Standard · addendum

CSTS-01 Reference Profile — Addendum A1

Question architecture, and the addressed holding. Two capabilities added under AR-3 that the ratified profile did not grant, presented for signature and ratified on 5 September 2026.

RATIFIED. This addendum is ratified. It was ratified on 5 September 2026 by Travis Lee, Chief Executive Architect of LeMay, and entered in the Registry of Instruments and Standards.

Two words are in play and they are not in conflict. RATIFIED is the word for a reader: this addendum has been ratified and entered in the registry. ratified is the token for a machine, and it is the value every question-bearing record emits as csts-addendum-compliance in both renderings. The profile this extends declares its own token, signed, which is unaffected — two instruments, two declarations, neither borrowing the other's authority.

Instrument: CSTS-01/ARCHIVE/A1
Extends: CSTS-01/ARCHIVE revision A — ratified, signed 3 September 2026
Signatory: Travis Lee
Seat: Chief Executive Architect of LeMay
Date of ratification: 5 September 2026
Conformance state: ratified — emitted on every question-bearing record, in both renderings
Substance: Unchanged by the ratification. The Chief ratified what was published; only the conformance state and the attestation block moved.
Presented: 3 September 2026, under AR-3, phases 2 and 3; amended and presented again 5 September 2026 with sections II.9, II.10 and III.4; extended 5 September 2026 with section III.6, the held state

I. Question architecture

An answering machine does not read a page; it looks for the shape of an answer. Most of what this archive knows is easiest to state truthfully in that shape, and the archive already held every one of those answers. It had no way to emit them as answers.

I.1: A page may emit a question node: FAQPage for more than one question, QAPage for exactly one. The archive emits whichever is true rather than always the larger of the two.
I.3: Every answer is composed only from fields the record carries. There is no generated prose. A question the record cannot answer does not ship — enforced by returning nothing rather than something.
I.4: Every answer carries its warrant: a citation naming the attestation, and isBasedOn pointing at the record's own provenance node.
I.5: The page and the graph say the same thing, in the same words, with the same citations.
I.6: At most eight questions to a page — a term of the archive's page-weight guard, not a matter of taste. Fewer than two answerable questions and no node is emitted at all.
I.7: The addendum declares itself separately. The ratified profile's own conformance declaration is unchanged.

II. The addressed holding

The ratified profile emitted a boundary by putting its coordinates inside the page. On the record of the Charles River Reservation that came to 940,481 bytes of one document — fourteen times the archive's own page-weight ceiling — and it put the record's identity behind a wall of numbers. Coordinates are data. Data in this archive is a preserved holding with an address, a media type, a license, and a digest.

II.1: A page must not inline a coordinate array. The boundary is a Map node addressing a self-hosted geo+json holding, with its size, digest, and license.
II.2: A page must not inline a column dictionary. The publisher's dictionary is a DataDownload addressing a self-hosted holding, preserved verbatim.
II.3: One shape across the corpus. Wide records and narrow ones emit the same nodes in the same positions.
II.4: A rendered map is an ImageObject carrying its alternative text in both caption and description. The schema refuses to store an image without it.
II.5: Every asset is rendered server-side, at accession, and never in a browser.
II.6: An asset is served with its digest and its license in headers, so a consumer that never parses the graph still receives both.
II.7: The move is a recorded transform on each record it touched. It is not a silent edit.
II.8: What is simplified says so. The drawing is simplified for display; the GeoJSON holding is not.
II.9: An asset's published address names its content: /asset/{digest}/{slug}.{ext}. A change of bytes is a change of address, so no cache can be wrong about it, and a digest the archive does not hold is answered 404 rather than the current bytes.
II.10: One address per asset per record. Every /asset/ occurrence — in markup, in the graph, and in the running prose of every answer and every transform description — is the address that record vouches for. A citation engine quotes an answer; it does not follow a link.

III. What this addendum refuses

An invented question. A question whose answer would have to be composed rather than assembled is not emitted, however useful it would be to a search engine. The archive has no opinion it did not accession.

An unlabeled picture. The schema will not store an image asset without alternative text, so a page cannot emit one.

Borrowed conformance. This addendum declares its own state and never the state of the instrument it extends. It declared provisional for exactly as long as it was unsigned and declares ratified from the act that ratified it, beside the profile's own signed.

A claim its evidence does not carry. A claim stands only where a quoted passage names the asserted name as a name of the subject itself — not as a title, not as an ordinary word, and not as the name of anything beside, inside, or merely containing the subject. A record withdrawn by a check later found wrong is reinstated, equally on the record.

Deleting what it moves. Nothing an addressed holding contains was removed from the archive. The boundary, the dictionary, and the list of contained places are each served whole at a stable address, and the page that no longer inlines them names that address in the reader's own sentence.

Choosing between asserting and expelling. Where a quoted passage raises a name and does not settle it, the archive neither publishes the claim nor withdraws it. It holds it — see the three states below.

III.6 — The three states of the gray record

A record in this archive stands in exactly one of three states, and a candidate that never became a record has a fourth disposition of its own. The held state was added under HOLD-1 and is standing doctrine, not the disposition of one tranche.

Published: The archive asserts it, on a named attestor's authority. It enters the retrieval corpus, it may be cited by a composed page, and its structured graph carries the assertion.
Held — contested: The archive keeps it and does not assert it. The record resolves at its own address with its quoted passage and its attestation printed whole and marked contested; it enters no composed page, no retrieval corpus, and no structured assertion of any kind.
Withdrawn: The tombstone. The record once stood correctly, a standard later failed it, and the page says so and reprints nothing it withdrew.
Refused: Not a state of a record, because there is no record. A candidate the shelves cannot answer for, kept with the clause it failed so the exclusion is auditable.

WHY A THIRD STATE WAS NEEDED. Some evidence raises a name and does not settle one. The archive asks whether an asserted name stands beside the verb that would be naming it, because English puts a name against its naming construction. Frothingham reads “a town-meeting was called, June 9” — a naming verb, the name “the Neck” ten words earlier in another clause, and nothing in the sentence naming any place. The mirror case is Drake's “The Neck, as it has always been called, was once covered with trees” — a genuine naming whose name stands further from its verb than any window narrow enough to exclude the first can reach. Both are one fact, and it is a fact about the archive rather than about the source: it cannot show that it settles the name.

Publishing would be wrong. A published claim asserts a place-name on a passage's authority. Where the passage does not settle it, publishing asserts what nobody attested and hands a citation engine a fabrication carrying a citation. Publishing on a reader's eyeball where the mechanism cannot see is the same breach with better manners: an archive that overrides its own instrument case by case has no instrument.

Withdrawing would be wrong. A withdrawal states that the archive held this and a standard failed it. These passages failed no standard, and in one class the source is plainly right. To withdraw them is to discard real gray-record material for being untidy — and carrying contested knowledge rather than expelling it is the one advantage this archive has over a wiki.

So the record is held, and holding has four obligations.

III.6.1 — It survives whole: The quoted passage, the attestation, the citation, the provenance chain and the transform ladder are unchanged and served. A held record stripped to a notice is a withdrawal wearing a different word.
III.6.2 — It is legible as contested: The page says so in its first three words, states what the passage does and does not carry, and says what would resolve it. It is listed among its kind, in a section that names the state. A held record no reader can reach has been expelled in everything but name.
III.6.3 — No machine may quote it as settled: On a claim record the title is the assertion, so the page title, the heading, the social title, the breadcrumb trail and every node of the structured graph carry a neutral label instead. The graph declares recordStatus: held and creativeWorkStatus: Contested, states the contest, and emits the name in no assertional field. The name appears in exactly one place on the page — inside the quoted passage, where it is the source speaking and not the archive. Exclusion from the composed layer is enforced in the schema by trigger, in both directions, because a rule that lives only in application code is a rule the next caller can forget.
III.6.4 — It is counted honestly, in both directions: A held record must inflate no figure a reader takes as settled, and must not vanish so that the archive understates what it holds. The holdings statement publishes all three states and they reconcile to every row the archive has accessioned. Under-counting is the failure direction that feels safe and is not.

What resolves a hold: evidence, never tidiness. A held record states which of two things it waits for, because they end by different acts. A record whose passage does not name the subject awaits a better source, and is published or withdrawn the day the archive holds a passage that names the subject unambiguously. A record the instrument's window could not reach awaits a wider window, and is resolved when the archive measures a better rule against its whole corpus — not by reaching past the present rule for the records a human eye happens to like. A hold is not a parking space: it is a statement, on the record, that the archive has looked and cannot settle.

Attestation

The signature block is closed in the instrument of record. The ratification was one constant in the reference implementation, and the whole emission surface advanced in a single edit — no page carries the value by hand. A guard reads the value out of the emitted head, names any page that carries a wrong one, and is kept rather than deleted once proven.

The profile this extends