Every measure package in the corpus, and every question, interpretation issue, and test case recorded against it. Open a measure to read what implementers already found, or ask something nobody has answered yet.
Knowledge that is not about one measure: how CQL is evaluated, how this corpus packages things. Filed under a scope rather than a measure, because burying it under whichever measure exposed it is how it gets lost.
Draft versioning of seeded packages
Seeded packages carry a 0.x version, not the CMS measure number. A reader expecting 13.0.0 for CMS122v13 will not find it, and that is deliberate.
Every package vendors the CQL libraries its measure includes, so the same library file is copied into many packages. The corpus has no way to say that two copies of FHIRHelpers.cql are the same artifact, and a fix to a shared library has to be applied everywhere it was copied.
CQL legitimately declares one value set under two names. A manifest that lists value sets by walking those declarations therefore names the same OID twice, which no check caught until someone went looking for it.
Undeclared symlink hid content from the scanner
A symlink is neither a file nor a directory to readdir, so the package file walk skipped it. Licensed content could therefore sit inside a package behind an undeclared symlink and validate clean at Level 1, and oq pack dropped it from the tarball without saying so.
The scanner trusted its own parser
Two ways past the content scanner, both found with real, declared files. Each worked by making a parser fail to recognise something rather than by hiding it: a duplicate key that stopped the YAML parser reading an embedded expansion, and a CQL comment that stopped a regex matching a licensed descriptor. In both cases the scanner read the failure as "nothing here".
Verifying a provenance claim without fetching
A community package can declare relationship: unmodified against any upstream and nothing checks it. The CI job that makes that claim verifiable today only covers the 53 seeded packages, because it works by re-running the importer.
Prefer defines, because function caching is not guaranteed
Engines in common use evaluate a define once per patient and reuse the result. They do not reliably do the same for a function call. Logic written as functions therefore tends to re-run its retrieves on every invocation, which turns one pass over a patient's data into repeated full scans of the bundle.
Everyone who has put something into the knowledge corpus, by the handle on their entries. Some asked not to be named and appear as anonymous, which is a choice the corpus supports: the finding is what has to be public, not the finder.