@saasontools/strauss-kb 0.1.14 → 0.1.16

package/dist/{chunk-43KALLFU.js → chunk-H5W53NVU.js}

@@ -24,16 +24,17 @@ var kbAnchorSchema = z.object({
    * (`https://github.com/org/name`) or a short name. Absent means the base's
    * own repository, which is what nearly every anchor means.
    *
-   * Unvalidated beyond not-blank: one repository has many spellings.
-   * Matched after normalisation; see ARCHITECTURE.
+   * Unvalidated beyond not-blank: one repository has many spellings, matched
+   * after normalisation. Only a full URL can be fetched from, so `validate`
+   * warns on a short one; see ARCHITECTURE.
    */
   repo: z.string().trim().min(1).optional(),
   /**
    * The git rev the evidence was taken at. Prefer a commit SHA: a branch
    * name is a moving pointer, so an anchor pinned to one says the evidence
    * came from wherever that branch happens to be now, which is not a
-   * baseline. Recorded and preserved in v1; ref-pinned reads land with
-   * SAA-709.
+   * baseline. A foreign anchor is checked at this rev, and compared against
+   * the remote's default branch on top of it.
    */
   ref: z.string().trim().min(1).optional(),
   hash: z.string().regex(/^sha256:[0-9a-f]{64}$/, {
@@ -415,12 +416,116 @@ function selectDecisions(records) {
   );
 }
 
-// src/anchor-resolver.ts
+// src/anchor-resolver/repo-identity.ts
 import { execFile } from "child_process";
-import { createHash } from "crypto";
-import { readFile, realpath, stat } from "fs/promises";
-import { isAbsolute, relative, resolve, sep } from "path";
 import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+function normalizeRepoUrl(value) {
+  let url = value.trim().replace(/^git\+/, "");
+  const scp = /^[\w.-]+@([\w.-]+):(.+)$/.exec(url);
+  if (scp) url = `https://${scp[1]}/${scp[2]}`;
+  url = url.replace(/^ssh:\/\/(?:[^@/]+@)?/, "https://");
+  url = trimTrailingSlashes(url);
+  if (url.endsWith(".git")) url = url.slice(0, -4);
+  return trimTrailingSlashes(url).toLowerCase();
+}
+function trimTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") end -= 1;
+  return value.slice(0, end);
+}
+function isCanonicalRepoUrl(value) {
+  return /^[a-z0-9+.-]+:\/\//.test(normalizeRepoUrl(value));
+}
+function repoPath(normalized) {
+  const withoutScheme = normalized.replace(/^[a-z0-9+.-]+:\/\//, "");
+  const segments = withoutScheme.split("/").filter(Boolean);
+  return segments.length > 1 ? segments.slice(1).join("/") : "";
+}
+function repoIdentifies(declared, originUrl) {
+  if (!originUrl) return false;
+  const origin = normalizeRepoUrl(originUrl);
+  const want = normalizeRepoUrl(declared);
+  if (!want || !origin) return false;
+  if (want === origin) return true;
+  const path = repoPath(origin);
+  if (!path) return false;
+  return want === path || want === (path.split("/").pop() ?? "");
+}
+async function repoOriginUrl(repoRoot) {
+  try {
+    const { stdout } = await execFileAsync(
+      "git",
+      ["-C", repoRoot, "config", "--get", "remote.origin.url"],
+      { timeout: 5e3 }
+    );
+    return stdout.trim() || null;
+  } catch {
+    return null;
+  }
+}
+var LazyOrigin = class {
+  constructor(repoRoot) {
+    this.repoRoot = repoRoot;
+  }
+  repoRoot;
+  url = null;
+  asked = false;
+  /** Asks git once, so later `isForeign` calls need no await. */
+  async prime() {
+    if (this.asked) return;
+    this.url = await repoOriginUrl(this.repoRoot);
+    this.asked = true;
+  }
+  /** Only meaningful after `prime`; an unprimed origin identifies nothing. */
+  isForeign(anchor) {
+    if (!anchor.repo) return false;
+    return !repoIdentifies(anchor.repo, this.url);
+  }
+  async foreign(anchor) {
+    if (!anchor.repo) return false;
+    await this.prime();
+    return this.isForeign(anchor);
+  }
+};
+
+// src/remote-repo/cache.ts
+import { homedir } from "os";
+import { join } from "path";
+function repoCacheDir(override) {
+  return override ?? process.env["STRAUSS_KB_REPO_CACHE"] ?? join(homedir(), ".strauss", "repo-cache");
+}
+var DEFAULT_FETCH_TIMEOUT_MS = 3e4;
+function fetchTimeoutMs(override) {
+  if (override !== void 0) return override;
+  const fromEnv = Number(process.env["STRAUSS_KB_FETCH_TIMEOUT_MS"]);
+  return Number.isFinite(fromEnv) && fromEnv > 0 ? fromEnv : DEFAULT_FETCH_TIMEOUT_MS;
+}
+function cachePathFor(repo, cacheDir) {
+  const normalized = normalizeRepoUrl(repo);
+  const scheme = /^[a-z0-9+.-]+:\/\//.exec(normalized);
+  if (!scheme) return null;
+  const segments = normalized.slice(scheme[0].length).split("/").filter(Boolean).map((segment) => safeSegment(segment));
+  if (segments.length < 2 || segments.some((segment) => segment === null)) {
+    return null;
+  }
+  const path = segments;
+  return join(cacheDir, ...path.slice(0, -1), `${path[path.length - 1]}.git`);
+}
+function safeSegment(value) {
+  return value === "." || value === ".." || value.includes("\0") ? null : value.replace(/[/\\:]/g, "-");
+}
+function revRef(rev) {
+  const safe = rev.replace(/[^A-Za-z0-9_-]/g, "-").slice(0, 64);
+  let hash = 5381;
+  for (let at = 0; at < rev.length; at++) {
+    hash = (hash * 33 ^ rev.charCodeAt(at)) >>> 0;
+  }
+  return `refs/strauss/${safe}-${hash.toString(16)}`;
+}
+
+// src/remote-repo/read.ts
+import { mkdir } from "fs/promises";
 
 // src/concurrency.ts
 var DEFAULT_IO_CONCURRENCY = 16;
@@ -451,9 +556,415 @@ async function mapLimit(items, limit, fn) {
   return out;
 }
 
-// src/anchor-resolver.ts
-var execFileAsync = promisify(execFile);
+// src/remote-repo/git.ts
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+
+// src/anchor-resolver/model.ts
 var MAX_ANCHOR_FILE_BYTES = 1048576;
+
+// src/remote-repo/git.ts
+var execFileAsync2 = promisify2(execFile2);
+function childEnv() {
+  const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+  for (const name of ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE"]) {
+    delete env[name];
+  }
+  return env;
+}
+async function git(args, options = {}) {
+  try {
+    const { stdout, stderr } = await execFileAsync2("git", args, {
+      ...options.cwd ? { cwd: options.cwd } : {},
+      timeout: options.timeoutMs ?? 3e4,
+      maxBuffer: options.maxBytes ?? MAX_ANCHOR_FILE_BYTES,
+      encoding: "utf8",
+      windowsHide: true,
+      env: childEnv()
+    });
+    return { ok: true, stdout, stderr, overflowed: false };
+  } catch (error) {
+    const failure = error;
+    return {
+      ok: false,
+      stdout: failure.stdout ?? "",
+      stderr: failure.stderr ?? "",
+      overflowed: failure.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER"
+    };
+  }
+}
+function transportReason(stderr) {
+  const text = stderr.toLowerCase();
+  if (text.includes("authentication failed") || text.includes("permission denied") || text.includes("could not read username") || text.includes("403 forbidden") || text.includes("access denied")) {
+    return "repo-unauthorized";
+  }
+  if (text.includes("couldn't find remote ref") || text.includes("unadvertised object") || text.includes("not our ref")) {
+    return "ref-not-found";
+  }
+  return "remote-unreachable";
+}
+
+// src/remote-repo/model.ts
+var UNCHECKED_REASONS = [
+  "remote-unreachable",
+  "repo-unauthorized",
+  "default-branch-unknown"
+];
+function isUncheckedReason(reason) {
+  return reason !== void 0 && UNCHECKED_REASONS.includes(reason);
+}
+function wantKey(repo, ref, file) {
+  return `${repo}\0${ref ?? ""}\0${file}`;
+}
+
+// src/remote-repo/validate.ts
+var MAX_REF_LENGTH = 200;
+var REF_SHAPE = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+function refShapeIsSafe(ref) {
+  if (!ref || ref.length > MAX_REF_LENGTH) return false;
+  if (ref.includes("..")) return false;
+  return REF_SHAPE.test(ref);
+}
+async function refIsWellFormed(ref) {
+  if (!refShapeIsSafe(ref)) return false;
+  const checked = await git(["check-ref-format", "--allow-onelevel", ref]);
+  return checked.ok;
+}
+function filePathIsSafe(file) {
+  const path = file.replace(/^\.\//, "");
+  if (!path || path.startsWith("-") || path.includes("\0")) return false;
+  return !path.split("/").includes("..");
+}
+var DEFAULT_PROTOCOLS = ["https", "ssh", "git"];
+function allowedProtocols() {
+  const raw = process.env["STRAUSS_KB_REPO_PROTOCOLS"];
+  if (raw === void 0) return [...DEFAULT_PROTOCOLS];
+  const listed = raw.split(",").map((entry) => entry.trim().toLowerCase()).filter(Boolean);
+  return listed.length ? listed : [...DEFAULT_PROTOCOLS];
+}
+function isShortRepoName(repo) {
+  return /^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(repo.trim());
+}
+var SCP_LIKE = /^[\w.-]+@[\w.-]+:(?!\/)\S+$/;
+var URL_SCHEME = /^([A-Za-z0-9+.-]+):\/\//;
+var CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+function repoUrlIsSafe(repo) {
+  const url = repo.trim();
+  if (!url || url.startsWith("-") || CONTROL_CHARS.test(url)) return false;
+  const allowed = allowedProtocols();
+  if (SCP_LIKE.test(url)) return allowed.includes("ssh");
+  const scheme = URL_SCHEME.exec(url);
+  if (!scheme?.[1]) return false;
+  if (!allowed.includes(scheme[1].toLowerCase())) return false;
+  const authority = url.slice(scheme[0].length).split("/")[0] ?? "";
+  const at = authority.lastIndexOf("@");
+  return at < 0 || !authority.slice(0, at).includes(":");
+}
+function protocolArgs() {
+  const allowed = allowedProtocols();
+  return [
+    "-c",
+    "protocol.ext.allow=never",
+    "-c",
+    `protocol.file.allow=${allowed.includes("file") ? "user" : "never"}`
+  ];
+}
+
+// src/remote-repo/read.ts
+var DEFAULT_REPO_CONCURRENCY = 4;
+var IMMUTABLE_REV = /^[0-9a-f]{40}$/;
+async function readRemoteAnchors(wants, options = {}) {
+  const out = /* @__PURE__ */ new Map();
+  if (!wants.length) return out;
+  const cacheDir = repoCacheDir(options.cacheDir);
+  const timeoutMs = fetchTimeoutMs(options.fetchTimeoutMs);
+  const byRepo = /* @__PURE__ */ new Map();
+  for (const want of wants) {
+    const key = normalizeRepoUrl(want.repo);
+    const group2 = byRepo.get(key) ?? { url: want.repo.trim(), wants: [] };
+    group2.wants.push(want);
+    byRepo.set(key, group2);
+  }
+  const groups = [...byRepo.entries()];
+  const results = await mapLimit(
+    groups,
+    Math.max(1, options.concurrency ?? DEFAULT_REPO_CONCURRENCY),
+    ([repo, group2]) => readOneRepo(repo, group2.url, group2.wants, {
+      cacheDir,
+      timeoutMs,
+      offline: options.offline === true
+    })
+  );
+  for (const result of results) {
+    for (const [key, read] of result) out.set(key, read);
+  }
+  return out;
+}
+async function readOneRepo(repo, url, declared, context) {
+  let wants = declared;
+  const all = (read) => new Map(wants.map((want) => [wantKey(repo, want.ref, want.file), read]));
+  if (isShortRepoName(url)) {
+    return all({ ok: false, reason: "remote-unreachable" });
+  }
+  if (!repoUrlIsSafe(url)) return all({ ok: false, reason: "repo-invalid" });
+  const cache = cachePathFor(repo, context.cacheDir);
+  if (!cache) return all({ ok: false, reason: "remote-unreachable" });
+  const rejected = /* @__PURE__ */ new Map();
+  const usable = [];
+  for (const want of wants) {
+    const reason = wantReason(want);
+    if (reason)
+      rejected.set(wantKey(repo, want.ref, want.file), { ok: false, reason });
+    else usable.push(want);
+  }
+  if (!usable.length) return rejected;
+  wants = usable;
+  const opened = await openCache(cache, url, context);
+  if (opened) return new Map([...rejected, ...all(opened)]);
+  const wantsDefault = wants.some((want) => want.ref === void 0);
+  const branch = wantsDefault ? await defaultBranch(cache, context) : {};
+  const revs = /* @__PURE__ */ new Map();
+  for (const rev of distinctRevs(wants, branch.name)) {
+    revs.set(
+      rev,
+      await refIsWellFormed(rev) ? await ensureRev(cache, rev, context) : { ok: false, reason: "ref-invalid" }
+    );
+  }
+  const reads = await mapLimit(
+    wants,
+    DEFAULT_IO_CONCURRENCY,
+    async (want) => {
+      const rev = want.ref ?? branch.name;
+      if (rev === void 0) {
+        return {
+          ok: false,
+          reason: branch.reason ?? "default-branch-unknown"
+        };
+      }
+      const failed = revs.get(rev);
+      if (failed) return failed;
+      return readBlob(cache, rev, want.file, context);
+    }
+  );
+  return new Map([
+    ...rejected,
+    ...wants.map(
+      (want, at) => [wantKey(repo, want.ref, want.file), reads[at]]
+    )
+  ]);
+}
+function wantReason(want) {
+  if (want.ref !== void 0 && !refShapeIsSafe(want.ref)) return "ref-invalid";
+  return filePathIsSafe(want.file) ? void 0 : "outside-repo";
+}
+function distinctRevs(wants, branch) {
+  const revs = /* @__PURE__ */ new Set();
+  for (const want of wants) {
+    if (want.ref !== void 0) revs.add(want.ref);
+    else if (branch) revs.add(branch);
+  }
+  return [...revs];
+}
+async function openCache(cache, url, context) {
+  try {
+    await mkdir(cache, { recursive: true });
+  } catch {
+    return { ok: false, reason: "remote-unreachable" };
+  }
+  const init = await git(["init", "--bare", "--quiet", cache], {
+    timeoutMs: context.timeoutMs
+  });
+  if (!init.ok) return { ok: false, reason: "remote-unreachable" };
+  const remote = await git(["config", "remote.origin.url", url], {
+    cwd: cache,
+    timeoutMs: context.timeoutMs
+  });
+  return remote.ok ? void 0 : { ok: false, reason: "remote-unreachable" };
+}
+async function defaultBranch(cache, context) {
+  if (!context.offline) {
+    const listed = await git(
+      [...protocolArgs(), "ls-remote", "--symref", "origin", "HEAD"],
+      {
+        cwd: cache,
+        timeoutMs: context.timeoutMs
+      }
+    );
+    const found = /^ref:\s+refs\/heads\/(\S+)\s+HEAD$/m.exec(listed.stdout);
+    if (listed.ok && found?.[1]) {
+      const name = found[1];
+      await git(["config", "strauss.defaultBranch", name], { cwd: cache });
+      return { name };
+    }
+    if (!listed.ok) {
+      const reason = transportReason(listed.stderr);
+      if (reason !== "ref-not-found") {
+        const cached2 = await cachedBranch(cache);
+        return cached2 ? { name: cached2 } : { reason };
+      }
+    }
+  }
+  const cached = await cachedBranch(cache);
+  if (cached) return { name: cached };
+  return {
+    reason: context.offline ? "remote-unreachable" : "default-branch-unknown"
+  };
+}
+async function cachedBranch(cache) {
+  const stored = await git(["config", "--get", "strauss.defaultBranch"], {
+    cwd: cache
+  });
+  if (stored.ok && stored.stdout.trim()) return stored.stdout.trim();
+  const head = await git(
+    ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"],
+    {
+      cwd: cache
+    }
+  );
+  const name = head.stdout.trim().replace(/^origin\//, "");
+  return head.ok && name ? name : void 0;
+}
+async function ensureRev(cache, rev, context) {
+  const ref = revRef(rev);
+  const have = await git(
+    ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`],
+    {
+      cwd: cache
+    }
+  );
+  const cached = have.ok && have.stdout.trim().length > 0;
+  if (cached && (context.offline || IMMUTABLE_REV.test(rev))) return void 0;
+  if (context.offline) return { ok: false, reason: "remote-unreachable" };
+  const fetched = await git(
+    [
+      ...protocolArgs(),
+      "fetch",
+      "--depth",
+      "1",
+      "origin",
+      "--end-of-options",
+      rev
+    ],
+    { cwd: cache, timeoutMs: context.timeoutMs }
+  );
+  if (!fetched.ok) {
+    const reason = transportReason(fetched.stderr);
+    if (cached && reason !== "ref-not-found") return void 0;
+    return { ok: false, reason };
+  }
+  const head = await git(["rev-parse", "FETCH_HEAD"], { cwd: cache });
+  const sha = head.stdout.trim();
+  if (!head.ok || !sha) return { ok: false, reason: "remote-unreachable" };
+  const updated = await git(["update-ref", ref, sha], { cwd: cache });
+  return updated.ok ? void 0 : { ok: false, reason: "remote-unreachable" };
+}
+async function readBlob(cache, rev, file, context) {
+  const path = file.replace(/^\.\//, "");
+  const blob = await git(
+    ["cat-file", "blob", "--end-of-options", `${revRef(rev)}:${path}`],
+    {
+      cwd: cache,
+      timeoutMs: context.timeoutMs
+    }
+  );
+  if (blob.ok) return { ok: true, source: blob.stdout };
+  if (blob.overflowed) return { ok: false, reason: "file-too-large" };
+  const text = blob.stderr.toLowerCase();
+  return text.includes("does not exist") || text.includes("not a valid object") ? { ok: false, reason: "file-missing" } : { ok: false, reason: "file-unreadable" };
+}
+
+// src/anchor-resolver/read.ts
+import { readFile, realpath, stat } from "fs/promises";
+import { isAbsolute, relative, resolve, sep } from "path";
+function anchorFilePath(repoRoot, file) {
+  const path = resolve(repoRoot, file.replace(/^\.\//, ""));
+  const rel = relative(resolve(repoRoot), path);
+  if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+    return null;
+  }
+  return path;
+}
+function contains(root, path) {
+  const rel = relative(root, path);
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+function errorCode(error) {
+  return typeof error === "object" && error !== null && "code" in error ? String(error.code) : void 0;
+}
+function anchorFileReader(repoRoot) {
+  let rootOnce;
+  const realRoot = () => {
+    rootOnce ??= realpath(resolve(repoRoot)).catch((error) => {
+      rootOnce = void 0;
+      throw error;
+    });
+    return rootOnce;
+  };
+  return (file) => readAnchorFileWithRoot(repoRoot, file, realRoot);
+}
+async function readAnchorFileWithRoot(repoRoot, file, realRoot) {
+  const lexical = anchorFilePath(repoRoot, file);
+  if (lexical === null) return { ok: false, reason: "outside-repo" };
+  let root;
+  let path;
+  try {
+    root = await realRoot();
+    path = await realpath(lexical);
+  } catch (error) {
+    const code = errorCode(error);
+    if (code === "ENOENT" || code === "ENOTDIR") {
+      return { ok: false, reason: "file-missing" };
+    }
+    return { ok: false, reason: "file-unreadable" };
+  }
+  if (!contains(root, path)) return { ok: false, reason: "outside-repo" };
+  try {
+    const stats = await stat(path);
+    if (!stats.isFile()) return { ok: false, reason: "file-unreadable" };
+    if (stats.size > MAX_ANCHOR_FILE_BYTES) {
+      return { ok: false, reason: "file-too-large" };
+    }
+    return { ok: true, source: await readFile(path, "utf8") };
+  } catch (error) {
+    const code = errorCode(error);
+    if (code === "ENOENT" || code === "ENOTDIR") {
+      return { ok: false, reason: "file-missing" };
+    }
+    return { ok: false, reason: "file-unreadable" };
+  }
+}
+function looksLikeWrongRepoRoot(drift) {
+  let checked = 0;
+  for (const entries of drift.values()) {
+    for (const entry of entries) {
+      if (entry.repo !== void 0) continue;
+      checked += 1;
+      if (entry.state !== "unresolved" || entry.reason !== "file-missing") {
+        return false;
+      }
+    }
+  }
+  return checked > 0;
+}
+async function readAnchorFiles(files, read, concurrency = DEFAULT_IO_CONCURRENCY) {
+  if (!Number.isInteger(concurrency) || concurrency < 1) {
+    throw new RangeError(
+      `readAnchorFiles: option "concurrency" must be a positive integer, got ${concurrency}`
+    );
+  }
+  const wanted = [...new Set(files)];
+  const results = await mapLimit(wanted, concurrency, async (file) => {
+    try {
+      return await read(file);
+    } catch {
+      return { ok: false, reason: "file-unreadable" };
+    }
+  });
+  return new Map(wanted.map((file, at) => [file, results[at]]));
+}
+
+// src/anchor-resolver/resolver.ts
+import { createHash } from "crypto";
 var PARENT_SCOPE_LINES = 50;
 var CLEAN_STATE = { blockComment: false, template: false };
 function stripLine(line, state) {
@@ -605,181 +1116,32 @@ var regexResolver = {
 };
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function distanceToParent(lines, index, parent) {
-  const floor = Math.max(0, index - PARENT_SCOPE_LINES);
-  for (let at = index; at >= floor; at--) {
-    if (parent.test(lines[at] ?? "")) return index - at;
-  }
-  return Number.POSITIVE_INFINITY;
-}
-function hashAnchorText(text) {
-  return `sha256:${createHash("sha256").update(text.replace(/\r\n/g, "\n")).digest("hex")}`;
-}
-function resolveAnchor(source, anchor, resolver = regexResolver) {
-  const normalized = source.replace(/\r\n/g, "\n");
-  if (!anchor.symbol) {
-    const lines = normalized.split("\n");
-    if (lines.length > 1 && lines[lines.length - 1] === "") lines.pop();
-    return {
-      text: normalized,
-      startLine: 1,
-      endLine: Math.max(1, lines.length)
-    };
-  }
-  return resolver.resolve(normalized, anchor.symbol);
-}
-function anchorFilePath(repoRoot, file) {
-  const path = resolve(repoRoot, file.replace(/^\.\//, ""));
-  const rel = relative(resolve(repoRoot), path);
-  if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
-    return null;
-  }
-  return path;
-}
-function contains(root, path) {
-  const rel = relative(root, path);
-  return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
-}
-function normalizeRepoUrl(value) {
-  let url = value.trim().replace(/^git\+/, "");
-  const scp = /^[\w.-]+@([\w.-]+):(.+)$/.exec(url);
-  if (scp) url = `https://${scp[1]}/${scp[2]}`;
-  url = url.replace(/^ssh:\/\/(?:[^@/]+@)?/, "https://");
-  url = trimTrailingSlashes(url);
-  if (url.endsWith(".git")) url = url.slice(0, -4);
-  return trimTrailingSlashes(url).toLowerCase();
-}
-function trimTrailingSlashes(value) {
-  let end = value.length;
-  while (end > 0 && value[end - 1] === "/") end -= 1;
-  return value.slice(0, end);
-}
-function repoPath(normalized) {
-  const withoutScheme = normalized.replace(/^[a-z0-9+.-]+:\/\//, "");
-  const segments = withoutScheme.split("/").filter(Boolean);
-  return segments.length > 1 ? segments.slice(1).join("/") : "";
-}
-function repoIdentifies(declared, originUrl) {
-  if (!originUrl) return false;
-  const origin = normalizeRepoUrl(originUrl);
-  const want = normalizeRepoUrl(declared);
-  if (!want || !origin) return false;
-  if (want === origin) return true;
-  const path = repoPath(origin);
-  if (!path) return false;
-  return want === path || want === (path.split("/").pop() ?? "");
-}
-async function repoOriginUrl(repoRoot) {
-  try {
-    const { stdout } = await execFileAsync(
-      "git",
-      ["-C", repoRoot, "config", "--get", "remote.origin.url"],
-      { timeout: 5e3 }
-    );
-    return stdout.trim() || null;
-  } catch {
-    return null;
-  }
-}
-var LazyOrigin = class {
-  constructor(repoRoot) {
-    this.repoRoot = repoRoot;
-  }
-  repoRoot;
-  url = null;
-  asked = false;
-  /** Asks git once, so later `isForeign` calls need no await. */
-  async prime() {
-    if (this.asked) return;
-    this.url = await repoOriginUrl(this.repoRoot);
-    this.asked = true;
-  }
-  /** Only meaningful after `prime`; an unprimed origin identifies nothing. */
-  isForeign(anchor) {
-    if (!anchor.repo) return false;
-    return !repoIdentifies(anchor.repo, this.url);
-  }
-  async foreign(anchor) {
-    if (!anchor.repo) return false;
-    await this.prime();
-    return this.isForeign(anchor);
-  }
-};
-function errorCode(error) {
-  return typeof error === "object" && error !== null && "code" in error ? String(error.code) : void 0;
-}
-function anchorFileReader(repoRoot) {
-  let rootOnce;
-  const realRoot = () => {
-    rootOnce ??= realpath(resolve(repoRoot)).catch((error) => {
-      rootOnce = void 0;
-      throw error;
-    });
-    return rootOnce;
-  };
-  return (file) => readAnchorFileWithRoot(repoRoot, file, realRoot);
-}
-async function readAnchorFileWithRoot(repoRoot, file, realRoot) {
-  const lexical = anchorFilePath(repoRoot, file);
-  if (lexical === null) return { ok: false, reason: "outside-repo" };
-  let root;
-  let path;
-  try {
-    root = await realRoot();
-    path = await realpath(lexical);
-  } catch (error) {
-    const code = errorCode(error);
-    if (code === "ENOENT" || code === "ENOTDIR") {
-      return { ok: false, reason: "file-missing" };
-    }
-    return { ok: false, reason: "file-unreadable" };
-  }
-  if (!contains(root, path)) return { ok: false, reason: "outside-repo" };
-  try {
-    const stats = await stat(path);
-    if (!stats.isFile()) return { ok: false, reason: "file-unreadable" };
-    if (stats.size > MAX_ANCHOR_FILE_BYTES) {
-      return { ok: false, reason: "file-too-large" };
-    }
-    return { ok: true, source: await readFile(path, "utf8") };
-  } catch (error) {
-    const code = errorCode(error);
-    if (code === "ENOENT" || code === "ENOTDIR") {
-      return { ok: false, reason: "file-missing" };
-    }
-    return { ok: false, reason: "file-unreadable" };
-  }
-}
-function looksLikeWrongRepoRoot(drift) {
-  let checked = 0;
-  for (const entries of drift.values()) {
-    for (const entry of entries) {
-      if (entry.reason === "foreign-repo") continue;
-      checked += 1;
-      if (entry.state !== "unresolved" || entry.reason !== "file-missing") {
-        return false;
-      }
-    }
+}
+function distanceToParent(lines, index, parent) {
+  const floor = Math.max(0, index - PARENT_SCOPE_LINES);
+  for (let at = index; at >= floor; at--) {
+    if (parent.test(lines[at] ?? "")) return index - at;
   }
-  return checked > 0;
+  return Number.POSITIVE_INFINITY;
 }
-async function readAnchorFiles(files, read, concurrency = DEFAULT_IO_CONCURRENCY) {
-  if (!Number.isInteger(concurrency) || concurrency < 1) {
-    throw new RangeError(
-      `readAnchorFiles: option "concurrency" must be a positive integer, got ${concurrency}`
-    );
+function hashAnchorText(text) {
+  return `sha256:${createHash("sha256").update(text.replace(/\r\n/g, "\n")).digest("hex")}`;
+}
+function resolveAnchor(source, anchor, resolver = regexResolver) {
+  const normalized = source.replace(/\r\n/g, "\n");
+  if (!anchor.symbol) {
+    const lines = normalized.split("\n");
+    if (lines.length > 1 && lines[lines.length - 1] === "") lines.pop();
+    return {
+      text: normalized,
+      startLine: 1,
+      endLine: Math.max(1, lines.length)
+    };
   }
-  const wanted = [...new Set(files)];
-  const results = await mapLimit(wanted, concurrency, async (file) => {
-    try {
-      return await read(file);
-    } catch {
-      return { ok: false, reason: "file-unreadable" };
-    }
-  });
-  return new Map(wanted.map((file, at) => [file, results[at]]));
+  return resolver.resolve(normalized, anchor.symbol);
 }
+
+// src/anchor-resolver/drift.ts
 async function detectAnchorDrift(records, options = {}) {
   const repoRoot = options.repoRoot ?? process.cwd();
   const resolver = options.resolver ?? regexResolver;
@@ -805,67 +1167,97 @@ async function detectAnchorDrift(records, options = {}) {
     }
   }
   const files = [];
+  const wants = [];
   for (const entries of planned.values()) {
-    for (const entry of entries) {
-      if (!entry.foreign) files.push(entry.anchor.file);
+    for (const { anchor, foreign } of entries) {
+      if (!foreign) files.push(anchor.file);
+      else wants.push(...remoteWants(anchor));
     }
   }
-  const reads = await readAnchorFiles(
-    files,
-    options.reader ?? anchorFileReader(repoRoot),
-    options.concurrency ?? DEFAULT_IO_CONCURRENCY
-  );
+  const [reads, remote] = await Promise.all([
+    readAnchorFiles(
+      files,
+      options.reader ?? anchorFileReader(repoRoot),
+      options.concurrency ?? DEFAULT_IO_CONCURRENCY
+    ),
+    (options.readRemote ?? readRemoteAnchors)(wants, options.remote ?? {})
+  ]);
   const drift = /* @__PURE__ */ new Map();
   for (const record of records) {
     const entries = [];
     for (const { anchor, foreign } of planned.get(record.conceptId) ?? []) {
-      const base = {
-        file: anchor.file,
-        ...anchor.symbol ? { symbol: anchor.symbol } : {},
-        storedHash: anchor.hash
-      };
-      if (foreign) {
-        entries.push({
-          ...base,
-          state: "unresolved",
-          diffSize: null,
-          reason: "foreign-repo"
-        });
-        continue;
-      }
-      const read = reads.get(anchor.file);
-      if (!read.ok) {
-        entries.push({
-          ...base,
-          state: "unresolved",
-          diffSize: null,
-          reason: read.reason
-        });
-        continue;
-      }
-      const resolved = resolveAnchor(read.source, anchor, resolver);
-      if (!resolved) {
-        entries.push({
-          ...base,
-          state: "unresolved",
-          diffSize: null,
-          reason: "symbol-not-found"
-        });
-        continue;
-      }
-      const currentHash = hashAnchorText(resolved.text);
-      const currentLines = resolved.endLine - resolved.startLine + 1;
-      entries.push({
-        ...base,
-        state: currentHash === anchor.hash ? "match" : "drifted",
-        currentHash,
-        diffSize: anchor.lines === void 0 ? null : Math.abs(currentLines - anchor.lines)
-      });
+      entries.push(
+        foreign ? remoteEntry(anchor, remote, resolver) : localEntry(anchor, reads.get(anchor.file), resolver)
+      );
     }
     if (entries.length) drift.set(record.conceptId, entries);
   }
   return drift;
 }
+function remoteWants(anchor) {
+  const repo = anchor.repo;
+  const wants = [{ repo, file: anchor.file }];
+  if (anchor.ref) wants.unshift({ repo, ref: anchor.ref, file: anchor.file });
+  return wants;
+}
+function base(anchor) {
+  return {
+    file: anchor.file,
+    ...anchor.symbol ? { symbol: anchor.symbol } : {},
+    storedHash: anchor.hash
+  };
+}
+function unresolved(anchor, reason, repo) {
+  return {
+    ...base(anchor),
+    state: "unresolved",
+    diffSize: null,
+    ...reason ? { reason } : {},
+    ...repo ? { repo } : {}
+  };
+}
+function hashIn(source, anchor, resolver) {
+  const resolved = resolveAnchor(source, anchor, resolver);
+  if (!resolved) return null;
+  return {
+    hash: hashAnchorText(resolved.text),
+    lines: resolved.endLine - resolved.startLine + 1
+  };
+}
+function compared(anchor, current, extra = {}) {
+  return {
+    ...base(anchor),
+    state: current.hash === anchor.hash ? "match" : "drifted",
+    currentHash: current.hash,
+    diffSize: anchor.lines === void 0 ? null : Math.abs(current.lines - anchor.lines),
+    ...extra
+  };
+}
+function localEntry(anchor, read, resolver) {
+  if (!read.ok) return unresolved(anchor, read.reason);
+  const current = hashIn(read.source, anchor, resolver);
+  return current ? compared(anchor, current) : unresolved(anchor, "symbol-not-found");
+}
+function remoteEntry(anchor, remote, resolver) {
+  const repo = anchor.repo;
+  const key = normalizeRepoUrl(repo);
+  const atDefault = remote.get(wantKey(key, void 0, anchor.file));
+  const primary = anchor.ref ? remote.get(wantKey(key, anchor.ref, anchor.file)) : atDefault;
+  if (!primary) return unresolved(anchor, "remote-unreachable", repo);
+  if (!primary.ok) return unresolved(anchor, primary.reason, repo);
+  const current = hashIn(primary.source, anchor, resolver);
+  if (!current) return unresolved(anchor, "symbol-not-found", repo);
+  if (!anchor.ref) return compared(anchor, current, { repo });
+  if (current.hash !== anchor.hash) {
+    return compared(anchor, current, { repo, remoteState: "drifted-from-ref" });
+  }
+  const head = atDefault?.ok ? hashIn(atDefault.source, anchor, resolver) : null;
+  return head && head.hash !== anchor.hash ? {
+    ...compared(anchor, head, { repo }),
+    state: "drifted",
+    remoteState: "drifted-on-default"
+  } : compared(anchor, current, { repo, remoteState: "matches-ref" });
+}
 
 // src/errors.ts
 var Fault = /* @__PURE__ */ ((Fault2) => {
@@ -881,6 +1273,8 @@ var ErrorTypes = /* @__PURE__ */ ((ErrorTypes2) => {
   ErrorTypes2["KbPackBudgetExceeded"] = "KbPackBudgetExceeded";
   ErrorTypes2["KbRecordNotFound"] = "KbRecordNotFound";
   ErrorTypes2["KbSelfVerification"] = "KbSelfVerification";
+  ErrorTypes2["KbStampBaselineUnreadable"] = "KbStampBaselineUnreadable";
+  ErrorTypes2["KbStampDigestBaselineAmbiguous"] = "KbStampDigestBaselineAmbiguous";
   ErrorTypes2["KbUnknownLinkRel"] = "KbUnknownLinkRel";
   ErrorTypes2["KbWriteConflict"] = "KbWriteConflict";
   return ErrorTypes2;
@@ -1035,6 +1429,36 @@ var KbInvalidConceptIdError = class extends BaseError {
     });
   }
 };
+var KbStampBaselineError = class extends BaseError {
+  constructor(since) {
+    super({
+      message: `kb: --since ${since} is neither a 64-character digest nor a readable stamp file`,
+      errorType: "KbStampBaselineUnreadable" /* KbStampBaselineUnreadable */,
+      code: 400,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details: { since }
+    });
+    this.since = since;
+  }
+  since;
+};
+var KbStampDigestBaselineError = class extends BaseError {
+  constructor(since) {
+    super({
+      message: `kb: --since ${since} is a digest, which needs --bundle (one base) \u2014 a file baseline works for many`,
+      errorType: "KbStampDigestBaselineAmbiguous" /* KbStampDigestBaselineAmbiguous */,
+      code: 400,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details: { since }
+    });
+    this.since = since;
+  }
+  since;
+};
 
 // src/kb-pins/budgets.ts
 function asBudgets(value) {
@@ -1085,10 +1509,10 @@ var KbBaseFrozenError = class extends Error {
 };
 
 // src/kb-pins/model.ts
-import { join } from "path";
+import { join as join2 } from "path";
 import { z as z4 } from "zod";
-var PINS_FILE = join(".strauss", "kb-pins.json");
-var PINS_LOCAL_FILE = join(".strauss", "kb-pins.local.json");
+var PINS_FILE = join2(".strauss", "kb-pins.json");
+var PINS_LOCAL_FILE = join2(".strauss", "kb-pins.local.json");
 var PIN_LAYERS = ["project", "local", "user"];
 var pinSchema = z4.object({
   /** Relative to the manifest's root, so the file is committable. */
@@ -1134,17 +1558,17 @@ var pinsManifestSchema = z4.object({
 }).passthrough();
 
 // src/kb-pins/layers.ts
-import { mkdir, readFile as readFile2, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { dirname, isAbsolute as isAbsolute2, join as join2, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
+import { mkdir as mkdir2, readFile as readFile2, writeFile } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { dirname, isAbsolute as isAbsolute2, join as join3, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
 function userRoot() {
-  return process.env.STRAUSS_KB_USER_ROOT || homedir();
+  return process.env.STRAUSS_KB_USER_ROOT || homedir2();
 }
 function layerRoot(workspaceDir, layer) {
   return layer === "user" ? userRoot() : resolve2(workspaceDir);
 }
 function layerFile(workspaceDir, layer) {
-  return join2(
+  return join3(
     layerRoot(workspaceDir, layer),
     layer === "local" ? PINS_LOCAL_FILE : PINS_FILE
   );
@@ -1177,7 +1601,7 @@ async function readPinsLayer(workspaceDir, layer) {
 }
 async function writePinsLayer(workspaceDir, layer, manifest) {
   const file = layerFile(workspaceDir, layer);
-  await mkdir(dirname(file), { recursive: true });
+  await mkdir2(dirname(file), { recursive: true });
   await writeFile(file, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
 }
@@ -1367,23 +1791,34 @@ function adjudicate(hits, bundle, now = /* @__PURE__ */ new Date(), anchorDrift)
     if (!record.frontmatter.verified?.length) {
       warnings.push({ kind: "unverified" });
     }
-    const moved = (anchorDrift?.get(record.conceptId) ?? []).filter(
-      (entry) => entry.state !== "match" && entry.reason !== "foreign-repo"
+    const found = (anchorDrift?.get(record.conceptId) ?? []).filter(
+      (entry) => entry.state !== "match"
     );
+    const unchecked2 = found.filter((entry) => isUncheckedReason(entry.reason));
+    const moved = found.filter((entry) => !isUncheckedReason(entry.reason));
     if (moved.length) {
+      warnings.push({ kind: "drifted", anchors: moved.map(warningAnchor) });
+    }
+    if (unchecked2.length) {
       warnings.push({
-        kind: "drifted",
-        anchors: moved.map(({ file, symbol, diffSize, reason }) => ({
-          file,
-          ...symbol !== void 0 ? { symbol } : {},
-          diffSize,
-          ...reason !== void 0 ? { reason } : {}
-        }))
+        kind: "unchecked",
+        anchors: unchecked2.map(warningAnchor)
       });
     }
     return { record, standing: STANDING[status], heads, warnings };
   });
 }
+function warningAnchor(entry) {
+  const { file, symbol, diffSize, reason, repo, remoteState } = entry;
+  return {
+    file,
+    ...symbol !== void 0 ? { symbol } : {},
+    diffSize,
+    ...reason !== void 0 ? { reason } : {},
+    ...repo !== void 0 ? { repo } : {},
+    ...remoteState !== void 0 ? { remoteState } : {}
+  };
+}
 function resolveHeads(from, byId) {
   const warnings = [];
   const heads = /* @__PURE__ */ new Map();
@@ -1660,7 +2095,7 @@ async function buildContext(store, workspaceDir, options = {}) {
       operation: "kb.context.refused",
       approxTokens: total,
       budgetTokens,
-      bases: bases.map((base) => base.path)
+      bases: bases.map((base2) => base2.path)
     });
     const refusal = [
       HEADING2,
@@ -1670,7 +2105,7 @@ async function buildContext(store, workspaceDir, options = {}) {
       "from a complete one. The pinned bases:",
       "",
       ...bases.map(
-        (base) => `- ${base.path} \u2014 ~${base.approxTokens} tokens (bundlePath: \`${base.absolutePath}\`)`
+        (base2) => `- ${base2.path} \u2014 ~${base2.approxTokens} tokens (bundlePath: \`${base2.absolutePath}\`)`
       ),
       "",
       "For the question at hand, read what you need now \u2014 `kb_load` a base",
@@ -1886,6 +2321,16 @@ function validateBundle(records) {
         );
       }
     }
+    for (const anchor of fm.strauss_anchors ?? []) {
+      if (anchor.repo && !isCanonicalRepoUrl(anchor.repo)) {
+        report(
+          "anchor_repo",
+          conceptId2,
+          `anchor repo "${anchor.repo}" is not a full remote URL, so it cannot be resolved against a remote`,
+          "warning"
+        );
+      }
+    }
     if (fm.strauss_assumption && fm.sources?.length) {
       report("assumption", conceptId2, "marked an assumption but cites sources");
     }
@@ -1905,7 +2350,8 @@ var KB_DOCTOR_CHECKS = [
   "orphaned",
   "broken-supersession",
   "superseded-but-cited",
-  "drifted"
+  "drifted",
+  "unchecked"
 ];
 var CHECK_HEADLINES = {
   expired: "past its stale_after date",
@@ -1915,7 +2361,8 @@ var CHECK_HEADLINES = {
   orphaned: "no other record links to it",
   "broken-supersession": "the supersession pointers do not resolve",
   "superseded-but-cited": "a live record's body links to one that no longer holds",
-  drifted: "the code an anchor points at moved out from under its hash"
+  drifted: "the code an anchor points at moved out from under its hash",
+  unchecked: "an anchor in another repository nothing could reach"
 };
 var DAY_MS = 864e5;
 function doctor(bundle, options = {}) {
@@ -1940,7 +2387,8 @@ function doctor(bundle, options = {}) {
     group("orphaned", orphaned(bundle)),
     group("broken-supersession", brokenSupersession(bundle, adjudicated)),
     group("superseded-but-cited", supersededButCited(bundle, standings)),
-    group("drifted", drifted(inForce))
+    group("drifted", drifted(inForce)),
+    group("unchecked", unchecked(inForce))
   ];
   const counts = Object.fromEntries(
     groups.map((entry) => [entry.check, entry.count])
@@ -2127,21 +2575,38 @@ function supersededButCited(bundle, standings) {
   return findings;
 }
 function drifted(hits) {
+  return anchorFindings(
+    hits,
+    "drifted",
+    (count2) => count2 === 1 ? "anchor no longer matches" : "anchors no longer match"
+  );
+}
+function unchecked(hits) {
+  return anchorFindings(
+    hits,
+    "unchecked",
+    (count2) => count2 === 1 ? "anchor was not checked" : "anchors were not checked"
+  );
+}
+function anchorFindings(hits, kind, headline) {
   const findings = [];
   for (const hit of hits) {
-    const warning = hit.warnings.find((entry) => entry.kind === "drifted");
+    const warning = hit.warnings.find(
+      (entry) => entry.kind === kind
+    );
     if (!warning) continue;
+    const byRepo = /* @__PURE__ */ new Map();
+    for (const anchor of warning.anchors) {
+      const repo = anchor.repo ?? "";
+      byRepo.set(repo, [...byRepo.get(repo) ?? [], describeAnchor(anchor)]);
+    }
+    const detail = [...byRepo.entries()].map(
+      ([repo, entries]) => repo ? `${repo}: ${entries.join(", ")}` : entries.join(", ")
+    );
     findings.push(
       finding(
         hit.record,
-        `${warning.anchors.length} ${warning.anchors.length === 1 ? "anchor no longer matches" : "anchors no longer match"}: ${warning.anchors.map((anchor) => {
-          const at = anchor.symbol ? `${anchor.file}:${anchor.symbol}` : anchor.file;
-          if (anchor.reason) return `${at} (${anchor.reason})`;
-          if (anchor.diffSize === null) {
-            return `${at} (changed, size unrecorded)`;
-          }
-          return anchor.diffSize === 0 ? `${at} (content changed, same line count)` : `${at} (${anchor.diffSize} line${anchor.diffSize === 1 ? "" : "s"} apart)`;
-        }).join(", ")}`
+        `${warning.anchors.length} ${headline(warning.anchors.length)}: ${detail.join("; ")}`
       )
     );
   }
@@ -2149,6 +2614,15 @@ function drifted(hits) {
     (left, right) => left.conceptId.localeCompare(right.conceptId)
   );
 }
+function describeAnchor(anchor) {
+  const at = anchor.symbol ? `${anchor.file}:${anchor.symbol}` : anchor.file;
+  if (anchor.reason) return `${at} (${anchor.reason})`;
+  if (anchor.remoteState === "drifted-on-default") {
+    return `${at} (matches ref, moved on the default branch)`;
+  }
+  if (anchor.diffSize === null) return `${at} (changed, size unrecorded)`;
+  return anchor.diffSize === 0 ? `${at} (content changed, same line count)` : `${at} (${anchor.diffSize} line${anchor.diffSize === 1 ? "" : "s"} apart)`;
+}
 function replaces(later, earlier) {
   return (later.frontmatter.strauss_supersedes ?? []).includes(earlier.conceptId) || earlier.frontmatter.strauss_superseded_by === later.conceptId;
 }
@@ -2316,12 +2790,15 @@ function argvFlag(argv, name) {
 var anchorResolveCommand = define({
   name: "anchor-resolve",
   tool: "kb_anchor_resolve",
-  usage: "anchor-resolve <concept-id> [--repo-root <path>] [--rebaseline] [--restamp]",
-  description: "Resolve a record's anchors against the working tree: stamp a hash onto anchors that lack one, report drift where the code moved. kb_verify's mechanical counterpart \u2014 reach for it when the question is whether the code still is what it was, not whether the claim still holds. Anchors naming another repository are skipped. Exits non-zero on drift.",
+  usage: "anchor-resolve <concept-id> [--repo-root <path>] [--offline] [--rebaseline] [--restamp]",
+  description: "Resolve a record's anchors: stamp a hash onto anchors that lack one, report drift where the code moved. An anchor naming another repository is read from that remote through a bare cache; --offline uses the cache only. kb_verify's mechanical counterpart \u2014 reach for it when the question is whether the code still is what it was. Exits non-zero on drift.",
   input: z8.object({
     bundlePath,
     conceptId,
     repoRoot: z8.string().min(1).optional(),
+    offline: z8.boolean().optional().describe(
+      "Resolve foreign anchors from the local repo cache only, never fetching."
+    ),
     rebaseline: z8.boolean().optional().describe(
       "Accept the current code as the new baseline for anchors that drifted."
     ),
@@ -2333,10 +2810,11 @@ var anchorResolveCommand = define({
     bundlePath: path,
     conceptId: argv[1],
     repoRoot: argvFlag(argv, "--repo-root"),
+    offline: argv.includes("--offline"),
     rebaseline: argv.includes("--rebaseline"),
     restamp: argv.includes("--restamp")
   }),
-  run: async ({ store, actor, now }, { bundlePath: path, conceptId: id, repoRoot, rebaseline, restamp }) => {
+  run: async ({ store, actor, now }, { bundlePath: path, conceptId: id, repoRoot, offline, rebaseline, restamp }) => {
     const root = repoRoot ?? process.cwd();
     const record = await store.read(path, id);
     if (!record) throw new KbRecordNotFoundError(id);
@@ -2351,18 +2829,10 @@ var anchorResolveCommand = define({
     }
     const results = [];
     const updated = [];
-    const origin = new LazyOrigin(root);
     let dirty = false;
-    if (anchors.some((anchor) => anchor.repo)) await origin.prime();
-    const foreign = new Map(
-      anchors.map((anchor) => [anchor, origin.isForeign(anchor)])
-    );
-    const reads = await readAnchorFiles(
-      anchors.filter((anchor) => !foreign.get(anchor)).map((anchor) => anchor.file),
-      anchorFileReader(root)
-    );
+    const sources = await readSources(anchors, root, offline === true);
     for (const anchor of anchors) {
-      const base = {
+      const base2 = {
         file: anchor.file,
         ...anchor.symbol ? { symbol: anchor.symbol } : {},
         // Carried onto unresolved findings too: an anchor that once hashed
@@ -2370,21 +2840,17 @@ var anchorResolveCommand = define({
         // has to be able to tell it from one nobody ever stamped.
         ...anchor.hash ? { storedHash: anchor.hash } : {}
       };
-      if (foreign.get(anchor)) {
-        results.push({ ...base, state: "unresolved", reason: "foreign-repo" });
-        updated.push(anchor);
-        continue;
-      }
-      const fileRead = reads.get(anchor.file);
-      if (!fileRead.ok) {
-        results.push({ ...base, state: "unresolved", reason: fileRead.reason });
+      const source = sources.get(anchor);
+      if (source.repo) base2.repo = source.repo;
+      if (!source.ok) {
+        results.push({ ...base2, state: "unresolved", reason: source.reason });
         updated.push(anchor);
         continue;
       }
-      const resolved = resolveAnchor(fileRead.source, anchor);
+      const resolved = resolveAnchor(source.source, anchor);
       if (!resolved) {
         results.push({
-          ...base,
+          ...base2,
           state: "unresolved",
           reason: "symbol-not-found"
         });
@@ -2399,30 +2865,47 @@ var anchorResolveCommand = define({
         lines: currentLines,
         resolved_at: now()
       };
+      const pinned = anchor.ref !== void 0 && source.repo !== void 0;
       if (!anchor.hash) {
-        results.push({ ...base, state: "stamped", currentHash });
+        results.push({ ...base2, state: "stamped", currentHash });
         updated.push(stamped);
         dirty = true;
-      } else if (anchor.hash === currentHash) {
-        results.push({
-          ...base,
-          state: "match",
-          currentHash
-        });
-        const refresh = restamp || anchor.resolved_at === void 0;
-        updated.push(refresh ? { ...anchor, resolved_at: now() } : anchor);
-        if (refresh) dirty = true;
-      } else {
+        continue;
+      }
+      if (anchor.hash !== currentHash) {
         results.push({
-          ...base,
+          ...base2,
           state: "drifted",
           currentHash,
-          diffSize: anchor.lines === void 0 ? null : Math.abs(currentLines - anchor.lines),
+          diffSize: lineDelta(anchor, currentLines),
+          ...pinned ? { remoteState: "drifted-from-ref" } : {},
           ...rebaseline ? { rebaselined: true } : {}
         });
         updated.push(rebaseline ? stamped : anchor);
         if (rebaseline) dirty = true;
+        continue;
+      }
+      const onDefault = pinned ? headHash(source, anchor) : void 0;
+      if (onDefault && onDefault.hash !== anchor.hash) {
+        results.push({
+          ...base2,
+          state: "drifted",
+          currentHash: onDefault.hash,
+          diffSize: lineDelta(anchor, onDefault.lines),
+          remoteState: "drifted-on-default"
+        });
+        updated.push(anchor);
+        continue;
       }
+      results.push({
+        ...base2,
+        state: "match",
+        currentHash,
+        ...pinned ? { remoteState: "matches-ref" } : {}
+      });
+      const refresh = restamp || anchor.resolved_at === void 0;
+      updated.push(refresh ? { ...anchor, resolved_at: now() } : anchor);
+      if (refresh) dirty = true;
     }
     let frozen = false;
     if (dirty) {
@@ -2435,16 +2918,19 @@ var anchorResolveCommand = define({
       if (!frozen) await store.updateAnchors(path, id, updated, actor);
     }
     const frozenNote = frozen ? { frozen: true, note: "base is frozen: nothing was stamped" } : {};
-    const checked = results.filter((entry) => entry.reason !== "foreign-repo");
-    const skipped = results.length - checked.length;
-    const matches2 = checked.filter((entry) => entry.state === "match").length;
-    const clean = checked.length > 0 && checked.every((entry) => entry.state === "match");
+    const unreachable = results.filter(
+      (entry) => isUncheckedReason(entry.reason)
+    ).length;
+    const checked = results.length - unreachable;
+    const matches2 = results.filter((entry) => entry.state === "match").length;
+    const note = `${matches2}/${checked} anchors match${unreachable ? `, ${unreachable} unreachable` : ""}`;
+    const clean = checked > 0 && matches2 === checked && unreachable === 0;
     if (clean) {
       try {
         await store.verify(
           path,
           id,
-          `anchor-resolve: ${matches2}/${checked.length} anchors match${skipped ? `, ${skipped} in another repo` : ""} (regex resolver)`,
+          `anchor-resolve: ${note} (regex resolver)`,
           actor,
           now()
         );
@@ -2460,18 +2946,81 @@ var anchorResolveCommand = define({
       }
       return { conceptId: id, results, verified: true, ...frozenNote };
     }
-    return { conceptId: id, results, verified: false, ...frozenNote };
+    return {
+      conceptId: id,
+      results,
+      verified: false,
+      ...unreachable ? { note } : {},
+      ...frozenNote
+    };
   },
   // A stored hash that no longer resolves is a broken anchor, not an absence:
   // the file was deleted or the symbol renamed, and exiting zero on it would
   // let the one edit that destroys an anchor pass the gate that exists to
   // catch it. An anchor nobody ever stamped is still just unstamped, and one
-  // belonging to another repository was never this run's to check — failing CI
-  // on either would gate on work this command did not do.
+  // whose remote nothing could reach was never checked — failing CI on either
+  // would gate on work this command did not do.
   failsWhen: (result) => result.results.some(
-    (entry) => entry.state === "drifted" || entry.state === "unresolved" && entry.storedHash !== void 0 && entry.reason !== "foreign-repo"
+    (entry) => entry.state === "drifted" || entry.state === "unresolved" && entry.storedHash !== void 0 && !isUncheckedReason(entry.reason)
   )
 });
+function lineDelta(anchor, current) {
+  return anchor.lines === void 0 ? null : Math.abs(current - anchor.lines);
+}
+function headHash(source, anchor) {
+  if (source.head === void 0) return void 0;
+  const resolved = resolveAnchor(source.head, anchor);
+  if (!resolved) return void 0;
+  return {
+    hash: hashAnchorText(resolved.text),
+    lines: resolved.endLine - resolved.startLine + 1
+  };
+}
+async function readSources(anchors, root, offline) {
+  const origin = new LazyOrigin(root);
+  if (anchors.some((anchor) => anchor.repo)) await origin.prime();
+  const foreign = new Map(
+    anchors.map((anchor) => [anchor, origin.isForeign(anchor)])
+  );
+  const local = anchors.filter((anchor) => !foreign.get(anchor));
+  const remote = anchors.filter((anchor) => foreign.get(anchor));
+  const reads = await readAnchorFiles(
+    local.map((anchor) => anchor.file),
+    anchorFileReader(root)
+  );
+  const blobs = await readRemoteAnchors(remote.flatMap(remoteWants), {
+    offline
+  });
+  const sources = /* @__PURE__ */ new Map();
+  for (const anchor of local) {
+    const read = reads.get(anchor.file);
+    sources.set(
+      anchor,
+      read.ok ? { ok: true, source: read.source } : { ok: false, reason: read.reason }
+    );
+  }
+  for (const anchor of remote) {
+    const repo = anchor.repo;
+    const key = normalizeRepoUrl(repo);
+    const atDefault = blobs.get(wantKey(key, void 0, anchor.file));
+    const primary = anchor.ref ? blobs.get(wantKey(key, anchor.ref, anchor.file)) : atDefault;
+    if (!primary?.ok) {
+      sources.set(anchor, {
+        ok: false,
+        reason: primary?.ok === false ? primary.reason : "remote-unreachable",
+        repo
+      });
+      continue;
+    }
+    sources.set(anchor, {
+      ok: true,
+      source: primary.source,
+      repo,
+      ...anchor.ref && atDefault?.ok ? { head: atDefault.source } : {}
+    });
+  }
+  return sources;
+}
 
 // src/commands/answer.ts
 import { z as z9 } from "zod";
@@ -2629,8 +3178,8 @@ var days = (what, fallback) => z13.number().int().positive().optional().describe
 var doctorCommand = define({
   name: "doctor",
   tool: "kb_doctor",
-  usage: "doctor [--expiring-days N] [--unverified-days N] [--aging-days N] [--repo-root PATH] [--strict]",
-  description: "Read-only health sweep: expired, expiring, unverified, aging, orphaned, broken-supersession, superseded-but-cited, drifted anchors. Every group is reported even when empty; nothing is written or re-stamped. Use it when picking up a base you have not touched in a while; kb_validate only checks that pointers between records agree.",
+  usage: "doctor [--expiring-days N] [--unverified-days N] [--aging-days N] [--repo-root PATH] [--offline] [--strict]",
+  description: "Read-only health sweep: expired, expiring, unverified, aging, orphaned, broken-supersession, superseded-but-cited, drifted and unchecked anchors. Every group is reported even when empty; nothing is written or re-stamped. Use it when picking up a base you have not touched in a while; kb_validate only checks that pointers between records agree.",
   input: z13.object({
     bundlePath,
     repoRoot: REPO_ROOT,
@@ -2646,6 +3195,9 @@ var doctorCommand = define({
       "How long a record may stay `open` or `proposed` before `aging` reports it, in days.",
       DEFAULT_AGING_DAYS
     ),
+    offline: z13.boolean().optional().describe(
+      "Read foreign anchors from the local repo cache only, never fetching."
+    ),
     strict: z13.boolean().optional().describe(
       "Turn an expired record into a non-zero exit for the CLI. No effect on the report itself."
     )
@@ -2665,13 +3217,23 @@ var doctorCommand = define({
       ...expiring2 !== void 0 ? { expiringDays: Number(expiring2) } : {},
       ...unverified2 !== void 0 ? { unverifiedDays: Number(unverified2) } : {},
       ...agingDays !== void 0 ? { agingDays: Number(agingDays) } : {},
+      ...argv.includes("--offline") ? { offline: true } : {},
       ...argv.includes("--strict") ? { strict: true } : {}
     };
   },
-  run: async ({ store, now }, { bundlePath: path, expiringDays, unverifiedDays, agingDays, repoRoot }) => {
+  run: async ({ store, now }, {
+    bundlePath: path,
+    expiringDays,
+    unverifiedDays,
+    agingDays,
+    repoRoot,
+    offline
+  }) => {
     const checkedAt = now();
     const records = await store.list(path);
-    const anchorDrift = await store.detectDrift(records, repoRoot);
+    const anchorDrift = await store.detectDrift(records, repoRoot, {
+      offline: offline === true
+    });
     const report = doctor(records, {
       ...expiringDays !== void 0 ? { expiringDays } : {},
       ...unverifiedDays !== void 0 ? { unverifiedDays } : {},
@@ -3081,17 +3643,115 @@ var schemaCommand = define({
   run: () => Promise.resolve(kbJsonSchemas())
 });
 
-// src/commands/status.ts
+// src/commands/stamp.ts
+import { readFile as readFile4 } from "fs/promises";
 import { z as z25 } from "zod";
+var DIGEST = /^[0-9a-f]{64}$/;
+var stampCommand = define({
+  name: "stamp",
+  tool: "kb_stamp",
+  usage: "stamp [--bundle PATH] [--since DIGEST|FILE]",
+  description: "Content stamp of a base \u2014 `load`'s digest, record counts, per-record digests \u2014 without any bodies. Takes no bundlePath to stamp every pinned base. With `since`, reports only the bases that moved, naming the changed ids when the baseline is a prior stamp; silent when nothing changed. Reads, never writes.",
+  input: z25.object({
+    bundlePath: z25.string().min(1).optional().describe(
+      "Absolute path to one knowledge base. Omit to stamp every pinned base."
+    ),
+    since: z25.string().min(1).optional().describe(
+      "Prior digest, or path to a prior `stamp --json`; only moved bases return, with changed ids when the baseline is a file."
+    )
+  }),
+  fromArgv: (argv, path, _stdin, bundleExplicit) => {
+    const since = argvFlag(argv, "--since");
+    return {
+      ...bundleExplicit ? { bundlePath: path } : {},
+      ...since !== void 0 ? { since } : {}
+    };
+  },
+  run: async ({ store }, { bundlePath: bundlePath2, since }) => {
+    const targets = bundlePath2 ? [bundlePath2] : (await readMergedPins(process.cwd())).pins.map(
+      (pin) => pin.absolutePath
+    );
+    if (since !== void 0 && DIGEST.test(since) && targets.length > 1) {
+      throw new KbStampDigestBaselineError(since);
+    }
+    const stamps = await Promise.all(
+      targets.map((target) => store.stamp(target))
+    );
+    if (since === void 0) {
+      return stamps.map((stamp) => ({ ...stamp, changed: null }));
+    }
+    const baseline = await readBaseline(since);
+    const reports = [];
+    for (const stamp of stamps) {
+      const before = baseline.byPath.get(stamp.path);
+      if (baseline.digest !== null) {
+        if (baseline.digest === stamp.digest) continue;
+        reports.push({ ...stamp, changed: null });
+        continue;
+      }
+      if (before && before.digest === stamp.digest) continue;
+      reports.push({ ...stamp, changed: changedIds(before?.records, stamp) });
+    }
+    return reports;
+  },
+  render: (result) => result.map((report) => {
+    const counts = `${report.recordCount} record(s), ${report.superseded} superseded`;
+    const head = `${report.path}  ${report.digest}  ${counts}${report.newestAt ? `  newest ${report.newestAt}` : ""}`;
+    return report.changed?.length ? `${head}
+  changed: ${report.changed.join(", ")}` : head;
+  }).join("\n")
+});
+function changedIds(before, stamp) {
+  const now = new Map(
+    stamp.records.map((record) => [record.conceptId, record.digest])
+  );
+  const ids = /* @__PURE__ */ new Set();
+  for (const [conceptId2, digest] of now) {
+    if (before?.get(conceptId2) !== digest) ids.add(conceptId2);
+  }
+  for (const conceptId2 of before?.keys() ?? []) {
+    if (!now.has(conceptId2)) ids.add(conceptId2);
+  }
+  return [...ids].sort();
+}
+async function readBaseline(since) {
+  if (DIGEST.test(since)) return { digest: since, byPath: /* @__PURE__ */ new Map() };
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile4(since, "utf8"));
+  } catch {
+    throw new KbStampBaselineError(since);
+  }
+  const entries = Array.isArray(parsed) ? parsed : parsed?.stamps ?? [];
+  const byPath = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    if (typeof entry?.path !== "string" || typeof entry?.digest !== "string") {
+      continue;
+    }
+    byPath.set(entry.path, {
+      digest: entry.digest,
+      records: new Map(
+        (entry.records ?? []).map((record) => [
+          record.conceptId,
+          record.digest
+        ])
+      )
+    });
+  }
+  return { digest: null, byPath };
+}
+
+// src/commands/status.ts
+import { z as z26 } from "zod";
 var statusCommand = define({
   name: "status",
   tool: "kb_status",
   usage: "status <concept-id> <status>",
   description: "Move a record's status. Compare-and-swap: a concurrent change fails instead of being overwritten.",
-  input: z25.object({
+  input: z26.object({
     bundlePath,
     conceptId,
-    status: z25.enum(KB_RECORD_STATUSES)
+    status: z26.enum(KB_RECORD_STATUSES)
   }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
@@ -3106,13 +3766,13 @@ var statusCommand = define({
 });
 
 // src/commands/supersede.ts
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 var supersedeCommand = define({
   name: "supersede",
   tool: "kb_supersede",
   usage: "supersede <concept-id> <replacement-id>",
   description: "Mark a record superseded by another, linked in both directions. Use instead of editing a record whose meaning changed.",
-  input: z26.object({ bundlePath, conceptId, replacementId: conceptId }),
+  input: z27.object({ bundlePath, conceptId, replacementId: conceptId }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
     conceptId: argv[1],
@@ -3126,16 +3786,16 @@ var supersedeCommand = define({
 });
 
 // src/commands/sync-instructions.ts
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 var syncInstructionsCommand = define({
   name: "sync-instructions",
   usage: "sync-instructions <file> [--profile NAME] [--budget N] [--full-under N]",
   description: "CLI-only: plant the kb_context block between sentinel comments in AGENTS.md or CLAUDE.md, idempotently.",
-  input: z27.object({
-    file: z27.string().min(1).describe("The instruction file to edit in place."),
-    budgetTokens: z27.number().int().positive().optional(),
-    fullUnderTokens: z27.number().int().positive().optional(),
-    profile: z27.string().optional()
+  input: z28.object({
+    file: z28.string().min(1).describe("The instruction file to edit in place."),
+    budgetTokens: z28.number().int().positive().optional(),
+    fullUnderTokens: z28.number().int().positive().optional(),
+    profile: z28.string().optional()
   }),
   fromArgv: (argv) => {
     const budget = argvFlag(argv, "--budget");
@@ -3161,17 +3821,17 @@ var syncInstructionsCommand = define({
 });
 
 // src/commands/trace.ts
-import { z as z28 } from "zod";
+import { z as z29 } from "zod";
 var traceCommand = define({
   name: "trace",
   tool: "kb_trace",
   usage: "trace <concept-id> [edges...]",
   description: 'Timeline of how a position was reached, ordered by write time, following supersession, shared anchors and shared sources. Includes rejected, draft and superseded records \u2014 in a history they are the content. For "why is it like this"; kb_load answers "what holds now".',
-  input: z28.object({
+  input: z29.object({
     bundlePath,
     conceptId,
-    edges: z28.array(z28.enum(TRACE_EDGES)).optional(),
-    depth: z28.number().int().positive().optional()
+    edges: z29.array(z29.enum(TRACE_EDGES)).optional(),
+    depth: z29.number().int().positive().optional()
   }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
@@ -3193,37 +3853,37 @@ var traceCommand = define({
 });
 
 // src/commands/types.ts
-import { z as z29 } from "zod";
+import { z as z30 } from "zod";
 var typesCommand = define({
   name: "types",
   tool: "kb_types",
   usage: "types",
   description: "The twelve record types with their purpose, body sections, and starting status. Read this before writing rather than guessing headings \u2014 a section the type does not define is rejected.",
-  input: z29.object({}),
+  input: z30.object({}),
   fromArgv: () => ({}),
   run: () => Promise.resolve(RECORD_TYPES)
 });
 
 // src/commands/unpin.ts
-import { z as z30 } from "zod";
+import { z as z31 } from "zod";
 var unpinCommand = define({
   name: "unpin",
   tool: "kb_unpin",
   usage: "unpin [bundle-path]",
   description: "Remove a base from every manifest layer that holds it. Reports the layers touched.",
-  input: z30.object({ bundlePath }),
+  input: z31.object({ bundlePath }),
   fromArgv: (argv, path) => ({ bundlePath: argv[1] ?? path }),
   run: (_ctx, { bundlePath: path }) => unpinBase(process.cwd(), path)
 });
 
 // src/commands/validate.ts
-import { z as z31 } from "zod";
+import { z as z32 } from "zod";
 var validateCommand = define({
   name: "validate",
   tool: "kb_validate",
   usage: "validate",
   description: "Check pointers no single record can see: supersession links that disagree between the two records, typed causal links, and assumptions that cite sources. Each finding carries a severity: errors fail the exit code, warnings do not.",
-  input: z31.object({ bundlePath }),
+  input: z32.object({ bundlePath }),
   fromArgv: (_argv, path) => ({ bundlePath: path }),
   run: async ({ store }, { bundlePath: path }) => validateBundle(await store.list(path)),
   // Warnings never fail the exit code; every other severity does.
@@ -3233,16 +3893,16 @@ var validateCommand = define({
 });
 
 // src/commands/verify.ts
-import { z as z32 } from "zod";
+import { z as z33 } from "zod";
 var verifyCommand = define({
   name: "verify",
   tool: "kb_verify",
   usage: "verify <concept-id> --note <text>",
   description: "Append a verified[] event: who checked, when, and what was found. Append-only. A record's own generator is refused unless the actor is `human:`-prefixed.",
-  input: z32.object({
+  input: z33.object({
     bundlePath,
     conceptId,
-    note: z32.string().refine((s) => s.trim().length > 0, {
+    note: z33.string().refine((s) => s.trim().length > 0, {
       message: "note must say what the check found"
     })
   }),
@@ -3262,15 +3922,15 @@ var verifyCommand = define({
 });
 
 // src/commands/write.ts
-import { z as z33 } from "zod";
+import { z as z34 } from "zod";
 var writeCommand = define({
   name: "write",
   tool: "kb_write",
   usage: "write <type> < record.json",
   description: "Write one record. Search first \u2014 a duplicate concept id is rejected, not overwritten; kb_types lists each type's sections. An unsourced claim is an `assumption` with assumption: true, never a vague `fact`. Conflicting records get a `risk`, `open-question`, or superseding `decision`. Prefer a new short record over overloading one. Never delete; supersede.",
-  input: z33.object({
+  input: z34.object({
     bundlePath,
-    type: z33.enum(KB_RECORD_TYPES),
+    type: z34.enum(KB_RECORD_TYPES),
     input: composeInputSchema
   }),
   fromArgv: async (argv, path, stdin) => ({
@@ -3294,13 +3954,13 @@ var writeCommand = define({
 });
 
 // src/commands/write-decision.ts
-import { z as z34 } from "zod";
+import { z as z35 } from "zod";
 var writeDecisionCommand = define({
   name: "write-decision",
   tool: "kb_write_decision",
   usage: "write-decision < decision.json",
   description: "Write a decision, with `alternative` (what was rejected and why) and `impact` as fields. Record one when a later reader would otherwise simplify the constraint away; skip when the diff already answers it. `sources` for material read, `anchors` for code, `relatedConceptIds` for records.",
-  input: z34.object({ bundlePath, input: decisionInputSchema }),
+  input: z35.object({ bundlePath, input: decisionInputSchema }),
   fromArgv: async (_argv, path, stdin) => ({
     bundlePath: path,
     input: JSON.parse(await stdin())
@@ -3340,6 +4000,7 @@ var KB_COMMANDS = [
   listCommand,
   readIndexCommand,
   logCommand,
+  stampCommand,
   validateCommand,
   doctorCommand,
   schemaCommand,
@@ -3381,7 +4042,7 @@ function parseMarkdownWithFrontmatter(text, schema) {
 
 // src/search-index.ts
 import { stat as stat2 } from "fs/promises";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var SEARCH_INDEX_FILE = ".index.sqlite";
 var COLLECTION = "kb";
 async function searchBase(bundlePath2, query, options = {}) {
@@ -3390,7 +4051,7 @@ async function searchBase(bundlePath2, query, options = {}) {
   let store = null;
   try {
     store = await qmd.createStore({
-      dbPath: join3(bundlePath2, SEARCH_INDEX_FILE),
+      dbPath: join4(bundlePath2, SEARCH_INDEX_FILE),
       config: {
         collections: {
           [COLLECTION]: {
@@ -3425,7 +4086,7 @@ async function searchBase(bundlePath2, query, options = {}) {
   }
 }
 async function isStale(bundlePath2) {
-  const indexAt = await stat2(join3(bundlePath2, SEARCH_INDEX_FILE)).then((s) => s.mtimeMs).catch(() => 0);
+  const indexAt = await stat2(join4(bundlePath2, SEARCH_INDEX_FILE)).then((s) => s.mtimeMs).catch(() => 0);
   if (!indexAt) return true;
   const { readdir: readdir2 } = await import("fs/promises");
   const names = (await readdir2(bundlePath2).catch(() => [])).filter(
@@ -3434,7 +4095,7 @@ async function isStale(bundlePath2) {
   let stale = false;
   await mapLimit(names, DEFAULT_IO_CONCURRENCY, async (name) => {
     if (stale) return;
-    const at = await stat2(join3(bundlePath2, name)).then((s) => s.mtimeMs).catch(() => 0);
+    const at = await stat2(join4(bundlePath2, name)).then((s) => s.mtimeMs).catch(() => 0);
     if (at > indexAt) stale = true;
   });
   return stale;
@@ -3469,18 +4130,49 @@ async function loadQmd(logger) {
 }
 
 // src/kb-store.ts
-import { createHash as createHash2 } from "crypto";
 import {
   appendFile,
   link,
-  mkdir as mkdir2,
+  mkdir as mkdir3,
   readdir,
-  readFile as readFile4,
+  readFile as readFile5,
   rename,
   unlink,
   writeFile as writeFile3
 } from "fs/promises";
-import { join as join4, resolve as resolve5, sep as sep3 } from "path";
+import { join as join5, resolve as resolve5, sep as sep3 } from "path";
+
+// src/kb-stamp.ts
+import { createHash as createHash2 } from "crypto";
+function sha256(contents) {
+  return createHash2("sha256").update(contents).digest("hex");
+}
+function bundleStamp(records, superseded) {
+  const entries = [
+    ...records.map((hit) => ({
+      conceptId: hit.record.conceptId,
+      digest: `current:${sha256(
+        stringifyMarkdownWithFrontmatter(
+          hit.record.body,
+          hit.record.frontmatter
+        )
+      )}`
+    })),
+    ...superseded.map((entry) => ({
+      conceptId: entry.conceptId,
+      digest: `superseded:${sha256(JSON.stringify(entry))}`
+    }))
+  ].sort((a, b) => a.conceptId < b.conceptId ? -1 : 1);
+  return {
+    digest: sha256(
+      entries.map((entry) => `${entry.conceptId}:${entry.digest}`).join("\n")
+    ),
+    records: entries
+  };
+}
+function bundleDigest(records, superseded) {
+  return bundleStamp(records, superseded).digest;
+}
 
 // src/kb-links/inbound.ts
 function inboundIndex(bundle) {
@@ -3642,7 +4334,7 @@ function appendUnionMergeLine(contents) {
 }
 
 // src/kb-store.ts
-var KB_DIR = join4(".strauss", "kb");
+var KB_DIR = join5(".strauss", "kb");
 var STORE_OWNED = /* @__PURE__ */ new Set([INDEX_FILE, LOG_FILE, SEARCH_INDEX_FILE]);
 var DEFAULT_LOAD_BUDGET = 25e3;
 var KbStore = class {
@@ -3673,7 +4365,7 @@ var KbStore = class {
     const conceptId2 = `${input.type}.${input.slug}`;
     const root = this.root(bundlePath2);
     const target = this.recordPath(bundlePath2, conceptId2);
-    await mkdir2(root, { recursive: true });
+    await mkdir3(root, { recursive: true });
     await this.publish(
       target,
       stringifyMarkdownWithFrontmatter(input.body, frontmatter),
@@ -3712,7 +4404,7 @@ var KbStore = class {
     const target = this.recordPath(bundlePath2, conceptId2);
     let raw;
     try {
-      raw = await readFile4(target, "utf8");
+      raw = await readFile5(target, "utf8");
     } catch {
       return null;
     }
@@ -3737,7 +4429,7 @@ var KbStore = class {
     const records = await mapLimit(
       wanted,
       DEFAULT_IO_CONCURRENCY,
-      async ({ name, conceptId: conceptId2 }) => this.parse(conceptId2, await readFile4(join4(root, name), "utf8"))
+      async ({ name, conceptId: conceptId2 }) => this.parse(conceptId2, await readFile5(join5(root, name), "utf8"))
     );
     return records.filter((record) => record !== null);
   }
@@ -3905,7 +4597,8 @@ ${answer}
    * at the repo root, and the MCP server's cwd is the workspace.
    *
    * Public because `doctor` needs the same map with the same degradation: a
-   * sweep that failed to read the tree should report no drift, not fail.
+   * sweep that failed to read the tree should report no drift, not fail — and
+   * `offline: false` there, because a sweep is worth a fetch.
    *
    * When no root was given and not one anchored file was found, the finding is
    * discarded. A base read from somewhere other than the tree it describes
@@ -3917,10 +4610,13 @@ ${answer}
    * plausible, and the misses become findings again; an explicit `repoRoot` is
    * taken at its word either way.
    */
-  async detectDrift(records, repoRoot) {
+  async detectDrift(records, repoRoot, options = {}) {
     try {
       const drift = await detectAnchorDrift(records, {
-        repoRoot: repoRoot ?? process.cwd()
+        repoRoot: repoRoot ?? process.cwd(),
+        // Offline by default: a read path must never spend a network fetch per
+        // call. `doctor` and `anchor-resolve` are the verbs that go get it.
+        remote: { offline: options.offline !== false }
       });
       if (repoRoot === void 0 && looksLikeWrongRepoRoot(drift)) {
         this.logger.warn?.({
@@ -4008,6 +4704,28 @@ ${answer}
       digest: bundleDigestValue
     };
   }
+  /**
+   * `load`'s digest without `load`'s bodies — the same records, adjudicated
+   * the same way, handed back as a stamp. Skips the anchor drift pass, which
+   * reads source files and only ever adds warnings: no warning reaches the
+   * digest, so the value is identical to the one `load` returns.
+   */
+  async stamp(bundlePath2) {
+    const bundle = await this.list(bundlePath2);
+    const adjudicated = adjudicate(bundle, bundle, /* @__PURE__ */ new Date());
+    const current = adjudicated.filter((hit) => hit.standing !== "superseded");
+    const superseded = adjudicated.filter((hit) => hit.standing === "superseded").map(stub);
+    const stamped = bundleStamp(current, superseded);
+    const dates = bundle.map((record) => record.frontmatter.generated?.at ?? null).filter((at) => typeof at === "string").sort();
+    return {
+      path: bundlePath2,
+      digest: stamped.digest,
+      recordCount: bundle.length,
+      superseded: superseded.length,
+      newestAt: dates.at(-1) ?? null,
+      records: stamped.records
+    };
+  }
   /** How a position was arrived at, as a timeline. See `trace.ts`. */
   async trace(bundlePath2, seedId, options = {}) {
     return trace(seedId, await this.list(bundlePath2), options);
@@ -4038,11 +4756,11 @@ ${answer}
   async readIndex(bundlePath2) {
     const root = this.root(bundlePath2);
     const expected = renderIndex(await this.list(bundlePath2));
-    const stored = await readFile4(join4(root, INDEX_FILE), "utf8").catch(
+    const stored = await readFile5(join5(root, INDEX_FILE), "utf8").catch(
       () => null
     );
     if (indexIsStale(stored, expected)) {
-      await this.publish(join4(root, INDEX_FILE), expected, true, INDEX_FILE);
+      await this.publish(join5(root, INDEX_FILE), expected, true, INDEX_FILE);
       this.logger.info?.({
         operation: "kb.index.repair",
         bundlePath: root,
@@ -4059,8 +4777,8 @@ ${answer}
    * knows which agent touched what. So a bad line is surfaced and left alone.
    */
   async readLog(bundlePath2) {
-    const raw = await readFile4(
-      join4(this.root(bundlePath2), LOG_FILE),
+    const raw = await readFile5(
+      join5(this.root(bundlePath2), LOG_FILE),
       "utf8"
     ).catch(() => "");
     const result = parseLog(raw);
@@ -4111,15 +4829,15 @@ ${answer}
   }
   async mutate(bundlePath2, conceptId2, change, entry, changeBody = (body) => body) {
     const target = this.recordPath(bundlePath2, conceptId2);
-    const before = await readFile4(target, "utf8").catch(() => null);
+    const before = await readFile5(target, "utf8").catch(() => null);
     if (before === null) throw new KbRecordNotFoundError(conceptId2);
     const parsed = this.parse(conceptId2, before);
     if (!parsed) throw new KbRecordNotFoundError(conceptId2);
     const frontmatter = change(parsed.frontmatter);
     const body = changeBody(parsed.body);
     const contents = stringifyMarkdownWithFrontmatter(body, frontmatter);
-    const witness = await readFile4(target, "utf8").catch(() => null);
-    if (witness === null || digest(witness) !== digest(before)) {
+    const witness = await readFile5(target, "utf8").catch(() => null);
+    if (witness === null || sha256(witness) !== sha256(before)) {
       throw new KbWriteConflictError(conceptId2);
     }
     await this.publish(target, contents, true, conceptId2);
@@ -4201,11 +4919,11 @@ ${answer}
    * file must not fail the mutation it guards.
    */
   async ensureGitattributes(root) {
-    const target = join4(root, GITATTRIBUTES_FILE);
+    const target = join5(root, GITATTRIBUTES_FILE);
     try {
       let existing;
       try {
-        existing = await readFile4(target, "utf8");
+        existing = await readFile5(target, "utf8");
       } catch (error) {
         if (error.code !== "ENOENT") throw error;
         existing = null;
@@ -4252,7 +4970,7 @@ ${answer}
   async record(root, entry) {
     await this.ensureGitattributes(root);
     const line = renderLogEntry({ at: (/* @__PURE__ */ new Date()).toISOString(), ...entry });
-    await appendFile(join4(root, LOG_FILE), line, "utf8").catch((error) => {
+    await appendFile(join5(root, LOG_FILE), line, "utf8").catch((error) => {
       this.logger.warn?.({
         operation: "kb.log.append",
         outcome: "failed",
@@ -4289,7 +5007,7 @@ ${answer}
         { conceptId: conceptId2 }
       );
     }
-    return join4(this.root(bundlePath2), `${conceptId2}.md`);
+    return join5(this.root(bundlePath2), `${conceptId2}.md`);
   }
 };
 function estimateTokens(record) {
@@ -4327,25 +5045,6 @@ function normalizeActor(id) {
   if (colon === -1) return id.toLowerCase();
   return id.slice(0, colon + 1).toLowerCase() + id.slice(colon + 1);
 }
-function digest(contents) {
-  return createHash2("sha256").update(contents).digest("hex");
-}
-function bundleDigest(records, superseded) {
-  const entries = [
-    ...records.map(
-      (hit) => `${hit.record.conceptId}:current:${digest(
-        stringifyMarkdownWithFrontmatter(
-          hit.record.body,
-          hit.record.frontmatter
-        )
-      )}`
-    ),
-    ...superseded.map(
-      (entry) => `${entry.conceptId}:superseded:${digest(JSON.stringify(entry))}`
-    )
-  ].sort();
-  return digest(entries.join("\n"));
-}
 
 // src/pack.ts
 var DEFAULT_PACK_HOPS = 2;
@@ -4432,7 +5131,7 @@ function typeRank(record) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.1.14" : "0.0.0-dev";
+var VERSION = true ? "0.1.16" : "0.0.0-dev";
 
 export {
   kbSourceSchema,
@@ -4464,10 +5163,13 @@ export {
   composeNoDecisionRecord,
   isNoDecisionRecord,
   selectDecisions,
+  isCanonicalRepoUrl,
+  repoCacheDir,
+  readRemoteAnchors,
+  anchorFilePath,
   regexResolver,
   hashAnchorText,
   resolveAnchor,
-  anchorFilePath,
   detectAnchorDrift,
   Fault,
   ErrorTypes,
@@ -4545,4 +5247,4 @@ export {
   KbStore,
   VERSION
 };
-//# sourceMappingURL=chunk-43KALLFU.js.map
+//# sourceMappingURL=chunk-H5W53NVU.js.map