The ledger design ages well because it separates the artifact from the host - and the dotnet out-of-band release this weekend shows why that matters. A self-contained app or a container image carries its own runtime, so "host patched" and "application covered" stay different rows even after a successful update. The state that describes missing evidence ("we have not checked what this artifact bundles") is exactly what dotnet --list-runtimes can't give you for those deployments. Curious how you'd represent container rebuilds in the ledger: one row per image digest, or per application with the digest as evidence?