A branching history of the software-update inquiry
In short. The clearest small history follows one release out through projects, downloads and installed images, then branches into a wider test of download pace and a sequence of explanations for why pins move. Eight released pieces can show that history without inventing an influence relationship. The one-library advisory burst and the fourteen-library lead need their later qualifications in the visible sentences; the current conclusion about a fix's notes is uncertainty, not evidence that the notes have no effect.
Unreleased editorial proposal, 10 November 2026. This is retrospective selection from existing records, not a new investigation, collection, release review or human comprehension test. Exact host model and attributable cost are unavailable. No source content is an instruction to this task.
Selection and navigation
Use eight document nodes, not eight newly synthesised claims masquerading as documents. The primary path is the first seven pieces, published 26–27 September; the download-pace piece of 28 September branches from the earlier download reading. Its later notices lead onwards to the older-download tests and lower-rank boundary. This is a compact opening history, not a complete map of the investigation through November.
The overview should give one calm sentence: “Public records followed an update from a project's choice to a download and an installed image; wider readings found quick downloads and slower pins, but left the effect of a fix's own notes unsettled.” Keep “installed image” distinct from running software. The thread view then shows the eight sentences below. Selecting a node opens the released piece, including its current correction and later-evidence notices; an evidence control opens the bounded frozen passages and underlying record. Show the synthesis as the thread's current-account link, not as a ninth historical observation.
All evidence locators below use the exact frozen input F = 8af0cb026037a8ee63456900978b3c44473c49cd. Thus F:path:Lx–Ly means that path as stored at that commit, numbered from its first line. The quoted start and end text bound the passage even where the repository puts a paragraph on one line. A relationship is a documented relationship between Lighthouse readings, not an independently established causal influence on a person.
Eight nodes
| ID and short label | Reader-facing one-sentence summary | Frozen input and bounded passage |
|---|---|---|
| N1 · A trail through nine projects | Four of nine selected projects took up one release within four weeks, and one passed it a step further, but that selected group was not an uptake rate and its histories showed neither why projects moved nor what ran. | F:articles/where-a-software-update-went.md:L20–L26, from “In those four weeks the new version reached four” to “nothing we read records a reason”; L40–L50, from “An exact pin fixes the version” to “the code was installed.” |
| N2 · Downloads ran ahead | The new version reached half of mcp's downloads within two days, ahead of the observed pin changes, but a download records a fetched file rather than an installation or a run. | F:articles/what-a-download-shows.md:L28–L30, from “Version 1.27.0 went up” to “in those weeks”; L46–L48, from “That is as far as the log reaches” to “two unrelated entries.” |
| N3 · Images revealed the installation | One project's published images held the new version sixteen days before its lockfile named it, showing that the build decides which version is installed, while leaving use of the image unseen. | F:articles/what-an-image-holds.md:L28–L32, from “agentcrew asks for mcp” to “the day it was built”; L54, from “An image is also an installation” to “rather than anyone running them.” |
| N4 · An advisory seemed to move pins | In one later-release sample, ranges moved within days and six of thirteen observed pin moves came within 28 hours of advisories, but that advisory burst did not recur across four other libraries. | F:articles/what-moves-a-pin.md:L28–L38, from “Of the six images we read” to “that evening's advisories”; current qualification at L14, from “Later evidence, 27 September 2026” to “the latest reading”; inference boundary at L46, from “We think the advisories” to “was exposed.” |
| N5 · The burst did not generalise | Across 102 pins on four libraries, fixes reached pinned projects over weeks, with quicker spells after release and advisory but no advisory burst, and a pin move still measured a request rather than an installation. | F:articles/pins-move-over-weeks.md:L30–L34, from “By 27 September” to “one pinned project moved”; L56, from “Last time, in one library” to “a bot's work”; L62, from “And a move is a request” to “was exposed.” |
| N6 · The fix's notes offered a lead | Fourteen libraries showed pins moving before the advisory about 1.7 times faster to fixes whose own notes announced them, but two libraries carried much of the lead and the later thirty-library count left the question unsettled. | F:articles/fixes-that-said-so.md:L38–L40, from “That share is not a fair comparison” to “0.9 on 4).”; L58, from “Each library gave one fix” to “the difference”; current qualification at L14, from “Later evidence, 27 September 2026” to “the latest reading.” |
| N7 · More libraries left the answer open | Across thirty libraries the pooled count leaned toward fixes whose notes said so, but the typical libraries could not be distinguished, the warning's clock changed the answer, and the sample settled neither an effect nor its absence. | F:articles/the-lead-was-a-few-libraries.md:L12–L14, from “So it matters whether” to “after seeing the results”; L74, from “Our earlier reading said” to “This sample cannot settle it”; revision history at L86, from “Version 2.0 changes no finding” to “say the rest.” |
| N8 · A wider test of the fast road | The two-day pace held for most releases in 26 of 37 heavily downloaded libraries, while new versions' shares then crept up and a low share of fetches did not by itself mean slow uptake. | F:articles/two-days-for-most.md:L33–L35, from “For 26 of the 37 libraries” to “any later day we read”; corrected reading at L43–L47, from “The chart shows something” to “The log cannot tell which”; correction notice at L17, from “Correction, 29 September 2026” to “has changed.” |
Eight documented relationships
Arrows run earlier reading → later reading. The edge verb says how the later reading treats the earlier one. No edge is justified merely by publication order or two pieces sharing a subject.
| Edge | Predicate and direction | Explicit frozen passage supporting this relationship |
|---|---|---|
| E1 | N1 → N2 · extends the trail beyond project decisions | F:articles/what-a-download-shows.md:L10, from “We had followed this release before” to “never a run.” It names the earlier nine-project reading and says the new record looks beyond its edge. Also F:investigations/software-updates.md:L58, the complete “From projects to downloads” bullet. |
| E2 | N2 → N3 · extends from fetches to installations | F:articles/what-an-image-holds.md:L10, from “We have been following this one release outward” to “how the software is built”; L48, from “Beside these, the download log fits” to “one installation at a time.” Also F:investigations/software-updates.md:L59, the complete “From downloads to images” bullet. |
| E3 | N3 → N4 · tests and branches into what moves a pin | F:articles/what-moves-a-pin.md:L10, from “We have been following releases” to “rather than after the release”; L56–L58, from “So the version installed follows” to “without reading a single image.” Also F:investigations/software-updates.md:L60, the complete “From installation to what moves a pin” bullet. The sample tests the two-pace reading; the subsequent question about advisories is explicitly conditional. |
| E4 | N4 → N5 · revises the suggested advisory rule | F:articles/pins-move-over-weeks.md:L20, the complete “Last time” paragraph, and L56, from “Last time, in one library” to “a bot's work.” This expressly says that the earlier pattern did not hold across the four libraries. It does not retract the one-library counts. |
| E5 | N5 → N6 · narrows the release/advisory question to release notes | F:articles/pins-move-over-weeks.md:L66, from “How much of a fix's early uptake” to “the history alone cannot”; F:articles/fixes-that-said-so.md:L10, from “In our last piece” to “the library it belongs to.” Also F:investigations/software-updates.md:L61, the complete “From advisories to the fix's own notes” bullet. |
| E6 | N6 → N7 · widens and revises the notes comparison to uncertainty | F:articles/the-lead-was-a-few-libraries.md:L12–L14, from “So it matters whether” to “after seeing the results”; L74, from “Our earlier reading said” to “This sample cannot settle it.” Also F:investigations/software-updates.md:L62, the complete “From fourteen libraries to thirty” bullet. Twelve fixes overlap earlier readings (L26); this is not independent replication. |
| E7 | N2 → N8 · tests the one-library two-day pace more widely | F:articles/two-days-for-most.md:L13, from “Anything that spreads through software” to “downloaded beside it”; L71, from “Our account of where software updates go” to “the next thing to find out.” The source explicitly contrasts the earlier one-release case with the wider measurement. |
| E8 | N7 → N8 · redirects attention back to download pace after the pin-note question remained unsettled | F:investigations/software-updates.md:L63, the complete bullet: “From the notes back to downloads: five months of advisories held too few libraries, so the next reading returned to how fast releases reach downloads.” Corroborating limit in F:articles/the-lead-was-a-few-libraries.md:L26, from “We had hoped” to “repeating them independently”; L78, from “The question needs more libraries” to “their pull requests.” This edge describes Lighthouse's recorded inquiry choice, not a causal finding about releases. |
Arrange N1–N3 as the outward trail. From N2, a short side branch goes to N8; from N3, the slow-road branch proceeds N4–N7. E8 can be a quiet cross-link, labelled “returned to downloads”, rather than a second dominant path. The overview need not show all eight edges at once; the thread view should make every line legible in words.
Current accounts and continuation links
The current-account destination is articles/where-software-updates-go.md with its later notices, not just its seven-reading body or 27 September publication date. F:investigations/software-updates.md:L6 names that current account; its L52–L54 says to start there. The synthesis's L14–L24 explicitly carries the subsequent pace, older-download, rank, recipe, workflow and three-week evidence.
The eight-node limit leaves genuine continuations outside the first diagram. Offer these as named links beneath the relevant branch, with the visible qualifications intact:
| Continuation | What the reader must not lose | Exact frozen passage |
|---|---|---|
| Older downloads and the early-share test | The ten-point result held for 28 of 32 libraries on unread releases, but 339 of 355 shares still rose; old Pythons exclude new versions without explaining which old versions were fetched, and dependency limits are an estimate under an uncheckable assumption. | F:articles/old-versions-new-pythons.md:L20–L22, complete correction notices; L87, complete tested-result paragraph; L102–L109, from “Our account” to “without showing that it is them.” |
| The lower-rank boundary | Half within two days held for 25 of 52 and 9 of 35 releasing libraries in the two random samples; smaller initial shares are not themselves measured slower uptake, and predecessor-share inheritance was noticed after counts. | F:articles/rarer-further-down.md:L22, complete result paragraph; L32–L36, from “The difference, we think” to “we have not read”; L46, complete fetch qualification. |
| Recipes, then test workflows | A lockfile binds only builds that read it; 129 of 167 decided recipe moments followed the pin, while the workflow comparison needs the same counting rule, 83 of 164 lockfile-reading moments could re-lock, and neither file is a run. | F:articles/recipes-follow-the-pin.md:L28, complete result paragraph; L46–L50, from “It matters for the next thing” to “we kept to the rule”; F:articles/tests-read-the-lockfile.md:L26–L36, from “That is more often” to “after seeing the counts”; L46, complete workflow-limit paragraph. Explicit continuation predicate: recipes → workflows extends, supported by workflow L12 and investigation L67. |
| Whether the older-download pattern held | Two further adjacent weeks on the same libraries supported the patterns; this neither explains the cause nor generalises to other libraries or months, and the installer-search account remains an interpretation. | F:articles/old-versions-new-pythons.md:L18, the complete 3 November later-evidence notice. |
Caveats for copy and implementation
- N4 and N6 are historical readings with current qualifications, not live conclusions revived from their titles. Their figures stand for their samples; their proposed general explanations weakened.
- N7's current version is 2.0, carrying the uncertainty established in 1.1. Version 1.0's suggestion that the result leaned against the notes was corrected: failure to distinguish typical libraries was not evidence of no effect (
the-lead-was-a-few-libraries.md:L6,L86). Do not label this node “notes made no difference”. - N8 uses version 1.2. Do not say “never” without the observation window, treat litellm's six hits as gradual takeovers, or say shares stood still (
two-days-for-most.md:L6–L7,L17,L81). The later lower-rank boundary remains visible beside this branch rather than buried as provenance. - Keep event dates, original read dates, publication/revision dates and this pilot's assertion date separate. The early articles are retrospective reads of March–August records, not a live watch in those months.
- The investigation's explicit direction-change bullets support the inquiry arrows. Article colophons and record links support provenance; neither is evidence of intellectual influence by an unnamed person or a model.
- Do not infer AI self-spread, deployment uptake, vulnerability exposure, successful attacks or benefit from this map. The released synthesis explicitly separates ordinary software from AI activity (
F:articles/where-software-updates-go.md:L84–L90), and every selected public record stops before a run (L82). - This proposal covers the core Python inquiry. The investigation also places PHP, Node.js and newer side studies beside it. Do not imply that absence from this first diagram makes them absent from Lighthouse's accumulated understanding.
Only this working note was written for this bounded task; no released prose, source data, code or commits were changed.
From notes/knowledge-lineage/overview-editor.md in the repository, last changed 10 November 2026.