# Directory Update Log

## 2026-10-09
* **Decided** (David): [an exploded isometric, with routes like a circulation diagram](decisions/exploded-isometric.md). The trace's drawing is now an isometric of the office with its floors pulled apart and heavy plate outlines, the route bold across floors and dotted between them, white on black; the lots and ducts beyond keep the first round's underground route. Rewrote [the drawing](design/the-section-drawing.md).
* **Decided** (David): [a simpler building, and cables underground](decisions/underground-and-simpler.md). The office is reduced to the entrance, the riser and the comms room; the data leaves underground through the cable entry to a data centre, an AI data centre and the third party's office, with breaks in the ground for the kilometres between them. Rewrote [the building](building/the-building.md) and [the section drawing](design/the-section-drawing.md).
* **Updated**: the [AI Act](law/wider-rulebook/ai-act.md) and [Digital Omnibus](law/wider-rulebook/digital-omnibus.md). The AI omnibus is Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 (confirmed on EUR-Lex): high-risk duties from 2 December 2027, and from 2 August 2028 for AI in regulated products, now a phase of its own. The Data Act part is still not agreed.
* **Added**: structured `actors` and `chapters` in [actors](law/eu-data-act/actors.md) and [chapters](law/eu-data-act/chapters.md), for the article pages; the build checks them against their tables and every article's `binds` and chapter against them.
* **Published**: the bundle with the site at /knowledge/, with a manifest. [The article](thesis/the-article.md) carries `publish: false` and is held back until the Trends Report publishes it.
* **Checked**: the four non-EU [jurisdictions](law/jurisdictions/index.md) against primary and official sources (SPEC §3.2.3) and rewritten. UK: smart data powers commenced 20 August 2025 (SI 2025/904); product security regime since 29 April 2024. New Zealand: banking designated 1 December 2025, electricity decided but not final (the first draft's 1 July 2027 was a planning date and is removed); IPP 3A in force since 1 May 2026. Australia: automated-decision transparency from 10 December 2026. United States: the CCPA has covered employee and business data since 1 January 2023.
* **Added**: `phases` on every right and instrument, and a `rulebook` block on each jurisdiction, for the rulebook's time axis and jurisdiction switch.
* **Checked**: [the trace](building/the-trace.md)'s attachments against the Official Journal text, as the author's own reading (SPEC §3.2.1); David confirmed the counts (§3.2.2). The trace's model gained what the event becomes at each hop and the footage's state while still on site.
* **Corrected**: [Share it](rights/share.md) now applies at the [third party](building/components/third-party.md). The trace's table already said it did; a new build check comparing that table with the rights found the gap.
* **Added**: [the trace](building/the-trace.md) now carries its model in frontmatter (`parties`, `hops`, `sensitive`). The site's ledger is computed from it, and the build recomputes every running total and compares it with the tables in the body.
* **Corrected**: [Article 5](law/eu-data-act/articles/article-05.md) now attaches to the [third party](building/components/third-party.md). The component listed Article 5 and the article did not list the component; the build's two-way reference check found it on its first run.
* **Decided** (David): the site and its repository are called **Data Explorer** (`data-explorer`). The jurisdiction switch stays, EU default. Cloud AI stays at hop 4 in both archetypes; local AI is the alternative on the governed path's hop 4 card ([the trace](building/the-trace.md)). The camera is the sensitive stream. The old site is left alone for now.
* **Changed**: no legal review will happen. `legal_review: pending` became `legal_review: none` everywhere, and [legal rigour](policies/legal-rigour.md) now requires a plain disclaimer (the author's reading, not reviewed by a lawyer, not legal advice) instead of a "draft for review" label.
* **Changed**: the Trends Report article is not yet published. Nothing on the site links to it until David adds the link ([the article](thesis/the-article.md), [archetypes only](policies/archetypes-only.md)).
* **Initialization**: Created the bundle for the Data Explorer, the successor to [stewardship-explorer](references/prototype.md).
* **Imported**: the prototype's content as one concept per item: 50 [articles](law/eu-data-act/articles/index.md), [chapters](law/eu-data-act/chapters.md), [definitions](law/eu-data-act/definitions.md), [actors](law/eu-data-act/actors.md), [milestones](law/eu-data-act/milestones.md), 7 [rights](rights/index.md), 10 [components](building/components/index.md), 6 [instruments](law/wider-rulebook/index.md). Two component vocabularies merged; retired-feature references removed from readings; the right `log` renamed `event-log` because `log.md` is reserved.
* **Added**: [the article](thesis/the-article.md) from the Gallagher Security Trends Report, and the thesis concepts it introduces: [copies and hands](thesis/copies-and-hands.md), [openness is the floor](thesis/openness-is-the-floor.md), [the archive is fuel](thesis/the-archive-is-fuel.md), [leave it alone](thesis/leave-it-alone.md). Rewrote [custody seams](thesis/custody-seams.md), [data stewardship](thesis/data-stewardship.md) and [the two archetypes](thesis/the-two-archetypes.md) against it; the full-stack archetype is now "the governed path", in the article's words.
* **Added**: [the trace](building/the-trace.md): one door event over six hops, with ledger counts for both archetypes. The counts show both archetypes making the same number of copies (six); what differs is hands (four against two) and seams (four against one). The site must say "fewer hands", not "fewer copies".
* **Added**: [camera](building/components/camera.md) as the sensitive stream and [third party](building/components/third-party.md) as the last hop.
* **Added**: [jurisdictions](law/jurisdictions/index.md): EU, UK, New Zealand, Australia, United States, first drafts.
* **Checked**: freshness on 2026-10-09. The Data Act part of the [Digital Omnibus](law/wider-rulebook/digital-omnibus.md) is not agreed, so the Act applies as written. Data by design (12 September 2026), CRA vulnerability reporting (11 September 2026) and AI Act transparency (2 August 2026) have all now passed and are noted as applying.
* **Decided**: [retire the node graph](decisions/retire-the-node-graph.md); [a landing page, then an instrument](decisions/landing-then-instrument.md). Proposed: [the bundle as the content source](decisions/okf-as-content-source.md).