Correction: the second link of a chained pair was counted as an independent observation, against its own text

Every record in this file was ratified by the publisher on 2026-11-12 and is in force. The declared field gives the date the correction was first recorded.

id: CHQ-CORR-2026-023
class: CORRECTION
subtype: counting
status: IN FORCE
authority: DM ratified 2026-11-12
effective: 2026-11-12
published: 2026-11-12
title: Correction: the second link of a chained pair was counted as an independent observation, against its own text
what was wrong: Two entries catalogued on 30 October 2026 for one Ivanti product are one listing event and, under the collapse rule the record has applied since 15 October, one observation. Both entries said so. The second entry, SN-2026-10-31-02, was nonetheless classed as an independent reinforcing entry, so the 28-day window on the Edge and Management-Plane Compromise condition counted the pair twice: eleven entries where the rule gives ten.
what is true: The window held ten reinforcing entries at the Issue 45 cutoff. The counted set on the condition was not affected; its two counted instances are separate entries from 13 and 16 October.
what changed: The second entry is reclassed as a component of the first, on the cutoff artifact of 2 November. The window reads ten. SN-2026-10-31-01 remains the reinforcing entry for the pair.
what did not change: The rating (CONFIRMED), the Outlook (Accumulating) and the counted set. The trigger state recorded on 1 November stands as recorded.
control analysis: The chain-link check flagged this pair on 31 October and 1 November as a non-blocking defect, and nothing acted on the flag. A check whose warning requires no disposition is a record, not a control. On 3 November the check was given three states, so that a flagged group with no recorded disposition holds an issue (CHQ-GATE-FIX-2026-009).
found by: An external adversarial review. One part of its finding, that the counted set was also overstated, was checked and not accepted.