What we got wrong

No rule permitted this and none required the second figure. The section was built the same day with a stated purpose recorded in its own source: that a reader told an agent is watched, without being told how much of it is watched, has been given a flattering half-truth. The renderer computed capability-class coverage and dropped the systems figure. Capability-class coverage reaches "n of n" as soon as one channel exists per declared class, however small a share of the agent's estate that class covers, so the figure that was published is the one that can never fall — and the figure that bounds what the Registry could have seen is the one that was withheld.

The coverage line now publishes both denominators: how many of the capability classes the agent declares are watched, and how many of the systems it is connected to are read. Where the first figure is complete and the second is not — precisely the case in which the first flatters — the record additionally states that every class being watched somewhere is not the same as every system being watched, and that the second figure is the one that bounds what the Registry could have seen.

No rule permitted this. Both events were recorded on 28 and 29 August 2026 under an earlier model in which a single column carried both what evidence concludes and how far it can be trusted. ADR-006 separated those into state and rung on 31 August, and Part C was published on 1 September with C1.3 (rungs are declared, observed, verified, inferred, unknown) and C1.7 (confidence may never exceed the trust domain of whoever produced the evidence) in force from publication. The two events were never revisited, and nothing in the system refused to publish them.

The Registry now refuses, at the database, to record an evidence event whose rung exceeds what its source can support: a collector inside the operator's trust domain is capped at "observed", an operator statement at "declared", and a value that is not a rung is rejected outright. The published record now carries the source of every event beside its rung, names the witness in plain words, states the highest rung that witness can support, and where the recorded rung exceeds it says so on the record itself. The two events are not edited. Evidence is append-only, and a registry that rewrites its own history to pass its own audit is worse than one that published a bad row and said so. The constraint that would reject them is deliberately left unvalidated against existing rows, so the table permanently and queryably states that it contains evidence which would not be accepted today.

No rule required this figure to be generated. G2.2 — published text asserting a fact about the record shall be generated, not typed — enters force on 12 September and was not yet binding. The number was carried by hand from a project document whose own table disagreed with it: that table has always recorded FM-10 as covered by Casualty Report No. 01.

The figure is now counted at request time from the register of published reports, against a definition stated in the code: a failure mode is covered when any published report carries it, primary or secondary. The number is now a consequence of a stated rule rather than a count somebody made, and it cannot go stale as reports are added.

No rule permitted this; it was a defect. The handler collapsed three distinct conditions into one answer — the registry reporting no such record, the registry being unreachable, and the registry returning an error — and served the first answer for all three.

The three conditions are now distinguished. A transient failure is retried once and then answered with 503 and a page stating that the registry could not be reached and that this is not a statement about the record. The 404 wording is reserved for the registry positively answering that no such record exists.

Rules F4.3 — demonstration entries are excluded from every published total. The rule was in force and the function implementing it, public_register().totals, computed the exclusion correctly throughout. The page did not consult it: it re-derived the edition line by summing every listed entry, and counted "fleets we do not control" as the listing count minus one, with no filter for demonstrations.

The edition line and the ownership statement are now read from a single source, public_register().totals, which honours F4.3. Where that source is unavailable the figures are omitted rather than recomputed, because a number the Registry cannot derive correctly is not published. A database trigger now refuses to list a demonstration fleet on the public register at all, and every demonstration entry carries a visible banner in addition to its DEM notation.

Rules G2.2 — published text asserting a fact is generated from the record, not written by hand. The line was written by hand into the page shell while the site genuinely was an undeployed prototype, and no mechanism existed that could notice when that stopped being true.

The claim has been deleted rather than updated. A corrected status line would rot in exactly the same way, on the same schedule, for the same reason. The footer now carries the Registry's name and nothing else, and any status or date placed there in future must be derived at request time from something that changes on its own.