@saasontools/strauss-kb 0.1.17 → 0.1.19

package/dist/index.cjs

@@ -85,6 +85,7 @@ __export(index_exports, {
   backlinks: () => backlinks,
   buildContext: () => buildContext,
   catalog: () => catalog,
+  classifyDrift: () => classifyDrift,
   composeDecisionRecord: () => composeDecisionRecord,
   composeInputSchema: () => composeInputSchema,
   composeLinkSchema: () => composeLinkSchema,
@@ -122,6 +123,7 @@ __export(index_exports, {
   listPins: () => listPins,
   loadQmd: () => loadQmd,
   matchToDiff: () => matchToDiff,
+  matchesTags: () => matchesTags,
   mergedContextBudgets: () => mergedContextBudgets,
   neighbours: () => neighbours,
   pack: () => pack,
@@ -132,6 +134,7 @@ __export(index_exports, {
   readMergedPins: () => readMergedPins,
   readPinsLayer: () => readPinsLayer,
   readRemoteAnchors: () => readRemoteAnchors,
+  reassessPacket: () => reassessPacket,
   regexResolver: () => regexResolver,
   renderCatalogLine: () => renderCatalogLine,
   renderIndex: () => renderIndex,
@@ -153,6 +156,7 @@ __export(index_exports, {
   toHookJson: () => toHookJson,
   trace: () => trace,
   treeSitterLanguages: () => treeSitterLanguages,
+  unifiedDiff: () => unifiedDiff,
   unpinBase: () => unpinBase,
   validateBundle: () => validateBundle
 });
@@ -181,9 +185,9 @@ async function mapLimit(items, limit, fn) {
     { length: Math.min(limit, items.length) },
     async () => {
       while (!failed && next < items.length) {
-        const at = next++;
+        const at2 = next++;
         try {
-          out[at] = await fn(items[at], at);
+          out[at2] = await fn(items[at2], at2);
         } catch (error) {
           failed = true;
           throw error;
@@ -262,6 +266,14 @@ var kbAnchorSchema = import_zod.z.object({
   hash: import_zod.z.string().regex(/^sha256:[0-9a-f]{64}$/, {
     message: "hash must be sha256:<64 hex chars>"
   }).optional(),
+  /**
+   * What `hash` was taken over: the span's raw text, or the normalised token
+   * stream a parser sees (`ast`). Absent means `raw`, which is what every
+   * anchor stamped before this field carries, so old hashes keep comparing
+   * the way they were written. An `ast` hash is blind to whitespace and
+   * comments, so reformatting the anchored code is not drift.
+   */
+  hash_kind: import_zod.z.enum(["raw", "ast"]).optional(),
   /** ISO 8601 timestamp of the last successful resolution. */
   resolved_at: import_zod.z.string().min(1).optional(),
   /** Line count of the text the hash was taken over. */
@@ -676,8 +688,8 @@ function safeSegment(value) {
 function revRef(rev) {
   const safe = rev.replace(/[^A-Za-z0-9_-]/g, "-").slice(0, 64);
   let hash = 5381;
-  for (let at = 0; at < rev.length; at++) {
-    hash = (hash * 33 ^ rev.charCodeAt(at)) >>> 0;
+  for (let at2 = 0; at2 < rev.length; at2++) {
+    hash = (hash * 33 ^ rev.charCodeAt(at2)) >>> 0;
   }
   return `refs/strauss/${safe}-${hash.toString(16)}`;
 }
@@ -786,8 +798,8 @@ function repoUrlIsSafe(repo) {
   if (!scheme?.[1]) return false;
   if (!allowed.includes(scheme[1].toLowerCase())) return false;
   const authority = url.slice(scheme[0].length).split("/")[0] ?? "";
-  const at = authority.lastIndexOf("@");
-  return at < 0 || !authority.slice(0, at).includes(":");
+  const at2 = authority.lastIndexOf("@");
+  return at2 < 0 || !authority.slice(0, at2).includes(":");
 }
 function protocolArgs() {
   const allowed = allowedProtocols();
@@ -878,7 +890,7 @@ async function readOneRepo(repo, url, declared, context) {
   return new Map([
     ...rejected2,
     ...wants.map(
-      (want, at) => [wantKey(repo, want.ref, want.file), reads[at]]
+      (want, at2) => [wantKey(repo, want.ref, want.file), reads[at2]]
     )
   ]);
 }
@@ -1067,7 +1079,8 @@ function warningAnchor(entry) {
     diffSize,
     ...reason !== void 0 ? { reason } : {},
     ...repo !== void 0 ? { repo } : {},
-    ...remoteState !== void 0 ? { remoteState } : {}
+    ...remoteState !== void 0 ? { remoteState } : {},
+    ...entry.class !== void 0 ? { class: entry.class } : {}
   };
 }
 function resolveHeads(from, byId) {
@@ -1238,7 +1251,7 @@ async function readAnchorFiles(files, read, concurrency = DEFAULT_IO_CONCURRENCY
       return { ok: false, reason: "file-unreadable" };
     }
   });
-  return new Map(wanted.map((file, at) => [file, results[at]]));
+  return new Map(wanted.map((file, at2) => [file, results[at2]]));
 }
 
 // src/anchor-resolver/resolver.ts
@@ -1428,8 +1441,8 @@ async function ensureGrammar(language, options = {}) {
       return miss(language, `grammar tree-sitter-${language}`, grammar);
     const parts = [];
     const total = pack2.tags.length;
-    for (const [at, part] of pack2.tags.entries()) {
-      const name = `${language} tags${total > 1 ? ` part ${at + 1}/${total}` : ""}`;
+    for (const [at2, part] of pack2.tags.entries()) {
+      const name = `${language} tags${total > 1 ? ` part ${at2 + 1}/${total}` : ""}`;
       const path = grammarCachePath(root, language, part.sha256, "scm");
       const held = await ensurePart(path, name, part, options);
       if (held !== true) return miss(language, name, held);
@@ -1577,8 +1590,8 @@ function typeNameIn(receiver) {
   while (stack.length) {
     const node = stack.pop();
     if (node.type === "type_identifier") return node.text;
-    for (let at = 0; at < node.childCount; at++) {
-      const child = node.child(at);
+    for (let at2 = 0; at2 < node.childCount; at2++) {
+      const child = node.child(at2);
       if (child) stack.push(child);
     }
   }
@@ -1587,7 +1600,7 @@ function typeNameIn(receiver) {
 function endsWith(chain, wanted) {
   if (wanted.length > chain.length) return false;
   const offset = chain.length - wanted.length;
-  return wanted.every((segment, at) => chain[offset + at] === segment);
+  return wanted.every((segment, at2) => chain[offset + at2] === segment);
 }
 function width(node) {
   return node.endIndex - node.startIndex;
@@ -1613,6 +1626,26 @@ function spanOf(definition, source) {
   };
 }
 
+// src/tree-sitter-resolver/tokens.ts
+function tokens(root) {
+  const out = [];
+  const stack = [root];
+  while (stack.length) {
+    const node = stack.pop();
+    if (node.type.includes("comment")) continue;
+    if (node.childCount === 0) {
+      const text = node.text.trim();
+      if (text) out.push(text);
+      continue;
+    }
+    for (let at2 = node.childCount - 1; at2 >= 0; at2--) {
+      const child = node.child(at2);
+      if (child) stack.push(child);
+    }
+  }
+  return out;
+}
+
 // src/tree-sitter-resolver/resolver.ts
 var TREE_CACHE_LIMIT = 32;
 var TreeSitterResolver = class {
@@ -1658,7 +1691,7 @@ var TreeSitterResolver = class {
       (language) => this.load(language)
     );
     languages.forEach(
-      (language, at) => this.loaded.set(language, loaded[at] ?? null)
+      (language, at2) => this.loaded.set(language, loaded[at2] ?? null)
     );
   }
   /**
@@ -1746,6 +1779,60 @@ var TreeSitterResolver = class {
     this.trees.set(key2, parsed);
     return parsed;
   }
+  /**
+   * Every definition this file declares, as dotted symbol and span.
+   *
+   * The inverse of `attempt`: that asks "where is this name", this asks "what
+   * names are here". `moved` needs the second — the stored hash has to be
+   * looked for at every definition in the repository, and there is no name to
+   * ask about, since the whole question is which name now carries that code.
+   */
+  spans(source, file) {
+    const language = languageForFile(file);
+    if (!language) return [];
+    const loaded = this.loaded.get(language);
+    if (!loaded) return [];
+    const parsed = this.parse(language, loaded, source);
+    if (!parsed) return [];
+    return parsed.definitions.filter((definition) => definition.target).map((definition) => ({
+      symbol: chainOf(definition, parsed.byNodeId).join("."),
+      span: spanOf(definition, source)
+    }));
+  }
+  /**
+   * The token stream of a span: every leaf the parser sees, comments dropped,
+   * joined by single spaces.
+   *
+   * This is what makes a reformat not be drift. Hashing it rather than the raw
+   * text means indentation, line breaks, trailing commas the formatter moved,
+   * and every comment above or inside the definition are outside the hash —
+   * and a renamed identifier or a changed literal is still inside it, because
+   * those are leaves.
+   *
+   * `null` when the file has no grammar, the grammar would not load, or the
+   * text will not parse: no normalisation is better than a guessed one.
+   */
+  normalize(text, file) {
+    const language = file ? languageForFile(file) : void 0;
+    if (!language) return null;
+    const loaded = this.loaded.get(language);
+    if (!loaded) return null;
+    const parser = this.parser;
+    if (!parser) return null;
+    let tree;
+    try {
+      parser.setLanguage(loaded.language);
+      tree = parser.parse(text);
+    } catch {
+      return null;
+    }
+    if (!tree) return null;
+    try {
+      return tokens(tree.rootNode).join(" ");
+    } finally {
+      tree.delete();
+    }
+  }
   /** Drops cached trees. Grammars stay loaded — they are immutable. */
   reset() {
     for (const parsed of this.trees.values()) parsed.tree.delete();
@@ -1899,7 +1986,7 @@ var regexResolver = {
         );
         const nearest = Math.min(...distances);
         if (Number.isFinite(nearest)) {
-          candidates = candidates.filter((_, at) => distances[at] === nearest);
+          candidates = candidates.filter((_, at2) => distances[at2] === nearest);
         }
       }
       if (candidates.length !== 1) return null;
@@ -1914,8 +2001,8 @@ function escapeRegExp(value) {
 }
 function distanceToParent(lines, index2, parent) {
   const floor = Math.max(0, index2 - PARENT_SCOPE_LINES);
-  for (let at = index2; at >= floor; at--) {
-    if (parent.test(lines[at] ?? "")) return index2 - at;
+  for (let at2 = index2; at2 >= floor; at2--) {
+    if (parent.test(lines[at2] ?? "")) return index2 - at2;
   }
   return Number.POSITIVE_INFINITY;
 }
@@ -1947,10 +2034,12 @@ function resolveAnchorSpan(source, anchor, resolvers = [regexResolver]) {
       if (attempt.reason === "symbol-not-found") continue;
       return { ok: false, reason: attempt.reason };
     }
+    const tokens2 = resolver.normalize?.(attempt.span.text, anchor.file);
     return {
       ok: true,
       span: attempt.span,
-      ...isResolverName(resolver.name) ? { resolver: resolver.name } : {}
+      ...isResolverName(resolver.name) ? { resolver: resolver.name } : {},
+      ...tokens2 ? { normalized: tokens2 } : {}
     };
   }
   return { ok: false, reason: "symbol-not-found" };
@@ -1978,6 +2067,11 @@ function resolverChanged(source, anchor, produced) {
   );
   return before !== null && hashAnchorText(before.text) === anchor.hash;
 }
+function anchorHashOf(anchor, outcome) {
+  const stored = anchor.hash ? anchor.hash_kind ?? "raw" : void 0;
+  const wanted = stored ?? (outcome.normalized ? "ast" : "raw");
+  return wanted === "ast" && outcome.normalized ? { hash: hashAnchorText(outcome.normalized), kind: "ast" } : { hash: hashAnchorText(outcome.span.text), kind: "raw" };
+}
 
 // src/anchor-resolver/drift.ts
 async function detectAnchorDrift(records, options = {}) {
@@ -2057,16 +2151,29 @@ function unresolved(anchor, reason, repo) {
     state: "unresolved",
     diffSize: null,
     ...reason ? { reason } : {},
-    ...repo ? { repo } : {}
+    ...repo ? { repo } : {},
+    ...classOf(reason)
   };
 }
+function provisionalDriftClass(entry) {
+  if (entry.state === "unresolved") {
+    return entry.reason === "file-missing" || entry.reason === "symbol-not-found" ? "gone" : void 0;
+  }
+  return entry.state === "drifted" ? "changed" : void 0;
+}
+function classOf(reason) {
+  const settled = provisionalDriftClass({ state: "unresolved", reason });
+  return settled ? { class: settled } : {};
+}
 function hashIn(source, anchor, resolvers) {
   const outcome = resolveAnchorSpan(source, anchor, resolvers);
   if (!outcome.ok) return { ok: false, reason: outcome.reason };
+  const { hash, kind } = anchorHashOf(anchor, outcome);
   return {
     ok: true,
     current: {
-      hash: hashAnchorText(outcome.span.text),
+      hash,
+      kind,
       lines: outcome.span.endLine - outcome.span.startLine + 1,
       ...outcome.resolver ? { resolver: outcome.resolver } : {}
     }
@@ -2079,11 +2186,14 @@ function resolverExtras(source, anchor, current) {
   };
 }
 function compared(anchor, current, extra = {}) {
+  const matched = current.hash === anchor.hash;
   return {
     ...base(anchor),
-    state: current.hash === anchor.hash ? "match" : "drifted",
+    state: matched ? "match" : "drifted",
     currentHash: current.hash,
+    hashKind: current.kind,
     diffSize: anchor.lines === void 0 ? null : Math.abs(current.lines - anchor.lines),
+    ...matched ? {} : { class: "changed" },
     ...extra
   };
 }
@@ -2240,8 +2350,8 @@ async function isStale(bundlePath2) {
   let stale = false;
   await mapLimit(names, DEFAULT_IO_CONCURRENCY, async (name) => {
     if (stale) return;
-    const at = await (0, import_promises5.stat)((0, import_node_path6.join)(bundlePath2, name)).then((s) => s.mtimeMs).catch(() => 0);
-    if (at > indexAt) stale = true;
+    const at2 = await (0, import_promises5.stat)((0, import_node_path6.join)(bundlePath2, name)).then((s) => s.mtimeMs).catch(() => 0);
+    if (at2 > indexAt) stale = true;
   });
   return stale;
 }
@@ -2536,8 +2646,8 @@ function trace(seedId, bundle, options = {}) {
   return [...reached.values()].sort(byGeneratedAt);
 }
 function byGeneratedAt(left, right) {
-  const at = (step) => step.record.frontmatter.generated?.at ?? "";
-  return at(left).localeCompare(at(right)) || left.depth - right.depth;
+  const at2 = (step) => step.record.frontmatter.generated?.at ?? "";
+  return at2(left).localeCompare(at2(right)) || left.depth - right.depth;
 }
 
 // src/pack.ts
@@ -2624,6 +2734,13 @@ function typeRank(record) {
   return index2 === -1 ? TYPE_PRIORITY.length : index2;
 }
 
+// src/kb-tags.ts
+function matchesTags(record, filter) {
+  if (!filter.tags?.length && !filter.excludeTags?.length) return true;
+  const carried = new Set(record.frontmatter.tags ?? []);
+  return (filter.tags ?? []).every((tag) => carried.has(tag)) && !(filter.excludeTags ?? []).some((tag) => carried.has(tag));
+}
+
 // src/catalog.ts
 var EMPTY_STANDINGS = {
   current: 0,
@@ -2634,7 +2751,7 @@ var EMPTY_STANDINGS = {
 };
 function catalog(bundle, options = {}) {
   const wanted = options.type ? bundle.filter((record) => record.frontmatter.type === options.type) : bundle;
-  const entries = adjudicate(wanted, bundle, options.now ?? /* @__PURE__ */ new Date()).map((hit) => ({
+  const entries = adjudicate(wanted, bundle, options.now ?? /* @__PURE__ */ new Date()).filter((hit) => matchesTags(hit.record, options)).map((hit) => ({
     conceptId: hit.record.conceptId,
     type: hit.record.frontmatter.type,
     title: hit.record.frontmatter.title ?? null,
@@ -2907,13 +3024,16 @@ var KbStore = class {
     return this.parse(conceptId2, raw);
   }
   /**
-   * Every record in the bundle, optionally narrowed to one type.
+   * Every record in the bundle, optionally narrowed to one type and to the
+   * records carrying every tag in `filter.tags`. Selection only — `excludeTags`
+   * is not taken here, because `query`, `catalog` and `load` read through this
+   * and must adjudicate over the whole base.
    *
    * A file that fails to parse is skipped and logged rather than thrown: one
    * malformed record — hand-edited, or written by a producer we don't know —
    * must not make the whole bundle unreadable.
    */
-  async list(bundlePath2, type) {
+  async list(bundlePath2, type, filter = {}) {
     const root = this.root(bundlePath2);
     let names;
     try {
@@ -2927,7 +3047,9 @@ var KbStore = class {
       DEFAULT_IO_CONCURRENCY,
       async ({ name, conceptId: conceptId2 }) => this.parse(conceptId2, await (0, import_promises6.readFile)((0, import_node_path7.join)(root, name), "utf8"))
     );
-    return records.filter((record) => record !== null);
+    return records.filter(
+      (record) => record !== null && matchesTags(record, filter)
+    );
   }
   /**
    * Moves a record's status, preserving everything else.
@@ -2973,8 +3095,8 @@ var KbStore = class {
    * and the refusal is logged under its own operation name — `mutate` only
    * logs what it publishes.
    */
-  async verify(bundlePath2, conceptId2, note, actor = "unknown", at = (/* @__PURE__ */ new Date()).toISOString()) {
-    const event = kbVerifiedEventSchema.parse({ by: actor, at, note });
+  async verify(bundlePath2, conceptId2, note, actor = "unknown", at2 = (/* @__PURE__ */ new Date()).toISOString()) {
+    const event = kbVerifiedEventSchema.parse({ by: actor, at: at2, note });
     const existing = await this.read(bundlePath2, conceptId2);
     if (!existing) throw new KbRecordNotFoundError(conceptId2);
     const generatedBy = existing.frontmatter.generated?.by;
@@ -3026,14 +3148,14 @@ var KbStore = class {
     return superseded;
   }
   /** Resolves an open question, stamping who answered and when. */
-  async answer(bundlePath2, conceptId2, answer, actor = "unknown", at = (/* @__PURE__ */ new Date()).toISOString()) {
+  async answer(bundlePath2, conceptId2, answer, actor = "unknown", at2 = (/* @__PURE__ */ new Date()).toISOString()) {
     return this.mutate(
       bundlePath2,
       conceptId2,
       (frontmatter) => ({
         ...frontmatter,
         strauss_status: "resolved",
-        strauss_answered: { by: actor, at }
+        strauss_answered: { by: actor, at: at2 }
       }),
       { operation: "answer", by: actor },
       (body) => `${body.trimEnd()}
@@ -3067,9 +3189,10 @@ ${answer}
       /* @__PURE__ */ new Date(),
       await this.detectDrift(narrowed, options.repoRoot)
     );
-    if (options.includeNonCurrent) return adjudicated;
-    const present = new Set(adjudicated.map((hit) => hit.record.conceptId));
-    return adjudicated.filter(
+    const kept = adjudicated.filter((hit) => matchesTags(hit.record, options));
+    if (options.includeNonCurrent) return kept;
+    const present = new Set(kept.map((hit) => hit.record.conceptId));
+    return kept.filter(
       (hit) => hit.standing !== "superseded" || !hit.heads.some((head) => present.has(head.conceptId))
     );
   }
@@ -3172,14 +3295,17 @@ ${answer}
       /* @__PURE__ */ new Date(),
       await this.detectDrift(wanted, options.repoRoot)
     );
-    const records = adjudicated.filter((hit) => hit.standing !== "superseded");
-    const superseded = adjudicated.filter((hit) => hit.standing === "superseded").map(stub);
+    const kept = adjudicated.filter(
+      (hit) => matchesTags(hit.record, { excludeTags: options.excludeTags })
+    );
+    const records = kept.filter((hit) => hit.standing !== "superseded");
+    const superseded = kept.filter((hit) => hit.standing === "superseded").map(stub);
     const approxTokens2 = records.reduce((total, hit) => total + estimateTokens(hit.record), 0) + superseded.reduce((total, entry) => total + estimateStubTokens(entry), 0);
     const bundleDigestValue = bundleDigest(records, superseded);
     if (!options.all && approxTokens2 > budgetTokens) {
       return {
         loaded: false,
-        recordCount: wanted.length,
+        recordCount: kept.length,
         approxTokens: approxTokens2,
         budgetTokens,
         message: refusalMessage({
@@ -3192,7 +3318,7 @@ ${answer}
     }
     return {
       loaded: true,
-      recordCount: wanted.length,
+      recordCount: kept.length,
       tokensLoaded: approxTokens2,
       budgetTokens: options.all ? null : budgetTokens,
       records,
@@ -3202,24 +3328,34 @@ ${answer}
   }
   /**
    * `load`'s digest without `load`'s bodies — the same records, adjudicated
-   * the same way, handed back as a stamp. Skips the anchor drift pass, which
-   * reads source files and only ever adds warnings: no warning reaches the
-   * digest, so the value is identical to the one `load` returns.
+   * the same way, handed back as a stamp.
+   *
+   * Drift is counted but kept out of the digest, which is what lets the reload
+   * hook ask one question and get two answers: whether the base moved, and
+   * whether the code under it did. A `load` and a `stamp` of the same base
+   * still agree on the digest, because no warning has ever reached it.
    */
-  async stamp(bundlePath2) {
+  async stamp(bundlePath2, options = {}) {
     const bundle = await this.list(bundlePath2);
     const adjudicated = adjudicate(bundle, bundle, /* @__PURE__ */ new Date());
     const current = adjudicated.filter((hit) => hit.standing !== "superseded");
     const superseded = adjudicated.filter((hit) => hit.standing === "superseded").map(stub);
     const stamped = bundleStamp(current, superseded);
-    const dates = bundle.map((record) => record.frontmatter.generated?.at ?? null).filter((at) => typeof at === "string").sort();
+    const dates = bundle.map((record) => record.frontmatter.generated?.at ?? null).filter((at2) => typeof at2 === "string").sort();
+    const drift = await this.detectDrift(bundle, options.repoRoot);
+    const drifted2 = drift === void 0 ? null : [...drift.values()].filter(
+      (entries) => entries.some(
+        (entry) => entry.state !== "match" && !isUncheckedReason(entry.reason)
+      )
+    ).length;
     return {
       path: bundlePath2,
       digest: stamped.digest,
       recordCount: bundle.length,
       superseded: superseded.length,
       newestAt: dates.at(-1) ?? null,
-      records: stamped.records
+      records: stamped.records,
+      drifted: drifted2
     };
   }
   /** How a position was arrived at, as a timeline. See `trace.ts`. */
@@ -3669,14 +3805,17 @@ function asBudgets(value) {
   if (value === null || typeof value !== "object") return {};
   const table2 = value;
   const pick = (key2, min) => {
-    const raw = table2[key2];
-    return typeof raw === "number" && Number.isInteger(raw) && raw >= min ? raw : void 0;
+    const raw2 = table2[key2];
+    return typeof raw2 === "number" && Number.isInteger(raw2) && raw2 >= min ? raw2 : void 0;
   };
   const budgetTokens = pick("budgetTokens", 1);
   const fullUnderTokens = pick("fullUnderTokens", 0);
+  const raw = table2["excludeTags"];
+  const excludeTags = Array.isArray(raw) ? raw.filter((tag) => typeof tag === "string" && tag !== "") : void 0;
   return {
     ...budgetTokens ? { budgetTokens } : {},
-    ...fullUnderTokens !== void 0 ? { fullUnderTokens } : {}
+    ...fullUnderTokens !== void 0 ? { fullUnderTokens } : {},
+    ...excludeTags ? { excludeTags } : {}
   };
 }
 function contextProfileBudgets(manifest, profile) {
@@ -3876,7 +4015,7 @@ async function listPins(store, workspaceDir) {
 }
 
 // src/kb-pins/pin.ts
-async function pinBase(store, workspaceDir, bundlePath2, at, options = {}) {
+async function pinBase(store, workspaceDir, bundlePath2, at2, options = {}) {
   const layer = options.layer ?? "project";
   const root = layerRoot(workspaceDir, layer);
   const manifest = await readPinsLayer(workspaceDir, layer);
@@ -3904,7 +4043,7 @@ async function pinBase(store, workspaceDir, bundlePath2, at, options = {}) {
     return {
       path: existing.path,
       layer,
-      pinnedAt: existing.pinnedAt ?? at,
+      pinnedAt: existing.pinnedAt ?? at2,
       alreadyPinned: true,
       ...updated.mode ? { mode: updated.mode } : {},
       ...updated.profiles ? { profiles: updated.profiles } : {},
@@ -3914,7 +4053,7 @@ async function pinBase(store, workspaceDir, bundlePath2, at, options = {}) {
   }
   const entry = {
     path: storablePath(root, bundlePath2),
-    pinnedAt: at,
+    pinnedAt: at2,
     ...fields
   };
   await writePinsLayer(workspaceDir, layer, {
@@ -3924,7 +4063,7 @@ async function pinBase(store, workspaceDir, bundlePath2, at, options = {}) {
   return {
     path: entry.path,
     layer,
-    pinnedAt: at,
+    pinnedAt: at2,
     alreadyPinned: false,
     ...fields,
     ...warning ? { warning } : {}
@@ -3992,7 +4131,7 @@ function preamble() {
     "tokens."
   ].join("\n");
 }
-async function renderBase(store, path, absolutePath, fullUnderTokens, pinMode, budgetTokens) {
+async function renderBase(store, path, absolutePath, fullUnderTokens, pinMode, budgetTokens, excludeTags) {
   const bundle = await store.list(absolutePath);
   if (bundle.length === 0) {
     return {
@@ -4006,7 +4145,8 @@ async function renderBase(store, path, absolutePath, fullUnderTokens, pinMode, b
   let degradedFrom;
   if (fullCap > 0) {
     const full = await store.load(absolutePath, {
-      budgetTokens: fullCap
+      budgetTokens: fullCap,
+      excludeTags
     });
     if (!full.loaded && pinMode === "full") {
       degradedFrom = { approxTokens: full.approxTokens };
@@ -4036,7 +4176,9 @@ async function renderBase(store, path, absolutePath, fullUnderTokens, pinMode, b
       };
     }
   }
-  const adjudicated = adjudicate(bundle, bundle);
+  const adjudicated = adjudicate(bundle, bundle).filter(
+    (hit) => matchesTags(hit.record, { excludeTags })
+  );
   const lines = adjudicated.filter((hit) => hit.standing !== "superseded").map((hit) => renderIndexLine(hit.record));
   const superseded = adjudicated.filter((hit) => hit.standing === "superseded").map(
     (hit) => `- \`${hit.record.conceptId}\` \u2192 superseded by ${hit.heads.map((head) => `\`${head.conceptId}\``).join(", ") || "(missing replacement)"}`
@@ -4057,6 +4199,7 @@ async function buildContext(store, workspaceDir, options = {}) {
   const fromManifest = mergedContextBudgets(merged, options.profile);
   budgetTokens = options.budgetTokens ?? fromManifest.budgetTokens ?? builtin.budgetTokens ?? DEFAULT_CONTEXT_BUDGET;
   fullUnderTokens = options.fullUnderTokens ?? fromManifest.fullUnderTokens ?? builtin.fullUnderTokens ?? 0;
+  const excludeTags = options.excludeTags ?? fromManifest.excludeTags ?? builtin.excludeTags ?? [];
   const pins = merged.pins.filter(
     (pin) => !pin.profiles?.length || !options.profile || pin.profiles.includes(options.profile)
   );
@@ -4077,7 +4220,8 @@ async function buildContext(store, workspaceDir, options = {}) {
         pin.absolutePath,
         fullUnderTokens,
         pin.mode,
-        budgetTokens
+        budgetTokens,
+        excludeTags
       ),
       frozen: pin.frozen === true
     }))
@@ -4452,18 +4596,18 @@ function expired(hits, now) {
   for (const hit of hits) {
     const raw = hit.record.frontmatter.stale_after;
     if (!raw) continue;
-    const at = Date.parse(raw);
-    if (Number.isNaN(at)) {
+    const at2 = Date.parse(raw);
+    if (Number.isNaN(at2)) {
       findings.push(
         finding(hit.record, `stale_after "${raw}" is not a readable date`)
       );
       continue;
     }
-    if (at < now.getTime()) {
+    if (at2 < now.getTime()) {
       findings.push(
         finding(
           hit.record,
-          `stale since ${raw} (${daysBetween(at, now.getTime())} days ago)`
+          `stale since ${raw} (${daysBetween(at2, now.getTime())} days ago)`
         )
       );
     }
@@ -4476,12 +4620,12 @@ function expiring(hits, now, withinDays) {
   for (const hit of hits) {
     const raw = hit.record.frontmatter.stale_after;
     if (!raw) continue;
-    const at = Date.parse(raw);
-    if (Number.isNaN(at) || at < now.getTime() || at > horizon) continue;
+    const at2 = Date.parse(raw);
+    if (Number.isNaN(at2) || at2 < now.getTime() || at2 > horizon) continue;
     findings.push(
       finding(
         hit.record,
-        `goes stale ${raw} (in ${daysBetween(now.getTime(), at)} days)`
+        `goes stale ${raw} (in ${daysBetween(now.getTime(), at2)} days)`
       )
     );
   }
@@ -4651,13 +4795,16 @@ function anchorFindings(hits, kind, headline) {
   );
 }
 function describeAnchor(anchor) {
-  const at = anchor.symbol ? `${anchor.file}:${anchor.symbol}` : anchor.file;
-  if (anchor.reason) return `${at} (${anchor.reason})`;
+  const at2 = anchor.symbol ? `${anchor.file}:${anchor.symbol}` : anchor.file;
+  if (anchor.class === "gone") {
+    return `${at2} gone${anchor.reason ? ` (${anchor.reason})` : ""}`;
+  }
+  if (anchor.reason) return `${at2} (${anchor.reason})`;
   if (anchor.remoteState === "drifted-on-default") {
-    return `${at} (matches ref, moved on the default branch)`;
+    return `${at2} (matches ref, moved on the default branch)`;
   }
-  if (anchor.diffSize === null) return `${at} (changed, size unrecorded)`;
-  return anchor.diffSize === 0 ? `${at} (content changed, same line count)` : `${at} (${anchor.diffSize} line${anchor.diffSize === 1 ? "" : "s"} apart)`;
+  if (anchor.diffSize === null) return `${at2} (changed, size unrecorded)`;
+  return anchor.diffSize === 0 ? `${at2} (content changed, same line count)` : `${at2} (${anchor.diffSize} line${anchor.diffSize === 1 ? "" : "s"} apart)`;
 }
 function replaces(later, earlier) {
   return (later.frontmatter.strauss_supersedes ?? []).includes(earlier.conceptId) || earlier.frontmatter.strauss_superseded_by === later.conceptId;
@@ -4674,9 +4821,9 @@ function daysBetween(from, to) {
   return Math.max(0, Math.floor((to - from) / DAY_MS));
 }
 function ageInDays(record, now) {
-  const at = record.frontmatter.generated?.at;
-  if (!at) return null;
-  const written = Date.parse(at);
+  const at2 = record.frontmatter.generated?.at;
+  if (!at2) return null;
+  const written = Date.parse(at2);
   if (Number.isNaN(written)) return null;
   return daysBetween(written, now.getTime());
 }
@@ -4735,6 +4882,9 @@ var import_zod9 = require("zod");
 var import_zod8 = require("zod");
 var bundlePath = import_zod8.z.string().min(1).describe("Absolute path to the knowledge base directory.");
 var conceptId = import_zod8.z.string().min(1).describe("e.g. decision.cursor-v2");
+var TAGS = import_zod8.z.array(import_zod8.z.string().min(1)).optional().describe(
+  "Keep only records carrying every one of these frontmatter tags. Matched exactly."
+);
 var REPO_ROOT = import_zod8.z.string().min(1).optional().describe(
   "Where the anchored source lives, for the drift check. Defaults to the working directory."
 );
@@ -4748,14 +4898,49 @@ function argvFlag(argv, name) {
     if (!value2) throw new KbMissingFlagValueError(name);
     return value2;
   }
-  const at = argv.indexOf(name);
-  if (at === -1) return void 0;
-  const value = argv[at + 1];
+  const at2 = argv.indexOf(name);
+  if (at2 === -1) return void 0;
+  const value = argv[at2 + 1];
   if (value === void 0 || value.startsWith("--")) {
     throw new KbMissingFlagValueError(name);
   }
   return value;
 }
+function argvFlags(argv, name) {
+  const values = [];
+  for (const [at2, arg] of argv.entries()) {
+    if (arg.startsWith(`${name}=`)) {
+      const value = arg.slice(name.length + 1);
+      if (!value) throw new KbMissingFlagValueError(name);
+      values.push(value);
+    } else if (arg === name) {
+      const value = argv[at2 + 1];
+      if (value === void 0 || value.startsWith("--")) {
+        throw new KbMissingFlagValueError(name);
+      }
+      values.push(value);
+    }
+  }
+  return values;
+}
+function argvWithout(argv, ...names) {
+  const kept = [];
+  for (let at2 = 0; at2 < argv.length; at2 += 1) {
+    const arg = argv[at2];
+    if (names.some((name) => arg.startsWith(`${name}=`))) continue;
+    if (names.includes(arg)) {
+      at2 += 1;
+      continue;
+    }
+    kept.push(arg);
+  }
+  return kept;
+}
+function argvPositional(argv, ...names) {
+  return argvWithout(argv.slice(1), ...names).find(
+    (arg) => !arg.startsWith("--")
+  );
+}
 
 // src/commands/anchor-resolve.ts
 function resolverSummary(results) {
@@ -4843,11 +5028,14 @@ var anchorResolveCommand = define({
       }
       const resolved = outcome.span;
       const producedBy = outcome.resolver;
-      const currentHash = hashAnchorText(resolved.text);
+      const { hash: currentHash, kind } = anchorHashOf(anchor, outcome);
       const currentLines = resolved.endLine - resolved.startLine + 1;
+      const stampedKind = outcome.normalized ? "ast" : "raw";
+      const stampedHash = outcome.normalized ? anchorHashOf({ ...anchor, hash: void 0 }, outcome).hash : currentHash;
       const stamped = {
         ...anchor,
-        hash: currentHash,
+        hash: stampedHash,
+        hash_kind: stampedKind,
         lines: currentLines,
         resolved_at: now(),
         ...producedBy ? { resolver: producedBy } : {}
@@ -4857,7 +5045,8 @@ var anchorResolveCommand = define({
         results.push({
           ...base2,
           state: "stamped",
-          currentHash,
+          currentHash: stampedHash,
+          hashKind: stampedKind,
           ...producedBy ? { resolver: producedBy } : {}
         });
         updated.push(stamped);
@@ -4869,6 +5058,7 @@ var anchorResolveCommand = define({
           ...base2,
           state: "drifted",
           currentHash,
+          hashKind: kind,
           diffSize: lineDelta(anchor, currentLines),
           ...producedBy ? { resolver: producedBy } : {},
           // A regex-stamped anchor re-read by tree-sitter drifts because the
@@ -4897,6 +5087,7 @@ var anchorResolveCommand = define({
         ...base2,
         state: "match",
         currentHash,
+        hashKind: kind,
         ...producedBy ? { resolver: producedBy } : {},
         ...pinned ? { remoteState: "matches-ref" } : {}
       });
@@ -5066,25 +5257,39 @@ var import_zod12 = require("zod");
 var catalogCommand = define({
   name: "catalog",
   tool: "kb_catalog",
-  usage: "catalog [type]",
+  usage: "catalog [type] [--tag T]...",
   description: "Lists every record as one line \u2014 concept id, type, title, standing, and a stale flag \u2014 at roughly thirty tokens each. Pick this over kb_load once kb_load refuses: kb_catalog never refuses. Superseded records show only their replacement; fetch bodies with kb_load, kb_pack, kb_query, or kb_trace.",
   input: import_zod12.z.object({
     bundlePath,
-    type: import_zod12.z.enum(KB_RECORD_TYPES).optional()
-  }),
-  fromArgv: (argv, path) => ({
-    bundlePath: path,
-    ...argv[1] && !argv[1].startsWith("--") ? { type: argv[1] } : {}
+    type: import_zod12.z.enum(KB_RECORD_TYPES).optional(),
+    tags: TAGS
   }),
-  run: async ({ store }, { bundlePath: path, type }) => render(
-    await store.catalog(path, { ...type ? { type } : {} }),
+  fromArgv: (argv, path) => {
+    const tags = argvFlags(argv, "--tag");
+    const type = argvPositional(argv, "--tag");
+    return {
+      bundlePath: path,
+      ...type ? { type } : {},
+      ...tags.length ? { tags } : {}
+    };
+  },
+  run: async ({ store }, { bundlePath: path, type, tags }) => render(
+    await store.catalog(path, {
+      ...type ? { type } : {},
+      ...tags ? { tags } : {}
+    }),
     path,
-    type
+    type,
+    tags
   )
 });
-function render(result, bundle, type) {
+function render(result, bundle, type, tags) {
+  const narrowed = [
+    ...type ? [type] : [],
+    ...tags?.length ? [`tags: ${tags.join(", ")}`] : []
+  ].join(" \xB7 ");
   const lines = [
-    `# KB Catalog${type ? ` \u2014 ${type}` : ""}`,
+    `# KB Catalog${narrowed ? ` \u2014 ${narrowed}` : ""}`,
     `bundle: ${bundle}`,
     `${count(result.recordCount, "record")}: ${standingCounts(result)}`
   ];
@@ -5096,7 +5301,7 @@ function render(result, bundle, type) {
   lines.push("");
   if (!result.entries.length) {
     lines.push(
-      type ? `(no records of type ${type})` : "(no records \u2014 this base is empty)"
+      narrowed ? `(no records matching ${narrowed})` : "(no records \u2014 this base is empty)"
     );
   } else {
     for (const entry of result.entries) lines.push(renderCatalogLine(entry));
@@ -5129,7 +5334,7 @@ var import_zod13 = require("zod");
 var contextCommand = define({
   name: "context",
   tool: "kb_context",
-  usage: "context [--profile NAME] [--budget N] [--full-under N] [--format json] [--event NAME]",
+  usage: "context [--profile NAME] [--budget N] [--full-under N] [--exclude-tag T]... [--format json] [--event NAME]",
   description: "Index block of pinned bases (ids, titles, standing) for injection at context birth. Takes no bundlePath \u2014 reads the workspace pin manifests. Empty when nothing is pinned; refuses over budget rather than truncating. Budget precedence: flags, then the manifest `context[profile]` over `context.default`, then the built-in profile, then package defaults.",
   input: import_zod13.z.object({
     budgetTokens: import_zod13.z.number().int().positive().optional().describe(
@@ -5141,6 +5346,9 @@ var contextCommand = define({
     profile: import_zod13.z.string().optional().describe(
       "Named budget set: built-ins are session-start (full-under 1500), compact and turn (budget 2500); the manifests' `context` tables override per repo. Unknown names fall through to defaults rather than failing."
     ),
+    excludeTags: import_zod13.z.array(import_zod13.z.string().min(1)).optional().describe(
+      "Frontmatter tags whose records stay out of the block. The base stays pinned and stays readable by tool; resolved like the budgets."
+    ),
     format: import_zod13.z.enum(["markdown", "json"]).optional().describe(
       "CLI envelope for hook protocols that require strict JSON on stdout. MCP callers omit this \u2014 the block itself is identical."
     ),
@@ -5154,19 +5362,22 @@ var contextCommand = define({
     const profile = argvFlag(argv, "--profile");
     const format = argvFlag(argv, "--format");
     const event = argvFlag(argv, "--event");
+    const excludeTags = argvFlags(argv, "--exclude-tag");
     return {
       ...budget ? { budgetTokens: Number(budget) } : {},
       ...fullUnder ? { fullUnderTokens: Number(fullUnder) } : {},
       ...profile ? { profile } : {},
+      ...excludeTags.length ? { excludeTags } : {},
       ...format ? { format } : {},
       ...event ? { event } : {}
     };
   },
-  run: async ({ store }, { budgetTokens, fullUnderTokens, profile, format, event }) => {
+  run: async ({ store }, { budgetTokens, fullUnderTokens, profile, excludeTags, format, event }) => {
     const result = await buildContext(store, process.cwd(), {
       ...budgetTokens ? { budgetTokens } : {},
       ...fullUnderTokens ? { fullUnderTokens } : {},
       ...profile ? { profile } : {},
+      ...excludeTags ? { excludeTags } : {},
       // Degradations — a full pin that could not fit, a refused block — go
       // to stderr as well as into the block itself: stderr is diagnostics on
       // both surfaces (hooks discard it, MCP logs it), so an operator can
@@ -5180,14 +5391,567 @@ var contextCommand = define({
 });
 
 // src/commands/doctor.ts
+var import_zod15 = require("zod");
+
+// src/drift/git.ts
+var import_node_child_process3 = require("child_process");
+var import_node_util3 = require("util");
+var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
+var MAX_GIT_OUTPUT_BYTES = 1048576;
+var GIT_TIMEOUT_MS = 5e3;
+async function git2(cwd, args) {
+  const env = { ...process.env };
+  delete env["GIT_DIR"];
+  delete env["GIT_WORK_TREE"];
+  delete env["GIT_INDEX_FILE"];
+  try {
+    const { stdout } = await execFileAsync3("git", ["-C", cwd, ...args], {
+      timeout: GIT_TIMEOUT_MS,
+      maxBuffer: MAX_GIT_OUTPUT_BYTES,
+      env
+    });
+    return { ok: true, stdout };
+  } catch {
+    return { ok: false };
+  }
+}
+async function listRepoFiles(repoRoot) {
+  const result = await git2(repoRoot, ["ls-files", "-z", "--cached"]);
+  if (!result.ok) return [];
+  return result.stdout.split("\0").filter(Boolean);
+}
+async function readOldSource(repoRoot, anchor) {
+  if (!filePathIsSafe(anchor.file))
+    return { ok: false, reason: "unrecoverable" };
+  if (anchor.ref && refShapeIsSafe(anchor.ref)) {
+    const shown2 = await showFile(repoRoot, anchor.ref, anchor.file);
+    if (shown2 !== null) {
+      return {
+        ok: true,
+        source: shown2,
+        origin: { kind: "ref", ref: anchor.ref }
+      };
+    }
+  }
+  const at2 = anchor.resolved_at;
+  if (!at2 || Number.isNaN(Date.parse(at2))) {
+    return { ok: false, reason: "unrecoverable" };
+  }
+  const found = await git2(repoRoot, [
+    "log",
+    "-1",
+    "--format=%H",
+    `--before=${at2}`,
+    "--end-of-options",
+    "HEAD",
+    "--",
+    anchor.file
+  ]);
+  const sha = found.ok ? found.stdout.trim() : "";
+  if (!sha || !refShapeIsSafe(sha))
+    return { ok: false, reason: "unrecoverable" };
+  const shown = await showFile(repoRoot, sha, anchor.file);
+  if (shown === null) return { ok: false, reason: "unrecoverable" };
+  return { ok: true, source: shown, origin: { kind: "history", ref: sha } };
+}
+async function showFile(repoRoot, ref, file) {
+  const path = file.replace(/^\.\//, "");
+  const result = await git2(repoRoot, [
+    "show",
+    "--end-of-options",
+    `${ref}:${path}`
+  ]);
+  return result.ok ? result.stdout : null;
+}
+
+// src/drift/moved.ts
+var import_promises9 = require("fs/promises");
+var MAX_MOVED_SEARCH_FILES = 2e3;
+var SEARCH_BATCH = 64;
+function movedSearch(repoRoot, options = {}) {
+  const read = options.reader ?? anchorFileReader(repoRoot);
+  const sizeOf = options.sizeOf ?? diskSize(repoRoot);
+  const resolver = new TreeSitterResolver();
+  let repoFiles;
+  const prepared = /* @__PURE__ */ new Set();
+  const filesForLanguage = async (language) => {
+    repoFiles ??= listRepoFiles(repoRoot);
+    return (await repoFiles).filter((file) => languageForFile(file) === language).slice(0, MAX_MOVED_SEARCH_FILES);
+  };
+  return {
+    async find(anchor) {
+      const stored = anchor.hash;
+      if (!stored) return void 0;
+      const language = languageForFile(anchor.file);
+      if (!language) return sameFileWindow(anchor, read, stored);
+      const candidates = await filesForLanguage(language);
+      if (!prepared.has(language)) {
+        await resolver.prepare(candidates.length ? candidates : [anchor.file]);
+        prepared.add(language);
+      }
+      const floor = anchor.lines ?? 0;
+      for (let at2 = 0; at2 < candidates.length; at2 += SEARCH_BATCH) {
+        const batch = candidates.slice(at2, at2 + SEARCH_BATCH);
+        const hits = await mapLimit(
+          batch,
+          DEFAULT_IO_CONCURRENCY,
+          async (file) => {
+            const size2 = await sizeOf(file);
+            if (size2 !== null && size2 < floor) return void 0;
+            return matchIn(resolver, read, anchor, stored, file);
+          }
+        );
+        const found = hits.find((hit) => hit !== void 0);
+        if (found) return found;
+      }
+      return void 0;
+    }
+  };
+}
+async function matchIn(resolver, read, anchor, stored, file) {
+  const source = await read(file);
+  if (!source.ok) return void 0;
+  const normalized = source.source.replace(/\r\n/g, "\n");
+  for (const found of resolver.spans(normalized, file)) {
+    const text = anchor.hash_kind === "ast" ? resolver.normalize(found.span.text, file) : found.span.text;
+    if (text === null || hashAnchorText(text) !== stored) continue;
+    if (file === anchor.file && found.symbol === anchor.symbol) continue;
+    return {
+      file,
+      symbol: found.symbol,
+      startLine: found.span.startLine,
+      endLine: found.span.endLine
+    };
+  }
+  return void 0;
+}
+function diskSize(repoRoot) {
+  return async (file) => {
+    const path = anchorFilePath(repoRoot, file);
+    if (path === null) return null;
+    try {
+      return (await (0, import_promises9.stat)(path)).size;
+    } catch {
+      return null;
+    }
+  };
+}
+async function sameFileWindow(anchor, read, stored) {
+  const height = anchor.lines;
+  if (!height || anchor.hash_kind === "ast") return void 0;
+  const source = await read(anchor.file);
+  if (!source.ok) return void 0;
+  const lines = source.source.replace(/\r\n/g, "\n").split("\n");
+  for (let at2 = 0; at2 + height <= lines.length; at2++) {
+    if (hashAnchorText(lines.slice(at2, at2 + height).join("\n")) !== stored) {
+      continue;
+    }
+    return {
+      file: anchor.file,
+      ...anchor.symbol ? { symbol: anchor.symbol } : {},
+      startLine: at2 + 1,
+      endLine: at2 + height
+    };
+  }
+  return void 0;
+}
+
+// src/drift/classify.ts
+async function classifyDrift(repoRoot, record, entries, options = {}) {
+  const anchors = (record.frontmatter.strauss_anchors ?? []).filter(
+    (anchor) => anchor.hash
+  );
+  const reader = options.reader ?? anchorFileReader(repoRoot);
+  const treeSitter = new TreeSitterResolver();
+  const resolvers = [treeSitter, regexResolver];
+  const search = options.search ?? movedSearch(repoRoot, { ...options.reader ? { reader } : {} });
+  const wanted = [];
+  entries.forEach((entry, at2) => {
+    const anchor = anchors[at2];
+    if (!anchor) return;
+    if (entry.state === "match" || isUncheckedReason(entry.reason)) return;
+    wanted.push({ anchor, entry });
+  });
+  if (!wanted.length) return [];
+  await prepareResolvers(
+    resolvers,
+    wanted.map(({ anchor }) => anchor.file)
+  );
+  const out = [];
+  for (const { anchor, entry } of wanted) {
+    const movedTo = await search.find(anchor);
+    if (movedTo) {
+      out.push({
+        anchor,
+        entry: { ...entry, class: "moved", movedTo },
+        class: "moved"
+      });
+      continue;
+    }
+    const newText = await currentText(reader, anchor, resolvers);
+    const old = options.withHistory === false ? { ok: false, reason: "unrecoverable" } : await readOldSource(repoRoot, anchor);
+    const oldText = old.ok ? spanIn(old.source, anchor, resolvers) : void 0;
+    const settled = newText !== void 0 && oldText !== void 0 && sameTokens(treeSitter, anchor.file, oldText, newText) ? "cosmetic" : entry.class ?? "changed";
+    out.push({
+      anchor,
+      entry: { ...entry, class: settled },
+      class: settled,
+      ...newText !== void 0 ? { newText } : {},
+      ...oldText !== void 0 ? { oldText } : {},
+      ...old.ok ? { oldOrigin: old.origin } : {}
+    });
+  }
+  return out;
+}
+function sameTokens(resolver, file, before, after) {
+  if (before === after) return false;
+  const left = resolver.normalize(before, file);
+  const right = resolver.normalize(after, file);
+  return left !== null && left === right;
+}
+async function currentText(reader, anchor, resolvers) {
+  const read = await reader(anchor.file);
+  if (!read.ok) return void 0;
+  return spanIn(read.source, anchor, resolvers);
+}
+function spanIn(source, anchor, resolvers) {
+  const outcome = resolveAnchorSpan(source, anchor, resolvers);
+  return outcome.ok ? outcome.span.text : void 0;
+}
+
+// src/drift/diff.ts
+var MAX_ANCHOR_DIFF_LINES = 200;
+var PACKET_DIFF_LINE_BUDGET = 200;
+var MIN_ANCHOR_DIFF_LINES = 12;
+function diffBudget(anchors) {
+  if (anchors <= 0) return MAX_ANCHOR_DIFF_LINES;
+  return Math.min(
+    MAX_ANCHOR_DIFF_LINES,
+    Math.max(
+      MIN_ANCHOR_DIFF_LINES,
+      Math.floor(PACKET_DIFF_LINE_BUDGET / anchors)
+    )
+  );
+}
+function unifiedDiff(before, after, options = {}) {
+  const max = options.maxLines ?? MAX_ANCHOR_DIFF_LINES;
+  const left = before.replace(/\r\n/g, "\n").split("\n");
+  const right = after.replace(/\r\n/g, "\n").split("\n");
+  const body = [];
+  let added = 0;
+  let removed = 0;
+  for (const edit of edits(left, right)) {
+    if (edit.kind === "same") body.push(` ${edit.line}`);
+    else if (edit.kind === "remove") {
+      body.push(`-${edit.line}`);
+      removed += 1;
+    } else {
+      body.push(`+${edit.line}`);
+      added += 1;
+    }
+  }
+  const truncated = body.length > max;
+  const shown = truncated ? body.slice(0, max) : body;
+  const header = `@@ -1,${left.length} +1,${right.length} @@${options.oldLabel ? ` ${options.oldLabel} \u2192 ${options.newLabel ?? ""}`.trimEnd() : ""}`;
+  const lines = [header, ...shown];
+  if (truncated) lines.push(`\u2026 ${body.length - max} more diff lines`);
+  return { text: lines.join("\n"), added, removed, truncated };
+}
+function edits(left, right) {
+  const rows = left.length;
+  const cols = right.length;
+  const table2 = Array.from(
+    { length: rows + 1 },
+    () => new Array(cols + 1).fill(0)
+  );
+  for (let row2 = rows - 1; row2 >= 0; row2--) {
+    for (let col2 = cols - 1; col2 >= 0; col2--) {
+      table2[row2][col2] = left[row2] === right[col2] ? table2[row2 + 1][col2 + 1] + 1 : Math.max(
+        table2[row2 + 1][col2],
+        table2[row2][col2 + 1]
+      );
+    }
+  }
+  const out = [];
+  let row = 0;
+  let col = 0;
+  while (row < rows && col < cols) {
+    if (left[row] === right[col]) {
+      out.push({ kind: "same", line: left[row] });
+      row += 1;
+      col += 1;
+    } else if (table2[row + 1][col] >= table2[row][col + 1]) {
+      out.push({ kind: "remove", line: left[row] });
+      row += 1;
+    } else {
+      out.push({ kind: "add", line: right[col] });
+      col += 1;
+    }
+  }
+  for (; row < rows; row++)
+    out.push({ kind: "remove", line: left[row] });
+  for (; col < cols; col++)
+    out.push({ kind: "add", line: right[col] });
+  return out;
+}
+
+// src/drift/packet.ts
+var PRESUMED_INVALID = [
+  "fact",
+  "constraint",
+  "contract"
+];
+var RATIONALE_SURVIVES = ["decision", "risk"];
+var DEFAULT_NOTES = {
+  "presumed-invalidated": "the code this claim was taken from changed; presume it no longer holds until re-read",
+  "rationale-may-survive": "the reasoning may outlive the code that implemented it; check whether it does",
+  review: "re-read the record against the new code"
+};
+async function reassessPacket(repoRoot, record, entries, options = {}) {
+  const classified = await classifyDrift(repoRoot, record, entries, {
+    ...options.reader ? { reader: options.reader } : {},
+    ...options.search ? { search: options.search } : {},
+    withHistory: options.withDiff !== false
+  });
+  const open = classified.filter(
+    (found) => found.class === "changed" || found.class === "gone"
+  );
+  if (!open.length) return { packet: null, classified };
+  const budget = diffBudget(open.length);
+  const anchors = open.map(
+    (found) => anchorPacket(found, options.withDiff === true, budget)
+  );
+  const type = record.frontmatter.type;
+  const fallback = isKbRecordType(type) ? PRESUMED_INVALID.includes(type) ? "presumed-invalidated" : RATIONALE_SURVIVES.includes(type) ? "rationale-may-survive" : "review" : "review";
+  return {
+    classified,
+    packet: {
+      conceptId: record.conceptId,
+      title: record.frontmatter.title ?? null,
+      type,
+      standing: options.standing ?? "unsettled",
+      why: record.frontmatter.description ?? null,
+      claim: claimOf(record),
+      anchors,
+      impact: (options.impact?.impacted ?? []).map((entry) => ({
+        conceptId: entry.conceptId,
+        title: entry.title,
+        standing: entry.standing,
+        depth: entry.depth
+      })),
+      impactTruncated: options.impact?.truncated ?? false,
+      default: fallback,
+      defaultNote: DEFAULT_NOTES[fallback]
+    }
+  };
+}
+function anchorPacket(found, withDiff, maxLines) {
+  const { entry } = found;
+  const base2 = {
+    file: entry.file,
+    ...entry.symbol ? { symbol: entry.symbol } : {},
+    class: found.class,
+    ...entry.reason ? { reason: entry.reason } : {},
+    storedHash: entry.storedHash,
+    ...entry.currentHash ? { currentHash: entry.currentHash } : {},
+    diffSize: entry.diffSize,
+    ...entry.movedTo ? { movedTo: entry.movedTo } : {}
+  };
+  if (!withDiff) return base2;
+  if (found.oldText === void 0 || !found.oldOrigin) {
+    return { ...base2, diff: { status: "unrecoverable" } };
+  }
+  const rendered = unifiedDiff(found.oldText, found.newText ?? "", {
+    maxLines
+  });
+  return {
+    ...base2,
+    diff: {
+      status: "ok",
+      source: found.oldOrigin.kind,
+      ref: found.oldOrigin.ref,
+      unified: rendered.text,
+      added: rendered.added,
+      removed: rendered.removed,
+      truncated: rendered.truncated
+    }
+  };
+}
+function claimOf(record) {
+  const type = record.frontmatter.type;
+  const section = isKbRecordType(type) ? RECORD_TYPES[type].sections[0] : void 0;
+  if (!section) return null;
+  const lines = record.body.replace(/\r\n/g, "\n").split("\n");
+  const start = lines.findIndex(
+    (line) => line.trim().toLowerCase() === `## ${section}`.toLowerCase()
+  );
+  if (start < 0) return null;
+  const rest = lines.slice(start + 1);
+  const end = rest.findIndex((line) => line.startsWith("## "));
+  const text = (end < 0 ? rest : rest.slice(0, end)).join("\n").trim();
+  return text ? { section, text } : null;
+}
+
+// src/commands/reassess.ts
 var import_zod14 = require("zod");
-var days = (what, fallback) => import_zod14.z.number().int().positive().optional().describe(`${what} Defaults to ${fallback}.`);
+var reassessCommand = define({
+  name: "reassess",
+  tool: "kb_reassess",
+  usage: "reassess <concept-id> [--repo-root <path>] [--with-diff]",
+  description: "One drifted record, as something to judge: its claim, each anchor's drift class, the old-vs-new span diff, and the records that depend on it. Formatting-only drift is dropped. Empty when there is nothing to reassess. Writes: relocates moved anchors, keeping their hash; never verifies, supersedes, or changes standing.",
+  input: import_zod14.z.object({
+    bundlePath,
+    conceptId,
+    repoRoot: REPO_ROOT,
+    withDiff: import_zod14.z.boolean().optional().describe(
+      "Recover each anchor's committed span and render the diff. Reads git history."
+    )
+  }),
+  fromArgv: (argv, path) => {
+    const repoRoot = argvFlag(argv, "--repo-root");
+    return {
+      bundlePath: path,
+      conceptId: argv[1],
+      ...repoRoot !== void 0 ? { repoRoot } : {},
+      ...argv.includes("--with-diff") ? { withDiff: true } : {}
+    };
+  },
+  run: async ({ store, actor }, { bundlePath: path, conceptId: id, repoRoot, withDiff }) => {
+    const root = repoRoot ?? process.cwd();
+    const bundle = await store.list(path);
+    const record = bundle.find((entry) => entry.conceptId === id);
+    if (!record) throw new KbRecordNotFoundError(id);
+    const drift = await store.detectDrift([record], repoRoot);
+    const entries = drift?.get(id) ?? [];
+    if (!entries.some((entry) => entry.state !== "match")) {
+      return { conceptId: id, packet: null, rebaselined: [], cosmetic: 0 };
+    }
+    const standing = adjudicate(bundle, bundle).find(
+      (hit) => hit.record.conceptId === id
+    )?.standing;
+    const impact2 = await store.impact(path, id);
+    const { packet, classified } = await reassessPacket(root, record, entries, {
+      ...withDiff ? { withDiff: true } : {},
+      impact: impact2,
+      ...standing ? { standing } : {}
+    });
+    const moves = classified.filter((found) => found.class === "moved");
+    let frozen = false;
+    const rebaselined = [];
+    if (moves.length) {
+      const relocated = /* @__PURE__ */ new Map();
+      for (const found of moves) {
+        const to = found.entry.movedTo;
+        if (!to) continue;
+        relocated.set(found.anchor, {
+          ...found.anchor,
+          file: to.file,
+          ...to.symbol ? { symbol: to.symbol } : {}
+        });
+        rebaselined.push({
+          file: found.anchor.file,
+          ...found.anchor.symbol ? { symbol: found.anchor.symbol } : {},
+          toFile: to.file,
+          ...to.symbol ? { toSymbol: to.symbol } : {}
+        });
+      }
+      try {
+        await assertBaseNotFrozen(process.cwd(), path);
+      } catch (error) {
+        if (!(error instanceof KbBaseFrozenError)) throw error;
+        frozen = true;
+      }
+      if (!frozen) {
+        await store.updateAnchors(
+          path,
+          id,
+          (record.frontmatter.strauss_anchors ?? []).map(
+            (anchor) => relocated.get(anchor) ?? anchor
+          ),
+          actor
+        );
+      }
+    }
+    return {
+      conceptId: id,
+      packet,
+      rebaselined: frozen ? [] : rebaselined,
+      cosmetic: classified.filter((found) => found.class === "cosmetic").length,
+      ...frozen ? {
+        frozen: true,
+        note: "base is frozen: nothing was rebaselined"
+      } : {}
+    };
+  },
+  render: (result) => renderReassess(result)
+});
+function renderReassess(result) {
+  const lines = [];
+  for (const move of result.rebaselined) {
+    lines.push(
+      `rebaselined: ${at(move.file, move.symbol)} \u2192 ${at(move.toFile, move.toSymbol)} (same code, new address)`
+    );
+  }
+  if (result.cosmetic) {
+    lines.push(
+      `${result.cosmetic} anchor${result.cosmetic === 1 ? "" : "s"} changed formatting only.`
+    );
+  }
+  if (result.note) lines.push(result.note);
+  const packet = result.packet;
+  if (!packet) {
+    lines.push(`${result.conceptId}: nothing to reassess.`);
+    return lines.join("\n");
+  }
+  lines.push(
+    "",
+    `# ${packet.conceptId}${packet.title ? ` \u2014 ${packet.title}` : ""}`,
+    `type: ${packet.type}   standing: ${packet.standing}`,
+    ...packet.why ? [`why: ${packet.why}`] : [],
+    ...packet.claim ? ["", `## ${packet.claim.section}`, packet.claim.text] : [],
+    "",
+    `## Anchors (${packet.anchors.length})`
+  );
+  for (const anchor of packet.anchors) {
+    lines.push(
+      `- ${at(anchor.file, anchor.symbol)} \u2014 ${anchor.class}${anchor.reason ? ` (${anchor.reason})` : ""}`
+    );
+    if (!anchor.diff) continue;
+    if (anchor.diff.status === "unrecoverable") {
+      lines.push(
+        "  diff: unrecoverable \u2014 no committed span to compare against"
+      );
+      continue;
+    }
+    lines.push(
+      `  diff vs ${anchor.diff.ref} (${anchor.diff.source}): +${anchor.diff.added} \u2212${anchor.diff.removed}`,
+      ...anchor.diff.unified.split("\n").map((line) => `  ${line}`)
+    );
+  }
+  if (packet.impact.length) {
+    lines.push("", `## Impact (${packet.impact.length})`);
+    for (const entry of packet.impact) {
+      lines.push(
+        `- ${entry.conceptId} [${entry.standing}]${entry.title ? ` \u2014 ${entry.title}` : ""}`
+      );
+    }
+    if (packet.impactTruncated) lines.push("- \u2026 walk truncated");
+  }
+  lines.push("", `Default: ${packet.default} \u2014 ${packet.defaultNote}.`);
+  return lines.join("\n");
+}
+function at(file, symbol) {
+  return symbol ? `${file}:${symbol}` : file;
+}
+
+// src/commands/doctor.ts
+var days = (what, fallback) => import_zod15.z.number().int().positive().optional().describe(`${what} Defaults to ${fallback}.`);
 var doctorCommand = define({
   name: "doctor",
   tool: "kb_doctor",
-  usage: "doctor [--expiring-days N] [--unverified-days N] [--aging-days N] [--repo-root PATH] [--offline] [--strict]",
-  description: "Read-only health sweep: expired, expiring, unverified, aging, orphaned, broken-supersession, superseded-but-cited, drifted and unchecked anchors. Every group is reported even when empty; nothing is written or re-stamped. Use it when picking up a base you have not touched in a while; kb_validate only checks that pointers between records agree.",
-  input: import_zod14.z.object({
+  usage: "doctor [--expiring-days N] [--unverified-days N] [--aging-days N] [--repo-root PATH] [--offline] [--strict] [--drifted [--with-diff]]",
+  description: "Read-only health sweep: expired, expiring, unverified, aging, orphaned, broken-supersession, superseded-but-cited, drifted and unchecked anchors. Every group is reported even when empty; nothing is written or re-stamped. `drifted` narrows it to a reassessment packet per drifted record, `with_diff` adding each anchor's old-vs-new span.",
+  input: import_zod15.z.object({
     bundlePath,
     repoRoot: REPO_ROOT,
     expiringDays: days(
@@ -5202,11 +5966,17 @@ var doctorCommand = define({
       "How long a record may stay `open` or `proposed` before `aging` reports it, in days.",
       DEFAULT_AGING_DAYS
     ),
-    offline: import_zod14.z.boolean().optional().describe(
+    offline: import_zod15.z.boolean().optional().describe(
       "Read foreign anchors from the local repo cache only, never fetching."
     ),
-    strict: import_zod14.z.boolean().optional().describe(
+    strict: import_zod15.z.boolean().optional().describe(
       "Turn an expired record into a non-zero exit for the CLI. No effect on the report itself."
+    ),
+    drifted: import_zod15.z.boolean().optional().describe(
+      "Report only drift, as a reassessment packet per record: claim, per-anchor class, and what depends on it."
+    ),
+    withDiff: import_zod15.z.boolean().optional().describe(
+      "With `drifted`: recover each anchor's committed span and render the old-vs-new diff. Reads git history."
     )
   }),
   // Presence, not truthiness: `--expiring-days ""` is a caller who meant
@@ -5225,7 +5995,9 @@ var doctorCommand = define({
       ...unverified2 !== void 0 ? { unverifiedDays: Number(unverified2) } : {},
       ...agingDays !== void 0 ? { agingDays: Number(agingDays) } : {},
       ...argv.includes("--offline") ? { offline: true } : {},
-      ...argv.includes("--strict") ? { strict: true } : {}
+      ...argv.includes("--strict") ? { strict: true } : {},
+      ...argv.includes("--drifted") ? { drifted: true } : {},
+      ...argv.includes("--with-diff") ? { withDiff: true } : {}
     };
   },
   run: async ({ store, now }, {
@@ -5234,7 +6006,9 @@ var doctorCommand = define({
     unverifiedDays,
     agingDays,
     repoRoot,
-    offline
+    offline,
+    drifted: drifted2,
+    withDiff
   }) => {
     const checkedAt = now();
     const records = await store.list(path);
@@ -5249,10 +6023,51 @@ var doctorCommand = define({
       now: new Date(checkedAt)
     });
     const hints = grammarHints();
+    if (!drifted2) {
+      return {
+        bundlePath: path,
+        checkedAt,
+        ...report,
+        ...hints.length ? { hints } : {}
+      };
+    }
+    const standings = new Map(
+      adjudicate(records, records, new Date(checkedAt)).map((hit) => [
+        hit.record.conceptId,
+        hit.standing
+      ])
+    );
+    const packets = [];
+    const rebaselinable = [];
+    const search = movedSearch(repoRoot ?? process.cwd());
+    for (const found of report.groups.find((g) => g.check === "drifted")?.findings ?? []) {
+      const record = records.find(
+        (entry) => entry.conceptId === found.conceptId
+      );
+      if (!record) continue;
+      const standing = standings.get(record.conceptId);
+      const built = await reassessPacket(
+        repoRoot ?? process.cwd(),
+        record,
+        anchorDrift?.get(record.conceptId) ?? [],
+        {
+          ...withDiff ? { withDiff: true } : {},
+          impact: await store.impact(path, record.conceptId),
+          ...standing ? { standing } : {},
+          search
+        }
+      );
+      if (built.packet) packets.push(built.packet);
+      if (built.classified.some((entry) => entry.class === "moved")) {
+        rebaselinable.push(record.conceptId);
+      }
+    }
     return {
       bundlePath: path,
       checkedAt,
       ...report,
+      packets,
+      rebaselinable,
       ...hints.length ? { hints } : {}
     };
   },
@@ -5266,6 +6081,7 @@ var doctorCommand = define({
   failsWhen: (result, input) => input.strict === true && result.counts.expired > 0
 });
 function render2(result) {
+  if (result.packets) return renderPackets(result);
   const { thresholds } = result;
   const lines = [
     `# KB Doctor \u2014 ${result.bundlePath}`,
@@ -5299,21 +6115,45 @@ function render2(result) {
   );
   return lines.join("\n");
 }
+function renderPackets(result) {
+  const packets = result.packets ?? [];
+  const lines = [
+    `# KB Drift \u2014 ${result.bundlePath}`,
+    `checked: ${result.checkedAt}`,
+    `${packets.length} record${packets.length === 1 ? "" : "s"} need a reading; ${result.counts.drifted} drifted in all.`
+  ];
+  if (result.rebaselinable?.length) {
+    lines.push(
+      `moved, rebaseline with \`kb_reassess\`: ${result.rebaselinable.join(", ")}`
+    );
+  }
+  for (const packet of packets) {
+    lines.push(
+      renderReassess({
+        conceptId: packet.conceptId,
+        packet,
+        rebaselined: [],
+        cosmetic: 0
+      })
+    );
+  }
+  return lines.join("\n");
+}
 
 // src/commands/impact.ts
-var import_zod15 = require("zod");
+var import_zod16 = require("zod");
 var impactCommand = define({
   name: "impact",
   tool: "kb_impact",
   usage: "impact <concept-id> [--depth N] [--rels a,b]",
   description: "What breaks if this record changes: its transitive set of dependants, each with its standing. Each rel declares which of its ends depends on the other, and the walk follows each rel in its own direction. Naming `related_to` or an unknown rel in `rels` is an error. kb_backlinks gives one flat hop.",
-  input: import_zod15.z.object({
+  input: import_zod16.z.object({
     bundlePath,
     conceptId,
-    depth: import_zod15.z.number().int().positive().optional().describe(
+    depth: import_zod16.z.number().int().positive().optional().describe(
       "Hops out from the record. Unbounded when omitted; a walk this cuts reports truncated: true."
     ),
-    rels: import_zod15.z.array(import_zod15.z.enum(KB_CAUSAL_LINK_RELS)).optional().describe(
+    rels: import_zod16.z.array(import_zod16.z.enum(KB_CAUSAL_LINK_RELS)).optional().describe(
       "Narrow which rels the walk follows. Defaults to every rel that carries a dependence \u2014 all but related_to."
     )
   }),
@@ -5334,35 +6174,49 @@ var impactCommand = define({
 });
 
 // src/commands/list.ts
-var import_zod16 = require("zod");
+var import_zod17 = require("zod");
 var listCommand = define({
   name: "list",
   tool: "kb_list",
-  usage: "list [type]",
-  description: "Every record, optionally one type. For enumerating; use kb_query for a question.",
-  input: import_zod16.z.object({ bundlePath, type: import_zod16.z.enum(KB_RECORD_TYPES).optional() }),
-  fromArgv: (argv, path) => ({ bundlePath: path, type: argv[1] }),
-  run: async ({ store }, { bundlePath: path, type }) => (await store.list(path, type)).map((record) => ({
-    conceptId: record.conceptId,
-    title: record.frontmatter.title ?? null,
-    description: record.frontmatter.description ?? null,
-    status: record.frontmatter.strauss_status,
-    anchors: record.frontmatter.strauss_anchors ?? []
-  }))
+  usage: "list [type] [--tag T]...",
+  description: "Every record, optionally one type or tag. For enumerating; use kb_query for a question.",
+  input: import_zod17.z.object({
+    bundlePath,
+    type: import_zod17.z.enum(KB_RECORD_TYPES).optional(),
+    tags: TAGS
+  }),
+  fromArgv: (argv, path) => {
+    const tags = argvFlags(argv, "--tag");
+    const type = argvPositional(argv, "--tag");
+    return {
+      bundlePath: path,
+      ...type ? { type } : {},
+      ...tags.length ? { tags } : {}
+    };
+  },
+  run: async ({ store }, { bundlePath: path, type, tags }) => (await store.list(path, type, { ...tags ? { tags } : {} })).map(
+    (record) => ({
+      conceptId: record.conceptId,
+      title: record.frontmatter.title ?? null,
+      description: record.frontmatter.description ?? null,
+      status: record.frontmatter.strauss_status,
+      anchors: record.frontmatter.strauss_anchors ?? []
+    })
+  )
 });
 
 // src/commands/load.ts
-var import_zod17 = require("zod");
+var import_zod18 = require("zod");
 var loadCommand = define({
   name: "load",
   tool: "kb_load",
   usage: "load [type] [--budget N | --all] [--repo-root PATH]",
   description: "Load the whole base, each record with its standing \u2014 call it first, at the point of use, since compaction drops it. Superseded records arrive as stubs; kb_trace has the history. Over budget it refuses: kb_catalog, then kb_pack, or narrow with `type`; `all` bypasses. Never read record files directly \u2014 only kb_* tools resolve supersession. `digest` stamps the base's content, so hooks know when to reload.",
-  input: import_zod17.z.object({
+  input: import_zod18.z.object({
     bundlePath,
-    type: import_zod17.z.enum(KB_RECORD_TYPES).optional(),
-    budgetTokens: import_zod17.z.number().int().positive().optional().describe("Approximate token ceiling. Defaults to 25000."),
-    all: import_zod17.z.boolean().optional().describe(
+    type: import_zod18.z.enum(KB_RECORD_TYPES).optional(),
+    budgetTokens: import_zod18.z.number().int().positive().optional().describe("Approximate token ceiling. Defaults to 25000."),
+    all: import_zod18.z.boolean().optional().describe(
       "Loads the entire base regardless of size, bypassing the token budget; mutually exclusive with budgetTokens."
     ),
     repoRoot: REPO_ROOT
@@ -5404,25 +6258,25 @@ var loadCommand = define({
 });
 
 // src/commands/log.ts
-var import_zod18 = require("zod");
+var import_zod19 = require("zod");
 var logCommand = define({
   name: "log",
   tool: "kb_log",
   usage: "log",
   description: "Who touched what, and when. Append-only; malformed lines are reported, never repaired.",
-  input: import_zod18.z.object({ bundlePath }),
+  input: import_zod19.z.object({ bundlePath }),
   fromArgv: (_argv, path) => ({ bundlePath: path }),
   run: ({ store }, { bundlePath: path }) => store.readLog(path)
 });
 
 // src/commands/no-decision.ts
-var import_zod19 = require("zod");
+var import_zod20 = require("zod");
 var noDecisionCommand = define({
   name: "no-decision",
   tool: "kb_no_decision",
   usage: "no-decision <reason...>",
   description: "Record in one sentence that a piece of work had nothing to decide. Idempotent.",
-  input: import_zod19.z.object({ bundlePath, reason: import_zod19.z.string().min(1) }),
+  input: import_zod20.z.object({ bundlePath, reason: import_zod20.z.string().min(1) }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
     reason: argv.slice(1).join(" ").trim()
@@ -5439,20 +6293,20 @@ var noDecisionCommand = define({
 });
 
 // src/commands/pack.ts
-var import_zod20 = require("zod");
+var import_zod21 = require("zod");
 var packCommand = define({
   name: "pack",
   tool: "kb_pack",
   usage: "pack <conceptId> [--hops N] [--max-nodes N] [--budget N]",
   description: "Bounded neighbourhood around one record: within `hops`, ranked, cut to `maxNodes`, with every cut record named under Excluded. Use when the base is over kb_load's budget and the work centres on a record you can name. Refuses over budget rather than truncating. Everything below the header is byte-stable across runs. Resolves supersession like kb_load.",
-  input: import_zod20.z.object({
+  input: import_zod21.z.object({
     bundlePath,
     conceptId,
-    hops: import_zod20.z.number().int().positive().optional().describe("How far from the root the walk may reach. Defaults to 2."),
-    maxNodes: import_zod20.z.number().int().positive().optional().describe(
+    hops: import_zod21.z.number().int().positive().optional().describe("How far from the root the walk may reach. Defaults to 2."),
+    maxNodes: import_zod21.z.number().int().positive().optional().describe(
       "How many records the pack may hold, root included. Defaults to 20."
     ),
-    budgetTokens: import_zod20.z.number().int().positive().optional().describe(
+    budgetTokens: import_zod21.z.number().int().positive().optional().describe(
       "Approximate token ceiling over what is actually emitted. Defaults to 25000."
     )
   }),
@@ -5477,12 +6331,12 @@ var packCommand = define({
     return render3(result, path, now());
   }
 });
-function render3(result, bundle, at) {
+function render3(result, bundle, at2) {
   const lines = [
     `# KB Pack \u2014 ${result.root}`,
     `bundle: ${bundle}`,
     `budget: ~${result.tokensLoaded} of ${result.budgetTokens} tokens, ${result.recordCount} records`,
-    `packed: ${at}`,
+    `packed: ${at2}`,
     "",
     `## Records (${result.records.length})`
   ];
@@ -5539,22 +6393,22 @@ function warningLabel(warning) {
 }
 
 // src/commands/pin.ts
-var import_zod21 = require("zod");
+var import_zod22 = require("zod");
 var pinCommand = define({
   name: "pin",
   tool: "kb_pin",
   usage: "pin [bundle-path] [--mode full|index] [--profiles a,b] [--local|--user] [--frozen|--unfreeze]",
   description: "Pin a base into a workspace manifest so kb_context surfaces it. Layers, nearest wins: project `.strauss/kb-pins.json` (default), `--local` (personal, gitignored), `--user` (`~/.strauss`). Idempotent; `--mode full|index`, `--profiles`, `--frozen`/`--unfreeze` update only those fields. A path with no records pins with a warning. Never touches the base itself.",
-  input: import_zod21.z.object({
+  input: import_zod22.z.object({
     bundlePath,
-    mode: import_zod21.z.enum(["full", "index"]).optional().describe(
+    mode: import_zod22.z.enum(["full", "index"]).optional().describe(
       "full: always emit this base's records whole (still under the block budget); index: never upgrade. Absent: the profile's full-under threshold decides."
     ),
-    profiles: import_zod21.z.array(import_zod21.z.string()).optional().describe("Context profiles this pin surfaces in. Absent: all of them."),
-    layer: import_zod21.z.enum(["project", "local", "user"]).optional().describe(
+    profiles: import_zod22.z.array(import_zod22.z.string()).optional().describe("Context profiles this pin surfaces in. Absent: all of them."),
+    layer: import_zod22.z.enum(["project", "local", "user"]).optional().describe(
       "Which manifest to write: project (committed, default), local (personal, gitignored), user (~/.strauss, every workspace)."
     ),
-    frozen: import_zod21.z.boolean().optional().describe(
+    frozen: import_zod22.z.boolean().optional().describe(
       "true: the base is concluded \u2014 writes against it refuse while pinned. false: lift a freeze."
     )
   }),
@@ -5583,47 +6437,49 @@ var pinCommand = define({
 });
 
 // src/commands/pins.ts
-var import_zod22 = require("zod");
+var import_zod23 = require("zod");
 var pinsCommand = define({
   name: "pins",
   tool: "kb_pins",
   usage: "pins",
   description: "Every pinned base across the manifest layers, with its layer and whether it resolves to records. Takes no bundlePath.",
-  input: import_zod22.z.object({}),
+  input: import_zod23.z.object({}),
   fromArgv: () => ({}),
   run: ({ store }) => listPins(store, process.cwd())
 });
 
 // src/commands/query.ts
-var import_zod23 = require("zod");
+var import_zod24 = require("zod");
 var queryCommand = define({
   name: "query",
   tool: "kb_query",
-  usage: "query <text...> [--repo-root PATH]",
+  usage: "query <text...> [--tag T]... [--repo-root PATH]",
   description: "Search; every hit carries its standing. Flagged, never filtered: a superseded hit returns with its replacement, a rejected one is marked. Prefer kb_load when the base fits its budget \u2014 a full read beats search. Results are volatile: place them at the tail, not the cached prefix. Never read record files directly.",
-  input: import_zod23.z.object({
+  input: import_zod24.z.object({
     bundlePath,
-    text: import_zod23.z.string().optional(),
-    type: import_zod23.z.enum(KB_RECORD_TYPES).optional(),
-    includeNonCurrent: import_zod23.z.boolean().optional(),
+    text: import_zod24.z.string().optional(),
+    type: import_zod24.z.enum(KB_RECORD_TYPES).optional(),
+    includeNonCurrent: import_zod24.z.boolean().optional(),
+    tags: TAGS,
     repoRoot: REPO_ROOT
   }),
-  // `--repo-root` is a flag, so its value must not fall into the search text.
+  // Both are flags, so neither's value may fall into the search text.
   fromArgv: (argv, path) => {
     const repoRoot = argvFlag(argv, "--repo-root");
-    const words = argv.slice(1);
-    const flag = words.indexOf("--repo-root");
-    if (flag !== -1) words.splice(flag, 2);
+    const tags = argvFlags(argv, "--tag");
+    const words = argvWithout(argv.slice(1), "--repo-root", "--tag");
     return {
       bundlePath: path,
       text: words.join(" ").trim(),
       includeNonCurrent: true,
+      ...tags.length ? { tags } : {},
       ...repoRoot !== void 0 ? { repoRoot } : {}
     };
   },
-  run: async ({ store }, { bundlePath: path, text, type, includeNonCurrent, repoRoot }) => (await store.query(path, text ?? "", {
+  run: async ({ store }, { bundlePath: path, text, type, includeNonCurrent, tags, repoRoot }) => (await store.query(path, text ?? "", {
     ...type ? { type } : {},
     includeNonCurrent: includeNonCurrent === true,
+    ...tags ? { tags } : {},
     ...repoRoot !== void 0 ? { repoRoot } : {}
   })).map((hit) => ({
     conceptId: hit.record.conceptId,
@@ -5637,43 +6493,43 @@ var queryCommand = define({
 });
 
 // src/commands/read-index.ts
-var import_zod24 = require("zod");
+var import_zod25 = require("zod");
 var readIndexCommand = define({
   name: "index",
   tool: "kb_index",
   usage: "index",
   description: "The index \u2014 title, type, status, description per record \u2014 rebuilt if stale. Cheapest re-orientation after compaction: call it (or kb_context) first, then kb_load or fetch by id.",
-  input: import_zod24.z.object({ bundlePath }),
+  input: import_zod25.z.object({ bundlePath }),
   fromArgv: (_argv, path) => ({ bundlePath: path }),
   run: ({ store }, { bundlePath: path }) => store.readIndex(path)
 });
 
 // src/commands/schema.ts
-var import_zod25 = require("zod");
+var import_zod26 = require("zod");
 var schemaCommand = define({
   name: "schema",
   tool: "kb_schema",
   usage: "schema",
   description: "JSON Schema for frontmatter, write input, and log entries, generated from the enforcing code.",
-  input: import_zod25.z.object({}),
+  input: import_zod26.z.object({}),
   fromArgv: () => ({}),
   run: () => Promise.resolve(kbJsonSchemas())
 });
 
 // src/commands/stamp.ts
-var import_promises9 = require("fs/promises");
-var import_zod26 = require("zod");
+var import_promises10 = require("fs/promises");
+var import_zod27 = require("zod");
 var DIGEST = /^[0-9a-f]{64}$/;
 var stampCommand = define({
   name: "stamp",
   tool: "kb_stamp",
   usage: "stamp [--bundle PATH] [--since DIGEST|FILE]",
-  description: "Content stamp of a base \u2014 `load`'s digest, record counts, per-record digests \u2014 without any bodies. Takes no bundlePath to stamp every pinned base. With `since`, reports only the bases that moved, naming the changed ids when the baseline is a prior stamp; silent when nothing changed. Reads, never writes.",
-  input: import_zod26.z.object({
-    bundlePath: import_zod26.z.string().min(1).optional().describe(
+  description: "Content stamp of a base \u2014 `load`'s digest, record counts, per-record digests, how many records have drifted anchors \u2014 without any bodies. Takes no bundlePath to stamp every pinned base. With `since`, reports only the bases that moved, naming the changed ids. Reads, never writes.",
+  input: import_zod27.z.object({
+    bundlePath: import_zod27.z.string().min(1).optional().describe(
       "Absolute path to one knowledge base. Omit to stamp every pinned base."
     ),
-    since: import_zod26.z.string().min(1).optional().describe(
+    since: import_zod27.z.string().min(1).optional().describe(
       "Prior digest, or path to a prior `stamp --json`; only moved bases return, with changed ids when the baseline is a file."
     )
   }),
@@ -5712,7 +6568,7 @@ var stampCommand = define({
     return reports;
   },
   render: (result) => result.map((report) => {
-    const counts = `${report.recordCount} record(s), ${report.superseded} superseded`;
+    const counts = `${report.recordCount} record(s), ${report.superseded} superseded${report.drifted ? `, ${report.drifted} drifted` : ""}`;
     const head = `${report.path}  ${report.digest}  ${counts}${report.newestAt ? `  newest ${report.newestAt}` : ""}`;
     return report.changed?.length ? `${head}
   changed: ${report.changed.join(", ")}` : head;
@@ -5735,7 +6591,7 @@ async function readBaseline(since) {
   if (DIGEST.test(since)) return { digest: since, byPath: /* @__PURE__ */ new Map() };
   let parsed;
   try {
-    parsed = JSON.parse(await (0, import_promises9.readFile)(since, "utf8"));
+    parsed = JSON.parse(await (0, import_promises10.readFile)(since, "utf8"));
   } catch {
     throw new KbStampBaselineError(since);
   }
@@ -5759,16 +6615,16 @@ async function readBaseline(since) {
 }
 
 // src/commands/status.ts
-var import_zod27 = require("zod");
+var import_zod28 = require("zod");
 var statusCommand = define({
   name: "status",
   tool: "kb_status",
   usage: "status <concept-id> <status>",
   description: "Move a record's status. Compare-and-swap: a concurrent change fails instead of being overwritten.",
-  input: import_zod27.z.object({
+  input: import_zod28.z.object({
     bundlePath,
     conceptId,
-    status: import_zod27.z.enum(KB_RECORD_STATUSES)
+    status: import_zod28.z.enum(KB_RECORD_STATUSES)
   }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
@@ -5783,13 +6639,13 @@ var statusCommand = define({
 });
 
 // src/commands/supersede.ts
-var import_zod28 = require("zod");
+var import_zod29 = require("zod");
 var supersedeCommand = define({
   name: "supersede",
   tool: "kb_supersede",
   usage: "supersede <concept-id> <replacement-id>",
   description: "Mark a record superseded by another, linked in both directions. Use instead of editing a record whose meaning changed.",
-  input: import_zod28.z.object({ bundlePath, conceptId, replacementId: conceptId }),
+  input: import_zod29.z.object({ bundlePath, conceptId, replacementId: conceptId }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
     conceptId: argv[1],
@@ -5803,16 +6659,16 @@ var supersedeCommand = define({
 });
 
 // src/commands/sync-instructions.ts
-var import_zod29 = require("zod");
+var import_zod30 = require("zod");
 var syncInstructionsCommand = define({
   name: "sync-instructions",
   usage: "sync-instructions <file> [--profile NAME] [--budget N] [--full-under N]",
   description: "CLI-only: plant the kb_context block between sentinel comments in AGENTS.md or CLAUDE.md, idempotently.",
-  input: import_zod29.z.object({
-    file: import_zod29.z.string().min(1).describe("The instruction file to edit in place."),
-    budgetTokens: import_zod29.z.number().int().positive().optional(),
-    fullUnderTokens: import_zod29.z.number().int().positive().optional(),
-    profile: import_zod29.z.string().optional()
+  input: import_zod30.z.object({
+    file: import_zod30.z.string().min(1).describe("The instruction file to edit in place."),
+    budgetTokens: import_zod30.z.number().int().positive().optional(),
+    fullUnderTokens: import_zod30.z.number().int().positive().optional(),
+    profile: import_zod30.z.string().optional()
   }),
   fromArgv: (argv) => {
     const budget = argvFlag(argv, "--budget");
@@ -5838,17 +6694,17 @@ var syncInstructionsCommand = define({
 });
 
 // src/commands/trace.ts
-var import_zod30 = require("zod");
+var import_zod31 = require("zod");
 var traceCommand = define({
   name: "trace",
   tool: "kb_trace",
   usage: "trace <concept-id> [edges...]",
   description: 'Timeline of how a position was reached, ordered by write time, following supersession, shared anchors and shared sources. Includes rejected, draft and superseded records \u2014 in a history they are the content. For "why is it like this"; kb_load answers "what holds now".',
-  input: import_zod30.z.object({
+  input: import_zod31.z.object({
     bundlePath,
     conceptId,
-    edges: import_zod30.z.array(import_zod30.z.enum(TRACE_EDGES)).optional(),
-    depth: import_zod30.z.number().int().positive().optional()
+    edges: import_zod31.z.array(import_zod31.z.enum(TRACE_EDGES)).optional(),
+    depth: import_zod31.z.number().int().positive().optional()
   }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
@@ -5870,37 +6726,37 @@ var traceCommand = define({
 });
 
 // src/commands/types.ts
-var import_zod31 = require("zod");
+var import_zod32 = require("zod");
 var typesCommand = define({
   name: "types",
   tool: "kb_types",
   usage: "types",
   description: "The twelve record types with their purpose, body sections, and starting status. Read this before writing rather than guessing headings \u2014 a section the type does not define is rejected.",
-  input: import_zod31.z.object({}),
+  input: import_zod32.z.object({}),
   fromArgv: () => ({}),
   run: () => Promise.resolve(RECORD_TYPES)
 });
 
 // src/commands/unpin.ts
-var import_zod32 = require("zod");
+var import_zod33 = require("zod");
 var unpinCommand = define({
   name: "unpin",
   tool: "kb_unpin",
   usage: "unpin [bundle-path]",
   description: "Remove a base from every manifest layer that holds it. Reports the layers touched.",
-  input: import_zod32.z.object({ bundlePath }),
+  input: import_zod33.z.object({ bundlePath }),
   fromArgv: (argv, path) => ({ bundlePath: argv[1] ?? path }),
   run: (_ctx, { bundlePath: path }) => unpinBase(process.cwd(), path)
 });
 
 // src/commands/validate.ts
-var import_zod33 = require("zod");
+var import_zod34 = require("zod");
 var validateCommand = define({
   name: "validate",
   tool: "kb_validate",
   usage: "validate",
   description: "Check pointers no single record can see: supersession links that disagree between the two records, typed causal links, and assumptions that cite sources. Each finding carries a severity: errors fail the exit code, warnings do not.",
-  input: import_zod33.z.object({ bundlePath }),
+  input: import_zod34.z.object({ bundlePath }),
   fromArgv: (_argv, path) => ({ bundlePath: path }),
   run: async ({ store }, { bundlePath: path }) => validateBundle(await store.list(path)),
   // Warnings never fail the exit code; every other severity does.
@@ -5910,16 +6766,16 @@ var validateCommand = define({
 });
 
 // src/commands/verify.ts
-var import_zod34 = require("zod");
+var import_zod35 = require("zod");
 var verifyCommand = define({
   name: "verify",
   tool: "kb_verify",
   usage: "verify <concept-id> --note <text>",
   description: "Append a verified[] event: who checked, when, and what was found. Append-only. A record's own generator is refused unless the actor is `human:`-prefixed.",
-  input: import_zod34.z.object({
+  input: import_zod35.z.object({
     bundlePath,
     conceptId,
-    note: import_zod34.z.string().refine((s) => s.trim().length > 0, {
+    note: import_zod35.z.string().refine((s) => s.trim().length > 0, {
       message: "note must say what the check found"
     })
   }),
@@ -5939,15 +6795,15 @@ var verifyCommand = define({
 });
 
 // src/commands/write.ts
-var import_zod35 = require("zod");
+var import_zod36 = require("zod");
 var writeCommand = define({
   name: "write",
   tool: "kb_write",
   usage: "write <type> < record.json",
   description: "Write one record. Search first \u2014 a duplicate concept id is rejected, not overwritten; kb_types lists each type's sections. An unsourced claim is an `assumption` with assumption: true, never a vague `fact`. Conflicting records get a `risk`, `open-question`, or superseding `decision`. Prefer a new short record over overloading one. Never delete; supersede.",
-  input: import_zod35.z.object({
+  input: import_zod36.z.object({
     bundlePath,
-    type: import_zod35.z.enum(KB_RECORD_TYPES),
+    type: import_zod36.z.enum(KB_RECORD_TYPES),
     input: composeInputSchema
   }),
   fromArgv: async (argv, path, stdin) => ({
@@ -5971,13 +6827,13 @@ var writeCommand = define({
 });
 
 // src/commands/write-decision.ts
-var import_zod36 = require("zod");
+var import_zod37 = require("zod");
 var writeDecisionCommand = define({
   name: "write-decision",
   tool: "kb_write_decision",
   usage: "write-decision < decision.json",
   description: "Write a decision, with `alternative` (what was rejected and why) and `impact` as fields. Record one when a later reader would otherwise simplify the constraint away; skip when the diff already answers it. `sources` for material read, `anchors` for code, `relatedConceptIds` for records.",
-  input: import_zod36.z.object({ bundlePath, input: decisionInputSchema }),
+  input: import_zod37.z.object({ bundlePath, input: decisionInputSchema }),
   fromArgv: async (_argv, path, stdin) => ({
     bundlePath: path,
     input: JSON.parse(await stdin())
@@ -6007,6 +6863,7 @@ var KB_COMMANDS = [
   answerCommand,
   verifyCommand,
   anchorResolveCommand,
+  reassessCommand,
   loadCommand,
   catalogCommand,
   packCommand,
@@ -6037,7 +6894,7 @@ var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 
 // src/version.ts
-var VERSION = true ? "0.1.17" : "0.0.0-dev";
+var VERSION = true ? "0.1.19" : "0.0.0-dev";
 
 // src/mcp.ts
 function createKbMcpServer() {
@@ -6131,21 +6988,21 @@ async function runKbCli(argv) {
 `);
 }
 function takeLiteral(argv) {
-  const at = argv.indexOf("--");
-  if (at === -1) return { flags: argv, literal: [] };
-  return { flags: argv.slice(0, at), literal: argv.slice(at + 1) };
+  const at2 = argv.indexOf("--");
+  if (at2 === -1) return { flags: argv, literal: [] };
+  return { flags: argv.slice(0, at2), literal: argv.slice(at2 + 1) };
 }
 function takeBundle(argv) {
-  const at = argv.indexOf("--bundle");
-  if (at === -1) {
+  const at2 = argv.indexOf("--bundle");
+  if (at2 === -1) {
     return { bundle: (0, import_node_path12.join)(process.cwd(), KB_DIR), explicit: false, rest: argv };
   }
-  const bundle = argv[at + 1];
+  const bundle = argv[at2 + 1];
   if (!bundle) die("--bundle requires a path");
   return {
     bundle,
     explicit: true,
-    rest: [...argv.slice(0, at), ...argv.slice(at + 2)]
+    rest: [...argv.slice(0, at2), ...argv.slice(at2 + 2)]
   };
 }
 function readStdin() {
@@ -6243,6 +7100,7 @@ function usage() {
   backlinks,
   buildContext,
   catalog,
+  classifyDrift,
   composeDecisionRecord,
   composeInputSchema,
   composeLinkSchema,
@@ -6280,6 +7138,7 @@ function usage() {
   listPins,
   loadQmd,
   matchToDiff,
+  matchesTags,
   mergedContextBudgets,
   neighbours,
   pack,
@@ -6290,6 +7149,7 @@ function usage() {
   readMergedPins,
   readPinsLayer,
   readRemoteAnchors,
+  reassessPacket,
   regexResolver,
   renderCatalogLine,
   renderIndex,
@@ -6311,6 +7171,7 @@ function usage() {
   toHookJson,
   trace,
   treeSitterLanguages,
+  unifiedDiff,
   unpinBase,
   validateBundle
 });