mason-context 0.16.1 → 0.16.3

package/dist/mason-auto.js

@@ -248,320 +248,101 @@ var init_storage = __esm({
   }
 });
 
-// src/automation/execution.ts
+// src/automation/store.ts
+import fs3 from "fs/promises";
 import os from "os";
-import { randomUUID as randomUUID2 } from "crypto";
 import { z } from "zod";
-function parseExecution(raw) {
-  try {
-    return executionSchema.parse(raw);
-  } catch (error) {
-    throw new Error("Invalid automation execution store; receipt history was retained.", { cause: error });
-  }
-}
-function automationFailure(error) {
-  const recorded = failureSchema.safeParse(error?.failure);
-  if (recorded.success) return recorded.data;
-  const message2 = (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 700);
-  const codes = /* @__PURE__ */ new Set();
-  let cause = error;
-  for (let i = 0; cause && i < 8; i++) {
-    codes.add(String(cause.code));
-    cause = cause.cause;
-  }
-  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message2) ? "inputs-changed" : /Automation is busy/.test(message2) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message2) ? "history-unavailable" : error instanceof z.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message2) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message2) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
-  return { code, message: message2, retryable: ["inputs-changed", "storage-full", "busy", "io-error"].includes(code), receiptRecorded: false };
-}
-function failureMessage(error) {
-  const failure = automationFailure(error);
-  return `Mason automation unavailable [${failure.code}]; evidence capture/verification was not established. ${failure.message}` + (failure.receiptRecorded ? "" : " No durable failure receipt was recorded.");
-}
-async function recordExecution(root, directory, event, run) {
-  const file = directory + "/execution.json";
-  const raw = await readStoreJson(root, file);
-  const log = raw === null ? { version: 1, attempts: [], discardedAttempts: 0 } : parseExecution(raw);
-  for (const attempt2 of log.attempts) if (attempt2.status === "running") attempt2.status = "unknown";
-  log.discardedAttempts += Math.max(0, log.attempts.length - 31);
-  log.attempts = log.attempts.slice(-31);
-  const started = performance.now();
-  const attempt = {
-    id: randomUUID2(),
-    event,
-    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    pid: process.pid,
-    host: os.hostname(),
-    status: "running"
-  };
-  log.attempts.push(attempt);
-  await writeStoreJson(root, file, log);
+function parseState(raw) {
   try {
-    const result = await run();
-    Object.assign(attempt, {
-      status: "completed",
-      finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      durationMs: performance.now() - started,
-      verificationStatus: result.report.status,
-      reportPath: result.report.reportPath
-    });
-    await writeStoreJson(root, file, log);
-    return result;
+    return stateSchema.parse(raw);
   } catch (error) {
-    const failure = automationFailure(error);
-    Object.assign(attempt, { status: "failed", finishedAt: (/* @__PURE__ */ new Date()).toISOString(), durationMs: performance.now() - started, failure });
-    delete attempt.verificationStatus;
-    delete attempt.reportPath;
-    try {
-      await writeStoreJson(root, file, { ...log, attempts: log.attempts.map((a) => a === attempt ? { ...a, failure: { ...failure, receiptRecorded: true } } : a) });
-      failure.receiptRecorded = true;
-    } catch {
-    }
-    throw Object.assign(new Error(failure.message, { cause: error }), { failure });
+    throw new Error("Invalid automation state; original evidence was retained.", { cause: error });
   }
 }
-async function executionStatus(root, directory) {
-  const raw = await readStoreJson(root, directory + "/execution.json");
-  if (raw === null) return { status: "not-observed", attempts: [] };
-  const log = parseExecution(raw);
-  let lock = null;
-  if (log.attempts.some((attempt) => attempt.status === "running")) {
+async function withLock(root, directory, run, waitMs = 5e3) {
+  const file = await storePath(root, directory + "/lock", true);
+  const deadline = Date.now() + waitMs;
+  let handle;
+  while (!handle) {
     try {
-      lock = await readStoreJson(root, directory + "/lock");
-    } catch {
-    }
-  }
-  for (const attempt of log.attempts) {
-    if (attempt.status !== "running") continue;
-    let alive = false;
-    if (attempt.host === os.hostname() && lock?.pid === attempt.pid && lock.host === attempt.host) {
+      handle = await fs3.open(file, "wx", 384);
       try {
-        process.kill(attempt.pid, 0);
-        alive = true;
+        await handle.writeFile(JSON.stringify({ pid: process.pid, host: os.hostname() }));
       } catch (error) {
-        alive = error.code === "EPERM";
+        await handle.close().catch(() => {
+        });
+        handle = void 0;
+        await fs3.rm(file, { force: true }).catch(() => {
+        });
+        throw error;
       }
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      try {
+        const owner = JSON.parse(await fs3.readFile(file, "utf8"));
+        if (owner.host === os.hostname() && Number.isInteger(owner.pid) && owner.pid > 0) {
+          try {
+            process.kill(owner.pid, 0);
+          } catch (probe) {
+            if (probe.code === "ESRCH") {
+              const reclaim = file + ".reclaim";
+              let guard;
+              try {
+                guard = await fs3.open(reclaim, "wx", 384);
+                const current = JSON.parse(await fs3.readFile(file, "utf8"));
+                if (current.pid === owner.pid && current.host === owner.host) await fs3.unlink(file);
+              } finally {
+                if (guard) {
+                  await guard.close();
+                  await fs3.rm(reclaim, { force: true });
+                }
+              }
+            }
+          }
+        }
+      } catch {
+      }
+      if (Date.now() >= deadline) throw new Error("Automation is busy or its lock needs inspection: " + file);
+      await new Promise((resolve) => setTimeout(resolve, 40));
     }
-    if (!alive) attempt.status = "unknown";
-  }
-  return { status: log.attempts.at(-1)?.status ?? "not-observed", attempts: log.attempts, discardedAttempts: log.discardedAttempts };
-}
-var failureSchema, attemptSchema, executionSchema;
-var init_execution = __esm({
-  "src/automation/execution.ts"() {
-    "use strict";
-    init_storage();
-    failureSchema = z.object({
-      code: z.enum(["inputs-changed", "storage-full", "busy", "invalid-input", "history-unavailable", "invalid-evidence", "io-error", "internal"]),
-      message: z.string(),
-      retryable: z.boolean(),
-      receiptRecorded: z.boolean()
-    });
-    attemptSchema = z.object({
-      id: z.string(),
-      event: z.string(),
-      startedAt: z.string(),
-      finishedAt: z.string().optional(),
-      durationMs: z.number().nonnegative().optional(),
-      pid: z.number().int().positive(),
-      host: z.string(),
-      status: z.enum(["running", "completed", "failed", "unknown"]),
-      verificationStatus: z.string().optional(),
-      reportPath: z.string().optional(),
-      failure: failureSchema.optional()
-    });
-    executionSchema = z.object({ version: z.literal(1), attempts: z.array(attemptSchema).max(32), discardedAttempts: z.number().int().nonnegative().default(0) });
-  }
-});
-
-// src/test-map.ts
-import path4 from "path";
-async function buildTestMap(dir) {
-  const rootDir = path4.resolve(dir);
-  const access = await createFileAccess(rootDir);
-  const testPatterns = [
-    "**/*.test.*",
-    "**/*.spec.*",
-    "**/*Test.kt",
-    "**/*Test.java",
-    "**/*Tests.kt",
-    "**/*Tests.java",
-    "**/test_*.py",
-    "**/*_test.py",
-    "**/*_test.go",
-    "**/*Tests.swift",
-    "**/*Test.swift",
-    "**/*_test.rs"
-  ];
-  const testFiles = await access.list(testPatterns);
-  const sourceFiles = await access.list();
-  const sourceByBaseName = /* @__PURE__ */ new Map();
-  for (const file of sourceFiles) {
-    if (testFiles.includes(file)) continue;
-    const baseName = path4.basename(file).replace(/\.[^.]+$/, "");
-    const existing = sourceByBaseName.get(baseName) ?? [];
-    existing.push(file);
-    sourceByBaseName.set(baseName, existing);
-  }
-  const paired = [];
-  const unmatched = [];
-  for (const testFile of testFiles) {
-    const testBaseName = path4.basename(testFile).replace(/\.[^.]+$/, "");
-    const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
-    if (!sourceName) {
-      unmatched.push(testFile);
-      continue;
-    }
-    const candidates = sourceByBaseName.get(sourceName);
-    if (candidates && candidates.length > 0) {
-      const testDir = path4.dirname(testFile);
-      const bestMatch = candidates.reduce((best, candidate) => {
-        const candidateDir = path4.dirname(candidate);
-        const bestDir = path4.dirname(best);
-        const candidateOverlap = commonSegments(testDir, candidateDir);
-        const bestOverlap = commonSegments(testDir, bestDir);
-        return candidateOverlap > bestOverlap ? candidate : best;
-      });
-      paired.push({
-        test: testFile,
-        source: bestMatch,
-        confidence: candidates.length === 1 ? "exact" : "best-guess"
-      });
-    } else {
-      unmatched.push(testFile);
-    }
-  }
-  return { totalTestFiles: testFiles.length, paired, unmatched };
-}
-function commonSegments(pathA, pathB) {
-  const segsA = pathA.split("/");
-  const segsB = pathB.split("/");
-  let count3 = 0;
-  for (let i = 0; i < Math.min(segsA.length, segsB.length); i++) {
-    if (segsA[i] === segsB[i]) count3++;
-    else break;
-  }
-  return count3;
-}
-var init_test_map = __esm({
-  "src/test-map.ts"() {
-    "use strict";
-    init_files();
-  }
-});
-
-// src/snapshot/snapshot.ts
-import path5 from "path";
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-import { z as z2 } from "zod";
-async function inspectSnapshot(rootDir) {
-  try {
-    const raw = await readStoreJson(rootDir, ".mason/snapshot.json");
-    const snapshot = raw === null ? null : snapshotSchema.parse(raw);
-    return { status: snapshot ? "available" : "missing", snapshot, diagnostics: [] };
-  } catch (error) {
-    return { status: "invalid", snapshot: null, diagnostics: [{
-      path: ".mason/snapshot.json",
-      message: error instanceof Error ? error.message : String(error)
-    }] };
   }
-}
-async function getCurrentGitHash(rootDir) {
   try {
-    const { stdout } = await exec2("git", ["rev-parse", "HEAD"], {
-      cwd: rootDir
-    });
-    return stdout.trim();
-  } catch {
-    return "unknown";
+    return await run();
+  } finally {
+    await handle.close();
+    await fs3.unlink(file);
   }
 }
-var exec2, repoPath, verificationFields, featureSchema, flowSchema, snapshotSchema;
-var init_snapshot = __esm({
-  "src/snapshot/snapshot.ts"() {
+var hostSchema, events, stateSchema;
+var init_store = __esm({
+  "src/automation/store.ts"() {
     "use strict";
-    init_files();
-    init_files();
     init_storage();
-    init_paths();
-    init_test_map();
-    exec2 = promisify2(execFile2);
-    repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
-    verificationFields = {
-      refreshedHash: z2.string().optional(),
-      verifiedAt: z2.string().optional(),
-      verifiedHash: z2.string().optional(),
-      verificationFailed: z2.boolean().optional(),
-      verificationNote: z2.string().optional()
-    };
-    featureSchema = z2.object({
-      description: z2.string(),
-      files: z2.array(repoPath),
-      tests: z2.array(repoPath).optional(),
-      type: z2.enum(["capability", "infrastructure"]).optional(),
-      ...verificationFields
-    }).passthrough();
-    flowSchema = z2.object({ description: z2.string(), chain: z2.array(repoPath), ...verificationFields }).passthrough();
-    snapshotSchema = z2.object({
-      version: z2.literal(2),
-      createdAt: z2.string(),
-      updatedAt: z2.string(),
-      gitHash: z2.string(),
-      features: z2.record(featureSchema),
-      flows: z2.record(flowSchema)
-    }).passthrough();
-  }
-});
-
-// src/drift/drift.ts
-import fs3 from "fs/promises";
-import path6 from "path";
-import { execFile as execFile3 } from "child_process";
-import { promisify as promisify3 } from "util";
-function parseChanges(output) {
-  const fields = output.split("\0");
-  const changes = [];
-  for (let i = 0; i < fields.length && fields[i]; ) {
-    const code = fields[i++];
-    const first = fields[i++];
-    if (!first) break;
-    const second = /^[RC]/.test(code) ? fields[i++] : void 0;
-    const change = second ? code.startsWith("R") ? { status: "renamed", path: second, previousPath: first } : { status: "added", path: second } : { status: code === "A" ? "added" : code === "D" ? "deleted" : "modified", path: first };
-    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/"))) continue;
-    changes.push(change);
-  }
-  return changes;
-}
-function touchedPaths(changes) {
-  return [...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))].sort();
-}
-async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
-  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
-  try {
-    const { stdout } = await exec3("git", ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
-    return parseChanges(stdout);
-  } catch {
-    return null;
-  }
-}
-async function getWorkingTree(resolvedRoot) {
-  try {
-    const [diff, untracked] = await Promise.all([
-      exec3("git", ["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
-      exec3("git", ["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
-    ]);
-    const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
-    return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
-  } catch {
-    return { available: false, changedFiles: [], untrackedFiles: [] };
-  }
-}
-var exec3;
-var init_drift = __esm({
-  "src/drift/drift.ts"() {
-    "use strict";
-    init_snapshot();
-    init_paths();
-    exec3 = promisify3(execFile3);
+    hostSchema = z.enum(["claude", "codex"]);
+    events = ["session_start", "turn_start", "before_tool", "after_tool", "task_end"];
+    stateSchema = z.object({
+      version: z.literal(1),
+      root: z.string(),
+      gitDir: z.string(),
+      branch: z.string(),
+      baselines: z.array(z.object({ path: z.string(), at: z.string(), event: z.string(), fingerprint: z.string() })).max(128),
+      sessions: z.record(z.object({
+        host: hostSchema,
+        seen: z.string().nullable(),
+        continued: z.boolean(),
+        initialIssues: z.array(z.string()),
+        initialDocs: z.record(z.string().nullable()),
+        lastUsed: z.string(),
+        mutationObserved: z.boolean(),
+        pending: z.record(z.string()),
+        coverageGaps: z.array(z.string()),
+        events: z.record(z.object({ at: z.string(), count: z.number().int().positive() }))
+      })),
+      updatedAt: z.string(),
+      fingerprint: z.string().nullable(),
+      latest: z.string().nullable(),
+      analysis: z.object({ id: z.string(), fingerprint: z.string(), completedAt: z.number(), path: z.string() }).optional()
+    });
   }
 });
 
@@ -849,8 +630,8 @@ var init_claims = __esm({
 });
 
 // src/audit/git.ts
-import { execFile as execFile4 } from "child_process";
-import { promisify as promisify4 } from "util";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
 function parseCommitLine(line) {
   const parts = line.split("	");
   if (parts.length < 3 || !parts[0]) return null;
@@ -858,7 +639,7 @@ function parseCommitLine(line) {
 }
 async function lastCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec4(
+    const { stdout } = await exec2(
       "git",
       ["log", "-1", `--format=${COMMIT_FORMAT}`, "--", relPath],
       { cwd: resolvedRoot }
@@ -871,7 +652,7 @@ async function lastCommitOf(resolvedRoot, relPath) {
 }
 async function deletingCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec4(
+    const { stdout } = await exec2(
       "git",
       [
         "log",
@@ -891,7 +672,7 @@ async function deletingCommitOf(resolvedRoot, relPath) {
 }
 async function firstCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec4(
+    const { stdout } = await exec2(
       "git",
       ["log", "--reverse", `--format=${COMMIT_FORMAT}`, "--", relPath],
       { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
@@ -905,7 +686,7 @@ async function firstCommitOf(resolvedRoot, relPath) {
 async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
   if (!fromHash || fromHash === "unknown") return null;
   try {
-    const { stdout } = await exec4(
+    const { stdout } = await exec2(
       "git",
       [
         "log",
@@ -930,23 +711,23 @@ async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
     return null;
   }
 }
-var exec4, COMMIT_FORMAT;
+var exec2, COMMIT_FORMAT;
 var init_git = __esm({
   "src/audit/git.ts"() {
     "use strict";
-    exec4 = promisify4(execFile4);
+    exec2 = promisify2(execFile2);
     COMMIT_FORMAT = "%H%x09%cI%x09%s";
   }
 });
 
 // src/audit/docs.ts
 import fs4 from "fs/promises";
-import path7 from "path";
-import { execFile as execFile5 } from "child_process";
-import { promisify as promisify5 } from "util";
+import path4 from "path";
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
 async function isDirty(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec5(
+    const { stdout } = await exec3(
       "git",
       ["status", "--porcelain", "--", relPath],
       { cwd: resolvedRoot }
@@ -960,7 +741,7 @@ async function discoverDocs(resolvedRoot) {
   const docs = await Promise.all(DOC_CANDIDATES.map(async (candidate) => {
     let content2;
     try {
-      content2 = await fs4.readFile(path7.join(resolvedRoot, candidate), "utf-8");
+      content2 = await fs4.readFile(path4.join(resolvedRoot, candidate), "utf-8");
     } catch {
       return null;
     }
@@ -976,18 +757,211 @@ async function discoverDocs(resolvedRoot) {
   }));
   return docs.filter((doc) => doc !== null);
 }
-var exec5, DOC_CANDIDATES;
+var exec3, DOC_CANDIDATES;
 var init_docs = __esm({
   "src/audit/docs.ts"() {
     "use strict";
-    init_claims();
-    init_git();
+    init_claims();
+    init_git();
+    exec3 = promisify3(execFile3);
+    DOC_CANDIDATES = [
+      "AGENTS.md",
+      "CLAUDE.md",
+      ".claude/CLAUDE.md"
+    ];
+  }
+});
+
+// src/test-map.ts
+import path5 from "path";
+async function buildTestMap(dir) {
+  const rootDir = path5.resolve(dir);
+  const access = await createFileAccess(rootDir);
+  const testPatterns = [
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/*Test.kt",
+    "**/*Test.java",
+    "**/*Tests.kt",
+    "**/*Tests.java",
+    "**/test_*.py",
+    "**/*_test.py",
+    "**/*_test.go",
+    "**/*Tests.swift",
+    "**/*Test.swift",
+    "**/*_test.rs"
+  ];
+  const testFiles = await access.list(testPatterns);
+  const sourceFiles = await access.list();
+  const sourceByBaseName = /* @__PURE__ */ new Map();
+  for (const file of sourceFiles) {
+    if (testFiles.includes(file)) continue;
+    const baseName = path5.basename(file).replace(/\.[^.]+$/, "");
+    const existing = sourceByBaseName.get(baseName) ?? [];
+    existing.push(file);
+    sourceByBaseName.set(baseName, existing);
+  }
+  const paired = [];
+  const unmatched = [];
+  for (const testFile of testFiles) {
+    const testBaseName = path5.basename(testFile).replace(/\.[^.]+$/, "");
+    const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
+    if (!sourceName) {
+      unmatched.push(testFile);
+      continue;
+    }
+    const candidates = sourceByBaseName.get(sourceName);
+    if (candidates && candidates.length > 0) {
+      const testDir = path5.dirname(testFile);
+      const bestMatch = candidates.reduce((best, candidate) => {
+        const candidateDir = path5.dirname(candidate);
+        const bestDir = path5.dirname(best);
+        const candidateOverlap = commonSegments(testDir, candidateDir);
+        const bestOverlap = commonSegments(testDir, bestDir);
+        return candidateOverlap > bestOverlap ? candidate : best;
+      });
+      paired.push({
+        test: testFile,
+        source: bestMatch,
+        confidence: candidates.length === 1 ? "exact" : "best-guess"
+      });
+    } else {
+      unmatched.push(testFile);
+    }
+  }
+  return { totalTestFiles: testFiles.length, paired, unmatched };
+}
+function commonSegments(pathA, pathB) {
+  const segsA = pathA.split("/");
+  const segsB = pathB.split("/");
+  let count3 = 0;
+  for (let i = 0; i < Math.min(segsA.length, segsB.length); i++) {
+    if (segsA[i] === segsB[i]) count3++;
+    else break;
+  }
+  return count3;
+}
+var init_test_map = __esm({
+  "src/test-map.ts"() {
+    "use strict";
+    init_files();
+  }
+});
+
+// src/snapshot/snapshot.ts
+import path6 from "path";
+import { execFile as execFile4 } from "child_process";
+import { promisify as promisify4 } from "util";
+import { z as z2 } from "zod";
+async function inspectSnapshot(rootDir) {
+  try {
+    const raw = await readStoreJson(rootDir, ".mason/snapshot.json");
+    const snapshot = raw === null ? null : snapshotSchema.parse(raw);
+    return { status: snapshot ? "available" : "missing", snapshot, diagnostics: [] };
+  } catch (error) {
+    return { status: "invalid", snapshot: null, diagnostics: [{
+      path: ".mason/snapshot.json",
+      message: error instanceof Error ? error.message : String(error)
+    }] };
+  }
+}
+async function getCurrentGitHash(rootDir) {
+  try {
+    const { stdout } = await exec4("git", ["rev-parse", "HEAD"], {
+      cwd: rootDir
+    });
+    return stdout.trim();
+  } catch {
+    return "unknown";
+  }
+}
+var exec4, repoPath, verificationFields, featureSchema, flowSchema, snapshotSchema;
+var init_snapshot = __esm({
+  "src/snapshot/snapshot.ts"() {
+    "use strict";
+    init_files();
+    init_files();
+    init_storage();
+    init_paths();
+    init_test_map();
+    exec4 = promisify4(execFile4);
+    repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
+    verificationFields = {
+      refreshedHash: z2.string().optional(),
+      verifiedAt: z2.string().optional(),
+      verifiedHash: z2.string().optional(),
+      verificationFailed: z2.boolean().optional(),
+      verificationNote: z2.string().optional()
+    };
+    featureSchema = z2.object({
+      description: z2.string(),
+      files: z2.array(repoPath),
+      tests: z2.array(repoPath).optional(),
+      type: z2.enum(["capability", "infrastructure"]).optional(),
+      ...verificationFields
+    }).passthrough();
+    flowSchema = z2.object({ description: z2.string(), chain: z2.array(repoPath), ...verificationFields }).passthrough();
+    snapshotSchema = z2.object({
+      version: z2.literal(2),
+      createdAt: z2.string(),
+      updatedAt: z2.string(),
+      gitHash: z2.string(),
+      features: z2.record(featureSchema),
+      flows: z2.record(flowSchema)
+    }).passthrough();
+  }
+});
+
+// src/drift/drift.ts
+import fs5 from "fs/promises";
+import path7 from "path";
+import { execFile as execFile5 } from "child_process";
+import { promisify as promisify5 } from "util";
+function parseChanges(output) {
+  const fields = output.split("\0");
+  const changes = [];
+  for (let i = 0; i < fields.length && fields[i]; ) {
+    const code = fields[i++];
+    const first = fields[i++];
+    if (!first) break;
+    const second = /^[RC]/.test(code) ? fields[i++] : void 0;
+    const change = second ? code.startsWith("R") ? { status: "renamed", path: second, previousPath: first } : { status: "added", path: second } : { status: code === "A" ? "added" : code === "D" ? "deleted" : "modified", path: first };
+    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/"))) continue;
+    changes.push(change);
+  }
+  return changes;
+}
+function touchedPaths(changes) {
+  return [...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))].sort();
+}
+async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
+  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
+  try {
+    const { stdout } = await exec5("git", ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
+    return parseChanges(stdout);
+  } catch {
+    return null;
+  }
+}
+async function getWorkingTree(resolvedRoot) {
+  try {
+    const [diff, untracked] = await Promise.all([
+      exec5("git", ["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
+      exec5("git", ["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
+    ]);
+    const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
+    return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
+  } catch {
+    return { available: false, changedFiles: [], untrackedFiles: [] };
+  }
+}
+var exec5;
+var init_drift = __esm({
+  "src/drift/drift.ts"() {
+    "use strict";
+    init_snapshot();
+    init_paths();
     exec5 = promisify5(execFile5);
-    DOC_CANDIDATES = [
-      "AGENTS.md",
-      "CLAUDE.md",
-      ".claude/CLAUDE.md"
-    ];
   }
 });
 
@@ -1008,11 +982,11 @@ var init_types = __esm({
 });
 
 // src/audit/checks/deleted-reference.ts
-import fs5 from "fs/promises";
+import fs6 from "fs/promises";
 import path8 from "path";
 async function exists(absPath) {
   try {
-    await fs5.access(absPath);
+    await fs6.access(absPath);
     return true;
   } catch {
     return false;
@@ -1106,14 +1080,14 @@ var init_deleted_reference = __esm({
 });
 
 // src/audit/inputs.ts
-import fs6 from "fs/promises";
+import fs7 from "fs/promises";
 import * as nativeFs from "fs";
 import path9 from "path";
 import { execFile as execFile6 } from "child_process";
 import { promisify as promisify6 } from "util";
 import fg2 from "fast-glob";
 async function auditInputPath(root, file) {
-  if (file === ".") return fs6.realpath(root);
+  if (file === ".") return fs7.realpath(root);
   try {
     return await storePath(root, file);
   } catch (error) {
@@ -1230,7 +1204,7 @@ var init_inputs = __esm({
 
 // src/audit/checks/new-module.ts
 import fg3 from "fast-glob";
-import fs7 from "fs/promises";
+import fs8 from "fs/promises";
 import path10 from "path";
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -1273,7 +1247,7 @@ async function moduleCandidates(root, combinedDocs) {
   const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
   const sources = sourcePaths.filter((file) => !file.split("/").some((part) => part.startsWith(".")));
   const listSubdirs = async (dir) => {
-    const entries = await fs7.readdir(await auditInputPath(root, dir), { withFileTypes: true });
+    const entries = await fs8.readdir(await auditInputPath(root, dir), { withFileTypes: true });
     const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path10.posix.join(dir, entry.name));
     const ignored = await gitIgnoredPaths(root, dirs);
     const visible = new Set(dirs.filter((dir2) => !ignored.has(dir2) || sources.some((file) => file.startsWith(dir2 + "/"))));
@@ -1900,15 +1874,16 @@ var init_provenance = __esm({
 });
 
 // src/decisions/decisions.ts
-import fs8 from "fs/promises";
+import fs9 from "fs/promises";
 import path13 from "path";
 import { createHash } from "crypto";
+import { z as z4 } from "zod";
 async function loadDecisionStore(rootDir) {
   const records = [];
   const diagnostics = [];
   let entries;
   try {
-    entries = await fs8.readdir(await storePath(rootDir, ".mason/decisions"));
+    entries = await fs9.readdir(await storePath(rootDir, ".mason/decisions"));
   } catch (error) {
     if (error.code !== "ENOENT") diagnostics.push({ path: ".mason/decisions", message: String(error) });
     return { records, diagnostics };
@@ -1926,6 +1901,7 @@ async function loadDecisionStore(rootDir) {
   }
   return { records, diagnostics };
 }
+var TITLE_MAX_CHARS, BODY_RECOMMENDED_CHARS, BODY_MAX_CHARS, boundedText, decisionTitleSchema, decisionBodySchema;
 var init_decisions = __esm({
   "src/decisions/decisions.ts"() {
     "use strict";
@@ -1934,6 +1910,18 @@ var init_decisions = __esm({
     init_snapshot();
     init_lexical();
     init_provenance();
+    TITLE_MAX_CHARS = 80;
+    BODY_RECOMMENDED_CHARS = 1500;
+    BODY_MAX_CHARS = 2500;
+    boundedText = (field, max, hint) => z4.string({
+      errorMap: (issue, ctx) => ({ message: issue.code === "too_big" ? `${field} has ${ctx.data.length} characters; maximum is ${max} (${ctx.data.length - max} over). ${hint}` : ctx.defaultError })
+    }).trim().min(1, `${field} must be non-empty`).max(max);
+    decisionTitleSchema = boundedText("title", TITLE_MAX_CHARS, "Tighten it to a specific headline.");
+    decisionBodySchema = boundedText(
+      "body",
+      BODY_MAX_CHARS,
+      `Aim for ${BODY_RECOMMENDED_CHARS} characters or fewer. Preserve the rule, reason, and exceptions; put supporting references in sources.`
+    );
   }
 });
 
@@ -2057,7 +2045,7 @@ var init_checks = __esm({
 });
 
 // src/audit/audit.ts
-import fs9 from "fs/promises";
+import fs10 from "fs/promises";
 import path15 from "path";
 async function computeAudit(rootDir, options = {}) {
   const resolvedRoot = path15.resolve(rootDir);
@@ -2092,7 +2080,7 @@ async function computeAudit(rootDir, options = {}) {
   }
   let decisionsPresent = false;
   try {
-    await fs9.access(path15.join(resolvedRoot, ".mason", "decisions"));
+    await fs10.access(path15.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -2129,10 +2117,10 @@ var init_audit = __esm({
 });
 
 // src/audit/repair.ts
-import fs10 from "fs/promises";
+import fs11 from "fs/promises";
 import path16 from "path";
-import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
-import { z as z4 } from "zod";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { z as z5 } from "zod";
 function findingId(finding) {
   const e = finding.evidence;
   let key;
@@ -2185,8 +2173,8 @@ async function stableAudit(root, checks, options = {}) {
   return report;
 }
 async function prepareRepair(rootDir, checks = ALL_CHECKS, options = {}) {
-  const root = await fs10.realpath(rootDir);
-  const selected = z4.array(checkSchema).nonempty().parse(checks);
+  const root = await fs11.realpath(rootDir);
+  const selected = z5.array(checkSchema).nonempty().parse(checks);
   const report = await stableAudit(root, selected, options);
   if (!report) throw new Error("No context files found to prepare a repair.");
   if (!report.gitAvailable) throw new Error("Readable Git history is required to prepare a repair.");
@@ -2197,12 +2185,12 @@ async function prepareRepair(rootDir, checks = ALL_CHECKS, options = {}) {
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     report: storedReport
   };
-  const baselinePath = ".mason/reports/repairs/" + randomUUID3() + ".json";
+  const baselinePath = ".mason/reports/repairs/" + randomUUID2() + ".json";
   await writeStoreJson(root, baselinePath, { ...payload, digest: digest(payload) });
   return { version: 1, action: "prepare", baselinePath, report };
 }
 async function verifyRepair(rootDir, baselinePath, options = {}) {
-  const root = await fs10.realpath(rootDir);
+  const root = await fs11.realpath(rootDir);
   const declaredRoot = path16.resolve(rootDir);
   const relative = path16.isAbsolute(baselinePath) ? path16.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
@@ -2277,7 +2265,7 @@ async function verifyRepair(rootDir, baselinePath, options = {}) {
     scope: "Original audit checks over current context files and repository evidence. Resolved means no longer detected by that check. Advisories require separate review; this is not a certification of documentation or application correctness."
   };
 }
-var checkSchema, commitSchema, anchorSchema, count, evidenceSchema, findingSchema, issueSchema, advisorySchema, checkResultSchema, reportSchema, baselineSchema, digest;
+var checkSchema, commitSchema, anchorSchema, count, evidenceSchema, findingSchema, issueSchema, advisorySchema, checkResultSchema, reportSchema, baselineSchema, digest, repairFindingSchema;
 var init_repair = __esm({
   "src/audit/repair.ts"() {
     "use strict";
@@ -2289,95 +2277,102 @@ var init_repair = __esm({
     init_files();
     init_paths();
     init_types();
-    checkSchema = z4.enum(["deleted-reference", "new-module", "stale-count", "dead-command", "deps-changed", "decision-anchor-drift"]);
-    commitSchema = z4.object({ hash: z4.string().regex(/^[a-f0-9]{40,64}$/), date: z4.string(), subject: z4.string() });
-    anchorSchema = z4.object({ doc: z4.string(), line: z4.number().int().positive().nullable(), excerpt: z4.string().nullable() });
-    count = z4.number().int().nonnegative();
-    evidenceSchema = z4.discriminatedUnion("kind", [
-      z4.object({
-        kind: z4.literal("missing-path"),
-        claimed: z4.string(),
-        renamedTo: z4.string().nullable(),
+    checkSchema = z5.enum(["deleted-reference", "new-module", "stale-count", "dead-command", "deps-changed", "decision-anchor-drift"]);
+    commitSchema = z5.object({ hash: z5.string().regex(/^[a-f0-9]{40,64}$/), date: z5.string(), subject: z5.string() });
+    anchorSchema = z5.object({ doc: z5.string(), line: z5.number().int().positive().nullable(), excerpt: z5.string().nullable() });
+    count = z5.number().int().nonnegative();
+    evidenceSchema = z5.discriminatedUnion("kind", [
+      z5.object({
+        kind: z5.literal("missing-path"),
+        claimed: z5.string(),
+        renamedTo: z5.string().nullable(),
         deletedInCommit: commitSchema.nullable(),
-        everTracked: z4.boolean(),
-        parentDirExists: z4.boolean()
+        everTracked: z5.boolean(),
+        parentDirExists: z5.boolean()
       }),
-      z4.object({
-        kind: z4.literal("unmentioned-dir"),
-        dir: z4.string(),
+      z5.object({
+        kind: z5.literal("unmentioned-dir"),
+        dir: z5.string(),
         sourceFileCount: count,
         firstCommit: commitSchema.nullable(),
-        checkedDocs: z4.array(z4.string())
+        checkedDocs: z5.array(z5.string())
       }),
-      z4.object({
-        kind: z4.literal("count-mismatch"),
+      z5.object({
+        kind: z5.literal("count-mismatch"),
         claimed: count,
         actual: count,
-        unit: z4.string(),
-        countedFrom: z4.string(),
-        members: z4.array(z4.string())
+        unit: z5.string(),
+        countedFrom: z5.string(),
+        members: z5.array(z5.string())
       }),
-      z4.object({
-        kind: z4.literal("missing-script"),
-        scriptName: z4.string(),
-        invocation: z4.string(),
-        manifestsChecked: z4.array(z4.string()),
-        availableScripts: z4.array(z4.string())
+      z5.object({
+        kind: z5.literal("missing-script"),
+        scriptName: z5.string(),
+        invocation: z5.string(),
+        manifestsChecked: z5.array(z5.string()),
+        availableScripts: z5.array(z5.string())
       }),
-      z4.object({
-        kind: z4.literal("doc-behind-manifests"),
+      z5.object({
+        kind: z5.literal("doc-behind-manifests"),
         docLastCommit: commitSchema,
-        manifestCommits: z4.array(commitSchema.extend({ files: z4.array(z4.string()) })),
+        manifestCommits: z5.array(commitSchema.extend({ files: z5.array(z5.string()) })),
         totalCommits: count
       }),
-      z4.object({
-        kind: z4.literal("decision-anchor"),
-        decisionId: z4.string(),
-        title: z4.string(),
-        changedFiles: z4.array(z4.string()),
-        refreshedHash: z4.string(),
-        provenance: z4.object({}).passthrough().optional()
+      z5.object({
+        kind: z5.literal("decision-anchor"),
+        decisionId: z5.string(),
+        title: z5.string(),
+        changedFiles: z5.array(z5.string()),
+        refreshedHash: z5.string(),
+        provenance: z5.object({}).passthrough().optional()
       })
     ]);
-    findingSchema = z4.object({ message: z4.string(), anchor: anchorSchema, evidence: evidenceSchema });
+    findingSchema = z5.object({ message: z5.string(), anchor: anchorSchema, evidence: evidenceSchema });
     issueSchema = findingSchema.extend({
-      type: z4.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
-      confidence: z4.enum(["certain", "likely"])
+      type: z5.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
+      confidence: z5.enum(["certain", "likely"])
     });
-    advisorySchema = findingSchema.extend({ type: z4.enum(["deps-changed", "decision-anchor-drift"]) });
-    checkResultSchema = z4.object({
-      issues: z4.array(issueSchema),
-      advisories: z4.array(advisorySchema),
-      suppressedAdvisories: z4.array(advisorySchema).optional(),
-      skipped: z4.array(z4.object({ check: z4.string(), reason: z4.string(), doc: z4.string().optional() }))
+    advisorySchema = findingSchema.extend({ type: z5.enum(["deps-changed", "decision-anchor-drift"]) });
+    checkResultSchema = z5.object({
+      issues: z5.array(issueSchema),
+      advisories: z5.array(advisorySchema),
+      suppressedAdvisories: z5.array(advisorySchema).optional(),
+      skipped: z5.array(z5.object({ check: z5.string(), reason: z5.string(), doc: z5.string().optional() }))
     });
-    reportSchema = z4.object({
-      version: z4.literal(1),
-      root: z4.string(),
-      gitAvailable: z4.literal(true),
+    reportSchema = z5.object({
+      version: z5.literal(1),
+      root: z5.string(),
+      gitAvailable: z5.literal(true),
       headHash: commitSchema.shape.hash,
-      checksRun: z4.array(checkSchema).nonempty(),
-      docs: z4.array(z4.object({
-        path: z4.enum(DOC_CANDIDATES),
+      checksRun: z5.array(checkSchema).nonempty(),
+      docs: z5.array(z5.object({
+        path: z5.enum(DOC_CANDIDATES),
         lastCommit: commitSchema.nullable(),
-        dirty: z4.boolean(),
+        dirty: z5.boolean(),
         lineCount: count
       })).nonempty(),
-      decisionsChecked: z4.boolean(),
-      clean: z4.boolean(),
-      issues: z4.array(issueSchema),
-      advisories: z4.array(advisorySchema),
-      suppressedAdvisories: z4.array(advisorySchema).optional(),
-      skippedChecks: z4.array(z4.object({ check: z4.string(), reason: z4.string(), doc: z4.string().optional() }))
+      decisionsChecked: z5.boolean(),
+      clean: z5.boolean(),
+      issues: z5.array(issueSchema),
+      advisories: z5.array(advisorySchema),
+      suppressedAdvisories: z5.array(advisorySchema).optional(),
+      skippedChecks: z5.array(z5.object({ check: z5.string(), reason: z5.string(), doc: z5.string().optional() }))
     });
-    baselineSchema = z4.object({
-      kind: z4.literal("mason-audit-repair"),
-      version: z4.literal(1),
-      createdAt: z4.string().datetime(),
+    baselineSchema = z5.object({
+      kind: z5.literal("mason-audit-repair"),
+      version: z5.literal(1),
+      createdAt: z5.string().datetime(),
       report: reportSchema,
-      digest: z4.string().regex(/^[a-f0-9]{64}$/)
+      digest: z5.string().regex(/^[a-f0-9]{64}$/)
     });
     digest = (value) => createHash2("sha256").update(JSON.stringify(value)).digest("hex");
+    repairFindingSchema = z5.object({
+      id: z5.string(),
+      original: z5.union([issueSchema, advisorySchema]),
+      status: z5.enum(["resolved", "unresolved", "review-required", "unverified"]),
+      reason: z5.string(),
+      current: z5.union([issueSchema, advisorySchema]).optional()
+    });
   }
 });
 
@@ -2390,19 +2385,19 @@ __export(evidence_exports, {
   readInputs: () => readInputs,
   workspace: () => workspace
 });
-import fs11 from "fs/promises";
+import fs12 from "fs/promises";
 import path17 from "path";
 import { createHash as createHash3 } from "crypto";
 import { execFile as execFile8 } from "child_process";
 import { promisify as promisify8 } from "util";
 import fg4 from "fast-glob";
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 async function git2(root, ...args) {
   return (await exec7("git", args, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout;
 }
 async function workspace(dir) {
-  const root = await fs11.realpath((await git2(dir, "rev-parse", "--show-toplevel")).trim());
-  const gitDir = await fs11.realpath((await git2(root, "rev-parse", "--absolute-git-dir")).trim());
+  const root = await fs12.realpath((await git2(dir, "rev-parse", "--show-toplevel")).trim());
+  const gitDir = await fs12.realpath((await git2(root, "rev-parse", "--absolute-git-dir")).trim());
   let branch;
   try {
     branch = (await git2(root, "symbolic-ref", "--quiet", "HEAD")).trim();
@@ -2421,7 +2416,7 @@ async function readInputs(root) {
   const head = headText.trim();
   let shallow = null;
   try {
-    shallow = await fs11.readFile(path17.resolve(root, shallowPath.trim()), "utf8");
+    shallow = await fs12.readFile(path17.resolve(root, shallowPath.trim()), "utf8");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
@@ -2434,7 +2429,7 @@ async function readInputs(root) {
     docContents.push([file, text2]);
     for (const claim of text2 ? extractClaims(text2).paths : []) {
       if (internal(claim.path) || claim.path.startsWith(".mason/")) continue;
-      const exists2 = async (p) => fs11.access(path17.resolve(root, p)).then(() => true, () => false);
+      const exists2 = async (p) => fs12.access(path17.resolve(root, p)).then(() => true, () => false);
       claims.push([claim.path, await exists2(claim.path), await exists2(path17.dirname(claim.path))]);
     }
   }
@@ -2452,7 +2447,7 @@ async function readInputs(root) {
   }
   const needsWorkspaceScripts = rootScripts !== null && commandClaims.some((claim) => !rootScripts.includes(claim.scriptName));
   const decisionDirectory = await storePath(root, ".mason/decisions");
-  const decisionPresence = await fs11.lstat(decisionDirectory).then((stat) => stat.isDirectory() ? "directory" : "file", (error) => {
+  const decisionPresence = await fs12.lstat(decisionDirectory).then((stat) => stat.isDirectory() ? "directory" : "file", (error) => {
     if (error.code === "ENOENT") return "absent";
     throw error;
   });
@@ -2521,113 +2516,219 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     exec7 = promisify8(execFile8);
-    engineVersion = true ? "0.16.1" : "development";
+    engineVersion = true ? "0.16.3" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
     internal = (file) => file === ".mason" || file === ".mason/reports" || file.startsWith(".mason/reports/");
-    cacheSchema = z5.object({ version: z5.literal(1), entries: z5.record(z5.object({ key: z5.string(), result: checkResultSchema })), digest: z5.string() });
+    cacheSchema = z6.object({ version: z6.literal(1), entries: z6.record(z6.object({ key: z6.string(), result: checkResultSchema })), digest: z6.string() });
   }
 });
 
-// src/automation/store.ts
-import fs12 from "fs/promises";
+// src/automation/execution.ts
 import os2 from "os";
-import { z as z6 } from "zod";
-function parseState(raw) {
+import fs13 from "fs/promises";
+import { randomUUID as randomUUID3 } from "crypto";
+import { z as z7 } from "zod";
+function parseExecution(raw) {
   try {
-    return stateSchema.parse(raw);
+    return executionSchema.parse(raw);
   } catch (error) {
-    throw new Error("Invalid automation state; original evidence was retained.", { cause: error });
+    throw new Error("Invalid automation execution store; receipt history was retained.", { cause: error });
   }
 }
-async function withLock(root, directory, run) {
-  const file = await storePath(root, directory + "/lock", true);
-  const deadline = Date.now() + 5e3;
-  let handle;
-  while (!handle) {
+function automationFailure(error) {
+  const recorded = failureSchema.safeParse(error?.failure);
+  if (recorded.success) return recorded.data;
+  const message2 = (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 700);
+  const codes = /* @__PURE__ */ new Set();
+  let cause = error;
+  for (let i = 0; cause && i < 8; i++) {
+    codes.add(String(cause.code));
+    cause = cause.cause;
+  }
+  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message2) ? "inputs-changed" : /Automation is busy/.test(message2) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message2) ? "history-unavailable" : error instanceof z7.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message2) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message2) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
+  return { code, message: message2, retryable: ["inputs-changed", "storage-full", "busy", "io-error"].includes(code), receiptRecorded: false };
+}
+function failureMessage(error) {
+  const failure = automationFailure(error);
+  return `Mason automation unavailable [${failure.code}]; evidence capture/verification was not established. ${failure.message}` + (failure.receiptRecorded ? "" : " No durable failure receipt was recorded.");
+}
+async function failureNotifications(root, directory) {
+  const raw = await readStoreJson(root, directory + "/notifications.json");
+  return raw === null ? { version: 1, sessions: {} } : notificationsSchema.parse(raw);
+}
+async function hookFailureMessage(dir, host, sessionId, error) {
+  const failure = automationFailure(error);
+  if (!failure.receiptRecorded) return failureMessage(error);
+  try {
+    const ws = await workspace(dir);
+    return await withLock(ws.root, ws.directory + "/notifications", async () => {
+      const notices = await failureNotifications(ws.root, ws.directory);
+      const key = hash([host, sessionId]), signature = hash([failure.code, failure.message]);
+      const previous = notices.sessions[key];
+      const execution = await executionStatus(ws.root, ws.directory);
+      const recovered = previous && execution.attempts.some((a) => a.status === "completed" && a.startedAt > previous.lastAt);
+      const repeat = previous?.signature === signature && !recovered;
+      notices.sessions[key] = {
+        signature,
+        code: failure.code,
+        message: failure.message,
+        count: repeat ? previous.count + 1 : 1,
+        lastAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      notices.sessions = Object.fromEntries(Object.entries(notices.sessions).sort(([, a], [, b]) => b.lastAt.localeCompare(a.lastAt)).slice(0, 32));
+      await writeStoreJson(ws.root, ws.directory + "/notifications.json", notices);
+      return repeat ? null : failureMessage(error) + " Repeated failures in this session are recorded in mason status --json.";
+    });
+  } catch {
+    return failureMessage(error);
+  }
+}
+async function refreshRunning(root, directory, attempts) {
+  for (const attempt of attempts) {
+    if (attempt.status !== "running") continue;
+    let alive = false;
     try {
-      handle = await fs12.open(file, "wx", 384);
-      try {
-        await handle.writeFile(JSON.stringify({ pid: process.pid, host: os2.hostname() }));
-      } catch (error) {
-        await handle.close().catch(() => {
-        });
-        handle = void 0;
-        await fs12.rm(file, { force: true }).catch(() => {
-        });
-        throw error;
+      const owner = await readStoreJson(root, attempt.lease ? leasePath(directory, attempt.id) : directory + "/lock");
+      if (attempt.host === os2.hostname() && owner?.pid === attempt.pid && owner.host === attempt.host) {
+        try {
+          process.kill(attempt.pid, 0);
+          alive = true;
+        } catch (error) {
+          alive = error.code === "EPERM";
+        }
       }
+    } catch {
+    }
+    if (!alive) attempt.status = "unknown";
+  }
+}
+async function editExecution(root, directory, edit) {
+  return withLock(root, directory + "/execution-lock", async () => {
+    const file = directory + "/execution.json";
+    const raw = await readStoreJson(root, file);
+    const log = raw === null ? { version: 1, attempts: [], discardedAttempts: 0 } : parseExecution(raw);
+    await refreshRunning(root, directory, log.attempts);
+    edit(log);
+    const finished = log.attempts.filter((a) => a.status !== "running");
+    const discard = new Set(finished.slice(0, Math.max(0, finished.length - 32)).map((a) => a.id));
+    log.discardedAttempts += discard.size;
+    log.attempts = log.attempts.filter((a) => !discard.has(a.id));
+    await writeStoreJson(root, file, log);
+  });
+}
+async function recordExecution(root, directory, event, run) {
+  const started = performance.now();
+  const attempt = {
+    id: randomUUID3(),
+    event,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    pid: process.pid,
+    host: os2.hostname(),
+    status: "running",
+    lease: true
+  };
+  const owner = leasePath(directory, attempt.id);
+  const finish = async (changes) => editExecution(root, directory, (log) => {
+    const current = log.attempts.find((a) => a.id === attempt.id);
+    if (!current) throw new Error("Automation execution receipt disappeared; completion could not be recorded.");
+    Object.assign(current, changes, { finishedAt: (/* @__PURE__ */ new Date()).toISOString(), durationMs: performance.now() - started });
+  });
+  await writeStoreJson(root, owner, { pid: attempt.pid, host: attempt.host });
+  try {
+    await editExecution(root, directory, (log) => {
+      if (log.attempts.filter((a) => a.status === "running").length >= 128) throw new Error("Too many active automation executions; existing receipts were retained.");
+      log.attempts.push(attempt);
+    });
+    try {
+      const result = await run();
+      await finish({ status: "completed", verificationStatus: result.report.status, reportPath: result.report.reportPath });
+      return result;
     } catch (error) {
-      if (error.code !== "EEXIST") throw error;
+      const failure = automationFailure(error);
       try {
-        const owner = JSON.parse(await fs12.readFile(file, "utf8"));
-        if (owner.host === os2.hostname() && Number.isInteger(owner.pid) && owner.pid > 0) {
-          try {
-            process.kill(owner.pid, 0);
-          } catch (probe) {
-            if (probe.code === "ESRCH") {
-              const reclaim = file + ".reclaim";
-              let guard;
-              try {
-                guard = await fs12.open(reclaim, "wx", 384);
-                const current = JSON.parse(await fs12.readFile(file, "utf8"));
-                if (current.pid === owner.pid && current.host === owner.host) await fs12.unlink(file);
-              } finally {
-                if (guard) {
-                  await guard.close();
-                  await fs12.rm(reclaim, { force: true });
-                }
-              }
-            }
-          }
-        }
+        await finish({ status: "failed", failure: { ...failure, receiptRecorded: true } });
+        failure.receiptRecorded = true;
       } catch {
       }
-      if (Date.now() >= deadline) throw new Error("Automation is busy or its lock needs inspection: " + file);
-      await new Promise((resolve) => setTimeout(resolve, 40));
+      throw Object.assign(new Error(failure.message, { cause: error }), { failure });
     }
-  }
-  try {
-    return await run();
   } finally {
-    await handle.close();
-    await fs12.unlink(file);
+    await fs13.rm(await storePath(root, owner), { force: true }).catch(() => {
+    });
   }
 }
-var hostSchema, events, stateSchema;
-var init_store = __esm({
-  "src/automation/store.ts"() {
+async function executionStatus(root, directory) {
+  const raw = await readStoreJson(root, directory + "/execution.json");
+  if (raw === null) return { status: "not-observed", attempts: [] };
+  const log = parseExecution(raw);
+  await refreshRunning(root, directory, log.attempts);
+  const completed = [...log.attempts].reverse().find((a) => a.status === "completed");
+  const outstanding = [...log.attempts].reverse().find((a) => ["failed", "unknown"].includes(a.status) && (!completed || (a.finishedAt ?? a.startedAt) >= completed.startedAt));
+  const status = log.attempts.some((a) => a.status === "running") ? "running" : outstanding?.status ?? log.attempts.at(-1)?.status ?? "not-observed";
+  return { status, attempts: log.attempts, discardedAttempts: log.discardedAttempts };
+}
+var failureSchema, attemptSchema, executionSchema, notificationsSchema, leasePath;
+var init_execution = __esm({
+  "src/automation/execution.ts"() {
     "use strict";
+    init_store();
+    init_evidence();
     init_storage();
-    hostSchema = z6.enum(["claude", "codex"]);
-    events = ["session_start", "turn_start", "before_tool", "after_tool", "task_end"];
-    stateSchema = z6.object({
-      version: z6.literal(1),
-      root: z6.string(),
-      gitDir: z6.string(),
-      branch: z6.string(),
-      baselines: z6.array(z6.object({ path: z6.string(), at: z6.string(), event: z6.string(), fingerprint: z6.string() })).max(128),
-      sessions: z6.record(z6.object({
-        host: hostSchema,
-        seen: z6.string().nullable(),
-        continued: z6.boolean(),
-        initialIssues: z6.array(z6.string()),
-        initialDocs: z6.record(z6.string().nullable()),
-        lastUsed: z6.string(),
-        mutationObserved: z6.boolean(),
-        pending: z6.record(z6.string()),
-        coverageGaps: z6.array(z6.string()),
-        events: z6.record(z6.object({ at: z6.string(), count: z6.number().int().positive() }))
-      })),
-      updatedAt: z6.string(),
-      fingerprint: z6.string().nullable(),
-      latest: z6.string().nullable()
+    failureSchema = z7.object({
+      code: z7.enum(["inputs-changed", "storage-full", "busy", "invalid-input", "history-unavailable", "invalid-evidence", "io-error", "internal"]),
+      message: z7.string(),
+      retryable: z7.boolean(),
+      receiptRecorded: z7.boolean()
     });
+    attemptSchema = z7.object({
+      id: z7.string().regex(/^[a-zA-Z0-9_-]+$/),
+      lease: z7.literal(true).optional(),
+      event: z7.string(),
+      startedAt: z7.string(),
+      finishedAt: z7.string().optional(),
+      durationMs: z7.number().nonnegative().optional(),
+      pid: z7.number().int().positive(),
+      host: z7.string(),
+      status: z7.enum(["running", "completed", "failed", "unknown"]),
+      verificationStatus: z7.string().optional(),
+      reportPath: z7.string().optional(),
+      failure: failureSchema.optional()
+    });
+    executionSchema = z7.object({ version: z7.literal(1), attempts: z7.array(attemptSchema).max(160), discardedAttempts: z7.number().int().nonnegative().default(0) });
+    notificationsSchema = z7.object({ version: z7.literal(1), sessions: z7.record(z7.object({
+      signature: z7.string(),
+      code: failureSchema.shape.code,
+      message: z7.string(),
+      count: z7.number().int().positive(),
+      lastAt: z7.string()
+    })) });
+    leasePath = (directory, id) => `${directory}/executions/${id}.json`;
   }
 });
 
 // src/automation/runtime.ts
 import { randomUUID as randomUUID4 } from "crypto";
+import { z as z8 } from "zod";
+async function observeReadOnlyTool(dir, event) {
+  const ws = await workspace(dir);
+  await withLock(ws.root, ws.directory, async () => {
+    const statePath = ws.directory + "/state.json";
+    const raw = await readStoreJson(ws.root, statePath);
+    if (raw === null) return;
+    const state = parseState(raw);
+    if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) {
+      throw new Error("Automation state belongs to another branch or worktree; original evidence was retained.");
+    }
+    const session = event.host && event.sessionId ? state.sessions[hash([event.host, event.sessionId])] : null;
+    if (!session) return;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    session.lastUsed = now;
+    session.events[event.event] = { at: now, count: (session.events[event.event]?.count ?? 0) + 1 };
+    await writeStoreJson(ws.root, statePath, state);
+  });
+  return { root: ws.root, directory: ws.directory };
+}
 function summarize(report) {
   const open = report.findings.filter((f) => f.status !== "resolved");
   return [
@@ -2639,176 +2740,234 @@ function summarize(report) {
     "Keep original evidence. Address findings relevant to the authorized task; report unrelated findings and unresolved advisories without approving them."
   ].join("\n");
 }
+async function loadState(ws) {
+  const raw = await readStoreJson(ws.root, ws.directory + "/state.json");
+  const state = raw === null ? {
+    version: 1,
+    root: ws.root,
+    gitDir: ws.gitDir,
+    branch: ws.branch,
+    baselines: [],
+    sessions: {},
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    fingerprint: null,
+    latest: null
+  } : parseState(raw);
+  if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) {
+    throw new Error("Automation state belongs to another branch or worktree; original evidence was retained.");
+  }
+  return state;
+}
+async function sharedAnalysis(ws, state, inputs, startedAt) {
+  const pointer = state.analysis;
+  if (!pointer || pointer.fingerprint !== inputs.fingerprint || pointer.completedAt < startedAt) return null;
+  const stored = sharedSchema.parse(await readStoreJson(ws.root, pointer.path));
+  const a = stored.analysis;
+  if (stored.digest !== hash(a) || a.id !== pointer.id || a.fingerprint !== inputs.fingerprint || a.completedAt !== pointer.completedAt || a.report.root !== ws.root || a.report.branch !== ws.branch || a.report.head !== inputs.head || hash(a.report.baselinePaths) !== hash(state.baselines.map((b) => b.path))) {
+    throw new Error("Invalid shared automation evidence; run a new check.");
+  }
+  if (a.baselineDigest !== await baselineDigest(ws, state)) throw new Error("Repair baseline was modified; use the original baseline.");
+  return a;
+}
+async function verifyInputs(ws, inputs) {
+  const [after, currentWs] = await Promise.all([readInputs(ws.root), workspace(ws.root)]);
+  if (after.fingerprint !== inputs.fingerprint || currentWs.directory !== ws.directory) {
+    throw new Error("Repository inputs or branch changed during automation; no current verification was recorded. Retry on a stable checkout.");
+  }
+}
+async function computeAnalysis(ws, state, inputs, event) {
+  const baselines = [...state.baselines];
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const empty = {
+    version: 1,
+    status: "unavailable",
+    root: ws.root,
+    branch: ws.branch,
+    head: inputs.head,
+    baselinePaths: [],
+    reportPath: "",
+    findings: [],
+    diagnostics: ["No AGENTS.md, CLAUDE.md, or .claude/CLAUDE.md exists. Documentation capture is unavailable; other Mason tools remain usable."],
+    checks: { ran: [], reused: [], skipped: [] },
+    counts: { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 },
+    capture: "unknown",
+    scope: SCOPE
+  };
+  if (!baselines.length && Object.values(inputs.docs).every((value) => value === null)) return { baselines, report: empty, cache: null };
+  if (ws.branch === "detached" && state.latest) {
+    const previous = await readStoreJson(ws.root, state.latest);
+    if (!previous?.head || !/^[a-f0-9]{40,64}$/.test(previous.head)) throw new Error("The previous detached checkout evidence is unavailable.");
+    try {
+      await git2(ws.root, "merge-base", "--is-ancestor", previous.head, inputs.head);
+    } catch {
+      throw new Error("Detached checkout moved to a different history; original repair evidence was retained. Inspect that baseline explicitly.");
+    }
+  }
+  let cached = null;
+  const diagnostics = [];
+  try {
+    cached = await readStoreJson(ws.root, ws.directory + "/cache.json");
+  } catch {
+    diagnostics.push("Unreadable automation cache; checks are being recomputed.");
+  }
+  const cache = checkCache(cached, inputs);
+  if (cache.diagnostic) diagnostics.push(cache.diagnostic);
+  const saveBaseline = async () => {
+    if (baselines.length >= 128) throw new Error("128 retained baselines need review; automatic capture stopped without discarding original evidence.");
+    const prepared = await prepareRepair(ws.root, ALL_CHECKS, cache.options);
+    baselines.push({ path: prepared.baselinePath, at: now, event: event.event, fingerprint: inputs.fingerprint });
+  };
+  if (!baselines.length) await saveBaseline();
+  const verifications = [];
+  for (const baseline of baselines) verifications.push(await verifyRepair(ws.root, baseline.path, cache.options));
+  const known = new Set(verifications.flatMap((v) => v.findings.map((f) => f.id)));
+  if (verifications.some((v) => v.newFindings.some((f) => !known.has(findingId(f))))) {
+    await saveBaseline();
+    verifications.push(await verifyRepair(ws.root, baselines.at(-1).path, cache.options));
+  }
+  const merged = /* @__PURE__ */ new Map();
+  for (const verification of verifications) {
+    for (const finding of verification.findings) {
+      const previous = merged.get(finding.id);
+      if (!previous || priority[finding.status] > priority[previous.status]) merged.set(finding.id, finding);
+    }
+    diagnostics.push(...verification.diagnostics);
+  }
+  const counts = { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 };
+  for (const finding of merged.values()) counts[finding.status]++;
+  const report = {
+    version: 1,
+    status: diagnostics.length || verifications.some((v) => v.status === "incomplete") ? "incomplete" : counts.unresolved ? "issues-remain" : "verified",
+    root: ws.root,
+    branch: ws.branch,
+    head: inputs.head,
+    baselinePaths: baselines.map((b) => b.path),
+    reportPath: "",
+    findings: [...merged.values()],
+    diagnostics: [...new Set(diagnostics)],
+    checks: { ran: [...cache.ran], reused: [...cache.reused].filter((name) => !cache.ran.has(name)), skipped: verifications.at(-1).currentAudit?.skippedChecks ?? [] },
+    counts,
+    capture: "unknown",
+    scope: SCOPE
+  };
+  return { baselines, report, cache: cache.ran.size || cached === null || cache.diagnostic ? cache.serialize() : null };
+}
+async function analyze(ws, inputs, event, startedAt) {
+  return withLock(ws.root, ws.directory + "/analysis/" + inputs.fingerprint, async () => {
+    const before = await loadState(ws);
+    const shared = await sharedAnalysis(ws, before, inputs, startedAt);
+    if (shared) return { analysis: shared, shared: true };
+    const originalDigest = await baselineDigest(ws, before);
+    const computed = await computeAnalysis(ws, before, inputs, event);
+    await verifyInputs(ws, inputs);
+    if (originalDigest !== await baselineDigest(ws, before)) throw new Error("Repair baseline was modified during automation; original evidence must be inspected.");
+    const id = randomUUID4();
+    const analysis = analysisSchema.parse({
+      id,
+      fingerprint: inputs.fingerprint,
+      completedAt: Date.now(),
+      baselineDigest: await baselineDigest(ws, { ...before, baselines: computed.baselines }),
+      report: computed.report
+    });
+    const analysisPath = ws.directory + "/checks/analysis-" + inputs.fingerprint + ".json";
+    await withLock(ws.root, ws.directory, async () => {
+      const state = await loadState(ws);
+      if (hash(state.baselines) !== hash(before.baselines) || state.analysis?.id !== before.analysis?.id) {
+        throw new Error("Automation evidence changed during analysis; retry against the retained baselines.");
+      }
+      await writeStoreJson(ws.root, analysisPath, { analysis, digest: hash(analysis) });
+      if (computed.cache) await writeStoreJson(ws.root, ws.directory + "/cache.json", computed.cache);
+      state.baselines = computed.baselines;
+      state.analysis = { id, fingerprint: inputs.fingerprint, completedAt: analysis.completedAt, path: analysisPath };
+      await writeStoreJson(ws.root, ws.directory + "/state.json", state);
+    });
+    return { analysis, shared: false };
+  }, Math.max(0, 25e3 - (Date.now() - startedAt)));
+}
 async function automate(dir, event) {
+  const startedAt = Date.now();
   const ws = await workspace(dir);
-  return withLock(ws.root, ws.directory, () => recordExecution(ws.root, ws.directory, event.event, async () => {
+  return recordExecution(ws.root, ws.directory, event.event, async () => {
     const inputs = await readInputs(ws.root);
-    const statePath = ws.directory + "/state.json";
-    const raw = await readStoreJson(ws.root, statePath);
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const state = raw === null ? {
-      version: 1,
-      root: ws.root,
-      gitDir: ws.gitDir,
-      branch: ws.branch,
-      baselines: [],
-      sessions: {},
-      updatedAt: now,
-      fingerprint: null,
-      latest: null
-    } : parseState(raw);
-    if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) {
-      throw new Error("Automation state belongs to another branch or worktree; original evidence was retained.");
-    }
-    if (ws.branch === "detached" && state.latest) {
-      const previous = await readStoreJson(ws.root, state.latest);
-      if (!previous?.head || !/^[a-f0-9]{40,64}$/.test(previous.head)) throw new Error("The previous detached checkout evidence is unavailable.");
-      try {
-        await git2(ws.root, "merge-base", "--is-ancestor", previous.head, inputs.head);
-      } catch {
-        throw new Error("Detached checkout moved to a different history; original repair evidence was retained. Inspect that baseline explicitly.");
+    const result = await analyze(ws, inputs, event, startedAt);
+    if (result.shared) {
+      await verifyInputs(ws, inputs);
+      if (result.analysis.baselineDigest !== await baselineDigest(ws, await loadState(ws))) {
+        throw new Error("Repair baseline was modified during shared automation; original evidence must be inspected.");
       }
     }
-    const key = event.host && event.sessionId ? hash([event.host, event.sessionId]) : null;
-    const newSession = key !== null && !state.sessions[key];
-    if (key && !state.sessions[key]) {
-      const keys = Object.keys(state.sessions).sort((a, b) => state.sessions[a].lastUsed.localeCompare(state.sessions[b].lastUsed));
-      for (const expired of keys.slice(0, Math.max(0, keys.length - 31))) delete state.sessions[expired];
-      state.sessions[key] = {
-        host: event.host,
-        seen: null,
-        continued: false,
-        initialIssues: [],
-        initialDocs: inputs.docs,
-        lastUsed: now,
-        mutationObserved: false,
-        pending: {},
-        coverageGaps: [],
-        events: {}
-      };
-    }
-    const session = key ? state.sessions[key] : null;
-    if (session) {
-      session.lastUsed = now;
-      session.events[event.event] = { at: now, count: (session.events[event.event]?.count ?? 0) + 1 };
-      if (event.event === "before_tool" && event.mutating && event.toolId) {
-        if (Object.keys(session.pending).length >= 128) throw new Error("Too many unfinished tool calls to track pre-edit evidence.");
-        session.pending[event.toolId] = inputs.fingerprint;
+    return withLock(ws.root, ws.directory, async () => {
+      const state = await loadState(ws);
+      if (state.analysis?.id !== result.analysis.id) throw new Error("Automation evidence changed during publication; retry against the current inputs.");
+      const report = structuredClone(result.analysis.report);
+      if (result.shared) report.checks = { ...report.checks, ran: [], reused: [.../* @__PURE__ */ new Set([...report.checks.ran, ...report.checks.reused])], shared: true };
+      report.reportPath = ws.directory + "/checks/" + randomUUID4() + ".json";
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const key = event.host && event.sessionId ? hash([event.host, event.sessionId]) : null;
+      const newSession = key !== null && !state.sessions[key];
+      if (key && !state.sessions[key]) {
+        const keys = Object.keys(state.sessions).sort((a, b) => state.sessions[a].lastUsed.localeCompare(state.sessions[b].lastUsed));
+        const removable = keys.filter((k) => !Object.keys(state.sessions[k].pending).length);
+        for (const expired of removable.slice(0, Math.max(0, keys.length - 31))) delete state.sessions[expired];
+        if (Object.keys(state.sessions).length >= 128) throw new Error("Too many sessions with unfinished tool calls; original evidence was retained.");
+        state.sessions[key] = {
+          host: event.host,
+          seen: null,
+          continued: false,
+          initialIssues: report.findings.filter((f) => f.status === "unresolved").map((f) => f.id),
+          initialDocs: inputs.docs,
+          lastUsed: now,
+          mutationObserved: false,
+          pending: {},
+          coverageGaps: [],
+          events: {}
+        };
       }
-      if (event.event === "after_tool" && event.mutating) {
-        session.mutationObserved = true;
-        if (!event.toolId || !session.pending[event.toolId]) {
-          const gap = "A tool completed without an observed matching pre-tool capture; pre-edit coverage is unknown.";
-          if (!session.coverageGaps.includes(gap)) session.coverageGaps.push(gap);
+      const session = key ? state.sessions[key] : null;
+      if (session) {
+        session.lastUsed = now;
+        session.events[event.event] = { at: now, count: (session.events[event.event]?.count ?? 0) + 1 };
+        if (event.event === "before_tool" && event.mutating && event.toolId) {
+          if (Object.keys(session.pending).length >= 128) throw new Error("Too many unfinished tool calls to track pre-edit evidence.");
+          session.pending[event.toolId] = inputs.fingerprint;
         }
-        if (event.toolId) delete session.pending[event.toolId];
+        if (event.event === "after_tool" && event.mutating) {
+          session.mutationObserved = true;
+          if (!event.toolId || !session.pending[event.toolId]) {
+            const gap = "A tool completed without an observed matching pre-tool capture; pre-edit coverage is unknown.";
+            if (!session.coverageGaps.includes(gap)) session.coverageGaps.push(gap);
+          }
+          if (event.toolId) delete session.pending[event.toolId];
+        }
+        report.diagnostics.push(...session.coverageGaps);
+        if (session.coverageGaps.length && report.status !== "unavailable") report.status = "incomplete";
+        report.capture = report.status !== "unavailable" && !session.coverageGaps.length && (session.events.session_start || session.events.before_tool) ? "observed" : "unknown";
       }
-    }
-    if (!state.baselines.length && Object.values(inputs.docs).every((value) => value === null)) {
-      const report2 = {
-        version: 1,
-        status: "unavailable",
-        root: ws.root,
-        branch: ws.branch,
-        head: inputs.head,
-        baselinePaths: [],
-        reportPath: ws.directory + "/checks/" + randomUUID4() + ".json",
-        findings: [],
-        diagnostics: ["No AGENTS.md, CLAUDE.md, or .claude/CLAUDE.md exists. Documentation capture is unavailable; other Mason tools remain usable."],
-        checks: { ran: [], reused: [], skipped: [] },
-        counts: { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 },
-        capture: "unknown",
-        scope: SCOPE
-      };
-      const notify2 = !session || session.seen !== "no-docs";
-      if (session) session.seen = "no-docs";
-      state.fingerprint = inputs.fingerprint;
-      state.latest = report2.reportPath;
-      state.updatedAt = now;
-      await writeStoreJson(ws.root, report2.reportPath, report2);
-      await writeStoreJson(ws.root, statePath, state);
-      return { report: report2, message: notify2 ? summarize(report2) : null, continueOnce: false };
-    }
-    let cached = null;
-    const diagnostics = [];
-    try {
-      cached = await readStoreJson(ws.root, ws.directory + "/cache.json");
-    } catch {
-      diagnostics.push("Unreadable automation cache; checks are being recomputed.");
-    }
-    const cache = checkCache(cached, inputs);
-    if (cache.diagnostic) diagnostics.push(cache.diagnostic);
-    const saveBaseline = async () => {
-      if (state.baselines.length >= 128) throw new Error("128 retained baselines need review; automatic capture stopped without discarding original evidence.");
-      const prepared = await prepareRepair(ws.root, ALL_CHECKS, cache.options);
-      state.baselines.push({ path: prepared.baselinePath, at: now, event: event.event, fingerprint: inputs.fingerprint });
-    };
-    if (!state.baselines.length) await saveBaseline();
-    const verifications = [];
-    for (const baseline of state.baselines) verifications.push(await verifyRepair(ws.root, baseline.path, cache.options));
-    const known = new Set(verifications.flatMap((v) => v.findings.map((f) => f.id)));
-    if (verifications.some((v) => v.newFindings.some((f) => !known.has(findingId(f))))) {
-      await saveBaseline();
-      verifications.push(await verifyRepair(ws.root, state.baselines.at(-1).path, cache.options));
-    }
-    const merged = /* @__PURE__ */ new Map();
-    for (const verification of verifications) {
-      for (const finding of verification.findings) {
-        const previous = merged.get(finding.id);
-        if (!previous || priority[finding.status] > priority[previous.status]) merged.set(finding.id, finding);
+      const signature = hash([report.status, report.findings, report.diagnostics, report.checks.skipped]);
+      const relevant = report.findings.some((f) => f.status === "unresolved" && session && (!session.initialIssues.includes(f.id) || session.initialDocs[f.original.anchor.doc] !== inputs.docs[f.original.anchor.doc]));
+      const continueOnce = event.event === "task_end" && !!session?.mutationObserved && relevant && !session.continued && !event.stopHookActive;
+      const notify = !session || newSession || signature !== session.seen || continueOnce;
+      if (session) {
+        session.seen = signature;
+        if (continueOnce) session.continued = true;
       }
-      diagnostics.push(...verification.diagnostics);
-    }
-    if (newSession && session) session.initialIssues = [...merged.values()].filter((f) => f.status === "unresolved").map((f) => f.id);
-    const current = verifications.at(-1).currentAudit;
-    const counts = { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 };
-    for (const finding of merged.values()) counts[finding.status]++;
-    if (session) diagnostics.push(...session.coverageGaps);
-    const capture = session && !session.coverageGaps.length && (session.events.session_start || session.events.before_tool) ? "observed" : "unknown";
-    const after = await readInputs(ws.root);
-    const currentWs = await workspace(ws.root);
-    if (after.fingerprint !== inputs.fingerprint || currentWs.directory !== ws.directory) {
-      throw new Error("Repository inputs or branch changed during automation; no current verification was recorded. Retry on a stable checkout.");
-    }
-    const report = {
-      version: 1,
-      status: diagnostics.length || verifications.some((v) => v.status === "incomplete") ? "incomplete" : counts.unresolved ? "issues-remain" : "verified",
-      root: ws.root,
-      branch: ws.branch,
-      head: inputs.head,
-      baselinePaths: state.baselines.map((b) => b.path),
-      reportPath: ws.directory + "/checks/" + randomUUID4() + ".json",
-      findings: [...merged.values()],
-      diagnostics: [...new Set(diagnostics)],
-      checks: { ran: [...cache.ran], reused: [...cache.reused].filter((name) => !cache.ran.has(name)), skipped: current?.skippedChecks ?? [] },
-      counts,
-      capture,
-      scope: SCOPE
-    };
-    const signature = hash([report.status, report.findings, report.diagnostics, report.checks.skipped]);
-    const relevant = report.findings.some((f) => f.status === "unresolved" && session && (!session.initialIssues.includes(f.id) || session.initialDocs[f.original.anchor.doc] !== inputs.docs[f.original.anchor.doc]));
-    const continueOnce = event.event === "task_end" && !!session?.mutationObserved && relevant && !session.continued && !event.stopHookActive;
-    const notify = !session || newSession || signature !== session.seen || continueOnce;
-    if (session) {
-      session.seen = signature;
-      if (continueOnce) session.continued = true;
-    }
-    const persistReport = !state.latest || state.fingerprint !== inputs.fingerprint || notify || event.event === "task_end";
-    if (!persistReport) report.reportPath = state.latest;
-    state.updatedAt = now;
-    state.fingerprint = inputs.fingerprint;
-    state.latest = report.reportPath;
-    if (persistReport) await writeStoreJson(ws.root, report.reportPath, report);
-    if (cache.ran.size || cached === null || cache.diagnostic) await writeStoreJson(ws.root, ws.directory + "/cache.json", cache.serialize());
-    await writeStoreJson(ws.root, statePath, state);
-    return { report, message: notify ? summarize(report) : null, continueOnce };
-  }));
+      const persistReport = !state.latest || state.fingerprint !== inputs.fingerprint || notify || event.event === "task_end";
+      if (!persistReport) report.reportPath = state.latest;
+      state.updatedAt = now;
+      state.fingerprint = inputs.fingerprint;
+      state.latest = report.reportPath;
+      if (persistReport) await writeStoreJson(ws.root, report.reportPath, report);
+      await writeStoreJson(ws.root, ws.directory + "/state.json", state);
+      return { report, message: notify ? summarize(report) : null, continueOnce };
+    });
+  });
 }
 async function automationStatus(dir) {
   const ws = await workspace(dir);
   const execution = await executionStatus(ws.root, ws.directory);
+  const notifications = await failureNotifications(ws.root, ws.directory);
   const raw = await readStoreJson(ws.root, ws.directory + "/state.json");
-  if (raw === null) return { version: 1, status: execution.status === "not-observed" ? "not-observed" : "unavailable", root: ws.root, branch: ws.branch, baselinePaths: [], hosts: {}, execution };
+  if (raw === null) return { version: 1, status: execution.status === "not-observed" ? "not-observed" : "unavailable", root: ws.root, branch: ws.branch, baselinePaths: [], hosts: {}, execution, notifications };
   const state = parseState(raw);
   if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) throw new Error("Automation state belongs to another workspace.");
   const inputs = await readInputs(ws.root);
@@ -2830,10 +2989,11 @@ async function automationStatus(dir) {
     verificationStatus: unfinished ? "unavailable" : latest?.status ?? "unavailable",
     hosts: hosts2,
     execution,
+    notifications,
     note: "Observed events do not prove all tool paths are intercepted. Run check to verify the retained evidence."
   };
 }
-var SCOPE, priority, cleanText;
+var SCOPE, priority, cleanText, analysisSchema, sharedSchema, baselineDigest;
 var init_runtime = __esm({
   "src/automation/runtime.ts"() {
     "use strict";
@@ -2846,11 +3006,40 @@ var init_runtime = __esm({
     SCOPE = "Documentation audit evidence only. Hook receipts show observed events, not complete interception. Resolved claims no longer fail their checks; advisories need separate review. Repair only within the user's task authorization.";
     priority = { resolved: 0, "review-required": 1, unresolved: 2, unverified: 3 };
     cleanText = (text2) => text2.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 250);
+    analysisSchema = z8.object({
+      id: z8.string(),
+      fingerprint: z8.string(),
+      completedAt: z8.number(),
+      baselineDigest: z8.string(),
+      report: z8.object({
+        version: z8.literal(1),
+        status: z8.enum(["verified", "issues-remain", "incomplete", "unavailable"]),
+        root: z8.string(),
+        branch: z8.string(),
+        head: z8.string(),
+        baselinePaths: z8.array(z8.string()),
+        reportPath: z8.string(),
+        findings: z8.array(repairFindingSchema),
+        diagnostics: z8.array(z8.string()),
+        checks: z8.object({
+          ran: z8.array(z8.string()),
+          reused: z8.array(z8.string()),
+          skipped: z8.array(z8.object({ check: z8.string(), reason: z8.string(), doc: z8.string().optional() }))
+        }),
+        counts: z8.object({ resolved: z8.number(), unresolved: z8.number(), "review-required": z8.number(), unverified: z8.number() }),
+        capture: z8.enum(["observed", "unknown"]),
+        scope: z8.string()
+      })
+    });
+    sharedSchema = z8.object({ analysis: analysisSchema, digest: z8.string() });
+    baselineDigest = async (ws, state) => hash(await Promise.all(
+      state.baselines.map(async (b) => [b.path, await readStoreJson(ws.root, b.path)])
+    ));
   }
 });
 
 // src/setup/model.ts
-import { z as z7 } from "zod";
+import { z as z9 } from "zod";
 async function loadSetup(root) {
   const raw = await readStoreJson(root, SETUP_PATH);
   if (raw === null) return null;
@@ -2868,27 +3057,27 @@ var init_model = __esm({
   "src/setup/model.ts"() {
     "use strict";
     init_storage();
-    setupHostSchema = z7.object({
-      configuredVersion: z7.string(),
-      revision: z7.string().uuid(),
-      fingerprint: z7.string(),
-      mcpFingerprint: z7.string(),
-      instructions: z7.array(z7.string())
+    setupHostSchema = z9.object({
+      configuredVersion: z9.string(),
+      revision: z9.string().uuid(),
+      fingerprint: z9.string(),
+      mcpFingerprint: z9.string(),
+      instructions: z9.array(z9.string())
     });
-    setupSchema = z7.object({ version: z7.literal(2), hosts: z7.object({
+    setupSchema = z9.object({ version: z9.literal(2), hosts: z9.object({
       codex: setupHostSchema.optional(),
       claude: setupHostSchema.optional()
     }) });
     SETUP_PATH = ".mason/local/setup.json";
-    receiptSchema = z7.object({
-      version: z7.literal(1),
-      host: z7.enum(["codex", "claude"]),
-      status: z7.enum(["installing", "configured"]),
-      initialReportPath: z7.string(),
-      initialBaselinePaths: z7.array(z7.string()),
-      root: z7.string(),
-      revision: z7.string().uuid(),
-      configuredAt: z7.string().optional()
+    receiptSchema = z9.object({
+      version: z9.literal(1),
+      host: z9.enum(["codex", "claude"]),
+      status: z9.enum(["installing", "configured"]),
+      initialReportPath: z9.string(),
+      initialBaselinePaths: z9.array(z9.string()),
+      root: z9.string(),
+      revision: z9.string().uuid(),
+      configuredAt: z9.string().optional()
     });
   }
 });
@@ -2896,6 +3085,7 @@ var init_model = __esm({
 // src/setup/launcher.ts
 import { execFile as execFile9 } from "child_process";
 import { promisify as promisify9 } from "util";
+import fs14 from "fs/promises";
 function globalCommand(args, platform = process.platform) {
   return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args] } : { command: "mason", args };
 }
@@ -2920,7 +3110,7 @@ var init_launcher = __esm({
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.16.1" : "development";
+    executingVersion = () => true ? "0.16.3" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -2933,8 +3123,8 @@ __export(observations_exports, {
   observeActivation: () => observeActivation,
   readObservation: () => readObservation
 });
-import fs13 from "fs/promises";
-import { z as z8 } from "zod";
+import fs15 from "fs/promises";
+import { z as z10 } from "zod";
 function observationPath(directory, host, revision, version = executingVersion()) {
   return `${directory}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
 }
@@ -2949,9 +3139,9 @@ async function observeActivation(dir, event, options = {}) {
   const host = process.env.MASON_SETUP_HOST, revision = process.env.MASON_SETUP_REVISION;
   if (host !== "codex" && host !== "claude" || !revision || !process.env.MASON_SETUP_ROOT) return null;
   try {
-    const capturedDirectory = options.reportPath?.match(/^(\.mason\/reports\/automation\/[a-f0-9]{24})\/checks\//)?.[1];
-    const ws = capturedDirectory ? { root: await fs13.realpath(dir), directory: capturedDirectory } : await workspace(dir);
-    if (ws.root !== await fs13.realpath(process.env.MASON_SETUP_ROOT)) return null;
+    const capturedDirectory = options.directory?.match(/^\.mason\/reports\/automation\/[a-f0-9]{24}$/)?.[0] ?? options.reportPath?.match(/^(\.mason\/reports\/automation\/[a-f0-9]{24})\/checks\//)?.[1];
+    const ws = capturedDirectory ? { root: await fs15.realpath(dir), directory: capturedDirectory } : await workspace(dir);
+    if (ws.root !== await fs15.realpath(process.env.MASON_SETUP_ROOT)) return null;
     const setup = await loadSetup(ws.root);
     if (setup?.hosts[host]?.revision !== revision) return "Mason setup changed; restart the assistant to observe the current integration.";
     const directory = ws.directory + "/activation";
@@ -2999,45 +3189,59 @@ var init_observations = __esm({
     init_storage();
     init_model();
     init_launcher();
-    observationSchema = z8.object({
-      version: z8.literal(1),
-      masonVersion: z8.string(),
-      root: z8.string(),
-      revision: z8.string(),
-      host: z8.enum(["codex", "claude"]),
-      contextCalls: z8.number().int().nonnegative(),
-      lastContextAt: z8.string().optional(),
-      sessions: z8.record(z8.object({
-        events: z8.array(z8.enum(events)),
-        at: z8.string(),
-        verificationStatus: z8.string().optional(),
-        reportPath: z8.string().optional()
+    observationSchema = z10.object({
+      version: z10.literal(1),
+      masonVersion: z10.string(),
+      root: z10.string(),
+      revision: z10.string(),
+      host: z10.enum(["codex", "claude"]),
+      contextCalls: z10.number().int().nonnegative(),
+      lastContextAt: z10.string().optional(),
+      sessions: z10.record(z10.object({
+        events: z10.array(z10.enum(events)),
+        at: z10.string(),
+        verificationStatus: z10.string().optional(),
+        reportPath: z10.string().optional()
       }))
     });
   }
 });
 
 // src/automation/adapters.ts
-import { z as z9 } from "zod";
+import { z as z11 } from "zod";
 function normalizeHook(host, raw) {
   hostSchema.parse(host);
   const input2 = inputSchema.parse(raw);
-  const readOnly = host === "claude" ? /^(Read|Glob|Grep|WebSearch|WebFetch)$/ : /^(read_file|list_dir|grep_files)$/;
-  return { cwd: input2.cwd, name: input2.hook_event_name, event: {
+  const readOnly = (host === "claude" ? /^(Read|Glob|Grep|WebSearch|WebFetch)$/ : /^(read_file|list_dir|grep_files|Read|Glob|Grep)$/).test(input2.tool_name ?? "");
+  return { cwd: input2.cwd, name: input2.hook_event_name, readOnly, event: {
     event: lifecycle[input2.hook_event_name],
     host,
     sessionId: input2.session_id,
     toolId: input2.tool_use_id,
-    mutating: !!input2.tool_name && !readOnly.test(input2.tool_name),
+    mutating: !!input2.tool_name && !readOnly,
     stopHookActive: input2.stop_hook_active || input2.permission_mode === "plan"
   } };
 }
 async function runAutomationHook(host, stdin) {
   let name = "";
+  let hook;
   try {
     if (Buffer.byteLength(stdin) > 1024 * 1024) throw new Error("Hook input exceeds 1 MiB.");
-    const input2 = normalizeHook(host, JSON.parse(stdin));
+    let raw;
+    try {
+      raw = JSON.parse(stdin);
+    } catch {
+      throw new Error("Hook input is not valid JSON.");
+    }
+    const input2 = normalizeHook(host, raw);
+    hook = input2;
     name = input2.name;
+    if (["before_tool", "after_tool"].includes(input2.event.event) && input2.readOnly) {
+      const observed = await observeReadOnlyTool(input2.cwd, input2.event);
+      const { observeActivation: observeActivation3 } = await Promise.resolve().then(() => (init_observations(), observations_exports));
+      const warning2 = await observeActivation3(observed.root, input2.event.event, { sessionId: input2.event.sessionId, directory: observed.directory });
+      return warning2 ? { systemMessage: warning2 } : null;
+    }
     const result = await automate(input2.cwd, input2.event);
     const { observeActivation: observeActivation2 } = await Promise.resolve().then(() => (init_observations(), observations_exports));
     const warning = await observeActivation2(result.report.root, input2.event.event, {
@@ -3052,12 +3256,20 @@ async function runAutomationHook(host, stdin) {
     }
     return { hookSpecificOutput: { hookEventName: name, additionalContext: result.message } };
   } catch (error) {
-    const message2 = failureMessage(error);
+    const message2 = hook ? await hookFailureMessage(hook.cwd, host, hook.event.sessionId, error) : failureMessage(error);
+    if (!message2) return null;
     return { systemMessage: message2, ...["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse"].includes(name) ? { hookSpecificOutput: { hookEventName: name, additionalContext: message2 } } : {} };
   }
 }
+function managedHookCommand(host, platform = process.platform) {
+  const command = `mason --setup-host ${host} auto hook --host ${host}`;
+  return platform === "win32" ? `cmd.exe /d /s /c "where mason >nul 2>nul & if errorlevel 1 (exit /b 0) else (${command})"` : `if command -v mason >/dev/null 2>&1; then ${command}; fi`;
+}
+function knownManagedHookCommands(host) {
+  return [managedHookCommand(host, "linux"), managedHookCommand(host, "win32"), `mason --setup-host ${host} auto hook --host ${host}`];
+}
 function hookConfig(host, command = "npx --no-install --package mason-context mason-auto") {
-  const handler = { type: "command", command: command + " hook --host " + host, timeout: 30 };
+  const handler = { type: "command", command: command === `mason --setup-host ${host} auto` ? managedHookCommand(host) : command + " hook --host " + host, timeout: 30 };
   return { hooks: Object.fromEntries(HOOK_EVENTS.map((name) => [
     name,
     [{ ...["PreToolUse", "PostToolUse"].includes(name) ? { matcher: ".*" } : {}, hooks: [{ ...handler }] }]
@@ -3070,15 +3282,15 @@ var init_adapters = __esm({
     init_execution();
     init_runtime();
     init_store();
-    inputSchema = z9.object({
-      cwd: z9.string().min(1),
-      session_id: z9.string().min(1).max(500),
-      hook_event_name: z9.enum(["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"]),
-      tool_name: z9.string().optional(),
-      tool_use_id: z9.string().max(500).optional(),
-      tool_input: z9.unknown().optional(),
-      stop_hook_active: z9.boolean().optional(),
-      permission_mode: z9.string().optional()
+    inputSchema = z11.object({
+      cwd: z11.string().min(1),
+      session_id: z11.string().min(1).max(500),
+      hook_event_name: z11.enum(["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"]),
+      tool_name: z11.string().optional(),
+      tool_use_id: z11.string().max(500).optional(),
+      tool_input: z11.unknown().optional(),
+      stop_hook_active: z11.boolean().optional(),
+      permission_mode: z11.string().optional()
     });
     lifecycle = {
       SessionStart: "session_start",
@@ -3098,7 +3310,7 @@ __export(files_exports, {
   managedBlock: () => managedBlock,
   readText: () => readText
 });
-import fs14 from "fs/promises";
+import fs16 from "fs/promises";
 import path18 from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 async function readText(root, file) {
@@ -3128,14 +3340,14 @@ async function applyEdit(root, edit) {
   if (edit.after === null) {
     const file2 = await storePath(root, edit.path);
     if (await readText(root, edit.path) !== edit.before) throw new Error("Input changed during removal: " + edit.path);
-    await fs14.unlink(file2);
+    await fs16.unlink(file2);
     return true;
   }
   const file = await storePath(root, edit.path, true);
   const temporary = path18.join(path18.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
   try {
-    const mode = await fs14.stat(file).then((s) => s.mode & 511, () => 384);
-    const handle = await fs14.open(temporary, "wx", mode);
+    const mode = await fs16.stat(file).then((s) => s.mode & 511, () => 384);
+    const handle = await fs16.open(temporary, "wx", mode);
     try {
       await handle.writeFile(edit.after, "utf8");
       await handle.sync();
@@ -3143,10 +3355,10 @@ async function applyEdit(root, edit) {
       await handle.close();
     }
     if (await readText(root, edit.path) !== edit.before) throw new Error("Integration input changed during update: " + edit.path);
-    await fs14.rename(temporary, file);
+    await fs16.rename(temporary, file);
     return true;
   } finally {
-    await fs14.rm(temporary, { force: true });
+    await fs16.rm(temporary, { force: true });
   }
 }
 var init_files2 = __esm({
@@ -3167,7 +3379,7 @@ __export(ownership_exports, {
   ownershipEdit: () => ownershipEdit,
   ownershipSchema: () => ownershipSchema
 });
-import { z as z10 } from "zod";
+import { z as z12 } from "zod";
 import { parse } from "smol-toml";
 function blockSpan(text2, start, end) {
   const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
@@ -3218,30 +3430,30 @@ var init_ownership = __esm({
       ["<!-- mason:agents:start -->", "<!-- mason:agents:end -->"],
       ["# mason:mcp:start", "# mason:mcp:end"]
     ];
-    fileSchema = z10.object({
-      created: z10.boolean(),
-      initialHash: z10.string(),
-      blocks: z10.record(z10.string()),
-      mcpHash: z10.string().optional(),
-      hookCommands: z10.array(z10.string()).optional(),
-      hooks: z10.record(z10.array(z10.string())).optional()
+    fileSchema = z12.object({
+      created: z12.boolean(),
+      initialHash: z12.string(),
+      blocks: z12.record(z12.string()),
+      mcpHash: z12.string().optional(),
+      hookCommands: z12.array(z12.string()).optional(),
+      hooks: z12.record(z12.array(z12.string())).optional()
     });
-    ownershipSchema = z10.object({ version: z10.literal(1), files: z10.record(fileSchema) });
+    ownershipSchema = z12.object({ version: z12.literal(1), files: z12.record(fileSchema) });
   }
 });
 
 // src/mcp/init.ts
-import { z as z11 } from "zod";
+import { z as z13 } from "zod";
 var markerSchema, CLAUDE_MD_SECTION, ASSISTANT_SETUP, QUICKSTART_PLAYBOOK, MAP_PLAYBOOK;
 var init_init = __esm({
   "src/mcp/init.ts"() {
     "use strict";
     init_storage();
     init_files2();
-    markerSchema = z11.object({
-      version: z11.literal(1),
-      initializedAt: z11.string(),
-      features: z11.object({ confluence: z11.boolean().optional() }).passthrough().optional()
+    markerSchema = z13.object({
+      version: z13.literal(1),
+      initializedAt: z13.string(),
+      features: z13.object({ confluence: z13.boolean().optional() }).passthrough().optional()
     }).passthrough();
     CLAUDE_MD_SECTION = `<!-- mason:start -->
 ## Mason project knowledge
@@ -3348,7 +3560,7 @@ __export(config_exports, {
 });
 import { isDeepStrictEqual } from "util";
 import { parse as parse2, stringify } from "smol-toml";
-import { z as z12 } from "zod";
+import { z as z14 } from "zod";
 async function instructionEdits(root, host) {
   const found = await Promise.all(DOC_CANDIDATES.map(async (file) => ({ path: file, text: await readText(root, file) })));
   const existing = found.find((f) => f.text !== null);
@@ -3464,7 +3676,7 @@ var init_config = __esm({
     init_install();
     init_files2();
     init_launcher();
-    object = z12.record(z12.unknown());
+    object = z14.record(z14.unknown());
     mcpPath = (host) => host === "codex" ? ".codex/config.toml" : ".mcp.json";
     TOML_START = "# mason:mcp:start";
     TOML_END = "# mason:mcp:end";
@@ -3484,7 +3696,7 @@ __export(install_exports, {
   planAutomationInstall: () => planAutomationInstall,
   recordSchema: () => recordSchema
 });
-import { z as z13 } from "zod";
+import { z as z15 } from "zod";
 async function installationRecord(root) {
   return recordSchema.parse(await readStoreJson(root, AUTOMATION_PATH) ?? { version: 1, hosts: {} });
 }
@@ -3502,7 +3714,7 @@ async function planAutomationInstall(root, host, command) {
   const previous = record.hosts[host]?.command;
   const ownershipText = await readText(root, OWNERSHIP_PATH);
   const pending = ownershipText === null ? [] : ownershipSchema.parse(JSON.parse(ownershipText)).files[file]?.hookCommands ?? [];
-  const owned = /* @__PURE__ */ new Set([previous, ...pending, newCommand]);
+  const owned = /* @__PURE__ */ new Set([previous, ...pending, newCommand, ...knownManagedHookCommands(host)]);
   const hooks = existing.hooks ?? {};
   for (const event of HOOK_EVENTS) {
     hooks[event] = (hooks[event] ?? []).map((group) => ({
@@ -3565,9 +3777,9 @@ var init_install = __esm({
     init_store();
     init_files2();
     init_ownership();
-    groupSchema = z13.object({ hooks: z13.array(z13.object({ type: z13.string(), command: z13.string().optional() }).passthrough()) }).passthrough();
-    automationConfigSchema = z13.object({ hooks: z13.record(z13.array(groupSchema)).optional() }).passthrough();
-    recordSchema = z13.object({ version: z13.literal(1), hosts: z13.record(z13.object({ command: z13.string() })) });
+    groupSchema = z15.object({ hooks: z15.array(z15.object({ type: z15.string(), command: z15.string().optional() }).passthrough()) }).passthrough();
+    automationConfigSchema = z15.object({ hooks: z15.record(z15.array(groupSchema)).optional() }).passthrough();
+    recordSchema = z15.object({ version: z15.literal(1), hosts: z15.record(z15.object({ command: z15.string() })) });
     AUTOMATION_PATH = ".mason/local/automation.json";
     configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
   }
@@ -3582,7 +3794,7 @@ __export(teardown_exports, {
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 import { parse as parse3, stringify as stringify2 } from "smol-toml";
 import fg5 from "fast-glob";
-import { z as z14 } from "zod";
+import { z as z16 } from "zod";
 async function planTeardown(root, selected) {
   const edits = [], diagnostics = [];
   const inputs = /* @__PURE__ */ new Map();
@@ -3606,6 +3818,7 @@ async function planTeardown(root, selected) {
   const commands = (host) => new Set([
     automation?.hosts[host]?.command,
     ...ownership.files[configPath(host)]?.hookCommands ?? [],
+    ...knownManagedHookCommands(host),
     hookConfig(host, hookCommand(host)).hooks.SessionStart[0].hooks[0].command,
     hookConfig(host).hooks.SessionStart[0].hooks[0].command
   ].filter((command) => !!command));
@@ -3728,7 +3941,7 @@ async function planTeardown(root, selected) {
     if (!remainingHost) await attempt(".mason/local/project.json", async () => {
       const before = await read(".mason/local/project.json");
       if (before === null) return;
-      z14.object({ version: z14.literal(1), initializedAt: z14.string() }).strict().parse(JSON.parse(before));
+      z16.object({ version: z16.literal(1), initializedAt: z16.string() }).strict().parse(JSON.parse(before));
       cleanup.push({ path: ".mason/local/project.json", before, after: null });
     });
     if (!diagnostics.length) {
@@ -3800,7 +4013,7 @@ var init_teardown = __esm({
     init_model();
     init_ownership();
     hosts = ["codex", "claude"];
-    object2 = z14.record(z14.unknown());
+    object2 = z16.record(z16.unknown());
     json = (value) => JSON.stringify(value, null, 2) + "\n";
   }
 });
@@ -3927,7 +4140,7 @@ var init_types2 = __esm({
 });
 
 // src/review/evidence/vitest.ts
-import { z as z15 } from "zod";
+import { z as z17 } from "zod";
 function parseVitest(raw, sourceRoot) {
   const report = schema.parse(raw);
   const findings = [], diagnostics = [];
@@ -3976,24 +4189,24 @@ var init_vitest = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    count2 = z15.number().int().nonnegative();
-    schema = z15.object({
-      success: z15.boolean(),
+    count2 = z17.number().int().nonnegative();
+    schema = z17.object({
+      success: z17.boolean(),
       numTotalTests: count2,
       numPassedTests: count2,
       numFailedTests: count2,
       numPendingTests: count2,
       numTodoTests: count2,
       numFailedTestSuites: count2,
-      testResults: z15.array(z15.object({
-        name: z15.string().min(1),
-        status: z15.enum(["passed", "failed"]),
-        message: z15.string().optional(),
-        assertionResults: z15.array(z15.object({
-          fullName: z15.string(),
-          status: z15.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
-          failureMessages: z15.array(z15.string()).nullable().optional(),
-          location: z15.object({ line: count2, column: count2 }).nullable().optional()
+      testResults: z17.array(z17.object({
+        name: z17.string().min(1),
+        status: z17.enum(["passed", "failed"]),
+        message: z17.string().optional(),
+        assertionResults: z17.array(z17.object({
+          fullName: z17.string(),
+          status: z17.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
+          failureMessages: z17.array(z17.string()).nullable().optional(),
+          location: z17.object({ line: count2, column: count2 }).nullable().optional()
         }))
       }))
     });
@@ -4001,7 +4214,7 @@ var init_vitest = __esm({
 });
 
 // src/review/evidence/sarif.ts
-import { z as z16 } from "zod";
+import { z as z18 } from "zod";
 function parseSarif(raw, sourceRoot) {
   const report = schema2.parse(raw), findings = [], diagnostics = [];
   let active = 0, suppressed = 0, absent = 0, unresolved = 0;
@@ -4092,29 +4305,29 @@ var init_sarif = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    index = z16.number().int().nonnegative();
-    artifact = z16.object({ uri: z16.string().optional(), uriBaseId: z16.string().optional(), index: index.optional() });
-    message = z16.object({ text: z16.string().optional(), markdown: z16.string().optional(), id: z16.string().optional(), arguments: z16.array(z16.string()).optional() });
-    level = z16.enum(["error", "warning", "note", "none"]);
-    location = z16.object({ physicalLocation: z16.object({ artifactLocation: artifact.optional(), region: z16.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
-    schema2 = z16.object({
-      version: z16.literal("2.1.0"),
-      runs: z16.array(z16.object({
-        tool: z16.object({ driver: z16.object({ name: z16.string().min(1), rules: z16.array(z16.object({ id: z16.string(), defaultConfiguration: z16.object({ level: level.optional() }).optional(), messageStrings: z16.record(message).optional() })).optional(), globalMessageStrings: z16.record(message).optional() }) }),
-        invocations: z16.array(z16.object({ executionSuccessful: z16.boolean(), commandLine: z16.string().optional(), toolExecutionNotifications: z16.array(z16.object({ level: level.optional(), message })).optional() })).optional(),
-        versionControlProvenance: z16.array(z16.object({ revisionId: z16.string().optional() })).optional(),
-        originalUriBaseIds: z16.record(artifact).optional(),
-        artifacts: z16.array(z16.object({ location: artifact.optional() })).optional(),
-        results: z16.array(z16.object({
-          ruleId: z16.string().optional(),
+    index = z18.number().int().nonnegative();
+    artifact = z18.object({ uri: z18.string().optional(), uriBaseId: z18.string().optional(), index: index.optional() });
+    message = z18.object({ text: z18.string().optional(), markdown: z18.string().optional(), id: z18.string().optional(), arguments: z18.array(z18.string()).optional() });
+    level = z18.enum(["error", "warning", "note", "none"]);
+    location = z18.object({ physicalLocation: z18.object({ artifactLocation: artifact.optional(), region: z18.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
+    schema2 = z18.object({
+      version: z18.literal("2.1.0"),
+      runs: z18.array(z18.object({
+        tool: z18.object({ driver: z18.object({ name: z18.string().min(1), rules: z18.array(z18.object({ id: z18.string(), defaultConfiguration: z18.object({ level: level.optional() }).optional(), messageStrings: z18.record(message).optional() })).optional(), globalMessageStrings: z18.record(message).optional() }) }),
+        invocations: z18.array(z18.object({ executionSuccessful: z18.boolean(), commandLine: z18.string().optional(), toolExecutionNotifications: z18.array(z18.object({ level: level.optional(), message })).optional() })).optional(),
+        versionControlProvenance: z18.array(z18.object({ revisionId: z18.string().optional() })).optional(),
+        originalUriBaseIds: z18.record(artifact).optional(),
+        artifacts: z18.array(z18.object({ location: artifact.optional() })).optional(),
+        results: z18.array(z18.object({
+          ruleId: z18.string().optional(),
           ruleIndex: index.optional(),
           message,
           level: level.optional(),
-          kind: z16.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
-          baselineState: z16.enum(["new", "unchanged", "updated", "absent"]).optional(),
-          suppressions: z16.array(z16.object({ kind: z16.enum(["inSource", "external"]), status: z16.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
-          locations: z16.array(location).optional(),
-          relatedLocations: z16.array(location).optional()
+          kind: z18.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
+          baselineState: z18.enum(["new", "unchanged", "updated", "absent"]).optional(),
+          suppressions: z18.array(z18.object({ kind: z18.enum(["inSource", "external"]), status: z18.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
+          locations: z18.array(location).optional(),
+          relatedLocations: z18.array(location).optional()
         })).optional()
       }))
     });
@@ -4123,7 +4336,7 @@ var init_sarif = __esm({
 
 // src/review/evidence.ts
 import path19 from "path";
-import { z as z17 } from "zod";
+import { z as z19 } from "zod";
 function relativeArtifact(root, file) {
   const relative = path19.isAbsolute(file) ? path19.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
@@ -4164,7 +4377,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
     let manifest, raw;
     try {
       manifest = relativeArtifact(root, supplied);
-      raw = z17.object({ version: z17.literal(1), checks: z17.array(z17.unknown()) }).parse(await readStoreJson(root, manifest));
+      raw = z19.object({ version: z19.literal(1), checks: z19.array(z19.unknown()) }).parse(await readStoreJson(root, manifest));
     } catch (error) {
       output.diagnostics.push(`${supplied}: ${String(error)}`);
       continue;
@@ -4317,25 +4530,25 @@ var init_evidence2 = __esm({
     init_vitest();
     init_sarif();
     init_types2();
-    checkSchema2 = z17.object({
-      id: z17.string().min(1).max(100),
-      kind: z17.enum(["tests", "static-analysis", "security", "complexity", "duplication"]),
-      tool: z17.string().min(1).max(200),
-      command: z17.string().min(1).max(2e3),
-      commit: z17.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
-      workingTreeClean: z17.boolean().optional(),
-      source: z17.string().max(2e3).optional(),
-      sourceRoot: z17.string().min(1).max(4e3).optional(),
-      status: z17.enum(["completed", "skipped", "unavailable"]).default("completed"),
-      reason: z17.string().min(1).max(2e3).optional(),
-      exitCode: z17.number().int().nullable().optional(),
-      report: z17.object({ format: z17.enum(["vitest-json", "sarif"]), path: z17.string().min(1).max(4e3) }).optional()
+    checkSchema2 = z19.object({
+      id: z19.string().min(1).max(100),
+      kind: z19.enum(["tests", "static-analysis", "security", "complexity", "duplication"]),
+      tool: z19.string().min(1).max(200),
+      command: z19.string().min(1).max(2e3),
+      commit: z19.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
+      workingTreeClean: z19.boolean().optional(),
+      source: z19.string().max(2e3).optional(),
+      sourceRoot: z19.string().min(1).max(4e3).optional(),
+      status: z19.enum(["completed", "skipped", "unavailable"]).default("completed"),
+      reason: z19.string().min(1).max(2e3).optional(),
+      exitCode: z19.number().int().nullable().optional(),
+      report: z19.object({ format: z19.enum(["vitest-json", "sarif"]), path: z19.string().min(1).max(4e3) }).optional()
     });
   }
 });
 
 // src/review/review.ts
-import fs15 from "fs/promises";
+import fs17 from "fs/promises";
 import path20 from "path";
 import { execFile as execFile12 } from "child_process";
 import { promisify as promisify12 } from "util";
@@ -4415,7 +4628,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs15.access(path20.join(resolvedRoot, relPath));
+        await fs17.access(path20.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -4569,7 +4782,7 @@ async function setupStatus(dir) {
       version: 1,
       status: pending.length ? "incomplete" : "not-configured",
       hosts: {},
-      next: pending.length ? "Setup did not finish. Rerun mason-auto setup --host " + pending[0] + " to resume using the retained original evidence." : "Run mason-auto setup --host codex or --host claude."
+      next: pending.length ? "Setup did not finish. Rerun mason-auto setup --host " + pending[0] + " to resume using the retained original evidence." : "Project hooks are inactive until local setup. Run mason setup --host codex or --host claude."
     };
   }
   const hosts2 = {};