diff --git a/CITATIONS-UNRESOLVED.md b/CITATIONS-UNRESOLVED.md
new file mode 100644
index 0000000..8b548d8
--- /dev/null
+++ b/CITATIONS-UNRESOLVED.md
@@ -0,0 +1,13 @@
+# Citations in this repository that you cannot open
+
+Same rule as the other Aere repositories: a citation is a promise that a claim is
+checkable, and where the target is not published the claim is traceable but **not
+independently verifiable by you**. Nothing was deleted to produce this list.
+
+Unresolvable distinct paths in this repository: **1**.
+
+- `docs/PQC-WALLET-DESIGN.md`  cited in: sdk-js/README.md — the wallet design note
+  stays internal by an explicit security review (2026-08-27): alongside the design it
+  analyses concrete attack paths against key handling, and that class of content is
+  not published. The README's claim it supports (keys never leave the device
+  unencrypted) is checkable directly in `src/` (the signing and storage code).