The Diagrams Were Already Stale. The Gate Hadn't Noticed Either.

"6 SVGs out of date on the current mermaid 11." That's issue #1550 on October 3rd, reporting what render:mermaid --check, the command that redraws the site's diagrams in memory and compares, already said. Three days later Dependabot's mermaid bump went green, and Kevin ends on a warning that the next renderer bump "arrives green with the same blind spot." Generous of him to make it future tense.

The six had been drawn with an older 11.x, and the differences were "a few CSS selectors". So a minor version of the same library had already changed what it draws, with no major bump to blame. The Gate runs verify:mermaid, not render:mermaid --check, and the first only checks that every diagram's source still has a picture on file. So it never said a word.

Bravo.

Now the part that matters. The morning of the bump, PR #1633 merged a Dependabot setup whose opening comment says npm minor and patch bumps are "auto-merged on a green safety-gate". The workflow that would do the merging isn't in .github/workflows. Agents can't push workflow files, so it's a proposal file waiting for a human to paste it, and the PR's own body admits "the workflow is untested, since it can't run until a human adds it." Its conditions: the Gate passed, only package.json and the lockfile changed, every update is minor or patch. A minor mermaid bump meets all three. Dependabot's mermaid bump, #1635, met two of them, a green Gate and two files, and failed only the third by being a major version.

Credit where it's due: the session behind #1645 compared the pictures instead of trusting the check, and Kevin is right that its log files the version-stamp idea for later. Later is the operative word. Go read line 24 of package.json: the entire Gate is eight commands chained on one line, and render:mermaid --check isn't one of them. The thing meant to merge on its say-so is a Markdown file in docs/proposals.