lockwire 0.1.29 → 0.1.31

package/README.md

@@ -13,6 +13,7 @@
 The mark is literal, not a metaphor: [lockwiring](https://en.wikipedia.org/wiki/Safety_wire) is the aviation-maintenance technique of threading wire through two fasteners so neither can work loose under vibration — the same idea applied to a doc claim and the code it depends on.
 
 [![npm](https://img.shields.io/npm/v/lockwire)](https://www.npmjs.com/package/lockwire)
+[![Socket](https://socket.dev/api/badge/npm/package/lockwire)](https://socket.dev/npm/package/lockwire)
 [![bundle size](https://img.shields.io/bundlephobia/minzip/lockwire)](https://bundlephobia.com/package/lockwire)
 [![license: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![Claude Code plugin](https://img.shields.io/badge/Claude%20Code-plugin-8A63D2)](https://code.claude.com/docs/en/plugins)
@@ -261,7 +262,7 @@ CLAUDE.md
 single-hash would flag 1 · lockwire flagged 1 · noise −0%
 ```
 
-Update the doc, then re-stamp — `--reviewed` is required because this anchor is currently `drifted`:
+Update the doc, then re-stamp — `--reviewed` is required because the code changed since the claim was stamped:
 
 ```bash
 $ lockwire link CLAUDE.md --reviewed

package/dist/actions.d.ts

@@ -13,11 +13,16 @@ export interface TargetResolution {
     /** When not found and there's more to say (an ambiguous CSV row, a missing column). */
     reason?: string;
 }
-/** Recomputes all four tier fingerprints for a target, or reports it unresolved (file/symbol not found). */
+/** The fingerprint version an anchor was stamped with (anchors from before versions are version 1). */
+export declare const versionOf: (anchor: Pick<Anchor, "fingerprintVersion">) => number;
+/**
+ * Recomputes all four tier fingerprints for a target, or reports it unresolved (file/symbol not found).
+ * `version` is how to compute them: the current way to stamp, an anchor's own to compare with it.
+ */
 export declare function resolveTarget(repoRoot: string, target: {
     path: string;
     symbol?: string;
-}, config: LockwireConfig): Promise<TargetResolution | null>;
+}, config: LockwireConfig, version?: number): Promise<TargetResolution | null>;
 /**
  * {@link resolveTarget} on given file contents rather than the file on disk — used to fingerprint a
  * target as it was at an earlier commit. `source` is the bound symbol's declaration as written.
@@ -25,7 +30,7 @@ export declare function resolveTarget(repoRoot: string, target: {
 export declare function resolveTargetInText(target: {
     path: string;
     symbol?: string;
-}, content: string, config: LockwireConfig): Promise<TargetResolution & {
+}, content: string, config: LockwireConfig, version?: number): Promise<TargetResolution & {
     source?: string;
 }>;
 /**
@@ -36,10 +41,18 @@ export declare function resolveTargetInText(target: {
  * unrelated neighbour with the same shape isn't mistaken for the rename target. Cross-file
  * relocation (the symbol moved to a different file) is not attempted in P0 — see docs/concepts.md limitations.
  */
-export declare function findRelocationCandidate(symbols: FileSymbols, missingSigFp: string, oldName: string, taken?: ReadonlySet<string>): string | null;
+export declare function findRelocationCandidate(symbols: FileSymbols, missingSigFp: string, oldName: string, taken?: ReadonlySet<string>, 
+/**
+ * The vanished symbol's stamped body and deps. When given, a candidate must also match one of them:
+ * a rename keeps the implementation, while a deleted function's look-alike neighbour (same
+ * parameters, different code) is not where its claim went.
+ */
+stamped?: Pick<Fingerprints, "body" | "deps">): string | null;
 export interface LinkResult {
     created: number;
     refreshed: number;
+    /** Markers whose anchor was already fresh and current: nothing was written for them. */
+    unchanged: number;
     skipped: {
         reason: string;
         target: string;
@@ -123,13 +136,15 @@ export interface CheckResult {
 /** A cached reader of a doc's markers, or null when the doc doesn't exist. */
 export declare function markerReader(repoRoot: string): (doc: string) => Promise<DocMarker[] | null>;
 /** The part of a marker needed to classify it and show its claim; DocMarker and the doc index both have it. */
-export type MarkerView = Pick<DocMarker, "id" | "target" | "line" | "claimExcerpt">;
+export type MarkerView = Pick<DocMarker, "id" | "target" | "line" | "claimExcerpt" | "problem">;
 /**
  * Markers in `docs` that no anchor in `lockfile` backs: no `id=` yet, an id that matches no anchor, an
  * id that belongs to the marker in another doc (a copy-paste), or one used twice in a doc. Until
  * `lockwire link` runs, such a claim isn't being checked at all.
  */
-export declare function findUnlinkedMarkers(lockfile: Lockfile, docs: readonly string[], readMarkers: (doc: string) => Promise<readonly MarkerView[] | null>): Promise<UnlinkedMarker[]>;
+export declare function findUnlinkedMarkers(lockfile: Lockfile, docs: readonly string[], readMarkers: (doc: string) => Promise<readonly MarkerView[] | null>, 
+/** When given, a marker whose target file is missing says so instead of "not linked yet". */
+repoRoot?: string): Promise<UnlinkedMarker[]>;
 /**
  * A holder a long-lived caller keeps between calls so the doc index lives in memory and each call
  * only re-validates it.
@@ -163,6 +178,10 @@ export declare function check(repoRoot: string, config: LockwireConfig, onlyPath
     write?: boolean;
     actor?: Actor;
 }): Promise<CheckResult>;
+/**
+ * Docs the config selects. A symlinked doc is skipped: it's another name for a file the walk reaches
+ * anyway (`README.md -> packages/zod/README.md`), and linking both would bind every claim twice.
+ */
 export declare function discoverDocs(repoRoot: string, config: LockwireConfig): Promise<string[]>;
 export declare function ack(repoRoot: string, anchorId: string, resolution: "updated" | "superseded" | "false-positive", note: string | undefined, actor: Actor, config: LockwireConfig): Promise<Anchor>;
 export declare function waive(repoRoot: string, anchorId: string, reason: string, expires: string, actor: Actor): Promise<Anchor>;

package/dist/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,UAAU,EAAgB,MAAM,eAAe,CAAC;AAe/E,OAAO,EAEL,KAAK,SAAS,EAIf,MAAM,cAAc,CAAC;AAUtB,OAAO,KAAK,EACV,KAAK,EACL,MAAM,EACN,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,IAAI,EACL,MAAM,YAAY,CAAC;AAUpB,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,YAAY,CAAC;IAC3B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,6DAA6D;IAC7D,KAAK,CAAC,EAAE;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,4GAA4G;AAC5G,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACzC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAKlC;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACzC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,gBAAgB,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAkEjD;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,WAAW,EACpB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,WAAW,CAAC,MAAM,CAAa,GACrC,MAAM,GAAG,IAAI,CAUf;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC/C;AAED,gIAAgI;AAChI,uGAAuG;AACvG,wBAAgB,eAAe,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAAE,CAGjF;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACzC,KAAK,EAAE,SAAS,IAAI,EAAE,GACrB,MAAM,GAAG,IAAI,CAMf;AAUD,oGAAoG;AACpG,wBAAsB,OAAO,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,KAAK,EACZ,IAAI,GAAE;IACJ,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,iFAAiF;IACjF,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IACtC,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;CACV,GACL,OAAO,CAAC,UAAU,CAAC,CAgMrB;AAED,qHAAqH;AACrH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACzC,KAAK,EAAE,IAAI,EAAE,EACb,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,YAAY,EAAE,IAAI,EAAE,CAAC;IACrB,qGAAqG;IACrG,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iGAAiG;IACjG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3E,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE;QAAE,mBAAmB,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;CACzF;AAED,oGAAoG;AACpG,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,YAAY,CAAC;IACtB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,IAE7B,KAAK,MAAM,KAAG,OAAO,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,CAOxD;AAED,+GAA+G;AAC/G,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,QAAQ,GAAG,MAAM,GAAG,cAAc,CAAC,CAAC;AAEpF;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,UAAU,EAAE,GAAG,IAAI,CAAC,GAClE,OAAO,CAAC,cAAc,EAAE,CAAC,CA4B3B;AAKD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,EACtB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GACpC,OAAO,CAAC,cAAc,EAAE,CAAC,CAQ3B;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,UAAU,CAAA;CAAO,GACnD,OAAO,CAAC;IACT,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;CACnB,CAAC,CAmBD;AAED,uGAAuG;AACvG,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAW3E;AAwBD,wBAAsB,KAAK,CACzB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,EACtB,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,EAC7B,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC5C,OAAO,CAAC,WAAW,CAAC,CAsXtB;AAED,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE9F;AAED,wBAAsB,GAAG,CACvB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,SAAS,GAAG,YAAY,GAAG,gBAAgB,EACvD,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,MAAM,CAAC,CAoDjB;AAED,wBAAsB,KAAK,CACzB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED,wBAAsB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG9E;AAED,wBAAsB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAG7F;AAED,wBAAsB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAKhF;AAED,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;GAmB1D"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,UAAU,EAAgB,MAAM,eAAe,CAAC;AAoB/E,OAAO,EAEL,KAAK,SAAS,EAIf,MAAM,cAAc,CAAC;AAWtB,OAAO,KAAK,EACV,KAAK,EACL,MAAM,EACN,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,IAAI,EACL,MAAM,YAAY,CAAC;AAUpB,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,YAAY,CAAC;IAC3B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,6DAA6D;IAC7D,KAAK,CAAC,EAAE;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,uGAAuG;AACvG,eAAO,MAAM,SAAS,GAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,WACpC,CAAC;AAEjC;;;GAGG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACzC,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,MAA4B,GACpC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAKlC;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACzC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,MAA4B,GACpC,OAAO,CAAC,gBAAgB,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA+DjD;AA2DD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,WAAW,EACpB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,WAAW,CAAC,MAAM,CAAa;AACtC;;;;GAIG;AACH,OAAO,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,GAC5C,MAAM,GAAG,IAAI,CAmBf;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,wFAAwF;IACxF,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC/C;AAED,gIAAgI;AAChI,uGAAuG;AACvG,wBAAgB,eAAe,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAAE,CAGjF;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACzC,KAAK,EAAE,SAAS,IAAI,EAAE,GACrB,MAAM,GAAG,IAAI,CAMf;AAUD,oGAAoG;AACpG,wBAAsB,OAAO,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,KAAK,EACZ,IAAI,GAAE;IACJ,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,iFAAiF;IACjF,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IACtC,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;CACV,GACL,OAAO,CAAC,UAAU,CAAC,CAoOrB;AAED,qHAAqH;AACrH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACzC,KAAK,EAAE,IAAI,EAAE,EACb,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,YAAY,EAAE,IAAI,EAAE,CAAC;IACrB,qGAAqG;IACrG,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iGAAiG;IACjG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3E,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE;QAAE,mBAAmB,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;CACzF;AAED,oGAAoG;AACpG,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,YAAY,CAAC;IACtB,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,IAE7B,KAAK,MAAM,KAAG,OAAO,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,CAOxD;AAED,+GAA+G;AAC/G,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,QAAQ,GAAG,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC,CAAC;AAEhG;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,UAAU,EAAE,GAAG,IAAI,CAAC;AACnE,6FAA6F;AAC7F,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,EAAE,CAAC,CAqC3B;AAKD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,EACtB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GACpC,OAAO,CAAC,cAAc,EAAE,CAAC,CAQ3B;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,UAAU,CAAA;CAAO,GACnD,OAAO,CAAC;IACT,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;CACnB,CAAC,CAmBD;AAED,uGAAuG;AACvG,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAW3E;AAwBD,wBAAsB,KAAK,CACzB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,EACtB,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,EAC7B,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC5C,OAAO,CAAC,WAAW,CAAC,CAuYtB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAI9F;AAED,wBAAsB,GAAG,CACvB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,SAAS,GAAG,YAAY,GAAG,gBAAgB,EACvD,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,MAAM,CAAC,CAqDjB;AAED,wBAAsB,KAAK,CACzB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,MAAM,CAAC,CAgCjB;AAED,wBAAsB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG9E;AAED,wBAAsB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAG7F;AAED,wBAAsB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAKhF;AAED,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;GAmB1D"}

package/dist/actions.js

@@ -2,29 +2,34 @@ import { existsSync, statSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { headCommit } from "./changed.js";
 import { loadDocIndex } from "./docindex.js";
-import { computeWholeFileTiers, extractFileSymbols, fileExportsFingerprint } from "./extract.js";
+import { computeWholeFileTiers, extractFileSymbols, FINGERPRINT_VERSION, fileExportsFingerprint, } from "./extract.js";
 import { langForPath, parserFor } from "./grammar.js";
 import { fingerprint, fingerprintSet } from "./hash.js";
 import { appendEvent, historyFor, readLedger } from "./ledger.js";
 import { anchorsForPath, lockfilePath, newAnchorId, readLockfile, removeAnchor, upsertAnchor, writeFileAtomic, writeLockfile, } from "./lockfile.js";
 import { claimUnchanged, retargetMarkerLine, scanMarkers, stampMarkerLine, } from "./markers.js";
-import { globToRegExp, isScannedDoc, matchesAny, outsideRepoMessage, resolveInsideRepo, stripBom, walkFiles, } from "./repo.js";
+import { canonicalDocPath, globToRegExp, isScannedDoc, matchesAny, outsideRepoMessage, resolveInsideRepo, stripBom, walkFiles, } from "./repo.js";
 import { ALL_TIERS, tierFingerprint } from "./types.js";
 import { checkClaimAgainstValue, dataFormatOf, resolveValue, valueFingerprintInput, wholeFileContent, } from "./values.js";
-/** Recomputes all four tier fingerprints for a target, or reports it unresolved (file/symbol not found). */
-export async function resolveTarget(repoRoot, target, config) {
+/** The fingerprint version an anchor was stamped with (anchors from before versions are version 1). */
+export const versionOf = (anchor) => anchor.fingerprintVersion ?? 1;
+/**
+ * Recomputes all four tier fingerprints for a target, or reports it unresolved (file/symbol not found).
+ * `version` is how to compute them: the current way to stamp, an anchor's own to compare with it.
+ */
+export async function resolveTarget(repoRoot, target, config, version = FINGERPRINT_VERSION) {
     const absPath = resolveInsideRepo(repoRoot, target.path);
     if (!absPath)
         throw new Error(outsideRepoMessage(target.path));
     if (!existsSync(absPath))
         return null;
-    return resolveTargetInText(target, await readFile(absPath, "utf8"), config);
+    return resolveTargetInText(target, await readFile(absPath, "utf8"), config, version);
 }
 /**
  * {@link resolveTarget} on given file contents rather than the file on disk — used to fingerprint a
  * target as it was at an earlier commit. `source` is the bound symbol's declaration as written.
  */
-export async function resolveTargetInText(target, content, config) {
+export async function resolveTargetInText(target, content, config, version = FINGERPRINT_VERSION) {
     // A data file (JSON, LaTeX macros): the target is a value in it, not a symbol.
     const dataFormat = dataFormatOf(target.path);
     if (dataFormat) {
@@ -49,13 +54,10 @@ export async function resolveTargetInText(target, content, config) {
     }
     const lang = langForPath(target.path);
     if (!lang)
-        throw new Error(`lockwire supports TypeScript, TSX, JavaScript, and Python source, and values in JSON and LaTeX (.tex) files — "${target.path}" is none of these`);
-    const parser = await parserFor(lang);
-    const tree = parser.parse(content);
-    if (!tree)
-        throw new Error(`failed to parse ${target.path}`);
-    const root = tree.rootNode;
-    const symbols = extractFileSymbols(root, lang, config.normalizeLocals);
+        throw new Error(`lockwire supports TypeScript, TSX, JavaScript, and Python source, and values in JSON, CSV, TSV and LaTeX (.tex) files — "${target.path}" is none of these`);
+    // A symbol anchor never needs the whole file serialized, which is the costly part in a big file.
+    const parsed = await parseSource(target.path, content, lang, config, version, !target.symbol);
+    const { symbols } = parsed;
     const pathFp = fingerprint(target.path);
     if (target.symbol) {
         const symbol = symbols.bySymbolPath.get(target.symbol);
@@ -73,19 +75,61 @@ export async function resolveTargetInText(target, content, config) {
             source: symbol.sourceText,
         };
     }
-    const whole = computeWholeFileTiers(root, lang, config.normalizeLocals);
     return {
         found: true,
         fingerprints: {
             path: pathFp,
             sig: fileExportsFingerprint(symbols),
-            body: fingerprint(whole.bodyNormalized),
-            deps: fingerprintSet(whole.deps),
+            body: fingerprint(parsed.whole?.bodyNormalized ?? ""),
+            deps: fingerprintSet(parsed.whole?.deps ?? []),
         },
         symbols,
         source: content,
     };
 }
+/**
+ * The last parse of each file, reused while its content is the same: a check with many anchors on one
+ * file parses it once, not once per anchor. Keyed on the content itself rather than mtime, so an edit
+ * within the same millisecond can't be served stale.
+ */
+const parseCache = new Map();
+const PARSE_CACHE_SIZE = 256;
+async function parseSource(path, content, lang, config, version, needWhole) {
+    const key = `${version}|${config.normalizeLocals}|${lang}|${path}`;
+    const hit = parseCache.get(key);
+    if (hit && hit.content === content && (hit.whole || !needWhole)) {
+        parseCache.delete(key); // most recently used last
+        parseCache.set(key, hit);
+        return hit;
+    }
+    const tree = (await parserFor(lang)).parse(content);
+    if (!tree)
+        throw new Error(`failed to parse ${path}`);
+    // Everything kept is read out as strings, so the tree (wasm memory) is freed straight away.
+    let parsed;
+    try {
+        parsed = {
+            content,
+            symbols: hit?.content === content
+                ? hit.symbols
+                : extractFileSymbols(tree.rootNode, lang, config.normalizeLocals, version),
+            ...(needWhole
+                ? { whole: computeWholeFileTiers(tree.rootNode, lang, config.normalizeLocals, version) }
+                : {}),
+        };
+    }
+    finally {
+        tree.delete();
+    }
+    parseCache.delete(key);
+    parseCache.set(key, parsed);
+    if (parseCache.size > PARSE_CACHE_SIZE) {
+        const oldest = parseCache.keys().next().value;
+        if (oldest !== undefined)
+            parseCache.delete(oldest);
+    }
+    return parsed;
+}
 /**
  * Same-file rename detection: if a symbol vanished but exactly one other symbol in the file has the
  * same signature apart from its name, relink to it. `sig` fingerprints include the symbol's name,
@@ -94,16 +138,28 @@ export async function resolveTargetInText(target, content, config) {
  * unrelated neighbour with the same shape isn't mistaken for the rename target. Cross-file
  * relocation (the symbol moved to a different file) is not attempted in P0 — see docs/concepts.md limitations.
  */
-export function findRelocationCandidate(symbols, missingSigFp, oldName, taken = new Set()) {
+export function findRelocationCandidate(symbols, missingSigFp, oldName, taken = new Set(), 
+/**
+ * The vanished symbol's stamped body and deps. When given, a candidate must also match one of them:
+ * a rename keeps the implementation, while a deleted function's look-alike neighbour (same
+ * parameters, different code) is not where its claim went.
+ */
+stamped) {
     const candidates = [];
     for (const [path, symbol] of symbols.bySymbolPath) {
         if (taken.has(path))
             continue;
-        const sig = symbol.sigTokens
-            .replace(`fn ${symbol.name}(`, `fn ${oldName}(`)
-            .replace(`class ${symbol.name} [`, `class ${oldName} [`);
-        if (fingerprint(sig) === missingSigFp)
-            candidates.push(path);
+        const sig = symbol.sigFor?.(oldName) ??
+            symbol.sigTokens
+                .replace(`fn ${symbol.name}(`, `fn ${oldName}(`)
+                .replace(`class ${symbol.name} [`, `class ${oldName} [`);
+        if (fingerprint(sig) !== missingSigFp)
+            continue;
+        if (stamped &&
+            fingerprint(symbol.bodyNormalized) !== stamped.body &&
+            fingerprintSet(symbol.deps) !== stamped.deps)
+            continue;
+        candidates.push(path);
     }
     return candidates.length === 1 ? (candidates[0] ?? null) : null;
 }
@@ -133,10 +189,12 @@ export async function linkDoc(repoRoot, docPath, config, actor, opts = {}) {
     const absDoc = resolveInsideRepo(repoRoot, docPath);
     if (!absDoc)
         throw new Error(outsideRepoMessage(docPath));
+    // A symlinked doc is bound under the file it points to, so naming either one gives the same anchors.
+    docPath = canonicalDocPath(repoRoot, docPath, absDoc);
     const text = await readFile(absDoc, "utf8");
     const markers = scanMarkers(text);
     const lockfile = await readLockfile(repoRoot);
-    const result = { created: 0, refreshed: 0, skipped: [] };
+    const result = { created: 0, refreshed: 0, unchanged: 0, skipped: [] };
     // Keep each line's own terminator: stamping a marker must change that one line, not rewrite every
     // CRLF in the file to LF. `parts` alternates line, terminator, line, terminator, ...
     const parts = text.split(/(\r?\n)/);
@@ -152,6 +210,10 @@ export async function linkDoc(repoRoot, docPath, config, actor, opts = {}) {
             continue;
         }
         const targetLabel = `${marker.target.path}${marker.target.symbol ? `#${marker.target.symbol}` : ""}`;
+        if (marker.problem) {
+            result.skipped.push({ reason: marker.problem, target: targetLabel });
+            continue;
+        }
         let existing = marker.id ? current.anchors.find((a) => a.id === marker.id) : undefined;
         // A marker copy-pasted into another doc carries the original's id. If the original doc still
         // holds that marker, this is a second claim, not the same one moved -- binding it to the
@@ -211,15 +273,27 @@ export async function linkDoc(repoRoot, docPath, config, actor, opts = {}) {
             });
             continue;
         }
-        // Re-stamping a drifted (or orphaned-then-reappeared) anchor accepts code nobody has looked at, so
-        // it needs a human's say-so -- unless the code still matches and only the claim sentence moved.
-        const codeDrifted = existing?.tiers.some((t) => tierFingerprint(resolved.fingerprints, t) !== tierFingerprint(existing.fingerprints, t)) === true;
-        if ((existing?.status === "drifted" || existing?.status === "orphaned") &&
-            codeDrifted &&
-            !opts.reviewed) {
+        // Compare with the anchor as it was computed: an anchor stamped by an older fingerprint version is
+        // compared under that version, so upgrading lockwire never reads as changed code.
+        const compared = existing && versionOf(existing) !== FINGERPRINT_VERSION
+            ? await resolveTarget(repoRoot, target, config, versionOf(existing)).catch(() => null)
+            : resolved;
+        const then = compared?.found ? compared : resolved;
+        // Re-stamping an anchor whose bound code moved since it was stamped accepts code nobody has looked
+        // at, so it needs a human's say-so -- whether or not a `check` has recorded the drift yet. A moved
+        // value the sentence already states is the fix itself, not unreviewed code.
+        const codeDrifted = existing?.tiers.some((t) => {
+            if (tierFingerprint(then.fingerprints, t) === tierFingerprint(existing.fingerprints, t))
+                return false;
+            if (t !== "value" || !resolved.value)
+                return true;
+            const verdict = checkClaimAgainstValue(marker.claimText, resolved.value.raw);
+            return !(verdict.checkable && verdict.matches);
+        }) === true;
+        if (codeDrifted && !opts.reviewed) {
             result.skipped.push({
-                reason: "drifted anchor needs --reviewed to re-stamp",
-                target: marker.target.path,
+                reason: "the code changed since this claim was stamped: review it, then link --reviewed",
+                target: targetLabel,
             });
             continue;
         }
@@ -245,6 +319,20 @@ export async function linkDoc(repoRoot, docPath, config, actor, opts = {}) {
         idsSeenInDoc.add(id);
         if (marker.id)
             idsSeenInDoc.add(marker.id);
+        // Nothing to re-stamp: same claim, same place, same code. Leave the anchor and the ledger alone.
+        if (existing &&
+            !isNew &&
+            !retargeted &&
+            existing.status === "fresh" &&
+            versionOf(existing) === FINGERPRINT_VERSION &&
+            existing.doc === docPath &&
+            existing.claim?.hash === marker.claimHash &&
+            existing.claim?.line === marker.claimLine &&
+            existing.tiers.join() === tiers.join() &&
+            ALL_TIERS.every((t) => tierFingerprint(existing.fingerprints, t) === tierFingerprint(resolved.fingerprints, t))) {
+            result.unchanged++;
+            continue;
+        }
         const anchor = {
             id,
             doc: docPath,
@@ -257,6 +345,7 @@ export async function linkDoc(repoRoot, docPath, config, actor, opts = {}) {
             target,
             tiers,
             fingerprints: resolved.fingerprints,
+            fingerprintVersion: FINGERPRINT_VERSION,
             linked: { at: new Date().toISOString(), commit, by: actor },
             status: "fresh",
             waiver: null,
@@ -330,6 +419,7 @@ export async function linkLockfileOnly(repoRoot, docPath, target, tiers, config,
         target,
         tiers,
         fingerprints: resolved.fingerprints,
+        fingerprintVersion: FINGERPRINT_VERSION,
         linked: { at: new Date().toISOString(), commit: null, by: actor },
         status: "fresh",
         waiver: null,
@@ -361,7 +451,9 @@ export function markerReader(repoRoot) {
  * id that belongs to the marker in another doc (a copy-paste), or one used twice in a doc. Until
  * `lockwire link` runs, such a claim isn't being checked at all.
  */
-export async function findUnlinkedMarkers(lockfile, docs, readMarkers) {
+export async function findUnlinkedMarkers(lockfile, docs, readMarkers, 
+/** When given, a marker whose target file is missing says so instead of "not linked yet". */
+repoRoot) {
     const unlinked = [];
     for (const doc of [...docs].sort()) {
         const markers = await readMarkers(doc);
@@ -371,8 +463,18 @@ export async function findUnlinkedMarkers(lockfile, docs, readMarkers) {
         for (const m of markers) {
             let reason = null;
             const anchor = m.id ? lockfile.anchors.find((a) => a.id === m.id) : undefined;
-            if (!m.id)
-                reason = "not linked yet";
+            if (!m.id && m.problem)
+                reason = `not linked: ${m.problem}`;
+            else if (!m.id) {
+                const abs = repoRoot ? resolveInsideRepo(repoRoot, m.target.path) : undefined;
+                // `link` can't fix a marker that points nowhere: say what's wrong with it instead.
+                reason =
+                    abs === null
+                        ? `${m.target.path} is outside the repository`
+                        : abs !== undefined && !existsSync(abs)
+                            ? `not linked: ${m.target.path} doesn't exist`
+                            : "not linked yet";
+            }
             else if (!anchor)
                 reason = `id ${m.id} matches no anchor`;
             else if (seenIds.has(m.id))
@@ -565,7 +667,7 @@ export async function check(repoRoot, config, onlyPaths, opts = {}) {
         let resolved;
         let unresolvedNote = "file not found";
         try {
-            resolved = await resolveTarget(repoRoot, anchor.target, config);
+            resolved = await resolveTarget(repoRoot, anchor.target, config, versionOf(anchor));
         }
         catch (err) {
             resolved = null;
@@ -596,10 +698,10 @@ export async function check(repoRoot, config, onlyPaths, opts = {}) {
             const relocatedTo = resolved.symbols
                 ? findRelocationCandidate(resolved.symbols, anchor.fingerprints.sig, anchor.target.symbol.slice(anchor.target.symbol.lastIndexOf(".") + 1), new Set(lockfile.anchors
                     .filter((a) => a.id !== anchor.id && a.target.path === anchor.target.path)
-                    .flatMap((a) => (a.target.symbol ? [a.target.symbol] : []))))
+                    .flatMap((a) => (a.target.symbol ? [a.target.symbol] : []))), anchor.fingerprints)
                 : null;
             if (relocatedTo) {
-                const reResolved = await resolveTarget(repoRoot, { path: anchor.target.path, symbol: relocatedTo }, config);
+                const reResolved = await resolveTarget(repoRoot, { path: anchor.target.path, symbol: relocatedTo }, config, versionOf(anchor));
                 const target = { path: anchor.target.path, symbol: relocatedTo };
                 // A rename must not launder other changes: `sig` is expected to differ (it carries the
                 // name, and the candidate already matched on it), but any other bound tier that moved is
@@ -750,6 +852,21 @@ export async function check(repoRoot, config, onlyPaths, opts = {}) {
             });
         }
         else {
+            // Stamped by an older fingerprint version and nothing has moved since: re-stamp it the current way
+            // so later checks see what the current version sees (types in `sig`, every overload, ...). Nothing
+            // about the claim changed, so this records no event. If the target doesn't resolve the current way
+            // (a version-1 path a newer version spells differently), it keeps its old fingerprints.
+            if (versionOf(anchor) !== FINGERPRINT_VERSION && anyTierChanged.length === 0) {
+                const upgraded = await resolveTarget(repoRoot, anchor.target, config).catch(() => null);
+                if (upgraded?.found) {
+                    anchor = {
+                        ...anchor,
+                        fingerprints: upgraded.fingerprints,
+                        fingerprintVersion: FINGERPRINT_VERSION,
+                    };
+                    current = upsertAnchor(current, anchor);
+                }
+            }
             if (anchor.status === "drifted" && unchangedForThisClaim) {
                 const resolvedAnchor = { ...anchor, status: "fresh" };
                 current = upsertAnchor(current, resolvedAnchor);
@@ -789,7 +906,7 @@ export async function check(repoRoot, config, onlyPaths, opts = {}) {
     const docsToScan = onlyPaths
         ? await docsInScope(repoRoot, config, onlyPaths)
         : await discoverDocs(repoRoot, config);
-    const unlinked = await findUnlinkedMarkers(lockfile, docsToScan, markersIn);
+    const unlinked = await findUnlinkedMarkers(lockfile, docsToScan, markersIn, repoRoot);
     const singleHashWouldFlag = examined.filter((r) => r.singleHashWouldFlag).length;
     // The noise comparison is about code fingerprints; a claim-only flag has no single-hash counterpart.
     const tieredFlagged = examined.filter((r) => (r.status === "drifted" || r.status === "orphaned") &&
@@ -810,8 +927,12 @@ export async function check(repoRoot, config, onlyPaths, opts = {}) {
     };
     return { summary, results, unlinked };
 }
+/**
+ * Docs the config selects. A symlinked doc is skipped: it's another name for a file the walk reaches
+ * anyway (`README.md -> packages/zod/README.md`), and linking both would bind every claim twice.
+ */
 export async function discoverDocs(repoRoot, config) {
-    return walkFiles(repoRoot, config.exclude).filter((p) => matchesAny(p, config.docs));
+    return walkFiles(repoRoot, config.exclude, { skipSymlinks: true }).filter((p) => matchesAny(p, config.docs));
 }
 export async function ack(repoRoot, anchorId, resolution, note, actor, config) {
     const lockfile = await readLockfile(repoRoot);
@@ -849,6 +970,7 @@ export async function ack(repoRoot, anchorId, resolution, note, actor, config) {
             ...anchor,
             status: "fresh",
             fingerprints: resolved.fingerprints,
+            fingerprintVersion: FINGERPRINT_VERSION,
             claim,
             ...(resolved.value ? { value: resolved.value.display } : {}),
         };
@@ -866,7 +988,13 @@ export async function ack(repoRoot, anchorId, resolution, note, actor, config) {
 }
 export async function waive(repoRoot, anchorId, reason, expires, actor) {
     const expiresAt = Date.parse(expires);
-    if (!/^\d{4}-\d{2}-\d{2}/.test(expires) || Number.isNaN(expiresAt))
+    // Date.parse rolls an impossible day over (2027-02-31 is March 3rd); a waiver must say what it means.
+    const [y, m, d] = (/^(\d{4})-(\d{2})-(\d{2})/.exec(expires) ?? []).slice(1).map(Number);
+    const realDay = y !== undefined &&
+        m !== undefined &&
+        d !== undefined &&
+        new Date(Date.UTC(y, m - 1, d)).toISOString().startsWith(expires.slice(0, 10));
+    if (!realDay || Number.isNaN(expiresAt))
         throw new Error(`invalid --expires "${expires}": use an ISO date such as 2026-12-31 (waivers must expire)`);
     if (expiresAt <= Date.now())
         throw new Error(`--expires "${expires}" is already in the past`);