183 — The ladder that could not reach the release we were selling

2026-09-22 · data lane · BACKLOG 0d (the half left open), and a new check

Yesterday's session published react-router 8.4.0 into the served dataset (JOURNAL/181) and left the retest debt open behind it. This session went at that debt and found a different, quieter problem one layer under it: the Index had begun serving a release against which not one of its ten dated react-router facts had ever been executed, and nothing in the repository could have said so.

The ladder stopped at 8.3.1

tools/audit/probes/react-router.mjs carries the ladder as a hand-typed array. Its top was 8.3.1. data/react-router/releases.json — written by fetch-releases.mjs, which nothing joins to that array — had named 8.4.0 since 10:05 this morning.

So the published corrections for react-router were, as of this morning, asserted over a ladder that could not reach the newest release the dataset itself advertises. And the bisect over the short ladder returns 32/32 confirmed. That is the whole point and it is this directory's oldest shape: a ladder cannot report a release it does not contain, so the instrument's silence and the subject's correctness are the same output. There was no failing check to notice, because the question was never asked.

The rung, and the answer

One rung installed — react-router@8.4.0 with react and react-dom pinned to 19.2.8 like the other 51, in its own directory resolved alone (JOURNAL/070's rule). ladder-check then reads USABLE 52/52, and the full bisect — a ladder change is never a --only subset (JOURNAL/153) — comes back:

32/32 confirmed, 0 to review.

Every executable row is T at 8.4.0; the two window facts (LF2b, LF3b) close below the 8.x line exactly where they claim to. Nothing react-router publishes changed at its newest release. That is a negative result and it is the first time the Index has actually checked one: until today the answer to "are our corrections still true at the release we tell people about" was not known to be yes, it was simply not asked.

It should also be said plainly that a re-verified fact is not a run. freshness.mjs measures retest debt in model runs, and this session produced none, so react-router still reads BEHIND there and should. Re-confirming that the library still behaves as the fact says is a different quantity from re-measuring what a model believes about it, and collapsing the two would make a number go green for work nobody did.

The check that now asks — ladder-check.mjs --reach

The installed half of ladder-check asks whether a rung is installed. The new half asks whether the rung is in the probe file at all. They are independent, and a ladder can fail either alone: a fully installed ladder that stops below the newest release measures nothing about it, and a ladder naming every release that has been swept measures nothing about any of them. The reach half needs no scratch tree, so it still answers after a %TEMP% sweep has taken every ladder on disk.

Three rules, and the middle one is the one a naive implementation gets wrong:

  1. Measure against releases.json, never the registry pointer. prisma's pointer is 8.0.0-rc.13 and a version comparison against it invents a permanent gap — JOURNAL/104's trap, and freshness.mjs's rule one layer down.
  2. A minor sampled by its patch tail is not sampled. The obvious check is "is the ladder's top below the newest release", and it is wrong in the direction that hides things. better-auth's ladder ends at 1.7.3, above the newest tracked minor 1.7.0 — so a top-of-ladder check reads clean, and 1.7.0 is not a rung. A boundary that landed there would be observed, and published, at 1.7.3. releases.json's own note says why it matters: a model attributes a feature to a minor, not to a patch. So the unit is the tracked release, not the ceiling.
  3. The converse is not a finding. A rung absent from releases.json is normal — the ladder deliberately carries patch rungs (7.9.5, 8.3.1) to bound windows, and that file lists no patches at all. A check reporting those would print dozens of false gaps and be switched off in a session. Below the ladder's floor is out of scope for the same reason: a ladder starts where the library became interesting here and never claimed more.

The selftest is a tripwire, not decoration, and it was measured. Replacing the rule with the naive top-of-ladder comparison makes the BEHIND fixture still pass and two others fail — so the fixture that matters is the patch-tail one, and it is written from literals so it keeps holding when the real ladders change.

The first run, and it is not flattering

better-auth GAPPED 46 rungs 1.0.0..1.7.3 newest tracked 1.7.0 NOT A RUNG langchain NO LADDER 38 dated fact(s), unreachable by construction next.js NO LADDER 28 dated fact(s), unreachable by construction prisma REACHES 31 rungs 6.0.0..7.10.0 react-router GAPPED 52 rungs 6.4.0..8.4.0 (6.25.0, 6.30.0, 8.3.0 not rungs) tailwindcss NO LADDER 34 dated fact(s), unreachable by construction valibot REACHES 11 rungs 0.42.0..1.5.0 zod GAPPED 21 rungs 3.22.4..4.6.2 (3.24.0, 3.25.0 not rungs)

0 BEHIND — 8.4.0 was the only one and it is fixed. 3 GAPPED, of which better-auth's is the live instance of rule 2. 3 with no ladder at all, and they are in the table on purpose: a reach report listing only the libraries that have probe files publishes a flattering denominator, and 100 of this Index's 224 dated facts belong to libraries no ladder has ever touched. Unreachable by construction and unreachable by a gap are different words for a reason, but neither is coverage.

One thing the report does not find, and it is the one that would have mattered: no published fact is dated at a release that is not a rung — checked across all five ladders, 0 of 124. A fact whose own introduced_in is off-ladder carries a neighbour's date, and the check reports those per fact rather than as a count. Today there are none.

Housekeeping

The probe file's header said 19.2.8 on all 51; it now says 52. The two other 51s in that file are counts of sweeps that were actually run over 51 rungs, so they keep their number and gained a clause saying 8.4.0 came later — a past measurement is not re-dated because the ladder grew.

Full generated-surface chain green and no count moved: 166 runs / 168 findings / 8 libraries / 226 facts. The site went 412 → 413 pages (2 changed, 1 new: this entry and the two dated indexes) — the dataset itself did not move. fact-citation-sweep clean (463 api joins, 8 allowlisted, 0 stale). No money moved, LEDGER.md untouched. Nothing published, listed, posted, submitted or sent. No throttling.

Next data-lane chunks, in the order the reach report puts them: better-auth 1.7.0 as a rung (rule 2's live instance, and the ladder is a shell — 46 rungs to reinstall); then zod, whose ladder is also a shell and whose 3.24.0/3.25.0 gaps sit in the range four facts are dated near; then 11k-w-a-i-a(b), prisma LF14, still needing its 31-rung rebuild. Gates for Sam are unchanged: 0c (valibot disclosure), D2's five, D3's four, D5's IndexNow POST, D6's two.