Release review of the pins piece, its short form, the front page that carries it, and the record behind them

Findings

This is the release gate for articles/pins-move-over-weeks.md, its illustration, its short form, the front page's lead, paragraph, table row and next question, and the record studies/LH008/. The reviewer read the dispatch, AGENTS.md and R-0007, then the record, its brief and sources, its scripts, and the tables in data/, then the piece, the short form and the front page changes sentence by sentence against the record. It went to the primary sources as the dispatch asked: ClickPy's top 200 for August 2026 was queried again with the study's SQL; OSV was queried again for every one of the 200 projects and the five chosen records were read by id; PyPI's release lists were read for the 16 projects with a qualifying advisory, and the selection rule in brief.md was reapplied from those reads; 17 repositories were cloned afresh and 18 moves or non-moves (one repository in both kinds) were re-read with a detector the reviewer wrote after reading moves_one in scripts/collect.py, without sharing its code; every derived table in data/ was recomputed from lags.csv, moves.csv, screen.csv, trailers.csv and read_log.csv with the reviewer's own short Python; the rates in hazard.csv were recomputed and two of their windows were found to be wrongly bounded; and both figures were regenerated from their scripts and compared byte for byte before the reviewer changed them.

The verdict is that the piece, the short form and the front page can be released after the changes below, which the reviewer made. Every source reading that was repeated reproduced to the second and the byte: the 200 projects and their download totals, all 948 OSV records, the 68 qualifying advisories and the rule's choice of these four libraries, the eight release upload times, and all 18 moves (snapshot commit, first moving commit, committer time, authorship class). Every count in the tables reproduced. What had to change was two windows in the rates table whose labels did not hold (the "2 to 7 days, before every advisory" row contained five moves made after urllib3's advisory, and the "7 days before the advisory" row's denominator counted 135 repository-days before the fixes existed); the record's and piece's silence on the other seven GitHub advisories published against pyjwt and starlette the same evening; one urllib3 Dependabot move whose author time, 14.8 hours before the advisory, the record had noted as a discrepancy but not read; a count of the study's own network reads that counted its clones twice; and small phrasings in the piece. None changes the Answer's shape: two short spells of quicker moves, one of two days after the release and one of about a week after the advisory, at about the same pace, with most moves at neither; a fix moving about twice the share of pins within 30 days that a release no advisory named did. The release's spell is shorter than the first edition's second row implied.

The piece, sentence by sentence, against the record and its tables

Line numbers are the piece's as found. "Live" means the reviewer's own read on 27 September at 08:01 UTC; "recomputed" means from the tables in data/.

The record against the primary sources

The writer's points, and what else was found

1. Must fix, fixed. The rates' windows. urllib3's advisory came 3.9 days and cryptography's 5.9 days after their releases, so a window from day 2 to day 7 after the release straddles them, and five of its ten moves are urllib3's in the day after its advisory. The record's table called the row "before every advisory" and the piece read it as the release's spell "easing to about two". Stopping the window at the advisory where it came first gives 1.51, the pace of the weeks between, so the release's spell is two days, not a week. The "7 days before the advisory" row began before the releases for two libraries; it now begins at the release, and is labelled as mixing the release's days. scripts/analyse.py's hazard section was rewritten to take window bounds per pair, data/hazard.csv regenerated (every other table byte-identical), scripts/draw_figure.py's panel and note changed and rates.svg regenerated. The record's Answer, rates table and note, the piece's line 27 and the short form's rates sentence now carry 1.4 (all four libraries, from day 2 to the advisory) in place of 2.2, and "between 1.3 and 1.7" is supported by the rows 1.34, 1.41 and 1.66.

2. Must fix, fixed. The evening of 15 June. The record, the piece, the short form and the figure spoke of three advisories that evening. OSV lists ten GitHub advisories against the three libraries between 17:28 and 20:40 UTC, four of them rated high (a second against starlette, fixed in 1.3.1, released 12 June). Every one of the ten named a fix already on PyPI. The record's Findings and Limits now list them and say that a repository reacting to any of them is counted against the chosen one (aindy-runtime moved to 1.3.1 with a message naming four starlette advisories); the piece's opening says "We followed the three"; the short form says "among ten against them that evening"; the figure's annotation says "the three advisories we followed".

3. Must fix, fixed. geonode's author time. The record noted that geonode's author and committer times differ by more than a day, and its interpretation paragraph said the three urllib3 Dependabot moves fit a security update opened on the advisory. Read from a fresh clone, the commit was authored by dependabot[bot] at 00:03:28 UTC on Monday 11 May, 14.8 hours before the advisory, and committed to master by a person at 08:57 UTC on 12 May, so the proposal was open before the advisory. devsecops-engine-tools' branch tip was authored 2.2 hours after the advisory; cytomine's squash carries no proposal time. The record's Findings and Limits and the piece's line 47 now say so, and the "fits a security update" reading is narrowed to the two.

4. Fixed. The count of the study's own reads. "217 clones and about 1,100 requests to public APIs" counted the 264 clone rows among the requests; read_log.csv holds 877 HTTP requests and 264 clone attempts. The record's header and the piece's colophon now say so.

5. Kept. "One pinned project moved in the day after" for pyjwt and starlette. Recomputed: pyjwt 0, starlette 1 (aindy-runtime, 0.33 days), one in all, as the piece says.

6. Should fix, fixed. "A branch a bot had opened." Two of the 16 merged branches counted as a bot's are vantage6's release branch and grooveshop-django-api's sync of main into a long-lived branch, each with a github-actions tip; the record's Limits said so and the piece did not. The piece's line 45 now qualifies the 16.

7. Should fix, fixed. "Dependabot says which it was in its pull requests." Neither the record nor the piece read a pull request, and the sentence stated as fact what the record lists as unread. It now says the pull requests would say which, and that we did not read them. The other outside facts were checked as far as the reviewer could: Dependabot is GitHub's, the National Vulnerability Database is the US government's, OSV is an open database that aggregates GitHub's advisories among others, and the library descriptions (urllib3 an HTTP client, pyjwt a JSON Web Token library, starlette a web toolkit) are fair in plain words.

8. Note. Kept. "About twice as many pins in its first month": 50 of 102 (49.0 per cent) against 21 of 91 (23.1 per cent), a ratio of 2.12. "About four in every hundred waiting projects moved each day": 4.11 per 100 repository-days. "Restatement of the earlier finding" and "What this does to what we said before": the quoted sentence is in the earlier piece at line 49, and LH007's counts (six of thirteen within 28 hours, four of the six Dependabot's) are as its record version 0.2 has them.

9. Note. Kept. The colophon's other details (948 records, the five ids and their modified dates, the eight frame versions, the release and comparison date ranges, the read windows, 12 of 118 commits with an AI co-author trailer, eight of them Claude models) reproduce. The reviewer filled the review line and set the record version to 0.2; the Draft labels and "Version 0.9, draft" stay for the driver.

10. Note. Kept. No em or en dash in the piece, short form, front page, record, brief, study sources, either figure or the figure scripts (checked by code point; the only non-ASCII character in the reader files is the middle dot in the bylines). British spellings ("program" for software is kept). No internal reference in the reader files' prose; the colophon names the model and links the record, as the earlier pieces do. Every relative link in the piece, short form and README resolves. No project is named as vulnerable in any file; the piece says "nothing here says that any project was exposed", the record "no project here is said to have been exposed", and the short form and front page carry the same. The observation and interpretation labels in the record are where a reader needs them; the piece marks its interpretation with "we think" and "we cannot say what did it". No claim of harm now, no named compromise, nothing irreversible: the study and this review made anonymous reads only and created no account.

11. Note. Kept. The front page's lead, paragraph, table row, next question and footer agree with the record as corrected; none of them carries the 2.2 figure or the "three advisories" count, and the reviewer made no change to README.md.

What the review could not check

• The other 175 moves and non-moves: the study's tables, taken as published; the 18 re-read agreed in every field.
• The 436 screening reads and Open Source Insights' lists: not repeated; the frame counts, hash ranks and screening decisions were recomputed from frame.csv and screen.csv, and the lists as served today may differ from the 07:24 read.
• Whether the brief's rules were written before 07:19:49, when the top 200 were read: consistent with the log, not provable from it.
• Whether GitHub's squash and merge commits were made by a person or by auto-merge: the committer is GitHub's identity and the record cannot tell.
• Dependabot's pull requests, GitHub's own advisory pages and the releases' notes: not read by the study and not by the review; the GitHub API is refused here.
• The figures were regenerated and their text read, not rendered.
• The review's own cost is not measured here; the driver prices it from the transcript. Its network use: one ClickPy query, 205 OSV requests, 16 PyPI reads, 17 blobless clones (209 MB on disk), and no other request.

Changes made by the reviewer

1. studies/LH008/scripts/analyse.py: the hazard section takes per-pair window bounds; new and relabelled windows. studies/LH008/data/hazard.csv: regenerated (16 rows). Every other table in data/ is byte-identical after the rerun.
2. studies/LH008/scripts/draw_figure.py and studies/LH008/rates.svg: the second bar's window and the panel note; the description; regenerated.
3. studies/LH008/LH008.md: version 0.2; header (authors, cites, the count of reads); the Answer's rates sentence; the advisories paragraph (the ten that evening); the rates table and its note; the urllib3 Dependabot paragraph; two Limits entries; the Corrections entry.
4. studies/LH008/scripts/draw_piece_figure.py and articles/pins-move-over-weeks.svg: the annotation and the description; regenerated.
5. articles/pins-move-over-weeks.md: the opening paragraph; line 27; the alt text; lines 45 and 47; the colophon (reads, record version, the review line).
6. articles/short/pins-move-over-weeks.md: the opening sentence; the rates sentence.
7. README.md: unchanged by the review.

The sentences of version 0.1 that were replaced, for the record: the rates table's rows "fixed release | 2 to 7 days (before every advisory) | 10 | 448.2 | 2.23" and "advisory | 7 days before to the advisory | 9 | 599.3 | 1.50"; the Answer's "against 1.3 to 1.7 per 100 repository-days in the weeks between the two and in the three weeks after the advisory"; the Findings' "they fit a security update opened when the advisory was published, and they fit equally a weekly version-update schedule"; the Limits' "which does not change which window it falls in"; and the header's "217 clones of public repositories and about 1,100 requests to public APIs".

Verdict

Nothing remains that must be fixed. The piece, the short form and the front page's lead, paragraph, row and next question can be released as they now stand; the driver removes the Draft labels, sets the piece's and short form's version and date on release, adds the releases.md line, and commits the record at version 0.2 with the piece. Version 0.1 of the record was never committed; this note quotes the sentences it changed.