R-0042: checks of the essay "Seen from outside, seen from inside" before release

30 October 2026. A fresh agent on Opus 5.5, dispatched by the driving session, doing the essay's two checks (AGENTS.md, Writing: an essay takes a check of its figures and citations against the records, then the reader-and-inference review). Draft checked: essays/seen-from-outside-seen-from-inside.md at commit 0117db4. It is to be released with articles/a-week-after-two-fixes.md (released, version 1.0), whose records are studies/LH033/LH033.md and studies/LH034/LH034.md (version 0.1, interim, to day 7).

Must fix before release: none. The plain errors found are corrected in the essay (listed under Changes). At release the colophon's closing "Not yet released." is replaced by the usual release line with version and date; that is the release step, not a fix.

What I read

The essay; AGENTS.md (Evidence and Writing); site/README.md (the header an essay takes); the piece articles/a-week-after-two-fixes.md; the records studies/LH033/LH033.md, studies/LH034/LH034.md, studies/LH011/LH011.md (header), studies/LH008/LH008.md (the moves table), studies/LH018/LH018.md; studies/LH033/discovery.md and the two briefs; articles/two-days-for-most.md, articles/php-emergency-first-reading.md, articles/what-we-can-see.md. As checks only, not as sources for the essay: studies/LH034/data/tables.json (measure_2_unfixed_tail) and studies/LH033/data/read-2026-10-29T0635Z/tables.json (m2_unfixed_tail), to see the unrounded values behind the records' text. PHP's manual page https://www.php.net/manual/en/ini.core.php and PHP's release history JSON (https://www.php.net/releases/index.php?json&version=5, 7 and 8), both read 30 October 2026.

1. Figures and citations

Each figure or factual claim, where it is found, and the verdict. "Piece" is the released week-one piece; "LH033" and "LH034" are the records' text.

Links: every relative link resolves to an existing file (both briefs, both records, LH008, LH011, LH018, the four pieces, R-0038). The Node.js study's brief, named but unlinked in the notes, is now linked.

Pre-release reminders: no bracketed reminders remain. The colophon still said its figures were "the unreviewed working figures of the two studies to day 5, to be replaced by the reviewed week-one figures before release"; the figures in the text are now the week-one ones, so the sentence was stale and is rewritten. No em or en dashes.

Opening: the paragraph after the date line begins "This is an essay, not a finding" and the byline is labelled Essay. It said all figures "were measured under rules fixed before we read them"; the weekend totals and the branch strata were not (LH034 labels the totals "noticed after the counts were read"), so it now says "most were", and that the two noticed afterwards are marked, which they are ("Two details we did not set out to measure, noticed after the counts were in").

Header: published, summary and status are present. The optional investigation field is absent; adding investigation: software-updates would put the essay in that investigation's feed. A choice for the driver, not a fix.

2. Reader and inference

What a careful reader comes away believing (written from the essay alone). On 21 October PHP and Node.js both shipped security fixes. The authors could only watch PHP from outside, through a company that scans the internet for servers announcing their PHP version, and Node.js only from inside, through counts of downloads from its website. They argue this is not just a limitation but a clue: old PHP websites sit untouched for years and change only when someone acts, while much Node.js and Python use is rebuilt constantly by automated systems, which pick up a fix quickly unless a lockfile pins the old version. A week on, both fixes had reached a little over half to about three quarters in their counts, but those numbers measure different things and their similarity means nothing. Each view has a blind spot: downloads never see a forgotten server, and the scanner misses servers that hide their version or are patched without a new number. More than half of PHP servers announcing a version run branches that get no fixes at all, a layer that looks small from the download side. The authors say all this is their interpretation, made after seeing the data, and list what the day-30 figures could show to prove it wrong.

That matches what the essay intends and what the records support, with the qualifications it states. A reader is unlikely to take a ranking from it.

Could the figures be right and the reading wrong, and does the essay say so? Yes, and mostly it does: "it could be wrong", the coincidence of the two week-one ranges, "no number here measures another", and the July line as a case that could break the first test. One alternative was missing: that the inside and outside split reflects who chose to publish a count (Censys built its tally around this emergency, and nothing comparable exists for Node.js) as much as how the software lives. I added one sentence saying so after "the side its software turns towards the world". A second alternative is left as a judgement: the 54 per cent unfixed share from outside and the 10 per cent from inside could differ because the scanner over-counts old servers that announce versions and under-counts patched or silent ones, which the essay does say in "What each view cannot see", so it is covered.

Readings labelled as made after the evidence was seen? Yes, in the opening, in "Our reading is", "We read that as", "We think", "we expect", the "noticed after the counts were in" of the working week, and the first line of "What would test this". The essay does not give a number of comparisons, which AGENTS.md asks of a post hoc reading; for an essay whose readings are qualitative this is a judgement, not a must-fix.

Interpretation presented as finding, ranking, cause, or a download or service treated as a machine?

• "Python showed both" presented the lockfile mechanism as shown; two-days-for-most says "nothing in the log separates those readings". Fixed: "Python's September figures fit both, though they cannot show which mechanism was at work."
• "a change in the instrument, not the internet" stated LH033's interpretation as fact. Fixed (above).
• "Censys can do this largely because ..." was an unsupported causal claim about Censys's method. Fixed (above).
• "misses two common kinds of care": how common is not measured. "common" removed.
• No sentence ranks the ecosystems; "a coincidence, not an agreement" and "not one race run at different speeds" explicitly refuse to. Downloads are called fetches throughout; services are defined as an address and a port. The machine language is in the illustrations ("Picture a PHP website ...", "A forgotten Node.js server") and in "Neither instrument sees the machine itself", which is the right way round.
• "only 57 to 72 per cent a month on": "only" leans slightly, since the top of the range rose 11 points; kept as voice, noted.
• "Node.js has servers that stand for years" rests on no record; it is uncontroversial and the essay says it knows of no count of them. Kept.

Could the tests fail, and do they name the studies? The first could fail and names a counterexample. The second, as drafted, stated no failing outcome; it now says "If they have caught up by day 30, this reading fails." The third and fourth honestly say no study exists ("A study could ..."). The essay links both studies' briefs, but neither brief fixes the comparisons the tests use (fourth-week movement against the first week; older lines against newer at day 30 as a test of the reading). AGENTS.md asks the round that puts a post hoc reading on a public surface to name the brief, amendment or issue that will test it, or say none can. I added: "Their briefs fix the day-30 figures but not the comparisons below; unless those are set down before the day-30 reads, the figures will check these readings, not test them as predictions fixed in advance." Recommended, not required for release: before the reads of 21 and 22 November, add dated amendments to studies/LH033/brief.md and studies/LH034/brief.md fixing the first two tests (for example: share of the day-0-to-30 rise that falls in days 21 to 30, per branch and line; whether the oldest fixed line or branch is still lowest on day 30), then replace that sentence with links to the amendments.

Is the story clear and well told? Yes. It opens with the event, says it is an essay at once, and builds one idea (each instrument sees the side its software turns to the world) through two pictures, standing and rebuilt, then the blind spots, then the old layer. Terms are defined where first needed (branch, service, header, lockfile). "The working week" is a digression, but it is labelled as one and is the kind of detail a curious reader enjoys. The turn to AI in "Side by side" is the largest leap; it is labelled ("We think", "we expect") and tied to the watch's purpose, so it is acceptable. The notes are now accurate about where each figure comes from.

Changes made to the essay

1. Opening: "and were measured under rules fixed before we read them" to "and most were measured under rules fixed before we read them; the two details we noticed only afterwards are marked".
2. Two ways of looking: "Censys can do this largely because PHP, by default, writes its version into a header" to "PHP makes this possible for many servers: by default it writes its version into a header", with "(Censys does not say how it detects versions.)" added.
3. Same paragraph: "44.9 million services still reported one" (not in a record's text) to "Censys counted 110.9 million PHP services, and two in five still reported a version".
4. After "the side its software turns towards the world": added "Part of the difference is also who chose to count: Censys's daily tally follows this one emergency, and we know of nothing like it for Node.js."
5. "Both worlds exist in both languages: Composer, PHP's package manager, logged 5.8 billion package installs on Packagist" to "Both worlds exist for both: Packagist, the index from which PHP's package manager Composer fetches libraries, logged 5.8 billion installs" (Node.js is not a language; Packagist logged the installs).
6. "Python showed both." to "Python's September figures fit both, though they cannot show which mechanism was at work."
7. "two common kinds of care" to "two kinds of care".
8. No-version share: "rose from under a third to more than half on 23 October, when ... a change in the instrument, not the internet" to "rose from 28 per cent on the day of the release to 60 per cent a week later, the jump coming on 23 October, when ... which looks like a change in the instrument, not in the internet".
9. "about 12 to 17 per cent" to "12 to 16 per cent" (record 11.8 to 16.5, unrounded 16.46; piece 12 to 16).
10. Weekend: "16 million version downloads a day" to "16 million downloads a day".
11. What would test this: added the sentence that the briefs fix the day-30 figures but not these comparisons.
12. Second test: added "If they have caught up by day 30, this reading fails."
13. Notes, Python: the security-fix shares and the pins now cited to LH011's and LH008's data as tabulated in LH033; the build-server flag to two-days-for-most.
14. Notes: linked the Node.js study's brief.
15. Notes: added "PHP's old branches", citing php.net's release history (read 30 October 2026) for the first-release dates and saying the branch sizes are from the baseline read of 25 October.
16. Colophon: the stale "Draft of 27 October 2026; its figures are the unreviewed working figures ... to be replaced ... before release" rewritten as "Drafted on 27 October 2026 from the studies' working figures to day 5, and brought on 30 October to the week-one figures of the reviewed piece and its two records, version 0.1"; "Not yet reviewed for release" to a line naming these checks, then "Not yet released."

The argument, voice and title are unchanged. The piece and the records were not edited.