Release review of the pin piece, its short form, the front page that carries it, and the record behind them

Findings

This is the release gate for articles/what-moves-a-pin.md, its illustration, its short form, the front page's lead, table row and "next question", and the record studies/LH007/. The reviewer read the dispatch, AGENTS.md and R-0006, then the record, its brief and sources, then the piece sentence by sentence against the record and the tables in data/, recomputing the derived counts with short Python. It went to the primary sources as the dispatch asked: three images were reread from the registries with the reviewer's own script (written after reading scripts/registry.py, not by running it), two of them successfully; the advisory was read again from OSV, once for 1.28.0 as the study did and once for mcp without a version; five repositories were cloned afresh and the four pin-moving commits the dispatch named were read, with each author and committer recorded only as a kind; the Dockerfiles, lockfiles and specifiers behind the open-range and exact-pin classifications were read at the build commits; ClickPy was queried anonymously with the study's SQL; the hash-order frame and sample were recomputed; and both figures were regenerated from their scripts and compared byte for byte.

The verdict is that the piece, the short form and the front page can be released after the changes below, which the reviewer made. Every registry reading reproduced agreed to the byte; every derived count in the tables was reproduced; the ClickPy shares reproduced day for day. What had to change was the record's compression of when pins moved ("for most of them ... within a day of a security advisory", where the figures are 0.9 to 27.6 hours and four of the nine lockfile or exact-pin repositories whose move was found, six of 13 projects in all); one fact the record and piece did not know, that three high-severity advisories against mcp were published within 18 minutes that evening, of which the study's version-specific OSV query showed only the third; mcp-atlassian's commit, counted with dependency bots when it is a FastMCP 3 migration under the project's own bot account with a person as co-author; a figure caption's "ten pins shown" where the figure draws nine; a median; and a header phrase. None changes the shares by class or the agreement of every pinned image with its pin; the claim about when pins move is narrowed.

The piece, sentence by sentence, against the record and its tables

Line numbers are the piece's as found. "Live" means the reviewer's own read on 26 September at 22:05 to 22:16 UTC; "recomputed" means from the tables in data/.

The record against the primary sources

The writer's four points, and what else was found

1. Must fix, fixed. "Within a day." The record's Answer, a Findings heading and the figure caption said the pins moved within a day of the advisory; the six moves run from 0.9 to 27.6 hours after it. All three now say 28 hours, as the piece already did.

2. Must fix, fixed. "For most of them." The Answer said the pinned images' pins moved "for most of them" a month later, within a day of the advisory. Of the 12 lockfile or exact-pin image repositories, 9 had no pin on 1.28.x within four weeks of the release (6 moved on days 30.5 to 56.6, 3 had not moved by 15 August), so "a month or more later, or not at all by mid-August" holds for most; but only 4 of the 9 whose move was found moved within 28 hours of the advisory, 6 of 13 across all classes. The Answer now gives those counts, and its bullet heading is "More first pins moved in the day after the advisory than in the four weeks after the release". The title of the piece said pinned software "moved when a security advisory came"; it now says "moved most often when a security advisory came", which is what six of 13 in one 28-hour window against three in four weeks supports, and the opening paragraph's "For most of them that was a month or more later" gains "if it had happened at all by mid-August". The same title change is in the short form, its colophon and the front page.

3. Must fix, fixed. mcp-atlassian's bot. The commit is authored under the project's own bot account, committed by GitHub's merge, co-authored by a person, and its message says it upgrades FastMCP to version 3 and raises mcp to 1.27 "with lock regeneration"; the regenerated lock holds 1.28.1. That is not a dependency bot. The record, the piece, the short form and the front page no longer say "four of the six by bots" or "by the hand of a bot"; they say four of the six were changes Dependabot wrote (three committed under its name, one merged by a person from its branch), one was under a project's own bot account with a person as co-author, and one a person's. Serena's Dependabot change was authored 3.6 minutes after the third advisory and committed to main by a person at 11:31 the next day; the piece's opening now says so instead of "a bot moved serena's".

4. Fixed. "Two and a half to four months after the builds." The record's header and the piece's line 17 now say "in the period" and "in those weeks"; the bracketing images run back to July 2025. The header's "the earliest drawn in the figure 32 days before" described the axis of installed.svg, not an image, and is reworded.

5. Must fix, fixed. Three advisories, not one. The study queried OSV for 1.28.0 and so saw only the advisory that 1.28.0 is affected by. Queried without a version, OSV lists two more high-severity advisories published 18 and 16 minutes before it, fixed in 1.27.2. openroad-mcp's "3 high-severity CVEs" are these three, named as alerts in its message, not "two of which were not identified" as the record's Limits said. The record's advisory paragraph, its Limits entry, the piece's opening and interpretation, the short form and the front page now say there were three that evening, that only the third needed 1.28.1 rather than 1.27.2, and that the hours are measured from the third (from the first, add 0.3). data/osv_mcp_all.csv and S9a in the study's sources.md hold the review's read. The timing conclusion does not change: the six moves fall between 1.2 and 27.9 hours after the first advisory.

6. Must fix, fixed. "Six of the ten pins shown." The figure draws nine diamonds. The piece's caption and the front page's now say nine. The figure's own headline said "pins moved around an advisory"; it now says "six of nine pins moved around an advisory", and the SVG was regenerated from the script.

7. Should fix, fixed. The advisory's scope. The piece and record describe the advisory accurately and neutrally (a WebSocket server transport without Host or Origin validation, rated high, fixed in 1.28.1). OSV's text adds that the transport is deprecated, is not reachable through FastMCP, and that servers using the other transports are not affected. The record's advisory paragraph and the piece's interpretation paragraph now carry that, which sharpens the disclaimer both already made. Nothing in any file says or implies that a named project or image is vulnerable or compromised: the record says "nothing here says any image or project is vulnerable", the piece "nothing here says that any of them, or any image, was exposed", and the short form and front page carry the same sentence in shorter form. No claim of harm now, no named compromise, nothing irreversible: the study and this review made anonymous reads only and created no account.

8. Note. Kept. The sample rule was applied as the brief states: the hash order is the SHA-256 of the normalised name, the first 120 in that order were screened, the 22 that qualified are the sample, and the decisions in candidates.csv precede the tag reads in read_log.csv. The frame's unread part (68 direct dependents not listed, 79 listed beyond the screening limit) is stated in the record.

9. Fixed. The download median. 50.4 for 17 June to 14 July, not 51.2, which is the upper middle value; the record says both.

10. Note. Kept. No em or en dash in the piece, short form, front page, record, brief, study sources, figure or figure script (checked by code point). British spellings. No internal reference in the reader files' prose. Relative links in the piece, short form and front page resolve. The Draft labels stay on both bylines for the driver. Both figures regenerate byte for byte from their scripts before the headline change, and the piece's figure after it. The figure was not rendered by the reviewer.

What the review could not check

• The other 46 image readings and the 26 configuration-only reads: the study's tables, taken as published; the two reread agreed to the byte.
• The public.ecr.aws image: refused with 429 throughout the review's window.
• GitHub's own advisory page: 403 anonymously through the proxy; OSV's copy of the GitHub advisory was read instead.
• The 75 screening clones and Open Source Insights' lists: not repeated; the hash order and the sample were recomputed from frame.csv.
• Whether GitHub's merges of the Dependabot commits were made by a person or by auto-merge: the committer is GitHub's merge identity in both cases and the record cannot tell.
• The review's own cost is not measured here; the driver prices it from the transcript. Its network use: two counted Docker Hub pulls and four HEADs, two ghcr.io manifests and one config, 188,761,350 layer bytes streamed, six blobless clones, two OSV queries, one ClickPy query, four raw.githubusercontent.com reads, and about eight refused requests to public.ecr.aws.

Changes made by the reviewer

1. studies/LH007/LH007.md: version 0.2; header (observation period, cites); the Answer's first paragraph and fourth bullet; two table cells (serena, mcp-atlassian); the advisory Findings paragraph, heading and content; the download median; the figure caption; the "advisory link" Limits entry; the Corrections entry.
2. studies/LH007/sources.md: S9a. studies/LH007/data/osv_mcp_all.csv: new, six rows.
3. studies/LH007/scripts/draw_piece_figure.py and articles/what-moves-a-pin.svg: the headline; regenerated.
4. articles/what-moves-a-pin.md: the title; the opening paragraph; line 5; line 17; line 31; the caption; the interpretation paragraph; the closing section; the colophon (OSV records, record version 0.2, the review).
5. articles/short/what-moves-a-pin.md: the title; the opening sentence; the fourth paragraph; the colophon.
6. README.md: the heading; the lead; the caption; "The next question".

Verdict

Nothing remains that must be fixed. The piece, the short form and the front page's lead, row and next question can be released as they now stand; the driver removes the Draft labels, fills the piece's version and date on release, adds the releases.md line, and commits the record at version 0.2 with the piece. Version 0.1 of the record was never committed; this note quotes the sentences it changed.