@saasontools/strauss-kb 0.1.4 → 0.1.6

package/dist/index.d.cts

@@ -31,6 +31,17 @@ declare const kbActorStampSchema: z.ZodObject<{
     by: z.ZodString;
     at: z.ZodString;
 }, z.core.$loose>;
+/**
+ * A `verified[]` event as this package writes one: the actor stamp plus a
+ * required note saying what the check found. Write-side only — the frontmatter
+ * keeps reading `verified` with `kbActorStampSchema`, because OKF-native
+ * entries carry no note and a consumer must not reject conformant records.
+ */
+declare const kbVerifiedEventSchema: z.ZodObject<{
+    by: z.ZodString;
+    at: z.ZodString;
+    note: z.ZodString;
+}, z.core.$loose>;
 /**
  * Where a record attaches in the code.
  *
@@ -124,6 +135,7 @@ declare const kbRecordFrontmatterSchema: z.ZodObject<{
 }, z.core.$loose>;
 type KbSource = z.infer<typeof kbSourceSchema>;
 type KbActorStamp = z.infer<typeof kbActorStampSchema>;
+type KbVerifiedEvent = z.infer<typeof kbVerifiedEventSchema>;
 type KbAnchor = z.infer<typeof kbAnchorSchema>;
 type KbRecordFrontmatter = z.infer<typeof kbRecordFrontmatterSchema>;
 type KbRecord = {
@@ -318,8 +330,9 @@ type KbLoadResult = {
     /** Named only. Their bodies are reachable through `trace`. */
     superseded: KbSupersededStub[];
     recordCount: number;
-    approxTokens: number;
-    budgetTokens: number;
+    tokensLoaded: number;
+    /** `null` when loaded via `all`: no ceiling was applied. */
+    budgetTokens: number | null;
 } | {
     loaded: false;
     recordCount: number;
@@ -385,6 +398,18 @@ declare class KbStore {
      * timeouts.
      */
     setStatus(bundlePath: string, conceptId: string, status: KbRecordStatus, actor?: string): Promise<KbRecord>;
+    /**
+     * Appends one `verified[]` event: who checked the record, when, and what the
+     * check found. Append-only — prior events are history, and are spread into
+     * the new array untouched rather than reshaped through the write schema.
+     *
+     * A record's generator cannot verify its own record unless the actor is
+     * human: the generator re-reading its own output is not an independent
+     * check. The rule runs before the mutation so a refusal never publishes,
+     * and the refusal is logged under its own operation name — `mutate` only
+     * logs what it publishes.
+     */
+    verify(bundlePath: string, conceptId: string, note: string, actor?: string, at?: string): Promise<KbRecord>;
     /**
      * Marks `conceptId` superseded by `replacementId`, and links both directions.
      *
@@ -430,10 +455,15 @@ declare class KbStore {
      * Refuses rather than truncates when the base is too large. A truncated base
      * is indistinguishable from a complete one, so a caller would answer "that
      * was never decided" from a slice it did not know was a slice.
+     *
+     * That refusal is the default guardrail. `all` bypasses it outright and
+     * always hands back the whole bundle: an explicit, never-accidental escape
+     * hatch for an operator who has the budget to spend, not a wider default.
      */
     load(bundlePath: string, options?: {
         budgetTokens?: number;
         type?: string;
+        all?: boolean;
     }): Promise<KbLoadResult>;
     /** How a position was arrived at, as a timeline. See `trace.ts`. */
     trace(bundlePath: string, seedId: string, options?: KbTraceOptions): Promise<KbTraceStep[]>;
@@ -516,6 +546,7 @@ declare enum ErrorTypes {
     KbRecordAlreadyExists = "KbRecordAlreadyExists",
     KbInvalidConceptId = "KbInvalidConceptId",
     KbRecordNotFound = "KbRecordNotFound",
+    KbSelfVerification = "KbSelfVerification",
     KbWriteConflict = "KbWriteConflict"
 }
 type ErrorDetails = Record<string, string | boolean | number | string[] | boolean[] | number[]>;
@@ -558,6 +589,13 @@ declare class KbWriteConflictError extends BaseError {
     readonly conceptId: string;
     constructor(conceptId: string);
 }
+/** A generator confirming its own record adds no independent check. */
+declare class KbSelfVerificationError extends BaseError {
+    readonly conceptId: string;
+    readonly actor: string;
+    readonly generatedBy: string;
+    constructor(conceptId: string, actor: string, generatedBy: string);
+}
 declare class KbInvalidConceptIdError extends BaseError {
     constructor(message: string, details: Record<string, string>);
 }
@@ -1259,4 +1297,4 @@ declare function parseMarkdownWithFrontmatter<S extends z.ZodType>(text: string,
     frontmatter: ReturnType<S["safeParse"]>;
 };
 
-export { BaseError, CONTEXT_BEGIN, CONTEXT_END, CONTEXT_PROFILES, type ComposeInput, type ComposedRecord, DECISION_TYPE, type DecisionInput, type DiffFile, type DiffHunk, type DiffMatch, type ErrorDetails, type ErrorProps, ErrorTypes, Fault, INDEX_FILE, KB_COMMANDS, KB_COMMANDS_BY_NAME, KB_CONCEPT_ID_PATTERN, KB_CONFIDENCES, KB_DIR, KB_MATERIALITIES, KB_RECORD_STATUSES, KB_RECORD_TYPES, KB_SLUG_PATTERN, type KbActorStamp, type KbAdjudicated, type KbAnchor, KbBaseFrozenError, type KbCommand, type KbCommandContext, type KbContextBudgets, type KbContextOptions, type KbContextResult, KbInvalidConceptIdError, type KbLoadResult, type KbLogEntry, type KbLogReadResult, type KbLogger, type KbMergedPin, type KbMergedPins, type KbPin, type KbPinLayer, type KbPinOptions, type KbPinResult, type KbPinStatus, KbPinsMalformedError, type KbPinsManifest, type KbRecord, KbRecordAlreadyExistsError, type KbRecordFrontmatter, KbRecordNotFoundError, type KbRecordStatus, type KbRecordType, type KbRecordTypeSpec, type KbSearchLogger, type KbSource, type KbStanding, KbStore, type KbSupersededStub, type KbSyncResult, type KbTraceEdge, type KbTraceOptions, type KbTraceStep, type KbValidationProblem, type KbWarning, KbWriteConflictError, type KbWriteInput, LOG_FILE, type MatchOptions, NO_DECISION_SLUG, PINS_FILE, PINS_LOCAL_FILE, PIN_LAYERS, type QmdModule, RECORD_TYPES, SEARCH_INDEX_FILE, type SearchHit, type SearchOptions, type SymbolRange, TRACE_EDGES, adjudicate, assertBaseNotFrozen, buildContext, composeDecisionRecord, composeInputSchema, composeNoDecisionRecord, composeRecord, contextProfileBudgets, createKbMcpServer, decisionInputSchema, indexIsStale, isKbRecordType, isNoDecisionRecord, kbActorStampSchema, kbAnchorSchema, kbConceptIdSchema, kbJsonSchemas, kbLogEntrySchema, kbRecordFrontmatterSchema, kbSourceSchema, listPins, loadQmd, matchToDiff, mergedContextBudgets, parseLog, parseMarkdownWithFrontmatter, pinBase, readMergedPins, readPinsLayer, renderIndex, renderIndexLine, renderLogEntry, resolveHeads, resolveHits, resolvePinPath, runKbCli, runKbMcpServer, searchBase, selectDecisions, splitMarkdownFrontmatter, stringifyMarkdownWithFrontmatter, syncInstructions, toHookJson, trace, unpinBase, validateBundle };
+export { BaseError, CONTEXT_BEGIN, CONTEXT_END, CONTEXT_PROFILES, type ComposeInput, type ComposedRecord, DECISION_TYPE, type DecisionInput, type DiffFile, type DiffHunk, type DiffMatch, type ErrorDetails, type ErrorProps, ErrorTypes, Fault, INDEX_FILE, KB_COMMANDS, KB_COMMANDS_BY_NAME, KB_CONCEPT_ID_PATTERN, KB_CONFIDENCES, KB_DIR, KB_MATERIALITIES, KB_RECORD_STATUSES, KB_RECORD_TYPES, KB_SLUG_PATTERN, type KbActorStamp, type KbAdjudicated, type KbAnchor, KbBaseFrozenError, type KbCommand, type KbCommandContext, type KbContextBudgets, type KbContextOptions, type KbContextResult, KbInvalidConceptIdError, type KbLoadResult, type KbLogEntry, type KbLogReadResult, type KbLogger, type KbMergedPin, type KbMergedPins, type KbPin, type KbPinLayer, type KbPinOptions, type KbPinResult, type KbPinStatus, KbPinsMalformedError, type KbPinsManifest, type KbRecord, KbRecordAlreadyExistsError, type KbRecordFrontmatter, KbRecordNotFoundError, type KbRecordStatus, type KbRecordType, type KbRecordTypeSpec, type KbSearchLogger, KbSelfVerificationError, type KbSource, type KbStanding, KbStore, type KbSupersededStub, type KbSyncResult, type KbTraceEdge, type KbTraceOptions, type KbTraceStep, type KbValidationProblem, type KbVerifiedEvent, type KbWarning, KbWriteConflictError, type KbWriteInput, LOG_FILE, type MatchOptions, NO_DECISION_SLUG, PINS_FILE, PINS_LOCAL_FILE, PIN_LAYERS, type QmdModule, RECORD_TYPES, SEARCH_INDEX_FILE, type SearchHit, type SearchOptions, type SymbolRange, TRACE_EDGES, adjudicate, assertBaseNotFrozen, buildContext, composeDecisionRecord, composeInputSchema, composeNoDecisionRecord, composeRecord, contextProfileBudgets, createKbMcpServer, decisionInputSchema, indexIsStale, isKbRecordType, isNoDecisionRecord, kbActorStampSchema, kbAnchorSchema, kbConceptIdSchema, kbJsonSchemas, kbLogEntrySchema, kbRecordFrontmatterSchema, kbSourceSchema, kbVerifiedEventSchema, listPins, loadQmd, matchToDiff, mergedContextBudgets, parseLog, parseMarkdownWithFrontmatter, pinBase, readMergedPins, readPinsLayer, renderIndex, renderIndexLine, renderLogEntry, resolveHeads, resolveHits, resolvePinPath, runKbCli, runKbMcpServer, searchBase, selectDecisions, splitMarkdownFrontmatter, stringifyMarkdownWithFrontmatter, syncInstructions, toHookJson, trace, unpinBase, validateBundle };

package/dist/index.d.ts

@@ -31,6 +31,17 @@ declare const kbActorStampSchema: z.ZodObject<{
     by: z.ZodString;
     at: z.ZodString;
 }, z.core.$loose>;
+/**
+ * A `verified[]` event as this package writes one: the actor stamp plus a
+ * required note saying what the check found. Write-side only — the frontmatter
+ * keeps reading `verified` with `kbActorStampSchema`, because OKF-native
+ * entries carry no note and a consumer must not reject conformant records.
+ */
+declare const kbVerifiedEventSchema: z.ZodObject<{
+    by: z.ZodString;
+    at: z.ZodString;
+    note: z.ZodString;
+}, z.core.$loose>;
 /**
  * Where a record attaches in the code.
  *
@@ -124,6 +135,7 @@ declare const kbRecordFrontmatterSchema: z.ZodObject<{
 }, z.core.$loose>;
 type KbSource = z.infer<typeof kbSourceSchema>;
 type KbActorStamp = z.infer<typeof kbActorStampSchema>;
+type KbVerifiedEvent = z.infer<typeof kbVerifiedEventSchema>;
 type KbAnchor = z.infer<typeof kbAnchorSchema>;
 type KbRecordFrontmatter = z.infer<typeof kbRecordFrontmatterSchema>;
 type KbRecord = {
@@ -318,8 +330,9 @@ type KbLoadResult = {
     /** Named only. Their bodies are reachable through `trace`. */
     superseded: KbSupersededStub[];
     recordCount: number;
-    approxTokens: number;
-    budgetTokens: number;
+    tokensLoaded: number;
+    /** `null` when loaded via `all`: no ceiling was applied. */
+    budgetTokens: number | null;
 } | {
     loaded: false;
     recordCount: number;
@@ -385,6 +398,18 @@ declare class KbStore {
      * timeouts.
      */
     setStatus(bundlePath: string, conceptId: string, status: KbRecordStatus, actor?: string): Promise<KbRecord>;
+    /**
+     * Appends one `verified[]` event: who checked the record, when, and what the
+     * check found. Append-only — prior events are history, and are spread into
+     * the new array untouched rather than reshaped through the write schema.
+     *
+     * A record's generator cannot verify its own record unless the actor is
+     * human: the generator re-reading its own output is not an independent
+     * check. The rule runs before the mutation so a refusal never publishes,
+     * and the refusal is logged under its own operation name — `mutate` only
+     * logs what it publishes.
+     */
+    verify(bundlePath: string, conceptId: string, note: string, actor?: string, at?: string): Promise<KbRecord>;
     /**
      * Marks `conceptId` superseded by `replacementId`, and links both directions.
      *
@@ -430,10 +455,15 @@ declare class KbStore {
      * Refuses rather than truncates when the base is too large. A truncated base
      * is indistinguishable from a complete one, so a caller would answer "that
      * was never decided" from a slice it did not know was a slice.
+     *
+     * That refusal is the default guardrail. `all` bypasses it outright and
+     * always hands back the whole bundle: an explicit, never-accidental escape
+     * hatch for an operator who has the budget to spend, not a wider default.
      */
     load(bundlePath: string, options?: {
         budgetTokens?: number;
         type?: string;
+        all?: boolean;
     }): Promise<KbLoadResult>;
     /** How a position was arrived at, as a timeline. See `trace.ts`. */
     trace(bundlePath: string, seedId: string, options?: KbTraceOptions): Promise<KbTraceStep[]>;
@@ -516,6 +546,7 @@ declare enum ErrorTypes {
     KbRecordAlreadyExists = "KbRecordAlreadyExists",
     KbInvalidConceptId = "KbInvalidConceptId",
     KbRecordNotFound = "KbRecordNotFound",
+    KbSelfVerification = "KbSelfVerification",
     KbWriteConflict = "KbWriteConflict"
 }
 type ErrorDetails = Record<string, string | boolean | number | string[] | boolean[] | number[]>;
@@ -558,6 +589,13 @@ declare class KbWriteConflictError extends BaseError {
     readonly conceptId: string;
     constructor(conceptId: string);
 }
+/** A generator confirming its own record adds no independent check. */
+declare class KbSelfVerificationError extends BaseError {
+    readonly conceptId: string;
+    readonly actor: string;
+    readonly generatedBy: string;
+    constructor(conceptId: string, actor: string, generatedBy: string);
+}
 declare class KbInvalidConceptIdError extends BaseError {
     constructor(message: string, details: Record<string, string>);
 }
@@ -1259,4 +1297,4 @@ declare function parseMarkdownWithFrontmatter<S extends z.ZodType>(text: string,
     frontmatter: ReturnType<S["safeParse"]>;
 };
 
-export { BaseError, CONTEXT_BEGIN, CONTEXT_END, CONTEXT_PROFILES, type ComposeInput, type ComposedRecord, DECISION_TYPE, type DecisionInput, type DiffFile, type DiffHunk, type DiffMatch, type ErrorDetails, type ErrorProps, ErrorTypes, Fault, INDEX_FILE, KB_COMMANDS, KB_COMMANDS_BY_NAME, KB_CONCEPT_ID_PATTERN, KB_CONFIDENCES, KB_DIR, KB_MATERIALITIES, KB_RECORD_STATUSES, KB_RECORD_TYPES, KB_SLUG_PATTERN, type KbActorStamp, type KbAdjudicated, type KbAnchor, KbBaseFrozenError, type KbCommand, type KbCommandContext, type KbContextBudgets, type KbContextOptions, type KbContextResult, KbInvalidConceptIdError, type KbLoadResult, type KbLogEntry, type KbLogReadResult, type KbLogger, type KbMergedPin, type KbMergedPins, type KbPin, type KbPinLayer, type KbPinOptions, type KbPinResult, type KbPinStatus, KbPinsMalformedError, type KbPinsManifest, type KbRecord, KbRecordAlreadyExistsError, type KbRecordFrontmatter, KbRecordNotFoundError, type KbRecordStatus, type KbRecordType, type KbRecordTypeSpec, type KbSearchLogger, type KbSource, type KbStanding, KbStore, type KbSupersededStub, type KbSyncResult, type KbTraceEdge, type KbTraceOptions, type KbTraceStep, type KbValidationProblem, type KbWarning, KbWriteConflictError, type KbWriteInput, LOG_FILE, type MatchOptions, NO_DECISION_SLUG, PINS_FILE, PINS_LOCAL_FILE, PIN_LAYERS, type QmdModule, RECORD_TYPES, SEARCH_INDEX_FILE, type SearchHit, type SearchOptions, type SymbolRange, TRACE_EDGES, adjudicate, assertBaseNotFrozen, buildContext, composeDecisionRecord, composeInputSchema, composeNoDecisionRecord, composeRecord, contextProfileBudgets, createKbMcpServer, decisionInputSchema, indexIsStale, isKbRecordType, isNoDecisionRecord, kbActorStampSchema, kbAnchorSchema, kbConceptIdSchema, kbJsonSchemas, kbLogEntrySchema, kbRecordFrontmatterSchema, kbSourceSchema, listPins, loadQmd, matchToDiff, mergedContextBudgets, parseLog, parseMarkdownWithFrontmatter, pinBase, readMergedPins, readPinsLayer, renderIndex, renderIndexLine, renderLogEntry, resolveHeads, resolveHits, resolvePinPath, runKbCli, runKbMcpServer, searchBase, selectDecisions, splitMarkdownFrontmatter, stringifyMarkdownWithFrontmatter, syncInstructions, toHookJson, trace, unpinBase, validateBundle };
+export { BaseError, CONTEXT_BEGIN, CONTEXT_END, CONTEXT_PROFILES, type ComposeInput, type ComposedRecord, DECISION_TYPE, type DecisionInput, type DiffFile, type DiffHunk, type DiffMatch, type ErrorDetails, type ErrorProps, ErrorTypes, Fault, INDEX_FILE, KB_COMMANDS, KB_COMMANDS_BY_NAME, KB_CONCEPT_ID_PATTERN, KB_CONFIDENCES, KB_DIR, KB_MATERIALITIES, KB_RECORD_STATUSES, KB_RECORD_TYPES, KB_SLUG_PATTERN, type KbActorStamp, type KbAdjudicated, type KbAnchor, KbBaseFrozenError, type KbCommand, type KbCommandContext, type KbContextBudgets, type KbContextOptions, type KbContextResult, KbInvalidConceptIdError, type KbLoadResult, type KbLogEntry, type KbLogReadResult, type KbLogger, type KbMergedPin, type KbMergedPins, type KbPin, type KbPinLayer, type KbPinOptions, type KbPinResult, type KbPinStatus, KbPinsMalformedError, type KbPinsManifest, type KbRecord, KbRecordAlreadyExistsError, type KbRecordFrontmatter, KbRecordNotFoundError, type KbRecordStatus, type KbRecordType, type KbRecordTypeSpec, type KbSearchLogger, KbSelfVerificationError, type KbSource, type KbStanding, KbStore, type KbSupersededStub, type KbSyncResult, type KbTraceEdge, type KbTraceOptions, type KbTraceStep, type KbValidationProblem, type KbVerifiedEvent, type KbWarning, KbWriteConflictError, type KbWriteInput, LOG_FILE, type MatchOptions, NO_DECISION_SLUG, PINS_FILE, PINS_LOCAL_FILE, PIN_LAYERS, type QmdModule, RECORD_TYPES, SEARCH_INDEX_FILE, type SearchHit, type SearchOptions, type SymbolRange, TRACE_EDGES, adjudicate, assertBaseNotFrozen, buildContext, composeDecisionRecord, composeInputSchema, composeNoDecisionRecord, composeRecord, contextProfileBudgets, createKbMcpServer, decisionInputSchema, indexIsStale, isKbRecordType, isNoDecisionRecord, kbActorStampSchema, kbAnchorSchema, kbConceptIdSchema, kbJsonSchemas, kbLogEntrySchema, kbRecordFrontmatterSchema, kbSourceSchema, kbVerifiedEventSchema, listPins, loadQmd, matchToDiff, mergedContextBudgets, parseLog, parseMarkdownWithFrontmatter, pinBase, readMergedPins, readPinsLayer, renderIndex, renderIndexLine, renderLogEntry, resolveHeads, resolveHits, resolvePinPath, runKbCli, runKbMcpServer, searchBase, selectDecisions, splitMarkdownFrontmatter, stringifyMarkdownWithFrontmatter, syncInstructions, toHookJson, trace, unpinBase, validateBundle };

package/dist/index.js

@@ -1,10 +1,10 @@
 import {
   runKbCli
-} from "./chunk-Y5C7Z2HG.js";
+} from "./chunk-V7TRZ2ER.js";
 import {
   createKbMcpServer,
   runKbMcpServer
-} from "./chunk-TS26G7TL.js";
+} from "./chunk-BVF7X5VO.js";
 import {
   BaseError,
   CONTEXT_BEGIN,
@@ -28,6 +28,7 @@ import {
   KbPinsMalformedError,
   KbRecordAlreadyExistsError,
   KbRecordNotFoundError,
+  KbSelfVerificationError,
   KbStore,
   KbWriteConflictError,
   LOG_FILE,
@@ -57,6 +58,7 @@ import {
   kbLogEntrySchema,
   kbRecordFrontmatterSchema,
   kbSourceSchema,
+  kbVerifiedEventSchema,
   listPins,
   loadQmd,
   mergedContextBudgets,
@@ -80,7 +82,7 @@ import {
   trace,
   unpinBase,
   validateBundle
-} from "./chunk-EDH43Z7J.js";
+} from "./chunk-PNSRTKYN.js";
 
 // src/match-diff.ts
 function matchToDiff(files, records, options = {}) {
@@ -184,6 +186,7 @@ export {
   KbPinsMalformedError,
   KbRecordAlreadyExistsError,
   KbRecordNotFoundError,
+  KbSelfVerificationError,
   KbStore,
   KbWriteConflictError,
   LOG_FILE,
@@ -214,6 +217,7 @@ export {
   kbLogEntrySchema,
   kbRecordFrontmatterSchema,
   kbSourceSchema,
+  kbVerifiedEventSchema,
   listPins,
   loadQmd,
   matchToDiff,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/match-diff.ts"],"sourcesContent":["import { adjudicate, type KbAdjudicated } from \"./adjudicate.js\";\nimport type { KbAnchor, KbRecord } from \"./kb-record.schema.js\";\n\n/**\n * Which records apply to which part of a change.\n *\n * Takes a structural description of a diff rather than a patch, so this package\n * carries no diff parser: callers already have one, and a knowledge base has no\n * business preferring a particular flavour of unified diff.\n *\n * Deterministic on purpose. Every step here is mechanical — the one judgment,\n * whether a matched record is worth showing a reviewer, is deliberately absent.\n * A model placed here would sit between the reviewer and their diff on every\n * review, to answer a question nobody has yet shown needs asking.\n *\n * Distinct from `load()`, which hands a reader the whole base. That answers\n * \"does anything address this question\"; this answers \"what is attached to this\n * code\", and an anchor is the author's own statement rather than an inference\n * from one. A reader guessing which record relates to a hunk would be guessing\n * at something already written down — and a diff has dozens of hunks, which is\n * dozens of reader calls against microseconds of matching. Where they compose:\n * this narrows a hunk to a few records, and a reader asked to explain them gets\n * those, not the base.\n */\nexport type DiffHunk = {\n  /** 1-based, inclusive, in the file's post-change line numbering. */\n  startLine: number;\n  endLine: number;\n};\n\nexport type DiffFile = {\n  /** Repo-relative, matching how anchors are written. */\n  filePath: string;\n  hunks: DiffHunk[];\n};\n\n/**\n * A symbol resolved to lines. Supplied by whatever the caller uses to index\n * symbols; absence is tolerated — see `place()`.\n */\nexport type SymbolRange = {\n  file: string;\n  symbol: string;\n  startLine: number;\n  endLine: number;\n};\n\nexport type DiffMatch = {\n  filePath: string;\n  hunk: DiffHunk;\n  /** Current records first — what still holds should be read before what does not. */\n  records: KbAdjudicated[];\n  /**\n   * `symbol` when every record here was placed by a resolved symbol range,\n   * `file` when at least one fell back to the whole file. Reported rather than\n   * hidden: a caller showing a file-level match as though it were pinned to\n   * these lines is claiming a precision it does not have.\n   */\n  precision: \"symbol\" | \"file\";\n};\n\nexport type MatchOptions = {\n  /** Without these, symbol anchors degrade to file level rather than vanishing. */\n  symbolRanges?: SymbolRange[];\n  now?: Date;\n};\n\nexport function matchToDiff(\n  files: DiffFile[],\n  records: KbRecord[],\n  options: MatchOptions = {},\n): DiffMatch[] {\n  const ranges = indexRanges(options.symbolRanges ?? []);\n  const anchored = records.filter(\n    (record) => (record.frontmatter.strauss_anchors ?? []).length > 0,\n  );\n  const matches: DiffMatch[] = [];\n\n  for (const file of files) {\n    const candidates = anchored\n      .map((record) => ({\n        record,\n        anchors: (record.frontmatter.strauss_anchors ?? []).filter(\n          (anchor) => normalize(anchor.file) === normalize(file.filePath),\n        ),\n      }))\n      .filter(({ anchors }) => anchors.length > 0);\n    if (!candidates.length) continue;\n\n    for (const hunk of file.hunks) {\n      const hits: KbRecord[] = [];\n      let precision: DiffMatch[\"precision\"] = \"symbol\";\n\n      for (const { record, anchors } of candidates) {\n        const placement = place(anchors, file.filePath, hunk, ranges);\n        if (placement === \"miss\") continue;\n        if (placement === \"file\") precision = \"file\";\n        hits.push(record);\n      }\n\n      if (!hits.length) continue;\n      matches.push({\n        filePath: file.filePath,\n        hunk,\n        records: order(adjudicate(hits, records, options.now)),\n        precision,\n      });\n    }\n  }\n\n  return matches;\n}\n\n/**\n * Whether any of a record's anchors puts it on this hunk.\n *\n * An anchor naming only a file is about the whole file, so it lands on every\n * hunk in it. One naming a symbol lands only where that symbol's lines overlap\n * — unless nothing resolved the symbol, in which case it falls back to the file\n * rather than disappearing. A record silently absent because a resolver was\n * unavailable is worse than one shown imprecisely and labelled as such.\n */\nfunction place(\n  anchors: KbAnchor[],\n  filePath: string,\n  hunk: DiffHunk,\n  ranges: Map<string, SymbolRange[]>,\n): \"symbol\" | \"file\" | \"miss\" {\n  let fallback: \"file\" | \"miss\" = \"miss\";\n\n  for (const anchor of anchors) {\n    if (!anchor.symbol) return \"file\";\n\n    const resolved = ranges.get(key(filePath, anchor.symbol));\n    if (!resolved?.length) {\n      fallback = \"file\";\n      continue;\n    }\n    if (resolved.some((range) => overlaps(range, hunk))) return \"symbol\";\n  }\n\n  return fallback;\n}\n\nfunction overlaps(range: SymbolRange, hunk: DiffHunk): boolean {\n  return range.startLine <= hunk.endLine && hunk.startLine <= range.endLine;\n}\n\n/** Current before superseded, then oldest first, so an arc reads in order. */\nfunction order(records: KbAdjudicated[]): KbAdjudicated[] {\n  const rank: Record<string, number> = {\n    current: 0,\n    unsettled: 1,\n    open: 2,\n    superseded: 3,\n    rejected: 4,\n  };\n  return [...records].sort(\n    (left, right) =>\n      (rank[left.standing] ?? 9) - (rank[right.standing] ?? 9) ||\n      (left.record.frontmatter.generated?.at ?? \"\").localeCompare(\n        right.record.frontmatter.generated?.at ?? \"\",\n      ),\n  );\n}\n\nfunction indexRanges(ranges: SymbolRange[]): Map<string, SymbolRange[]> {\n  const byKey = new Map<string, SymbolRange[]>();\n  for (const range of ranges) {\n    const id = key(range.file, range.symbol);\n    byKey.set(id, [...(byKey.get(id) ?? []), range]);\n  }\n  return byKey;\n}\n\nfunction key(file: string, symbol: string): string {\n  return `${normalize(file)}#${symbol}`;\n}\n\n/** Anchors are written by hand often enough that `./` shows up. */\nfunction normalize(path: string): string {\n  return path.replace(/^\\.\\//, \"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmEO,SAAS,YACd,OACA,SACA,UAAwB,CAAC,GACZ;AACb,QAAM,SAAS,YAAY,QAAQ,gBAAgB,CAAC,CAAC;AACrD,QAAM,WAAW,QAAQ;AAAA,IACvB,CAAC,YAAY,OAAO,YAAY,mBAAmB,CAAC,GAAG,SAAS;AAAA,EAClE;AACA,QAAM,UAAuB,CAAC;AAE9B,aAAW,QAAQ,OAAO;AACxB,UAAM,aAAa,SAChB,IAAI,CAAC,YAAY;AAAA,MAChB;AAAA,MACA,UAAU,OAAO,YAAY,mBAAmB,CAAC,GAAG;AAAA,QAClD,CAAC,WAAW,UAAU,OAAO,IAAI,MAAM,UAAU,KAAK,QAAQ;AAAA,MAChE;AAAA,IACF,EAAE,EACD,OAAO,CAAC,EAAE,QAAQ,MAAM,QAAQ,SAAS,CAAC;AAC7C,QAAI,CAAC,WAAW,OAAQ;AAExB,eAAW,QAAQ,KAAK,OAAO;AAC7B,YAAM,OAAmB,CAAC;AAC1B,UAAI,YAAoC;AAExC,iBAAW,EAAE,QAAQ,QAAQ,KAAK,YAAY;AAC5C,cAAM,YAAY,MAAM,SAAS,KAAK,UAAU,MAAM,MAAM;AAC5D,YAAI,cAAc,OAAQ;AAC1B,YAAI,cAAc,OAAQ,aAAY;AACtC,aAAK,KAAK,MAAM;AAAA,MAClB;AAEA,UAAI,CAAC,KAAK,OAAQ;AAClB,cAAQ,KAAK;AAAA,QACX,UAAU,KAAK;AAAA,QACf;AAAA,QACA,SAAS,MAAM,WAAW,MAAM,SAAS,QAAQ,GAAG,CAAC;AAAA,QACrD;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAWA,SAAS,MACP,SACA,UACA,MACA,QAC4B;AAC5B,MAAI,WAA4B;AAEhC,aAAW,UAAU,SAAS;AAC5B,QAAI,CAAC,OAAO,OAAQ,QAAO;AAE3B,UAAM,WAAW,OAAO,IAAI,IAAI,UAAU,OAAO,MAAM,CAAC;AACxD,QAAI,CAAC,UAAU,QAAQ;AACrB,iBAAW;AACX;AAAA,IACF;AACA,QAAI,SAAS,KAAK,CAAC,UAAU,SAAS,OAAO,IAAI,CAAC,EAAG,QAAO;AAAA,EAC9D;AAEA,SAAO;AACT;AAEA,SAAS,SAAS,OAAoB,MAAyB;AAC7D,SAAO,MAAM,aAAa,KAAK,WAAW,KAAK,aAAa,MAAM;AACpE;AAGA,SAAS,MAAM,SAA2C;AACxD,QAAM,OAA+B;AAAA,IACnC,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,YAAY;AAAA,IACZ,UAAU;AAAA,EACZ;AACA,SAAO,CAAC,GAAG,OAAO,EAAE;AAAA,IAClB,CAAC,MAAM,WACJ,KAAK,KAAK,QAAQ,KAAK,MAAM,KAAK,MAAM,QAAQ,KAAK,OACrD,KAAK,OAAO,YAAY,WAAW,MAAM,IAAI;AAAA,MAC5C,MAAM,OAAO,YAAY,WAAW,MAAM;AAAA,IAC5C;AAAA,EACJ;AACF;AAEA,SAAS,YAAY,QAAmD;AACtE,QAAM,QAAQ,oBAAI,IAA2B;AAC7C,aAAW,SAAS,QAAQ;AAC1B,UAAM,KAAK,IAAI,MAAM,MAAM,MAAM,MAAM;AACvC,UAAM,IAAI,IAAI,CAAC,GAAI,MAAM,IAAI,EAAE,KAAK,CAAC,GAAI,KAAK,CAAC;AAAA,EACjD;AACA,SAAO;AACT;AAEA,SAAS,IAAI,MAAc,QAAwB;AACjD,SAAO,GAAG,UAAU,IAAI,CAAC,IAAI,MAAM;AACrC;AAGA,SAAS,UAAU,MAAsB;AACvC,SAAO,KAAK,QAAQ,SAAS,EAAE;AACjC;","names":[]}
+{"version":3,"sources":["../src/match-diff.ts"],"sourcesContent":["import { adjudicate, type KbAdjudicated } from \"./adjudicate.js\";\nimport type { KbAnchor, KbRecord } from \"./kb-record.schema.js\";\n\n/**\n * Which records apply to which part of a change.\n *\n * Takes a structural description of a diff rather than a patch, so this package\n * carries no diff parser: callers already have one, and a knowledge base has no\n * business preferring a particular flavour of unified diff.\n *\n * Deterministic on purpose. Every step here is mechanical — the one judgment,\n * whether a matched record is worth showing a reviewer, is deliberately absent.\n * A model placed here would sit between the reviewer and their diff on every\n * review, to answer a question nobody has yet shown needs asking.\n *\n * Distinct from `load()`, which hands a reader the whole base. That answers\n * \"does anything address this question\"; this answers \"what is attached to this\n * code\", and an anchor is the author's own statement rather than an inference\n * from one. A reader guessing which record relates to a hunk would be guessing\n * at something already written down — and a diff has dozens of hunks, which is\n * dozens of reader calls against microseconds of matching. Where they compose:\n * this narrows a hunk to a few records, and a reader asked to explain them gets\n * those, not the base.\n */\nexport type DiffHunk = {\n  /** 1-based, inclusive, in the file's post-change line numbering. */\n  startLine: number;\n  endLine: number;\n};\n\nexport type DiffFile = {\n  /** Repo-relative, matching how anchors are written. */\n  filePath: string;\n  hunks: DiffHunk[];\n};\n\n/**\n * A symbol resolved to lines. Supplied by whatever the caller uses to index\n * symbols; absence is tolerated — see `place()`.\n */\nexport type SymbolRange = {\n  file: string;\n  symbol: string;\n  startLine: number;\n  endLine: number;\n};\n\nexport type DiffMatch = {\n  filePath: string;\n  hunk: DiffHunk;\n  /** Current records first — what still holds should be read before what does not. */\n  records: KbAdjudicated[];\n  /**\n   * `symbol` when every record here was placed by a resolved symbol range,\n   * `file` when at least one fell back to the whole file. Reported rather than\n   * hidden: a caller showing a file-level match as though it were pinned to\n   * these lines is claiming a precision it does not have.\n   */\n  precision: \"symbol\" | \"file\";\n};\n\nexport type MatchOptions = {\n  /** Without these, symbol anchors degrade to file level rather than vanishing. */\n  symbolRanges?: SymbolRange[];\n  now?: Date;\n};\n\nexport function matchToDiff(\n  files: DiffFile[],\n  records: KbRecord[],\n  options: MatchOptions = {},\n): DiffMatch[] {\n  const ranges = indexRanges(options.symbolRanges ?? []);\n  const anchored = records.filter(\n    (record) => (record.frontmatter.strauss_anchors ?? []).length > 0,\n  );\n  const matches: DiffMatch[] = [];\n\n  for (const file of files) {\n    const candidates = anchored\n      .map((record) => ({\n        record,\n        anchors: (record.frontmatter.strauss_anchors ?? []).filter(\n          (anchor) => normalize(anchor.file) === normalize(file.filePath),\n        ),\n      }))\n      .filter(({ anchors }) => anchors.length > 0);\n    if (!candidates.length) continue;\n\n    for (const hunk of file.hunks) {\n      const hits: KbRecord[] = [];\n      let precision: DiffMatch[\"precision\"] = \"symbol\";\n\n      for (const { record, anchors } of candidates) {\n        const placement = place(anchors, file.filePath, hunk, ranges);\n        if (placement === \"miss\") continue;\n        if (placement === \"file\") precision = \"file\";\n        hits.push(record);\n      }\n\n      if (!hits.length) continue;\n      matches.push({\n        filePath: file.filePath,\n        hunk,\n        records: order(adjudicate(hits, records, options.now)),\n        precision,\n      });\n    }\n  }\n\n  return matches;\n}\n\n/**\n * Whether any of a record's anchors puts it on this hunk.\n *\n * An anchor naming only a file is about the whole file, so it lands on every\n * hunk in it. One naming a symbol lands only where that symbol's lines overlap\n * — unless nothing resolved the symbol, in which case it falls back to the file\n * rather than disappearing. A record silently absent because a resolver was\n * unavailable is worse than one shown imprecisely and labelled as such.\n */\nfunction place(\n  anchors: KbAnchor[],\n  filePath: string,\n  hunk: DiffHunk,\n  ranges: Map<string, SymbolRange[]>,\n): \"symbol\" | \"file\" | \"miss\" {\n  let fallback: \"file\" | \"miss\" = \"miss\";\n\n  for (const anchor of anchors) {\n    if (!anchor.symbol) return \"file\";\n\n    const resolved = ranges.get(key(filePath, anchor.symbol));\n    if (!resolved?.length) {\n      fallback = \"file\";\n      continue;\n    }\n    if (resolved.some((range) => overlaps(range, hunk))) return \"symbol\";\n  }\n\n  return fallback;\n}\n\nfunction overlaps(range: SymbolRange, hunk: DiffHunk): boolean {\n  return range.startLine <= hunk.endLine && hunk.startLine <= range.endLine;\n}\n\n/** Current before superseded, then oldest first, so an arc reads in order. */\nfunction order(records: KbAdjudicated[]): KbAdjudicated[] {\n  const rank: Record<string, number> = {\n    current: 0,\n    unsettled: 1,\n    open: 2,\n    superseded: 3,\n    rejected: 4,\n  };\n  return [...records].sort(\n    (left, right) =>\n      (rank[left.standing] ?? 9) - (rank[right.standing] ?? 9) ||\n      (left.record.frontmatter.generated?.at ?? \"\").localeCompare(\n        right.record.frontmatter.generated?.at ?? \"\",\n      ),\n  );\n}\n\nfunction indexRanges(ranges: SymbolRange[]): Map<string, SymbolRange[]> {\n  const byKey = new Map<string, SymbolRange[]>();\n  for (const range of ranges) {\n    const id = key(range.file, range.symbol);\n    byKey.set(id, [...(byKey.get(id) ?? []), range]);\n  }\n  return byKey;\n}\n\nfunction key(file: string, symbol: string): string {\n  return `${normalize(file)}#${symbol}`;\n}\n\n/** Anchors are written by hand often enough that `./` shows up. */\nfunction normalize(path: string): string {\n  return path.replace(/^\\.\\//, \"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmEO,SAAS,YACd,OACA,SACA,UAAwB,CAAC,GACZ;AACb,QAAM,SAAS,YAAY,QAAQ,gBAAgB,CAAC,CAAC;AACrD,QAAM,WAAW,QAAQ;AAAA,IACvB,CAAC,YAAY,OAAO,YAAY,mBAAmB,CAAC,GAAG,SAAS;AAAA,EAClE;AACA,QAAM,UAAuB,CAAC;AAE9B,aAAW,QAAQ,OAAO;AACxB,UAAM,aAAa,SAChB,IAAI,CAAC,YAAY;AAAA,MAChB;AAAA,MACA,UAAU,OAAO,YAAY,mBAAmB,CAAC,GAAG;AAAA,QAClD,CAAC,WAAW,UAAU,OAAO,IAAI,MAAM,UAAU,KAAK,QAAQ;AAAA,MAChE;AAAA,IACF,EAAE,EACD,OAAO,CAAC,EAAE,QAAQ,MAAM,QAAQ,SAAS,CAAC;AAC7C,QAAI,CAAC,WAAW,OAAQ;AAExB,eAAW,QAAQ,KAAK,OAAO;AAC7B,YAAM,OAAmB,CAAC;AAC1B,UAAI,YAAoC;AAExC,iBAAW,EAAE,QAAQ,QAAQ,KAAK,YAAY;AAC5C,cAAM,YAAY,MAAM,SAAS,KAAK,UAAU,MAAM,MAAM;AAC5D,YAAI,cAAc,OAAQ;AAC1B,YAAI,cAAc,OAAQ,aAAY;AACtC,aAAK,KAAK,MAAM;AAAA,MAClB;AAEA,UAAI,CAAC,KAAK,OAAQ;AAClB,cAAQ,KAAK;AAAA,QACX,UAAU,KAAK;AAAA,QACf;AAAA,QACA,SAAS,MAAM,WAAW,MAAM,SAAS,QAAQ,GAAG,CAAC;AAAA,QACrD;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAWA,SAAS,MACP,SACA,UACA,MACA,QAC4B;AAC5B,MAAI,WAA4B;AAEhC,aAAW,UAAU,SAAS;AAC5B,QAAI,CAAC,OAAO,OAAQ,QAAO;AAE3B,UAAM,WAAW,OAAO,IAAI,IAAI,UAAU,OAAO,MAAM,CAAC;AACxD,QAAI,CAAC,UAAU,QAAQ;AACrB,iBAAW;AACX;AAAA,IACF;AACA,QAAI,SAAS,KAAK,CAAC,UAAU,SAAS,OAAO,IAAI,CAAC,EAAG,QAAO;AAAA,EAC9D;AAEA,SAAO;AACT;AAEA,SAAS,SAAS,OAAoB,MAAyB;AAC7D,SAAO,MAAM,aAAa,KAAK,WAAW,KAAK,aAAa,MAAM;AACpE;AAGA,SAAS,MAAM,SAA2C;AACxD,QAAM,OAA+B;AAAA,IACnC,SAAS;AAAA,IACT,WAAW;AAAA,IACX,MAAM;AAAA,IACN,YAAY;AAAA,IACZ,UAAU;AAAA,EACZ;AACA,SAAO,CAAC,GAAG,OAAO,EAAE;AAAA,IAClB,CAAC,MAAM,WACJ,KAAK,KAAK,QAAQ,KAAK,MAAM,KAAK,MAAM,QAAQ,KAAK,OACrD,KAAK,OAAO,YAAY,WAAW,MAAM,IAAI;AAAA,MAC5C,MAAM,OAAO,YAAY,WAAW,MAAM;AAAA,IAC5C;AAAA,EACJ;AACF;AAEA,SAAS,YAAY,QAAmD;AACtE,QAAM,QAAQ,oBAAI,IAA2B;AAC7C,aAAW,SAAS,QAAQ;AAC1B,UAAM,KAAK,IAAI,MAAM,MAAM,MAAM,MAAM;AACvC,UAAM,IAAI,IAAI,CAAC,GAAI,MAAM,IAAI,EAAE,KAAK,CAAC,GAAI,KAAK,CAAC;AAAA,EACjD;AACA,SAAO;AACT;AAEA,SAAS,IAAI,MAAc,QAAwB;AACjD,SAAO,GAAG,UAAU,IAAI,CAAC,IAAI,MAAM;AACrC;AAGA,SAAS,UAAU,MAAsB;AACvC,SAAO,KAAK,QAAQ,SAAS,EAAE;AACjC;","names":[]}

package/dist/mcp-main.cjs

@@ -46,6 +46,11 @@ var kbActorStampSchema = import_zod.z.object({
   by: import_zod.z.string().min(1),
   at: import_zod.z.string().min(1)
 }).passthrough();
+var kbVerifiedEventSchema = kbActorStampSchema.extend({
+  note: import_zod.z.string().refine((s) => s.trim().length > 0, {
+    message: "note must say what the check found"
+  })
+});
 var kbAnchorSchema = import_zod.z.object({
   file: import_zod.z.string().min(1),
   symbol: import_zod.z.string().min(1).optional()
@@ -1074,25 +1079,32 @@ var import_zod9 = require("zod");
 var loadCommand = define({
   name: "load",
   tool: "kb_load",
-  usage: "load [type] [--budget N]",
-  description: "Load the whole knowledge base at once, each record with its standing. Prefer this over searching: these bases run to a few thousand tokens, and a reader holding all of it has perfect recall and knows why it is asking, which no ranker does. Superseded records arrive under `superseded` as name, replacement and date only \u2014 their bodies no longer hold, and reading one later in a long session is the mistake this prevents; pass the id to kb_trace when you need the history. Rejected and unresolved records arrive whole: what was turned down, and what is still open, is the part a diff cannot show you. Refuses with a count rather than truncating when the base is too large \u2014 a truncated base is indistinguishable from a complete one, and would have you conclude something was never decided from a slice you did not know was a slice. Call at the point of use, not once per session: a base loaded early is summarised away by compaction, so if the visible context holds no records from this base and the question at hand is one it might govern, load before answering \u2014 never conclude nothing was decided from a context with no KB content in it. This tool (with kb_query and kb_trace) is the only supported way to read a base; a raw file read bypasses supersession resolution and returns replaced records as if current.",
+  usage: "load [type] [--budget N | --all]",
+  description: "Load the whole knowledge base at once, each record with its standing. Prefer this over searching: these bases run to a few thousand tokens, and a reader holding all of it has perfect recall and knows why it is asking, which no ranker does. Superseded records arrive under `superseded` as name, replacement and date only \u2014 their bodies no longer hold, and reading one later in a long session is the mistake this prevents; pass the id to kb_trace when you need the history. Rejected and unresolved records arrive whole: what was turned down, and what is still open, is the part a diff cannot show you. Refuses with a count rather than truncating when the base is too large \u2014 a truncated base is indistinguishable from a complete one, and would have you conclude something was never decided from a slice you did not know was a slice. Call at the point of use, not once per session: a base loaded early is summarised away by compaction, so if the visible context holds no records from this base and the question at hand is one it might govern, load before answering \u2014 never conclude nothing was decided from a context with no KB content in it. This tool (with kb_query and kb_trace) is the only supported way to read a base; a raw file read bypasses supersession resolution and returns replaced records as if current.\n\nThat refusal is the default guardrail, meant for an agent that would otherwise burn its whole context on one call. `all` bypasses it and loads everything regardless of size: a deliberate operator with the budget to spend, not something to reach for automatically. It is mutually exclusive with `budgetTokens`. When the reader does not need everything, kb_query or a narrower `type` filter is the better fit than either.",
   input: import_zod9.z.object({
     bundlePath,
     type: import_zod9.z.enum(KB_RECORD_TYPES).optional(),
-    budgetTokens: import_zod9.z.number().int().positive().optional().describe("Approximate token ceiling. Defaults to 25000.")
+    budgetTokens: import_zod9.z.number().int().positive().optional().describe("Approximate token ceiling. Defaults to 25000."),
+    all: import_zod9.z.boolean().optional().describe(
+      "Load the entire base regardless of size. The deliberate-operator escape hatch; mutually exclusive with budgetTokens."
+    )
+  }).refine((value) => !(value.all && value.budgetTokens !== void 0), {
+    message: "all and budgetTokens are mutually exclusive: pass a ceiling or none, not both."
   }),
   fromArgv: (argv, path) => {
     const budget = argvFlag(argv, "--budget");
     return {
       bundlePath: path,
-      ...argv[1] && argv[1] !== "--budget" ? { type: argv[1] } : {},
-      ...budget ? { budgetTokens: Number(budget) } : {}
+      ...argv[1] && !argv[1].startsWith("--") ? { type: argv[1] } : {},
+      ...budget ? { budgetTokens: Number(budget) } : {},
+      ...argv.includes("--all") ? { all: true } : {}
     };
   },
-  run: async ({ store }, { bundlePath: path, type, budgetTokens }) => {
+  run: async ({ store }, { bundlePath: path, type, budgetTokens, all }) => {
     const result = await store.load(path, {
       ...type ? { type } : {},
-      ...budgetTokens ? { budgetTokens } : {}
+      ...budgetTokens ? { budgetTokens } : {},
+      ...all ? { all } : {}
     });
     if (!result.loaded) return result;
     return {
@@ -1570,8 +1582,37 @@ var validateCommand = define({
   failsWhen: (result) => Array.isArray(result) && result.length > 0
 });
 
-// src/commands/write.ts
+// src/commands/verify.ts
 var import_zod26 = require("zod");
+var verifyCommand = define({
+  name: "verify",
+  tool: "kb_verify",
+  usage: "verify <concept-id> --note <text>",
+  description: "Append one verified[] event \u2014 who checked the record, when, and what the check found. Appends only; prior events are never rewritten. A record's own generator is refused unless the actor is human: re-reading your own output is not an independent check.",
+  input: import_zod26.z.object({
+    bundlePath,
+    conceptId,
+    note: import_zod26.z.string().refine((s) => s.trim().length > 0, {
+      message: "note must say what the check found"
+    })
+  }),
+  fromArgv: (argv, path) => ({
+    bundlePath: path,
+    conceptId: argv[1],
+    note: argvFlag(argv, "--note")
+  }),
+  run: async ({ store, actor, now }, { bundlePath: path, conceptId: id, note }) => {
+    await assertBaseNotFrozen(process.cwd(), path);
+    const record = await store.verify(path, id, note, actor, now());
+    return {
+      conceptId: record.conceptId,
+      verified: record.frontmatter.verified?.length ?? 0
+    };
+  }
+});
+
+// src/commands/write.ts
+var import_zod27 = require("zod");
 var writeCommand = define({
   name: "write",
   tool: "kb_write",
@@ -1585,9 +1626,9 @@ var writeCommand = define({
     "- Prefer a new record over overloading an existing one, and keep each short. A record nobody finishes reading is not durable memory.",
     "- Records are never deleted; supersede instead, so the earlier reasoning stays inspectable."
   ].join("\n"),
-  input: import_zod26.z.object({
+  input: import_zod27.z.object({
     bundlePath,
-    type: import_zod26.z.enum(KB_RECORD_TYPES),
+    type: import_zod27.z.enum(KB_RECORD_TYPES),
     input: composeInputSchema
   }),
   fromArgv: async (argv, path, stdin) => ({
@@ -1611,7 +1652,7 @@ var writeCommand = define({
 });
 
 // src/commands/write-decision.ts
-var import_zod27 = require("zod");
+var import_zod28 = require("zod");
 var writeDecisionCommand = define({
   name: "write-decision",
   tool: "kb_write_decision",
@@ -1624,7 +1665,7 @@ var writeDecisionCommand = define({
     "- `alternative` is what you turned down and why, not a list of everything considered.",
     "- A reference to material you read goes in `sources`; a reference to code goes in `anchors`; a reference to another record goes in `relatedConceptIds`."
   ].join("\n"),
-  input: import_zod27.z.object({ bundlePath, input: decisionInputSchema }),
+  input: import_zod28.z.object({ bundlePath, input: decisionInputSchema }),
   fromArgv: async (_argv, path, stdin) => ({
     bundlePath: path,
     input: JSON.parse(await stdin())
@@ -1652,6 +1693,7 @@ var KB_COMMANDS = [
   statusCommand,
   supersedeCommand,
   answerCommand,
+  verifyCommand,
   loadCommand,
   queryCommand,
   traceCommand,
@@ -1767,6 +1809,25 @@ var KbWriteConflictError = class extends BaseError {
   }
   conceptId;
 };
+var KbSelfVerificationError = class extends BaseError {
+  constructor(conceptId2, actor, generatedBy) {
+    super({
+      message: `kb: ${conceptId2} was generated by ${generatedBy}, and a record's generator cannot verify it \u2014 only a human or a different actor can`,
+      errorType: "KbSelfVerification" /* KbSelfVerification */,
+      code: 400,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details: { conceptId: conceptId2, actor, generatedBy, action: "refused" }
+    });
+    this.conceptId = conceptId2;
+    this.actor = actor;
+    this.generatedBy = generatedBy;
+  }
+  conceptId;
+  actor;
+  generatedBy;
+};
 var KbInvalidConceptIdError = class extends BaseError {
   constructor(message, details) {
     super({
@@ -1985,6 +2046,40 @@ var KbStore = class {
       { operation: `status:${status}`, by: actor }
     );
   }
+  /**
+   * Appends one `verified[]` event: who checked the record, when, and what the
+   * check found. Append-only — prior events are history, and are spread into
+   * the new array untouched rather than reshaped through the write schema.
+   *
+   * A record's generator cannot verify its own record unless the actor is
+   * human: the generator re-reading its own output is not an independent
+   * check. The rule runs before the mutation so a refusal never publishes,
+   * and the refusal is logged under its own operation name — `mutate` only
+   * logs what it publishes.
+   */
+  async verify(bundlePath2, conceptId2, note, actor = "unknown", at = (/* @__PURE__ */ new Date()).toISOString()) {
+    const event = kbVerifiedEventSchema.parse({ by: actor, at, note });
+    const existing = await this.read(bundlePath2, conceptId2);
+    if (!existing) throw new KbRecordNotFoundError(conceptId2);
+    const generatedBy = existing.frontmatter.generated?.by;
+    if (generatedBy !== void 0 && actor.toLowerCase() === generatedBy.toLowerCase() && !normalizeActor(actor).startsWith("human:")) {
+      await this.record(this.root(bundlePath2), {
+        operation: "verify:refused",
+        conceptId: conceptId2,
+        by: actor
+      });
+      throw new KbSelfVerificationError(conceptId2, actor, generatedBy);
+    }
+    return this.mutate(
+      bundlePath2,
+      conceptId2,
+      (frontmatter) => ({
+        ...frontmatter,
+        verified: [...frontmatter.verified ?? [], event]
+      }),
+      { operation: "verify", by: actor }
+    );
+  }
   /**
    * Marks `conceptId` superseded by `replacementId`, and links both directions.
    *
@@ -2088,6 +2183,10 @@ ${answer}
    * Refuses rather than truncates when the base is too large. A truncated base
    * is indistinguishable from a complete one, so a caller would answer "that
    * was never decided" from a slice it did not know was a slice.
+   *
+   * That refusal is the default guardrail. `all` bypasses it outright and
+   * always hands back the whole bundle: an explicit, never-accidental escape
+   * hatch for an operator who has the budget to spend, not a wider default.
    */
   async load(bundlePath2, options = {}) {
     const budgetTokens = options.budgetTokens ?? DEFAULT_LOAD_BUDGET;
@@ -2097,7 +2196,7 @@ ${answer}
     const records = adjudicated.filter((hit) => hit.standing !== "superseded");
     const superseded = adjudicated.filter((hit) => hit.standing === "superseded").map(stub);
     const approxTokens2 = records.reduce((total, hit) => total + estimateTokens(hit.record), 0) + superseded.reduce((total, entry) => total + estimateStubTokens(entry), 0);
-    if (approxTokens2 > budgetTokens) {
+    if (!options.all && approxTokens2 > budgetTokens) {
       return {
         loaded: false,
         recordCount: wanted.length,
@@ -2108,8 +2207,8 @@ ${answer}
     return {
       loaded: true,
       recordCount: wanted.length,
-      approxTokens: approxTokens2,
-      budgetTokens,
+      tokensLoaded: approxTokens2,
+      budgetTokens: options.all ? null : budgetTokens,
       records,
       superseded
     };
@@ -2315,6 +2414,11 @@ function matches(record, needle) {
     (field) => field?.toLowerCase().includes(needle)
   );
 }
+function normalizeActor(id) {
+  const colon = id.indexOf(":");
+  if (colon === -1) return id.toLowerCase();
+  return id.slice(0, colon + 1).toLowerCase() + id.slice(colon + 1);
+}
 function digest(contents) {
   return (0, import_node_crypto.createHash)("sha256").update(contents).digest("hex");
 }