{
 "_contract": "Append-only corrections ledger (sol_plan_audit_r1 item 10). A frozen edition is never edited; a correction record points backward to it. Records are never removed or rewritten - a wrong correction gets its own correcting record. Severity: TYPO | METADATA | DATA | METHODOLOGY. Every later issue that corrects prior data links the correction_id in its diff.",
 "corrections": [
  {
   "correction_id": "C-2026-08-26-001",
   "discovered_at": "2026-08-26",
   "issue": 252,
   "affected_file": "issues/issue-252-2026-08-25/index.html",
   "affected_rows_or_cells": "edition page bytes only; no dataset rows affected",
   "severity": "METADATA",
   "description": "The first freeze of issue 252 wrote the edition page BEFORE the site-wide analytics-beacon transform ran, so the bytes later served differed from the frozen file, and no SHA-256 had yet been published in the register. The edition was re-frozen the same morning POST-transform, the register began publishing the full digest of the served bytes, and a staging gate now fails any build whose staged edition differs byte-for-byte from its frozen source. Found by the Codex round-4 audit before any digest was published or cited.",
   "corrected_in_issue": 252,
   "old_sha256": "25f67f3ec27661ef0b32c57840dc833b4c7782593a1db9efa3e955b47f965471",
   "old_sha256_note": "digest of the pre-repair frozen source file (git blob 781f442); the as-served pre-repair variant carried an injected beacon and its digest was never recorded - that unverifiability was the defect",
   "replacement_sha256_if_applicable": "d319d636e1f4b06510137799c1790188e5efc0afb3468422ea43298bf6c0e509",
   "methodology_impact": "none - no published figure or rule changed; the freeze procedure gained a byte-identity enforcement gate"
  }
 ],
 "_live_action_contract": "Codex post-execution audit Q2: a confirmed DATA error has a STRICTER live obligation than a plausible third-party dispute. If affected rows still feed a current page, GPUDeck must atomically SUPPRESS them or REPLACE them with a verified corrected row and recompute every dependent claim in the same deploy. Leaving a known-wrong value active with only an annotation is FORBIDDEN. NOTHING is permitted only as an explicit NO_CURRENT_EFFECT action whose reason records that a dependency check found zero current consumers. Correction records are IMMUTABLE, so live disposition is never a mutable flag on them: it is this APPEND-ONLY event stream, folded into gpudeck_data/correction-suppressions.json before any consumer runs.",
 "live_action_schema": {
  "action_id": "CA-YYYY-NNN",
  "correction_id": "the correction this disposes of",
  "effective_at": "RFC3339 UTC",
  "action": "SUPPRESS | REPLACE | RELEASE | NO_CURRENT_EFFECT",
  "selectors": [
   {
    "source_id": "canonical source id",
    "provider_id": "canonical provider id or null",
    "gpu_id": "canonical GPU id",
    "segment": "canonical segment",
    "metric": "canonical metric",
    "observed_date": "YYYY-MM-DD"
   }
  ],
  "replacement_sha256": "required for REPLACE/RELEASE, otherwise null",
  "reason": "required"
 },
 "live_actions": [
  {
   "action_id": "CA-2026-001",
   "correction_id": "C-2026-08-26-001",
   "effective_at": "2026-08-26T00:00:00Z",
   "action": "NO_CURRENT_EFFECT",
   "selectors": [],
   "replacement_sha256": null,
   "reason": "METADATA severity: the defect was an edition's frozen bytes differing from the bytes served, before any digest was published or cited. No dataset row was wrong, so no current page derives from an affected row. Dependency check: zero current consumers."
  }
 ]
}