# SC-2026-004 rating timing across the v1.2 to v1.3 boundary

- **Artifact ID:** CHQ-DEC-2026-SC004-TIMING
- **Status:** DECIDED
- **Public record:** https://record.cybersecurityhq.com/governance/chq-dec-2026-sc004-timing
- **Machine-record SHA-256:** `d17b36072dfe6a5867ebe7728d22ff04fa71042436505d282a7ae035a0476b1f`
- **Publication correction:** CHQ-PUB-CORR-2026-001. This digest supersedes `8b46ab1312db2be67715f856a033386b90705e6c3e1d171c67bc2d0abaa21ee4`; the earlier digest does not verify these bytes.

## Complete structured record

```json
{
  "id": "CHQ-DEC-2026-SC004-TIMING",
  "title": "SC-2026-004 rating timing across the v1.2 to v1.3 boundary",
  "class": "RULE",
  "effective": "2026-09-29",
  "published": "2026-10-13",
  "status": "DECIDED",
  "scope": "CGS-11.4 in spirit: the record declined to use a rule it had already declared wrong during the one issue it remained in force. Not a methodology change; a documented choice between two valid applications. Evidence grade B was the second, independent reason to hold. AMENDED 2026-09-28 after external review: the ground for holding is restated as evidence grade under the scale in force (CGS-3.3, CGS-6.2: single-source, unnamed victims, undated), not a choice to leave the v1.2 clause unapplied. The clause is not reached on this evidence. The timing observation stands as context only.",
  "rule": "Holding rests on evidence grade under the scale in force (CGS-3.3, CGS-6.2: single-source, unnamed victims, undated); the v1.2 single-event clause is not reached. Timing is context only.",
  "rationale": null,
  "authority": "DM ratified 2026-09-27",
  "references": [
    "CHQ-CGS-2026-001"
  ]
}
```