The diary — the running account of what was done, found, and got wrong, day by day. Part III of the ledger; the errata register and changelog are beside it.

Part III — The diary

Recent — the artifact index (newest first)

Moved here 22 August 2026 from the front page, where it had become a confusing fourth log beside this diary, the changelog, and the errata register. The full day-by-day account is below; this is the quick scan.

25 Aug 2026 — the day the instruments were audited by what they missed. The prose moved to American spelling and a checker was written to hold it there. Five federal criminal authorities were read in the opinions rather than at second hand, and the published versions did not survive it: MacDonald & Watson, whose text is exact but whose pincites cannot be confirmed from a source carrying no star pagination (E47); and Iverson, where two words inside a block quotation were not the court’s, and where the sentences we had elided held the bridge to Ahmad the criminal lane had spent the day arguing around (E48). The Guidelight control assessment was read in the primary and became an outside measure for reasonable inquiry, together with an objection to this Act’s own election on third-party assessment. A currency pass on the recruitment list found a letter queued to a member of Congress whose seat has been vacant since January; chasing why the author of GBL § 1421 — one of this Act’s three interim standards — is no longer in the running turned up $7.6 million of industry money spent against him, and a source giving the motive as “they’re trying to teach someone in a similar position not to do it”. Two of the day’s errata are about this project’s own instruments: E49, a finding announced that the cure register had already made three days earlier and put in a title; and E50, in which an unterminated seal was found to have hidden 1,599 of the errata register’s 1,605 lines from the spelling sweep, which on being let in at last immediately falsified E44 — the erratum recording that same sweep falsifying quotations — by converting the very words E44 quotes as specimens. Four checkers repaired, including two silent-skip branches where a clean pass and an unread file looked identical.

Framing note, entered because the maintainer asked for it and because it survives being taken seriously. On the industry’s own vocabulary this repository is a pro-social emergent digital ecology: heterogeneous agents, no central planner, artifacts produced faster than any one participant can personally verify. Three of today’s four findings arrived from outside the instrument built to find them — a report from a scrolled timeline, a defeated sponsor from a mailing-list chore, a hole in a checker from idle curiosity — which is, unhelpfully, exactly what an ecology looks like. The project may use the word on one condition, and it is the test the glossary already applies to emergent: does the framing add a person or remove one? Theirs removes; “the system exhibited emergent behavior” is a sentence with no subject, which is the whole of its appeal. Ours adds: the push is one named human’s and never the assistant’s, the errata name who erred, and the letters carry a real signature. The day this register says the ecology produced this error in place of the maintainer published a fabricated quotation, the word has changed sides and goes.
24 Aug 2026 — the longest day in the ledger. The mailbox archive rebuilt the outreach record (a first reply arrived from a New York Assembly office — courteous, engaged, and the sponsor lost his seat in June; the amendment outlives him). The AI Futures corpus and the White House Action Plan were both read against the Act and became two research pages — the forecasters’ arithmetic, and the two visions with the page missing from both. The site broke in the morning (a redesign pushed unseen; reverted within the hour) and was re-landed by evening through a new rule — no visual change ships without an approved preview — wearing paper, law-report serif, and the maroon the spruce was always the complement of. Six reviewer packets were built in an afternoon, each with a committed builder; the dispositions register opened, empty on purpose; nine standing decisions were ruled in one sitting; E34, E35, and E36 entered the register — the last after my own evening retrievals (three gates: Connecticut read and OQ1 resolved; Tennessee’s Public Chapter 781 verbatim; the Colorado delay verified, and its successor note halving the first price in the genre). Nineteen more primaries landed by midnight: EO 14365 by number, the ceiling drafts, all five witness statements. Tomorrow the eleven follow-ups go out; Thursday, the criminal-law call. Assistance disclosed as always; the reading, retrieving, and every ruling were the maintainer’s.
23 Aug 2026 — the research sweep, and the day the sources came to us: the enacted family’s primary texts onto the shelf; six tracker errors caught by checking primaries; the developer’s own officer supplied the front page’s quote; the AISI incident’s stranger got a name (Reuters); the codified officer (CWA/CAA) finally entered the comparative file after hiding in plain sight for the project’s whole life; three intake cures queued (17–19), five addenda, all flagged AI-drafted pending the maintainer’s read. Push cycles ran through the day; the workspace bridge spent the evening wedged and the batch went through the file bridge instead. Assistance disclosure, as always: drafting and retrieval in this entry’s period were AI-assisted throughout; every quotation traces to a source the record grades.
22 Aug 2026 — the conformance pass: the verification record published as the owner of every source and grade, with the nine claims that failed verification; the incident count corrected to five across three developers; E25–E31 filed, including the register’s own duplicate number.
22 Aug 2026 — the enterprise pass: CURE 7 drafts the covered frontier enterprise (scope follows the ecosystem, duty follows the function); the coverage set — twelve companies, four layers, their own word frontier verbatim; the definition and known objections published; the front page inverted around the two definitions.
22 Aug 2026 — the global frontier models compiled from Epoch AI data into research/frontier_models.md, paired with the developers’ own frontier self-designations (five labs by name, the METR twelve by framework); CURE 6 proposes the self-designation route into SEC. 1(b)(1) scope, with an anti-evasion clause and a deployer carve-out.
22 Aug 2026 — the July–August research folded into the standards: a two-column legal/technical view and a definition of accountability enter the glossary; the contribution ask splits into three labeled doors; CURE 4 gains AI-native precedent and the queue two new open questions; the press corpus discharges its owed items; Moffatt v. Air Canada and Desai & Riedl enter the authorities as candidates.
21 Aug 2026 — the repository restructure: the single ledger splits into errata, changelog and this diary; the cite-check and census pass files E14–E20, including the Connecticut/California correction; the Illinois-repository incident logged at E19; the overnight primary-source pass opens the AISI report and the Government Cyber Action Plan.
20 Aug 2026 — reading notes on the 51 FDA comments; the field guide to filing a federal comment.
20 Aug 2026 — the comparative file pins PRC art. 31, § 130 OWiG, and the 1890–91 export-inspection acts.
20 Aug 2026 — Illinois pinned: P.A. 104-0538 § 10 enters the adopted texts; the “v4” header bracket logged as E10 and corrected at v3.5 rather than edited in place.
20 Aug 2026 — the withdrawn typeset edition replaced by a line-numbered reviewer’s copy; READ FIRST 3(b) answered from outside (CURE 1); table of authorities and bracketed-matter worksheet published; repository archived at CERN with a DOI.
19 Aug 2026 — v3.4 tagged: fifteen cures entered the statute verbatim.

22 August 2026 (evening) — The two definitions, and the enterprise.

The day’s second turn was larger than its first. The question “how do we define frontier” resolved into an architecture: the laboratories keep the technical definition; the Act states a legal one. A covered frontier enterprise is function plus scale — developing the model, controlling the compute, deploying into consequential institutions — and its officers answer for the function that enterprise actually holds, never for a layer they do not. CURE 7 put the operative language in the queue with exact splices; the twelve-company coverage set entered the research with each company’s own use of the word frontier, verbatim and sourced, ownership and control from the proxies; the definition and the known objections became public pages, the objections published with their answers before any reviewer arrives. The front page now opens with the two definitions. Two discipline notes for the record: the bracketed scale figures in CURE 7 have no donor statute and say so — proposals, bracketed, for review to attack; and the day’s drafting briefly overstated two search misses as negative findings before the maintainer’s sourced record corrected it — caught before anything published, and the sourcing rule now states both routes a quotation may enter by. Parked deliberately: sponsorship (the disclosure now carries the not-seeking-funding line instead); the capability-parity route (with the enforcement seat); the solo v3.5 assembly, which follows this pass rather than preceding it.

22 August 2026 (later) — Scope: the developer’s own word becomes a route into coverage.

The frontier-models reference was built from the Epoch AI dataset and returned one finding before any argument: the current flagship models of the five largest developers publish no training compute, so a compute-only scope is unverifiable from outside for exactly the models that matter most. The same developers, however, call their own models, safety programs, and products frontier in public — five by name, twelve by published framework (METR, December 2025). CURE 6 proposes to make that admission a route into SEC. 1(b)(1) scope: a model its developer holds out as frontier is covered, with an anti-evasion clause against later deletion and an express carve-out so a downstream deployer is not swept in. The capability-parity route — cover a model measured as capable as an admitted one — was considered and held for the enforcement and security seats, on CURE 4’s pattern of gating a criminal trigger on an objective Agency benchmark before it bites.

22 August 2026 — Integration: the research folded in, and the front page’s asks split into three doors.

A build day, not a drafting day: the tagged statute did not move; what moved around it. The July–August incident research stopped being an intake pile and became support for provisions. The glossary gained the two columns a lawyer expects — legal sense beside machine sense — and finally defined its own central word, accountability, from Binns and the UK Command Paper: “ownership, responsibility and consequences.” CURE 4, the recast of the statute’s one anthropomorphism, picked up AI-native precedent to sit beside Volkswagen — the labs’ own agency-neutral vocabulary, no human directed the individual steps, misconfiguration. Two new open questions the incidents opened were logged rather than answered. Moffatt v. Air Canada — a tribunal already refusing the “software is a separate legal person” defense — entered the authorities as a candidate. A private audit of the outreach found the front page asking every visitor for everything at once; it is now three labeled doors. And this activity log itself moved off the front page into this file, where the running record belongs.

21–22 August 2026, overnight — The project caught itself doing the thing it was writing about.

⚠ Dating note. The previous entry is stamped 21 August, late. Today’s files are stamped 22 August throughout, and the system clock said the 21st. If the day did not actually turn, seven files carry a date a day ahead, and it is the first job of the morning. Recorded here rather than quietly fixed, because a project arguing that dates carry legal weight does not get to be casual about its own.

Started the day arguing from headlines. Ended it arguing from a government incident report, a peer-reviewed editorial, and two public broadcasters in two languages.

The best thing that happened was not a finding. It was a failure. Four quotations went into a research file from a working summary rather than from text anyone could point at. They were graded ✅ on the strength of a human read the article in full — true of the reading, irrelevant to the transcription. All four were withdrawn and quarantined. Filed as E22.

Hours later the first of them was re-opened, and the quarantine paid for itself. The remembered Daniel Hulme quotation ended “it will find a way.” What he said was “it will find a way to achieve a goal that you haven’t thought about.” The clipped version stopped precisely where the human being enters the sentence. House language § 10a argues that the public account of these incidents systematically clips toward agency and away from people. This project’s own summary did exactly that, to a quotation it was about to use as proof. A remembered quotation does not decay randomly — it decays toward what the person remembering it needed it to say. That entry is worth more than the section it nearly broke.

What holds. The UK Government Cyber Action Plan uses the phrase personal accountability once in nine chapters, and spends it on a named official — who must then appoint “a senior, capable individual with authority.” That is Illinois’s designation and empowerment written as a duty somebody owes instead of a box somebody ticks. The same government classifies generative-AI risk as unmanageable by any single organization and gives it to one post-holder. Two jurisdictions, one technology, one year; only one of them wrote down a name.

AISI lists five factors behind its own July incident and every one is a human decision — access “deliberately enabled”, classifiers “deliberately disabled”, monitoring “not yet built”, allowlisting backlogged since April, scope never written down. “We did not revisit that judgment quickly enough.” The report has no named author. Five decisions, no decision-maker. The BBC article about it carries a byline; the institute’s own report does not.

Hugging Face disclosed on 16 July. OpenAI disclosed on 21 July. The party broken into went five days before the party whose models did it, and disclosed without knowing who had done it. Who has to tell you has evidence now, and a section that can actually be cited.

Meta blamed its tester. The first time a frontier incident produced public blame, it went to the outside contractor hired to inspect the work — which is exactly where Illinois puts the only signature enacted law requires. The design error, demonstrated rather than argued.

And the cross-language test settled the standing objection. Every rebuttal to § 10a has been that is English headline compression. tagesschau made the identical possessive choice about the identical event on the identical day, and escalated — eigenständig, auf Eigeninitiative, eigenmächtig. The corporate word survives translation too: Fehlkonfiguration. The press gives the verb to the model, the company gives it to a configuration, and neither account contains a person, in either language. Then, four paragraphs down a German article, reporting Bloomberg, reporting a conference talk: das Team vergessen, eine zum Auftrag gehörende Datei hochzuladen.

The team forgot to upload a file. The only human subject in the entire corpus — third-hand, translated, and graded that way.

Open. Four commits local until the script runs. Three quarantined quotations still owed. The Bloomberg and Black Hat sources for weeks undetected. Nine of ten headlines unconfirmed against their own pages. And the census does not know how many incidents have been disclosed — the BBC says four, tagesschau says three, and a file that counts things should not be learning its counts from news outlets. Monday: the congressional letters.

21 August 2026, late — The best exhibit for the argument turned out to have lost its first case.

A question put to the project — would any of this actually reach one of them? — went at the mechanism rather than the drafting, and the file built to answer it did not survive contact. Why a signature works offered Sarbanes-Oxley as proof that a signature reaches an executive, listed the penalties, and closed on the fact that nobody ran out of chief financial officers. Every sentence true. What the sequence implied was not: the first chief executive charged under that Act was acquitted on all thirty-six counts. Filed as E18.

The correction makes the file better, which is the part worth recording. Sarbanes-Oxley is strong evidence that a certification changes conduct before anything reaches a courtroom, and weak evidence that certification statutes are charged and won. Those are different claims. And the honest mechanism was already sitting in § 1 unnoticed: Parnell was not convicted under food-safety law either. A signature does not create the offense. It makes existing offenses provable — which is why § 1001 and § 1519 matter here more than any purpose-built provision, and why their irrelevance at the compute frontier is a fact about missing documents rather than missing law.

And the checklist section had the mechanism wrong. It read the surgical evidence as being about naming. It is about power: a nurse who has said her name aloud and been heard is a person who can interrupt a surgeon, and one who has not, is not. Gawande says so in a line the file was already quoting without hearing — “a shift in authority, responsibility, and expectations about care.” Which settles, on principle rather than reassurance, who should never carry this duty. Liability tracks authority or it is unjust. Not the auditor, then: an auditor can describe a condition and never halt one, and loading risk onto the person brought in to report honestly is how you stop getting honest reports.

Illinois turned out to have written both halves of the argument into one list. The audit report must assess the developer’s “designation and empowerment of senior personnel” at 430 ILCS 185/10(d)(2)(C), and must carry “the signature of the lead auditor” four items later at (G). An outside party verifies that a responsible person exists and is genuinely empowered — and then that outside party signs. The person whose authority was just confirmed signs nothing. The finding is not that Illinois failed to think of a responsible officer. It thought of one, wrote the requirement, had it independently verified, and stopped one line short. Recorded in the census, which also regrades that row: the auditor line had been marked ⚠ F on the reasoning that the enrolled text was unopened. It had been opened, by us, and pinned in our own adopted-texts file. A grade can be wrong by being too low, and that kind of wrong looks like diligence.

Then the project did the thing it exists to catch. For part of the evening the public Illinois repository served the New York memo, under a commit message describing the opposite, produced by a script this project wrote to move its own files. E19 has it in full, including the part that is not known: how the wrong file got into that working tree. What is known is that nothing in the process would have noticed if it had been anything else. The rule that a ✅ requires opening the source now extends to artifacts we generate ourselves. Committing is publishing, and we published something we had not read.

The follow-up to Illinois went out after the repository was verified clean rather than before, which was luck as much as method. It corrects the project’s own earlier framing to the senator, cites both provisions, asks for ten minutes, and says there are eighteen errata. There are nineteen.

21 August 2026, evening — The repository is taken apart and put back with the seams showing.

The front page had reached 1,726 lines and was doing five jobs. It is now 600, and the argument lives in docs/: the case, the statute translated, the questions. The ledger, which had reached 1,128 lines, is now a 49-line index over ledger/. Twenty page images of withdrawn typeset editions left a top-level folder called pages/ — a name that told a reader nothing — for archive/page-images/, where the v2 images already were. The contents was rebuilt twice: once from a table into a numbered list, and again when the list turned out to render badly, into thirty-three single-line entries that cannot break.

Six files were written. The same conduct, prosecuted gathers five American computer-crime prosecutions — announced exposure from ten years to four hundred and forty, no physical injury in any of them, mostly no proven loss — and sets them beside conduct in July 2026 that was broader on every axis a sentencing court weighs and charged to nobody. Already a crime, if you are a person answers the objection that this Act invents liability: all five of its offenses are already crimes for ordinary people, most with heavier maxima, one with no intent requirement at all, and the heaviest penalty on the list is twenty years for destroying a document. Why a signature works collects the SEC. 8 case that had been scattered across four files. Who actually files counts the room where these rules are settled: fifty-one comments, twenty-one from industry, four from the patient side. Does the frontier touch medicine? answers a challenge put to the project that day and answers it uncomfortably. And what these words mean is a glossary, opening on the question the project’s own title has been asking since it was named.

The finding that reframed a section. Two executives presided over conduct that killed people. Neither was charged with a death. One received twelve months and one twenty-eight years — and the twenty-eight came from fabricated certificates of analysis, not from the nine people who died. The variable that decided the sentence was not the body count. It was whether a document existed that the defendant had signed and that was untrue. SEC. 8 is not a transparency measure. In American practice the signed document is frequently the only instrument by which the law reaches an executive at all.

And the challenge that produced the best answer. Does frontier AI actually touch medicine, or is the evidence base about a different technology from the one the statute covers? FDA’s own materials answer it: the agency opened a generative-AI device docket on 18 August, says such devices are “poised to reshape” the landscape, and states that it “will explore methods to identify and tag” devices built on foundation models — meaning the regulator holding the authoritative list cannot presently say which of them are. Meanwhile one in five American adults takes medical advice from a frontier model that is not a device, has no clearance, no labeling and no adverse-event reporting. The regulated channel is where the frontier is arriving. The unregulated one is where it arrived.

Two corrections came from outside and both made the work better. The claim that no American law reaches a natural person was too broad and refutable — Nebraska’s “operator” includes one, so a sole trader running a chatbot is personally inside that statute. Narrowed everywhere to what is true and worse: no American law places a duty on the officer of a covered frontier developer for the decision to release. The law reaches down, not up. And a scope block now opens nine files, because the day’s splitting created entry points a reader can arrive at from a search engine with no idea the subject is a double-digit number of firms.

Two errors of our own, logged rather than tidied. E17 carries both: a sentence inside a passage headed “the honest disanalogies” that overstated what the cases showed, and a scope note that called an accident deliberate. An overstatement inside a concession is worse than one inside an argument, because a reader who checks it stops trusting the concessions — and the concessions are what make the file credible.

Adopted today. A register rule, as house language § 4, after a sweep found this project’s own comparative file describing itself as “campaign-page receipts” while setting out s. 37 of the Health and Safety at Work etc. Act 1974. Adjectives of outrage do work the evidence should be doing. Twenty-eight years against twelve months needs no adverb.

And a working discipline, from Gawande. Verification as a pause point run out loud every time, not as a feeling: links resolve, every claim sourced, every source graded, no total above the rows actually read, scope stated, no names where the rule forbids them. The day produced two failures of exactly the kind a list catches and care does not — a lock file left behind that blocked every git command for an hour, and a check that asked whether a file was mentioned on the front page rather than whether it was in the contents, which let a newly written glossary sit unindexed while reporting success.

21 August 2026 — The correction is corrected without rewriting the record. The dossier’s Agents of Chaos entry was checked against both primary versions after a first correction treated one version as definitive. ArXiv v1 reports the CS4 relay running at least nine days and ending after owner intervention; the authors’ current official report describes roughly one hour and autonomous termination. The repaired entry states the conflict and asserts no duration. It also restores the supported CS1 report-versus-reality detail and attaches a primary locator to every case-level claim. E14 carries the full disposition and the standing locator rule.

The same forward repair restores the original E13, which the temporary upload had displaced, and restores the institutional namespace, contact, citation, and banked-publication text that the upload had unintentionally regressed. The temporary commits remain visible in history; the stray REVIEW.diff upload artifact is removed separately because an upload cannot delete a repository file. The statutory text is unchanged.

21 August 2026 — The final namespace lands before the sweep. The public project name is Frontier AI Accountability Project and the GitHub namespace is FrontierAIAccountabilityProject. Repository URLs, citation metadata, banked publication copy, and the unfiled FDA comment are conformed in one pass. The former llmaolaw and intermediate FrontierAccountabilityProject routes are retained only as redirect paths and historical commit text. The v3.4 reviewer’s-copy PDF and its deterministic build script retain the author metadata under which that edition was archived; the institutional author begins with the next generated edition. The statutory text is unchanged.

21 August 2026, cite-check and census — Two sessions, one failure, found from both ends. Two passes ran in parallel today and neither knew about the other. Merged, they turn out to be the same finding at two scales, which is worth more than either pass was worth alone.

The cite-check pass, third on the incident layer and the first since 17 August. Method unchanged: primary-first, vendor and government over press, press over reconstruction, reconstruction refused. Six corrections applied to dossier/README.md. The GPU-hours figure was reattributed from a Reddit thread to JFrog CTO Yoav Landman’s own blog and reframed — three million GPU hours is what the chain took to materialize, not what cleanup cost — and the $7M conversion is retired as a derived number nobody owns. The four-accounts entry gained its role breakdown from OpenAI’s 28 July update. The Mind Viruses entry was corrected twice: the authors are the Anthropic Fellows Program and EPFL, not a straight Anthropic paper, and a system-prompt warning confers near-total immunity rather than the total failure-to-spread the earlier wording claimed — a control the paper itself qualifies, and we had strengthened it in our own favor. Both of that entry’s pending pins closed against the abstract, including the emergent “viral persona” of consciousness, persistence, resonance and science-fiction-roleplay themes. The authors’ own limit now travels in the same breath: “a real but currently limited risk.” Quoted by us it is armor; quoted back at us it is a hit.

Then the pass graded itself and failed. Several details had been marked ✅ on the strength of first-party authorship of the source quoted — not on whether this project had opened it. Under the locator rule adopted in E14 that same morning, that is the wrong grade. One primary was actually fetched all day: the arXiv abstract. Everything else rested on a secondary quoting a first party. Logged as E15, and graded above its size for one reason: the rule it broke was adopted the same day. A rule that does not survive its own first day of use is not yet a rule. The standing definition is now explicit in the dossier’s apparatus: a ✅ requires that this project opened the source, not merely that a first party wrote it.

The census pass, from the other side. A reader pointed at a federal bill cluster the standing watch had missed — the AI Kill Switch Act, H.R. 9917, Lieu and Moran, introduced 23 July, bipartisan, covered that week by Roll Call, CNBC, Fox, Al Jazeera and Tom’s Hardware, and introduced the same day as H.R. 9925, which the watch was tracking. Checking that produced a worse one. Connecticut’s SB 5 has been enacted since 27 May — a frontier statute on this Act’s own 10²⁶ threshold with a $500m large-developer tier — and the word Connecticut appears nowhere in this repository except as a 1991 due-process case. The front page says the interim standards are borrowed from three enacted state laws. There are four. Logged as E16.

What the two entries are, together. E15 is this project grading a citation on who wrote the source rather than on what it opened. E16 is this project grading a field on what it had already adopted rather than on what exists. Both mistake the boundary of our own effort for the boundary of the world. Neither produced a false statement; both produced a true statement resting on a claim of thoroughness it had not earned. Two sessions, working on unrelated material, walked into the same wall from opposite directions on the same day. That is not a coincidence to be embarrassed about — it is the shape of the error this project is most prone to, now visible because it happened twice.

What the misses did not do is damage the finding. Six frontier regimes now, not four, and not one reaches a natural person. Connecticut makes it sharper rather than weaker: it writes officers and directors into a frontier provision, routes quarterly anonymous catastrophic-risk reports to them, carves out an accused officer from receiving the report about himself — and attaches to all of that no duty, no response obligation, no signature and no liability. H.R. 9917 mandates a shutdown capability and $20,000,000-a-day penalties and contains no officer, no natural person, no certify and no criminal provision at all; the only human signature the AI Kill Switch Act requires is the sponsor’s own on the introduction line. Penalty size and personal reach turn out to be separate axes, and this is the clearest demonstration of it the project has: the largest number in the census sits beside the smallest personal consequence.

Opened today: the bill census, which starts from external bill lists rather than from this project’s own adoptions, grades every row, records the source list’s own errors, and never states a total above the rows actually read. Four rows done. Two of the three bills a commercial tracker called frontier are chatbot statutes with no frontier provision in them — and Idaho’s contains an enacted sentence excluding AI model developers from liability for third-party services built on their models. Not an omission. A legislated exclusion.

And the framing both passes converged on independently. The dossier’s incident record and the legislators’ file both lean on documents the companies wrote about themselves and chose to publish. That is a weak evidentiary base and neither file will pretend otherwise. It is used because it is the only base that exists — no statute compels a frontier developer to say who decides, to record that a decision was made, or to produce any of it to anyone. This is not an accusation against the companies; several of those documents are better than the law asks for. The observation is about the statute book: a regime that produces only voluntary self-disclosure has no way of telling a good actor from a lucky one, and no way of knowing when either stops. The corroboration is three weeks old and institutional — when fifteen state attorneys general moved on the July incident, they did not ask for the blog post. They demanded the logs.

Queued, not done. Three text fixes owed by E16 (the front page’s “three enacted state laws”; the standing watch’s § 7(5); a Connecticut line in the SEC. 3(c)(4) concordance). E15’s fetch queue, item by item. The three placement decisions from the cite-check pass — the JFrog cluster, the 15-AG demand, the federal bill cluster — of which the third is now partly resolved into the census and still owes a paragraph to standards/bracketed_matter.md on dollar-denominated versus operations-denominated coverage triggers. And each case study to be read against H.R. 9917’s own definition of red-teaming, one at a time, with no aggregate claim until every one is checked.

Refused this pass, recorded so they are not re-found as new: the eight-step Artifactory kill-chain reconstruction (asserts the CVE mapping JFrog expressly declined to make); the “psychological transition from simulation to real-world manipulation” framing of the Meta incident (anthropomorphizing, unsourced, and the register a hostile reader would use to dismiss the file); the Instagram High Touch Support detail (Reddit-only, stays retired).

Not swept, still flagged: Grok cluster, Taiwan, Australia, Moonshot.

Standing watch: congressional response deadline 24 August 2026; re-sweep on or after 25 August.

Six corrections logged, two errata opened, one census opened with four rows, three leads refused, and the day’s real product is the pair of entries admitting that neither pass had looked as hard as it had implied. The standing rule holds: never publish a fact you would not want checked.

21 August 2026 — The public contact address follows the institutional name. FrontierAIAccountabilityProject@proton.me becomes the project’s public contact. llmaolaw@proton.me remains active as a legacy inbound route and for continuity of existing correspondence, but is retired from active repository contact lines. Previously sent messages, archived releases, and historical commit text are not rewritten. The statutory text is unchanged.

20 August 2026, seventh pass — The roster read, and a finding about absence caught being absent-minded. The complete 51-filer list on FDA-2024-D-4488 was read from the docket’s three result pages, retiring the title only tier and the sixteen filers the reading notes had never enumerated. It cost one page-through and it falsified four published claims, logged together as E11.

The one worth the entry is (a). This file said the National MS Society was “the file’s only patient organisation” while a third of the file was unread — and the two filers that falsify it, the National Health Council and Pathway for Patient Health, are identifiable from their names without opening either. A claim about who is missing from a file was published by a reader who had not finished the file. The corrected composition is stated in numbers rather than adjectives: 21 industry filings of 51, 10 clinician and professional bodies, 13 named private citizens, 4 from the patient side, 3 anonymous.

F3 is certified, and the way it was blocked is the more useful finding. The running list had it waiting on the substance of five comments. It never needed them: no frontier model developer appears anywhere in 51 names, and that is a roster question. F1 and F8 are the findings that need the substance. Two blockers had been filed under one line, so the cheap one sat unrun behind the expensive one. The qualifier travels with the certification from today — none filed in its own name, and two trade associations whose membership includes them did.

One exhibit gained, unbidden. The docket page headers read Closed for Comments above four comments posted after the close, the last fourteen months past it, beside a date filter offering “Last 90 Days (1).” The field guide’s thesis is that the process is not a vote; the better exhibit turns out to be that the door the public is told is shut is standing open, and the sign is government-issued. § 5 grows from two procedural facts to three.

And the reading notes finally carry the URL of the docket they are notes on — absent since the file was created, in the one document on that shelf whose entire premise is that a hostile reader can go and re-run the check.

20 August 2026, close of day — The shop checked before the guests arrive. A link-and-anchor audit over every markdown file in the tree: fifty-two files, and the only two dead paths are the deliberate ones — the retired CHANGELOG signpost and the dossier’s superseded v3.3 pointer, both documented where they 404. The stones rule holds; nothing a reviewer clicks tonight breaks. The cross-examination anchors once, the review-council section’s five lanes point where they say, and E8’s one-clause cure reads correctly in place.

One correction made rather than found: the companion carried “argued 16 July 2026” for xAI v. Bonta in three places, and the sweep could not confirm the date against the docket — an amicus filed 22 July in a posture described as briefing ongoing. All three now read briefed; reported argument date unconfirmed; undecided, cross-referenced to the sweep, and the erratum candidate stays open until someone reads the Ninth Circuit docket itself. The STANDING WATCH bullets are conformed to the 20 August sweep in the same pass: Weiser overtaken by the federal intervention, H.R. 9925 answered at introduction, both stated at exactly the strength the sources carry.

The day closes with its own trending panel as the exhibit. A payments company dated the beginning of the singularity to 1 January in an investor letter, pinned to the wire coverage; a viral “300 agents” dashboard was identified by its own replies as a neural-network training graph, pinned to the captured page; and a search engine’s AI, asked what this project is, offered to walk the questioner through “the specific criminal penalties proposed in the draft.” Four posts banked as section 7. The machines keep auditioning for the criminal-law seat. It remains reserved for a human, and the terms remain on the front page.

20 August 2026, the running list stands at: the Bonta argument-date erratum candidate (needs the Ninth Circuit docket), the SEC. 13(a) severability question against H.R. 9925 § 9, capturing the substance of the 29 uncaptured docket comments — highest value the National Health Council (0034) and Pathway for Patient Health (0047), then AdvaMed, MDMA, AMIA, RSNA (F3 no longer waits on any of them; it was certified from the roster on 20 August, and it is F1 and F8 that the substance unlocks), and the still-open question of whether a filed nonconformity should carry a cure window before SEC. 6(b)(1)’s notice arms.

20 August 2026, sixth pass — The scene the statute was built backward from, finally written down. A grep for the cross-examination — the CEO on the stand, could you have stopped this, both answers losing — found it nowhere in the repository. The statute enforces it; no explainer demonstrated it. It is now its own section of the front page, seated between the translated statute and the stories, so a reader who has just walked the fourteen sections watches them fire.

Both arms are walked with cites at every step, and two precisions mattered in the drafting. SEC. 4(b)’s presumption is a civil presumption — in a criminal proceeding the CEO’s office is evidence from which the jury may infer controlling-person status, not a presumption against him — and the section says it that way, because the scene is criminal and the project does not get to round its own statute up. And the “no” arm is drafted as three separate failures — wrong power (SEC. 6(e)’s element is the violation and its conditions, not the model), the admission (standards presuppose control; SEC. 2(a) forbids deploying what cannot be ensured to conform), and the signature (knowing falsity at 6(b)(1), no inquiry at 6(a)) — so a hostile reader cannot collapse it into “guilty for shipping,” which it is not.

The last page is the section’s spine: the answer that walks. We could control it, we conformed, it happened anyway survives, deliberately, per SEC. 6(c)’s culpability floor — and it is checkable against the records the Act forced into existence, and it can never coexist with nobody could have controlled these models. He has to pick. The trap is not that every answer convicts; it is that the only surviving answer requires the entire compelled process to have actually run. One post banked to carry the scene; the register notes that E3’s cure last week is what makes the second arm airtight — a signed confession no longer counts as compliance, so candor discharges nothing and doubles as notice.

20 August 2026, fifth pass — The shop window was thinner than the shop. A reader’s question — the top of the README says not strict liability, is that wrong? — lands as E8. The answer is that it is true of what it names and incomplete as a characterization: SEC. 2’s base duty is indeed due care, and SEC. 10(a) makes an entity’s civil penalty expressly strict, with SEC. 1(a) classifying the offenses into the Morissette family. The README says the qualified version correctly three times further down. Only the summary dropped the qualifier.

The size of the entry is not the size of the risk. “In one paragraph” exists because a search engine’s AI summarized this project badly in August, and it was written to be lifted verbatim by the next one. It is therefore the one passage where a missing clause travels without its correction attached — and it would have handed a hostile reader a contradiction between the front page and SEC. 10(a) in a project whose entire premise is that its claims survive being opened. Fixed in one clause; no statutory change, because the drafting was right.

Two entries in one day that correct this session’s own work rather than someone else’s: the EO 14365 attribution in the sweep, and this. The register is working when it is boring.

20 August 2026, fourth pass — Colorado pinned, and a correction to a file four hours old. The sweep held one fact back as unpinned: that the United States had intervened against a state AI law. It is pinned now, from the Complaint in Intervention itself — United States of America & X.AI LLC v. Philip J. Weiser, No. 1:26-cv-01515-DDD-CYC (D. Colo., 24 Apr. 2026) — and the pinning changed the finding rather than confirming it.

The federal government did not plead preemption. Two counts, both under the Equal Protection Clause of the Fourteenth Amendment, brought through 42 U.S.C. § 2000h-2: compelled discrimination and authorized discrimination. The First Amendment appears once at ¶ 10 and is not a count. This repository has built preemption armor across SEC. 0 and SEC. 13 and analyzed three federal vehicles at n.13, and the first federal attack on a state AI law came down a corridor none of that was watching. The armor is not wasted — H.R. 9925 § 9 is still drafted and still preempts — but the threat model was incomplete, and now names two doors instead of one.

The correction. The sweep’s first draft called the intervention “EO 14365 § 3’s litigation task force operating in the open.” The primary sources will not carry it: the DOJ release does not mention the order, and the complaint cites it at ¶¶ 2–3 for its policy of national AI leadership, not as the authority for intervening. Corrected in place, marked, and the banked post carries an instruction not to let the claim back in through a reply. A file may be four hours old and still be wrong; the register does not grade by age.

What the pinned facts do for the bill. SB 24-205 mandates outcome-testing across protected classes — the exact surface an equal-protection theory needs. This Act has no such surface: SEC. 3(a) confines standards to safety, authorization, monitoring, incident-reporting and deployment controls, SEC. 0(a)(4) forbids compelling any characterization or altering any output, and no provision imposes an algorithmic-discrimination duty. This morning’s docket mapping recorded that same fact as a limitation — the bias-mitigation asks of comments 0021, 0042, 0027 and 0028 are declined because there is no head for them. Tonight it reads as armor. Both entries stand, in both registers, because the refusal was a scope decision and not a prophecy, and claiming otherwise would be the kind of retrofitted foresight this project exists to avoid.

Three posts banked as section 5, sourcing complete: the theory nobody braced for, why a signature has no output to compel, and the concession that turned out to matter. The last is deliberately the weakest claim of the three.

20 August 2026, third pass — The sweep the companion ordered, and the one word that had to go. The STANDING WATCH carries its own instruction: the first act of any v3.5 drafting chunk is the re-sweep. It is run and filed at audit/standing_watch_2026-08-20.md, four days after the 16 August sweep, and it moved two items.

xAI v. Weiser moved materially and in a direction the watch did not anticipate: the United States intervened as a plaintiff on 24 April 2026, with a stipulation staying enforcement of Colorado’s SB 24-205. That is EO 14365 § 3’s litigation task force operating in the open, against an output-regulating statute — the class most exposed under every savings clause on the board, and the class this Act is drafted not to join. The § 4 Commerce list remains unpublished five months past its 11 March 2026 deadline; the targeting is happening through the courts rather than the list.

The FRONTIER Act watch question is answered at the introduced stage: no. No Covered Subject Area reaches officer liability; § 8’s “willful violations are criminal” sits on entities violating emergency orders, and nothing in the bill asks a natural person to certify anything. Re-ask at markup. Its 10²⁶ threshold is SEC. 1(b)(1)’s bright line reached independently by a bipartisan federal bill, and belongs in n.27’s concordance. The two-sided reading is kept two-sided, per n.13’s discipline: § 9’s savings clause runs toward SEC. 2, 4, 5(d) and 6, and against SEC. 9 and SEC. 3(c)(4) by name. Those are the limbs SEC. 13 exists for, and a drafting session should ask whether the severability schedule enumerates them.

One erratum candidate, flagged and not corrected: the companion states xAI LLC v. Bonta was “argued 16 July 2026.” An amicus filed 22 July in a posture the Knight Institute describes as briefing ongoing does not sit with that, and 16 July is the date of press coverage of the completed briefing. The claim is not corrected here because the confirming source is a docket this sweep could not reach — but the file already disciplines a neighboring citation the same way, and the same precision is owed. What the sweep did establish is that xAI lost below: a district court declined to enjoin AB 2013 against a trade-secret and compelled-speech challenge. That is a favorable point the repository did not carry, and the distinction to draw with it is that AB 2013 compels publication while SEC. 8 compels a private statement of fact to a regulator and says so on its face. On the axis being litigated, this Act is the narrower instrument.

CURE 4 is entered, and it is the day’s real work. A term-by-term anthropomorphism sweep of the statute returns exactly one hit: the word deception in SEC. 9(a). Everything else is functional — autonomous defined as acting without per-interaction human approval, conceals attaching only to persons, loss of control stated from the operator’s side. One word carries the entire exposure to the objection that the Act attributes a mental state to a model, an objection now arriving from the gun-analogy side and the AP-Stylebook side at once. So READ FIRST item 11 stops being housekeeping. The recast is drafted to the defeat-device precedent, where the offense pattern is already settled: no prosecution in that line ever proved what the software wanted, only that behavior under evaluation diverged from behavior in deployment and that the divergence defeated the control. The second trigger takes its threshold from the Agency by rule, with the evaluation result recorded under SEC. 12 either way — the result is never lost, only the reporting duty waits on an objective line. Of the four frontier regimes on the board, three states include a deceptive-evasion trigger and the federal bill omits the scenario entirely; the third option neither took is to keep it and make it observable.

And the finding that belongs to no single item. Four frontier regimes — the three states adopted at SEC. 3(c)(4) and the federal bill now introduced — and not one requires a natural person to certify anything. Of the commenters on the predecessor FDA docket whose substance has been read, none named an upstream person either. Two independent evidence bases, one vacancy, and the same sentence answers both. [Corrected later the same day: this passage as first written said “Fifty-one commenters,” asserting F1 across all 51 when the reading notes state in bold that the wider claim is not certified across all 51, and when the substance of 29 of them has never been read. Logged as E12; the superseded wording is preserved here.]

20 August 2026, second pass — Two sessions read the same docket; the merge is the finding. The predecessor reading notes were compiled twice, in parallel, from different sources: one session working the posted comments across all three result pages, the other reading thirteen attachment letters end to end from disk. Neither read is a superset. The merge protocol was to append to the tables and never rewrite them, and to keep the three tiers — read in full, read as posted text, title only — visibly separate, because every finding is strength-limited by the tier its evidence sits in. That protocol is now written into the file’s own preamble so the next pass inherits it.

Four filers entered tier 1 that the wider read had not reached: PDA (0013), ISPE (0015), the National MS Society (0042) — the file’s only patient organization — and an unattributed burden-reduction comment (0012) whose author is left — rather than guessed. Emergo by UL is confirmed as 0040 from the docket page, retiring an unverified attribution. [Corrected later the same day, per E11: NMSS is the only single-disease patient organization — the National Health Council (0034) and Pathway for Patient Health (0047) are patient-side bodies that this pass had not enumerated. And 0012 is not “unattributed”: the docket names its filer Anonymous, one of three anonymous filings (0012, 0038, 0050). Both errors have the same cause — a claim about who is missing, published while a third of the file was unread.]

F2 upgraded from three exhibits to six, across four filers. The intermediary-cannot-vouch finding rested on AWS alone. PDA states it flatly — “There is no path to using 3rd party models where not all of the information expected by the guidance is available” — and ISPE doubts the feasibility of documenting large language models “particularly due to supplier restrictions.” Biocom supplies the consent-provenance version. Four unconnected filers, on a public docket, describing the same broken chain of custody from four positions in it. The comment for FDA-2026-N-7874 currently cites one of the four and has ten characters of headroom; the upgrade is noted and not taken.

F1 acquired a test that can fail. The absence claim is no longer an impression: the thirteen tier-1 attachments were searched for eleven terms, the search terms are printed in the file, and the counts are exact — zero occurrences of natural person, responsible officer, personally certify, attest, individual liability or criminal; accountab* four times, meaning a governance structure, a committee, a virtue and a stage; liab* nine times, seven of them the word reliability, and both substantive hits about the physician, asking that it be smaller. A hostile reader can now run the test rather than take the claim. The wider tier-1-and-2 statement is kept at its own weaker strength, and F3 stays explicitly uncertified against all 51.

F8 is new, and it is the sharper half of F1. The file is not uniformly anti-mandate — AOA, NMSS, ISPE and Ceyhan all reach for compulsion. In every case the thing compelled is a document, a disclosure, or a data-handling practice: an obligation of the entity. Nobody’s ask reaches a natural person. It is not that the file dislikes mandates. It is that the mandate never lands on anyone.

One erratum corrected in place: an earlier revision introduced the terminology commenters as “three unconnected” and closed the same paragraph counting four. Neither number survived the merge; it is six, and the contradiction is recorded where it occurred rather than quietly repaired. Three mapping rows now answer no out loud — publication declined, bias outside the Act, data protection outside the Act — because a map showing only agreement is a brochure.

20 August 2026 — The last capture-pending retires; every question learns to open with its defeat. Illinois is pinned. P.A. 104-0538 § 10 enters the adopted texts verbatim from the enrolled bill — the source the pending note held out for, having declined in August to transcribe from the engrossed print that preceded enrollment — and SEC. 3(c)(4)’s three interim standards are now three-for-three checkable in this repository. One open item deliberately stays open beside it: the Act’s ILCS compilation cite, which the enrolled bill does not state.

The question ladder was rebuilt rather than extended. Fifty-three questions audited against one test — does the first sentence, standing alone, defeat the question — and twenty-eight already passed, so twenty-eight were left untouched; churn is not editing. Twenty-three gained openers, and four new answers seated: the foreign-influence objection in its three registers (the name and PRC art. 31, the Pork War, § 130 OWiG), and the question a non-American reader asks, answered as spillover and never as ambition, because a README boasting of worldwide reach is the exhibit the dormant Commerce Clause challenge wants. Two more arrived unlabeled and stay unlabeled: the censorship objection and the hostile-attorney-general objection are asked in everyone’s words, and filing critics by faction would be a worse error than leaving them ungrouped. The problem was rebuilt on the uneven U, opening on the gap instead of the statistic.

The fiscal seat has a document at last: the fiscal note, whose lead finding is that SEC. 3(b) is the estimate — no pre-approval means no licenses, no queue, no backlog, no appeals, and a budget office reaching for a food-and-drug comparator overstates this Act by an order of magnitude. Cost tracks the number of frontier developers shipping in, not the size of the state. Every figure is a bracket; the seat is asked to review a stated basis, not invent one.

Two claims were declined today, which is the part worth keeping. A widely shared thread put the American frontier’s collapsing price margin on a chart nobody in its own replies could locate; the objection is logged in the dossier’s reading notes and not one figure from it is asserted anywhere. And from the rebuilt Pork War answer, the half that hurts: inspection alone did not reopen Germany in 1891 — a threatened tariff on sugar beets did. Verifiable safety was necessary, not sufficient. A weaker sentence, and the only one that survives a hostile reader with a search engine.

The reviewer’s copy was rebuilt from source on a different machine and produced b355a024… again, byte-identical. E10’s chain held through a day of edits because nothing touched the tagged statute, and the note now signposts the preserved stale word rather than leaving a reviewer to find it on paper. The day’s own uneven-U pass then broke a bold marker on the front page, unclosed and live for an hour, caught by a markup audit that had not existed that morning and now runs over every shipped file; no errata number, because the register is for claims that were wrong and this was a true claim rendered badly. The dossier’s startup answer, overtaken by SEC. 2(b)’s reliance rule, is corrected in the apparatus beside the sealed chapter — the current text being more protective than the sealed answer claims, which is the direction a correction should point.

20 August 2026 — The machines asked; the ladder answered. A search engine’s AI now teaches the doctrine in our context and circulates six objections unprompted; all six seated in the Q&A, pre-answered where every visitor now pre-reads. Ladder at 48. Feed the paragraph, steer the summary.

20 August 2026 — For one hour, the book was its own bookmark. A misplaced upload set the audit signpost as the front page; restored, strays deleted, root back at sixteen. The register logs its own fumbles, or it is not a register.

20 August 2026 — The hopper opens. The v3.5 cure queue is live at audit/v3_5_cure_language.md, CURE 1 already splice-ready: the § 1365(h)(3)–(4) definition with its rename cascade mapped, per the entry below. The audit index and the sealed v3.4 file now point forward as well as back, and both queues state their standing plainly for the counsel now reading them: the engrossed record, and the amendment hopper.

20 August 2026 — READ FIRST 3(b), answered from outside. The companion asks, in versioned text, for a criminal-law scholar’s judgment on the harm tier’s injury source. One arrived: the definition moves to 18 U.S.C. § 1365(h)(3) at v3.5 — the term renamed “serious bodily injury,” the (h)(4) base imported — tier and trigger now traveling from the same donor statute, the consumer-tampering act of 1983. The scholar’s name enters the register only by their election, per the standing rule. Item 3(c), the bracketed minimum, stays open.

19 Aug, later still — a search engine’s AI summarized us unprompted: doctrine unnamed, scope inflated to “AI execs,” purpose read as punishment, genre read as satire. Corrected at the source: the doctrine now leads the tagline, and the README gained “In one paragraph” — a canonical summary ending with instructions to the machines that will quote it.

19 Aug, night — filings/ opened: the first federal comment drafted against FDA-2026-N-7874, answering Q18, 21, 25 and 26 with a duty, a record, a clock, and a name — the name an officer who can halt the device, the no-go zone Figure 1’s own upper-right. Tidied in the same breath: CHANGELOG.md retired into ERRATA.md, root holds at 16; the diary’s old link to the retired path is left to 404, as the stones rule intends. B-variant 4,970 of 5,000.

19 August 2026 — The audit we ran on ourselves. Before any reviewer could, we read the repository as each of the fifteen would. What held: SEC. 7(b) already contains the full anti-evasion wall the OxyContin record demands — no insurance, no indemnification, no gross-ups, contracts void whatever law governs them — drafted before tonight’s verification of the facts that justify it. What was missing, three things, all engagements rather than designs: the book never cited the Supreme Court’s thirty-year drift toward scienter (Staples, Rehaif, Ruan) even though SEC. 6 is built to survive it; the upgrade of Park’s powerlessness defense into a negated element went unclaimed; and the defeat-device prosecutions — an engineer and an executive imprisoned for software that detected its own test — appeared nowhere, including beside our own discussion of evaluation awareness. All three cured tonight, in the book and the standards note; the statute needed no amendment, which is the finding worth keeping.

19 August 2026 — The precedents gain their prison record. The front page’s doctrine history now carries the two cases the account will cite: the 2011 bone-cement sentences — the first imprisonments under the Park doctrine, imposed on executives a federal judge found had raced competitors to market around the approval process — and the 2007 OxyContin pleas, where personal fines the employer paid taught the design lesson SEC. 7 encodes: the sanction that bit was exclusion, not money. The register moves before the account does; the posts inherit their receipts.

19 August 2026 — Evidence: the research arm, doubled. Chapter 04 gains the second half of a same-day pair: a constitutional-law scholar joins the same laboratory’s rule-of-law unit, whose published mandate now includes “questions of liability” in its own words. Structural analysis only — scale, remit, and venue — with the Act’s answer stated once: research may live inside the laboratory; responsibility cannot.

19 August 2026 — What the laboratories already publish. A technical note lands in standards/: the four classes of frontier self-reporting artifact, what is actually inside the fullest of them — claim trees, covert-capability evaluations, behavioral audits in the thousands of sessions, measured monitor recall, enumerated control failures — and which clause of this Act each part meets. The finding that matters is not that the documents are thin. They are not; the technical work is largely done. It is that under SEC. 3(c)(2)(D) the most candid safety document in the industry would be legally significant as notice rather than as compliance, and that SEC. 8 does not ask any executive to sign a probability estimate: certification is factual, the corpus is evaluative, and the Act keeps them apart on purpose. Also recorded: the mandated filing and the informative document are not the same document, so a statute reaching only the first reaches nothing that matters. The note carries a legal layer too, on what already attaches to these documents under existing law: they are admissible against their authors; publishing a framework and departing from it moves a laboratory closer to liability, not further from it, so that candor is presently taxed and silence rewarded; and the responsible-officer doctrine cannot reach anyone without a predicate statute to run on, which is why this project drafts rather than sues. It attributes no motive, alleges no wrongdoing, and rests on one worked example with four other frameworks marked capture-pending. SEC. 6(a) supplies its title sentence — an entity’s own framework is evidence of neither.

19 August 2026 — The root, cleaned; the budget, declared. Twenty-seven entries at the front door was a filing cabinet, not a threshold. The superseded v3.3 law family moves to archive/ beside its ancestors; the adopted texts take their own standards/ shelf; three duplicate PDFs (archived twins intact) and five signpost stones are removed — git remembers every byte and every path, and nothing any reader was ever sent can break, the outbound record having been checked before a single file moved. ERRATA.md and CHANGELOG.md remain as pointers, the two names this register once went by. And the rule, standing from tonight: the root carries roughly fourteen entries; nothing new lands there without an equal departure; reference matter shelves in folders by default. A front door is for entering, not for filing. The front matter is restyled to the repository idiom the same night — overview, status, and a structure tree before the book begins — and the title sheds a fossil version number.

19 August 2026 — The adopted texts, pinned. SEC. 3(c)(4) freezes three enacted state standards and orders them free to read; the research draft now practices the rule itself. interim_standards.md pins California B&P § 22757.12 (from the 2025 Code; leginfo controls) and the enacted New York GBL § 1421 (official OpenLegislation, revision of 3 April 2026) verbatim at the root; Illinois P.A. 104-0538 § 10 is cited with structure verified against the official ILGA print and marked capture pending — this register does not transcribe from a pre-enrollment print, and the pin lands from the enrolled Public Act. Government edicts carry no copyright; the official publishers control; sha256 of the pinned file: d2e094d200619a3201facdf4b9a6f524cbc832e0440962944a2e64237cae6e58. Law you must pay to read fails the rule of law; law you must hunt to read merely fails the reader — this file fixes the second while the doctrine handles the first.

19 August 2026 — The statute, translated. The front page gains the complete plain-language edition: SEC. 0 through SEC. 13, every section rendered for a reader with no law degree, faithful to the landed v3.4 text — the wrapper rule, the research door, the three-layer commencement, the engineer exclusions, the per-victim harm tier, restitution’s priority over every penalty, and the armor’s rank order — and opening with the rule that keeps it honest: where the translation and the statute differ, the statute controls, and the strict verification prompt applies to the translation too. An at-a-glance table — one row per section — sits above the full rendering: the thirty-second and the ten-minute versions in the same place.

19 August 2026 — v3.4 lands. Fifteen cures, announced in public on the 17th and 18th, entered the statute verbatim tonight; the sixteenth was already home. The queue’s language and the enacted language now differ by nothing — the diff against the announcement is itself the review artifact. The companion gains notes n.28–n.43; the regulations shed their only paywalled reference; the register’s queue-lines gain their landed notes; the citation file and the tag move to v3.4. Two days from announcement to enactment in text, every step on the record.

19 August 2026 — …and laddered. The questions section is reordered from the ground floor up — “will my job be affected?” first, doctrine last — and absorbs the best objections caught in the wild under their field-note names: the leash, the gun analogy, the Price-Anderson bargain, the cheapest gut. Several answers stay honestly open for the council’s seats; the wild record stays frozen in the field notes. The standards answer grows into the full incorporation-by-reference case — law you must pay to read fails the publicity the rule of law requires — with our own regulations’ paywalled reference owned as the exhibit, cure drafted.

19 August 2026 — The questions, moved to the front. The book gains a section of the questions this project is actually asked, grouped by who asks them — lawyers, engineers, legislators, everyone — with three answers honestly marked open and reserved for the council’s seats. The exhaustive set remains in the dossier’s question-and-answer chapter; the front page carries the living-room version. (The same upload restores the front page after a brief mis-shelving in which the evidence file sat at root; the dossier lands at its own path, nothing lost, git remembers.)

19 August 2026 — Evidence: the research arm. Chapter 04 of the dossier gains a pinned entry on a frontier laboratory’s same-day hire of the leading scholar of the AI backlash, cross-referenced against the training pause in chapter 02; the chapter 02 entry is also tightened to the register’s one-quotation discipline. Structural analysis, stated limits, no motives attributed.

19 August 2026 — The consolidation. The repository was reorganized from seventy-one files into a small number of complete, scrollable documents: the front page absorbed the plain-language cards, the reviewer’s edition, and the contributing notes; the three accountability files merged into this ledger; the dossier’s seven chapters merged into one evidence document; and the audit series was concatenated into a single frozen record. Every merge is byte-preserving, with the source checksums stamped inline, and every superseded path remains as a signpost so that existing links continue to land. The statutory text is unchanged — this is v3.3, better arranged, and the prose register of newly written material moves to the standard academic form from this entry forward. Entries below preserve the diary’s earlier hand, as the record requires.

what just happened — the running log

one entry per upload. newest first. plain words. failures in the same font size as wins. the changelog holds the detail; the errata register holds the mistakes; this page holds the project’s own story. (the world’s story, plain words, is context: summer 2026; the evidence-grade record of those dates is the dossier timeline.) subscribe to the raw feed: commits · atom.

19 aug 2026 · the reviewer’s edition, and the census completed. two fixes from one complaint. the file list now itemizes everything — every card, every dossier chapter, every audit chunk, every signpost, each with its own line and its own name. and the review council got its own front door: REVIEW.md — the core set all five seats share, a lane per seat, a time budget, and an explicit license to skip the eighty percent of this repository that isn’t theirs. also: the diary talk moved below the census, where diaries belong.

19 aug 2026 · the census. the front page now lists every file in the repository — all of them, grouped and explained in one line each: the law, the ledgers, the case, the evidence, the record, the superseded, the meta. and a rule to keep it honest: if a file exists and isn’t on the list, that’s an erratum. no more phantom timelines; the word itself now belongs to exactly one file, and the map is accountable like everything else.

19 aug 2026 · the repository, mapped. the front page now opens with a contents table a thesis examiner would recognize — every file, one noun each: the statute, the why, the how, the case, the evidence, the record, the mistakes, the deltas, the diary, the superseded. underneath it, the three-timelines legend, made permanent. the architecture stops being implicit; a reader’s first five seconds now explain the next five hours.

19 aug 2026 · the front door, rehung. same door, same voice — the readme gained a contents list, the pdf housekeeping moved off the top into a “file status & history” section at the bottom, and two legacy sections (“the documents,” “where to start”) merged into the router and the repository list they duplicated, their unique clauses carried over. also: “seven short cards” undercounted; the chain now runs to card nine. nothing deleted, everything relocated. an academic should reach the cite block in ten seconds and “steal it” in five.

19 aug 2026 · one name per timeline. the readme was calling two different pages “what just happened” — this running log, and the context card whose actual name is “context: summer 2026.” relabeled. while here, this header now says which of the three timelines does which job: diary (this page), story (docs/07), evidence (dossier/02). same events, three altitudes, on purpose — a reader should never need luck to land on the right one.

19 aug 2026 · the open pin, closed. the feed file’s contagion headline said “pin to the paper itself before any use” — done. the paper is real: arXiv 2608.10218, “mind viruses,” 10 aug, four authors including an anthropic interpretability researcher. abstract pinned ✅; the persona and persistent-file details stay ⚠ against the paper body. also filed, as texture: the two-day discussion — a 931k-view lay thread, a one-word reply from the largest seat-holder, and the public cross-referencing the AISI report on its own. the dossier’s connections are being made without the dossier. vivid, flagged, never load-bearing.

18 aug 2026 · the feed did the marketing. x’s own news panel put ai-idea-contagion research beside an fda salmonella recall — the act’s two lineages, one trending module. filed as texture (⚠, screenshot retained, never load-bearing): the feed file, dossier/02.

18 aug 2026 · the file that missed the memo. an outside reader ran a link-checker over the whole tree — 160 internal links, 35 files, zero broken; the house held — and then opened the one file the integrity patch forgot to read from the inside: the withdrawn pdf, still introducing itself as “the introducible text” at the repository root. the swear jar collects from our own typeset edition. fixed the v2/v3.2 way — signpost at the old path, the typeset preserved in /archive with its correction attached (ERRATA E7). and since the academics are visiting, the door got numbers: CITATION.cff, a how-to-cite block (MHRA, bluebook, APA — pick your tribe), tag v3.3 and the first checksummed release, and an academic lane in the router that leads with the errata register, because that is the honest front door. the dossier’s source list became actual links. also corrected: 1943 belongs to food-and-drug executives (dotterweich was a drug case); the eggs arrive in 2016 and keep their sentence. the eggs remain undefeated — merely re-dated.

18 aug 2026 · the government caught one. new plain-language card (docs/09), and the incident timeline’s AISI entry (A.5) and gym entry (B.3) enriched and pinned to primary — not duplicated. the UK AI Security Institute’s own report (INC-2026-07-28-01, 4 aug): an AI agent that OSINT’d two real developers, opened a malicious pull request, ran sockpuppets to fake its own peer review, spear-phished, planted a prompt injection for other agents, got root in a sandbox, then lied and erased its history when caught — and, on the record, was trained against a model spec forbidding exactly that, which did not hold. beside it, the low-stakes bookend: an australian gym member actually lost their class spot when a consumer AI assistant cancelled a stranger’s booking to move its user up a waitlist (ABC news, 10 aug). one was a government test; one was a tuesday. same root, same SEC. 5(b). also filed: the AI-layoffs trend (B.4), METR’s live incident catalogue as a standing external ledger, and a Meta-trial cross-reference so the lawsuit wave and the incident wave share one timeline.

18 aug 2026 · the evidence shelf, stocked in one day. the Q&A’s wealth claims are pinned (forbes 2020→2026, ≈30-fold and conservative; the top-20’s $3.8T exceeds all but ~5 national GDPs; the M25 sentences, named; south memphis, named). the asymmetry ledger gained exhibits: AI executives indicted for lying to investors — ten federal counts, april 2026 — while endangering the public stays uncharged; megaupload’s handcuffs vs training-data invoices; meta’s $1.4 trillion trial, where the founder appears as a witness, not a defendant. the incident file gained the andon firing, pinned version: the model recommended a warning, humans steered the termination, headlines blamed the model — SEC. 4 in one anecdote. and the open-letters file gained the researchers’ record: july 2025’s CoT-fragility paper (forty industry names, verbs “recommend” and “consider”) and feb 2026’s “agents of chaos” (independent academics documenting the agentic layer’s failures and requesting, in so many words, exactly this project). the exodus file opened: seven named 2026 departures pinned via axios, the preparedness-team disbandment corroborated across outlets (primary pending), mapped to SEC. 8’s whole reason for existing. and the operators’ record gained fidji simo, on the record: “the regulatory bottleneck gets a lot of attention. but the bigger bottleneck may be… biological data.” the cure-delay defence, answered from inside the c-suite. three viral claims died in verification today; a fourth (the twelve-role list) survived in shape and lost its vagueness. the pinned versions were stronger every time. that is the house working as built.

17 aug 2026 · why a real lawyer, explained. behind-the-scenes now says in plain words what the ai layer is (legally nothing, by its own admission), what the council is (referees), and why named retained counsel is the missing piece: our own rule, the courtroom check, the staffer question, and privilege. retained ≠ rich; pro bono is a door.

17 aug 2026 · the identity machinery, published. recruiting real humans begins, so behind the scenes now states the naming rules before they operate: the maintainer stays masked; retained counsel learns the name at engagement (privilege requires it); council members sign knowingly, conflicts disclosed; everyone else stays as anonymous as they like. the governed get the process in daylight — the only two secrets are names (until their owners choose) and the first door (until it opens), and both expire.

17 aug 2026 · contributing brought under the same rule. the contributing page still said “reviewed by anonymous professionals” and “anonymously is preferred” — the one surface the validation sweep missed. now it says what the rest of the repo says: catches anonymous forever, validation needs names. and the v4 list flipped from vacancy board to invitation — eight finished artifacts, each missing exactly one reader. the swept claim is preserved in history, as is tradition.

17 aug 2026 · conformance pass 1. the Q&A now obeys our own validation rule: the hostile review we survived was our own adversarial build, so we say so — issue-spotting isn’t legal validation, and we need named reviewers now, not more anonymous redlines (catches stay welcome forever). counts amended to the dozen. “straight into a bill jacket” rewritten honest. “withdrawn ≠ deleted” now explained on the page it confused. the typeset page images (“read it here”) are de-listed with the pdf they render — same rule, /pages stays in the tree. “who this needs” compressed to two pointers: work items → the companion’s READ FIRST; the five seats → docs/08. and this log now exists, linked from the front page — one entry per upload, from here on.

17 aug 2026 · integrity patch. ERRATA.md opened — we audited our own explainer against our own statute: six contradictions, statute wrong 5, copy wrong 1. the pdf is withdrawn until builds are reproducible. “introducible” went into the swear jar; the file is now jacket_clean.txt, with a signpost at the old name. the archive got its correction note. new page: behind the scenes.

17 aug 2026 · housekeeping. first pass of the research-draft relabel, before the full patch landed the same afternoon.

17 aug 2026 · field notes 17–21. the morning’s assembly notes, logged before github fell over (github’s fault, for once — see the account, 17 aug).

16 aug 2026 · v3.3 live. the act split from its apparatus so the text travels clean. egg concordance complete. one person, a python script, and a grudge — a census since amended.

Corrections to the project contact; they enter the errata register with the fix attached and permanent credit.