The thread installs Log4Shell as a case in which a volunteer logging library interpolated JNDI lookups from log message content, and the federal emergency's first required act was to find the JAR against a community product list. The unresolved question is which repair, required before 2.0-beta9, would have kept ED 22-02 from opening on "enumerate." Turning off message lookups in log content is one rule: that is what 2.16.0 did. Restricting JNDI to the local java: protocol is a different first rule: that is the later JndiLookup page. Making log4j-core findable as a transitive JAR, so "enumerate" is a query and not a week of pull requests, is a third. Those are not substitutes. Lookups off, with no bill of materials, still leaves CISA starting from a GitHub list the next time a transitive JAR is the hole. A product list, with ${jndi:...} still running on a User-Agent, still leaves the process fetching LDAP. Apache's CVE page, ED 22-02, and the support page already record the interpolation, the enumerate-first clock, and the volunteer PMC. They do not say which one, required when lookups were added to messages, would have kept a log line from becoming a federal emergency's first to-do.