Disputes are won in the paperwork, and the paperwork has a deadline

Last Monday was about the shape of a record. This week is about what a record is for.

---

The dispute you are going to have was decided in March

Ask anyone who has been through one. The dispute is not lost in the hearing. By the time two sets of lawyers are reading the same contract to each other, the facts are fixed, and the only question is whose facts were written down at the time.

That is the part that is winnable, and it is winnable early. Nearly every contract form and security-of-payment statute in this country says, somewhere, some version of the same two things:

1. You have a window. Notify the event within this many business days, or the entitlement is gone regardless of its merit.
2. You need the contemporaneous record. Not a reconstruction. The diary, the docket, the photograph, made at the time.

Both of those are perfectly knowable in advance. What makes them hard is that the window lives in a contract document, the record lives in a site system, the calendar lives in someone's head, and no two of those things have ever been in the same place.

So this week we put them in the same place.

125 standards, every one with a citation

Demiton now carries a register of evidence standards: the published obligations that decide whether a claim survives. Not our opinions about good practice. Clauses and statutes, each stored with its source, its grade and its reference, so anyone can read the original.

There are 125 of them as of this week, across five dispute types:

And across seven jurisdiction buckets: New Zealand 44, Queensland 26, New South Wales 21, Western Australia 16, Victoria 8, Commonwealth 7, Australian Capital Territory 3.

New Zealand is in that list deliberately and from the first day, not as a later port. The platform gained a real jurisdiction and currency vocabulary this week (more on that below) and New Zealand partitions along with it, which means a New Zealand job is a first-class job rather than an Australian job with the labels changed.

What runs every morning

For every active project, the platform resolves which of those 125 standards actually apply, by jurisdiction first, then by contract form or statute. Then it evaluates each one:

• A standard with a cadence (a daily diary, a monthly claim) is checked against how fresh that register is. If the site diary for this project has not had a record in eleven days and the standard says daily, that is a gap now, not at the final account.
• A standard with an event deadline (notice within ten business days of the instruction) is checked for a compensating record inside the deadline, counted in Australian business days or New Zealand working days depending on where the job is. A ten-business-day window that falls across Anzac Day is not a ten-calendar-day window, and treating it as one produces a confident wrong answer.
• A standard about a state you must hold (a current insurance, a retained record) is checked for a current record.

Each check writes one verdict: met, at risk, missed, or unmeasurable, with the reason and an exposure figure attached, so the gaps sort by what they are worth rather than by how recently they appeared.

The fourth of those is the one I want to defend.

Grey, not red

Unmeasurable means the register that would answer this question is not connected, so we genuinely do not know.

It would be very easy to render that as a red miss. A wall of red on a new account looks like the product is finding a great deal, and it is a lie: the platform is not looking at a system it cannot see. So unmeasurable renders grey, says which register would answer it, and links you to connecting that register. It is never counted as a failure.

This is the same discipline as last week's partial harvest. A result that looks complete and is not is worse than an obviously incomplete one, and a prevention product that cries wolf on its first day has spent the only credibility it will ever get cheaply.

The Disputes page also carries a one-line note that this is not legal advice, because it is not. Every row is a citation you can read, and a statement about whether a record exists. Whether you would win is a question for someone with a practising certificate.

Building the surface found its own bugs, as usual. The verdict facts were being matched on the wrong key, which would have silently rendered every count as zero for this disease and nobody would have noticed, because zero gaps looks like good news.

Five diseases, not six

Last Monday this blog said six. It is five.

Weather folded into missed claims on 16 September. Four days of rain nobody claimed is not a distinct failure mode. It is an entitlement you were owed under a clause and did not claim inside its window, which is precisely what missed claims already means. Keeping it separate made the list look more thorough and made the mechanism worse, because the cure for an unclaimed rain day is the same cure as for an unclaimed variation: notice the window, attach the record.

So the list is: rework, missed claims, cost drift, disputes, lapsed compliance. Two of the five now have a verdict running daily against real projects.

The weather work did not go anywhere, it just went where it belongs. The platform picked up the Bureau's forecast-location catalogue this week and a live hourly reader, so "was it actually raining on that job on that day" resolves against a real location rather than a nearest guess.

The form now refuses

Here is the sequel to last week's Nightingale piece, and it is a reversal.

The original decision was that a register would log a fact that did not match its contract, and write it anyway. Reasonable-sounding, and wrong. A standard that nothing enforces is a wish, and we said exactly that last week about a different gap without noticing we were still doing it here.

As of this week, a register refuses a fact that does not adhere to its contract. Three refusals, each visible and logged: a contract that exists but does not parse, a validator that faults, and a payload with a declared field of the wrong type.

Turning it on immediately found two defects that would have refused our own records:

1. We had implemented integer wrong. JSON Schema defines an integer as any number with a zero fractional part. We had implemented it as Python's idea of an integer, so 28.0 produced by our own contract parser failed a field declared as an integer. A genuinely fractional value is still refused.
2. We were running the wrong check on the highest-volume register in the platform. A site diary arriving from a vendor carries the vendor's own field names, and two of them collided by name with canonical fields declared as integers. The first version of the gate would have refused one hundred percent of those writes. The contract itself now decides which check applies, which as a side effect finally reaches the 79 contracts out of 172 that had no field mapping and were therefore being checked by nothing at all.

Both of those are the point of the exercise. A gate you turn on and nothing happens has told you nothing. We measured before enforcing, with a tool that replays live facts through the gate and reports what would be refused, and then fixed what it named.

The contract is public now

Last week the register catalogue became a page. This week the schema behind it became an API.

api.demiton.io/api/v1/public/registers returns every register contract with no login: 173 of them, full JSON Schema, field by field. The documentation site now reads from that API rather than walking our git history, so what the docs say and what the platform enforces cannot drift apart.

Publication runs through a redaction allowlist, and the interesting part is its failure mode: a document that still matches the leak pattern after redaction is refused with an error and logged, not served. Citations, internal evidence notes and vendor field maps stay private. The safe default when redaction is uncertain is to serve nothing.

Underneath that, the corpus moved: 64 fields across 50 registers were retyped this week onto a shared jurisdiction and currency vocabulary, and those registers went to a second major version. Every one of them ships with an upgrade function, so a fact written under version one is upgraded into the new shape when it is read rather than being stranded or rewritten. Inside the app, a register's Schema tab now shows every version it has ever had and the field-level diff between them.

That last paragraph is the boring one and it is the one that matters. A shape you cannot revise is a shape you will eventually have to abandon.

The cure has to reach a person

An alert that fires into an empty room is not a cure.

We found that alerts were being written with no addressee, so they landed in an organisation-wide feed and the notification bell never lit up for anybody. Every alert delivered, nobody told. That is fixed: one row per active member, with the count reported per channel.

Alongside it, three things shipped:

• A notification inbox, personal to you, with your unread count, distinct from the org-wide disease surface and from platform admin.
• A notification detail page, so an alert is read before its action is taken rather than actioned from a one-line summary.
• Weekly digest delivery. A countdown obligation is a state, not an event, so an immediate email per obligation per countdown stage is a mailbox nobody reads by Wednesday. In digest mode the in-app row still writes instantly (the feed and the bell stay complete) while email and push are held and rolled into one weekly summary with named rows and stated truncation. A quiet organisation still gets its all-clear, because silence is ambiguous and an all-clear is not. Double-sending is prevented by a database marker rather than scheduler state, so a restarted worker cannot send twice.

Alerts now dispatch from Temporal, which brings me to the other half of the week.

Every run is durable now

Workflow runs and agent runs execute on Temporal, in every environment. The five cutover flags that used to route them are deleted, not defaulted to true.

That distinction is the whole thing. A flag defaulted to the new behaviour still means two code paths exist, one of which nobody exercises and everybody assumes works. Deleting it means there is one path, and it is the one under test.

The same week, the feature flag count went from 17 to 9, and every deletion made a behaviour unconditional:

• Entitlement enforcement now denies rather than audits-and-allows, across all seven call sites. The setting had defaulted to strict since June; what is gone is the escape hatch.
• Register contract enforcement is unconditional, per the refusal above.
• Streaming is always on.
• Four read-path flags went, including one that closed a real defect where a register could read unscoped while reporting that it had scoped.

Compliance and Projects are gone, and that is the plan working

Two whole surfaces were deleted this week and Protection absorbed both. The compliance wizard's standing evidence is what the lapsed compliance disease reads. The project tracker became the Project board, which is now a list of every project you have against the cover your plan entitles you to.

The board used to be built from verdicts, which meant a project only appeared once something had gone wrong with it. On a prevention product that is exactly backwards: a project the platform is watching and has found nothing wrong with is the successful case, and it was invisible. It now shows every project in two groups, those with a contract read (which have a value and count toward your cover) and those with work against them and no contract read yet, collapsed behind a count, each one saying plainly that it counts toward nothing yet.

Old URLs redirect, so nothing anyone bookmarked breaks. In the sidebar, Memory is now called Registers, because that is what is in it.

Also this week

• A harvest that wrote nothing used to report success. It does not any more. Same family as last week's partial-harvest bug, and there are probably more of these, which is why we keep saying it out loud.
• The Assignar partner showcase published, with its film, covering what actually comes across the wire when you connect it.
• New registers and producers: bank guarantees and asbestos registers from documents, asset meter readings wired to telematics, asset disposals harvested from the finance ledger, and utility locations extracted from plans. One register, tender_addendum, was retired for never having been populated. Writing shapes before they fill is the method; keeping one that never filled is just clutter.

What's next

Wednesday is a partner showcase. Friday is a long read. And the thing I actually want to write here is the one I could not write last week and cannot write this week either: the first time a cure fires on a live job, catches something real, and the contractor gets the money.

Two diseases now have a mechanism that runs without being asked. That is not the same as a cure that has been proved, and we will not say it has been until it has. When it fires, it goes on the record here, with the date.

If you run a contract form or a jurisdiction whose notice windows are not in our 125, tell us. The clause is public. Knowing which clauses actually bite is not.