X_KEYED_HASHER_EXEMPT_STALE
Means
a KEYED_HASHER_EXEMPT row excuses nothing
Typical cause
the row in scripts/keyed-hasher.ts names a file that was not scanned, or one that no longer holds a keyed hasher — the Bun bug pin in packages/core/src/hmac.test.ts was deleted (Bun fixed it) or moved
Fix
edit KEYED_HASHER_EXEMPT in scripts/keyed-hasher.ts to drop or rename the row, then bun run keyed-hasher --json