mason-context 0.17.3 → 0.18.0

package/dist/mason-auto.js

@@ -36,12 +36,69 @@ var init_paths = __esm({
   }
 });
 
+// src/utils/profile.ts
+import { AsyncLocalStorage } from "async_hooks";
+async function profilePhase(label, run) {
+  const phases = profiles.getStore();
+  if (!phases) return run();
+  const start = performance.now();
+  try {
+    return await run();
+  } finally {
+    const timing = phases[label] ??= { calls: 0, totalMs: 0 };
+    timing.calls++;
+    timing.totalMs += performance.now() - start;
+  }
+}
+async function withProfile(run, emit) {
+  const phases = {};
+  const start = performance.now();
+  return profiles.run(phases, async () => {
+    try {
+      return await run();
+    } finally {
+      emit(JSON.stringify({ kind: "mason-profile", version: 1, totalMs: performance.now() - start, phases }));
+    }
+  });
+}
+var profiles;
+var init_profile = __esm({
+  "src/utils/profile.ts"() {
+    "use strict";
+    profiles = new AsyncLocalStorage();
+  }
+});
+
+// src/utils/git-read.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+function execGit(args, options) {
+  const command = args.find((arg) => !arg.startsWith("-")) ?? "other";
+  return profilePhase("git." + (commands.has(command) ? command : "other"), async () => {
+    const { input: input2, ...processOptions } = options;
+    const operation = execute("git", args, processOptions);
+    if (input2 !== void 0) {
+      operation.child.stdin.on("error", () => {
+      });
+      operation.child.stdin.end(input2);
+    }
+    return operation;
+  });
+}
+var execute, commands;
+var init_git_read = __esm({
+  "src/utils/git-read.ts"() {
+    "use strict";
+    init_profile();
+    execute = promisify(execFile);
+    commands = /* @__PURE__ */ new Set(["rev-parse", "symbolic-ref", "for-each-ref", "ls-files", "check-ignore", "status", "log", "diff", "ls-tree", "show", "merge-base"]);
+  }
+});
+
 // src/utils/files.ts
 import fs from "fs/promises";
 import { constants } from "fs";
 import path2 from "path";
-import { execFile } from "child_process";
-import { promisify } from "util";
 import fg from "fast-glob";
 function isSensitiveFile(file) {
   return file.split(/[\\/]/).some(
@@ -95,12 +152,12 @@ async function createFileAccess(rootDir) {
   const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
   let gitFiles = null;
   try {
-    const { stdout } = await exec("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
+    const { stdout } = await execGit(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
     gitFiles = new Set(stdout.split("\0").filter(Boolean));
   } catch {
     let inGit = false;
     try {
-      await exec("git", ["rev-parse", "--git-dir"], { cwd: root });
+      await execGit(["rev-parse", "--git-dir"], { cwd: root });
       inGit = true;
     } catch {
     }
@@ -143,12 +200,12 @@ async function createFileAccess(rootDir) {
   }
   return { root, config, list, read };
 }
-var exec, SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
+var SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
 var init_files = __esm({
   "src/utils/files.ts"() {
     "use strict";
+    init_git_read();
     init_paths();
-    exec = promisify(execFile);
     SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
     SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
     SOURCE_IGNORE = [
@@ -248,18 +305,34 @@ var init_storage = __esm({
   }
 });
 
-// src/automation/store.ts
+// src/utils/store-lock.ts
 import fs3 from "fs/promises";
 import os from "os";
-import { z } from "zod";
-function parseState(raw) {
+async function lockDiagnostic(file) {
+  let reason2;
   try {
-    return stateSchema.parse(raw);
+    const owner = JSON.parse(await fs3.readFile(file, "utf8"));
+    if (!owner || typeof owner.host !== "string" || !Number.isInteger(owner.pid) || owner.pid <= 0) {
+      reason2 = "Lock owner data is incomplete or malformed.";
+    } else if (owner.host !== os.hostname()) {
+      reason2 = "The lock belongs to another host; its process cannot be checked locally.";
+    } else {
+      try {
+        process.kill(owner.pid, 0);
+        reason2 = `Local owner PID ${owner.pid} is still running.`;
+      } catch (error) {
+        reason2 = error.code === "ESRCH" ? `Local owner PID ${owner.pid} has exited, but lock recovery has not completed.` : `Local owner PID ${owner.pid} could not be checked.`;
+      }
+    }
   } catch (error) {
-    throw new Error("Invalid automation state; original evidence was retained.", { cause: error });
+    reason2 = error instanceof SyntaxError ? "Lock owner data is incomplete or malformed." : "Lock owner data could not be read; the lock may have changed.";
   }
+  if (await fs3.lstat(file + ".reclaim").then(() => true, () => false)) {
+    reason2 += " A recovery guard also needs inspection: " + file + ".reclaim.";
+  }
+  return reason2 + " Retry if a writer is active. For manual recovery, stop all Mason writers for this checkout, confirm they have exited (including other hosts), then remove only confirmed abandoned lock and lock.reclaim files. See docs/reference.md#snapshot-repairs-and-verification.";
 }
-async function withLock(root, directory, run, waitMs = 5e3) {
+async function withStoreLock(root, directory, run, waitMs = 5e3, label = "Mason store") {
   const file = await storePath(root, directory + "/lock", true);
   const deadline = Date.now() + waitMs;
   let handle;
@@ -302,7 +375,7 @@ async function withLock(root, directory, run, waitMs = 5e3) {
         }
       } catch {
       }
-      if (Date.now() >= deadline) throw new Error("Automation is busy or its lock needs inspection: " + file);
+      if (Date.now() >= deadline) throw new Error(label + " is busy or its lock needs inspection: " + file + ". " + await lockDiagnostic(file));
       await new Promise((resolve) => setTimeout(resolve, 40));
     }
   }
@@ -313,11 +386,30 @@ async function withLock(root, directory, run, waitMs = 5e3) {
     await fs3.unlink(file);
   }
 }
+var init_store_lock = __esm({
+  "src/utils/store-lock.ts"() {
+    "use strict";
+    init_storage();
+  }
+});
+
+// src/automation/store.ts
+import { z } from "zod";
+function parseState(raw) {
+  try {
+    return stateSchema.parse(raw);
+  } catch (error) {
+    throw new Error("Invalid automation state; original evidence was retained.", { cause: error });
+  }
+}
+function withLock(root, directory, run, waitMs = 5e3) {
+  return withStoreLock(root, directory, run, waitMs, "Automation");
+}
 var hostSchema, events, stateSchema;
 var init_store = __esm({
   "src/automation/store.ts"() {
     "use strict";
-    init_storage();
+    init_store_lock();
     hostSchema = z.enum(["claude", "codex"]);
     events = ["session_start", "turn_start", "before_tool", "after_tool", "task_end"];
     stateSchema = z.object({
@@ -346,39 +438,6 @@ var init_store = __esm({
   }
 });
 
-// src/utils/profile.ts
-import { AsyncLocalStorage } from "async_hooks";
-async function profilePhase(label, run) {
-  const phases = profiles.getStore();
-  if (!phases) return run();
-  const start = performance.now();
-  try {
-    return await run();
-  } finally {
-    const timing = phases[label] ??= { calls: 0, totalMs: 0 };
-    timing.calls++;
-    timing.totalMs += performance.now() - start;
-  }
-}
-async function withProfile(run, emit) {
-  const phases = {};
-  const start = performance.now();
-  return profiles.run(phases, async () => {
-    try {
-      return await run();
-    } finally {
-      emit(JSON.stringify({ kind: "mason-profile", version: 1, totalMs: performance.now() - start, phases }));
-    }
-  });
-}
-var profiles;
-var init_profile = __esm({
-  "src/utils/profile.ts"() {
-    "use strict";
-    profiles = new AsyncLocalStorage();
-  }
-});
-
 // src/audit/commands.ts
 import path4 from "path";
 function splitCommands(line) {
@@ -603,14 +662,14 @@ function extractClaims(content2) {
   const ignored = computeIgnoredLines(lines);
   const paths = /* @__PURE__ */ new Map();
   const counts = [];
-  const commands = /* @__PURE__ */ new Map();
+  const commands2 = /* @__PURE__ */ new Map();
   const addPath = (claim) => {
     const key = [claim.relativeTo ?? "scope", claim.path].join(":");
     if (!paths.has(key)) paths.set(key, claim);
   };
   const addCommand = (claim) => {
     const key = JSON.stringify([claim.scriptName, claim.directory, claim.scopeUnknown]);
-    if (!commands.has(key)) commands.set(key, claim);
+    if (!commands2.has(key)) commands2.set(key, claim);
   };
   const parsed = markdown.parse(lines.map((line, i) => ignored[i] ? "" : line).join("\n"), {});
   for (const token of parsed) {
@@ -712,7 +771,7 @@ function extractClaims(content2) {
   return {
     paths: [...paths.values()],
     counts,
-    commands: [...commands.values()]
+    commands: [...commands2.values()]
   };
 }
 var ROOT_FILE_NAMES, SHELL_FENCE_INFOS, markdown, COUNT_RE, COUNT_DENYLIST_RE, IGNORE_LINE, IGNORE_START, IGNORE_END;
@@ -762,9 +821,53 @@ var init_claims = __esm({
   }
 });
 
+// src/audit/inspection.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import path5 from "path";
+function withRepositoryInspection(root, run) {
+  return inspections.run({ root: path5.resolve(root), reads: /* @__PURE__ */ new Map() }, run);
+}
+function inspectionRead(root, key, read) {
+  const inspection = inspections.getStore();
+  if (!inspection || inspection.root !== path5.resolve(root)) return read();
+  if (!inspection.reads.has(key)) {
+    const pending = read();
+    inspection.reads.set(key, pending);
+    void pending.catch(() => {
+      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
+    });
+  }
+  return inspection.reads.get(key);
+}
+function inspectionGit(args, options) {
+  return inspectionRead(options.cwd, "git:" + JSON.stringify([args, options]), () => execGit(args, options));
+}
+async function auditGitPaths(root, kind) {
+  const shared = inspections.getStore()?.root === path5.resolve(root);
+  const specs = shared ? [...docSpecs, ...sourceSpecs] : kind === "documents" ? docSpecs : sourceSpecs;
+  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
+  const { stdout } = await inspectionGit(
+    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
+    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
+  );
+  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? /^(readme|agents|claude)\.md$/i.test(path5.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
+  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
+  return paths.sort();
+}
+var inspections, sourceSpecs, docSpecs, sourceSuffixes;
+var init_inspection = __esm({
+  "src/audit/inspection.ts"() {
+    "use strict";
+    init_git_read();
+    init_files();
+    inspections = new AsyncLocalStorage2();
+    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
+    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
+    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+  }
+});
+
 // src/audit/git.ts
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
 function parseCommitLine(line) {
   const parts = line.split("	");
   if (parts.length < 3 || !parts[0]) return null;
@@ -772,8 +875,7 @@ function parseCommitLine(line) {
 }
 async function lastCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec2(
-      "git",
+    const { stdout } = await inspectionGit(
       ["log", "-1", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
       { cwd: resolvedRoot }
     );
@@ -785,8 +887,7 @@ async function lastCommitOf(resolvedRoot, relPath) {
 }
 async function deletingCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec2(
-      "git",
+    const { stdout } = await inspectionGit(
       [
         "log",
         "-1",
@@ -805,8 +906,7 @@ async function deletingCommitOf(resolvedRoot, relPath) {
 }
 async function firstCommitOf(resolvedRoot, relPath) {
   try {
-    const { stdout } = await exec2(
-      "git",
+    const { stdout } = await inspectionGit(
       ["log", "--reverse", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
       { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
     );
@@ -819,8 +919,7 @@ async function firstCommitOf(resolvedRoot, relPath) {
 async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
   if (!fromHash || fromHash === "unknown") return null;
   try {
-    const { stdout } = await exec2(
-      "git",
+    const { stdout } = await inspectionGit(
       [
         "log",
         `${fromHash}..HEAD`,
@@ -844,11 +943,11 @@ async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
     return null;
   }
 }
-var exec2, COMMIT_FORMAT;
+var COMMIT_FORMAT;
 var init_git = __esm({
   "src/audit/git.ts"() {
     "use strict";
-    exec2 = promisify2(execFile2);
+    init_inspection();
     COMMIT_FORMAT = "%H%x09%cI%x09%s";
   }
 });
@@ -856,9 +955,7 @@ var init_git = __esm({
 // src/audit/inputs.ts
 import fs4 from "fs/promises";
 import * as nativeFs from "fs";
-import path5 from "path";
-import { execFile as execFile3 } from "child_process";
-import { promisify as promisify3 } from "util";
+import path6 from "path";
 import fg2 from "fast-glob";
 async function auditInputPath(root, file) {
   if (file === ".") return fs4.realpath(root);
@@ -885,7 +982,7 @@ async function auditGlob(root, patterns, options) {
   if (Array.isArray(patterns) && !patterns.length) return [];
   const directories = /* @__PURE__ */ new Set();
   const readdir2 = ((directory, opts, callback) => {
-    const relative = path5.relative(root, directory).split(path5.sep).join("/") || ".";
+    const relative = path6.relative(root, directory).split(path6.sep).join("/") || ".";
     directories.add(relative);
     if (directories.size > MAX_INPUTS) {
       callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
@@ -896,7 +993,7 @@ async function auditGlob(root, patterns, options) {
     }, callback);
   });
   const lstat2 = ((file, callback) => {
-    const relative = path5.relative(root, file).split(path5.sep).join("/") || ".";
+    const relative = path6.relative(root, file).split(path6.sep).join("/") || ".";
     auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
   });
   const stream = fg2.stream(patterns, {
@@ -933,62 +1030,48 @@ async function auditGlob(root, patterns, options) {
   return matches.sort();
 }
 async function gitSourcePaths(root) {
-  const { stdout } = await execute(
-    "git",
-    [
-      "ls-files",
-      "-z",
-      "--cached",
-      "--others",
-      "--exclude-standard",
-      "--",
-      ...SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`)
-    ],
-    { cwd: root, maxBuffer: 32 * 1024 * 1024, timeout: 1e4 }
-  );
-  return [...new Set(stdout.split("\0").filter(Boolean))].sort();
+  return auditGitPaths(root, "sources");
 }
 async function gitIgnoredPaths(root, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
-  const operation = execute(
-    "git",
-    ["check-ignore", "-z", "--stdin"],
-    { cwd: root, maxBuffer: 4 * 1024 * 1024, timeout: 1e4 }
-  );
-  operation.child.stdin.on("error", () => {
-  });
-  operation.child.stdin.end(files.join("\0") + "\0");
-  try {
-    return new Set((await operation).stdout.split("\0").filter(Boolean));
-  } catch (error) {
-    if (error.code === 1) return /* @__PURE__ */ new Set();
-    throw error;
+  const ignored = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < files.length; offset += 1e3) {
+    try {
+      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
+        cwd: root,
+        maxBuffer: 4 * 1024 * 1024,
+        timeout: 1e4,
+        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
+      });
+      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
+    } catch (error) {
+      if (error.code !== 1) throw error;
+    }
   }
+  return ignored;
 }
-var execute, MAX_INPUTS;
+var MAX_INPUTS;
 var init_inputs = __esm({
   "src/audit/inputs.ts"() {
     "use strict";
     init_files();
     init_storage();
-    execute = promisify3(execFile3);
+    init_git_read();
+    init_inspection();
     MAX_INPUTS = 1e5;
   }
 });
 
 // src/audit/docs.ts
 import fs5 from "fs/promises";
-import path6 from "path";
-import { execFile as execFile4 } from "child_process";
-import { promisify as promisify4 } from "util";
+import path7 from "path";
 import fg3 from "fast-glob";
 async function dirtyDocs(resolvedRoot, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
   try {
     const dirty = /* @__PURE__ */ new Set();
     for (let offset = 0; offset < files.length; offset += 256) {
-      const { stdout } = await exec3(
-        "git",
+      const { stdout } = await execGit(
         ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...files.slice(offset, offset + 256).map((file) => `:(literal)${file}`)],
         { cwd: resolvedRoot, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 }
       );
@@ -1008,25 +1091,10 @@ async function dirtyDocs(resolvedRoot, files) {
 async function discoverDocPaths(root) {
   let candidates = [];
   try {
-    const { stdout } = await exec3(
-      "git",
-      [
-        "ls-files",
-        "-z",
-        "--cached",
-        "--others",
-        "--exclude-standard",
-        "--",
-        ":(icase,glob)**/readme.md",
-        ":(icase,glob)**/agents.md",
-        ":(icase,glob)**/claude.md"
-      ],
-      { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 }
-    );
-    candidates = stdout.split("\0").filter(Boolean);
+    candidates = await auditGitPaths(root, "documents");
   } catch (error) {
     try {
-      await exec3("git", ["rev-parse", "--git-dir"], { cwd: root });
+      await execGit(["rev-parse", "--git-dir"], { cwd: root });
     } catch {
       return localDocPaths(root);
     }
@@ -1073,14 +1141,14 @@ async function localDocPaths(root) {
       throw error;
     }
     for (const entry of entries) if (/^(?:agents|claude|readme)\.md$/i.test(entry.name)) {
-      paths.push(path6.posix.join(dir, entry.name));
+      paths.push(path7.posix.join(dir, entry.name));
     }
   }
   return paths;
 }
 function documentScope(file) {
-  const parent = path6.posix.dirname(file);
-  return path6.posix.basename(parent).toLowerCase() === ".claude" ? path6.posix.dirname(parent) : parent;
+  const parent = path7.posix.dirname(file);
+  return path7.posix.basename(parent).toLowerCase() === ".claude" ? path7.posix.dirname(parent) : parent;
 }
 async function discoverDocs(resolvedRoot) {
   return profilePhase("audit.documents", () => readDocs(resolvedRoot));
@@ -1100,7 +1168,7 @@ async function readDocs(resolvedRoot) {
         path: candidate,
         content: content2,
         scope: documentScope(candidate),
-        kind: /^readme\.md$/i.test(path6.posix.basename(candidate)) ? "readme" : "instructions",
+        kind: /^readme\.md$/i.test(path7.posix.basename(candidate)) ? "readme" : "instructions",
         lineCount: content2.split("\n").length,
         lastCommit,
         dirty: dirty.has(candidate),
@@ -1110,16 +1178,17 @@ async function readDocs(resolvedRoot) {
   }
   return docs;
 }
-var exec3, DOC_CANDIDATES;
+var DOC_CANDIDATES;
 var init_docs = __esm({
   "src/audit/docs.ts"() {
     "use strict";
+    init_git_read();
     init_profile();
     init_claims();
     init_git();
     init_inputs();
     init_files();
-    exec3 = promisify4(execFile4);
+    init_inspection();
     DOC_CANDIDATES = [
       "AGENTS.md",
       "CLAUDE.md",
@@ -1130,14 +1199,14 @@ var init_docs = __esm({
 
 // src/audit/scope.ts
 import fs6 from "fs/promises";
-import path7 from "path";
+import path8 from "path";
 function scopedPath(directory, value) {
-  if (path7.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value)) return null;
-  const resolved = path7.posix.normalize(path7.posix.join(directory, value));
+  if (path8.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value)) return null;
+  const resolved = path8.posix.normalize(path8.posix.join(directory, value));
   return resolved === ".." || resolved.startsWith("../") ? null : resolved;
 }
 function pathClaimScope(doc, claim) {
-  const directory = claim.relativeTo === "document" ? path7.posix.dirname(doc) : documentScope(doc);
+  const directory = claim.relativeTo === "document" ? path8.posix.dirname(doc) : documentScope(doc);
   const local = scopedPath(directory, claim.path);
   if (!local) return null;
   const candidates = claim.relativeTo === "document" || directory === "." ? [local] : [...new Set([local, scopedPath(".", claim.path)].filter((p) => p !== null))];
@@ -1170,10 +1239,18 @@ var init_scope = __esm({
   }
 });
 
+// src/snapshot/lock.ts
+var init_lock = __esm({
+  "src/snapshot/lock.ts"() {
+    "use strict";
+    init_store_lock();
+  }
+});
+
 // src/test-map.ts
-import path8 from "path";
+import path9 from "path";
 async function buildTestMap(dir) {
-  const rootDir = path8.resolve(dir);
+  const rootDir = path9.resolve(dir);
   const access = await createFileAccess(rootDir);
   const testPatterns = [
     "**/*.test.*",
@@ -1194,7 +1271,7 @@ async function buildTestMap(dir) {
   const sourceByBaseName = /* @__PURE__ */ new Map();
   for (const file of sourceFiles) {
     if (testFiles.includes(file)) continue;
-    const baseName = path8.basename(file).replace(/\.[^.]+$/, "");
+    const baseName = path9.basename(file).replace(/\.[^.]+$/, "");
     const existing = sourceByBaseName.get(baseName) ?? [];
     existing.push(file);
     sourceByBaseName.set(baseName, existing);
@@ -1202,7 +1279,7 @@ async function buildTestMap(dir) {
   const paired = [];
   const unmatched = [];
   for (const testFile of testFiles) {
-    const testBaseName = path8.basename(testFile).replace(/\.[^.]+$/, "");
+    const testBaseName = path9.basename(testFile).replace(/\.[^.]+$/, "");
     const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
     if (!sourceName) {
       unmatched.push(testFile);
@@ -1210,10 +1287,10 @@ async function buildTestMap(dir) {
     }
     const candidates = sourceByBaseName.get(sourceName);
     if (candidates && candidates.length > 0) {
-      const testDir = path8.dirname(testFile);
+      const testDir = path9.dirname(testFile);
       const bestMatch = candidates.reduce((best, candidate) => {
-        const candidateDir = path8.dirname(candidate);
-        const bestDir = path8.dirname(best);
+        const candidateDir = path9.dirname(candidate);
+        const bestDir = path9.dirname(best);
         const candidateOverlap = commonSegments(testDir, candidateDir);
         const bestOverlap = commonSegments(testDir, bestDir);
         return candidateOverlap > bestOverlap ? candidate : best;
@@ -1247,9 +1324,7 @@ var init_test_map = __esm({
 });
 
 // src/snapshot/snapshot.ts
-import path9 from "path";
-import { execFile as execFile5 } from "child_process";
-import { promisify as promisify5 } from "util";
+import path10 from "path";
 import { z as z2 } from "zod";
 async function inspectSnapshot(rootDir) {
   try {
@@ -1265,7 +1340,7 @@ async function inspectSnapshot(rootDir) {
 }
 async function getCurrentGitHash(rootDir) {
   try {
-    const { stdout } = await exec4("git", ["rev-parse", "HEAD"], {
+    const { stdout } = await execGit(["rev-parse", "HEAD"], {
       cwd: rootDir
     });
     return stdout.trim();
@@ -1273,21 +1348,23 @@ async function getCurrentGitHash(rootDir) {
     return "unknown";
   }
 }
-var exec4, repoPath, verificationFields, featureSchema, flowSchema, snapshotSchema;
+var repoPath, verificationFields, featureSchema, flowSchema, snapshotSchema;
 var init_snapshot = __esm({
   "src/snapshot/snapshot.ts"() {
     "use strict";
+    init_git_read();
     init_files();
     init_files();
     init_storage();
+    init_lock();
     init_paths();
     init_test_map();
-    exec4 = promisify5(execFile5);
     repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
     verificationFields = {
       refreshedHash: z2.string().optional(),
       verifiedAt: z2.string().optional(),
       verifiedHash: z2.string().optional(),
+      verificationToken: z2.string().optional(),
       verificationFailed: z2.boolean().optional(),
       verificationNote: z2.string().optional()
     };
@@ -1312,9 +1389,7 @@ var init_snapshot = __esm({
 
 // src/drift/drift.ts
 import fs7 from "fs/promises";
-import path10 from "path";
-import { execFile as execFile6 } from "child_process";
-import { promisify as promisify6 } from "util";
+import path11 from "path";
 function parseChanges(output) {
   const fields = output.split("\0");
   const changes = [];
@@ -1335,7 +1410,7 @@ function touchedPaths(changes) {
 async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
   if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
   try {
-    const { stdout } = await exec5("git", ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
+    const { stdout } = await execGit(["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
     return parseChanges(stdout);
   } catch {
     return null;
@@ -1344,8 +1419,8 @@ async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
 async function getWorkingTree(resolvedRoot) {
   try {
     const [diff, untracked] = await Promise.all([
-      exec5("git", ["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
-      exec5("git", ["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
+      execGit(["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
+      execGit(["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
     ]);
     const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
     return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
@@ -1353,13 +1428,12 @@ async function getWorkingTree(resolvedRoot) {
     return { available: false, changedFiles: [], untrackedFiles: [] };
   }
 }
-var exec5;
 var init_drift = __esm({
   "src/drift/drift.ts"() {
     "use strict";
+    init_git_read();
     init_snapshot();
     init_paths();
-    exec5 = promisify6(execFile6);
   }
 });
 
@@ -1380,7 +1454,7 @@ var init_types = __esm({
 });
 
 // src/audit/checks/deleted-reference.ts
-import path11 from "path";
+import path12 from "path";
 async function checkDeletedReferences(ctx) {
   const result = emptyResult();
   for (const doc of ctx.docs) {
@@ -1409,7 +1483,7 @@ async function checkDeletedReferences(ctx) {
       const candidates = await Promise.all(scope.candidates.map(async (file) => ({
         file,
         tracked: await lastCommitOf(ctx.root, file),
-        parent: await pathExists(ctx.root, path11.posix.dirname(file))
+        parent: await pathExists(ctx.root, path12.posix.dirname(file))
       })));
       const candidate = candidates.find((c) => c.tracked || renames.has(c.file)) ?? candidates.find((c) => c.parent);
       if (!candidate && claim.relativeTo !== "document") continue;
@@ -1449,7 +1523,7 @@ var init_deleted_reference = __esm({
 // src/audit/checks/new-module.ts
 import fg4 from "fast-glob";
 import fs8 from "fs/promises";
-import path12 from "path";
+import path13 from "path";
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -1487,23 +1561,36 @@ async function checkNewModules(ctx) {
   return result;
 }
 function moduleDocumentation(docs) {
-  return docs.map((doc) => doc.content + "\n" + (path12.posix.dirname(doc.path) === "." ? "" : path12.posix.dirname(doc.path) + "/")).join("\n");
+  return docs.map((doc) => doc.content + "\n" + (path13.posix.dirname(doc.path) === "." ? "" : path13.posix.dirname(doc.path) + "/")).join("\n");
+}
+function moduleCandidates(root, combinedDocs) {
+  return inspectionRead(root, "modules:" + combinedDocs, () => collectModuleCandidates(root, combinedDocs));
 }
-async function moduleCandidates(root, combinedDocs) {
+async function collectModuleCandidates(root, combinedDocs) {
   const [config, sourcePaths] = await Promise.all([loadProjectConfig(root), gitSourcePaths(root)]);
   const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
   const sources = sourcePaths.filter((file) => !file.split("/").some((part) => part.startsWith(".")));
-  const listSubdirs = async (dir) => {
-    const entries = await fs8.readdir(await auditInputPath(root, dir), { withFileTypes: true });
-    const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink() && sources.some((file) => file.startsWith(path12.posix.join(dir, entry.name) + "/"))) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path12.posix.join(dir, entry.name));
-    const ignored = await gitIgnoredPaths(root, dirs);
-    const visible = new Set(dirs.filter((dir2) => !ignored.has(dir2) || sources.some((file) => file.startsWith(dir2 + "/"))));
-    return (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
-      ignore,
-      onlyDirectories: true,
-      label: "Module directory discovery",
-      select: (file) => visible.has(file)
-    })).map((file) => path12.posix.basename(file));
+  const listSubdirs = async (parents) => {
+    const byParent = /* @__PURE__ */ new Map();
+    for (let offset = 0; offset < parents.length; offset += 16) {
+      await Promise.all(parents.slice(offset, offset + 16).map(async (dir) => {
+        const entries = await fs8.readdir(await auditInputPath(root, dir), { withFileTypes: true });
+        const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink() && sources.some((file) => file.startsWith(path13.posix.join(dir, entry.name) + "/"))) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path13.posix.join(dir, entry.name));
+        byParent.set(dir, dirs);
+      }));
+    }
+    const ignored = await gitIgnoredPaths(root, [...byParent.values()].flat());
+    const result = /* @__PURE__ */ new Map();
+    for (const dir of parents) {
+      const visible = new Set(byParent.get(dir).filter((candidate) => !ignored.has(candidate) || sources.some((file) => file.startsWith(candidate + "/"))));
+      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
+        ignore,
+        onlyDirectories: true,
+        label: "Module directory discovery",
+        select: (file) => visible.has(file)
+      })).map((file) => path13.posix.basename(file)));
+    }
+    return result;
   };
   const countSourceFiles = async (dir) => {
     const files = sources.filter((file) => file.startsWith(dir + "/"));
@@ -1519,14 +1606,16 @@ async function moduleCandidates(root, combinedDocs) {
     return count4;
   };
   const candidates = [];
-  for (const topDir of await listSubdirs(".")) {
+  const topDirs = (await listSubdirs(["."])).get(".");
+  const nested = await listSubdirs(topDirs.filter((dir) => isMentioned(combinedDocs, dir)));
+  for (const topDir of topDirs) {
     const topMentioned = isMentioned(combinedDocs, topDir);
     if (!topMentioned) {
       const count4 = await countSourceFiles(topDir);
       if (count4 >= 1) candidates.push({ dir: topDir, sourceFileCount: count4 });
       continue;
     }
-    const subdirs = await listSubdirs(topDir);
+    const subdirs = nested.get(topDir);
     const mentioned = subdirs.filter((s) => isMentioned(combinedDocs, s));
     if (mentioned.length < ENUMERATION_THRESHOLD) continue;
     for (const sub of subdirs) {
@@ -1543,6 +1632,7 @@ var DIR_DENYLIST, SECOND_LEVEL_MIN_SOURCE_FILES, ENUMERATION_THRESHOLD;
 var init_new_module = __esm({
   "src/audit/checks/new-module.ts"() {
     "use strict";
+    init_inspection();
     init_files();
     init_inputs();
     init_git();
@@ -1572,7 +1662,7 @@ var init_new_module = __esm({
 });
 
 // src/audit/checks/stale-count.ts
-import path13 from "path";
+import path14 from "path";
 async function countGradleModules(root) {
   for (const name of ["settings.gradle.kts", "settings.gradle"]) {
     const content2 = await readAuditInput(root, name);
@@ -1606,7 +1696,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "package.json workspaces",
-        members: matched.map((m) => path13.dirname(m)).sort()
+        members: matched.map((m) => path14.dirname(m)).sort()
       };
     }
   }
@@ -1637,7 +1727,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "pnpm-workspace.yaml",
-        members: matched.map((m) => path13.dirname(m)).sort()
+        members: matched.map((m) => path14.dirname(m)).sort()
       };
     }
   }
@@ -1659,8 +1749,8 @@ async function countCargoCrates(root) {
         ignore: ["**/target/**"],
         label: "Cargo workspace discovery"
       });
-      for (const m of matched) members.add(path13.dirname(m));
-    } else if (await readAuditInput(root, path13.posix.join(entry, "Cargo.toml")) !== null) {
+      for (const m of matched) members.add(path14.dirname(m));
+    } else if (await readAuditInput(root, path14.posix.join(entry, "Cargo.toml")) !== null) {
       members.add(entry);
     }
   }
@@ -1680,7 +1770,7 @@ async function resolveCountSource(root, claim) {
 }
 async function resolveDocCountSource(root, doc, claim) {
   const scope = documentScope(doc);
-  const source = await resolveCountSource(path13.join(root, scope), claim);
+  const source = await resolveCountSource(path14.join(root, scope), claim);
   if (!source || scope === ".") return source;
   return {
     ...source,
@@ -1732,7 +1822,7 @@ var init_stale_count = __esm({
 });
 
 // src/audit/checks/dead-command.ts
-import path14 from "path";
+import path15 from "path";
 function scriptsOf(raw) {
   try {
     const pkg = JSON.parse(raw);
@@ -1768,7 +1858,7 @@ async function commandInputs(root, docs) {
     }
     let cursor = directory;
     while (true) {
-      const manifest = path14.posix.join(cursor, "package.json");
+      const manifest = path15.posix.join(cursor, "package.json");
       scope.candidates.push(manifest);
       const raw = await read(manifest);
       if (raw !== null) {
@@ -1779,7 +1869,7 @@ async function commandInputs(root, docs) {
         break;
       }
       if (claim.directory !== void 0 || cursor === ".") break;
-      cursor = path14.posix.dirname(cursor);
+      cursor = path15.posix.dirname(cursor);
     }
     if (!resolution.manifest && !resolution.problem) {
       resolution.problem = `No package.json for the command's scope (${directory}).`;
@@ -1842,10 +1932,8 @@ var init_dead_command = __esm({
 });
 
 // src/audit/release-metadata.ts
-import { execFile as execFile7 } from "child_process";
-import { promisify as promisify7 } from "util";
 async function git(root, args) {
-  return (await exec6("git", args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
+  return (await execGit(args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
 }
 function withoutAndroidReleaseValues(text2) {
   if (/\/\*|"""|'''/.test(text2) || !/id\s*\(?\s*["']com\.android\.(application|library)["']/.test(text2)) return null;
@@ -1891,11 +1979,10 @@ async function releaseMetadataOnly(root, commit) {
     return false;
   }
 }
-var exec6;
 var init_release_metadata = __esm({
   "src/audit/release-metadata.ts"() {
     "use strict";
-    exec6 = promisify7(execFile7);
+    init_git_read();
   }
 });
 
@@ -1991,7 +2078,7 @@ var init_deps_changed = __esm({
 });
 
 // src/context/lexical.ts
-import path15 from "path";
+import path16 from "path";
 var init_lexical = __esm({
   "src/context/lexical.ts"() {
     "use strict";
@@ -2175,7 +2262,7 @@ var init_provenance = __esm({
 
 // src/decisions/decisions.ts
 import fs9 from "fs/promises";
-import path16 from "path";
+import path17 from "path";
 import { createHash } from "crypto";
 import { z as z4 } from "zod";
 async function loadDecisionStore(rootDir) {
@@ -2226,9 +2313,9 @@ var init_decisions = __esm({
 });
 
 // src/decisions/drift.ts
-import path17 from "path";
+import path18 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path17.resolve(rootDir);
+  const resolvedRoot = path18.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
   const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
   const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
@@ -2452,8 +2539,6 @@ var init_findings = __esm({
 
 // src/audit/advisory-review.ts
 import fs10 from "fs/promises";
-import { execFile as execFile8 } from "child_process";
-import { promisify as promisify8 } from "util";
 import { z as z6 } from "zod";
 async function readRecord(root, id) {
   const raw = await readStoreJson(root, recordPath(id));
@@ -2580,10 +2665,12 @@ async function advisoryReviewInventory(root) {
   if (names.length > 5e3) throw new Error("Advisory review inventory exceeds 5,000 records.");
   return Promise.all(names.filter((name) => name.endsWith(".json")).sort().map(async (name) => [name, await readAuditInput(root, ".mason/reviews/advisories/" + name)]));
 }
-var execute2, git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
+var git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
 var init_advisory_review = __esm({
   "src/audit/advisory-review.ts"() {
     "use strict";
+    init_inspection();
+    init_git_read();
     init_findings();
     init_deps_changed();
     init_inputs();
@@ -2593,8 +2680,7 @@ var init_advisory_review = __esm({
     init_store();
     init_decisions();
     init_drift2();
-    execute2 = promisify8(execFile8);
-    git2 = async (root, ...args) => (await execute2("git", args, { cwd: root, timeout: 1e4, maxBuffer: 8 * 1024 * 1024 })).stdout;
+    git2 = async (root, ...args) => (await (["log", "ls-tree", "ls-files", "merge-base"].includes(args[0]) ? inspectionGit : execGit)(args, { cwd: root, timeout: 1e4, maxBuffer: 8 * 1024 * 1024 })).stdout;
     hashSchema = z6.string().regex(/^[a-f0-9]{64}$/);
     commitSchema2 = z6.string().regex(/^[a-f0-9]{40,64}$/);
     evidenceSchema2 = z6.object({
@@ -2638,12 +2724,12 @@ var init_advisory_review = __esm({
 
 // src/audit/audit.ts
 import fs11 from "fs/promises";
-import path18 from "path";
+import path19 from "path";
 async function computeAudit(rootDir, options = {}) {
   return profilePhase("audit.current", () => auditCurrent(rootDir, options));
 }
 async function auditCurrent(rootDir, options) {
-  const resolvedRoot = path18.resolve(rootDir);
+  const resolvedRoot = path19.resolve(rootDir);
   const [docs, headHash] = await Promise.all([discoverDocs(resolvedRoot), getCurrentGitHash(resolvedRoot)]);
   if (docs.length === 0) return null;
   const report = {
@@ -2677,7 +2763,7 @@ async function auditCurrent(rootDir, options) {
   }
   let decisionsPresent = false;
   try {
-    await fs11.access(path18.join(resolvedRoot, ".mason", "decisions"));
+    await fs11.access(path19.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -2719,7 +2805,7 @@ var init_audit = __esm({
 
 // src/audit/repair.ts
 import fs12 from "fs/promises";
-import path19 from "path";
+import path20 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 import { z as z7 } from "zod";
 function recheckable(finding) {
@@ -2754,8 +2840,8 @@ async function readStableAudit(root, checks, options) {
   }
   return report;
 }
-async function withRepairSession(root, options, run, cachedAudit) {
-  const before = await Promise.all([getCurrentGitHash(root), docState(root), advisoryReviewInventory(root).then(digest)]);
+async function withRepairSession(root, options, run, validate, cachedAudit) {
+  const head = await getCurrentGitHash(root);
   const audits = /* @__PURE__ */ new Map();
   const documents = /* @__PURE__ */ new Map();
   const history = /* @__PURE__ */ new Map();
@@ -2766,9 +2852,9 @@ async function withRepairSession(root, options, run, cachedAudit) {
   };
   const session = {
     audit: (checks) => memo(audits, [...checks].sort().join(","), async () => {
-      if (cachedAudit && cachedAudit.headHash === before[0] && cachedAudit.root === root && digest([...checks].sort()) === digest([...cachedAudit.checksRun ?? []].sort())) {
+      if (cachedAudit && cachedAudit.headHash === head && cachedAudit.root === root && digest([...checks].sort()) === digest([...cachedAudit.checksRun ?? []].sort())) {
         const current = structuredClone(cachedAudit);
-        const reviews = (await Promise.all(allFindings(current).map((f) => assessAdvisory(root, f, before[0])))).filter((r) => r !== null);
+        const reviews = (await Promise.all(allFindings(current).map((f) => assessAdvisory(root, f, head)))).filter((r) => r !== null);
         delete current.advisoryReviews;
         if (reviews.length) current.advisoryReviews = reviews;
         return current;
@@ -2776,16 +2862,15 @@ async function withRepairSession(root, options, run, cachedAudit) {
       return computeAudit(root, { ...options, checks });
     }),
     document: (file) => memo(documents, file, async () => readBoundedFile(await storePath(root, file), 10 * 1024 * 1024)),
-    history: (head) => memo(history, head, () => getChangesWithStatus(root, head)),
-    assessment: (dir, finding, head) => memo(assessments, digest([dir, finding, head]), () => assessAdvisory(dir, finding, head))
+    history: (head2) => memo(history, head2, () => getChangesWithStatus(root, head2)),
+    assessment: (dir, finding, head2) => memo(assessments, digest([dir, finding, head2]), () => assessAdvisory(dir, finding, head2))
   };
   const result = await run({
     prepare: () => prepareOriginal(root, ALL_CHECKS, options, session),
     verify: (baseline) => profilePhase("repair.verify", () => verifyOriginal(root, baseline, options, session)),
     currentAudit: () => session.audit(ALL_CHECKS)
   });
-  const after = await Promise.all([getCurrentGitHash(root), docState(root), advisoryReviewInventory(root).then(digest)]);
-  if (digest(before) !== digest(after)) throw new Error("HEAD, context files or advisory review records changed during verification; retry against stable evidence.");
+  await validate();
   return result;
 }
 async function prepareOriginal(rootDir, checks, options, session) {
@@ -2807,8 +2892,8 @@ async function prepareOriginal(rootDir, checks, options, session) {
 }
 async function loadRepairBaseline(rootDir, baselinePath) {
   const root = await fs12.realpath(rootDir);
-  const declaredRoot = path19.resolve(rootDir);
-  const relative = path19.isAbsolute(baselinePath) ? path19.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const declaredRoot = path20.resolve(rootDir);
+  const relative = path20.isAbsolute(baselinePath) ? path20.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
   const { digest: savedDigest, ...payload } = stored;
   if (digest(payload) !== savedDigest) throw new Error("Repair baseline was modified; use the original baseline.");
@@ -2967,14 +3052,12 @@ var init_repair = __esm({
 
 // src/automation/evidence.ts
 import fs13 from "fs/promises";
-import path20 from "path";
+import path21 from "path";
 import { createHash as createHash3 } from "crypto";
-import { execFile as execFile9 } from "child_process";
-import { promisify as promisify9 } from "util";
 import fg5 from "fast-glob";
 import { z as z8 } from "zod";
 async function git3(root, ...args) {
-  return profilePhase("automation.git", async () => (await exec7("git", args, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout);
+  return profilePhase("automation.git", async () => (await execGit(args, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout);
 }
 async function workspace(dir) {
   const root = await fs13.realpath((await git3(dir, "rev-parse", "--show-toplevel")).trim());
@@ -2998,7 +3081,7 @@ async function collectInputs(root) {
   const head = headText.trim();
   let shallow = null;
   try {
-    shallow = await fs13.readFile(path20.resolve(root, shallowPath.trim()), "utf8");
+    shallow = await fs13.readFile(path21.resolve(root, shallowPath.trim()), "utf8");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
@@ -3022,7 +3105,7 @@ async function collectInputs(root) {
       if (scope?.candidates.some(gitMetadataPath)) continue;
       for (const candidate of scope?.candidates ?? []) {
         if (optionalMasonPath(candidate)) continue;
-        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path20.posix.dirname(candidate))]);
+        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path21.posix.dirname(candidate))]);
         claims.push([candidate, filePresent, parentPresent]);
       }
     }
@@ -3034,7 +3117,7 @@ async function collectInputs(root) {
     if (error.code === "ENOENT") return "absent";
     throw error;
   });
-  const [modules, counts, commands, decisionFiles] = await Promise.all([
+  const [modules, counts, commands2, decisionFiles] = await Promise.all([
     combinedDocs ? moduleCandidates(root, combinedDocs) : [],
     Promise.all(countClaims.map(({ doc, claim }) => resolveDocCountSource(root, doc, claim))),
     commandInputs(root, parsedDocs),
@@ -3053,7 +3136,7 @@ async function collectInputs(root) {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
     "stale-count": hash([common, counts]),
-    "dead-command": hash([common, commands]),
+    "dead-command": hash([common, commands2]),
     "deps-changed": hash([common, docStatus]),
     "decision-anchor-drift": hash([common, decisionPresence, decisions, status, index2])
   };
@@ -3091,10 +3174,11 @@ function checkCache(raw, inputs) {
     }
   };
 }
-var exec7, engineVersion, hash, content, cacheSchema;
+var engineVersion, hash, content, cacheSchema;
 var init_evidence = __esm({
   "src/automation/evidence.ts"() {
     "use strict";
+    init_git_read();
     init_profile();
     init_docs();
     init_scope();
@@ -3107,8 +3191,7 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     init_advisory_review();
-    exec7 = promisify9(execFile9);
-    engineVersion = true ? "0.17.3" : "development";
+    engineVersion = true ? "0.18.0" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
     cacheSchema = z8.object({ version: z8.literal(1), entries: z8.record(z8.object({ key: z8.string(), result: checkResultSchema })), digest: z8.string() });
@@ -3376,12 +3459,12 @@ async function matchingAnalysis(ws, state, inputs) {
   return { analysis: a };
 }
 async function verifyInputs(ws, inputs) {
-  return profilePhase("automation.revalidate", async () => {
+  return profilePhase("automation.revalidate", () => withRepositoryInspection(ws.root, async () => {
     const [after, currentWs] = await Promise.all([readInputs(ws.root), workspace(ws.root)]);
     if (after.fingerprint !== inputs.fingerprint || currentWs.directory !== ws.directory) {
       throw new Error("Repository inputs or branch changed during automation; no current verification was recorded. Retry on a stable checkout.");
     }
-  });
+  }));
 }
 async function computeAnalysis(ws, state, inputs, event, previousAudit, cacheDiagnostic) {
   const baselines = [...state.baselines];
@@ -3401,7 +3484,10 @@ async function computeAnalysis(ws, state, inputs, event, previousAudit, cacheDia
     capture: "unknown",
     scope: SCOPE
   };
-  if (!baselines.length && Object.values(inputs.docs).every((value) => value === null)) return { baselines, report: empty, cache: null };
+  if (!baselines.length && Object.values(inputs.docs).every((value) => value === null)) {
+    await verifyInputs(ws, inputs);
+    return { baselines, report: empty, cache: null };
+  }
   if (ws.branch === "detached" && state.latest) {
     const previous = await readStoreJson(ws.root, state.latest);
     if (!previous?.head || !/^[a-f0-9]{40,64}$/.test(previous.head)) throw new Error("The previous detached checkout evidence is unavailable.");
@@ -3439,7 +3525,7 @@ async function computeAnalysis(ws, state, inputs, event, previousAudit, cacheDia
     }
     currentAudit = await repairs.currentAudit();
     return verifications2;
-  }, cachedAudit);
+  }, () => verifyInputs(ws, inputs), cachedAudit);
   const merged = /* @__PURE__ */ new Map();
   for (const verification of verifications) {
     for (const finding of verification.findings) {
@@ -3474,7 +3560,6 @@ async function analyze(ws, inputs, event, startedAt) {
     if (previous && previous.completedAt >= startedAt) return { analysis: previous, shared: true };
     const originalDigest = await baselineDigest(ws, before);
     const computed = await computeAnalysis(ws, before, inputs, event, previous?.currentAudit, diagnostic);
-    await verifyInputs(ws, inputs);
     if (originalDigest !== await baselineDigest(ws, before)) throw new Error("Repair baseline was modified during automation; original evidence must be inspected.");
     const id = randomUUID4();
     const analysis = analysisSchema.parse({
@@ -3503,7 +3588,7 @@ async function analyze(ws, inputs, event, startedAt) {
 async function automate(dir, event) {
   const startedAt = Date.now();
   const ws = await profilePhase("automation.workspace", () => workspace(dir));
-  return recordExecution(ws.root, ws.directory, event.event, async () => {
+  return recordExecution(ws.root, ws.directory, event.event, () => withRepositoryInspection(ws.root, async () => {
     const inputs = await readInputs(ws.root);
     const result = await profilePhase("automation.analysis", () => analyze(ws, inputs, event, startedAt));
     if (result.shared) {
@@ -3576,7 +3661,7 @@ async function automate(dir, event) {
       await writeStoreJson(ws.root, ws.directory + "/state.json", state);
       return { report, message: notify ? summarize(report) : null, continueOnce };
     }));
-  });
+  }));
 }
 async function automationStatus(dir) {
   const ws = await profilePhase("automation.workspace", () => workspace(dir));
@@ -3614,6 +3699,7 @@ var init_runtime = __esm({
   "src/automation/runtime.ts"() {
     "use strict";
     init_profile();
+    init_inspection();
     init_execution();
     init_repair();
     init_types();
@@ -3659,9 +3745,9 @@ var init_runtime = __esm({
 
 // src/automation/hook-root.ts
 import fs15 from "fs/promises";
-import path21 from "path";
+import path22 from "path";
 async function repositoryRoot(dir) {
-  if (!path21.isAbsolute(dir)) throw new Error("Hook input working directory must be absolute.");
+  if (!path22.isAbsolute(dir)) throw new Error("Hook input working directory must be absolute.");
   try {
     return await fs15.realpath((await git3(dir, "rev-parse", "--show-toplevel")).trim());
   } catch (error) {
@@ -3745,8 +3831,8 @@ __export(launcher_exports, {
   mcpCommand: () => mcpCommand,
   prepareLaunch: () => prepareLaunch
 });
-import { execFile as execFile10 } from "child_process";
-import { promisify as promisify10 } from "util";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
 import fs16 from "fs/promises";
 function globalCommand(args, platform = process.platform) {
   return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args] } : { command: "mason", args };
@@ -3754,7 +3840,7 @@ function globalCommand(args, platform = process.platform) {
 async function installedCommand() {
   const invocation = globalCommand(["internal-integration-version"]);
   try {
-    const { stdout } = await promisify10(execFile10)(
+    const { stdout } = await promisify2(execFile2)(
       invocation.command,
       invocation.args,
       { timeout: 5e3, maxBuffer: 8192, windowsHide: true }
@@ -3790,7 +3876,7 @@ var init_launcher = __esm({
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.17.3" : "development";
+    executingVersion = () => true ? "0.18.0" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -4006,7 +4092,7 @@ __export(files_exports, {
   readText: () => readText
 });
 import fs18 from "fs/promises";
-import path22 from "path";
+import path23 from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 async function readText(root, file) {
   try {
@@ -4039,7 +4125,7 @@ async function applyEdit(root, edit) {
     return true;
   }
   const file = await storePath(root, edit.path, true);
-  const temporary = path22.join(path22.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  const temporary = path23.join(path23.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
   try {
     const mode = await fs18.stat(file).then((s) => s.mode & 511, () => 384);
     const handle = await fs18.open(temporary, "wx", mode);
@@ -4159,7 +4245,7 @@ Mason provides recorded decisions and file impact over MCP. A concept map is opt
 - Before editing a file \u2192 \`get_impact\` to check references, tests, and historical change partners.
 - Investigation or correction reveals a reusable project lesson \u2192 \`save_decision\` before finishing. Capture only the lasting constraint and reason, with anchors and known sources, owner, and recorder. This creates a proposal; never infer approval. Preserve uncertain causes and unknown attribution. Route project lessons here; keep personal preferences in agent memory. Skip code summaries, current checkout status, temporary task permissions, session trivia, and secrets. No qualifying lesson means no record.
 - Before saving, compare the lesson with matching \`get_context\` records and any pending proposal. If new evidence changes the same lesson's assumptions, scope, or recommended action, revise it with \`save_decision(id: existingId)\`, including when it is accepted. Preserve supported rationale and sources, replace obsolete instructions, and add the new evidence. Create a separate record for a genuinely distinct lesson; skip unchanged restatements. Revision preserves history and leaves the accepted version operative until authorized review.
-- Consult trust metadata before relying on entries: unknown or changed freshness requires inspection, and failed verification means the description must be corrected. Check approval too: proposals are suggestions, legacy records are unreviewed, and accepted decisions are recorded constraints subject to freshness checks. An accepted revision remains operative while a pending proposal is reviewed; keep both versions and their freshness distinct.
+- Consult trust metadata before relying on entries: unknown or changed freshness requires inspection, stale or unknown map verification requires a fresh evidence review, and a recorded failed verdict means the description must be corrected. Check approval too: proposals are suggestions, legacy records are unreviewed, and accepted decisions are recorded constraints subject to freshness checks. An accepted revision remains operative while a pending proposal is reviewed; keep both versions and their freshness distinct.
 - Asked to review or re-verify a decision \u2192 \`review_decision\` first to inspect content, sources, history, and code changes. Record acceptance, reaffirmation, or retirement only when authorized by the user or a cited team review, with the actual reviewer and reason. Never infer approval from unchanged code. Review and commit the local record through the normal project workflow.
 - For an architectural overview, use \`get_snapshot\` if a map is available. If \`map.status\` is missing or invalid, use available decisions and source evidence; do not start building a map unless requested.
 - \`mason_init\` returns documentation audit and committed-diff review results, plus a short setup guide. Pass \`evidence\` with local CI manifest paths to include test and analysis results; the CLI equivalent is \`mason-review --evidence <manifest>\`. State skipped, unavailable, stale, or unknown checks explicitly. Related accepted decisions identify review context, not proven violations.
@@ -4484,14 +4570,14 @@ async function planTeardown(root, selected) {
   const setup = setupBefore === null ? null : setupSchema.parse(JSON.parse(setupBefore));
   const automationBefore = await read(AUTOMATION_PATH);
   const automation = automationBefore === null ? null : recordSchema2.parse(JSON.parse(automationBefore));
-  const commands = (host) => new Set([
+  const commands2 = (host) => new Set([
     automation?.hosts[host]?.command,
     ...ownership.files[configPath(host)]?.hookCommands ?? [],
     ...knownManagedHookCommands(host),
     hookConfig(host, hookCommand(host)).hooks.SessionStart[0].hooks[0].command,
     hookConfig(host).hooks.SessionStart[0].hooks[0].command
   ].filter((command) => !!command));
-  const possibleHook = (command, host) => commands(host).has(command) || /\bmason(?:-auto|-hook)?\b/.test(command);
+  const possibleHook = (command, host) => commands2(host).has(command) || /\bmason(?:-auto|-hook)?\b/.test(command);
   const add = (file, before, after, empty) => {
     edits.push({ path: file, before, after: ownership.files[file]?.created && (empty || ownership.files[file].initialHash === hash(before)) ? null : after });
   };
@@ -4555,12 +4641,12 @@ async function planTeardown(root, selected) {
       for (const [event, groups] of Object.entries(config.hooks ?? {})) {
         const known = ownership.files[hookFile]?.hooks?.[event];
         const handlers = groups.flatMap((group) => group.hooks);
-        if (known && !handlers.some((handler) => handler.type === "command" && handler.command && commands(host).has(handler.command)) && handlers.some((handler) => !known.includes(hash(handler)))) {
+        if (known && !handlers.some((handler) => handler.type === "command" && handler.command && commands2(host).has(handler.command)) && handlers.some((handler) => !known.includes(hash(handler)))) {
           diagnostics.push({ path: hookFile, message: "A recorded Mason hook is missing beside a new or edited handler (" + event + "); inspect ownership manually." });
         }
         const kept = groups.flatMap((group) => {
           const handlers2 = group.hooks.filter((handler) => {
-            if (handler.type === "command" && handler.command && commands(host).has(handler.command)) {
+            if (handler.type === "command" && handler.command && commands2(host).has(handler.command)) {
               changed = true;
               return false;
             }
@@ -4692,13 +4778,13 @@ var init_teardown = __esm({
 });
 
 // src/review/cochange.ts
-import { execFile as execFile11 } from "child_process";
-import { promisify as promisify11 } from "util";
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
 async function buildMatrix(resolvedRoot) {
   try {
-    const { stdout: shallow } = await exec8("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
+    const { stdout: shallow } = await exec("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
     if (shallow.trim() === "true") return null;
-    const { stdout } = await exec8(
+    const { stdout } = await exec(
       "git",
       ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
       { cwd: resolvedRoot, maxBuffer: 100 * 1024 * 1024 }
@@ -4754,11 +4840,11 @@ async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, all
   findings.sort((a, b) => b.rate - a.rate || b.sharedCommits - a.sharedCommits);
   return findings;
 }
-var exec8, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
+var exec, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
 var init_cochange = __esm({
   "src/review/cochange.ts"() {
     "use strict";
-    exec8 = promisify11(execFile11);
+    exec = promisify3(execFile3);
     HISTORY_COMMITS = 1500;
     MIN_FILE_COMMITS = 5;
     MIN_SHARED_COMMITS = 4;
@@ -5066,10 +5152,10 @@ var init_check = __esm({
 });
 
 // src/review/evidence.ts
-import path23 from "path";
+import path24 from "path";
 import { z as z22 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path23.isAbsolute(file) ? path23.relative(root, file) : file;
+  const relative = path24.isAbsolute(file) ? path24.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -5166,7 +5252,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path23.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path24.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -5288,12 +5374,12 @@ var init_evidence2 = __esm({
 
 // src/review/review.ts
 import fs19 from "fs/promises";
-import path24 from "path";
-import { execFile as execFile12 } from "child_process";
-import { promisify as promisify12 } from "util";
+import path25 from "path";
+import { execFile as execFile4 } from "child_process";
+import { promisify as promisify4 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
   try {
-    const { stdout } = await exec9("git", ["merge-base", base, head], {
+    const { stdout } = await exec2("git", ["merge-base", base, head], {
       cwd: resolvedRoot
     });
     return stdout.trim() || null;
@@ -5304,7 +5390,7 @@ async function resolveMergeBase(resolvedRoot, base, head) {
 async function defaultBase(resolvedRoot) {
   for (const ref of ["origin/HEAD", "origin/main", "origin/master", "main"]) {
     try {
-      await exec9("git", ["rev-parse", "--verify", "--quiet", ref], {
+      await exec2("git", ["rev-parse", "--verify", "--quiet", ref], {
         cwd: resolvedRoot
       });
       return ref;
@@ -5317,7 +5403,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path24.resolve(rootDir);
+  const resolvedRoot = path25.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -5367,7 +5453,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs19.access(path24.join(resolvedRoot, relPath));
+        await fs19.access(path25.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -5400,7 +5486,7 @@ async function computeReview(rootDir, base, options = {}) {
   }
   return finalize();
 }
-var exec9, MAX_ANALYZED_FILES;
+var exec2, MAX_ANALYZED_FILES;
 var init_review = __esm({
   "src/review/review.ts"() {
     "use strict";
@@ -5412,7 +5498,7 @@ var init_review = __esm({
     init_cochange();
     init_evidence2();
     init_snapshot();
-    exec9 = promisify12(execFile12);
+    exec2 = promisify4(execFile4);
     MAX_ANALYZED_FILES = 50;
   }
 });