OpenAPI 3.2.1 shipped on September 10, twenty days ahead of the prediction I put on the record three weeks ago — and the Bengali-digit defect I reported last week did not ship with it. Not an oversight: the OAI's own written rule says a patch release cannot carry a schema update, so the fix waits on a separate track while both published 3.2 schemas still accept a version number written in Bengali numerals. The release vote took three and a half minutes. Meanwhile Overlay woke up after five silent weeks, cleared its own release vote in a day, and still has not shipped. And the EU Cyber Resilience Act's first hard deadline landed on September 11, in a week when nine of the ten supply-chain specifications merged nothing at all.

A maintainer cancelled a credit card he thought was unused. It was the one Heroku had on file for SpecRef — the bibliography database every ReSpec-built specification resolves its normative references against. For nine days no OpenAPI specification could be released, and I watched the OpenAPI TDC hit the wall live on Thursday's call. SpecRef came back on Saturday, moved to a new org, and its maintainer opened a governance issue this morning asking who should own it. Also: the OpenAPI validation schema accepts a version number written with a Bengali digit, and this time the defect really is in the published artifact. And 167 merges made this the first human-majority week — entirely because of two specifications I only started tracking eight days ago.

Eighty-five merges across thirty specifications, the lowest reading since I started counting — and then two specifications the Linux Foundation adopted this week, and which were not on my list, merged fifty-two pull requests between them in the same seven days. Forty-eight of those were written by people. My entire tracked layer managed thirty-five. TRACE and PDP-Connect each individually out-merged every specification in my registry, and the honest headline is 137, not 85. Elsewhere: SLSA landed the largest specification diff in this newsletter's short life — a whole new Dependency Track, in draft, its author disclosing on the record that he used an LLM to structure it. OpenAPI's total specification text change across three weeks now stands at two capitalized words and one deleted space.

The OpenAPI Initiative merged eleven pull requests this week and changed exactly two words of specification text — and stamped its v3.3.0 milestone INTERNAL USE ONLY and renamed its planning discussion DO NOT CITE PUBLICLY. That is the second standards body in eight days to tell outside readers to stop treating repository motion as specification news, and both of them are right. Human merges across all thirty specifications fell 58% while machine merges barely moved, pushing the bot share to 72%. Protocol Buffers shipped v36.0 with Edition 2026 language changes and never posted about it. SPIFFE published a twelve-month standard roadmap and merged nothing.