create-egregore 0.19.33 → 0.20.1

package/runtime/codex/bin/graph-op.sh

@@ -708,7 +708,8 @@ case "$OP" in
     fi
     bash "$GS" query "
       MATCH (s:Session)-[:HANDED_TO]->(p:Person)
-      WHERE (
+      WHERE NOT coalesce(p.kind, '') IN ['identity_alias']
+        AND (
         toLower(coalesce(p.name, '')) = toLower(\$user)
         OR toLower(coalesce(p.github, '')) = toLower(\$user)
         OR toLower(coalesce(p.githubUsername, '')) = toLower(\$user)
@@ -718,13 +719,13 @@ case "$OP" in
         AND coalesce(s.handoffStatus, 'pending')
             IN ['pending','unread','read','claimed']
       WITH DISTINCT s
-      OPTIONAL MATCH (s)-[:BY]->(author:Person)
-      WITH s, author,
+      WITH s, head([(s)-[:BY]->(author:Person)
+                    WHERE NOT coalesce(author.kind, '') IN ['identity_alias'] | author.name]) AS authorName,
            CASE WHEN s.date IS NULL THEN null
                 ELSE duration.inDays(date(s.date), date()).days END AS ageDays
       RETURN s.id AS id,
              coalesce(s.topic, s.summary, s.branch) AS topic,
-             coalesce(author.name, s.author, 'unknown') AS author,
+             coalesce(authorName, s.author, 'unknown') AS author,
              toString(s.date) AS date,
              coalesce(s.handoffStatus, 'pending') AS status,
              coalesce(s.handoffIntent, 'unclassified') AS intent,

package/runtime/codex/bin/graph.sh

@@ -21,10 +21,18 @@ if [ "$_MODE" = "local" ]; then
   exit 0
 fi
 
-# Load specific variables from .env if it exists (safe extraction, no arbitrary code execution)
-if [ -f "$SCRIPT_DIR/.env" ]; then
-  EGREGORE_API_URL="${EGREGORE_API_URL:-$(grep '^EGREGORE_API_URL=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)}"
-  EGREGORE_API_KEY="${EGREGORE_API_KEY:-$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)}"
+# Load specific variables from .env if it exists (safe extraction, no arbitrary code execution).
+# A worktree missing its .env symlink resolves through worktree-links.sh, which
+# self-heals the link and falls back to the main checkout's .env.
+_ENV_FILE="$SCRIPT_DIR/.env"
+if [ ! -f "$_ENV_FILE" ] && [ -f "$SCRIPT_DIR/bin/lib/worktree-links.sh" ]; then
+  # shellcheck source=bin/lib/worktree-links.sh
+  source "$SCRIPT_DIR/bin/lib/worktree-links.sh" 2>/dev/null || true
+  _ENV_FILE="$(egregore_env_file "$SCRIPT_DIR" 2>/dev/null || true)"
+fi
+if [ -n "$_ENV_FILE" ] && [ -f "$_ENV_FILE" ]; then
+  EGREGORE_API_URL="${EGREGORE_API_URL:-$(grep '^EGREGORE_API_URL=' "$_ENV_FILE" 2>/dev/null | cut -d'=' -f2- || true)}"
+  EGREGORE_API_KEY="${EGREGORE_API_KEY:-$(grep '^EGREGORE_API_KEY=' "$_ENV_FILE" 2>/dev/null | cut -d'=' -f2- || true)}"
 fi
 
 # api_url comes from egregore.json (committed, non-secret)
@@ -168,8 +176,26 @@ if [ -n "$API_URL" ] && [ -n "$API_KEY" ]; then
     fi
   }
 
+elif [ -n "$API_URL" ]; then
+  # === CONNECTED CONFIG, MISSING KEY ===
+  # api_url is configured, so the org expects a live graph, but no API key was
+  # found. Faking '{"results":[]}' here made a missing credential (e.g. a
+  # worktree without its .env symlink) indistinguishable from an empty graph —
+  # fail loudly instead. `test` keeps its offline JSON contract: dashboards,
+  # render-card, and startup-check consume it.
+  _missing_credentials() {
+    {
+      echo "Error: api_url is configured but EGREGORE_API_KEY is empty (looked in: ${_ENV_FILE:-$SCRIPT_DIR/.env})."
+      echo "  If this is a worktree, its .env symlink may be missing. Run /env to configure."
+    } >&2
+    exit 1
+  }
+  run_query() { _missing_credentials; }
+  get_schema() { _missing_credentials; }
+  test_connection() { echo '{"status":"offline","reason":"no_api_key"}'; }
+
 else
-  # === OFFLINE MODE: No API key — return empty results (OSS/local) ===
+  # === OFFLINE MODE: no api_url configured (OSS/unconfigured) ===
   run_query() { echo '{"results":[]}'; }
   get_schema() { echo '{}'; }
   test_connection() { echo '{"status":"offline","reason":"no_api_key"}'; }

package/runtime/codex/bin/handoff-pr-backfill.sh

@@ -77,7 +77,7 @@ if [ -d "$MEMORY_DIR" ]; then
   (
     cd "$MEMORY_DIR" || exit 0
     git add -A >/dev/null 2>&1
-    git commit -m "Backfill PR numbers for handoff: $TOPIC" >/dev/null 2>&1 || exit 0
+    git commit -m "chore(handoff): backfill PR numbers for $TOPIC" >/dev/null 2>&1 || exit 0
     git pull --rebase origin main --quiet >/dev/null 2>&1
     git push origin main --quiet >/dev/null 2>&1
   ) || true

package/runtime/codex/bin/handoff-run.sh

@@ -36,6 +36,11 @@ set -euo pipefail
 #   1 on unrecoverable failure (file write, memory push, bad args).
 
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=bin/lib/git-message.sh
+. "$SCRIPT_DIR/bin/lib/git-message.sh" 2>/dev/null || true
+type egregore_commit >/dev/null 2>&1 || egregore_commit() {
+  local gd="$1" m="$3"; shift 3; git -C "$gd" commit -m "$m" "$@"
+}
 CONFIG="$SCRIPT_DIR/egregore.json"
 
 if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
@@ -326,12 +331,12 @@ PID_ARTIFACTS=$!
     git add "$REL_FILE" handoffs/index.md >/dev/null 2>&1
 
     if [ -n "$RECIPIENT" ]; then
-      MSG_COMMIT="Handoff: ${TOPIC} (to ${RECIPIENT})"
+      MSG_COMMIT="chore(handoff): record ${TOPIC} (to ${RECIPIENT})"
     else
-      MSG_COMMIT="Handoff: ${TOPIC}"
+      MSG_COMMIT="chore(handoff): record ${TOPIC}"
     fi
 
-    git commit -m "$MSG_COMMIT" >/dev/null 2>&1 || true
+    egregore_commit . "$SCRIPT_DIR" "$MSG_COMMIT" >/dev/null 2>&1 || true
 
     STASHED=0
     if [ -n "$(git status --porcelain 2>/dev/null)" ]; then

package/runtime/codex/bin/handoff-save-egregore.sh

@@ -47,19 +47,16 @@ done
 
 case "$KIND" in
   autosave)
-    MSG_PREFIX="Auto-save"
+    MSG_PREFIX="chore(autosave): save"
     PR_WHAT="Save session content captured by the opted-in autosave workflow."
     PR_WHY="This preserves unattended non-coding work without requiring an explicit /save."
     ;;
   *)
-    MSG_PREFIX="Handoff"
+    MSG_PREFIX="chore(handoff): record"
     PR_WHAT="Save core-repository session work captured when the handoff was created."
     PR_WHY="The handoff records shared context immediately; this companion PR keeps the originating checkout's work from remaining only local."
     ;;
 esac
-PR_BODY=$(printf '## What\n\n- %s\n\n## Why\n\n%s Topic: `%s`.\n\n## Verification\n\nNot verified — background %s save; review code or configuration changes before merging.\n\n🤖 Saved via `bin/handoff-save-egregore.sh`\n' \
-  "$PR_WHAT" "$PR_WHY" "$TOPIC" "$KIND")
-
 [ -n "$AUTHOR" ] || { echo "handoff-save-egregore: missing author" >&2; exit 1; }
 
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
@@ -88,6 +85,21 @@ BASE_REF="origin/$BASE_BRANCH"
 . "$SCRIPT_DIR/bin/lib/git-safe.sh" 2>/dev/null || true
 type git_add_guarded >/dev/null 2>&1 || git_add_guarded() { git add -A 2>/dev/null || true; }
 
+# Shared commit/PR message mechanics (trailers + skeleton body shape).
+# shellcheck source=bin/lib/git-message.sh
+. "$SCRIPT_DIR/bin/lib/git-message.sh" 2>/dev/null || true
+type egregore_commit >/dev/null 2>&1 || egregore_commit() {
+  local gd="$1" m="$3"; shift 3; git -C "$gd" commit -m "$m" "$@"
+}
+type egregore_pr_skeleton >/dev/null 2>&1 || egregore_pr_skeleton() {
+  printf '## What\n%s\n\n## Why\n%s\n\n## Verification\n%s\n\n%s\n' "$1" "$2" "$3" "$4"
+}
+PR_BODY=$(egregore_pr_skeleton \
+  "- $PR_WHAT" \
+  "$PR_WHY Topic: \`$TOPIC\`." \
+  "Not verified — background $KIND save; review code or configuration changes before merging." \
+  "🤖 Saved via \`bin/handoff-save-egregore.sh\`")
+
 # Shared non-coding classifier (auto-merge policy lives in one place).
 # shellcheck source=bin/lib/noncode.sh
 . "$SCRIPT_DIR/bin/lib/noncode.sh" 2>/dev/null || true
@@ -131,7 +143,7 @@ fi
 # --- Commit whatever is uncommitted --------------------------------------
 if [ -n "$(git status --porcelain 2>/dev/null)" ]; then
   git_add_guarded
-  git commit -m "${MSG_PREFIX}: ${TOPIC}" --quiet 2>/dev/null || true
+  egregore_commit . "$REPO_DIR" "${MSG_PREFIX} ${TOPIC}" --quiet 2>/dev/null || true
 fi
 
 # --- Rebase onto the configured base, fall back to merge on conflicts ----
@@ -182,7 +194,7 @@ else
   PR_URL=$(gh pr create \
     --base "$BASE_BRANCH" \
     --head "$CURRENT_BRANCH" \
-    --title "${MSG_PREFIX}: ${TOPIC}" \
+    --title "${MSG_PREFIX} ${TOPIC}" \
     --body "$PR_BODY" \
     2>/dev/null || echo "")
   PR_NUMBER=$(echo "$PR_URL" | grep -oE '[0-9]+$' || echo "")

package/runtime/codex/bin/ingest.py

@@ -23,10 +23,12 @@ from datetime import datetime, timezone
 from pathlib import Path
 from xml.etree import ElementTree
 
-sys.path.insert(0, str(Path(__file__).resolve().parent))
+sys.path.append(str(Path(__file__).resolve().parent))
+import catalogue as catalogue_module  # noqa: E402
 import doc_segment  # noqa: E402  (same-directory module, path set above)
 import pdf_extract  # noqa: E402
 import source_profile  # noqa: E402
+import text_repair  # noqa: E402
 
 
 ROOT = Path(__file__).resolve().parent.parent
@@ -152,6 +154,65 @@ def chunks(text: str, limit: int = 7000) -> list[str]:
     return result
 
 
+# Catalogue columns that carry provenance, by what they mean rather than by
+# what any one organisation calls them. A profile's `map` already renames its
+# own columns to these, so no further configuration is needed.
+CATALOGUE_URL_FIELDS = ("url", "source_url", "link")
+CATALOGUE_INSTITUTION_FIELDS = ("institution", "publisher", "source_type", "source")
+
+
+def catalogue_provenance(catalogued: dict) -> tuple:
+    """The URL and institution a catalogue records for a document.
+
+    The resolver has always accepted these and ranks both above a filename,
+    because a filename is what someone happened to save a file as. Ingest
+    passed only the filename, so the stronger evidence sitting in the row it
+    had just read went unused.
+
+    Measured on a real archive that was not a marginal loss. Seventy articles
+    downloaded from two journal indexes were saved under bare article titles,
+    carrying no publisher token to match. The profile had rules for both
+    indexes and the catalogue named the index for every one of them, and still
+    nothing matched — the one input that could have identified them was the one
+    input never passed.
+    """
+    if not catalogued:
+        return "", ""
+    url = next((str(catalogued[f]) for f in CATALOGUE_URL_FIELDS if catalogued.get(f)), "")
+    institution = next(
+        (str(catalogued[f]) for f in CATALOGUE_INSTITUTION_FIELDS if catalogued.get(f)), "")
+    return url, institution
+
+
+def find_publisher_profile() -> Path | None:
+    """Where this instance's publisher profile is, if it has one.
+
+    The profile is what assigns a zone and a trust tier to each document, and
+    zone is a hard retrieval boundary. Ingesting without it produces a corpus
+    where every document is unplaced, so every later question is refused — a
+    failure that looks like an empty archive rather than a missing setting.
+
+    So this looks in the places a profile actually lives rather than in one
+    fixed path. An instance keeps its ontology under memory/knowledge/tools/,
+    not beside its intake metadata, and requiring an environment variable to
+    bridge that gap means the common case is the broken one.
+    """
+    override = os.environ.get("EGREGORE_PUBLISHER_PROFILE")
+    if override:
+        path = Path(override)
+        return path if path.is_file() else None
+
+    candidates = [metadata_root() / "publisher-profile.json"]
+    memory = Path("memory")
+    if memory.is_dir():
+        candidates.extend(sorted(memory.glob("knowledge/tools/*/publisher-profile.json")))
+        candidates.append(memory / "publisher-profile.json")
+    for path in candidates:
+        if path.is_file():
+            return path
+    return None
+
+
 def publisher_profile() -> dict | None:
     """Load the instance's publisher profile, if one is configured.
 
@@ -159,9 +220,8 @@ def publisher_profile() -> dict | None:
     operator set: deriving a region is an inference, and an inference must not
     silently replace a stated fact.
     """
-    override = os.environ.get("EGREGORE_PUBLISHER_PROFILE")
-    path = Path(override) if override else (metadata_root() / "publisher-profile.json")
-    if not path.is_file():
+    path = find_publisher_profile()
+    if path is None:
         return None
     try:
         return json.loads(path.read_text(encoding="utf-8"))
@@ -223,8 +283,31 @@ def add_path(args: argparse.Namespace) -> dict:
     existing_manifest = load_manifest(directory)
     previous = {d["id"]: d for d in existing_manifest.get("documents", [])}
     now = datetime.now(timezone.utc).isoformat()
+    profile_path = find_publisher_profile()
     profile = publisher_profile()
+    if profile is None:
+        # Said once, plainly, because the alternative is a corpus that ingests
+        # cleanly and then refuses every question with no indication why.
+        print("ingest: no publisher-profile.json found — documents will carry no zone "
+              "or trust tier, and a zoneless document can never be served. Put one "
+              "under memory/knowledge/tools/<ontology>/ or set "
+              "EGREGORE_PUBLISHER_PROFILE.", file=sys.stderr)
+    catalogue = catalogue_module.load(
+        profile or {}, base=profile_path.parent if profile_path else None
+    )
+    repair_map = text_repair.load_mapping(profile or {})
     ingested = unchanged = metadata_updated = skipped = pruned = 0
+    # How often progress is written. The manifest used to be saved once, after
+    # every file, so an interrupted run lost everything it had extracted — on a
+    # 921-document folder that was two and a half hours of OCR with nothing to
+    # show. Documents already on disk were re-extracted because nothing recorded
+    # them. Writing periodically means an interruption costs at most this many.
+    checkpoint_every = int(os.environ.get("EGREGORE_INGEST_CHECKPOINT", "25") or 0)
+    since_checkpoint = 0
+    # Read before the loop rather than after it, so a checkpoint writes the real
+    # deletion records instead of dropping them. Pruning still happens later; a
+    # mid-run save simply carries forward what the previous run recorded.
+    tombstones = existing_manifest.get("tombstones", [])
     errors: list[dict] = []
     seen_paths: set[str] = set()
 
@@ -252,6 +335,15 @@ def add_path(args: argparse.Namespace) -> dict:
             extraction = {"kind": "local", "extractor": extractor} if extractor else None
             if extraction and detail:
                 extraction["pages"] = detail
+        # Fix characters the document's own font encoding got wrong, before
+        # anything downstream indexes or quotes them.
+        repaired = None
+        if text and repair_map:
+            outcome = text_repair.repair(text, repair_map)
+            if outcome.replaced:
+                text = outcome.text
+                repaired = outcome.as_report()
+
         if error or text is None or not text.strip():
             skipped += 1
             errors.append({"path": relative, "error": error or "empty extracted text"})
@@ -283,6 +375,9 @@ def add_path(args: argparse.Namespace) -> dict:
             continue
         # Segment before chunking so no passage straddles two works. A document
         # holding a single work yields one segment, and chunking is unchanged.
+        if repaired and extraction:
+            extraction["repair"] = repaired
+
         segments = doc_segment.segment(text)
         document_chunks: list[tuple[str, doc_segment.Segment]] = []
         for seg in segments:
@@ -314,12 +409,37 @@ def add_path(args: argparse.Namespace) -> dict:
         # is absent filters nothing. A derived value is marked as derived: anything
         # downstream can tell it apart from one a person stated, and weigh it by the
         # confidence recorded alongside. An operator's value is never overwritten.
+        # Evidence strongest first: what the operator stated, then what the
+        # organisation's own catalogue records, then what can be inferred from
+        # the document's origin. A weaker source never overwrites a stronger one.
         provenance = None
         doc_boundaries = dict(boundaries)
+        catalogued = catalogue_module.lookup(catalogue, relative)
+
+        if catalogued:
+            provenance = {"from_catalogue": {k: v for k, v in catalogued.items()}}
+            for field_name, value in catalogued.items():
+                if field_name in ("zone", "crop", "topic", "customer", "jurisdiction", "project"):
+                    if field_name not in doc_boundaries:
+                        doc_boundaries[field_name] = value
+                        provenance["applied_boundary"] = field_name
+            if catalogued.get("year"):
+                structure.setdefault("publication_year", catalogued["year"])
+                structure["year_source"] = structure.get("year_source") or "catalogue"
+            if catalogued.get("tier"):
+                provenance["tier"] = catalogued["tier"]
+            provenance["confidence"] = "high"
+
         if profile:
-            resolved = source_profile.resolve(profile, filename=relative)
+            catalogue_url, catalogue_institution = catalogue_provenance(catalogued)
+            resolved = source_profile.resolve(
+                profile, url=catalogue_url, institution=catalogue_institution,
+                filename=relative)
             if resolved.publisher_class or resolved.notes:
-                provenance = resolved.as_dict()
+                inferred = resolved.as_dict()
+                # Keep the inference visible even when the catalogue answered,
+                # so a disagreement between the two is inspectable.
+                provenance = {**inferred, **(provenance or {})} if provenance else inferred
             key = source_profile.boundary_key(profile)
             if key and resolved.zone and key not in doc_boundaries:
                 doc_boundaries[key] = resolved.zone
@@ -362,12 +482,18 @@ def add_path(args: argparse.Namespace) -> dict:
             "status": "unverified",
             "ingested_at": now,
         }
+        since_checkpoint += 1
+        if checkpoint_every and since_checkpoint >= checkpoint_every:
+            # A crash between the document write and this one costs re-extraction
+            # of at most `checkpoint_every` files, never the whole run.
+            write_manifest(directory, source_id, org, args, boundaries, base, now,
+                           previous, tombstones, errors)
+            since_checkpoint = 0
         if existing and existing.get("content_hash") == content_hash:
             metadata_updated += 1
         else:
             ingested += 1
 
-    tombstones = existing_manifest.get("tombstones", [])
     if args.prune:
         if not input_path.is_dir():
             raise ValueError("--prune requires a directory snapshot")
@@ -389,11 +515,23 @@ def add_path(args: argparse.Namespace) -> dict:
     # Current documents always win over historical deletion records.
     tombstones = [row for row in tombstones if row["id"] not in previous]
 
+    write_manifest(directory, source_id, org, args, boundaries, base, now,
+                   previous, tombstones, errors)
+    return {"org": org, "source": source_id, "ingested": ingested, "unchanged": unchanged, "metadata_updated": metadata_updated, "skipped": skipped, "pruned": pruned, "documents": len(previous), "metadata_root": str(directory), "data_root": str(docs_dir)}
+
+
+def write_manifest(directory, source_id, org, args, boundaries, base, now,
+                   previous, tombstones, errors) -> None:
+    """Persist progress. Called periodically during a run and once at the end.
+
+    One writer for both so a checkpoint and a completed run cannot record the
+    corpus differently.
+    """
     source_record = {
         "id": source_id,
         "org": org,
-        "name": args.name or source_id,
-        "kind": args.kind,
+        "name": getattr(args, "name", None) or source_id,
+        "kind": getattr(args, "kind", None),
         "boundaries": boundaries,
         "root_hint": base.name,
         "updated_at": now,
@@ -410,7 +548,6 @@ def add_path(args: argparse.Namespace) -> dict:
             "errors": errors,
         },
     )
-    return {"org": org, "source": source_id, "ingested": ingested, "unchanged": unchanged, "metadata_updated": metadata_updated, "skipped": skipped, "pruned": pruned, "documents": len(previous), "metadata_root": str(directory), "data_root": str(docs_dir)}
 
 
 def cmd_add(args: argparse.Namespace) -> int:
@@ -418,6 +555,191 @@ def cmd_add(args: argparse.Namespace) -> int:
     return 0
 
 
+def rewrite_frontmatter(path: Path, updates: dict) -> bool:
+    """Replace named frontmatter fields in place, leaving the text untouched.
+
+    A document's placement lives in two files — the manifest record and this
+    document's own frontmatter — and a reader may consult either. Updating one
+    and not the other produces a corpus that disagrees with itself, which is
+    worse than the stale value it replaced.
+
+    Only the named lines are rewritten. The body is never reparsed, so nothing
+    that survived extraction can be lost by a maintenance pass.
+    """
+    try:
+        text = path.read_text(encoding="utf-8")
+    except OSError:
+        return False
+    lines = text.split("\n")
+    if not lines or lines[0].strip() != "---":
+        return False
+    try:
+        close = next(i for i in range(1, len(lines)) if lines[i].strip() == "---")
+    except StopIteration:
+        return False
+    remaining = dict(updates)
+    for i in range(1, close):
+        key = lines[i].split(":", 1)[0].strip()
+        if key in remaining:
+            lines[i] = f"{key}: {json.dumps(remaining.pop(key), ensure_ascii=False)}"
+    # A field the original write omitted is appended rather than dropped, so a
+    # document ingested before a field existed still gains it.
+    for key, value in remaining.items():
+        lines.insert(close, f"{key}: {json.dumps(value, ensure_ascii=False)}")
+        close += 1
+    atomic_text(path, "\n".join(lines))
+    return True
+
+
+def reresolve_source(args: argparse.Namespace) -> dict:
+    """Re-derive placement for documents already ingested.
+
+    Placement is written once, at ingest, and never revisited. That is right
+    for content — the text of a document does not change because a rule did —
+    but wrong for the rules themselves. Correcting a publisher profile changed
+    nothing about the corpus it governs: `add` skips on the content hash and
+    returns before it ever consults the profile, so it reported every document
+    unchanged while the corrected rule went unapplied. The only way to apply a
+    fix was to re-extract thousands of documents, redoing OCR to recompute a
+    field that depends on nothing but the filename.
+
+    So this re-runs the resolver alone. No file is reopened, no text is
+    re-extracted; the stored path is all the resolver ever needed.
+
+    Evidence precedence is the same as at ingest, and is the reason this is
+    safe to run at any time: a value the operator stated, or one the
+    organisation's own catalogue recorded, is never overwritten by an
+    inference. Only a placement this resolver derived — or the absence of one —
+    is open to revision.
+    """
+    config = load_config()
+    source_id = slug(args.source)
+    directory = source_dir(source_id)
+    manifest = load_manifest(directory)
+    records = manifest.get("documents") or []
+    if not records:
+        return {"source": source_id, "error": "no manifest, or no documents in it",
+                "metadata_root": str(directory)}
+
+    profile = publisher_profile()
+    if profile is None:
+        return {"source": source_id,
+                "error": "no publisher-profile.json found — nothing to resolve against"}
+    key = source_profile.boundary_key(profile)
+    if not key:
+        return {"source": source_id, "error": "profile declares no boundary key"}
+
+    docs_dir = data_root() / "sources" / source_id / "documents"
+    placed = rezoned = identified = unchanged = protected = missing = 0
+    changes: list = []
+
+    for record in records:
+        relative = record.get("source_path")
+        if not relative:
+            unchanged += 1
+            continue
+        boundaries = dict(record.get("boundaries") or {})
+        provenance = dict(record.get("provenance") or {})
+        catalogued = provenance.get("from_catalogue") or {}
+
+        # The same evidence the original ingest had, re-read from the record so
+        # a document identified only by its catalogue row resolves here too.
+        catalogue_url, catalogue_institution = catalogue_provenance(catalogued)
+        resolved = source_profile.resolve(
+            profile, url=catalogue_url, institution=catalogue_institution,
+            filename=relative)
+
+        # Placement and identification are decided separately. A document can
+        # become identifiable — a journal index naming its publisher — without
+        # that saying anything about which region it applies to, and reporting
+        # only the placement would call that document unchanged when the thing
+        # that decides how far to trust it has just been settled.
+        current = boundaries.get(key)
+        # Anything the operator stated or the catalogue recorded outranks an
+        # inference and is left exactly as it is.
+        derived_here = (provenance.get("derived") is True
+                        and provenance.get("applied_boundary") == key)
+        zone_open = not ((current and not derived_here) or catalogued.get(key))
+        zone_changes = bool(zone_open and resolved.zone and resolved.zone != current)
+
+        # A tier the catalogue stated is likewise not ours to revise.
+        class_open = not catalogued.get("tier")
+        class_changes = bool(
+            class_open and resolved.publisher_class
+            and (resolved.publisher_class != provenance.get("publisher_class")
+                 or resolved.tier != provenance.get("tier")))
+
+        if not zone_changes and not class_changes:
+            if not zone_open and not class_open:
+                protected += 1
+            elif current and not zone_open:
+                protected += 1
+            else:
+                unchanged += 1
+            continue
+
+        # The fresh resolution replaces the recorded inference whenever either
+        # half moved. Refreshing only on a class change once left a re-zoned
+        # document carrying the confidence and notes of the resolution it no
+        # longer had — a record that reported an inferred national zone with
+        # the confidence of a precise one.
+        updated_provenance = dict(provenance)
+        updated_provenance.update(resolved.as_dict())
+        if class_changes:
+            identified += 1
+        if catalogued:
+            updated_provenance["from_catalogue"] = catalogued
+        if zone_changes:
+            updated_provenance["applied_boundary"] = key
+            updated_provenance["derived"] = True
+            boundaries[key] = resolved.zone
+            if current:
+                rezoned += 1
+            else:
+                placed += 1
+
+        changes.append({"id": record["id"], "source_path": relative,
+                        "zone": {"from": current, "to": boundaries.get(key)},
+                        "class": {"from": provenance.get("publisher_class"),
+                                  "to": updated_provenance.get("publisher_class")},
+                        "matched_by": resolved.matched_by})
+
+        if args.dry_run:
+            continue
+        record["boundaries"] = boundaries
+        record["provenance"] = updated_provenance
+        file_path = record.get("file_path")
+        target = (data_root() / file_path) if file_path else (docs_dir / f"{record['id']}.md")
+        if not rewrite_frontmatter(target, {"boundaries": boundaries,
+                                            "provenance": updated_provenance}):
+            missing += 1
+
+    if not args.dry_run and (placed or rezoned or identified):
+        manifest["documents"] = sorted(records, key=lambda d: d["id"])
+        atomic_json(directory / "manifest.json", manifest)
+
+    return {
+        "org": slug(config.get("slug") or "egregore"),
+        "source": source_id,
+        "dry_run": bool(args.dry_run),
+        "documents": len(records),
+        "placed": placed,
+        "rezoned": rezoned,
+        "identified": identified,
+        "unchanged": unchanged,
+        "protected": protected,
+        "frontmatter_not_found": missing,
+        "examples": changes[: max(0, args.examples)],
+        "metadata_root": str(directory),
+    }
+
+
+def cmd_reresolve(args: argparse.Namespace) -> int:
+    result = reresolve_source(args)
+    print(json.dumps(result, indent=2, ensure_ascii=False))
+    return 1 if result.get("error") else 0
+
+
 def selection_relative_path(value: object) -> str:
     if not isinstance(value, str) or not value or "\x00" in value or "\\" in value:
         raise ValueError("selection contains an invalid relative path")
@@ -643,6 +965,15 @@ def parser() -> argparse.ArgumentParser:
     add.add_argument("--boundary", action="append", default=[])
     add.add_argument("--prune", action="store_true", help="tombstone files absent from this authoritative directory snapshot")
     add.set_defaults(func=cmd_add)
+    reresolve = sub.add_parser(
+        "reresolve",
+        help="re-derive placement from the current profile, without re-reading any document")
+    reresolve.add_argument("--source", required=True, help="source id to re-resolve")
+    reresolve.add_argument("--dry-run", action="store_true",
+                           help="report what would change and write nothing")
+    reresolve.add_argument("--examples", type=int, default=10,
+                           help="how many changed documents to list (default 10)")
+    reresolve.set_defaults(func=cmd_reresolve)
     add_selection = sub.add_parser("add-selection")
     add_selection.add_argument("manifest")
     add_selection.set_defaults(func=cmd_add_selection)