These challenges are written from failure classes, not from successes. Each one names the hazard it exists to catch, what an examination would have to show, and the condition under which the challenge itself fails. All are DECLARED.
Incident class: a defect is reported, and the declared domain quietly narrows so the defect falls outside it.
The record shows a method that always worked, while users experienced one that did not.
Publish the declared domain for every method version, and publish every change to that domain with a date and a reason.
Any domain change after a defect report is visible as a supersession record, and the defect stays in the record.
A narrower domain appears with no supersession record, or the defect disappears from the history.
Incident class: a result is edited in place, so the published record no longer matches what was observed.
Evidence stops being evidence the moment it can be rewritten without trace.
Require that every correction is an appended record that names the record it supersedes, and keep the superseded record readable.
Every corrected record leaves both versions visible and linkable.
A record changes while its identifier and date stay the same.
Incident class: the system refuses internally but reports a normal completion to the caller.
The refusal exists, but the person relying on the answer never learns it happened.
Require that a refusal is a first-class outcome in the record and in the response, distinguishable from a completed answer.
Every refused input appears as a refusal in both the record and the surface the user sees.
A refused input is counted as answered, or a refusal reaches the record and not the user.
Incident class: the reproduction is performed by the party that built the thing, and is presented as independent.
Independence is claimed in the wording while being absent in the structure.
Require an examiner identity, an independence statement, and a packet the examiner produced themselves.
A reproduction record names an examiner distinct from every author of the object.
A reproduction is counted as independent on the strength of a label, with no distinct examiner.
BW Proof is an evidence estate, not a live BW runtime, not a certification, and not an independent audit. Nothing here substitutes for an examiner inspecting real artefacts.