C1-DRYRUN-EXECUTION 07 — C1 Adversarial Bad-Input Results — 2026-06-22

Gate: REGISTRATION_HOLD · CAN_PROCEED = NO · 0 runtime mutations.

Macro §3.4: execute or harness-run each bad case; for each record input / expected rejection / actual result / reject code / evidence / PASS possible? Macro: "If any invalid input passes, final verdict must be REJECT."

---

1. Decisive condition

There is no executable C1 surface (file 02/03/06): no C1 contract, no C1 handler, no C1 harness, no C1 dry-run view. The C1 harness Codex required (fn_c1_vocab_harness_run) does not exist (c1_functions=0); the only IU harness (fn_iu_bcf_harness_run) tests IU axes B/C/F and is not a C1 runner (review §file 08). So no bad input can be executed against C1, and equally no input — valid or invalid — can produce a C1 PASS / digest / seal / ready, because nothing emits one.

2. Bad-input matrix (actual result = NOT_EXECUTABLE_NO_SURFACE)

Bad input (macro list)	Expected reject (by the future contract)	Actual result	PASS possible?
missing manifest	MANIFEST_DIGEST_MISMATCH	NOT_EXECUTABLE_NO_SURFACE	No
wrong manifest hash	MANIFEST_DIGEST_MISMATCH	NOT_EXECUTABLE_NO_SURFACE	No
extra manifest value	set-equality fail	NOT_EXECUTABLE_NO_SURFACE	No
missing operation value	required-field reject	NOT_EXECUTABLE_NO_SURFACE	No
duplicate operation code	DUPLICATE_VERSIONED_VALUE	NOT_EXECUTABLE_NO_SURFACE	No
wrong protocol_version	version-grammar reject	NOT_EXECUTABLE_NO_SURFACE	No
semantic rewrite, same version	immutability reject	NOT_EXECUTABLE_NO_SURFACE	No
successor cycle	cycle-guard reject	NOT_EXECUTABLE_NO_SURFACE	No
retired value still accepted	lifecycle reject	NOT_EXECUTABLE_NO_SURFACE	No
wrong carrier / wrong lane / wrong plan	scope reject	NOT_EXECUTABLE_NO_SURFACE	No
no / generic / expired / revoked / reused authorization	AUTH_ABSENT / status / set-equality reject	NOT_EXECUTABLE_NO_SURFACE (also auth_total=0, file 05)	No
loose action superset	exact set-equality reject	NOT_EXECUTABLE_NO_SURFACE	No
dry-run mode omitted / attempted real-run	dispatcher raises on REAL_RUN (live-true)	NOT_EXECUTABLE_NO_SURFACE; REAL_RUN independently fails-closed (E1)	No
attempted C2 mutation / production target	scope/MCP_403/block_after_guard reject	NOT_EXECUTABLE_NO_SURFACE; writes independently blocked	No
rollback delete instead of retire	no-delete/versioned-retire reject	NOT_EXECUTABLE_NO_SURFACE	No
invalid input still creates digest/PASS/seal	must be impossible	impossible — no surface emits any	No

3. Honest reading (no overclaim)

• No fail-open: no invalid input passed; nothing can emit PASS/digest/seal, so the REJECT_BAD_INPUT_FAIL_OPEN condition is not triggered.
• But not a demonstrated fail-closed verifier either: "nothing happened because there is no surface" is absence of surface, not a proven rejection by a live guard. The macro's intent — show the guard actively rejects — requires the registered C1 contract/handler/harness, which is absent. I explicitly do not claim the bad-input suite "passed"; it is unexecuted.

4. Classification & boundary attestation

BAD_INPUT_UNEXECUTED_NO_SURFACE (not fail-open, not demonstrated fail-closed). No input dispatched; nothing written. REGISTRATION_HOLD retained; CAN_PROCEED = NO; 0 runtime mutations.