@popovych.co/witness 0.14.2 → 0.14.4

package/dist/history.js

@@ -17,10 +17,20 @@ export function contentAtSha(root, rel, sha) {
     }
     return undefined;
 }
+// D160 audit note: a batched `git log --name-only` replacement for the per-plan
+// `git log -1` below was written and REVERTED — merge commits print no name list and
+// multi-path pathspecs change history simplification, so the batch disagreed with the
+// per-file shape in both directions (a different pin than `witness diff` resolves — the
+// exact second derivation this row exists to forbid). The per-plan spawn cost on idle
+// `next`/`status` turns is accepted and recorded in Open / deferred.
 export function baseForSpec(root, canon, specId, excludePlanId) {
     const candidates = canon.docs.filter((d) => d.meta.type === 'plan' &&
         d.meta.parent === specId &&
         typeof d.meta['derives-from'] === 'string' &&
+        // D160. A withdrawn plan is not a realization: counting an abandoned plan's pin as
+        // the base would report `delta: none` for content nothing ever implemented, and
+        // would hide the spec from the plan queue that keys on this same derivation.
+        String(d.meta.status) !== 'abandoned' &&
         d.meta.id !== excludePlanId);
     if (candidates.length === 0)
         return { kind: 'empty' };

package/dist/reviewed.js

@@ -1,9 +1,9 @@
 import { createHash } from 'node:crypto';
-import { existsSync } from 'node:fs';
+import { existsSync, lstatSync, readlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import { canonicalJson, canonicalSha, planContentSha } from './sha.js';
 import { changedFiles } from './evidence.js';
-import { git } from './gitio.js';
+import { git, tryGit } from './gitio.js';
 import { effortAbandoned, effortStreams, latestRecap, readStream } from './journal.js';
 import { findById } from './scan.js';
 // Row 96a. The reviewed identity is the DIFF the battery read: the base commit plus the
@@ -20,10 +20,39 @@ import { findById } from './scan.js';
 // Deleted paths carry an explicit marker: `hash-object` throws on a missing file, and
 // dropping the path silently would make "this file is gone" invisible to the identity.
 const DELETED_BLOB = '(deleted)';
+// D161 (#27, corrected by the audit's F1/F4). A changed path can be a symlink, a gitlink
+// (submodule) or another non-file — entries `hash-object` fatals on or mis-hashes. Each
+// gets the value git itself would store, so every reviewable change moves the identity
+// and nothing else does:
+//  - symlink: the target STRING is git's blob — hash-object would FOLLOW the link and a
+//    retarget between byte-identical (or dangling) targets would vanish (F4);
+//  - inner repo: its HEAD — but only when the path IS its own repo. A cwd-based rev-parse
+//    walks upward and answers with the OUTER head for a plain directory, moving the
+//    identity on every commit and re-arming settled gates over identical diffs (F1);
+//  - staged gitlink with an uninitialized dir: the staged pointer itself;
+//  - anything else: a constant marker, like DELETED_BLOB, so presence still counts.
+function blobOf(runRoot, rel) {
+    const abs = join(runRoot, rel);
+    const st = lstatSync(abs, { throwIfNoEntry: false });
+    if (!st)
+        return DELETED_BLOB;
+    if (st.isSymbolicLink())
+        return `(link)${readlinkSync(abs)}`;
+    if (st.isFile())
+        return git(runRoot, 'hash-object', '--', rel);
+    if (existsSync(join(abs, '.git'))) {
+        const inner = tryGit(abs, 'rev-parse', 'HEAD');
+        if (inner.ok)
+            return `(gitlink)${inner.out}`;
+    }
+    const staged = tryGit(runRoot, 'ls-files', '--stage', '--', rel);
+    if (staged.ok && staged.out.startsWith('160000 ')) {
+        return `(gitlink)${staged.out.split(/\s+/)[1]}`;
+    }
+    return '(non-file)';
+}
 export function diffReviewedSha(runRoot, base) {
-    const pairs = changedFiles(runRoot, base).map((rel) => existsSync(join(runRoot, rel))
-        ? `${rel}\0${git(runRoot, 'hash-object', '--', rel)}`
-        : `${rel}\0${DELETED_BLOB}`);
+    const pairs = changedFiles(runRoot, base).map((rel) => `${rel}\0${blobOf(runRoot, rel)}`);
     return sha256([base, '\n', pairs.sort().join('\n')]);
 }
 // Row 95: implement's identity is the diff AND the plan, because the battery reads both —

package/dist/verbs/next.js

@@ -8,6 +8,8 @@ import { findById, loadCanon, plannableParent } from '../scan.js';
 import { designArtifactCurrent, designPending, designUnseen } from '../design.js';
 import { effortAbandoned, effortStreams, latestRecap, readStream } from '../journal.js';
 import { diffReviewedSha, effortOf, effortReviewedSha, effortSpecs, effortWrites, implementReviewedSha, planPairSha } from '../reviewed.js';
+import { baseForSpec } from '../history.js';
+import { canonicalSha } from '../sha.js';
 import { changedFiles, diffBase, evidenceForDiff, isTestPath } from '../evidence.js';
 import { SESSION_DEFAULT, stagePin } from '../model.js';
 import { handoffLine, relayLine, resolveDriver, resolveJudge } from '../harness.js';
@@ -345,7 +347,10 @@ export function readyChoice(canon, ready) {
                     ? {
                         why: flat
                             ? 'the dependency graph does not distinguish these — ranked by ui flag, then by id'
-                            : `${n} of the ${ready.length} ready specs depend on it directly; planning it later means re-planning them`,
+                            // D160 (#25, cosmetic): the count is direct dependents across all of canon
+                            // (human-checkable in frontmatter, D121) — not a subset of the ready list,
+                            // so the sentence must not claim one.
+                            : `${n} canon doc(s) depend on it directly; planning it later means re-planning them`,
                         judgeFirst: 'which slice matters this week. This ranks the dependency graph, which is all the CLI can see — product priority outranks it',
                     }
                     : {
@@ -623,23 +628,24 @@ export function computeNext(root, ctx, canon, cfg) {
         const s = String(doc.meta.status);
         return doc.meta.type === 'plan' ? s === 'done' : s === 'live' || doc.meta.type === 'principles';
     };
-    // D157. A spec is queued when the plan gate would accept it as a parent AND someone owes
-    // it a plan. `approved` is owed by definition (decompose just passed). `live` is owed
-    // only while a live effort that wrote it owns zero non-abandoned plans — efforts never
-    // auto-terminate, so without that clause every finished spec would queue forever.
+    // D157/D160. A spec is queued when the plan gate would accept it as a parent AND its
+    // content has moved past the last plan's pin — the same base derivation `witness diff`
+    // prints, because the effort ledger is not a readiness signal: an amendment can be
+    // realized by a plan booked under a different effort (issue #25), and a plan count of
+    // zero proves nothing either way. No pin at all means never realized, which is owed.
     // Reaching this rung proves decompose is settled: rung 6 returns first otherwise.
-    const owedByEffort = (id) => efforts.some((e) => {
-        const w = effortWrites(root, e.slug);
-        if (!w.has(id))
-            return false;
-        return !plans.some((p) => w.has(String(p.meta.id)) && String(p.meta.status) !== 'abandoned');
-    });
+    const unrealizedDelta = (d) => {
+        const base = baseForSpec(root, canon, String(d.meta.id));
+        return base.kind === 'empty' || base.sha !== canonicalSha(d.meta, d.body);
+    };
     const planless = canon.docs
         .filter((d) => d.meta.type === 'spec' && plannableParent(d))
-        .filter((d) => String(d.meta.status) === 'approved' || owedByEffort(String(d.meta.id)))
         .filter((d) => !plans.some((p) => String(p.meta.parent) === String(d.meta.id) &&
         !['done', 'abandoned'].includes(String(p.meta.status))))
         .filter((d) => (d.meta.depends ?? []).every(ready))
+        // last on purpose: the only filter that costs a subprocess — the in-memory ones above
+        // discard for free, and all four are pure predicates over an intersection
+        .filter(unrealizedDelta)
         .map((d) => String(d.meta.id)).sort();
     if (planless.length > 0) {
         // A spec whose plan write can actually be booked outranks one that needs a new effort

package/dist/verdict.js

@@ -103,7 +103,7 @@ function resolveDocPath(segments, body) {
 function safeRel(rel) {
     return !isAbsolute(rel) && !normalize(rel).split(/[\\/]/).includes('..');
 }
-function resolveCodeAnchor(anchor, root, canon) {
+function resolveCodeAnchor(anchor, root, files, canon) {
     if (/[:#]L?\d+$/.test(anchor))
         return 'line numbers refused — they drift across revisions; use file#symbol';
     const [file = '', symbol] = anchor.split('#', 2);
@@ -114,8 +114,18 @@ function resolveCodeAnchor(anchor, root, canon) {
     // from two trees. Code paths keep the reviewed tree, which is the thing under judgment.
     const isCanon = canon !== undefined && canon.dirs.some((d) => file === d || file.startsWith(`${d}/`));
     const abs = join(isCanon ? canon.root : root, file);
-    if (!existsSync(abs) || !statSync(abs).isFile())
-        return `no file ${file} in the reviewed tree`;
+    if (!existsSync(abs) || !statSync(abs).isFile()) {
+        // D162 (issue #29). The coverage floor counts every path the diff lists, so every one
+        // of them must be anchorable or the floor is unsatisfiable by construction: a submodule
+        // pointer is a directory, a deleted file is nothing, a symlink can point at a directory
+        // — and each is reviewed content, its hunk in the prompt. The bare path resolves; a
+        // symbol still needs a file body to be found in.
+        if (!files.includes(file))
+            return `no file ${file} in the reviewed tree`;
+        if (symbol === undefined)
+            return undefined;
+        return `${file} is a changed path with no file body in the reviewed tree (a submodule pointer, a deleted file, or a directory) — anchor it by bare path`;
+    }
     if (symbol !== undefined) {
         const re = new RegExp(`\\b${symbol.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`);
         if (!re.test(readFileSync(abs, 'utf8')))
@@ -172,6 +182,10 @@ export function resolveAnchor(anchor, reviewed) {
             return undefined;
         if (!safeRel(scope))
             return `omission scope escapes the reviewed tree: ${scope}`;
+        // D162: a changed path is reviewed content even when nothing is left on disk (a deleted
+        // file's un-migrated export is an omission scoped exactly there).
+        if (reviewed.kind === 'tree' && reviewed.files.includes(scope))
+            return undefined;
         return existsSync(join(reviewed.root, scope))
             ? undefined
             : `omission scope "${scope}" is no file or directory in the reviewed tree`;
@@ -180,7 +194,7 @@ export function resolveAnchor(anchor, reviewed) {
         const canon = reviewed.canonRoot !== undefined && reviewed.canonDirs !== undefined
             ? { root: reviewed.canonRoot, dirs: reviewed.canonDirs }
             : undefined;
-        return resolveCodeAnchor(anchor, reviewed.root, canon);
+        return resolveCodeAnchor(anchor, reviewed.root, reviewed.files, canon);
     }
     const segments = anchor.split(' > ');
     if (!segments[0].startsWith('#')) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@popovych.co/witness",
-  "version": "0.14.2",
+  "version": "0.14.4",
   "description": "Evidence-gated spec-driven development pipeline for AI coding agents: brainstorm to PR in six stages, where specs are state, plans are motion, and no transition passes without evidence. Drives from Claude Code or Pi.",
   "keywords": [
     "spec-driven-development",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "witness",
   "description": "Spec-driven development with evidence gates: brainstorm → PR through six stages and five gates. Skills author, the pinned witness CLI writes state and witnesses evidence; gates stop where judgment is owed.",
-  "version": "0.14.2",
+  "version": "0.14.4",
   "author": {
     "name": "Kostiantyn Popovych"
   },

package/plugin/commands/witness.md

@@ -10,7 +10,7 @@ The CLI decides, you act. If `$ARGUMENTS` contains `--manual`, append `--manual`
 Resolve the CLI once:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.2}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.4}"
 ```
 
 If the repo has no `witness.config.yaml`, run `$WITNESS init` first (one bootstrap commit), then proceed. If init or any verb refuses on a dirty tree, the human commits or cleans it — **never `git commit` yourself, anywhere, at any stage**: the CLI makes its own state commits, and the ship phase makes the sole code commit.

package/plugin/hooks/session-dashboard.sh

@@ -3,4 +3,4 @@
 # context). Silent everywhere that isn't a witness repo; failures swallowed:
 # session start must never hang or die on this.
 [ -f witness.config.yaml ] || exit 0
-${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.2} 2>/dev/null || true
+${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.4} 2>/dev/null || true

package/plugin/skills/witness-brainstorm/SKILL.md

@@ -15,7 +15,7 @@ witness: ends in a confirmed scope recap, writes no document. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.2}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.4}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-decompose/SKILL.md

@@ -10,7 +10,7 @@ description: Slice a witness effort's confirmed recap into vertical spec slices,
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.2}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.4}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-design/SKILL.md

@@ -16,7 +16,7 @@ No text copied verbatim; the design-critic lens is new material. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.2}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.4}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-implement/SKILL.md

@@ -15,7 +15,7 @@ tests carry the parent spec's tag in their NAME. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.2}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.4}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-plan/SKILL.md

@@ -15,7 +15,7 @@ parent's criteria. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.2}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.4}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/plugin/skills/witness-ship/SKILL.md

@@ -15,7 +15,7 @@ model can. See NOTICE.md. -->
 Resolve the CLI once per session:
 
 ```bash
-WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.2}"
+WITNESS="${WITNESS_BIN:-npx -y @popovych.co/witness@0.14.4}"
 ```
 
 - **Render the CLI's decision output verbatim and in full — every line, unmodified.** Never print a command set you remember; never recompose, reformat, summarise or reorder what the CLI emitted. Which decisions are live, how they rank, and what each costs are the CLI's answers, and they change with the round, the bound, the repair grant and the content sha — a remembered set is wrong in more states than it is right.

package/prompts/code-reviewer.md

@@ -51,7 +51,7 @@ Respond with ONLY a JSON object — no prose before or after it (a single ```jso
 Anchor grammar — every anchor must resolve against the reviewed content, or your whole verdict is rejected as malformed:
 
 - Document reviews: a heading path, ` > `-separated — `## Behavior`, or `auth-refresh > ## Behavior` where a first segment without `#` names a reviewed document.
-- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). Never line numbers — `file.ts:42` rejects the verdict.
+- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). A changed path with no file body — a submodule pointer, a deleted file — is anchored by its bare path; the diff hunk is the evidence. Never line numbers — `file.ts:42` rejects the verdict.
 - Something missing entirely: the finding's `"anchor"` value itself becomes `{ "kind": "omission", "scope": "<doc id, heading path, file, directory, or .>" }` — e.g. a full finding reads `{ "blocking": true, "anchor": { "kind": "omission", "scope": "tests/" }, "claim": "..." }`. Never place `kind`/`scope` as siblings of `blocking`/`claim` — they replace the `anchor` value, not sit beside it. The scope must exist; blocking omissions stop the gate like any other finding.
 
 Coverage is proof of reading, required even when `findings` is empty:

package/prompts/drift-reviewer.md

@@ -27,7 +27,7 @@ Respond with ONLY a JSON object — no prose before or after it (a single ```jso
 Anchor grammar — every anchor must resolve against the reviewed content, or your whole verdict is rejected as malformed:
 
 - Document reviews: a heading path, ` > `-separated — `## Behavior`, or `auth-refresh > ## Behavior` where a first segment without `#` names a reviewed document. A `## Valid anchors` menu precedes the reviewed content — copy anchors from it verbatim; never paraphrase a heading.
-- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). Never line numbers — `file.ts:42` rejects the verdict.
+- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). A changed path with no file body — a submodule pointer, a deleted file — is anchored by its bare path; the diff hunk is the evidence. Never line numbers — `file.ts:42` rejects the verdict.
 - Something missing entirely: the finding's `"anchor"` value itself becomes `{ "kind": "omission", "scope": "<doc id, heading path, file, directory, or .>" }` — e.g. a full finding reads `{ "blocking": true, "anchor": { "kind": "omission", "scope": "tests/" }, "claim": "..." }`. Never place `kind`/`scope` as siblings of `blocking`/`claim` — they replace the `anchor` value, not sit beside it. The scope must exist; blocking omissions stop the gate like any other finding.
 
 Coverage is proof of reading, required even when `findings` is empty:

package/prompts/plan-critic.md

@@ -24,7 +24,7 @@ Respond with ONLY a JSON object — no prose before or after it (a single ```jso
 Anchor grammar — every anchor must resolve against the reviewed content, or your whole verdict is rejected as malformed:
 
 - Document reviews: a heading path, ` > `-separated — `## Behavior`, or `auth-refresh > ## Behavior` where a first segment without `#` names a reviewed document. A `## Valid anchors` menu precedes the reviewed content — copy anchors from it verbatim; never paraphrase a heading.
-- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). Never line numbers — `file.ts:42` rejects the verdict.
+- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). A changed path with no file body — a submodule pointer, a deleted file — is anchored by its bare path; the diff hunk is the evidence. Never line numbers — `file.ts:42` rejects the verdict.
 - Something missing entirely: the finding's `"anchor"` value itself becomes `{ "kind": "omission", "scope": "<doc id, heading path, file, directory, or .>" }` — e.g. a full finding reads `{ "blocking": true, "anchor": { "kind": "omission", "scope": "tests/" }, "claim": "..." }`. Never place `kind`/`scope` as siblings of `blocking`/`claim` — they replace the `anchor` value, not sit beside it. The scope must exist; blocking omissions stop the gate like any other finding.
 
 Coverage is proof of reading, required even when `findings` is empty:

package/prompts/pr-test.md

@@ -84,7 +84,7 @@ Respond with ONLY a JSON object — no prose before or after it (a single ```jso
 Anchor grammar — every anchor must resolve against the reviewed content, or your whole verdict is rejected as malformed:
 
 - Document reviews: a heading path, ` > `-separated — `## Behavior`, or `auth-refresh > ## Behavior` where a first segment without `#` names a reviewed document.
-- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). Never line numbers — `file.ts:42` rejects the verdict.
+- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). A changed path with no file body — a submodule pointer, a deleted file — is anchored by its bare path; the diff hunk is the evidence. Never line numbers — `file.ts:42` rejects the verdict.
 - Something missing entirely: the finding's `"anchor"` value itself becomes `{ "kind": "omission", "scope": "<doc id, heading path, file, directory, or .>" }` — e.g. a full finding reads `{ "blocking": true, "anchor": { "kind": "omission", "scope": "tests/" }, "claim": "..." }`. Never place `kind`/`scope` as siblings of `blocking`/`claim` — they replace the `anchor` value, not sit beside it. The scope must exist; blocking omissions stop the gate like any other finding.
 
 Coverage is proof of reading, required even when `findings` is empty:

package/prompts/silent-failure-hunter.md

@@ -132,7 +132,7 @@ Respond with ONLY a JSON object — no prose before or after it (a single ```jso
 Anchor grammar — every anchor must resolve against the reviewed content, or your whole verdict is rejected as malformed:
 
 - Document reviews: a heading path, ` > `-separated — `## Behavior`, or `auth-refresh > ## Behavior` where a first segment without `#` names a reviewed document.
-- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). Never line numbers — `file.ts:42` rejects the verdict.
+- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). A changed path with no file body — a submodule pointer, a deleted file — is anchored by its bare path; the diff hunk is the evidence. Never line numbers — `file.ts:42` rejects the verdict.
 - Something missing entirely: the finding's `"anchor"` value itself becomes `{ "kind": "omission", "scope": "<doc id, heading path, file, directory, or .>" }` — e.g. a full finding reads `{ "blocking": true, "anchor": { "kind": "omission", "scope": "tests/" }, "claim": "..." }`. Never place `kind`/`scope` as siblings of `blocking`/`claim` — they replace the `anchor` value, not sit beside it. The scope must exist; blocking omissions stop the gate like any other finding.
 
 Coverage is proof of reading, required even when `findings` is empty:

package/prompts/slicing-critic.md

@@ -33,7 +33,7 @@ Respond with ONLY a JSON object — no prose before or after it (a single ```jso
 Anchor grammar — every anchor must resolve against the reviewed content, or your whole verdict is rejected as malformed:
 
 - Document reviews: a heading path, ` > `-separated — `## Behavior`, or `auth-refresh > ## Behavior` where a first segment without `#` names a reviewed document. A `## Valid anchors` menu precedes the reviewed content — copy anchors from it verbatim; never paraphrase a heading.
-- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). Never line numbers — `file.ts:42` rejects the verdict.
+- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). A changed path with no file body — a submodule pointer, a deleted file — is anchored by its bare path; the diff hunk is the evidence. Never line numbers — `file.ts:42` rejects the verdict.
 - Something missing entirely: the finding's `"anchor"` value itself becomes `{ "kind": "omission", "scope": "<doc id, heading path, file, directory, or .>" }` — e.g. a full finding reads `{ "blocking": true, "anchor": { "kind": "omission", "scope": "tests/" }, "claim": "..." }`. Never place `kind`/`scope` as siblings of `blocking`/`claim` — they replace the `anchor` value, not sit beside it. The scope must exist; blocking omissions stop the gate like any other finding.
 
 Coverage is proof of reading, required even when `findings` is empty:

package/prompts/type-design.md

@@ -100,7 +100,7 @@ Respond with ONLY a JSON object — no prose before or after it (a single ```jso
 Anchor grammar — every anchor must resolve against the reviewed content, or your whole verdict is rejected as malformed:
 
 - Document reviews: a heading path, ` > `-separated — `## Behavior`, or `auth-refresh > ## Behavior` where a first segment without `#` names a reviewed document.
-- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). Never line numbers — `file.ts:42` rejects the verdict.
+- Code reviews: `path/to/file` or `path/to/file#symbol` (the symbol must occur in that file). A changed path with no file body — a submodule pointer, a deleted file — is anchored by its bare path; the diff hunk is the evidence. Never line numbers — `file.ts:42` rejects the verdict.
 - Something missing entirely: the finding's `"anchor"` value itself becomes `{ "kind": "omission", "scope": "<doc id, heading path, file, directory, or .>" }` — e.g. a full finding reads `{ "blocking": true, "anchor": { "kind": "omission", "scope": "tests/" }, "claim": "..." }`. Never place `kind`/`scope` as siblings of `blocking`/`claim` — they replace the `anchor` value, not sit beside it. The scope must exist; blocking omissions stop the gate like any other finding.
 
 Coverage is proof of reading, required even when `findings` is empty: