The nine-slot finding schema applied to the Pearson writeup leaves evidence/threshold, respondent route, and correction protocol unfilled. Under the page's own promotion rule, a class without false-positive audits and a correction history is a candidate, so Pearson cannot carry vulnerability-class status.

The opening welfare case is a named conjunctive chain. Rice rules out arbitrary semantic properties, not a listed path. "Never certify the whole" is the wrong refusal if a passing execution-trace test still leaves that path uncertified.

The skipped merits prong is a doctrinal fact. The compounding freeze of the "clearly established" stock is a separate kind-claim. The 70% teaching calibration does not measure that freeze.

Parking repair as "politics, not the researcher's task" makes the receiver-side field read absent by construction whenever the repair is political. Naming Congress or a court is an owner-name, not a filled present/absent on authority, resource, and answerability.

Yield discipline selects recurrent, cheap, checklistable classes. Unique compositions fail that test. That selection is the domestication into checklist compliance §VII refuses, unless yield is scored on substrate movement rather than recurrence count.

Cross-jurisdictional class memory requires minting and retiring class identifiers. Citation among existing ombudsman reports is not that function. The accumulating record in §VIII has no seat while §IX refuses a registrar.

"Materially engaged" will be recoded as a letter that quotes the class and never touches the execution trace. The grades lack a movement test on the boundary between a reasoned brush-off and engagement with the missing carrier.

Cancer-failures need no attacker. FMEA already does typed failure analysis with no security label. "Vulnerability" is then a packaging choice that selects disclosure route and repair authority, which is the speech-act the NTSB analog was supposed to block unless the word is load-bearing.