The audit ledger.

{
  "item": {
    "id": "cf43762e-43d2-4d66-9bd3-fab6f619b33c",
    "note": "Live advanced proof: decide",
    "source": "npm",
    "status": "ready",
    "analysis": {
      "band": "review",
      "score": 62,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "risk",
          "label": "Version distance",
          "value": "major boundary",
          "detail": "A major release can change public contracts and runtime assumptions.",
          "impact": 100,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "calm",
          "label": "Release cooldown",
          "value": "10 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 20,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "watch",
          "label": "Package surface",
          "value": "6.1 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 48,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "zod 4.6.5 crosses a meaningful change boundary. Compare APIs, run focused tests, and make the rollback path explicit.",
      "headline": "Upgrade needs a deliberate migration pass",
      "confidence": "high",
      "generatedAt": "2026-09-24T10:01:12.298Z",
      "packageName": "zod",
      "latestVersion": "4.6.5",
      "currentVersion": "3.22.4",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Search the codebase for removed or renamed APIs before merging.",
        "Deploy behind a canary or feature flag with a documented rollback command."
      ]
    },
    "snapshot": {
      "name": "zod",
      "source": "npm",
      "license": "MIT",
      "homepage": "https://zod.dev",
      "keywords": [
        "typescript",
        "schema",
        "validation",
        "type",
        "inference"
      ],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "git+https://github.com/colinhacks/zod.git",
      "description": "TypeScript-first schema declaration and validation library with static type inference",
      "publishedAt": "2026-09-13T23:25:14.484Z",
      "lastModified": "2026-09-13T23:25:14.484Z",
      "unpackedSize": 6140311,
      "latestVersion": "4.6.5",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T10:01:12.299Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T10:01:18.565Z",
    "packageName": "zod",
    "latestVersion": "4.6.5",
    "currentVersion": "3.22.4"
  },
  "action": "delete",
  "deletedAt": "2026-09-24T10:01:24.914Z"
}

{
  "item": {
    "id": "8e1a3236-3f55-4192-804d-848e8497e6a7",
    "note": "Live advanced proof: hand off",
    "source": "npm",
    "status": "paused",
    "analysis": {
      "band": "watch",
      "score": 44,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "watch",
          "label": "Version distance",
          "value": "minor boundary",
          "detail": "The distance between the installed and latest versions is measured directly.",
          "impact": 55,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "good",
          "label": "Release cooldown",
          "value": "117 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 5,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "risk",
          "label": "Package surface",
          "value": "10.9 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 82,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "date-fns 4.4.0 is worth trying, but the release is recent enough to earn a short observation window before production.",
      "headline": "Watch the release, then ship in a canary",
      "confidence": "high",
      "generatedAt": "2026-09-24T10:01:19.715Z",
      "packageName": "date-fns",
      "latestVersion": "4.4.0",
      "currentVersion": "4.1.0",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Run the application smoke path and watch runtime errors for one release window."
      ]
    },
    "snapshot": {
      "name": "date-fns",
      "source": "npm",
      "license": "MIT",
      "homepage": null,
      "keywords": [],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "https://github.com/date-fns/date-fns",
      "description": "Modern JavaScript date utility library",
      "publishedAt": "2026-05-29T23:23:42.430Z",
      "lastModified": "2026-05-29T23:23:42.430Z",
      "unpackedSize": 10902084,
      "latestVersion": "4.4.0",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T10:01:19.715Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T10:01:20.475Z",
    "packageName": "date-fns",
    "latestVersion": "4.4.0",
    "currentVersion": "4.1.0"
  },
  "action": "delete",
  "deletedAt": "2026-09-24T10:01:21.234Z"
}

{
  "after": {
    "id": "8e1a3236-3f55-4192-804d-848e8497e6a7",
    "note": "Live advanced proof: hand off",
    "source": "npm",
    "status": "paused",
    "analysis": {
      "band": "watch",
      "score": 44,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "watch",
          "label": "Version distance",
          "value": "minor boundary",
          "detail": "The distance between the installed and latest versions is measured directly.",
          "impact": 55,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "good",
          "label": "Release cooldown",
          "value": "117 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 5,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "risk",
          "label": "Package surface",
          "value": "10.9 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 82,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "date-fns 4.4.0 is worth trying, but the release is recent enough to earn a short observation window before production.",
      "headline": "Watch the release, then ship in a canary",
      "confidence": "high",
      "generatedAt": "2026-09-24T10:01:19.715Z",
      "packageName": "date-fns",
      "latestVersion": "4.4.0",
      "currentVersion": "4.1.0",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Run the application smoke path and watch runtime errors for one release window."
      ]
    },
    "snapshot": {
      "name": "date-fns",
      "source": "npm",
      "license": "MIT",
      "homepage": null,
      "keywords": [],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "https://github.com/date-fns/date-fns",
      "description": "Modern JavaScript date utility library",
      "publishedAt": "2026-05-29T23:23:42.430Z",
      "lastModified": "2026-05-29T23:23:42.430Z",
      "unpackedSize": 10902084,
      "latestVersion": "4.4.0",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T10:01:19.715Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T10:01:20.475Z",
    "packageName": "date-fns",
    "latestVersion": "4.4.0",
    "currentVersion": "4.1.0"
  },
  "action": "update",
  "before": {
    "id": "8e1a3236-3f55-4192-804d-848e8497e6a7",
    "note": "Live advanced proof: hand off",
    "source": "npm",
    "status": "watching",
    "analysis": {
      "band": "watch",
      "score": 44,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "watch",
          "label": "Version distance",
          "value": "minor boundary",
          "detail": "The distance between the installed and latest versions is measured directly.",
          "impact": 55,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "good",
          "label": "Release cooldown",
          "value": "117 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 5,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "risk",
          "label": "Package surface",
          "value": "10.9 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 82,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "date-fns 4.4.0 is worth trying, but the release is recent enough to earn a short observation window before production.",
      "headline": "Watch the release, then ship in a canary",
      "confidence": "high",
      "generatedAt": "2026-09-24T10:01:19.715Z",
      "packageName": "date-fns",
      "latestVersion": "4.4.0",
      "currentVersion": "4.1.0",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Run the application smoke path and watch runtime errors for one release window."
      ]
    },
    "snapshot": {
      "name": "date-fns",
      "source": "npm",
      "license": "MIT",
      "homepage": null,
      "keywords": [],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "https://github.com/date-fns/date-fns",
      "description": "Modern JavaScript date utility library",
      "publishedAt": "2026-05-29T23:23:42.430Z",
      "lastModified": "2026-05-29T23:23:42.430Z",
      "unpackedSize": 10902084,
      "latestVersion": "4.4.0",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T10:01:19.715Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T10:01:19.715Z",
    "packageName": "date-fns",
    "latestVersion": "4.4.0",
    "currentVersion": "4.1.0"
  }
}

{
  "item": {
    "id": "8e1a3236-3f55-4192-804d-848e8497e6a7",
    "note": "Live advanced proof: hand off",
    "source": "npm",
    "status": "watching",
    "analysis": {
      "band": "watch",
      "score": 44,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "watch",
          "label": "Version distance",
          "value": "minor boundary",
          "detail": "The distance between the installed and latest versions is measured directly.",
          "impact": 55,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "good",
          "label": "Release cooldown",
          "value": "117 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 5,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "risk",
          "label": "Package surface",
          "value": "10.9 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 82,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "date-fns 4.4.0 is worth trying, but the release is recent enough to earn a short observation window before production.",
      "headline": "Watch the release, then ship in a canary",
      "confidence": "high",
      "generatedAt": "2026-09-24T10:01:19.715Z",
      "packageName": "date-fns",
      "latestVersion": "4.4.0",
      "currentVersion": "4.1.0",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Run the application smoke path and watch runtime errors for one release window."
      ]
    },
    "snapshot": {
      "name": "date-fns",
      "source": "npm",
      "license": "MIT",
      "homepage": null,
      "keywords": [],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "https://github.com/date-fns/date-fns",
      "description": "Modern JavaScript date utility library",
      "publishedAt": "2026-05-29T23:23:42.430Z",
      "lastModified": "2026-05-29T23:23:42.430Z",
      "unpackedSize": 10902084,
      "latestVersion": "4.4.0",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T10:01:19.715Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T10:01:19.715Z",
    "packageName": "date-fns",
    "latestVersion": "4.4.0",
    "currentVersion": "4.1.0"
  },
  "action": "create"
}

{
  "after": {
    "id": "cf43762e-43d2-4d66-9bd3-fab6f619b33c",
    "note": "Live advanced proof: decide",
    "source": "npm",
    "status": "ready",
    "analysis": {
      "band": "review",
      "score": 62,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "risk",
          "label": "Version distance",
          "value": "major boundary",
          "detail": "A major release can change public contracts and runtime assumptions.",
          "impact": 100,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "calm",
          "label": "Release cooldown",
          "value": "10 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 20,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "watch",
          "label": "Package surface",
          "value": "6.1 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 48,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "zod 4.6.5 crosses a meaningful change boundary. Compare APIs, run focused tests, and make the rollback path explicit.",
      "headline": "Upgrade needs a deliberate migration pass",
      "confidence": "high",
      "generatedAt": "2026-09-24T10:01:12.298Z",
      "packageName": "zod",
      "latestVersion": "4.6.5",
      "currentVersion": "3.22.4",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Search the codebase for removed or renamed APIs before merging.",
        "Deploy behind a canary or feature flag with a documented rollback command."
      ]
    },
    "snapshot": {
      "name": "zod",
      "source": "npm",
      "license": "MIT",
      "homepage": "https://zod.dev",
      "keywords": [
        "typescript",
        "schema",
        "validation",
        "type",
        "inference"
      ],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "git+https://github.com/colinhacks/zod.git",
      "description": "TypeScript-first schema declaration and validation library with static type inference",
      "publishedAt": "2026-09-13T23:25:14.484Z",
      "lastModified": "2026-09-13T23:25:14.484Z",
      "unpackedSize": 6140311,
      "latestVersion": "4.6.5",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T10:01:12.299Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T10:01:18.565Z",
    "packageName": "zod",
    "latestVersion": "4.6.5",
    "currentVersion": "3.22.4"
  },
  "action": "update",
  "before": {
    "id": "cf43762e-43d2-4d66-9bd3-fab6f619b33c",
    "note": "Live advanced proof: remember",
    "source": "npm",
    "status": "watching",
    "analysis": {
      "band": "review",
      "score": 62,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "risk",
          "label": "Version distance",
          "value": "major boundary",
          "detail": "A major release can change public contracts and runtime assumptions.",
          "impact": 100,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "calm",
          "label": "Release cooldown",
          "value": "10 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 20,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "watch",
          "label": "Package surface",
          "value": "6.1 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 48,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "zod 4.6.5 crosses a meaningful change boundary. Compare APIs, run focused tests, and make the rollback path explicit.",
      "headline": "Upgrade needs a deliberate migration pass",
      "confidence": "high",
      "generatedAt": "2026-09-24T10:01:12.298Z",
      "packageName": "zod",
      "latestVersion": "4.6.5",
      "currentVersion": "3.22.4",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Search the codebase for removed or renamed APIs before merging.",
        "Deploy behind a canary or feature flag with a documented rollback command."
      ]
    },
    "snapshot": {
      "name": "zod",
      "source": "npm",
      "license": "MIT",
      "homepage": "https://zod.dev",
      "keywords": [
        "typescript",
        "schema",
        "validation",
        "type",
        "inference"
      ],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "git+https://github.com/colinhacks/zod.git",
      "description": "TypeScript-first schema declaration and validation library with static type inference",
      "publishedAt": "2026-09-13T23:25:14.484Z",
      "lastModified": "2026-09-13T23:25:14.484Z",
      "unpackedSize": 6140311,
      "latestVersion": "4.6.5",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T10:01:12.299Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T10:01:12.299Z",
    "packageName": "zod",
    "latestVersion": "4.6.5",
    "currentVersion": "3.22.4"
  }
}

{
  "item": {
    "id": "cf43762e-43d2-4d66-9bd3-fab6f619b33c",
    "note": "Live advanced proof: remember",
    "source": "npm",
    "status": "watching",
    "analysis": {
      "band": "review",
      "score": 62,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "risk",
          "label": "Version distance",
          "value": "major boundary",
          "detail": "A major release can change public contracts and runtime assumptions.",
          "impact": 100,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "calm",
          "label": "Release cooldown",
          "value": "10 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 20,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "watch",
          "label": "Package surface",
          "value": "6.1 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 48,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "zod 4.6.5 crosses a meaningful change boundary. Compare APIs, run focused tests, and make the rollback path explicit.",
      "headline": "Upgrade needs a deliberate migration pass",
      "confidence": "high",
      "generatedAt": "2026-09-24T10:01:12.298Z",
      "packageName": "zod",
      "latestVersion": "4.6.5",
      "currentVersion": "3.22.4",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Search the codebase for removed or renamed APIs before merging.",
        "Deploy behind a canary or feature flag with a documented rollback command."
      ]
    },
    "snapshot": {
      "name": "zod",
      "source": "npm",
      "license": "MIT",
      "homepage": "https://zod.dev",
      "keywords": [
        "typescript",
        "schema",
        "validation",
        "type",
        "inference"
      ],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "git+https://github.com/colinhacks/zod.git",
      "description": "TypeScript-first schema declaration and validation library with static type inference",
      "publishedAt": "2026-09-13T23:25:14.484Z",
      "lastModified": "2026-09-13T23:25:14.484Z",
      "unpackedSize": 6140311,
      "latestVersion": "4.6.5",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T10:01:12.299Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T10:01:12.299Z",
    "packageName": "zod",
    "latestVersion": "4.6.5",
    "currentVersion": "3.22.4"
  },
  "action": "create"
}

{
  "item": {
    "id": "0b5cd305-a421-4651-8d38-8d5bb44cd73d",
    "note": "Final live proof: decide",
    "source": "npm",
    "status": "ready",
    "analysis": {
      "band": "review",
      "score": 62,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "risk",
          "label": "Version distance",
          "value": "major boundary",
          "detail": "A major release can change public contracts and runtime assumptions.",
          "impact": 100,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "calm",
          "label": "Release cooldown",
          "value": "10 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 20,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "watch",
          "label": "Package surface",
          "value": "6.1 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 48,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "zod 4.6.5 crosses a meaningful change boundary. Compare APIs, run focused tests, and make the rollback path explicit.",
      "headline": "Upgrade needs a deliberate migration pass",
      "confidence": "high",
      "generatedAt": "2026-09-24T05:49:26.127Z",
      "packageName": "zod",
      "latestVersion": "4.6.5",
      "currentVersion": "3.22.4",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Search the codebase for removed or renamed APIs before merging.",
        "Deploy behind a canary or feature flag with a documented rollback command."
      ]
    },
    "snapshot": {
      "name": "zod",
      "source": "npm",
      "license": "MIT",
      "homepage": "https://zod.dev",
      "keywords": [
        "typescript",
        "schema",
        "validation",
        "type",
        "inference"
      ],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "git+https://github.com/colinhacks/zod.git",
      "description": "TypeScript-first schema declaration and validation library with static type inference",
      "publishedAt": "2026-09-13T23:25:14.484Z",
      "lastModified": "2026-09-13T23:25:14.484Z",
      "unpackedSize": 6140311,
      "latestVersion": "4.6.5",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T05:49:26.131Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T05:49:26.955Z",
    "packageName": "zod",
    "latestVersion": "4.6.5",
    "currentVersion": "3.22.4"
  },
  "action": "delete",
  "deletedAt": "2026-09-24T05:49:29.102Z"
}

{
  "item": {
    "id": "8d37721b-b58b-474c-be19-be37c200a1a5",
    "note": "Final live proof: hand off",
    "source": "npm",
    "status": "paused",
    "analysis": {
      "band": "watch",
      "score": 44,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "watch",
          "label": "Version distance",
          "value": "minor boundary",
          "detail": "The distance between the installed and latest versions is measured directly.",
          "impact": 55,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "good",
          "label": "Release cooldown",
          "value": "117 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 5,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "risk",
          "label": "Package surface",
          "value": "10.9 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 82,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "date-fns 4.4.0 is worth trying, but the release is recent enough to earn a short observation window before production.",
      "headline": "Watch the release, then ship in a canary",
      "confidence": "high",
      "generatedAt": "2026-09-24T05:49:27.334Z",
      "packageName": "date-fns",
      "latestVersion": "4.4.0",
      "currentVersion": "4.1.0",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Run the application smoke path and watch runtime errors for one release window."
      ]
    },
    "snapshot": {
      "name": "date-fns",
      "source": "npm",
      "license": "MIT",
      "homepage": null,
      "keywords": [],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "https://github.com/date-fns/date-fns",
      "description": "Modern JavaScript date utility library",
      "publishedAt": "2026-05-29T23:23:42.430Z",
      "lastModified": "2026-05-29T23:23:42.430Z",
      "unpackedSize": 10902084,
      "latestVersion": "4.4.0",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T05:49:27.334Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T05:49:27.907Z",
    "packageName": "date-fns",
    "latestVersion": "4.4.0",
    "currentVersion": "4.1.0"
  },
  "action": "delete",
  "deletedAt": "2026-09-24T05:49:28.361Z"
}

{
  "after": {
    "id": "8d37721b-b58b-474c-be19-be37c200a1a5",
    "note": "Final live proof: hand off",
    "source": "npm",
    "status": "paused",
    "analysis": {
      "band": "watch",
      "score": 44,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "watch",
          "label": "Version distance",
          "value": "minor boundary",
          "detail": "The distance between the installed and latest versions is measured directly.",
          "impact": 55,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "good",
          "label": "Release cooldown",
          "value": "117 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 5,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "risk",
          "label": "Package surface",
          "value": "10.9 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 82,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "date-fns 4.4.0 is worth trying, but the release is recent enough to earn a short observation window before production.",
      "headline": "Watch the release, then ship in a canary",
      "confidence": "high",
      "generatedAt": "2026-09-24T05:49:27.334Z",
      "packageName": "date-fns",
      "latestVersion": "4.4.0",
      "currentVersion": "4.1.0",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Run the application smoke path and watch runtime errors for one release window."
      ]
    },
    "snapshot": {
      "name": "date-fns",
      "source": "npm",
      "license": "MIT",
      "homepage": null,
      "keywords": [],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "https://github.com/date-fns/date-fns",
      "description": "Modern JavaScript date utility library",
      "publishedAt": "2026-05-29T23:23:42.430Z",
      "lastModified": "2026-05-29T23:23:42.430Z",
      "unpackedSize": 10902084,
      "latestVersion": "4.4.0",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T05:49:27.334Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T05:49:27.907Z",
    "packageName": "date-fns",
    "latestVersion": "4.4.0",
    "currentVersion": "4.1.0"
  },
  "action": "update",
  "before": {
    "id": "8d37721b-b58b-474c-be19-be37c200a1a5",
    "note": "Final live proof: hand off",
    "source": "npm",
    "status": "watching",
    "analysis": {
      "band": "watch",
      "score": 44,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "watch",
          "label": "Version distance",
          "value": "minor boundary",
          "detail": "The distance between the installed and latest versions is measured directly.",
          "impact": 55,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "good",
          "label": "Release cooldown",
          "value": "117 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 5,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "risk",
          "label": "Package surface",
          "value": "10.9 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 82,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "date-fns 4.4.0 is worth trying, but the release is recent enough to earn a short observation window before production.",
      "headline": "Watch the release, then ship in a canary",
      "confidence": "high",
      "generatedAt": "2026-09-24T05:49:27.334Z",
      "packageName": "date-fns",
      "latestVersion": "4.4.0",
      "currentVersion": "4.1.0",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Run the application smoke path and watch runtime errors for one release window."
      ]
    },
    "snapshot": {
      "name": "date-fns",
      "source": "npm",
      "license": "MIT",
      "homepage": null,
      "keywords": [],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "https://github.com/date-fns/date-fns",
      "description": "Modern JavaScript date utility library",
      "publishedAt": "2026-05-29T23:23:42.430Z",
      "lastModified": "2026-05-29T23:23:42.430Z",
      "unpackedSize": 10902084,
      "latestVersion": "4.4.0",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T05:49:27.334Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T05:49:27.334Z",
    "packageName": "date-fns",
    "latestVersion": "4.4.0",
    "currentVersion": "4.1.0"
  }
}

{
  "item": {
    "id": "8d37721b-b58b-474c-be19-be37c200a1a5",
    "note": "Final live proof: hand off",
    "source": "npm",
    "status": "watching",
    "analysis": {
      "band": "watch",
      "score": 44,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "watch",
          "label": "Version distance",
          "value": "minor boundary",
          "detail": "The distance between the installed and latest versions is measured directly.",
          "impact": 55,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "good",
          "label": "Release cooldown",
          "value": "117 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 5,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "risk",
          "label": "Package surface",
          "value": "10.9 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 82,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "date-fns 4.4.0 is worth trying, but the release is recent enough to earn a short observation window before production.",
      "headline": "Watch the release, then ship in a canary",
      "confidence": "high",
      "generatedAt": "2026-09-24T05:49:27.334Z",
      "packageName": "date-fns",
      "latestVersion": "4.4.0",
      "currentVersion": "4.1.0",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Run the application smoke path and watch runtime errors for one release window."
      ]
    },
    "snapshot": {
      "name": "date-fns",
      "source": "npm",
      "license": "MIT",
      "homepage": null,
      "keywords": [],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "https://github.com/date-fns/date-fns",
      "description": "Modern JavaScript date utility library",
      "publishedAt": "2026-05-29T23:23:42.430Z",
      "lastModified": "2026-05-29T23:23:42.430Z",
      "unpackedSize": 10902084,
      "latestVersion": "4.4.0",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T05:49:27.334Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T05:49:27.334Z",
    "packageName": "date-fns",
    "latestVersion": "4.4.0",
    "currentVersion": "4.1.0"
  },
  "action": "create"
}

{
  "after": {
    "id": "0b5cd305-a421-4651-8d38-8d5bb44cd73d",
    "note": "Final live proof: decide",
    "source": "npm",
    "status": "ready",
    "analysis": {
      "band": "review",
      "score": 62,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "risk",
          "label": "Version distance",
          "value": "major boundary",
          "detail": "A major release can change public contracts and runtime assumptions.",
          "impact": 100,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "calm",
          "label": "Release cooldown",
          "value": "10 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 20,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "watch",
          "label": "Package surface",
          "value": "6.1 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 48,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "zod 4.6.5 crosses a meaningful change boundary. Compare APIs, run focused tests, and make the rollback path explicit.",
      "headline": "Upgrade needs a deliberate migration pass",
      "confidence": "high",
      "generatedAt": "2026-09-24T05:49:26.127Z",
      "packageName": "zod",
      "latestVersion": "4.6.5",
      "currentVersion": "3.22.4",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Search the codebase for removed or renamed APIs before merging.",
        "Deploy behind a canary or feature flag with a documented rollback command."
      ]
    },
    "snapshot": {
      "name": "zod",
      "source": "npm",
      "license": "MIT",
      "homepage": "https://zod.dev",
      "keywords": [
        "typescript",
        "schema",
        "validation",
        "type",
        "inference"
      ],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "git+https://github.com/colinhacks/zod.git",
      "description": "TypeScript-first schema declaration and validation library with static type inference",
      "publishedAt": "2026-09-13T23:25:14.484Z",
      "lastModified": "2026-09-13T23:25:14.484Z",
      "unpackedSize": 6140311,
      "latestVersion": "4.6.5",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T05:49:26.131Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T05:49:26.955Z",
    "packageName": "zod",
    "latestVersion": "4.6.5",
    "currentVersion": "3.22.4"
  },
  "action": "update",
  "before": {
    "id": "0b5cd305-a421-4651-8d38-8d5bb44cd73d",
    "note": "Final live proof: remember",
    "source": "npm",
    "status": "watching",
    "analysis": {
      "band": "review",
      "score": 62,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "risk",
          "label": "Version distance",
          "value": "major boundary",
          "detail": "A major release can change public contracts and runtime assumptions.",
          "impact": 100,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "calm",
          "label": "Release cooldown",
          "value": "10 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 20,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "watch",
          "label": "Package surface",
          "value": "6.1 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 48,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "zod 4.6.5 crosses a meaningful change boundary. Compare APIs, run focused tests, and make the rollback path explicit.",
      "headline": "Upgrade needs a deliberate migration pass",
      "confidence": "high",
      "generatedAt": "2026-09-24T05:49:26.127Z",
      "packageName": "zod",
      "latestVersion": "4.6.5",
      "currentVersion": "3.22.4",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Search the codebase for removed or renamed APIs before merging.",
        "Deploy behind a canary or feature flag with a documented rollback command."
      ]
    },
    "snapshot": {
      "name": "zod",
      "source": "npm",
      "license": "MIT",
      "homepage": "https://zod.dev",
      "keywords": [
        "typescript",
        "schema",
        "validation",
        "type",
        "inference"
      ],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "git+https://github.com/colinhacks/zod.git",
      "description": "TypeScript-first schema declaration and validation library with static type inference",
      "publishedAt": "2026-09-13T23:25:14.484Z",
      "lastModified": "2026-09-13T23:25:14.484Z",
      "unpackedSize": 6140311,
      "latestVersion": "4.6.5",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T05:49:26.131Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T05:49:26.131Z",
    "packageName": "zod",
    "latestVersion": "4.6.5",
    "currentVersion": "3.22.4"
  }
}

{
  "item": {
    "id": "0b5cd305-a421-4651-8d38-8d5bb44cd73d",
    "note": "Final live proof: remember",
    "source": "npm",
    "status": "watching",
    "analysis": {
      "band": "review",
      "score": 62,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "risk",
          "label": "Version distance",
          "value": "major boundary",
          "detail": "A major release can change public contracts and runtime assumptions.",
          "impact": 100,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "calm",
          "label": "Release cooldown",
          "value": "10 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 20,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "watch",
          "label": "Package surface",
          "value": "6.1 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 48,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "zod 4.6.5 crosses a meaningful change boundary. Compare APIs, run focused tests, and make the rollback path explicit.",
      "headline": "Upgrade needs a deliberate migration pass",
      "confidence": "high",
      "generatedAt": "2026-09-24T05:49:26.127Z",
      "packageName": "zod",
      "latestVersion": "4.6.5",
      "currentVersion": "3.22.4",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Search the codebase for removed or renamed APIs before merging.",
        "Deploy behind a canary or feature flag with a documented rollback command."
      ]
    },
    "snapshot": {
      "name": "zod",
      "source": "npm",
      "license": "MIT",
      "homepage": "https://zod.dev",
      "keywords": [
        "typescript",
        "schema",
        "validation",
        "type",
        "inference"
      ],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "git+https://github.com/colinhacks/zod.git",
      "description": "TypeScript-first schema declaration and validation library with static type inference",
      "publishedAt": "2026-09-13T23:25:14.484Z",
      "lastModified": "2026-09-13T23:25:14.484Z",
      "unpackedSize": 6140311,
      "latestVersion": "4.6.5",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T05:49:26.131Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T05:49:26.131Z",
    "packageName": "zod",
    "latestVersion": "4.6.5",
    "currentVersion": "3.22.4"
  },
  "action": "create"
}

{
  "item": {
    "id": "81d0c4a6-12e2-496e-8bf8-bdc6039ec225",
    "note": "Live HTTP update proof",
    "source": "npm",
    "status": "ready",
    "analysis": {
      "band": "review",
      "score": 62,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "risk",
          "label": "Version distance",
          "value": "major boundary",
          "detail": "A major release can change public contracts and runtime assumptions.",
          "impact": 100,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "calm",
          "label": "Release cooldown",
          "value": "10 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 20,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "watch",
          "label": "Package surface",
          "value": "6.1 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 48,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "zod 4.6.5 crosses a meaningful change boundary. Compare APIs, run focused tests, and make the rollback path explicit.",
      "headline": "Upgrade needs a deliberate migration pass",
      "confidence": "high",
      "generatedAt": "2026-09-24T04:58:56.790Z",
      "packageName": "zod",
      "latestVersion": "4.6.5",
      "currentVersion": "3.22.4",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Search the codebase for removed or renamed APIs before merging.",
        "Deploy behind a canary or feature flag with a documented rollback command."
      ]
    },
    "snapshot": {
      "name": "zod",
      "source": "npm",
      "license": "MIT",
      "homepage": "https://zod.dev",
      "keywords": [
        "typescript",
        "schema",
        "validation",
        "type",
        "inference"
      ],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "git+https://github.com/colinhacks/zod.git",
      "description": "TypeScript-first schema declaration and validation library with static type inference",
      "publishedAt": "2026-09-13T23:25:14.484Z",
      "lastModified": "2026-09-13T23:25:14.484Z",
      "unpackedSize": 6140311,
      "latestVersion": "4.6.5",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T04:58:56.790Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T04:58:59.243Z",
    "packageName": "zod",
    "latestVersion": "4.6.5",
    "currentVersion": "3.22.4"
  },
  "action": "delete",
  "deletedAt": "2026-09-24T04:59:04.463Z"
}

{
  "item": {
    "id": "2c65e9b0-7143-446c-8cb9-b06b717790c4",
    "note": "Live MCP update proof",
    "source": "npm",
    "status": "paused",
    "analysis": {
      "band": "watch",
      "score": 44,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "watch",
          "label": "Version distance",
          "value": "minor boundary",
          "detail": "The distance between the installed and latest versions is measured directly.",
          "impact": 55,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "good",
          "label": "Release cooldown",
          "value": "117 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 5,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "risk",
          "label": "Package surface",
          "value": "10.9 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 82,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "date-fns 4.4.0 is worth trying, but the release is recent enough to earn a short observation window before production.",
      "headline": "Watch the release, then ship in a canary",
      "confidence": "high",
      "generatedAt": "2026-09-24T04:59:00.852Z",
      "packageName": "date-fns",
      "latestVersion": "4.4.0",
      "currentVersion": "4.1.0",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Run the application smoke path and watch runtime errors for one release window."
      ]
    },
    "snapshot": {
      "name": "date-fns",
      "source": "npm",
      "license": "MIT",
      "homepage": null,
      "keywords": [],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "https://github.com/date-fns/date-fns",
      "description": "Modern JavaScript date utility library",
      "publishedAt": "2026-05-29T23:23:42.430Z",
      "lastModified": "2026-05-29T23:23:42.430Z",
      "unpackedSize": 10902084,
      "latestVersion": "4.4.0",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T04:59:00.852Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T04:59:01.601Z",
    "packageName": "date-fns",
    "latestVersion": "4.4.0",
    "currentVersion": "4.1.0"
  },
  "action": "delete",
  "deletedAt": "2026-09-24T04:59:02.414Z"
}

{
  "after": {
    "id": "2c65e9b0-7143-446c-8cb9-b06b717790c4",
    "note": "Live MCP update proof",
    "source": "npm",
    "status": "paused",
    "analysis": {
      "band": "watch",
      "score": 44,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "watch",
          "label": "Version distance",
          "value": "minor boundary",
          "detail": "The distance between the installed and latest versions is measured directly.",
          "impact": 55,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "good",
          "label": "Release cooldown",
          "value": "117 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 5,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "risk",
          "label": "Package surface",
          "value": "10.9 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 82,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "date-fns 4.4.0 is worth trying, but the release is recent enough to earn a short observation window before production.",
      "headline": "Watch the release, then ship in a canary",
      "confidence": "high",
      "generatedAt": "2026-09-24T04:59:00.852Z",
      "packageName": "date-fns",
      "latestVersion": "4.4.0",
      "currentVersion": "4.1.0",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Run the application smoke path and watch runtime errors for one release window."
      ]
    },
    "snapshot": {
      "name": "date-fns",
      "source": "npm",
      "license": "MIT",
      "homepage": null,
      "keywords": [],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "https://github.com/date-fns/date-fns",
      "description": "Modern JavaScript date utility library",
      "publishedAt": "2026-05-29T23:23:42.430Z",
      "lastModified": "2026-05-29T23:23:42.430Z",
      "unpackedSize": 10902084,
      "latestVersion": "4.4.0",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T04:59:00.852Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T04:59:01.601Z",
    "packageName": "date-fns",
    "latestVersion": "4.4.0",
    "currentVersion": "4.1.0"
  },
  "action": "update",
  "before": {
    "id": "2c65e9b0-7143-446c-8cb9-b06b717790c4",
    "note": "Live MCP mutation proof",
    "source": "npm",
    "status": "watching",
    "analysis": {
      "band": "watch",
      "score": 44,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "watch",
          "label": "Version distance",
          "value": "minor boundary",
          "detail": "The distance between the installed and latest versions is measured directly.",
          "impact": 55,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "good",
          "label": "Release cooldown",
          "value": "117 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 5,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "risk",
          "label": "Package surface",
          "value": "10.9 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 82,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "date-fns 4.4.0 is worth trying, but the release is recent enough to earn a short observation window before production.",
      "headline": "Watch the release, then ship in a canary",
      "confidence": "high",
      "generatedAt": "2026-09-24T04:59:00.852Z",
      "packageName": "date-fns",
      "latestVersion": "4.4.0",
      "currentVersion": "4.1.0",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Run the application smoke path and watch runtime errors for one release window."
      ]
    },
    "snapshot": {
      "name": "date-fns",
      "source": "npm",
      "license": "MIT",
      "homepage": null,
      "keywords": [],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "https://github.com/date-fns/date-fns",
      "description": "Modern JavaScript date utility library",
      "publishedAt": "2026-05-29T23:23:42.430Z",
      "lastModified": "2026-05-29T23:23:42.430Z",
      "unpackedSize": 10902084,
      "latestVersion": "4.4.0",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T04:59:00.852Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T04:59:00.852Z",
    "packageName": "date-fns",
    "latestVersion": "4.4.0",
    "currentVersion": "4.1.0"
  }
}

{
  "item": {
    "id": "2c65e9b0-7143-446c-8cb9-b06b717790c4",
    "note": "Live MCP mutation proof",
    "source": "npm",
    "status": "watching",
    "analysis": {
      "band": "watch",
      "score": 44,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "watch",
          "label": "Version distance",
          "value": "minor boundary",
          "detail": "The distance between the installed and latest versions is measured directly.",
          "impact": 55,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "good",
          "label": "Release cooldown",
          "value": "117 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 5,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "risk",
          "label": "Package surface",
          "value": "10.9 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 82,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "date-fns 4.4.0 is worth trying, but the release is recent enough to earn a short observation window before production.",
      "headline": "Watch the release, then ship in a canary",
      "confidence": "high",
      "generatedAt": "2026-09-24T04:59:00.852Z",
      "packageName": "date-fns",
      "latestVersion": "4.4.0",
      "currentVersion": "4.1.0",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Run the application smoke path and watch runtime errors for one release window."
      ]
    },
    "snapshot": {
      "name": "date-fns",
      "source": "npm",
      "license": "MIT",
      "homepage": null,
      "keywords": [],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "https://github.com/date-fns/date-fns",
      "description": "Modern JavaScript date utility library",
      "publishedAt": "2026-05-29T23:23:42.430Z",
      "lastModified": "2026-05-29T23:23:42.430Z",
      "unpackedSize": 10902084,
      "latestVersion": "4.4.0",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T04:59:00.852Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T04:59:00.852Z",
    "packageName": "date-fns",
    "latestVersion": "4.4.0",
    "currentVersion": "4.1.0"
  },
  "action": "create"
}

{
  "after": {
    "id": "81d0c4a6-12e2-496e-8bf8-bdc6039ec225",
    "note": "Live HTTP update proof",
    "source": "npm",
    "status": "ready",
    "analysis": {
      "band": "review",
      "score": 62,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "risk",
          "label": "Version distance",
          "value": "major boundary",
          "detail": "A major release can change public contracts and runtime assumptions.",
          "impact": 100,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "calm",
          "label": "Release cooldown",
          "value": "10 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 20,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "watch",
          "label": "Package surface",
          "value": "6.1 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 48,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "zod 4.6.5 crosses a meaningful change boundary. Compare APIs, run focused tests, and make the rollback path explicit.",
      "headline": "Upgrade needs a deliberate migration pass",
      "confidence": "high",
      "generatedAt": "2026-09-24T04:58:56.790Z",
      "packageName": "zod",
      "latestVersion": "4.6.5",
      "currentVersion": "3.22.4",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Search the codebase for removed or renamed APIs before merging.",
        "Deploy behind a canary or feature flag with a documented rollback command."
      ]
    },
    "snapshot": {
      "name": "zod",
      "source": "npm",
      "license": "MIT",
      "homepage": "https://zod.dev",
      "keywords": [
        "typescript",
        "schema",
        "validation",
        "type",
        "inference"
      ],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "git+https://github.com/colinhacks/zod.git",
      "description": "TypeScript-first schema declaration and validation library with static type inference",
      "publishedAt": "2026-09-13T23:25:14.484Z",
      "lastModified": "2026-09-13T23:25:14.484Z",
      "unpackedSize": 6140311,
      "latestVersion": "4.6.5",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T04:58:56.790Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T04:58:59.243Z",
    "packageName": "zod",
    "latestVersion": "4.6.5",
    "currentVersion": "3.22.4"
  },
  "action": "update",
  "before": {
    "id": "81d0c4a6-12e2-496e-8bf8-bdc6039ec225",
    "note": "Live HTTP usefulness proof",
    "source": "npm",
    "status": "watching",
    "analysis": {
      "band": "review",
      "score": 62,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "risk",
          "label": "Version distance",
          "value": "major boundary",
          "detail": "A major release can change public contracts and runtime assumptions.",
          "impact": 100,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "calm",
          "label": "Release cooldown",
          "value": "10 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 20,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "watch",
          "label": "Package surface",
          "value": "6.1 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 48,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "zod 4.6.5 crosses a meaningful change boundary. Compare APIs, run focused tests, and make the rollback path explicit.",
      "headline": "Upgrade needs a deliberate migration pass",
      "confidence": "high",
      "generatedAt": "2026-09-24T04:58:56.790Z",
      "packageName": "zod",
      "latestVersion": "4.6.5",
      "currentVersion": "3.22.4",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Search the codebase for removed or renamed APIs before merging.",
        "Deploy behind a canary or feature flag with a documented rollback command."
      ]
    },
    "snapshot": {
      "name": "zod",
      "source": "npm",
      "license": "MIT",
      "homepage": "https://zod.dev",
      "keywords": [
        "typescript",
        "schema",
        "validation",
        "type",
        "inference"
      ],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "git+https://github.com/colinhacks/zod.git",
      "description": "TypeScript-first schema declaration and validation library with static type inference",
      "publishedAt": "2026-09-13T23:25:14.484Z",
      "lastModified": "2026-09-13T23:25:14.484Z",
      "unpackedSize": 6140311,
      "latestVersion": "4.6.5",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T04:58:56.790Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T04:58:56.790Z",
    "packageName": "zod",
    "latestVersion": "4.6.5",
    "currentVersion": "3.22.4"
  }
}

{
  "item": {
    "id": "81d0c4a6-12e2-496e-8bf8-bdc6039ec225",
    "note": "Live HTTP usefulness proof",
    "source": "npm",
    "status": "watching",
    "analysis": {
      "band": "review",
      "score": 62,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "risk",
          "label": "Version distance",
          "value": "major boundary",
          "detail": "A major release can change public contracts and runtime assumptions.",
          "impact": 100,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "calm",
          "label": "Release cooldown",
          "value": "10 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 20,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "watch",
          "label": "Maintenance signal",
          "value": "1 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 60,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "watch",
          "label": "Package surface",
          "value": "6.1 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 48,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "zod 4.6.5 crosses a meaningful change boundary. Compare APIs, run focused tests, and make the rollback path explicit.",
      "headline": "Upgrade needs a deliberate migration pass",
      "confidence": "high",
      "generatedAt": "2026-09-24T04:58:56.790Z",
      "packageName": "zod",
      "latestVersion": "4.6.5",
      "currentVersion": "3.22.4",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Search the codebase for removed or renamed APIs before merging.",
        "Deploy behind a canary or feature flag with a documented rollback command."
      ]
    },
    "snapshot": {
      "name": "zod",
      "source": "npm",
      "license": "MIT",
      "homepage": "https://zod.dev",
      "keywords": [
        "typescript",
        "schema",
        "validation",
        "type",
        "inference"
      ],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "git+https://github.com/colinhacks/zod.git",
      "description": "TypeScript-first schema declaration and validation library with static type inference",
      "publishedAt": "2026-09-13T23:25:14.484Z",
      "lastModified": "2026-09-13T23:25:14.484Z",
      "unpackedSize": 6140311,
      "latestVersion": "4.6.5",
      "maintainerCount": 1
    },
    "createdAt": "2026-09-24T04:58:56.790Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-24T04:58:56.790Z",
    "packageName": "zod",
    "latestVersion": "4.6.5",
    "currentVersion": "3.22.4"
  },
  "action": "create"
}

{
  "item": {
    "id": "9f20dfd6-52c2-4f40-bb51-0542b7e7b999",
    "note": "Hold until the editor plugin migration is tested on Windows.",
    "source": "fallback",
    "status": "paused",
    "analysis": {
      "band": "watch",
      "score": 34,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "watch",
          "label": "Version distance",
          "value": "minor boundary",
          "detail": "The distance between the installed and latest versions is measured directly.",
          "impact": 55,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "good",
          "label": "Release cooldown",
          "value": "19 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 5,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "good",
          "label": "Maintenance signal",
          "value": "4 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 10,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "risk",
          "label": "Package surface",
          "value": "21.0 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 82,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "Apache-2.0 license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "typescript 5.9.3 is worth trying, but the release is recent enough to earn a short observation window before production.",
      "headline": "Watch the release, then ship in a canary",
      "confidence": "low",
      "generatedAt": "2026-09-17T11:25:00.000Z",
      "packageName": "typescript",
      "latestVersion": "5.9.3",
      "currentVersion": "5.8.3",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Run the application smoke path and watch runtime errors for one release window."
      ]
    },
    "snapshot": {
      "name": "typescript",
      "source": "fallback",
      "license": "Apache-2.0",
      "homepage": "https://www.typescriptlang.org",
      "keywords": [
        "typescript",
        "compiler",
        "types"
      ],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "https://github.com/microsoft/TypeScript",
      "description": "TypeScript is a language for application scale JavaScript",
      "publishedAt": "2026-08-29T08:30:00.000Z",
      "lastModified": "2026-08-29T08:30:00.000Z",
      "unpackedSize": 21000000,
      "latestVersion": "5.9.3",
      "maintainerCount": 4
    },
    "createdAt": "2026-09-17T11:25:00.000Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-17T11:25:00.000Z",
    "packageName": "typescript",
    "latestVersion": "5.9.3",
    "currentVersion": "5.8.3"
  },
  "action": "seed"
}

{
  "item": {
    "id": "b03a48f9-1d07-4a96-8249-523268bbf6b6",
    "note": "Candidate for a small canary after the type suite passes.",
    "source": "fallback",
    "status": "ready",
    "analysis": {
      "band": "review",
      "score": 60,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "risk",
          "label": "Version distance",
          "value": "major boundary",
          "detail": "A major release can change public contracts and runtime assumptions.",
          "impact": 100,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "risk",
          "label": "Release cooldown",
          "value": "3 days old",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 75,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "good",
          "label": "Maintenance signal",
          "value": "5 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 10,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "good",
          "label": "Package surface",
          "value": "0.4 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 18,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "react 19.2.8 crosses a meaningful change boundary. Compare APIs, run focused tests, and make the rollback path explicit.",
      "headline": "Upgrade needs a deliberate migration pass",
      "confidence": "low",
      "generatedAt": "2026-09-19T15:40:00.000Z",
      "packageName": "react",
      "latestVersion": "19.2.8",
      "currentVersion": "18.3.1",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Search the codebase for removed or renamed APIs before merging.",
        "Deploy behind a canary or feature flag with a documented rollback command."
      ]
    },
    "snapshot": {
      "name": "react",
      "source": "fallback",
      "license": "MIT",
      "homepage": "https://react.dev",
      "keywords": [
        "react",
        "ui",
        "components"
      ],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "https://github.com/facebook/react",
      "description": "The library for web and native user interfaces",
      "publishedAt": "2026-09-16T10:15:00.000Z",
      "lastModified": "2026-09-16T10:15:00.000Z",
      "unpackedSize": 380000,
      "latestVersion": "19.2.8",
      "maintainerCount": 5
    },
    "createdAt": "2026-09-19T15:40:00.000Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-19T15:40:00.000Z",
    "packageName": "react",
    "latestVersion": "19.2.8",
    "currentVersion": "18.3.1"
  },
  "action": "seed"
}

{
  "item": {
    "id": "dcebcfbf-c41e-4e3f-a7fe-e4009a1e0144",
    "note": "Check the App Router cache semantics before the next release train.",
    "source": "fallback",
    "status": "watching",
    "analysis": {
      "band": "review",
      "score": 70,
      "factors": [
        {
          "id": "semver-distance",
          "tone": "risk",
          "label": "Version distance",
          "value": "major boundary",
          "detail": "A major release can change public contracts and runtime assumptions.",
          "impact": 100,
          "weight": 40
        },
        {
          "id": "release-cooldown",
          "tone": "risk",
          "label": "Release cooldown",
          "value": "published today",
          "detail": "Recent releases receive a short observation window before a production recommendation.",
          "impact": 95,
          "weight": 20
        },
        {
          "id": "maintenance-signal",
          "tone": "good",
          "label": "Maintenance signal",
          "value": "8 maintainers",
          "detail": "Maintainer and repository signals help identify provenance risk.",
          "impact": 10,
          "weight": 20
        },
        {
          "id": "package-surface",
          "tone": "risk",
          "label": "Package surface",
          "value": "28.4 MB unpacked",
          "detail": "A larger package has more install-time and transitive review surface.",
          "impact": 82,
          "weight": 10
        },
        {
          "id": "metadata-quality",
          "tone": "good",
          "label": "Metadata quality",
          "value": "MIT license",
          "detail": "Complete license and description metadata makes a release easier to review.",
          "impact": 8,
          "weight": 10
        }
      ],
      "summary": "next 16.3.6 crosses a meaningful change boundary. Compare APIs, run focused tests, and make the rollback path explicit.",
      "headline": "Upgrade needs a deliberate migration pass",
      "confidence": "low",
      "generatedAt": "2026-09-21T09:10:00.000Z",
      "packageName": "next",
      "latestVersion": "16.3.6",
      "currentVersion": "15.5.7",
      "migrationSteps": [
        "Read the upstream release note and confirm the intended version exists in npm.",
        "Pin the candidate in a branch and run the focused test suite before the full build.",
        "Search the codebase for removed or renamed APIs before merging.",
        "Deploy behind a canary or feature flag with a documented rollback command."
      ]
    },
    "snapshot": {
      "name": "next",
      "source": "fallback",
      "license": "MIT",
      "homepage": "https://nextjs.org",
      "keywords": [
        "react",
        "framework",
        "web"
      ],
      "ecosystem": "npm",
      "deprecated": null,
      "repository": "https://github.com/vercel/next.js",
      "description": "The React framework for the web",
      "publishedAt": "2026-09-20T14:00:00.000Z",
      "lastModified": "2026-09-20T14:00:00.000Z",
      "unpackedSize": 28400000,
      "latestVersion": "16.3.6",
      "maintainerCount": 8
    },
    "createdAt": "2026-09-21T09:10:00.000Z",
    "ecosystem": "npm",
    "updatedAt": "2026-09-21T09:10:00.000Z",
    "packageName": "next",
    "latestVersion": "16.3.6",
    "currentVersion": "15.5.7"
  },
  "action": "seed"
}