staysfixed 0.7.1 → 0.8.0

package/src/v2/selfcheck.js

@@ -116,6 +116,49 @@ export const CASES = [
     }),
   },
 
+  {
+    // Nothing this product prints changes, deliberately. A server written straight on
+    // node:http registers nothing — there is no `app.get` for a reader to find — so before
+    // the request handler itself was read, the only honest answer here was silence, and
+    // silence is the one answer this corpus exists to make impossible.
+    name: 'a route quietly renamed in a server written by hand',
+    breaks: 'A server built straight on node:http had one of its routes renamed. Nothing it prints changes, so the only way to see it is to read the handler.',
+    expect: 'a finding',
+    mustSay: [/health/i],
+    build: (broken) => ({
+      'package.json': PKG,
+      'cli.js': [
+        "import http from 'node:http';",
+        '',
+        'const server = http.createServer((req, res) => {',
+        "  if (req.url === '/orders') {",
+        "    res.writeHead(200, { 'content-type': 'application/json' });",
+        '    res.end(\'{"orders":2}\');',
+        '    return;',
+        '  }',
+        broken
+          ? "  if (req.url === '/healthz') {"
+          : "  if (req.url === '/health') {",
+        '    res.writeHead(200);',
+        '    res.end(\'{"ok":true}\');',
+        '    return;',
+        '  }',
+        '  res.writeHead(404);',
+        "  res.end('not found');",
+        '});',
+        '',
+        "await new Promise((done) => server.listen(0, '127.0.0.1', done));",
+        'const address = server.address();',
+        "const port = typeof address === 'object' && address ? address.port : 0;",
+        'const reply = await fetch(`http://127.0.0.1:${port}/orders`);',
+        'console.log(`GET /orders -> ${reply.status}`);',
+        'console.log(await reply.text());',
+        'server.close();',
+        '',
+      ].join('\n'),
+    }),
+  },
+
   {
     name: 'a field dropped from a reply',
     breaks: 'A field quietly disappeared from a reply that everything downstream reads.',
@@ -425,6 +468,111 @@ export const CASES = [
         .join('\n'),
     }),
   },
+
+  {
+    name: "a break only the project's own tests can see",
+    breaks:
+      'A total stops rounding. The command-line program only ever adds whole pounds, so what it prints does not move by one character and every journey this tool can discover on its own stays silent. The project\'s own test adds pennies, and it is the only thing in the repository that notices.',
+    expect: 'a finding',
+    mustSay: [/pennies/i],
+    journeys: [
+      {
+        name: 'suite-test-total-test',
+        describe: 'run the 3 checks in test/total.test.js and watch what they touch',
+        source: 'suite',
+        surface: 'cli',
+        from: 'test/total.test.js',
+        channels: ['results', 'complaints', 'counters'],
+        steps: [
+          {
+            act: 'run-tests',
+            runner: 'node:test',
+            file: 'test/total.test.js',
+            // Named rather than given as a path, so this case runs on a machine whose Node
+            // lives somewhere else. `node` is on the path of any machine that got this far.
+            command: 'node',
+            argv: ['--test', '--test-reporter=tap', 'test/total.test.js'],
+            note: 'Run this exactly as it was harvested. A test file run a different way is a different journey.',
+          },
+        ],
+      },
+    ],
+    build: (broken) => ({
+      'package.json': JSON.stringify(
+        { name: 'widget', version: '1.0.0', type: 'module', bin: { widget: 'cli.js' }, scripts: { test: 'node --test' } },
+        null,
+        2,
+      ) + '\n',
+      'total.js': [
+        'export function total(items) {',
+        '  let sum = 0;',
+        '  for (const item of items) sum += item.price;',
+        broken ? '  return sum;' : '  return Math.round(sum * 100) / 100;',
+        '}',
+        '',
+      ].join('\n'),
+      'cli.js': [
+        "import { total } from './total.js';",
+        '// Whole pounds only, which is why running the product proves nothing here.',
+        'console.log(total([{ price: 2 }, { price: 3 }]));',
+        '',
+      ].join('\n'),
+      'test/total.test.js': [
+        "import { test } from 'node:test';",
+        "import assert from 'node:assert/strict';",
+        "import { total } from '../total.js';",
+        '',
+        "test('adds whole pounds', () => {",
+        '  assert.equal(total([{ price: 2 }, { price: 3 }]), 5);',
+        '});',
+        '',
+        "test('adds pennies without floating point dust', () => {",
+        '  assert.equal(total([{ price: 0.1 }, { price: 0.2 }]), 0.3);',
+        '});',
+        '',
+      ].join('\n'),
+    }),
+  },
+
+  {
+    name: 'a break behind an npm script',
+    breaks:
+      'A message changes, behind `npm run`. Nothing about the product is unusual — what this case really watches is the watcher: it rides inside the child, and until 2026-08-30 the proxy it put over the environment had no `set` trap, so npm wrote npm_lifecycle_event, read back nothing, and exited 1 without printing a word. Every product whose start command went through npm looked like a product that would not boot, on both builds equally, which is a silence rather than a finding.',
+    expect: 'a finding',
+    mustSay: [/two orders|three orders/i],
+    journeys: [
+      {
+        name: 'run-it',
+        describe: 'Run the product the way its own package.json says to run it.',
+        source: 'code',
+        surface: 'cli',
+        steps: [
+          {
+            act: 'run',
+            run: 'npm run --silent report',
+            note: 'through npm, because that is what `staysfixed init` writes by default',
+            env: {
+              // npm's own update check reaches for the registry, which is refused - and an
+              // attempt that happens on one run and not the next is noise this case would
+              // then have to argue about. Switched off rather than subtracted.
+              NO_UPDATE_NOTIFIER: '1',
+              npm_config_update_notifier: 'false',
+              npm_config_audit: 'false',
+              npm_config_fund: 'false',
+            },
+          },
+        ],
+      },
+    ],
+    build: (broken) => ({
+      'package.json': JSON.stringify(
+        { name: 'widget', version: '1.0.0', type: 'module', scripts: { report: 'node report.js' } },
+        null,
+        2,
+      ) + '\n',
+      'report.js': `console.log('${broken ? 'three' : 'two'} orders');\n`,
+    }),
+  },
 ];
 
 /**
@@ -477,22 +625,51 @@ async function makeStoreUnwritable(dir, working) {
     return { ready: false, why: `the warm-up run did not work: ${why(e)}` };
   }
 
-  /** @type {string[]} */
-  const shut = [];
-  for (const build of await fsp.readdir(builds, { withFileTypes: true })) {
-    if (!build.isDirectory()) continue;
-    const inside = path.join(builds, build.name);
-    for (const journey of await fsp.readdir(inside, { withFileTypes: true })) {
-      if (!journey.isDirectory()) continue;
-      const folder = path.join(inside, journey.name);
-      await fsp.chmod(folder, 0o555);
-      shut.push(folder);
-    }
-  }
-  if (shut.length === 0) return { ready: false, why: 'the warm-up run stored nothing, so there was nothing to make read-only' };
+  // Shut every folder under the store, not only the ones the captures land in.
+  //
+  // This walked two levels by hand — builds, then journeys — which left the build record
+  // itself writable. That is the wrong half: `openProject` writes the build record before a
+  // single journey runs, so a disk that has given out fails THERE first, and a case that
+  // only shuts the capture folders never exercises the path the real failure takes.
+  // Shutting the whole store is the mirror of `relax`, which is what puts it back.
+  const shut = await shutTight(path.join(dir, '.staysfixed', 'v2'));
+  if (shut === 0) return { ready: false, why: 'the warm-up run stored nothing, so there was nothing to make read-only' };
   return { ready: true, why: '' };
 }
 
+/**
+ * Make a folder and everything under it read-only, and say how many folders that was.
+ *
+ * The exact mirror of `relax`, which undoes it. Failures are ignored on purpose: a folder
+ * that will not change permissions is one this case cannot use, and the count tells the
+ * caller whether enough of the store was shut for the case to mean anything.
+ *
+ * @param {string} dir
+ * @returns {Promise<number>}
+ */
+async function shutTight(dir) {
+  /** @type {import('node:fs').Dirent[]} */
+  let inside = [];
+  try {
+    inside = await fsp.readdir(dir, { withFileTypes: true });
+  } catch {
+    return 0;
+  }
+  let shut = 0;
+  for (const entry of inside) {
+    if (entry.isDirectory()) shut += await shutTight(path.join(dir, entry.name));
+  }
+  // The folder itself last: shut it first and its own children become unreachable.
+  try {
+    await fsp.chmod(dir, 0o555);
+    shut += 1;
+  } catch {
+    // Read-only already, or a filesystem that will not say no. Either way, not a reason
+    // to stop — `relax` will still walk it, and the count tells the caller what happened.
+  }
+  return shut;
+}
+
 // ---------------------------------------------------------------------------
 // Running it
 // ---------------------------------------------------------------------------

package/src/v2/ship.js

@@ -156,15 +156,29 @@ export async function onShip(opts = {}) {
     const store = openStore({ root });
     await ensureStore(store);
 
-    const build = await resolveBuild(store, product, release, opts.build);
+    /** @type {string[]} */
+    const unreadable = [];
+    const build = await resolveBuild(store, product, release, opts.build, (/** @type {string} */ why) => unreadable.push(String(why)));
+    if (unreadable.length > 0) {
+      // Said whether or not a build was found, because a damaged record changes what the
+      // answer is worth either way: if none was found it may be the reason, and if one was
+      // found it may not be the right one.
+      result.lines.push(
+        `${unreadable.length} stored ${unreadable.length === 1 ? 'record' : 'records'} of ${product} could not be read, so ${unreadable.length === 1 ? 'it was' : 'they were'} left out of this decision: ${unreadable.join('; ')}`,
+      );
+    }
     if (!build) {
       result.cut = false;
+      const because = unreadable.length > 0
+        ? ` ${unreadable.length} of its stored ${unreadable.length === 1 ? 'record' : 'records'} could not be read, which may be why.`
+        : '';
       result.lines = [
         `${product} ${release.describe}`,
-        `Stays Fixed has no record of this build, so it did not become the reference. Nothing about ${product} is being compared against anything yet.`,
+        `Stays Fixed has no record of this build, so it did not become the reference. Nothing about ${product} is being compared against anything yet.${because}`,
         'Run `staysfixed check` once before the next release and it will record itself from then on.',
+        ...(unreadable.length > 0 ? [`What could not be read: ${unreadable.join('; ')}`] : []),
       ];
-      result.summary = `${product} shipped ${release.what}, but Stays Fixed had never seen this build, so what "working" means has not moved. Run a check before the next release.`;
+      result.summary = `${product} shipped ${release.what}, but Stays Fixed had never seen this build, so what "working" means has not moved.${because} Run a check before the next release.`;
       return result;
     }
 
@@ -381,10 +395,20 @@ async function versionBump(root) {
  * @param {string} product
  * @param {Release} release
  * @param {string|BuildFingerprint} [told]
+ * @param {(why: string) => void} [onProblem]  Told about any stored record that would not open.
  * @returns {Promise<BuildFingerprint|null>}
  */
-async function resolveBuild(store, product, release, told) {
-  const builds = await listBuilds(store, { product });
+async function resolveBuild(store, product, release, told, onProblem) {
+  // A record nobody could read must never be silently absent here.
+  //
+  // This function decides which build becomes the definition of "working" for a whole
+  // product. `listBuilds` skips a damaged record rather than failing, which is right for a
+  // listing and wrong here twice over: a build whose record will not open looks exactly like
+  // a build that was never walked, so the answer is "Stays Fixed has never seen this build"
+  // when the truth is "it has, and the record is broken"; and where two builds share a
+  // commit, losing the clean one to a damaged record leaves the dirty one to be blessed in
+  // its place. Neither is a thing to work out from an empty list.
+  const builds = await listBuilds(store, { product, onProblem });
 
   if (told) {
     const id = typeof told === 'string' ? told : told.id;

package/src/v2/store.js

@@ -256,7 +256,7 @@ export async function saveCapture(store, capture) {
  * clears those up.
  *
  * @param {Store} store
- * @param {{build: BuildFingerprint, journey: string, run: CaptureRun, id?: string, source?: JourneySource, startedAt?: string, rules?: string}} opts
+ * @param {{build: BuildFingerprint, journey: string, run: CaptureRun, id?: string, source?: JourneySource, startedAt?: string, rules?: string, rulesScope?: Record<string, string[]>}} opts
  * @returns {Promise<{ref: CaptureRef, append: (o: Observation) => Promise<void>, close: (end?: {durationMs?: number, coverage?: Coverage, note?: string}) => Promise<CaptureRef>, abandon: () => Promise<void>}>}
  */
 export async function openCaptureWriter(store, opts) {
@@ -282,6 +282,7 @@ export async function openCaptureWriter(store, opts) {
   };
   if (opts.source) shell.source = opts.source;
   if (opts.rules) shell.rules = opts.rules;
+  if (opts.rulesScope) shell.rulesScope = opts.rulesScope;
   await handle.write(JSON.stringify(headerOf(shell)) + '\n');
 
   let open = true;
@@ -367,6 +368,16 @@ async function bumpBuild(store, capture) {
 }
 
 /**
+ * The first line of a capture file.
+ *
+ * The field list is written out rather than spread, so that what reaches disk is a decision
+ * somebody made. The cost of that is this: a field added to `Capture` and not added here is
+ * silently dropped, and everything downstream reads its absence as a fact about the run. It
+ * happened to `rulesScope` — stamped on every capture, written to none of them, and the
+ * feature that reads it took the "this record predates the stamp" branch forever. If you add
+ * a field to Capture that a later run needs, add it here and to the read in `loadCapture`,
+ * and prove it with a write-then-read test rather than a unit test on the stamping.
+ *
  * @param {Capture} capture
  * @returns {Record<string, unknown>}
  */
@@ -381,6 +392,7 @@ function headerOf(capture) {
     run: capture.run,
     startedAt: capture.startedAt,
     rules: capture.rules,
+    rulesScope: capture.rulesScope,
   };
 }
 
@@ -512,6 +524,7 @@ export async function loadCapture(store, where) {
   };
   if (header.source) capture.source = header.source;
   if (header.rules) capture.rules = header.rules;
+  if (header.rulesScope) capture.rulesScope = header.rulesScope;
   if (end?.coverage) capture.coverage = end.coverage;
 
   const notes = [];
@@ -824,6 +837,59 @@ export async function pruneBuild(store, buildId, opts = {}) {
   return { removed, kept };
 }
 
+/**
+ * Throw the whole of a build away: its record, its captures, its folder.
+ *
+ * The companion `pruneBuild` thins one build's captures down to the newest few, which is the
+ * right tool when a build is worth keeping and its hundred captures are not. It is the wrong
+ * tool for the growth anybody actually measures: one build FOLDER per check, forever, in a
+ * directory this tool asks people to commit. Nothing could remove a folder at all, so the only
+ * housekeeping that existed could not touch the thing that grows.
+ *
+ * The two refusals are the same two, for the same reason, and they are loud rather than quiet
+ * because deleting the evidence of what "working" means is not recoverable:
+ *
+ *   - A build any product points at as its reference is never removed. Its captures are the
+ *     only record of what working looked like, and once they are gone the next check has
+ *     nothing to compare against.
+ *   - A build whose own record cannot be read is never removed. An unreadable record is the
+ *     one state where we do not know what we would be deleting, and "I could not tell, so I
+ *     deleted it" is the wrong way round.
+ *
+ * WHAT TO KEEP IS NOT DECIDED HERE. This removes one build that has been named. Which builds
+ * are worth keeping — how many, how long, whether a `work-` build off a dirty tree is worth
+ * less than a `git-` one off a commit — is a policy about somebody's disk and their history,
+ * and it belongs where the run knows what it just did, not in the file that owns the folder.
+ *
+ * @param {Store} store
+ * @param {string} buildId
+ * @returns {Promise<{removed: true, captures: number}>}
+ */
+export async function removeBuild(store, buildId) {
+  const record = await loadBuild(store, buildId);
+  const references = await loadReferences(store);
+
+  // Asked of the POINTERS rather than of the build's own record, for the reason spelled out in
+  // pruneBuild: a build whose build.json is missing answers nothing, and reading it the other
+  // way round would skip the guard exactly when it matters most.
+  const pointedAt = Object.values(references).filter((p) => p?.buildId === buildId);
+  if (pointedAt.length > 0) {
+    throw new StaysFixedError(
+      `${buildId} is the reference for ${pointedAt.map((p) => p.product).join(', ')}, so it cannot be thrown away.`,
+      { hint: 'Point the reference at a newer build first, with setReference.' },
+    );
+  }
+  if (!record) {
+    throw new StaysFixedError(`Nothing here says what ${buildId} is, so it will not be thrown away.`, {
+      hint: 'Its build.json is missing. Deleting a build on the strength of a record nobody can read is how the evidence for "this used to work" disappears. Run a check against it to rewrite the record, or delete the folder deliberately.',
+    });
+  }
+
+  const captures = (await listCaptures(store, { buildId })).length;
+  await fsp.rm(buildDir(store, buildId), { recursive: true, force: true });
+  return { removed: true, captures };
+}
+
 /**
  * Delete `.part` files left behind by runs that died.
  *

package/src/v2/types.js

@@ -152,7 +152,6 @@
  * @property {string|null} [branch]
  * @property {boolean} [dirty]        Working tree had uncommitted changes.
  * @property {string} [artifact]      Path to the built thing. NOT stored here — see store.js.
- * @property {string} [artifactSha256]
  * @property {string} [builtAt]       ISO timestamp.
  * @property {string} [platform]      e.g. 'darwin-arm64'. Comparing across platforms warns.
  * @property {string} [tool]          Stays Fixed version that captured it.
@@ -183,7 +182,12 @@
  * @property {Coverage} [coverage]    What this capture did NOT manage to look at.
  * @property {boolean} [complete]     False when the file was read back torn — see store.js.
  * @property {string} [note]
- * @property {string} [rules]         Id of the normalisation rule set applied, if any.
+ * @property {string} [rules]         Fingerprint of what the normalisation rules DO, if any
+ *                                   were applied. Scope is stamped separately — see rulesScope.
+ * @property {Record<string, string[]>} [rulesScope]
+ *                                   Where each scoped rule applied, by rule id. Absent on
+ *                                   captures written before this was stamped, which is a real
+ *                                   state and says "cannot be compared" rather than "nothing".
  */
 
 // ---------------------------------------------------------------------------
@@ -438,6 +442,12 @@ export {};
  *                                    '$.items.3.name'. Used by sort, round and drop.
  * @property {boolean} [off]          Shipped, documented, and not switched on.
  * @property {string} [whyOff]        Why it is not on by default.
+ * @property {boolean} [machine]      This rule's pattern is a fact about THIS machine — where
+ *                                    the project is checked out, where home is, where the temp
+ *                                    folder went today — rather than a decision about what to
+ *                                    tidy. Two machines running the same rule write the same
+ *                                    placeholder, so the rule is the same rule and its pattern
+ *                                    must not reach the fingerprint. See rulesFingerprint.
  */
 
 /**

package/src/v2/waiver.js

@@ -36,7 +36,6 @@
  * different difference and is reported.
  */
 
-import fsp from 'node:fs/promises';
 import path from 'node:path';
 import crypto from 'node:crypto';
 
@@ -48,9 +47,10 @@ import {
   readIntent,
   readIntentById,
   referenceStamp,
+  fingerprintTree,
+  treeMovedSince,
   readJsonFile,
   writeJsonAtomic,
-  shortDigest,
 } from './intent.js';
 
 /**
@@ -71,10 +71,15 @@ import {
  */
 export const WAIVER_BUDGET = 5;
 
-/** How many differences of one finding go into its fingerprint. Clusters can hold hundreds. */
-const FINGERPRINT_DIFFERENCES = 40;
-
-/** How many dead waivers are kept per product, so a summary can still say what expired. */
+/**
+ * How many dead waivers are kept per product, so a summary can still say what expired.
+ *
+ * LIVE ONES ARE NEVER PRUNED, which is what matters: the budget, the gates and whether a
+ * difference is covered are all worked out from those alone and none of them can be affected
+ * by this number. What it can affect is the sentence "three waivers expired when you
+ * shipped", which counts the dead ones still on disk — so after fifty of them, spread over
+ * ten ships or more, that number is the recent history rather than the whole of it.
+ */
 const KEEP_EXPIRED = 50;
 
 // ---------------------------------------------------------------------------
@@ -94,12 +99,22 @@ const KEEP_EXPIRED = 50;
  * @property {string} fingerprint      Pins the exact difference, values included.
  * @property {string} finding          The finding's own id, when it had one.
  * @property {string} summary          The finding's title, kept so this reads without a check.
- * @property {string[]} paths          The addresses involved, trimmed.
+ * @property {string[]} paths          The first few addresses involved, for somebody reading
+ *                                    this back later. Nothing is decided from them: what the
+ *                                    waiver actually covers is `fingerprint`, which takes in
+ *                                    every difference with no ceiling at all.
  * @property {FindingClass} class      What the engine called it. Always ordinary — see gate 1.
  * @property {string} why              The agent's reason, in its own words.
  * @property {string} intentId
  * @property {string} intentSummary    Copied, so a pruned intent does not orphan the waiver.
  * @property {string} ordering         What was known about when the intent was sealed.
+ * @property {{moved: boolean, knowable: boolean, say: string}} codeSince
+ *                                    Whether the code moved between sealing that intent and
+ *                                    writing this. Not a gate — a moved tree is what an
+ *                                    intent sealed BEFORE the work is supposed to look like.
+ *                                    It is recorded because the alternative is that nobody
+ *                                    reading this waiver a month later can tell whether the
+ *                                    intent describes the build that was actually checked.
  * @property {IntentCoverage} coverage How well it matched what was declared, and how sure.
  * @property {string} at               ISO. Written here, never supplied.
  * @property {string} [by]
@@ -284,6 +299,12 @@ export async function waive(store, what) {
     };
   }
 
+  // The last of the three things intent.js says its tree fingerprint makes checkable. The
+  // other two are gates above; this one cannot be, because both answers are legitimate — an
+  // intent sealed before the work SHOULD see a moved tree, and one sealed after it should
+  // not. So it is written down rather than judged, and a person reading the waiver decides.
+  const codeSince = treeMovedSince(intent, await fingerprintTree(store.root));
+
   /** @type {Waiver} */
   const waiver = {
     id: `waiver-${crypto.randomBytes(5).toString('hex')}`,
@@ -297,6 +318,7 @@ export async function waive(store, what) {
     intentId: intent.id,
     intentSummary: intent.summary,
     ordering: intent.ordering,
+    codeSince,
     coverage,
     at: new Date().toISOString(),
     reference: stamp,
@@ -318,6 +340,7 @@ export async function waive(store, what) {
       `Recorded as intended: ${waiver.summary}`,
       `Your reason, kept: ${why}`,
       `Matched against what you sealed: ${coverage.why} (${coverage.confidence} match)`,
+      codeSince.say,
       '',
       `${left} of your ${WAIVER_BUDGET} waivers left before the next ship. This one is pinned to the exact values that differ and to the reference in force now: if either moves, it stops covering anything.`,
       'This is not approval. Nothing becomes the new normal until a build ships. Say in what you report back that you waived this, and why.',
@@ -371,45 +394,6 @@ export function waiverFor(waivers, finding) {
   return waivers.find((w) => w.fingerprint === fingerprint) ?? null;
 }
 
-/**
- * What the closing summary needs: how many were waived, how many are left, what expired, and one
- * sentence saying so.
- *
- * Waivers must be visible, not quiet. This is the function that makes them so, and a summary
- * that does not use it is hiding something an agent decided on its own.
- *
- * @param {Store} store
- * @param {string} product
- * @returns {Promise<{budget: number, spent: number, left: number, active: Waiver[], expired: number, reference: string, line: string}>}
- */
-export async function countWaivers(store, product) {
-  const stamp = await referenceStamp(store, product);
-  const all = await allWaivers(store, product);
-  const active = all.filter((w) => isLive(w, stamp));
-  const expired = all.length - active.length;
-  const left = Math.max(0, WAIVER_BUDGET - active.length);
-
-  const line =
-    active.length === 0
-      ? `Nothing was waived${expired > 0 ? `, and ${expired} older waiver${expired === 1 ? '' : 's'} died when the reference last moved` : ''}.`
-      : `${active.length} difference${active.length === 1 ? ' was' : 's were'} recorded as intended, not approved: ${active
-          .map((w) => trim(w.summary, 90))
-          .join('; ')}. ${left} of the ${WAIVER_BUDGET} allowed before a person has to look ${left === 1 ? 'is' : 'are'} left.`;
-
-  return { budget: WAIVER_BUDGET, spent: active.length, left, active, expired, reference: stamp, line };
-}
-
-/**
- * Forget a product's waivers. Housekeeping, and the way a test starts clean.
- *
- * @param {Store} store
- * @param {string} product
- * @returns {Promise<void>}
- */
-export async function forgetWaivers(store, product) {
-  await fsp.rm(waiversFile(store, product), { force: true });
-}
-
 /**
  * What a waiver is pinned to.
  *
@@ -418,20 +402,46 @@ export async function forgetWaivers(store, product) {
  * which errs towards a person looking at something they have already seen rather than towards a
  * new break hiding behind an old excuse. That is the right way round.
  *
+ * EVERY difference, and there is deliberately no ceiling on that. Until 2026-08-30 this took
+ * the first forty and stopped, and the sentence above was simply false: a waiver written about
+ * a three-hundred-address finding went on covering it after a value past the fortieth turned
+ * into something else. The addresses were all still there, the title still read the same, the
+ * cluster was still one finding — so the pin matched, the difference was filed as intended, and
+ * nobody was ever shown the one row that had actually broken. That is the whole failure this
+ * file exists to prevent, arriving through the file itself.
+ *
+ * The cost of having no ceiling is a hash over text the caller is already holding in memory,
+ * which is nothing next to being wrong. The tuples are sorted first so that two runs which
+ * found the same differences in a different order still pin to the same thing; the number of
+ * them goes in as well, so a cluster that merely GREW cannot match a waiver written about the
+ * smaller one.
+ *
  * @param {Finding} finding
  * @returns {string}
  */
 export function fingerprintFinding(finding) {
-  const differences = (finding.differences ?? [])
-    .slice(0, FINGERPRINT_DIFFERENCES)
-    .map((d) => [d.path, d.kind, face(d.reference), face(d.candidate)]);
+  const differences = finding.differences ?? [];
+  const hash = crypto.createHash('sha256');
+  /** @param {unknown} part */
+  const eat = (part) => {
+    // JSON escapes every newline inside a value, so a newline is a separator nothing in the
+    // text can forge — two different findings cannot run together into one identical digest.
+    hash.update(`${JSON.stringify(part) ?? 'null'}\n`);
+  };
+
+  eat(finding.title ?? '');
+  eat([...(finding.paths ?? [])].sort());
+  eat(differences.length);
+  const rows = differences.map((d) => JSON.stringify([d.path, d.kind, face(d.reference), face(d.candidate)]));
+  rows.sort();
+  for (const row of rows) hash.update(`${row}\n`);
+
   // A finding with no differences attached, which some callers pass, still has to be pinnable,
   // so the sample and the paths stand in for them.
-  const fallback =
-    differences.length > 0
-      ? []
-      : [finding.sample?.path ?? '', finding.sample?.kind ?? '', face(finding.sample?.reference), face(finding.sample?.candidate)];
-  return shortDigest([finding.title ?? '', [...(finding.paths ?? [])].sort(), differences, fallback]);
+  if (differences.length === 0) {
+    eat([finding.sample?.path ?? '', finding.sample?.kind ?? '', face(finding.sample?.reference), face(finding.sample?.candidate)]);
+  }
+  return hash.digest('hex').slice(0, 16);
 }
 
 // ---------------------------------------------------------------------------