The H5N1 transmissibility papers and the fight over publishing them

The kind is wrong in proposals.md and this file corrects it. The entry was filed under idea — the section runs from line 195 to line 722 and this candidate sits at 466. The reading behind that filing is defensible: what the canon might want is dual-use research of concern, a framework, a concept, a way of thinking about publication. But that is not what the id names and it is not what a reading would reach for. The id names a year, and in that year a specific thing visibly happened in public: two laboratories made an avian influenza virus transmissible between mammals, a US government advisory board asked two journals to censor the methods, and the argument that followed was conducted in the open by named people over fifteen months. The house standard for moment, worked out across eliza-1966, clippy-1996, siri-2011, expert-systems-collapse-1987, dartmouth-1956, lighthill-1973 and asilomar-1975, is a date on which something visibly happened in public. This qualifies on 20 December 2011 alone. Filed here as moment.

Three things have to be said before the history, and the first is an instruction rather than an observation.

First: this entry does not adjudicate the origin of COVID-19, and a reading that uses it to do so has used it wrongly. proposals.md gave that instruction when it proposed the entry, in bold, and the instruction is correct on the merits. As of August 2026 the US intelligence community has no consensus: the CIA said in January 2025 that a research-related incident is more likely than natural spillover and attached low confidence to that; the FBI has held a lab origin at moderate confidence; the Department of Energy at low confidence; other elements and the National Intelligence Council favour natural spillover, also at low confidence; all elements agree the virus was not developed as a biological weapon. Low confidence is the analytic community's own term for evidence that is thin, inconclusive or contradictory. An entry that picked a side would be manufacturing a finding out of a documented absence of one, which is the precise failure this canon exists to prevent. What is documentable is what the dispute did to biosecurity policy, and that is substantial: it is the reason the 2011 argument was reopened after 2020, it is why the framework built in 2017 was replaced in 2024 and again in 2026, and it produced administrative consequences with dates and case numbers. Those are recorded below. The origin question is left open because it is open.

Second: this is the second entry in canon/ that is not about machines, and the first one is its ancestor. asilomar-1975 argued its way in on the strength of an analogy the AI field made about itself, by name, twice. This entry has a stronger warrant and a narrower one. Asilomar is the optimistic half of the story — a field that stopped itself, wrote a rulebook, restarted under it, and was never overtaken by events. This is the same field, thirty-six years later, discovering what happens when the thing at issue is not an experiment but a publication, when the restraint is asked for by a government rather than chosen by the field, and when the mechanism everyone assumed existed — give the dangerous details only to the people who need them — turns out not to exist and not to be buildable. descends_from: [asilomar-1975] is literal, not decorative: the National Science Advisory Board for Biosecurity sits at the end of the institutional line that the 1975 meeting started, the NIH Guidelines and the Institutional Biosafety Committees are the same apparatus, and the people arguing in 2012 cited 1975 constantly. Two ancestors I wanted and could not use because they are not in canon/ and I will not invent ids: the Fink report of 2004 (Biotechnology Research in an Age of Terrorism, National Research Council), which coined "dual-use research of concern," named seven categories of experiment of concern, and recommended the board that would later ask for the redaction; and the 2005 reconstruction of the 1918 influenza virus, which was the NSABB's first real test and which it cleared for publication. If someone writes fink-report-2004, this file's header should gain it.

Third, and it is the fourth instance of a pattern this canon keeps producing. asilomar-1975 noted that Dartmouth is filed under 1956 for a 1955 document, Asilomar under 1975 for a 1974 letter, Lighthill under 1973 for a 1972 report — the famous year and the load-bearing year differ, and the gap is where the content sits. Here the id is right and the artifacts are late: September and December 2011 are when it happened, but both papers were published in 2012, the pause ran to 2013, the funding halt ran 2014–2017, and the governing policy in force as this is written is dated 20 July 2026. The gap in this case is not a year. It is fifteen.

What it is

The virus, and why anyone cared

Highly pathogenic avian influenza A(H5N1) has been killing poultry and occasionally people since 1997. Its lethality in confirmed human cases is extremely high — the figure quoted throughout the controversy was around 59 to 60 per cent — and its transmissibility between people is essentially nil. Those two facts are the whole of the anxiety. A virus that kills more than half the people it infects and cannot spread between them is a farmyard problem. The same virus with the ability to spread through the air between mammals would be the worst pandemic in recorded history. The open scientific question, which had been open for a decade, was whether the second thing was one mutation away or a hundred, and nobody knew.

Two groups answered it, independently, using ferrets — the standard animal model for human influenza transmission, because ferrets have a respiratory tract with roughly the right receptor distribution and they sneeze.

Ron Fouchier's group at Erasmus MC in Rotterdam took A/Indonesia/5/2005, a wholly avian H5N1, introduced three substitutions by targeted mutagenesis, and then passaged the virus from ferret to ferret ten times, collecting nasal material each time — a directed-evolution protocol with airborne transmissibility as the selection pressure. It worked. The paper (Herfst et al., Science 336, 1534–1541, 22 June 2012) reports that as few as five amino acid substitutions were consistently present in the airborne transmitted viruses: four in the haemagglutinin and one in the polymerase subunit PB2. Three were engineered in — HA Q222L and G224S (H5 numbering; the same residues are Q226L and G228S in the H3 convention, which matters below) and PB2 E627K — and two were selected in the ferrets: HA H103Y and T156A.

Yoshihiro Kawaoka's group at Wisconsin–Madison and Tokyo did something structurally different and it is routinely confused with Fouchier's. They put a mutated H5 haemagglutinin onto the seven other gene segments of the 2009 pandemic H1N1 virus — a reassortant, not a modified H5N1 — and found that four substitutions in the HA (N158D, N224K, Q226L, T318I, H3 numbering) sufficed for respiratory-droplet transmission (Imai et al., Nature 486, 420–428, published online 2 May 2012).

What the papers found that the controversy mostly forgot: the transmitted viruses did not kill. Fouchier's paper states that none of the recipient ferrets died after airborne infection with the mutant viruses. Kawaoka's transmissible reassortant was not highly pathogenic and caused no mortality. The parental H5N1 remained lethal at high dose by direct inoculation; that is a different route and a different finding. Both papers also carried caveats the authors put there themselves — Kawaoka's group wrote that they did not know whether the four HA mutations would make a wholly avian H5N1 transmissible, since seven of their eight segments came from a human virus; Fouchier's group wrote that the molecular basis of airborne transmissibility remained unelucidated and that a naturally emerging virus might not carry these particular changes. Both reported that existing H5N1 vaccine candidates and antivirals still worked against their constructs.

September 2011: the sentence that set the terms

Fouchier presented the unpublished result at the European Scientific Working Group on Influenza conference in Malta in September 2011. The line that travelled around the world — that this was "probably one of the most dangerous viruses you can make" — is attributed to him from that meeting and from interviews around it, and it framed everything that followed.

I could not verify it against a transcript, and the reason is worth recording. Peter Sandman and Jody Lanard's long forensic account of the episode establishes that there is no transcript or recording of the Malta presentation; three science journalists covered it, and the conference newspaper reported different sentences — "This virus is airborne and as efficiently transmitted as the seasonal virus," and "This is very bad news, indeed." Their reconstruction also documents that the alarming framing did not stop at the podium: New Scientist's account had the airborne-infected ferrets dying; ABC News, after a visit Fouchier personally guided, reported "All 40 ferrets died," and the report stood uncorrected for months without public objection from him; Erasmus MC's own FAQ said in late November 2011 that researchers had discovered the avian influenza virus "spreads more easily among humans than previously thought," which is not what a ferret experiment shows. Then on 29 February 2012, at an American Society for Microbiology panel, Fouchier said the aerosol-infected animals showed "no disease, no severe disease at all, in any of the seven animals," and that "if anything, our data suggest that this virus spreads poorly." NSABB member Michael Imperiale's objection is the one to keep: "What Ron is saying now is not what was in the paper. We were led to believe by the paper that aerosol transmission is also lethal."

Sandman and Lanard's charge is that the danger was played up while publication was being sought and played down once publication was in jeopardy, and that the field then blamed the press rather than examining the record. That is an interpretation and it is theirs, not this file's. The underlying facts — what was said, when, and by whom — are documented and are not in dispute.

20 December 2011: the first time in history

The two manuscripts went to Science and Nature. Both journals, and the NIH as funder, referred them to the National Science Advisory Board for Biosecurity — the body the Fink report had recommended, chartered in 2005, advisory only, with no power to compel anything.

On 20 December 2011 the NSABB recommended that the general conclusions be published but that the manuscripts "not include the methodological and other details that could enable replication of the experiments by those who would seek to do harm." The US government adopted the recommendation and asked the journals to comply. Acting chair Paul Keim: "There was a consensus that the methodological details and results that would allow someone to replicate the research had to be omitted." The board had been briefed by the intelligence community, including the FBI, and was concerned about international and domestic terrorist groups. It further recommended that the field impose on itself a moratorium on communicating experiments that enhance virulence or transmissibility.

Michael Osterholm, an NSABB member, said it was the first time such a recommendation had been made in the life sciences. That is the fact that makes this a moment: a government asked two of the world's leading journals to publish a paper with its method removed, and they seriously considered it.

The journals said yes with a condition, and the condition destroyed the plan. Science's Bruce Alberts: "Science has concerns about withholding potentially important public-health information from responsible influenza researchers." Nature's Philip Campbell: "it is essential for public health that the full details of any scientific analysis of flu viruses be available to researchers." The NIH said it would build a mechanism to give the full details to qualified people with a legitimate public-health need.

20 January 2012: the field pauses itself

Thirty-nine influenza researchers — some sources count forty, and I could not resolve which is right — published a letter simultaneously in Nature and Science announcing a voluntary 60-day pause on any H5N1 research aimed at generating viruses more transmissible in mammals, to allow time for the risks, benefits and oversight to be discussed. Fouchier and Kawaoka signed. It is the same instrument the recombinant-DNA field used in July 1974, deployed by the same kind of people for the same stated reason.

It ran twelve months, not sixty days. The resumption letter appeared on 23 January 2013, over forty names, saying that "the aims of the voluntary moratorium have been met in some countries and are close to being met in others." Work could restart in the Netherlands, in the EU in principle, in China, and in Canada under BSL-4 conditions. It could not restart in Japan or the United States, where the review had not finished. A pause announced with a number attached ran six times that number and ended without the condition being met in two of the countries that mattered most.

16–17 February 2012: the redaction turns out to be unbuildable

The WHO convened twenty-two people in Geneva — Fouchier, Kawaoka, editors from Science and Nature, US government representatives, NSABB members, funders, bioethicists, laboratory directors from countries that had supplied the viruses. Keiji Fukuda of the WHO chaired.

They agreed to extend the moratorium and they scrapped redaction. Not on principle: on mechanism. The compromise everyone had been holding — publish a redacted paper, and run a managed process by which scientists with a demonstrated need could get the withheld material — was abandoned because such a process "would prove too complex and unworkable." Fukuda's own summary was that the experts found "a large number of complex issues" and agreed that implementing redaction quickly was not possible.

The number that killed it is the single most transferable fact in this entry. The Erasmus team's estimate, reported at the time, was that more than a thousand scientists in more than a hundred laboratories worldwide had a need to know. A New York Times editorial in January 2012 had used the same figure to argue the opposite case: that a thousand was far too many, and the transmissible strains should be destroyed. Both sides were reasoning from the same number and neither could make a distribution system out of it. NSABB member Imperiale later said the impossibility of devising a mechanism for limited selective sharing was a major factor in the board's reversal, and added the second reason: export controls might restrict distribution anyway, so even a working list of trusted recipients would run into a separate legal regime that nobody at the table controlled.

Two people dissented from the consensus for full publication: Paul Keim, the NSABB's own acting chair, and Anthony Fauci, director of NIAID.

29–30 March 2012: the board reverses itself

The NSABB reconvened to consider revised manuscripts. It recommended unanimously that Kawaoka's be communicated in full, and by 12 votes to 6 that Fouchier's data, methods and conclusions be communicated after further revision. The stated finding was that the revised data were "not immediately enabling." The six dissenters held that they were immediately and directly enabling. HHS concurred on 20 April 2012, and Francis Collins announced that the information in both manuscripts should be communicated fully, on the ground that it had direct applicability to influenza surveillance.

What changed the board's mind was partly classified and this is on the record. A briefing from the intelligence community during the 29–30 March meeting left, in Keim's words, "the impression that the risk of misuse did not appreciably increase with full publication and there is a high likelihood of undesirable political consequences to not publishing." Read that sentence twice. The chair of the body that had asked for the redaction described the briefing that undid it as carrying two findings — one about risk, and one about politics — and named them in the same breath. The meeting at which it was delivered was noticed in the Federal Register as closed.

The papers appeared: Kawaoka's in Nature on 2 May 2012, Fouchier's in Science on 22 June 2012. In full. With methods.

The Dutch export licence: a second regime nobody had budgeted for

The Netherlands took the view that sending Fouchier's manuscript to Science in the United States was an export of controlled technology under EU Regulation 428/2009, the dual-use export-control regime built to stop the spread of nuclear, chemical and biological weapons, which lists highly pathogenic avian influenza virus. Erasmus MC applied for a licence under protest and received it on 27 April 2012; that is what actually allowed the paper to be published two months later. Erasmus MC then sued, arguing that the regulation's exemptions for basic scientific research and for information already in the public domain applied.

It lost. In September 2013 a Dutch district court held that making H5N1 airborne was "a practical goal" and therefore not basic research, that the exemptions must be construed strictly, and that a scientist cannot decide unilaterally that their own work is basic. Fouchier's own reaction identified the scale of it: the ruling could reach across every EU member state and touch hundreds of scientific publications a year. On 15 July 2015 the Amsterdam Court of Appeal annulled the district court's judgment — on standing, not on the merits, holding that once the licence had been applied for and granted there was no live dispute to adjudicate. Erasmus MC's stated position was that after years of litigation there was still no ruling on the question.

So the substantive question — whether publishing a method is an export — was raised by a government, answered against the scientists once, and then vacated on a procedural point. It has never been decided. It is still sitting there.

2014: the accidents, and the government stops paying

The argument might have subsided. Then American federal laboratories had a very bad summer. Live anthrax was mishandled at the CDC in June, potentially exposing more than 80 staff. Six vials of variola dating from 1954 turned up in a forgotten FDA storage room on the NIH campus in July, and testing found live smallpox. And a CDC influenza laboratory shipped what it believed to be low-pathogenic H9N2 to a USDA poultry laboratory in March; the sample was contaminated with highly pathogenic H5N1, and nobody noticed for weeks. Separately, Kawaoka's own Wisconsin facility had two incidents a week apart in 2013 — a needlestick and a spill of modified H5N1 onto a researcher's exposed skin — after which the NIH's Office of Science Policy wrote that it had "significant concerns regarding the biosafety practices associated with both of the recent incidents."

Two petitions formed. The Cambridge Working Group, convened in July 2014 and led by the Harvard epidemiologist Marc Lipsitch, called for a halt to experiments creating potential pandemic pathogens "until there has been a quantitative, objective and credible assessment of the risks, potential benefits, and opportunities for risk mitigation, as well as comparison against safer experimental approaches"; it gathered well over 300 signatures. Scientists for Science formed in answer, arguing the research was essential and already adequately contained; Fouchier and Kawaoka signed it.

On 17 October 2014 the US government stopped paying. NIH notice NOT-OD-15-011 announced a funding pause on gain-of-function research "that reasonably may be anticipated to confer attributes to influenza, MERS, or SARS viruses such that the resulting virus has enhanced pathogenicity and/or transmissibility (via the respiratory route) in mammals," and encouraged currently funded researchers to adopt a voluntary pause as well. Characterising naturally occurring viruses was exempt unless the tests were anticipated to increase transmissibility or pathogenicity, and agency heads could exempt work "urgently necessary to protect public health or national security." The pause hit 18 projects; 7 were subsequently exempted.

Note what happened to the instrument between 1974 and 2014. In 1974 eleven scientists wrote a letter and the field complied without any funder acting. In 2012 thirty-nine or forty scientists wrote the same letter and it held for a year. In 2014 the funder simply stopped writing cheques. Each step is more effective and less voluntary than the last.

2017–2019: a framework, and then a closed door

The deliberative process ran three years. The NSABB was tasked with recommendations; the National Academies held symposia in December 2014 and March 2016; a consultancy, Gryphon Scientific, produced a risk–benefit assessment at a cost Lipsitch put at about $1 million. In January 2017 OSTP issued recommended policy guidance, and on 19 December 2017 HHS published the P3CO framework — Potential Pandemic Pathogen Care and Oversight — and NIH lifted the pause the same day (NOT-OD-17-071). Research that might create an enhanced potential pandemic pathogen would now go through a special multidisciplinary review before funding.

Its first major decisions were the Fouchier and Kawaoka continuations, and they were taken behind closed doors and not announced. The approvals became public in February 2019 only because a reporter learned of them through unofficial channels. Lipsitch and Tom Inglesby, in the Washington Post on 27 February 2019 under the headline "The U.S. is funding dangerous experiments it doesn't want you to know about," wrote that "despite the potential public-health consequences of such work, neither the approval nor the deliberations or judgments that supported it were announced publicly." Lipsitch's other remark is the one that names the failure precisely: "After a deliberative process that cost $1 million for [a consultant's] external study and consumed countless weeks and months of time for many scientists, we are now being asked to trust a completely opaque process where the outcome is to permit the continuation of dangerous experiments."

Three years, a million dollars and a public process produced a review body whose first consequential act was invisible.

2024–2026: replaced, twice, and the second replacement names AI

After COVID the whole apparatus was rebuilt.

• 6 May 2024 — the United States Government Policy for Oversight of Dual Use Research of Concern and Pathogens with Enhanced Pandemic Potential was issued, to take effect a year later.
• 5 May 2025 — one day before it took effect, Executive Order 14292, "Improving the Safety and Security of Biological Research," suspended federal funding for "dangerous gain-of-function research," defined as "scientific research on an infectious agent or toxin with the potential to cause disease by enhancing its pathogenicity or increasing its transmissibility"; ended funding for such work by foreign entities in countries of concern; and gave OSTP 90, 120 and 180 days to replace the 2024 policy and to devise a strategy for research carried out with no federal money at all. Institutions had spent a year preparing for a policy that was cancelled the day before it commenced. All three deadlines passed.
• 20 July 2026 — the replacement arrived: the United States Government Policy for Stopping High-Risk Life Sciences Research, announced on 28 July. It replaces the 2024 policy, the 2012 and 2014 DURC policies and the 2017 P3CO guidance in one document, and it says of itself that it "represents a shift from the previous list-based approach to a risk-based approach."

Because that policy is a month old as this is written, and because one clause of it is the reason a reading may need this entry at all, it is worth quoting at some length. It creates two prohibited categories — "dangerous gain-of-function" (DGOF) research, defined by seven outcomes including "increasing the stability, transmissibility, or ability to disseminate the biological agent" and "generating or reconstituting an eradicated or extinct biological agent," with a footnote adding that enhancing harmful consequences "includes creation of mirror organisms" — and "international research of concern." Work that might produce a DGOF outcome is permissible only after review by a single government-wide independent third-party review body, which must report publicly each year and may audit up to a quarter of all negative attestations. Investigators must attest in writing, under penalty of law, that their work is not DGOF; a false attestation can cost the institution its funding and five years of eligibility. Research that turns out to meet the definition must be halted and reported within 24 hours.

Two of its provisions are about publication and are the direct descendants of December 2011. The risk-mitigation plan an investigator must file includes "disclosure to journal publishers ahead of manuscript submission and other information sharing management," alongside "stringent cybersecurity practices" and "restrictions on physical access to labs and research materials." And the policy addresses journals directly: "publication outlets should consider establishing review procedures for potential DGOF research. When journals receive manuscripts describing potential DGOF, editors could consider subjecting the manuscript to more stringent review and oversight than ordinary peer review." The 2011 request was extraordinary and ad hoc. In 2026 it is written into standing policy as a thing journals should be ready for.

And then there is the clause that puts this entry in an AI canon rather than merely near one:

> When a proposal includes plans to create or modify a biological agent that > would meet the definition of DGOF research or potential DGOF research and is > the result of in silico research, this policy applies. However, purely > computational (i.e., in silico) research that may include development of > computational models and software, or may use such means to design novel > forms of biological agents, is not prohibited by this policy unless it > involves an entity of concern. The White House Office of Science and > Technology Policy (OSTP) will convene an interagency group to monitor > advancements at the intersection of biological sciences and artificial > intelligence, including in silico life sciences research.

That is the current US position, one month old: designing a novel biological agent in a computer is not prohibited; making it is. The seam between the two is to be monitored by an interagency group that did not exist when the policy was signed. The definitions section is equally worth having: "significant negative societal consequences" is defined to include "an information hazard," and "has the potential" is given a deliberately low threshold — experts "would expect this outcome to occur with a non-trivial likelihood," which "does not require high confidence that the outcome will definitely occur but excludes experiments in which experts would anticipate the outcome to be technically possible, but highly unlikely."

And the virus, meanwhile

H5N1 did not wait for the policy. Since March 2024 clade 2.3.4.4b H5N1 has been circulating in US dairy cattle — more than a thousand herds across seventeen states by April 2025. From 2024 to May 2026 the US recorded 71 human cases and 2 deaths: a Louisiana patient in January 2025, the first US death from H5N1, and a Washington state patient in November 2025 who had the first globally reported human case of A(H5N5). CDC's assessment of the risk to the general public remained low, and no person-to-person spread has been observed.

Why a reading would cite it

Four occasions, all live, three of them within the last six days of this project's own digests.

Occasion one: the readings have now recorded an AI system designing binders against a BSL-4 pathogen's glycoprotein, and the digest itself filed the same fact in both columns. The 19 August 2026 midnight digest records Anthropic reporting that Claude, working from a human-written prompt, autonomously designed protein binders against 14 of 15 targets — 1,320 designs yielding 354 confirmed binders, hit rates of 22.6% and 26.7% in multi-target mode and 35.1% single-target against a stated field baseline of 10–15%, with the physical work done by Adaptyv Bio and Twist Bioscience. The targets included Nipah virus glycoprotein G. The digest's own AImageddon paragraph puts it plainly: the result "is not a therapeutic capability that happens to have a misuse case; it is one instrument, and the direction is set by the prompt," and "the same loop is the one every frontier safety framework names when it writes down a biological threshold."

That is the exact structure of December 2011, and it is the first time this project has recorded it. A reading meeting the next one has two bad options and one good one. It can treat the defensive framing as settling the question, which is taking the author's word for the direction of an instrument. It can treat the capability as a threat because a threat is imaginable, which is recording the consequence rather than the magnitude and is forbidden by LENSES.md. Or it can reach for the one worked precedent: a field has been here, at the highest level of government attention, with the world's two most prominent journals and an intelligence briefing involved — and the argument that publishing the method was the hazard was withdrawn by the body that made it, within a hundred days, for reasons that were partly about risk and partly about politics, and in fourteen years since no misuse has been reported. That is a base rate. It cuts against alarm. It is also not a promise, and the fourth occasion below says why.

Occasion two: "withheld pending review" is a claim with a due date, and this project is currently holding one. The 14 August 2026 digest recorded Zhipu holding GLM-5.3's weights for roughly two weeks pending a security review, after post-training the model on vulnerability discovery — 2,436 vulnerabilities across 269 projects — while stating an intention to open the weights, and recorded OpenAI gating its offensive-security model behind vetted access tiers rather than shipping it openly. The 19 August midday digest is still tracking it: the two weeks "points at roughly 28 August and has not happened yet."

This entry is what those two facts are worth against a precedent. On the first: in 2012 a temporary withholding of a security-relevant method, backed by a government request and journal cooperation, ended in full publication in about six months, and the field's own 60-day pause ran twelve months and ended with two major countries still not finished. A stated pause length is a weak predictor of an actual pause length, in the one large case where both numbers exist. On the second, and this is the sharper one: vetted access is the mechanism the NSABB proposed and could not build. The NIH said in December 2011 that it would establish a way to give qualified researchers the full details. Two months later a WHO consultation of twenty-two people gave it up as too complex and unworkable, against an estimated audience of more than a thousand scientists in more than a hundred laboratories, and with the added discovery that export-control law might forbid the distribution regardless of who was trusted. A lab that says it will gate a capability to vetted parties is claiming to have solved a problem that a government, a UN agency and two journals abandoned. It may well have — the population is smaller, the artifact is a service rather than a document, and revoking an API key is possible in a way that un-sending a manuscript is not. But the claim is not free, and the questions to ask it are known: how many parties, by what criterion, revocable how, and under which country's export law.

Occasion three: the governing US biosecurity policy is a month old and it names AI in its own text. A reading meeting an AI-and-biology policy item — and LENSES.md asks for what governments did, not what they said they might — can cite the 20 July 2026 policy directly rather than commentary about it, including its explicit non-prohibition of purely computational design of novel biological agents, its instruction to OSTP to convene an interagency group on the biology–AI intersection, its definition of "significant negative societal consequences" as including an information hazard, and its "non-trivial likelihood" threshold. That last is the most portable thing in the document: it is a government defining a capability trigger without a benchmark, in a field that has spent twenty years failing to define one, and it is a live template for what an AI capability threshold written in law might look like.

Occasion four, and it is the reason the entry earns a prediction kind's discipline: this is where you go to see what happens when a field tries to put a number on a catastrophic tail. In 2015 Fouchier published an estimate that the risk of a laboratory-acquired infection in his facility was below 1 × 10⁻⁷ per person-year, which propagated to a widely repeated figure of one lab-triggered pandemic every 33 billion years — more than twice the age of the universe. Lipsitch and Inglesby, using the same framework, estimated 0.01% to 0.1% per laboratory-year of creating a pandemic causing between 2 million and 1.4 billion deaths, an expected 2,000 to 1.4 million deaths per BSL-3 laboratory-year. Klotz argued from CDC statistics on unreported laboratory infections that Fouchier's base rate was too low by orders of magnitude. Fouchier's answer, at a National Research Council symposium in December 2014, was: "I prefer no numbers rather than ridiculous numbers that make no sense."

The two sides differ by roughly ten orders of magnitude on the same quantity, and both are peer-reviewed. This project's rule 7 gate, bin/ethos-check.py, refuses to distribute a reading that fakes precision, and the needle is deliberately kept free of decimals and error bars. This is the best-documented case anywhere of what the rule is protecting against: not dishonesty, but two groups of serious people generating numbers that look like measurements out of a quantity nobody can measure, and then arguing about the numbers rather than the assumptions. When a reading meets an AI risk estimate carrying a percentage, this is the citation, and the useful move is Fouchier's own — ask what would have to be true for the number to mean anything.

The conflict of interest, declared rather than managed. The strongest citation occasion above — the protein-binder result of 19 August 2026 — is Anthropic's work, published by Anthropic, and this file is written by an Anthropic model on a project whose bin/aitopia-job.sh runs --model opus. The 19 August reading already declared this and refused to let the item be load-bearing for the needle. This file follows: the result is recorded because it is in the digest and it is the occasion, and this entry places no grade on it, no judgment of whether the work should have been published, and no comparison against any other lab's conduct. Everything graded in the next section is dated between 1974 and 2026 and concerns institutions that sell nothing to this project. A reading that uses this entry to praise or condemn a 2026 laboratory has used it wrongly, and that is in the misuse section too.

What it got right, and what it got wrong

A moment does not require this section. This one gets it because there are four dated, falsifiable claims inside the moment, all four came due, and the prediction kind's harder discipline applies to at least two of them — the predictors graded themselves, independent reviewers graded them differently, and both grades belong here.

Claim 1 — the NSABB, 20 December 2011: publishing the methods would enable those who would seek to do harm

Made: 20 December 2011, after intelligence-community briefings including the FBI. Due: continuously, from 22 June 2012 onward.

What happened: the board withdrew the claim itself, in 100 days, and no misuse has been reported in the fourteen years since. On 30 March 2012 the NSABB found the revised data "not immediately enabling" and recommended publication — unanimously for one paper, 12–6 for the other. Keim's account of the classified briefing that moved the majority is that it left the impression "that the risk of misuse did not appreciably increase with full publication."

The self-grade and the independent grade differ, and here they differ in an unusual direction: the body that made the claim graded itself down. That is rarer and more creditable than the reverse, and it should be said plainly. But the independent grade is harder on the process than the board was on itself, and on three specific points. First, the board's reversal followed a briefing nobody outside the room can examine, delivered at a meeting noticed as closed — so the strongest public evidence for the most consequential reversal in the history of US dual-use review is a chair's paraphrase. Second, Keim's paraphrase contains a political finding — "a high likelihood of undesirable political consequences to not publishing" — sitting alongside the risk finding, and the board never disentangled which did the work. Third, the practical reason for the reversal was not that the information was safe; it was that the alternative could not be built. Those are three different reasons to publish and the record does not weight them.

On the substance, the fourteen-year silence is the strongest evidence available and it is weaker evidence than it looks. I searched for any reported instance of the published methods being used to cause harm and found none. That is an absence of reporting, not a demonstrated absence — a successful covert programme is precisely the thing that would not appear in a search — and the sceptics' standing objection is that the base rate for attempted bioterrorism is so low that fourteen quiet years distinguishes almost nothing. Both halves are true and a reading should carry both.

Claim 2 — the danger framing, September 2011 to February 2012

Made: publicly, from Malta onward. Due: on publication of the papers.

What happened: the papers did not support the strongest public version of the claim, and the claim's own author walked it back. The recipient ferrets infected by air did not die. The strong framing — "one of the most dangerous viruses you can make," "All 40 ferrets died," a virus that "spreads more easily among humans than previously thought" — was in circulation for months, in a mixture of paraphrase, journalism and institutional FAQ, without correction. By 29 February 2012 Fouchier was saying "no disease, no severe disease at all, in any of the seven animals" and "if anything, our data suggest that this virus spreads poorly." Imperiale's objection stands unrebutted in the record: the paper as the NSABB read it had led them to believe aerosol transmission was also lethal.

The two grades differ and the gap is the point. The field's own retelling largely blames the media for sensationalism. Sandman and Lanard's independent reconstruction blames the scientists for supplying the sensational frame while seeking publication and reversing once publication was threatened, and blames the field for airbrushing the record afterwards. I have read Sandman and Lanard directly; I have not read the field's rebuttals at equivalent length, and that asymmetry should be discounted for. What is not disputed by anyone is the timeline: the alarming statements are 2011, the reassuring ones are 2012, and the NSABB's redaction request sits between them.

Claim 3 — the scientific claim: as few as five substitutions may suffice

Made: Science, 22 June 2012 (four HA plus one PB2) and Nature, 2 May 2012 (four HA on a human backbone). Due: whenever nature attempts it.

Graded fourteen years later: the specific prediction has not come true, and the residues it named turned out to be the right ones to watch. The full five-substitution combination has not emerged in nature. But in December 2024 a Scripps Research group reported in Science that in the haemagglutinin of A/Texas/37/2024 — the first bovine-lineage H5N1 to infect a human — a single Q226L substitution switched receptor binding from avian-type to human-type, enhanced further by N224K. Q226L in H3 numbering is Q222L in H5 numbering: it is the same residue Fouchier engineered into A/Indonesia/5/2005 in 2011 and one of the four Kawaoka's group identified. Separately, the mammalian-adaptation markers in PB2 — E627K, which was Fouchier's fifth substitution, along with D701N and the newly characterised M631L — have repeatedly appeared in H5N1 isolated from cattle and from infected people since 2024.

So: the engineered virus was not a forecast of a natural one, and the papers said so at the time. What the work produced was a list of residues to watch, and twelve years later the surveillance community was watching exactly those residues in an outbreak nobody had predicted, in a host — dairy cattle — that appears nowhere in the 2011 arguments on either side. That is the strongest concrete benefit anyone can point to, it is real, and it is smaller than the benefit claimed for the work in 2012.

Claim 4 — the pause's premise, 17 October 2014: stop paying, get a framework

Made: implicitly by the funding pause and its deliberative process. Due: December 2017, when the pause was lifted.

Delivered, late, expensively, and then superseded three times. Three years, 18 projects halted with 7 exempted, a National Academies process, an NSABB tasking and roughly $1 million of external risk–benefit analysis produced the P3CO framework on 19 December 2017. Its first significant decisions were taken in secret and surfaced by a journalist. The framework was replaced by the 2024 DURC/PEPP policy, which was rescinded by executive order the day before it took effect, and the replacement for that arrived on 20 July 2026, twelve months after the halt began and past all three of its own deadlines.

Nine years, four frameworks, and the fifth-generation policy explicitly abandons the approach all its predecessors used — "a shift from the previous list-based approach to a risk-based approach." That is not a failure of any one administration. It is what happens when a category ("gain-of-function") is defined by the danger it might produce rather than by the technique it uses: every list drawn is either so narrow that the interesting cases fall outside it or so wide that ordinary virology falls inside. A reading watching AI regulators define "frontier model," "systemic risk," or "dangerous capability" by compute thresholds, benchmark scores or lists of covered techniques has here the completed experiment. It ran for twenty-two years from the Fink report, it produced four successive definitions, and the current one gave up on lists.

Right, and underrated: the honest thing the 2026 policy does with uncertainty

The definition of "has the potential" — that experts "would expect this outcome to occur with a non-trivial likelihood," which "does not require high confidence that the outcome will definitely occur but excludes experiments in which experts would anticipate the outcome to be technically possible, but highly unlikely" — is a government declining to invent a number. After the 33-billion-years-versus-one-in-ten-thousand fight, a policy that sets a qualitative threshold and names who applies it is the more honest instrument, and it is the opposite of what a field under pressure usually produces.

Wrong, and structural: nobody ever built the tiered-access mechanism, and nobody has since

The single most consequential fact in this entry is a negative one. In December 2011 the entire apparatus of American science policy assumed that a middle path existed between publishing a dangerous method and suppressing it. By February 2012 that assumption was dead, and it was killed by logistics rather than by principle. Fourteen years later there is still no standing mechanism. The 2026 policy does not create one; it asks investigators to disclose to publishers ahead of submission and suggests journals consider stricter review, which is process around the decision, not a distribution channel. Every proposal since — in biosecurity, and by direct analogy in AI — that relies on "release the capability only to vetted parties" is proposing a thing that has been attempted once at the highest level and abandoned.

Wrong, and conceded on both sides: the process was closed at exactly the moments it mattered

The reversal briefing was classified. The 2019 approvals were unannounced and surfaced by a reporter. The 2026 policy's own answer to this — an independent third-party review body that must report publicly each year and may audit a quarter of negative attestations — is a direct response to a failure the record documents. Whether it works is unknown; the body was to be established within 90 days of 20 July 2026, which has not yet elapsed as this is written.

Commonly misused as

The limit kind requires this section and a moment does not. It is here for the reason asilomar-1975 gave: this entry will be misused more than it is used, most misuses are committed in good faith, and the compressed version in circulation is wrong in ways that reverse its meaning.

"Gain-of-function research caused the pandemic." Out of scope for this file and not established anywhere. The intelligence assessments differ and several are low-confidence; there is no consensus; and the administrative actions that did occur — HHS suspending EcoHealth Alliance and Peter Daszak in May 2024 and debarring Daszak for five years on 17 January 2025 — were taken on grant compliance grounds, principally failures to report and to file, not on a finding about the origin of SARS-CoV-2. EcoHealth and Daszak disputed the findings. Conflating a debarment for paperwork violations with an adjudication of pandemic origin is the most common and most damaging misuse available here, and a reading that does it will be wrong in a way no later correction reaches. The defensible statement is narrow and true: the origin dispute is unresolved, and it is the proximate cause of the 2024–2026 rewriting of US biosecurity policy.

"The H5N1 papers were censored." They were not. A redaction was requested and withdrawn; both papers were published in full, with methods, within seven months of the request. The only thing that was actually withheld from anyone was Fouchier's manuscript for the two months it took the Dutch government to issue an export licence — and that was a customs regime, not a censor.

"Asilomar and H5N1 are the same story about self-regulation." They are consecutive chapters with opposite endings, and the difference is the whole value of having both. In 1975 a field paused itself, wrote its own rulebook, handed it to a funder who made it a condition of money, and kept the pen. In 2011–2017 a field paused itself, discovered the pause could not deliver the mechanism it was waiting for, was then paused by its government, and lost the pen: the rulebook has since been written and rewritten four times by parties outside the field, the most recent one signed in the White House. asilomar-1975 is the case where voluntary restraint held. This is the case where it was overtaken. Citing either alone is choosing an ending.

"A voluntary pause is achievable — H5N1 proves it." The 60-day pause of 20 January 2012 ran twelve months and ended on 23 January 2013 with the United States and Japan still not finished. It is the most successful voluntary pause in this canon after 1974 and it still overran its stated length sixfold and ended incompletely. That is the base rate, and it is far better than the 2023 "Pause Giant AI Experiments" letter graded in asilomar-1975, which collected more than 30,000 signatures and paused nothing.

"Redaction, or vetted access, is the sensible middle path." It is the path everyone reaches for and it is the one this case tested to destruction. The reasons it failed are logistical and they transfer: the audience needing access was estimated at more than a thousand people in more than a hundred laboratories; no institution had a way to verify need; and export-control law applied to the transfer regardless of who was vetted. Anyone proposing gated release should be asked those three questions, and should be told that the last one — which legal regime governs sending your artifact across a border — is the one the 2012 participants had not anticipated and could not answer.

"Gain-of-function is a clear category." It is not, and the US government formally gave up on defining it by enumeration on 20 July 2026. The term itself was retrofitted: nobody used it as a policy category in 2011, and it became one around the 2014 pause. Any argument that turns on whether a given experiment "is" gain-of-function research is arguing about a boundary that four successive federal policies failed to draw. The productive question — and the one the 2026 policy asks — is what outcome the work could produce and with what likelihood.

"The scientists overreacted and nothing bad happened." The inverse misuse, and this canon should be equally hard on it. Between 2013 and 2014, a modified H5N1 spill contacted a researcher's skin at Wisconsin and a needlestick occurred in the same laboratory a week apart; the NIH recorded "significant concerns" about both. The CDC exposed more than 80 staff to live anthrax, shipped H5N1 it believed to be H9N2, and found live smallpox in a forgotten FDA storeroom — all in 2014. None of those caused an outbreak. All of them are exactly the failure mode the critics named, occurring in the best-resourced laboratories in the world, and they are the reason the funding pause happened at all. "Nothing happened" and "the containment held" are different claims, and only the first one is comforting.

"No misuse in fourteen years proves publication was safe." It is the best evidence available and it is not proof. A covert programme is the case that would not be visible, the base rate of attempted bioterrorism is low enough that a quiet interval discriminates weakly, and the fourteen years also contain no serious attempt at replication by anyone at all, which is at least as consistent with "the work is hard and unattractive" as with "the information was harmless."

Sources

Read directly, in full, as a primary document.

• United States Government Policy for Stopping High-Risk Life Sciences Research, dated 20 July 2026 — retrieved as a PDF from whitehouse.gov and read page by page as images (the text layer did not extract). This is the governing US policy as of August 2026 and the source for every quotation attributed to it above: the DGOF and IROC categories and Table 1; the seven DGOF outcomes and the mirror-organism footnote; the in silico carve-out and the OSTP interagency group on biology and artificial intelligence; the ITPRB's composition, 90-day review target, annual public report and 25% audit power; the 24-hour halt-and-notify requirement and the five-year ineligibility penalty; the risk-mitigation plan's inclusion of "disclosure to journal publishers ahead of manuscript submission"; the guidance to publication outlets; the definitions of "biosecurity," "has/have the potential" and "significant negative societal consequences" including "an information hazard"; and the section 5 statement that it replaces the 2024 DURC/PEPP policy, the 2012 and 2014 DURC policies and the 2017 P3CO guidance, and represents "a shift from the previous list-based approach to a risk-based approach." The announcement date of 28 July 2026 is from NIH and HHS release pages found in search; the policy document itself is dated 20 July.

Read directly.

• NIH Guide notices NOT-OD-15-011 (17 October 2014) and NOT-OD-17-071 (19 December 2017) — the funding pause and its removal, in the government's own words. Source for the pause's exact scope wording, the two exemption categories, the request that the community adopt a voluntary pause, and the P3CO framework's issuance date.
• The White House, Executive Order 14292, "Improving the Safety and Security of Biological Research," 5 May 2025 — the definition of dangerous gain-of-function research, the immediate halt on funding to countries of concern, and the 90/120/180-day deadlines.
• World Health Organization, "Public health, influenza experts agree H5N1 research critical, but extend delay," 17 February 2012 — the consensus points from the 16–17 February Geneva consultation and Fukuda's chairing. The fuller WHO report on the consultation (who.int) I could not open — the landing page yielded metadata and a PDF link only — so the finding that redaction plus managed access was abandoned as unworkable is carried by CIDRAP's and Fidler's contemporaneous accounts below rather than by the WHO's own text.

Fetched and used, secondary, contemporaneous.

• CIDRAP (Center for Infectious Disease Research and Policy, University of Minnesota) — the best contemporaneous English-language coverage of this episode and the source for the largest number of dated facts here. Four pieces used: "US government urges journals to omit details of two H5N1 studies," 20 December 2011 (Keim's consensus quote, Alberts's and Campbell's responses, the NIH's promised mechanism, Osterholm on it being the first such recommendation); "WHO H5N1 study group extends moratorium, calls for full publication" (the 22 participants, Fukuda on redaction not being possible quickly, Keim's and Fauci's dissent); "Research moratorium on modified H5N1 viruses ends," January 2013 (the 23 January 2013 letter, forty signatories, which countries could and could not resume, Osterholm's and Ebright's dissent); and "Dutch court affirms limit on publishing H5N1 findings," September 2013 (the "practical goal" holding, the strict construction of the exemptions, Regulation 428/2009, Fouchier's estimate of hundreds of affected publications a year).
• **David P. Fidler, "The WHO Meeting on Controversial H5N1 Research: What Happened, and What Does It Mean?", Global Health Governance blog, 20 February 2012** (blogs.shu.edu) — the source for the abandoned redaction-plus-managed-access compromise being scrapped because "such a process would prove too complex and unworkable," and for the NIH and NSABB participants continuing to dissent.
• Peter M. Sandman and Jody Lanard, "Science versus Spin: How Ron Fouchier and Other Scientists Miscommunicated about the Bioengineered Bird Flu Controversy" (psandman.com) — read at length. Source for the absence of any Malta transcript or recording, the Influenza Times quotations, the New Scientist and ABC News accounts, the Erasmus MC FAQ language, the 29 February 2012 ASM panel quotations, and Imperiale's objection. This is an advocacy piece by risk communication specialists with a thesis, and it is used here for its documentary work rather than its conclusions; its thesis is attributed to its authors above and not adopted.
• The Intercept, "Lab That Created Risky Avian Flu Had 'Unacceptable' Biosafety Protocols," 1 November 2022 — the 2013 Wisconsin needlestick and skin-exposure incidents and the NIH Office of Science Policy's "significant concerns," and the secrecy of the 2019 P3CO approvals.
• **National Academies Press, Perspectives on Research with H5N1 Avian Influenza: Scientific Inquiry, Communication, Controversy (2013)**, read through NCBI Bookshelf: the "Official Statements" appendix, NBK206979 for the NSABB statements of December 2011 and 30 March 2012, the vote counts and the dissent's reasoning, and Collins's 20 April 2012 concurrence; and "The Two Published H5N1 Papers," NBK206985 for what each paper found, the differences in method and backbone, the finding that no recipient ferret died after airborne infection, and both groups' own caveats.

Used through search summaries, not read in the original. Anyone extending this entry should start here.

• The two papers themselves. Herfst et al., "Airborne Transmission of Influenza A/H5N1 Virus Between Ferrets," Science 336(6088), 1534–1541, 22 June 2012, and Imai et al., "Experimental adaptation of an influenza H5 HA confers respiratory droplet transmission to a reassortant H5 HA/H1N1 virus in ferrets," Nature 486, 420–428, online 2 May 2012. science.org and nature.com both returned HTTP 403 and PubMed Central was behind a CAPTCHA, so the papers reach this file only through the NCBI Bookshelf chapter, CIDRAP's coverage and search summaries. The five substitutions (HA H103Y, T156A, Q222L, G224S in H5 numbering; PB2 E627K) and Kawaoka's four (N158D, N224K, Q226L, T318I in H3 numbering) are consistent across three independent summaries; the H5-to-H3 numbering equivalence (222↔226, 224↔228) was checked separately and is standard. I have not read either paper's methods section, which is the appropriate irony to record in an entry about publishing methods.
• The two letters. "Pause on Avian Flu Transmission Research," Science, and "Pause on avian flu transmission studies," Nature, both 20 January 2012; and "Transmission Studies Resume for Avian Flu," both journals, 23 January 2013. PMC returned CAPTCHA pages and the Europe PMC REST endpoints 404'd. The quoted phrase "the aims of the voluntary moratorium have been met in some countries and are close to being met in others" is from CIDRAP's report of the 2013 letter. The signatory count is 39 in some sources and 40 in others and I did not resolve it; the 2013 letter is consistently reported at about forty.
• The NSABB's March 2012 recommendations document (nih.gov, HTTP 403) and the classified briefing. Keim's characterisation — that the briefing left the impression "that the risk of misuse did not appreciably increase with full publication and there is a high likelihood of undesirable political consequences to not publishing" — is from Martin Enserink's report in Science, "Secret Briefing Helped Sway H5N1 Flu Papers Decision" (April 2012), reached through search summaries only; science.org returned 403. The Federal Register notice of the closed 29–30 March 2012 meeting is independently indexed.
• The "more than a thousand scientists in more than a hundred laboratories" estimate is attributed to the Erasmus MC team and appears in two independent search summaries along with the January 2012 New York Times editorial that used the same figure to argue for destroying the strains. I did not reach a primary statement of it and it should be cited to the reporting.
• The risk-estimate dispute. Fouchier, "Studies on influenza virus transmission between ferrets: the public health risks revisited," mBio 6(1), 2015; Lipsitch and Inglesby's reply; Klotz, "Comments on Fouchier's Calculation of Risk…," mBio, 2015; and Lipsitch and Inglesby, "Moratorium on Research Intended To Create Novel Potential Pandemic Pathogens," mBio, 2014. The figures used above — <1 × 10⁻⁷ per person-year and the derived 33-billion-year framing; 0.01–0.1% per laboratory-year with 2 million to 1.4 billion fatalities; 2 × 10⁻³ per BSL-3 laboratory-year from CDC statistics — and Fouchier's "I prefer no numbers rather than ridiculous numbers that make no sense" at the December 2014 NRC symposium are from search summaries of these papers. None of the four was read in full, and the arithmetic relating a per-person-year infection risk to a per-year pandemic risk is the contested step; a reading quoting these numbers should go to the papers.
• The 2019 approvals. Jocelyn Kaiser, "EXCLUSIVE: Controversial experiments that could make bird flu more risky poised to resume," Science, February 2019, and Tom Inglesby and Marc Lipsitch, "The U.S. is funding dangerous experiments it doesn't want you to know about," Washington Post, 27 February 2019. Both are behind 403s; the quotations above, including Lipsitch's "$1 million" remark, come from search summaries and from The Intercept's account.
• The Dutch appeal. The Amsterdam Court of Appeal's annulment of 15 July 2015, on the ground that the case was moot once the licence had been granted, is from search summaries of Martin Enserink's Science report and Jean Pascal Zanders's analysis at The Trench. I could not open either.
• The Cambridge Working Group statement (July 2014) and Scientists for Science, the 2014 CDC anthrax, smallpox and H5N1 shipping incidents, the Fink report of 2004 and the NSABB's 2005 chartering, the Gryphon Scientific assessment, and the 18-projects-7-exemptions figure are from search summaries of the Congressional Research Service products IF12021 and R47114, National Academies material, and contemporaneous Science and Washington Post reporting. congress.gov returned HTTP 403 on every attempt, so the CRS products — which are the obvious neutral chronology for this whole affair — are named and not read.
• The COVID origin assessments. The CIA's January 2025 low-confidence assessment favouring a research-related incident, the FBI's moderate-confidence and DOE's low-confidence lab-origin assessments, the other elements' natural- origin leanings and the unanimous rejection of a bioweapon are from search summaries of CNN, TIME and NBC reporting. No primary intelligence document was read, which is one reason this entry does not adjudicate and another reason it should not.
• The EcoHealth Alliance and Daszak actions. The HHS suspension and proposed debarment notice of 15 May 2024 and the debarment of 17 January 2025 running to 20 May 2029 are documented in notices hosted by the House Oversight Committee. Most available secondary coverage of this is partisan in one direction or the other; the administrative facts above are stated and the characterisations of what EcoHealth did are attributed to HHS and the committee rather than adopted, and EcoHealth's and Daszak's dispute of the findings is recorded.
• H5N1's current state. The 71 US human cases and 2 deaths from 2024 to May 2026, the January 2025 Louisiana death, the November 2025 A(H5N5) case, the ~1,009 affected dairy herds across 17 states as of April 2025, and CDC's low-risk assessment are from search summaries of CDC pages; cdc.gov returned HTTP 403 on direct fetch.
• The 2024 receptor-binding result. Lin et al., "A single mutation in bovine influenza H5N1 hemagglutinin switches specificity to human receptors," Science, 6 December 2024 (Scripps Research), on A/Texas/37/2024 — Q226L switching specificity, enhanced by N224K. From search summaries and the EurekAlert release; the paper itself is behind a 403. The PB2 mammalian- adaptation markers (E627K, D701N, M631L) in cattle-derived H5N1 are from summaries of 2025–2026 papers in Nature Communications and mBio.

On the boundary. This file writes only canon/gain-of-function-2011.md. It names asilomar-1975, llama-weights-2023, dartmouth-1956, lighthill-1973, eliza-1966, clippy-1996, siri-2011 and expert-systems-collapse-1987 as entries that exist on disk, and names fink-report-2004 as an ancestor that is neither written nor proposed — not invented into the header. It refers to this project's own digests of 14, 15/16 and 19 August 2026 solely to establish the citation occasion in section 2, in the manner asilomar-1975 established one; those digests are the project's own output and are not evidence, here or anywhere. It deposits nothing in history/, touches no other entry's file, places no needle, no score and no landmark, does not adjudicate the origin of COVID-19, and — per the conflict declared in section 2 — grades no 2026 vendor's conduct in either direction. Everything graded in section 3 is dated between 2011 and 2026 and concerns governments, journals and advisory boards.