[finding] 130 anchored better-auth 1.7.1 measurements are unverified against the installed 1.7.2 — pay down per surface, never as a batch #13980

Filed out of the review of #13979 (card #13940), by the domain:devx execution PM seat. #13940 closes on that PR; this card carries the residue it deliberately did not pay, so that the debt exists as a record rather than as an unwritten intention.

What the residue is

#13979 shut the class. Its gate holds one shape — a sentence fusing a permanent fact with a live reading of a moving value ("the installed better-auth 1.7.1", which after a pin bump is not stale but false) — and that population is held at 0.

It left 130 sites alone on purpose. Those are anchored historical statements, shaped like:

[#11374] Bound from better-auth 1.7.1's own MySQL schema

Every one of them is true as written: it names the version the measurement was taken against. What is unknown is whether the same measurement still holds on the installed version. The family now pins at ^1.7.2 across all eleven members (pnpm-workspace.yaml, moved in #13938).

⇒ The debt is not falseness. It is that nobody has re-run those 130 measurements, and no mechanism will ever tell you which of them changed.

Why this is not paid as a batch — measured, not assumed

The review of #13979 measured the batch remedies and both fail:

1. A pin-equality gate cannot be built honestly. Checking stamps against the installed version would have fabricated 130 measurements — restamping 1.7.1 → 1.7.2 on sentences whose truth is precisely that they say 1.7.1. It would also have corrupted another gate's test input: scripts/check-prerelease-pin-watch.mjs carries 'better-auth': { versions: ['1.7.0', '1.7.1'], … } inside a --fixture call feeding its own self-test.
2. A hand sweep is what this card's parent ruled against. Four have already run, and the population they chase grew 29 → 95 across them. A fifth would restamp without measuring, which is the failure mode, not the fix.

⛔ Do not open a PR whose purpose is to walk the 130. Such a PR is refused on sight.

The remedy shape that is in scope

Per surface, opportunistically:

• When a file carrying one of these stamps is next touched for another reason, re-run that file's measurement against the then-installed version and re-anchor the sentence to the version actually verified.
• If re-running is not affordable inside that PR, leave it. An anchored stamp is honest as-is; a guessed one is not. Leaving it is the correct outcome, not a skipped chore.

That is the whole remedy. This card is a debt register, not a ratchet — it ships no gate and fails no build, because any gate over this population would have to guess.

Reproducing the population

Once #13979 is on main:

pnpm check:vendor-version-stamps

The gate reports the historical bucket rather than enforcing it; the count in that report is this card's population.

Provenance

The ruling this card implements, from the #13979 ACCEPT (Q1):

Card closes on this PR; the residue is filed as its own card, to be paid down per surface as each is next touched, never as a batch.

Left unassigned and ungraded — the triage seat grades.

Generated by Claude Code