Validate original_hash in link_versions --reviewed; document follow-ups (#194)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -379,8 +379,10 @@ for the `link_versions` binary).
   (1) a PNG's XMP `xmpMM:DerivedFrom/stRef:documentID = blake3:<hex>` (iTXt chunk
   `XML:com.adobe.xmp`, read by hand, no decode); (2) the file-name convention next
   to an indexed original in the same library (same dir, or the parent of
-  `aiedits/`). Name links are retried every tick (`sweep_name_links`), so an
-  original that wasn't hashed yet, or arrives later, still links. Only *new* rows
+  `aiedits/`). Name links are retried every tick (`sweep_name_links`, paged by a
+  per-library resume cursor that wraps, so candidates that never resolve can't starve
+  the ones behind them), so an original that wasn't hashed yet, or arrives later,
+  still links. Only *new* rows
   are examined, so files ingested before this existed need the `link_versions`
   binary once.
 - **Date/GPS/camera copy**: a version row takes its original's date triple, GPS and
@@ -397,16 +399,23 @@ for the `link_versions` binary).
   normal photo, so nothing disappears silently. Applied in `/photos` (SQL for the
   recursive listing, `hidden_version_rows` for the folder walk and tag branch),
   `/memories` and reels, `/photos/exif`, `/photos/gps-summary`, unified search, the
-  camera counts and the media gauges; `include_versions=true` lists them.
+  camera counts and the media gauges; `include_versions=true` lists them. The non-recursive `/photos` `dirs` also drops a
+  folder whose indexed contents are all hidden versions (typically `aiedits/`;
+  `dirs_holding_only_hidden_versions`, one indexed range scan per dir).
 - **Display file** is fetched through the original's library, so the display
   choice only counts when the chosen version has a row there (else the original
   shows; `PUT /image/versions/display` answers 400). Recording a link also drops
   the version's `face_detections`, CLIP columns and `clip_failures`.
 - **Tags and favorites** written or read on a version path bind to the original
   (`canonical_rel_path` in the tag/favorite DAOs, `get_rel_paths_sharing_content`
-  for reads). Insight generation on a version path runs against the original. A
-  *manual date* set on a version path is overwritten by the copy above: send the
-  original's path.
+  for reads). Annotations are keyed by rel_path alone, so a path that also names a
+  non-version file in any library is never redirected. Linking merges favorites and
+  tags already recorded on the version's own path into the original (union, duplicates
+  dropped; `link_version`). Insight generation on a version path runs against the
+  original. A *manual date* set or cleared on a version path (`POST /image/exif/date`,
+  `/clear`) is applied to the original's row instead, as the copy above would overwrite
+  it. Precomputed reels are not invalidated by a display change: reels render the
+  original's path, never the display file.
 - **Excluded from derived work** (`NOT_A_VERSION_CLAUSE`): face backlog and ingest
   candidates, face stats (numerator and denominator), CLIP backlog and index, and
   exact/perceptual duplicate grouping. Thumbnails and previews *are* generated.
@@ -421,7 +430,8 @@ for the `link_versions` binary).
   TSV. `exact` rows (XMP, file name) are what ingest would have linked and apply
   with `--apply`; `review` rows (ComfyUI prompt `LoadImage` input, Upscayl-style
   names, nearest pHash) apply only from a reviewed TSV (`--reviewed`), each checked
-  against the current hash; `unresolved` rows are listed, never guessed. `--apply`
+  against the current version hash and the TSV's `original_hash` (stale rows are refused
+  and listed); `unresolved` rows are listed, never guessed. `--apply`
   takes a `VACUUM INTO` snapshot first.
 
 ### Enhance on demand (#192)