Pre-launch FS hardening + WHITEOUT deletion (depth→1024, redirect/contentHash specs, per-name whiteout)

docs/DEPLOYMENT.md

@@ -16,6 +16,7 @@ This runbook produces a **mainnet-forward** Sepolia deployment: the Sepolia stru
   - **1 SystemAccount proxy** (Transparent, CREATE3-deterministic): the neutral system write-identity (ADR-0053). Has its own `ProxyAdmin`. Separate from the resolver proxies; its burn requires additional verification (see burn checklist).
 - **3 stateless views** (redeployable, in no UID): EFSRouter, EFSFileView, ListReader.
 - **9 EAS schemas** registered against the proxy addresses: ANCHOR, PROPERTY, DATA(empty), PIN, TAG, MIRROR, LIST, LIST_ENTRY, REDIRECT. (SORT_INFO + EFSSortOverlay are **deferred**, added later additively.)
+- **WHITEOUT — additive post-freeze (ADR-0055):** a **10th** schema + a **7th** resolver proxy (`WhiteoutResolver`, with its own `ProxyAdmin`) registered **additively** after the nine are live — NOT part of the original freeze set. Deployed via the additive path (`deploy-lib` `detectMissingResolvers`/`buildAdditivePlan`: deploys ONLY WhiteoutResolver + registers ONLY WHITEOUT, core untouched). When present, the deployed set is 7 resolver proxies + SystemAccount (**8** CREATE3 contracts / **8** ProxyAdmins) and 10 schemas; the burn ceremony covers WhiteoutResolver's ProxyAdmin (it is **not** `OwnableUpgradeable`, so no contract-owner renounce). Full sign-off row + burn coverage: `docs/SEPOLIA_FREEZE_TABLE.md` §WHITEOUT.
 
 ---
 
@@ -198,7 +199,7 @@ yarn deploy:efs-views --network localhost
 
 **Upgrading a resolver later (from the Safe):** in Safe{Wallet}, propose a tx to `ProxyAdmin.upgradeAndCall(proxy, newImpl, 0x)`; sign; execute. Or script it with `@safe-global/protocol-kit`.
 
-**Burn to immutable (pre-mainnet, after a ≥14-day soak):** the pre-burn checklist is in `docs/SEPOLIA_FREEZE_TABLE.md`; when satisfied, the Safe executes `ProxyAdmin.renounceOwnership()` per proxy — all **7** proxies (6 resolver proxies + SystemAccount proxy). **The contract-owner vs ProxyAdmin distinction (PR #24 50yr-review):** each proxied contract has two independent owners — its external ProxyAdmin (controls upgrades) and, where the logic is `Ownable`/`OwnableUpgradeable`, the contract's own owner (controls its setters). `ProxyAdmin.renounceOwnership()` does NOT zero the contract-owner; both must be renounced or the Safe retains live authority over a nominally "frozen" contract. So the burn also calls **`EFSIndexer.renounceOwnership()`** and **`MirrorResolver.renounceOwnership()`** — the two `OwnableUpgradeable` resolvers. This is load-bearing for EFSIndexer: its one-shot `setSortsAnchor(...)` is never set in this freeze (SORT_INFO deferred), so until the kernel owner is renounced a post-burn Safe could weld a permanent value into the immutable kernel. (EdgeResolver/ListResolver/ListEntryResolver/AliasResolver have no owner — config is `initialize()`-only — so they need no renounce.) For SystemAccount specifically: (1) call `SystemAccount.sealModules()` **before** burning, verify `SystemAccount.modulesSealed() == true` (permanently prevents any new system-writer module from being authorized post-burn — ADR-0053 "pre-burn only" membership); (2) burn its ProxyAdmin like the others; and (3) call `SystemAccount.renounceOwnership()` to zero its own `OwnableUpgradeable` owner. Post-burn verify `EFSIndexer.owner()==0`, `MirrorResolver.owner()==0`, `SystemAccount.owner()==0` (+ every ProxyAdmin), and that `setSortsAnchor`/`upgradeAndCall` now revert. Address + UID + data unchanged; logic frozen forever.
+**Burn to immutable (pre-mainnet, after a ≥14-day soak):** the pre-burn checklist is in `docs/SEPOLIA_FREEZE_TABLE.md`; when satisfied, the Safe executes `ProxyAdmin.renounceOwnership()` per proxy — all **7** proxies (6 resolver proxies + SystemAccount proxy), or **8** once the additive WhiteoutResolver (ADR-0055) is deployed (7 resolver proxies + SystemAccount). **The contract-owner vs ProxyAdmin distinction (PR #24 50yr-review):** each proxied contract has two independent owners — its external ProxyAdmin (controls upgrades) and, where the logic is `Ownable`/`OwnableUpgradeable`, the contract's own owner (controls its setters). `ProxyAdmin.renounceOwnership()` does NOT zero the contract-owner; both must be renounced or the Safe retains live authority over a nominally "frozen" contract. So the burn also calls **`EFSIndexer.renounceOwnership()`** and **`MirrorResolver.renounceOwnership()`** — the two `OwnableUpgradeable` resolvers. This is load-bearing for EFSIndexer: its one-shot `setSortsAnchor(...)` is never set in this freeze (SORT_INFO deferred), so until the kernel owner is renounced a post-burn Safe could weld a permanent value into the immutable kernel. (EdgeResolver/ListResolver/ListEntryResolver/AliasResolver/WhiteoutResolver have no owner — config is `initialize()`-only — so they need no renounce; the additive WhiteoutResolver needs only its ProxyAdmin renounced in the per-proxy step above.) For SystemAccount specifically: (1) call `SystemAccount.sealModules()` **before** burning, verify `SystemAccount.modulesSealed() == true` (permanently prevents any new system-writer module from being authorized post-burn — ADR-0053 "pre-burn only" membership); (2) burn its ProxyAdmin like the others; and (3) call `SystemAccount.renounceOwnership()` to zero its own `OwnableUpgradeable` owner. Post-burn verify `EFSIndexer.owner()==0`, `MirrorResolver.owner()==0`, `SystemAccount.owner()==0` (+ every ProxyAdmin), and that `setSortsAnchor`/`upgradeAndCall` now revert. Address + UID + data unchanged; logic frozen forever.
 
 ---