diff --git a/data/backlinks.json b/data/backlinks.json
index 0c91df7..6118934 100644
--- a/data/backlinks.json
+++ b/data/backlinks.json
@@ -1,20 +1,4 @@
 [
-  {
-    "framework": "AIUC-1",
-    "control_id": "2026-03-27",
-    "control_name": "1.0.0",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Initial release — full mapping DSGAI01–DSGAI21 to AIUC-1"
-      }
-    ]
-  },
   {
     "framework": "AIUC-1",
     "control_id": "A",
@@ -1161,118 +1145,6 @@
       }
     ]
   },
-  {
-    "framework": "AIUC-1",
-    "control_id": "Date",
-    "control_name": "Version",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Change"
-      }
-    ]
-  },
-  {
-    "framework": "AIUC-1",
-    "control_id": "DSGAI01, DSGAI04, DSGAI05, DSGAI10, DSGAI12, DSGAI16, DSGAI17",
-    "control_name": "B — Security",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "AIUC-1",
-    "control_id": "DSGAI02, DSGAI03, DSGAI06, DSGAI07, DSGAI08, DSGAI09, DSGAI14, DSGAI15, DSGAI18, DSGAI21",
-    "control_name": "A — Data & Privacy",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "AIUC-1",
-    "control_id": "DSGAI02, DSGAI06, DSGAI09, DSGAI13, DSGAI18, DSGAI20, DSGAI21",
-    "control_name": "E — Accountability",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "AIUC-1",
-    "control_id": "DSGAI05, DSGAI20",
-    "control_name": "C — Safety",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "AIUC-1",
-    "control_id": "DSGAI12, DSGAI19",
-    "control_name": "D — Reliability",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "AIUC-1",
-    "control_id": "DSGAI20",
-    "control_name": "F — Society",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
   {
     "framework": "AIUC-1",
     "control_id": "E",
@@ -1548,22 +1420,6 @@
       }
     ]
   },
-  {
-    "framework": "AIUC-1",
-    "control_id": "Primary DSGAI entries",
-    "control_name": "AIUC-1 Domain",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Status"
-      }
-    ]
-  },
   {
     "framework": "CIS Controls v8.1",
     "control_id": "12.4 Establish and maintain architecture diagram",
@@ -34224,22 +34080,6 @@
       }
     ]
   },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "2026-03-27",
-    "control_name": "1.0.0",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Initial release — full mapping DSGAI01–DSGAI21 to NHI Top 10"
-      }
-    ]
-  },
   {
     "framework": "OWASP NHI Top 10",
     "control_id": "Agent credentials exposed in memory, logs, tool payloads",
@@ -34592,22 +34432,6 @@
       }
     ]
   },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "Date",
-    "control_name": "Version",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Change"
-      }
-    ]
-  },
   {
     "framework": "OWASP NHI Top 10",
     "control_id": "Decommissioned pipeline identities remain in lineage records",
@@ -34640,182 +34464,6 @@
       }
     ]
   },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI entries most affected",
-    "control_name": "NHI Risk",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI02, DSGAI07, DSGAI08, DSGAI09",
-    "control_name": "NHI-5 Over-Privileged NHI",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI02, DSGAI07, DSGAI09, DSGAI12",
-    "control_name": "NHI-7 Long-Lived",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI02, DSGAI09, DSGAI14",
-    "control_name": "NHI-6 Insecure Storage",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Platform"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI03, DSGAI06, DSGAI16",
-    "control_name": "NHI-2 Secret Leakage",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "DevSecOps"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI04, DSGAI07, DSGAI08, DSGAI19",
-    "control_name": "NHI-9 NHI Reuse",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI04, DSGAI08",
-    "control_name": "NHI-4 Insecure Authentication",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Platform"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI13, DSGAI16, DSGAI17",
-    "control_name": "NHI-3 Third-Party NHI",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Security"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI16, DSGAI17",
-    "control_name": "NHI-8 Env Isolation",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "DevSecOps"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI18, DSGAI20, DSGAI21",
-    "control_name": "NHI-10 Human Use",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI21",
-    "control_name": "NHI-1 Improper Offboarding",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
   {
     "framework": "OWASP NHI Top 10",
     "control_id": "Embedding store service account with cross-tenant read access",
diff --git a/data/entries/ASI10.json b/data/entries/ASI10.json
index bfe72e8..627368d 100644
--- a/data/entries/ASI10.json
+++ b/data/entries/ASI10.json
@@ -1200,6 +1200,14 @@
       "LLM04",
       "LLM10"
     ],
+    "dsgai_2026": [
+      "DSGAI16",
+      "DSGAI03",
+      "DSGAI19",
+      "DSGAI02",
+      "DSGAI17",
+      "DSGAI06"
+    ],
     "agentic_top10": [
       "ASI01",
       "ASI02",
@@ -1210,14 +1218,6 @@
       "ASI07",
       "ASI08",
       "ASI09"
-    ],
-    "dsgai_2026": [
-      "DSGAI16",
-      "DSGAI03",
-      "DSGAI19",
-      "DSGAI02",
-      "DSGAI17",
-      "DSGAI06"
     ]
   },
   "changelog": [
diff --git a/data/entries/DSGAI21.json b/data/entries/DSGAI21.json
index fea057a..8b4ec60 100644
--- a/data/entries/DSGAI21.json
+++ b/data/entries/DSGAI21.json
@@ -651,90 +651,6 @@
       "confidence": "unreviewed",
       "reviewed_by": []
     },
-    {
-      "framework": "AIUC-1",
-      "control_id": "Primary DSGAI entries",
-      "control_name": "AIUC-1 Domain",
-      "tier": "Foundational",
-      "scope": "Both",
-      "notes": "Status",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "AIUC-1",
-      "control_id": "DSGAI02, DSGAI03, DSGAI06, DSGAI07, DSGAI08, DSGAI09, DSGAI14, DSGAI15, DSGAI18, DSGAI21",
-      "control_name": "A — Data & Privacy",
-      "tier": "Foundational",
-      "scope": "Both",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "AIUC-1",
-      "control_id": "DSGAI01, DSGAI04, DSGAI05, DSGAI10, DSGAI12, DSGAI16, DSGAI17",
-      "control_name": "B — Security",
-      "tier": "Foundational",
-      "scope": "Both",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "AIUC-1",
-      "control_id": "DSGAI05, DSGAI20",
-      "control_name": "C — Safety",
-      "tier": "Foundational",
-      "scope": "Both",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "AIUC-1",
-      "control_id": "DSGAI12, DSGAI19",
-      "control_name": "D — Reliability",
-      "tier": "Foundational",
-      "scope": "Both",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "AIUC-1",
-      "control_id": "DSGAI02, DSGAI06, DSGAI09, DSGAI13, DSGAI18, DSGAI20, DSGAI21",
-      "control_name": "E — Accountability",
-      "tier": "Foundational",
-      "scope": "Both",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "AIUC-1",
-      "control_id": "DSGAI20",
-      "control_name": "F — Society",
-      "tier": "Foundational",
-      "scope": "Both",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "AIUC-1",
-      "control_id": "Date",
-      "control_name": "Version",
-      "tier": "Foundational",
-      "scope": "Both",
-      "notes": "Change",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "AIUC-1",
-      "control_id": "2026-03-27",
-      "control_name": "1.0.0",
-      "tier": "Foundational",
-      "scope": "Both",
-      "notes": "Initial release — full mapping DSGAI01–DSGAI21 to AIUC-1",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
     {
       "framework": "OWASP NHI Top 10",
       "control_id": "Machine credentials used for ingestion operations — no individual attribution",
@@ -765,130 +681,6 @@
       "confidence": "unreviewed",
       "reviewed_by": []
     },
-    {
-      "framework": "OWASP NHI Top 10",
-      "control_id": "DSGAI entries most affected",
-      "control_name": "NHI Risk",
-      "tier": "Foundational",
-      "scope": "Both",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "OWASP NHI Top 10",
-      "control_id": "DSGAI21",
-      "control_name": "NHI-1 Improper Offboarding",
-      "tier": "Foundational",
-      "scope": "Both",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "OWASP NHI Top 10",
-      "control_id": "DSGAI03, DSGAI06, DSGAI16",
-      "control_name": "NHI-2 Secret Leakage",
-      "tier": "Foundational",
-      "scope": "Both",
-      "notes": "DevSecOps",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "OWASP NHI Top 10",
-      "control_id": "DSGAI13, DSGAI16, DSGAI17",
-      "control_name": "NHI-3 Third-Party NHI",
-      "tier": "Foundational",
-      "scope": "Both",
-      "notes": "Security",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "OWASP NHI Top 10",
-      "control_id": "DSGAI04, DSGAI08",
-      "control_name": "NHI-4 Insecure Authentication",
-      "tier": "Foundational",
-      "scope": "Both",
-      "notes": "Platform",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "OWASP NHI Top 10",
-      "control_id": "DSGAI02, DSGAI07, DSGAI08, DSGAI09",
-      "control_name": "NHI-5 Over-Privileged NHI",
-      "tier": "Foundational",
-      "scope": "Both",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "OWASP NHI Top 10",
-      "control_id": "DSGAI02, DSGAI09, DSGAI14",
-      "control_name": "NHI-6 Insecure Storage",
-      "tier": "Foundational",
-      "scope": "Both",
-      "notes": "Platform",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "OWASP NHI Top 10",
-      "control_id": "DSGAI02, DSGAI07, DSGAI09, DSGAI12",
-      "control_name": "NHI-7 Long-Lived",
-      "tier": "Foundational",
-      "scope": "Both",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "OWASP NHI Top 10",
-      "control_id": "DSGAI16, DSGAI17",
-      "control_name": "NHI-8 Env Isolation",
-      "tier": "Foundational",
-      "scope": "Both",
-      "notes": "DevSecOps",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "OWASP NHI Top 10",
-      "control_id": "DSGAI04, DSGAI07, DSGAI08, DSGAI19",
-      "control_name": "NHI-9 NHI Reuse",
-      "tier": "Foundational",
-      "scope": "Both",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "OWASP NHI Top 10",
-      "control_id": "DSGAI18, DSGAI20, DSGAI21",
-      "control_name": "NHI-10 Human Use",
-      "tier": "Foundational",
-      "scope": "Both",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "OWASP NHI Top 10",
-      "control_id": "Date",
-      "control_name": "Version",
-      "tier": "Foundational",
-      "scope": "Both",
-      "notes": "Change",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
-    {
-      "framework": "OWASP NHI Top 10",
-      "control_id": "2026-03-27",
-      "control_name": "1.0.0",
-      "tier": "Foundational",
-      "scope": "Both",
-      "notes": "Initial release — full mapping DSGAI01–DSGAI21 to NHI Top 10",
-      "confidence": "unreviewed",
-      "reviewed_by": []
-    },
     {
       "framework": "NIST SP 800-218A",
       "control_id": "PW.1.1-PS",
@@ -1202,11 +994,12 @@
       "ASI02"
     ],
     "dsgai_2026": [
+      "DSGAI02",
+      "DSGAI09",
       "DSGAI01",
       "DSGAI03",
       "DSGAI07",
       "DSGAI08",
-      "DSGAI02",
       "DSGAI06",
       "DSGAI12",
       "DSGAI13",
@@ -1217,7 +1010,6 @@
       "DSGAI17",
       "DSGAI14",
       "DSGAI15",
-      "DSGAI09",
       "DSGAI16",
       "DSGAI10",
       "DSGAI19",
diff --git a/data/entries/LLM10.json b/data/entries/LLM10.json
index 4bd8494..0ba49fd 100644
--- a/data/entries/LLM10.json
+++ b/data/entries/LLM10.json
@@ -1072,17 +1072,6 @@
     }
   ],
   "crossrefs": {
-    "llm_top10": [
-      "LLM01",
-      "LLM03",
-      "LLM08",
-      "LLM02",
-      "LLM04",
-      "LLM05",
-      "LLM09",
-      "LLM07",
-      "LLM06"
-    ],
     "agentic_top10": [
       "ASI02",
       "ASI05",
diff --git a/data/frameworks/aiuc-1.json b/data/frameworks/aiuc-1.json
index 428abcd..2655baf 100644
--- a/data/frameworks/aiuc-1.json
+++ b/data/frameworks/aiuc-1.json
@@ -92,61 +92,20 @@
       "title": "Society (full domain)",
       "description": "Foundational",
       "kind": "control"
-    },
-    {
-      "control_id": "Primary DSGAI entries",
-      "title": "AIUC-1 Domain",
-      "description": "Status",
-      "kind": "control"
-    },
-    {
-      "control_id": "DSGAI02, DSGAI03, DSGAI06, DSGAI07, DSGAI08, DSGAI09, DSGAI14, DSGAI15, DSGAI18, DSGAI21",
-      "title": "A — Data & Privacy",
-      "kind": "control"
-    },
-    {
-      "control_id": "DSGAI01, DSGAI04, DSGAI05, DSGAI10, DSGAI12, DSGAI16, DSGAI17",
-      "title": "B — Security",
-      "kind": "control"
-    },
-    {
-      "control_id": "DSGAI05, DSGAI20",
-      "title": "C — Safety",
-      "kind": "control"
-    },
-    {
-      "control_id": "DSGAI12, DSGAI19",
-      "title": "D — Reliability",
-      "kind": "control"
-    },
-    {
-      "control_id": "DSGAI02, DSGAI06, DSGAI09, DSGAI13, DSGAI18, DSGAI20, DSGAI21",
-      "title": "E — Accountability",
-      "kind": "control"
-    },
-    {
-      "control_id": "DSGAI20",
-      "title": "F — Society",
-      "kind": "control"
-    },
-    {
-      "control_id": "Date",
-      "title": "Version",
-      "description": "Change",
-      "kind": "control"
-    },
-    {
-      "control_id": "2026-03-27",
-      "title": "1.0.0",
-      "description": "Initial release — full mapping DSGAI01–DSGAI21 to AIUC-1",
-      "kind": "control"
     }
   ],
   "inventory_completeness": {
     "status": "partial",
-    "included": 23,
+    "included": 14,
     "total": null,
     "note": "Every item in this registry is referenced by a mapping, so the registry was derived from the mappings rather than from the framework. It cannot contain controls this crosswalk has not mapped. Authoritative total not yet established.",
     "source": "https://www.ai-safety-institute.org/"
-  }
+  },
+  "changelog": [
+    {
+      "date": "2026-09-14",
+      "change": "Removed 9 items that were never controls: rows from the closing summary and changelog tables of dsgai-2026 mapping files (e.g. \"Date\", \"DSGAI entries most affected\"), parsed as DSGAI21 mappings because extractSection() ran past the last entry, then extracted here.",
+      "author": "OWASP GenAI Data Security Initiative"
+    }
+  ]
 }
diff --git a/data/frameworks/nist-sp-800-218a.json b/data/frameworks/nist-sp-800-218a.json
index ca90644..18d689b 100644
--- a/data/frameworks/nist-sp-800-218a.json
+++ b/data/frameworks/nist-sp-800-218a.json
@@ -328,6 +328,6 @@
     "included": 52,
     "total": null,
     "note": "Every item in this registry is referenced by a mapping, so the registry was derived from the mappings rather than from the framework. It cannot contain controls this crosswalk has not mapped. Authoritative total not yet established.",
-    "source": "https://csrc.nist.gov/pubs/sp/800/218/a/final"
+    "source": "https://doi.org/10.6028/NIST.SP.800-218A"
   }
 }
diff --git a/data/frameworks/owasp-nhi.json b/data/frameworks/owasp-nhi.json
index 1232f3e..49775f2 100644
--- a/data/frameworks/owasp-nhi.json
+++ b/data/frameworks/owasp-nhi.json
@@ -520,78 +520,6 @@
       "description": "Protect lineage system credentials",
       "kind": "control"
     },
-    {
-      "control_id": "DSGAI entries most affected",
-      "title": "NHI Risk",
-      "kind": "control"
-    },
-    {
-      "control_id": "DSGAI21",
-      "title": "NHI-1 Improper Offboarding",
-      "kind": "control"
-    },
-    {
-      "control_id": "DSGAI03, DSGAI06, DSGAI16",
-      "title": "NHI-2 Secret Leakage",
-      "description": "DevSecOps",
-      "kind": "control"
-    },
-    {
-      "control_id": "DSGAI13, DSGAI16, DSGAI17",
-      "title": "NHI-3 Third-Party NHI",
-      "description": "Security",
-      "kind": "control"
-    },
-    {
-      "control_id": "DSGAI04, DSGAI08",
-      "title": "NHI-4 Insecure Authentication",
-      "description": "Platform",
-      "kind": "control"
-    },
-    {
-      "control_id": "DSGAI02, DSGAI07, DSGAI08, DSGAI09",
-      "title": "NHI-5 Over-Privileged NHI",
-      "kind": "control"
-    },
-    {
-      "control_id": "DSGAI02, DSGAI09, DSGAI14",
-      "title": "NHI-6 Insecure Storage",
-      "description": "Platform",
-      "kind": "control"
-    },
-    {
-      "control_id": "DSGAI02, DSGAI07, DSGAI09, DSGAI12",
-      "title": "NHI-7 Long-Lived",
-      "kind": "control"
-    },
-    {
-      "control_id": "DSGAI16, DSGAI17",
-      "title": "NHI-8 Env Isolation",
-      "description": "DevSecOps",
-      "kind": "control"
-    },
-    {
-      "control_id": "DSGAI04, DSGAI07, DSGAI08, DSGAI19",
-      "title": "NHI-9 NHI Reuse",
-      "kind": "control"
-    },
-    {
-      "control_id": "DSGAI18, DSGAI20, DSGAI21",
-      "title": "NHI-10 Human Use",
-      "kind": "control"
-    },
-    {
-      "control_id": "Date",
-      "title": "Version",
-      "description": "Change",
-      "kind": "control"
-    },
-    {
-      "control_id": "2026-03-27",
-      "title": "1.0.0",
-      "description": "Initial release — full mapping DSGAI01–DSGAI21 to NHI Top 10",
-      "kind": "control"
-    },
     {
       "control_id": "Injection blast radius proportional to credential scope",
       "title": "NHI-5 Over-Privileged NHI",
@@ -709,9 +637,16 @@
   ],
   "inventory_completeness": {
     "status": "unknown",
-    "included": 117,
+    "included": 104,
     "total": null,
     "note": "Authoritative control count not established. Needs a count from the published framework.",
     "source": "https://owasp.org/www-project-non-human-identities-top-10/"
-  }
+  },
+  "changelog": [
+    {
+      "date": "2026-09-14",
+      "change": "Removed 13 items that were never controls: rows from the closing summary and changelog tables of dsgai-2026 mapping files (e.g. \"Date\", \"DSGAI entries most affected\"), parsed as DSGAI21 mappings because extractSection() ran past the last entry, then extracted here.",
+      "author": "OWASP GenAI Data Security Initiative"
+    }
+  ]
 }
diff --git a/data/stats.json b/data/stats.json
index 33bc82b..7ceb136 100644
--- a/data/stats.json
+++ b/data/stats.json
@@ -27,11 +27,11 @@
     }
   },
   "mappings": {
-    "total": 3803,
+    "total": 3781,
     "by_list": {
       "Agentic-Top10-2026": 993,
       "AST-Top10-2026": 36,
-      "DSGAI-2026": 1788,
+      "DSGAI-2026": 1766,
       "LLM-Top10-2026": 986
     }
   },
@@ -87,10 +87,10 @@
     ]
   },
   "controls": {
-    "total": 1563,
-    "registry_items": 1705,
+    "total": 1541,
+    "registry_items": 1683,
     "by_kind": {
-      "control": 1563,
+      "control": 1541,
       "layer": 10,
       "technique": 50,
       "threat-category": 6,
diff --git a/docs/backlinks.js b/docs/backlinks.js
index 574545c..1a410f0 100644
--- a/docs/backlinks.js
+++ b/docs/backlinks.js
@@ -1,22 +1,6 @@
 // Auto-generated by scripts/generate.js — do not edit manually
-// Backlinks: 1324
+// Backlinks: 1302
 window.CROSSWALK_BACKLINKS = [
-  {
-    "framework": "AIUC-1",
-    "control_id": "2026-03-27",
-    "control_name": "1.0.0",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Initial release — full mapping DSGAI01–DSGAI21 to AIUC-1"
-      }
-    ]
-  },
   {
     "framework": "AIUC-1",
     "control_id": "A",
@@ -1163,118 +1147,6 @@ window.CROSSWALK_BACKLINKS = [
       }
     ]
   },
-  {
-    "framework": "AIUC-1",
-    "control_id": "Date",
-    "control_name": "Version",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Change"
-      }
-    ]
-  },
-  {
-    "framework": "AIUC-1",
-    "control_id": "DSGAI01, DSGAI04, DSGAI05, DSGAI10, DSGAI12, DSGAI16, DSGAI17",
-    "control_name": "B — Security",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "AIUC-1",
-    "control_id": "DSGAI02, DSGAI03, DSGAI06, DSGAI07, DSGAI08, DSGAI09, DSGAI14, DSGAI15, DSGAI18, DSGAI21",
-    "control_name": "A — Data & Privacy",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "AIUC-1",
-    "control_id": "DSGAI02, DSGAI06, DSGAI09, DSGAI13, DSGAI18, DSGAI20, DSGAI21",
-    "control_name": "E — Accountability",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "AIUC-1",
-    "control_id": "DSGAI05, DSGAI20",
-    "control_name": "C — Safety",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "AIUC-1",
-    "control_id": "DSGAI12, DSGAI19",
-    "control_name": "D — Reliability",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "AIUC-1",
-    "control_id": "DSGAI20",
-    "control_name": "F — Society",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
   {
     "framework": "AIUC-1",
     "control_id": "E",
@@ -1550,22 +1422,6 @@ window.CROSSWALK_BACKLINKS = [
       }
     ]
   },
-  {
-    "framework": "AIUC-1",
-    "control_id": "Primary DSGAI entries",
-    "control_name": "AIUC-1 Domain",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Status"
-      }
-    ]
-  },
   {
     "framework": "CIS Controls v8.1",
     "control_id": "12.4 Establish and maintain architecture diagram",
@@ -34226,22 +34082,6 @@ window.CROSSWALK_BACKLINKS = [
       }
     ]
   },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "2026-03-27",
-    "control_name": "1.0.0",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Initial release — full mapping DSGAI01–DSGAI21 to NHI Top 10"
-      }
-    ]
-  },
   {
     "framework": "OWASP NHI Top 10",
     "control_id": "Agent credentials exposed in memory, logs, tool payloads",
@@ -34594,22 +34434,6 @@ window.CROSSWALK_BACKLINKS = [
       }
     ]
   },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "Date",
-    "control_name": "Version",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Change"
-      }
-    ]
-  },
   {
     "framework": "OWASP NHI Top 10",
     "control_id": "Decommissioned pipeline identities remain in lineage records",
@@ -34642,182 +34466,6 @@ window.CROSSWALK_BACKLINKS = [
       }
     ]
   },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI entries most affected",
-    "control_name": "NHI Risk",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI02, DSGAI07, DSGAI08, DSGAI09",
-    "control_name": "NHI-5 Over-Privileged NHI",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI02, DSGAI07, DSGAI09, DSGAI12",
-    "control_name": "NHI-7 Long-Lived",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI02, DSGAI09, DSGAI14",
-    "control_name": "NHI-6 Insecure Storage",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Platform"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI03, DSGAI06, DSGAI16",
-    "control_name": "NHI-2 Secret Leakage",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "DevSecOps"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI04, DSGAI07, DSGAI08, DSGAI19",
-    "control_name": "NHI-9 NHI Reuse",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI04, DSGAI08",
-    "control_name": "NHI-4 Insecure Authentication",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Platform"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI13, DSGAI16, DSGAI17",
-    "control_name": "NHI-3 Third-Party NHI",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Security"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI16, DSGAI17",
-    "control_name": "NHI-8 Env Isolation",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "DevSecOps"
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI18, DSGAI20, DSGAI21",
-    "control_name": "NHI-10 Human Use",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
-  {
-    "framework": "OWASP NHI Top 10",
-    "control_id": "DSGAI21",
-    "control_name": "NHI-1 Improper Offboarding",
-    "entries": [
-      {
-        "id": "DSGAI21",
-        "name": "Disinformation via Data Poisoning",
-        "source_list": "DSGAI-2026",
-        "severity": "High",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": null
-      }
-    ]
-  },
   {
     "framework": "OWASP NHI Top 10",
     "control_id": "Embedding store service account with cross-tenant read access",
diff --git a/docs/data.js b/docs/data.js
index 5e081c1..9fdde79 100644
--- a/docs/data.js
+++ b/docs/data.js
@@ -11728,17 +11728,6 @@ window.CROSSWALK_DATA = [
       }
     ],
     "crossrefs": {
-      "llm_top10": [
-        "LLM01",
-        "LLM03",
-        "LLM08",
-        "LLM02",
-        "LLM04",
-        "LLM05",
-        "LLM09",
-        "LLM07",
-        "LLM06"
-      ],
       "agentic_top10": [
         "ASI02",
         "ASI05",
@@ -24910,6 +24899,14 @@ window.CROSSWALK_DATA = [
         "LLM04",
         "LLM10"
       ],
+      "dsgai_2026": [
+        "DSGAI16",
+        "DSGAI03",
+        "DSGAI19",
+        "DSGAI02",
+        "DSGAI17",
+        "DSGAI06"
+      ],
       "agentic_top10": [
         "ASI01",
         "ASI02",
@@ -24920,14 +24917,6 @@ window.CROSSWALK_DATA = [
         "ASI07",
         "ASI08",
         "ASI09"
-      ],
-      "dsgai_2026": [
-        "DSGAI16",
-        "DSGAI03",
-        "DSGAI19",
-        "DSGAI02",
-        "DSGAI17",
-        "DSGAI06"
       ]
     },
     "changelog": [
@@ -45610,90 +45599,6 @@ window.CROSSWALK_DATA = [
         "confidence": "unreviewed",
         "reviewed_by": []
       },
-      {
-        "framework": "AIUC-1",
-        "control_id": "Primary DSGAI entries",
-        "control_name": "AIUC-1 Domain",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Status",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "AIUC-1",
-        "control_id": "DSGAI02, DSGAI03, DSGAI06, DSGAI07, DSGAI08, DSGAI09, DSGAI14, DSGAI15, DSGAI18, DSGAI21",
-        "control_name": "A — Data & Privacy",
-        "tier": "Foundational",
-        "scope": "Both",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "AIUC-1",
-        "control_id": "DSGAI01, DSGAI04, DSGAI05, DSGAI10, DSGAI12, DSGAI16, DSGAI17",
-        "control_name": "B — Security",
-        "tier": "Foundational",
-        "scope": "Both",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "AIUC-1",
-        "control_id": "DSGAI05, DSGAI20",
-        "control_name": "C — Safety",
-        "tier": "Foundational",
-        "scope": "Both",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "AIUC-1",
-        "control_id": "DSGAI12, DSGAI19",
-        "control_name": "D — Reliability",
-        "tier": "Foundational",
-        "scope": "Both",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "AIUC-1",
-        "control_id": "DSGAI02, DSGAI06, DSGAI09, DSGAI13, DSGAI18, DSGAI20, DSGAI21",
-        "control_name": "E — Accountability",
-        "tier": "Foundational",
-        "scope": "Both",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "AIUC-1",
-        "control_id": "DSGAI20",
-        "control_name": "F — Society",
-        "tier": "Foundational",
-        "scope": "Both",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "AIUC-1",
-        "control_id": "Date",
-        "control_name": "Version",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Change",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "AIUC-1",
-        "control_id": "2026-03-27",
-        "control_name": "1.0.0",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Initial release — full mapping DSGAI01–DSGAI21 to AIUC-1",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
       {
         "framework": "OWASP NHI Top 10",
         "control_id": "Machine credentials used for ingestion operations — no individual attribution",
@@ -45724,130 +45629,6 @@ window.CROSSWALK_DATA = [
         "confidence": "unreviewed",
         "reviewed_by": []
       },
-      {
-        "framework": "OWASP NHI Top 10",
-        "control_id": "DSGAI entries most affected",
-        "control_name": "NHI Risk",
-        "tier": "Foundational",
-        "scope": "Both",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "OWASP NHI Top 10",
-        "control_id": "DSGAI21",
-        "control_name": "NHI-1 Improper Offboarding",
-        "tier": "Foundational",
-        "scope": "Both",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "OWASP NHI Top 10",
-        "control_id": "DSGAI03, DSGAI06, DSGAI16",
-        "control_name": "NHI-2 Secret Leakage",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "DevSecOps",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "OWASP NHI Top 10",
-        "control_id": "DSGAI13, DSGAI16, DSGAI17",
-        "control_name": "NHI-3 Third-Party NHI",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Security",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "OWASP NHI Top 10",
-        "control_id": "DSGAI04, DSGAI08",
-        "control_name": "NHI-4 Insecure Authentication",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Platform",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "OWASP NHI Top 10",
-        "control_id": "DSGAI02, DSGAI07, DSGAI08, DSGAI09",
-        "control_name": "NHI-5 Over-Privileged NHI",
-        "tier": "Foundational",
-        "scope": "Both",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "OWASP NHI Top 10",
-        "control_id": "DSGAI02, DSGAI09, DSGAI14",
-        "control_name": "NHI-6 Insecure Storage",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Platform",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "OWASP NHI Top 10",
-        "control_id": "DSGAI02, DSGAI07, DSGAI09, DSGAI12",
-        "control_name": "NHI-7 Long-Lived",
-        "tier": "Foundational",
-        "scope": "Both",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "OWASP NHI Top 10",
-        "control_id": "DSGAI16, DSGAI17",
-        "control_name": "NHI-8 Env Isolation",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "DevSecOps",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "OWASP NHI Top 10",
-        "control_id": "DSGAI04, DSGAI07, DSGAI08, DSGAI19",
-        "control_name": "NHI-9 NHI Reuse",
-        "tier": "Foundational",
-        "scope": "Both",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "OWASP NHI Top 10",
-        "control_id": "DSGAI18, DSGAI20, DSGAI21",
-        "control_name": "NHI-10 Human Use",
-        "tier": "Foundational",
-        "scope": "Both",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "OWASP NHI Top 10",
-        "control_id": "Date",
-        "control_name": "Version",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Change",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
-      {
-        "framework": "OWASP NHI Top 10",
-        "control_id": "2026-03-27",
-        "control_name": "1.0.0",
-        "tier": "Foundational",
-        "scope": "Both",
-        "notes": "Initial release — full mapping DSGAI01–DSGAI21 to NHI Top 10",
-        "confidence": "unreviewed",
-        "reviewed_by": []
-      },
       {
         "framework": "NIST SP 800-218A",
         "control_id": "PW.1.1-PS",
@@ -46161,11 +45942,12 @@ window.CROSSWALK_DATA = [
         "ASI02"
       ],
       "dsgai_2026": [
+        "DSGAI02",
+        "DSGAI09",
         "DSGAI01",
         "DSGAI03",
         "DSGAI07",
         "DSGAI08",
-        "DSGAI02",
         "DSGAI06",
         "DSGAI12",
         "DSGAI13",
@@ -46176,7 +45958,6 @@ window.CROSSWALK_DATA = [
         "DSGAI17",
         "DSGAI14",
         "DSGAI15",
-        "DSGAI09",
         "DSGAI16",
         "DSGAI10",
         "DSGAI19",
diff --git a/docs/frameworks-registry.js b/docs/frameworks-registry.js
index 350983b..c119838 100644
--- a/docs/frameworks-registry.js
+++ b/docs/frameworks-registry.js
@@ -95,63 +95,22 @@ window.CROSSWALK_FRAMEWORKS = [
         "title": "Society (full domain)",
         "description": "Foundational",
         "kind": "control"
-      },
-      {
-        "control_id": "Primary DSGAI entries",
-        "title": "AIUC-1 Domain",
-        "description": "Status",
-        "kind": "control"
-      },
-      {
-        "control_id": "DSGAI02, DSGAI03, DSGAI06, DSGAI07, DSGAI08, DSGAI09, DSGAI14, DSGAI15, DSGAI18, DSGAI21",
-        "title": "A — Data & Privacy",
-        "kind": "control"
-      },
-      {
-        "control_id": "DSGAI01, DSGAI04, DSGAI05, DSGAI10, DSGAI12, DSGAI16, DSGAI17",
-        "title": "B — Security",
-        "kind": "control"
-      },
-      {
-        "control_id": "DSGAI05, DSGAI20",
-        "title": "C — Safety",
-        "kind": "control"
-      },
-      {
-        "control_id": "DSGAI12, DSGAI19",
-        "title": "D — Reliability",
-        "kind": "control"
-      },
-      {
-        "control_id": "DSGAI02, DSGAI06, DSGAI09, DSGAI13, DSGAI18, DSGAI20, DSGAI21",
-        "title": "E — Accountability",
-        "kind": "control"
-      },
-      {
-        "control_id": "DSGAI20",
-        "title": "F — Society",
-        "kind": "control"
-      },
-      {
-        "control_id": "Date",
-        "title": "Version",
-        "description": "Change",
-        "kind": "control"
-      },
-      {
-        "control_id": "2026-03-27",
-        "title": "1.0.0",
-        "description": "Initial release — full mapping DSGAI01–DSGAI21 to AIUC-1",
-        "kind": "control"
       }
     ],
     "inventory_completeness": {
       "status": "partial",
-      "included": 23,
+      "included": 14,
       "total": null,
       "note": "Every item in this registry is referenced by a mapping, so the registry was derived from the mappings rather than from the framework. It cannot contain controls this crosswalk has not mapped. Authoritative total not yet established.",
       "source": "https://www.ai-safety-institute.org/"
-    }
+    },
+    "changelog": [
+      {
+        "date": "2026-09-14",
+        "change": "Removed 9 items that were never controls: rows from the closing summary and changelog tables of dsgai-2026 mapping files (e.g. \"Date\", \"DSGAI entries most affected\"), parsed as DSGAI21 mappings because extractSection() ran past the last entry, then extracted here.",
+        "author": "OWASP GenAI Data Security Initiative"
+      }
+    ]
   },
   {
     "id": "cis-controls",
@@ -6669,7 +6628,7 @@ window.CROSSWALK_FRAMEWORKS = [
       "included": 52,
       "total": null,
       "note": "Every item in this registry is referenced by a mapping, so the registry was derived from the mappings rather than from the framework. It cannot contain controls this crosswalk has not mapped. Authoritative total not yet established.",
-      "source": "https://csrc.nist.gov/pubs/sp/800/218/a/final"
+      "source": "https://doi.org/10.6028/NIST.SP.800-218A"
     }
   },
   {
@@ -10218,78 +10177,6 @@ window.CROSSWALK_FRAMEWORKS = [
         "description": "Protect lineage system credentials",
         "kind": "control"
       },
-      {
-        "control_id": "DSGAI entries most affected",
-        "title": "NHI Risk",
-        "kind": "control"
-      },
-      {
-        "control_id": "DSGAI21",
-        "title": "NHI-1 Improper Offboarding",
-        "kind": "control"
-      },
-      {
-        "control_id": "DSGAI03, DSGAI06, DSGAI16",
-        "title": "NHI-2 Secret Leakage",
-        "description": "DevSecOps",
-        "kind": "control"
-      },
-      {
-        "control_id": "DSGAI13, DSGAI16, DSGAI17",
-        "title": "NHI-3 Third-Party NHI",
-        "description": "Security",
-        "kind": "control"
-      },
-      {
-        "control_id": "DSGAI04, DSGAI08",
-        "title": "NHI-4 Insecure Authentication",
-        "description": "Platform",
-        "kind": "control"
-      },
-      {
-        "control_id": "DSGAI02, DSGAI07, DSGAI08, DSGAI09",
-        "title": "NHI-5 Over-Privileged NHI",
-        "kind": "control"
-      },
-      {
-        "control_id": "DSGAI02, DSGAI09, DSGAI14",
-        "title": "NHI-6 Insecure Storage",
-        "description": "Platform",
-        "kind": "control"
-      },
-      {
-        "control_id": "DSGAI02, DSGAI07, DSGAI09, DSGAI12",
-        "title": "NHI-7 Long-Lived",
-        "kind": "control"
-      },
-      {
-        "control_id": "DSGAI16, DSGAI17",
-        "title": "NHI-8 Env Isolation",
-        "description": "DevSecOps",
-        "kind": "control"
-      },
-      {
-        "control_id": "DSGAI04, DSGAI07, DSGAI08, DSGAI19",
-        "title": "NHI-9 NHI Reuse",
-        "kind": "control"
-      },
-      {
-        "control_id": "DSGAI18, DSGAI20, DSGAI21",
-        "title": "NHI-10 Human Use",
-        "kind": "control"
-      },
-      {
-        "control_id": "Date",
-        "title": "Version",
-        "description": "Change",
-        "kind": "control"
-      },
-      {
-        "control_id": "2026-03-27",
-        "title": "1.0.0",
-        "description": "Initial release — full mapping DSGAI01–DSGAI21 to NHI Top 10",
-        "kind": "control"
-      },
       {
         "control_id": "Injection blast radius proportional to credential scope",
         "title": "NHI-5 Over-Privileged NHI",
@@ -10407,11 +10294,18 @@ window.CROSSWALK_FRAMEWORKS = [
     ],
     "inventory_completeness": {
       "status": "unknown",
-      "included": 117,
+      "included": 104,
       "total": null,
       "note": "Authoritative control count not established. Needs a count from the published framework.",
       "source": "https://owasp.org/www-project-non-human-identities-top-10/"
-    }
+    },
+    "changelog": [
+      {
+        "date": "2026-09-14",
+        "change": "Removed 13 items that were never controls: rows from the closing summary and changelog tables of dsgai-2026 mapping files (e.g. \"Date\", \"DSGAI entries most affected\"), parsed as DSGAI21 mappings because extractSection() ran past the last entry, then extracted here.",
+        "author": "OWASP GenAI Data Security Initiative"
+      }
+    ]
   },
   {
     "id": "owasp-samm",
diff --git a/docs/index.html b/docs/index.html
index 19bf650..b55026c 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -1134,7 +1134,7 @@
 <div class="app" id="app"><noscript>
   <div style="max-width:800px;margin:40px auto;padding:0 24px;line-height:1.6;">
     <h1>GenAI Crosswalk</h1>
-    <p>GenAI Crosswalk is the flagship dataset and tool of the <a href="https://genai.owasp.org">OWASP GenAI Security Project</a>. It is the most comprehensive mapping of Gen AI and Agentic security risks to industry frameworks: 51 entries across the OWASP LLM Top 10, the OWASP Top 10 for Agentic Applications, DSGAI (Data Security for GenAI) and the OWASP Agentic Skills Top 10, mapped to 26 industry frameworks with 3,803 individual control mappings.</p>
+    <p>GenAI Crosswalk is the flagship dataset and tool of the <a href="https://genai.owasp.org">OWASP GenAI Security Project</a>. It is the most comprehensive mapping of Gen AI and Agentic security risks to industry frameworks: 51 entries across the OWASP LLM Top 10, the OWASP Top 10 for Agentic Applications, DSGAI (Data Security for GenAI) and the OWASP Agentic Skills Top 10, mapped to 26 industry frameworks with 3,781 individual control mappings.</p>
     <p><strong>Review state.</strong> Every mapping in this project is <code>unreviewed</code> until a named reviewer signs it. 2 of the 26 mapped frameworks — CoSAI and the EU AI Act Code of Practice — currently carry <em>candidate</em> rows only: the control ids are accurate to the published framework, but the pairing to a risk is a proposal awaiting subject-matter review, not an assertion. They are counted as mapped because a mapping file exists; they are not counted as verified, because nothing here is.</p>
     <h2>OWASP Top 10 for Agentic AI — Risks &amp; Mitigations</h2>
     <p>See the full <a href="agentic-ai-top10/">OWASP Top 10 for Agentic AI risks and mitigations</a>: Agent Goal Hijack, Tool Misuse &amp; Exploitation, Identity &amp; Privilege Abuse, Agentic Supply Chain Vulnerabilities, Unexpected Code Execution, Memory &amp; Context Poisoning, Insecure Inter-Agent Communication, Cascading Agent Failures, Human-Agent Trust Exploitation, and Rogue Agents.</p>
diff --git a/scripts/generate.js b/scripts/generate.js
index bb71e64..14ff33e 100644
--- a/scripts/generate.js
+++ b/scripts/generate.js
@@ -275,7 +275,14 @@ function parseQuickRef(content) {
 }
 
 /**
- * Extract the body of a vulnerability section (### IDxx … until next ### or end).
+ * Extract the body of a vulnerability section (### IDxx … until the next ###,
+ * the next ## section, or end).
+ *
+ * Stopping at `## ` matters for the LAST entry in a file. Stopping only at
+ * `### ` let it run on through the file's closing sections, so trailing tables
+ * — a summary matrix, the changelog's `| Version | Date |` — were parsed as
+ * that entry's control mappings and then extracted into the registries as
+ * "controls" (DSGAI21 carried 19 such rows).
  */
 function extractSection(content, id) {
   const lines = content.split('\n');
@@ -285,7 +292,7 @@ function extractSection(content, id) {
   for (let i = 0; i < lines.length; i++) {
     if (idRegex.test(lines[i])) {
       start = i + 1;
-    } else if (start !== -1 && /^###\s/.test(lines[i])) {
+    } else if (start !== -1 && /^#{2,3}\s/.test(lines[i])) {
       return lines.slice(start, i).join('\n');
     }
   }
diff --git a/scripts/generate.test.mjs b/scripts/generate.test.mjs
index c531ae4..16417d0 100644
--- a/scripts/generate.test.mjs
+++ b/scripts/generate.test.mjs
@@ -139,3 +139,26 @@ test('webapp bundles stay in step with the entry files', () => {
   const onDisk = fs.readdirSync(ENTRIES).filter((f) => f.endsWith('.json')).length;
   assert.equal(bundled.length, onDisk, 'docs/data.js and data/entries hold different entry counts');
 });
+
+test('no mapping row or registry item comes from a table outside an entry section', () => {
+  // extractSection() once ran past the last entry in a file, so the closing
+  // summary matrix and the changelog's `| Version | Date |` rows were stored as
+  // DSGAI21 control mappings — ids like "Date", "2026-03-27" and
+  // "DSGAI02, DSGAI09, DSGAI14" — and then extracted into the registries.
+  const NOT_A_CONTROL = /^(date|version|change|author|primary .+ entries|.+ entries most affected|\d{4}-\d{2}-\d{2}|((LLM|ASI|DSGAI|AST)\d{2}(,\s*)?)+)$/i;
+  const leaked = [];
+  for (const f of fs.readdirSync(ENTRIES).filter((x) => x.endsWith('.json'))) {
+    const e = JSON.parse(fs.readFileSync(path.join(ENTRIES, f), 'utf8'));
+    for (const m of e.mappings) {
+      if (NOT_A_CONTROL.test(m.control_id.trim())) leaked.push(`${e.id} ${m.framework}: "${m.control_id}"`);
+    }
+  }
+  const fwDir = path.join(ROOT, 'data', 'frameworks');
+  for (const f of fs.readdirSync(fwDir).filter((x) => x.endsWith('.json'))) {
+    const r = JSON.parse(fs.readFileSync(path.join(fwDir, f), 'utf8'));
+    for (const c of r.controls) {
+      if (NOT_A_CONTROL.test(c.control_id.trim())) leaked.push(`registry ${r.name}: "${c.control_id}"`);
+    }
+  }
+  assert.deepEqual(leaked.slice(0, 5), [], `${leaked.length} row(s) parsed from outside an entry section`);
+});