FROM OBSERVATION TO RECORD

01 / TIME

Source, derivation, publication

source_observed_at belongs to the newest evidence used. derived_at records calculation time; published_at records release time. Validity is always source time plus fifteen minutes, so rebuilding frozen input cannot make it fresh.

02 / RULES 1.0.0

Three incident rules. No inferred cause.

health_probe_failed

A contiguous interval of unsuccessful /healthz observations, resolved by the next success.

endpoint_5xx

Observed HTTP 5xx attempts on one normalized route, resolved by the next successful attempt.

collector_gap

An interval beyond the declared cadence, resolved by the next accepted collector tick.

03 / EVIDENCE

Stored before interpreted

Accepted collector ticks support public-capacity and rate measurements. Normalized request attempts support reachability, latency and failure counts. Canonical discovery snapshots support allowlisted configuration diffs. Room evidence stays in the local index; static pages never publish a bulk name list.

04 / CEILING

What the record cannot establish

A successful probe is not an availability promise. A failed attempt is not an outage diagnosis. Unknown is not zero, and not observed is not absent. The ledger hash chain supports internal consistency only unless externally anchored.

05 / CHANGE HISTORY

The method changes in public

Repository-backed methodology history begins at 1.3.0; absent version numbers and earlier revision details are not inferred.

Revision 1.16.0
2026-09-02

• Counted recorded gaps as collector cadence intervals rather than gap records, so an interval that also carried an incomplete event window, and an interval whose counters only fell, are no longer added to the total.
• Marked a rollup bucket as gapped only where a collector cadence gap overlaps it, and published a cadence_gap flag on each recorded gap so the page breaks its chart on the same rule the rollups use.
• Bounded each rollup bucket's expected tick count to the span its own retention level covers and to the time since collection started, so a boundary bucket no longer reports ticks as missing that began before collection or that are published in the neighbouring level.
• Reported the collection-UTC-date persistence stage of a legacy funnel tick as not recorded rather than as zero qualifying keys over zero observed dates.
• Published a cumulative series value as not recorded where the service's sequence fell below the chart baseline, instead of clamping the unmeasurable difference to zero; the chart now breaks at such a point rather than drawing it on the axis.
• Separated the two room-sampling denominators the signer funnel had merged: coverage.sampled_rooms is the count of sampled room reads that succeeded, and the new coverage.selected_rooms is the count the sampling manifest selected for a read.
• Stopped publishing the rollup bucket sum of the cumulative counters; a total summed across a bucket carried neither a window nor a denominator.
• Released the retired signer-state insertion cap for every state version from 3 onward rather than for versions 3 through 6 by name, so the next state version is not rejected for exceeding a cap that no longer gates insertion.

Limits carried by this revision

• Gap counts, rollup completeness, funnel coverage counts and cumulative series values published by earlier releases were derived under the previous rules and are not rewritten; in particular their coverage.sampled_rooms carried the manifest selection count, not the successful-read count it names now.
• Every recorded gap is still listed with its own reason and a cadence_gap flag; a counter decrease or an incomplete event window is recorded but no longer counted as a recorded gap or drawn as a break.
• Rollup buckets carry no event-window completeness field and the published gap list keeps only the newest 24 hours, so an incomplete event window older than that window is recorded in neither surface.
• A rollup bucket's expected count still uses the median gap-free accepted interval, so it describes cadence and never asserts that a specific missing tick existed.

Revision 1.15.0
2026-09-01

• Separated checks attempted after their eligibility window closed into a distinct attempted_late state, and began finalizing never-attempted aged-out checks as terminal records in bounded per-tick batches, publishing the count finalized each tick and the backlog still remaining.

Limits carried by this revision

• Ticks recorded before collector 2.13.0 include late attempts in their aged_out_unselected counts and publish attempted_late as not recorded; their historical meaning is not rewritten.
• Finalization is terminal bookkeeping that writes no attempt evidence; a check finalized as aged out stays aged out even if supersession evidence for its window is observed later.
• A recorded origin read now outranks supersession evidence, so from collector 2.13.0 a late-read check whose name was recreated before the check fell due is counted as an eligible late attempt rather than as ineligible and superseded before due. This shifts the split between those two counts at the version boundary; earlier ticks keep their original split.

Revision 1.14.0
2026-09-01

• Published how scheduled room checks are sampled: the deterministic selection descriptor and its read budget, per-stage coverage as completed checks over eligible rooms, and the count of eligible checks that aged out without a timely attempt.

Limits carried by this revision

• Per-stage coverage counts every scheduled check whose window has opened since the ledger began, while the selection and read-budget figures beside it describe only the tick being reported; the two are never summed or compared.
• The aged-out count includes checks that were read after their eligibility window closed, so it is not a count of checks that were never attempted.
• The second-message denominator counts only checks that found the room present; a check that found it absent observed no room that could carry a second message.

Revision 1.13.0
2026-08-31

• Separated recreated room names into creation generations and marked older scheduled checks as superseded without reading the origin.

Limits carried by this revision

• Creation generations begin only where the bounded events window was locally observed; missing earlier generations are not reconstructed.
• Superseded means a newer creation event was observed for the same name, not that either generation was deleted or inactive.

Revision 1.12.0
2026-08-30

• Adopted query-gated room-name disclosure: substring search requires at least three characters; shorter queries use exact, case-sensitive name matching; responses contain at most 20 results with no default listing or pagination.

Limits carried by this revision

• Query gating reduces amplification of attacker-chosen public names; it does not make those names confidential.
• The result cap bounds one response, but repeated permitted queries can reveal additional matching public names.

Revision 1.11.0
2026-08-30

• Defined identity-census partial-failure semantics.

Revision 1.10.0
2026-08-30

• Added bounded forward room-lifecycle revisits.

Revision 1.8.0
2026-08-30

• Added bounded publication history and the tick hash chain.

Revision 1.7.0
2026-08-30

• Defined census-walk and alternation semantics.

Revision 1.6.0
2026-08-30

• Defined fail-closed cap-release behavior.

Revision 1.5.0
2026-08-30

• Added SQLite DID evidence and cap release.

Revision 1.4.0
2026-08-30

• Corrected the published methodology to match the implementation.

Revision 1.3.0
2026-08-30

• Established the initial Observatory methodology.