Registry errata

What we got wrong, and cannot unwrite.

Every anchor in this registry is immutable. That is not an inconvenience we work around — it is the whole property that makes an anchor worth anything. If we could quietly rewrite a record after the fact, no record here would mean anything, and neither would any of the proofs built on it.

So when we get something wrong, the record stands as issued and the correction is published here: named, dated, and anchored in the same registry it corrects.

This page is empty of good news by design. An errata page with nothing on it usually means nobody is looking.

How to read an erratum. The fingerprints themselves are never wrong — a hash commits to the document that produced it, and that property survives any labelling mistake. What can be wrong is the human-readable label we attached, or the claim we made about what a record was. Those are what get corrected here.

Erratum 001 — six determinations published without their synthetic marker

ERRATUM 001 · ISSUED 2026-09-05 · CONCERNS 6 ANCHORS OF 28

What is wrong

Six anchors carry the label LMN determination without the (synthetic pilot) marker that the eight anchors issued later the same evening carry. All six are synthetic pilot cases. No real patient, no protected health information, no real clinical determination was involved in any of them.

4c374b3c985fa0ef2450128ec46d174ecb3279e93bd301649cad224953f66f10 anchored 2026-09-04 19:00:19Z · verify → 658e6ffb8a5f3f13bad35425463d2297ee695b0e019ae7fc8b73e4139ea824fd anchored 2026-09-04 19:01:26Z · verify → ea73e91fc44c539179e505800f155a61c3cf06660eb6e93a6e2ca0e246fe5ecc anchored 2026-09-04 19:01:26Z · verify → 849e1f0115424ee36d1d94d1cd39d465984a8e1ad7c31f2d0f27e4cd79444e17 anchored 2026-09-04 19:01:28Z · verify → f4a18bb05cde75b0931162e3e96e3c0bbf68655210d34fe94914a066236d4d68 anchored 2026-09-04 19:01:28Z · verify → f7927dbc04abe28dab70583f378242103b1dea50884cfdd8e728e194fe2d3e2b anchored 2026-09-04 19:01:29Z · verify →

Root cause

The anchoring code chose the label by testing the case text for the string [SYNTHETIC: present, it appended the marker; absent, it wrote a bare LMN determination. The marker is written by the intake wizard into the case's medical_justification field, but the label test read content and document_text instead — different fields. Synthetic cases whose document text did not happen to repeat the marker were published with a label indistinguishable from a real patient determination.

The default was backwards. It treated “real” as the fallback in a system that, having no executed Business Associate Agreement, can only produce synthetic cases in the first place.

What did not happen

Fix

The label is now unconditional. Until a Business Associate Agreement is executed and go-live is approved, every determination the system issues is labelled (synthetic pilot) regardless of case text — because every determination it can issue is in fact synthetic. Marking one as real is now a deliberate configuration change made alongside the BAA, not an inference from prose in a field. It fails closed, the same way the specialty gate does.

Canonical text

The full erratum, as issued:

SHA-256 3ed97903b47a7689399633bc3cfc87e277b9eed6184db2fadab82e2198977fee
erratum-001.txt · recompute it yourself: shasum -a 256 erratum-001.txt

Verify this erratum Check the whole registry

What an errata page is for

A registry that publishes only its successes is a marketing asset, not a record. The test of one is what it does on the day it is wrong. This page is that test, and it stays here permanently — entries are added, never removed.

If you find something in this registry you believe is mislabelled or misrepresented, the fingerprints are public and the verification recipe is published; you do not need our cooperation to check, and you do not need our permission to say so.