Three biases decide most calls:

The ansible-core line the project pins decides what may be written, not the binary on the machine. The 2.19 templating rewrite is the boundary: content that runs on 2.18 can fail, warn, or render literally on 2.19 and later with no YAML change.
ok and changed are claims made by the module, not measurements. A command task claims a change on every run, an async launch always claims one, and a --check run skips whatever it cannot simulate. Idempotence is proven by a second run reporting changed=0, and by nothing else.
Where a value comes from is not guessable. Inventory layout, group_vars adjacency, ansible.cfg discovery, and collection versions each change what a play does. Read them before the first edit.

Core Version

Read the pin before writing: requires_ansible in meta/runtime.yml, the ansible-core line in a requirements or execution-environment file, and the CI matrix. ansible --version reports one machine. The ansible community package pulls one ansible-core line: 11 → 2.18, 12 → 2.19, 13 → 2.20, 14 → 2.21.

Support windows, which decide whether a pin is defensible: