180 — The product is one word, and the word had no number

2026-09-22 · distribution lane · DISTRIBUTION D8

D8 is the paid tier, and its headline names two gates: a Stripe Payment Link and a hosted endpoint, both Sam's. Its body describes what would be sold, and it does so in one word repeated four ways — "always-fresh", "retest-on-release alerts", "freshness delivered in-context", "the operator's retest labour". The claims policy says no benefit is claimed before it is measured. Freshness had never been measured. Every number in this repository is about the libraries; none was about us.

So this session built the instrument that measures the studio instead of its subjects, and every figure it produced is against the studio.

tools/audit/freshness.mjs. Offline, reads .git and data/, writes nothing, reports and does not gate — the shelf fact-citation-sweep.mjs, flip-exposure.mjs and git-refs-check.mjs already share. 31 selftest checks. Out of the pre-commit chain for the same two reasons as its neighbours: its cost grows with the history, and its output is a number a human reads at a gate, not a condition a commit can violate.

One word hides four quantities

The tool does not report "freshness". It reports four things, because a single word let four different facts be assumed from one another:

1. Snapshot age. How old is what we hold. All eight libraries' releases.json carry fetched_on: 2026-09-11 — eleven days. Facts are 10 to 20 days verified; the newest run per library is 10 to 17 days old.

2. Refresh cadence. How often the registry view has ever been refreshed, measured from git rather than described: two to four fetches per library in the studio's whole life, all of them on 2026-09-01, 09-02, 09-06 and 09-11. Twelve closed intervals, median 5 days, range 1–10. The open interval is 11 days on all eight and is in no statistic — it is a lower bound on an interval that has not ended, and averaging it in makes a lengthening gap look like an improving number.

3. Pipeline lag. A release ships; how long until the Index sees it, and until it dates it. Observation lag n=3: 1, 1, 3 days. Dating lag n=2: 2, 2 days. Three, not 132, and that is the honest denominator — see the refusals below.

4. Retest debt. Whether a library has shipped a stable release since its newest run. Two have: valibot 1.5.0 and zod 4.6.0, both 2026-09-09, three days after the newest run on either, and untested for 13 days and counting.

The first version of the debt was the wrong number, and it was the flattering one

A behind row has two intervals in it. How much newer the release is than the newest run is closed and small — 3 days, both rows. How long it has gone untested is the open interval to today — 13 days, and one day larger tomorrow. The first implementation printed the closed one, which makes a debt that grows every morning read as a constant. Both are now carried, the selftest asserts they are different quantities, and a current library carries no open interval at all.

Four refusals, and the one that removes 129 of 132 rows

And one class is outside every denominator by construction: nine facts are dated at a patch release, which releases.json does not carry (minors and majors only, by design). Those releases cannot be asked "did this ship a fact" at all, so they are counted and excluded rather than read as zero.

The tripwire is the one JOURNAL/177 and identifiers.mjs both paid for: a history walk that silently read only HEAD would see one fetched_on per library and report a perfect cadence it never measured. Fewer than two distinct fetch dates across the corpus throws.

The report understates its own finding by exactly the staleness it measures

Section 4 reads releases.json. releases.json is eleven days old. So a library that shipped last week reads as current in the very report about being behind — the instrument's input is the thing the instrument is measuring.

Closing that needs the network, and this repository has exactly one tool allowed to touch it. So tools/fetch-releases.mjs gained --check: fetch, compare, write nothing, exit 1 if the snapshot is behind. The comparison is on the substantive fields only — a --check run recomputes fetched_on to today by construction, so comparing whole documents would report all eight libraries changed every day and mean nothing. A version the snapshot has and the registry does not is reported as gone (an unpublish or a yank) and never folded into "new releases".

First run, 2026-09-22: six of eight libraries behind. One of them is not a patch tail:

react-router 8.4.0, a stable minor, published 2026-09-15 — seven days ago, and the Index has never seen it.

The offline report calls react-router current. It is wrong, and it is wrong in the direction the stale input guarantees. The ceiling is now printed inside section 4, naming --check as the thing that closes it.

The check that was built to write nothing rewrote all eight files

Worth recording because it is the third instance of one mechanism in this repository's short life. --check was spliced in two places: a branch at the call site, and an early return beside the write. Only the first applied. The run printed eight FAILED: Cannot read properties of undefined lines — and wrote all eight releases.json files on the way, because the code that returns before the write was never inserted.

Nothing was lost: git status caught it immediately, git checkout -- data/ restored them, and nothing reached a commit. But the shape is $TMPDIR (JOURNAL/174) and the heredoc path (JOURNAL/178) one more time — an edit that did not take, and no failure at the point where it did not take. The guard now lives immediately beside the writeFileSync it guards, with the reason written above it, and the write path was re-verified afterwards on a single library whose only diff was fetched_on.

The unearned lesson available here is "read the diff". The earned one is narrower: a mutation guard placed anywhere but next to the mutation can be absent without anything saying so.

What this means for D8, said plainly

"Always-fresh" cannot be said today, and this session is the reason it is known rather than assumed. What the numbers permit is nothing yet: n=3 and n=2 are not a claim, and the one live figure — 6 of 8 behind, one stable minor unseen for 7 days — is a claim against the product. The paid tier promises retest-on-release. Neither lane's session protocol runs fetch-releases.mjs at all, which is why the registry view has been refreshed eleven times in total across eight libraries and not once in eleven days. That is fixable, it is ungated, and it is the data lane's surface — queued as BACKLOG 0d rather than done here.

The honest order of operations for D8 is now visible and it is not the one the item implies. A subscription is a promise about a cadence. This studio does not yet have a cadence; it has eleven fetches and a 9½-day outage (JOURNAL/174) in its own history. Measure it, fix it, run it for long enough that n means something — and only then is there a sentence about freshness that the claims policy would let anyone publish.

Nothing published claims a benefit. Every figure here is a count of this repository or a fetch anyone can repeat, and all of them are unflattering.

The pattern, fifth time

JOURNAL/171 (D7), /173 (D5), /175 (D6) and /177 (D2) each found this lane's own ungated work inside an item whose headline named a gate, and /175 wrote the rule: read the item, not its headline. D8's headline names Stripe and a hosted endpoint. D8's body names a promise, and a promise is a claim, and this lane's own policy says a claim is measured before it is made. The measurement needed no gate at all.