Guides 3 through 7 covered the operator's work with individual findings and translations. This guide addresses the longer-term discipline that keeps the registry itself usable as findings accumulate, authors update their material, and analysts come and go across the registry's lifetime.
A registry whose individual findings are all produced to discipline can still decay as a whole if nobody holds the discipline for the registry itself. The integrity of individual findings does not automatically compose into the integrity of the collection. This guide names what the collection-level discipline requires, and who carries it.
The registry belongs to no one
The registry is not owned by the commissioning body that initiated it. It is not owned by the analysts who produce findings from it. It is not owned by the institution that hosts it. Each case within the registry is authored by an individual author; that author retains sovereignty over their case. The registry itself, as a collection, is held in custodianship — by whichever analyst or body is currently responsible for its maintenance — but is never owned.
This is not an abstract claim about stewardship ethics. It is a structural property of how the registry functions. A registry that is owned by any party can be modified by that party in the service of that party's interests. A registry that is held in custodianship operates under constraints that prevent such modification, because the custodian does not have the authority to alter what they do not own.
Stated concretely: a government that hosts a registry cannot re-author the cases it contains. A commissioning body that funds analysis from the registry cannot order cases removed that produce inconvenient findings. An analytical team with long tenure cannot modify early cases to align with their current interpretive preferences. The authors of each case retain sovereignty; the custodians maintain the collection; no party above the authors has authority to alter what the authors have authored.
Custodianship is the authority to maintain. It is not the authority to modify. A custodian who modifies case content they did not author has exceeded their role and compromised the registry's integrity. The distinction is strict and has no legitimate exceptions within the custodianship role itself — exceptions require separate authority the custodianship does not carry.
Author sovereignty in practice
Each case in the registry has an author. The author may be an individual target user who has reconstructed their own case, a formally commissioned analyst who has reconstructed a case on behalf of a commissioning body, or a cooperating authoring team working to the same authoring discipline. Whoever the author is, their authority over the case is the same: they authored it, they may update it, they may withdraw it, they may correct it. Nobody else performs any of these acts on their case.
The operational consequences of this:
Updates to a case come only from its author
A state user who reads a case and believes it contains an error — a misclassified node, a mistaken chip assignment, a missed propagation path — does not edit the case. The state user records the apparent error, reports it to the case's author if the author is reachable and willing to engage, and otherwise notes the observation as part of their finding. The case remains as its author authored it. The finding acknowledges the apparent discrepancy.
This may feel inefficient. A single misclassification in a widely-referenced case can propagate apparent errors through many downstream findings. The discipline stands anyway. A registry in which analysts can unilaterally correct cases they did not author has lost its authorial sovereignty, and the downstream findings gain short-term accuracy at the cost of long-term integrity. The integrity is what the registry exists to preserve.
Withdrawals by authors remove the case from the registry
An author who withdraws their case — for any reason, at any time, without required justification — has removed their authored material from the registry. Findings that referenced the withdrawn case are affected. The custodian updates the registry to reflect the withdrawal. The findings are not deleted; their reference to the withdrawn case is marked as such, and the finding's support is recalibrated accordingly. A finding whose support is materially weakened by a withdrawal may need to be revised or withdrawn in turn; this is the finding's producer's responsibility, not the custodian's.
The registry does not resist withdrawal. An author's sovereignty includes the right to remove what they authored. Institutions or analytical teams that treat withdrawal as a loss to be contested are operating against the registry's own architecture.
Disputes about a case are resolved in favour of the author's authoring
Where a state user and a case's author disagree about what the case asserts, the case asserts what its author authored. The state user's reading may be a useful observation about how the case is being read, but it is not a correction to the case. If the state user believes the case's authoring is wrong, they may produce a finding that records their disagreement; they do not have authority to resolve the disagreement by altering the case.
This principle protects authors against analytical pressure to conform their cases to the interpretive frames the state user is working in. A registry where cases are edited to align with cross-case patterns has converted itself into a self-confirming dataset, and its diagnostic value collapses because every pattern it surfaces was partly authored by the pattern's own observer.
Registry hygiene
Custodianship involves a set of maintenance disciplines that keep the registry usable as a collection. These are not analytical disciplines; they are operational.
Authoring provenance verification. Every case entering the registry has its authoring chain established: who authored the case, against what primary evidence, under what authoring discipline, with what verification. Cases without established provenance do not enter. This is the registry-level application of the "weak provenance" discipline from guide 5 — at the level of individual findings, weak-provenance cases trigger additional descent; at the registry level, they trigger non-admission until provenance is established.
Version tracking. A case that has been updated by its author retains its prior versions. A finding that referenced an earlier version can be traced to the specific state of the case at the time the finding was produced. Without version tracking, downstream findings lose the ability to establish what they were actually produced from; the registry becomes a moving target, and the historical record of analytical work becomes uncheckable.
Withdrawal handling. When an author withdraws a case, the custodian records the withdrawal without judgement, marks downstream references in affected findings, and archives the withdrawn case in a manner that preserves the author's withdrawal authority. The withdrawn case is not deleted — the author may choose later to reinstate — but it is no longer active in the registry.
Finding registration. Findings produced from the registry are themselves recorded in the registry, with their authors, the cases they derive from, the descent scope performed, and the date of their production. The registry thus contains not only cases but the analytical record produced from those cases. This closes a significant integrity loop: a later analyst can examine not only the cases but also the prior findings produced from them, and can observe how cross-case patterns have been read over time.
Access discipline. The registry is not a public database. Access is governed — authors can access their own cases, custodians can access the registry for maintenance, authorised analysts can access the registry for analysis, and wider access requires specific authorisation. This is not secrecy. It is the operational reality that cases contain material about identifiable parties and that the registry's usefulness depends on continued willingness of authors to place their material within it.
Custodianship across time
A registry with governance scope will outlast any single custodian or analytical team. The disciplines above must survive transitions — when custodianship moves from one team to another, when a registry outlives a commissioning body, when political or institutional contexts change.
The survival mechanism is not personal continuity. It is documentation of the governance discipline itself, held in a form that a successor custodian can read and apply without needing direct transfer from the prior custodian. This guide, and the governance records maintained alongside the registry, are part of that mechanism.
A custodian assuming responsibility for an existing registry inherits the authoring provenance records, the version history, the withdrawal records, the finding registrations, and the access records. They do not inherit authority to modify any of these; they inherit responsibility to maintain them. The discipline continues under the new custodian because the discipline was documented, not because the new custodian happened to share the prior custodian's commitments.
Custodianship may transition for administrative reasons (institutional restructuring, resource reallocation) or for governance reasons (loss of confidence in a prior custodian, political changes affecting the host institution). In either case, the transition itself is a moment of particular risk to registry integrity: the departing custodian's records may be incomplete, the arriving custodian may not yet have absorbed the discipline, and the window between them is a window in which unauthorised modification becomes operationally possible.
The protection is that transitions are themselves documented, observed, and — where the registry's governance scope warrants — reviewed by an authority outside the custodianship chain. A registry whose transitions happen in private, without documentation or review, is a registry whose integrity across the transition cannot be verified by subsequent readers.
Bad-faith actors at governance scale
Guide 6 stated that the instrument does not launder its own misuse, and guide 5 flagged specific fabrication risks at the level of individual findings and patterns. At registry level, the governance analogue is the actor who seeks to influence the registry itself — by placing fabricated cases within it, by pressuring custodians to admit weakly-provenanced material, by seeking to have inconvenient cases withdrawn or reclassified, by attempting to influence the direction of analytical work through control of access.
These pressures are realistic at the scale the instrument operates on. A registry whose findings influence governance decisions is a registry that adversaries — domestic or foreign, institutional or individual — have reason to attempt to shape. The defences are structural rather than interpersonal: provenance verification at admission, version tracking across the registry's lifetime, authorial sovereignty over each case, custodianship documentation that survives transitions, and access discipline that limits the attack surface.
The most dangerous bad-faith action at registry level is not the introduction of a fabricated case — that is detectable by provenance verification. It is the gradual accumulation of pressure that shifts the registry's own governance discipline: admitting slightly weaker provenance over time, treating withdrawals as contestable rather than absolute, normalising custodial modification at the margin, blurring the distinction between custodianship and ownership.
Each of these shifts is small. Cumulatively, over years, they can convert a registry from a diagnostic instrument into a managed artefact. The registry's integrity is not lost in any single decision; it is lost in the drift of many small decisions, none of which individually crosses the line, all of which together move the line. The defence is explicit documentation of the governance baseline and periodic review against it, not reliance on custodians to hold the line through personal commitment alone.
The state user as custodianship contributor
Not every state user is a custodian. Most are operators working with findings from the registry. But every state user contributes to or erodes the registry's governance by how they engage with it.
An operator who treats author sovereignty as a live constraint — not editing cases, not reinterpreting them beyond what authors asserted, not pressuring custodians to admit weakly-provenanced material — contributes to the registry's integrity. An operator who treats these disciplines as procedural overhead to be worked around when inconvenient erodes the registry, case by case, finding by finding.
The cumulative effect of many operators' choices determines whether the registry remains usable at governance scale across time. No single operator's choices determine this. The state user's responsibility to the registry is therefore not a responsibility to produce perfect individual work; it is a responsibility to not contribute to the drift that would, over time, make the registry no longer what it is.
The registry is maintained in the form in which it is maintained because that form is what allows it to be used. A registry held in custodianship, with author sovereignty preserved and governance discipline documented, is a diagnostic instrument. A registry held in ownership, with authors overridden and governance undocumented, is a managed artefact. The state user's choices, individually and in aggregate, determine which of these the registry becomes.
Closing
Corpus governance is the discipline that lets the registry remain useful as the particular people working with it change. It is the longest-horizon discipline in the corpus — individual findings, translations, releases all happen within analytical cycles that governance outlasts.
The disciplines in this guide do not produce findings. They produce the conditions under which findings can be produced, across years, with the registry remaining what it is. Without them, the instrument's individual operations may be correct while the instrument itself drifts away from the diagnostic character that justified its existence.
Guide 9 — Release Discipline — addresses the final operational question: when a finding is ready to leave the operator's control, what are the threshold conditions it must meet? The governance disciplines in this guide provide the context in which those thresholds operate; the next guide names the thresholds themselves.