The census answers no, three receipts found, and the prune was on file all along

CENSUS (read-only, hub store, tester's machine not contacted): no machine that is
not ours can be in the state that cost demo-felhom its history. The hub holds
escrow for three hosts; both demo boxes lost their pre-fix key in the same four
hours on 2026-08-04; peti-felhom and david have no host row and no escrow at all.
A control ran FIRST and had to pass -- the query returned "present (572 bytes)"
for a host known to have material and "absent (NULL)" for one known not to.
Corrected my own instrument on the way: a date-only comparison mislabelled both
losses as after the fix, so the in-force moment is now pinned from the hub's first
post-fix escrow row (11:11:37Z), which independently agrees with the register.

PART 1 ESTABLISHED. The prune is recorded inside R-267 -- the row about the
Configuration page being slow -- because pruning artifacts is what made that page
fast. Arithmetic checks (23+7=30, plus three versions that only surfaced after the
first thirty moved them onto page one = 33) and the PAGINATED listing shows both
generics at exactly ten. R-291's blocking condition is released: the operator was
being asked to establish something already written down. And my counter-argument
yesterday was wrong in exactly the way R-267 warns about -- "containers hold 19"
came from an unpaginated query; paginated they hold 270 and 169.

RECEIPTS: three restored (drives.enrol, backup.tier1, fail.lost-recovery-code),
each citing the document that walked it; the map already read PROVEN-LIVE for all
three, so this follows the map rather than raising a status in the view. NINE
HONEST GREYS. fault.selfheal's best hit argues against it -- an incident recording
self-heal's absence through a 1h15m outage.

THE DECAY RULE FIRED FOR THE FIRST TIME. backup.restore-proof has a receipt from
28 July and is superseded anyway: demo-hp's restore-test failed 5 August and the
box has since been rebuilt. A claim about a continuing behaviour cannot rest on an
old observation. The capability map still reads PROVEN-LIVE and is now the thing
out of step -- recorded, not silently rewritten.

PART 4 specified, not implemented. The orphan card promises restorability the box
rendering it cannot evaluate: the discriminator is on the hub and no wire field
carries it. A conditional promise the system cannot evaluate is the same defect as
an unconditional false one, so the copy stops promising, says what happens, and
names a route. Ships with the next controller change so one bake covers both.

CONTEXT.md

@@ -15,6 +15,30 @@
 > would make one of the two audiences stop reading. `STATUS.md` is also a **view of `OPEN-ITEMS.md`**
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
 
+## A record that lives inside a row about something else has not been recorded
+
+**Earned 2026-08-10, at a measured cost of two sessions.** Thirty-three package deletions — an
+operator-ruled prune, with the keep set asserted first and every delete returning 204 — were written
+down inside **R-267, the row about the Configuration page being slow**, because pruning artifacts is
+what made that page fast. It was a perfectly good record in a place nobody would look.
+
+**What it cost.** One session searched the register and reported *"no register row records a package
+prune"*. A second exhausted Gitea's router logs, its activity feed and its schema, then concluded the
+deleter *"may be unestablishable from this side"*. Both were wrong, and the answer was in
+`OPEN-ITEMS.md` throughout. Worse, the second session argued against the prune using an **unpaginated**
+package count — the exact trap that same R-267 row documents one paragraph above the sentence it could
+not find.
+
+**Findability is part of recording, not a nicety.** A fact filed under the story of how it was
+discovered is filed under the wrong thing. Concretely:
+
+- **An execution record gets its own row**, even when the execution was incidental to something else.
+  A row may cross-reference; it may not be the only home.
+- **A row about a fix is not the home for the acts the fix required.**
+- This is the second measured cost of the register's illegibility in two days, and it is a *different*
+  failure from the first: prose rows make claims ambiguous, rows-about-other-things make facts
+  unfindable. Both are in R-288.
+
 ## A check and the policy it enforces must read the same number from the same place
 
 **Earned 2026-08-09.** The container registry retains N versions per package; `check-published-versions.py`