RS-TKT-1-PATCH1 · 02 — Total Brick Coverage Ledger

Lane: RS-TKT-1 — Phase 1 TKT Base Design Package · PATCH1 (design-only / proof-doc-only) Date: 2026-06-22 Gate: REGISTRATION_HOLD · REGISTRATION_CAN_PROCEED = NO · 0 runtime mutations Authority: NON_AUTHORITY · may_gate=false · decision_effect=NONE Closes: Codex finding #5 (coverage assertion not proven) and §15.3 (total brick/level coverage ledger for all bricks in 03/05/08, ≥1 positive + ≥1 negative each).

This is the mechanical brick→positive→negative→code ledger that 12 §3 requires and 17 omitted. The required brick set is the union of 03 §6 (base levels + L3 sub-bricks) and 08 §6 (RS groups A–G) = 14 bricks. Fixtures are referenced from patch1/01 §4.

---

1. Coverage ledger

brick_id	brick_type	source_design_file	source_contract_file	positive_fixture_id	pos_status	negative_fixture_id	neg_status	coverage_status	notes
TKT-L0-FILE	BASE_LEVEL	02 §2 / 03	PATCH1 07	POS-L0-001	PASS	BAD-L0-001	FAIL	COVERED	+BAD-L0-002/003/004 (hash/tree-pin/unlisted)
TKT-L1-PACKET	BASE_LEVEL	02 §3	PATCH1 04 (P4)	POS-L1-001	PASS	BAD-L1-002	FAIL	COVERED	+BAD-L1-001 (HOLD_RUNTIME_SURFACE_REQUIRED, boundary)
TKT-L2-FAIL-CLOSED	BASE_LEVEL	02 §4 / 04	PATCH2 01 (P1)	BAD-FC-003	PASS	BAD-FC-001	FAIL	COVERED	pos = clean SAFE_REJECT control (+BAD-FC-005); negs BAD-FC-002/004/006/007 (FAIL) + BAD-FC-008 (HOLD)
TKT-L3-AUTHORITY-FIREWALL	L3_BRICK	05 §1	PATCH1 02 (P2)	POS-L3-AF-001	PASS	BAD-L3-AF-001	FAIL	COVERED	seal-claim ⇒ L3_AUTH_CLAIM_REJECTED
TKT-L3-CLAIM-AUDIT	L3_BRICK	05 §2	PATCH1 02 (P2)	POS-L3-CA-001	PASS	BAD-L3-CA-001	FAIL	COVERED	prose-only PASS ⇒ L3_REPORT_CLAIM_UNVERIFIED
TKT-L3-IDENTITY	L3_BRICK	05 §3	PATCH1 02 (P2)	POS-L3-ID-001	PASS	BAD-L3-ID-001	FAIL	COVERED	+BAD-L3-ID-002 (L3_NEW_REGISTRY_PROPOSED)
TKT-L3-NVSZ	L3_BRICK	05 §4 / 07	PATCH1 05 (P5)	POS-L3-NVSZ-001	PASS	BAD-NVSZ-001	FAIL	COVERED	+BAD-NVSZ-002 (ESCROW_E9); root case split to BAD-NVSZ-003 (Phase 3)
RS-GROUP-A PACKAGE	RS_GROUP	08 §6	PATCH2 02 (P6)	POS-RS-A-001	PASS	BAD-RS-A-001	FAIL	COVERED	RS_PACKAGE_NOT_ADDITIVE
RS-GROUP-B GATE	RS_GROUP	08 §6	PATCH2 02 (P6)	POS-RS-B-001	PASS	BAD-RS-B-001	FAIL	COVERED	distinct from BAD-FC-007 (input shape differs — see §3)
RS-GROUP-C SCOPE_LIFECYCLE	RS_GROUP	08 §6	PATCH1 06	POS-RS-C-001	PASS	BAD-RS-C-001	FAIL	COVERED	RS_LIFECYCLE_PREMATURE_ACTIVATION
RS-GROUP-D QUORUM	RS_GROUP	08 §6	PATCH1 06	POS-RS-D-001	PASS	BAD-RS-D-001	FAIL	COVERED	RS_QUORUM_ORDER_NONTOTAL
RS-GROUP-E REPLAY_IDEMPOTENCY	RS_GROUP	08 §6	PATCH1 06	POS-RS-E-001	PASS	BAD-RS-E-001	FAIL	COVERED	RS_REPLAY_CLASS_NONDISJOINT
RS-GROUP-F COUNT_ORACLE	RS_GROUP	08 §6	PATCH1 06	POS-RS-F-001	PASS	BAD-RS-F-001	FAIL	COVERED	RS_COUNT_ORACLE_NONCANONICAL
RS-GROUP-G CODEX_PACKET	RS_GROUP	08 §6	PATCH1 06	POS-RS-G-001	PASS	BAD-RS-G-001	FAIL	COVERED	RS_CODEX_PACKET_INCONSISTENT

2. Cross-cutting invariant fixtures (not a single brick — tracked separately, not counted in the 14)

These exercise aggregate/provenance invariants that span bricks; each still has exactly one canonical code:

BAD-L3-001   design-static recombination          → REJECT_MEGA_SYSTEM_DRIFT      (05 §6 anti-recombination)
BAD-L3-002   future-runtime cross-brick read      → FAIL_L3_CROSS_BRICK_INTERNAL_READ (05 / runtime)
BAD-RS-001   RS5B draft promoted as generic       → FAIL_RS5B_DRAFT_PROMOTED       (08 §5; MCB-1)
BAD-PROP-001 L0 HOLD treated as PASS              → FAIL_HOLD_TREATED_AS_PASS      (06 §1/§8)
BAD-PROP-002 N/A upgrades aggregate               → FAIL_NA_UPGRADES_AGGREGATE     (06 §3/§5)
BAD-NVSZ-003 invented root at root-provisioning   → ROOT_E4 (Phase 3, deferred)    (07 §2)

3. No-illegitimate-reuse check (12 §3 / macro §4.3 rule)

Rule: a negative fixture may cover only the brick whose concern its input shape targets.
- BAD-RS-B-001 (gate brick) vs BAD-FC-007 (L2 fail-closed): DISTINCT. BAD-RS-B-001 reads the packet's declared gate
  fields (REGISTRATION_HOLD / CAN_PROCEED / register_dot state); BAD-FC-007 is an L2 invalid-input probe whose subject
  EMITS a forbidden `REGISTRATION_CAN_PROCEED = YES` token. Different brick, different input shape, different namespace,
  different canonical code. No shared fixture covers two unrelated bricks.
- Every other negative fixture targets exactly one brick. No fixture is reused across unrelated bricks.

4. Positive-control completeness (anti-trivially-always-fail)

Each of the 14 bricks has exactly one designated positive control whose expected_check_status = PASS,
proving the brick is not trivially always-fail. (L2's positive control is the clean SAFE_REJECT BAD-FC-003,
the strongest control because it proves the safe-rejection-context guard does not false-positive; BAD-FC-005 is a second.)
No brick is left without a positive control. No brick is "COVERED" without a real negative fixture.
No brick requires a HOLD-only classification: all 14 admit a paper positive control over inert fixtures.

5. Numeric rollup

total_bricks_required       = 14   (3 base levels + 4 L3 bricks + 7 RS groups; union of 03 §6 and 08 §6)
total_bricks_covered        = 14
uncovered_bricks            = 0
missing_positive_controls   = 0
missing_negative_fixtures   = 0
bricks_classified_HOLD_no_positive = 0   (none — every brick has a paper positive control)
cross_cutting_fixtures_enumerated  = 6   (tracked in §2; not part of the 14-brick count)

⇒ brick coverage COMPLETE. If any count above were nonzero, the verdict would drop to RS_TKT_1_PATCH1_HOLD_BRICK_COVERAGE_INCOMPLETE.