docs: distinguish client agencies from contractors

references/derived-contractor-registry.md

@@ -14,6 +14,8 @@ Treat the contractor registry as a **derived view**, never as a second editable
 
 Do not turn `Not publicly identified`, “suppliers not named”, descriptive prose, or an ambiguous composite phrase into entities. Do not silently upgrade one role into another: development does not prove hosting or current support.
 
+Classify the entity itself before deriving a contractor card. A ministry, agency, authority, or other government body does not become a contractor merely because an observation calls it an operator, centralized service provider, platform owner, or public-sector implementer. If that body is itself an investigation subject, retain it in the Clients registry and preserve its exact service relationship as observation text, but exclude it from `CTR-*` extraction and contractor links. Research its own systems and commercial delivery partners from its Client dossier. Add an explicit, reviewed exclusion rule when free-text parsing would otherwise promote the body; do not hide the relationship or rewrite the public agency as a commercial supplier.
+
 ## Identity and stable routes
 
 Normalize only safe textual differences for matching. Preserve the displayed source name and keep ambiguous composites separate until evidence supports a split or merge. Generate stable `CTR-*` IDs and slugs from a durable normalized identity key rather than sequence position. Sequence numbers may order generated files but must not define identity.