Filed by the round that delivered #15931 (PR #16205), which repointed both import lines at the root barrel. That PR deliberately did not edit either site below, and this row exists so the drift is not left silent.
Two places state, in the present tense, that the residue is still there. Both stop being true the moment PR #16205 lands.
1. docs/qa/platform-checklist/FOLLOW-UPS.md
What SURVIVES that removal, in the same document. PHASE2_IMPLEMENTATION.md sections 4 and 5 still tell readers to import … from '@objectstack/core/security' — a subpath packages/core/package.json declares in no exports entry, so it resolves for no consumer of the published package. Deliberately left: the two repairs (declare the subpath, or repoint both sections at the root barrel) differ in whether they widen the published contract, which is not a lane's call. Filed separately.
The "filed separately" half stays true — that filing is #15931. What goes stale is "still tell readers to" and "Deliberately left".
2. packages/core/src/security/security-scanner-retirement.pin.test.ts
A comment in the file header, in the paragraph headed "ON THE SECOND SURFACE":
…so that specifier resolves for no consumer of the published package and never has (PHASE2_IMPLEMENTATION.md sections 4 and 5 still teach it; filed separately, since the two repairs differ in whether they widen the published contract).
Nothing goes red: measured, no assertion in that file reads the document, and the surrounding claim about packages/core/package.json declaring exactly . and ./logger remains exactly true — PR #16205 does not touch that file. Only the parenthetical is stale.
Why the delivering PR left both alone
Neither repair is mechanically pinned by existing evidence — each needs a sentence written, not a substitution applied — and site 2 sits in a test file whose suite that diff otherwise does not implicate, which would have widened its verification surface for a comment. Site 1 is a QA ledger with its own authoring process. So both were reported rather than absorbed.
Ungraded and unassigned: whether a stale parenthetical in a tombstone comment is worth a commit at all is a triage call, and the honest answer may be to fix site 1 and leave site 2.
Generated by Claude Code
Filed by the round that delivered #15931 (PR #16205), which repointed both import lines at the root barrel. That PR deliberately did not edit either site below, and this row exists so the drift is not left silent.
Two places state, in the present tense, that the residue is still there. Both stop being true the moment PR #16205 lands.
1.
docs/qa/platform-checklist/FOLLOW-UPS.mdThe "filed separately" half stays true — that filing is #15931. What goes stale is "still tell readers to" and "Deliberately left".
2.
packages/core/src/security/security-scanner-retirement.pin.test.tsA comment in the file header, in the paragraph headed "ON THE SECOND SURFACE":
Nothing goes red: measured, no assertion in that file reads the document, and the surrounding claim about
packages/core/package.jsondeclaring exactly.and./loggerremains exactly true — PR #16205 does not touch that file. Only the parenthetical is stale.Why the delivering PR left both alone
Neither repair is mechanically pinned by existing evidence — each needs a sentence written, not a substitution applied — and site 2 sits in a test file whose suite that diff otherwise does not implicate, which would have widened its verification surface for a comment. Site 1 is a QA ledger with its own authoring process. So both were reported rather than absorbed.
Ungraded and unassigned: whether a stale parenthetical in a tombstone comment is worth a commit at all is a triage call, and the honest answer may be to fix site 1 and leave site 2.
Generated by Claude Code