Summary

  • At 17:18 UTC on 12 May 2010, Douglas Onyango posted what he called the latest Soft Landing text to AFRINIC's RPD mailing list ahead of AFRINIC-12. AFRINIC's later official history says this updated proposal received the new reference AFPUB-2010-v4-001. Yet the retrieved email does not display that identifier and its text retains an internal Date field of 27-11-09.
  • The substance did move. Compared with the retrieved 28 September 2009 text, the 12 May version changed the exhaustion minimum from /23 to /24, kept /23 as the maximum, retained the ceiling of four allocations per LIR, and retained a /12 reserve with Board-release discretion. It also repeated a complete prohibition on use outside the region, then had to be corrected the next morning to restore a proposed exception of no more than 10 percent for connectivity back to resources inside the region.
  • A new reference can improve discovery and prevent incompatible drafts from being conflated. It cannot replace an immutable snapshot, a parent-child crosswalk, a reproducible diff, an issue disposition or an authority instrument. It also cannot turn a private registry's bookkeeping role into sovereignty, ownership, regulation, punishment or adjudication.

Analysis

A new identity that the event document did not show

The most revealing feature of the 12 May reissue is not a grand theory of IPv4 exhaustion. It is an ordinary documentary contradiction. At 17:18 UTC, Douglas Onyango sent the RPD list what he described as the latest Soft Landing proposal, circulated in preparation for AFRINIC-12. AFRINIC's later official history identifies that date as the point at which the updated text received the new reference AFPUB-2010-v4-001. But the retrieved message itself contains no such reference. Inside the reposted proposal, the Date field still reads 27-11-09.

Both records matter, but they prove different things. The mailing-list message proves what was placed before readers at that time. The later history proves that AFRINIC subsequently described the reissue as a reference change. Neither record, taken alone or together, supplies a complete chain from the prior documentary identity to the new one. The archive does not expose, in the retrieved evidence, a signed crosswalk identifying the exact parent text, an immutable child snapshot, matching content hashes or an AFRINIC-authored line-by-line diff.

A reader can reconstruct some of the change by comparing messages, but the institution did not package that reconstruction as part of the identity event.

That distinction is more than archival neatness. A reference number answers a narrow question: what label has an institution attached to an artifact? A redline answers another: what changed between two defined artifacts? A process record answers a third: what did participants do with the proposed changes? An authority instrument answers a fourth: what permits an institution or office-holder to take an operative step? Collapsing those questions invites the label to do work it cannot do.

The absence of the announced identifier from the event email does not prove misconduct or a breach of some numbering rule. No retrieved source establishes the formal numbering convention, the immediately superseded reference or the reason for assigning the new identity. Nor does the old internal date establish motive. It does, however, make the record harder to authenticate by inspection. A reader encountering the May timestamp, a November date inside the text and a reference supplied only by later history must decide which signals define the version. Good version control removes that ambiguity before it becomes a governance argument.

The archive's current state deepens, rather than resolves, the lineage question. The official archive is now titled AFPUB-2010-v4-005, and its history says that a version dated 25 January 2011 became AFPUB-2010-v4-005-draft-01. The retrieved record does not explain the complete crosswalk from the -001 identity attributed to 12 May 2010 to the eventual -005 identity. It would be wrong to infer the missing intermediate contents, the rationale for renumbering or a violation of an unknown formal rule. The warranted finding is narrower: the visible identifiers do not themselves furnish a reproducible lineage.

The bounded redline: one changed range, two retained controls

The closest retrieved pre-reissue full text is the message of 28 September 2009. It is useful here only as a defined comparator. In that text, the minimum allocation during exhaustion was /23 and the maximum was also /23. No LIR could receive more than four allocations during the exhaustion period. The proposal set aside a /12 reserve and gave the Board discretion to replenish that reserve according to demand and community interest. It also prohibited use of the relevant resources outside the AFRINIC region.

The 12 May repost changed the allocation range. It made /24 the minimum while keeping /23 as the maximum. That is a substantive amendment: it permitted a smaller allocation at the floor without enlarging the ceiling. The limit of four allocations per LIR remained. So did the /12 reserve and materially similar Board discretion over its release or replenishment. These are the few fields required to understand the reissue; the story does not need a general tutorial on address-prefix notation or a retelling of the proposal's entire life.

Even this compact comparison shows why a full-text repost is not a sufficient change record. A reader scanning for new language might notice the move from /23 to /24, or might not. A reader relying on the old internal date could mistake the text for a copy of the November proposal. A reviewer might correctly identify the changed minimum while assuming that every issue recorded after the previous meeting had also been incorporated. The work of comparison shifts from the author and custodian, who know what they changed, to every recipient, who must independently discover it.

The reserve provision presents a second documentary warning. A 4 December 2009 outcome post described a requested change from /16 to /12. Yet the retrieved 28 September text already stated /12, and the 12 May text also stated /12. The record available here does not establish whether the outcome note referred to another version, misstated the baseline or captured a discussion not reflected in the retrieved post. It must remain an unresolved inconsistency. Silently choosing an explanation would convert archival uncertainty into invented history.

That unresolved point illustrates the proper role of a redline. A diff cannot decide which proposal ought to prevail, and it cannot manufacture consensus. But it can identify the exact source and target snapshots, expose whether a field changed, and reveal when an issue ledger appears to describe a different baseline. It turns a vague dispute about recollection into a precise question about documents. That is institutional infrastructure, not clerical decoration.

The economics make precision consequential. Near a scarce pool, the minimum allocation size affects which requests can be accommodated and how finely the remaining space can be distributed. A repeat-allocation ceiling affects how often an LIR can return. Reserve rules determine what is withheld and who may decide to release it. Geography clauses constrain where allocated resources may be used. Small textual changes can therefore redistribute opportunities, planning costs and exposure to refusal. BTW's remaining-pool research supports that bounded mechanism; it does not make the later exhaustion history the subject of this event.

The correction that a version label could not perform

The geography clause supplies the clearest test. The 12 May post repeated the rule that none of the resources covered by the proposal could be used outside the region. On 13 May at 06:48 UTC, a participant identified as SM noted that this paragraph was the reason the proposal had returned to the list and recalled the change proposed by Mark Elkins on 27 November. At 07:04 UTC, minutes later, Onyango apologized and reposted the text. The corrected clause allowed no more than 10 percent to be used outside the region, and only for connecting back to resources located inside the region.

The record establishes an omission and a swift correction. It does not establish whether the omission was deliberate, why it occurred, how many participants read the first version or whether every participant saw the correction before the meeting. It would be reckless to call it deception, bad faith or illegality. The stronger and fully supported conclusion is procedural: a proposal said to have a new identity still carried an important clause that did not reflect a recorded prior amendment, and the defect became visible only because a participant compared the text and raised it.

The content of the correction mattered. A complete prohibition and a conditional 10 percent exception are not stylistic alternatives. They define different operational permissions and different geographic constraints. In a system where address use touches network design and interconnection, that difference could shape topology, contracts and cost. LARUS's continuity analysis supplies the general propagation mechanism: unclear registry decisions and records can travel into routing arrangements, transfers, agreements and operational risk. LARUS is not a witness to the 2010 exchange; the list messages are.

Its contribution is to explain why a documentary defect at a coordination institution need not remain a documentary defect downstream.

Had the 12 May package included an immutable parent snapshot and a signed redline, the changed /24 minimum would have appeared immediately, while the unchanged geography prohibition could have been checked against the issue ledger. The discrepancy would not have required every reader to remember or rediscover the November discussion. The correction could then have been published as a new child snapshot, with its own hash, timestamp and author, rather than as another full-text message whose relationship to the previous one readers had to infer.

This counterfactual does not argue that references should be abandoned. Without a new identity, a materially revised text might be conflated with the September version, increasing confusion. The lesson is that an identifier should anchor a chain rather than float above it. A label without a parent link and diff can make a document easier to cite while leaving its substance harder to verify. In the worst case, later readers may mistake continuity of naming for continuity of text.

The strongest defence of the reissue

There is a serious defence of AFRINIC's documentary choice. The proposal had passed through two meetings without consensus and had undergone material editing. Assigning a fresh reference could avoid collisions among drafts, improve discoverability and give participants approaching AFRINIC-12 a stable object to discuss. Publishing full text to an open mailing list was also better than circulating an unavailable document. A diligent participant could place the 28 September and 12 May messages side by side and identify differences manually. The next-day exchange demonstrates that the list could detect and correct an error.

That defence deserves full credit. Version identity has genuine governance value. Institutions need stable handles for proposals, minutes, objections and decisions. If every material revision retained an indistinguishable name, citations would become ambiguous and discussions could cross without participants realising they were using incompatible texts. The correction also shows a functioning element of open review: someone noticed a problem, the author acknowledged it, and a revised full text followed quickly.

But the defence reaches only so far. Manual reconstruction was possible, not reliable by design. The event message lacked the reference later associated with it. Its internal date pointed backward. It changed the allocation floor and left other controls in place without showing which fields moved. It repeated a geography clause that the prior outcome record indicated should change. Then it acquired a corrected successor within roughly fourteen hours.

A recipient had to know which earlier post to choose, locate it, compare full bodies, reconcile the old date, notice the geography problem, find the correction and decide which version was meant for the meeting.

Those costs are not proof that participants failed. They are evidence that the archive made individual diligence substitute for institutional traceability. The distinction matters because governance records outlive the people who remember how they were produced. Years later, a policy researcher, operator, member, court or new staff member cannot depend on mailing-list memory. A stable identifier earns its keep only when it exposes the artifact it names and its relationship to the artifacts before and after it.

The appropriate answer is therefore not fewer references but better ones. Each material version should have an immutable public text, a content hash, an explicit parent and child identifier, the change author's name, a precise publication time, the reason for revision, and a line-level as well as field-level diff. Each disputed issue should be linked to a disposition such as accepted, rejected, deferred or unresolved. The record should name the meeting or last-call stage for which the text was prepared, show its current process status and link the exact instrument relied on for any approval or implementation.

Such a system separates three forms of certainty that are often confused. Documentary certainty establishes which bytes belong to which version. Procedural certainty establishes what a defined process recorded about that version. Authority certainty establishes who may act, for whom, within what scope and under which instrument. A reference identifier can contribute to the first. It cannot, by itself, establish the second or the third.

A reissue was not ratification

The 12 May act belongs within a narrow process boundary. It followed no-consensus outcomes at AFRINIC-10 and AFRINIC-11, but those meetings are not the subject here. AFRINIC's later history says that the proposal reached consensus with modifications at AFRINIC-12 on 3 June 2010. A later last-call record opened further comment, and the official history says objections returned the proposal to discussion. These later acts show why the May reissue cannot be described as adoption, ratification or implementation.

The word consensus in an institutional record proves that the institution recorded consensus under its process. It should not be expanded into a vote, unanimity, representation of every operator, ownership, sovereignty or public mandate unless separate evidence establishes those propositions. The same discipline applies to labels such as community, stewardship and regional resources. They may describe the institution's vocabulary and activity; they do not prove the legitimacy or scope claimed by the vocabulary itself.

This is the policy-mirror principle applied to the archive. A policy manual and its version history reveal what an institution believes it can administer. They should accurately reflect operational reality. They do not create the authority they describe. AFRINIC, as a private bookkeeper and uniqueness coordinator, may maintain registries and apply bounded distribution rules to its unallocated pool when valid private instruments permit it. It does not thereby become a sovereign, legislature, state regulator, police force, prosecutor, punisher, owner or adjudicator for Africa or for the Internet.

Scarcity does not turn a clerk into a landlord. The fact that number resources must be uniquely coordinated, and that the final unallocated pool required choices, makes accurate records more important. It does not convert the registry's ledger entry into title over running networks or its document number into law. Once resources are operating in networks, any continuing claim of control must be traced to a valid instrument and bounded by the rights of the affected principal. A proposal reference is not that instrument.

The May reissue therefore supports two conclusions at once. First, the institution had a legitimate documentary need to distinguish a revised proposal from earlier texts. Second, the resulting identifier, even if perfectly recorded, could prove no more than identity. It could not enact geographic restrictions, supply agreement, validate Board discretion, or authorize an adverse act against an operator. Those propositions require their own process and authority evidence.

What the record establishes, and what it leaves open

A disciplined account can say six things with confidence. AFRINIC's later history assigns the -001 reference to the 12 May update. The event email does not display it. The text inside that email retains the date 27-11-09. Against the retrieved September comparator, the allocation minimum moved from /23 to /24 while the /23 maximum and four-allocation limit remained. The /12 reserve and Board-release discretion remained visible in both texts. The geography clause first repeated the complete prohibition and was corrected the next morning to a narrow 10 percent exception.

The same account must preserve the gaps. It cannot name the formal predecessor reference immediately superseded on 12 May. It cannot state the numbering rule or why -001 was chosen. It cannot explain why the archive later used -005 or reconstruct every intermediate version. It cannot identify the exact snapshot projected or debated at AFRINIC-12. It cannot establish that a formal redline never existed somewhere else, only that none is present in the retrieved record. It cannot decide why the internal date was old, why the identifier was absent, or why the geography amendment was omitted from the first repost.

Nor can it resolve the reserve discrepancy. The December outcome record speaks of a move from /16 to /12, whereas the retrieved September full text already says /12. That could reflect a different baseline, a recording error or another explanation, but none is established. The uncertainty belongs in the history until stronger evidence supplies a verifiable answer. An archive earns trust by marking uncertainty, not by sanding it away.

The decision test for any present policy record follows directly. Can an independent reader retrieve the exact parent and child texts? Do their published hashes match the downloaded files? Does the record classify changes according to technical, economic, rights-affecting and editorial impact? Does it show the relevant process stage and current disposition? Does it identify the principal whose rights or operations are affected? Does it link the authority instrument for the act contemplated? Can an outside reviewer reproduce how each objection was disposed of?

Can the institution reverse a mistaken documentary or operational act without disrupting running networks?

These questions are not demands for bureaucratic excess. They are a proportionate response to the asymmetry of recordkeeping. The institution and author know what they intended to change; the recipient sees only what was published. The institution controls the reference namespace; the reader bears the cost of reconstructing it. The institution can later cite its own history; an affected operator may have to disprove an inference assembled from incomplete records. Publishing lineage and diffs moves evidence toward the party best placed to supply it.

A crosswalk is an argument made inspectable

A complete crosswalk would do more than place identifiers in chronological order. It would name the exact September snapshot used as the comparison base, state whether another intervening text displaced it, and bind the 12 May transmission to the bytes AFRINIC intended readers to review. It would distinguish the first May repost from the corrected 13 May text, rather than leaving both under a conversational description such as the latest proposal. It would then connect those artifacts to the version discussed in June and, ultimately, to the later -005 archive identity without implying that their clauses were identical.

For each link, the crosswalk should answer a small set of falsifiable questions. Which file is the parent? Which file is the child? Who authorised the change in documentary status? When was the child made available? Why was it created? Which fields changed? Which objections led to those changes? What process destination was intended? A hash would let anyone confirm that a downloaded file matches the preserved artifact. A signature or comparable tamper-evident record would show who vouched for the manifest. Neither device would settle the merits, but both would make later alteration or mistaken substitution easier to detect.

The distinction between line-level and field-level comparison is important. A line diff reveals inserted, deleted and moved words. A field ledger tells a reviewer what those words do. In this case, the allocation floor changed, the ceiling did not, the repeat limit did not, and the reserve remained visible. The geography rule appeared unchanged on 12 May, then changed on 13 May. A field classification would mark the allocation floor as economic and technical, and the geography clause as operational and rights-affecting.

That tells reviewers where attention is most valuable without asking them to accept the custodian's judgment about whether the amendment is good.

An issue-to-text matrix would add a further safeguard. The 4 December outcome record identified topics that participants wanted changed after the previous meeting. A matrix could point from each topic to the exact clause in the new version and state whether it was accepted, rejected, deferred or unresolved. The geography omission would then have appeared as a mismatch between disposition and text. The reserve inconsistency would also have been visible: the issue record described /16 becoming /12, but the selected September comparator already contained /12.

Rather than forcing a speculative answer, the matrix could flag the baseline as unresolved.

This design distributes attention fairly. Mailing-list veterans may remember which message contains the relevant amendment; a new participant will not. An author can scan a draft against a private working copy; an operator arriving later sees only the archive. Someone fluent in prefix notation may instantly recognise the significance of /24 replacing /23 at the minimum; another affected reader may understand the commercial consequence without spotting the textual change. An institutional redline makes access to the delta less dependent on tenure, specialist memory or time available for forensic comparison.

It also prevents the meaning of latest from drifting. Latest at 17:18 UTC on 12 May referred to a text with a complete geographic prohibition. By 07:04 UTC on 13 May, the corrected repost contained a conditional exception. If both are described later as the May proposal, a statement that was accurate for one snapshot can be wrongly attributed to the other. Precise child identities make time part of the record. They allow a reviewer to ask not only what the proposal said, but what it said at the moment a participant relied on it.

The record should also distinguish correction from erasure. The first May text remains historically important because it shows what was actually sent and what prompted the response. Preserving it does not endorse its clause. The corrected successor should carry a clear notice, a link back and a disposition explaining the amendment. This pattern supports institutional learning: readers can see the defect, the speed of response and the resulting text. Overwriting the first artifact would remove accountability; leaving two unlinked full-text messages imposes avoidable ambiguity.

Finally, a crosswalk must stop at documentary truth. It can demonstrate that a particular text descended from another, that an identified author changed it, and that an institution assigned it a status. It cannot demonstrate that every affected principal agreed, that a recorded consensus represented all operators, or that the resulting rule binds a person outside the scope of the relevant instrument. Making the documentary argument inspectable is valuable precisely because it keeps that argument within its proper bounds.

Rights impact begins where bookkeeping reaches operations

The allocation floor, reserve discretion and geography clause sit inside a proposal about distributing an unallocated pool, but their effects do not end in a document. They can influence which requests qualify, when organisations can expand, how they connect facilities and where they bear transition costs. That operational reach is why a registry must classify the effect of each change and identify the principal exposed to it. It is not evidence that the registry owns the addresses, the networks or the region.

The burden of production should follow control of the evidence. AFRINIC controls its reference namespace and its canonical historical presentation, so it should produce the version manifest and diff. An office-holder asserting a power should produce the instrument granting that power. An operator challenging a clause should identify the affected operation and preserve the version relied upon. This allocation does not predetermine the merits. It makes each participant supply the evidence uniquely within its reach, reducing the temptation to use institutional labels as a shortcut.

Rights impact also changes the standard for correction. A typographical edit may need only a logged successor. A changed allocation range requires economic and technical explanation. A geography restriction requires explicit notice, identification of who is affected and a path to contest the interpretation. An implementation step that could disrupt running networks requires a reversible plan. The more a textual change travels from bookkeeping into operations, the less acceptable it becomes to rely on an unlabeled full-text replacement.

The 13 May correction demonstrates the benefit of contestability without proving that the wider process was legitimate. A participant could point to the mismatch, and the author could issue a corrected text. That is useful evidence of responsiveness. The next institutional step should have been to turn the exchange into durable structure: bind each snapshot, classify the amendment, record why it changed and identify which version proceeded. Responsive conversation and authoritative recordkeeping are complements, not substitutes.

Three counterfactuals and one durable boundary

Consider first a signed redline accompanying the 12 May reissue. Reviewers would have seen the new /24 floor next to the retained /23 ceiling. They would also have seen that the geography paragraph remained unchanged despite the previous issue record. The likely benefit would not have been automatic agreement. It would have been faster, more equal access to the object of disagreement. The next-day correction could have been attached to the same chain without ambiguity.

Consider next a materially revised text with no new identity. Discussion could have mixed the September and May proposals under one label. Citations might have pointed to different clauses while appearing to point to the same proposal. The absence of a new reference would therefore have imposed its own costs. This is why the correct remedy is a fuller identity system, not a rejection of identifiers.

Consider finally a reference with no crosswalk. That is close to the condition preserved by the retrieved record: a later history supplies -001, the event email supplies full text and an old internal date, and later history ends under -005. A reader can do detective work, yet a future official can still cite the identifier as though it proved seamless continuity. Metadata then creates an aura of institutional pedigree without exposing the substantive path.

The durable boundary is instrument first. A registry record describes an artifact and should reflect operational fact. It cannot create legitimacy, ownership or authority. If an allocation rule, geographic condition, reserve decision or later administrative act affects a principal, the institution must show the contractual, constitutional, judicial or other valid instrument that permits the action. Reference, process and authority must be linked, but never treated as interchangeable.

That boundary protects the registry too. A private coordinator need not claim public power to perform valuable work. Accurate uniqueness records, predictable allocation administration and continuity services are substantial functions. Their credibility grows when the institution says exactly what a document number proves and refuses to load it with claims it cannot bear. The 12 May episode is a lesson in modest institutional strength: identify the text, expose the change, record the disagreement, cite the instrument and leave legitimacy to evidence rather than typography.