Residual Surfaces in Retail CBDC Incidents and the Verification–Residual Partition: A Coding Study with Contrast to an Explicit Residual-Trust Settlement Design

This paper applies a pre-specified coding protocol that partitions operational harm into a verification surface (Lv:failure of stated, checkable properties) and a residual surface (Lr: issuer/operator actions outside those properties) todocumented retail central bank digital currency (CBDC) episodes. In the coded sample, publicly evidenced harm isresidual-dominated (liveness, certificate/operations failure, pilot exit, issuer policy privilege). Currency-unit estimatesof rho-hat = Lr/(Lv+Lr) are often undefined because losses are unreported; the scientific claim is therefore taxonomicand directional, not a calibrated global mean of residual trust. The same partition contrasts CBDCarchitectures—which maximise issuer residual power by design—with a zero-knowledge settlement design class thatmaximises the verification surface (conservation, client-held spend authority) and names residual operator power(ordering, availability, visibility). Open artefacts for the latter are linked for illustration only; no productionperformance or audit claim is made. Keywords: residual trust; residual surface; CBDC; operational resilience; zero-knowledge settlement; verification surface.JEL: E42, E58, G28, D82, L14. Working paper; not peer-reviewed. Incident coding is single-coder pending dual review. Metrics are definitional templates. CBDC loss magnitudes in currency units are mostly unreported.