The life of a record

A record is not a single, frozen snapshot forever. It is born, it can be edited, and it can be unpublished. What makes it trustworthy is not that nothing ever changes, it is that what cannot change never does, and everything that can change leaves a trace instead of quietly overwriting history.

Every record answers two independent questions, and confusing them is the most common misreading of how the registry works:

Question	What decides it
Does this record exist, and who owns it?	Its lifecycle state: active, awaiting an owner, or unpublished.
Is this record public?	Its level: Verified records are public, Registered ones are private. See Directory.

An active record can be private (the common case: a free Registered record). A record can also exist without an owner yet. Neither of those facts says anything about whether it is listed publicly, that is decided only by verification.

Almost every record is created the ordinary way: someone registers it themselves and owns it from the start. A record can also exist without an owner attached yet, marked unclaimed, waiting for the person it refers to (or a representative acting for them) to come forward and take control through a claim. An unclaimed record is not a lesser or provisional record, it holds its THB number, date and hash exactly like any other; it simply has no owner attached until someone claims it.

Three fields are protected by a database rule that rejects any change, whether from the owner or an administrator:

• The THB number (registry_code): the external reference to the record. If it could change, every past citation of it would break.
• The registration date (registered_at): if this were editable, the record would prove anteriority of nothing.
• The slug: the record’s public URL identifier. A changeable slug would let old links resolve to a different record.

These three are enforced at the database level, not just in the interface: any attempt to change them is rejected regardless of who makes the request or through which path.

The content hash works a little differently, and it is worth being precise about it. A record’s descriptive fields, the avatar’s name, its type, its scope, where it operates, and the responsible person’s name, are editable by the owner. Freezing the hash forever at registration would mean that the moment you fixed a typo in the avatar’s name, the hash would stop matching the record and would look tampered with, forever.

Instead, the hash is current: it always reflects the latest saved version of those fields, recomputed automatically on every edit that touches them. What is truly permanent is not one hash frozen at the top of the record, it is the full history. Every version, starting with version 1 at registration, is archived permanently in an append-only log that nothing can update or delete, each with its own hash and the exact data that produced it.

A record can be unpublished by its owner. It stops appearing in search and in the public API, but its page keeps answering, with a dated 410 Gone notice rather than a plain 404. The difference matters: a 404 says “nothing here”, a 410 says “this existed, and it was deliberately taken down on this date”. The registry never quietly erases a trace, it marks it as closed. And the THB number that record held is retired with it, never reassigned to anything else.

A record you look at today can be trusted to mean what it says, because the parts that would matter for a dispute, when it was declared and by whom, cannot be rewritten after the fact, and the parts that legitimately change over time do so in the open, with every prior state still on record.