(sigil deps fetch)

Warn when the lockfile pins an older tag than the declared range now resolves to.

sigil deps install reuses the locked SHA whenever the lock entry's manifest identity still matches — it never asks whether a newer tag satisfies the range. Only deps update re-resolves, and it does so silently. The consequence is that a security fix published as a patch tag inside an existing caret range can sit unadopted indefinitely while install reports success every time; a known heap over-read was nearly re-shipped exactly this way.

This is a WARNING, not a re-resolution. A lockfile that silently moved under install would defeat the point of having one. The operator is told, and chooses.

Cost is one local git tag --list: ensure-bare-repo has already run git fetch --tags against this very repo earlier on this code path, so the newer tag is on disk before we get here. No network access is added. (The registry from-pkg path is deliberately NOT given the same check — its locked install is contractually offline, and the equivalent warning there would cost an index round-trip.)

Classify a discarded constraint. Pure: no I/O, no filesystem.

range the version range that was discarded, or #f when the arrival path carries no range at all (a workspace-member pull). have the version already resolved for that package, or #f when it could not be determined.

Returns one of: "SATISFIED" the resolved version meets the discarded range "UNSATISFIED" it does not — the interesting case "NO-RANGE" nothing was constrained, nothing was lost "UNKNOWN-INSTALLED-VERSION" a range was discarded but the resolved version is unreadable, so we cannot say "UNPARSEABLE" the range or the version failed to parse

The last two exist so "I could not determine this" is never reported as "SATISFIED". A classifier that cannot say "I don't know" launders its own failures into reassuring answers.

Print a structured error when two workspace members declare non-intersecting sigil: ranges. Names both sides + their respective ranges so the user knows exactly which package.sgl to reconcile. Bracketed by separator newlines for visual contrast, matching the look of check-sigil-version-compatible.

Verify that every member of ws declares a sigil: range compatible with the workspace's concrete version. Unlike dependency resolution, this does not require pairwise member ranges to intersect; a monorepo workspace has one active language version, and older members can remain valid as long as that version is at or above their declared floor.

The workspace's concrete version is a Sigil language version only when the workspace ships the language itself, i.e. it has a sigil-lib member. For application workspaces (including standalone packages wrapped by package->workspace), the workspace version is the app's own release version and is unrelated to the members' sigil: language floors; comparing them would reject every fresh sigil init app (version "0.1.0" vs sigil: "^0.15"). Those workspaces are validated against the resolved sigil dependency at resolution time instead, so this check no-ops for them.

No-op for non-workspace inputs. Members without a sigil: field are skipped here (presence enforcement is the job of validate-host-sigil-field, which is called separately).

Workspace-aware version of validate-host-sigil-fields-on. Calls the bootstrap-friendly presence check from (sigil deps installed) for every host package, then runs the cross-member intersection check. Shadows the re-export above so post-bootstrap callers get the richer behavior automatically.

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)

(No description)