docs: add format-specific lockfile parser limitations

Closes #3

The parser-coverage doc previously documented general edge cases
(monorepos, nested node_modules, optional deps, private registries)
but did not spell out the format-specific behaviors each parser has
today. This section pulls those out per format, cross-referenced
against src/parsers/*.ts so bug reports can hit the right target.

- package-lock.json: v1/v2/v3 handling, node_modules path filter,
  dev flag source.
- pnpm-lock.yaml: v5/v6/v9 branch, link: / workspace: stripping,
  approximated path reconstruction.
- yarn.lock: --prod-only not honored (no dev/prod distinction in
  Classic lockfiles), flattened paths.
- bun.lock: JSONC parsing, workspace-based dev inference.
- package.json fallback: 50-entry skipped-deps cap, no transitive
  visibility.

Author: mvanhorn

docs/parser-coverage.md

@@ -40,6 +40,42 @@ For accurate transitive visibility and resolved version scanning, always use a l
 
 ---
 
+## Format-specific limitations
+
+Each parser handles some details differently. The behaviors below reflect the current implementation in `src/parsers/`.
+
+### package-lock.json
+
+- **v1, v2, and v3 supported.** v1 uses the legacy nested `dependencies` object; v2 and v3 use the flat `packages` map. Both paths are handled.
+- **Entries without a `node_modules/` path are skipped.** Root-level `""` entries that describe the project itself are intentionally ignored.
+- **Dev classification comes from the lockfile's `dev` flag.** Packages marked `devOptional` are classified as prod unless `dev: true` is also set.
+
+### pnpm-lock.yaml
+
+- **Lockfile versions v5, v6, and v9+ supported.** v9+ uses the newer `snapshots` model; earlier versions use the legacy `packages` map. The parser branches on `lockfileVersion`.
+- **Non-registry resolutions are skipped.** `link:` and `workspace:` prefixes are stripped, and any resulting relative-path reference (`./`, `../`) is not scanned. Tarball URLs and `file:` references without a resolvable version are similarly skipped.
+- **Dependency paths are approximated** from importer relationships and package snapshots, not a strict resolution tree.
+
+### yarn.lock
+
+- **Classic (v1) and Berry (v2/v3) formats supported** via `yarn-lockfile`.
+- **`--prod-only` has no effect with yarn.lock.** Yarn Classic lockfiles don't record a dev/prod distinction, so every resolved entry is scanned regardless of the flag.
+- **Dependency paths are flattened to `project > name`.** Transitive path reconstruction is limited for yarn.lock — this is the MVP behavior noted in the scan output.
+
+### bun.lock
+
+- **JSONC format** (Bun v1.1.38+). Trailing commas are stripped before JSON parsing.
+- **Dev inference from workspace sections.** A package is treated as dev-only if its name appears in a workspace's `devDependencies` but not its `dependencies`. Transitive packages default to prod.
+- **Dependency paths are flattened to `project > name`** (same as yarn.lock).
+
+### package.json (fallback)
+
+- **Only exact-pinned direct dependencies** are scanned (e.g. `"lodash": "4.17.20"`). Range specifiers (`^`, `~`, `>=`, `*`, `latest`, git/tarball URLs) are skipped and reported.
+- **Skipped-dependency report is capped at 50 entries.** In projects with many non-pinned specs, only the first 50 are listed in the report; the scan itself still proceeds.
+- **No transitive visibility.** Because no lockfile is present, resolved versions of sub-dependencies cannot be determined.
+
+---
+
 ## Known edge cases
 
 **Monorepos and workspaces**