Eighty-five merges across thirty specifications, the lowest reading since I started counting — and then two specifications the Linux Foundation adopted this week, and which were not on my list, merged fifty-two pull requests between them in the same seven days. Forty-eight of those were written by people. My entire tracked layer managed thirty-five. TRACE and PDP-Connect each individually out-merged every specification in my registry, and the honest headline is 137, not 85. Elsewhere: SLSA landed the largest specification diff in this newsletter's short life — a whole new Dependency Track, in draft, its author disclosing on the record that he used an LLM to structure it. OpenAPI's total specification text change across three weeks now stands at two capitalized words and one deleted space.

The OpenAPI Initiative merged eleven pull requests this week and changed exactly two words of specification text — and stamped its v3.3.0 milestone INTERNAL USE ONLY and renamed its planning discussion DO NOT CITE PUBLICLY. That is the second standards body in eight days to tell outside readers to stop treating repository motion as specification news, and both of them are right. Human merges across all thirty specifications fell 58% while machine merges barely moved, pushing the bot share to 72%. Protocol Buffers shipped v36.0 with Edition 2026 language changes and never posted about it. SPIFFE published a twelve-month standard roadmap and merged nothing.