diff --git a/CLAUDE.md b/CLAUDE.md
index 1ddc338..27c8329 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -77,6 +77,12 @@ cd client && npm run test:watch
 - Export pure functions (validators, formatters, etc.) for direct testing
 - Run `npm test` in both `server/` and `client/` before committing
 
+**Doc drift check:**
+```bash
+node scripts/doc-drift.js
+```
+Scans `CLAUDE.md` and `PRD.md` for verifiable code references (file paths, API routes, component names) and cross-checks each against the filesystem and source tree. Prints a PASS/FAIL report with doc name and line number. Exits non-zero on any failure — suitable for CI gating.
+
 ## Application Structure
 
 The default route `/` renders the paycheck-centric main view (`client/src/pages/PaycheckView.jsx`). It shows the current month's two paychecks side-by-side with bills, paid status, one-time expenses, and remaining balance. Month navigation (prev/next) fetches data via `GET /api/paychecks?year=&month=`.
diff --git a/scripts/doc-drift.js b/scripts/doc-drift.js
new file mode 100644
index 0000000..9db41b1
--- /dev/null
+++ b/scripts/doc-drift.js
@@ -0,0 +1,203 @@
+#!/usr/bin/env node
+/**
+ * doc-drift.js — detects documentation drift by cross-checking verifiable
+ * code references in CLAUDE.md and PRD.md against the filesystem and source tree.
+ *
+ * Usage: node scripts/doc-drift.js
+ * Exits non-zero if any drift is found.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const DOCS = ['CLAUDE.md', 'PRD.md'].map(f => path.join(ROOT, f));
+
+// ── Result tracking ──────────────────────────────────────────────────────────
+
+const results = [];
+
+function record(doc, line, kind, ref, pass, reason) {
+  results.push({ doc: path.basename(doc), line, kind, ref, pass, reason });
+}
+
+// ── Extraction helpers ───────────────────────────────────────────────────────
+
+/** Extract all backtick spans from a line (may be multiple). */
+function backtickSpans(line) {
+  const spans = [];
+  const re = /`([^`]+)`/g;
+  let m;
+  while ((m = re.exec(line)) !== null) spans.push(m[1]);
+  return spans;
+}
+
+/** Return true if a span looks like a file/dir path we can verify. */
+function isFilePath(span) {
+  // Must contain a slash and start with a recognisable project prefix.
+  return (
+    /[/\\]/.test(span) &&
+    /^(client|server|db|scripts|docker-compose)/.test(span) &&
+    // Exclude shell commands, URLs, SQL snippets, etc.
+    !/\s/.test(span) &&
+    !span.includes('=') &&
+    !span.startsWith('http')
+  );
+}
+
+/** Return true if a span looks like a component/page reference (*.jsx). */
+function isJsxRef(span) {
+  return /\w+\.jsx$/.test(span) && !/[/]/.test(span); // bare name, no path
+}
+
+/** Extract HTTP API route patterns like `GET /api/paychecks`. */
+function extractApiRoutes(line) {
+  const routes = [];
+  const re = /\b(GET|POST|PUT|DELETE|PATCH)\s+(\/api\/[^\s,`'")\]]+)/g;
+  let m;
+  while ((m = re.exec(line)) !== null) routes.push({ method: m[1], path: m[2] });
+  return routes;
+}
+
+// ── Verification helpers ─────────────────────────────────────────────────────
+
+function fileExists(relPath) {
+  return fs.existsSync(path.join(ROOT, relPath));
+}
+
+/**
+ * For API routes: grep server/src/routes/ for the route path string.
+ * We look for the path fragment (everything after /api) as a string literal.
+ */
+function apiRouteExists(routePath) {
+  // Strip query-string placeholders like ?year=&month=
+  const clean = routePath.replace(/\?.*$/, '').replace(/:id/g, ':id');
+  // Build a grep-friendly pattern: look for the path minus leading /api
+  const fragment = clean.replace(/^\/api/, '');
+  try {
+    const out = execSync(
+      `grep -rE --include="*.js" -l "${clean}|${fragment}" "${path.join(ROOT, 'server/src/routes')}"`,
+      { stdio: ['pipe', 'pipe', 'pipe'] }
+    ).toString().trim();
+    return out.length > 0;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * For bare *.jsx component names: check that a file with that name exists
+ * somewhere under client/src/.
+ */
+function jsxComponentExists(name) {
+  try {
+    const out = execSync(
+      `find "${path.join(ROOT, 'client/src')}" -name "${name}" -type f`,
+      { stdio: ['pipe', 'pipe', 'pipe'] }
+    ).toString().trim();
+    return out.length > 0;
+  } catch {
+    return false;
+  }
+}
+
+// ── Main ─────────────────────────────────────────────────────────────────────
+
+for (const docPath of DOCS) {
+  if (!fs.existsSync(docPath)) {
+    console.error(`WARN: doc not found: ${docPath}`);
+    continue;
+  }
+
+  const lines = fs.readFileSync(docPath, 'utf8').split('\n');
+
+  lines.forEach((rawLine, idx) => {
+    const lineNo = idx + 1;
+
+    // 1. Backtick file paths
+    for (const span of backtickSpans(rawLine)) {
+      if (isFilePath(span)) {
+        const exists = fileExists(span);
+        record(
+          docPath,
+          lineNo,
+          'file-path',
+          span,
+          exists,
+          exists ? 'found on filesystem' : `not found: ${span}`
+        );
+        continue;
+      }
+
+      if (isJsxRef(span)) {
+        const exists = jsxComponentExists(span);
+        record(
+          docPath,
+          lineNo,
+          'component',
+          span,
+          exists,
+          exists ? 'found under client/src' : `no file named ${span} in client/src`
+        );
+      }
+    }
+
+    // 2. API routes (inside or outside backticks)
+    for (const { method, path: routePath } of extractApiRoutes(rawLine)) {
+      const ref = `${method} ${routePath}`;
+      const exists = apiRouteExists(routePath);
+      record(
+        docPath,
+        lineNo,
+        'api-route',
+        ref,
+        exists,
+        exists ? 'found in server/src/routes' : `route not found in server/src/routes`
+      );
+    }
+  });
+}
+
+// ── Report ───────────────────────────────────────────────────────────────────
+
+const padDoc  = Math.max(...results.map(r => r.doc.length), 9);
+const padKind = Math.max(...results.map(r => r.kind.length), 9);
+const padRef  = Math.min(60, Math.max(...results.map(r => r.ref.length), 10));
+
+const header = [
+  'STATUS'.padEnd(6),
+  'DOC'.padEnd(padDoc),
+  'LINE'.padStart(4),
+  'KIND'.padEnd(padKind),
+  'REFERENCE',
+].join('  ');
+
+console.log('\n' + header);
+console.log('─'.repeat(header.length + 10));
+
+let failures = 0;
+
+for (const r of results) {
+  const status = r.pass ? 'PASS' : 'FAIL';
+  const ref = r.ref.length > padRef ? r.ref.slice(0, padRef - 1) + '…' : r.ref;
+  const line = [
+    (r.pass ? '\x1b[32m' : '\x1b[31m') + status.padEnd(6) + '\x1b[0m',
+    r.doc.padEnd(padDoc),
+    String(r.line).padStart(4),
+    r.kind.padEnd(padKind),
+    ref,
+  ].join('  ');
+  console.log(line);
+  if (!r.pass) {
+    console.log(`       \x1b[33m↳ ${r.reason}\x1b[0m`);
+    failures++;
+  }
+}
+
+console.log('─'.repeat(header.length + 10));
+console.log(`\n${results.length} references checked — ${failures} failure(s)\n`);
+
+process.exit(failures > 0 ? 1 : 0);