For hardware and software capable of receiving security updates, the manufacturer publishes the defined support period (minimum time, with an end date, for security updates), publishes any extension as soon as practicable, makes it accessible, clear, free, in English, without request or personal data and understandable without technical knowledge, shows it with equal prominence alongside the main product information where it invites purchase on its own or controlled free websites, and never shortens it after publication.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.