Evidence cards
One card per tracked entry, meant to be read away from this site: the status this record holds, the evidence state beside it, the day the document was last observed, and the address of the entry it is drawn from.
What embeddable means here
Three mechanisms could put a card on another page. Two are refused, and the refusal is not a preference — it is already what this site’s response headers say.
A frame. The other page would load this one inside itself, so every
person reading that page would make a request to this origin, and a request
carries an address and a browser string whether or not anything here writes
them down. public/_headers declares
frame-ancestors 'none' and X-Frame-Options: DENY on every path, so a frame does not render at all.
A hotlinked image. The same property, and quieter about it: an image
looks inert on the page that carries it. The same header block declares
Cross-Origin-Resource-Policy: same-origin, which is the
instruction not to load this origin’s bytes into a document served from
another one.
A copied fragment. Taken. A card is markup and inline style attributes and nothing else: no script, no stylesheet, no font file, no image, and no request of any kind back here. The site that carries a card serves it from its own bytes, and this record learns nothing about who read it.
The limits, which are the price of that mechanism
A copy does not update. It states what this record held on one day, for ever. So the day is printed on the face of every card rather than implied, and the one link on it goes to the entry, which is the only route to what the record holds now.
Nothing here can see a card once it is taken. That is the mechanism working, and it is also the cost: a card cannot be withdrawn, corrected or counted from this side. A correction reaches a copy only through the link.
Style attributes are stripped by many publishing tools. So no card carries a fact in its colour, its size or its position: with every attribute gone it says the same things in the same words.
A card carries states and days. Every address, every retained passage
and every digest stays on the entry page. Publisher passages in particular
are withheld: a quotation is asserted against the bytes it was read from by
scripts/quotefidelity.py, which reads a declared list of
quoting surfaces, and this is not one of them. Withholding is what this
record does where a constraint and the evidence meet — never a quotation
moved into an element the census cannot see.
A card is not a badge
A badge asserts a grade. Every card carries the same colours whatever it says, nothing on one is coloured, sized or ordered by what it states, and there is no mark, no tick and no rank anywhere on it. Two axes, a day and an address: the status this record holds, with whether a publisher surface was read for it; the evidence this record holds beside it; when the document was last observed here; and where the entry is. No card rates the document, and none rates the publisher.
The status value is printed as this record stores it —
in-force rather than the reader’s spelling the entry
page uses. One value, one spelling, on the surface that travels furthest
from the page that could explain a second one.
The day a card can carry
A card states a last-observed day only where this record has retrieved the document the entry names and taken a digest of it. Where it has not, the card prints an em dash and the sentence saying which absence it is — an absent day and a day nobody looked for are opposite facts, and off-site an unexplained blank is read as the worse of the two. Listed in the order the states are tested, over all 132 tracked entries:
- 0 of 132 — the entry names a body or a programme, so there is no document to retrieve and the card carries an em dash
- 0 of 132 — this record cannot tell which of its retrievals for the entry are of the document it names, so the card states no day rather than the wrong one
- 125 of 132 — the document the entry names has been retrieved here and digested, so the card carries the day that last happened
- 7 of 132 — retrievals are recorded and none of them has produced a digest of the document the entry names, so the card carries an em dash and says so
- 0 of 132 — no retrieval at all is recorded for the entry, so the card carries an em dash and says so
Every card
132 tracked entries, one card each, listed alphabetically by title: ordering by how recently an entry was observed would put the most recently read first and present that placement as a finding.
- 21 CFR Part 11
- 21 CFR Part 211
- 21 CFR Part 820 (QMSR)
- Annex 11 concept paper
- Annex 15 revision concept paper
- ANVISA
- ASTM E2363
- ASTM E2500
- ASTM E2537
- CEN/CLC JTC 21
- CISA CPG 2.0
- DI revision concept paper
- EMA AI reflection paper
- EMA CT computerised systems
- EMA data quality framework
- EMA work programme
- EU AI Act
- EU Cyber Resilience Act
- EU Cybersecurity Act
- EU GMP Annex 1
- EU GMP Annex 10
- EU GMP Annex 11
- EU GMP Annex 11 (draft)
- EU GMP Annex 12
- EU GMP Annex 13
- EU GMP Annex 14
- EU GMP Annex 15
- EU GMP Annex 16
- EU GMP Annex 17
- EU GMP Annex 19
- EU GMP Annex 2
- EU GMP Annex 21
- EU GMP Annex 22
- EU GMP Annex 3
- EU GMP Annex 6
- EU GMP Annex 7
- EU GMP Annex 8
- EU GMP Annex 9
- EU GMP Chapter 1
- EU GMP Chapter 2
- EU GMP Chapter 3
- EU GMP Chapter 4
- EU GMP Chapter 4 (draft)
- EU GMP Chapter 5
- EU GMP Chapter 6
- EU GMP Chapter 7
- EU GMP Chapter 8
- EU GMP Chapter 9
- EU IVDR
- EU Machinery Regulation
- EU MDR
- EU NIS2 Directive
- FDA AI device list
- FDA AI guidance
- FDA CDRH AI/ML
- FDA clinical decision support
- FDA CSA
- FDA data integrity
- FDA device cybersecurity
- FDA device cybersecurity (2026)
- FDA electronic systems (clinical)
- FDA ETP
- FDA GMLP guiding principles
- FDA guidance agenda
- FDA Part 11 scope
- FDA PCCP
- FDA postmarket cybersecurity
- FDA process analytical framework
- FDA software validation
- FDA/EMA AI principles
- GAMP 5 2nd Ed
- GAMP AI Guide
- Health Canada ML
- ICH E6(R3)
- ICH Q12
- ICH Q13
- ICH Q14
- ICH Q2(R2)
- ICH Q9(R1)
- IEC 62304
- IEC 62443
- IEC 81001-5-1
- IEEE 7000
- IMDRF AI/ML WG
- IMDRF SaMD
- ISO 13485
- ISO 14971
- ISO 81001-1
- ISO/IEC 22989
- ISO/IEC 23894
- ISO/IEC 24028
- ISO/IEC 27001
- ISO/IEC 27002
- ISO/IEC 27017
- ISO/IEC 27017:2026
- ISO/IEC 27018
- ISO/IEC 27018:2025
- ISO/IEC 38507
- ISO/IEC 42001
- ISO/IEC 42005
- ISO/IEC 5259
- ISO/IEC SC 42
- ISPE GAMP RDI
- ISPE Pharma 4.0
- MHRA AI
- MHRA AI Airlock
- MHRA data integrity
- NIST agent standards
- NIST AI 600-1
- NIST AI RMF
- NIST AI RMF Playbook
- NIST CSF 2.0
- NIST SP 800-82
- NISTIR 8183
- NMPA portal
- PDA TR 80
- PIC/S Annex 11
- PIC/S GMP Guide
- PIC/S PI 011
- PIC/S PI 041
- PMDA AI
- prEN 18229-1
- prEN 18229-2
- prEN 18281
- prEN 18282
- Regulation (EU) 2026/1744
- Swissmedic
- TGA SaMD
- WHO AI health
- WHO computerised systems
- WHO data integrity guideline
- WHO data management
Last updated: