@saasontools/strauss-kb 0.1.9 → 0.1.11

package/dist/{chunk-OFDWRMY6.js → chunk-OVRQCQ6P.js}

@@ -18,7 +18,31 @@ var kbVerifiedEventSchema = kbActorStampSchema.extend({
 });
 var kbAnchorSchema = z.object({
   file: z.string().min(1),
-  symbol: z.string().min(1).optional()
+  symbol: z.string().min(1).optional(),
+  /**
+   * Which repository the file lives in — a remote URL
+   * (`https://github.com/org/name`) or a short name. Absent means the base's
+   * own repository, which is what nearly every anchor means.
+   *
+   * Unvalidated beyond not-blank: one repository has many spellings.
+   * Matched after normalisation; see ARCHITECTURE.
+   */
+  repo: z.string().trim().min(1).optional(),
+  /**
+   * The git rev the evidence was taken at. Prefer a commit SHA: a branch
+   * name is a moving pointer, so an anchor pinned to one says the evidence
+   * came from wherever that branch happens to be now, which is not a
+   * baseline. Recorded and preserved in v1; ref-pinned reads land with
+   * SAA-709.
+   */
+  ref: z.string().trim().min(1).optional(),
+  hash: z.string().regex(/^sha256:[0-9a-f]{64}$/, {
+    message: "hash must be sha256:<64 hex chars>"
+  }).optional(),
+  /** ISO 8601 timestamp of the last successful resolution. */
+  resolved_at: z.string().min(1).optional(),
+  /** Line count of the text the hash was taken over. */
+  lines: z.number().int().positive().optional()
 }).strict();
 var KB_RECORD_TYPES = [
   "fact",
@@ -295,6 +319,609 @@ function selectDecisions(records) {
   );
 }
 
+// src/anchor-resolver.ts
+import { execFile } from "child_process";
+import { createHash } from "crypto";
+import { readFile, realpath, stat } from "fs/promises";
+import { isAbsolute, relative, resolve, sep } from "path";
+import { promisify } from "util";
+
+// src/concurrency.ts
+var DEFAULT_IO_CONCURRENCY = 16;
+async function mapLimit(items, limit, fn) {
+  if (!Number.isInteger(limit) || limit < 1) {
+    throw new RangeError(
+      `mapLimit: "limit" must be a positive integer, got ${limit}`
+    );
+  }
+  const out = new Array(items.length);
+  let next = 0;
+  let failed = false;
+  const runners = Array.from(
+    { length: Math.min(limit, items.length) },
+    async () => {
+      while (!failed && next < items.length) {
+        const at = next++;
+        try {
+          out[at] = await fn(items[at], at);
+        } catch (error) {
+          failed = true;
+          throw error;
+        }
+      }
+    }
+  );
+  await Promise.all(runners);
+  return out;
+}
+
+// src/anchor-resolver.ts
+var execFileAsync = promisify(execFile);
+var MAX_ANCHOR_FILE_BYTES = 1048576;
+var PARENT_SCOPE_LINES = 50;
+var CLEAN_STATE = { blockComment: false, template: false };
+function stripLine(line, state) {
+  let out = "";
+  let index = 0;
+  let { blockComment, template } = state;
+  while (index < line.length) {
+    const char = line[index];
+    const next = line[index + 1];
+    if (blockComment) {
+      if (char === "*" && next === "/") {
+        blockComment = false;
+        index += 2;
+        continue;
+      }
+      index += 1;
+      continue;
+    }
+    if (template) {
+      if (char === "\\") {
+        index += 2;
+        continue;
+      }
+      if (char === "`") template = false;
+      index += 1;
+      continue;
+    }
+    if (char === "/" && next === "*") {
+      blockComment = true;
+      index += 2;
+      continue;
+    }
+    if (char === "/" && next === "/") break;
+    if (char === "`") {
+      template = true;
+      index += 1;
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      const quote = char;
+      index += 1;
+      while (index < line.length) {
+        if (line[index] === "\\") {
+          index += 2;
+          continue;
+        }
+        if (line[index] === quote) {
+          index += 1;
+          break;
+        }
+        index += 1;
+      }
+      continue;
+    }
+    out += char;
+    index += 1;
+  }
+  return { code: out, state: { blockComment, template } };
+}
+function span(lines, from, to) {
+  return {
+    text: lines.slice(from, to + 1).join("\n"),
+    startLine: from + 1,
+    endLine: to + 1
+  };
+}
+function captureBraceBlock(lines, matchLine) {
+  let depth = 0;
+  let opened = false;
+  let state = CLEAN_STATE;
+  for (let index = matchLine; index < lines.length; index++) {
+    const stripped = stripLine(lines[index] ?? "", state);
+    state = stripped.state;
+    for (const char of stripped.code) {
+      if (char === "{") {
+        depth += 1;
+        opened = true;
+      } else if (char === "}") {
+        depth = Math.max(0, depth - 1);
+      } else if (char === ";" && !opened) {
+        return span(lines, matchLine, index);
+      }
+    }
+    if (opened && depth === 0) return span(lines, matchLine, index);
+  }
+  return null;
+}
+var PYTHON_HEADER = /^\s*(?:async\s+)?(?:def|class)\s+[A-Za-z_]\w*\s*[(:]/;
+function captureIndentedBlock(lines, matchLine) {
+  const header = lines[matchLine] ?? "";
+  const indent = header.length - header.trimStart().length;
+  let headerEnd = -1;
+  for (let index = matchLine; index < lines.length && index <= matchLine + 20; index++) {
+    const code = stripLine(lines[index] ?? "", CLEAN_STATE).code.trimEnd();
+    if (code.endsWith(":")) {
+      headerEnd = index;
+      break;
+    }
+    if (code.includes(":")) return span(lines, matchLine, index);
+  }
+  if (headerEnd === -1) return null;
+  let end = headerEnd;
+  for (let index = headerEnd + 1; index < lines.length; index++) {
+    const line = lines[index] ?? "";
+    if (line.trim() === "") continue;
+    const lineIndent = line.length - line.trimStart().length;
+    if (lineIndent <= indent) break;
+    end = index;
+  }
+  return end === headerEnd ? null : span(lines, matchLine, end);
+}
+var TIERS = [
+  (name) => new RegExp(
+    `(?:function|class|interface|type|enum|const|let|var|def)\\s+${name}\\b`
+  ),
+  (name) => new RegExp(`\\b${name}\\s*[:=]`),
+  (name) => new RegExp(`\\b${name}\\s*\\(`),
+  (name) => new RegExp(`\\b${name}\\b`)
+];
+var regexResolver = {
+  name: "regex",
+  resolve(source, symbol) {
+    const segments = symbol.split(".");
+    const name = segments[segments.length - 1];
+    if (!name) return null;
+    const parent = segments.length > 1 ? segments[segments.length - 2] : void 0;
+    const escaped = escapeRegExp(name);
+    const parentPattern = parent ? new RegExp(`\\b${escapeRegExp(parent)}\\b`) : null;
+    const lines = source.split("\n");
+    for (const tier of TIERS) {
+      const pattern = tier(escaped);
+      let candidates = lines.map((line, index) => ({ line, index })).filter((entry) => pattern.test(entry.line)).map((entry) => entry.index);
+      if (!candidates.length) continue;
+      if (parentPattern && candidates.length > 1) {
+        const distances = candidates.map(
+          (index) => distanceToParent(lines, index, parentPattern)
+        );
+        const nearest = Math.min(...distances);
+        if (Number.isFinite(nearest)) {
+          candidates = candidates.filter((_, at) => distances[at] === nearest);
+        }
+      }
+      if (candidates.length !== 1) return null;
+      const matchLine = candidates[0];
+      return PYTHON_HEADER.test(lines[matchLine] ?? "") ? captureIndentedBlock(lines, matchLine) : captureBraceBlock(lines, matchLine);
+    }
+    return null;
+  }
+};
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function distanceToParent(lines, index, parent) {
+  const floor = Math.max(0, index - PARENT_SCOPE_LINES);
+  for (let at = index; at >= floor; at--) {
+    if (parent.test(lines[at] ?? "")) return index - at;
+  }
+  return Number.POSITIVE_INFINITY;
+}
+function hashAnchorText(text) {
+  return `sha256:${createHash("sha256").update(text.replace(/\r\n/g, "\n")).digest("hex")}`;
+}
+function resolveAnchor(source, anchor, resolver = regexResolver) {
+  const normalized = source.replace(/\r\n/g, "\n");
+  if (!anchor.symbol) {
+    const lines = normalized.split("\n");
+    if (lines.length > 1 && lines[lines.length - 1] === "") lines.pop();
+    return {
+      text: normalized,
+      startLine: 1,
+      endLine: Math.max(1, lines.length)
+    };
+  }
+  return resolver.resolve(normalized, anchor.symbol);
+}
+function anchorFilePath(repoRoot, file) {
+  const path = resolve(repoRoot, file.replace(/^\.\//, ""));
+  const rel = relative(resolve(repoRoot), path);
+  if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+    return null;
+  }
+  return path;
+}
+function contains(root, path) {
+  const rel = relative(root, path);
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+function normalizeRepoUrl(value) {
+  let url = value.trim().replace(/^git\+/, "");
+  const scp = /^[\w.-]+@([\w.-]+):(.+)$/.exec(url);
+  if (scp) url = `https://${scp[1]}/${scp[2]}`;
+  url = url.replace(/^ssh:\/\/(?:[^@/]+@)?/, "https://");
+  url = trimTrailingSlashes(url);
+  if (url.endsWith(".git")) url = url.slice(0, -4);
+  return trimTrailingSlashes(url).toLowerCase();
+}
+function trimTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") end -= 1;
+  return value.slice(0, end);
+}
+function repoPath(normalized) {
+  const withoutScheme = normalized.replace(/^[a-z0-9+.-]+:\/\//, "");
+  const segments = withoutScheme.split("/").filter(Boolean);
+  return segments.length > 1 ? segments.slice(1).join("/") : "";
+}
+function repoIdentifies(declared, originUrl) {
+  if (!originUrl) return false;
+  const origin = normalizeRepoUrl(originUrl);
+  const want = normalizeRepoUrl(declared);
+  if (!want || !origin) return false;
+  if (want === origin) return true;
+  const path = repoPath(origin);
+  if (!path) return false;
+  return want === path || want === (path.split("/").pop() ?? "");
+}
+async function repoOriginUrl(repoRoot) {
+  try {
+    const { stdout } = await execFileAsync(
+      "git",
+      ["-C", repoRoot, "config", "--get", "remote.origin.url"],
+      { timeout: 5e3 }
+    );
+    return stdout.trim() || null;
+  } catch {
+    return null;
+  }
+}
+var LazyOrigin = class {
+  constructor(repoRoot) {
+    this.repoRoot = repoRoot;
+  }
+  repoRoot;
+  url = null;
+  asked = false;
+  /** Asks git once, so later `isForeign` calls need no await. */
+  async prime() {
+    if (this.asked) return;
+    this.url = await repoOriginUrl(this.repoRoot);
+    this.asked = true;
+  }
+  /** Only meaningful after `prime`; an unprimed origin identifies nothing. */
+  isForeign(anchor) {
+    if (!anchor.repo) return false;
+    return !repoIdentifies(anchor.repo, this.url);
+  }
+  async foreign(anchor) {
+    if (!anchor.repo) return false;
+    await this.prime();
+    return this.isForeign(anchor);
+  }
+};
+function errorCode(error) {
+  return typeof error === "object" && error !== null && "code" in error ? String(error.code) : void 0;
+}
+function anchorFileReader(repoRoot) {
+  let rootOnce;
+  const realRoot = () => {
+    rootOnce ??= realpath(resolve(repoRoot)).catch((error) => {
+      rootOnce = void 0;
+      throw error;
+    });
+    return rootOnce;
+  };
+  return (file) => readAnchorFileWithRoot(repoRoot, file, realRoot);
+}
+async function readAnchorFileWithRoot(repoRoot, file, realRoot) {
+  const lexical = anchorFilePath(repoRoot, file);
+  if (lexical === null) return { ok: false, reason: "outside-repo" };
+  let root;
+  let path;
+  try {
+    root = await realRoot();
+    path = await realpath(lexical);
+  } catch (error) {
+    const code = errorCode(error);
+    if (code === "ENOENT" || code === "ENOTDIR") {
+      return { ok: false, reason: "file-missing" };
+    }
+    return { ok: false, reason: "file-unreadable" };
+  }
+  if (!contains(root, path)) return { ok: false, reason: "outside-repo" };
+  try {
+    const stats = await stat(path);
+    if (!stats.isFile()) return { ok: false, reason: "file-unreadable" };
+    if (stats.size > MAX_ANCHOR_FILE_BYTES) {
+      return { ok: false, reason: "file-too-large" };
+    }
+    return { ok: true, source: await readFile(path, "utf8") };
+  } catch (error) {
+    const code = errorCode(error);
+    if (code === "ENOENT" || code === "ENOTDIR") {
+      return { ok: false, reason: "file-missing" };
+    }
+    return { ok: false, reason: "file-unreadable" };
+  }
+}
+function looksLikeWrongRepoRoot(drift) {
+  let checked = 0;
+  for (const entries of drift.values()) {
+    for (const entry of entries) {
+      if (entry.reason === "foreign-repo") continue;
+      checked += 1;
+      if (entry.state !== "unresolved" || entry.reason !== "file-missing") {
+        return false;
+      }
+    }
+  }
+  return checked > 0;
+}
+async function readAnchorFiles(files, read, concurrency = DEFAULT_IO_CONCURRENCY) {
+  if (!Number.isInteger(concurrency) || concurrency < 1) {
+    throw new RangeError(
+      `readAnchorFiles: option "concurrency" must be a positive integer, got ${concurrency}`
+    );
+  }
+  const wanted = [...new Set(files)];
+  const results = await mapLimit(wanted, concurrency, async (file) => {
+    try {
+      return await read(file);
+    } catch {
+      return { ok: false, reason: "file-unreadable" };
+    }
+  });
+  return new Map(wanted.map((file, at) => [file, results[at]]));
+}
+async function detectAnchorDrift(records, options = {}) {
+  const repoRoot = options.repoRoot ?? process.cwd();
+  const resolver = options.resolver ?? regexResolver;
+  const origin = new LazyOrigin(repoRoot);
+  const planned = /* @__PURE__ */ new Map();
+  let declaresRepo = false;
+  for (const record of records) {
+    const anchors = (record.frontmatter.strauss_anchors ?? []).filter(
+      (anchor) => anchor.hash
+    );
+    if (!anchors.length) continue;
+    if (anchors.some((anchor) => anchor.repo)) declaresRepo = true;
+    planned.set(
+      record.conceptId,
+      anchors.map((anchor) => ({ anchor, foreign: false }))
+    );
+  }
+  if (declaresRepo) {
+    await origin.prime();
+    for (const entries of planned.values()) {
+      for (const entry of entries)
+        entry.foreign = origin.isForeign(entry.anchor);
+    }
+  }
+  const files = [];
+  for (const entries of planned.values()) {
+    for (const entry of entries) {
+      if (!entry.foreign) files.push(entry.anchor.file);
+    }
+  }
+  const reads = await readAnchorFiles(
+    files,
+    options.reader ?? anchorFileReader(repoRoot),
+    options.concurrency ?? DEFAULT_IO_CONCURRENCY
+  );
+  const drift = /* @__PURE__ */ new Map();
+  for (const record of records) {
+    const entries = [];
+    for (const { anchor, foreign } of planned.get(record.conceptId) ?? []) {
+      const base = {
+        file: anchor.file,
+        ...anchor.symbol ? { symbol: anchor.symbol } : {},
+        storedHash: anchor.hash
+      };
+      if (foreign) {
+        entries.push({
+          ...base,
+          state: "unresolved",
+          diffSize: null,
+          reason: "foreign-repo"
+        });
+        continue;
+      }
+      const read = reads.get(anchor.file);
+      if (!read.ok) {
+        entries.push({
+          ...base,
+          state: "unresolved",
+          diffSize: null,
+          reason: read.reason
+        });
+        continue;
+      }
+      const resolved = resolveAnchor(read.source, anchor, resolver);
+      if (!resolved) {
+        entries.push({
+          ...base,
+          state: "unresolved",
+          diffSize: null,
+          reason: "symbol-not-found"
+        });
+        continue;
+      }
+      const currentHash = hashAnchorText(resolved.text);
+      const currentLines = resolved.endLine - resolved.startLine + 1;
+      entries.push({
+        ...base,
+        state: currentHash === anchor.hash ? "match" : "drifted",
+        currentHash,
+        diffSize: anchor.lines === void 0 ? null : Math.abs(currentLines - anchor.lines)
+      });
+    }
+    if (entries.length) drift.set(record.conceptId, entries);
+  }
+  return drift;
+}
+
+// src/errors.ts
+var Fault = /* @__PURE__ */ ((Fault2) => {
+  Fault2["Configuration"] = "Configuration";
+  Fault2["System"] = "System";
+  Fault2["User"] = "User";
+  return Fault2;
+})(Fault || {});
+var ErrorTypes = /* @__PURE__ */ ((ErrorTypes2) => {
+  ErrorTypes2["KbRecordAlreadyExists"] = "KbRecordAlreadyExists";
+  ErrorTypes2["KbInvalidConceptId"] = "KbInvalidConceptId";
+  ErrorTypes2["KbMissingFlagValue"] = "KbMissingFlagValue";
+  ErrorTypes2["KbPackBudgetExceeded"] = "KbPackBudgetExceeded";
+  ErrorTypes2["KbRecordNotFound"] = "KbRecordNotFound";
+  ErrorTypes2["KbSelfVerification"] = "KbSelfVerification";
+  ErrorTypes2["KbWriteConflict"] = "KbWriteConflict";
+  return ErrorTypes2;
+})(ErrorTypes || {});
+var BaseError = class extends Error {
+  code;
+  errorType;
+  fault;
+  retriable;
+  reportToUser;
+  details;
+  constructor(props) {
+    super(props.message);
+    this.name = props.name ?? this.constructor.name;
+    this.code = props.code ?? 500;
+    this.errorType = props.errorType;
+    this.fault = props.fault;
+    this.retriable = props.retriable ?? true;
+    this.reportToUser = props.reportToUser ?? false;
+    this.details = props.details;
+  }
+};
+
+// src/kb-errors.ts
+var KbRecordAlreadyExistsError = class extends BaseError {
+  constructor(conceptId2) {
+    super({
+      message: `kb: ${conceptId2} already exists \u2014 choose a more specific slug, or write with overwrite`,
+      errorType: "KbRecordAlreadyExists" /* KbRecordAlreadyExists */,
+      code: 409,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details: { conceptId: conceptId2, action: "refused" }
+    });
+    this.conceptId = conceptId2;
+  }
+  conceptId;
+};
+var KbRecordNotFoundError = class extends BaseError {
+  constructor(conceptId2) {
+    super({
+      message: `kb: ${conceptId2} does not exist`,
+      errorType: "KbRecordNotFound" /* KbRecordNotFound */,
+      code: 404,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details: { conceptId: conceptId2 }
+    });
+    this.conceptId = conceptId2;
+  }
+  conceptId;
+};
+var KbWriteConflictError = class extends BaseError {
+  constructor(conceptId2) {
+    super({
+      message: `kb: ${conceptId2} changed while it was being updated \u2014 re-read and retry`,
+      errorType: "KbWriteConflict" /* KbWriteConflict */,
+      code: 409,
+      fault: "System" /* System */,
+      retriable: true,
+      reportToUser: true,
+      details: { conceptId: conceptId2 }
+    });
+    this.conceptId = conceptId2;
+  }
+  conceptId;
+};
+var KbSelfVerificationError = class extends BaseError {
+  constructor(conceptId2, actor, generatedBy) {
+    super({
+      message: `kb: ${conceptId2} was generated by ${generatedBy}, and a record's generator cannot verify it \u2014 only a human or a different actor can`,
+      errorType: "KbSelfVerification" /* KbSelfVerification */,
+      code: 400,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details: { conceptId: conceptId2, actor, generatedBy, action: "refused" }
+    });
+    this.conceptId = conceptId2;
+    this.actor = actor;
+    this.generatedBy = generatedBy;
+  }
+  conceptId;
+  actor;
+  generatedBy;
+};
+var KbPackBudgetExceededError = class extends BaseError {
+  constructor(recordCount, approxTokens2, budgetTokens, excluded) {
+    super({
+      message: `kb: a pack of ${recordCount} records is ~${approxTokens2} tokens against a budget of ${budgetTokens} \u2014 lower hops or maxNodes, or raise the budget`,
+      errorType: "KbPackBudgetExceeded" /* KbPackBudgetExceeded */,
+      code: 400,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details: { recordCount, approxTokens: approxTokens2, budgetTokens, excluded }
+    });
+    this.recordCount = recordCount;
+    this.approxTokens = approxTokens2;
+    this.budgetTokens = budgetTokens;
+    this.excluded = excluded;
+  }
+  recordCount;
+  approxTokens;
+  budgetTokens;
+  excluded;
+};
+var KbMissingFlagValueError = class extends BaseError {
+  constructor(flag) {
+    super({
+      message: `kb: ${flag} needs a value \u2014 pass ${flag} <value> or ${flag}=<value>`,
+      errorType: "KbMissingFlagValue" /* KbMissingFlagValue */,
+      code: 400,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details: { flag }
+    });
+    this.flag = flag;
+  }
+  flag;
+};
+var KbInvalidConceptIdError = class extends BaseError {
+  constructor(message, details) {
+    super({
+      message: `kb: ${message}`,
+      errorType: "KbInvalidConceptId" /* KbInvalidConceptId */,
+      code: 400,
+      fault: "User" /* User */,
+      retriable: false,
+      reportToUser: true,
+      details
+    });
+  }
+};
+
 // src/kb-pins/budgets.ts
 function asBudgets(value) {
   if (value === null || typeof value !== "object") return {};
@@ -393,14 +1020,14 @@ var pinsManifestSchema = z4.object({
 }).passthrough();
 
 // src/kb-pins/layers.ts
-import { mkdir, readFile, writeFile } from "fs/promises";
+import { mkdir, readFile as readFile2, writeFile } from "fs/promises";
 import { homedir } from "os";
-import { dirname, isAbsolute, join as join2, relative, resolve, sep } from "path";
+import { dirname, isAbsolute as isAbsolute2, join as join2, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
 function userRoot() {
   return process.env.STRAUSS_KB_USER_ROOT || homedir();
 }
 function layerRoot(workspaceDir, layer) {
-  return layer === "user" ? userRoot() : resolve(workspaceDir);
+  return layer === "user" ? userRoot() : resolve2(workspaceDir);
 }
 function layerFile(workspaceDir, layer) {
   return join2(
@@ -412,7 +1039,7 @@ async function readPinsLayer(workspaceDir, layer) {
   const file = layerFile(workspaceDir, layer);
   let raw;
   try {
-    raw = await readFile(file, "utf8");
+    raw = await readFile2(file, "utf8");
   } catch {
     return { pins: [] };
   }
@@ -441,11 +1068,11 @@ async function writePinsLayer(workspaceDir, layer, manifest) {
 `, "utf8");
 }
 function resolvePinPath(rootDir, path) {
-  return isAbsolute(path) ? resolve(path) : resolve(rootDir, path.split("/").join(sep));
+  return isAbsolute2(path) ? resolve2(path) : resolve2(rootDir, path.split("/").join(sep2));
 }
 function storablePath(rootDir, bundlePath2) {
-  const rel = relative(resolve(rootDir), resolve(bundlePath2));
-  return (rel === "" ? "." : rel).split(sep).join("/");
+  const rel = relative2(resolve2(rootDir), resolve2(bundlePath2));
+  return (rel === "" ? "." : rel).split(sep2).join("/");
 }
 async function readMergedPins(workspaceDir) {
   const manifests = {};
@@ -471,10 +1098,10 @@ async function readMergedPins(workspaceDir) {
 }
 
 // src/kb-pins/frozen.ts
-import { resolve as resolve2 } from "path";
+import { resolve as resolve3 } from "path";
 async function assertBaseNotFrozen(workspaceDir, bundlePath2) {
   const merged = await readMergedPins(workspaceDir);
-  const absolute = resolve2(bundlePath2);
+  const absolute = resolve3(bundlePath2);
   const pin = merged.pins.find((entry) => entry.absolutePath === absolute);
   if (pin?.frozen === true) {
     throw new KbBaseFrozenError(pin.path, pin.layer);
@@ -559,7 +1186,7 @@ async function pinBase(store, workspaceDir, bundlePath2, at, options = {}) {
 }
 
 // src/kb-pins/unpin.ts
-import { resolve as resolve3 } from "path";
+import { resolve as resolve4 } from "path";
 async function unpinBase(workspaceDir, bundlePath2) {
   const layers = [];
   for (const layer of PIN_LAYERS) {
@@ -580,7 +1207,7 @@ async function unpinBase(workspaceDir, bundlePath2) {
     }
   }
   return {
-    path: storablePath(resolve3(workspaceDir), bundlePath2),
+    path: storablePath(resolve4(workspaceDir), bundlePath2),
     removed: layers.length > 0,
     layers
   };
@@ -596,7 +1223,7 @@ var STANDING = {
   rejected: "rejected",
   superseded: "superseded"
 };
-function adjudicate(hits, bundle, now = /* @__PURE__ */ new Date()) {
+function adjudicate(hits, bundle, now = /* @__PURE__ */ new Date(), anchorDrift) {
   const byId = new Map(bundle.map((record) => [record.conceptId, record]));
   return hits.map((record) => {
     const status = record.frontmatter.strauss_status;
@@ -626,6 +1253,20 @@ function adjudicate(hits, bundle, now = /* @__PURE__ */ new Date()) {
     if (!record.frontmatter.verified?.length) {
       warnings.push({ kind: "unverified" });
     }
+    const moved = (anchorDrift?.get(record.conceptId) ?? []).filter(
+      (entry) => entry.state !== "match" && entry.reason !== "foreign-repo"
+    );
+    if (moved.length) {
+      warnings.push({
+        kind: "drifted",
+        anchors: moved.map(({ file, symbol, diffSize, reason }) => ({
+          file,
+          ...symbol !== void 0 ? { symbol } : {},
+          diffSize,
+          ...reason !== void 0 ? { reason } : {}
+        }))
+      });
+    }
     return { record, standing: STANDING[status], heads, warnings };
   });
 }
@@ -678,6 +1319,52 @@ function successors(record, byId) {
   return { records, missing };
 }
 
+// src/catalog.ts
+var EMPTY_STANDINGS = {
+  current: 0,
+  superseded: 0,
+  rejected: 0,
+  unsettled: 0,
+  open: 0
+};
+function catalog(bundle, options = {}) {
+  const wanted = options.type ? bundle.filter((record) => record.frontmatter.type === options.type) : bundle;
+  const entries = adjudicate(wanted, bundle, options.now ?? /* @__PURE__ */ new Date()).map((hit) => ({
+    conceptId: hit.record.conceptId,
+    type: hit.record.frontmatter.type,
+    title: hit.record.frontmatter.title ?? null,
+    standing: hit.standing,
+    supersededBy: hit.heads.map((head) => head.conceptId),
+    stale: hit.warnings.some((warning) => warning.kind === "stale")
+  })).sort(byTypeThenTitle);
+  const standings = { ...EMPTY_STANDINGS };
+  for (const entry of entries) standings[entry.standing] += 1;
+  return {
+    entries,
+    recordCount: entries.length,
+    standings,
+    currentCount: standings.current,
+    supersededCount: standings.superseded,
+    staleCount: entries.filter((entry) => entry.stale).length
+  };
+}
+function byTypeThenTitle(left, right) {
+  return byCodeUnit(left.type, right.type) || byCodeUnit(left.title ?? "", right.title ?? "") || byCodeUnit(left.conceptId, right.conceptId);
+}
+function byCodeUnit(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+function renderCatalogLine(entry) {
+  const parts = [
+    entry.conceptId,
+    entry.type,
+    entry.title ?? "(untitled)",
+    entry.standing === "superseded" ? `superseded \u2192 ${entry.supersededBy.join(", ") || "(no surviving head)"}` : entry.standing
+  ];
+  if (entry.stale) parts.push("stale");
+  return `- ${parts.join(" \xB7 ")}`;
+}
+
 // src/kb-index.ts
 var INDEX_FILE = "INDEX.md";
 var HEADING = "# KB Index";
@@ -700,7 +1387,7 @@ function indexIsStale(stored, expected) {
 }
 
 // src/kb-context.ts
-import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { readFile as readFile3, writeFile as writeFile2 } from "fs/promises";
 var HEADING2 = "## Knowledge bases (pinned)";
 var DEFAULT_CONTEXT_BUDGET = 4e3;
 var CONTEXT_PROFILES = {
@@ -904,7 +1591,7 @@ function toHookJson(block, event) {
 var CONTEXT_BEGIN = "<!-- strauss-kb:begin -->";
 var CONTEXT_END = "<!-- strauss-kb:end -->";
 async function syncInstructions(file, block) {
-  const existing = await readFile2(file, "utf8").catch(() => null);
+  const existing = await readFile3(file, "utf8").catch(() => null);
   const region = block ? `${CONTEXT_BEGIN}
 ${block.trim()}
 ${CONTEXT_END}` : null;
@@ -1056,7 +1743,8 @@ var KB_DOCTOR_CHECKS = [
   "aging",
   "orphaned",
   "broken-supersession",
-  "superseded-but-cited"
+  "superseded-but-cited",
+  "drifted"
 ];
 var CHECK_HEADLINES = {
   expired: "past its stale_after date",
@@ -1065,7 +1753,8 @@ var CHECK_HEADLINES = {
   aging: "still open or still proposed long after it was written",
   orphaned: "no other record links to it",
   "broken-supersession": "the supersession pointers do not resolve",
-  "superseded-but-cited": "a live record's body links to one that no longer holds"
+  "superseded-but-cited": "a live record's body links to one that no longer holds",
+  drifted: "the code an anchor points at moved out from under its hash"
 };
 var DAY_MS = 864e5;
 function doctor(bundle, options = {}) {
@@ -1075,7 +1764,7 @@ function doctor(bundle, options = {}) {
     agingDays: options.agingDays ?? DEFAULT_AGING_DAYS
   };
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const adjudicated = adjudicate(bundle, bundle, now);
+  const adjudicated = adjudicate(bundle, bundle, now, options.anchorDrift);
   const standings = new Map(
     adjudicated.map((hit) => [hit.record.conceptId, hit.standing])
   );
@@ -1089,7 +1778,8 @@ function doctor(bundle, options = {}) {
     group("aging", aging(inForce, now, thresholds.agingDays)),
     group("orphaned", orphaned(bundle)),
     group("broken-supersession", brokenSupersession(bundle, adjudicated)),
-    group("superseded-but-cited", supersededButCited(bundle, standings))
+    group("superseded-but-cited", supersededButCited(bundle, standings)),
+    group("drifted", drifted(inForce))
   ];
   const counts = Object.fromEntries(
     groups.map((entry) => [entry.check, entry.count])
@@ -1275,6 +1965,29 @@ function supersededButCited(bundle, standings) {
   }
   return findings;
 }
+function drifted(hits) {
+  const findings = [];
+  for (const hit of hits) {
+    const warning = hit.warnings.find((entry) => entry.kind === "drifted");
+    if (!warning) continue;
+    findings.push(
+      finding(
+        hit.record,
+        `${warning.anchors.length} ${warning.anchors.length === 1 ? "anchor no longer matches" : "anchors no longer match"}: ${warning.anchors.map((anchor) => {
+          const at = anchor.symbol ? `${anchor.file}:${anchor.symbol}` : anchor.file;
+          if (anchor.reason) return `${at} (${anchor.reason})`;
+          if (anchor.diffSize === null) {
+            return `${at} (changed, size unrecorded)`;
+          }
+          return anchor.diffSize === 0 ? `${at} (content changed, same line count)` : `${at} (${anchor.diffSize} line${anchor.diffSize === 1 ? "" : "s"} apart)`;
+        }).join(", ")}`
+      )
+    );
+  }
+  return findings.sort(
+    (left, right) => left.conceptId.localeCompare(right.conceptId)
+  );
+}
 function replaces(later, earlier) {
   return (later.frontmatter.strauss_supersedes ?? []).includes(earlier.conceptId) || earlier.frontmatter.strauss_superseded_by === later.conceptId;
 }
@@ -1399,28 +2112,204 @@ function byGeneratedAt(left, right) {
   return at(left).localeCompare(at(right)) || left.depth - right.depth;
 }
 
-// src/commands/answer.ts
+// src/commands/anchor-resolve.ts
 import { z as z8 } from "zod";
 
 // src/commands/model.ts
 import { z as z7 } from "zod";
 var bundlePath = z7.string().min(1).describe("Absolute path to the knowledge base directory.");
 var conceptId = z7.string().min(1).describe("e.g. decision.cursor-v2");
+var REPO_ROOT = z7.string().min(1).optional().describe(
+  "Where the anchored source lives, for the drift check. Defaults to the working directory."
+);
 function define(command) {
   return command;
 }
 function argvFlag(argv, name) {
+  const joined = argv.find((arg) => arg.startsWith(`${name}=`));
+  if (joined !== void 0) {
+    const value2 = joined.slice(name.length + 1);
+    if (!value2) throw new KbMissingFlagValueError(name);
+    return value2;
+  }
   const at = argv.indexOf(name);
-  return at !== -1 ? argv[at + 1] : void 0;
+  if (at === -1) return void 0;
+  const value = argv[at + 1];
+  if (value === void 0 || value.startsWith("--")) {
+    throw new KbMissingFlagValueError(name);
+  }
+  return value;
 }
 
+// src/commands/anchor-resolve.ts
+var anchorResolveCommand = define({
+  name: "anchor-resolve",
+  tool: "kb_anchor_resolve",
+  usage: "anchor-resolve <concept-id> [--repo-root <path>] [--rebaseline] [--restamp]",
+  description: "Resolve a record's anchors against the working tree: stamp a hash onto anchors that lack one, report drift where the code moved. kb_verify's mechanical counterpart \u2014 reach for it when the question is whether the code still is what it was, not whether the claim still holds. Anchors naming another repository are skipped. Exits non-zero on drift.",
+  input: z8.object({
+    bundlePath,
+    conceptId,
+    repoRoot: z8.string().min(1).optional(),
+    rebaseline: z8.boolean().optional().describe(
+      "Accept the current code as the new baseline for anchors that drifted."
+    ),
+    restamp: z8.boolean().optional().describe(
+      "Refresh `resolved_at` on anchors that already match. Off by default, so a green run writes nothing."
+    )
+  }),
+  fromArgv: (argv, path) => ({
+    bundlePath: path,
+    conceptId: argv[1],
+    repoRoot: argvFlag(argv, "--repo-root"),
+    rebaseline: argv.includes("--rebaseline"),
+    restamp: argv.includes("--restamp")
+  }),
+  run: async ({ store, actor, now }, { bundlePath: path, conceptId: id, repoRoot, rebaseline, restamp }) => {
+    const root = repoRoot ?? process.cwd();
+    const record = await store.read(path, id);
+    if (!record) throw new KbRecordNotFoundError(id);
+    const anchors = record.frontmatter.strauss_anchors ?? [];
+    if (!anchors.length) {
+      return {
+        conceptId: id,
+        results: [],
+        verified: false,
+        note: "record has no anchors"
+      };
+    }
+    const results = [];
+    const updated = [];
+    const origin = new LazyOrigin(root);
+    let dirty = false;
+    if (anchors.some((anchor) => anchor.repo)) await origin.prime();
+    const foreign = new Map(
+      anchors.map((anchor) => [anchor, origin.isForeign(anchor)])
+    );
+    const reads = await readAnchorFiles(
+      anchors.filter((anchor) => !foreign.get(anchor)).map((anchor) => anchor.file),
+      anchorFileReader(root)
+    );
+    for (const anchor of anchors) {
+      const base = {
+        file: anchor.file,
+        ...anchor.symbol ? { symbol: anchor.symbol } : {},
+        // Carried onto unresolved findings too: an anchor that once hashed
+        // and now resolves to nothing is a broken anchor, and the exit code
+        // has to be able to tell it from one nobody ever stamped.
+        ...anchor.hash ? { storedHash: anchor.hash } : {}
+      };
+      if (foreign.get(anchor)) {
+        results.push({ ...base, state: "unresolved", reason: "foreign-repo" });
+        updated.push(anchor);
+        continue;
+      }
+      const fileRead = reads.get(anchor.file);
+      if (!fileRead.ok) {
+        results.push({ ...base, state: "unresolved", reason: fileRead.reason });
+        updated.push(anchor);
+        continue;
+      }
+      const resolved = resolveAnchor(fileRead.source, anchor);
+      if (!resolved) {
+        results.push({
+          ...base,
+          state: "unresolved",
+          reason: "symbol-not-found"
+        });
+        updated.push(anchor);
+        continue;
+      }
+      const currentHash = hashAnchorText(resolved.text);
+      const currentLines = resolved.endLine - resolved.startLine + 1;
+      const stamped = {
+        ...anchor,
+        hash: currentHash,
+        lines: currentLines,
+        resolved_at: now()
+      };
+      if (!anchor.hash) {
+        results.push({ ...base, state: "stamped", currentHash });
+        updated.push(stamped);
+        dirty = true;
+      } else if (anchor.hash === currentHash) {
+        results.push({
+          ...base,
+          state: "match",
+          currentHash
+        });
+        const refresh = restamp || anchor.resolved_at === void 0;
+        updated.push(refresh ? { ...anchor, resolved_at: now() } : anchor);
+        if (refresh) dirty = true;
+      } else {
+        results.push({
+          ...base,
+          state: "drifted",
+          currentHash,
+          diffSize: anchor.lines === void 0 ? null : Math.abs(currentLines - anchor.lines),
+          ...rebaseline ? { rebaselined: true } : {}
+        });
+        updated.push(rebaseline ? stamped : anchor);
+        if (rebaseline) dirty = true;
+      }
+    }
+    let frozen = false;
+    if (dirty) {
+      try {
+        await assertBaseNotFrozen(process.cwd(), path);
+      } catch (error) {
+        if (!(error instanceof KbBaseFrozenError)) throw error;
+        frozen = true;
+      }
+      if (!frozen) await store.updateAnchors(path, id, updated, actor);
+    }
+    const frozenNote = frozen ? { frozen: true, note: "base is frozen: nothing was stamped" } : {};
+    const checked = results.filter((entry) => entry.reason !== "foreign-repo");
+    const skipped = results.length - checked.length;
+    const matches2 = checked.filter((entry) => entry.state === "match").length;
+    const clean = checked.length > 0 && checked.every((entry) => entry.state === "match");
+    if (clean) {
+      try {
+        await store.verify(
+          path,
+          id,
+          `anchor-resolve: ${matches2}/${checked.length} anchors match${skipped ? `, ${skipped} in another repo` : ""} (regex resolver)`,
+          actor,
+          now()
+        );
+      } catch (error) {
+        if (!(error instanceof KbSelfVerificationError)) throw error;
+        return {
+          conceptId: id,
+          results,
+          verified: false,
+          verifyRefused: "self-verification",
+          ...frozenNote
+        };
+      }
+      return { conceptId: id, results, verified: true, ...frozenNote };
+    }
+    return { conceptId: id, results, verified: false, ...frozenNote };
+  },
+  // A stored hash that no longer resolves is a broken anchor, not an absence:
+  // the file was deleted or the symbol renamed, and exiting zero on it would
+  // let the one edit that destroys an anchor pass the gate that exists to
+  // catch it. An anchor nobody ever stamped is still just unstamped, and one
+  // belonging to another repository was never this run's to check — failing CI
+  // on either would gate on work this command did not do.
+  failsWhen: (result) => result.results.some(
+    (entry) => entry.state === "drifted" || entry.state === "unresolved" && entry.storedHash !== void 0 && entry.reason !== "foreign-repo"
+  )
+});
+
 // src/commands/answer.ts
+import { z as z9 } from "zod";
 var answerCommand = define({
   name: "answer",
   tool: "kb_answer",
   usage: "answer <concept-id> <answer...>",
   description: "Resolve an open question: sets the status, stamps who answered and when, and appends an Answer section. If the answer overturns an assumption or a decision, that is a supersession \u2014 do it explicitly.",
-  input: z8.object({ bundlePath, conceptId, answer: z8.string().min(1) }),
+  input: z9.object({ bundlePath, conceptId, answer: z9.string().min(1) }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
     conceptId: argv[1],
@@ -1433,27 +2322,90 @@ var answerCommand = define({
   }
 });
 
+// src/commands/catalog.ts
+import { z as z10 } from "zod";
+var catalogCommand = define({
+  name: "catalog",
+  tool: "kb_catalog",
+  usage: "catalog [type]",
+  description: "Lists every record as one line \u2014 concept id, type, title, standing, and a stale flag \u2014 at roughly thirty tokens each. Pick this over kb_load once kb_load refuses: kb_catalog never refuses. Superseded records show only their replacement; fetch bodies with kb_load, kb_pack, kb_query, or kb_trace.",
+  input: z10.object({
+    bundlePath,
+    type: z10.enum(KB_RECORD_TYPES).optional()
+  }),
+  fromArgv: (argv, path) => ({
+    bundlePath: path,
+    ...argv[1] && !argv[1].startsWith("--") ? { type: argv[1] } : {}
+  }),
+  run: async ({ store }, { bundlePath: path, type }) => render(
+    await store.catalog(path, { ...type ? { type } : {} }),
+    path,
+    type
+  )
+});
+function render(result, bundle, type) {
+  const lines = [
+    `# KB Catalog${type ? ` \u2014 ${type}` : ""}`,
+    `bundle: ${bundle}`,
+    `${count(result.recordCount, "record")}: ${standingCounts(result)}`
+  ];
+  if (result.staleCount) {
+    lines.push(
+      `${result.staleCount} stale \u2014 a flag over the standings above, not one of them`
+    );
+  }
+  lines.push("");
+  if (!result.entries.length) {
+    lines.push(
+      type ? `(no records of type ${type})` : "(no records \u2014 this base is empty)"
+    );
+  } else {
+    for (const entry of result.entries) lines.push(renderCatalogLine(entry));
+  }
+  lines.push(
+    "",
+    "Bodies are not here: kb_pack <conceptId> for the neighbourhood around one record, kb_load for the whole base when it fits the budget, kb_query for a lookup by wording, kb_trace <conceptId> for how a position was arrived at."
+  );
+  return lines.join("\n");
+}
+function standingCounts(result) {
+  const ORDER = [
+    "current",
+    "open",
+    "unsettled",
+    "rejected",
+    "superseded"
+  ];
+  const parts = ORDER.filter((standing) => result.standings[standing]).map(
+    (standing) => `${result.standings[standing]} ${standing}`
+  );
+  return parts.length ? parts.join(" \xB7 ") : "none";
+}
+function count(value, noun) {
+  return `${value} ${value === 1 ? noun : `${noun}s`}`;
+}
+
 // src/commands/context.ts
-import { z as z9 } from "zod";
+import { z as z11 } from "zod";
 var contextCommand = define({
   name: "context",
   tool: "kb_context",
   usage: "context [--profile NAME] [--budget N] [--full-under N] [--format json] [--event NAME]",
   description: "The pinned-base index block, for injection at every context birth \u2014 startup, clear, resume, and after compaction. An index, not the content: concept ids, titles and standing, with the bodies left behind kb_load at the point of use. Emits nothing when nothing is pinned. Refuses with the list of bases and their sizes rather than truncating past its budget. Budgets resolve most-specific-first: explicit flags, then the workspace manifests' `context` tables (per profile, over their `default`), then the built-in profile (session-start, compact, turn), then package defaults \u2014 so a repo tunes its own numbers in .strauss/kb-pins.json without touching hook commands. Like kb_schema and kb_types this takes no bundlePath \u2014 it reads the workspace pin manifests, because which bases a session should see is workspace state, not a property of one base.",
-  input: z9.object({
-    budgetTokens: z9.number().int().positive().optional().describe(
+  input: z11.object({
+    budgetTokens: z11.number().int().positive().optional().describe(
       "Ceiling on the whole emitted block; past it the command refuses with a list of bases rather than truncating. Defaults to 4000."
     ),
-    fullUnderTokens: z9.number().int().positive().optional().describe(
+    fullUnderTokens: z11.number().int().positive().optional().describe(
       "Per-base rendering threshold, applied before the budget: a base whose complete load fits under this arrives as full records instead of index lines, and the whole block still answers to budgetTokens. Off by default \u2014 index-only is the safe default at a context birth, because injected bodies outlive the qualifiers on them; the session-start profile opts tiny bases in at 1500."
     ),
-    profile: z9.string().optional().describe(
+    profile: z11.string().optional().describe(
       "Named budget set: built-ins are session-start (full-under 1500), compact and turn (budget 2500); the manifests' `context` tables override per repo. Unknown names fall through to defaults rather than failing."
     ),
-    format: z9.enum(["markdown", "json"]).optional().describe(
+    format: z11.enum(["markdown", "json"]).optional().describe(
       "CLI envelope for hook protocols that require strict JSON on stdout. MCP callers omit this \u2014 the block itself is identical."
     ),
-    event: z9.string().optional().describe(
+    event: z11.string().optional().describe(
       "hookEventName stamped into the JSON envelope. Only meaningful with format=json."
     )
   }),
@@ -1489,15 +2441,16 @@ var contextCommand = define({
 });
 
 // src/commands/doctor.ts
-import { z as z10 } from "zod";
-var days = (what, fallback) => z10.number().int().positive().optional().describe(`${what} Defaults to ${fallback}.`);
+import { z as z12 } from "zod";
+var days = (what, fallback) => z12.number().int().positive().optional().describe(`${what} Defaults to ${fallback}.`);
 var doctorCommand = define({
   name: "doctor",
   tool: "kb_doctor",
-  usage: "doctor [--expiring-days N] [--unverified-days N] [--aging-days N] [--strict]",
-  description: "A health sweep over a whole base: what the calendar has already retired, what nobody ever confirmed, what has been open or proposed long enough that the status is now the answer, and what the graph has dropped on the floor. Read-only \u2014 it never writes, never supersedes, and never re-dates anything; every finding names a record for a person to repair. Seven checks, grouped and counted: expired (past `stale_after`), expiring (inside the window), unverified (an empty `verified[]` on a record old enough to matter), aging (still `open` or `proposed`), orphaned (no other record links to it), broken supersession (a chain that does not resolve), and superseded-but-cited (a live record whose body links to a record that no longer holds). Every group is reported even when empty, because a check that found nothing and a check that never ran look identical in a report that only lists findings.\n\nThis is the question no reader thinks to ask, which is why it needs a command: decay is invisible from inside a single record \u2014 a stale one reads exactly like a live one, and a question nobody answered reads exactly like one nobody asked. Reach for it when picking up a base someone else kept, before trusting a base you have not touched in months, or on a schedule; kb_validate is the narrower neighbour, checking only whether pointers between records agree.",
-  input: z10.object({
+  usage: "doctor [--expiring-days N] [--unverified-days N] [--aging-days N] [--repo-root PATH] [--strict]",
+  description: "Read-only health sweep: expired, expiring, unverified, aging, orphaned, broken-supersession, superseded-but-cited, drifted anchors. Every group is reported even when empty; nothing is written or re-stamped. Use it when picking up a base you have not touched in a while; kb_validate only checks that pointers between records agree.",
+  input: z12.object({
     bundlePath,
+    repoRoot: REPO_ROOT,
     expiringDays: days(
       "How far ahead `expiring` looks, in days.",
       DEFAULT_EXPIRING_DAYS
@@ -1510,7 +2463,7 @@ var doctorCommand = define({
       "How long a record may stay `open` or `proposed` before `aging` reports it, in days.",
       DEFAULT_AGING_DAYS
     ),
-    strict: z10.boolean().optional().describe(
+    strict: z12.boolean().optional().describe(
       "Turn an expired record into a non-zero exit for the CLI. No effect on the report itself."
     )
   }),
@@ -1522,32 +2475,39 @@ var doctorCommand = define({
     const expiring2 = argvFlag(argv, "--expiring-days");
     const unverified2 = argvFlag(argv, "--unverified-days");
     const agingDays = argvFlag(argv, "--aging-days");
+    const repoRoot = argvFlag(argv, "--repo-root");
     return {
       bundlePath: path,
+      ...repoRoot !== void 0 ? { repoRoot } : {},
       ...expiring2 !== void 0 ? { expiringDays: Number(expiring2) } : {},
       ...unverified2 !== void 0 ? { unverifiedDays: Number(unverified2) } : {},
       ...agingDays !== void 0 ? { agingDays: Number(agingDays) } : {},
       ...argv.includes("--strict") ? { strict: true } : {}
     };
   },
-  run: async ({ store, now }, { bundlePath: path, expiringDays, unverifiedDays, agingDays }) => {
+  run: async ({ store, now }, { bundlePath: path, expiringDays, unverifiedDays, agingDays, repoRoot }) => {
     const checkedAt = now();
-    const report = doctor(await store.list(path), {
+    const records = await store.list(path);
+    const anchorDrift = await store.detectDrift(records, repoRoot);
+    const report = doctor(records, {
       ...expiringDays !== void 0 ? { expiringDays } : {},
       ...unverifiedDays !== void 0 ? { unverifiedDays } : {},
       ...agingDays !== void 0 ? { agingDays } : {},
+      ...anchorDrift !== void 0 ? { anchorDrift } : {},
       now: new Date(checkedAt)
     });
     return { bundlePath: path, checkedAt, ...report };
   },
-  render: (result) => render(result),
-  // Only expiry, and only under --strict. The other six checks report debt a
+  render: (result) => render2(result),
+  // Only expiry, and only under --strict. The other seven checks report debt a
   // reader decides about; an expired record is the base asserting something it
   // already said it would stop standing behind, which is the one finding a
-  // pipeline can act on without a judgment call.
+  // pipeline can act on without a judgment call. Drift has its own gate —
+  // `anchor-resolve` exits non-zero on it, against a repo root the caller
+  // named, which is the run a CI pipeline should be making anyway.
   failsWhen: (result, input) => input.strict === true && result.counts.expired > 0
 });
-function render(result) {
+function render2(result) {
   const { thresholds } = result;
   const lines = [
     `# KB Doctor \u2014 ${result.bundlePath}`,
@@ -1579,13 +2539,13 @@ function render(result) {
 }
 
 // src/commands/list.ts
-import { z as z11 } from "zod";
+import { z as z13 } from "zod";
 var listCommand = define({
   name: "list",
   tool: "kb_list",
   usage: "list [type]",
   description: "Every record, optionally narrowed to one type. Use kb_query when you have a question; this is for enumerating.",
-  input: z11.object({ bundlePath, type: z11.enum(KB_RECORD_TYPES).optional() }),
+  input: z13.object({ bundlePath, type: z13.enum(KB_RECORD_TYPES).optional() }),
   fromArgv: (argv, path) => ({ bundlePath: path, type: argv[1] }),
   run: async ({ store }, { bundlePath: path, type }) => (await store.list(path, type)).map((record) => ({
     conceptId: record.conceptId,
@@ -1597,36 +2557,40 @@ var listCommand = define({
 });
 
 // src/commands/load.ts
-import { z as z12 } from "zod";
+import { z as z14 } from "zod";
 var loadCommand = define({
   name: "load",
   tool: "kb_load",
-  usage: "load [type] [--budget N | --all]",
-  description: "Load the whole knowledge base at once, each record with its standing. Prefer this over searching: these bases run to a few thousand tokens, and a reader holding all of it has perfect recall and knows why it is asking, which no ranker does. Superseded records arrive under `superseded` as name, replacement and date only \u2014 their bodies no longer hold, and reading one later in a long session is the mistake this prevents; pass the id to kb_trace when you need the history. Rejected and unresolved records arrive whole: what was turned down, and what is still open, is the part a diff cannot show you. Refuses with a count rather than truncating when the base is too large \u2014 a truncated base is indistinguishable from a complete one, and would have you conclude something was never decided from a slice you did not know was a slice. Call at the point of use, not once per session: a base loaded early is summarised away by compaction, so if the visible context holds no records from this base and the question at hand is one it might govern, load before answering \u2014 never conclude nothing was decided from a context with no KB content in it. This tool (with kb_query and kb_trace) is the only supported way to read a base; a raw file read bypasses supersession resolution and returns replaced records as if current.\n\nThat refusal is the default guardrail, meant for an agent that would otherwise burn its whole context on one call. `all` bypasses it and loads everything regardless of size: a deliberate operator with the budget to spend, not something to reach for automatically. It is mutually exclusive with `budgetTokens`. When the reader does not need everything, kb_query or a narrower `type` filter is the better fit than either.",
-  input: z12.object({
+  usage: "load [type] [--budget N | --all] [--repo-root PATH]",
+  description: "Loads the whole knowledge base at once, each record with its standing. Superseded records arrive as stubs (name, replacement, date); rejected and open records arrive whole. Refuses past the token budget rather than truncating \u2014 call kb_catalog, then kb_pack on the record that matters, or narrow with `type`; kb_query for a lookup by wording. `all` bypasses the budget.",
+  input: z14.object({
     bundlePath,
-    type: z12.enum(KB_RECORD_TYPES).optional(),
-    budgetTokens: z12.number().int().positive().optional().describe("Approximate token ceiling. Defaults to 25000."),
-    all: z12.boolean().optional().describe(
-      "Load the entire base regardless of size. The deliberate-operator escape hatch; mutually exclusive with budgetTokens."
-    )
+    type: z14.enum(KB_RECORD_TYPES).optional(),
+    budgetTokens: z14.number().int().positive().optional().describe("Approximate token ceiling. Defaults to 25000."),
+    all: z14.boolean().optional().describe(
+      "Loads the entire base regardless of size, bypassing the token budget; mutually exclusive with budgetTokens."
+    ),
+    repoRoot: REPO_ROOT
   }).refine((value) => !(value.all && value.budgetTokens !== void 0), {
-    message: "all and budgetTokens are mutually exclusive: pass a ceiling or none, not both."
+    message: "all is mutually exclusive with budgetTokens: pass a ceiling or none, not both."
   }),
   fromArgv: (argv, path) => {
     const budget = argvFlag(argv, "--budget");
+    const repoRoot = argvFlag(argv, "--repo-root");
     return {
       bundlePath: path,
       ...argv[1] && !argv[1].startsWith("--") ? { type: argv[1] } : {},
       ...budget ? { budgetTokens: Number(budget) } : {},
-      ...argv.includes("--all") ? { all: true } : {}
+      ...argv.includes("--all") ? { all: true } : {},
+      ...repoRoot !== void 0 ? { repoRoot } : {}
     };
   },
-  run: async ({ store }, { bundlePath: path, type, budgetTokens, all }) => {
+  run: async ({ store }, { bundlePath: path, type, budgetTokens, all, repoRoot }) => {
     const result = await store.load(path, {
       ...type ? { type } : {},
       ...budgetTokens ? { budgetTokens } : {},
-      ...all ? { all } : {}
+      ...all ? { all } : {},
+      ...repoRoot !== void 0 ? { repoRoot } : {}
     });
     if (!result.loaded) return result;
     return {
@@ -1645,25 +2609,25 @@ var loadCommand = define({
 });
 
 // src/commands/log.ts
-import { z as z13 } from "zod";
+import { z as z15 } from "zod";
 var logCommand = define({
   name: "log",
   tool: "kb_log",
   usage: "log",
   description: "What touched what, and when. The only artifact here that cannot be reconstructed from the records, so malformed lines are reported rather than repaired.",
-  input: z13.object({ bundlePath }),
+  input: z15.object({ bundlePath }),
   fromArgv: (_argv, path) => ({ bundlePath: path }),
   run: ({ store }, { bundlePath: path }) => store.readLog(path)
 });
 
 // src/commands/no-decision.ts
-import { z as z14 } from "zod";
+import { z as z16 } from "zod";
 var noDecisionCommand = define({
   name: "no-decision",
   tool: "kb_no_decision",
   usage: "no-decision <reason...>",
   description: 'Claim in one sentence that there was nothing to decide. Gating on "did you write a decision?" rewards writing a junk one; gating on "did you answer?" does not, so silence has to be expressible. Idempotent \u2014 restating it is not a collision.',
-  input: z14.object({ bundlePath, reason: z14.string().min(1) }),
+  input: z16.object({ bundlePath, reason: z16.string().min(1) }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
     reason: argv.slice(1).join(" ").trim()
@@ -1680,20 +2644,20 @@ var noDecisionCommand = define({
 });
 
 // src/commands/pack.ts
-import { z as z15 } from "zod";
+import { z as z17 } from "zod";
 var packCommand = define({
   name: "pack",
   tool: "kb_pack",
   usage: "pack <conceptId> [--hops N] [--max-nodes N] [--budget N]",
   description: "The bounded neighbourhood around one record: everything within `hops` of the root, ranked and cut to `maxNodes`, with every cut record named under Excluded \u2014 a named gap is knowable, a silent one is not. Prefer this over kb_load when the base is too large to hold whole and the work centres on one record; prefer it over kb_query when the question needs the governed neighbourhood \u2014 what was settled and what binds near this record \u2014 rather than a lookup by wording. Superseded records arrive as name, replacement and date stubs exactly as kb_load emits them: their bodies no longer hold, and kb_trace has the history. Refuses outright rather than truncating when the pack would exceed its token budget \u2014 a partial pack is indistinguishable from a complete one \u2014 reporting the record count and every already-cut id so the caller can lower hops or maxNodes, or raise the budget. The header carries the bundle, root, budget and a timestamp; everything below the header is byte-identical across runs over an unchanged base, so two packs can be diffed and a changed byte means changed knowledge. This tool (with kb_load, kb_query and kb_trace) is the only supported way to read a base; a raw file read bypasses supersession resolution and returns replaced records as if current.",
-  input: z15.object({
+  input: z17.object({
     bundlePath,
     conceptId,
-    hops: z15.number().int().positive().optional().describe("How far from the root the walk may reach. Defaults to 2."),
-    maxNodes: z15.number().int().positive().optional().describe(
+    hops: z17.number().int().positive().optional().describe("How far from the root the walk may reach. Defaults to 2."),
+    maxNodes: z17.number().int().positive().optional().describe(
       "How many records the pack may hold, root included. Defaults to 20."
     ),
-    budgetTokens: z15.number().int().positive().optional().describe(
+    budgetTokens: z17.number().int().positive().optional().describe(
       "Approximate token ceiling over what is actually emitted. Defaults to 25000."
     )
   }),
@@ -1715,10 +2679,10 @@ var packCommand = define({
       ...maxNodes !== void 0 ? { maxNodes } : {},
       ...budgetTokens !== void 0 ? { budgetTokens } : {}
     });
-    return render2(result, path, now());
+    return render3(result, path, now());
   }
 });
-function render2(result, bundle, at) {
+function render3(result, bundle, at) {
   const lines = [
     `# KB Pack \u2014 ${result.root}`,
     `bundle: ${bundle}`,
@@ -1780,22 +2744,22 @@ function warningLabel(warning) {
 }
 
 // src/commands/pin.ts
-import { z as z16 } from "zod";
+import { z as z18 } from "zod";
 var pinCommand = define({
   name: "pin",
   tool: "kb_pin",
   usage: "pin [bundle-path] [--mode full|index] [--profiles a,b] [--local|--user] [--frozen|--unfreeze]",
   description: "Pin a base into a workspace pin manifest, so `context` surfaces it at every context birth. Three layers, nearest wins: the committed project manifest (.strauss/kb-pins.json, the default), `--local` (.strauss/kb-pins.local.json, personal and gitignored), and `--user` (~/.strauss/kb-pins.json, every workspace). Idempotent \u2014 re-pinning changes nothing unless --mode, --profiles, or --frozen/--unfreeze are given, which update just those fields. `--mode full` preloads the whole base into the block regardless of the full-under threshold; `--mode index` never upgrades. `--profiles` scopes the pin to named context profiles. `--frozen` marks the base concluded: write commands against it refuse and `context` labels it read-only. A path with no records yet succeeds with a warning; bases are routinely pinned before they are populated. Pins are workspace state: the pinned base itself is never touched.",
-  input: z16.object({
+  input: z18.object({
     bundlePath,
-    mode: z16.enum(["full", "index"]).optional().describe(
+    mode: z18.enum(["full", "index"]).optional().describe(
       "full: always emit this base's records whole (still under the block budget); index: never upgrade. Absent: the profile's full-under threshold decides."
     ),
-    profiles: z16.array(z16.string()).optional().describe("Context profiles this pin surfaces in. Absent: all of them."),
-    layer: z16.enum(["project", "local", "user"]).optional().describe(
+    profiles: z18.array(z18.string()).optional().describe("Context profiles this pin surfaces in. Absent: all of them."),
+    layer: z18.enum(["project", "local", "user"]).optional().describe(
       "Which manifest to write: project (committed, default), local (personal, gitignored), user (~/.strauss, every workspace)."
     ),
-    frozen: z16.boolean().optional().describe(
+    frozen: z18.boolean().optional().describe(
       "true: the base is concluded \u2014 writes against it refuse while pinned. false: lift a freeze."
     )
   }),
@@ -1824,38 +2788,48 @@ var pinCommand = define({
 });
 
 // src/commands/pins.ts
-import { z as z17 } from "zod";
+import { z as z19 } from "zod";
 var pinsCommand = define({
   name: "pins",
   tool: "kb_pins",
   usage: "pins",
   description: "Every pinned base across the manifest layers, each with its layer and whether it currently resolves to readable records. Reads the workspace manifests rather than any one base, like kb_context.",
-  input: z17.object({}),
+  input: z19.object({}),
   fromArgv: () => ({}),
   run: ({ store }) => listPins(store, process.cwd())
 });
 
 // src/commands/query.ts
-import { z as z18 } from "zod";
+import { z as z20 } from "zod";
 var queryCommand = define({
   name: "query",
   tool: "kb_query",
-  usage: "query <text...>",
-  description: "Search and return each match with its standing. Results are flagged, never filtered: a superseded record comes back alongside whatever replaced it, and a rejected one is marked as something explicitly not adopted. Prefer kb_load when the base fits its budget: on this package's measurements, a reader holding the whole base answered eight of nine questions whose wording appears in no record, where embedding search answered four. Never read record files directly \u2014 this tool (with kb_load and kb_trace) is the only supported way to read a base; a file read bypasses supersession resolution and returns replaced records as if current.",
-  input: z18.object({
+  usage: "query <text...> [--repo-root PATH]",
+  description: "Search and return each match with its standing. Results are flagged, never filtered: a superseded record comes back alongside whatever replaced it, and a rejected one is marked as something explicitly not adopted. This is the lookup-by-wording rung, and the narrowest of the three: use it when you know roughly what the record says. The decision rule around it \u2014 while the base fits kb_load's token budget, kb_load it whole, because on this package's measurements a reader holding the whole base answered eight of nine questions whose wording appears in no record where embedding search answered four; once kb_load refuses, kb_catalog for one line per record and then kb_pack on the record the work centres on; and kb_query when the question is a point lookup rather than a neighbourhood. A query cannot tell you that nothing was decided \u2014 it returns its nearest hit whatever the distance \u2014 so reach for kb_catalog when the question is what exists. Never read record files directly: this tool (with kb_load, kb_catalog, kb_pack and kb_trace) is the only supported way to read a base; a file read bypasses supersession resolution and returns replaced records as if current.",
+  input: z20.object({
     bundlePath,
-    text: z18.string().optional(),
-    type: z18.enum(KB_RECORD_TYPES).optional(),
-    includeNonCurrent: z18.boolean().optional()
-  }),
-  fromArgv: (argv, path) => ({
-    bundlePath: path,
-    text: argv.slice(1).join(" ").trim(),
-    includeNonCurrent: true
+    text: z20.string().optional(),
+    type: z20.enum(KB_RECORD_TYPES).optional(),
+    includeNonCurrent: z20.boolean().optional(),
+    repoRoot: REPO_ROOT
   }),
-  run: async ({ store }, { bundlePath: path, text, type, includeNonCurrent }) => (await store.query(path, text ?? "", {
+  // `--repo-root` is a flag, so its value must not fall into the search text.
+  fromArgv: (argv, path) => {
+    const repoRoot = argvFlag(argv, "--repo-root");
+    const words = argv.slice(1);
+    const flag = words.indexOf("--repo-root");
+    if (flag !== -1) words.splice(flag, 2);
+    return {
+      bundlePath: path,
+      text: words.join(" ").trim(),
+      includeNonCurrent: true,
+      ...repoRoot !== void 0 ? { repoRoot } : {}
+    };
+  },
+  run: async ({ store }, { bundlePath: path, text, type, includeNonCurrent, repoRoot }) => (await store.query(path, text ?? "", {
     ...type ? { type } : {},
-    includeNonCurrent: includeNonCurrent === true
+    includeNonCurrent: includeNonCurrent === true,
+    ...repoRoot !== void 0 ? { repoRoot } : {}
   })).map((hit) => ({
     conceptId: hit.record.conceptId,
     title: hit.record.frontmatter.title ?? null,
@@ -1868,40 +2842,40 @@ var queryCommand = define({
 });
 
 // src/commands/read-index.ts
-import { z as z19 } from "zod";
+import { z as z21 } from "zod";
 var readIndexCommand = define({
   name: "index",
   tool: "kb_index",
   usage: "index",
   description: "The index, rebuilt if it disagrees with the records. One call gives the whole shape of the base: title, type, status, and description per record. The cheap re-orientation call after compaction or deep in a long session \u2014 a few hundred tokens; call it (or kb_context, when bases are pinned) first, then kb_load or fetch by concept id.",
-  input: z19.object({ bundlePath }),
+  input: z21.object({ bundlePath }),
   fromArgv: (_argv, path) => ({ bundlePath: path }),
   run: ({ store }, { bundlePath: path }) => store.readIndex(path)
 });
 
 // src/commands/schema.ts
-import { z as z20 } from "zod";
+import { z as z22 } from "zod";
 var schemaCommand = define({
   name: "schema",
   tool: "kb_schema",
   usage: "schema",
   description: "JSON Schema for the frontmatter, the write input, and log entries \u2014 generated from the code that enforces them, so it cannot drift from what a write will accept.",
-  input: z20.object({}),
+  input: z22.object({}),
   fromArgv: () => ({}),
   run: () => Promise.resolve(kbJsonSchemas())
 });
 
 // src/commands/status.ts
-import { z as z21 } from "zod";
+import { z as z23 } from "zod";
 var statusCommand = define({
   name: "status",
   tool: "kb_status",
   usage: "status <concept-id> <status>",
   description: "Move a record's status, leaving everything else alone. Uses a compare-and-swap, so a concurrent change fails loudly rather than being overwritten.",
-  input: z21.object({
+  input: z23.object({
     bundlePath,
     conceptId,
-    status: z21.enum(KB_RECORD_STATUSES)
+    status: z23.enum(KB_RECORD_STATUSES)
   }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
@@ -1916,13 +2890,13 @@ var statusCommand = define({
 });
 
 // src/commands/supersede.ts
-import { z as z22 } from "zod";
+import { z as z24 } from "zod";
 var supersedeCommand = define({
   name: "supersede",
   tool: "kb_supersede",
   usage: "supersede <concept-id> <replacement-id>",
   description: "Mark a record superseded by another, linking both directions. Use this rather than editing a record whose meaning changed \u2014 a record that quietly becomes something else invalidates every reference to it, and the earlier understanding is what a later trace needs.",
-  input: z22.object({ bundlePath, conceptId, replacementId: conceptId }),
+  input: z24.object({ bundlePath, conceptId, replacementId: conceptId }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
     conceptId: argv[1],
@@ -1936,16 +2910,16 @@ var supersedeCommand = define({
 });
 
 // src/commands/sync-instructions.ts
-import { z as z23 } from "zod";
+import { z as z25 } from "zod";
 var syncInstructionsCommand = define({
   name: "sync-instructions",
   usage: "sync-instructions <file> [--profile NAME] [--budget N] [--full-under N]",
   description: "Idempotently plant the `context` block between sentinel comments in an instruction file (AGENTS.md, CLAUDE.md), creating the block when absent and leaving everything outside the sentinels alone. CLI-only: this is file plumbing for runtimes whose instruction files are re-read where their conversations are not, not an agent capability \u2014 the capability is kb_context.",
-  input: z23.object({
-    file: z23.string().min(1).describe("The instruction file to edit in place."),
-    budgetTokens: z23.number().int().positive().optional(),
-    fullUnderTokens: z23.number().int().positive().optional(),
-    profile: z23.string().optional()
+  input: z25.object({
+    file: z25.string().min(1).describe("The instruction file to edit in place."),
+    budgetTokens: z25.number().int().positive().optional(),
+    fullUnderTokens: z25.number().int().positive().optional(),
+    profile: z25.string().optional()
   }),
   fromArgv: (argv) => {
     const budget = argvFlag(argv, "--budget");
@@ -1971,17 +2945,17 @@ var syncInstructionsCommand = define({
 });
 
 // src/commands/trace.ts
-import { z as z24 } from "zod";
+import { z as z26 } from "zod";
 var traceCommand = define({
   name: "trace",
   tool: "kb_trace",
   usage: "trace <concept-id> [edges...]",
   description: 'How a position was arrived at, as a timeline ordered by when each record was written. Deliberately includes rejected, draft, and superseded records \u2014 in a history those are the content, not noise. Follows supersession, shared code anchors, and shared sources. Use when the question is "why is this the way it is" rather than "what do we hold now". This tool (with kb_load and kb_query) is the only supported way to read a base; a raw file read bypasses supersession resolution and returns replaced records as if current.',
-  input: z24.object({
+  input: z26.object({
     bundlePath,
     conceptId,
-    edges: z24.array(z24.enum(TRACE_EDGES)).optional(),
-    depth: z24.number().int().positive().optional()
+    edges: z26.array(z26.enum(TRACE_EDGES)).optional(),
+    depth: z26.number().int().positive().optional()
   }),
   fromArgv: (argv, path) => ({
     bundlePath: path,
@@ -2003,53 +2977,53 @@ var traceCommand = define({
 });
 
 // src/commands/types.ts
-import { z as z25 } from "zod";
+import { z as z27 } from "zod";
 var typesCommand = define({
   name: "types",
   tool: "kb_types",
   usage: "types",
   description: "The twelve record types with their purpose, body sections, and starting status. Read this before writing rather than guessing headings \u2014 a section the type does not define is rejected.",
-  input: z25.object({}),
+  input: z27.object({}),
   fromArgv: () => ({}),
   run: () => Promise.resolve(RECORD_TYPES)
 });
 
 // src/commands/unpin.ts
-import { z as z26 } from "zod";
+import { z as z28 } from "zod";
 var unpinCommand = define({
   name: "unpin",
   tool: "kb_unpin",
   usage: "unpin [bundle-path]",
   description: "Remove a base from every pin manifest layer that holds it \u2014 project, local, and user \u2014 because unpinned means gone, not still injected from another file. Reports which layers were touched.",
-  input: z26.object({ bundlePath }),
+  input: z28.object({ bundlePath }),
   fromArgv: (argv, path) => ({ bundlePath: argv[1] ?? path }),
   run: (_ctx, { bundlePath: path }) => unpinBase(process.cwd(), path)
 });
 
 // src/commands/validate.ts
-import { z as z27 } from "zod";
+import { z as z29 } from "zod";
 var validateCommand = define({
   name: "validate",
   tool: "kb_validate",
   usage: "validate",
   description: "Check pointers no single record can see: supersession links that disagree between the two records, and assumptions that cite sources. Per-record shape is enforced on every read, so a problem here means someone edited a file by hand.",
-  input: z27.object({ bundlePath }),
+  input: z29.object({ bundlePath }),
   fromArgv: (_argv, path) => ({ bundlePath: path }),
   run: async ({ store }, { bundlePath: path }) => validateBundle(await store.list(path)),
   failsWhen: (result) => Array.isArray(result) && result.length > 0
 });
 
 // src/commands/verify.ts
-import { z as z28 } from "zod";
+import { z as z30 } from "zod";
 var verifyCommand = define({
   name: "verify",
   tool: "kb_verify",
   usage: "verify <concept-id> --note <text>",
   description: "Append one verified[] event \u2014 who checked the record, when, and what the check found. Appends only; prior events are never rewritten. A record's own generator is refused unless the actor is human: re-reading your own output is not an independent check.",
-  input: z28.object({
+  input: z30.object({
     bundlePath,
     conceptId,
-    note: z28.string().refine((s) => s.trim().length > 0, {
+    note: z30.string().refine((s) => s.trim().length > 0, {
       message: "note must say what the check found"
     })
   }),
@@ -2069,7 +3043,7 @@ var verifyCommand = define({
 });
 
 // src/commands/write.ts
-import { z as z29 } from "zod";
+import { z as z31 } from "zod";
 var writeCommand = define({
   name: "write",
   tool: "kb_write",
@@ -2083,9 +3057,9 @@ var writeCommand = define({
     "- Prefer a new record over overloading an existing one, and keep each short. A record nobody finishes reading is not durable memory.",
     "- Records are never deleted; supersede instead, so the earlier reasoning stays inspectable."
   ].join("\n"),
-  input: z29.object({
+  input: z31.object({
     bundlePath,
-    type: z29.enum(KB_RECORD_TYPES),
+    type: z31.enum(KB_RECORD_TYPES),
     input: composeInputSchema
   }),
   fromArgv: async (argv, path, stdin) => ({
@@ -2109,7 +3083,7 @@ var writeCommand = define({
 });
 
 // src/commands/write-decision.ts
-import { z as z30 } from "zod";
+import { z as z32 } from "zod";
 var writeDecisionCommand = define({
   name: "write-decision",
   tool: "kb_write_decision",
@@ -2122,7 +3096,7 @@ var writeDecisionCommand = define({
     "- `alternative` is what you turned down and why, not a list of everything considered.",
     "- A reference to material you read goes in `sources`; a reference to code goes in `anchors`; a reference to another record goes in `relatedConceptIds`."
   ].join("\n"),
-  input: z30.object({ bundlePath, input: decisionInputSchema }),
+  input: z32.object({ bundlePath, input: decisionInputSchema }),
   fromArgv: async (_argv, path, stdin) => ({
     bundlePath: path,
     input: JSON.parse(await stdin())
@@ -2151,7 +3125,9 @@ var KB_COMMANDS = [
   supersedeCommand,
   answerCommand,
   verifyCommand,
+  anchorResolveCommand,
   loadCommand,
+  catalogCommand,
   packCommand,
   queryCommand,
   traceCommand,
@@ -2197,143 +3173,8 @@ function parseMarkdownWithFrontmatter(text, schema) {
   };
 }
 
-// src/errors.ts
-var Fault = /* @__PURE__ */ ((Fault2) => {
-  Fault2["Configuration"] = "Configuration";
-  Fault2["System"] = "System";
-  Fault2["User"] = "User";
-  return Fault2;
-})(Fault || {});
-var ErrorTypes = /* @__PURE__ */ ((ErrorTypes2) => {
-  ErrorTypes2["KbRecordAlreadyExists"] = "KbRecordAlreadyExists";
-  ErrorTypes2["KbInvalidConceptId"] = "KbInvalidConceptId";
-  ErrorTypes2["KbPackBudgetExceeded"] = "KbPackBudgetExceeded";
-  ErrorTypes2["KbRecordNotFound"] = "KbRecordNotFound";
-  ErrorTypes2["KbSelfVerification"] = "KbSelfVerification";
-  ErrorTypes2["KbWriteConflict"] = "KbWriteConflict";
-  return ErrorTypes2;
-})(ErrorTypes || {});
-var BaseError = class extends Error {
-  code;
-  errorType;
-  fault;
-  retriable;
-  reportToUser;
-  details;
-  constructor(props) {
-    super(props.message);
-    this.name = props.name ?? this.constructor.name;
-    this.code = props.code ?? 500;
-    this.errorType = props.errorType;
-    this.fault = props.fault;
-    this.retriable = props.retriable ?? true;
-    this.reportToUser = props.reportToUser ?? false;
-    this.details = props.details;
-  }
-};
-
-// src/kb-errors.ts
-var KbRecordAlreadyExistsError = class extends BaseError {
-  constructor(conceptId2) {
-    super({
-      message: `kb: ${conceptId2} already exists \u2014 choose a more specific slug, or write with overwrite`,
-      errorType: "KbRecordAlreadyExists" /* KbRecordAlreadyExists */,
-      code: 409,
-      fault: "User" /* User */,
-      retriable: false,
-      reportToUser: true,
-      details: { conceptId: conceptId2, action: "refused" }
-    });
-    this.conceptId = conceptId2;
-  }
-  conceptId;
-};
-var KbRecordNotFoundError = class extends BaseError {
-  constructor(conceptId2) {
-    super({
-      message: `kb: ${conceptId2} does not exist`,
-      errorType: "KbRecordNotFound" /* KbRecordNotFound */,
-      code: 404,
-      fault: "User" /* User */,
-      retriable: false,
-      reportToUser: true,
-      details: { conceptId: conceptId2 }
-    });
-    this.conceptId = conceptId2;
-  }
-  conceptId;
-};
-var KbWriteConflictError = class extends BaseError {
-  constructor(conceptId2) {
-    super({
-      message: `kb: ${conceptId2} changed while it was being updated \u2014 re-read and retry`,
-      errorType: "KbWriteConflict" /* KbWriteConflict */,
-      code: 409,
-      fault: "System" /* System */,
-      retriable: true,
-      reportToUser: true,
-      details: { conceptId: conceptId2 }
-    });
-    this.conceptId = conceptId2;
-  }
-  conceptId;
-};
-var KbSelfVerificationError = class extends BaseError {
-  constructor(conceptId2, actor, generatedBy) {
-    super({
-      message: `kb: ${conceptId2} was generated by ${generatedBy}, and a record's generator cannot verify it \u2014 only a human or a different actor can`,
-      errorType: "KbSelfVerification" /* KbSelfVerification */,
-      code: 400,
-      fault: "User" /* User */,
-      retriable: false,
-      reportToUser: true,
-      details: { conceptId: conceptId2, actor, generatedBy, action: "refused" }
-    });
-    this.conceptId = conceptId2;
-    this.actor = actor;
-    this.generatedBy = generatedBy;
-  }
-  conceptId;
-  actor;
-  generatedBy;
-};
-var KbPackBudgetExceededError = class extends BaseError {
-  constructor(recordCount, approxTokens2, budgetTokens, excluded) {
-    super({
-      message: `kb: a pack of ${recordCount} records is ~${approxTokens2} tokens against a budget of ${budgetTokens} \u2014 lower hops or maxNodes, or raise the budget`,
-      errorType: "KbPackBudgetExceeded" /* KbPackBudgetExceeded */,
-      code: 400,
-      fault: "User" /* User */,
-      retriable: false,
-      reportToUser: true,
-      details: { recordCount, approxTokens: approxTokens2, budgetTokens, excluded }
-    });
-    this.recordCount = recordCount;
-    this.approxTokens = approxTokens2;
-    this.budgetTokens = budgetTokens;
-    this.excluded = excluded;
-  }
-  recordCount;
-  approxTokens;
-  budgetTokens;
-  excluded;
-};
-var KbInvalidConceptIdError = class extends BaseError {
-  constructor(message, details) {
-    super({
-      message: `kb: ${message}`,
-      errorType: "KbInvalidConceptId" /* KbInvalidConceptId */,
-      code: 400,
-      fault: "User" /* User */,
-      retriable: false,
-      reportToUser: true,
-      details
-    });
-  }
-};
-
 // src/search-index.ts
-import { stat } from "fs/promises";
+import { stat as stat2 } from "fs/promises";
 import { join as join3 } from "path";
 var SEARCH_INDEX_FILE = ".index.sqlite";
 var COLLECTION = "kb";
@@ -2378,16 +3219,19 @@ async function searchBase(bundlePath2, query, options = {}) {
   }
 }
 async function isStale(bundlePath2) {
-  const indexAt = await stat(join3(bundlePath2, SEARCH_INDEX_FILE)).then((s) => s.mtimeMs).catch(() => 0);
+  const indexAt = await stat2(join3(bundlePath2, SEARCH_INDEX_FILE)).then((s) => s.mtimeMs).catch(() => 0);
   if (!indexAt) return true;
   const { readdir: readdir2 } = await import("fs/promises");
-  const names = await readdir2(bundlePath2).catch(() => []);
-  for (const name of names) {
-    if (!name.endsWith(".md") || name === INDEX_FILE) continue;
-    const at = await stat(join3(bundlePath2, name)).then((s) => s.mtimeMs).catch(() => 0);
-    if (at > indexAt) return true;
-  }
-  return false;
+  const names = (await readdir2(bundlePath2).catch(() => [])).filter(
+    (name) => name.endsWith(".md") && name !== INDEX_FILE
+  );
+  let stale = false;
+  await mapLimit(names, DEFAULT_IO_CONCURRENCY, async (name) => {
+    if (stale) return;
+    const at = await stat2(join3(bundlePath2, name)).then((s) => s.mtimeMs).catch(() => 0);
+    if (at > indexAt) stale = true;
+  });
+  return stale;
 }
 function resolveHits(hits, records) {
   const byName = /* @__PURE__ */ new Map();
@@ -2419,18 +3263,18 @@ async function loadQmd(logger) {
 }
 
 // src/kb-store.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import {
   appendFile,
   link,
   mkdir as mkdir2,
   readdir,
-  readFile as readFile3,
+  readFile as readFile4,
   rename,
   unlink,
   writeFile as writeFile3
 } from "fs/promises";
-import { join as join4, resolve as resolve4, sep as sep2 } from "path";
+import { join as join4, resolve as resolve5, sep as sep3 } from "path";
 
 // src/kb-gitattributes.ts
 var GITATTRIBUTES_FILE = ".gitattributes";
@@ -2527,7 +3371,7 @@ var KbStore = class {
     const target = this.recordPath(bundlePath2, conceptId2);
     let raw;
     try {
-      raw = await readFile3(target, "utf8");
+      raw = await readFile4(target, "utf8");
     } catch {
       return null;
     }
@@ -2549,10 +3393,10 @@ var KbStore = class {
       return [];
     }
     const wanted = names.sort().filter((name) => name.endsWith(".md") && !STORE_OWNED.has(name)).map((name) => ({ name, conceptId: name.slice(0, -".md".length) })).filter(({ conceptId: conceptId2 }) => !type || conceptId2.startsWith(`${type}.`));
-    const records = await Promise.all(
-      wanted.map(
-        async ({ name, conceptId: conceptId2 }) => this.parse(conceptId2, await readFile3(join4(root, name), "utf8"))
-      )
+    const records = await mapLimit(
+      wanted,
+      DEFAULT_IO_CONCURRENCY,
+      async ({ name, conceptId: conceptId2 }) => this.parse(conceptId2, await readFile4(join4(root, name), "utf8"))
     );
     return records.filter((record) => record !== null);
   }
@@ -2574,6 +3418,21 @@ var KbStore = class {
       { operation: `status:${status}`, by: actor }
     );
   }
+  /**
+   * Replaces a record's anchors wholesale, preserving everything else.
+   *
+   * Wholesale rather than merged: the caller just resolved the anchors it is
+   * writing, so it holds the complete current set, and a merge would keep
+   * stale entries the resolution pass deliberately dropped.
+   */
+  async updateAnchors(bundlePath2, conceptId2, anchors, actor = "unknown") {
+    return this.mutate(
+      bundlePath2,
+      conceptId2,
+      (frontmatter) => ({ ...frontmatter, strauss_anchors: anchors }),
+      { operation: "anchor-resolve", by: actor }
+    );
+  }
   /**
    * Appends one `verified[]` event: who checked the record, when, and what the
    * check found. Append-only — prior events are history, and are spread into
@@ -2672,9 +3531,12 @@ ${answer}
     const bundle = await this.list(bundlePath2);
     const needle = text.trim();
     const hits = needle ? await this.rank(bundlePath2, needle, bundle) : bundle;
+    const narrowed = options.type ? hits.filter((r) => r.frontmatter.type === options.type) : hits;
     const adjudicated = adjudicate(
-      options.type ? hits.filter((r) => r.frontmatter.type === options.type) : hits,
-      bundle
+      narrowed,
+      bundle,
+      /* @__PURE__ */ new Date(),
+      await this.detectDrift(narrowed, options.repoRoot)
     );
     if (options.includeNonCurrent) return adjudicated;
     const present = new Set(adjudicated.map((hit) => hit.record.conceptId));
@@ -2693,6 +3555,50 @@ ${answer}
     const lowered = needle.toLowerCase();
     return bundle.filter((record) => matches(record, lowered));
   }
+  /**
+   * Anchor drift over the records about to be handed back. Like the search
+   * index, this is an enrichment: a filesystem failure degrades to "no drift
+   * reported" rather than failing the read. Anchors without a stored hash are
+   * skipped inside `detectAnchorDrift`, so a base nobody has stamped pays no
+   * fs cost here. `repoRoot` defaults to the working directory — the CLI runs
+   * at the repo root, and the MCP server's cwd is the workspace.
+   *
+   * Public because `doctor` needs the same map with the same degradation: a
+   * sweep that failed to read the tree should report no drift, not fail.
+   *
+   * When no root was given and not one anchored file was found, the finding is
+   * discarded. A base read from somewhere other than the tree it describes
+   * misses every file at once, and that shape is far likelier to be a wrong
+   * default root than a repository where every anchored file was deleted on
+   * the same day. Reporting it would put a drift warning on every record in
+   * the base, which teaches a reader to ignore the warning — the one outcome
+   * worse than not having it. One file found anywhere makes the root
+   * plausible, and the misses become findings again; an explicit `repoRoot` is
+   * taken at its word either way.
+   */
+  async detectDrift(records, repoRoot) {
+    try {
+      const drift = await detectAnchorDrift(records, {
+        repoRoot: repoRoot ?? process.cwd()
+      });
+      if (repoRoot === void 0 && looksLikeWrongRepoRoot(drift)) {
+        this.logger.warn?.({
+          operation: "kb.anchor-drift",
+          outcome: "skipped",
+          reason: "no anchored file found under the default repo root"
+        });
+        return void 0;
+      }
+      return drift;
+    } catch (error) {
+      this.logger.warn?.({
+        operation: "kb.anchor-drift",
+        outcome: "skipped",
+        error: error instanceof Error ? error.message : "unknown"
+      });
+      return void 0;
+    }
+  }
   /**
    * The whole base, adjudicated, when it is small enough to hand over.
    *
@@ -2712,15 +3618,27 @@ ${answer}
    * is indistinguishable from a complete one, so a caller would answer "that
    * was never decided" from a slice it did not know was a slice.
    *
-   * That refusal is the default guardrail. `all` bypasses it outright and
-   * always hands back the whole bundle: an explicit, never-accidental escape
-   * hatch for an operator who has the budget to spend, not a wider default.
+   * A token budget decides that, measured over what is actually handed back.
+   * The refusal names the estimate and the budget, because a caller told only
+   * "too big" cannot tell whether to narrow the type filter, raise the budget,
+   * or stop loading the base whole altogether. Past the budget the answer is
+   * the catalog and then a pack, which is what the refusal says.
+   *
+   * That refusal is the default guardrail. `all` bypasses the budget outright
+   * and always hands back the whole bundle: an explicit, never-accidental
+   * escape hatch for an operator who has the budget to spend, not a wider
+   * default.
    */
   async load(bundlePath2, options = {}) {
     const budgetTokens = options.budgetTokens ?? DEFAULT_LOAD_BUDGET;
     const bundle = await this.list(bundlePath2);
     const wanted = options.type ? bundle.filter((record) => record.frontmatter.type === options.type) : bundle;
-    const adjudicated = adjudicate(wanted, bundle);
+    const adjudicated = adjudicate(
+      wanted,
+      bundle,
+      /* @__PURE__ */ new Date(),
+      await this.detectDrift(wanted, options.repoRoot)
+    );
     const records = adjudicated.filter((hit) => hit.standing !== "superseded");
     const superseded = adjudicated.filter((hit) => hit.standing === "superseded").map(stub);
     const approxTokens2 = records.reduce((total, hit) => total + estimateTokens(hit.record), 0) + superseded.reduce((total, entry) => total + estimateStubTokens(entry), 0);
@@ -2729,7 +3647,12 @@ ${answer}
         loaded: false,
         recordCount: wanted.length,
         approxTokens: approxTokens2,
-        budgetTokens
+        budgetTokens,
+        message: refusalMessage({
+          approxTokens: approxTokens2,
+          budgetTokens,
+          type: options.type
+        })
       };
     }
     return {
@@ -2745,6 +3668,10 @@ ${answer}
   async trace(bundlePath2, seedId, options = {}) {
     return trace(seedId, await this.list(bundlePath2), options);
   }
+  /** Every record named in one line each. See `catalog.ts`. */
+  async catalog(bundlePath2, options = {}) {
+    return catalog(await this.list(bundlePath2), options);
+  }
   /** A bounded neighbourhood around one record. See `pack.ts`. */
   async pack(bundlePath2, rootId, options = {}) {
     return pack(await this.list(bundlePath2), rootId, options);
@@ -2759,7 +3686,7 @@ ${answer}
   async readIndex(bundlePath2) {
     const root = this.root(bundlePath2);
     const expected = renderIndex(await this.list(bundlePath2));
-    const stored = await readFile3(join4(root, INDEX_FILE), "utf8").catch(
+    const stored = await readFile4(join4(root, INDEX_FILE), "utf8").catch(
       () => null
     );
     if (indexIsStale(stored, expected)) {
@@ -2780,7 +3707,7 @@ ${answer}
    * knows which agent touched what. So a bad line is surfaced and left alone.
    */
   async readLog(bundlePath2) {
-    const raw = await readFile3(
+    const raw = await readFile4(
       join4(this.root(bundlePath2), LOG_FILE),
       "utf8"
     ).catch(() => "");
@@ -2832,14 +3759,14 @@ ${answer}
   }
   async mutate(bundlePath2, conceptId2, change, entry, changeBody = (body) => body) {
     const target = this.recordPath(bundlePath2, conceptId2);
-    const before = await readFile3(target, "utf8").catch(() => null);
+    const before = await readFile4(target, "utf8").catch(() => null);
     if (before === null) throw new KbRecordNotFoundError(conceptId2);
     const parsed = this.parse(conceptId2, before);
     if (!parsed) throw new KbRecordNotFoundError(conceptId2);
     const frontmatter = change(parsed.frontmatter);
     const body = changeBody(parsed.body);
     const contents = stringifyMarkdownWithFrontmatter(body, frontmatter);
-    const witness = await readFile3(target, "utf8").catch(() => null);
+    const witness = await readFile4(target, "utf8").catch(() => null);
     if (witness === null || digest(witness) !== digest(before)) {
       throw new KbWriteConflictError(conceptId2);
     }
@@ -2926,16 +3853,26 @@ ${answer}
     try {
       let existing;
       try {
-        existing = await readFile3(target, "utf8");
+        existing = await readFile4(target, "utf8");
       } catch (error) {
         if (error.code !== "ENOENT") throw error;
         existing = null;
       }
       if (existing === null) {
-        await writeFile3(target, appendUnionMergeLine(""), {
-          encoding: "utf8",
-          flag: "wx"
-        });
+        try {
+          await writeFile3(target, appendUnionMergeLine(""), {
+            encoding: "utf8",
+            flag: "wx"
+          });
+        } catch (error) {
+          if (error.code !== "EEXIST") throw error;
+          this.logger.info?.({
+            operation: "kb.gitattributes.ensure",
+            bundlePath: root,
+            outcome: "exists"
+          });
+          return;
+        }
         this.logger.info?.({
           operation: "kb.gitattributes.ensure",
           bundlePath: root,
@@ -2989,12 +3926,12 @@ ${answer}
     };
   }
   root(bundlePath2) {
-    return resolve4(bundlePath2);
+    return resolve5(bundlePath2);
   }
   // Concept ids are `<type>.<slug>` and map to a single file directly under the
   // bundle root; anything carrying a separator would escape it.
   recordPath(bundlePath2, conceptId2) {
-    if (conceptId2.includes(sep2) || conceptId2.includes("/")) {
+    if (conceptId2.includes(sep3) || conceptId2.includes("/")) {
       throw new KbInvalidConceptIdError(
         "concept id must not contain a path separator",
         { conceptId: conceptId2 }
@@ -3011,6 +3948,14 @@ function estimateTokens(record) {
 function estimateStubTokens(entry) {
   return Math.ceil(JSON.stringify(entry).length / 4);
 }
+function refusalMessage(refusal) {
+  const scope = refusal.type ? ` of type ${refusal.type}` : "";
+  return [
+    `Refusing to load this base whole: ~${refusal.approxTokens} tokens is past the ${refusal.budgetTokens}-token budget.`,
+    `Call kb_catalog for one line per record${scope} (id, type, title, standing), then kb_pack on the record that matters; kb_query works for a lookup by wording.`,
+    `To load anyway: raise budgetTokens (currently ${refusal.budgetTokens}), or all=true to bypass the budget.`
+  ].join(" ");
+}
 function stub(hit) {
   return {
     conceptId: hit.record.conceptId,
@@ -3031,7 +3976,7 @@ function normalizeActor(id) {
   return id.slice(0, colon + 1).toLowerCase() + id.slice(colon + 1);
 }
 function digest(contents) {
-  return createHash("sha256").update(contents).digest("hex");
+  return createHash2("sha256").update(contents).digest("hex");
 }
 
 // src/pack.ts
@@ -3119,7 +4064,7 @@ function typeRank(record) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.1.9" : "0.0.0-dev";
+var VERSION = true ? "0.1.11" : "0.0.0-dev";
 
 export {
   kbSourceSchema,
@@ -3145,6 +4090,21 @@ export {
   composeNoDecisionRecord,
   isNoDecisionRecord,
   selectDecisions,
+  regexResolver,
+  hashAnchorText,
+  resolveAnchor,
+  anchorFilePath,
+  detectAnchorDrift,
+  Fault,
+  ErrorTypes,
+  BaseError,
+  KbRecordAlreadyExistsError,
+  KbRecordNotFoundError,
+  KbWriteConflictError,
+  KbSelfVerificationError,
+  KbPackBudgetExceededError,
+  KbMissingFlagValueError,
+  KbInvalidConceptIdError,
   contextProfileBudgets,
   mergedContextBudgets,
   KbPinsMalformedError,
@@ -3161,6 +4121,8 @@ export {
   unpinBase,
   adjudicate,
   resolveHeads,
+  catalog,
+  renderCatalogLine,
   INDEX_FILE,
   renderIndex,
   renderIndexLine,
@@ -3192,15 +4154,6 @@ export {
   stringifyMarkdownWithFrontmatter,
   splitMarkdownFrontmatter,
   parseMarkdownWithFrontmatter,
-  Fault,
-  ErrorTypes,
-  BaseError,
-  KbRecordAlreadyExistsError,
-  KbRecordNotFoundError,
-  KbWriteConflictError,
-  KbSelfVerificationError,
-  KbPackBudgetExceededError,
-  KbInvalidConceptIdError,
   SEARCH_INDEX_FILE,
   searchBase,
   resolveHits,
@@ -3213,4 +4166,4 @@ export {
   KbStore,
   VERSION
 };
-//# sourceMappingURL=chunk-OFDWRMY6.js.map
+//# sourceMappingURL=chunk-OVRQCQ6P.js.map