4,900, not 5,000
On 16 August 2026, in the hours before this site went live, our reference implementation and our normative text disagreed about one number. The script that computes every canonical figure in the document family placed the boundary of the Highly concentrated band at 5,000, and the Universal Framework’s metric specification derives 4,900. Both had passed review, only one could be right, and this post records which, why, and what we did about it.
Where 4,900 comes from
The framework’s bands are not chosen numbers. For common-mode failure the operationally meaningful quantity is the largest single share at a layer, the share of the service that fails with its biggest dependency. For any largest share s₁, the index has a lower bound of s₁² × 10,000, and the bands derive from that bound.
A dependency holding 70% of a layer’s assets contributes 0.70², which is 4,900. So 4,900 is where an estate can first be consistent with one dependency able to take the clear majority of a service, and boundary values belong to the higher band, meaning an index of exactly 4,900 reads Highly concentrated.
The derivation also explains what the bands are not. Merger-review thresholds encode market power, this bound encodes defect propagation, and importing round numbers from the former would decorate the latter. A round 5,000 in the script was that kind of import, plausible, tidy, and derived from nothing. Nobody had questioned the round number, which is the whole trouble with round numbers.
What we fixed, and what we asserted
The normative document governs. That rule was written into the family’s precedence order before this discrepancy existed, so the fix was mechanical. The script now encodes 4,900, the ten canonical test vectors were regenerated, and the regenerated set was asserted numerically identical to the published figures, with the band-label distribution asserted unchanged.
That last assertion is the substantive one. No figure anywhere in the document family sits inside the 4,900–5,000 gap, so no published index, band or worked example moved. The defect was real and its blast radius, this time, was zero.
The parallel
Aerospace keeps the canonical record of what happens when this class of defect goes unchecked. On 23 September 1999, NASA lost the Mars Climate Orbiter. The Mishap Investigation Board’s Phase I report of 10 November 1999, chaired by Arthur Stephenson, traced the root cause to ground software producing thruster impulse in pound-force seconds where the interface specification required newton-seconds. Two artifacts disagreed about a unit, the specification was authoritative, and the verification step that existed to compare them never confirmed the match.
We take one lesson from it, and not a lesson about software modesty. The comparison between implementation and specification is the control. Name the authoritative document in advance, and run the check before the thing ships rather than after.
Why we’re telling you
Because a silent fix would contradict everything the framework asks of suppliers. This framework grades suppliers on disclosure, records named non-responses, and treats silence as a bound rather than a pass. A document family built on those rules doesn’t get to fix its own defects quietly.
Our corrections policy is additive and loud. This one is logged on the errata page alongside anything readers find, and the reference implementation and vectors are published under Apache-2.0 so that the next mismatch is anyone’s to catch. The boundary in the script now matches the boundary in the text. Both are yours to check, and the checking is the point.