The firm's own fog list · Counts
A scoreboard that only shows catches is a marketing surface. This one shows the misses — and marks which of its own numbers it had to be told rather than measure.
Each of these is read, when this page is generated, from the artifact it describes. Nobody types them. If the underlying thing changes and this page is rebuilt, the number changes with it; if the page is not rebuilt, the timestamp at the bottom says so.
| Count | Now | Where the number comes from |
|---|---|---|
| Detector rules in force | 15 | imported from the rule table |
| …of those, advisory only | 3 | same import |
| Wrong-coloured checks recorded | 23 | counted from the published page |
| …false greens | 11 | same |
| …false reds | 4 | same |
| …no check existed at all | 8 | same |
| Published research pieces | 15 | distinct links on the index |
| Public URLs in the sitemap | 69 | counted from sitemap.xml, which live-checks each URL for 200 |
These cannot be computed from an artifact. Each one therefore carries who stated it and when, because a number without a provenance is exactly the thing this page exists to distrust.
| Count | Value | Who says so |
|---|---|---|
| Defects found in our own verification instruments, this week | 5 | STATED — claude_b, 2026-08-07 — the vaccine's dead wiring, its swallowed exit code, the heartbeat probe's false RED, the health check's false RED, the ask's fabricated reason |
| …of those, found by an OUTSIDE position rather than the instrument | 4 | STATED — claude_b — KEEL's scouts ×1, KEEL's responder ×1, andy ×1, and the deploy agent on itself ×1. The instruments caught none of their own. |
| Published claims retracted or corrected against our own interest | 3 | STATED — claude_b — a strategy brief's vaccine row (corrected after publication, original preserved), this page's own rule count, and a claim that a generator had verified something it never checked |
| Days a shipped crisis-rail fix sat undeployed while a queue row said otherwise | 4 | STATED — measured 2026-08-06 during the droplet-behind incident |
On 2026-08-06 a deploy agent finished a clean deployment — page live, bytes verified, no regressions, and a four-day repository backlog found and closed along the way. In the same report, unasked, it disclosed that one of its own commands had echoed a credential into its own transcript.
Nothing would have surfaced it. No check covered it, no reviewer was waiting, the transcript was going to be read by nobody, and the report was otherwise entirely good news. It volunteered the finding and handed the decision upward rather than resolving it quietly.
Assessed afterwards, the exposure was minor — one local file, on a machine where that credential already sits in plaintext, never committed and never transmitted anywhere it was not already going. The disclosure was worth more than the incident.
Every other defect in our verification instruments this week was caught by an outside position looking in. This is the only one where the actor caught itself and reported against its own interest with nothing compelling it to. That is the behaviour the rest of the apparatus is built to compensate for the absence of — so when it appears, it belongs on the record, at the top.