@saasontools/strauss-kb 0.1.20 → 0.1.22

package/dist/mcp-main.cjs

@@ -32,617 +32,139 @@ var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 
 // src/decision-record.ts
-var import_zod3 = require("zod");
+var import_zod4 = require("zod");
 
 // src/compose.ts
-var import_zod2 = require("zod");
+var import_zod3 = require("zod");
 
-// src/kb-record.schema.ts
-var import_zod = require("zod");
-var kbSourceSchema = import_zod.z.object({
-  id: import_zod.z.string().min(1),
-  resource: import_zod.z.string().min(1),
-  title: import_zod.z.string().min(1).optional(),
-  author: import_zod.z.string().min(1).optional(),
-  last_modified: import_zod.z.string().min(1).optional()
-}).passthrough();
-var kbActorStampSchema = import_zod.z.object({
-  by: import_zod.z.string().min(1),
-  at: import_zod.z.string().min(1)
-}).passthrough();
-var kbVerifiedEventSchema = kbActorStampSchema.extend({
-  note: import_zod.z.string().refine((s) => s.trim().length > 0, {
-    message: "note must say what the check found"
-  })
-});
-var kbAnchorSpanSchema = import_zod.z.object({
-  start: import_zod.z.number().int().positive(),
-  end: import_zod.z.number().int().positive()
-}).strict();
-var kbAnchorSchema = import_zod.z.object({
-  file: import_zod.z.string().min(1),
-  symbol: import_zod.z.string().min(1).optional(),
-  /**
-   * The lines the concept names, when no symbol covers them — deleted code,
-   * YAML, SQL, Markdown. Alternative to `symbol`, never a refinement of it.
-   */
-  span: kbAnchorSpanSchema.optional(),
-  /**
-   * Which side of the change the anchor describes. `old` is code as it was
-   * committed at `ref`, which is the only way to anchor something deleted;
-   * absent means the working tree.
-   */
-  side: import_zod.z.enum(["old", "new"]).optional(),
-  /**
-   * Which repository the file lives in — a remote URL
-   * (`https://github.com/org/name`) or a short name. Absent means the base's
-   * own repository, which is what nearly every anchor means.
-   *
-   * Unvalidated beyond not-blank: one repository has many spellings, matched
-   * after normalisation. Only a full URL can be fetched from, so `validate`
-   * warns on a short one; see ARCHITECTURE.
-   */
-  repo: import_zod.z.string().trim().min(1).optional(),
-  /**
-   * The git rev the evidence was taken at. Prefer a commit SHA: a branch
-   * name is a moving pointer, so an anchor pinned to one says the evidence
-   * came from wherever that branch happens to be now, which is not a
-   * baseline. A foreign anchor is checked at this rev, and compared against
-   * the remote's default branch on top of it.
-   */
-  ref: import_zod.z.string().trim().min(1).optional(),
-  hash: import_zod.z.string().regex(/^sha256:[0-9a-f]{64}$/, {
-    message: "hash must be sha256:<64 hex chars>"
-  }).optional(),
-  /**
-   * What `hash` was taken over: the span's raw text, or the normalised token
-   * stream a parser sees (`ast`). Absent means `raw`, which is what every
-   * anchor stamped before this field carries, so old hashes keep comparing
-   * the way they were written. An `ast` hash is blind to whitespace and
-   * comments, so reformatting the anchored code is not drift.
-   */
-  hash_kind: import_zod.z.enum(["raw", "ast"]).optional(),
-  /** ISO 8601 timestamp of the last successful resolution. */
-  resolved_at: import_zod.z.string().min(1).optional(),
-  /** Line count of the text the hash was taken over. */
-  lines: import_zod.z.number().int().positive().optional(),
-  /**
-   * Which resolver produced the hashed span. Absent means an anchor stamped
-   * before resolvers were named, which is read as `regex` — the only one
-   * there was. A hash from a different resolver is drift, not a match.
-   */
-  resolver: import_zod.z.enum(["tree-sitter", "regex", "span"]).optional()
-}).strict();
-var kbAnchorWriteSchema = kbAnchorSchema.superRefine((anchor, ctx) => {
-  if (anchor.span && anchor.symbol) {
-    ctx.addIssue({
-      code: import_zod.z.ZodIssueCode.custom,
-      path: ["span"],
-      message: "an anchor names a symbol or a span, not both"
-    });
+// src/concurrency.ts
+var DEFAULT_IO_CONCURRENCY = 16;
+async function mapLimit(items, limit, fn) {
+  if (!Number.isInteger(limit) || limit < 1) {
+    throw new RangeError(
+      `mapLimit: "limit" must be a positive integer, got ${limit}`
+    );
   }
-  if (anchor.span && anchor.span.end < anchor.span.start) {
-    ctx.addIssue({
-      code: import_zod.z.ZodIssueCode.custom,
-      path: ["span", "end"],
-      message: "span end must not precede start"
-    });
+  const out = new Array(items.length);
+  let next = 0;
+  let failed = false;
+  const runners = Array.from(
+    { length: Math.min(limit, items.length) },
+    async () => {
+      while (!failed && next < items.length) {
+        const at2 = next++;
+        try {
+          out[at2] = await fn(items[at2], at2);
+        } catch (error) {
+          failed = true;
+          throw error;
+        }
+      }
+    }
+  );
+  await Promise.all(runners);
+  return out;
+}
+
+// src/drift/git.ts
+var import_node_child_process2 = require("child_process");
+var import_node_util2 = require("util");
+
+// src/remote-repo/git.ts
+var import_node_child_process = require("child_process");
+var import_node_util = require("util");
+
+// src/anchor-resolver/model.ts
+var MAX_ANCHOR_FILE_BYTES = 1048576;
+
+// src/remote-repo/git.ts
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
+function childEnv() {
+  const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+  for (const name of ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE"]) {
+    delete env[name];
   }
-  if (anchor.span && anchor.hash_kind === "ast") {
-    ctx.addIssue({
-      code: import_zod.z.ZodIssueCode.custom,
-      path: ["hash_kind"],
-      message: "a span is hashed raw, never ast"
+  return env;
+}
+async function git(args, options = {}) {
+  try {
+    const { stdout, stderr } = await execFileAsync("git", args, {
+      ...options.cwd ? { cwd: options.cwd } : {},
+      timeout: options.timeoutMs ?? 3e4,
+      maxBuffer: options.maxBytes ?? MAX_ANCHOR_FILE_BYTES,
+      encoding: "utf8",
+      windowsHide: true,
+      env: childEnv()
     });
+    return { ok: true, stdout, stderr, overflowed: false };
+  } catch (error) {
+    const failure = error;
+    return {
+      ok: false,
+      stdout: failure.stdout ?? "",
+      stderr: failure.stderr ?? "",
+      overflowed: failure.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER"
+    };
   }
-  if (anchor.side === "old" && !anchor.ref) {
-    ctx.addIssue({
-      code: import_zod.z.ZodIssueCode.custom,
-      path: ["ref"],
-      message: 'side: "old" needs a ref \u2014 committed code has no other address'
-    });
+}
+function transportReason(stderr) {
+  const text = stderr.toLowerCase();
+  if (text.includes("authentication failed") || text.includes("permission denied") || text.includes("could not read username") || text.includes("403 forbidden") || text.includes("access denied")) {
+    return "repo-unauthorized";
   }
-});
-var kbLinkSchema = import_zod.z.object({
-  target: import_zod.z.string().min(1),
-  rel: import_zod.z.string().min(1)
-}).passthrough();
-var KB_RECORD_TYPES = [
-  "fact",
-  "requirement",
-  "constraint",
-  "decision",
-  "assumption",
-  "open-question",
-  "risk",
-  "contract",
-  "flow",
-  "affected-system",
-  "test-obligation",
-  "source-note"
-];
-var KB_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-var KB_CONCEPT_ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*\.[a-z0-9]+(?:-[a-z0-9]+)*$/;
-var kbConceptIdSchema = import_zod.z.string().regex(KB_CONCEPT_ID_PATTERN, {
-  message: "concept id must be <type>.<slug>, both kebab-case"
-});
-var KB_RECORD_STATUSES = [
-  "draft",
-  "proposed",
-  "accepted",
-  "open",
-  "resolved",
-  "rejected",
-  "superseded"
-];
-var KB_MATERIALITIES = [
-  "blocking",
-  "important",
-  "non-blocking"
-];
-var KB_CONFIDENCES = ["low", "medium", "high"];
-var kbRecordFrontmatterSchema = import_zod.z.object({
-  // OKF: the only always-required key. A concept carrying just `type` is
-  // fully conformant, so everything below stays optional.
-  type: import_zod.z.string().min(1),
-  // OKF recommended.
-  title: import_zod.z.string().min(1).optional(),
-  description: import_zod.z.string().min(1).optional(),
-  resource: import_zod.z.string().min(1).optional(),
-  tags: import_zod.z.array(import_zod.z.string()).optional(),
-  // OKF optional: provenance and freshness.
-  sources: import_zod.z.array(kbSourceSchema).optional(),
-  generated: kbActorStampSchema.optional(),
-  verified: import_zod.z.array(kbActorStampSchema).optional(),
-  stale_after: import_zod.z.string().min(1).optional(),
-  // strauss extensions — see the module comment.
-  strauss_anchors: import_zod.z.array(kbAnchorSchema).optional(),
-  strauss_verify: import_zod.z.array(import_zod.z.string().min(1)).optional(),
-  // Typed causal edges, source → target, living on the source. `A depends_on
-  // B` means A needs B, so `kb_impact` walks these inbound: what breaks if B
-  // changes is whatever declared a dependence on it.
-  strauss_links: import_zod.z.array(kbLinkSchema).optional(),
-  // Total after parsing, tolerant before it. Our producers must supply a
-  // status — an absent one would leave every reader inventing its own default
-  // — but OKF calls a concept carrying only `type` fully conformant, so
-  // rejecting a foreign record for the lack of one would put us outside the
-  // spec. The default resolves it in the single place that can: here.
-  strauss_status: import_zod.z.enum(KB_RECORD_STATUSES).default("draft"),
-  strauss_supersedes: import_zod.z.array(import_zod.z.string().min(1)).optional(),
-  strauss_superseded_by: import_zod.z.string().min(1).optional(),
-  strauss_answered: kbActorStampSchema.optional(),
-  strauss_materiality: import_zod.z.enum(KB_MATERIALITIES).optional(),
-  strauss_confidence: import_zod.z.enum(KB_CONFIDENCES).optional(),
-  strauss_owner: import_zod.z.string().min(1).optional(),
-  // "No source exists" as a field rather than a sentinel entry inside
-  // `sources`. A sentinel in a reference list is a value doing work a field
-  // should do; as a field, `sources` may be legitimately empty.
-  strauss_assumption: import_zod.z.boolean().optional()
-}).passthrough();
+  if (text.includes("couldn't find remote ref") || text.includes("unadvertised object") || text.includes("not our ref")) {
+    return "ref-not-found";
+  }
+  return "remote-unreachable";
+}
 
-// src/record-types.ts
-var RECORD_TYPES = {
-  fact: {
-    purpose: "Observed or sourced fact",
-    sections: ["Claim", "Evidence", "Implication"],
-    initialStatus: "accepted"
-  },
-  requirement: {
-    purpose: "Required behavior or outcome",
-    sections: ["Claim", "Evidence", "Implication"],
-    initialStatus: "proposed"
-  },
-  constraint: {
-    purpose: "Limitation, compatibility boundary, policy, or restriction",
-    sections: ["Claim", "Evidence", "Implication"],
-    initialStatus: "accepted"
-  },
-  decision: {
-    purpose: "Chosen or proposed direction",
-    sections: ["Decision", "Rationale", "Rejected", "Impact"],
-    initialStatus: "accepted"
-  },
-  assumption: {
-    purpose: "Unsourced or not-yet-confirmed working assumption",
-    sections: ["Claim", "Why we think so", "What would falsify it"],
-    initialStatus: "draft"
-  },
-  "open-question": {
-    purpose: "Question needing resolution",
-    sections: ["Question", "Why it matters", "Default assumption"],
-    initialStatus: "open"
-  },
-  risk: {
-    purpose: "Something that can go wrong",
-    sections: ["Risk", "Why it matters", "Mitigation", "Verification"],
-    initialStatus: "open"
-  },
-  contract: {
-    purpose: "API, data, event, schema, or permission contract",
-    sections: ["Contract", "Producer", "Consumer", "Compatibility"],
-    initialStatus: "proposed"
-  },
-  flow: {
-    purpose: "Sequence, lifecycle, or state behavior",
-    sections: ["Flow", "Trigger", "Steps", "Failure modes"],
-    initialStatus: "accepted"
-  },
-  "affected-system": {
-    purpose: "Component, service, package, integration, or external system",
-    sections: ["System", "How it is affected", "Blast radius"],
-    initialStatus: "accepted"
-  },
-  "test-obligation": {
-    purpose: "Behavior or contract that must be verified",
-    sections: ["Obligation", "Why it matters", "How to verify"],
-    initialStatus: "open"
-  },
-  "source-note": {
-    purpose: "Extracted note from source material",
-    sections: ["Note", "Where it came from"],
-    initialStatus: "accepted"
-  }
-};
-function isKbRecordType(value) {
-  return Object.prototype.hasOwnProperty.call(RECORD_TYPES, value);
+// src/remote-repo/validate.ts
+var MAX_REF_LENGTH = 200;
+var REF_SHAPE = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+function refShapeIsSafe(ref) {
+  if (!ref || ref.length > MAX_REF_LENGTH) return false;
+  if (ref.includes("..")) return false;
+  return REF_SHAPE.test(ref);
 }
-var KB_LINK_RELS = [
-  "depends_on",
-  "constrains",
-  "informs",
-  "blocks",
-  "invalidates",
-  "verified_by",
-  "satisfies",
-  "related_to"
-];
-var LINK_RELS = {
-  depends_on: {
-    purpose: "The source needs the target to hold; the source breaks if the target changes",
-    phrase: "Depends on",
-    dependant: "source"
-  },
-  constrains: {
-    purpose: "The source bounds what the target may do; the target breaks if the constraint changes",
-    phrase: "Constrains",
-    dependant: "target"
-  },
-  informs: {
-    purpose: "The source shaped the target without binding it; the target is what needs revisiting",
-    phrase: "Informs",
-    dependant: "target"
-  },
-  blocks: {
-    purpose: "The target cannot proceed until the source is settled; the target is what waits",
-    phrase: "Blocks",
-    dependant: "target"
-  },
-  invalidates: {
-    purpose: "The source makes the target no longer hold; the target is what stops holding",
-    phrase: "Invalidates",
-    dependant: "target"
-  },
-  verified_by: {
-    purpose: "The target is the check that confirms the source; the source's confirmation moves with it",
-    phrase: "Verified by",
-    dependant: "source"
-  },
-  satisfies: {
-    purpose: "The source discharges the target's requirement; the source must change if the requirement does",
-    phrase: "Satisfies",
-    dependant: "source"
-  },
-  related_to: {
-    purpose: "A pointer worth following, with no claim of dependence",
-    phrase: "Relates to",
-    dependant: null
-  }
-};
-var KB_CAUSAL_LINK_RELS = KB_LINK_RELS.filter(
-  (rel) => LINK_RELS[rel].dependant !== null
-);
-function isKbLinkRel(value) {
-  return Object.prototype.hasOwnProperty.call(LINK_RELS, value);
+function localRevShapeIsSafe(rev) {
+  if (!rev || rev.length > MAX_REF_LENGTH) return false;
+  if (rev.includes("..")) return false;
+  return /^[A-Za-z0-9][A-Za-z0-9._/^~-]*$/.test(rev);
 }
-
-// src/compose.ts
-var composeLinkSchema = import_zod2.z.object({
-  target: kbConceptIdSchema,
-  rel: import_zod2.z.enum(KB_LINK_RELS)
-}).strict();
-var composeInputSchema = import_zod2.z.object({
-  slug: import_zod2.z.string().min(1),
-  /** One line, in the reader's terms. Becomes OKF `title`. */
-  title: import_zod2.z.string().min(1),
-  /** The consequence — what breaks if this is wrong. Becomes `description`. */
-  why: import_zod2.z.string().min(1),
-  /** Keyed by section heading from the type's spec. Unknown keys rejected. */
-  sections: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.string().min(1)).optional(),
-  anchors: import_zod2.z.array(kbAnchorWriteSchema).optional(),
-  sources: import_zod2.z.array(kbSourceSchema).optional(),
-  /** No source exists, as a claim rather than a sentinel in `sources`. */
-  assumption: import_zod2.z.boolean().optional(),
-  /**
-   * OKF `stale_after`: the absolute date this record stops being trusted.
-   * Anything the outside world can change — pricing, quotas, versions,
-   * reception counts — should carry one.
-   */
-  stale_after: import_zod2.z.string().regex(/^\d{4}-\d{2}-\d{2}$/, {
-    message: "stale_after must be YYYY-MM-DD"
-  }).refine((date) => !Number.isNaN(Date.parse(date)), {
-    message: "stale_after must be a real date"
-  }).optional(),
-  verify: import_zod2.z.array(import_zod2.z.string().min(1)).optional(),
-  tags: import_zod2.z.array(import_zod2.z.string().min(1)).optional(),
-  /** Concept ids this record relates to; rendered as body links. */
-  relatedConceptIds: import_zod2.z.array(kbConceptIdSchema).optional(),
-  /**
-   * Typed causal edges, source → target: `{ target: "fact.b", rel:
-   * "depends_on" }` on record A says A needs B. Stored in frontmatter and
-   * also rendered as one prose sentence each, so the meaning survives a
-   * reader that knows only OKF. The vocabulary goes into the description from
-   * the same table the walk uses, so `kb_schema` emits it.
-   */
-  links: import_zod2.z.array(composeLinkSchema).max(64).optional().describe(
-    `Typed causal edges, source \u2192 target \u2014 a link on this record says this record <rel> the target. ${KB_LINK_RELS.map(
-      (rel) => `${rel}: ${LINK_RELS[rel].purpose}`
-    ).join("; ")}.`
-  ),
-  /** Concept ids this record replaces. The store settles the backlinks. */
-  supersedes: import_zod2.z.array(kbConceptIdSchema).max(32).optional(),
-  materiality: import_zod2.z.enum(KB_MATERIALITIES).optional(),
-  confidence: import_zod2.z.enum(KB_CONFIDENCES).optional(),
-  owner: import_zod2.z.string().min(1).optional()
-}).strict();
-function composeRecord(type, input, writtenBy, writtenAt) {
-  const parsed = composeInputSchema.parse(input);
-  const spec = RECORD_TYPES[type];
-  const sections = parsed.sections ?? {};
-  const unknown = Object.keys(sections).filter(
-    (heading) => !spec.sections.includes(heading)
-  );
-  if (unknown.length) {
-    throw new Error(
-      `kb: ${type} has no section ${unknown.join(", ")} \u2014 expected one of ${spec.sections.join(", ")}`
-    );
-  }
-  const frontmatter = {
-    title: parsed.title,
-    description: parsed.why,
-    generated: { by: writtenBy, at: writtenAt },
-    // Empty rather than absent: a later verification pass appends here, and an
-    // empty list says "not yet verified" where a missing key would only say
-    // "this producer didn't think about it".
-    verified: [],
-    strauss_status: spec.initialStatus
-  };
-  if (parsed.stale_after) frontmatter.stale_after = parsed.stale_after;
-  if (parsed.anchors?.length) frontmatter.strauss_anchors = parsed.anchors;
-  if (parsed.verify?.length) frontmatter.strauss_verify = parsed.verify;
-  if (parsed.tags?.length) frontmatter.tags = parsed.tags;
-  if (parsed.sources?.length) frontmatter.sources = parsed.sources;
-  if (parsed.assumption) frontmatter.strauss_assumption = true;
-  if (parsed.materiality) frontmatter.strauss_materiality = parsed.materiality;
-  if (parsed.confidence) frontmatter.strauss_confidence = parsed.confidence;
-  if (parsed.owner) frontmatter.strauss_owner = parsed.owner;
-  if (parsed.supersedes?.length)
-    frontmatter.strauss_supersedes = parsed.supersedes;
-  const selfLink = parsed.links?.find(
-    (link2) => link2.target === `${type}.${parsed.slug}`
-  );
-  if (selfLink) {
-    throw new Error(
-      `kb: ${type}.${parsed.slug} cannot ${selfLink.rel} itself \u2014 a link must name another record`
-    );
-  }
-  if (parsed.links?.length) frontmatter.strauss_links = parsed.links;
-  const blocks = [];
-  for (const heading of spec.sections) {
-    const text = sections[heading];
-    if (text) blocks.push(`## ${heading}
-
-${text}`);
-  }
-  if (!blocks.length) blocks.push(parsed.why);
-  for (const related of parsed.relatedConceptIds ?? []) {
-    blocks.push(`Relates to [${related}](${related}.md).`);
-  }
-  for (const link2 of parsed.links ?? []) {
-    blocks.push(
-      `${LINK_RELS[link2.rel].phrase} [${link2.target}](${link2.target}.md).`
-    );
-  }
-  if (parsed.sources?.length) {
-    blocks.push(
-      parsed.sources.map((source) => `[^${source.id}]: ${source.title ?? source.resource}`).join("\n")
-    );
-  }
-  return {
-    type,
-    slug: parsed.slug,
-    frontmatter,
-    body: `${blocks.join("\n\n")}
-`
-  };
+async function refIsWellFormed(ref) {
+  if (!refShapeIsSafe(ref)) return false;
+  const checked = await git(["check-ref-format", "--allow-onelevel", ref]);
+  return checked.ok;
 }
-
-// src/decision-record.ts
-var DECISION_TYPE = "decision";
-var NO_DECISION_SLUG = "none";
-var decisionInputSchema = composeInputSchema.omit({ sections: true }).extend({
-  alternative: import_zod3.z.string().min(1).optional(),
-  impact: import_zod3.z.string().min(1).optional()
-}).strict();
-function composeDecisionRecord(input, writtenBy, writtenAt) {
-  const { alternative, impact: impact2, ...rest } = input;
-  return composeRecord(
-    DECISION_TYPE,
-    {
-      ...rest,
-      sections: {
-        Decision: input.title,
-        Rationale: input.why,
-        ...alternative ? { Rejected: alternative } : {},
-        ...impact2 ? { Impact: impact2 } : {}
-      }
-    },
-    writtenBy,
-    writtenAt
-  );
+function filePathIsSafe(file) {
+  const path = file.replace(/^\.\//, "");
+  if (!path || path.startsWith("-") || path.includes("\0")) return false;
+  return !path.split("/").includes("..");
 }
-function composeNoDecisionRecord(reason, writtenBy, writtenAt) {
-  return composeRecord(
-    DECISION_TYPE,
-    {
-      slug: NO_DECISION_SLUG,
-      title: "No decision to record",
-      why: reason,
-      sections: { Decision: reason }
-    },
-    writtenBy,
-    writtenAt
-  );
+var DEFAULT_PROTOCOLS = ["https", "ssh", "git"];
+function allowedProtocols() {
+  const raw = process.env["STRAUSS_KB_REPO_PROTOCOLS"];
+  if (raw === void 0) return [...DEFAULT_PROTOCOLS];
+  const listed = raw.split(",").map((entry) => entry.trim().toLowerCase()).filter(Boolean);
+  return listed.length ? listed : [...DEFAULT_PROTOCOLS];
 }
-function isNoDecisionRecord(record) {
-  return record.conceptId === `${DECISION_TYPE}.${NO_DECISION_SLUG}`;
+function isShortRepoName(repo) {
+  return /^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(repo.trim());
 }
-function selectDecisions(records) {
-  return records.filter(
-    (record) => record.conceptId.startsWith(`${DECISION_TYPE}.`) && !isNoDecisionRecord(record)
-  );
-}
-
-// src/commands/anchor-resolve.ts
-var import_zod7 = require("zod");
-
-// src/concurrency.ts
-var DEFAULT_IO_CONCURRENCY = 16;
-async function mapLimit(items, limit, fn) {
-  if (!Number.isInteger(limit) || limit < 1) {
-    throw new RangeError(
-      `mapLimit: "limit" must be a positive integer, got ${limit}`
-    );
-  }
-  const out = new Array(items.length);
-  let next = 0;
-  let failed = false;
-  const runners = Array.from(
-    { length: Math.min(limit, items.length) },
-    async () => {
-      while (!failed && next < items.length) {
-        const at2 = next++;
-        try {
-          out[at2] = await fn(items[at2], at2);
-        } catch (error) {
-          failed = true;
-          throw error;
-        }
-      }
-    }
-  );
-  await Promise.all(runners);
-  return out;
-}
-
-// src/drift/git.ts
-var import_node_child_process2 = require("child_process");
-var import_node_util2 = require("util");
-
-// src/remote-repo/git.ts
-var import_node_child_process = require("child_process");
-var import_node_util = require("util");
-
-// src/anchor-resolver/model.ts
-var MAX_ANCHOR_FILE_BYTES = 1048576;
-
-// src/remote-repo/git.ts
-var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
-function childEnv() {
-  const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
-  for (const name of ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE"]) {
-    delete env[name];
-  }
-  return env;
-}
-async function git(args, options = {}) {
-  try {
-    const { stdout, stderr } = await execFileAsync("git", args, {
-      ...options.cwd ? { cwd: options.cwd } : {},
-      timeout: options.timeoutMs ?? 3e4,
-      maxBuffer: options.maxBytes ?? MAX_ANCHOR_FILE_BYTES,
-      encoding: "utf8",
-      windowsHide: true,
-      env: childEnv()
-    });
-    return { ok: true, stdout, stderr, overflowed: false };
-  } catch (error) {
-    const failure = error;
-    return {
-      ok: false,
-      stdout: failure.stdout ?? "",
-      stderr: failure.stderr ?? "",
-      overflowed: failure.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER"
-    };
-  }
-}
-function transportReason(stderr) {
-  const text = stderr.toLowerCase();
-  if (text.includes("authentication failed") || text.includes("permission denied") || text.includes("could not read username") || text.includes("403 forbidden") || text.includes("access denied")) {
-    return "repo-unauthorized";
-  }
-  if (text.includes("couldn't find remote ref") || text.includes("unadvertised object") || text.includes("not our ref")) {
-    return "ref-not-found";
-  }
-  return "remote-unreachable";
-}
-
-// src/remote-repo/validate.ts
-var MAX_REF_LENGTH = 200;
-var REF_SHAPE = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
-function refShapeIsSafe(ref) {
-  if (!ref || ref.length > MAX_REF_LENGTH) return false;
-  if (ref.includes("..")) return false;
-  return REF_SHAPE.test(ref);
-}
-function localRevShapeIsSafe(rev) {
-  if (!rev || rev.length > MAX_REF_LENGTH) return false;
-  if (rev.includes("..")) return false;
-  return /^[A-Za-z0-9][A-Za-z0-9._/^~-]*$/.test(rev);
-}
-async function refIsWellFormed(ref) {
-  if (!refShapeIsSafe(ref)) return false;
-  const checked = await git(["check-ref-format", "--allow-onelevel", ref]);
-  return checked.ok;
-}
-function filePathIsSafe(file) {
-  const path = file.replace(/^\.\//, "");
-  if (!path || path.startsWith("-") || path.includes("\0")) return false;
-  return !path.split("/").includes("..");
-}
-var DEFAULT_PROTOCOLS = ["https", "ssh", "git"];
-function allowedProtocols() {
-  const raw = process.env["STRAUSS_KB_REPO_PROTOCOLS"];
-  if (raw === void 0) return [...DEFAULT_PROTOCOLS];
-  const listed = raw.split(",").map((entry) => entry.trim().toLowerCase()).filter(Boolean);
-  return listed.length ? listed : [...DEFAULT_PROTOCOLS];
-}
-function isShortRepoName(repo) {
-  return /^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(repo.trim());
-}
-var SCP_LIKE = /^[\w.-]+@[\w.-]+:(?!\/)\S+$/;
-var URL_SCHEME = /^([A-Za-z0-9+.-]+):\/\//;
-var CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
-function repoUrlIsSafe(repo) {
-  const url = repo.trim();
-  if (!url || url.startsWith("-") || CONTROL_CHARS.test(url)) return false;
-  const allowed = allowedProtocols();
-  if (SCP_LIKE.test(url)) return allowed.includes("ssh");
-  const scheme = URL_SCHEME.exec(url);
-  if (!scheme?.[1]) return false;
-  if (!allowed.includes(scheme[1].toLowerCase())) return false;
-  const authority = url.slice(scheme[0].length).split("/")[0] ?? "";
-  const at2 = authority.lastIndexOf("@");
-  return at2 < 0 || !authority.slice(0, at2).includes(":");
+var SCP_LIKE = /^[\w.-]+@[\w.-]+:(?!\/)\S+$/;
+var URL_SCHEME = /^([A-Za-z0-9+.-]+):\/\//;
+var CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+function repoUrlIsSafe(repo) {
+  const url = repo.trim();
+  if (!url || url.startsWith("-") || CONTROL_CHARS.test(url)) return false;
+  const allowed = allowedProtocols();
+  if (SCP_LIKE.test(url)) return allowed.includes("ssh");
+  const scheme = URL_SCHEME.exec(url);
+  if (!scheme?.[1]) return false;
+  if (!allowed.includes(scheme[1].toLowerCase())) return false;
+  const authority = url.slice(scheme[0].length).split("/")[0] ?? "";
+  const at2 = authority.lastIndexOf("@");
+  return at2 < 0 || !authority.slice(0, at2).includes(":");
 }
 function protocolArgs() {
   const allowed = allowedProtocols();
@@ -1327,26 +849,26 @@ var import_node_path4 = require("path");
 var import_node_url = require("url");
 
 // src/grammars/model.ts
-var import_zod4 = require("zod");
-var sha2562 = import_zod4.z.string().regex(/^[0-9a-f]{64}$/);
-var grammarWasmSchema = import_zod4.z.object({
-  url: import_zod4.z.string().min(1),
+var import_zod = require("zod");
+var sha2562 = import_zod.z.string().regex(/^[0-9a-f]{64}$/);
+var grammarWasmSchema = import_zod.z.object({
+  url: import_zod.z.string().min(1),
   sha256: sha2562,
-  bytes: import_zod4.z.number().int().positive()
+  bytes: import_zod.z.number().int().positive()
 });
-var grammarTagsSchema = import_zod4.z.object({ url: import_zod4.z.string().min(1), sha256: sha2562 });
-var grammarPackSchema = import_zod4.z.object({
-  package: import_zod4.z.string().min(1),
+var grammarTagsSchema = import_zod.z.object({ url: import_zod.z.string().min(1), sha256: sha2562 });
+var grammarPackSchema = import_zod.z.object({
+  package: import_zod.z.string().min(1),
   wasm: grammarWasmSchema,
-  tags: import_zod4.z.array(grammarTagsSchema),
-  license: import_zod4.z.string().min(1),
-  extensions: import_zod4.z.array(import_zod4.z.string().min(1))
+  tags: import_zod.z.array(grammarTagsSchema),
+  license: import_zod.z.string().min(1),
+  extensions: import_zod.z.array(import_zod.z.string().min(1))
 });
-var grammarManifestSchema = import_zod4.z.object({
+var grammarManifestSchema = import_zod.z.object({
   /** The runtime the packs were proved against. */
-  webTreeSitter: import_zod4.z.string().min(1),
-  linguist: import_zod4.z.object({ tag: import_zod4.z.string().min(1), commit: import_zod4.z.string().min(1) }),
-  packs: import_zod4.z.record(import_zod4.z.string().min(1), grammarPackSchema)
+  webTreeSitter: import_zod.z.string().min(1),
+  linguist: import_zod.z.object({ tag: import_zod.z.string().min(1), commit: import_zod.z.string().min(1) }),
+  packs: import_zod.z.record(import_zod.z.string().min(1), grammarPackSchema)
 });
 
 // src/grammars/manifest.ts
@@ -1968,321 +1490,908 @@ function distanceToParent(lines, index2, parent) {
   for (let at2 = index2; at2 >= floor; at2--) {
     if (parent.test(lines[at2] ?? "")) return index2 - at2;
   }
-  return Number.POSITIVE_INFINITY;
+  return Number.POSITIVE_INFINITY;
+}
+function hashAnchorText(text) {
+  return `sha256:${(0, import_node_crypto3.createHash)("sha256").update(text.replace(/\r\n/g, "\n")).digest("hex")}`;
+}
+function resolveAnchorSpan(source, anchor, resolvers = [regexResolver]) {
+  const normalized = source.replace(/\r\n/g, "\n");
+  if (anchor.span) return sliceSpan(normalized, anchor.span);
+  if (!anchor.symbol) {
+    const lines = normalized.split("\n");
+    if (lines.length > 1 && lines[lines.length - 1] === "") lines.pop();
+    return {
+      ok: true,
+      span: {
+        text: normalized,
+        startLine: 1,
+        endLine: Math.max(1, lines.length)
+      }
+    };
+  }
+  let afterParsedMiss = false;
+  for (const resolver of resolvers) {
+    const attempt = resolver.attempt ? resolver.attempt(normalized, anchor.symbol, anchor.file, {
+      afterParsedMiss
+    }) : fromResolve(resolver, normalized, anchor.symbol, anchor.file);
+    if (attempt.kind === "abstain") continue;
+    if (attempt.kind === "unresolved") {
+      if (attempt.reason === "symbol-not-found") {
+        if (resolver.attempt) afterParsedMiss = true;
+        continue;
+      }
+      return { ok: false, reason: attempt.reason };
+    }
+    const tokens2 = resolver.normalize?.(attempt.span.text, anchor.file);
+    return {
+      ok: true,
+      span: attempt.span,
+      ...isResolverName(resolver.name) ? { resolver: resolver.name } : {},
+      ...tokens2 ? { normalized: tokens2 } : {}
+    };
+  }
+  return { ok: false, reason: "symbol-not-found" };
+}
+function sliceSpan(source, range) {
+  const lines = source.split("\n");
+  if (lines.length > 1 && lines[lines.length - 1] === "") lines.pop();
+  if (range.end > lines.length) {
+    return { ok: false, reason: "span-out-of-range" };
+  }
+  return {
+    ok: true,
+    span: {
+      text: lines.slice(range.start - 1, range.end).join("\n"),
+      startLine: range.start,
+      endLine: range.end
+    },
+    resolver: "span"
+  };
+}
+function fromResolve(resolver, source, symbol, file) {
+  const span2 = resolver.resolve(source, symbol, file);
+  return span2 ? { kind: "resolved", span: span2 } : { kind: "unresolved", reason: "symbol-not-found" };
+}
+function isResolverName(name) {
+  return name === "tree-sitter" || name === "regex" || name === "span";
+}
+async function prepareResolvers(resolvers, files) {
+  for (const resolver of resolvers) await resolver.prepare?.(files);
+}
+function defaultAnchorResolvers(grammars = {}) {
+  return [new TreeSitterResolver(grammars), regexResolver];
+}
+function resolverChanged(source, anchor, produced) {
+  const previous = anchor.resolver ?? "regex";
+  if (!produced || !anchor.symbol || previous === produced) return false;
+  if (previous !== "regex") return false;
+  const before = regexResolver.resolve(
+    source.replace(/\r\n/g, "\n"),
+    anchor.symbol
+  );
+  return before !== null && hashAnchorText(before.text) === anchor.hash;
+}
+function anchorHashOf(anchor, outcome) {
+  if (outcome.resolver === "span") {
+    return { hash: hashAnchorText(outcome.span.text), kind: "raw" };
+  }
+  const stored = anchor.hash ? anchor.hash_kind ?? "raw" : void 0;
+  const wanted = stored ?? (outcome.normalized ? "ast" : "raw");
+  return wanted === "ast" && outcome.normalized ? { hash: hashAnchorText(outcome.normalized), kind: "ast" } : { hash: hashAnchorText(outcome.span.text), kind: "raw" };
+}
+
+// src/anchor-resolver/drift.ts
+async function detectAnchorDrift(records, options = {}) {
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const resolvers = options.resolvers ?? (options.resolver ? [options.resolver] : defaultAnchorResolvers({
+    offline: options.remote?.offline === true
+  }));
+  const origin = new LazyOrigin(repoRoot);
+  const planned = /* @__PURE__ */ new Map();
+  let declaresRepo = false;
+  for (const record of records) {
+    const anchors = (record.frontmatter.strauss_anchors ?? []).filter(
+      (anchor) => anchor.hash
+    );
+    if (!anchors.length) continue;
+    if (anchors.some((anchor) => anchor.repo)) declaresRepo = true;
+    planned.set(
+      record.conceptId,
+      anchors.map((anchor) => ({ anchor, foreign: false }))
+    );
+  }
+  if (declaresRepo) {
+    await origin.prime();
+    for (const entries of planned.values()) {
+      for (const entry of entries)
+        entry.foreign = origin.isForeign(entry.anchor);
+    }
+  }
+  const files = [];
+  const committedWants = [];
+  const wants = [];
+  for (const entries of planned.values()) {
+    for (const { anchor, foreign } of entries) {
+      if (foreign) wants.push(...remoteWants(anchor));
+      else if (anchor.side === "old") committedWants.push(anchor);
+      else files.push(anchor.file);
+    }
+  }
+  const [reads, committed, remote] = await Promise.all([
+    readAnchorFiles(
+      files,
+      options.reader ?? anchorFileReader(repoRoot),
+      options.concurrency ?? DEFAULT_IO_CONCURRENCY
+    ),
+    readCommitted(repoRoot, committedWants, options),
+    (options.readRemote ?? readRemoteAnchors)(wants, options.remote ?? {})
+  ]);
+  await prepareResolvers(resolvers, [
+    ...files,
+    ...committedWants.map((anchor) => anchor.file),
+    ...wants.map((want) => want.file)
+  ]);
+  const drift = /* @__PURE__ */ new Map();
+  for (const record of records) {
+    const entries = [];
+    for (const { anchor, foreign } of planned.get(record.conceptId) ?? []) {
+      if (foreign) {
+        entries.push(remoteEntry(anchor, remote, resolvers));
+        continue;
+      }
+      const read = anchor.side === "old" ? committed.get(atRefKey(anchor)) : reads.get(anchor.file);
+      entries.push(localEntry(anchor, read, resolvers));
+    }
+    if (entries.length) drift.set(record.conceptId, entries);
+  }
+  return drift;
+}
+function atRefKey(anchor) {
+  return `${anchor.ref ?? ""}\0${anchor.file}`;
+}
+async function readCommitted(repoRoot, anchors, options = {}) {
+  if (!anchors.length) return /* @__PURE__ */ new Map();
+  const read = options.readAtRef ?? readFileAtRef;
+  const byKey = /* @__PURE__ */ new Map();
+  for (const anchor of anchors) byKey.set(atRefKey(anchor), anchor);
+  const keys = [...byKey.keys()];
+  const results = await mapLimit(
+    keys,
+    options.concurrency ?? DEFAULT_IO_CONCURRENCY,
+    (key2) => read(repoRoot, byKey.get(key2))
+  );
+  return new Map(keys.map((key2, at2) => [key2, results[at2]]));
+}
+function remoteWants(anchor) {
+  const repo = anchor.repo;
+  const wants = [{ repo, file: anchor.file }];
+  if (anchor.ref) wants.unshift({ repo, ref: anchor.ref, file: anchor.file });
+  return wants;
+}
+function base(anchor) {
+  return {
+    file: anchor.file,
+    ...anchor.symbol ? { symbol: anchor.symbol } : {},
+    ...anchor.side === "old" ? { side: "old" } : {},
+    storedHash: anchor.hash
+  };
+}
+function unresolved(anchor, reason, repo) {
+  return {
+    ...base(anchor),
+    state: "unresolved",
+    diffSize: null,
+    ...reason ? { reason } : {},
+    ...repo ? { repo } : {},
+    ...classOf(reason)
+  };
+}
+var GONE_REASONS = /* @__PURE__ */ new Set([
+  "file-missing",
+  "symbol-not-found",
+  "span-out-of-range",
+  "ref-unreadable"
+]);
+function provisionalDriftClass(entry) {
+  if (entry.state === "unresolved") {
+    return GONE_REASONS.has(entry.reason) ? "gone" : void 0;
+  }
+  return entry.state === "drifted" ? "changed" : void 0;
+}
+function classOf(reason) {
+  const settled = provisionalDriftClass({ state: "unresolved", reason });
+  return settled ? { class: settled } : {};
+}
+function hashIn(source, anchor, resolvers) {
+  const outcome = resolveAnchorSpan(source, anchor, resolvers);
+  if (!outcome.ok) return { ok: false, reason: outcome.reason };
+  const { hash, kind } = anchorHashOf(anchor, outcome);
+  return {
+    ok: true,
+    current: {
+      hash,
+      kind,
+      lines: outcome.span.endLine - outcome.span.startLine + 1,
+      ...outcome.resolver ? { resolver: outcome.resolver } : {}
+    }
+  };
+}
+function resolverExtras(source, anchor, current) {
+  return {
+    ...current.resolver ? { resolver: current.resolver } : {},
+    ...current.hash !== anchor.hash && resolverChanged(source, anchor, current.resolver) ? { reason: "resolver-changed" } : {}
+  };
+}
+function compared(anchor, current, extra = {}) {
+  const matched = current.hash === anchor.hash;
+  return {
+    ...base(anchor),
+    state: matched ? "match" : "drifted",
+    currentHash: current.hash,
+    hashKind: current.kind,
+    diffSize: anchor.lines === void 0 ? null : Math.abs(current.lines - anchor.lines),
+    ...matched ? {} : { class: "changed" },
+    ...extra
+  };
+}
+function localEntry(anchor, read, resolvers) {
+  if (!read.ok) return unresolved(anchor, read.reason);
+  const found = hashIn(read.source, anchor, resolvers);
+  if (!found.ok) return unresolved(anchor, found.reason);
+  return compared(
+    anchor,
+    found.current,
+    resolverExtras(read.source, anchor, found.current)
+  );
+}
+function remoteEntry(anchor, remote, resolvers) {
+  const repo = anchor.repo;
+  const key2 = normalizeRepoUrl(repo);
+  const atDefault = remote.get(wantKey(key2, void 0, anchor.file));
+  const primary = anchor.ref ? remote.get(wantKey(key2, anchor.ref, anchor.file)) : atDefault;
+  if (!primary) return unresolved(anchor, "remote-unreachable", repo);
+  if (!primary.ok) return unresolved(anchor, primary.reason, repo);
+  const found = hashIn(primary.source, anchor, resolvers);
+  if (!found.ok) return unresolved(anchor, found.reason, repo);
+  const current = found.current;
+  const extras = resolverExtras(primary.source, anchor, current);
+  if (!anchor.ref) return compared(anchor, current, { repo, ...extras });
+  if (current.hash !== anchor.hash) {
+    return compared(anchor, current, {
+      repo,
+      ...extras,
+      remoteState: "drifted-from-ref"
+    });
+  }
+  if (anchor.side === "old") {
+    return compared(anchor, current, {
+      repo,
+      ...extras,
+      remoteState: "matches-ref"
+    });
+  }
+  const head = atDefault?.ok ? hashIn(atDefault.source, anchor, resolvers) : null;
+  return head?.ok && head.current.hash !== anchor.hash ? {
+    ...compared(anchor, head.current, {
+      repo,
+      ...head.current.resolver ? { resolver: head.current.resolver } : {}
+    }),
+    state: "drifted",
+    remoteState: "drifted-on-default"
+  } : compared(anchor, current, {
+    repo,
+    ...extras,
+    remoteState: "matches-ref"
+  });
+}
+
+// src/kb-record.schema.ts
+var import_zod2 = require("zod");
+var kbSourceSchema = import_zod2.z.object({
+  id: import_zod2.z.string().min(1),
+  resource: import_zod2.z.string().min(1),
+  title: import_zod2.z.string().min(1).optional(),
+  author: import_zod2.z.string().min(1).optional(),
+  last_modified: import_zod2.z.string().min(1).optional()
+}).passthrough();
+var kbActorStampSchema = import_zod2.z.object({
+  by: import_zod2.z.string().min(1),
+  at: import_zod2.z.string().min(1)
+}).passthrough();
+var kbVerifiedEventSchema = kbActorStampSchema.extend({
+  note: import_zod2.z.string().refine((s) => s.trim().length > 0, {
+    message: "note must say what the check found"
+  })
+});
+var kbAnchorSpanSchema = import_zod2.z.object({
+  start: import_zod2.z.number().int().positive(),
+  end: import_zod2.z.number().int().positive()
+}).strict();
+var kbAnchorSchema = import_zod2.z.object({
+  file: import_zod2.z.string().min(1),
+  symbol: import_zod2.z.string().min(1).optional(),
+  /**
+   * The lines the concept names, when no symbol covers them — deleted code,
+   * YAML, SQL, Markdown. Alternative to `symbol`, never a refinement of it.
+   */
+  span: kbAnchorSpanSchema.optional(),
+  /**
+   * Which side of the change the anchor describes. `old` is code as it was
+   * committed at `ref`, which is the only way to anchor something deleted;
+   * absent means the working tree.
+   */
+  side: import_zod2.z.enum(["old", "new"]).optional(),
+  /**
+   * Which repository the file lives in — a remote URL
+   * (`https://github.com/org/name`) or a short name. Absent means the base's
+   * own repository, which is what nearly every anchor means.
+   *
+   * Unvalidated beyond not-blank: one repository has many spellings, matched
+   * after normalisation. Only a full URL can be fetched from, so `validate`
+   * warns on a short one; see ARCHITECTURE.
+   */
+  repo: import_zod2.z.string().trim().min(1).optional(),
+  /**
+   * The git rev the evidence was taken at. Prefer a commit SHA: a branch
+   * name is a moving pointer, so an anchor pinned to one says the evidence
+   * came from wherever that branch happens to be now, which is not a
+   * baseline. A foreign anchor is checked at this rev, and compared against
+   * the remote's default branch on top of it.
+   */
+  ref: import_zod2.z.string().trim().min(1).optional(),
+  hash: import_zod2.z.string().regex(/^sha256:[0-9a-f]{64}$/, {
+    message: "hash must be sha256:<64 hex chars>"
+  }).optional(),
+  /**
+   * What `hash` was taken over: the span's raw text, or the normalised token
+   * stream a parser sees (`ast`). Absent means `raw`, which is what every
+   * anchor stamped before this field carries, so old hashes keep comparing
+   * the way they were written. An `ast` hash is blind to whitespace and
+   * comments, so reformatting the anchored code is not drift.
+   */
+  hash_kind: import_zod2.z.enum(["raw", "ast"]).optional(),
+  /** ISO 8601 timestamp of the last successful resolution. */
+  resolved_at: import_zod2.z.string().min(1).optional(),
+  /** Line count of the text the hash was taken over. */
+  lines: import_zod2.z.number().int().positive().optional(),
+  /**
+   * Which resolver produced the hashed span. Absent means an anchor stamped
+   * before resolvers were named, which is read as `regex` — the only one
+   * there was. A hash from a different resolver is drift, not a match.
+   */
+  resolver: import_zod2.z.enum(["tree-sitter", "regex", "span"]).optional()
+}).strict();
+var kbAnchorWriteSchema = kbAnchorSchema.superRefine((anchor, ctx) => {
+  if (anchor.span && anchor.symbol) {
+    ctx.addIssue({
+      code: import_zod2.z.ZodIssueCode.custom,
+      path: ["span"],
+      message: "an anchor names a symbol or a span, not both"
+    });
+  }
+  if (anchor.span && anchor.span.end < anchor.span.start) {
+    ctx.addIssue({
+      code: import_zod2.z.ZodIssueCode.custom,
+      path: ["span", "end"],
+      message: "span end must not precede start"
+    });
+  }
+  if (anchor.span && anchor.hash_kind === "ast") {
+    ctx.addIssue({
+      code: import_zod2.z.ZodIssueCode.custom,
+      path: ["hash_kind"],
+      message: "a span is hashed raw, never ast"
+    });
+  }
+  if (anchor.side === "old" && !anchor.ref) {
+    ctx.addIssue({
+      code: import_zod2.z.ZodIssueCode.custom,
+      path: ["ref"],
+      message: 'side: "old" needs a ref \u2014 committed code has no other address'
+    });
+  }
+});
+var kbAnchorLocatorSchema = kbAnchorSchema.pick({
+  file: true,
+  symbol: true,
+  span: true,
+  side: true,
+  repo: true,
+  ref: true
+});
+var kbLinkSchema = import_zod2.z.object({
+  target: import_zod2.z.string().min(1),
+  rel: import_zod2.z.string().min(1)
+}).passthrough();
+var KB_RECORD_TYPES = [
+  "fact",
+  "requirement",
+  "constraint",
+  "decision",
+  "assumption",
+  "open-question",
+  "risk",
+  "contract",
+  "flow",
+  "affected-system",
+  "test-obligation",
+  "source-note"
+];
+var KB_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var KB_CONCEPT_ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*\.[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var kbConceptIdSchema = import_zod2.z.string().regex(KB_CONCEPT_ID_PATTERN, {
+  message: "concept id must be <type>.<slug>, both kebab-case"
+});
+var KB_RECORD_STATUSES = [
+  "draft",
+  "proposed",
+  "accepted",
+  "open",
+  "resolved",
+  "rejected",
+  "superseded"
+];
+var KB_MATERIALITIES = [
+  "blocking",
+  "important",
+  "non-blocking"
+];
+var KB_CONFIDENCES = ["low", "medium", "high"];
+var kbRecordFrontmatterSchema = import_zod2.z.object({
+  // OKF: the only always-required key. A concept carrying just `type` is
+  // fully conformant, so everything below stays optional.
+  type: import_zod2.z.string().min(1),
+  // OKF recommended.
+  title: import_zod2.z.string().min(1).optional(),
+  description: import_zod2.z.string().min(1).optional(),
+  resource: import_zod2.z.string().min(1).optional(),
+  tags: import_zod2.z.array(import_zod2.z.string()).optional(),
+  // OKF optional: provenance and freshness.
+  sources: import_zod2.z.array(kbSourceSchema).optional(),
+  generated: kbActorStampSchema.optional(),
+  verified: import_zod2.z.array(kbActorStampSchema).optional(),
+  stale_after: import_zod2.z.string().min(1).optional(),
+  // strauss extensions — see the module comment.
+  strauss_anchors: import_zod2.z.array(kbAnchorSchema).optional(),
+  strauss_verify: import_zod2.z.array(import_zod2.z.string().min(1)).optional(),
+  // Typed causal edges, source → target, living on the source. `A depends_on
+  // B` means A needs B, so `kb_impact` walks these inbound: what breaks if B
+  // changes is whatever declared a dependence on it.
+  strauss_links: import_zod2.z.array(kbLinkSchema).optional(),
+  // Total after parsing, tolerant before it. Our producers must supply a
+  // status — an absent one would leave every reader inventing its own default
+  // — but OKF calls a concept carrying only `type` fully conformant, so
+  // rejecting a foreign record for the lack of one would put us outside the
+  // spec. The default resolves it in the single place that can: here.
+  strauss_status: import_zod2.z.enum(KB_RECORD_STATUSES).default("draft"),
+  strauss_supersedes: import_zod2.z.array(import_zod2.z.string().min(1)).optional(),
+  strauss_superseded_by: import_zod2.z.string().min(1).optional(),
+  strauss_answered: kbActorStampSchema.optional(),
+  strauss_materiality: import_zod2.z.enum(KB_MATERIALITIES).optional(),
+  strauss_confidence: import_zod2.z.enum(KB_CONFIDENCES).optional(),
+  strauss_owner: import_zod2.z.string().min(1).optional(),
+  // "No source exists" as a field rather than a sentinel entry inside
+  // `sources`. A sentinel in a reference list is a value doing work a field
+  // should do; as a field, `sources` may be legitimately empty.
+  strauss_assumption: import_zod2.z.boolean().optional()
+}).passthrough();
+
+// src/errors.ts
+var BaseError = class extends Error {
+  code;
+  errorType;
+  fault;
+  retriable;
+  reportToUser;
+  details;
+  constructor(props) {
+    super(props.message);
+    this.name = props.name ?? this.constructor.name;
+    this.code = props.code ?? 500;
+    this.errorType = props.errorType;
+    this.fault = props.fault;
+    this.retriable = props.retriable ?? true;
+    this.reportToUser = props.reportToUser ?? false;
+    this.details = props.details;
+  }
+};
+
+// src/anchors/errors.ts
+function locatorText(locator) {
+  const span2 = locator.span ? `:${locator.span.start}-${locator.span.end}` : "";
+  const symbol = locator.symbol ? `:${cap(locator.symbol)}` : "";
+  const repo = locator.repo ? `${cap(locator.repo)}@` : "";
+  const ref = locator.ref ? `@${cap(locator.ref)}` : "";
+  return `${repo}${cap(locator.file)}${symbol}${span2}${ref}`;
 }
-function hashAnchorText(text) {
-  return `sha256:${(0, import_node_crypto3.createHash)("sha256").update(text.replace(/\r\n/g, "\n")).digest("hex")}`;
+var FIELD_CAP = 120;
+function cap(value) {
+  return value.length > FIELD_CAP ? `${value.slice(0, FIELD_CAP - 1)}\u2026` : value;
 }
-function resolveAnchorSpan(source, anchor, resolvers = [regexResolver]) {
-  const normalized = source.replace(/\r\n/g, "\n");
-  if (anchor.span) return sliceSpan(normalized, anchor.span);
-  if (!anchor.symbol) {
-    const lines = normalized.split("\n");
-    if (lines.length > 1 && lines[lines.length - 1] === "") lines.pop();
-    return {
-      ok: true,
-      span: {
-        text: normalized,
-        startLine: 1,
-        endLine: Math.max(1, lines.length)
-      }
-    };
+var KbAnchorSetDuplicateError = class extends BaseError {
+  constructor(locator) {
+    super({
+      message: `kb: ${locator} appears twice in this set \u2014 a record holds each pointer once`,
+      errorType: "KbAnchorSetDuplicate" /* KbAnchorSetDuplicate */,
+      code: 400,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details: { locator, action: "refused" }
+    });
+    this.locator = locator;
   }
-  let afterParsedMiss = false;
-  for (const resolver of resolvers) {
-    const attempt = resolver.attempt ? resolver.attempt(normalized, anchor.symbol, anchor.file, {
-      afterParsedMiss
-    }) : fromResolve(resolver, normalized, anchor.symbol, anchor.file);
-    if (attempt.kind === "abstain") continue;
-    if (attempt.kind === "unresolved") {
-      if (attempt.reason === "symbol-not-found") {
-        if (resolver.attempt) afterParsedMiss = true;
-        continue;
-      }
-      return { ok: false, reason: attempt.reason };
+  locator;
+};
+
+// src/anchors/apply.ts
+var LOCATOR_FIELDS = [
+  "file",
+  "symbol",
+  "span",
+  "side",
+  "repo",
+  "ref"
+];
+function applyAnchorSet(current, incoming) {
+  const anchors = incoming.map((anchor) => ({ ...anchor }));
+  const seen = /* @__PURE__ */ new Set();
+  for (const anchor of anchors) {
+    const key2 = locatorKey(anchor);
+    if (seen.has(key2)) {
+      throw new KbAnchorSetDuplicateError(locatorText(locatorOf(anchor)));
     }
-    const tokens2 = resolver.normalize?.(attempt.span.text, anchor.file);
-    return {
-      ok: true,
-      span: attempt.span,
-      ...isResolverName(resolver.name) ? { resolver: resolver.name } : {},
-      ...tokens2 ? { normalized: tokens2 } : {}
-    };
+    seen.add(key2);
   }
-  return { ok: false, reason: "symbol-not-found" };
+  return { anchors, changes: diff(current, anchors) };
 }
-function sliceSpan(source, range) {
-  const lines = source.split("\n");
-  if (lines.length > 1 && lines[lines.length - 1] === "") lines.pop();
-  if (range.end > lines.length) {
-    return { ok: false, reason: "span-out-of-range" };
+function diff(current, next) {
+  const before = new Map(
+    current.filter((anchor) => anchor.hash).map((a) => [a.hash, a])
+  );
+  const beforeLocators = new Map(current.map((a) => [locatorKey(a), a]));
+  const afterLocators = new Set(next.map((anchor) => locatorKey(anchor)));
+  const moved = /* @__PURE__ */ new Set();
+  const changes = [];
+  for (const anchor of next) {
+    const source = anchor.hash ? before.get(anchor.hash) : void 0;
+    if (source) {
+      if (locatorKey(source) === locatorKey(anchor)) continue;
+      moved.add(locatorKey(source));
+      changes.push({
+        op: "move",
+        from: locatorOf(source),
+        to: locatorOf(anchor)
+      });
+      continue;
+    }
+    if (beforeLocators.has(locatorKey(anchor))) continue;
+    changes.push({ op: "add", to: locatorOf(anchor) });
   }
-  return {
-    ok: true,
-    span: {
-      text: lines.slice(range.start - 1, range.end).join("\n"),
-      startLine: range.start,
-      endLine: range.end
-    },
-    resolver: "span"
-  };
-}
-function fromResolve(resolver, source, symbol, file) {
-  const span2 = resolver.resolve(source, symbol, file);
-  return span2 ? { kind: "resolved", span: span2 } : { kind: "unresolved", reason: "symbol-not-found" };
-}
-function isResolverName(name) {
-  return name === "tree-sitter" || name === "regex" || name === "span";
+  for (const anchor of current) {
+    const key2 = locatorKey(anchor);
+    if (afterLocators.has(key2) || moved.has(key2)) continue;
+    changes.push({ op: "drop", from: locatorOf(anchor) });
+  }
+  return changes;
 }
-async function prepareResolvers(resolvers, files) {
-  for (const resolver of resolvers) await resolver.prepare?.(files);
+function locatorOf(anchor) {
+  return kbAnchorLocatorSchema.parse(
+    Object.fromEntries(
+      LOCATOR_FIELDS.flatMap(
+        (field) => anchor[field] === void 0 ? [] : [[field, anchor[field]]]
+      )
+    )
+  );
 }
-function defaultAnchorResolvers(grammars = {}) {
-  return [new TreeSitterResolver(grammars), regexResolver];
+function locatorKey(anchor) {
+  return JSON.stringify([
+    anchor.file,
+    anchor.symbol ?? "",
+    anchor.span ? `${anchor.span.start}-${anchor.span.end}` : "",
+    anchor.side ?? "new",
+    anchor.repo === void 0 ? "" : normalizeRepoUrl(anchor.repo),
+    anchor.ref ?? ""
+  ]);
 }
-function resolverChanged(source, anchor, produced) {
-  const previous = anchor.resolver ?? "regex";
-  if (!produced || !anchor.symbol || previous === produced) return false;
-  if (previous !== "regex") return false;
-  const before = regexResolver.resolve(
-    source.replace(/\r\n/g, "\n"),
-    anchor.symbol
-  );
-  return before !== null && hashAnchorText(before.text) === anchor.hash;
+
+// src/record-types.ts
+var RECORD_TYPES = {
+  fact: {
+    purpose: "Observed or sourced fact",
+    sections: ["Claim", "Evidence", "Implication"],
+    initialStatus: "accepted"
+  },
+  requirement: {
+    purpose: "Required behavior or outcome",
+    sections: ["Claim", "Evidence", "Implication"],
+    initialStatus: "proposed"
+  },
+  constraint: {
+    purpose: "Limitation, compatibility boundary, policy, or restriction",
+    sections: ["Claim", "Evidence", "Implication"],
+    initialStatus: "accepted"
+  },
+  decision: {
+    purpose: "Chosen or proposed direction",
+    sections: ["Decision", "Rationale", "Rejected", "Impact"],
+    initialStatus: "accepted"
+  },
+  assumption: {
+    purpose: "Unsourced or not-yet-confirmed working assumption",
+    sections: ["Claim", "Why we think so", "What would falsify it"],
+    initialStatus: "draft"
+  },
+  "open-question": {
+    purpose: "Question needing resolution",
+    sections: ["Question", "Why it matters", "Default assumption"],
+    initialStatus: "open"
+  },
+  risk: {
+    purpose: "Something that can go wrong",
+    sections: ["Risk", "Why it matters", "Mitigation", "Verification"],
+    initialStatus: "open"
+  },
+  contract: {
+    purpose: "API, data, event, schema, or permission contract",
+    sections: ["Contract", "Producer", "Consumer", "Compatibility"],
+    initialStatus: "proposed"
+  },
+  flow: {
+    purpose: "Sequence, lifecycle, or state behavior",
+    sections: ["Flow", "Trigger", "Steps", "Failure modes"],
+    initialStatus: "accepted"
+  },
+  "affected-system": {
+    purpose: "Component, service, package, integration, or external system",
+    sections: ["System", "How it is affected", "Blast radius"],
+    initialStatus: "accepted"
+  },
+  "test-obligation": {
+    purpose: "Behavior or contract that must be verified",
+    sections: ["Obligation", "Why it matters", "How to verify"],
+    initialStatus: "open"
+  },
+  "source-note": {
+    purpose: "Extracted note from source material",
+    sections: ["Note", "Where it came from"],
+    initialStatus: "accepted"
+  }
+};
+function isKbRecordType(value) {
+  return Object.prototype.hasOwnProperty.call(RECORD_TYPES, value);
 }
-function anchorHashOf(anchor, outcome) {
-  if (outcome.resolver === "span") {
-    return { hash: hashAnchorText(outcome.span.text), kind: "raw" };
+var KB_LINK_RELS = [
+  "depends_on",
+  "constrains",
+  "informs",
+  "blocks",
+  "invalidates",
+  "verified_by",
+  "satisfies",
+  "related_to"
+];
+var LINK_RELS = {
+  depends_on: {
+    purpose: "The source needs the target to hold; the source breaks if the target changes",
+    phrase: "Depends on",
+    dependant: "source"
+  },
+  constrains: {
+    purpose: "The source bounds what the target may do; the target breaks if the constraint changes",
+    phrase: "Constrains",
+    dependant: "target"
+  },
+  informs: {
+    purpose: "The source shaped the target without binding it; the target is what needs revisiting",
+    phrase: "Informs",
+    dependant: "target"
+  },
+  blocks: {
+    purpose: "The target cannot proceed until the source is settled; the target is what waits",
+    phrase: "Blocks",
+    dependant: "target"
+  },
+  invalidates: {
+    purpose: "The source makes the target no longer hold; the target is what stops holding",
+    phrase: "Invalidates",
+    dependant: "target"
+  },
+  verified_by: {
+    purpose: "The target is the check that confirms the source; the source's confirmation moves with it",
+    phrase: "Verified by",
+    dependant: "source"
+  },
+  satisfies: {
+    purpose: "The source discharges the target's requirement; the source must change if the requirement does",
+    phrase: "Satisfies",
+    dependant: "source"
+  },
+  related_to: {
+    purpose: "A pointer worth following, with no claim of dependence",
+    phrase: "Relates to",
+    dependant: null
   }
-  const stored = anchor.hash ? anchor.hash_kind ?? "raw" : void 0;
-  const wanted = stored ?? (outcome.normalized ? "ast" : "raw");
-  return wanted === "ast" && outcome.normalized ? { hash: hashAnchorText(outcome.normalized), kind: "ast" } : { hash: hashAnchorText(outcome.span.text), kind: "raw" };
+};
+var KB_CAUSAL_LINK_RELS = KB_LINK_RELS.filter(
+  (rel) => LINK_RELS[rel].dependant !== null
+);
+function isKbLinkRel(value) {
+  return Object.prototype.hasOwnProperty.call(LINK_RELS, value);
 }
 
-// src/anchor-resolver/drift.ts
-async function detectAnchorDrift(records, options = {}) {
-  const repoRoot = options.repoRoot ?? process.cwd();
-  const resolvers = options.resolvers ?? (options.resolver ? [options.resolver] : defaultAnchorResolvers({
-    offline: options.remote?.offline === true
-  }));
-  const origin = new LazyOrigin(repoRoot);
-  const planned = /* @__PURE__ */ new Map();
-  let declaresRepo = false;
-  for (const record of records) {
-    const anchors = (record.frontmatter.strauss_anchors ?? []).filter(
-      (anchor) => anchor.hash
+// src/compose.ts
+var composeLinkSchema = import_zod3.z.object({
+  target: kbConceptIdSchema,
+  rel: import_zod3.z.enum(KB_LINK_RELS)
+}).strict();
+var composeInputSchema = import_zod3.z.object({
+  slug: import_zod3.z.string().min(1),
+  /** One line, in the reader's terms. Becomes OKF `title`. */
+  title: import_zod3.z.string().min(1),
+  /** The consequence — what breaks if this is wrong. Becomes `description`. */
+  why: import_zod3.z.string().min(1),
+  /** Keyed by section heading from the type's spec. Unknown keys rejected. */
+  sections: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.string().min(1)).optional(),
+  anchors: import_zod3.z.array(kbAnchorWriteSchema).optional(),
+  sources: import_zod3.z.array(kbSourceSchema).optional(),
+  /** No source exists, as a claim rather than a sentinel in `sources`. */
+  assumption: import_zod3.z.boolean().optional(),
+  /**
+   * OKF `stale_after`: the absolute date this record stops being trusted.
+   * Anything the outside world can change — pricing, quotas, versions,
+   * reception counts — should carry one.
+   */
+  stale_after: import_zod3.z.string().regex(/^\d{4}-\d{2}-\d{2}$/, {
+    message: "stale_after must be YYYY-MM-DD"
+  }).refine((date) => !Number.isNaN(Date.parse(date)), {
+    message: "stale_after must be a real date"
+  }).optional(),
+  verify: import_zod3.z.array(import_zod3.z.string().min(1)).optional(),
+  tags: import_zod3.z.array(import_zod3.z.string().min(1)).optional(),
+  /** Concept ids this record relates to; rendered as body links. */
+  relatedConceptIds: import_zod3.z.array(kbConceptIdSchema).optional(),
+  /**
+   * Typed causal edges, source → target: `{ target: "fact.b", rel:
+   * "depends_on" }` on record A says A needs B. Stored in frontmatter and
+   * also rendered as one prose sentence each, so the meaning survives a
+   * reader that knows only OKF. The vocabulary goes into the description from
+   * the same table the walk uses, so `kb_schema` emits it.
+   */
+  links: import_zod3.z.array(composeLinkSchema).max(64).optional().describe(
+    `Typed causal edges, source \u2192 target \u2014 a link on this record says this record <rel> the target. ${KB_LINK_RELS.map(
+      (rel) => `${rel}: ${LINK_RELS[rel].purpose}`
+    ).join("; ")}.`
+  ),
+  /** Concept ids this record replaces. The store settles the backlinks. */
+  supersedes: import_zod3.z.array(kbConceptIdSchema).max(32).optional(),
+  materiality: import_zod3.z.enum(KB_MATERIALITIES).optional(),
+  confidence: import_zod3.z.enum(KB_CONFIDENCES).optional(),
+  owner: import_zod3.z.string().min(1).optional()
+}).strict();
+function composeRecord(type, input, writtenBy, writtenAt) {
+  const parsed = composeInputSchema.parse(input);
+  const spec = RECORD_TYPES[type];
+  const sections = parsed.sections ?? {};
+  const unknown = Object.keys(sections).filter(
+    (heading) => !spec.sections.includes(heading)
+  );
+  if (unknown.length) {
+    throw new Error(
+      `kb: ${type} has no section ${unknown.join(", ")} \u2014 expected one of ${spec.sections.join(", ")}`
     );
-    if (!anchors.length) continue;
-    if (anchors.some((anchor) => anchor.repo)) declaresRepo = true;
-    planned.set(
-      record.conceptId,
-      anchors.map((anchor) => ({ anchor, foreign: false }))
+  }
+  const frontmatter = {
+    title: parsed.title,
+    description: parsed.why,
+    generated: { by: writtenBy, at: writtenAt },
+    // Empty rather than absent: a later verification pass appends here, and an
+    // empty list says "not yet verified" where a missing key would only say
+    // "this producer didn't think about it".
+    verified: [],
+    strauss_status: spec.initialStatus
+  };
+  if (parsed.stale_after) frontmatter.stale_after = parsed.stale_after;
+  if (parsed.anchors?.length) {
+    frontmatter.strauss_anchors = applyAnchorSet([], parsed.anchors).anchors;
+  }
+  if (parsed.verify?.length) frontmatter.strauss_verify = parsed.verify;
+  if (parsed.tags?.length) frontmatter.tags = parsed.tags;
+  if (parsed.sources?.length) frontmatter.sources = parsed.sources;
+  if (parsed.assumption) frontmatter.strauss_assumption = true;
+  if (parsed.materiality) frontmatter.strauss_materiality = parsed.materiality;
+  if (parsed.confidence) frontmatter.strauss_confidence = parsed.confidence;
+  if (parsed.owner) frontmatter.strauss_owner = parsed.owner;
+  if (parsed.supersedes?.length)
+    frontmatter.strauss_supersedes = parsed.supersedes;
+  const selfLink = parsed.links?.find(
+    (link2) => link2.target === `${type}.${parsed.slug}`
+  );
+  if (selfLink) {
+    throw new Error(
+      `kb: ${type}.${parsed.slug} cannot ${selfLink.rel} itself \u2014 a link must name another record`
     );
   }
-  if (declaresRepo) {
-    await origin.prime();
-    for (const entries of planned.values()) {
-      for (const entry of entries)
-        entry.foreign = origin.isForeign(entry.anchor);
-    }
+  if (parsed.links?.length) frontmatter.strauss_links = parsed.links;
+  const blocks = [];
+  for (const heading of spec.sections) {
+    const text = sections[heading];
+    if (text) blocks.push(`## ${heading}
+
+${text}`);
   }
-  const files = [];
-  const committedWants = [];
-  const wants = [];
-  for (const entries of planned.values()) {
-    for (const { anchor, foreign } of entries) {
-      if (foreign) wants.push(...remoteWants(anchor));
-      else if (anchor.side === "old") committedWants.push(anchor);
-      else files.push(anchor.file);
-    }
+  if (!blocks.length) blocks.push(parsed.why);
+  for (const related of parsed.relatedConceptIds ?? []) {
+    blocks.push(`Relates to [${related}](${related}.md).`);
   }
-  const [reads, committed, remote] = await Promise.all([
-    readAnchorFiles(
-      files,
-      options.reader ?? anchorFileReader(repoRoot),
-      options.concurrency ?? DEFAULT_IO_CONCURRENCY
-    ),
-    readCommitted(repoRoot, committedWants, options),
-    (options.readRemote ?? readRemoteAnchors)(wants, options.remote ?? {})
-  ]);
-  await prepareResolvers(resolvers, [
-    ...files,
-    ...committedWants.map((anchor) => anchor.file),
-    ...wants.map((want) => want.file)
-  ]);
-  const drift = /* @__PURE__ */ new Map();
-  for (const record of records) {
-    const entries = [];
-    for (const { anchor, foreign } of planned.get(record.conceptId) ?? []) {
-      if (foreign) {
-        entries.push(remoteEntry(anchor, remote, resolvers));
-        continue;
-      }
-      const read = anchor.side === "old" ? committed.get(atRefKey(anchor)) : reads.get(anchor.file);
-      entries.push(localEntry(anchor, read, resolvers));
-    }
-    if (entries.length) drift.set(record.conceptId, entries);
+  for (const link2 of parsed.links ?? []) {
+    blocks.push(
+      `${LINK_RELS[link2.rel].phrase} [${link2.target}](${link2.target}.md).`
+    );
   }
-  return drift;
-}
-function atRefKey(anchor) {
-  return `${anchor.ref ?? ""}\0${anchor.file}`;
-}
-async function readCommitted(repoRoot, anchors, options = {}) {
-  if (!anchors.length) return /* @__PURE__ */ new Map();
-  const read = options.readAtRef ?? readFileAtRef;
-  const byKey = /* @__PURE__ */ new Map();
-  for (const anchor of anchors) byKey.set(atRefKey(anchor), anchor);
-  const keys = [...byKey.keys()];
-  const results = await mapLimit(
-    keys,
-    options.concurrency ?? DEFAULT_IO_CONCURRENCY,
-    (key2) => read(repoRoot, byKey.get(key2))
-  );
-  return new Map(keys.map((key2, at2) => [key2, results[at2]]));
-}
-function remoteWants(anchor) {
-  const repo = anchor.repo;
-  const wants = [{ repo, file: anchor.file }];
-  if (anchor.ref) wants.unshift({ repo, ref: anchor.ref, file: anchor.file });
-  return wants;
-}
-function base(anchor) {
-  return {
-    file: anchor.file,
-    ...anchor.symbol ? { symbol: anchor.symbol } : {},
-    ...anchor.side === "old" ? { side: "old" } : {},
-    storedHash: anchor.hash
-  };
-}
-function unresolved(anchor, reason, repo) {
-  return {
-    ...base(anchor),
-    state: "unresolved",
-    diffSize: null,
-    ...reason ? { reason } : {},
-    ...repo ? { repo } : {},
-    ...classOf(reason)
-  };
-}
-var GONE_REASONS = /* @__PURE__ */ new Set([
-  "file-missing",
-  "symbol-not-found",
-  "span-out-of-range",
-  "ref-unreadable"
-]);
-function provisionalDriftClass(entry) {
-  if (entry.state === "unresolved") {
-    return GONE_REASONS.has(entry.reason) ? "gone" : void 0;
+  if (parsed.sources?.length) {
+    blocks.push(
+      parsed.sources.map((source) => `[^${source.id}]: ${source.title ?? source.resource}`).join("\n")
+    );
   }
-  return entry.state === "drifted" ? "changed" : void 0;
-}
-function classOf(reason) {
-  const settled = provisionalDriftClass({ state: "unresolved", reason });
-  return settled ? { class: settled } : {};
-}
-function hashIn(source, anchor, resolvers) {
-  const outcome = resolveAnchorSpan(source, anchor, resolvers);
-  if (!outcome.ok) return { ok: false, reason: outcome.reason };
-  const { hash, kind } = anchorHashOf(anchor, outcome);
-  return {
-    ok: true,
-    current: {
-      hash,
-      kind,
-      lines: outcome.span.endLine - outcome.span.startLine + 1,
-      ...outcome.resolver ? { resolver: outcome.resolver } : {}
-    }
-  };
-}
-function resolverExtras(source, anchor, current) {
-  return {
-    ...current.resolver ? { resolver: current.resolver } : {},
-    ...current.hash !== anchor.hash && resolverChanged(source, anchor, current.resolver) ? { reason: "resolver-changed" } : {}
-  };
-}
-function compared(anchor, current, extra = {}) {
-  const matched = current.hash === anchor.hash;
   return {
-    ...base(anchor),
-    state: matched ? "match" : "drifted",
-    currentHash: current.hash,
-    hashKind: current.kind,
-    diffSize: anchor.lines === void 0 ? null : Math.abs(current.lines - anchor.lines),
-    ...matched ? {} : { class: "changed" },
-    ...extra
+    type,
+    slug: parsed.slug,
+    frontmatter,
+    body: `${blocks.join("\n\n")}
+`
   };
 }
-function localEntry(anchor, read, resolvers) {
-  if (!read.ok) return unresolved(anchor, read.reason);
-  const found = hashIn(read.source, anchor, resolvers);
-  if (!found.ok) return unresolved(anchor, found.reason);
-  return compared(
-    anchor,
-    found.current,
-    resolverExtras(read.source, anchor, found.current)
-  );
-}
-function remoteEntry(anchor, remote, resolvers) {
-  const repo = anchor.repo;
-  const key2 = normalizeRepoUrl(repo);
-  const atDefault = remote.get(wantKey(key2, void 0, anchor.file));
-  const primary = anchor.ref ? remote.get(wantKey(key2, anchor.ref, anchor.file)) : atDefault;
-  if (!primary) return unresolved(anchor, "remote-unreachable", repo);
-  if (!primary.ok) return unresolved(anchor, primary.reason, repo);
-  const found = hashIn(primary.source, anchor, resolvers);
-  if (!found.ok) return unresolved(anchor, found.reason, repo);
-  const current = found.current;
-  const extras = resolverExtras(primary.source, anchor, current);
-  if (!anchor.ref) return compared(anchor, current, { repo, ...extras });
-  if (current.hash !== anchor.hash) {
-    return compared(anchor, current, {
-      repo,
-      ...extras,
-      remoteState: "drifted-from-ref"
-    });
-  }
-  if (anchor.side === "old") {
-    return compared(anchor, current, {
-      repo,
-      ...extras,
-      remoteState: "matches-ref"
-    });
-  }
-  const head = atDefault?.ok ? hashIn(atDefault.source, anchor, resolvers) : null;
-  return head?.ok && head.current.hash !== anchor.hash ? {
-    ...compared(anchor, head.current, {
-      repo,
-      ...head.current.resolver ? { resolver: head.current.resolver } : {}
-    }),
-    state: "drifted",
-    remoteState: "drifted-on-default"
-  } : compared(anchor, current, {
-    repo,
-    ...extras,
-    remoteState: "matches-ref"
-  });
+
+// src/decision-record.ts
+var DECISION_TYPE = "decision";
+var NO_DECISION_SLUG = "none";
+var decisionInputSchema = composeInputSchema.omit({ sections: true }).extend({
+  alternative: import_zod4.z.string().min(1).optional(),
+  impact: import_zod4.z.string().min(1).optional()
+}).strict();
+function composeDecisionRecord(input, writtenBy, writtenAt) {
+  const { alternative, impact: impact2, ...rest } = input;
+  return composeRecord(
+    DECISION_TYPE,
+    {
+      ...rest,
+      sections: {
+        Decision: input.title,
+        Rationale: input.why,
+        ...alternative ? { Rejected: alternative } : {},
+        ...impact2 ? { Impact: impact2 } : {}
+      }
+    },
+    writtenBy,
+    writtenAt
+  );
+}
+function composeNoDecisionRecord(reason, writtenBy, writtenAt) {
+  return composeRecord(
+    DECISION_TYPE,
+    {
+      slug: NO_DECISION_SLUG,
+      title: "No decision to record",
+      why: reason,
+      sections: { Decision: reason }
+    },
+    writtenBy,
+    writtenAt
+  );
+}
+function isNoDecisionRecord(record) {
+  return record.conceptId === `${DECISION_TYPE}.${NO_DECISION_SLUG}`;
+}
+function selectDecisions(records) {
+  return records.filter(
+    (record) => record.conceptId.startsWith(`${DECISION_TYPE}.`) && !isNoDecisionRecord(record)
+  );
 }
 
-// src/errors.ts
-var BaseError = class extends Error {
-  code;
-  errorType;
-  fault;
-  retriable;
-  reportToUser;
-  details;
-  constructor(props) {
-    super(props.message);
-    this.name = props.name ?? this.constructor.name;
-    this.code = props.code ?? 500;
-    this.errorType = props.errorType;
-    this.fault = props.fault;
-    this.retriable = props.retriable ?? true;
-    this.reportToUser = props.reportToUser ?? false;
-    this.details = props.details;
-  }
-};
+// src/commands/anchor-resolve.ts
+var import_zod7 = require("zod");
 
 // src/kb-errors.ts
 var KbRecordAlreadyExistsError = class extends BaseError {
@@ -2349,6 +2458,38 @@ var KbSelfVerificationError = class extends BaseError {
   actor;
   generatedBy;
 };
+var KbInvalidActorError = class extends BaseError {
+  constructor(actor, reason) {
+    super({
+      message: `kb: actor ${JSON.stringify(actor)} ${reason} \u2014 set STRAUSS_KB_ACTOR, e.g. human:alice or agent:reviewer`,
+      errorType: "KbInvalidActor" /* KbInvalidActor */,
+      code: 400,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details: { actor, reason, action: "refused" }
+    });
+    this.actor = actor;
+    this.reason = reason;
+  }
+  actor;
+  reason;
+};
+var KbFlagConflictError = class extends BaseError {
+  constructor(flags) {
+    super({
+      message: `kb: ${flags.join(" and ")} cannot be combined`,
+      errorType: "KbFlagConflict" /* KbFlagConflict */,
+      code: 400,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details: { flags }
+    });
+    this.flags = flags;
+  }
+  flags;
+};
 var KbPackBudgetExceededError = class extends BaseError {
   constructor(recordCount, approxTokens2, budgetTokens, excluded) {
     super({
@@ -2892,19 +3033,11 @@ function argvPositional(argv, ...names) {
 }
 
 // src/commands/anchor-resolve.ts
-function resolverSummary(results) {
-  const names = [
-    ...new Set(
-      results.flatMap((entry) => entry.resolver ? [entry.resolver] : [])
-    )
-  ].sort();
-  return names.length ? `${names.join(" + ")} resolver` : "whole-file";
-}
 var anchorResolveCommand = define({
   name: "anchor-resolve",
   tool: "kb_anchor_resolve",
-  usage: "anchor-resolve <concept-id> [--repo-root <path>] [--offline] [--rebaseline] [--restamp]",
-  description: "Resolve a record's anchors: stamp a hash onto anchors that lack one, report drift where the code moved. An anchor naming another repository is read from that remote through a bare cache; --offline uses the cache only. kb_verify's mechanical counterpart \u2014 reach for it when the question is whether the code still is what it was. Exits non-zero on drift.",
+  usage: "anchor-resolve <concept-id> [--repo-root <path>] [--offline] [--rebaseline] [--restamp] [--check]",
+  description: "Resolve a record's anchors: stamp a hash onto anchors that lack one, report drift where the code moved. An anchor naming another repository is read from that remote through a bare cache; --offline uses the cache only. Never writes verified[]; a judgment is kb_verify. Exits non-zero on drift.",
   input: import_zod7.z.object({
     bundlePath,
     conceptId,
@@ -2917,6 +3050,9 @@ var anchorResolveCommand = define({
     ),
     restamp: import_zod7.z.boolean().optional().describe(
       "Refresh `resolved_at` on anchors that already match. Off by default, so a green run writes nothing."
+    ),
+    check: import_zod7.z.boolean().optional().describe(
+      "Resolve and report only: no hash, no `resolved_at`, no log entry."
     )
   }),
   fromArgv: (argv, path) => ({
@@ -2925,9 +3061,24 @@ var anchorResolveCommand = define({
     repoRoot: argvFlag(argv, "--repo-root"),
     offline: argv.includes("--offline"),
     rebaseline: argv.includes("--rebaseline"),
-    restamp: argv.includes("--restamp")
+    restamp: argv.includes("--restamp"),
+    check: argv.includes("--check")
   }),
-  run: async ({ store, actor, now }, { bundlePath: path, conceptId: id, repoRoot, offline, rebaseline, restamp }) => {
+  run: async ({ store, actor, now }, {
+    bundlePath: path,
+    conceptId: id,
+    repoRoot,
+    offline,
+    rebaseline,
+    restamp,
+    check
+  }) => {
+    if (check && (rebaseline || restamp)) {
+      throw new KbFlagConflictError([
+        "check",
+        rebaseline ? "rebaseline" : "restamp"
+      ]);
+    }
     const root = repoRoot ?? process.cwd();
     const record = await store.read(path, id);
     if (!record) throw new KbRecordNotFoundError(id);
@@ -2936,7 +3087,6 @@ var anchorResolveCommand = define({
       return {
         conceptId: id,
         results: [],
-        verified: false,
         note: "record has no anchors"
       };
     }
@@ -2994,7 +3144,7 @@ var anchorResolveCommand = define({
       if (!anchor.hash) {
         results.push({
           ...base2,
-          state: "stamped",
+          state: check ? "unstamped" : "stamped",
           currentHash: stampedHash,
           hashKind: stampedKind,
           ...producedBy ? { resolver: producedBy } : {}
@@ -3046,7 +3196,7 @@ var anchorResolveCommand = define({
       if (refresh) dirty = true;
     }
     let frozen = false;
-    if (dirty) {
+    if (dirty && !check) {
       try {
         await assertBaseNotFrozen(process.cwd(), path);
       } catch (error) {
@@ -3061,42 +3211,11 @@ var anchorResolveCommand = define({
     const unreachable = results.filter(
       (entry) => isUncheckedReason(entry.reason)
     ).length;
-    const checked = results.length - unreachable;
     const matches3 = results.filter((entry) => entry.state === "match").length;
-    const note = `${matches3}/${checked} anchors match${unreachable ? `, ${unreachable} unreachable` : ""}`;
-    const clean = checked > 0 && matches3 === checked && unreachable === 0;
-    if (clean) {
-      try {
-        await store.verify(
-          path,
-          id,
-          `anchor-resolve: ${note} (${resolverSummary(results)})`,
-          actor,
-          now()
-        );
-      } catch (error) {
-        if (!(error instanceof KbSelfVerificationError)) throw error;
-        return {
-          conceptId: id,
-          results,
-          verified: false,
-          verifyRefused: "self-verification",
-          ...frozenNote,
-          ...hintNote
-        };
-      }
-      return {
-        conceptId: id,
-        results,
-        verified: true,
-        ...frozenNote,
-        ...hintNote
-      };
-    }
+    const note = `${matches3}/${results.length - unreachable} anchors match, ${unreachable} unreachable`;
     return {
       conceptId: id,
       results,
-      verified: false,
       ...unreachable ? { note } : {},
       ...frozenNote,
       ...hintNote
@@ -3183,14 +3302,117 @@ async function readSources(anchors, root, offline) {
   return sources;
 }
 
-// src/commands/answer.ts
+// src/commands/anchor-set/model.ts
 var import_zod8 = require("zod");
+var anchorSetInputSchema = import_zod8.z.object({
+  reason: import_zod8.z.string().refine((text) => text.trim().length > 0, {
+    message: "reason must say what was reviewed"
+  }).describe(
+    "What the reviewer read that makes these the right pointers. Recorded in the log."
+  ),
+  anchors: import_zod8.z.array(kbAnchorWriteSchema).min(1).describe(
+    "The complete new anchor set. Carry an anchor's hash forward to keep drift visible until the new code is read."
+  )
+}).strict();
+var anchorSetCommandInput = import_zod8.z.object({
+  bundlePath,
+  conceptId,
+  input: anchorSetInputSchema,
+  resolve: import_zod8.z.boolean().optional().describe(
+    "Also resolve and stamp every anchor against the current code, as anchor-resolve --rebaseline does."
+  ),
+  repoRoot: import_zod8.z.string().min(1).optional().describe(
+    "Where the anchored source lives, for resolve. Defaults to the working directory."
+  ),
+  offline: import_zod8.z.boolean().optional().describe("With resolve, read foreign anchors from the repo cache only.")
+});
+
+// src/commands/anchor-set/command.ts
+var NOTE = "pointers only: nothing was resolved or verified. Run anchor-resolve to check the new pointers, --rebaseline to accept the code, or pass resolve to do both here.";
+var STAMPED_NOTE = "pointers set and stamped against the current code. Not verification: run verify separately if someone reviewed it.";
+var anchorSetCommand = define({
+  name: "anchor-set",
+  tool: "kb_anchor_set",
+  usage: "anchor-set <concept-id> [--resolve] [--repo-root <path>] [--offline] < anchors.json",
+  description: "Set a record's code anchors after a reviewed refactor, with a reason. The array is the whole set. With resolve, every anchor is stamped against the current code in the same call; without it, run kb_anchor_resolve next. Recorded in the log, never verification.",
+  input: anchorSetCommandInput,
+  fromArgv: async (argv, path, stdin) => ({
+    bundlePath: path,
+    conceptId: argv[1],
+    input: JSON.parse(await stdin()),
+    resolve: argv.includes("--resolve"),
+    repoRoot: argvFlag(argv, "--repo-root"),
+    offline: argv.includes("--offline")
+  }),
+  run: async (ctx, { bundlePath: path, conceptId: id, input, resolve: resolve7, repoRoot, offline }) => {
+    const { store, actor } = ctx;
+    await assertBaseNotFrozen(process.cwd(), path);
+    let applied;
+    const record = await store.updateAnchors(
+      path,
+      id,
+      (current) => {
+        applied = applyAnchorSet(current, input.anchors);
+        return {
+          anchors: applied.anchors,
+          log: {
+            operation: "anchor-set",
+            reason: input.reason,
+            anchors: applied.changes
+          }
+        };
+      },
+      actor
+    );
+    const changes = applied?.changes ?? [];
+    if (!resolve7) {
+      return {
+        conceptId: id,
+        reason: input.reason,
+        changes,
+        anchors: record.frontmatter.strauss_anchors ?? [],
+        baseline: "unchanged",
+        note: NOTE
+      };
+    }
+    const resolved = await anchorResolveCommand.run(
+      ctx,
+      anchorResolveCommand.input.parse({
+        bundlePath: path,
+        conceptId: id,
+        rebaseline: true,
+        ...repoRoot ? { repoRoot } : {},
+        ...offline ? { offline } : {}
+      })
+    );
+    const after = await store.read(path, id);
+    return {
+      conceptId: id,
+      reason: input.reason,
+      changes,
+      anchors: after?.frontmatter.strauss_anchors ?? [],
+      baseline: "stamped",
+      resolved: resolved.results,
+      note: STAMPED_NOTE
+    };
+  },
+  // With `resolve`, a pointer that names nothing is a failed set, not a
+  // finding to read later. A remote nothing could reach was never checked, so
+  // it does not fail — the same line anchor-resolve draws.
+  failsWhen: (result) => (result.resolved ?? []).some((entry) => {
+    const { state, reason } = entry;
+    return state === "unresolved" && !isUncheckedReason(reason);
+  })
+});
+
+// src/commands/answer.ts
+var import_zod9 = require("zod");
 var answerCommand = define({
   name: "answer",
   tool: "kb_answer",
   usage: "answer <concept-id> <answer...>",
   description: "Resolve an open question: set status, stamp who and when, append an Answer section. If the answer overturns a decision or assumption, supersede that record explicitly.",
-  input: import_zod8.z.object({ bundlePath, conceptId, answer: import_zod8.z.string().min(1) }),
+  input: import_zod9.z.object({ bundlePath, conceptId, answer: import_zod9.z.string().min(1) }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
     conceptId: argv[1],
@@ -3204,19 +3426,19 @@ var answerCommand = define({
 });
 
 // src/commands/backlinks.ts
-var import_zod9 = require("zod");
+var import_zod10 = require("zod");
 var backlinksCommand = define({
   name: "backlinks",
   tool: "kb_backlinks",
   usage: "backlinks <concept-id>",
   description: "Who points at this record: every inbound typed causal link (`strauss_links`), one hop, every rel including `related_to`, each with its rel and the standing of the record that made it. Use it when you need the exact edges \u2014 reviewing or renaming a record.",
-  input: import_zod9.z.object({ bundlePath, conceptId }),
+  input: import_zod10.z.object({ bundlePath, conceptId }),
   fromArgv: (argv, path) => ({ bundlePath: path, conceptId: argv[1] }),
   run: async ({ store }, { bundlePath: path, conceptId: id }) => store.backlinks(path, id)
 });
 
 // src/commands/catalog.ts
-var import_zod10 = require("zod");
+var import_zod11 = require("zod");
 
 // src/adjudicate.ts
 var STANDING = {
@@ -3395,9 +3617,9 @@ var catalogCommand = define({
   tool: "kb_catalog",
   usage: "catalog [type] [--tag T]...",
   description: "Lists every record as one line \u2014 concept id, type, title, standing, and a stale flag \u2014 at roughly thirty tokens each. Pick this over kb_load once kb_load refuses: kb_catalog never refuses. Superseded records show only their replacement; fetch bodies with kb_load, kb_pack, kb_query, or kb_trace.",
-  input: import_zod10.z.object({
+  input: import_zod11.z.object({
     bundlePath,
-    type: import_zod10.z.enum(KB_RECORD_TYPES).optional(),
+    type: import_zod11.z.enum(KB_RECORD_TYPES).optional(),
     tags: TAGS
   }),
   fromArgv: (argv, path) => {
@@ -3469,7 +3691,7 @@ function count(value, noun) {
 var import_node_buffer = require("buffer");
 var import_promises7 = require("fs/promises");
 var import_node_path10 = require("path");
-var import_zod13 = require("zod");
+var import_zod14 = require("zod");
 
 // src/match-diff.ts
 function matchToDiff(files, records, options = {}) {
@@ -4073,7 +4295,7 @@ function claimOf(record) {
 }
 
 // src/commands/match/command.ts
-var import_zod12 = require("zod");
+var import_zod13 = require("zod");
 
 // src/commands/match/errors.ts
 var KbMatchInputError = class extends BaseError {
@@ -4093,21 +4315,21 @@ var KbMatchInputError = class extends BaseError {
 };
 
 // src/commands/match/model.ts
-var import_zod11 = require("zod");
-var diffHunkSchema = import_zod11.z.object({
-  startLine: import_zod11.z.number().int().positive(),
-  endLine: import_zod11.z.number().int().positive(),
-  side: import_zod11.z.enum(["old", "new"]).optional()
+var import_zod12 = require("zod");
+var diffHunkSchema = import_zod12.z.object({
+  startLine: import_zod12.z.number().int().positive(),
+  endLine: import_zod12.z.number().int().positive(),
+  side: import_zod12.z.enum(["old", "new"]).optional()
 }).passthrough();
-var diffFileSchema = import_zod11.z.object({
-  filePath: import_zod11.z.string().min(1).describe("Repo-relative, spelled the way anchors are."),
-  hunks: import_zod11.z.array(diffHunkSchema)
+var diffFileSchema = import_zod12.z.object({
+  filePath: import_zod12.z.string().min(1).describe("Repo-relative, spelled the way anchors are."),
+  hunks: import_zod12.z.array(diffHunkSchema)
 });
-var symbolRangeSchema = import_zod11.z.object({
-  file: import_zod11.z.string().min(1),
-  symbol: import_zod11.z.string().min(1),
-  startLine: import_zod11.z.number().int().positive(),
-  endLine: import_zod11.z.number().int().positive()
+var symbolRangeSchema = import_zod12.z.object({
+  file: import_zod12.z.string().min(1),
+  symbol: import_zod12.z.string().min(1),
+  startLine: import_zod12.z.number().int().positive(),
+  endLine: import_zod12.z.number().int().positive()
 });
 
 // src/commands/match/parse-unified-diff.ts
@@ -4356,17 +4578,17 @@ var matchCommand = define({
   tool: "kb_match",
   usage: "match --git <base>..<head> | --stdin [--repo-root <path>] [--offline] [--include-non-current]",
   description: "Which records sit on each changed hunk: the anchored records per file range, current first, each with its standing and the anchor that matched. kb_load hands over a whole base; this narrows a diff. Symbol ranges resolve from repoRoot when omitted; non-current records need includeNonCurrent.",
-  input: import_zod12.z.object({
+  input: import_zod13.z.object({
     bundlePath,
-    files: import_zod12.z.array(diffFileSchema).describe("The changed files, each with its post-change line ranges."),
-    symbolRanges: import_zod12.z.array(symbolRangeSchema).optional().describe(
+    files: import_zod13.z.array(diffFileSchema).describe("The changed files, each with its post-change line ranges."),
+    symbolRanges: import_zod13.z.array(symbolRangeSchema).optional().describe(
       "Symbol spans the caller already has. Resolved from repoRoot when omitted."
     ),
     repoRoot: REPO_ROOT,
-    offline: import_zod12.z.boolean().optional().describe(
+    offline: import_zod13.z.boolean().optional().describe(
       "Resolve symbol ranges from what is already on disk, never fetching a grammar."
     ),
-    includeNonCurrent: import_zod12.z.boolean().optional().describe(
+    includeNonCurrent: import_zod13.z.boolean().optional().describe(
       "Return superseded, rejected and unsettled records too, each carrying its standing."
     )
   }),
@@ -4380,11 +4602,11 @@ var matchCommand = define({
       ...argv.includes("--include-non-current") ? { includeNonCurrent: true } : {}
     };
     if (range !== void 0) {
-      const diff = await readRangeDiff(repoRoot ?? process.cwd(), range);
-      if (!diff.ok) {
-        throw new KbMatchInputError(`--git ${range} ${REFUSED[diff.reason]}`);
+      const diff2 = await readRangeDiff(repoRoot ?? process.cwd(), range);
+      if (!diff2.ok) {
+        throw new KbMatchInputError(`--git ${range} ${REFUSED[diff2.reason]}`);
       }
-      return { ...base2, files: parseUnifiedDiff(diff.text) };
+      return { ...base2, files: parseUnifiedDiff(diff2.text) };
     }
     if (!argv.includes("--stdin")) {
       throw new KbMatchInputError(
@@ -4470,22 +4692,22 @@ function project(match, ranges, all) {
 
 // src/commands/classify.ts
 var classifyFileSchema = diffFileSchema.extend({
-  hunks: import_zod13.z.array(
-    diffHunkSchema.extend({ lines: import_zod13.z.array(import_zod13.z.string()).optional() })
+  hunks: import_zod14.z.array(
+    diffHunkSchema.extend({ lines: import_zod14.z.array(import_zod14.z.string()).optional() })
   ),
-  renamedFrom: import_zod13.z.string().min(1).optional().describe("Where `git diff -M` says the path came from."),
-  similarity: import_zod13.z.number().min(0).max(100).optional()
+  renamedFrom: import_zod14.z.string().min(1).optional().describe("Where `git diff -M` says the path came from."),
+  similarity: import_zod14.z.number().min(0).max(100).optional()
 });
 var classifyCommand = define({
   name: "classify",
   tool: "kb_classify",
   usage: "classify --git <base>..<head> | --stdin [--repo-root <path>] [--offline]",
   description: "What kind of change each file carries: test, config, ci, docs, lockfile, generated, boilerplate, rename or source, with the rule that decided it. Derived from the diff and never stored; a `review:generated`, `review:boilerplate` or `review:move` fact anchored on a file overrides the heuristic. kb_match says what sits on a hunk; this says whether to read it.",
-  input: import_zod13.z.object({
+  input: import_zod14.z.object({
     bundlePath,
-    files: import_zod13.z.array(classifyFileSchema).describe("The changed files, each with its line ranges."),
+    files: import_zod14.z.array(classifyFileSchema).describe("The changed files, each with its line ranges."),
     repoRoot: REPO_ROOT,
-    offline: import_zod13.z.boolean().optional().describe(
+    offline: import_zod14.z.boolean().optional().describe(
       "Resolve symbol ranges from what is already on disk, never fetching a grammar."
     )
   }),
@@ -4498,15 +4720,15 @@ var classifyCommand = define({
       ...argv.includes("--offline") ? { offline: true } : {}
     };
     if (range !== void 0) {
-      const diff = await readRangeDiff(repoRoot ?? process.cwd(), range);
-      if (!diff.ok) {
+      const diff2 = await readRangeDiff(repoRoot ?? process.cwd(), range);
+      if (!diff2.ok) {
         throw new KbClassifyInputError(
-          `--git ${range} ${REFUSED2[diff.reason]}`
+          `--git ${range} ${REFUSED2[diff2.reason]}`
         );
       }
       return {
         ...base2,
-        files: parseUnifiedDiff(diff.text, {
+        files: parseUnifiedDiff(diff2.text, {
           keepEmpty: true,
           withLines: true
         })
@@ -4596,7 +4818,7 @@ function renderClassify(result) {
 }
 
 // src/commands/context.ts
-var import_zod14 = require("zod");
+var import_zod15 = require("zod");
 
 // src/kb-context.ts
 var import_promises8 = require("fs/promises");
@@ -4867,23 +5089,23 @@ var contextCommand = define({
   tool: "kb_context",
   usage: "context [--profile NAME] [--budget N] [--full-under N] [--exclude-tag T]... [--format json] [--event NAME]",
   description: "Index block of pinned bases (ids, titles, standing) for injection at context birth. Takes no bundlePath \u2014 reads the workspace pin manifests. Empty when nothing is pinned; refuses over budget rather than truncating. Budget precedence: flags, then the manifest `context[profile]` over `context.default`, then the built-in profile, then package defaults.",
-  input: import_zod14.z.object({
-    budgetTokens: import_zod14.z.number().int().positive().optional().describe(
+  input: import_zod15.z.object({
+    budgetTokens: import_zod15.z.number().int().positive().optional().describe(
       "Ceiling on the whole emitted block; past it the command refuses with a list of bases rather than truncating. Defaults to 4000."
     ),
-    fullUnderTokens: import_zod14.z.number().int().positive().optional().describe(
+    fullUnderTokens: import_zod15.z.number().int().positive().optional().describe(
       "Per-base rendering threshold, applied before the budget: a base whose complete load fits under this arrives as full records instead of index lines, and the whole block still answers to budgetTokens. Off by default \u2014 index-only is the safe default at a context birth, because injected bodies outlive the qualifiers on them; the session-start profile opts tiny bases in at 1500."
     ),
-    profile: import_zod14.z.string().optional().describe(
+    profile: import_zod15.z.string().optional().describe(
       "Named budget set: built-ins are session-start (full-under 1500), compact and turn (budget 2500); the manifests' `context` tables override per repo. Unknown names fall through to defaults rather than failing."
     ),
-    excludeTags: import_zod14.z.array(import_zod14.z.string().min(1)).optional().describe(
+    excludeTags: import_zod15.z.array(import_zod15.z.string().min(1)).optional().describe(
       "Frontmatter tags whose records stay out of the block. The base stays pinned and stays readable by tool; resolved like the budgets."
     ),
-    format: import_zod14.z.enum(["markdown", "json"]).optional().describe(
+    format: import_zod15.z.enum(["markdown", "json"]).optional().describe(
       "CLI envelope for hook protocols that require strict JSON on stdout. MCP callers omit this \u2014 the block itself is identical."
     ),
-    event: import_zod14.z.string().optional().describe(
+    event: import_zod15.z.string().optional().describe(
       "hookEventName stamped into the JSON envelope. Only meaningful with format=json."
     )
   }),
@@ -4922,7 +5144,7 @@ var contextCommand = define({
 });
 
 // src/commands/doctor.ts
-var import_zod16 = require("zod");
+var import_zod17 = require("zod");
 
 // src/kb-edges.ts
 var KB_EDGE_KINDS = [
@@ -5438,17 +5660,17 @@ function ageInDays(record, now) {
 }
 
 // src/commands/reassess.ts
-var import_zod15 = require("zod");
+var import_zod16 = require("zod");
 var reassessCommand = define({
   name: "reassess",
   tool: "kb_reassess",
   usage: "reassess <concept-id> [--repo-root <path>] [--with-diff]",
   description: "One drifted record, as something to judge: its claim, each anchor's drift class, the old-vs-new span diff, and the records that depend on it. Formatting-only drift is dropped. Empty when there is nothing to reassess. Writes: relocates moved anchors, keeping their hash; never verifies, supersedes, or changes standing.",
-  input: import_zod15.z.object({
+  input: import_zod16.z.object({
     bundlePath,
     conceptId,
     repoRoot: REPO_ROOT,
-    withDiff: import_zod15.z.boolean().optional().describe(
+    withDiff: import_zod16.z.boolean().optional().describe(
       "Recover each anchor's committed span and render the diff. Reads git history."
     )
   }),
@@ -5593,13 +5815,13 @@ function at(file, symbol) {
 }
 
 // src/commands/doctor.ts
-var days = (what, fallback) => import_zod16.z.number().int().positive().optional().describe(`${what} Defaults to ${fallback}.`);
+var days = (what, fallback) => import_zod17.z.number().int().positive().optional().describe(`${what} Defaults to ${fallback}.`);
 var doctorCommand = define({
   name: "doctor",
   tool: "kb_doctor",
   usage: "doctor [--expiring-days N] [--unverified-days N] [--aging-days N] [--repo-root PATH] [--offline] [--strict] [--drifted [--with-diff]]",
   description: "Read-only health sweep: expired, expiring, unverified, aging, orphaned, broken-supersession, superseded-but-cited, drifted and unchecked anchors. Every group is reported even when empty; nothing is written or re-stamped. `drifted` narrows it to a reassessment packet per drifted record, `with_diff` adding each anchor's old-vs-new span.",
-  input: import_zod16.z.object({
+  input: import_zod17.z.object({
     bundlePath,
     repoRoot: REPO_ROOT,
     expiringDays: days(
@@ -5614,16 +5836,16 @@ var doctorCommand = define({
       "How long a record may stay `open` or `proposed` before `aging` reports it, in days.",
       DEFAULT_AGING_DAYS
     ),
-    offline: import_zod16.z.boolean().optional().describe(
+    offline: import_zod17.z.boolean().optional().describe(
       "Read foreign anchors from the local repo cache only, never fetching."
     ),
-    strict: import_zod16.z.boolean().optional().describe(
+    strict: import_zod17.z.boolean().optional().describe(
       "Turn an expired record into a non-zero exit for the CLI. No effect on the report itself."
     ),
-    drifted: import_zod16.z.boolean().optional().describe(
+    drifted: import_zod17.z.boolean().optional().describe(
       "Report only drift, as a reassessment packet per record: claim, per-anchor class, and what depends on it."
     ),
-    withDiff: import_zod16.z.boolean().optional().describe(
+    withDiff: import_zod17.z.boolean().optional().describe(
       "With `drifted`: recover each anchor's committed span and render the old-vs-new diff. Reads git history."
     )
   }),
@@ -5800,7 +6022,7 @@ function renderPackets(result) {
 // src/commands/export.ts
 var import_promises9 = require("fs/promises");
 var import_node_path11 = require("path");
-var import_zod17 = require("zod");
+var import_zod18 = require("zod");
 var NUMBERED = /^(\d{4})-(.+)\.md$/;
 var MARKER = "<!-- strauss-kb export: ";
 var exportCommand = define({
@@ -5808,10 +6030,10 @@ var exportCommand = define({
   tool: "kb_export",
   usage: "export --format madr --to <dir>",
   description: "Write the base's decisions out as numbered MADR files, one per decision, for a repository that keeps ADRs of its own. Numbering is by slug, so a re-run rewrites its own files in place. A superseded decision is exported with what replaced it.",
-  input: import_zod17.z.object({
+  input: import_zod18.z.object({
     bundlePath,
-    format: import_zod17.z.enum(["madr"]).describe("Output layout. `madr` is the only one so far."),
-    to: import_zod17.z.string().min(1).describe("Directory the ADR files are written into.")
+    format: import_zod18.z.enum(["madr"]).describe("Output layout. `madr` is the only one so far."),
+    to: import_zod18.z.string().min(1).describe("Directory the ADR files are written into.")
   }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
@@ -5933,19 +6155,19 @@ function bodySections(body) {
 }
 
 // src/commands/impact.ts
-var import_zod18 = require("zod");
+var import_zod19 = require("zod");
 var impactCommand = define({
   name: "impact",
   tool: "kb_impact",
   usage: "impact <concept-id> [--depth N] [--rels a,b]",
   description: "What breaks if this record changes: its transitive set of dependants, each with its standing. Each rel declares which of its ends depends on the other, and the walk follows each rel in its own direction. Naming `related_to` or an unknown rel in `rels` is an error. kb_backlinks gives one flat hop.",
-  input: import_zod18.z.object({
+  input: import_zod19.z.object({
     bundlePath,
     conceptId,
-    depth: import_zod18.z.number().int().positive().optional().describe(
+    depth: import_zod19.z.number().int().positive().optional().describe(
       "Hops out from the record. Unbounded when omitted; a walk this cuts reports truncated: true."
     ),
-    rels: import_zod18.z.array(import_zod18.z.enum(KB_CAUSAL_LINK_RELS)).optional().describe(
+    rels: import_zod19.z.array(import_zod19.z.enum(KB_CAUSAL_LINK_RELS)).optional().describe(
       "Narrow which rels the walk follows. Defaults to every rel that carries a dependence \u2014 all but related_to."
     )
   }),
@@ -5966,15 +6188,15 @@ var impactCommand = define({
 });
 
 // src/commands/list.ts
-var import_zod19 = require("zod");
+var import_zod20 = require("zod");
 var listCommand = define({
   name: "list",
   tool: "kb_list",
   usage: "list [type] [--tag T]...",
   description: "Every record, optionally one type or tag. For enumerating; use kb_query for a question.",
-  input: import_zod19.z.object({
+  input: import_zod20.z.object({
     bundlePath,
-    type: import_zod19.z.enum(KB_RECORD_TYPES).optional(),
+    type: import_zod20.z.enum(KB_RECORD_TYPES).optional(),
     tags: TAGS
   }),
   fromArgv: (argv, path) => {
@@ -5998,17 +6220,17 @@ var listCommand = define({
 });
 
 // src/commands/load.ts
-var import_zod20 = require("zod");
+var import_zod21 = require("zod");
 var loadCommand = define({
   name: "load",
   tool: "kb_load",
   usage: "load [type] [--budget N | --all] [--repo-root PATH]",
   description: "Load the whole base, each record with its standing \u2014 call it first, at the point of use, since compaction drops it. Superseded records arrive as stubs; kb_trace has the history. Over budget it refuses: kb_catalog, then kb_pack, or narrow with `type`; `all` bypasses. Never read record files directly \u2014 only kb_* tools resolve supersession. `digest` stamps the base's content, so hooks know when to reload.",
-  input: import_zod20.z.object({
+  input: import_zod21.z.object({
     bundlePath,
-    type: import_zod20.z.enum(KB_RECORD_TYPES).optional(),
-    budgetTokens: import_zod20.z.number().int().positive().optional().describe("Approximate token ceiling. Defaults to 25000."),
-    all: import_zod20.z.boolean().optional().describe(
+    type: import_zod21.z.enum(KB_RECORD_TYPES).optional(),
+    budgetTokens: import_zod21.z.number().int().positive().optional().describe("Approximate token ceiling. Defaults to 25000."),
+    all: import_zod21.z.boolean().optional().describe(
       "Loads the entire base regardless of size, bypassing the token budget; mutually exclusive with budgetTokens."
     ),
     repoRoot: REPO_ROOT
@@ -6050,25 +6272,25 @@ var loadCommand = define({
 });
 
 // src/commands/log.ts
-var import_zod21 = require("zod");
+var import_zod22 = require("zod");
 var logCommand = define({
   name: "log",
   tool: "kb_log",
   usage: "log",
   description: "Who touched what, and when. Append-only; malformed lines are reported, never repaired.",
-  input: import_zod21.z.object({ bundlePath }),
+  input: import_zod22.z.object({ bundlePath }),
   fromArgv: (_argv, path) => ({ bundlePath: path }),
   run: ({ store }, { bundlePath: path }) => store.readLog(path)
 });
 
 // src/commands/no-decision.ts
-var import_zod22 = require("zod");
+var import_zod23 = require("zod");
 var noDecisionCommand = define({
   name: "no-decision",
   tool: "kb_no_decision",
   usage: "no-decision <reason...>",
   description: "Record in one sentence that a piece of work had nothing to decide. Idempotent.",
-  input: import_zod22.z.object({ bundlePath, reason: import_zod22.z.string().min(1) }),
+  input: import_zod23.z.object({ bundlePath, reason: import_zod23.z.string().min(1) }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
     reason: argv.slice(1).join(" ").trim()
@@ -6085,20 +6307,20 @@ var noDecisionCommand = define({
 });
 
 // src/commands/pack.ts
-var import_zod23 = require("zod");
+var import_zod24 = require("zod");
 var packCommand = define({
   name: "pack",
   tool: "kb_pack",
   usage: "pack <conceptId> [--hops N] [--max-nodes N] [--budget N]",
   description: "Bounded neighbourhood around one record: within `hops`, ranked, cut to `maxNodes`, with every cut record named under Excluded. Use when the base is over kb_load's budget and the work centres on a record you can name. Refuses over budget rather than truncating. Everything below the header is byte-stable across runs. Resolves supersession like kb_load.",
-  input: import_zod23.z.object({
+  input: import_zod24.z.object({
     bundlePath,
     conceptId,
-    hops: import_zod23.z.number().int().positive().optional().describe("How far from the root the walk may reach. Defaults to 2."),
-    maxNodes: import_zod23.z.number().int().positive().optional().describe(
+    hops: import_zod24.z.number().int().positive().optional().describe("How far from the root the walk may reach. Defaults to 2."),
+    maxNodes: import_zod24.z.number().int().positive().optional().describe(
       "How many records the pack may hold, root included. Defaults to 20."
     ),
-    budgetTokens: import_zod23.z.number().int().positive().optional().describe(
+    budgetTokens: import_zod24.z.number().int().positive().optional().describe(
       "Approximate token ceiling over what is actually emitted. Defaults to 25000."
     )
   }),
@@ -6185,22 +6407,22 @@ function warningLabel(warning) {
 }
 
 // src/commands/pin.ts
-var import_zod24 = require("zod");
+var import_zod25 = require("zod");
 var pinCommand = define({
   name: "pin",
   tool: "kb_pin",
   usage: "pin [bundle-path] [--mode full|index] [--profiles a,b] [--local|--user] [--frozen|--unfreeze]",
   description: "Pin a base into a workspace manifest so kb_context surfaces it. Layers, nearest wins: project `.strauss/kb-pins.json` (default), `--local` (personal, gitignored), `--user` (`~/.strauss`). Idempotent; `--mode full|index`, `--profiles`, `--frozen`/`--unfreeze` update only those fields. A path with no records pins with a warning. Never touches the base itself.",
-  input: import_zod24.z.object({
+  input: import_zod25.z.object({
     bundlePath,
-    mode: import_zod24.z.enum(["full", "index"]).optional().describe(
+    mode: import_zod25.z.enum(["full", "index"]).optional().describe(
       "full: always emit this base's records whole (still under the block budget); index: never upgrade. Absent: the profile's full-under threshold decides."
     ),
-    profiles: import_zod24.z.array(import_zod24.z.string()).optional().describe("Context profiles this pin surfaces in. Absent: all of them."),
-    layer: import_zod24.z.enum(["project", "local", "user"]).optional().describe(
+    profiles: import_zod25.z.array(import_zod25.z.string()).optional().describe("Context profiles this pin surfaces in. Absent: all of them."),
+    layer: import_zod25.z.enum(["project", "local", "user"]).optional().describe(
       "Which manifest to write: project (committed, default), local (personal, gitignored), user (~/.strauss, every workspace)."
     ),
-    frozen: import_zod24.z.boolean().optional().describe(
+    frozen: import_zod25.z.boolean().optional().describe(
       "true: the base is concluded \u2014 writes against it refuse while pinned. false: lift a freeze."
     )
   }),
@@ -6229,13 +6451,13 @@ var pinCommand = define({
 });
 
 // src/commands/pins.ts
-var import_zod25 = require("zod");
+var import_zod26 = require("zod");
 var pinsCommand = define({
   name: "pins",
   tool: "kb_pins",
   usage: "pins",
   description: "Every pinned base across the manifest layers, with its layer and whether it resolves to records. Takes no bundlePath.",
-  input: import_zod25.z.object({}),
+  input: import_zod26.z.object({}),
   fromArgv: () => ({}),
   run: ({ store }) => listPins(store, process.cwd())
 });
@@ -6506,16 +6728,16 @@ function recordType(conceptId2) {
 }
 
 // src/commands/promote/model.ts
-var import_zod26 = require("zod");
-var promoteInputSchema = import_zod26.z.object({
+var import_zod27 = require("zod");
+var promoteInputSchema = import_zod27.z.object({
   bundlePath,
-  conceptIds: import_zod26.z.array(conceptId).max(64).optional().describe("Records to copy into the target base. Omit with `list`."),
-  to: import_zod26.z.string().min(1).optional().describe("Absolute path to the base being promoted into."),
-  source: import_zod26.z.string().min(1).optional().describe(
+  conceptIds: import_zod27.z.array(conceptId).max(64).optional().describe("Records to copy into the target base. Omit with `list`."),
+  to: import_zod27.z.string().min(1).optional().describe("Absolute path to the base being promoted into."),
+  source: import_zod27.z.string().min(1).optional().describe(
     "Where the promotion came from, usually the pull request URL. Recorded on each copy as a source."
   ),
-  force: import_zod26.z.boolean().optional().describe("Overwrite a record the target base already holds."),
-  list: import_zod26.z.boolean().optional().describe("List the source base's candidates instead of promoting.")
+  force: import_zod27.z.boolean().optional().describe("Overwrite a record the target base already holds."),
+  list: import_zod27.z.boolean().optional().describe("List the source base's candidates instead of promoting.")
 }).refine((input) => input.list === true || input.to !== void 0, {
   message: "promote needs a target base \u2014 pass --to <bundle>, or --list",
   path: ["to"]
@@ -6652,17 +6874,17 @@ function renderPromote(result) {
 }
 
 // src/commands/query.ts
-var import_zod27 = require("zod");
+var import_zod28 = require("zod");
 var queryCommand = define({
   name: "query",
   tool: "kb_query",
   usage: "query <text...> [--tag T]... [--repo-root PATH]",
   description: "Search; every hit carries its standing. Flagged, never filtered: a superseded hit returns with its replacement, a rejected one is marked. Prefer kb_load when the base fits its budget \u2014 a full read beats search. Results are volatile: place them at the tail, not the cached prefix. Never read record files directly.",
-  input: import_zod27.z.object({
+  input: import_zod28.z.object({
     bundlePath,
-    text: import_zod27.z.string().optional(),
-    type: import_zod27.z.enum(KB_RECORD_TYPES).optional(),
-    includeNonCurrent: import_zod27.z.boolean().optional(),
+    text: import_zod28.z.string().optional(),
+    type: import_zod28.z.enum(KB_RECORD_TYPES).optional(),
+    includeNonCurrent: import_zod28.z.boolean().optional(),
     tags: TAGS,
     repoRoot: REPO_ROOT
   }),
@@ -6696,27 +6918,32 @@ var queryCommand = define({
 });
 
 // src/commands/read-index.ts
-var import_zod28 = require("zod");
+var import_zod29 = require("zod");
 var readIndexCommand = define({
   name: "index",
   tool: "kb_index",
   usage: "index",
   description: "The index \u2014 title, type, status, description per record \u2014 rebuilt if stale. Cheapest re-orientation after compaction: call it (or kb_context) first, then kb_load or fetch by id.",
-  input: import_zod28.z.object({ bundlePath }),
+  input: import_zod29.z.object({ bundlePath }),
   fromArgv: (_argv, path) => ({ bundlePath: path }),
   run: ({ store }, { bundlePath: path }) => store.readIndex(path)
 });
 
 // src/commands/schema.ts
-var import_zod31 = require("zod");
+var import_zod32 = require("zod");
 
 // src/json-schema.ts
-var import_zod30 = require("zod");
+var import_zod31 = require("zod");
 
 // src/kb-log.ts
-var import_zod29 = require("zod");
+var import_zod30 = require("zod");
 var LOG_FILE = "log.jsonl";
-var kbLogEntrySchema = import_zod29.z.object({
+var kbLogAnchorChangeSchema = import_zod30.z.object({
+  op: import_zod30.z.enum(["move", "add", "drop"]),
+  from: kbAnchorLocatorSchema.optional(),
+  to: kbAnchorLocatorSchema.optional()
+}).strict();
+var kbLogEntryFields = import_zod30.z.object({
   // Validated, not just `min(1)`: `at` is a sort key (see `parseLog`
   // below), and a value that isn't actually chronological — a Unix
   // timestamp, a human-typed date, garbage — would sort wrong without
@@ -6725,18 +6952,28 @@ var kbLogEntrySchema = import_zod29.z.object({
   // and rejects everything else, including a non-`Z` offset — so a
   // malformed `at` is reported the same way a malformed line already is,
   // rather than silently sorting into the wrong place.
-  at: import_zod29.z.iso.datetime(),
-  by: import_zod29.z.string().min(1),
-  operation: import_zod29.z.string().min(1),
-  conceptId: import_zod29.z.string().min(1),
+  at: import_zod30.z.iso.datetime(),
+  by: import_zod30.z.string().min(1),
+  operation: import_zod30.z.string().min(1),
+  conceptId: import_zod30.z.string().min(1),
   /**
    * The operation's other end, where it has one: a second concept id for
    * supersession, the other base's path for promotion.
    */
-  target: import_zod29.z.string().min(1).optional()
-}).strict();
+  target: import_zod30.z.string().min(1).optional(),
+  /**
+   * Why the operation was performed, where the operation demands one.
+   * `anchor-set` does: a pointer moved by a reader is only auditable if
+   * the reading is recorded beside it.
+   */
+  reason: import_zod30.z.string().min(1).optional(),
+  /** What `anchor-set` changed, derived from the record before and after. */
+  anchors: import_zod30.z.array(kbLogAnchorChangeSchema).optional()
+});
+var kbLogEntrySchema = kbLogEntryFields.passthrough();
+var kbLogEntryWriteSchema = kbLogEntryFields.strict();
 function renderLogEntry(entry) {
-  return `${JSON.stringify(kbLogEntrySchema.parse(entry))}
+  return `${JSON.stringify(kbLogEntryWriteSchema.parse(entry))}
 `;
 }
 var CONFLICT_MARKER = /^(<{7}|\|{7}|={7}|>{7})/;
@@ -6777,11 +7014,11 @@ function parseLog(raw) {
 // src/json-schema.ts
 function kbJsonSchemas() {
   return {
-    recordFrontmatter: import_zod30.z.toJSONSchema(kbRecordFrontmatterSchema, {
+    recordFrontmatter: import_zod31.z.toJSONSchema(kbRecordFrontmatterSchema, {
       io: "input"
     }),
-    composeInput: import_zod30.z.toJSONSchema(composeInputSchema, { io: "input" }),
-    logEntry: import_zod30.z.toJSONSchema(kbLogEntrySchema, { io: "input" })
+    composeInput: import_zod31.z.toJSONSchema(composeInputSchema, { io: "input" }),
+    logEntry: import_zod31.z.toJSONSchema(kbLogEntrySchema, { io: "input" })
   };
 }
 
@@ -6791,25 +7028,25 @@ var schemaCommand = define({
   tool: "kb_schema",
   usage: "schema",
   description: "JSON Schema for frontmatter, write input, and log entries, generated from the enforcing code.",
-  input: import_zod31.z.object({}),
+  input: import_zod32.z.object({}),
   fromArgv: () => ({}),
   run: () => Promise.resolve(kbJsonSchemas())
 });
 
 // src/commands/stamp.ts
 var import_promises10 = require("fs/promises");
-var import_zod32 = require("zod");
+var import_zod33 = require("zod");
 var DIGEST = /^[0-9a-f]{64}$/;
 var stampCommand = define({
   name: "stamp",
   tool: "kb_stamp",
   usage: "stamp [--bundle PATH] [--since DIGEST|FILE]",
   description: "Content stamp of a base \u2014 `load`'s digest, record counts, per-record digests, how many records have drifted anchors \u2014 without any bodies. Takes no bundlePath to stamp every pinned base. With `since`, reports only the bases that moved, naming the changed ids. Reads, never writes.",
-  input: import_zod32.z.object({
-    bundlePath: import_zod32.z.string().min(1).optional().describe(
+  input: import_zod33.z.object({
+    bundlePath: import_zod33.z.string().min(1).optional().describe(
       "Absolute path to one knowledge base. Omit to stamp every pinned base."
     ),
-    since: import_zod32.z.string().min(1).optional().describe(
+    since: import_zod33.z.string().min(1).optional().describe(
       "Prior digest, or path to a prior `stamp --json`; only moved bases return, with changed ids when the baseline is a file."
     )
   }),
@@ -6895,16 +7132,16 @@ async function readBaseline(since) {
 }
 
 // src/commands/status.ts
-var import_zod33 = require("zod");
+var import_zod34 = require("zod");
 var statusCommand = define({
   name: "status",
   tool: "kb_status",
   usage: "status <concept-id> <status>",
   description: "Move a record's status. Compare-and-swap: a concurrent change fails instead of being overwritten.",
-  input: import_zod33.z.object({
+  input: import_zod34.z.object({
     bundlePath,
     conceptId,
-    status: import_zod33.z.enum(KB_RECORD_STATUSES)
+    status: import_zod34.z.enum(KB_RECORD_STATUSES)
   }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
@@ -6919,13 +7156,13 @@ var statusCommand = define({
 });
 
 // src/commands/supersede.ts
-var import_zod34 = require("zod");
+var import_zod35 = require("zod");
 var supersedeCommand = define({
   name: "supersede",
   tool: "kb_supersede",
   usage: "supersede <concept-id> <replacement-id>",
   description: "Mark a record superseded by another, linked in both directions. Use instead of editing a record whose meaning changed.",
-  input: import_zod34.z.object({ bundlePath, conceptId, replacementId: conceptId }),
+  input: import_zod35.z.object({ bundlePath, conceptId, replacementId: conceptId }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
     conceptId: argv[1],
@@ -6939,7 +7176,7 @@ var supersedeCommand = define({
 });
 
 // src/commands/sweep.ts
-var import_zod35 = require("zod");
+var import_zod36 = require("zod");
 var TERMINAL = [
   "resolved",
   "rejected",
@@ -6950,15 +7187,15 @@ var sweepCommand = define({
   tool: "kb_sweep",
   usage: "sweep --tag <tag> --terminal [--dry-run]",
   description: "Delete tagged records that are resolved, rejected or superseded. Refuses without --tag, keeps any record a surviving record still points at, and logs each deletion.",
-  input: import_zod35.z.object({
+  input: import_zod36.z.object({
     bundlePath,
-    tag: import_zod35.z.string({ error: "sweep needs --tag: it never sweeps a whole base" }).min(1).describe("Only records carrying this tag are considered."),
-    terminal: import_zod35.z.literal(true, {
+    tag: import_zod36.z.string({ error: "sweep needs --tag: it never sweeps a whole base" }).min(1).describe("Only records carrying this tag are considered."),
+    terminal: import_zod36.z.literal(true, {
       error: "sweep needs --terminal: it deletes only settled records"
     }).describe(
       "Required. Names the only scope sweep deletes: resolved, rejected and superseded records."
     ),
-    dryRun: import_zod35.z.boolean().optional().describe("Report what would go, and delete nothing.")
+    dryRun: import_zod36.z.boolean().optional().describe("Report what would go, and delete nothing.")
   }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
@@ -7075,16 +7312,16 @@ function renderSweep(result) {
 }
 
 // src/commands/sync-instructions.ts
-var import_zod36 = require("zod");
+var import_zod37 = require("zod");
 var syncInstructionsCommand = define({
   name: "sync-instructions",
   usage: "sync-instructions <file> [--profile NAME] [--budget N] [--full-under N]",
   description: "CLI-only: plant the kb_context block between sentinel comments in AGENTS.md or CLAUDE.md, idempotently.",
-  input: import_zod36.z.object({
-    file: import_zod36.z.string().min(1).describe("The instruction file to edit in place."),
-    budgetTokens: import_zod36.z.number().int().positive().optional(),
-    fullUnderTokens: import_zod36.z.number().int().positive().optional(),
-    profile: import_zod36.z.string().optional()
+  input: import_zod37.z.object({
+    file: import_zod37.z.string().min(1).describe("The instruction file to edit in place."),
+    budgetTokens: import_zod37.z.number().int().positive().optional(),
+    fullUnderTokens: import_zod37.z.number().int().positive().optional(),
+    profile: import_zod37.z.string().optional()
   }),
   fromArgv: (argv) => {
     const budget = argvFlag(argv, "--budget");
@@ -7110,7 +7347,7 @@ var syncInstructionsCommand = define({
 });
 
 // src/commands/trace.ts
-var import_zod37 = require("zod");
+var import_zod38 = require("zod");
 
 // src/trace.ts
 var TRACE_EDGES = [
@@ -7166,11 +7403,11 @@ var traceCommand = define({
   tool: "kb_trace",
   usage: "trace <concept-id> [edges...]",
   description: 'Timeline of how a position was reached, ordered by write time, following supersession, shared anchors and shared sources. Includes rejected, draft and superseded records \u2014 in a history they are the content. For "why is it like this"; kb_load answers "what holds now".',
-  input: import_zod37.z.object({
+  input: import_zod38.z.object({
     bundlePath,
     conceptId,
-    edges: import_zod37.z.array(import_zod37.z.enum(TRACE_EDGES)).optional(),
-    depth: import_zod37.z.number().int().positive().optional()
+    edges: import_zod38.z.array(import_zod38.z.enum(TRACE_EDGES)).optional(),
+    depth: import_zod38.z.number().int().positive().optional()
   }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
@@ -7192,37 +7429,37 @@ var traceCommand = define({
 });
 
 // src/commands/types.ts
-var import_zod38 = require("zod");
+var import_zod39 = require("zod");
 var typesCommand = define({
   name: "types",
   tool: "kb_types",
   usage: "types",
   description: "The twelve record types with their purpose, body sections, and starting status. Read this before writing rather than guessing headings \u2014 a section the type does not define is rejected.",
-  input: import_zod38.z.object({}),
+  input: import_zod39.z.object({}),
   fromArgv: () => ({}),
   run: () => Promise.resolve(RECORD_TYPES)
 });
 
 // src/commands/unpin.ts
-var import_zod39 = require("zod");
+var import_zod40 = require("zod");
 var unpinCommand = define({
   name: "unpin",
   tool: "kb_unpin",
   usage: "unpin [bundle-path]",
   description: "Remove a base from every manifest layer that holds it. Reports the layers touched.",
-  input: import_zod39.z.object({ bundlePath }),
+  input: import_zod40.z.object({ bundlePath }),
   fromArgv: (argv, path) => ({ bundlePath: argv[1] ?? path }),
   run: (_ctx, { bundlePath: path }) => unpinBase(process.cwd(), path)
 });
 
 // src/commands/validate.ts
-var import_zod40 = require("zod");
+var import_zod41 = require("zod");
 var validateCommand = define({
   name: "validate",
   tool: "kb_validate",
   usage: "validate",
   description: "Check pointers no single record can see: supersession links that disagree between the two records, typed causal links, and assumptions that cite sources. Each finding carries a severity: errors fail the exit code, warnings do not.",
-  input: import_zod40.z.object({ bundlePath }),
+  input: import_zod41.z.object({ bundlePath }),
   fromArgv: (_argv, path) => ({ bundlePath: path }),
   run: async ({ store }, { bundlePath: path }) => validateBundle(await store.list(path)),
   // Warnings never fail the exit code; every other severity does.
@@ -7232,16 +7469,16 @@ var validateCommand = define({
 });
 
 // src/commands/verify.ts
-var import_zod41 = require("zod");
+var import_zod42 = require("zod");
 var verifyCommand = define({
   name: "verify",
   tool: "kb_verify",
   usage: "verify <concept-id> --note <text>",
   description: "Append a verified[] event: who checked, when, and what was found. Append-only. A record's own generator is refused unless the actor is `human:`-prefixed.",
-  input: import_zod41.z.object({
+  input: import_zod42.z.object({
     bundlePath,
     conceptId,
-    note: import_zod41.z.string().refine((s) => s.trim().length > 0, {
+    note: import_zod42.z.string().refine((s) => s.trim().length > 0, {
       message: "note must say what the check found"
     })
   }),
@@ -7261,15 +7498,15 @@ var verifyCommand = define({
 });
 
 // src/commands/write.ts
-var import_zod42 = require("zod");
+var import_zod43 = require("zod");
 var writeCommand = define({
   name: "write",
   tool: "kb_write",
   usage: "write <type> < record.json",
   description: "Write one record. Search first \u2014 a duplicate concept id is rejected, not overwritten; kb_types lists each type's sections. An unsourced claim is an `assumption` with assumption: true, never a vague `fact`. Conflicting records get a `risk`, `open-question`, or superseding `decision`. Prefer a new short record over overloading one. Never delete; supersede.",
-  input: import_zod42.z.object({
+  input: import_zod43.z.object({
     bundlePath,
-    type: import_zod42.z.enum(KB_RECORD_TYPES),
+    type: import_zod43.z.enum(KB_RECORD_TYPES),
     input: composeInputSchema
   }),
   fromArgv: async (argv, path, stdin) => ({
@@ -7293,13 +7530,13 @@ var writeCommand = define({
 });
 
 // src/commands/write-decision.ts
-var import_zod43 = require("zod");
+var import_zod44 = require("zod");
 var writeDecisionCommand = define({
   name: "write-decision",
   tool: "kb_write_decision",
   usage: "write-decision < decision.json",
   description: "Write a decision, with `alternative` (what was rejected and why) and `impact` as fields. Record one when a later reader would otherwise simplify the constraint away; skip when the diff already answers it. `sources` for material read, `anchors` for code, `relatedConceptIds` for records.",
-  input: import_zod43.z.object({ bundlePath, input: decisionInputSchema }),
+  input: import_zod44.z.object({ bundlePath, input: decisionInputSchema }),
   fromArgv: async (_argv, path, stdin) => ({
     bundlePath: path,
     input: JSON.parse(await stdin())
@@ -7329,6 +7566,7 @@ var KB_COMMANDS = [
   answerCommand,
   verifyCommand,
   anchorResolveCommand,
+  anchorSetCommand,
   reassessCommand,
   promoteCommand,
   loadCommand,
@@ -7653,6 +7891,7 @@ var KbStore = class {
    * its contents.
    */
   async write(bundlePath2, input, actor = "unknown") {
+    assertActor(actor);
     if (!KB_SLUG_PATTERN.test(input.slug)) {
       throw new KbInvalidConceptIdError("slug must be kebab-case", {
         slug: input.slug
@@ -7754,6 +7993,7 @@ var KbStore = class {
    * timeouts.
    */
   async setStatus(bundlePath2, conceptId2, status, actor = "unknown") {
+    assertActor(actor);
     return this.mutate(
       bundlePath2,
       conceptId2,
@@ -7762,22 +8002,31 @@ var KbStore = class {
     );
   }
   /**
-   * Replaces a record's anchors wholesale, preserving everything else.
-   *
-   * Wholesale rather than merged: the caller just resolved the anchors it is
-   * writing, so it holds the complete current set, and a merge would keep
-   * stale entries the resolution pass deliberately dropped.
-   *
-   * Through the write schema: this is a write, and a defect a hand-edit put in
-   * the frontmatter must not be published back out under an actor stamp.
+   * Replaces a record's anchors, preserving everything else. An array is the
+   * whole set; a function is a patch and runs inside the mutation, against
+   * the anchors the record holds then — see
+   * `decision.anchor-update-patch-inside-mutation`.
    */
   async updateAnchors(bundlePath2, conceptId2, anchors, actor = "unknown") {
-    const checked = anchors.map((anchor) => kbAnchorWriteSchema.parse(anchor));
+    assertActor(actor);
+    let entry = {
+      operation: "anchor-resolve",
+      by: actor
+    };
     return this.mutate(
       bundlePath2,
       conceptId2,
-      (frontmatter) => ({ ...frontmatter, strauss_anchors: checked }),
-      { operation: "anchor-resolve", by: actor }
+      (frontmatter) => {
+        const write = typeof anchors === "function" ? anchors(frontmatter.strauss_anchors ?? []) : { anchors };
+        if (write.log) entry = { ...write.log, by: actor };
+        return {
+          ...frontmatter,
+          strauss_anchors: write.anchors.map(
+            (anchor) => kbAnchorWriteSchema.parse(anchor)
+          )
+        };
+      },
+      () => entry
     );
   }
   /**
@@ -7792,6 +8041,7 @@ var KbStore = class {
    * logs what it publishes.
    */
   async verify(bundlePath2, conceptId2, note, actor = "unknown", at2 = (/* @__PURE__ */ new Date()).toISOString()) {
+    assertActor(actor, { named: true });
     const event = kbVerifiedEventSchema.parse({ by: actor, at: at2, note });
     const existing = await this.read(bundlePath2, conceptId2);
     if (!existing) throw new KbRecordNotFoundError(conceptId2);
@@ -7822,6 +8072,7 @@ var KbStore = class {
    * in normal use, and validation drops to catching hand-edits.
    */
   async supersede(bundlePath2, conceptId2, replacementId, actor = "unknown") {
+    assertActor(actor);
     const replacement = await this.read(bundlePath2, replacementId);
     if (!replacement) throw new KbRecordNotFoundError(replacementId);
     const superseded = await this.markSuperseded(
@@ -7845,6 +8096,7 @@ var KbStore = class {
   }
   /** Resolves an open question, stamping who answered and when. */
   async answer(bundlePath2, conceptId2, answer, actor = "unknown", at2 = (/* @__PURE__ */ new Date()).toISOString()) {
+    assertActor(actor);
     return this.mutate(
       bundlePath2,
       conceptId2,
@@ -7871,6 +8123,7 @@ ${answer}
    * terminal status since the caller listed it is reported, not removed.
    */
   async deleteRecord(bundlePath2, conceptId2, expected, actor = "unknown") {
+    assertActor(actor);
     const target = this.recordPath(bundlePath2, conceptId2);
     const witness = await this.read(bundlePath2, conceptId2);
     if (!witness) throw new KbRecordNotFoundError(conceptId2);
@@ -8174,6 +8427,7 @@ ${answer}
    * base too, where nothing was written.
    */
   async note(bundlePath2, entry) {
+    assertActor(entry.by);
     await this.record(this.root(bundlePath2), entry);
   }
   /**
@@ -8226,7 +8480,10 @@ ${answer}
       throw new KbWriteConflictError(conceptId2);
     }
     await this.publish(target, contents, true, conceptId2);
-    await this.record(this.root(bundlePath2), { ...entry, conceptId: conceptId2 });
+    await this.record(this.root(bundlePath2), {
+      ...typeof entry === "function" ? entry() : entry,
+      conceptId: conceptId2
+    });
     return { conceptId: conceptId2, frontmatter, body };
   }
   /**
@@ -8431,9 +8688,18 @@ function normalizeActor(id) {
   if (colon === -1) return id.toLowerCase();
   return id.slice(0, colon + 1).toLowerCase() + id.slice(colon + 1);
 }
+var KB_ACTOR_PATTERN = /^[A-Za-z][\w-]*(?::[\p{L}\p{M}\p{N}_.@+/-]+)?$/u;
+function assertActor(actor, { named = false } = {}) {
+  if (!KB_ACTOR_PATTERN.test(actor)) {
+    throw new KbInvalidActorError(actor, "is not kind or kind:name");
+  }
+  if (named && normalizeActor(actor) === "unknown") {
+    throw new KbInvalidActorError(actor, "cannot verify: name who checked");
+  }
+}
 
 // src/version.ts
-var VERSION = true ? "0.1.20" : "0.0.0-dev";
+var VERSION = true ? "0.1.22" : "0.0.0-dev";
 
 // src/mcp.ts
 function createKbMcpServer() {