diff --git a/.luarc-typecheck.json b/.luarc-typecheck.json
new file mode 100644
index 0000000..e902932
--- /dev/null
+++ b/.luarc-typecheck.json
@@ -0,0 +1,9 @@
+{
+  "runtime": { "version": "LuaJIT" },
+  "workspace": {
+    "useGitIgnore": false,
+    "library": ["vendor"],
+    "ignoreDir": [".claude", ".git", ".idea", ".venv", "build", "dist", "node_modules", "vendor"]
+  },
+  "diagnostics": { "disable": ["unnecessary-assert"] }
+}
diff --git a/Makefile b/Makefile
index ef17773..4610957 100644
--- a/Makefile
+++ b/Makefile
@@ -167,11 +167,17 @@ lint:
 # Deliberately NOT part of `check`: a handful of type-narrowing and
 # deliberate-bad-argument diagnostics remain, and turning CI red on those is a
 # separate decision from making the check runnable.
+#
+# Checks the whole repo, not just src/: an editor's workspace is the repo, and
+# @alias resolves workspace-wide, so a narrower scope gives different findings
+# rather than fewer. --configpath pins the config, because .luarc.json is
+# personal editor preference and the count moves with it.
 .PHONY: typecheck
 typecheck:
 	@if command -v lua-language-server >/dev/null 2>&1; then \
-		echo "Running lua-language-server..."; \
-		lua-language-server --check "$(CURDIR)/src" --checklevel=Warning --logpath="$(CURDIR)/build/luals"; \
+		echo "Running lua-language-server $$(lua-language-server --version)..."; \
+		lua-language-server --check "$(CURDIR)" --checklevel=Warning \
+			--configpath="$(CURDIR)/.luarc-typecheck.json" --logpath="$(CURDIR)/build/luals"; \
 	else \
 		echo "lua-language-server not found. Install with: make install-deps"; \
 		exit 1; \
diff --git a/src/crypto/annotations.lua b/src/crypto/annotations.lua
index 7585b0d..0ee6bb6 100644
--- a/src/crypto/annotations.lua
+++ b/src/crypto/annotations.lua
@@ -10,7 +10,8 @@
 --- `crypto.init`) does not bundle it and the shipped builds are unchanged.
 ---
 --- Do not add runtime code here. Types used by a single module stay in that
---- module, next to what they describe.
+--- module, next to what they describe, and a type already defined in `vendor/`
+--- stays there rather than being restated here.
 
 -- ----------------------------------------------------------------------------
 -- Curve25519 field arithmetic
@@ -27,6 +28,6 @@
 -- ----------------------------------------------------------------------------
 -- Lua 5.1/5.2 have no 64-bit integers and 5.3+ `//` semantics differ, so the
 -- 64-bit primitives (SHA-512, BLAKE2b) carry 64-bit quantities as a pair of
--- 32-bit halves. Used by `utils/bytes`, `sha512` and `blake2`.
-
---- @alias Int64HighLow { [1]: integer, [2]: integer } 64-bit value as {high, low} 32-bit halves
+-- 32-bit halves, used by `utils/bytes`, `sha512` and `blake2`.
+--
+-- Int64HighLow is defined in vendor/bitn.lua, where these halves come from.