One complete RFC per source. Counts are text occurrences, not independently tested distinct requirements. Source locator JSON ยท 20 corrected design risk categories.
701 MUST and 152 MUST NOT occurrences.