mason-context 0.16.2 → 0.17.0

package/dist/mason.js

@@ -248,391 +248,255 @@ var init_storage = __esm({
   }
 });
 
-// src/automation/execution.ts
+// src/automation/store.ts
+import fs3 from "fs/promises";
 import os from "os";
-import { randomUUID as randomUUID2 } from "crypto";
 import { z } from "zod";
-function parseExecution(raw) {
-  try {
-    return executionSchema.parse(raw);
-  } catch (error) {
-    throw new Error("Invalid automation execution store; receipt history was retained.", { cause: error });
-  }
-}
-function automationFailure(error) {
-  const recorded = failureSchema.safeParse(error?.failure);
-  if (recorded.success) return recorded.data;
-  const message2 = (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 700);
-  const codes = /* @__PURE__ */ new Set();
-  let cause = error;
-  for (let i = 0; cause && i < 8; i++) {
-    codes.add(String(cause.code));
-    cause = cause.cause;
-  }
-  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message2) ? "inputs-changed" : /Automation is busy/.test(message2) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message2) ? "history-unavailable" : error instanceof z.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message2) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message2) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
-  return { code, message: message2, retryable: ["inputs-changed", "storage-full", "busy", "io-error"].includes(code), receiptRecorded: false };
-}
-function failureMessage(error) {
-  const failure = automationFailure(error);
-  return `Mason automation unavailable [${failure.code}]; evidence capture/verification was not established. ${failure.message}` + (failure.receiptRecorded ? "" : " No durable failure receipt was recorded.");
-}
-async function recordExecution(root, directory, event, run) {
-  const file = directory + "/execution.json";
-  const raw = await readStoreJson(root, file);
-  const log = raw === null ? { version: 1, attempts: [], discardedAttempts: 0 } : parseExecution(raw);
-  for (const attempt2 of log.attempts) if (attempt2.status === "running") attempt2.status = "unknown";
-  log.discardedAttempts += Math.max(0, log.attempts.length - 31);
-  log.attempts = log.attempts.slice(-31);
-  const started = performance.now();
-  const attempt = {
-    id: randomUUID2(),
-    event,
-    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    pid: process.pid,
-    host: os.hostname(),
-    status: "running"
-  };
-  log.attempts.push(attempt);
-  await writeStoreJson(root, file, log);
+function parseState(raw) {
   try {
-    const result = await run();
-    Object.assign(attempt, {
-      status: "completed",
-      finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      durationMs: performance.now() - started,
-      verificationStatus: result.report.status,
-      reportPath: result.report.reportPath
-    });
-    await writeStoreJson(root, file, log);
-    return result;
+    return stateSchema.parse(raw);
   } catch (error) {
-    const failure = automationFailure(error);
-    Object.assign(attempt, { status: "failed", finishedAt: (/* @__PURE__ */ new Date()).toISOString(), durationMs: performance.now() - started, failure });
-    delete attempt.verificationStatus;
-    delete attempt.reportPath;
-    try {
-      await writeStoreJson(root, file, { ...log, attempts: log.attempts.map((a) => a === attempt ? { ...a, failure: { ...failure, receiptRecorded: true } } : a) });
-      failure.receiptRecorded = true;
-    } catch {
-    }
-    throw Object.assign(new Error(failure.message, { cause: error }), { failure });
+    throw new Error("Invalid automation state; original evidence was retained.", { cause: error });
   }
 }
-async function executionStatus(root, directory) {
-  const raw = await readStoreJson(root, directory + "/execution.json");
-  if (raw === null) return { status: "not-observed", attempts: [] };
-  const log = parseExecution(raw);
-  let lock = null;
-  if (log.attempts.some((attempt) => attempt.status === "running")) {
+async function withLock(root, directory, run, waitMs = 5e3) {
+  const file = await storePath(root, directory + "/lock", true);
+  const deadline = Date.now() + waitMs;
+  let handle;
+  while (!handle) {
     try {
-      lock = await readStoreJson(root, directory + "/lock");
-    } catch {
-    }
-  }
-  for (const attempt of log.attempts) {
-    if (attempt.status !== "running") continue;
-    let alive = false;
-    if (attempt.host === os.hostname() && lock?.pid === attempt.pid && lock.host === attempt.host) {
+      handle = await fs3.open(file, "wx", 384);
       try {
-        process.kill(attempt.pid, 0);
-        alive = true;
+        await handle.writeFile(JSON.stringify({ pid: process.pid, host: os.hostname() }));
       } catch (error) {
-        alive = error.code === "EPERM";
+        await handle.close().catch(() => {
+        });
+        handle = void 0;
+        await fs3.rm(file, { force: true }).catch(() => {
+        });
+        throw error;
+      }
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      try {
+        const owner = JSON.parse(await fs3.readFile(file, "utf8"));
+        if (owner.host === os.hostname() && Number.isInteger(owner.pid) && owner.pid > 0) {
+          try {
+            process.kill(owner.pid, 0);
+          } catch (probe) {
+            if (probe.code === "ESRCH") {
+              const reclaim = file + ".reclaim";
+              let guard;
+              try {
+                guard = await fs3.open(reclaim, "wx", 384);
+                const current = JSON.parse(await fs3.readFile(file, "utf8"));
+                if (current.pid === owner.pid && current.host === owner.host) await fs3.unlink(file);
+              } finally {
+                if (guard) {
+                  await guard.close();
+                  await fs3.rm(reclaim, { force: true });
+                }
+              }
+            }
+          }
+        }
+      } catch {
       }
+      if (Date.now() >= deadline) throw new Error("Automation is busy or its lock needs inspection: " + file);
+      await new Promise((resolve) => setTimeout(resolve, 40));
     }
-    if (!alive) attempt.status = "unknown";
   }
-  return { status: log.attempts.at(-1)?.status ?? "not-observed", attempts: log.attempts, discardedAttempts: log.discardedAttempts };
+  try {
+    return await run();
+  } finally {
+    await handle.close();
+    await fs3.unlink(file);
+  }
 }
-var failureSchema, attemptSchema, executionSchema;
-var init_execution = __esm({
-  "src/automation/execution.ts"() {
+var hostSchema, events, stateSchema;
+var init_store = __esm({
+  "src/automation/store.ts"() {
     "use strict";
     init_storage();
-    failureSchema = z.object({
-      code: z.enum(["inputs-changed", "storage-full", "busy", "invalid-input", "history-unavailable", "invalid-evidence", "io-error", "internal"]),
-      message: z.string(),
-      retryable: z.boolean(),
-      receiptRecorded: z.boolean()
-    });
-    attemptSchema = z.object({
-      id: z.string(),
-      event: z.string(),
-      startedAt: z.string(),
-      finishedAt: z.string().optional(),
-      durationMs: z.number().nonnegative().optional(),
-      pid: z.number().int().positive(),
-      host: z.string(),
-      status: z.enum(["running", "completed", "failed", "unknown"]),
-      verificationStatus: z.string().optional(),
-      reportPath: z.string().optional(),
-      failure: failureSchema.optional()
+    hostSchema = z.enum(["claude", "codex"]);
+    events = ["session_start", "turn_start", "before_tool", "after_tool", "task_end"];
+    stateSchema = z.object({
+      version: z.literal(1),
+      root: z.string(),
+      gitDir: z.string(),
+      branch: z.string(),
+      baselines: z.array(z.object({ path: z.string(), at: z.string(), event: z.string(), fingerprint: z.string() })).max(128),
+      sessions: z.record(z.object({
+        host: hostSchema,
+        seen: z.string().nullable(),
+        continued: z.boolean(),
+        initialIssues: z.array(z.string()),
+        initialDocs: z.record(z.string().nullable()),
+        lastUsed: z.string(),
+        mutationObserved: z.boolean(),
+        pending: z.record(z.string()),
+        coverageGaps: z.array(z.string()),
+        events: z.record(z.object({ at: z.string(), count: z.number().int().positive() }))
+      })),
+      updatedAt: z.string(),
+      fingerprint: z.string().nullable(),
+      latest: z.string().nullable(),
+      analysis: z.object({ id: z.string(), fingerprint: z.string(), completedAt: z.number(), path: z.string() }).optional()
     });
-    executionSchema = z.object({ version: z.literal(1), attempts: z.array(attemptSchema).max(32), discardedAttempts: z.number().int().nonnegative().default(0) });
   }
 });
 
-// src/test-map.ts
+// src/audit/commands.ts
 import path4 from "path";
-async function buildTestMap(dir) {
-  const rootDir = path4.resolve(dir);
-  const access = await createFileAccess(rootDir);
-  const testPatterns = [
-    "**/*.test.*",
-    "**/*.spec.*",
-    "**/*Test.kt",
-    "**/*Test.java",
-    "**/*Tests.kt",
-    "**/*Tests.java",
-    "**/test_*.py",
-    "**/*_test.py",
-    "**/*_test.go",
-    "**/*Tests.swift",
-    "**/*Test.swift",
-    "**/*_test.rs"
-  ];
-  const testFiles = await access.list(testPatterns);
-  const sourceFiles = await access.list();
-  const sourceByBaseName = /* @__PURE__ */ new Map();
-  for (const file of sourceFiles) {
-    if (testFiles.includes(file)) continue;
-    const baseName = path4.basename(file).replace(/\.[^.]+$/, "");
-    const existing = sourceByBaseName.get(baseName) ?? [];
-    existing.push(file);
-    sourceByBaseName.set(baseName, existing);
-  }
-  const paired = [];
-  const unmatched = [];
-  for (const testFile of testFiles) {
-    const testBaseName = path4.basename(testFile).replace(/\.[^.]+$/, "");
-    const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
-    if (!sourceName) {
-      unmatched.push(testFile);
+function splitCommands(line) {
+  const parts = [];
+  let quote2 = "", start = 0;
+  for (let i = 0; i < line.length; i++) {
+    const char = line[i];
+    if (char === "\\") {
+      i++;
       continue;
     }
-    const candidates = sourceByBaseName.get(sourceName);
-    if (candidates && candidates.length > 0) {
-      const testDir = path4.dirname(testFile);
-      const bestMatch = candidates.reduce((best, candidate) => {
-        const candidateDir = path4.dirname(candidate);
-        const bestDir = path4.dirname(best);
-        const candidateOverlap = commonSegments(testDir, candidateDir);
-        const bestOverlap = commonSegments(testDir, bestDir);
-        return candidateOverlap > bestOverlap ? candidate : best;
-      });
-      paired.push({
-        test: testFile,
-        source: bestMatch,
-        confidence: candidates.length === 1 ? "exact" : "best-guess"
-      });
-    } else {
-      unmatched.push(testFile);
+    if (quote2) {
+      if (char === quote2) quote2 = "";
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote2 = char;
+      continue;
+    }
+    if (char === ";" || line.slice(i, i + 2) === "&&") {
+      parts.push(line.slice(start, i));
+      if (char === "&") i++;
+      start = i + 1;
     }
   }
-  return { totalTestFiles: testFiles.length, paired, unmatched };
+  parts.push(line.slice(start));
+  return parts;
 }
-function commonSegments(pathA, pathB) {
-  const segsA = pathA.split("/");
-  const segsB = pathB.split("/");
-  let count3 = 0;
-  for (let i = 0; i < Math.min(segsA.length, segsB.length); i++) {
-    if (segsA[i] === segsB[i]) count3++;
-    else break;
+function commandClaims(line, lineNo, cwd, shell = false) {
+  const claims = [];
+  const segments = splitCommands(line);
+  for (const segment of segments) {
+    const text2 = segment.trim().replace(/^\$\s+/, "");
+    if (text2.startsWith("#") || /^(?:echo|printf)\b/.test(text2)) continue;
+    const cd = text2.match(/^cd\s+(.+)$/);
+    if (cd) {
+      const directory = literal(cd[1]);
+      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path4.posix.join(cwd ?? ".", directory);
+      continue;
+    }
+    for (const match of text2.matchAll(COMMAND)) {
+      const flags = match[2].trim();
+      const selector = flags.match(/^(?:--prefix|--dir|-C)(?:\s+|=)(.+)$/);
+      let directory = cwd;
+      let scopeUnknown;
+      if (shell && match.index !== 0 || match[3].startsWith("-")) scopeUnknown = "Unsupported shell wrapper or options before the script.";
+      if (selector) {
+        const selected = literal(selector[1]);
+        directory = selected === null || cwd === null ? null : path4.posix.join(cwd ?? ".", selected);
+      } else if (flags) scopeUnknown = "Unsupported package-manager options before run: " + flags;
+      const tail = text2.slice(match.index + match[0].length).split(/\s--(?:\s|$)/)[0];
+      if (/(?:^|\s)(?:--workspace(?:s)?|-w|--filter|-F|--prefix|--dir|-C|--if-present)(?:\s|=|$)/.test(tail)) {
+        scopeUnknown = "Package selection or conditional options after the script need review.";
+      }
+      if (/[|()]/.test(text2) || /\b(?:pushd|popd|if|for|while)\b/.test(text2) || directory === null) {
+        scopeUnknown = "The command's working directory or shell control flow could not be resolved.";
+      }
+      claims.push({
+        scriptName: match[3],
+        invocation: match[0],
+        excerpt: match[0],
+        line: lineNo,
+        ...directory !== void 0 && directory !== null ? { directory } : {},
+        ...scopeUnknown ? { scopeUnknown } : {}
+      });
+    }
+    if (/\b(?:cd|pushd|popd)\b/.test(text2)) cwd = null;
   }
-  return count3;
+  return { claims, cwd };
 }
-var init_test_map = __esm({
-  "src/test-map.ts"() {
+var TOKEN, COMMAND, literal;
+var init_commands = __esm({
+  "src/audit/commands.ts"() {
     "use strict";
-    init_files();
+    TOKEN = `(?:"[^"\\n]*"|'[^'\\n]*'|[^\\s\`;&|]+)`;
+    COMMAND = new RegExp(`\\b(npm|pnpm|yarn)((?:[ \\t]+${TOKEN})*?)[ \\t]+run[ \\t]+([A-Za-z0-9:_.-]+)`, "g");
+    literal = (value) => {
+      const unquoted = value.replace(/^(["'])(.*)\1$/, "$2");
+      return /[$`*?\[\]{}~\\\x00-\x1f]/.test(unquoted) || path4.posix.isAbsolute(unquoted) ? null : unquoted;
+    };
   }
 });
 
-// src/snapshot/snapshot.ts
-import path5 from "path";
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-import { z as z2 } from "zod";
-async function inspectSnapshot(rootDir) {
-  try {
-    const raw = await readStoreJson(rootDir, ".mason/snapshot.json");
-    const snapshot = raw === null ? null : snapshotSchema.parse(raw);
-    return { status: snapshot ? "available" : "missing", snapshot, diagnostics: [] };
-  } catch (error) {
-    return { status: "invalid", snapshot: null, diagnostics: [{
-      path: ".mason/snapshot.json",
-      message: error instanceof Error ? error.message : String(error)
-    }] };
+// src/audit/tree.ts
+function glyphIndex(line) {
+  for (const glyph of GLYPHS) {
+    const idx = line.indexOf(glyph);
+    if (idx !== -1) return idx;
   }
+  return -1;
 }
-async function getCurrentGitHash(rootDir) {
-  try {
-    const { stdout } = await exec2("git", ["rev-parse", "HEAD"], {
-      cwd: rootDir
+function isSpacerLine(line) {
+  return /^[\s│|]*$/.test(line);
+}
+function entryName(afterGlyph) {
+  let name = afterGlyph.replace(/^\s+/, "");
+  const hash2 = name.search(/\s+#/);
+  if (hash2 !== -1) name = name.slice(0, hash2);
+  const columns = name.search(/\s{2,}/);
+  if (columns !== -1) name = name.slice(0, columns);
+  name = name.trim();
+  if (!name || /\s/.test(name)) return null;
+  return name;
+}
+function extractTreeClaims(blockLines, blockStartLine) {
+  const glyphLines = blockLines.filter((l) => glyphIndex(l) !== -1).length;
+  if (glyphLines < MIN_GLYPH_LINES) return [];
+  const claims = [];
+  const stack = [];
+  let rootPrefix = "";
+  let started = false;
+  for (let i = 0; i < blockLines.length; i++) {
+    const line = blockLines[i];
+    const col = glyphIndex(line);
+    if (col === -1) {
+      if (isSpacerLine(line)) continue;
+      if (!started) {
+        const candidate = line.trim();
+        if (candidate.endsWith("/") && !/\s/.test(candidate)) {
+          rootPrefix = candidate.replace(/\/+$/, "");
+          claims.push({
+            path: rootPrefix,
+            line: blockStartLine + i,
+            excerpt: candidate
+          });
+        }
+        continue;
+      }
+      return claims;
+    }
+    started = true;
+    const name = entryName(line.slice(col + GLYPHS[0].length));
+    if (name === null) return claims;
+    while (stack.length > 0 && stack[stack.length - 1].col >= col) {
+      stack.pop();
+    }
+    const isDir = name.endsWith("/");
+    const cleanName = name.replace(/\/+$/, "");
+    const segments = [
+      ...rootPrefix ? [rootPrefix] : [],
+      ...stack.map((s) => s.name),
+      cleanName
+    ];
+    claims.push({
+      path: segments.join("/"),
+      line: blockStartLine + i,
+      excerpt: name
     });
-    return stdout.trim();
-  } catch {
-    return "unknown";
+    if (isDir) stack.push({ col, name: cleanName });
   }
-}
-var exec2, repoPath, verificationFields, featureSchema, flowSchema, snapshotSchema;
-var init_snapshot = __esm({
-  "src/snapshot/snapshot.ts"() {
-    "use strict";
-    init_files();
-    init_files();
-    init_storage();
-    init_paths();
-    init_test_map();
-    exec2 = promisify2(execFile2);
-    repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
-    verificationFields = {
-      refreshedHash: z2.string().optional(),
-      verifiedAt: z2.string().optional(),
-      verifiedHash: z2.string().optional(),
-      verificationFailed: z2.boolean().optional(),
-      verificationNote: z2.string().optional()
-    };
-    featureSchema = z2.object({
-      description: z2.string(),
-      files: z2.array(repoPath),
-      tests: z2.array(repoPath).optional(),
-      type: z2.enum(["capability", "infrastructure"]).optional(),
-      ...verificationFields
-    }).passthrough();
-    flowSchema = z2.object({ description: z2.string(), chain: z2.array(repoPath), ...verificationFields }).passthrough();
-    snapshotSchema = z2.object({
-      version: z2.literal(2),
-      createdAt: z2.string(),
-      updatedAt: z2.string(),
-      gitHash: z2.string(),
-      features: z2.record(featureSchema),
-      flows: z2.record(flowSchema)
-    }).passthrough();
-  }
-});
-
-// src/drift/drift.ts
-import fs3 from "fs/promises";
-import path6 from "path";
-import { execFile as execFile3 } from "child_process";
-import { promisify as promisify3 } from "util";
-function parseChanges(output) {
-  const fields = output.split("\0");
-  const changes = [];
-  for (let i = 0; i < fields.length && fields[i]; ) {
-    const code = fields[i++];
-    const first = fields[i++];
-    if (!first) break;
-    const second = /^[RC]/.test(code) ? fields[i++] : void 0;
-    const change = second ? code.startsWith("R") ? { status: "renamed", path: second, previousPath: first } : { status: "added", path: second } : { status: code === "A" ? "added" : code === "D" ? "deleted" : "modified", path: first };
-    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/"))) continue;
-    changes.push(change);
-  }
-  return changes;
-}
-function touchedPaths(changes) {
-  return [...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))].sort();
-}
-async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
-  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
-  try {
-    const { stdout } = await exec3("git", ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
-    return parseChanges(stdout);
-  } catch {
-    return null;
-  }
-}
-async function getWorkingTree(resolvedRoot) {
-  try {
-    const [diff, untracked] = await Promise.all([
-      exec3("git", ["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
-      exec3("git", ["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
-    ]);
-    const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
-    return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
-  } catch {
-    return { available: false, changedFiles: [], untrackedFiles: [] };
-  }
-}
-var exec3;
-var init_drift = __esm({
-  "src/drift/drift.ts"() {
-    "use strict";
-    init_snapshot();
-    init_paths();
-    exec3 = promisify3(execFile3);
-  }
-});
-
-// src/audit/tree.ts
-function glyphIndex(line) {
-  for (const glyph of GLYPHS) {
-    const idx = line.indexOf(glyph);
-    if (idx !== -1) return idx;
-  }
-  return -1;
-}
-function isSpacerLine(line) {
-  return /^[\s│|]*$/.test(line);
-}
-function entryName(afterGlyph) {
-  let name = afterGlyph.replace(/^\s+/, "");
-  const hash2 = name.search(/\s+#/);
-  if (hash2 !== -1) name = name.slice(0, hash2);
-  const columns = name.search(/\s{2,}/);
-  if (columns !== -1) name = name.slice(0, columns);
-  name = name.trim();
-  if (!name || /\s/.test(name)) return null;
-  return name;
-}
-function extractTreeClaims(blockLines, blockStartLine) {
-  const glyphLines = blockLines.filter((l) => glyphIndex(l) !== -1).length;
-  if (glyphLines < MIN_GLYPH_LINES) return [];
-  const claims = [];
-  const stack = [];
-  let rootPrefix = "";
-  let started = false;
-  for (let i = 0; i < blockLines.length; i++) {
-    const line = blockLines[i];
-    const col = glyphIndex(line);
-    if (col === -1) {
-      if (isSpacerLine(line)) continue;
-      if (!started) {
-        const candidate = line.trim();
-        if (candidate.endsWith("/") && !/\s/.test(candidate)) {
-          rootPrefix = candidate.replace(/\/+$/, "");
-          claims.push({
-            path: rootPrefix,
-            line: blockStartLine + i,
-            excerpt: candidate
-          });
-        }
-        continue;
-      }
-      return claims;
-    }
-    started = true;
-    const name = entryName(line.slice(col + GLYPHS[0].length));
-    if (name === null) return claims;
-    while (stack.length > 0 && stack[stack.length - 1].col >= col) {
-      stack.pop();
-    }
-    const isDir = name.endsWith("/");
-    const cleanName = name.replace(/\/+$/, "");
-    const segments = [
-      ...rootPrefix ? [rootPrefix] : [],
-      ...stack.map((s) => s.name),
-      cleanName
-    ];
-    claims.push({
-      path: segments.join("/"),
-      line: blockStartLine + i,
-      excerpt: name
-    });
-    if (isDir) stack.push({ col, name: cleanName });
-  }
-  return claims;
+  return claims;
 }
 var MIN_GLYPH_LINES, GLYPHS;
 var init_tree = __esm({
@@ -644,6 +508,7 @@ var init_tree = __esm({
 });
 
 // src/audit/claims.ts
+import MarkdownIt from "markdown-it";
 function normalizePathToken(token) {
   let t = token.trim();
   if (!t) return null;
@@ -707,11 +572,34 @@ function extractClaims(content2) {
   const counts = [];
   const commands = /* @__PURE__ */ new Map();
   const addPath = (claim) => {
-    if (!paths.has(claim.path)) paths.set(claim.path, claim);
+    const key = [claim.relativeTo ?? "scope", claim.path].join(":");
+    if (!paths.has(key)) paths.set(key, claim);
   };
   const addCommand = (claim) => {
-    if (!commands.has(claim.scriptName)) commands.set(claim.scriptName, claim);
+    const key = JSON.stringify([claim.scriptName, claim.directory, claim.scopeUnknown]);
+    if (!commands.has(key)) commands.set(key, claim);
   };
+  const parsed = markdown.parse(lines.map((line, i) => ignored[i] ? "" : line).join("\n"), {});
+  for (const token of parsed) {
+    if (token.type !== "inline" || !token.map) continue;
+    let line = token.map[0] + 1;
+    for (const child of token.children ?? []) {
+      const target = child.type === "link_open" ? child.attrGet("href") : child.type === "image" ? child.attrGet("src") : null;
+      if (target && !/^(?:[a-z][a-z0-9+.-]*:|[\/#~])/i.test(target)) {
+        let pathname = null;
+        try {
+          pathname = decodeURIComponent(target.split(/[?#]/)[0]);
+        } catch {
+        }
+        if (pathname && !/[$*?{}<>\\\x00-\x1f]/.test(pathname)) {
+          addPath({ path: pathname, line, excerpt: target, relativeTo: "document" });
+        }
+      }
+      if (child.type === "softbreak" || child.type === "hardbreak") line++;
+      else line += child.content.split("\n").length - 1;
+    }
+  }
+  let shellCwd;
   let inFence = false;
   let fenceInfo = "";
   let fenceMarker = "";
@@ -742,6 +630,7 @@ function extractClaims(content2) {
         fenceMarker = fenceMatch[1][0];
         fenceInfo = fenceMatch[2].trim().toLowerCase();
         blockLines = [];
+        shellCwd = void 0;
         blockStartLine = lineNo + 1;
       } else if (fenceMatch[1][0] === fenceMarker) {
         inFence = false;
@@ -752,14 +641,9 @@ function extractClaims(content2) {
     if (inFence) {
       blockLines.push(ignored[i] ? "" : line);
       if (!ignored[i] && SHELL_FENCE_INFOS.has(fenceInfo)) {
-        for (const m of line.matchAll(COMMAND_RE)) {
-          addCommand({
-            scriptName: m[2],
-            invocation: m[0],
-            line: lineNo,
-            excerpt: m[0]
-          });
-        }
+        const scanned = commandClaims(line, lineNo, shellCwd, true);
+        shellCwd = scanned.cwd;
+        for (const claim of scanned.claims) addCommand(claim);
       }
       continue;
     }
@@ -786,14 +670,10 @@ function extractClaims(content2) {
         excerpt: m[0]
       });
     }
-    for (const m of line.matchAll(COMMAND_RE)) {
-      addCommand({
-        scriptName: m[2],
-        invocation: m[0],
-        line: lineNo,
-        excerpt: m[0]
-      });
+    for (const match of line.matchAll(/`([^`]+)`/g)) {
+      for (const claim of commandClaims(match[1], lineNo, void 0, true).claims) addCommand(claim);
     }
+    for (const claim of commandClaims(line.replace(/`[^`]+`/g, ""), lineNo).claims) addCommand(claim);
   }
   if (inFence) processBlock();
   return {
@@ -802,10 +682,11 @@ function extractClaims(content2) {
     commands: [...commands.values()]
   };
 }
-var ROOT_FILE_NAMES, SHELL_FENCE_INFOS, COMMAND_RE, COUNT_RE, COUNT_DENYLIST_RE, IGNORE_LINE, IGNORE_START, IGNORE_END;
+var ROOT_FILE_NAMES, SHELL_FENCE_INFOS, markdown, COUNT_RE, COUNT_DENYLIST_RE, IGNORE_LINE, IGNORE_START, IGNORE_END;
 var init_claims = __esm({
   "src/audit/claims.ts"() {
     "use strict";
+    init_commands();
     init_tree();
     ROOT_FILE_NAMES = /* @__PURE__ */ new Set([
       "package.json",
@@ -839,7 +720,7 @@ var init_claims = __esm({
       ".env.example"
     ]);
     SHELL_FENCE_INFOS = /* @__PURE__ */ new Set(["", "bash", "sh", "shell", "console", "zsh"]);
-    COMMAND_RE = /\b(npm|pnpm|yarn)\s+run\s+([A-Za-z0-9:_.-]+)/g;
+    markdown = new MarkdownIt("commonmark", { html: false });
     COUNT_RE = /(\d+)\s+(modules?|packages?|workspaces?|crates?)\b/gi;
     COUNT_DENYLIST_RE = /^\s*(manager|registr|lock|json)/i;
     IGNORE_LINE = "<!-- mason:ignore -->";
@@ -849,8 +730,8 @@ var init_claims = __esm({
 });
 
 // src/audit/git.ts
-import { execFile as execFile4 } from "child_process";
-import { promisify as promisify4 } from "util";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
 function parseCommitLine(line) {
   const parts = line.split("	");
   if (parts.length < 3 || !parts[0]) return null;
@@ -858,9 +739,9 @@ function parseCommitLine(line) {
 }
 async function lastCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec4(
+    const { stdout } = await exec2(
       "git",
-      ["log", "-1", `--format=${COMMIT_FORMAT}`, "--", relPath],
+      ["log", "-1", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
       { cwd: resolvedRoot }
     );
     const line = stdout.trim().split("\n")[0];
@@ -871,7 +752,7 @@ async function lastCommitOf(resolvedRoot, relPath) {
 }
 async function deletingCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec4(
+    const { stdout } = await exec2(
       "git",
       [
         "log",
@@ -879,7 +760,7 @@ async function deletingCommitOf(resolvedRoot, relPath) {
         "--diff-filter=D",
         `--format=${COMMIT_FORMAT}`,
         "--",
-        relPath
+        `:(literal)${relPath}`
       ],
       { cwd: resolvedRoot }
     );
@@ -891,9 +772,9 @@ async function deletingCommitOf(resolvedRoot, relPath) {
 }
 async function firstCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec4(
+    const { stdout } = await exec2(
       "git",
-      ["log", "--reverse", `--format=${COMMIT_FORMAT}`, "--", relPath],
+      ["log", "--reverse", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
       { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
     );
     const line = stdout.trim().split("\n")[0];
@@ -905,7 +786,7 @@ async function firstCommitOf(resolvedRoot, relPath) {
 async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
   if (!fromHash || fromHash === "unknown") return null;
   try {
-    const { stdout } = await exec4(
+    const { stdout } = await exec2(
       "git",
       [
         "log",
@@ -927,67 +808,502 @@ async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
     }
     return { commits, total: commits.length };
   } catch {
-    return null;
+    return null;
+  }
+}
+var exec2, COMMIT_FORMAT;
+var init_git = __esm({
+  "src/audit/git.ts"() {
+    "use strict";
+    exec2 = promisify2(execFile2);
+    COMMIT_FORMAT = "%H%x09%cI%x09%s";
+  }
+});
+
+// src/audit/inputs.ts
+import fs4 from "fs/promises";
+import * as nativeFs from "fs";
+import path5 from "path";
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
+import fg2 from "fast-glob";
+async function auditInputPath(root, file) {
+  if (file === ".") return fs4.realpath(root);
+  try {
+    return await storePath(root, file);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Symlink")) {
+      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
+    }
+    throw error;
+  }
+}
+async function readAuditInput(root, file) {
+  try {
+    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
+    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
+    return value;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function auditGlob(root, patterns, options) {
+  if (Array.isArray(patterns) && !patterns.length) return [];
+  const directories = /* @__PURE__ */ new Set();
+  const readdir2 = ((directory, opts, callback) => {
+    const relative = path5.relative(root, directory).split(path5.sep).join("/") || ".";
+    directories.add(relative);
+    if (directories.size > MAX_INPUTS) {
+      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
+      return;
+    }
+    auditInputPath(root, relative).then(() => {
+      nativeFs.readdir(directory, opts, callback);
+    }, callback);
+  });
+  const lstat2 = ((file, callback) => {
+    const relative = path5.relative(root, file).split(path5.sep).join("/") || ".";
+    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
+  });
+  const stream = fg2.stream(patterns, {
+    cwd: root,
+    ignore: options.ignore,
+    onlyFiles: false,
+    onlyDirectories: options.onlyDirectories,
+    objectMode: true,
+    followSymbolicLinks: options.followSymbolicLinks ?? true,
+    fs: { readdir: readdir2, lstat: lstat2 },
+    concurrency: 16
+  });
+  const matches = [];
+  try {
+    for await (const value of stream) {
+      const entry = value;
+      const file = entry.path;
+      if (options.select && !options.select(file)) continue;
+      await auditInputPath(root, file);
+      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
+      matches.push(file);
+      if (matches.length > MAX_INPUTS) {
+        const largest = [...matches.reduce((counts, item) => {
+          const dir = item.split("/")[0];
+          counts.set(dir, (counts.get(dir) ?? 0) + 1);
+          return counts;
+        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
+        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count4]) => `${dir} (${count4})`).join(", ")}. Narrow this check's inputs.`);
+      }
+    }
+  } finally {
+    stream.destroy();
+  }
+  return matches.sort();
+}
+async function gitSourcePaths(root) {
+  const { stdout } = await execute(
+    "git",
+    [
+      "ls-files",
+      "-z",
+      "--cached",
+      "--others",
+      "--exclude-standard",
+      "--",
+      ...SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`)
+    ],
+    { cwd: root, maxBuffer: 32 * 1024 * 1024, timeout: 1e4 }
+  );
+  return [...new Set(stdout.split("\0").filter(Boolean))].sort();
+}
+async function gitIgnoredPaths(root, files) {
+  if (!files.length) return /* @__PURE__ */ new Set();
+  const operation = execute(
+    "git",
+    ["check-ignore", "-z", "--stdin"],
+    { cwd: root, maxBuffer: 4 * 1024 * 1024, timeout: 1e4 }
+  );
+  operation.child.stdin.on("error", () => {
+  });
+  operation.child.stdin.end(files.join("\0") + "\0");
+  try {
+    return new Set((await operation).stdout.split("\0").filter(Boolean));
+  } catch (error) {
+    if (error.code === 1) return /* @__PURE__ */ new Set();
+    throw error;
+  }
+}
+var execute, MAX_INPUTS;
+var init_inputs = __esm({
+  "src/audit/inputs.ts"() {
+    "use strict";
+    init_files();
+    init_storage();
+    execute = promisify3(execFile3);
+    MAX_INPUTS = 1e5;
+  }
+});
+
+// src/audit/docs.ts
+import fs5 from "fs/promises";
+import path6 from "path";
+import { execFile as execFile4 } from "child_process";
+import { promisify as promisify4 } from "util";
+import fg3 from "fast-glob";
+async function isDirty(resolvedRoot, relPath) {
+  try {
+    const { stdout } = await exec3(
+      "git",
+      ["status", "--porcelain", "--", `:(literal)${relPath}`],
+      { cwd: resolvedRoot }
+    );
+    return stdout.trim().length > 0;
+  } catch {
+    return true;
+  }
+}
+async function discoverDocPaths(root) {
+  let candidates = [];
+  try {
+    const { stdout } = await exec3(
+      "git",
+      [
+        "ls-files",
+        "-z",
+        "--cached",
+        "--others",
+        "--exclude-standard",
+        "--",
+        ":(icase,glob)**/readme.md",
+        ":(icase,glob)**/agents.md",
+        ":(icase,glob)**/claude.md"
+      ],
+      { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 }
+    );
+    candidates = stdout.split("\0").filter(Boolean);
+  } catch (error) {
+    try {
+      await exec3("git", ["rev-parse", "--git-dir"], { cwd: root });
+    } catch {
+      return localDocPaths(root);
+    }
+    throw error;
+  }
+  candidates.push(...await localDocPaths(root));
+  const config = await loadProjectConfig(root);
+  const excluded = [
+    "**/node_modules/**",
+    "**/vendor/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/target/**",
+    "**/.git/**",
+    "**/.venv/**",
+    "**/venv/**",
+    ".mason/**",
+    ...config.ignore ?? []
+  ];
+  const paths = [];
+  const unique = [...new Set(candidates)].sort();
+  for (let offset = 0; offset < unique.length; offset += 256) {
+    paths.push(...await auditGlob(root, unique.slice(offset, offset + 256).map((p) => fg3.escapePath(p)), {
+      ignore: excluded,
+      followSymbolicLinks: false,
+      label: "Documentation discovery"
+    }));
+    if (paths.length > 1e4) throw new Error("Documentation discovery exceeds 10,000 relevant files; narrow .mason/config.json ignore patterns.");
+  }
+  const priority2 = (file) => {
+    const index2 = DOC_CANDIDATES.findIndex((p) => p.toLowerCase() === file.toLowerCase());
+    return index2 < 0 ? DOC_CANDIDATES.length : index2;
+  };
+  return paths.sort((a, b) => priority2(a) - priority2(b) || a.localeCompare(b));
+}
+async function localDocPaths(root) {
+  const paths = [];
+  for (const dir of [".", ".claude"]) {
+    let entries;
+    try {
+      entries = await fs5.readdir(await auditInputPath(root, dir), { withFileTypes: true });
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      throw error;
+    }
+    for (const entry of entries) if (/^(?:agents|claude|readme)\.md$/i.test(entry.name)) {
+      paths.push(path6.posix.join(dir, entry.name));
+    }
+  }
+  return paths;
+}
+function documentScope(file) {
+  const parent = path6.posix.dirname(file);
+  return path6.posix.basename(parent).toLowerCase() === ".claude" ? path6.posix.dirname(parent) : parent;
+}
+async function discoverDocs(resolvedRoot) {
+  const docs = [];
+  for (const candidate of await discoverDocPaths(resolvedRoot)) {
+    const content2 = await readAuditInput(resolvedRoot, candidate);
+    if (content2 === null) throw new Error("Document disappeared during discovery: " + candidate);
+    const [lastCommit, dirty] = await Promise.all([lastCommitOf(resolvedRoot, candidate), isDirty(resolvedRoot, candidate)]);
+    docs.push({
+      path: candidate,
+      content: content2,
+      scope: documentScope(candidate),
+      kind: /^readme\.md$/i.test(path6.posix.basename(candidate)) ? "readme" : "instructions",
+      lineCount: content2.split("\n").length,
+      lastCommit,
+      dirty,
+      claims: extractClaims(content2)
+    });
+  }
+  return docs;
+}
+var exec3, DOC_CANDIDATES;
+var init_docs = __esm({
+  "src/audit/docs.ts"() {
+    "use strict";
+    init_claims();
+    init_git();
+    init_inputs();
+    init_files();
+    exec3 = promisify4(execFile4);
+    DOC_CANDIDATES = [
+      "AGENTS.md",
+      "CLAUDE.md",
+      ".claude/CLAUDE.md"
+    ];
+  }
+});
+
+// src/audit/scope.ts
+import fs6 from "fs/promises";
+import path7 from "path";
+function scopedPath(directory, value) {
+  if (path7.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value)) return null;
+  const resolved = path7.posix.normalize(path7.posix.join(directory, value));
+  return resolved === ".." || resolved.startsWith("../") ? null : resolved;
+}
+function pathClaimScope(doc, claim) {
+  const directory = claim.relativeTo === "document" ? path7.posix.dirname(doc) : documentScope(doc);
+  const local = scopedPath(directory, claim.path);
+  if (!local) return null;
+  const candidates = claim.relativeTo === "document" || directory === "." ? [local] : [...new Set([local, scopedPath(".", claim.path)].filter((p) => p !== null))];
+  return {
+    basis: claim.relativeTo === "document" ? "document-link" : directory === "." ? "repository" : "document",
+    directory,
+    candidates
+  };
+}
+async function pathExists(root, file) {
+  const absolute = await auditInputPath(root, file);
+  try {
+    await fs6.access(absolute);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+function optionalMasonPath(file) {
+  return file.split("/").includes(".mason");
+}
+var init_scope = __esm({
+  "src/audit/scope.ts"() {
+    "use strict";
+    init_inputs();
+    init_docs();
+  }
+});
+
+// src/test-map.ts
+import path8 from "path";
+async function buildTestMap(dir) {
+  const rootDir = path8.resolve(dir);
+  const access = await createFileAccess(rootDir);
+  const testPatterns = [
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/*Test.kt",
+    "**/*Test.java",
+    "**/*Tests.kt",
+    "**/*Tests.java",
+    "**/test_*.py",
+    "**/*_test.py",
+    "**/*_test.go",
+    "**/*Tests.swift",
+    "**/*Test.swift",
+    "**/*_test.rs"
+  ];
+  const testFiles = await access.list(testPatterns);
+  const sourceFiles = await access.list();
+  const sourceByBaseName = /* @__PURE__ */ new Map();
+  for (const file of sourceFiles) {
+    if (testFiles.includes(file)) continue;
+    const baseName = path8.basename(file).replace(/\.[^.]+$/, "");
+    const existing = sourceByBaseName.get(baseName) ?? [];
+    existing.push(file);
+    sourceByBaseName.set(baseName, existing);
+  }
+  const paired = [];
+  const unmatched = [];
+  for (const testFile of testFiles) {
+    const testBaseName = path8.basename(testFile).replace(/\.[^.]+$/, "");
+    const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
+    if (!sourceName) {
+      unmatched.push(testFile);
+      continue;
+    }
+    const candidates = sourceByBaseName.get(sourceName);
+    if (candidates && candidates.length > 0) {
+      const testDir = path8.dirname(testFile);
+      const bestMatch = candidates.reduce((best, candidate) => {
+        const candidateDir = path8.dirname(candidate);
+        const bestDir = path8.dirname(best);
+        const candidateOverlap = commonSegments(testDir, candidateDir);
+        const bestOverlap = commonSegments(testDir, bestDir);
+        return candidateOverlap > bestOverlap ? candidate : best;
+      });
+      paired.push({
+        test: testFile,
+        source: bestMatch,
+        confidence: candidates.length === 1 ? "exact" : "best-guess"
+      });
+    } else {
+      unmatched.push(testFile);
+    }
+  }
+  return { totalTestFiles: testFiles.length, paired, unmatched };
+}
+function commonSegments(pathA, pathB) {
+  const segsA = pathA.split("/");
+  const segsB = pathB.split("/");
+  let count4 = 0;
+  for (let i = 0; i < Math.min(segsA.length, segsB.length); i++) {
+    if (segsA[i] === segsB[i]) count4++;
+    else break;
+  }
+  return count4;
+}
+var init_test_map = __esm({
+  "src/test-map.ts"() {
+    "use strict";
+    init_files();
+  }
+});
+
+// src/snapshot/snapshot.ts
+import path9 from "path";
+import { execFile as execFile5 } from "child_process";
+import { promisify as promisify5 } from "util";
+import { z as z2 } from "zod";
+async function inspectSnapshot(rootDir) {
+  try {
+    const raw = await readStoreJson(rootDir, ".mason/snapshot.json");
+    const snapshot = raw === null ? null : snapshotSchema.parse(raw);
+    return { status: snapshot ? "available" : "missing", snapshot, diagnostics: [] };
+  } catch (error) {
+    return { status: "invalid", snapshot: null, diagnostics: [{
+      path: ".mason/snapshot.json",
+      message: error instanceof Error ? error.message : String(error)
+    }] };
+  }
+}
+async function getCurrentGitHash(rootDir) {
+  try {
+    const { stdout } = await exec4("git", ["rev-parse", "HEAD"], {
+      cwd: rootDir
+    });
+    return stdout.trim();
+  } catch {
+    return "unknown";
   }
 }
-var exec4, COMMIT_FORMAT;
-var init_git = __esm({
-  "src/audit/git.ts"() {
+var exec4, repoPath, verificationFields, featureSchema, flowSchema, snapshotSchema;
+var init_snapshot = __esm({
+  "src/snapshot/snapshot.ts"() {
     "use strict";
-    exec4 = promisify4(execFile4);
-    COMMIT_FORMAT = "%H%x09%cI%x09%s";
+    init_files();
+    init_files();
+    init_storage();
+    init_paths();
+    init_test_map();
+    exec4 = promisify5(execFile5);
+    repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
+    verificationFields = {
+      refreshedHash: z2.string().optional(),
+      verifiedAt: z2.string().optional(),
+      verifiedHash: z2.string().optional(),
+      verificationFailed: z2.boolean().optional(),
+      verificationNote: z2.string().optional()
+    };
+    featureSchema = z2.object({
+      description: z2.string(),
+      files: z2.array(repoPath),
+      tests: z2.array(repoPath).optional(),
+      type: z2.enum(["capability", "infrastructure"]).optional(),
+      ...verificationFields
+    }).passthrough();
+    flowSchema = z2.object({ description: z2.string(), chain: z2.array(repoPath), ...verificationFields }).passthrough();
+    snapshotSchema = z2.object({
+      version: z2.literal(2),
+      createdAt: z2.string(),
+      updatedAt: z2.string(),
+      gitHash: z2.string(),
+      features: z2.record(featureSchema),
+      flows: z2.record(flowSchema)
+    }).passthrough();
   }
 });
 
-// src/audit/docs.ts
-import fs4 from "fs/promises";
-import path7 from "path";
-import { execFile as execFile5 } from "child_process";
-import { promisify as promisify5 } from "util";
-async function isDirty(resolvedRoot, relPath) {
+// src/drift/drift.ts
+import fs7 from "fs/promises";
+import path10 from "path";
+import { execFile as execFile6 } from "child_process";
+import { promisify as promisify6 } from "util";
+function parseChanges(output) {
+  const fields = output.split("\0");
+  const changes = [];
+  for (let i = 0; i < fields.length && fields[i]; ) {
+    const code = fields[i++];
+    const first = fields[i++];
+    if (!first) break;
+    const second = /^[RC]/.test(code) ? fields[i++] : void 0;
+    const change = second ? code.startsWith("R") ? { status: "renamed", path: second, previousPath: first } : { status: "added", path: second } : { status: code === "A" ? "added" : code === "D" ? "deleted" : "modified", path: first };
+    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/"))) continue;
+    changes.push(change);
+  }
+  return changes;
+}
+function touchedPaths(changes) {
+  return [...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))].sort();
+}
+async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
+  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
   try {
-    const { stdout } = await exec5(
-      "git",
-      ["status", "--porcelain", "--", relPath],
-      { cwd: resolvedRoot }
-    );
-    return stdout.trim().length > 0;
+    const { stdout } = await exec5("git", ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
+    return parseChanges(stdout);
   } catch {
-    return false;
+    return null;
   }
 }
-async function discoverDocs(resolvedRoot) {
-  const docs = await Promise.all(DOC_CANDIDATES.map(async (candidate) => {
-    let content2;
-    try {
-      content2 = await fs4.readFile(path7.join(resolvedRoot, candidate), "utf-8");
-    } catch {
-      return null;
-    }
-    const [lastCommit, dirty] = await Promise.all([lastCommitOf(resolvedRoot, candidate), isDirty(resolvedRoot, candidate)]);
-    return {
-      path: candidate,
-      content: content2,
-      lineCount: content2.split("\n").length,
-      lastCommit,
-      dirty,
-      claims: extractClaims(content2)
-    };
-  }));
-  return docs.filter((doc) => doc !== null);
+async function getWorkingTree(resolvedRoot) {
+  try {
+    const [diff, untracked] = await Promise.all([
+      exec5("git", ["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
+      exec5("git", ["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
+    ]);
+    const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
+    return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
+  } catch {
+    return { available: false, changedFiles: [], untrackedFiles: [] };
+  }
 }
-var exec5, DOC_CANDIDATES;
-var init_docs = __esm({
-  "src/audit/docs.ts"() {
+var exec5;
+var init_drift = __esm({
+  "src/drift/drift.ts"() {
     "use strict";
-    init_claims();
-    init_git();
-    exec5 = promisify5(execFile5);
-    DOC_CANDIDATES = [
-      "AGENTS.md",
-      "CLAUDE.md",
-      ".claude/CLAUDE.md"
-    ];
+    init_snapshot();
+    init_paths();
+    exec5 = promisify6(execFile6);
   }
 });
 
@@ -1008,91 +1324,51 @@ var init_types = __esm({
 });
 
 // src/audit/checks/deleted-reference.ts
-import fs5 from "fs/promises";
-import path8 from "path";
-async function exists(absPath) {
-  try {
-    await fs5.access(absPath);
-    return true;
-  } catch {
-    return false;
-  }
-}
+import path11 from "path";
 async function checkDeletedReferences(ctx) {
   const result = emptyResult();
   for (const doc of ctx.docs) {
     const changes = ctx.changesSinceDoc.get(doc.path);
-    const renames = /* @__PURE__ */ new Map();
-    for (const change of changes ?? []) {
-      if (change.status === "renamed" && change.previousPath) {
-        renames.set(change.previousPath, change.path);
-      }
-    }
+    const renames = new Map((changes ?? []).filter((c) => c.status === "renamed" && c.previousPath).map((c) => [c.previousPath, c.path]));
     for (const claim of doc.claims.paths) {
-      if (claim.path === ".mason" || claim.path.startsWith(".mason/")) {
-        continue;
-      }
-      if (await exists(path8.join(ctx.root, claim.path))) continue;
-      const anchor = { doc: doc.path, line: claim.line, excerpt: claim.excerpt };
-      const renamedTo = renames.get(claim.path) ?? null;
-      if (renamedTo) {
-        result.issues.push({
-          type: "deleted-reference",
-          message: `\`${claim.path}\` was renamed to \`${renamedTo}\``,
-          anchor,
-          confidence: "certain",
-          evidence: {
-            kind: "missing-path",
-            claimed: claim.path,
-            renamedTo,
-            deletedInCommit: null,
-            everTracked: true,
-            parentDirExists: true
-          }
-        });
-        continue;
-      }
-      const tracked = await lastCommitOf(ctx.root, claim.path);
-      if (tracked) {
-        const deleted = await deletingCommitOf(ctx.root, claim.path);
-        const detail = deleted ? ` \u2013 deleted in ${deleted.hash.slice(0, 7)} "${deleted.subject}" (${deleted.date.slice(0, 10)})` : "";
-        result.issues.push({
-          type: "deleted-reference",
-          message: `\`${claim.path}\` no longer exists${detail}`,
-          anchor,
-          confidence: "certain",
-          evidence: {
-            kind: "missing-path",
-            claimed: claim.path,
-            renamedTo: null,
-            deletedInCommit: deleted,
-            everTracked: true,
-            parentDirExists: await exists(
-              path8.join(ctx.root, path8.dirname(claim.path))
-            )
-          }
+      const scope = pathClaimScope(doc.path, claim);
+      if (!scope) {
+        result.skipped.push({
+          check: "deleted-reference",
+          doc: doc.path,
+          reason: `Reference ${claim.excerpt} is outside the repository or has an unsupported path.`
         });
         continue;
       }
-      const parentDirExists = await exists(
-        path8.join(ctx.root, path8.dirname(claim.path))
-      );
-      if (!parentDirExists) continue;
-      const issue = {
-        type: "deleted-reference",
-        message: `\`${claim.path}\` does not exist (never tracked in git \u2013 possible typo or invented path)`,
-        anchor,
-        confidence: "likely",
-        evidence: {
-          kind: "missing-path",
-          claimed: claim.path,
-          renamedTo: null,
-          deletedInCommit: null,
-          everTracked: false,
-          parentDirExists: true
-        }
+      if (scope.candidates.some(optionalMasonPath)) continue;
+      if ((await Promise.all(scope.candidates.map((file) => pathExists(ctx.root, file)))).some(Boolean)) continue;
+      const candidates = await Promise.all(scope.candidates.map(async (file) => ({
+        file,
+        tracked: await lastCommitOf(ctx.root, file),
+        parent: await pathExists(ctx.root, path11.posix.dirname(file))
+      })));
+      const candidate = candidates.find((c) => c.tracked || renames.has(c.file)) ?? candidates.find((c) => c.parent);
+      if (!candidate && claim.relativeTo !== "document") continue;
+      const resolvedPath = candidate?.file ?? scope.candidates[0];
+      const renamedTo = renames.get(resolvedPath) ?? null;
+      const deletedInCommit = candidate?.tracked && !renamedTo ? await deletingCommitOf(ctx.root, resolvedPath) : null;
+      const evidence = {
+        kind: "missing-path",
+        claimed: claim.path,
+        resolvedPath,
+        scope,
+        renamedTo,
+        deletedInCommit,
+        everTracked: !!candidate?.tracked || !!renamedTo,
+        parentDirExists: candidate?.parent ?? false
       };
-      result.issues.push(issue);
+      const anchor = { doc: doc.path, line: claim.line, excerpt: claim.excerpt };
+      const message2 = renamedTo ? `\`${resolvedPath}\` was renamed to \`${renamedTo}\`` : `\`${resolvedPath}\` does not exist` + (deletedInCommit ? ` \u2013 deleted in ${deletedInCommit.hash.slice(0, 7)} "${deletedInCommit.subject}" (${deletedInCommit.date.slice(0, 10)})` : "");
+      if (scope.basis !== "document" && (renamedTo || candidate?.tracked)) {
+        result.issues.push({ type: "deleted-reference", message: message2, anchor, confidence: "certain", evidence });
+      } else {
+        result.advisories.push({ resolution: "recheck", type: "deleted-reference", message: message2 + (scope.basis === "document" ? "; the bare path's document/repository scope needs review." : "; no tracked history establishes it as a required file. Review for a typo, generated output, or example."), anchor, evidence });
+      }
     }
   }
   return result;
@@ -1100,138 +1376,16 @@ async function checkDeletedReferences(ctx) {
 var init_deleted_reference = __esm({
   "src/audit/checks/deleted-reference.ts"() {
     "use strict";
-    init_git();
-    init_checks();
-  }
-});
-
-// src/audit/inputs.ts
-import fs6 from "fs/promises";
-import * as nativeFs from "fs";
-import path9 from "path";
-import { execFile as execFile6 } from "child_process";
-import { promisify as promisify6 } from "util";
-import fg2 from "fast-glob";
-async function auditInputPath(root, file) {
-  if (file === ".") return fs6.realpath(root);
-  try {
-    return await storePath(root, file);
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith("Symlink")) {
-      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
-    }
-    throw error;
-  }
-}
-async function readAuditInput(root, file) {
-  try {
-    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
-    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
-    return value;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-async function auditGlob(root, patterns, options) {
-  if (Array.isArray(patterns) && !patterns.length) return [];
-  const directories = /* @__PURE__ */ new Set();
-  const readdir2 = ((directory, opts, callback) => {
-    const relative = path9.relative(root, directory).split(path9.sep).join("/") || ".";
-    directories.add(relative);
-    if (directories.size > MAX_INPUTS) {
-      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
-      return;
-    }
-    auditInputPath(root, relative).then(() => {
-      nativeFs.readdir(directory, opts, callback);
-    }, callback);
-  });
-  const lstat2 = ((file, callback) => {
-    const relative = path9.relative(root, file).split(path9.sep).join("/") || ".";
-    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
-  });
-  const stream = fg2.stream(patterns, {
-    cwd: root,
-    ignore: options.ignore,
-    onlyFiles: false,
-    onlyDirectories: options.onlyDirectories,
-    objectMode: true,
-    followSymbolicLinks: options.followSymbolicLinks ?? true,
-    fs: { readdir: readdir2, lstat: lstat2 },
-    concurrency: 16
-  });
-  const matches = [];
-  try {
-    for await (const value of stream) {
-      const entry = value;
-      const file = entry.path;
-      if (options.select && !options.select(file)) continue;
-      await auditInputPath(root, file);
-      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
-      matches.push(file);
-      if (matches.length > MAX_INPUTS) {
-        const largest = [...matches.reduce((counts, item) => {
-          const dir = item.split("/")[0];
-          counts.set(dir, (counts.get(dir) ?? 0) + 1);
-          return counts;
-        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
-        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count3]) => `${dir} (${count3})`).join(", ")}. Narrow this check's inputs.`);
-      }
-    }
-  } finally {
-    stream.destroy();
-  }
-  return matches.sort();
-}
-async function gitSourcePaths(root) {
-  const { stdout } = await execute(
-    "git",
-    [
-      "ls-files",
-      "-z",
-      "--cached",
-      "--others",
-      "--exclude-standard",
-      "--",
-      ...SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`)
-    ],
-    { cwd: root, maxBuffer: 32 * 1024 * 1024, timeout: 1e4 }
-  );
-  return [...new Set(stdout.split("\0").filter(Boolean))].sort();
-}
-async function gitIgnoredPaths(root, files) {
-  if (!files.length) return /* @__PURE__ */ new Set();
-  const operation = execute(
-    "git",
-    ["check-ignore", "-z", "--stdin"],
-    { cwd: root, maxBuffer: 4 * 1024 * 1024, timeout: 1e4 }
-  );
-  operation.child.stdin.on("error", () => {
-  });
-  operation.child.stdin.end(files.join("\0") + "\0");
-  try {
-    return new Set((await operation).stdout.split("\0").filter(Boolean));
-  } catch (error) {
-    if (error.code === 1) return /* @__PURE__ */ new Set();
-    throw error;
-  }
-}
-var execute, MAX_INPUTS;
-var init_inputs = __esm({
-  "src/audit/inputs.ts"() {
-    "use strict";
-    init_files();
-    init_storage();
-    execute = promisify6(execFile6);
-    MAX_INPUTS = 1e5;
+    init_git();
+    init_scope();
+    init_checks();
   }
 });
 
 // src/audit/checks/new-module.ts
-import fg3 from "fast-glob";
-import fs7 from "fs/promises";
-import path10 from "path";
+import fg4 from "fast-glob";
+import fs8 from "fs/promises";
+import path12 from "path";
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -1245,15 +1399,15 @@ function isMentioned(combinedDocs, name) {
 async function checkNewModules(ctx) {
   const result = emptyResult();
   if (ctx.docs.length === 0) return result;
-  const combinedDocs = ctx.docs.map((d) => d.content).join("\n");
+  const combinedDocs = moduleDocumentation(ctx.docs);
   const primaryDoc = ctx.docs[0].path;
   const checkedDocs = ctx.docs.map((d) => d.path);
   const flag = async (dir, sourceFileCount) => {
-    result.issues.push({
+    result.advisories.push({
+      resolution: "recheck",
       type: "new-module",
-      message: `directory \`${dir}/\` contains ${sourceFileCount} source file${sourceFileCount === 1 ? "" : "s"} but is not mentioned in any context file`,
+      message: `directory \`${dir}/\` contains ${sourceFileCount} source file${sourceFileCount === 1 ? "" : "s"} but is not mentioned in the discovered documentation; review whether it needs documenting`,
       anchor: { doc: primaryDoc, line: null, excerpt: dir },
-      confidence: "likely",
       evidence: {
         kind: "unmentioned-dir",
         dir,
@@ -1268,41 +1422,44 @@ async function checkNewModules(ctx) {
   }
   return result;
 }
+function moduleDocumentation(docs) {
+  return docs.map((doc) => doc.content + "\n" + (path12.posix.dirname(doc.path) === "." ? "" : path12.posix.dirname(doc.path) + "/")).join("\n");
+}
 async function moduleCandidates(root, combinedDocs) {
   const [config, sourcePaths] = await Promise.all([loadProjectConfig(root), gitSourcePaths(root)]);
   const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
   const sources = sourcePaths.filter((file) => !file.split("/").some((part) => part.startsWith(".")));
   const listSubdirs = async (dir) => {
-    const entries = await fs7.readdir(await auditInputPath(root, dir), { withFileTypes: true });
-    const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path10.posix.join(dir, entry.name));
+    const entries = await fs8.readdir(await auditInputPath(root, dir), { withFileTypes: true });
+    const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink() && sources.some((file) => file.startsWith(path12.posix.join(dir, entry.name) + "/"))) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path12.posix.join(dir, entry.name));
     const ignored = await gitIgnoredPaths(root, dirs);
     const visible = new Set(dirs.filter((dir2) => !ignored.has(dir2) || sources.some((file) => file.startsWith(dir2 + "/"))));
-    return (await auditGlob(root, dir === "." ? "*" : `${fg3.escapePath(dir)}/*`, {
+    return (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
       ignore,
       onlyDirectories: true,
       label: "Module directory discovery",
       select: (file) => visible.has(file)
-    })).map((file) => path10.posix.basename(file));
+    })).map((file) => path12.posix.basename(file));
   };
   const countSourceFiles = async (dir) => {
     const files = sources.filter((file) => file.startsWith(dir + "/"));
-    let count3 = 0;
+    let count4 = 0;
     for (let offset = 0; offset < files.length; offset += 256) {
-      count3 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg3.escapePath(file)), {
+      count4 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg4.escapePath(file)), {
         ignore,
         followSymbolicLinks: false,
         label: `Source discovery in ${dir}`
       })).length;
-      if (count3 > 1e5) throw new Error(`Source discovery in ${dir} exceeds 100,000 relevant files. Exclude generated source with .mason/config.json ignore patterns or narrow this audit's checks.`);
+      if (count4 > 1e5) throw new Error(`Source discovery in ${dir} exceeds 100,000 relevant files. Exclude generated source with .mason/config.json ignore patterns or narrow this audit's checks.`);
     }
-    return count3;
+    return count4;
   };
   const candidates = [];
   for (const topDir of await listSubdirs(".")) {
     const topMentioned = isMentioned(combinedDocs, topDir);
     if (!topMentioned) {
-      const count3 = await countSourceFiles(topDir);
-      if (count3 >= 1) candidates.push({ dir: topDir, sourceFileCount: count3 });
+      const count4 = await countSourceFiles(topDir);
+      if (count4 >= 1) candidates.push({ dir: topDir, sourceFileCount: count4 });
       continue;
     }
     const subdirs = await listSubdirs(topDir);
@@ -1310,9 +1467,9 @@ async function moduleCandidates(root, combinedDocs) {
     if (mentioned.length < ENUMERATION_THRESHOLD) continue;
     for (const sub of subdirs) {
       if (isMentioned(combinedDocs, sub)) continue;
-      const count3 = await countSourceFiles(`${topDir}/${sub}`);
-      if (count3 >= SECOND_LEVEL_MIN_SOURCE_FILES) {
-        candidates.push({ dir: `${topDir}/${sub}`, sourceFileCount: count3 });
+      const count4 = await countSourceFiles(`${topDir}/${sub}`);
+      if (count4 >= SECOND_LEVEL_MIN_SOURCE_FILES) {
+        candidates.push({ dir: `${topDir}/${sub}`, sourceFileCount: count4 });
       }
     }
   }
@@ -1351,7 +1508,7 @@ var init_new_module = __esm({
 });
 
 // src/audit/checks/stale-count.ts
-import path11 from "path";
+import path13 from "path";
 async function countGradleModules(root) {
   for (const name of ["settings.gradle.kts", "settings.gradle"]) {
     const content2 = await readAuditInput(root, name);
@@ -1385,7 +1542,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "package.json workspaces",
-        members: matched.map((m) => path11.dirname(m)).sort()
+        members: matched.map((m) => path13.dirname(m)).sort()
       };
     }
   }
@@ -1416,7 +1573,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "pnpm-workspace.yaml",
-        members: matched.map((m) => path11.dirname(m)).sort()
+        members: matched.map((m) => path13.dirname(m)).sort()
       };
     }
   }
@@ -1438,8 +1595,8 @@ async function countCargoCrates(root) {
         ignore: ["**/target/**"],
         label: "Cargo workspace discovery"
       });
-      for (const m of matched) members.add(path11.dirname(m));
-    } else if (await readAuditInput(root, path11.posix.join(entry, "Cargo.toml")) !== null) {
+      for (const m of matched) members.add(path13.dirname(m));
+    } else if (await readAuditInput(root, path13.posix.join(entry, "Cargo.toml")) !== null) {
       members.add(entry);
     }
   }
@@ -1457,11 +1614,21 @@ async function resolveCountSource(root, claim) {
   if (unit === "crate") return countCargoCrates(root);
   return await countNpmWorkspaces(root) ?? await countCargoCrates(root) ?? await countGradleModules(root);
 }
+async function resolveDocCountSource(root, doc, claim) {
+  const scope = documentScope(doc);
+  const source = await resolveCountSource(path13.join(root, scope), claim);
+  if (!source || scope === ".") return source;
+  return {
+    ...source,
+    countedFrom: scope + "/" + source.countedFrom,
+    members: source.members.map((member) => scope + "/" + member)
+  };
+}
 async function checkStaleCounts(ctx) {
   const result = emptyResult();
   for (const doc of ctx.docs) {
     for (const claim of doc.claims.counts) {
-      const source = await resolveCountSource(ctx.root, claim);
+      const source = await resolveDocCountSource(ctx.root, doc.path, claim);
       if (source === null) {
         result.skipped.push({
           check: "stale-count",
@@ -1493,6 +1660,7 @@ var MEMBERS_CAP;
 var init_stale_count = __esm({
   "src/audit/checks/stale-count.ts"() {
     "use strict";
+    init_docs();
     init_inputs();
     init_checks();
     MEMBERS_CAP = 50;
@@ -1500,61 +1668,94 @@ var init_stale_count = __esm({
 });
 
 // src/audit/checks/dead-command.ts
-async function scriptsOf(root, manifest) {
-  const raw = await readAuditInput(root, manifest);
-  if (raw === null) return null;
+import path14 from "path";
+function scriptsOf(raw) {
   try {
     const pkg = JSON.parse(raw);
-    return pkg && typeof pkg.scripts === "object" && pkg.scripts !== null ? Object.keys(pkg.scripts) : [];
+    if (!pkg || typeof pkg !== "object" || Array.isArray(pkg)) return null;
+    if (pkg.scripts === void 0) return [];
+    return pkg.scripts && typeof pkg.scripts === "object" && !Array.isArray(pkg.scripts) && Object.values(pkg.scripts).every((value) => typeof value === "string") ? Object.keys(pkg.scripts) : null;
   } catch {
     return null;
   }
 }
+async function commandInputs(root, docs) {
+  const contents = /* @__PURE__ */ new Map();
+  const read = async (file) => {
+    if (!contents.has(file)) contents.set(file, await readAuditInput(root, file));
+    return contents.get(file);
+  };
+  await read("package.json");
+  let inventory;
+  const resolutions = [];
+  for (const doc of docs) for (const claim of doc.claims.commands) {
+    const base = documentScope(doc.path);
+    const directory = scopedPath(base, claim.directory ?? ".");
+    const scope = {
+      basis: claim.directory === void 0 ? "document" : "explicit",
+      directory: directory ?? base,
+      candidates: []
+    };
+    const resolution = { doc: doc.path, claim, scope, manifest: null, scripts: [], elsewhere: [] };
+    resolutions.push(resolution);
+    if (claim.scopeUnknown || directory === null) {
+      resolution.problem = claim.scopeUnknown ?? "The command's directory leaves the repository.";
+      continue;
+    }
+    let cursor = directory;
+    while (true) {
+      const manifest = path14.posix.join(cursor, "package.json");
+      scope.candidates.push(manifest);
+      const raw = await read(manifest);
+      if (raw !== null) {
+        resolution.manifest = manifest;
+        const scripts = scriptsOf(raw);
+        if (scripts === null) resolution.problem = "Invalid package manifest: " + manifest;
+        else resolution.scripts = scripts;
+        break;
+      }
+      if (claim.directory !== void 0 || cursor === ".") break;
+      cursor = path14.posix.dirname(cursor);
+    }
+    if (!resolution.manifest && !resolution.problem) {
+      resolution.problem = `No package.json for the command's scope (${directory}).`;
+    }
+    if (resolution.problem || resolution.scripts.includes(claim.scriptName) || claim.directory !== void 0) continue;
+    inventory ??= await commandManifests(root);
+    for (const manifest of [.../* @__PURE__ */ new Set(["package.json", ...inventory])].sort()) {
+      if (scope.candidates.includes(manifest)) continue;
+      scope.candidates.push(manifest);
+      const raw = await read(manifest);
+      if (raw === null) continue;
+      const scripts = scriptsOf(raw);
+      if (scripts === null) resolution.problem = "Cannot establish script availability: invalid manifest " + manifest;
+      else if (scripts.includes(claim.scriptName)) resolution.elsewhere.push(manifest);
+    }
+  }
+  return { manifests: [...contents].sort(([a], [b]) => a.localeCompare(b)), resolutions };
+}
 async function checkDeadCommands(ctx) {
   const result = emptyResult();
-  const commandClaims = ctx.docs.flatMap(
-    (doc) => doc.claims.commands.map((claim) => ({ doc, claim }))
-  );
-  if (commandClaims.length === 0) return result;
-  const rootScripts = await scriptsOf(ctx.root, "package.json");
-  if (rootScripts === null) {
-    result.skipped.push({
-      check: "dead-command",
-      reason: "no package.json at the repo root"
-    });
-    return result;
-  }
-  const rootSet = new Set(rootScripts);
-  let workspaceScripts = null;
-  let manifestsChecked = ["package.json"];
-  const loadWorkspaceScripts = async () => {
-    if (workspaceScripts !== null) return workspaceScripts;
-    workspaceScripts = /* @__PURE__ */ new Set();
-    const manifests = await commandManifests(ctx.root);
-    manifestsChecked = ["package.json", ...manifests.sort()];
-    for (const manifest of manifests) {
-      const scripts = await scriptsOf(ctx.root, manifest);
-      for (const name of scripts ?? []) workspaceScripts.add(name);
+  const { resolutions } = await commandInputs(ctx.root, ctx.docs);
+  for (const { doc, claim, scope, scripts, elsewhere, problem, manifest } of resolutions) {
+    if (problem) {
+      result.skipped.push({ check: "dead-command", doc, reason: problem });
+      continue;
     }
-    return workspaceScripts;
-  };
-  for (const { doc, claim } of commandClaims) {
-    if (rootSet.has(claim.scriptName)) continue;
-    const elsewhere = await loadWorkspaceScripts();
-    if (elsewhere.has(claim.scriptName)) continue;
-    result.issues.push({
-      type: "dead-command",
-      message: `\`${claim.invocation}\` refers to script "${claim.scriptName}", which exists in no package.json`,
-      anchor: { doc: doc.path, line: claim.line, excerpt: claim.excerpt },
-      confidence: "certain",
-      evidence: {
-        kind: "missing-script",
-        scriptName: claim.scriptName,
-        invocation: claim.invocation,
-        manifestsChecked,
-        availableScripts: rootScripts.slice(0, AVAILABLE_SCRIPTS_CAP)
-      }
-    });
+    if (scripts.includes(claim.scriptName)) continue;
+    const evidence = {
+      kind: "missing-script",
+      scriptName: claim.scriptName,
+      invocation: claim.invocation,
+      manifestsChecked: scope.candidates,
+      availableScripts: scripts.slice(0, AVAILABLE_SCRIPTS_CAP),
+      scope
+    };
+    const anchor = { doc, line: claim.line, excerpt: claim.excerpt };
+    const message2 = `\`${claim.invocation}\` names script "${claim.scriptName}", which is absent from ${manifest}`;
+    const certain = documentScope(doc) === "." && (scope.basis === "explicit" || !elsewhere.length);
+    if (certain) result.issues.push({ type: "dead-command", message: message2, anchor, confidence: "certain", evidence });
+    else result.advisories.push({ resolution: "recheck", type: "dead-command", message: message2 + (elsewhere.length ? `; it exists in ${elsewhere.join(", ")}. Clarify the intended working directory.` : "; the intended working directory needs review."), anchor, evidence });
   }
   return result;
 }
@@ -1569,6 +1770,8 @@ var init_dead_command = __esm({
   "src/audit/checks/dead-command.ts"() {
     "use strict";
     init_inputs();
+    init_docs();
+    init_scope();
     init_checks();
     AVAILABLE_SCRIPTS_CAP = 30;
   }
@@ -1582,13 +1785,13 @@ async function git(root, args2) {
 }
 function withoutAndroidReleaseValues(text2) {
   if (/\/\*|"""|'''/.test(text2) || !/id\s*\(?\s*["']com\.android\.(application|library)["']/.test(text2)) return null;
-  const scopes = [];
+  const scopes2 = [];
   const normalized = [];
   let assignments = 0;
   for (const line of text2.split("\n")) {
     const code = line.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\/\/.*$/g, (token) => token.startsWith("//") ? "" : '""');
     const assignment = line.match(/^(\s*)(versionName|versionCode)(\s*(?:=\s*|\s+))("[A-Za-z0-9._+-]+"|'[A-Za-z0-9._+-]+'|\d+)(\s*)$/);
-    if (assignment && scopes.join("/") === "android/defaultConfig" && (assignment[2] === "versionCode" ? /^\d+$/.test(assignment[4]) : /^["']/.test(assignment[4]))) {
+    if (assignment && scopes2.join("/") === "android/defaultConfig" && (assignment[2] === "versionCode" ? /^\d+$/.test(assignment[4]) : /^["']/.test(assignment[4]))) {
       normalized.push(assignment[1] + assignment[2] + assignment[3] + "<release-value>" + assignment[5]);
       assignments++;
     } else {
@@ -1597,12 +1800,12 @@ function withoutAndroidReleaseValues(text2) {
     }
     const named = code.match(/^\s*(android|defaultConfig)\s*\{\s*$/)?.[1];
     for (const brace of code.matchAll(/[{}]/g)) {
-      if (brace[0] === "{") scopes.push(named ?? "unknown");
-      else if (!scopes.length) return null;
-      else scopes.pop();
+      if (brace[0] === "{") scopes2.push(named ?? "unknown");
+      else if (!scopes2.length) return null;
+      else scopes2.pop();
     }
   }
-  return assignments && !scopes.length ? normalized.join("\n") : null;
+  return assignments && !scopes2.length ? normalized.join("\n") : null;
 }
 async function releaseMetadataOnly(root, commit) {
   if (!commit.files.length || !commit.files.every((file) => /(^|\/)build\.gradle(?:\.kts)?$/.test(file))) return false;
@@ -1633,6 +1836,12 @@ var init_release_metadata = __esm({
 });
 
 // src/audit/checks/deps-changed.ts
+function manifestPathspecs(doc) {
+  const scope = documentScope(doc);
+  if (scope === ".") return MANIFEST_PATHSPECS;
+  const escaped = scope.replace(/[\\*?\[\]]/g, "\\$&");
+  return MANIFEST_PATHSPECS.map((spec) => spec.startsWith(":(glob)") ? ":(glob)" + escaped + "/" + spec.slice(":(glob)".length) : ":(literal)" + scope + "/" + spec);
+}
 async function checkDepsChanged(ctx) {
   const result = emptyResult();
   result.suppressedAdvisories = [];
@@ -1656,7 +1865,7 @@ async function checkDepsChanged(ctx) {
     const range = await commitsTouchingSince(
       ctx.root,
       doc.lastCommit.hash,
-      MANIFEST_PATHSPECS
+      manifestPathspecs(doc.path)
     );
     if (range === null) {
       result.skipped.push({
@@ -1695,6 +1904,7 @@ var MANIFEST_COMMITS_CAP, MANIFEST_PATHSPECS;
 var init_deps_changed = __esm({
   "src/audit/checks/deps-changed.ts"() {
     "use strict";
+    init_docs();
     init_release_metadata();
     init_git();
     init_checks();
@@ -1717,7 +1927,7 @@ var init_deps_changed = __esm({
 });
 
 // src/context/lexical.ts
-import path12 from "path";
+import path15 from "path";
 var init_lexical = __esm({
   "src/context/lexical.ts"() {
     "use strict";
@@ -1900,15 +2110,16 @@ var init_provenance = __esm({
 });
 
 // src/decisions/decisions.ts
-import fs8 from "fs/promises";
-import path13 from "path";
+import fs9 from "fs/promises";
+import path16 from "path";
 import { createHash } from "crypto";
+import { z as z4 } from "zod";
 async function loadDecisionStore(rootDir) {
   const records = [];
   const diagnostics = [];
   let entries;
   try {
-    entries = await fs8.readdir(await storePath(rootDir, ".mason/decisions"));
+    entries = await fs9.readdir(await storePath(rootDir, ".mason/decisions"));
   } catch (error) {
     if (error.code !== "ENOENT") diagnostics.push({ path: ".mason/decisions", message: String(error) });
     return { records, diagnostics };
@@ -1926,6 +2137,7 @@ async function loadDecisionStore(rootDir) {
   }
   return { records, diagnostics };
 }
+var TITLE_MAX_CHARS, BODY_RECOMMENDED_CHARS, BODY_MAX_CHARS, boundedText, decisionTitleSchema, decisionBodySchema;
 var init_decisions = __esm({
   "src/decisions/decisions.ts"() {
     "use strict";
@@ -1934,13 +2146,25 @@ var init_decisions = __esm({
     init_snapshot();
     init_lexical();
     init_provenance();
+    TITLE_MAX_CHARS = 80;
+    BODY_RECOMMENDED_CHARS = 1500;
+    BODY_MAX_CHARS = 2500;
+    boundedText = (field, max, hint) => z4.string({
+      errorMap: (issue, ctx) => ({ message: issue.code === "too_big" ? `${field} has ${ctx.data.length} characters; maximum is ${max} (${ctx.data.length - max} over). ${hint}` : ctx.defaultError })
+    }).trim().min(1, `${field} must be non-empty`).max(max);
+    decisionTitleSchema = boundedText("title", TITLE_MAX_CHARS, "Tighten it to a specific headline.");
+    decisionBodySchema = boundedText(
+      "body",
+      BODY_MAX_CHARS,
+      `Aim for ${BODY_RECOMMENDED_CHARS} characters or fewer. Preserve the rule, reason, and exceptions; put supporting references in sources.`
+    );
   }
 });
 
 // src/decisions/drift.ts
-import path14 from "path";
+import path17 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path14.resolve(rootDir);
+  const resolvedRoot = path17.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
   const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
   const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
@@ -2056,11 +2280,303 @@ var init_checks = __esm({
   }
 });
 
+// src/audit/findings.ts
+import { createHash as createHash2 } from "crypto";
+import { z as z5 } from "zod";
+function findingId(finding) {
+  const e = finding.evidence;
+  let key;
+  switch (e.kind) {
+    case "missing-path":
+      key = e.resolvedPath && e.resolvedPath !== e.claimed ? [e.claimed, e.resolvedPath] : e.claimed;
+      break;
+    case "unmentioned-dir":
+      key = e.dir;
+      break;
+    case "count-mismatch":
+      key = [e.unit.replace(/s$/, ""), e.countedFrom];
+      break;
+    case "missing-script":
+      key = e.scope && e.scope.directory !== "." ? [e.scriptName, e.scope.directory] : e.scriptName;
+      break;
+    case "doc-behind-manifests":
+      key = null;
+      break;
+    case "decision-anchor":
+      key = [e.decisionId, e.provenance?.revision, e.provenance?.approval];
+      break;
+  }
+  return digest([finding.type, finding.anchor.doc, key]);
+}
+var digest, checkSchema, commitSchema, anchorSchema, count, scopeSchema, evidenceSchema, findingSchema, issueSchema, advisorySchema, checkResultSchema;
+var init_findings = __esm({
+  "src/audit/findings.ts"() {
+    "use strict";
+    digest = (value) => createHash2("sha256").update(JSON.stringify(value)).digest("hex");
+    checkSchema = z5.enum(["deleted-reference", "new-module", "stale-count", "dead-command", "deps-changed", "decision-anchor-drift"]);
+    commitSchema = z5.object({ hash: z5.string().regex(/^[a-f0-9]{40,64}$/), date: z5.string(), subject: z5.string() });
+    anchorSchema = z5.object({ doc: z5.string(), line: z5.number().int().positive().nullable(), excerpt: z5.string().nullable() });
+    count = z5.number().int().nonnegative();
+    scopeSchema = z5.object({
+      basis: z5.enum(["repository", "document", "document-link", "explicit"]),
+      directory: z5.string(),
+      candidates: z5.array(z5.string())
+    });
+    evidenceSchema = z5.discriminatedUnion("kind", [
+      z5.object({
+        kind: z5.literal("missing-path"),
+        claimed: z5.string(),
+        renamedTo: z5.string().nullable(),
+        deletedInCommit: commitSchema.nullable(),
+        everTracked: z5.boolean(),
+        parentDirExists: z5.boolean(),
+        resolvedPath: z5.string().optional(),
+        scope: scopeSchema.optional()
+      }),
+      z5.object({
+        kind: z5.literal("unmentioned-dir"),
+        dir: z5.string(),
+        sourceFileCount: count,
+        firstCommit: commitSchema.nullable(),
+        checkedDocs: z5.array(z5.string())
+      }),
+      z5.object({
+        kind: z5.literal("count-mismatch"),
+        claimed: count,
+        actual: count,
+        unit: z5.string(),
+        countedFrom: z5.string(),
+        members: z5.array(z5.string())
+      }),
+      z5.object({
+        kind: z5.literal("missing-script"),
+        scriptName: z5.string(),
+        invocation: z5.string(),
+        manifestsChecked: z5.array(z5.string()),
+        availableScripts: z5.array(z5.string()),
+        scope: scopeSchema.optional()
+      }),
+      z5.object({
+        kind: z5.literal("doc-behind-manifests"),
+        docLastCommit: commitSchema,
+        manifestCommits: z5.array(commitSchema.extend({ files: z5.array(z5.string()) })),
+        totalCommits: count
+      }),
+      z5.object({
+        kind: z5.literal("decision-anchor"),
+        decisionId: z5.string(),
+        title: z5.string(),
+        changedFiles: z5.array(z5.string()),
+        refreshedHash: z5.string(),
+        provenance: z5.object({}).passthrough().optional()
+      })
+    ]);
+    findingSchema = z5.object({ message: z5.string(), anchor: anchorSchema, evidence: evidenceSchema });
+    issueSchema = findingSchema.extend({
+      type: z5.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
+      confidence: z5.enum(["certain", "likely"])
+    });
+    advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z5.literal("recheck").optional() });
+    checkResultSchema = z5.object({
+      issues: z5.array(issueSchema),
+      advisories: z5.array(advisorySchema),
+      suppressedAdvisories: z5.array(advisorySchema).optional(),
+      skipped: z5.array(z5.object({ check: z5.string(), reason: z5.string(), doc: z5.string().optional() }))
+    });
+  }
+});
+
+// src/audit/advisory-review.ts
+import fs10 from "fs/promises";
+import { execFile as execFile8 } from "child_process";
+import { promisify as promisify8 } from "util";
+import { z as z6 } from "zod";
+async function readRecord(root, id) {
+  const raw = await readStoreJson(root, recordPath(id));
+  if (raw === null) return null;
+  const record = recordSchema.parse(raw);
+  const { digest: stored, ...payload } = record;
+  if (record.id !== id || digest(payload) !== stored || record.events.some((event) => findingId(event.finding) !== id || event.evidence.fingerprint !== digest([event.evidence.scope, event.evidence.tree, event.evidence.lastScopeCommit, event.evidence.paths]))) {
+    throw new Error("Advisory review record is inconsistent or modified; inspect its history.");
+  }
+  return record;
+}
+function scopes(finding) {
+  const files = [finding.anchor.doc], e = finding.evidence;
+  if (e.kind === "decision-anchor") throw new Error("Use review_decision for decision acceptance, reaffirmation or retirement.");
+  if (e.kind === "doc-behind-manifests") return [`:(literal)${finding.anchor.doc}`, ...manifestPathspecs(finding.anchor.doc)];
+  if (e.kind === "missing-path") files.push(...e.scope?.candidates ?? [e.resolvedPath ?? e.claimed]);
+  else if (e.kind === "missing-script") files.push(...e.manifestsChecked, ...e.scope?.candidates ?? []);
+  else if (e.kind === "unmentioned-dir") files.push(e.dir, ...e.checkedDocs);
+  else throw new Error("This advisory has no supported review scope.");
+  return [...new Set(files)].map((file) => {
+    if (normalizeRepoPath(file) !== file) throw new Error("Advisory contains an invalid scoped path: " + file);
+    return `:(literal)${file}`;
+  }).sort();
+}
+async function reviewEvidence(root, finding) {
+  if (normalizeRepoPath(finding.anchor.doc) !== finding.anchor.doc) throw new Error("Invalid advisory document path.");
+  const scope = scopes(finding);
+  const head = (await git2(root, "rev-parse", "HEAD")).trim();
+  const tracked = (await git2(root, "ls-files", "--cached", "-z", "--", ...scope)).split("\0").filter(Boolean);
+  if (tracked.length > 2e4) throw new Error("Advisory scope exceeds 20,000 tracked files.");
+  const [tree, status, lastScopeCommit, document] = await Promise.all([
+    tracked.length ? git2(root, "ls-tree", "-r", "-z", "HEAD", "--", ...tracked.map((file) => `:(literal)${file}`)) : "",
+    git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...scope),
+    git2(root, "log", "-1", "--format=%H", "HEAD", "--", ...scope).then((value) => value.trim()),
+    readAuditInput(root, finding.anchor.doc)
+  ]);
+  if (!document?.trim()) throw new Error("Original advisory document is missing, empty or unreadable.");
+  if (tree.length > 2 * 1024 * 1024 || tree.split("\0").length > 2e4) throw new Error("Advisory scope is too large for a complete review; narrow the documentation scope.");
+  for (const entry of tree.split("\0").filter(Boolean)) {
+    const tab = entry.indexOf("	"), file = entry.slice(tab + 1);
+    if (entry.startsWith("120000 ") || entry.startsWith("160000 ")) throw new Error("Symlink or submodule in advisory review scope: " + file);
+    await storePath(root, file);
+  }
+  const paths = finding.evidence.kind === "missing-path" ? await Promise.all(
+    (finding.evidence.scope?.candidates ?? [finding.evidence.resolvedPath ?? finding.evidence.claimed]).map(async (file) => ({ path: file, exists: await pathExists(root, file) }))
+  ) : [];
+  let dirty = status.length > 0;
+  if (finding.evidence.kind === "missing-script") {
+    for (const file of [...finding.evidence.manifestsChecked, ...finding.evidence.scope?.candidates ?? []]) {
+      if (!tracked.includes(file) && await pathExists(root, file)) dirty = true;
+    }
+  }
+  const fingerprint = digest([scope, tree, lastScopeCommit, paths]);
+  if ((await git2(root, "rev-parse", "HEAD")).trim() !== head) throw new Error("HEAD changed while collecting review evidence.");
+  return {
+    ...evidenceSchema2.parse({ head, scope, tree, lastScopeCommit, paths, fingerprint }),
+    dirty,
+    documentDigest: digest(document)
+  };
+}
+async function decisionAssessment(root, finding, baselineHead) {
+  const evidence = finding.evidence;
+  if (evidence.kind !== "decision-anchor") return null;
+  const id = findingId(finding);
+  const store = await loadDecisionStore(root);
+  if (store.diagnostics.length) throw new Error("Decision records have unavailable or malformed evidence; review cannot be confirmed.");
+  const record = store.records.find((record2) => record2.id === evidence.decisionId);
+  if (!record || record.version !== 2) return null;
+  const events2 = record.history.filter((event2) => ["accepted", "reaffirmed", "retired"].includes(event2.kind));
+  const event = events2.at(-1);
+  if (!event?.evidence || !event.actor || !event.note || !event.evidence.historyAvailable || event.evidence.localChanges.length) return null;
+  try {
+    await git2(root, "merge-base", "--is-ancestor", baselineHead, event.evidence.headHash);
+  } catch {
+    return null;
+  }
+  const drift = await computeDecisionDrift(root, [record]);
+  if (!drift.historyAvailable) throw new Error("Decision review history is unavailable.");
+  const retired = record.status === "retired" && event.kind === "retired";
+  const current = retired || record.status === "active" && record.approval === "accepted" && drift.freshness?.[record.id] === "current" && !drift.pendingProposals?.[record.id];
+  return {
+    id,
+    status: current ? "current" : "reopened",
+    outcome: event.kind,
+    reviewer: event.actor,
+    note: event.note,
+    reviewedHead: event.evidence.headHash,
+    recordPath: `.mason/decisions/${record.id}.json`,
+    reason: current ? "The existing decision review records acceptance, reaffirmation or retirement covering the original finding." : "Decision content or anchor evidence changed after its review; review the decision again."
+  };
+}
+async function assessAdvisory(root, finding, baselineHead) {
+  if ("confidence" in finding) return null;
+  const id = findingId(finding);
+  try {
+    if (finding.evidence.kind === "decision-anchor") return await decisionAssessment(root, finding, baselineHead);
+    const record = await readRecord(root, id);
+    if (!record) return null;
+    const event = record.events.at(-1);
+    const current = await reviewEvidence(root, event.finding);
+    await git2(root, "merge-base", "--is-ancestor", event.evidence.head, current.head);
+    const base = {
+      id,
+      recordPath: recordPath(id),
+      reviewer: event.reviewer,
+      note: event.note,
+      outcome: event.outcome,
+      reviewedHead: event.evidence.head
+    };
+    if (current.dirty || current.fingerprint !== event.evidence.fingerprint || digest(scopes(finding)) !== digest(event.evidence.scope)) return { ...base, status: "reopened", reason: "Relevant document or repository evidence changed after the assessment; prepare a new review." };
+    return { ...base, status: event.outcome === "deferred" ? "deferred" : "current", reason: event.outcome === "deferred" ? "The review was deferred and remains outstanding." : "An explicit assessment covers the current committed scope. This does not approve an engineering decision or certify correctness." };
+  } catch (error) {
+    return { id, status: "unverified", reason: error instanceof Error ? error.message : String(error) };
+  }
+}
+async function advisoryReviewInventory(root) {
+  let names;
+  try {
+    names = await fs10.readdir(await storePath(root, ".mason/reviews/advisories"));
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  if (names.length > 5e3) throw new Error("Advisory review inventory exceeds 5,000 records.");
+  return Promise.all(names.filter((name) => name.endsWith(".json")).sort().map(async (name) => [name, await readAuditInput(root, ".mason/reviews/advisories/" + name)]));
+}
+var execute2, git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
+var init_advisory_review = __esm({
+  "src/audit/advisory-review.ts"() {
+    "use strict";
+    init_findings();
+    init_deps_changed();
+    init_inputs();
+    init_scope();
+    init_storage();
+    init_paths();
+    init_store();
+    init_decisions();
+    init_drift2();
+    execute2 = promisify8(execFile8);
+    git2 = async (root, ...args2) => (await execute2("git", args2, { cwd: root, timeout: 1e4, maxBuffer: 8 * 1024 * 1024 })).stdout;
+    hashSchema = z6.string().regex(/^[a-f0-9]{64}$/);
+    commitSchema2 = z6.string().regex(/^[a-f0-9]{40,64}$/);
+    evidenceSchema2 = z6.object({
+      head: commitSchema2,
+      fingerprint: hashSchema,
+      scope: z6.array(z6.string()).min(1).max(1e3),
+      tree: z6.string().max(2 * 1024 * 1024),
+      lastScopeCommit: commitSchema2,
+      paths: z6.array(z6.object({ path: z6.string(), exists: z6.boolean() })).max(1e3)
+    });
+    eventSchema2 = z6.object({
+      at: z6.string().datetime(),
+      reviewer: z6.string().trim().min(1).max(200),
+      note: z6.string().trim().min(1).max(2500),
+      outcome: z6.enum(["addressed", "inapplicable", "deferred"]),
+      finding: advisorySchema.refine((finding) => finding.evidence.kind !== "decision-anchor", "Decision findings use decision reviews"),
+      evidence: evidenceSchema2
+    });
+    recordSchema = z6.object({ version: z6.literal(1), id: hashSchema, events: z6.array(eventSchema2).min(1).max(200), digest: hashSchema });
+    reviewSummarySchema = z6.object({
+      id: hashSchema,
+      status: z6.enum(["current", "reopened", "deferred", "unverified"]),
+      reason: z6.string(),
+      recordPath: z6.string().optional(),
+      reviewer: z6.string().optional(),
+      note: z6.string().optional(),
+      outcome: z6.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired"]).optional(),
+      reviewedHead: z6.string().optional()
+    });
+    advisoryReviewRequest = z6.object({
+      baselinePath: z6.string().min(1),
+      findingId: hashSchema,
+      action: z6.enum(["prepare", "addressed", "inapplicable", "deferred"]).default("prepare"),
+      reviewer: eventSchema2.shape.reviewer.optional(),
+      note: eventSchema2.shape.note.optional(),
+      reviewToken: hashSchema.optional()
+    });
+    recordPath = (id) => `.mason/reviews/advisories/${hashSchema.parse(id)}.json`;
+  }
+});
+
 // src/audit/audit.ts
-import fs9 from "fs/promises";
-import path15 from "path";
+import fs11 from "fs/promises";
+import path18 from "path";
 async function computeAudit(rootDir, options = {}) {
-  const resolvedRoot = path15.resolve(rootDir);
+  const resolvedRoot = path18.resolve(rootDir);
   const [docs, headHash] = await Promise.all([discoverDocs(resolvedRoot), getCurrentGitHash(resolvedRoot)]);
   if (docs.length === 0) return null;
   const report = {
@@ -2071,6 +2587,8 @@ async function computeAudit(rootDir, options = {}) {
     checksRun: [],
     docs: docs.map((d) => ({
       path: d.path,
+      scope: d.scope,
+      kind: d.kind,
       lastCommit: d.lastCommit,
       dirty: d.dirty,
       lineCount: d.lineCount
@@ -2092,7 +2610,7 @@ async function computeAudit(rootDir, options = {}) {
   }
   let decisionsPresent = false;
   try {
-    await fs9.access(path15.join(resolvedRoot, ".mason", "decisions"));
+    await fs11.access(path18.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -2115,6 +2633,8 @@ async function computeAudit(rootDir, options = {}) {
     report.skippedChecks.push(...skipped);
   }
   report.clean = report.issues.length === 0;
+  const reviews = (await Promise.all([...report.advisories, ...report.suppressedAdvisories].map((finding) => assessAdvisory(resolvedRoot, finding, headHash)))).filter((review) => review !== null);
+  if (reviews.length) report.advisoryReviews = reviews;
   return report;
 }
 var init_audit = __esm({
@@ -2125,45 +2645,24 @@ var init_audit = __esm({
     init_docs();
     init_types();
     init_checks();
+    init_advisory_review();
   }
 });
 
 // src/audit/repair.ts
-import fs10 from "fs/promises";
-import path16 from "path";
-import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
-import { z as z4 } from "zod";
-function findingId(finding) {
-  const e = finding.evidence;
-  let key;
-  switch (e.kind) {
-    case "missing-path":
-      key = e.claimed;
-      break;
-    case "unmentioned-dir":
-      key = e.dir;
-      break;
-    case "count-mismatch":
-      key = [e.unit.replace(/s$/, ""), e.countedFrom];
-      break;
-    case "missing-script":
-      key = e.scriptName;
-      break;
-    case "doc-behind-manifests":
-      key = null;
-      break;
-    case "decision-anchor":
-      key = [e.decisionId, e.provenance?.revision, e.provenance?.approval];
-      break;
-  }
-  return digest([finding.type, finding.anchor.doc, key]);
+import fs12 from "fs/promises";
+import path19 from "path";
+import { randomUUID as randomUUID2 } from "crypto";
+import { z as z7 } from "zod";
+function recheckable(finding) {
+  return !("confidence" in finding) && finding.resolution === "recheck" && ["deleted-reference", "dead-command", "new-module"].includes(finding.type) && ["missing-path", "missing-script", "unmentioned-dir"].includes(finding.evidence.kind);
 }
 function allFindings(report) {
   return [...report.issues, ...report.advisories, ...report.suppressedAdvisories ?? []];
 }
 async function docState(root) {
   const docs = [];
-  for (const doc of DOC_CANDIDATES) {
+  for (const doc of await discoverDocPaths(root)) {
     try {
       const content2 = await readBoundedFile(await storePath(root, doc), 10 * 1024 * 1024);
       if (content2 === null) throw new Error("Context file is not regular or exceeds 10 MiB: " + doc);
@@ -2185,8 +2684,8 @@ async function stableAudit(root, checks, options = {}) {
   return report;
 }
 async function prepareRepair(rootDir, checks = ALL_CHECKS, options = {}) {
-  const root = await fs10.realpath(rootDir);
-  const selected = z4.array(checkSchema).nonempty().parse(checks);
+  const root = await fs12.realpath(rootDir);
+  const selected = z7.array(checkSchema).nonempty().parse(checks);
   const report = await stableAudit(root, selected, options);
   if (!report) throw new Error("No context files found to prepare a repair.");
   if (!report.gitAvailable) throw new Error("Readable Git history is required to prepare a repair.");
@@ -2197,27 +2696,33 @@ async function prepareRepair(rootDir, checks = ALL_CHECKS, options = {}) {
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     report: storedReport
   };
-  const baselinePath = ".mason/reports/repairs/" + randomUUID3() + ".json";
+  const baselinePath = ".mason/reports/repairs/" + randomUUID2() + ".json";
   await writeStoreJson(root, baselinePath, { ...payload, digest: digest(payload) });
   return { version: 1, action: "prepare", baselinePath, report };
 }
-async function verifyRepair(rootDir, baselinePath, options = {}) {
-  const root = await fs10.realpath(rootDir);
-  const declaredRoot = path16.resolve(rootDir);
-  const relative = path16.isAbsolute(baselinePath) ? path16.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+async function loadRepairBaseline(rootDir, baselinePath) {
+  const root = await fs12.realpath(rootDir);
+  const declaredRoot = path19.resolve(rootDir);
+  const relative = path19.isAbsolute(baselinePath) ? path19.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
   const { digest: savedDigest, ...payload } = stored;
   if (digest(payload) !== savedDigest) throw new Error("Repair baseline was modified; use the original baseline.");
   if (stored.report.root !== root) throw new Error("Repair baseline belongs to a different repository.");
   const original = stored.report;
+  return { root, relative, original };
+}
+async function verifyRepair(rootDir, baselinePath, options = {}) {
+  const { root, relative, original } = await loadRepairBaseline(rootDir, baselinePath);
   const diagnostics = [];
+  let reviewDigest;
   let current = null;
   try {
+    reviewDigest = digest(await advisoryReviewInventory(root));
     current = await stableAudit(root, original.checksRun, options);
     if (!current) diagnostics.push("No context files remain available to audit.");
     else if (!current.gitAvailable) diagnostics.push("Git history is unavailable.");
     for (const doc of original.docs) {
-      if (!original.issues.some((f) => f.anchor.doc === doc.path) || !current?.docs.some((d) => d.path === doc.path)) continue;
+      if (!allFindings(original).some((f) => f.anchor.doc === doc.path) || !current?.docs.some((d) => d.path === doc.path)) continue;
       const content2 = await readBoundedFile(await storePath(root, doc.path), 10 * 1024 * 1024);
       if (content2 === null || !content2.trim()) {
         diagnostics.push("Original context file " + doc.path + " is empty or unreadable; losing its claims does not verify a repair.");
@@ -2234,21 +2739,27 @@ async function verifyRepair(rootDir, baselinePath, options = {}) {
   const originalIds = new Set(originalFindings.map(findingId));
   const missingDocs = original.docs.filter((doc) => !current?.docs.some((d) => d.path === doc.path));
   for (const doc of missingDocs) diagnostics.push("Original context file " + doc.path + " is unavailable; removing it does not verify a repair.");
-  const findings = originalFindings.map((finding) => {
+  const findings = await Promise.all(originalFindings.map(async (finding) => {
     const id = findingId(finding);
     const now = currentById.get(id);
     const base = { id, original: finding, ...now ? { current: now } : {} };
     if (diagnostics.length || !current) {
       return { ...base, status: "unverified", reason: "The original audit scope could not be verified. See diagnostics." };
     }
-    if ("confidence" in finding && now) {
+    if (now && ("confidence" in finding || "confidence" in now)) {
       return { ...base, status: "unresolved", reason: "The original check still reports this claim." };
     }
     const skipped = current.skippedChecks.filter((s) => s.check === finding.type && (!s.doc || s.doc === finding.anchor.doc));
     if (!current.checksRun?.includes(finding.type) || skipped.length) {
       return { ...base, status: "unverified", reason: skipped.map((s) => s.reason).join("; ") || "The original check did not run." };
     }
-    if (!("confidence" in finding)) {
+    const review = await assessAdvisory(root, now ?? finding, original.headHash);
+    if (review) {
+      if (review.status === "unverified") return { ...base, review, status: "unverified", reason: review.reason };
+      if (review.status === "current") return { ...base, review, status: "resolved", reason: review.reason };
+      return { ...base, review, status: "review-required", reason: review.reason };
+    }
+    if (!("confidence" in finding) && (!recheckable(finding) || now)) {
       return {
         ...base,
         status: "review-required",
@@ -2256,11 +2767,27 @@ async function verifyRepair(rootDir, baselinePath, options = {}) {
       };
     }
     return { ...base, status: "resolved", reason: "The original check ran and no longer reports this claim. Inspect the edit for semantic correctness." };
-  });
+  }));
+  try {
+    if (reviewDigest !== digest(await advisoryReviewInventory(root)) || current?.headHash !== await getCurrentGitHash(root)) {
+      diagnostics.push("HEAD or advisory review records changed during verification; repeat against stable evidence.");
+      for (const finding of findings) {
+        finding.status = "unverified";
+        finding.reason = diagnostics.at(-1);
+      }
+    }
+  } catch (error) {
+    diagnostics.push(String(error));
+    for (const finding of findings) {
+      finding.status = "unverified";
+      finding.reason = "Advisory review evidence became unavailable during verification.";
+    }
+  }
   const newFindings = [...currentById].filter(([id]) => !originalIds.has(id)).map(([, f]) => f);
+  const reviewedIds = new Set(current?.advisoryReviews?.filter((review) => review.status === "current").map((review) => review.id));
   const counts = { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 };
   for (const f of findings) counts[f.status]++;
-  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f));
+  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f) && !reviewedIds.has(findingId(f)));
   const issuesRemain = counts.unresolved > 0 || newFindings.some((f) => "confidence" in f);
   return {
     version: 1,
@@ -2274,10 +2801,10 @@ async function verifyRepair(rootDir, baselinePath, options = {}) {
     diagnostics,
     currentAudit: current,
     counts,
-    scope: "Original audit checks over current context files and repository evidence. Resolved means no longer detected by that check. Advisories require separate review; this is not a certification of documentation or application correctness."
+    scope: "Original audit checks over current context files and repository evidence. Resolved means no longer detected by the check or covered by an explicit assessment of current evidence; inspect each finding's reason and review. This is not a certification of documentation or application correctness."
   };
 }
-var checkSchema, commitSchema, anchorSchema, count, evidenceSchema, findingSchema, issueSchema, advisorySchema, checkResultSchema, reportSchema, baselineSchema, digest;
+var count2, reportSchema, baselineSchema, repairFindingSchema;
 var init_repair = __esm({
   "src/audit/repair.ts"() {
     "use strict";
@@ -2289,95 +2816,46 @@ var init_repair = __esm({
     init_files();
     init_paths();
     init_types();
-    checkSchema = z4.enum(["deleted-reference", "new-module", "stale-count", "dead-command", "deps-changed", "decision-anchor-drift"]);
-    commitSchema = z4.object({ hash: z4.string().regex(/^[a-f0-9]{40,64}$/), date: z4.string(), subject: z4.string() });
-    anchorSchema = z4.object({ doc: z4.string(), line: z4.number().int().positive().nullable(), excerpt: z4.string().nullable() });
-    count = z4.number().int().nonnegative();
-    evidenceSchema = z4.discriminatedUnion("kind", [
-      z4.object({
-        kind: z4.literal("missing-path"),
-        claimed: z4.string(),
-        renamedTo: z4.string().nullable(),
-        deletedInCommit: commitSchema.nullable(),
-        everTracked: z4.boolean(),
-        parentDirExists: z4.boolean()
-      }),
-      z4.object({
-        kind: z4.literal("unmentioned-dir"),
-        dir: z4.string(),
-        sourceFileCount: count,
-        firstCommit: commitSchema.nullable(),
-        checkedDocs: z4.array(z4.string())
-      }),
-      z4.object({
-        kind: z4.literal("count-mismatch"),
-        claimed: count,
-        actual: count,
-        unit: z4.string(),
-        countedFrom: z4.string(),
-        members: z4.array(z4.string())
-      }),
-      z4.object({
-        kind: z4.literal("missing-script"),
-        scriptName: z4.string(),
-        invocation: z4.string(),
-        manifestsChecked: z4.array(z4.string()),
-        availableScripts: z4.array(z4.string())
-      }),
-      z4.object({
-        kind: z4.literal("doc-behind-manifests"),
-        docLastCommit: commitSchema,
-        manifestCommits: z4.array(commitSchema.extend({ files: z4.array(z4.string()) })),
-        totalCommits: count
-      }),
-      z4.object({
-        kind: z4.literal("decision-anchor"),
-        decisionId: z4.string(),
-        title: z4.string(),
-        changedFiles: z4.array(z4.string()),
-        refreshedHash: z4.string(),
-        provenance: z4.object({}).passthrough().optional()
-      })
-    ]);
-    findingSchema = z4.object({ message: z4.string(), anchor: anchorSchema, evidence: evidenceSchema });
-    issueSchema = findingSchema.extend({
-      type: z4.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
-      confidence: z4.enum(["certain", "likely"])
-    });
-    advisorySchema = findingSchema.extend({ type: z4.enum(["deps-changed", "decision-anchor-drift"]) });
-    checkResultSchema = z4.object({
-      issues: z4.array(issueSchema),
-      advisories: z4.array(advisorySchema),
-      suppressedAdvisories: z4.array(advisorySchema).optional(),
-      skipped: z4.array(z4.object({ check: z4.string(), reason: z4.string(), doc: z4.string().optional() }))
-    });
-    reportSchema = z4.object({
-      version: z4.literal(1),
-      root: z4.string(),
-      gitAvailable: z4.literal(true),
+    init_findings();
+    init_advisory_review();
+    init_findings();
+    count2 = z7.number().int().nonnegative();
+    reportSchema = z7.object({
+      version: z7.literal(1),
+      root: z7.string(),
+      gitAvailable: z7.literal(true),
       headHash: commitSchema.shape.hash,
-      checksRun: z4.array(checkSchema).nonempty(),
-      docs: z4.array(z4.object({
-        path: z4.enum(DOC_CANDIDATES),
+      checksRun: z7.array(checkSchema).nonempty(),
+      docs: z7.array(z7.object({
+        path: z7.string().refine((value) => normalizeRepoPath(value) === value),
+        scope: z7.string().optional(),
+        kind: z7.enum(["instructions", "readme"]).optional(),
         lastCommit: commitSchema.nullable(),
-        dirty: z4.boolean(),
-        lineCount: count
+        dirty: z7.boolean(),
+        lineCount: count2
       })).nonempty(),
-      decisionsChecked: z4.boolean(),
-      clean: z4.boolean(),
-      issues: z4.array(issueSchema),
-      advisories: z4.array(advisorySchema),
-      suppressedAdvisories: z4.array(advisorySchema).optional(),
-      skippedChecks: z4.array(z4.object({ check: z4.string(), reason: z4.string(), doc: z4.string().optional() }))
+      decisionsChecked: z7.boolean(),
+      clean: z7.boolean(),
+      issues: z7.array(issueSchema),
+      advisories: z7.array(advisorySchema),
+      suppressedAdvisories: z7.array(advisorySchema).optional(),
+      skippedChecks: z7.array(z7.object({ check: z7.string(), reason: z7.string(), doc: z7.string().optional() }))
     });
-    baselineSchema = z4.object({
-      kind: z4.literal("mason-audit-repair"),
-      version: z4.literal(1),
-      createdAt: z4.string().datetime(),
+    baselineSchema = z7.object({
+      kind: z7.literal("mason-audit-repair"),
+      version: z7.literal(1),
+      createdAt: z7.string().datetime(),
       report: reportSchema,
-      digest: z4.string().regex(/^[a-f0-9]{64}$/)
+      digest: z7.string().regex(/^[a-f0-9]{64}$/)
+    });
+    repairFindingSchema = z7.object({
+      id: z7.string(),
+      original: z7.union([issueSchema, advisorySchema]),
+      status: z7.enum(["resolved", "unresolved", "review-required", "unverified"]),
+      reason: z7.string(),
+      current: z7.union([issueSchema, advisorySchema]).optional(),
+      review: reviewSummarySchema.optional()
     });
-    digest = (value) => createHash2("sha256").update(JSON.stringify(value)).digest("hex");
   }
 });
 
@@ -2385,102 +2863,94 @@ var init_repair = __esm({
 var evidence_exports = {};
 __export(evidence_exports, {
   checkCache: () => checkCache,
-  git: () => git2,
+  git: () => git3,
   hash: () => hash,
   readInputs: () => readInputs,
   workspace: () => workspace
 });
-import fs11 from "fs/promises";
-import path17 from "path";
+import fs13 from "fs/promises";
+import path20 from "path";
 import { createHash as createHash3 } from "crypto";
-import { execFile as execFile8 } from "child_process";
-import { promisify as promisify8 } from "util";
-import fg4 from "fast-glob";
-import { z as z5 } from "zod";
-async function git2(root, ...args2) {
+import { execFile as execFile9 } from "child_process";
+import { promisify as promisify9 } from "util";
+import fg5 from "fast-glob";
+import { z as z8 } from "zod";
+async function git3(root, ...args2) {
   return (await exec7("git", args2, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout;
 }
 async function workspace(dir) {
-  const root = await fs11.realpath((await git2(dir, "rev-parse", "--show-toplevel")).trim());
-  const gitDir = await fs11.realpath((await git2(root, "rev-parse", "--absolute-git-dir")).trim());
+  const root = await fs13.realpath((await git3(dir, "rev-parse", "--show-toplevel")).trim());
+  const gitDir = await fs13.realpath((await git3(root, "rev-parse", "--absolute-git-dir")).trim());
   let branch;
   try {
-    branch = (await git2(root, "symbolic-ref", "--quiet", "HEAD")).trim();
+    branch = (await git3(root, "symbolic-ref", "--quiet", "HEAD")).trim();
   } catch {
     branch = "detached";
   }
   return { root, gitDir, branch, directory: ".mason/reports/automation/" + hash([root, gitDir, branch]).slice(0, 24) };
 }
 async function readInputs(root) {
+  const docPaths = await discoverDocPaths(root);
   const [headText, docStatus, shallowPath, replacements] = await Promise.all([
-    git2(root, "rev-parse", "HEAD"),
-    git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...DOC_CANDIDATES),
-    git2(root, "rev-parse", "--git-path", "shallow"),
-    git2(root, "for-each-ref", "--format=%(refname) %(objectname)", "refs/replace")
+    git3(root, "rev-parse", "HEAD"),
+    docPaths.length ? git3(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...docPaths.map((p) => `:(literal)${p}`)) : "",
+    git3(root, "rev-parse", "--git-path", "shallow"),
+    git3(root, "for-each-ref", "--format=%(refname) %(objectname)", "refs/replace")
   ]);
   const head = headText.trim();
   let shallow = null;
   try {
-    shallow = await fs11.readFile(path17.resolve(root, shallowPath.trim()), "utf8");
+    shallow = await fs13.readFile(path20.resolve(root, shallowPath.trim()), "utf8");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
   const docs = {};
   const docContents = [];
   const claims = [];
-  for (const file of DOC_CANDIDATES) {
+  for (const file of docPaths) {
     const text2 = await content(root, file);
     docs[file] = text2 === null ? null : hash(text2);
     docContents.push([file, text2]);
     for (const claim of text2 ? extractClaims(text2).paths : []) {
-      if (internal(claim.path) || claim.path.startsWith(".mason/")) continue;
-      const exists2 = async (p) => fs11.access(path17.resolve(root, p)).then(() => true, () => false);
-      claims.push([claim.path, await exists2(claim.path), await exists2(path17.dirname(claim.path))]);
-    }
-  }
-  const combinedDocs = docContents.map(([, text2]) => text2 ?? "").join("\n");
-  const countClaims = docContents.flatMap(([, text2]) => text2 ? extractClaims(text2).counts : []);
-  const commandClaims = docContents.flatMap(([, text2]) => text2 ? extractClaims(text2).commands : []);
-  const rootPackage = await content(root, "package.json");
-  let rootScripts = null;
-  if (rootPackage !== null) {
-    try {
-      const pkg = JSON.parse(rootPackage);
-      rootScripts = pkg?.scripts && typeof pkg.scripts === "object" ? Object.keys(pkg.scripts) : [];
-    } catch {
+      const scope = pathClaimScope(file, claim);
+      for (const candidate of scope?.candidates ?? []) {
+        if (optionalMasonPath(candidate)) continue;
+        claims.push([candidate, await pathExists(root, candidate), await pathExists(root, path20.posix.dirname(candidate))]);
+      }
     }
   }
-  const needsWorkspaceScripts = rootScripts !== null && commandClaims.some((claim) => !rootScripts.includes(claim.scriptName));
+  const parsedDocs = docContents.map(([file, text2]) => ({ path: file, content: text2 ?? "", claims: extractClaims(text2 ?? "") }));
+  const combinedDocs = moduleDocumentation(parsedDocs);
+  const countClaims = parsedDocs.flatMap((doc) => doc.claims.counts.map((claim) => ({ doc: doc.path, claim })));
   const decisionDirectory = await storePath(root, ".mason/decisions");
-  const decisionPresence = await fs11.lstat(decisionDirectory).then((stat) => stat.isDirectory() ? "directory" : "file", (error) => {
+  const decisionPresence = await fs13.lstat(decisionDirectory).then((stat) => stat.isDirectory() ? "directory" : "file", (error) => {
     if (error.code === "ENOENT") return "absent";
     throw error;
   });
-  const [modules, counts, manifests, decisionFiles] = await Promise.all([
+  const [modules, counts, commands, decisionFiles] = await Promise.all([
     combinedDocs ? moduleCandidates(root, combinedDocs) : [],
-    Promise.all(countClaims.map((claim) => resolveCountSource(root, claim))),
-    needsWorkspaceScripts ? commandManifests(root) : [],
-    fg4(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
+    Promise.all(countClaims.map(({ doc, claim }) => resolveDocCountSource(root, doc, claim))),
+    commandInputs(root, parsedDocs),
+    fg5(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
   ]);
-  const packages = [["package.json", rootPackage], ...await Promise.all(manifests.sort().map(async (file) => [file, await content(root, file)]))];
   const decisions = await Promise.all(decisionFiles.sort().map(async (file) => {
     await storePath(root, file);
     return [file, await content(root, file)];
   }));
   const [status, index2] = decisions.length ? await Promise.all([
-    git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
-    git2(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
+    git3(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
+    git3(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
   ]) : ["", ""];
-  const common = [3, engineVersion, head, shallow, replacements, docContents];
+  const common = [4, engineVersion, head, shallow, replacements, docContents];
   const keys = {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
     "stale-count": hash([common, counts]),
-    "dead-command": hash([common, packages]),
+    "dead-command": hash([common, commands]),
     "deps-changed": hash([common, docStatus]),
     "decision-anchor-drift": hash([common, decisionPresence, decisions, status, index2])
   };
-  return { fingerprint: hash(keys), head, docs, keys };
+  return { fingerprint: hash([keys, await advisoryReviewInventory(root)]), head, docs, keys };
 }
 function checkCache(raw, inputs) {
   let entries = {};
@@ -2507,11 +2977,12 @@ function checkCache(raw, inputs) {
     return { version: 1, entries: canonical, digest: hash(canonical) };
   } };
 }
-var exec7, engineVersion, hash, content, internal, cacheSchema;
+var exec7, engineVersion, hash, content, cacheSchema;
 var init_evidence = __esm({
   "src/automation/evidence.ts"() {
     "use strict";
     init_docs();
+    init_scope();
     init_claims();
     init_repair();
     init_checks();
@@ -2520,114 +2991,201 @@ var init_evidence = __esm({
     init_stale_count();
     init_dead_command();
     init_storage();
-    exec7 = promisify8(execFile8);
-    engineVersion = true ? "0.16.2" : "development";
+    init_advisory_review();
+    exec7 = promisify9(execFile9);
+    engineVersion = true ? "0.17.0" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
-    internal = (file) => file === ".mason" || file === ".mason/reports" || file.startsWith(".mason/reports/");
-    cacheSchema = z5.object({ version: z5.literal(1), entries: z5.record(z5.object({ key: z5.string(), result: checkResultSchema })), digest: z5.string() });
+    cacheSchema = z8.object({ version: z8.literal(1), entries: z8.record(z8.object({ key: z8.string(), result: checkResultSchema })), digest: z8.string() });
+  }
+});
+
+// src/automation/execution.ts
+import os2 from "os";
+import fs14 from "fs/promises";
+import { randomUUID as randomUUID3 } from "crypto";
+import { z as z9 } from "zod";
+function parseExecution(raw) {
+  try {
+    return executionSchema.parse(raw);
+  } catch (error) {
+    throw new Error("Invalid automation execution store; receipt history was retained.", { cause: error });
+  }
+}
+function automationFailure(error) {
+  const recorded = failureSchema.safeParse(error?.failure);
+  if (recorded.success) return recorded.data;
+  const message2 = (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 700);
+  const codes = /* @__PURE__ */ new Set();
+  let cause = error;
+  for (let i = 0; cause && i < 8; i++) {
+    codes.add(String(cause.code));
+    cause = cause.cause;
   }
-});
-
-// src/automation/store.ts
-import fs12 from "fs/promises";
-import os2 from "os";
-import { z as z6 } from "zod";
-function parseState(raw) {
+  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message2) ? "inputs-changed" : /Automation is busy/.test(message2) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message2) ? "history-unavailable" : error instanceof z9.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message2) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message2) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
+  return { code, message: message2, retryable: ["inputs-changed", "storage-full", "busy", "io-error"].includes(code), receiptRecorded: false };
+}
+function failureMessage(error) {
+  const failure = automationFailure(error);
+  return `Mason automation unavailable [${failure.code}]; evidence capture/verification was not established. ${failure.message}` + (failure.receiptRecorded ? "" : " No durable failure receipt was recorded.");
+}
+async function failureNotifications(root, directory) {
+  const raw = await readStoreJson(root, directory + "/notifications.json");
+  return raw === null ? { version: 1, sessions: {} } : notificationsSchema.parse(raw);
+}
+async function hookFailureMessage(dir, host, sessionId, error) {
+  const failure = automationFailure(error);
+  if (!failure.receiptRecorded) return failureMessage(error);
   try {
-    return stateSchema.parse(raw);
-  } catch (error) {
-    throw new Error("Invalid automation state; original evidence was retained.", { cause: error });
+    const ws = await workspace(dir);
+    return await withLock(ws.root, ws.directory + "/notifications", async () => {
+      const notices = await failureNotifications(ws.root, ws.directory);
+      const key = hash([host, sessionId]), signature = hash([failure.code, failure.message]);
+      const previous = notices.sessions[key];
+      const execution = await executionStatus(ws.root, ws.directory);
+      const recovered = previous && execution.attempts.some((a) => a.status === "completed" && a.startedAt > previous.lastAt);
+      const repeat = previous?.signature === signature && !recovered;
+      notices.sessions[key] = {
+        signature,
+        code: failure.code,
+        message: failure.message,
+        count: repeat ? previous.count + 1 : 1,
+        lastAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      notices.sessions = Object.fromEntries(Object.entries(notices.sessions).sort(([, a], [, b]) => b.lastAt.localeCompare(a.lastAt)).slice(0, 32));
+      await writeStoreJson(ws.root, ws.directory + "/notifications.json", notices);
+      return repeat ? null : failureMessage(error) + " Repeated failures in this session are recorded in mason status --json.";
+    });
+  } catch {
+    return failureMessage(error);
   }
 }
-async function withLock(root, directory, run) {
-  const file = await storePath(root, directory + "/lock", true);
-  const deadline = Date.now() + 5e3;
-  let handle;
-  while (!handle) {
+async function refreshRunning(root, directory, attempts) {
+  for (const attempt of attempts) {
+    if (attempt.status !== "running") continue;
+    let alive = false;
     try {
-      handle = await fs12.open(file, "wx", 384);
-      try {
-        await handle.writeFile(JSON.stringify({ pid: process.pid, host: os2.hostname() }));
-      } catch (error) {
-        await handle.close().catch(() => {
-        });
-        handle = void 0;
-        await fs12.rm(file, { force: true }).catch(() => {
-        });
-        throw error;
+      const owner = await readStoreJson(root, attempt.lease ? leasePath(directory, attempt.id) : directory + "/lock");
+      if (attempt.host === os2.hostname() && owner?.pid === attempt.pid && owner.host === attempt.host) {
+        try {
+          process.kill(attempt.pid, 0);
+          alive = true;
+        } catch (error) {
+          alive = error.code === "EPERM";
+        }
       }
+    } catch {
+    }
+    if (!alive) attempt.status = "unknown";
+  }
+}
+async function editExecution(root, directory, edit) {
+  return withLock(root, directory + "/execution-lock", async () => {
+    const file = directory + "/execution.json";
+    const raw = await readStoreJson(root, file);
+    const log = raw === null ? { version: 1, attempts: [], discardedAttempts: 0 } : parseExecution(raw);
+    await refreshRunning(root, directory, log.attempts);
+    edit(log);
+    const finished = log.attempts.filter((a) => a.status !== "running");
+    const discard = new Set(finished.slice(0, Math.max(0, finished.length - 32)).map((a) => a.id));
+    log.discardedAttempts += discard.size;
+    log.attempts = log.attempts.filter((a) => !discard.has(a.id));
+    await writeStoreJson(root, file, log);
+  });
+}
+async function recordExecution(root, directory, event, run) {
+  const started = performance.now();
+  const attempt = {
+    id: randomUUID3(),
+    event,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    pid: process.pid,
+    host: os2.hostname(),
+    status: "running",
+    lease: true
+  };
+  const owner = leasePath(directory, attempt.id);
+  const finish = async (changes) => editExecution(root, directory, (log) => {
+    const current = log.attempts.find((a) => a.id === attempt.id);
+    if (!current) throw new Error("Automation execution receipt disappeared; completion could not be recorded.");
+    Object.assign(current, changes, { finishedAt: (/* @__PURE__ */ new Date()).toISOString(), durationMs: performance.now() - started });
+  });
+  await writeStoreJson(root, owner, { pid: attempt.pid, host: attempt.host });
+  try {
+    await editExecution(root, directory, (log) => {
+      if (log.attempts.filter((a) => a.status === "running").length >= 128) throw new Error("Too many active automation executions; existing receipts were retained.");
+      log.attempts.push(attempt);
+    });
+    try {
+      const result = await run();
+      await finish({ status: "completed", verificationStatus: result.report.status, reportPath: result.report.reportPath });
+      return result;
     } catch (error) {
-      if (error.code !== "EEXIST") throw error;
+      const failure = automationFailure(error);
       try {
-        const owner = JSON.parse(await fs12.readFile(file, "utf8"));
-        if (owner.host === os2.hostname() && Number.isInteger(owner.pid) && owner.pid > 0) {
-          try {
-            process.kill(owner.pid, 0);
-          } catch (probe) {
-            if (probe.code === "ESRCH") {
-              const reclaim = file + ".reclaim";
-              let guard;
-              try {
-                guard = await fs12.open(reclaim, "wx", 384);
-                const current = JSON.parse(await fs12.readFile(file, "utf8"));
-                if (current.pid === owner.pid && current.host === owner.host) await fs12.unlink(file);
-              } finally {
-                if (guard) {
-                  await guard.close();
-                  await fs12.rm(reclaim, { force: true });
-                }
-              }
-            }
-          }
-        }
+        await finish({ status: "failed", failure: { ...failure, receiptRecorded: true } });
+        failure.receiptRecorded = true;
       } catch {
       }
-      if (Date.now() >= deadline) throw new Error("Automation is busy or its lock needs inspection: " + file);
-      await new Promise((resolve) => setTimeout(resolve, 40));
+      throw Object.assign(new Error(failure.message, { cause: error }), { failure });
     }
-  }
-  try {
-    return await run();
   } finally {
-    await handle.close();
-    await fs12.unlink(file);
+    await fs14.rm(await storePath(root, owner), { force: true }).catch(() => {
+    });
   }
 }
-var hostSchema, events, stateSchema;
-var init_store = __esm({
-  "src/automation/store.ts"() {
+async function executionStatus(root, directory) {
+  const raw = await readStoreJson(root, directory + "/execution.json");
+  if (raw === null) return { status: "not-observed", attempts: [] };
+  const log = parseExecution(raw);
+  await refreshRunning(root, directory, log.attempts);
+  const completed = [...log.attempts].reverse().find((a) => a.status === "completed");
+  const outstanding = [...log.attempts].reverse().find((a) => ["failed", "unknown"].includes(a.status) && (!completed || (a.finishedAt ?? a.startedAt) >= completed.startedAt));
+  const status = log.attempts.some((a) => a.status === "running") ? "running" : outstanding?.status ?? log.attempts.at(-1)?.status ?? "not-observed";
+  return { status, attempts: log.attempts, discardedAttempts: log.discardedAttempts };
+}
+var failureSchema, attemptSchema, executionSchema, notificationsSchema, leasePath;
+var init_execution = __esm({
+  "src/automation/execution.ts"() {
     "use strict";
+    init_store();
+    init_evidence();
     init_storage();
-    hostSchema = z6.enum(["claude", "codex"]);
-    events = ["session_start", "turn_start", "before_tool", "after_tool", "task_end"];
-    stateSchema = z6.object({
-      version: z6.literal(1),
-      root: z6.string(),
-      gitDir: z6.string(),
-      branch: z6.string(),
-      baselines: z6.array(z6.object({ path: z6.string(), at: z6.string(), event: z6.string(), fingerprint: z6.string() })).max(128),
-      sessions: z6.record(z6.object({
-        host: hostSchema,
-        seen: z6.string().nullable(),
-        continued: z6.boolean(),
-        initialIssues: z6.array(z6.string()),
-        initialDocs: z6.record(z6.string().nullable()),
-        lastUsed: z6.string(),
-        mutationObserved: z6.boolean(),
-        pending: z6.record(z6.string()),
-        coverageGaps: z6.array(z6.string()),
-        events: z6.record(z6.object({ at: z6.string(), count: z6.number().int().positive() }))
-      })),
-      updatedAt: z6.string(),
-      fingerprint: z6.string().nullable(),
-      latest: z6.string().nullable()
+    failureSchema = z9.object({
+      code: z9.enum(["inputs-changed", "storage-full", "busy", "invalid-input", "history-unavailable", "invalid-evidence", "io-error", "internal"]),
+      message: z9.string(),
+      retryable: z9.boolean(),
+      receiptRecorded: z9.boolean()
+    });
+    attemptSchema = z9.object({
+      id: z9.string().regex(/^[a-zA-Z0-9_-]+$/),
+      lease: z9.literal(true).optional(),
+      event: z9.string(),
+      startedAt: z9.string(),
+      finishedAt: z9.string().optional(),
+      durationMs: z9.number().nonnegative().optional(),
+      pid: z9.number().int().positive(),
+      host: z9.string(),
+      status: z9.enum(["running", "completed", "failed", "unknown"]),
+      verificationStatus: z9.string().optional(),
+      reportPath: z9.string().optional(),
+      failure: failureSchema.optional()
     });
+    executionSchema = z9.object({ version: z9.literal(1), attempts: z9.array(attemptSchema).max(160), discardedAttempts: z9.number().int().nonnegative().default(0) });
+    notificationsSchema = z9.object({ version: z9.literal(1), sessions: z9.record(z9.object({
+      signature: z9.string(),
+      code: failureSchema.shape.code,
+      message: z9.string(),
+      count: z9.number().int().positive(),
+      lastAt: z9.string()
+    })) });
+    leasePath = (directory, id) => `${directory}/executions/${id}.json`;
   }
 });
 
 // src/automation/runtime.ts
 import { randomUUID as randomUUID4 } from "crypto";
+import { z as z10 } from "zod";
 async function observeReadOnlyTool(dir, event) {
   const ws = await workspace(dir);
   await withLock(ws.root, ws.directory, async () => {
@@ -2658,176 +3216,234 @@ function summarize(report) {
     "Keep original evidence. Address findings relevant to the authorized task; report unrelated findings and unresolved advisories without approving them."
   ].join("\n");
 }
+async function loadState(ws) {
+  const raw = await readStoreJson(ws.root, ws.directory + "/state.json");
+  const state = raw === null ? {
+    version: 1,
+    root: ws.root,
+    gitDir: ws.gitDir,
+    branch: ws.branch,
+    baselines: [],
+    sessions: {},
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    fingerprint: null,
+    latest: null
+  } : parseState(raw);
+  if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) {
+    throw new Error("Automation state belongs to another branch or worktree; original evidence was retained.");
+  }
+  return state;
+}
+async function sharedAnalysis(ws, state, inputs, startedAt) {
+  const pointer = state.analysis;
+  if (!pointer || pointer.fingerprint !== inputs.fingerprint || pointer.completedAt < startedAt) return null;
+  const stored = sharedSchema.parse(await readStoreJson(ws.root, pointer.path));
+  const a = stored.analysis;
+  if (stored.digest !== hash(a) || a.id !== pointer.id || a.fingerprint !== inputs.fingerprint || a.completedAt !== pointer.completedAt || a.report.root !== ws.root || a.report.branch !== ws.branch || a.report.head !== inputs.head || hash(a.report.baselinePaths) !== hash(state.baselines.map((b) => b.path))) {
+    throw new Error("Invalid shared automation evidence; run a new check.");
+  }
+  if (a.baselineDigest !== await baselineDigest(ws, state)) throw new Error("Repair baseline was modified; use the original baseline.");
+  return a;
+}
+async function verifyInputs(ws, inputs) {
+  const [after, currentWs] = await Promise.all([readInputs(ws.root), workspace(ws.root)]);
+  if (after.fingerprint !== inputs.fingerprint || currentWs.directory !== ws.directory) {
+    throw new Error("Repository inputs or branch changed during automation; no current verification was recorded. Retry on a stable checkout.");
+  }
+}
+async function computeAnalysis(ws, state, inputs, event) {
+  const baselines = [...state.baselines];
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const empty = {
+    version: 1,
+    status: "unavailable",
+    root: ws.root,
+    branch: ws.branch,
+    head: inputs.head,
+    baselinePaths: [],
+    reportPath: "",
+    findings: [],
+    diagnostics: ["No README.md or agent instruction files were discovered. Documentation capture is unavailable; other Mason tools remain usable."],
+    checks: { ran: [], reused: [], skipped: [] },
+    counts: { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 },
+    capture: "unknown",
+    scope: SCOPE
+  };
+  if (!baselines.length && Object.values(inputs.docs).every((value) => value === null)) return { baselines, report: empty, cache: null };
+  if (ws.branch === "detached" && state.latest) {
+    const previous = await readStoreJson(ws.root, state.latest);
+    if (!previous?.head || !/^[a-f0-9]{40,64}$/.test(previous.head)) throw new Error("The previous detached checkout evidence is unavailable.");
+    try {
+      await git3(ws.root, "merge-base", "--is-ancestor", previous.head, inputs.head);
+    } catch {
+      throw new Error("Detached checkout moved to a different history; original repair evidence was retained. Inspect that baseline explicitly.");
+    }
+  }
+  let cached = null;
+  const diagnostics = [];
+  try {
+    cached = await readStoreJson(ws.root, ws.directory + "/cache.json");
+  } catch {
+    diagnostics.push("Unreadable automation cache; checks are being recomputed.");
+  }
+  const cache = checkCache(cached, inputs);
+  if (cache.diagnostic) diagnostics.push(cache.diagnostic);
+  const saveBaseline = async () => {
+    if (baselines.length >= 128) throw new Error("128 retained baselines need review; automatic capture stopped without discarding original evidence.");
+    const prepared = await prepareRepair(ws.root, ALL_CHECKS, cache.options);
+    baselines.push({ path: prepared.baselinePath, at: now, event: event.event, fingerprint: inputs.fingerprint });
+  };
+  if (!baselines.length) await saveBaseline();
+  const verifications = [];
+  for (const baseline of baselines) verifications.push(await verifyRepair(ws.root, baseline.path, cache.options));
+  const known = new Set(verifications.flatMap((v) => v.findings.map((f) => f.id)));
+  if (verifications.some((v) => v.newFindings.some((f) => !known.has(findingId(f))))) {
+    await saveBaseline();
+    verifications.push(await verifyRepair(ws.root, baselines.at(-1).path, cache.options));
+  }
+  const merged = /* @__PURE__ */ new Map();
+  for (const verification of verifications) {
+    for (const finding of verification.findings) {
+      const previous = merged.get(finding.id);
+      if (!previous || priority[finding.status] > priority[previous.status]) merged.set(finding.id, finding);
+    }
+    diagnostics.push(...verification.diagnostics);
+  }
+  const counts = { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 };
+  for (const finding of merged.values()) counts[finding.status]++;
+  const report = {
+    version: 1,
+    status: diagnostics.length || verifications.some((v) => v.status === "incomplete") ? "incomplete" : counts.unresolved ? "issues-remain" : "verified",
+    root: ws.root,
+    branch: ws.branch,
+    head: inputs.head,
+    baselinePaths: baselines.map((b) => b.path),
+    reportPath: "",
+    findings: [...merged.values()],
+    diagnostics: [...new Set(diagnostics)],
+    checks: { ran: [...cache.ran], reused: [...cache.reused].filter((name) => !cache.ran.has(name)), skipped: verifications.at(-1).currentAudit?.skippedChecks ?? [] },
+    counts,
+    capture: "unknown",
+    scope: SCOPE
+  };
+  return { baselines, report, cache: cache.ran.size || cached === null || cache.diagnostic ? cache.serialize() : null };
+}
+async function analyze(ws, inputs, event, startedAt) {
+  return withLock(ws.root, ws.directory + "/analysis/" + inputs.fingerprint, async () => {
+    const before = await loadState(ws);
+    const shared = await sharedAnalysis(ws, before, inputs, startedAt);
+    if (shared) return { analysis: shared, shared: true };
+    const originalDigest = await baselineDigest(ws, before);
+    const computed = await computeAnalysis(ws, before, inputs, event);
+    await verifyInputs(ws, inputs);
+    if (originalDigest !== await baselineDigest(ws, before)) throw new Error("Repair baseline was modified during automation; original evidence must be inspected.");
+    const id = randomUUID4();
+    const analysis = analysisSchema.parse({
+      id,
+      fingerprint: inputs.fingerprint,
+      completedAt: Date.now(),
+      baselineDigest: await baselineDigest(ws, { ...before, baselines: computed.baselines }),
+      report: computed.report
+    });
+    const analysisPath = ws.directory + "/checks/analysis-" + inputs.fingerprint + ".json";
+    await withLock(ws.root, ws.directory, async () => {
+      const state = await loadState(ws);
+      if (hash(state.baselines) !== hash(before.baselines) || state.analysis?.id !== before.analysis?.id) {
+        throw new Error("Automation evidence changed during analysis; retry against the retained baselines.");
+      }
+      await writeStoreJson(ws.root, analysisPath, { analysis, digest: hash(analysis) });
+      if (computed.cache) await writeStoreJson(ws.root, ws.directory + "/cache.json", computed.cache);
+      state.baselines = computed.baselines;
+      state.analysis = { id, fingerprint: inputs.fingerprint, completedAt: analysis.completedAt, path: analysisPath };
+      await writeStoreJson(ws.root, ws.directory + "/state.json", state);
+    });
+    return { analysis, shared: false };
+  }, Math.max(0, 25e3 - (Date.now() - startedAt)));
+}
 async function automate(dir, event) {
+  const startedAt = Date.now();
   const ws = await workspace(dir);
-  return withLock(ws.root, ws.directory, () => recordExecution(ws.root, ws.directory, event.event, async () => {
+  return recordExecution(ws.root, ws.directory, event.event, async () => {
     const inputs = await readInputs(ws.root);
-    const statePath = ws.directory + "/state.json";
-    const raw = await readStoreJson(ws.root, statePath);
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const state = raw === null ? {
-      version: 1,
-      root: ws.root,
-      gitDir: ws.gitDir,
-      branch: ws.branch,
-      baselines: [],
-      sessions: {},
-      updatedAt: now,
-      fingerprint: null,
-      latest: null
-    } : parseState(raw);
-    if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) {
-      throw new Error("Automation state belongs to another branch or worktree; original evidence was retained.");
-    }
-    if (ws.branch === "detached" && state.latest) {
-      const previous = await readStoreJson(ws.root, state.latest);
-      if (!previous?.head || !/^[a-f0-9]{40,64}$/.test(previous.head)) throw new Error("The previous detached checkout evidence is unavailable.");
-      try {
-        await git2(ws.root, "merge-base", "--is-ancestor", previous.head, inputs.head);
-      } catch {
-        throw new Error("Detached checkout moved to a different history; original repair evidence was retained. Inspect that baseline explicitly.");
+    const result = await analyze(ws, inputs, event, startedAt);
+    if (result.shared) {
+      await verifyInputs(ws, inputs);
+      if (result.analysis.baselineDigest !== await baselineDigest(ws, await loadState(ws))) {
+        throw new Error("Repair baseline was modified during shared automation; original evidence must be inspected.");
       }
     }
-    const key = event.host && event.sessionId ? hash([event.host, event.sessionId]) : null;
-    const newSession = key !== null && !state.sessions[key];
-    if (key && !state.sessions[key]) {
-      const keys = Object.keys(state.sessions).sort((a, b) => state.sessions[a].lastUsed.localeCompare(state.sessions[b].lastUsed));
-      for (const expired of keys.slice(0, Math.max(0, keys.length - 31))) delete state.sessions[expired];
-      state.sessions[key] = {
-        host: event.host,
-        seen: null,
-        continued: false,
-        initialIssues: [],
-        initialDocs: inputs.docs,
-        lastUsed: now,
-        mutationObserved: false,
-        pending: {},
-        coverageGaps: [],
-        events: {}
-      };
-    }
-    const session = key ? state.sessions[key] : null;
-    if (session) {
-      session.lastUsed = now;
-      session.events[event.event] = { at: now, count: (session.events[event.event]?.count ?? 0) + 1 };
-      if (event.event === "before_tool" && event.mutating && event.toolId) {
-        if (Object.keys(session.pending).length >= 128) throw new Error("Too many unfinished tool calls to track pre-edit evidence.");
-        session.pending[event.toolId] = inputs.fingerprint;
+    return withLock(ws.root, ws.directory, async () => {
+      const state = await loadState(ws);
+      if (state.analysis?.id !== result.analysis.id) throw new Error("Automation evidence changed during publication; retry against the current inputs.");
+      const report = structuredClone(result.analysis.report);
+      if (result.shared) report.checks = { ...report.checks, ran: [], reused: [.../* @__PURE__ */ new Set([...report.checks.ran, ...report.checks.reused])], shared: true };
+      report.reportPath = ws.directory + "/checks/" + randomUUID4() + ".json";
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const key = event.host && event.sessionId ? hash([event.host, event.sessionId]) : null;
+      const newSession = key !== null && !state.sessions[key];
+      if (key && !state.sessions[key]) {
+        const keys = Object.keys(state.sessions).sort((a, b) => state.sessions[a].lastUsed.localeCompare(state.sessions[b].lastUsed));
+        const removable = keys.filter((k) => !Object.keys(state.sessions[k].pending).length);
+        for (const expired of removable.slice(0, Math.max(0, keys.length - 31))) delete state.sessions[expired];
+        if (Object.keys(state.sessions).length >= 128) throw new Error("Too many sessions with unfinished tool calls; original evidence was retained.");
+        state.sessions[key] = {
+          host: event.host,
+          seen: null,
+          continued: false,
+          initialIssues: report.findings.filter((f) => f.status === "unresolved").map((f) => f.id),
+          initialDocs: inputs.docs,
+          lastUsed: now,
+          mutationObserved: false,
+          pending: {},
+          coverageGaps: [],
+          events: {}
+        };
       }
-      if (event.event === "after_tool" && event.mutating) {
-        session.mutationObserved = true;
-        if (!event.toolId || !session.pending[event.toolId]) {
-          const gap = "A tool completed without an observed matching pre-tool capture; pre-edit coverage is unknown.";
-          if (!session.coverageGaps.includes(gap)) session.coverageGaps.push(gap);
+      const session = key ? state.sessions[key] : null;
+      if (session) {
+        session.lastUsed = now;
+        session.events[event.event] = { at: now, count: (session.events[event.event]?.count ?? 0) + 1 };
+        if (event.event === "before_tool" && event.mutating && event.toolId) {
+          if (Object.keys(session.pending).length >= 128) throw new Error("Too many unfinished tool calls to track pre-edit evidence.");
+          session.pending[event.toolId] = inputs.fingerprint;
+        }
+        if (event.event === "after_tool" && event.mutating) {
+          session.mutationObserved = true;
+          if (!event.toolId || !session.pending[event.toolId]) {
+            const gap = "A tool completed without an observed matching pre-tool capture; pre-edit coverage is unknown.";
+            if (!session.coverageGaps.includes(gap)) session.coverageGaps.push(gap);
+          }
+          if (event.toolId) delete session.pending[event.toolId];
         }
-        if (event.toolId) delete session.pending[event.toolId];
+        report.diagnostics.push(...session.coverageGaps);
+        if (session.coverageGaps.length && report.status !== "unavailable") report.status = "incomplete";
+        report.capture = report.status !== "unavailable" && !session.coverageGaps.length && (session.events.session_start || session.events.before_tool) ? "observed" : "unknown";
       }
-    }
-    if (!state.baselines.length && Object.values(inputs.docs).every((value) => value === null)) {
-      const report2 = {
-        version: 1,
-        status: "unavailable",
-        root: ws.root,
-        branch: ws.branch,
-        head: inputs.head,
-        baselinePaths: [],
-        reportPath: ws.directory + "/checks/" + randomUUID4() + ".json",
-        findings: [],
-        diagnostics: ["No AGENTS.md, CLAUDE.md, or .claude/CLAUDE.md exists. Documentation capture is unavailable; other Mason tools remain usable."],
-        checks: { ran: [], reused: [], skipped: [] },
-        counts: { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 },
-        capture: "unknown",
-        scope: SCOPE
-      };
-      const notify2 = !session || session.seen !== "no-docs";
-      if (session) session.seen = "no-docs";
-      state.fingerprint = inputs.fingerprint;
-      state.latest = report2.reportPath;
-      state.updatedAt = now;
-      await writeStoreJson(ws.root, report2.reportPath, report2);
-      await writeStoreJson(ws.root, statePath, state);
-      return { report: report2, message: notify2 ? summarize(report2) : null, continueOnce: false };
-    }
-    let cached = null;
-    const diagnostics = [];
-    try {
-      cached = await readStoreJson(ws.root, ws.directory + "/cache.json");
-    } catch {
-      diagnostics.push("Unreadable automation cache; checks are being recomputed.");
-    }
-    const cache = checkCache(cached, inputs);
-    if (cache.diagnostic) diagnostics.push(cache.diagnostic);
-    const saveBaseline = async () => {
-      if (state.baselines.length >= 128) throw new Error("128 retained baselines need review; automatic capture stopped without discarding original evidence.");
-      const prepared = await prepareRepair(ws.root, ALL_CHECKS, cache.options);
-      state.baselines.push({ path: prepared.baselinePath, at: now, event: event.event, fingerprint: inputs.fingerprint });
-    };
-    if (!state.baselines.length) await saveBaseline();
-    const verifications = [];
-    for (const baseline of state.baselines) verifications.push(await verifyRepair(ws.root, baseline.path, cache.options));
-    const known = new Set(verifications.flatMap((v) => v.findings.map((f) => f.id)));
-    if (verifications.some((v) => v.newFindings.some((f) => !known.has(findingId(f))))) {
-      await saveBaseline();
-      verifications.push(await verifyRepair(ws.root, state.baselines.at(-1).path, cache.options));
-    }
-    const merged = /* @__PURE__ */ new Map();
-    for (const verification of verifications) {
-      for (const finding of verification.findings) {
-        const previous = merged.get(finding.id);
-        if (!previous || priority[finding.status] > priority[previous.status]) merged.set(finding.id, finding);
+      const signature = hash([report.status, report.findings, report.diagnostics, report.checks.skipped]);
+      const relevant = report.findings.some((f) => f.status === "unresolved" && session && (!session.initialIssues.includes(f.id) || session.initialDocs[f.original.anchor.doc] !== inputs.docs[f.original.anchor.doc]));
+      const continueOnce = event.event === "task_end" && !!session?.mutationObserved && relevant && !session.continued && !event.stopHookActive;
+      const notify = !session || newSession || signature !== session.seen || continueOnce;
+      if (session) {
+        session.seen = signature;
+        if (continueOnce) session.continued = true;
       }
-      diagnostics.push(...verification.diagnostics);
-    }
-    if (newSession && session) session.initialIssues = [...merged.values()].filter((f) => f.status === "unresolved").map((f) => f.id);
-    const current = verifications.at(-1).currentAudit;
-    const counts = { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 };
-    for (const finding of merged.values()) counts[finding.status]++;
-    if (session) diagnostics.push(...session.coverageGaps);
-    const capture = session && !session.coverageGaps.length && (session.events.session_start || session.events.before_tool) ? "observed" : "unknown";
-    const after = await readInputs(ws.root);
-    const currentWs = await workspace(ws.root);
-    if (after.fingerprint !== inputs.fingerprint || currentWs.directory !== ws.directory) {
-      throw new Error("Repository inputs or branch changed during automation; no current verification was recorded. Retry on a stable checkout.");
-    }
-    const report = {
-      version: 1,
-      status: diagnostics.length || verifications.some((v) => v.status === "incomplete") ? "incomplete" : counts.unresolved ? "issues-remain" : "verified",
-      root: ws.root,
-      branch: ws.branch,
-      head: inputs.head,
-      baselinePaths: state.baselines.map((b) => b.path),
-      reportPath: ws.directory + "/checks/" + randomUUID4() + ".json",
-      findings: [...merged.values()],
-      diagnostics: [...new Set(diagnostics)],
-      checks: { ran: [...cache.ran], reused: [...cache.reused].filter((name) => !cache.ran.has(name)), skipped: current?.skippedChecks ?? [] },
-      counts,
-      capture,
-      scope: SCOPE
-    };
-    const signature = hash([report.status, report.findings, report.diagnostics, report.checks.skipped]);
-    const relevant = report.findings.some((f) => f.status === "unresolved" && session && (!session.initialIssues.includes(f.id) || session.initialDocs[f.original.anchor.doc] !== inputs.docs[f.original.anchor.doc]));
-    const continueOnce = event.event === "task_end" && !!session?.mutationObserved && relevant && !session.continued && !event.stopHookActive;
-    const notify = !session || newSession || signature !== session.seen || continueOnce;
-    if (session) {
-      session.seen = signature;
-      if (continueOnce) session.continued = true;
-    }
-    const persistReport = !state.latest || state.fingerprint !== inputs.fingerprint || notify || event.event === "task_end";
-    if (!persistReport) report.reportPath = state.latest;
-    state.updatedAt = now;
-    state.fingerprint = inputs.fingerprint;
-    state.latest = report.reportPath;
-    if (persistReport) await writeStoreJson(ws.root, report.reportPath, report);
-    if (cache.ran.size || cached === null || cache.diagnostic) await writeStoreJson(ws.root, ws.directory + "/cache.json", cache.serialize());
-    await writeStoreJson(ws.root, statePath, state);
-    return { report, message: notify ? summarize(report) : null, continueOnce };
-  }));
+      const persistReport = !state.latest || state.fingerprint !== inputs.fingerprint || notify || event.event === "task_end";
+      if (!persistReport) report.reportPath = state.latest;
+      state.updatedAt = now;
+      state.fingerprint = inputs.fingerprint;
+      state.latest = report.reportPath;
+      if (persistReport) await writeStoreJson(ws.root, report.reportPath, report);
+      await writeStoreJson(ws.root, ws.directory + "/state.json", state);
+      return { report, message: notify ? summarize(report) : null, continueOnce };
+    });
+  });
 }
 async function automationStatus(dir) {
   const ws = await workspace(dir);
   const execution = await executionStatus(ws.root, ws.directory);
+  const notifications = await failureNotifications(ws.root, ws.directory);
   const raw = await readStoreJson(ws.root, ws.directory + "/state.json");
-  if (raw === null) return { version: 1, status: execution.status === "not-observed" ? "not-observed" : "unavailable", root: ws.root, branch: ws.branch, baselinePaths: [], hosts: {}, execution };
+  if (raw === null) return { version: 1, status: execution.status === "not-observed" ? "not-observed" : "unavailable", root: ws.root, branch: ws.branch, baselinePaths: [], hosts: {}, execution, notifications };
   const state = parseState(raw);
   if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) throw new Error("Automation state belongs to another workspace.");
   const inputs = await readInputs(ws.root);
@@ -2849,10 +3465,11 @@ async function automationStatus(dir) {
     verificationStatus: unfinished ? "unavailable" : latest?.status ?? "unavailable",
     hosts: hosts2,
     execution,
+    notifications,
     note: "Observed events do not prove all tool paths are intercepted. Run check to verify the retained evidence."
   };
 }
-var SCOPE, priority, cleanText;
+var SCOPE, priority, cleanText, analysisSchema, sharedSchema, baselineDigest;
 var init_runtime = __esm({
   "src/automation/runtime.ts"() {
     "use strict";
@@ -2862,14 +3479,43 @@ var init_runtime = __esm({
     init_storage();
     init_evidence();
     init_store();
-    SCOPE = "Documentation audit evidence only. Hook receipts show observed events, not complete interception. Resolved claims no longer fail their checks; advisories need separate review. Repair only within the user's task authorization.";
+    SCOPE = "Documentation audit evidence only. Hook receipts show observed events, not complete interception. Resolved findings no longer fail their checks or have a recorded assessment covering current evidence. Repair and review only within the user's task authorization.";
     priority = { resolved: 0, "review-required": 1, unresolved: 2, unverified: 3 };
     cleanText = (text2) => text2.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 250);
+    analysisSchema = z10.object({
+      id: z10.string(),
+      fingerprint: z10.string(),
+      completedAt: z10.number(),
+      baselineDigest: z10.string(),
+      report: z10.object({
+        version: z10.literal(1),
+        status: z10.enum(["verified", "issues-remain", "incomplete", "unavailable"]),
+        root: z10.string(),
+        branch: z10.string(),
+        head: z10.string(),
+        baselinePaths: z10.array(z10.string()),
+        reportPath: z10.string(),
+        findings: z10.array(repairFindingSchema),
+        diagnostics: z10.array(z10.string()),
+        checks: z10.object({
+          ran: z10.array(z10.string()),
+          reused: z10.array(z10.string()),
+          skipped: z10.array(z10.object({ check: z10.string(), reason: z10.string(), doc: z10.string().optional() }))
+        }),
+        counts: z10.object({ resolved: z10.number(), unresolved: z10.number(), "review-required": z10.number(), unverified: z10.number() }),
+        capture: z10.enum(["observed", "unknown"]),
+        scope: z10.string()
+      })
+    });
+    sharedSchema = z10.object({ analysis: analysisSchema, digest: z10.string() });
+    baselineDigest = async (ws, state) => hash(await Promise.all(
+      state.baselines.map(async (b) => [b.path, await readStoreJson(ws.root, b.path)])
+    ));
   }
 });
 
 // src/setup/model.ts
-import { z as z7 } from "zod";
+import { z as z11 } from "zod";
 async function loadSetup(root) {
   const raw = await readStoreJson(root, SETUP_PATH);
   if (raw === null) return null;
@@ -2887,27 +3533,27 @@ var init_model = __esm({
   "src/setup/model.ts"() {
     "use strict";
     init_storage();
-    setupHostSchema = z7.object({
-      configuredVersion: z7.string(),
-      revision: z7.string().uuid(),
-      fingerprint: z7.string(),
-      mcpFingerprint: z7.string(),
-      instructions: z7.array(z7.string())
+    setupHostSchema = z11.object({
+      configuredVersion: z11.string(),
+      revision: z11.string().uuid(),
+      fingerprint: z11.string(),
+      mcpFingerprint: z11.string(),
+      instructions: z11.array(z11.string())
     });
-    setupSchema = z7.object({ version: z7.literal(2), hosts: z7.object({
+    setupSchema = z11.object({ version: z11.literal(2), hosts: z11.object({
       codex: setupHostSchema.optional(),
       claude: setupHostSchema.optional()
     }) });
     SETUP_PATH = ".mason/local/setup.json";
-    receiptSchema = z7.object({
-      version: z7.literal(1),
-      host: z7.enum(["codex", "claude"]),
-      status: z7.enum(["installing", "configured"]),
-      initialReportPath: z7.string(),
-      initialBaselinePaths: z7.array(z7.string()),
-      root: z7.string(),
-      revision: z7.string().uuid(),
-      configuredAt: z7.string().optional()
+    receiptSchema = z11.object({
+      version: z11.literal(1),
+      host: z11.enum(["codex", "claude"]),
+      status: z11.enum(["installing", "configured"]),
+      initialReportPath: z11.string(),
+      initialBaselinePaths: z11.array(z11.string()),
+      root: z11.string(),
+      revision: z11.string().uuid(),
+      configuredAt: z11.string().optional()
     });
   }
 });
@@ -2922,16 +3568,16 @@ __export(launcher_exports, {
   mcpCommand: () => mcpCommand,
   prepareLaunch: () => prepareLaunch
 });
-import { execFile as execFile9 } from "child_process";
-import { promisify as promisify9 } from "util";
-import fs13 from "fs/promises";
+import { execFile as execFile10 } from "child_process";
+import { promisify as promisify10 } from "util";
+import fs15 from "fs/promises";
 function globalCommand(args2, platform = process.platform) {
   return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args2] } : { command: "mason", args: args2 };
 }
 async function installedCommand() {
   const invocation = globalCommand(["internal-integration-version"]);
   try {
-    const { stdout } = await promisify9(execFile9)(
+    const { stdout } = await promisify10(execFile10)(
       invocation.command,
       invocation.args,
       { timeout: 5e3, maxBuffer: 8192, windowsHide: true }
@@ -2944,7 +3590,7 @@ async function installedCommand() {
   }
 }
 async function prepareLaunch(host, options = {}) {
-  const root = await fs13.realpath((await git2(process.cwd(), "rev-parse", "--show-toplevel")).trim());
+  const root = await fs15.realpath((await git3(process.cwd(), "rev-parse", "--show-toplevel")).trim());
   const entry = (await loadSetup(root))?.hosts[host];
   if (!entry) {
     if (options.allowInactive) return false;
@@ -2961,7 +3607,7 @@ var init_launcher = __esm({
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.16.2" : "development";
+    executingVersion = () => true ? "0.17.0" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -2974,8 +3620,8 @@ __export(observations_exports, {
   observeActivation: () => observeActivation,
   readObservation: () => readObservation
 });
-import fs14 from "fs/promises";
-import { z as z8 } from "zod";
+import fs16 from "fs/promises";
+import { z as z12 } from "zod";
 function observationPath(directory, host, revision, version = executingVersion()) {
   return `${directory}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
 }
@@ -2991,8 +3637,8 @@ async function observeActivation(dir, event, options = {}) {
   if (host !== "codex" && host !== "claude" || !revision || !process.env.MASON_SETUP_ROOT) return null;
   try {
     const capturedDirectory = options.directory?.match(/^\.mason\/reports\/automation\/[a-f0-9]{24}$/)?.[0] ?? options.reportPath?.match(/^(\.mason\/reports\/automation\/[a-f0-9]{24})\/checks\//)?.[1];
-    const ws = capturedDirectory ? { root: await fs14.realpath(dir), directory: capturedDirectory } : await workspace(dir);
-    if (ws.root !== await fs14.realpath(process.env.MASON_SETUP_ROOT)) return null;
+    const ws = capturedDirectory ? { root: await fs16.realpath(dir), directory: capturedDirectory } : await workspace(dir);
+    if (ws.root !== await fs16.realpath(process.env.MASON_SETUP_ROOT)) return null;
     const setup = await loadSetup(ws.root);
     if (setup?.hosts[host]?.revision !== revision) return "Mason setup changed; restart the assistant to observe the current integration.";
     const directory = ws.directory + "/activation";
@@ -3040,26 +3686,26 @@ var init_observations = __esm({
     init_storage();
     init_model();
     init_launcher();
-    observationSchema = z8.object({
-      version: z8.literal(1),
-      masonVersion: z8.string(),
-      root: z8.string(),
-      revision: z8.string(),
-      host: z8.enum(["codex", "claude"]),
-      contextCalls: z8.number().int().nonnegative(),
-      lastContextAt: z8.string().optional(),
-      sessions: z8.record(z8.object({
-        events: z8.array(z8.enum(events)),
-        at: z8.string(),
-        verificationStatus: z8.string().optional(),
-        reportPath: z8.string().optional()
+    observationSchema = z12.object({
+      version: z12.literal(1),
+      masonVersion: z12.string(),
+      root: z12.string(),
+      revision: z12.string(),
+      host: z12.enum(["codex", "claude"]),
+      contextCalls: z12.number().int().nonnegative(),
+      lastContextAt: z12.string().optional(),
+      sessions: z12.record(z12.object({
+        events: z12.array(z12.enum(events)),
+        at: z12.string(),
+        verificationStatus: z12.string().optional(),
+        reportPath: z12.string().optional()
       }))
     });
   }
 });
 
 // src/automation/adapters.ts
-import { z as z9 } from "zod";
+import { z as z13 } from "zod";
 function normalizeHook(host, raw) {
   hostSchema.parse(host);
   const input = inputSchema.parse(raw);
@@ -3075,6 +3721,7 @@ function normalizeHook(host, raw) {
 }
 async function runAutomationHook(host, stdin) {
   let name = "";
+  let hook;
   try {
     if (Buffer.byteLength(stdin) > 1024 * 1024) throw new Error("Hook input exceeds 1 MiB.");
     let raw;
@@ -3084,6 +3731,7 @@ async function runAutomationHook(host, stdin) {
       throw new Error("Hook input is not valid JSON.");
     }
     const input = normalizeHook(host, raw);
+    hook = input;
     name = input.name;
     if (["before_tool", "after_tool"].includes(input.event.event) && input.readOnly) {
       const observed = await observeReadOnlyTool(input.cwd, input.event);
@@ -3105,7 +3753,8 @@ async function runAutomationHook(host, stdin) {
     }
     return { hookSpecificOutput: { hookEventName: name, additionalContext: result.message } };
   } catch (error) {
-    const message2 = failureMessage(error);
+    const message2 = hook ? await hookFailureMessage(hook.cwd, host, hook.event.sessionId, error) : failureMessage(error);
+    if (!message2) return null;
     return { systemMessage: message2, ...["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse"].includes(name) ? { hookSpecificOutput: { hookEventName: name, additionalContext: message2 } } : {} };
   }
 }
@@ -3130,15 +3779,15 @@ var init_adapters = __esm({
     init_execution();
     init_runtime();
     init_store();
-    inputSchema = z9.object({
-      cwd: z9.string().min(1),
-      session_id: z9.string().min(1).max(500),
-      hook_event_name: z9.enum(["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"]),
-      tool_name: z9.string().optional(),
-      tool_use_id: z9.string().max(500).optional(),
-      tool_input: z9.unknown().optional(),
-      stop_hook_active: z9.boolean().optional(),
-      permission_mode: z9.string().optional()
+    inputSchema = z13.object({
+      cwd: z13.string().min(1),
+      session_id: z13.string().min(1).max(500),
+      hook_event_name: z13.enum(["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"]),
+      tool_name: z13.string().optional(),
+      tool_use_id: z13.string().max(500).optional(),
+      tool_input: z13.unknown().optional(),
+      stop_hook_active: z13.boolean().optional(),
+      permission_mode: z13.string().optional()
     });
     lifecycle = {
       SessionStart: "session_start",
@@ -3158,8 +3807,8 @@ __export(files_exports, {
   managedBlock: () => managedBlock,
   readText: () => readText
 });
-import fs15 from "fs/promises";
-import path18 from "path";
+import fs17 from "fs/promises";
+import path21 from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 async function readText(root, file) {
   try {
@@ -3188,14 +3837,14 @@ async function applyEdit(root, edit) {
   if (edit.after === null) {
     const file2 = await storePath(root, edit.path);
     if (await readText(root, edit.path) !== edit.before) throw new Error("Input changed during removal: " + edit.path);
-    await fs15.unlink(file2);
+    await fs17.unlink(file2);
     return true;
   }
   const file = await storePath(root, edit.path, true);
-  const temporary = path18.join(path18.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  const temporary = path21.join(path21.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
   try {
-    const mode = await fs15.stat(file).then((s) => s.mode & 511, () => 384);
-    const handle = await fs15.open(temporary, "wx", mode);
+    const mode = await fs17.stat(file).then((s) => s.mode & 511, () => 384);
+    const handle = await fs17.open(temporary, "wx", mode);
     try {
       await handle.writeFile(edit.after, "utf8");
       await handle.sync();
@@ -3203,10 +3852,10 @@ async function applyEdit(root, edit) {
       await handle.close();
     }
     if (await readText(root, edit.path) !== edit.before) throw new Error("Integration input changed during update: " + edit.path);
-    await fs15.rename(temporary, file);
+    await fs17.rename(temporary, file);
     return true;
   } finally {
-    await fs15.rm(temporary, { force: true });
+    await fs17.rm(temporary, { force: true });
   }
 }
 var init_files2 = __esm({
@@ -3227,7 +3876,7 @@ __export(ownership_exports, {
   ownershipEdit: () => ownershipEdit,
   ownershipSchema: () => ownershipSchema
 });
-import { z as z10 } from "zod";
+import { z as z14 } from "zod";
 import { parse } from "smol-toml";
 function blockSpan(text2, start, end) {
   const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
@@ -3278,30 +3927,30 @@ var init_ownership = __esm({
       ["<!-- mason:agents:start -->", "<!-- mason:agents:end -->"],
       ["# mason:mcp:start", "# mason:mcp:end"]
     ];
-    fileSchema = z10.object({
-      created: z10.boolean(),
-      initialHash: z10.string(),
-      blocks: z10.record(z10.string()),
-      mcpHash: z10.string().optional(),
-      hookCommands: z10.array(z10.string()).optional(),
-      hooks: z10.record(z10.array(z10.string())).optional()
+    fileSchema = z14.object({
+      created: z14.boolean(),
+      initialHash: z14.string(),
+      blocks: z14.record(z14.string()),
+      mcpHash: z14.string().optional(),
+      hookCommands: z14.array(z14.string()).optional(),
+      hooks: z14.record(z14.array(z14.string())).optional()
     });
-    ownershipSchema = z10.object({ version: z10.literal(1), files: z10.record(fileSchema) });
+    ownershipSchema = z14.object({ version: z14.literal(1), files: z14.record(fileSchema) });
   }
 });
 
 // src/mcp/init.ts
-import { z as z11 } from "zod";
+import { z as z15 } from "zod";
 var markerSchema, CLAUDE_MD_SECTION, ASSISTANT_SETUP, QUICKSTART_PLAYBOOK, MAP_PLAYBOOK;
 var init_init = __esm({
   "src/mcp/init.ts"() {
     "use strict";
     init_storage();
     init_files2();
-    markerSchema = z11.object({
-      version: z11.literal(1),
-      initializedAt: z11.string(),
-      features: z11.object({ confluence: z11.boolean().optional() }).passthrough().optional()
+    markerSchema = z15.object({
+      version: z15.literal(1),
+      initializedAt: z15.string(),
+      features: z15.object({ confluence: z15.boolean().optional() }).passthrough().optional()
     }).passthrough();
     CLAUDE_MD_SECTION = `<!-- mason:start -->
 ## Mason project knowledge
@@ -3311,12 +3960,14 @@ Mason provides recorded decisions and file impact over MCP. A concept map is opt
 - Task, bug, change request, or investigation of why the project works this way \u2192 \`get_context\` with the task text and known files: matching decisions, related tests, impact, and any available map entries.
 - Before editing a file \u2192 \`get_impact\` to check references, tests, and historical change partners.
 - Investigation or correction reveals a reusable project lesson \u2192 \`save_decision\` before finishing. Capture only the lasting constraint and reason, with anchors and known sources, owner, and recorder. This creates a proposal; never infer approval. Preserve uncertain causes and unknown attribution. Route project lessons here; keep personal preferences in agent memory. Skip code summaries, current checkout status, temporary task permissions, session trivia, and secrets. No qualifying lesson means no record.
+- Before saving, compare the lesson with matching \`get_context\` records and any pending proposal. If new evidence changes the same lesson's assumptions, scope, or recommended action, revise it with \`save_decision(id: existingId)\`, including when it is accepted. Preserve supported rationale and sources, replace obsolete instructions, and add the new evidence. Create a separate record for a genuinely distinct lesson; skip unchanged restatements. Revision preserves history and leaves the accepted version operative until authorized review.
 - Consult trust metadata before relying on entries: unknown or changed freshness requires inspection, and failed verification means the description must be corrected. Check approval too: proposals are suggestions, legacy records are unreviewed, and accepted decisions are recorded constraints subject to freshness checks. An accepted revision remains operative while a pending proposal is reviewed; keep both versions and their freshness distinct.
 - Asked to review or re-verify a decision \u2192 \`review_decision\` first to inspect content, sources, history, and code changes. Record acceptance, reaffirmation, or retirement only when authorized by the user or a cited team review, with the actual reviewer and reason. Never infer approval from unchanged code. Review and commit the local record through the normal project workflow.
 - For an architectural overview, use \`get_snapshot\` if a map is available. If \`map.status\` is missing or invalid, use available decisions and source evidence; do not start building a map unless requested.
 - \`mason_init\` returns documentation audit and committed-diff review results, plus a short setup guide. Pass \`evidence\` with local CI manifest paths to include test and analysis results; the CLI equivalent is \`mason-review --evidence <manifest>\`. State skipped, unavailable, stale, or unknown checks explicitly. Related accepted decisions identify review context, not proven violations.
 
 - When documentation repair is authorized, use \`mason_repair(action: "prepare")\` before edits, keep its baselinePath, and use \`mason_repair(action: "verify", baselinePath)\` after edits and any final doc commit. Report every original finding's outcome and any new findings. Suppressed advisories remain unresolved; editing a doc does not approve it.
+- When advisory assessment is authorized, use \`review_advisory(action: "prepare", baselinePath, findingId)\` to inspect original evidence and history. Record \`addressed\`, \`inapplicable\`, or \`deferred\` with the actual reviewer, reason in note, and returned reviewToken only after relevant edits are committed. Commit the assessment and verify the same baseline again. Relevant evidence changes reopen it; deferral stays outstanding. Decision findings use \`review_decision\`; advisory closure never approves a decision.
 
 - When Mason automation is installed, use \`mason_automation(action: "status")\` to inspect configured hooks and observed events, and \`mason_automation(action: "check")\` to resume its retained repair evidence. CLI fallback: \`mason-auto status\` / \`mason-auto check\`. Preserve existing baselines across sessions. Automatic checks do not authorize unrelated repairs or approve advisories.
 
@@ -3332,7 +3983,7 @@ ${CLAUDE_MD_SECTION}`;
 
 1. Explain the actionable findings with their source evidence. Separate audit issues, advisories, and skipped checks. The review covers committed changes from the merge base to HEAD; workingTree paths are not included in that review. An unavailable or empty check is not proof that the project is correct. Use the CLI for full output if a summary is truncated.
 2. Address findings within the user's requested scope. Setup alone authorizes Mason host configuration, hooks, instructions, and ignore rules; rewriting existing project claims requires repair scope. If repair is authorized, call \`mason_repair(dir, action: "prepare")\` before editing; it saves the full original findings even when this summary is truncated. Inspect relevant source, make grounded edits, then call \`mason_repair(dir, action: "verify", baselinePath)\` with that same baseline, including after any final doc commit. Report resolved, unresolved, review-required, unverified, and new findings. Keep suppressed advisories visible even when setup has already dirtied a doc. Do not invent a decision just to populate the store.
-3. When the task reveals a real lesson or constraint, call \`save_decision\` with title, body, category, anchors, and known owner/source/actor information. Missing attribution can be added later. The tool writes a local proposal; editing it preserves revision history and requires a new acceptance, while any earlier accepted revision remains operative. An unchanged save never refreshes its evidence. When decision review is requested, \`review_decision\` prepares the record and code evidence before any authorized verdict. Review and commit records through the normal workflow. Retrieve it on the next relevant task with \`get_context(dir, task, files)\`.
+3. When the task reveals a real lesson or constraint, compare matching \`get_context\` records first. If its assumptions, scope, or recommended action changed, revise that record using \`save_decision(id: existingId)\`; create a separate record for a genuinely distinct lesson and skip unchanged restatements. Include title, body, category, anchors, and known owner/source/actor information. Preserve supported rationale and sources, replace obsolete instructions, and add new evidence. Missing attribution can be added later. The tool writes a local proposal; editing it preserves revision history and requires a new acceptance, while any earlier accepted revision remains operative. An unchanged save never refreshes its evidence. When decision review is requested, \`review_decision\` prepares the record and code evidence before any authorized verdict. Review and commit records through the normal workflow. Retrieve it on the next relevant task with \`get_context(dir, task, files)\`.
 
 ${ASSISTANT_SETUP}
 
@@ -3378,8 +4029,8 @@ var git_exports = {};
 __export(git_exports, {
   isGitRepo: () => isGitRepo
 });
-import { execFile as execFile10 } from "child_process";
-import { promisify as promisify10 } from "util";
+import { execFile as execFile11 } from "child_process";
+import { promisify as promisify11 } from "util";
 async function isGitRepo(dir) {
   try {
     await exec8("git", ["rev-parse", "--git-dir"], { cwd: dir });
@@ -3392,7 +4043,7 @@ var exec8;
 var init_git2 = __esm({
   "src/utils/git.ts"() {
     "use strict";
-    exec8 = promisify10(execFile10);
+    exec8 = promisify11(execFile11);
   }
 });
 
@@ -3408,7 +4059,7 @@ __export(config_exports, {
 });
 import { isDeepStrictEqual } from "util";
 import { parse as parse2, stringify } from "smol-toml";
-import { z as z12 } from "zod";
+import { z as z16 } from "zod";
 async function instructionEdits(root, host) {
   const found = await Promise.all(DOC_CANDIDATES.map(async (file) => ({ path: file, text: await readText(root, file) })));
   const existing = found.find((f) => f.text !== null);
@@ -3477,11 +4128,11 @@ async function hookEdits(root, host) {
 }
 async function ancillaryEdits(root) {
   const ignore = await readText(root, ".gitignore");
-  const { git: git3 } = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
+  const { git: git4 } = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
   const { isGitRepo: isGitRepo2 } = await Promise.resolve().then(() => (init_git2(), git_exports));
   let parentIgnored = false;
   try {
-    if (await isGitRepo2(root)) parentIgnored = !!(await git3(root, "check-ignore", "--no-index", ".mason")).trim();
+    if (await isGitRepo2(root)) parentIgnored = !!(await git4(root, "check-ignore", "--no-index", ".mason")).trim();
   } catch (error) {
     if (error.code !== 1) throw error;
   }
@@ -3490,6 +4141,8 @@ async function ancillaryEdits(root) {
     ...retainParentRule ? ["!/.mason/", "/.mason/*"] : [],
     "!/.mason/decisions/",
     "!/.mason/decisions/**",
+    "!/.mason/reviews/",
+    "!/.mason/reviews/**",
     "!/.mason/config.json",
     "!/.mason/snapshot.json",
     "/.mason/local/",
@@ -3524,7 +4177,7 @@ var init_config = __esm({
     init_install();
     init_files2();
     init_launcher();
-    object = z12.record(z12.unknown());
+    object = z16.record(z16.unknown());
     mcpPath = (host) => host === "codex" ? ".codex/config.toml" : ".mcp.json";
     TOML_START = "# mason:mcp:start";
     TOML_END = "# mason:mcp:end";
@@ -3542,11 +4195,11 @@ __export(install_exports, {
   installAutomation: () => installAutomation,
   installedAutomation: () => installedAutomation,
   planAutomationInstall: () => planAutomationInstall,
-  recordSchema: () => recordSchema
+  recordSchema: () => recordSchema2
 });
-import { z as z13 } from "zod";
+import { z as z17 } from "zod";
 async function installationRecord(root) {
-  return recordSchema.parse(await readStoreJson(root, AUTOMATION_PATH) ?? { version: 1, hosts: {} });
+  return recordSchema2.parse(await readStoreJson(root, AUTOMATION_PATH) ?? { version: 1, hosts: {} });
 }
 async function installAutomation(dir, host, command2) {
   const ws = await workspace(dir);
@@ -3615,7 +4268,7 @@ async function installedAutomation(dir) {
   }
   return result;
 }
-var groupSchema, automationConfigSchema, recordSchema, AUTOMATION_PATH, configPath;
+var groupSchema, automationConfigSchema, recordSchema2, AUTOMATION_PATH, configPath;
 var init_install = __esm({
   "src/automation/install.ts"() {
     "use strict";
@@ -3625,9 +4278,9 @@ var init_install = __esm({
     init_store();
     init_files2();
     init_ownership();
-    groupSchema = z13.object({ hooks: z13.array(z13.object({ type: z13.string(), command: z13.string().optional() }).passthrough()) }).passthrough();
-    automationConfigSchema = z13.object({ hooks: z13.record(z13.array(groupSchema)).optional() }).passthrough();
-    recordSchema = z13.object({ version: z13.literal(1), hosts: z13.record(z13.object({ command: z13.string() })) });
+    groupSchema = z17.object({ hooks: z17.array(z17.object({ type: z17.string(), command: z17.string().optional() }).passthrough()) }).passthrough();
+    automationConfigSchema = z17.object({ hooks: z17.record(z17.array(groupSchema)).optional() }).passthrough();
+    recordSchema2 = z17.object({ version: z17.literal(1), hosts: z17.record(z17.object({ command: z17.string() })) });
     AUTOMATION_PATH = ".mason/local/automation.json";
     configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
   }
@@ -3641,8 +4294,8 @@ __export(teardown_exports, {
 });
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 import { parse as parse3, stringify as stringify2 } from "smol-toml";
-import fg5 from "fast-glob";
-import { z as z14 } from "zod";
+import fg6 from "fast-glob";
+import { z as z18 } from "zod";
 async function planTeardown(root, selected) {
   const edits = [], diagnostics = [];
   const inputs = /* @__PURE__ */ new Map();
@@ -3662,7 +4315,7 @@ async function planTeardown(root, selected) {
   const setupBefore = await read(SETUP_PATH);
   const setup = setupBefore === null ? null : setupSchema.parse(JSON.parse(setupBefore));
   const automationBefore = await read(AUTOMATION_PATH);
-  const automation = automationBefore === null ? null : recordSchema.parse(JSON.parse(automationBefore));
+  const automation = automationBefore === null ? null : recordSchema2.parse(JSON.parse(automationBefore));
   const commands = (host) => new Set([
     automation?.hosts[host]?.command,
     ...ownership.files[configPath(host)]?.hookCommands ?? [],
@@ -3776,7 +4429,7 @@ async function planTeardown(root, selected) {
   if (diagnostics.length) edits.splice(instructionEditStart);
   if (!diagnostics.length) {
     const cleanup = [];
-    const receiptFiles = await fg5(
+    const receiptFiles = await fg6(
       selected.map((host) => ".mason/reports/automation/*/setup-" + host + ".json"),
       { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false }
     );
@@ -3789,7 +4442,7 @@ async function planTeardown(root, selected) {
     if (!remainingHost) await attempt(".mason/local/project.json", async () => {
       const before = await read(".mason/local/project.json");
       if (before === null) return;
-      z14.object({ version: z14.literal(1), initializedAt: z14.string() }).strict().parse(JSON.parse(before));
+      z18.object({ version: z18.literal(1), initializedAt: z18.string() }).strict().parse(JSON.parse(before));
       cleanup.push({ path: ".mason/local/project.json", before, after: null });
     });
     if (!diagnostics.length) {
@@ -3861,14 +4514,14 @@ var init_teardown = __esm({
     init_model();
     init_ownership();
     hosts = ["codex", "claude"];
-    object2 = z14.record(z14.unknown());
+    object2 = z18.record(z18.unknown());
     json = (value) => JSON.stringify(value, null, 2) + "\n";
   }
 });
 
 // src/review/cochange.ts
-import { execFile as execFile11 } from "child_process";
-import { promisify as promisify11 } from "util";
+import { execFile as execFile12 } from "child_process";
+import { promisify as promisify12 } from "util";
 async function buildMatrix(resolvedRoot) {
   try {
     const { stdout: shallow } = await exec9("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
@@ -3933,7 +4586,7 @@ var exec9, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_R
 var init_cochange = __esm({
   "src/review/cochange.ts"() {
     "use strict";
-    exec9 = promisify11(execFile11);
+    exec9 = promisify12(execFile12);
     HISTORY_COMMITS = 1500;
     MIN_FILE_COMMITS = 5;
     MIN_SHARED_COMMITS = 4;
@@ -3988,7 +4641,7 @@ var init_types2 = __esm({
 });
 
 // src/review/evidence/vitest.ts
-import { z as z15 } from "zod";
+import { z as z19 } from "zod";
 function parseVitest(raw, sourceRoot) {
   const report = schema.parse(raw);
   const findings = [], diagnostics = [];
@@ -4031,30 +4684,30 @@ function parseVitest(raw, sourceRoot) {
     diagnostics
   };
 }
-var count2, schema;
+var count3, schema;
 var init_vitest = __esm({
   "src/review/evidence/vitest.ts"() {
     "use strict";
     init_paths2();
     init_types2();
-    count2 = z15.number().int().nonnegative();
-    schema = z15.object({
-      success: z15.boolean(),
-      numTotalTests: count2,
-      numPassedTests: count2,
-      numFailedTests: count2,
-      numPendingTests: count2,
-      numTodoTests: count2,
-      numFailedTestSuites: count2,
-      testResults: z15.array(z15.object({
-        name: z15.string().min(1),
-        status: z15.enum(["passed", "failed"]),
-        message: z15.string().optional(),
-        assertionResults: z15.array(z15.object({
-          fullName: z15.string(),
-          status: z15.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
-          failureMessages: z15.array(z15.string()).nullable().optional(),
-          location: z15.object({ line: count2, column: count2 }).nullable().optional()
+    count3 = z19.number().int().nonnegative();
+    schema = z19.object({
+      success: z19.boolean(),
+      numTotalTests: count3,
+      numPassedTests: count3,
+      numFailedTests: count3,
+      numPendingTests: count3,
+      numTodoTests: count3,
+      numFailedTestSuites: count3,
+      testResults: z19.array(z19.object({
+        name: z19.string().min(1),
+        status: z19.enum(["passed", "failed"]),
+        message: z19.string().optional(),
+        assertionResults: z19.array(z19.object({
+          fullName: z19.string(),
+          status: z19.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
+          failureMessages: z19.array(z19.string()).nullable().optional(),
+          location: z19.object({ line: count3, column: count3 }).nullable().optional()
         }))
       }))
     });
@@ -4062,7 +4715,7 @@ var init_vitest = __esm({
 });
 
 // src/review/evidence/sarif.ts
-import { z as z16 } from "zod";
+import { z as z20 } from "zod";
 function parseSarif(raw, sourceRoot) {
   const report = schema2.parse(raw), findings = [], diagnostics = [];
   let active = 0, suppressed = 0, absent = 0, unresolved = 0;
@@ -4153,40 +4806,98 @@ var init_sarif = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    index = z16.number().int().nonnegative();
-    artifact = z16.object({ uri: z16.string().optional(), uriBaseId: z16.string().optional(), index: index.optional() });
-    message = z16.object({ text: z16.string().optional(), markdown: z16.string().optional(), id: z16.string().optional(), arguments: z16.array(z16.string()).optional() });
-    level = z16.enum(["error", "warning", "note", "none"]);
-    location = z16.object({ physicalLocation: z16.object({ artifactLocation: artifact.optional(), region: z16.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
-    schema2 = z16.object({
-      version: z16.literal("2.1.0"),
-      runs: z16.array(z16.object({
-        tool: z16.object({ driver: z16.object({ name: z16.string().min(1), rules: z16.array(z16.object({ id: z16.string(), defaultConfiguration: z16.object({ level: level.optional() }).optional(), messageStrings: z16.record(message).optional() })).optional(), globalMessageStrings: z16.record(message).optional() }) }),
-        invocations: z16.array(z16.object({ executionSuccessful: z16.boolean(), commandLine: z16.string().optional(), toolExecutionNotifications: z16.array(z16.object({ level: level.optional(), message })).optional() })).optional(),
-        versionControlProvenance: z16.array(z16.object({ revisionId: z16.string().optional() })).optional(),
-        originalUriBaseIds: z16.record(artifact).optional(),
-        artifacts: z16.array(z16.object({ location: artifact.optional() })).optional(),
-        results: z16.array(z16.object({
-          ruleId: z16.string().optional(),
+    index = z20.number().int().nonnegative();
+    artifact = z20.object({ uri: z20.string().optional(), uriBaseId: z20.string().optional(), index: index.optional() });
+    message = z20.object({ text: z20.string().optional(), markdown: z20.string().optional(), id: z20.string().optional(), arguments: z20.array(z20.string()).optional() });
+    level = z20.enum(["error", "warning", "note", "none"]);
+    location = z20.object({ physicalLocation: z20.object({ artifactLocation: artifact.optional(), region: z20.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
+    schema2 = z20.object({
+      version: z20.literal("2.1.0"),
+      runs: z20.array(z20.object({
+        tool: z20.object({ driver: z20.object({ name: z20.string().min(1), rules: z20.array(z20.object({ id: z20.string(), defaultConfiguration: z20.object({ level: level.optional() }).optional(), messageStrings: z20.record(message).optional() })).optional(), globalMessageStrings: z20.record(message).optional() }) }),
+        invocations: z20.array(z20.object({ executionSuccessful: z20.boolean(), commandLine: z20.string().optional(), toolExecutionNotifications: z20.array(z20.object({ level: level.optional(), message })).optional() })).optional(),
+        versionControlProvenance: z20.array(z20.object({ revisionId: z20.string().optional() })).optional(),
+        originalUriBaseIds: z20.record(artifact).optional(),
+        artifacts: z20.array(z20.object({ location: artifact.optional() })).optional(),
+        results: z20.array(z20.object({
+          ruleId: z20.string().optional(),
           ruleIndex: index.optional(),
           message,
           level: level.optional(),
-          kind: z16.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
-          baselineState: z16.enum(["new", "unchanged", "updated", "absent"]).optional(),
-          suppressions: z16.array(z16.object({ kind: z16.enum(["inSource", "external"]), status: z16.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
-          locations: z16.array(location).optional(),
-          relatedLocations: z16.array(location).optional()
+          kind: z20.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
+          baselineState: z20.enum(["new", "unchanged", "updated", "absent"]).optional(),
+          suppressions: z20.array(z20.object({ kind: z20.enum(["inSource", "external"]), status: z20.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
+          locations: z20.array(location).optional(),
+          relatedLocations: z20.array(location).optional()
         })).optional()
       }))
     });
   }
 });
 
+// src/review/evidence/check.ts
+import { z as z21 } from "zod";
+function parseCheck(raw, sourceRoot) {
+  const report = schema3.parse(raw);
+  const diagnostics = [], findings = [];
+  const counts = { total: report.results.length, passed: 0, failed: 0, skipped: 0 };
+  for (const [index2, result] of report.results.entries()) {
+    counts[result.status]++;
+    const locations = result.locations.flatMap((location2) => {
+      const file = evidencePath(location2.file, sourceRoot);
+      if (!file) {
+        diagnostics.push(`Check location is outside the declared checkout or invalid: ${location2.file}`);
+        return [];
+      }
+      return [{ ...location2, file }];
+    });
+    if (result.status === "failed") findings.push({
+      id: String(index2),
+      ...messagePreview([result.name, result.message].filter(Boolean).join("\n")),
+      severity: "error",
+      state: "active",
+      locations
+    });
+  }
+  if (!counts.total) diagnostics.push("No check results were recorded; an empty report is not passing evidence.");
+  if (counts.skipped) diagnostics.push(`${counts.skipped} checks were skipped; verification is incomplete.`);
+  return {
+    outcome: counts.failed ? "failed" : !counts.total ? "unavailable" : !counts.passed ? "skipped" : "passed",
+    counts,
+    findings,
+    incomplete: diagnostics.length > 0,
+    diagnostics,
+    ...report.commit ? { reportedCommits: [report.commit] } : {}
+  };
+}
+var schema3;
+var init_check = __esm({
+  "src/review/evidence/check.ts"() {
+    "use strict";
+    init_paths2();
+    init_types2();
+    schema3 = z21.object({
+      version: z21.literal(1),
+      commit: z21.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).optional(),
+      results: z21.array(z21.object({
+        name: z21.string().min(1).max(1e3),
+        status: z21.enum(["passed", "failed", "skipped"]),
+        message: z21.string().max(1e5).optional(),
+        locations: z21.array(z21.object({
+          file: z21.string().min(1).max(4e3),
+          line: z21.number().int().positive().optional(),
+          column: z21.number().int().positive().optional()
+        })).max(100).default([])
+      })).max(1e5)
+    });
+  }
+});
+
 // src/review/evidence.ts
-import path19 from "path";
-import { z as z17 } from "zod";
+import path22 from "path";
+import { z as z22 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path19.isAbsolute(file) ? path19.relative(root, file) : file;
+  const relative = path22.isAbsolute(file) ? path22.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -4225,7 +4936,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
     let manifest, raw;
     try {
       manifest = relativeArtifact(root, supplied);
-      raw = z17.object({ version: z17.literal(1), checks: z17.array(z17.unknown()) }).parse(await readStoreJson(root, manifest));
+      raw = z22.object({ version: z22.literal(1), checks: z22.array(z22.unknown()) }).parse(await readStoreJson(root, manifest));
     } catch (error) {
       output.diagnostics.push(`${supplied}: ${String(error)}`);
       continue;
@@ -4264,7 +4975,8 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         counts: {},
         incomplete: false,
         diagnostics: [],
-        truncated: false
+        truncated: false,
+        ...check.environment ? { environment: check.environment } : {}
       };
       output.checks.push(result);
       if (check.workingTreeClean !== true) result.diagnostics.push("The check's working tree was dirty or not recorded; its results cannot be attributed to the claimed commit alone.");
@@ -4277,13 +4989,13 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
       }
       try {
         if (!check.report) throw new Error("Completed check has no report artifact.");
-        if (check.kind === "tests" !== (check.report.format === "vitest-json")) throw new Error("Test checks require vitest-json; analysis checks require sarif.");
+        if (check.report.format !== "mason-check-json" && check.kind === "tests" !== (check.report.format === "vitest-json")) throw new Error("Test checks require vitest-json or mason-check-json; analysis checks require sarif or mason-check-json.");
         const file = relativeArtifact(root, check.report.path);
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path19.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
-        const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : parseSarif(report, sourceRoot);
+        if (!path22.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
         result.incomplete = parsed.incomplete;
@@ -4303,7 +5015,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
           result.outcome = "failed";
           result.diagnostics.push(`Check command exited ${check.exitCode} despite a report with no active failures.`);
         }
-        if (check.report.format === "vitest-json" && pairs === void 0) {
+        if (check.kind === "tests" && pairs === void 0) {
           try {
             pairs = (await buildTestMap(root)).paired;
           } catch (error) {
@@ -4377,29 +5089,36 @@ var init_evidence2 = __esm({
     init_provenance();
     init_vitest();
     init_sarif();
+    init_check();
     init_types2();
-    checkSchema2 = z17.object({
-      id: z17.string().min(1).max(100),
-      kind: z17.enum(["tests", "static-analysis", "security", "complexity", "duplication"]),
-      tool: z17.string().min(1).max(200),
-      command: z17.string().min(1).max(2e3),
-      commit: z17.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
-      workingTreeClean: z17.boolean().optional(),
-      source: z17.string().max(2e3).optional(),
-      sourceRoot: z17.string().min(1).max(4e3).optional(),
-      status: z17.enum(["completed", "skipped", "unavailable"]).default("completed"),
-      reason: z17.string().min(1).max(2e3).optional(),
-      exitCode: z17.number().int().nullable().optional(),
-      report: z17.object({ format: z17.enum(["vitest-json", "sarif"]), path: z17.string().min(1).max(4e3) }).optional()
+    checkSchema2 = z22.object({
+      id: z22.string().min(1).max(100),
+      kind: z22.enum(["tests", "static-analysis", "security", "complexity", "duplication", "documentation"]),
+      tool: z22.string().min(1).max(200),
+      command: z22.string().min(1).max(2e3),
+      commit: z22.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
+      workingTreeClean: z22.boolean().optional(),
+      source: z22.string().max(2e3).optional(),
+      sourceRoot: z22.string().min(1).max(4e3).optional(),
+      status: z22.enum(["completed", "skipped", "unavailable"]).default("completed"),
+      reason: z22.string().min(1).max(2e3).optional(),
+      exitCode: z22.number().int().nullable().optional(),
+      environment: z22.object({
+        toolVersion: z22.string().min(1).max(200),
+        runtime: z22.string().min(1).max(200).optional(),
+        platform: z22.string().min(1).max(200).optional(),
+        configuration: z22.array(z22.string().min(1).max(4e3)).max(100).optional()
+      }).optional(),
+      report: z22.object({ format: z22.enum(["vitest-json", "sarif", "mason-check-json"]), path: z22.string().min(1).max(4e3) }).optional()
     });
   }
 });
 
 // src/review/review.ts
-import fs16 from "fs/promises";
-import path20 from "path";
-import { execFile as execFile12 } from "child_process";
-import { promisify as promisify12 } from "util";
+import fs18 from "fs/promises";
+import path23 from "path";
+import { execFile as execFile13 } from "child_process";
+import { promisify as promisify13 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
   try {
     const { stdout } = await exec10("git", ["merge-base", base, head], {
@@ -4426,7 +5145,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path20.resolve(rootDir);
+  const resolvedRoot = path23.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -4476,7 +5195,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs16.access(path20.join(resolvedRoot, relPath));
+        await fs18.access(path23.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -4521,7 +5240,7 @@ var init_review = __esm({
     init_cochange();
     init_evidence2();
     init_snapshot();
-    exec10 = promisify12(execFile12);
+    exec10 = promisify13(execFile13);
     MAX_ANALYZED_FILES = 50;
   }
 });
@@ -4530,7 +5249,7 @@ var init_review = __esm({
 async function auditSummary(root) {
   try {
     const report = await computeAudit(root);
-    if (!report) return { status: "no-context-files", reason: "No AGENTS.md, CLAUDE.md, or .claude/CLAUDE.md found to audit." };
+    if (!report) return { status: "no-context-files", reason: "No README.md or agent instruction files found to audit." };
     if (!report.gitAvailable) return { status: "unavailable", reason: "Audit needs readable Git history to verify documentation claims.", docs: report.docs };
     return {
       ...report,
@@ -4839,16 +5558,16 @@ var init_setup = __esm({
 });
 
 // src/distribution/bundle.ts
-import fs17 from "fs/promises";
-import path21 from "path";
+import fs19 from "fs/promises";
+import path24 from "path";
 import { createHash as createHash4 } from "crypto";
-import { z as z18 } from "zod";
+import { z as z23 } from "zod";
 async function readBundle(root) {
-  const bytes = await fs17.readFile(await storePath(root, "bundle.json"));
+  const bytes = await fs19.readFile(await storePath(root, "bundle.json"));
   const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
   const windows = manifest.target.startsWith("win32-");
   for (const file of Object.keys(manifest.files)) {
-    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path21.isAbsolute(file)) {
+    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path24.isAbsolute(file)) {
       throw new Error("Unsafe path in Mason bundle: " + file);
     }
   }
@@ -4863,7 +5582,7 @@ async function verifyBundle(root, expectedHash) {
   if (bundle.manifest.target !== `${process.platform}-${process.arch}`) throw new Error("Mason bundle is for another platform. Install this platform's bundle and rerun setup.");
   const files = Object.keys(bundle.manifest.files);
   for (let i = 0; i < files.length; i += 8) await Promise.all(files.slice(i, i + 8).map(async (file) => {
-    if (sha256(await fs17.readFile(await storePath(root, file))) !== bundle.manifest.files[file]) throw new Error("Mason bundle checksum mismatch: " + file);
+    if (sha256(await fs19.readFile(await storePath(root, file))) !== bundle.manifest.files[file]) throw new Error("Mason bundle checksum mismatch: " + file);
   }));
   return bundle;
 }
@@ -4873,31 +5592,31 @@ var init_bundle = __esm({
     "use strict";
     init_storage();
     targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
-    digest2 = z18.string().regex(/^[a-f0-9]{64}$/);
-    bundleSchema = z18.object({
-      format: z18.literal(1),
-      version: z18.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
-      target: z18.enum(targets),
-      nodeVersion: z18.string(),
-      files: z18.record(digest2)
+    digest2 = z23.string().regex(/^[a-f0-9]{64}$/);
+    bundleSchema = z23.object({
+      format: z23.literal(1),
+      version: z23.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
+      target: z23.enum(targets),
+      nodeVersion: z23.string(),
+      files: z23.record(digest2)
     }).strict();
     sha256 = (bytes) => createHash4("sha256").update(bytes).digest("hex");
   }
 });
 
 // src/distribution/path.ts
-import fs18 from "fs/promises";
+import fs20 from "fs/promises";
 import os3 from "os";
-import path22 from "path";
-import { execFile as execFile13 } from "child_process";
-import { promisify as promisify13 } from "util";
+import path25 from "path";
+import { execFile as execFile14 } from "child_process";
+import { promisify as promisify14 } from "util";
 import { createHash as createHash5, randomUUID as randomUUID7 } from "crypto";
-import { z as z19 } from "zod";
+import { z as z24 } from "zod";
 async function configurePath(bin, previous, save, options = {}) {
   const env = options.env ?? process.env, platform = options.platform ?? process.platform;
   const changes = [...previous];
   const currentPath = platform === "win32" ? Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] : env.PATH;
-  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path22.posix.isAbsolute(entry) && path22.posix.resolve(entry) === path22.posix.resolve(bin));
+  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path25.posix.isAbsolute(entry) && path25.posix.resolve(entry) === path25.posix.resolve(bin));
   const message2 = alreadyOnPath ? "Run: mason setup --host codex" : "Open a new terminal, then run: mason setup --host codex";
   const manual = (reason2) => ({ status: "manual", changes, message: `${reason2}
 ${alreadyOnPath ? message2 : `Add ${bin} to your PATH, then run: mason setup --host codex`}` });
@@ -4915,33 +5634,33 @@ ${alreadyOnPath ? message2 : `Add ${bin} to your PATH, then run: mason setup --h
       }
       return { status: "configured", changes, message: message2 };
     }
-    const shell = path22.basename(env.SHELL ?? os3.userInfo().shell ?? "");
+    const shell = path25.basename(env.SHELL ?? os3.userInfo().shell ?? "");
     const userHome = options.userHome ?? os3.homedir();
     let profiles;
     if (!["bash", "zsh", "sh"].includes(shell)) return manual(`Automatic PATH setup is unavailable for ${shell || "an unknown shell"}.`);
-    if (env.MASON_PROFILE) profiles = [path22.resolve(env.MASON_PROFILE)];
-    else if (shell === "zsh") profiles = [path22.join(env.ZDOTDIR || userHome, ".zshrc")];
-    else if (shell === "sh") profiles = [path22.join(userHome, ".profile")];
+    if (env.MASON_PROFILE) profiles = [path25.resolve(env.MASON_PROFILE)];
+    else if (shell === "zsh") profiles = [path25.join(env.ZDOTDIR || userHome, ".zshrc")];
+    else if (shell === "sh") profiles = [path25.join(userHome, ".profile")];
     else {
-      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path22.join(userHome, name));
+      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path25.join(userHome, name));
       let login = candidates[2];
-      for (const file of candidates) if (await fs18.lstat(file).then(() => true, (error) => {
+      for (const file of candidates) if (await fs20.lstat(file).then(() => true, (error) => {
         if (error.code === "ENOENT") return false;
         throw error;
       })) {
         login = file;
         break;
       }
-      profiles = [path22.join(userHome, ".bashrc"), login];
+      profiles = [path25.join(userHome, ".bashrc"), login];
     }
     const marker = `# >>> mason PATH ${createHash5("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
     for (const profile of profiles) {
-      const stat = await fs18.lstat(profile).catch((error) => {
+      const stat = await fs20.lstat(profile).catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
-      const file = stat?.isSymbolicLink() ? await fs18.realpath(profile) : path22.resolve(profile);
-      const original = await fs18.readFile(file).catch((error) => {
+      const file = stat?.isSymbolicLink() ? await fs20.realpath(profile) : path25.resolve(profile);
+      const original = await fs20.readFile(file).catch((error) => {
         if (error.code === "ENOENT" && !stat) return null;
         throw error;
       });
@@ -4956,8 +5675,8 @@ ${alreadyOnPath ? message2 : `Add ${bin} to your PATH, then run: mason setup --h
         changes.push({ kind: "profile", file, block, created: original === null });
         await save(changes);
       }
-      await fs18.mkdir(path22.dirname(file), { recursive: true });
-      const handle = await fs18.open(file, original === null ? "ax+" : "a+", 384);
+      await fs20.mkdir(path25.dirname(file), { recursive: true });
+      const handle = await fs20.open(file, original === null ? "ax+" : "a+", 384);
       try {
         if (!(await handle.readFile()).equals(original ?? Buffer.alloc(0))) throw new Error(`Shell profile changed during installation: ${profile}`);
         await handle.writeFile(block);
@@ -4981,13 +5700,13 @@ async function removePath(changes) {
         await windowsPath("remove", change.entry, current, change.created);
         continue;
       }
-      const stat = await fs18.lstat(change.file).catch((error) => {
+      const stat = await fs20.lstat(change.file).catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
       if (!stat) continue;
       if (!stat.isFile()) throw new Error("profile type changed");
-      const bytes = await fs18.readFile(change.file), text2 = bytes.toString("utf8");
+      const bytes = await fs20.readFile(change.file), text2 = bytes.toString("utf8");
       if (!Buffer.from(text2).equals(bytes)) throw new Error("profile encoding changed");
       const index2 = text2.indexOf(change.block);
       if (index2 < 0 || text2.indexOf(change.block, index2 + change.block.length) >= 0) throw new Error("PATH block was edited or removed");
@@ -4997,7 +5716,7 @@ async function removePath(changes) {
       const temporary = change.file + ".mason-" + randomUUID7();
       try {
         if (stat.nlink > 1) throw new Error("profile has multiple hard links");
-        const handle = await fs18.open(temporary, "wx", stat.mode & 511);
+        const handle = await fs20.open(temporary, "wx", stat.mode & 511);
         try {
           await handle.writeFile(next);
           await handle.chmod(stat.mode & 511);
@@ -5006,11 +5725,11 @@ async function removePath(changes) {
         } finally {
           await handle.close();
         }
-        const current = await fs18.lstat(change.file);
-        if (!current.isFile() || current.ino !== stat.ino || !(await fs18.readFile(change.file)).equals(bytes)) throw new Error("profile changed during uninstall");
-        await fs18.rename(temporary, change.file);
+        const current = await fs20.lstat(change.file);
+        if (!current.isFile() || current.ino !== stat.ino || !(await fs20.readFile(change.file)).equals(bytes)) throw new Error("profile changed during uninstall");
+        await fs20.rename(temporary, change.file);
       } finally {
-        await fs18.rm(temporary, { force: true });
+        await fs20.rm(temporary, { force: true });
       }
     } catch (error) {
       warnings.push(`Retained PATH setting ${change.kind === "profile" ? change.file : change.entry}: ${error instanceof Error ? error.message : String(error)}`);
@@ -5044,20 +5763,20 @@ try {
   @{ value = $next; kind = $kind } | ConvertTo-Json -Compress
 } finally { $key.Dispose() }
 `;
-  const { stdout } = await execute2("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { windowsHide: true, timeout: 15e3, maxBuffer: 1024 * 1024 });
+  const { stdout } = await execute3("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { windowsHide: true, timeout: 15e3, maxBuffer: 1024 * 1024 });
   return JSON.parse(stdout.replace(/^\uFEFF/, "").trim());
 }
-var execute2, pathChangeSchema, quote, normalizeWindowsEntry, hasWindowsEntry;
+var execute3, pathChangeSchema, quote, normalizeWindowsEntry, hasWindowsEntry;
 var init_path = __esm({
   "src/distribution/path.ts"() {
     "use strict";
-    execute2 = promisify13(execFile13);
-    pathChangeSchema = z19.discriminatedUnion("kind", [
-      z19.object({ kind: z19.literal("profile"), file: z19.string(), block: z19.string(), created: z19.boolean() }),
-      z19.object({ kind: z19.literal("windows"), entry: z19.string(), created: z19.boolean() })
+    execute3 = promisify14(execFile14);
+    pathChangeSchema = z24.discriminatedUnion("kind", [
+      z24.object({ kind: z24.literal("profile"), file: z24.string(), block: z24.string(), created: z24.boolean() }),
+      z24.object({ kind: z24.literal("windows"), entry: z24.string(), created: z24.boolean() })
     ]);
     quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
-    normalizeWindowsEntry = (value) => path22.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
+    normalizeWindowsEntry = (value) => path25.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
     hasWindowsEntry = (value, entry, env = process.env) => {
       const variables = new Map(Object.entries(env).map(([key, value2]) => [key.toLowerCase(), value2]));
       const expand = (part) => part.replace(/%([^%]+)%/g, (match, key) => variables.get(key.toLowerCase()) ?? match);
@@ -5075,41 +5794,41 @@ __export(install_exports2, {
   uninstallStandalone: () => uninstallStandalone,
   upgradeStandalone: () => upgradeStandalone
 });
-import fs19 from "fs/promises";
+import fs21 from "fs/promises";
 import os4 from "os";
-import path23 from "path";
+import path26 from "path";
 import { fileURLToPath } from "url";
 import { spawn } from "child_process";
 import { randomUUID as randomUUID8 } from "crypto";
-import { z as z20 } from "zod";
+import { z as z25 } from "zod";
 async function replace(file, content2, mode = 384) {
   const temp = file + ".tmp-" + randomUUID8();
   try {
-    await fs19.writeFile(temp, content2, { mode, flag: "wx" });
-    await fs19.rename(temp, file);
+    await fs21.writeFile(temp, content2, { mode, flag: "wx" });
+    await fs21.rename(temp, file);
   } finally {
-    await fs19.rm(temp, { force: true });
+    await fs21.rm(temp, { force: true });
   }
 }
 async function installStandalone(source) {
   const bundle = await verifyBundle(source);
-  const selectedHome = path23.resolve(defaultHome());
-  await fs19.mkdir(selectedHome, { recursive: true });
-  const home = await fs19.realpath(selectedHome);
-  const selectedBin = path23.resolve(process.env.MASON_BIN_DIR ?? (process.platform === "win32" ? path23.join(home, "bin") : path23.join(os4.homedir(), ".local/bin")));
+  const selectedHome = path26.resolve(defaultHome());
+  await fs21.mkdir(selectedHome, { recursive: true });
+  const home = await fs21.realpath(selectedHome);
+  const selectedBin = path26.resolve(process.env.MASON_BIN_DIR ?? (process.platform === "win32" ? path26.join(home, "bin") : path26.join(os4.homedir(), ".local/bin")));
   return withLock(home, ".install-lock", async () => {
     const raw = await readStoreJson(home, "install.json");
-    const previous = raw === null ? null : recordSchema2.parse(raw);
-    if (!previous) for (const file of await fs19.readdir(home)) {
+    const previous = raw === null ? null : recordSchema3.parse(raw);
+    if (!previous) for (const file of await fs21.readdir(home)) {
       if (file === ".install-lock") continue;
-      const directory = path23.join(home, file);
-      const stat = await fs19.lstat(directory);
-      if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs19.readdir(directory)).length) {
+      const directory = path26.join(home, file);
+      const stat = await fs21.lstat(directory);
+      if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs21.readdir(directory)).length) {
         throw new Error("Mason installation directory is not empty and has no ownership receipt.");
       }
     }
-    await fs19.mkdir(selectedBin, { recursive: true });
-    const bin = await fs19.realpath(selectedBin);
+    await fs21.mkdir(selectedBin, { recursive: true });
+    const bin = await fs21.realpath(selectedBin);
     if (previous && (previous.home !== home || previous.bin !== bin)) throw new Error("Installation paths differ from the existing Mason receipt.");
     const id = bundle.manifestHash.slice(0, 24);
     const destination = await storePath(home, "versions/" + id);
@@ -5120,10 +5839,10 @@ $previousToken = $env:MASON_UNINSTALL_TOKEN
 $token = [Guid]::NewGuid().ToString()
 $env:MASON_UNINSTALL_TOKEN = $token
 try {
-  & ${psQuote(path23.join(destination, "node.exe"))} ${psQuote(path23.join(destination, "app/dist/mason.js"))} @args
+  & ${psQuote(path26.join(destination, "node.exe"))} ${psQuote(path26.join(destination, "app/dist/mason.js"))} @args
   $code = $LASTEXITCODE
   if ($code -eq 0 -and $args.Count -eq 1 -and $args[0] -eq 'uninstall') {
-    if ([IO.File]::ReadAllText(${psQuote(path23.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
+    if ([IO.File]::ReadAllText(${psQuote(path26.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
     Remove-Item -LiteralPath ${psQuote(home)} -Recurse -Force
     Write-Output ${psQuote("Removed standalone installation: " + home)}
   }
@@ -5132,11 +5851,11 @@ try {
 finally { $env:MASON_UNINSTALL_TOKEN = $previousToken }
 `
     } : { mason: `#!/bin/sh
-exec ${shQuote(path23.join(destination, "node"))} ${shQuote(path23.join(destination, "app/dist/mason.js"))} "$@"
+exec ${shQuote(path26.join(destination, "node"))} ${shQuote(path26.join(destination, "app/dist/mason.js"))} "$@"
 ` };
     for (const [name, content2] of Object.entries(launchers)) {
       const file = await storePath(bin, name);
-      const old = await fs19.readFile(file, "utf8").catch((error) => {
+      const old = await fs21.readFile(file, "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
@@ -5145,7 +5864,7 @@ exec ${shQuote(path23.join(destination, "node"))} ${shQuote(path23.join(destinat
     const retired = Object.entries({ ...previous?.previousLaunchers, ...previous?.launchers }).filter(([name]) => !(name in launchers));
     const checkRetired = async (name, expected) => {
       if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
-      const actual = await fs19.readFile(await storePath(bin, name), "utf8").catch((error) => {
+      const actual = await fs21.readFile(await storePath(bin, name), "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
@@ -5155,28 +5874,28 @@ exec ${shQuote(path23.join(destination, "node"))} ${shQuote(path23.join(destinat
     const receipt = { format: 1, home, bin, current: id, version: bundle.manifest.version, launchers, pathChanges: previous?.pathChanges ?? [] };
     await writeStoreJson(home, "install.json", { ...receipt, previousLaunchers: previous?.previousLaunchers ?? previous?.launchers });
     const stage = await storePath(home, "versions/.install-" + randomUUID8(), true);
-    await fs19.mkdir(stage);
+    await fs21.mkdir(stage);
     try {
       for (const file of ["bundle.json", ...Object.keys(bundle.manifest.files)]) {
         const from = await storePath(source, file), to = await storePath(stage, file, true);
-        await fs19.copyFile(from, to);
-        await fs19.chmod(to, (await fs19.stat(from)).mode & 511);
+        await fs21.copyFile(from, to);
+        await fs21.chmod(to, (await fs21.stat(from)).mode & 511);
       }
       await verifyBundle(stage, bundle.manifestHash);
-      const exists2 = await fs19.lstat(destination).then(() => true, (error) => {
+      const exists = await fs21.lstat(destination).then(() => true, (error) => {
         if (error.code === "ENOENT") return false;
         throw error;
       });
-      if (exists2) await verifyBundle(destination, bundle.manifestHash);
-      else await fs19.rename(stage, destination);
+      if (exists) await verifyBundle(destination, bundle.manifestHash);
+      else await fs21.rename(stage, destination);
       for (const [name, content2] of Object.entries(launchers)) await replace(await storePath(bin, name, true), content2, 493);
       for (const [name, expected] of retired) {
         await checkRetired(name, expected);
-        await fs19.rm(await storePath(bin, name), { force: true });
+        await fs21.rm(await storePath(bin, name), { force: true });
       }
       await writeStoreJson(home, "install.json", receipt);
     } finally {
-      await fs19.rm(stage, { recursive: true, force: true });
+      await fs21.rm(stage, { recursive: true, force: true });
     }
     const pathResult = await configurePath(bin, receipt.pathChanges, async (changes) => {
       receipt.pathChanges = changes;
@@ -5186,12 +5905,12 @@ exec ${shQuote(path23.join(destination, "node"))} ${shQuote(path23.join(destinat
   });
 }
 async function currentInstallation() {
-  const app = path23.dirname(path23.dirname(fileURLToPath(import.meta.url)));
-  const bundle = path23.dirname(app), home = path23.dirname(path23.dirname(bundle));
+  const app = path26.dirname(path26.dirname(fileURLToPath(import.meta.url)));
+  const bundle = path26.dirname(app), home = path26.dirname(path26.dirname(bundle));
   const raw = await readStoreJson(home, "install.json");
   if (!raw) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
-  const record = recordSchema2.parse(raw);
-  if (record.home !== await fs19.realpath(home) || path23.dirname(bundle) !== path23.join(home, "versions")) throw new Error("Invalid standalone installation receipt.");
+  const record = recordSchema3.parse(raw);
+  if (record.home !== await fs21.realpath(home) || path26.dirname(bundle) !== path26.join(home, "versions")) throw new Error("Invalid standalone installation receipt.");
   return { home, bundle, record };
 }
 async function upgradeStandalone(version) {
@@ -5199,7 +5918,7 @@ async function upgradeStandalone(version) {
   const { home, bundle, record } = await currentInstallation();
   await verifyBundle(bundle);
   const windows = process.platform === "win32";
-  const script = path23.join(bundle, windows ? "install.ps1" : "install.sh");
+  const script = path26.join(bundle, windows ? "install.ps1" : "install.sh");
   return new Promise((resolve, reject) => {
     const child = spawn(
       windows ? "powershell.exe" : "sh",
@@ -5220,7 +5939,7 @@ async function uninstallStandalone() {
     for (const [name, expected] of Object.entries(record.launchers)) {
       if (!launcherNames.includes(name)) throw new Error("Invalid owned launcher name.");
       const file = await storePath(record.bin, name);
-      const actual = await fs19.readFile(file, "utf8").catch((error) => {
+      const actual = await fs21.readFile(file, "utf8").catch((error) => {
         if (error.code === "ENOENT") return null;
         throw error;
       });
@@ -5228,12 +5947,12 @@ async function uninstallStandalone() {
     }
     for (const warning of await removePath(record.pathChanges ?? [])) console.error(warning);
     if (process.platform === "win32") await replace(await storePath(home, ".uninstall-request.txt", true), token);
-    for (const name of Object.keys(record.launchers)) await fs19.rm(await storePath(record.bin, name), { force: true });
+    for (const name of Object.keys(record.launchers)) await fs21.rm(await storePath(record.bin, name), { force: true });
   });
-  if (process.platform !== "win32") await fs19.rm(home, { recursive: true, force: true });
+  if (process.platform !== "win32") await fs21.rm(home, { recursive: true, force: true });
   return home;
 }
-var recordSchema2, shQuote, psQuote, WINDOWS_BATCH_LAUNCHER, launcherNames, defaultHome;
+var recordSchema3, shQuote, psQuote, WINDOWS_BATCH_LAUNCHER, launcherNames, defaultHome;
 var init_install2 = __esm({
   "src/distribution/install.ts"() {
     "use strict";
@@ -5241,21 +5960,21 @@ var init_install2 = __esm({
     init_storage();
     init_store();
     init_path();
-    recordSchema2 = z20.object({
-      format: z20.literal(1),
-      home: z20.string(),
-      bin: z20.string(),
-      current: z20.string().regex(/^[a-f0-9]{24}$/),
-      version: z20.string(),
-      launchers: z20.record(z20.string()),
-      previousLaunchers: z20.record(z20.string()).optional(),
-      pathChanges: z20.array(pathChangeSchema).optional()
+    recordSchema3 = z25.object({
+      format: z25.literal(1),
+      home: z25.string(),
+      bin: z25.string(),
+      current: z25.string().regex(/^[a-f0-9]{24}$/),
+      version: z25.string(),
+      launchers: z25.record(z25.string()),
+      previousLaunchers: z25.record(z25.string()).optional(),
+      pathChanges: z25.array(pathChangeSchema).optional()
     });
     shQuote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
     psQuote = (s) => "'" + s.replace(/'/g, "''") + "'";
     WINDOWS_BATCH_LAUNCHER = '@echo off\r\ngoto #_mason_handoff_# 2>NUL || title %COMSPEC% & powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "%~dp0mason-launcher.ps1" %*\r\n';
     launcherNames = ["mason", "mason.cmd", "mason.ps1", "mason-launcher.ps1"];
-    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path23.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path23.join(os4.homedir(), ".local/share/mason"));
+    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path26.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path26.join(os4.homedir(), ".local/share/mason"));
   }
 });
 
@@ -5385,7 +6104,7 @@ var inputArgs = process.argv.slice(2);
 var managedLaunch = inputArgs[0] === "--setup-host";
 var setupHost = managedLaunch ? inputArgs.splice(0, 2)[1] : void 0;
 var [command, ...args] = inputArgs;
-var usage = `Mason ${"0.16.2"}
+var usage = `Mason ${"0.17.0"}
 
 Usage: mason <command> [options]
 
@@ -5409,9 +6128,9 @@ try {
     const active = await prepareLaunch2(setupHost, { allowInactive: command === "auto" && isHookCommand(args) });
     if (!active) process.exit(0);
   }
-  if (command === "internal-integration-version") console.log(JSON.stringify({ protocol: 1, version: "0.16.2" }));
+  if (command === "internal-integration-version") console.log(JSON.stringify({ protocol: 1, version: "0.17.0" }));
   else if (!command || ["--help", "-h", "help"].includes(command)) console.log(usage);
-  else if (["--version", "-v"].includes(command)) console.log("0.16.2");
+  else if (["--version", "-v"].includes(command)) console.log("0.17.0");
   else if (command === "internal-install") {
     if (args.length) throw new Error("internal-install takes no arguments.");
     const { installStandalone: installStandalone2 } = await Promise.resolve().then(() => (init_install2(), install_exports2));