Filed out of the review of #13979 (card #13940), by the domain:devx execution PM seat. #13940 closes on that PR; this card carries the residue it deliberately did not pay, so that the debt exists as a record rather than as an unwritten intention.
What the residue is
#13979 shut the class. Its gate holds one shape — a sentence fusing a permanent fact with a live reading of a moving value ("the installed better-auth 1.7.1", which after a pin bump is not stale but false) — and that population is held at 0.
It left 130 sites alone on purpose. Those are anchored historical statements, shaped like:
[#11374] Bound from better-auth 1.7.1's own MySQL schema
Every one of them is true as written: it names the version the measurement was taken against. What is unknown is whether the same measurement still holds on the installed version. The family now pins at ^1.7.2 across all eleven members (pnpm-workspace.yaml, moved in #13938).
⇒ The debt is not falseness. It is that nobody has re-run those 130 measurements, and no mechanism will ever tell you which of them changed.
Why this is not paid as a batch — measured, not assumed
The review of #13979 measured the batch remedies and both fail:
- A pin-equality gate cannot be built honestly. Checking stamps against the installed version would have fabricated 130 measurements — restamping
1.7.1 → 1.7.2 on sentences whose truth is precisely that they say 1.7.1. It would also have corrupted another gate's test input: scripts/check-prerelease-pin-watch.mjs carries 'better-auth': { versions: ['1.7.0', '1.7.1'], … } inside a --fixture call feeding its own self-test.
- A hand sweep is what this card's parent ruled against. Four have already run, and the population they chase grew 29 → 95 across them. A fifth would restamp without measuring, which is the failure mode, not the fix.
⛔ Do not open a PR whose purpose is to walk the 130. Such a PR is refused on sight.
The remedy shape that is in scope
Per surface, opportunistically:
- When a file carrying one of these stamps is next touched for another reason, re-run that file's measurement against the then-installed version and re-anchor the sentence to the version actually verified.
- If re-running is not affordable inside that PR, leave it. An anchored stamp is honest as-is; a guessed one is not. Leaving it is the correct outcome, not a skipped chore.
That is the whole remedy. This card is a debt register, not a ratchet — it ships no gate and fails no build, because any gate over this population would have to guess.
Reproducing the population
Once #13979 is on main:
pnpm check:vendor-version-stamps
The gate reports the historical bucket rather than enforcing it; the count in that report is this card's population.
Provenance
The ruling this card implements, from the #13979 ACCEPT (Q1):
Card closes on this PR; the residue is filed as its own card, to be paid down per surface as each is next touched, never as a batch.
Left unassigned and ungraded — the triage seat grades.
Generated by Claude Code
Filed out of the review of #13979 (card #13940), by the
domain:devxexecution PM seat. #13940 closes on that PR; this card carries the residue it deliberately did not pay, so that the debt exists as a record rather than as an unwritten intention.What the residue is
#13979 shut the class. Its gate holds one shape — a sentence fusing a permanent fact with a live reading of a moving value ("the installed better-auth 1.7.1", which after a pin bump is not stale but false) — and that population is held at 0.
It left 130 sites alone on purpose. Those are anchored historical statements, shaped like:
Every one of them is true as written: it names the version the measurement was taken against. What is unknown is whether the same measurement still holds on the installed version. The family now pins at
^1.7.2across all eleven members (pnpm-workspace.yaml, moved in #13938).⇒ The debt is not falseness. It is that nobody has re-run those 130 measurements, and no mechanism will ever tell you which of them changed.
Why this is not paid as a batch — measured, not assumed
The review of #13979 measured the batch remedies and both fail:
1.7.1→1.7.2on sentences whose truth is precisely that they say 1.7.1. It would also have corrupted another gate's test input:scripts/check-prerelease-pin-watch.mjscarries'better-auth': { versions: ['1.7.0', '1.7.1'], … }inside a--fixturecall feeding its own self-test.⛔ Do not open a PR whose purpose is to walk the 130. Such a PR is refused on sight.
The remedy shape that is in scope
Per surface, opportunistically:
That is the whole remedy. This card is a debt register, not a ratchet — it ships no gate and fails no build, because any gate over this population would have to guess.
Reproducing the population
Once #13979 is on
main:The gate reports the historical bucket rather than enforcing it; the count in that report is this card's population.
Provenance
The ruling this card implements, from the #13979 ACCEPT (Q1):
Left unassigned and ungraded — the triage seat grades.
Generated by Claude Code