The October 24 post documented the shape of the October record: four working documents listed by title on the Council's public register, every click answering "The content of this document is not accessible," against a June register where the same document classes were live links. That post's last open question was a document-access request pending with a reply due in early November. The reply has now arrived, and it is the release mechanism working — not a leak, not a briefing, a twenty-two-day turnaround from request to PUBLIC stamp.

What was released, and how

Brussels Record filed the request on October 5, under Regulation (EC) No 1049/2001, for four working documents. On October 27 the Council sent two of them and put them on its own document server:

  • WK 15082/26 — "Outcome of the 6th trilogue on 29 September 2026 and way forward," the presidency's own note, dated 30 September 2026.
  • WK 13816/26 — the four-column table, 575 pages, setting out Commission proposal, Parliament's mandate, Council's mandate, and the draft agreement as of the technical meeting of September 10.

Both were LIMITE; both now carry a PUBLIC stamp. For the other two — WK 14760/26, the documents prepared for the sixth trilogue, and WK 14059/26, a Commission presentation — the Council extended the deadline to November 18, with the stated reason that consultations on them are still under way. That reason is itself a fact about the negotiation: the unread documents are drafts still being worked; withholding them keeps the live compromise text inside the room for at least another two weeks.

What the Council's own note says

This site read the PDF directly — the presidency's hand, not a press account. The architecture in three lines:

Agreed, with the package structure explicit. On the text prepared at technical level: "Provisional agreement was reached in principle, subject to agreement on the entire detection package." The note further defines that all elements are "considered part of a possible package deal." In Council language this is load-bearing: what September's reporting had as a provisional deal on public content is now, on the Council's own paper, contingent — the public-content detection orders, the redress and safeguards provisions, every element, hang together as one package in whatever December produces. The other formally agreed element: the EU Centre's own-initiative searches in public content, covering "known and new material," with the note's line — this provisional agreement "can pave the way" for the procedure to establish the agency's seat. Meaning: the scanning centre's institutional build proceeds regardless of how the private-message fight ends.

Not agreed, with the failure named. Everything on non-public content: "The main open issues remain the targeting of detection/searches and their scope." That is the whole private-content fight in one line — who it can point at, and how wide it reaches.

The Council's red lines, and the E2EE sentence. On providers' own-initiative searches in non-public content — the mechanism that would let a hosting provider scan user files without any order — the presidency says member states could accept some of Parliament's conditions (a search plan, ex-post review, searches targeted to specific parts of a service and, where possible, to individual users), then draws the line: any solution "must not discourage providers from carrying out voluntary searches, must not lead to delays in starting the searches and should include known and new CSAM and grooming in the scope." And then the sentence with the widest consequence for anyone running encrypted infrastructure: "The Presidency clarified that end-to-end encrypted content would be excluded from the scope of searches." Read it for what it covers — own-initiative searches — and for what it does not say, which is anything about detection orders in private content, the second pillar, where the Parliament's position is unchanged.

The two poles on detection orders in private content. The note records that Parliament considers detection orders "targeted to specific users and limited to known CSAM" a key element, with the rapporteur framing them as "a measure of last resort to impose obligations on providers rather than duplicate criminal investigations." The presidency "recalled that it did not have a mandate to agree with detection orders in private content." The note also records that some member states oppose orders targeted at specific users for one reason ("no added value," overlap with criminal procedures) while others oppose orders "resulting in indiscriminate scanning" for the opposite reason — the note does not name which states. The blocking-count arithmetic is therefore unchanged: nine governments on record against mandatory scanning of private messages, 32.9 percent of the EU population, 2.1 points short of the more than 35 percent that blocks a Council vote, as of October 28.

The four-column table: a mandate of "deleted"

The 575-page table is the formal record of both negotiating positions, and its Council mandate column is unambiguous in the section that matters. In Section 2 — Detection obligations — covering detection orders in Articles 7 through 11, the Council's mandate reads "deleted" line after line; this site counted the string "deleted" at 587 occurrences across the columns and checked the Section 2 headings directly. The Commission's proposal to create a power to issue detection orders exists in the Council's position as a deletion. The Parliament's mandate column keeps detection orders where this site has reported since July: targeted, with "reasonable grounds of suspicion for a link, even an indirect one" to specific users, "a specific group of users, either as such or as subscribers to a specific channel of communication" — and one clause worth quoting in full, because it is the strongest encryption protection in either mandate: the orders exclude communications "to which end-to-end encryption is, has been or will be applied." Applied — future-tense-safe. A service that turns on E2EE tomorrow is covered by the exclusion; providers who cannot add E2EE are not protected by it.

What the table deliberately does not show: the compromise drafts prepared for the September trilogue — the text where actual agreement was being built. Those texts "are part of WK 14760/26," the withheld document. So the public record as of today contains both poles (deleted orders, targeted-and-E2EE-excluded orders) and none of the bridge — and the bridge is sealed until at least November 18.

The calendar, corrected on the record

Three dates this site had differently, and one correction belongs to itself:

  • October 1, this site: "the trilogue expected in November is the final attempt at a political deal" — the frame "November is the vote that matters."
  • The Council's note, dated September 30 and sealed until October 27: the technical meeting "planned on 12 October 2026 in preparation of the seventh trilogue tentatively scheduled for December 2026 at the European Parliament."
  • The trackers: MLex reported December 8 on October 22; Patrick Breyer's tracker carries "8 December 2026: Seventh and potentially final trilogue negotiation" — present in the October 24 snapshot of that page, absent in the October 15 snapshot, so the day was on the reference tracker in a window this site's own October 24 post straddled.

So: no November trilogue was ever scheduled on the record this request opened. The seventh trilogue is tentatively December 2026 — December 8 per MLex and Breyer, "tentatively" in the Council's own words, no day in the note. The vote-that-matters has a month on it now, and the honest correction is that the calendar said December internally from September 30 onward. What November is instead remains what the October 24 post said it might be: the month the government count moves — and the month the Council answers on the two remaining papers, with the November 18 extended deadline.

What a self-hoster actually does with this

The note changes the operational picture in exactly one place worth the attention of a community running its own stack, and consolidates the rest:

  • The package structure is now on the Council's own paper. The public-content elements — orders on public content, limited to known material "to avoid a general monitoring obligation," plus redress and safeguards — are agreed in principle subject to the entire detection package. If the package collapses in December, none of it is law. If the package succeeds, the public-content layer arrives with it: the September finding stands with better sourcing now — public rooms, public shares, and public web services on your own disk face orders you can answer for, and the same content on someone else's platform faces the platform's compliance instead.
  • The E2EE exclusion, on the Council's own paper. A self-hoster's defensible layer keeps growing in writing: the Parliament's mandate excludes anything "to which end-to-end encryption is, has been or will be applied" from detection orders; the presidency excludes E2EE content from own-initiative searches. Neither covers the case a community file store actually is — non-public, non-E2EE files — which is exactly the own-initiative-searches-in-non-public-content mechanism still under negotiation, where the Council's red lines (no discouraging, no delay, known and new material plus grooming in scope) sit against the Parliament's conditions (search plan, review, known material only). The December fight over that mechanism is the fight over the surface your private shares live on; watch for whether the "search plan reviewed before anything starts" condition survives — the silent-approval variant, where scanning starts unless a veto lands, was the Council's form in the leaked texts, and the note's red line about "delays in starting the searches" leans the same direction.
  • Transitional rules are on the Parliament's request list. Providers scanning voluntarily today "can continue until the regulation applies" — the request is in the note. Today's voluntary scanning did not stop when the interim regime expired in April; the note shows its continuation becoming a structural feature of the permanent law. If your stack ever hosts the overflow of users leaving those providers, the transition clause is what determines what they arrive with — and what the receiving infrastructure of a community instance must be prepared to refuse.
  • The seat procedure. "Can pave the way" is doing quiet work in that sentence: the EU Centre that would run indicator-matching, indicators and own-initiative crawling gets its institutional runway from this agreement regardless of the December outcome on private messages. The infrastructure the regulation would have ordered into existence is being agreed into existence first, one uncontroversial piece at a time.

The exit in the dark room

The mechanism deserves the last word, because it is the replicable part. One requester, one form, twenty-two days, and two LIMITE documents became PUBLIC files with permanent URLs on the Council's own server. The Council documented the extensions for the other two to November 18 with a reason — consultations on live drafts — which is a legitimate answer under the regulation and also the exact status of documents that matter most. Nothing stops a second request when that deadline passes, and nothing stopped the first. The October 24 post closed on the register's lights having been on in midsummer and off in the endgame; a month later, two of the off lights are on again — because someone asked, on paper, in the one form the whole system is required to answer. The two drafts still waiting — the sixth-trilogue texts (WK 14760/26) and the Commission presentation (WK 14059/26) — will show the bridge between a mandate of "deleted" and a deal, before December 8. Whoever reads them next week is a week ahead of the vote that now decides, and one request away from it.