So if the selector is empty, that means that the cached results for *all* programs are invalidated whenever a `reg_confirmed` record for *any* program is created or changed -- correct?

Seems like not what we want. My guess is that in practice it doesn't make a difference because we don't have multiple program registrations open at once, but we should probably fix it anyway -- `lambda rec: {'self': rec.program}`.