# Animation package contract and lineage ledger — method

This draft compares twenty npm package names across five fixed publication cutoffs. It records declared contracts and documented migration context. It does not execute a package or establish browser support, application compatibility, accessibility, performance, security or future maintenance. A named technical reviewer has not signed off.

The original observation data and compilation are licensed **CC BY 4.0**. Attribute the ledger, retain source links and dates, and identify changes. Package code, documentation and trademarks keep their own terms. No package code, tar archives or external documentation bodies are redistributed in this asset. The original viewer and verification utility are MIT-licensed.

## What was checked

On 24 October 2026, the audit opened twenty public npm registry records, twenty GitHub repository records and twenty current upstream READMEs. It also attempted fifteen specific documentation and repository-alias requests: fourteen returned bodies and the Popmotion migration index returned HTTP 403. All request times, redirects, hashes and failures are retained in `source-ledger.json`. An earlier web-tool documentation inspection is recorded separately without invented timestamps.

The preserved 23 October inputs comprise 65 distinct shipped release archives and 100 cutoff slots. We re-hashed all 65 archives and their extracted manifest records, then read `package/package.json` in memory to verify the stored content. No archive was installed or executed. All 96 populated slots matched their source declarations. Four slots predate a stable publication: the 2019 slots for `@react-spring/web` and `@theatre/core`, and the 2019 and 2021 slots for `@formkit/auto-animate`.

Every populated cutoff was reselected from the newly retrieved registry record. The version, publication date and retained registry fields matched the saved baseline in all 96 cases. The current `latest` tag matched each saved selected tag version for all twenty packages. Those checks do not prove that metadata can never change. Source hashes identify the bodies used for this edition.

## Cutoff selection

The cutoffs are 31 December 2019, 2021, 2023 and 2025 at 23:59:59 UTC, plus the original audit instant, **23 October 2026 at 19:08:15.760857 UTC**. The last cutoff is not the end of 23 October.

For each package and cutoff, select the highest numeric stable semantic version whose recorded publication time is no later than the cutoff. Accept versions matching `major.minor.patch`; exclude prereleases. The selected version is not a reconstruction of the historical npm `latest` tag. The highest numeric version, latest tag and most recent publication are separate fields. For example, `velocity-animate` has an observed latest tag of 1.5.2 even though higher stable version numbers exist.

These are release artifacts and retained registry records read at the audit. They are not archived copies of the registry from 2019–2025. Current repository flags, current deprecation notices and current documentation are kept separate from historical manifest declarations.

## Counting declared changes

Use the shipped manifest as the primary contract record. Preserve the corresponding registry fields alongside it. Compare consecutive **populated** cutoff slots, skipping a pre-release empty slot rather than converting it into an empty manifest. Intervening releases are outside this sample.

Fourteen declaration fields use JSON-value comparison, with object key order ignored. The types field compares `types`, falling back to `typings`. The Node field compares `engines.node`. Repository identity normalizes protocol syntax, a trailing `.git`, a trailing slash and case. It does not rewrite known transfers or infer common ownership. Other strings remain as declared.

A zero count means the sampled declarations were equal. It is not a claim of API stability or compatibility. An absent field is shown as “Not declared,” not as false or unsupported. The peer-metadata count covers `peerDependenciesMeta`, rather than proving an optional peer worked. The `browser`, `sideEffects` and engine fields are declarations, not executed behavior.

The registry/shipped discrepancy count sums unequal field values over the populated slots. A version repeated at several cutoffs can contribute several times. This count is not the number of unique versions, bugs, broken packages or security problems. Repository URL normalization can make a lineage identity unchanged while the raw registry and shipped URL forms differ.

## Completing the documentation and lineage joins

Each of the twenty rows now has a dated, source-linked documentation review. Eight have an explicit migration note, seven have integration guidance only, three retain an unknown migration contract, and two have documentation-version warnings. “Unknown” means not established in the named reviewed sources; it does not claim that no document exists elsewhere.

The notes are original summaries of current official guidance. They are not backdated into historical cutoffs. The two rows classified as documentation-version warnings are `velocity-animate`, whose README separates V1 documentation from V2 wiki guidance while the latest tag remains 1.5.2, and `countup.js`, whose current README contains option deprecations without an established release boundary. AOS also has a default-branch warning about `aos@next`, but its stable v2 branch was opened separately and establishes the `data-aos` migration; its row is therefore classified as documented migration. The Popmotion migration-index failure is preserved, while its accessible README supplies only a current integration contract.

For `motion`, the 2019 repository declaration now resolves to the distinct, archived `steelbrain/motion` repository. Current `motiondivision/motion` has a different GitHub repository ID. The row therefore describes a package-name history spanning different repository identities, not one continuous current-project upgrade history. Its counts remain visible with that warning.

Old repository URLs for Theatre, React Move and ScrollReveal now resolve to the same numeric repository IDs as their current records. That supports a current alias join. It does not establish transfer dates or continuous ownership. A README statement about private development is recorded as such; it is not treated as retirement or a release promise. The documented end of React Transition Group v1 updates applies to v1, not the entire package.

## Files and reproduction

- `index.json`: twenty full rows, twenty substantive observations, all cutoff declarations, current checks, documentation joins and explicit unknowns.
- `index.csv`: a flat export of the same rows, authored and checked separately. Structured snapshots remain in JSON.
- `source-ledger.json`: primary-source requests, dates, roles, results and hashes. Raw third-party bodies stay in the research workspace.
- `evidence/`: original source-verification results, current metadata joins, mechanical count checks and baseline-preservation record.
- `verify_snapshot_counts.py`: original, standard-library-only verifier for the delivered declarations and counts. Run `python3 verify_snapshot_counts.py` from this folder; it makes no network request and executes no package code.
- `../../demos/reference/rendering-api-support/index.html`: original local viewer with package/note search, documentation-state filters, two-cutoff comparison and all twenty observations.
- `hashes.txt`: SHA-256 inventory refreshed after the final CSV is authored; excludes itself and includes the matching viewer.

The viewer embeds this edition's JSON and its SHA-256. It has no external scripts, fonts, images or automatic network requests. Clicking a source link intentionally opens that primary source. Viewer checks apply only to the original filtering and diff code. They do not convert metadata into package behavior evidence.

## Review and time

All author and reviewer identity fields remain null. The unsigned sheet is `../../review/data-animation-package-contracts.md`. Confirm source selection, the lineage warnings, licence boundaries, unknowns, every rendered diff and CSV equivalence before signing.

Recorded agent activity intervals are supplied separately in the production time ledger. They are wall-clock work windows, not measured human engineer-hours or a staffing estimate. Initial brief/schema reading before the timer was not retrospectively estimated.