mason-context 0.19.0 → 0.19.2

package/dist/mason.js

@@ -96,6 +96,26 @@ var init_git_read = __esm({
   }
 });
 
+// src/audit/types.ts
+var types_exports = {};
+__export(types_exports, {
+  ALL_CHECKS: () => ALL_CHECKS
+});
+var ALL_CHECKS;
+var init_types = __esm({
+  "src/audit/types.ts"() {
+    "use strict";
+    ALL_CHECKS = [
+      "deleted-reference",
+      "new-module",
+      "stale-count",
+      "dead-command",
+      "deps-changed",
+      "decision-anchor-drift"
+    ];
+  }
+});
+
 // src/utils/files.ts
 import fs from "fs/promises";
 import { constants } from "fs";
@@ -140,6 +160,27 @@ async function loadProjectConfig(root) {
       }
       config[key] = value[key];
     }
+    if (value.audit !== void 0) {
+      const audit = value.audit;
+      if (!audit || typeof audit !== "object" || Array.isArray(audit)) throw new Error("Configuration audit must be an object");
+      const patterns = (raw2) => {
+        if (!Array.isArray(raw2) || raw2.length > 100 || !raw2.every((s) => typeof s === "string" && normalizeRepoPath(s) === s && !s.startsWith("!") && !/[\x00-\x1f]/.test(s))) {
+          throw new Error("Audit patterns must be at most 100 repository-relative globs without traversal or negation");
+        }
+        return raw2;
+      };
+      config.audit = {};
+      if (audit.include !== void 0) config.audit.include = patterns(audit.include);
+      if (audit.exclude !== void 0) {
+        if (!audit.exclude || typeof audit.exclude !== "object" || Array.isArray(audit.exclude)) throw new Error("audit.exclude must map check names to patterns");
+        const { ALL_CHECKS: ALL_CHECKS2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+        config.audit.exclude = {};
+        for (const [check, globs] of Object.entries(audit.exclude)) {
+          if (!ALL_CHECKS2.includes(check)) throw new Error("Unknown audit check: " + check);
+          config.audit.exclude[check] = patterns(globs);
+        }
+      }
+    }
     return config;
   } catch (error) {
     if (error.code === "ENOENT") return {};
@@ -394,8 +435,229 @@ var init_store_lock = __esm({
   }
 });
 
-// src/automation/store.ts
+// src/audit/findings.ts
+import { createHash } from "crypto";
 import { z } from "zod";
+function findingId(finding) {
+  const e = finding.evidence;
+  let key;
+  switch (e.kind) {
+    case "missing-path":
+      key = e.resolvedPath && e.resolvedPath !== e.claimed ? [e.claimed, e.resolvedPath] : e.claimed;
+      break;
+    case "unmentioned-dir":
+      key = e.dir;
+      break;
+    case "count-mismatch":
+      key = [e.unit.replace(/s$/, ""), e.countedFrom];
+      break;
+    case "missing-script":
+      key = e.scope && e.scope.directory !== "." ? [e.scriptName, e.scope.directory] : e.scriptName;
+      break;
+    case "doc-behind-manifests":
+      key = null;
+      break;
+    case "decision-anchor":
+      key = [e.decisionId, e.provenance?.revision, e.provenance?.approval];
+      break;
+  }
+  return digest([finding.type, finding.anchor.doc, key]);
+}
+var digest, checkSchema, commitSchema, anchorSchema, count, scopeSchema, evidenceSchema, findingSchema, issueSchema, advisorySchema, checkResultSchema;
+var init_findings = __esm({
+  "src/audit/findings.ts"() {
+    "use strict";
+    digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+    checkSchema = z.enum(["deleted-reference", "new-module", "stale-count", "dead-command", "deps-changed", "decision-anchor-drift"]);
+    commitSchema = z.object({ hash: z.string().regex(/^[a-f0-9]{40,64}$/), date: z.string(), subject: z.string() });
+    anchorSchema = z.object({ doc: z.string(), line: z.number().int().positive().nullable(), excerpt: z.string().nullable() });
+    count = z.number().int().nonnegative();
+    scopeSchema = z.object({
+      basis: z.enum(["repository", "document", "document-link", "explicit"]),
+      directory: z.string(),
+      candidates: z.array(z.string())
+    });
+    evidenceSchema = z.discriminatedUnion("kind", [
+      z.object({
+        kind: z.literal("missing-path"),
+        claimed: z.string(),
+        renamedTo: z.string().nullable(),
+        deletedInCommit: commitSchema.nullable(),
+        everTracked: z.boolean(),
+        parentDirExists: z.boolean(),
+        resolvedPath: z.string().optional(),
+        scope: scopeSchema.optional()
+      }),
+      z.object({
+        kind: z.literal("unmentioned-dir"),
+        dir: z.string(),
+        sourceFileCount: count,
+        firstCommit: commitSchema.nullable(),
+        checkedDocs: z.array(z.string())
+      }),
+      z.object({
+        kind: z.literal("count-mismatch"),
+        claimed: count,
+        actual: count,
+        unit: z.string(),
+        countedFrom: z.string(),
+        members: z.array(z.string())
+      }),
+      z.object({
+        kind: z.literal("missing-script"),
+        scriptName: z.string(),
+        invocation: z.string(),
+        manifestsChecked: z.array(z.string()),
+        availableScripts: z.array(z.string()),
+        scope: scopeSchema.optional()
+      }),
+      z.object({
+        kind: z.literal("doc-behind-manifests"),
+        docLastCommit: commitSchema,
+        manifestCommits: z.array(commitSchema.extend({ files: z.array(z.string()) })),
+        totalCommits: count,
+        matches: z.array(z.object({ dependency: z.string(), manifest: z.string(), before: z.string().nullable(), after: z.string().nullable(), line: z.number().int().positive(), excerpt: z.string() })).optional(),
+        matchingIncomplete: z.boolean().optional()
+      }),
+      z.object({
+        kind: z.literal("decision-anchor"),
+        decisionId: z.string(),
+        title: z.string(),
+        changedFiles: z.array(z.string()),
+        refreshedHash: z.string(),
+        provenance: z.object({}).passthrough().optional()
+      })
+    ]);
+    findingSchema = z.object({ message: z.string(), anchor: anchorSchema, evidence: evidenceSchema });
+    issueSchema = findingSchema.extend({
+      type: z.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
+      confidence: z.enum(["certain", "likely"])
+    });
+    advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z.enum(["recheck", "informational"]).optional() });
+    checkResultSchema = z.object({
+      issues: z.array(issueSchema),
+      advisories: z.array(advisorySchema),
+      suppressedAdvisories: z.array(advisorySchema).optional(),
+      skipped: z.array(z.object({ check: z.string(), reason: z.string(), doc: z.string().optional() }))
+    });
+  }
+});
+
+// src/automation/notifications.ts
+import { z as z2 } from "zod";
+function condition(finding) {
+  const source = finding.current ?? finding.original;
+  const e = source.evidence;
+  const id = e.kind === "decision-anchor" ? digest([source.type, source.anchor.doc, e.decisionId]) : finding.id;
+  const result = { level: "confidence" in source ? 2 : 1, facts: [] };
+  switch (e.kind) {
+    case "count-mismatch":
+      result.magnitude = Math.abs(e.actual - e.claimed);
+      break;
+    case "unmentioned-dir":
+      result.magnitude = e.sourceFileCount;
+      break;
+    case "decision-anchor":
+      result.facts = [...e.changedFiles].sort();
+      break;
+    case "doc-behind-manifests":
+      result.facts = (e.matches ?? []).map((m) => JSON.stringify([m.manifest, m.dependency, m.after])).sort();
+      break;
+  }
+  return { id, condition: result };
+}
+function notificationConditions(findings) {
+  const active = findings.filter((f) => f.status !== "resolved");
+  const currentIds = new Set(active.filter((f) => f.current).map((f) => condition(f).id));
+  const result = {};
+  for (const f of active) {
+    const value = condition(f);
+    if (!f.current && currentIds.has(value.id)) continue;
+    const previous = result[value.id];
+    result[value.id] = previous ? {
+      level: Math.max(previous.level, value.condition.level),
+      facts: [.../* @__PURE__ */ new Set([...previous.facts, ...value.condition.facts])].sort(),
+      ...previous.magnitude !== void 0 || value.condition.magnitude !== void 0 ? { magnitude: Math.max(previous.magnitude ?? 0, value.condition.magnitude ?? 0) } : {}
+    } : value.condition;
+  }
+  return result;
+}
+function createNotificationState(findings, head) {
+  return { version: 1, baselineHead: head, baseline: notificationConditions(findings), delivered: {}, cleared: [] };
+}
+function worsened(current, previous) {
+  return !previous || current.level > previous.level || (current.magnitude ?? 0) > (previous.magnitude ?? 0) || current.facts.some((fact) => !previous.facts.includes(fact));
+}
+function completionFindings(state, findings) {
+  const current = notificationConditions(findings);
+  const cleared = new Set(state.cleared);
+  const resolvedIds = new Set(findings.filter((f) => f.status === "resolved").map((f) => condition(f).id));
+  for (const id of Object.keys(state.baseline)) if (resolvedIds.has(id) && !current[id]) cleared.add(id);
+  state.cleared = [...cleared];
+  const selected = [];
+  const selectedIds = /* @__PURE__ */ new Set();
+  const delivered = { ...state.delivered };
+  for (const finding of findings) {
+    const value = condition(finding);
+    const previous = state.delivered[value.id];
+    value.condition = current[value.id] ?? value.condition;
+    if (finding.status === "unverified" || !finding.current && finding.status !== "resolved") {
+      continue;
+    }
+    if (finding.status === "resolved") {
+      if (!current[value.id]) delete delivered[value.id];
+      continue;
+    }
+    const eligible = cleared.has(value.id) || worsened(value.condition, state.baseline[value.id]);
+    if (!eligible) continue;
+    if (!selectedIds.has(value.id) && worsened(value.condition, previous)) {
+      selectedIds.add(value.id);
+      const source = finding.current;
+      selected.push(source.evidence.kind === "decision-anchor" ? { ...finding, current: { ...source, evidence: { ...source.evidence, changedFiles: value.condition.facts } } } : finding);
+      if (selected.length <= MAX_COMPLETION_FINDINGS) delivered[value.id] = value.condition;
+    }
+  }
+  state.delivered = delivered;
+  return selected;
+}
+function completionSummary(findings, reportPath) {
+  if (!findings.length) return null;
+  const safe = (value) => value.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 250);
+  return [
+    `Mason: ${findings.length} new or worsened finding(s) since the retained baseline.`,
+    ...findings.slice(0, MAX_COMPLETION_FINDINGS).map((f) => {
+      const source = f.current ?? f.original;
+      const detail = source.evidence.kind === "decision-anchor" ? `Changes to ${source.evidence.changedFiles.join(", ")} may affect decision "${source.evidence.title}". Inspect the diff if relevant; acceptance is not required.` : source.message;
+      return `[${f.status === "unresolved" ? "issue" : "advisory"}] ${safe(source.anchor.doc)}: ${safe(detail)}`;
+    }),
+    ...findings.length > MAX_COMPLETION_FINDINGS ? [`${findings.length - MAX_COMPLETION_FINDINGS} more in the report; pending later feedback.`] : [],
+    `Evidence: ${reportPath}. Explicit audit: mason_automation(action: "check").`,
+    "Inspect findings within the authorized work. Concurrent changes may also contribute; this summary does not establish who introduced them."
+  ].join("\n");
+}
+var conditionSchema, MAX_COMPLETION_FINDINGS, notificationStateSchema;
+var init_notifications = __esm({
+  "src/automation/notifications.ts"() {
+    "use strict";
+    init_findings();
+    conditionSchema = z2.object({
+      level: z2.number(),
+      facts: z2.array(z2.string()),
+      magnitude: z2.number().optional()
+    });
+    MAX_COMPLETION_FINDINGS = 4;
+    notificationStateSchema = z2.object({
+      version: z2.literal(1),
+      baselineHead: z2.string(),
+      baseline: z2.record(conditionSchema),
+      delivered: z2.record(conditionSchema),
+      cleared: z2.array(z2.string())
+    });
+  }
+});
+
+// src/automation/store.ts
+import { z as z3 } from "zod";
 function parseState(raw) {
   try {
     return stateSchema.parse(raw);
@@ -411,36 +673,217 @@ var init_store = __esm({
   "src/automation/store.ts"() {
     "use strict";
     init_store_lock();
-    hostSchema = z.enum(["claude", "codex"]);
+    init_notifications();
+    hostSchema = z3.enum(["claude", "codex"]);
     events = ["session_start", "turn_start", "before_tool", "after_tool", "task_end"];
-    stateSchema = z.object({
-      version: z.literal(1),
-      root: z.string(),
-      gitDir: z.string(),
-      branch: z.string(),
-      baselines: z.array(z.object({ path: z.string(), at: z.string(), event: z.string(), fingerprint: z.string() })).max(128),
-      sessions: z.record(z.object({
+    stateSchema = z3.object({
+      version: z3.literal(1),
+      root: z3.string(),
+      gitDir: z3.string(),
+      branch: z3.string(),
+      baselines: z3.array(z3.object({ path: z3.string(), at: z3.string(), event: z3.string(), fingerprint: z3.string() })).max(128),
+      sessions: z3.record(z3.object({
         host: hostSchema,
-        seen: z.string().nullable(),
-        continued: z.boolean(),
-        initialIssues: z.array(z.string()),
-        initialDocs: z.record(z.string().nullable()),
-        lastUsed: z.string(),
-        mutationObserved: z.boolean(),
-        pending: z.record(z.string()),
-        coverageGaps: z.array(z.string()),
-        events: z.record(z.object({ at: z.string(), count: z.number().int().positive() }))
+        lastUsed: z3.string(),
+        notifiedDiagnostics: z3.array(z3.string()).default([]),
+        pending: z3.record(z3.string()),
+        coverageGaps: z3.array(z3.string()),
+        events: z3.record(z3.object({ at: z3.string(), count: z3.number().int().positive() }))
       })),
-      updatedAt: z.string(),
-      fingerprint: z.string().nullable(),
-      latest: z.string().nullable(),
-      analysis: z.object({ id: z.string(), fingerprint: z.string(), completedAt: z.number(), path: z.string() }).optional()
+      updatedAt: z3.string(),
+      fingerprint: z3.string().nullable(),
+      latest: z3.string().nullable(),
+      notifications: notificationStateSchema.optional(),
+      agentNotifications: notificationStateSchema.optional(),
+      analysis: z3.object({ id: z3.string(), fingerprint: z3.string(), completedAt: z3.number(), path: z3.string() }).optional()
     });
   }
 });
 
-// src/audit/commands.ts
+// src/audit/inspection.ts
+import fg2 from "fast-glob";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 import path4 from "path";
+function withRepositoryInspection(root, run) {
+  return inspections.run({ root: path4.resolve(root), reads: /* @__PURE__ */ new Map() }, run);
+}
+function inspectionRead(root, key, read) {
+  const inspection = inspections.getStore();
+  if (!inspection || inspection.root !== path4.resolve(root)) return read();
+  if (!inspection.reads.has(key)) {
+    const pending = read();
+    inspection.reads.set(key, pending);
+    void pending.catch(() => {
+      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
+    });
+  }
+  return inspection.reads.get(key);
+}
+function inspectionGit(args2, options) {
+  return inspectionRead(options.cwd, "git:" + JSON.stringify([args2, options]), () => execGit(args2, options));
+}
+async function auditGitPaths(root, kind) {
+  const custom = (await loadProjectConfig(root)).audit?.include ?? [];
+  const shared = inspections.getStore()?.root === path4.resolve(root) && !custom.length;
+  const expanded = fg2.generateTasks(custom).flatMap((task) => task.positive);
+  if (expanded.length > 1e3) throw new Error("Audit include patterns expand to more than 1,000 globs");
+  const documentSpecs = [...docSpecs, ...expanded.map((pattern) => `:(glob)${pattern}`)];
+  const specs = shared ? [...documentSpecs, ...sourceSpecs] : kind === "documents" ? documentSpecs : sourceSpecs;
+  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
+  const { stdout } = await inspectionGit(
+    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
+    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
+  );
+  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? custom.length > 0 || /^(readme|agents|claude)\.md$/i.test(path4.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
+  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
+  return paths.sort();
+}
+var inspections, sourceSpecs, docSpecs, sourceSuffixes;
+var init_inspection = __esm({
+  "src/audit/inspection.ts"() {
+    "use strict";
+    init_git_read();
+    init_files();
+    inspections = new AsyncLocalStorage2();
+    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
+    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
+    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+  }
+});
+
+// src/audit/inputs.ts
+import fs4 from "fs/promises";
+import * as nativeFs from "fs";
+import path5 from "path";
+import fg3 from "fast-glob";
+async function auditInputPath(root, file) {
+  if (file === ".") return fs4.realpath(root);
+  try {
+    return await storePath(root, file);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Symlink")) {
+      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
+    }
+    throw error;
+  }
+}
+async function readAuditInput(root, file) {
+  try {
+    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
+    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
+    return value;
+  } catch (error) {
+    if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return null;
+    throw error;
+  }
+}
+async function auditGlob(root, patterns, options) {
+  if (Array.isArray(patterns) && !patterns.length) return [];
+  const directories = /* @__PURE__ */ new Set();
+  const readdir2 = ((directory, opts, callback) => {
+    const relative = path5.relative(root, directory).split(path5.sep).join("/") || ".";
+    directories.add(relative);
+    if (directories.size > MAX_INPUTS) {
+      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
+      return;
+    }
+    auditInputPath(root, relative).then(() => {
+      nativeFs.readdir(directory, opts, callback);
+    }, callback);
+  });
+  const lstat2 = ((file, callback) => {
+    const relative = path5.relative(root, file).split(path5.sep).join("/") || ".";
+    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
+  });
+  const stream = fg3.stream(patterns, {
+    cwd: root,
+    ignore: options.ignore,
+    onlyFiles: false,
+    onlyDirectories: options.onlyDirectories,
+    objectMode: true,
+    followSymbolicLinks: options.followSymbolicLinks ?? true,
+    fs: { readdir: readdir2, lstat: lstat2 },
+    concurrency: 16
+  });
+  const matches = [];
+  try {
+    for await (const value of stream) {
+      const entry = value;
+      const file = entry.path;
+      if (options.select && !options.select(file)) continue;
+      await auditInputPath(root, file);
+      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
+      matches.push(file);
+      if (matches.length > MAX_INPUTS) {
+        const largest = [...matches.reduce((counts, item) => {
+          const dir = item.split("/")[0];
+          counts.set(dir, (counts.get(dir) ?? 0) + 1);
+          return counts;
+        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
+        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count4]) => `${dir} (${count4})`).join(", ")}. Narrow this check's inputs.`);
+      }
+    }
+  } finally {
+    stream.destroy();
+  }
+  return matches.sort();
+}
+async function gitSourcePaths(root) {
+  return auditGitPaths(root, "sources");
+}
+async function gitIgnoredPaths(root, files) {
+  if (!files.length) return /* @__PURE__ */ new Set();
+  const ignored = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < files.length; offset += 1e3) {
+    try {
+      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
+        cwd: root,
+        maxBuffer: 4 * 1024 * 1024,
+        timeout: 1e4,
+        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
+      });
+      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
+    } catch (error) {
+      if (error.code !== 1) throw error;
+    }
+  }
+  return ignored;
+}
+var MAX_INPUTS;
+var init_inputs = __esm({
+  "src/audit/inputs.ts"() {
+    "use strict";
+    init_files();
+    init_storage();
+    init_git_read();
+    init_inspection();
+    MAX_INPUTS = 1e5;
+  }
+});
+
+// src/audit/policy.ts
+import fg4 from "fast-glob";
+async function includedCheckPaths(root, paths, exclude) {
+  if (!exclude.length) return new Set(paths);
+  const included = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < paths.length; offset += 256) {
+    for (const file of await auditGlob(root, paths.slice(offset, offset + 256).map((file2) => fg4.escapePath(file2)), {
+      ignore: exclude,
+      followSymbolicLinks: false,
+      label: "Audit check exclusions"
+    })) included.add(file);
+  }
+  return included;
+}
+var init_policy = __esm({
+  "src/audit/policy.ts"() {
+    "use strict";
+    init_inputs();
+  }
+});
+
+// src/audit/commands.ts
+import path6 from "path";
 function splitCommands(line) {
   const parts = [];
   let quote2 = "", start = 0;
@@ -476,7 +919,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
     const cd = text2.match(/^cd\s+(.+)$/);
     if (cd) {
       const directory = literal(cd[1]);
-      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path4.posix.join(cwd ?? ".", directory);
+      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path6.posix.join(cwd ?? ".", directory);
       continue;
     }
     for (const match of text2.matchAll(COMMAND)) {
@@ -487,7 +930,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
       if (shell && match.index !== 0 || match[3].startsWith("-")) scopeUnknown = "Unsupported shell wrapper or options before the script.";
       if (selector) {
         const selected = literal(selector[1]);
-        directory = selected === null || cwd === null ? null : path4.posix.join(cwd ?? ".", selected);
+        directory = selected === null || cwd === null ? null : path6.posix.join(cwd ?? ".", selected);
       } else if (flags) scopeUnknown = "Unsupported package-manager options before run: " + flags;
       const tail = text2.slice(match.index + match[0].length).split(/\s--(?:\s|$)/)[0];
       if (/(?:^|\s)(?:--workspace(?:s)?|-w|--filter|-F|--prefix|--dir|-C|--if-present)(?:\s|=|$)/.test(tail)) {
@@ -517,7 +960,7 @@ var init_commands = __esm({
     COMMAND = new RegExp(`\\b(npm|pnpm|yarn)((?:[ \\t]+${TOKEN})*?)[ \\t]+run[ \\t]+([A-Za-z0-9:_.-]+)`, "g");
     literal = (value) => {
       const unquoted = value.replace(/^(["'])(.*)\1$/, "$2");
-      return /[$`*?\[\]{}~\\\x00-\x1f]/.test(unquoted) || path4.posix.isAbsolute(unquoted) ? null : unquoted;
+      return /[$`*?\[\]{}~\\\x00-\x1f]/.test(unquoted) || path6.posix.isAbsolute(unquoted) ? null : unquoted;
     };
   }
 });
@@ -822,52 +1265,6 @@ var init_claims = __esm({
   }
 });
 
-// src/audit/inspection.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-import path5 from "path";
-function withRepositoryInspection(root, run) {
-  return inspections.run({ root: path5.resolve(root), reads: /* @__PURE__ */ new Map() }, run);
-}
-function inspectionRead(root, key, read) {
-  const inspection = inspections.getStore();
-  if (!inspection || inspection.root !== path5.resolve(root)) return read();
-  if (!inspection.reads.has(key)) {
-    const pending = read();
-    inspection.reads.set(key, pending);
-    void pending.catch(() => {
-      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
-    });
-  }
-  return inspection.reads.get(key);
-}
-function inspectionGit(args2, options) {
-  return inspectionRead(options.cwd, "git:" + JSON.stringify([args2, options]), () => execGit(args2, options));
-}
-async function auditGitPaths(root, kind) {
-  const shared = inspections.getStore()?.root === path5.resolve(root);
-  const specs = shared ? [...docSpecs, ...sourceSpecs] : kind === "documents" ? docSpecs : sourceSpecs;
-  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
-  const { stdout } = await inspectionGit(
-    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
-    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
-  );
-  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? /^(readme|agents|claude)\.md$/i.test(path5.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
-  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
-  return paths.sort();
-}
-var inspections, sourceSpecs, docSpecs, sourceSuffixes;
-var init_inspection = __esm({
-  "src/audit/inspection.ts"() {
-    "use strict";
-    init_git_read();
-    init_files();
-    inspections = new AsyncLocalStorage2();
-    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
-    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
-    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
-  }
-});
-
 // src/audit/git.ts
 function parseCommitLine(line) {
   const parts = line.split("	");
@@ -946,127 +1343,17 @@ async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
 }
 var COMMIT_FORMAT;
 var init_git = __esm({
-  "src/audit/git.ts"() {
-    "use strict";
-    init_inspection();
-    COMMIT_FORMAT = "%H%x09%cI%x09%s";
-  }
-});
-
-// src/audit/inputs.ts
-import fs4 from "fs/promises";
-import * as nativeFs from "fs";
-import path6 from "path";
-import fg2 from "fast-glob";
-async function auditInputPath(root, file) {
-  if (file === ".") return fs4.realpath(root);
-  try {
-    return await storePath(root, file);
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith("Symlink")) {
-      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
-    }
-    throw error;
-  }
-}
-async function readAuditInput(root, file) {
-  try {
-    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
-    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
-    return value;
-  } catch (error) {
-    if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return null;
-    throw error;
-  }
-}
-async function auditGlob(root, patterns, options) {
-  if (Array.isArray(patterns) && !patterns.length) return [];
-  const directories = /* @__PURE__ */ new Set();
-  const readdir2 = ((directory, opts, callback) => {
-    const relative = path6.relative(root, directory).split(path6.sep).join("/") || ".";
-    directories.add(relative);
-    if (directories.size > MAX_INPUTS) {
-      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
-      return;
-    }
-    auditInputPath(root, relative).then(() => {
-      nativeFs.readdir(directory, opts, callback);
-    }, callback);
-  });
-  const lstat2 = ((file, callback) => {
-    const relative = path6.relative(root, file).split(path6.sep).join("/") || ".";
-    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
-  });
-  const stream = fg2.stream(patterns, {
-    cwd: root,
-    ignore: options.ignore,
-    onlyFiles: false,
-    onlyDirectories: options.onlyDirectories,
-    objectMode: true,
-    followSymbolicLinks: options.followSymbolicLinks ?? true,
-    fs: { readdir: readdir2, lstat: lstat2 },
-    concurrency: 16
-  });
-  const matches = [];
-  try {
-    for await (const value of stream) {
-      const entry = value;
-      const file = entry.path;
-      if (options.select && !options.select(file)) continue;
-      await auditInputPath(root, file);
-      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
-      matches.push(file);
-      if (matches.length > MAX_INPUTS) {
-        const largest = [...matches.reduce((counts, item) => {
-          const dir = item.split("/")[0];
-          counts.set(dir, (counts.get(dir) ?? 0) + 1);
-          return counts;
-        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
-        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count4]) => `${dir} (${count4})`).join(", ")}. Narrow this check's inputs.`);
-      }
-    }
-  } finally {
-    stream.destroy();
-  }
-  return matches.sort();
-}
-async function gitSourcePaths(root) {
-  return auditGitPaths(root, "sources");
-}
-async function gitIgnoredPaths(root, files) {
-  if (!files.length) return /* @__PURE__ */ new Set();
-  const ignored = /* @__PURE__ */ new Set();
-  for (let offset = 0; offset < files.length; offset += 1e3) {
-    try {
-      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
-        cwd: root,
-        maxBuffer: 4 * 1024 * 1024,
-        timeout: 1e4,
-        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
-      });
-      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
-    } catch (error) {
-      if (error.code !== 1) throw error;
-    }
-  }
-  return ignored;
-}
-var MAX_INPUTS;
-var init_inputs = __esm({
-  "src/audit/inputs.ts"() {
-    "use strict";
-    init_files();
-    init_storage();
-    init_git_read();
+  "src/audit/git.ts"() {
+    "use strict";
     init_inspection();
-    MAX_INPUTS = 1e5;
+    COMMIT_FORMAT = "%H%x09%cI%x09%s";
   }
 });
 
 // src/audit/docs.ts
 import fs5 from "fs/promises";
 import path7 from "path";
-import fg3 from "fast-glob";
+import fg5 from "fast-glob";
 async function dirtyDocs(resolvedRoot, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
   try {
@@ -1118,7 +1405,7 @@ async function discoverDocPaths(root) {
   const paths = [];
   const unique = [...new Set(candidates)].sort();
   for (let offset = 0; offset < unique.length; offset += 256) {
-    paths.push(...await auditGlob(root, unique.slice(offset, offset + 256).map((p) => fg3.escapePath(p)), {
+    paths.push(...await auditGlob(root, unique.slice(offset, offset + 256).map((p) => fg5.escapePath(p)), {
       ignore: excluded,
       followSymbolicLinks: false,
       label: "Documentation discovery"
@@ -1148,6 +1435,7 @@ async function localDocPaths(root) {
   return paths;
 }
 function documentScope(file) {
+  if (!/^(readme|agents|claude)\.md$/i.test(path7.posix.basename(file))) return ".";
   const parent = path7.posix.dirname(file);
   return path7.posix.basename(parent).toLowerCase() === ".claude" ? path7.posix.dirname(parent) : parent;
 }
@@ -1169,7 +1457,7 @@ async function readDocs(resolvedRoot) {
         path: candidate,
         content: content2,
         scope: documentScope(candidate),
-        kind: /^readme\.md$/i.test(path7.posix.basename(candidate)) ? "readme" : "instructions",
+        kind: /^readme\.md$/i.test(path7.posix.basename(candidate)) ? "readme" : /^(agents|claude)\.md$/i.test(path7.posix.basename(candidate)) ? "instructions" : "guide",
         lineCount: content2.split("\n").length,
         lastCommit,
         dirty: dirty.has(candidate),
@@ -1326,7 +1614,7 @@ var init_test_map = __esm({
 
 // src/snapshot/snapshot.ts
 import path10 from "path";
-import { z as z2 } from "zod";
+import { z as z4 } from "zod";
 async function inspectSnapshot(rootDir) {
   try {
     const raw = await readStoreJson(rootDir, ".mason/snapshot.json");
@@ -1360,30 +1648,30 @@ var init_snapshot = __esm({
     init_lock();
     init_paths();
     init_test_map();
-    repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
+    repoPath = z4.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
     verificationFields = {
-      refreshedHash: z2.string().optional(),
-      verifiedAt: z2.string().optional(),
-      verifiedHash: z2.string().optional(),
-      verificationToken: z2.string().optional(),
-      verificationFailed: z2.boolean().optional(),
-      verificationNote: z2.string().optional()
+      refreshedHash: z4.string().optional(),
+      verifiedAt: z4.string().optional(),
+      verifiedHash: z4.string().optional(),
+      verificationToken: z4.string().optional(),
+      verificationFailed: z4.boolean().optional(),
+      verificationNote: z4.string().optional()
     };
-    featureSchema = z2.object({
-      description: z2.string(),
-      files: z2.array(repoPath),
-      tests: z2.array(repoPath).optional(),
-      type: z2.enum(["capability", "infrastructure"]).optional(),
+    featureSchema = z4.object({
+      description: z4.string(),
+      files: z4.array(repoPath),
+      tests: z4.array(repoPath).optional(),
+      type: z4.enum(["capability", "infrastructure"]).optional(),
       ...verificationFields
     }).passthrough();
-    flowSchema = z2.object({ description: z2.string(), chain: z2.array(repoPath), ...verificationFields }).passthrough();
-    snapshotSchema = z2.object({
-      version: z2.literal(2),
-      createdAt: z2.string(),
-      updatedAt: z2.string(),
-      gitHash: z2.string(),
-      features: z2.record(featureSchema),
-      flows: z2.record(flowSchema)
+    flowSchema = z4.object({ description: z4.string(), chain: z4.array(repoPath), ...verificationFields }).passthrough();
+    snapshotSchema = z4.object({
+      version: z4.literal(2),
+      createdAt: z4.string(),
+      updatedAt: z4.string(),
+      gitHash: z4.string(),
+      features: z4.record(featureSchema),
+      flows: z4.record(flowSchema)
     }).passthrough();
   }
 });
@@ -1438,22 +1726,6 @@ var init_drift = __esm({
   }
 });
 
-// src/audit/types.ts
-var ALL_CHECKS;
-var init_types = __esm({
-  "src/audit/types.ts"() {
-    "use strict";
-    ALL_CHECKS = [
-      "deleted-reference",
-      "new-module",
-      "stale-count",
-      "dead-command",
-      "deps-changed",
-      "decision-anchor-drift"
-    ];
-  }
-});
-
 // src/audit/checks/deleted-reference.ts
 import path12 from "path";
 async function checkDeletedReferences(ctx) {
@@ -1522,7 +1794,7 @@ var init_deleted_reference = __esm({
 });
 
 // src/audit/checks/new-module.ts
-import fg4 from "fast-glob";
+import fg6 from "fast-glob";
 import fs8 from "fs/promises";
 import path13 from "path";
 function escapeRegExp(text2) {
@@ -1584,7 +1856,7 @@ async function collectModuleCandidates(root, combinedDocs) {
     const result = /* @__PURE__ */ new Map();
     for (const dir of parents) {
       const visible = new Set(byParent.get(dir).filter((candidate) => !ignored.has(candidate) || sources.some((file) => file.startsWith(candidate + "/"))));
-      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
+      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg6.escapePath(dir)}/*`, {
         ignore,
         onlyDirectories: true,
         label: "Module directory discovery",
@@ -1597,7 +1869,7 @@ async function collectModuleCandidates(root, combinedDocs) {
     const files = sources.filter((file) => file.startsWith(dir + "/"));
     let count4 = 0;
     for (let offset = 0; offset < files.length; offset += 256) {
-      count4 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg4.escapePath(file)), {
+      count4 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg6.escapePath(file)), {
         ignore,
         followSymbolicLinks: false,
         label: `Source discovery in ${dir}`
@@ -1932,6 +2204,87 @@ var init_dead_command = __esm({
   }
 });
 
+// src/audit/dependency-claims.ts
+import path16 from "path";
+import { parse as parseToml } from "smol-toml";
+function dependencyText(content2) {
+  return content2.replace(/<!-- mason:start -->[\s\S]*?<!-- mason:end -->/g, (text2) => text2.replace(/[^\n]/g, " ")).replace(/<!--[\s\S]*?-->/g, (text2) => text2.replace(/[^\n]/g, " "));
+}
+function declarations(file, source) {
+  const result = /* @__PURE__ */ new Map();
+  if (!source) return result;
+  if (path16.posix.basename(file) === "package.json") {
+    const json2 = JSON.parse(source);
+    for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies", "engines"]) {
+      for (const [name, value] of Object.entries(json2[section] ?? {})) {
+        if (typeof value === "string") result.set(name, [...result.has(name) ? [result.get(name)] : [], value].join("; "));
+      }
+    }
+  } else if (file.endsWith("libs.versions.toml")) {
+    const catalog = parseToml(source);
+    for (const section of ["libraries", "plugins"]) for (const [alias, entry] of Object.entries(catalog[section] ?? {})) {
+      if (typeof entry === "string") {
+        const parts = entry.split(":");
+        if (parts.length >= 3) result.set(parts.slice(0, -1).join(":"), parts.at(-1));
+      } else if (entry && typeof entry === "object") {
+        const name = entry.module ?? (entry.group && entry.name ? `${entry.group}:${entry.name}` : entry.id);
+        const version = typeof entry.version === "string" ? entry.version : catalog.versions?.[entry.version?.ref];
+        if (typeof name === "string") result.set(name, typeof version === "string" ? version : "unspecified");
+      }
+    }
+  } else if (/build\.gradle(?:\.kts)?$/.test(file)) {
+    for (const match of source.matchAll(/["']([\w.-]+:[\w.-]+):([^"'\s]+)["']/g)) result.set(match[1], match[2]);
+    for (const match of source.matchAll(/\bid\s*\(?\s*["']([\w.-]+)["']\s*\)?\s*version\s*["']([^"']+)["']/g)) result.set(match[1], match[2]);
+  }
+  return result;
+}
+async function matchDependencyChanges(root, from, head, files, content2) {
+  const matches = [];
+  const lines = dependencyText(content2).split("\n");
+  let incomplete = files.length > 64;
+  for (const file of files.slice(0, 64)) {
+    if (!/(?:^|\/)(?:package\.json|libs\.versions\.toml|build\.gradle(?:\.kts)?)$/.test(file)) {
+      incomplete = true;
+      continue;
+    }
+    try {
+      const read = async (revision) => {
+        const { stdout: entry } = await inspectionGit(["ls-tree", revision, "--", `:(literal)${file}`], { cwd: root, timeout: 1e4 });
+        if (!entry) return "";
+        if (!entry.startsWith("100644 ") && !entry.startsWith("100755 ")) throw new Error("Unsupported manifest mode");
+        return (await inspectionGit(["show", `${revision}:${file}`], { cwd: root, maxBuffer: 1024 * 1024, timeout: 1e4 })).stdout;
+      };
+      const [before, after] = await Promise.all([read(from), read(head)]);
+      const old = declarations(file, before), next = declarations(file, after);
+      for (const dependency of /* @__PURE__ */ new Set([...old.keys(), ...next.keys()])) {
+        if (old.get(dependency) === next.get(dependency)) continue;
+        const escaped = dependency.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        const mention = new RegExp(`(^|[^a-zA-Z0-9_@./-])${escaped}(?![a-zA-Z0-9_/-]|\\.[a-zA-Z0-9_])`, "i");
+        const line = lines.findIndex((text2) => mention.test(text2));
+        if (line < 0) continue;
+        matches.push({
+          dependency,
+          manifest: file,
+          before: old.get(dependency) ?? null,
+          after: next.get(dependency) ?? null,
+          line: line + 1,
+          excerpt: lines[line].trim().slice(0, 500)
+        });
+        if (matches.length >= 100) return { matches, incomplete: true };
+      }
+    } catch {
+      incomplete = true;
+    }
+  }
+  return { matches, incomplete };
+}
+var init_dependency_claims = __esm({
+  "src/audit/dependency-claims.ts"() {
+    "use strict";
+    init_inspection();
+  }
+});
+
 // src/audit/release-metadata.ts
 async function git(root, args2) {
   return (await execGit(args2, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
@@ -2011,13 +2364,6 @@ async function checkDepsChanged(ctx) {
       });
       continue;
     }
-    if (doc.dirty) {
-      result.skipped.push({
-        check: "deps-changed",
-        doc: doc.path,
-        reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
-      });
-    }
     let content2 = doc.content;
     if (doc.dirty) {
       try {
@@ -2030,7 +2376,6 @@ async function checkDepsChanged(ctx) {
         continue;
       }
     }
-    if (!hasDependencyContent(content2)) continue;
     const range = await commitsTouchingSince(
       ctx.root,
       doc.lastCommit.hash,
@@ -2054,16 +2399,32 @@ async function checkDepsChanged(ctx) {
     range.commits = relevant;
     range.total = relevant.length;
     if (range.total === 0) continue;
-    const latest = range.commits[0];
+    const relevance = await matchDependencyChanges(
+      ctx.root,
+      doc.lastCommit.hash,
+      ctx.headHash,
+      [...new Set(range.commits.flatMap((commit) => commit.files))],
+      content2
+    );
+    if (!relevance.matches.length && !hasDependencyContent(content2)) continue;
+    const match = relevance.matches[0];
+    if (doc.dirty && match) result.skipped.push({
+      check: "deps-changed",
+      doc: doc.path,
+      reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
+    });
     (doc.dirty ? result.suppressedAdvisories : result.advisories).push({
       type: "deps-changed",
-      message: `dependency manifests touched by ${range.total} commit${range.total === 1 ? "" : "s"} since ${doc.path} was last committed (latest: ${latest.hash.slice(0, 7)} "${latest.subject}")`,
-      anchor: { doc: doc.path, line: null, excerpt: null },
+      ...match ? {} : { resolution: "informational" },
+      message: match ? `${match.dependency} changed from ${match.before ?? "absent"} to ${match.after ?? "removed"} in ${match.manifest}; review ${doc.path}:${match.line}: ${match.excerpt}${relevance.matches.length > 1 ? ` (${relevance.matches.length - 1} more matches in evidence)` : ""}` : `Dependency manifests changed after the document baseline ${doc.lastCommit.hash.slice(0, 7)} (${doc.lastCommit.date.slice(0, 10)}); no specific affected passage was established. Informational only.${relevance.incomplete ? " Some manifest declarations could not be matched." : ""}`,
+      anchor: { doc: doc.path, line: match?.line ?? null, excerpt: match?.excerpt ?? null },
       evidence: {
         kind: "doc-behind-manifests",
         docLastCommit: doc.lastCommit,
         manifestCommits: range.commits.slice(0, MANIFEST_COMMITS_CAP),
-        totalCommits: range.total
+        totalCommits: range.total,
+        matches: relevance.matches,
+        matchingIncomplete: relevance.incomplete
       }
     });
   }
@@ -2073,6 +2434,7 @@ var MANIFEST_COMMITS_CAP, MANIFEST_PATHSPECS;
 var init_deps_changed = __esm({
   "src/audit/checks/deps-changed.ts"() {
     "use strict";
+    init_dependency_claims();
     init_docs();
     init_release_metadata();
     init_git();
@@ -2097,7 +2459,7 @@ var init_deps_changed = __esm({
 });
 
 // src/context/lexical.ts
-import path16 from "path";
+import path17 from "path";
 var init_lexical = __esm({
   "src/context/lexical.ts"() {
     "use strict";
@@ -2121,7 +2483,7 @@ var init_trust = __esm({
 });
 
 // src/decisions/provenance.ts
-import { z as z3 } from "zod";
+import { z as z5 } from "zod";
 function decisionContent(record) {
   return {
     title: record.title,
@@ -2185,67 +2547,67 @@ var init_provenance = __esm({
     "use strict";
     init_paths();
     init_trust();
-    text = (max) => z3.string().trim().min(1).max(max);
-    decisionSourceSchema = z3.object({
-      kind: z3.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
+    text = (max) => z5.string().trim().min(1).max(max);
+    decisionSourceSchema = z5.object({
+      kind: z5.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
       reference: text(1e3),
       note: text(500).optional()
     }).strict();
-    attributionSchema = z3.object({
+    attributionSchema = z5.object({
       owner: text(200).nullable().optional(),
-      sources: z3.array(decisionSourceSchema).max(20).optional(),
+      sources: z5.array(decisionSourceSchema).max(20).optional(),
       actor: text(200).optional()
     });
-    contentSchema = z3.object({
-      title: z3.string().min(1),
-      body: z3.string().min(1),
-      category: z3.enum(["decision", "gotcha", "deprecation", "convention"]),
-      files: z3.array(z3.string().refine((f) => normalizeRepoPath(f) !== null)),
+    contentSchema = z5.object({
+      title: z5.string().min(1),
+      body: z5.string().min(1),
+      category: z5.enum(["decision", "gotcha", "deprecation", "convention"]),
+      files: z5.array(z5.string().refine((f) => normalizeRepoPath(f) !== null)),
       owner: text(200).optional(),
-      sources: z3.array(decisionSourceSchema).max(20)
+      sources: z5.array(decisionSourceSchema).max(20)
     });
-    approvalSchema = z3.enum(["unreviewed", "proposed", "accepted"]);
-    statusSchema = z3.enum(["active", "superseded", "retired"]);
-    reviewEvidenceSchema = z3.object({
-      baseHash: z3.string(),
-      headHash: z3.string(),
-      historyAvailable: z3.boolean(),
-      changedFiles: z3.array(z3.string()),
-      localChanges: z3.array(z3.string())
+    approvalSchema = z5.enum(["unreviewed", "proposed", "accepted"]);
+    statusSchema = z5.enum(["active", "superseded", "retired"]);
+    reviewEvidenceSchema = z5.object({
+      baseHash: z5.string(),
+      headHash: z5.string(),
+      historyAvailable: z5.boolean(),
+      changedFiles: z5.array(z5.string()),
+      localChanges: z5.array(z5.string())
     });
-    eventSchema = z3.object({
-      kind: z3.enum(["imported", "created", "revised", "accepted", "reaffirmed", "retired", "superseded"]),
-      at: z3.string().datetime(),
+    eventSchema = z5.object({
+      kind: z5.enum(["imported", "created", "revised", "accepted", "reaffirmed", "retired", "superseded"]),
+      at: z5.string().datetime(),
       actor: text(200).optional(),
       note: text(1500).optional(),
-      revision: z3.number().int().positive(),
+      revision: z5.number().int().positive(),
       content: contentSchema,
       approval: approvalSchema,
       status: statusSchema,
-      refreshedHash: z3.string(),
+      refreshedHash: z5.string(),
       evidence: reviewEvidenceSchema.optional()
     });
-    legacySchema = z3.object({
-      version: z3.literal(1),
-      id: z3.string().regex(/^[a-zA-Z0-9_-]+$/),
-      title: z3.string().min(1),
-      body: z3.string().min(1),
+    legacySchema = z5.object({
+      version: z5.literal(1),
+      id: z5.string().regex(/^[a-zA-Z0-9_-]+$/),
+      title: z5.string().min(1),
+      body: z5.string().min(1),
       category: contentSchema.shape.category,
       files: contentSchema.shape.files,
-      createdAt: z3.string(),
-      updatedAt: z3.string(),
-      refreshedHash: z3.string(),
-      status: z3.enum(["active", "superseded"]),
-      supersededBy: z3.string().optional()
+      createdAt: z5.string(),
+      updatedAt: z5.string(),
+      refreshedHash: z5.string(),
+      status: z5.enum(["active", "superseded"]),
+      supersededBy: z5.string().optional()
     }).passthrough();
     currentSchema = legacySchema.extend({
-      version: z3.literal(2),
+      version: z5.literal(2),
       status: statusSchema,
       approval: approvalSchema,
-      revision: z3.number().int().positive(),
+      revision: z5.number().int().positive(),
       owner: text(200).optional(),
-      sources: z3.array(decisionSourceSchema).max(20),
-      history: z3.array(eventSchema).min(1)
+      sources: z5.array(decisionSourceSchema).max(20),
+      history: z5.array(eventSchema).min(1)
     }).superRefine((record, ctx) => {
       const invalid = (message2) => ctx.addIssue({ code: "custom", message: message2 });
       const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
@@ -2275,15 +2637,15 @@ var init_provenance = __esm({
       }
       if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash) invalid("Decision does not match the final history event");
     });
-    decisionSchema = z3.union([legacySchema, currentSchema]);
+    decisionSchema = z5.union([legacySchema, currentSchema]);
   }
 });
 
 // src/decisions/decisions.ts
 import fs9 from "fs/promises";
-import path17 from "path";
-import { createHash } from "crypto";
-import { z as z4 } from "zod";
+import path18 from "path";
+import { createHash as createHash2 } from "crypto";
+import { z as z6 } from "zod";
 async function loadDecisionStore(rootDir) {
   const records = [];
   const diagnostics = [];
@@ -2319,7 +2681,7 @@ var init_decisions = __esm({
     TITLE_MAX_CHARS = 80;
     BODY_RECOMMENDED_CHARS = 1500;
     BODY_MAX_CHARS = 2500;
-    boundedText = (field, max, hint) => z4.string({
+    boundedText = (field, max, hint) => z6.string({
       errorMap: (issue, ctx) => ({ message: issue.code === "too_big" ? `${field} has ${ctx.data.length} characters; maximum is ${max} (${ctx.data.length - max} over). ${hint}` : ctx.defaultError })
     }).trim().min(1, `${field} must be non-empty`).max(max);
     decisionTitleSchema = boundedText("title", TITLE_MAX_CHARS, "Tighten it to a specific headline.");
@@ -2332,9 +2694,9 @@ var init_decisions = __esm({
 });
 
 // src/decisions/drift.ts
-import path18 from "path";
+import path19 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path18.resolve(rootDir);
+  const resolvedRoot = path19.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
   const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
   const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
@@ -2450,128 +2812,26 @@ var init_checks = __esm({
   }
 });
 
-// src/audit/findings.ts
-import { createHash as createHash2 } from "crypto";
-import { z as z5 } from "zod";
-function findingId(finding) {
-  const e = finding.evidence;
-  let key;
-  switch (e.kind) {
-    case "missing-path":
-      key = e.resolvedPath && e.resolvedPath !== e.claimed ? [e.claimed, e.resolvedPath] : e.claimed;
-      break;
-    case "unmentioned-dir":
-      key = e.dir;
-      break;
-    case "count-mismatch":
-      key = [e.unit.replace(/s$/, ""), e.countedFrom];
-      break;
-    case "missing-script":
-      key = e.scope && e.scope.directory !== "." ? [e.scriptName, e.scope.directory] : e.scriptName;
-      break;
-    case "doc-behind-manifests":
-      key = null;
-      break;
-    case "decision-anchor":
-      key = [e.decisionId, e.provenance?.revision, e.provenance?.approval];
-      break;
-  }
-  return digest([finding.type, finding.anchor.doc, key]);
-}
-var digest, checkSchema, commitSchema, anchorSchema, count, scopeSchema, evidenceSchema, findingSchema, issueSchema, advisorySchema, checkResultSchema;
-var init_findings = __esm({
-  "src/audit/findings.ts"() {
-    "use strict";
-    digest = (value) => createHash2("sha256").update(JSON.stringify(value)).digest("hex");
-    checkSchema = z5.enum(["deleted-reference", "new-module", "stale-count", "dead-command", "deps-changed", "decision-anchor-drift"]);
-    commitSchema = z5.object({ hash: z5.string().regex(/^[a-f0-9]{40,64}$/), date: z5.string(), subject: z5.string() });
-    anchorSchema = z5.object({ doc: z5.string(), line: z5.number().int().positive().nullable(), excerpt: z5.string().nullable() });
-    count = z5.number().int().nonnegative();
-    scopeSchema = z5.object({
-      basis: z5.enum(["repository", "document", "document-link", "explicit"]),
-      directory: z5.string(),
-      candidates: z5.array(z5.string())
-    });
-    evidenceSchema = z5.discriminatedUnion("kind", [
-      z5.object({
-        kind: z5.literal("missing-path"),
-        claimed: z5.string(),
-        renamedTo: z5.string().nullable(),
-        deletedInCommit: commitSchema.nullable(),
-        everTracked: z5.boolean(),
-        parentDirExists: z5.boolean(),
-        resolvedPath: z5.string().optional(),
-        scope: scopeSchema.optional()
-      }),
-      z5.object({
-        kind: z5.literal("unmentioned-dir"),
-        dir: z5.string(),
-        sourceFileCount: count,
-        firstCommit: commitSchema.nullable(),
-        checkedDocs: z5.array(z5.string())
-      }),
-      z5.object({
-        kind: z5.literal("count-mismatch"),
-        claimed: count,
-        actual: count,
-        unit: z5.string(),
-        countedFrom: z5.string(),
-        members: z5.array(z5.string())
-      }),
-      z5.object({
-        kind: z5.literal("missing-script"),
-        scriptName: z5.string(),
-        invocation: z5.string(),
-        manifestsChecked: z5.array(z5.string()),
-        availableScripts: z5.array(z5.string()),
-        scope: scopeSchema.optional()
-      }),
-      z5.object({
-        kind: z5.literal("doc-behind-manifests"),
-        docLastCommit: commitSchema,
-        manifestCommits: z5.array(commitSchema.extend({ files: z5.array(z5.string()) })),
-        totalCommits: count
-      }),
-      z5.object({
-        kind: z5.literal("decision-anchor"),
-        decisionId: z5.string(),
-        title: z5.string(),
-        changedFiles: z5.array(z5.string()),
-        refreshedHash: z5.string(),
-        provenance: z5.object({}).passthrough().optional()
-      })
-    ]);
-    findingSchema = z5.object({ message: z5.string(), anchor: anchorSchema, evidence: evidenceSchema });
-    issueSchema = findingSchema.extend({
-      type: z5.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
-      confidence: z5.enum(["certain", "likely"])
-    });
-    advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z5.literal("recheck").optional() });
-    checkResultSchema = z5.object({
-      issues: z5.array(issueSchema),
-      advisories: z5.array(advisorySchema),
-      suppressedAdvisories: z5.array(advisorySchema).optional(),
-      skipped: z5.array(z5.object({ check: z5.string(), reason: z5.string(), doc: z5.string().optional() }))
-    });
-  }
-});
-
 // src/audit/advisory-review.ts
 import fs10 from "fs/promises";
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 async function readRecord(root, id) {
   const raw = await readStoreJson(root, recordPath(id));
   if (raw === null) return null;
   const record = recordSchema.parse(raw);
   const { digest: stored, ...payload } = record;
-  if (record.id !== id || digest(payload) !== stored || record.events.some((event) => findingId(event.finding) !== id || event.evidence.fingerprint !== digest([event.evidence.scope, event.evidence.tree, event.evidence.lastScopeCommit, event.evidence.paths]))) {
+  if (record.id !== id || digest(payload) !== stored || record.events.some((event) => findingId(event.finding) !== id || (event.outcome === "dismissed" ? !event.reasonCode || event.finding.type !== "deps-changed" : !event.reviewer || !!event.reasonCode) || event.evidence.fingerprint !== evidenceFingerprint(event.evidence, event.reasonCode))) {
     throw new Error("Advisory review record is inconsistent or modified; inspect its history.");
   }
   return record;
 }
-function scopes(finding) {
+function evidenceFingerprint(evidence, reason2) {
+  return digest([evidence.scope, evidence.tree, ...reason2 === "no-dependency-claims" ? [] : [evidence.lastScopeCommit], evidence.paths]);
+}
+function scopes(finding, reason2) {
   const files = [finding.anchor.doc], e = finding.evidence;
   if (e.kind === "decision-anchor") throw new Error("Use review_decision for decision acceptance, reaffirmation or retirement.");
+  if (reason2 === "no-dependency-claims" && e.kind === "doc-behind-manifests") return [`:(literal)${finding.anchor.doc}`];
   if (e.kind === "doc-behind-manifests") return [`:(literal)${finding.anchor.doc}`, ...manifestPathspecs(finding.anchor.doc)];
   if (e.kind === "missing-path") files.push(...e.scope?.candidates ?? [e.resolvedPath ?? e.claimed]);
   else if (e.kind === "missing-script") files.push(...e.manifestsChecked, ...e.scope?.candidates ?? []);
@@ -2582,9 +2842,9 @@ function scopes(finding) {
     return `:(literal)${file}`;
   }).sort();
 }
-async function reviewEvidence(root, finding) {
+async function reviewEvidence(root, finding, reason2) {
   if (normalizeRepoPath(finding.anchor.doc) !== finding.anchor.doc) throw new Error("Invalid advisory document path.");
-  const scope = scopes(finding);
+  const scope = scopes(finding, reason2);
   const head = (await git2(root, "rev-parse", "HEAD")).trim();
   const tracked = (await git2(root, "ls-files", "--cached", "-z", "--", ...scope)).split("\0").filter(Boolean);
   if (tracked.length > 2e4) throw new Error("Advisory scope exceeds 20,000 tracked files.");
@@ -2610,7 +2870,7 @@ async function reviewEvidence(root, finding) {
       if (!tracked.includes(file) && await pathExists(root, file)) dirty = true;
     }
   }
-  const fingerprint = digest([scope, tree, lastScopeCommit, paths]);
+  const fingerprint = evidenceFingerprint({ head, scope, tree, lastScopeCommit, paths, fingerprint: "" }, reason2);
   if ((await git2(root, "rev-parse", "HEAD")).trim() !== head) throw new Error("HEAD changed while collecting review evidence.");
   return {
     ...evidenceSchema2.parse({ head, scope, tree, lastScopeCommit, paths, fingerprint }),
@@ -2657,7 +2917,7 @@ async function assessAdvisory(root, finding, baselineHead) {
     const record = await readRecord(root, id);
     if (!record) return null;
     const event = record.events.at(-1);
-    const current = await reviewEvidence(root, event.finding);
+    const current = await reviewEvidence(root, event.finding, event.reasonCode);
     await git2(root, "merge-base", "--is-ancestor", event.evidence.head, current.head);
     const base = {
       id,
@@ -2667,7 +2927,7 @@ async function assessAdvisory(root, finding, baselineHead) {
       outcome: event.outcome,
       reviewedHead: event.evidence.head
     };
-    if (current.dirty || current.fingerprint !== event.evidence.fingerprint || digest(scopes(finding)) !== digest(event.evidence.scope)) return { ...base, status: "reopened", reason: "Relevant document or repository evidence changed after the assessment; prepare a new review." };
+    if (current.dirty || current.fingerprint !== event.evidence.fingerprint || digest(scopes(finding, event.reasonCode)) !== digest(event.evidence.scope)) return { ...base, status: "reopened", reason: "Relevant document or repository evidence changed after the assessment; prepare a new review." };
     return { ...base, status: event.outcome === "deferred" ? "deferred" : "current", reason: event.outcome === "deferred" ? "The review was deferred and remains outstanding." : "An explicit assessment covers the current committed scope. This does not approve an engineering decision or certify correctness." };
   } catch (error) {
     return { id, status: "unverified", reason: error instanceof Error ? error.message : String(error) };
@@ -2684,7 +2944,7 @@ async function advisoryReviewInventory(root) {
   if (names.length > 5e3) throw new Error("Advisory review inventory exceeds 5,000 records.");
   return Promise.all(names.filter((name) => name.endsWith(".json")).sort().map(async (name) => [name, await readAuditInput(root, ".mason/reviews/advisories/" + name)]));
 }
-var git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
+var git2, hashSchema, commitSchema2, evidenceSchema2, dismissalReasonSchema, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
 var init_advisory_review = __esm({
   "src/audit/advisory-review.ts"() {
     "use strict";
@@ -2700,39 +2960,42 @@ var init_advisory_review = __esm({
     init_decisions();
     init_drift2();
     git2 = async (root, ...args2) => (await (["log", "ls-tree", "ls-files", "merge-base"].includes(args2[0]) ? inspectionGit : execGit)(args2, { cwd: root, timeout: 1e4, maxBuffer: 8 * 1024 * 1024 })).stdout;
-    hashSchema = z6.string().regex(/^[a-f0-9]{64}$/);
-    commitSchema2 = z6.string().regex(/^[a-f0-9]{40,64}$/);
-    evidenceSchema2 = z6.object({
+    hashSchema = z7.string().regex(/^[a-f0-9]{64}$/);
+    commitSchema2 = z7.string().regex(/^[a-f0-9]{40,64}$/);
+    evidenceSchema2 = z7.object({
       head: commitSchema2,
       fingerprint: hashSchema,
-      scope: z6.array(z6.string()).min(1).max(1e3),
-      tree: z6.string().max(2 * 1024 * 1024),
+      scope: z7.array(z7.string()).min(1).max(1e3),
+      tree: z7.string().max(2 * 1024 * 1024),
       lastScopeCommit: commitSchema2,
-      paths: z6.array(z6.object({ path: z6.string(), exists: z6.boolean() })).max(1e3)
+      paths: z7.array(z7.object({ path: z7.string(), exists: z7.boolean() })).max(1e3)
     });
-    eventSchema2 = z6.object({
-      at: z6.string().datetime(),
-      reviewer: z6.string().trim().min(1).max(200),
-      note: z6.string().trim().min(1).max(2500),
-      outcome: z6.enum(["addressed", "inapplicable", "deferred"]),
+    dismissalReasonSchema = z7.enum(["no-dependency-claims", "unrelated-manifest-change"]);
+    eventSchema2 = z7.object({
+      at: z7.string().datetime(),
+      reviewer: z7.string().trim().min(1).max(200).optional(),
+      note: z7.string().trim().min(1).max(2500),
+      outcome: z7.enum(["addressed", "inapplicable", "deferred", "dismissed"]),
+      reasonCode: dismissalReasonSchema.optional(),
       finding: advisorySchema.refine((finding) => finding.evidence.kind !== "decision-anchor", "Decision findings use decision reviews"),
       evidence: evidenceSchema2
     });
-    recordSchema = z6.object({ version: z6.literal(1), id: hashSchema, events: z6.array(eventSchema2).min(1).max(200), digest: hashSchema });
-    reviewSummarySchema = z6.object({
+    recordSchema = z7.object({ version: z7.literal(1), id: hashSchema, events: z7.array(eventSchema2).min(1).max(200), digest: hashSchema });
+    reviewSummarySchema = z7.object({
       id: hashSchema,
-      status: z6.enum(["current", "reopened", "deferred", "unverified"]),
-      reason: z6.string(),
-      recordPath: z6.string().optional(),
-      reviewer: z6.string().optional(),
-      note: z6.string().optional(),
-      outcome: z6.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired"]).optional(),
-      reviewedHead: z6.string().optional()
+      status: z7.enum(["current", "reopened", "deferred", "unverified"]),
+      reason: z7.string(),
+      recordPath: z7.string().optional(),
+      reviewer: z7.string().optional(),
+      note: z7.string().optional(),
+      outcome: z7.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired", "dismissed"]).optional(),
+      reviewedHead: z7.string().optional()
     });
-    advisoryReviewRequest = z6.object({
-      baselinePath: z6.string().min(1),
+    advisoryReviewRequest = z7.object({
+      baselinePath: z7.string().min(1),
       findingId: hashSchema,
-      action: z6.enum(["prepare", "addressed", "inapplicable", "deferred"]).default("prepare"),
+      action: z7.enum(["prepare", "addressed", "inapplicable", "deferred", "dismiss"]).default("prepare"),
+      reasonCode: dismissalReasonSchema.optional(),
       reviewer: eventSchema2.shape.reviewer.optional(),
       note: eventSchema2.shape.note.optional(),
       reviewToken: hashSchema.optional()
@@ -2743,12 +3006,12 @@ var init_advisory_review = __esm({
 
 // src/audit/audit.ts
 import fs11 from "fs/promises";
-import path19 from "path";
+import path20 from "path";
 async function computeAudit(rootDir, options = {}) {
   return profilePhase("audit.current", () => auditCurrent(rootDir, options));
 }
 async function auditCurrent(rootDir, options) {
-  const resolvedRoot = path19.resolve(rootDir);
+  const resolvedRoot = path20.resolve(rootDir);
   const [docs, headHash] = await Promise.all([discoverDocs(resolvedRoot), getCurrentGitHash(resolvedRoot)]);
   if (docs.length === 0) return null;
   const report = {
@@ -2782,7 +3045,7 @@ async function auditCurrent(rootDir, options) {
   }
   let decisionsPresent = false;
   try {
-    await fs11.access(path19.join(resolvedRoot, ".mason", "decisions"));
+    await fs11.access(path20.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -2794,13 +3057,21 @@ async function auditCurrent(rootDir, options) {
     changesSinceDoc,
     decisionsPresent
   };
+  const policy = (await loadProjectConfig(resolvedRoot)).audit;
   const selected = options.checks ?? ALL_CHECKS;
   for (const name of ALL_CHECKS) {
     if (!selected.includes(name)) continue;
-    const { issues, advisories, suppressedAdvisories, skipped } = await (options.runCheck ? options.runCheck(name, ctx) : CHECKS[name](ctx));
+    const exclusions = policy?.exclude?.[name] ?? [];
+    const included = await includedCheckPaths(resolvedRoot, docs.map((doc) => doc.path), exclusions);
+    const excluded = docs.filter((doc) => !included.has(doc.path)).map((doc) => ({ check: name, doc: doc.path }));
+    if (excluded.length) (report.excludedChecks ??= []).push(...excluded);
+    const scoped = { ...ctx, docs: docs.filter((doc) => included.has(doc.path)) };
+    const { issues, advisories, suppressedAdvisories, skipped } = await (options.runCheck ? options.runCheck(name, scoped) : CHECKS[name](scoped));
     report.checksRun.push(name);
     report.issues.push(...issues);
-    report.advisories.push(...advisories);
+    const advisoryPaths = await includedCheckPaths(resolvedRoot, [...new Set(advisories.map((f) => f.anchor.doc))], exclusions);
+    report.advisories.push(...advisories.filter((f) => advisoryPaths.has(f.anchor.doc)));
+    for (const f of advisories) if (!advisoryPaths.has(f.anchor.doc)) (report.excludedChecks ??= []).push({ check: name, doc: f.anchor.doc });
     report.suppressedAdvisories.push(...suppressedAdvisories ?? []);
     report.skippedChecks.push(...skipped);
   }
@@ -2812,6 +3083,8 @@ async function auditCurrent(rootDir, options) {
 var init_audit = __esm({
   "src/audit/audit.ts"() {
     "use strict";
+    init_files();
+    init_policy();
     init_profile();
     init_drift();
     init_snapshot();
@@ -2824,9 +3097,9 @@ var init_audit = __esm({
 
 // src/audit/repair.ts
 import fs12 from "fs/promises";
-import path20 from "path";
+import path21 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 function recheckable(finding) {
   return !("confidence" in finding) && finding.resolution === "recheck" && ["deleted-reference", "dead-command", "new-module"].includes(finding.type) && ["missing-path", "missing-script", "unmentioned-dir"].includes(finding.evidence.kind);
 }
@@ -2845,7 +3118,7 @@ async function docState(root) {
       docs.push([doc, null]);
     }
   }
-  return digest(docs);
+  return digest([docs, (await loadProjectConfig(root)).audit]);
 }
 async function stableAudit(root, checks, options = {}) {
   return profilePhase("repair.audit", () => readStableAudit(root, checks, options));
@@ -2894,7 +3167,7 @@ async function withRepairSession(root, options, run, validate, cachedAudit) {
 }
 async function prepareOriginal(rootDir, checks, options, session) {
   const root = await fs12.realpath(rootDir);
-  const selected = z7.array(checkSchema).nonempty().parse(checks);
+  const selected = z8.array(checkSchema).nonempty().parse(checks);
   const report = await (session ? session.audit(selected) : stableAudit(root, selected, options));
   if (!report) throw new Error("No context files found to prepare a repair.");
   if (!report.gitAvailable) throw new Error("Readable Git history is required to prepare a repair.");
@@ -2911,8 +3184,8 @@ async function prepareOriginal(rootDir, checks, options, session) {
 }
 async function loadRepairBaseline(rootDir, baselinePath) {
   const root = await fs12.realpath(rootDir);
-  const declaredRoot = path20.resolve(rootDir);
-  const relative = path20.isAbsolute(baselinePath) ? path20.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const declaredRoot = path21.resolve(rootDir);
+  const relative = path21.isAbsolute(baselinePath) ? path21.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
   const { digest: savedDigest, ...payload } = stored;
   if (digest(payload) !== savedDigest) throw new Error("Repair baseline was modified; use the original baseline.");
@@ -2958,6 +3231,9 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
     if (now && ("confidence" in finding || "confidence" in now)) {
       return { ...base, status: "unresolved", reason: "The original check still reports this claim." };
     }
+    if (current.excludedChecks?.some((excluded) => excluded.check === finding.type && excluded.doc === finding.anchor.doc)) {
+      return { ...base, status: "resolved", reason: "Excluded by project audit policy; this is not a correctness assessment. Original evidence is retained." };
+    }
     const skipped = current.skippedChecks.filter((s) => s.check === finding.type && (!s.doc || s.doc === finding.anchor.doc));
     if (!current.checksRun?.includes(finding.type) || skipped.length) {
       return { ...base, status: "unverified", reason: skipped.map((s) => s.reason).join("; ") || "The original check did not run." };
@@ -2968,6 +3244,9 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
       if (review.status === "current") return { ...base, review, status: "resolved", reason: review.reason };
       return { ...base, review, status: "review-required", reason: review.reason };
     }
+    if (!("confidence" in finding) && finding.evidence.kind === "doc-behind-manifests" && !finding.evidence.matches?.length && (!now || !("confidence" in now) && now.resolution === "informational")) {
+      return { ...base, status: "resolved", reason: "Manifest recency alone establishes no affected passage. Retained as information; no assessment is required." };
+    }
     if (!("confidence" in finding) && (!recheckable(finding) || now)) {
       return {
         ...base,
@@ -2996,7 +3275,7 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
   const reviewedIds = new Set(current?.advisoryReviews?.filter((review) => review.status === "current").map((review) => review.id));
   const counts = { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 };
   for (const f of findings) counts[f.status]++;
-  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f) && !reviewedIds.has(findingId(f)));
+  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f) && f.resolution !== "informational" && !reviewedIds.has(findingId(f)));
   const issuesRemain = counts.unresolved > 0 || newFindings.some((f) => "confidence" in f);
   return {
     version: 1,
@@ -3029,41 +3308,42 @@ var init_repair = __esm({
     init_findings();
     init_advisory_review();
     init_findings();
-    count2 = z7.number().int().nonnegative();
-    reportSchema = z7.object({
-      version: z7.literal(1),
-      root: z7.string(),
-      gitAvailable: z7.literal(true),
+    count2 = z8.number().int().nonnegative();
+    reportSchema = z8.object({
+      version: z8.literal(1),
+      root: z8.string(),
+      gitAvailable: z8.literal(true),
       headHash: commitSchema.shape.hash,
-      checksRun: z7.array(checkSchema).nonempty(),
-      docs: z7.array(z7.object({
-        path: z7.string().refine((value) => normalizeRepoPath(value) === value),
-        scope: z7.string().optional(),
-        kind: z7.enum(["instructions", "readme"]).optional(),
+      checksRun: z8.array(checkSchema).nonempty(),
+      docs: z8.array(z8.object({
+        path: z8.string().refine((value) => normalizeRepoPath(value) === value),
+        scope: z8.string().optional(),
+        kind: z8.enum(["instructions", "readme", "guide"]).optional(),
         lastCommit: commitSchema.nullable(),
-        dirty: z7.boolean(),
+        dirty: z8.boolean(),
         lineCount: count2
       })).nonempty(),
-      decisionsChecked: z7.boolean(),
-      clean: z7.boolean(),
-      issues: z7.array(issueSchema),
-      advisories: z7.array(advisorySchema),
-      suppressedAdvisories: z7.array(advisorySchema).optional(),
-      skippedChecks: z7.array(z7.object({ check: z7.string(), reason: z7.string(), doc: z7.string().optional() }))
+      decisionsChecked: z8.boolean(),
+      clean: z8.boolean(),
+      excludedChecks: z8.array(z8.object({ check: checkSchema, doc: z8.string() })).optional(),
+      issues: z8.array(issueSchema),
+      advisories: z8.array(advisorySchema),
+      suppressedAdvisories: z8.array(advisorySchema).optional(),
+      skippedChecks: z8.array(z8.object({ check: z8.string(), reason: z8.string(), doc: z8.string().optional() }))
     });
-    baselineSchema = z7.object({
-      kind: z7.literal("mason-audit-repair"),
-      version: z7.literal(1),
-      createdAt: z7.string().datetime(),
+    baselineSchema = z8.object({
+      kind: z8.literal("mason-audit-repair"),
+      version: z8.literal(1),
+      createdAt: z8.string().datetime(),
       report: reportSchema,
-      digest: z7.string().regex(/^[a-f0-9]{64}$/)
+      digest: z8.string().regex(/^[a-f0-9]{64}$/)
     });
-    repairFindingSchema = z7.object({
-      id: z7.string(),
-      original: z7.union([issueSchema, advisorySchema]),
-      status: z7.enum(["resolved", "unresolved", "review-required", "unverified"]),
-      reason: z7.string(),
-      current: z7.union([issueSchema, advisorySchema]).optional(),
+    repairFindingSchema = z8.object({
+      id: z8.string(),
+      original: z8.union([issueSchema, advisorySchema]),
+      status: z8.enum(["resolved", "unresolved", "review-required", "unverified"]),
+      reason: z8.string(),
+      current: z8.union([issueSchema, advisorySchema]).optional(),
       review: reviewSummarySchema.optional()
     });
   }
@@ -3071,10 +3351,10 @@ var init_repair = __esm({
 
 // src/automation/evidence.ts
 import fs13 from "fs/promises";
-import path21 from "path";
+import path22 from "path";
 import { createHash as createHash3 } from "crypto";
-import fg5 from "fast-glob";
-import { z as z8 } from "zod";
+import fg7 from "fast-glob";
+import { z as z9 } from "zod";
 async function git3(root, ...args2) {
   return profilePhase("automation.git", async () => (await execGit(args2, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout);
 }
@@ -3091,6 +3371,11 @@ async function readInputs(root) {
 }
 async function collectInputs(root) {
   const docPaths = await discoverDocPaths(root);
+  const auditPolicy = (await loadProjectConfig(root)).audit;
+  const allowed = /* @__PURE__ */ new Map();
+  for (const name of ["deleted-reference", "new-module", "stale-count", "dead-command"]) {
+    allowed.set(name, await includedCheckPaths(root, docPaths, auditPolicy?.exclude?.[name] ?? []));
+  }
   const [headText, docStatus, shallowPath, replacements] = await Promise.all([
     git3(root, "rev-parse", "HEAD"),
     docPaths.length ? git3(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...docPaths.map((p) => `:(literal)${p}`)) : "",
@@ -3100,7 +3385,7 @@ async function collectInputs(root) {
   const head = headText.trim();
   let shallow = null;
   try {
-    shallow = await fs13.readFile(path21.resolve(root, shallowPath.trim()), "utf8");
+    shallow = await fs13.readFile(path22.resolve(root, shallowPath.trim()), "utf8");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
@@ -3119,18 +3404,18 @@ async function collectInputs(root) {
     docContents.push([file, text2]);
     const parsed = { path: file, content: text2 ?? "", claims: extractClaims(text2 ?? "") };
     parsedDocs.push(parsed);
-    for (const claim of parsed.claims.paths) {
+    for (const claim of allowed.get("deleted-reference").has(file) ? parsed.claims.paths : []) {
       const scope = pathClaimScope(file, claim);
       if (scope?.candidates.some(gitMetadataPath)) continue;
       for (const candidate of scope?.candidates ?? []) {
         if (optionalMasonPath(candidate)) continue;
-        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path21.posix.dirname(candidate))]);
+        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path22.posix.dirname(candidate))]);
         claims.push([candidate, filePresent, parentPresent]);
       }
     }
   }
-  const combinedDocs = moduleDocumentation(parsedDocs);
-  const countClaims = parsedDocs.flatMap((doc) => doc.claims.counts.map((claim) => ({ doc: doc.path, claim })));
+  const combinedDocs = moduleDocumentation(parsedDocs.filter((doc) => allowed.get("new-module").has(doc.path)));
+  const countClaims = parsedDocs.filter((doc) => allowed.get("stale-count").has(doc.path)).flatMap((doc) => doc.claims.counts.map((claim) => ({ doc: doc.path, claim })));
   const decisionDirectory = await storePath(root, ".mason/decisions");
   const decisionPresence = await fs13.lstat(decisionDirectory).then((stat) => stat.isDirectory() ? "directory" : "file", (error) => {
     if (error.code === "ENOENT") return "absent";
@@ -3139,8 +3424,8 @@ async function collectInputs(root) {
   const [modules, counts, commands2, decisionFiles] = await Promise.all([
     combinedDocs ? moduleCandidates(root, combinedDocs) : [],
     Promise.all(countClaims.map(({ doc, claim }) => resolveDocCountSource(root, doc, claim))),
-    commandInputs(root, parsedDocs),
-    fg5(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
+    commandInputs(root, parsedDocs.filter((doc) => allowed.get("dead-command").has(doc.path))),
+    fg7(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
   ]);
   const decisions = await Promise.all(decisionFiles.sort().map(async (file) => {
     await storePath(root, file);
@@ -3150,7 +3435,7 @@ async function collectInputs(root) {
     git3(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
     git3(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
   ]) : ["", ""];
-  const common = [6, engineVersion, head, shallow, replacements, docContents];
+  const common = [7, engineVersion, head, shallow, replacements, docContents, auditPolicy];
   const keys = {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
@@ -3197,6 +3482,8 @@ var engineVersion, hash, content, cacheSchema;
 var init_evidence = __esm({
   "src/automation/evidence.ts"() {
     "use strict";
+    init_policy();
+    init_files();
     init_git_read();
     init_profile();
     init_docs();
@@ -3210,10 +3497,10 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     init_advisory_review();
-    engineVersion = true ? "0.19.0" : "development";
+    engineVersion = true ? "0.19.2" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
-    cacheSchema = z8.object({ version: z8.literal(1), entries: z8.record(z8.object({ key: z8.string(), result: checkResultSchema })), digest: z8.string() });
+    cacheSchema = z9.object({ version: z9.literal(1), entries: z9.record(z9.object({ key: z9.string(), result: checkResultSchema })), digest: z9.string() });
   }
 });
 
@@ -3221,7 +3508,7 @@ var init_evidence = __esm({
 import os2 from "os";
 import fs14 from "fs/promises";
 import { randomUUID as randomUUID3 } from "crypto";
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 function parseExecution(raw) {
   try {
     return executionSchema.parse(raw);
@@ -3239,7 +3526,7 @@ function automationFailure(error) {
     codes.add(String(cause.code));
     cause = cause.cause;
   }
-  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message2) ? "inputs-changed" : /Automation is busy/.test(message2) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message2) ? "history-unavailable" : error instanceof z9.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message2) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message2) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
+  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message2) ? "inputs-changed" : /Automation is busy/.test(message2) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message2) ? "history-unavailable" : error instanceof z10.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message2) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message2) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
   return { code, message: message2, retryable: ["inputs-changed", "storage-full", "busy", "io-error"].includes(code), receiptRecorded: false };
 }
 function failureMessage(error) {
@@ -3368,41 +3655,103 @@ var init_execution = __esm({
     init_store();
     init_evidence();
     init_storage();
-    failureSchema = z9.object({
-      code: z9.enum(["inputs-changed", "storage-full", "busy", "invalid-input", "history-unavailable", "invalid-evidence", "io-error", "internal"]),
-      message: z9.string(),
-      retryable: z9.boolean(),
-      receiptRecorded: z9.boolean()
+    failureSchema = z10.object({
+      code: z10.enum(["inputs-changed", "storage-full", "busy", "invalid-input", "history-unavailable", "invalid-evidence", "io-error", "internal"]),
+      message: z10.string(),
+      retryable: z10.boolean(),
+      receiptRecorded: z10.boolean()
     });
-    attemptSchema = z9.object({
-      id: z9.string().regex(/^[a-zA-Z0-9_-]+$/),
-      lease: z9.literal(true).optional(),
-      event: z9.string(),
-      startedAt: z9.string(),
-      finishedAt: z9.string().optional(),
-      durationMs: z9.number().nonnegative().optional(),
-      pid: z9.number().int().positive(),
-      host: z9.string(),
-      status: z9.enum(["running", "completed", "failed", "unknown"]),
-      verificationStatus: z9.string().optional(),
-      reportPath: z9.string().optional(),
+    attemptSchema = z10.object({
+      id: z10.string().regex(/^[a-zA-Z0-9_-]+$/),
+      lease: z10.literal(true).optional(),
+      event: z10.string(),
+      startedAt: z10.string(),
+      finishedAt: z10.string().optional(),
+      durationMs: z10.number().nonnegative().optional(),
+      pid: z10.number().int().positive(),
+      host: z10.string(),
+      status: z10.enum(["running", "completed", "failed", "unknown"]),
+      verificationStatus: z10.string().optional(),
+      reportPath: z10.string().optional(),
       failure: failureSchema.optional()
     });
-    executionSchema = z9.object({ version: z9.literal(1), attempts: z9.array(attemptSchema).max(160), discardedAttempts: z9.number().int().nonnegative().default(0) });
-    notificationsSchema = z9.object({ version: z9.literal(1), sessions: z9.record(z9.object({
-      signature: z9.string(),
+    executionSchema = z10.object({ version: z10.literal(1), attempts: z10.array(attemptSchema).max(160), discardedAttempts: z10.number().int().nonnegative().default(0) });
+    notificationsSchema = z10.object({ version: z10.literal(1), sessions: z10.record(z10.object({
+      signature: z10.string(),
       code: failureSchema.shape.code,
-      message: z9.string(),
-      count: z9.number().int().positive(),
-      lastAt: z9.string()
+      message: z10.string(),
+      count: z10.number().int().positive(),
+      lastAt: z10.string()
     })) });
     leasePath = (directory, id) => `${directory}/executions/${id}.json`;
   }
 });
 
+// src/decisions/pending.ts
+var pending_exports = {};
+__export(pending_exports, {
+  pendingKnowledge: () => pendingKnowledge
+});
+async function pendingKnowledge(root, now = Date.now()) {
+  try {
+    const [store, status] = await Promise.all([
+      loadDecisionStore(root),
+      execGit(
+        ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".mason/decisions"],
+        { cwd: root, timeout: 1e4, maxBuffer: 1024 * 1024 }
+      )
+    ]);
+    const changed = /* @__PURE__ */ new Set();
+    const entries = status.stdout.split("\0");
+    for (let i = 0; i < entries.length; i++) {
+      const entry = entries[i];
+      if (!entry) continue;
+      const file = entry.slice(3);
+      if (/^\.mason\/decisions\/[^/]+\.json$/.test(file)) changed.add(file);
+      if (/[RC]/.test(entry.slice(0, 2))) i++;
+    }
+    const records = new Map(store.records.map((record) => [`.mason/decisions/${record.id}.json`, record]));
+    const age = (at) => {
+      const time = at ? Date.parse(at) : NaN;
+      return Number.isFinite(time) ? `${Math.max(0, Math.floor((now - time) / 864e5))} days` : "unknown age";
+    };
+    const safe = (value) => value.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ");
+    const list = (items) => items.slice(0, 5).map(safe).join("; ") + (items.length > 5 ? `; ${items.length - 5} more` : "");
+    const proposals = store.records.filter((record) => record.status === "active" && decisionApproval(record) === "proposed").map((record) => {
+      const history = record.version === 2 ? record.history : [];
+      let lastReview = -1;
+      history.forEach((event, index2) => {
+        if (event.kind === "accepted" || event.kind === "reaffirmed") lastReview = index2;
+      });
+      const since = history.slice(lastReview + 1).find((event) => event.kind === "created" || event.kind === "revised")?.at ?? record.createdAt;
+      return { record, since };
+    }).sort((a, b) => {
+      const timestamp = (value) => Number.isFinite(Date.parse(value)) ? Date.parse(value) : Infinity;
+      return timestamp(a.since) - timestamp(b.since) || a.record.id.localeCompare(b.record.id);
+    });
+    const lines = [];
+    if (changed.size) lines.push(`${changed.size} uncommitted decision record(s): ${list([...changed].sort().map((file) => `${file} (saved-record age: ${age(records.get(file)?.updatedAt)})`))}.`);
+    if (proposals.length) lines.push(`${proposals.length} proposal(s) awaiting review (oldest first): ${list(proposals.map(({ record, since }) => `.mason/decisions/${record.id}.json (${age(since)})`))}.`);
+    if (store.diagnostics.length) lines.push(`${store.diagnostics.length} decision record(s) could not be read; pending knowledge summary is incomplete.`);
+    return lines.length ? `Mason pending knowledge:
+${lines.join("\n")}
+Informational only; review and commit through the normal project workflow. No approval is implied.` : null;
+  } catch {
+    return "Mason pending knowledge: unavailable; decision records or Git status could not be read.";
+  }
+}
+var init_pending = __esm({
+  "src/decisions/pending.ts"() {
+    "use strict";
+    init_git_read();
+    init_decisions();
+    init_provenance();
+  }
+});
+
 // src/automation/runtime.ts
 import { randomUUID as randomUUID4 } from "crypto";
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 async function observeReadOnlyTool(dir, event) {
   const ws = await profilePhase("automation.workspace", () => workspace(dir));
   await withLock(ws.root, ws.directory, async () => {
@@ -3624,6 +3973,19 @@ async function automate(dir, event) {
       const state = await loadState(ws);
       if (state.analysis?.id !== result.analysis.id) throw new Error("Automation evidence changed during publication; retry against the current inputs.");
       const report = structuredClone(result.analysis.report);
+      if (!state.notifications) {
+        let baseline = { findings: report.findings, head: report.head };
+        if (state.latest) {
+          try {
+            const previous = z11.object({ findings: z11.array(repairFindingSchema), head: z11.string() }).safeParse(await readStoreJson(ws.root, state.latest));
+            if (!previous.success) throw new Error("Unsupported saved report");
+            baseline = previous.data;
+          } catch {
+            report.diagnostics.push("The saved notification baseline could not be read; initialized from the current audit. Original repair evidence is retained. Run an explicit check for all outstanding findings.");
+          }
+        }
+        state.notifications = createNotificationState(baseline.findings, baseline.head);
+      }
       if (result.shared) report.checks = { ...report.checks, ran: [], reused: [.../* @__PURE__ */ new Set([...report.checks.ran, ...report.checks.reused])], shared: true };
       report.reportPath = ws.directory + "/checks/" + randomUUID4() + ".json";
       const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -3636,12 +3998,8 @@ async function automate(dir, event) {
         if (Object.keys(state.sessions).length >= 128) throw new Error("Too many sessions with unfinished tool calls; original evidence was retained.");
         state.sessions[key] = {
           host: event.host,
-          seen: null,
-          continued: false,
-          initialIssues: report.findings.filter((f) => f.status === "unresolved").map((f) => f.id),
-          initialDocs: inputs.docs,
+          notifiedDiagnostics: [],
           lastUsed: now,
-          mutationObserved: false,
           pending: {},
           coverageGaps: [],
           events: {}
@@ -3656,7 +4014,6 @@ async function automate(dir, event) {
           session.pending[event.toolId] = inputs.fingerprint;
         }
         if (event.event === "after_tool" && event.mutating) {
-          session.mutationObserved = true;
           if (!event.toolId || !session.pending[event.toolId]) {
             const gap = "A tool completed without an observed matching pre-tool capture in this checkout; pre-edit coverage is unknown. The tool may have changed checkouts; captures are kept separately for each worktree.";
             if (!session.coverageGaps.includes(gap)) session.coverageGaps.push(gap);
@@ -3667,31 +4024,39 @@ async function automate(dir, event) {
         if (session.coverageGaps.length && report.status !== "unavailable") report.status = "incomplete";
         report.capture = report.status !== "unavailable" && !session.coverageGaps.length && (session.events.session_start || session.events.before_tool) ? "observed" : "unknown";
       }
-      const signature = hash([report.status, report.findings, report.diagnostics, report.checks.skipped]);
-      const relevant = report.findings.some((f) => f.status === "unresolved" && session && (!session.initialIssues.includes(f.id) || session.initialDocs[f.original.anchor.doc] !== inputs.docs[f.original.anchor.doc]));
-      const continueOnce = event.event === "task_end" && !!session?.mutationObserved && relevant && !session.continued && !event.stopHookActive;
-      const notify = !session || newSession || signature !== session.seen || continueOnce;
-      if (session) {
-        session.seen = signature;
-        if (continueOnce) session.continued = true;
-      }
-      const persistReport = !state.latest || state.fingerprint !== inputs.fingerprint || notify || event.event === "task_end";
+      const selected = session && event.event === "task_end" ? completionFindings(state.notifications, report.findings) : [];
+      state.agentNotifications ??= { ...structuredClone(state.notifications), delivered: {} };
+      const feedback = session && ["turn_start", "after_tool"].includes(event.event) ? completionFindings(state.agentNotifications, report.findings) : [];
+      const diagnostics = session ? report.diagnostics.filter((d) => !session.notifiedDiagnostics.includes(d)).slice(0, 2) : [];
+      if (session) session.notifiedDiagnostics = [.../* @__PURE__ */ new Set([
+        ...session.notifiedDiagnostics.filter((d) => report.diagnostics.includes(d)),
+        ...diagnostics
+      ])];
+      const message2 = !session ? summarize(report) : [
+        completionSummary(selected, report.reportPath),
+        completionSummary(feedback, report.reportPath),
+        ...diagnostics.length ? [`Mason: verification limited. ${diagnostics.slice(0, 2).map(cleanText).join(" ")} Evidence: ${report.reportPath}.`] : []
+      ].filter(Boolean).join("\n") || null;
+      const notify = message2 !== null;
+      const persistReport = !state.latest || state.fingerprint !== inputs.fingerprint || notify || newSession || event.event === "task_end";
       if (!persistReport) report.reportPath = state.latest;
       state.updatedAt = now;
       state.fingerprint = inputs.fingerprint;
       state.latest = report.reportPath;
       if (persistReport) await writeStoreJson(ws.root, report.reportPath, report);
       await writeStoreJson(ws.root, ws.directory + "/state.json", state);
-      return { report, message: notify ? summarize(report) : null, continueOnce };
+      return { report, message: message2 };
     }));
   }));
 }
 async function automationStatus(dir) {
+  const { pendingKnowledge: pendingKnowledge2 } = await Promise.resolve().then(() => (init_pending(), pending_exports));
   const ws = await profilePhase("automation.workspace", () => workspace(dir));
+  const knowledge = await pendingKnowledge2(ws.root);
   const execution = await executionStatus(ws.root, ws.directory);
   const notifications = await failureNotifications(ws.root, ws.directory);
   const raw = await readStoreJson(ws.root, ws.directory + "/state.json");
-  if (raw === null) return { version: 1, status: execution.status === "not-observed" ? "not-observed" : "unavailable", root: ws.root, branch: ws.branch, baselinePaths: [], hosts: {}, execution, notifications };
+  if (raw === null) return { version: 1, status: execution.status === "not-observed" ? "not-observed" : "unavailable", root: ws.root, branch: ws.branch, baselinePaths: [], hosts: {}, execution, notifications, knowledge };
   const state = parseState(raw);
   if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) throw new Error("Automation state belongs to another workspace.");
   const inputs = await readInputs(ws.root);
@@ -3714,6 +4079,8 @@ async function automationStatus(dir) {
     hosts: hosts2,
     execution,
     notifications,
+    knowledge,
+    notificationBaselineHead: state.notifications?.baselineHead ?? null,
     note: "Observed events do not prove all tool paths are intercepted. Run check to verify the retained evidence."
   };
 }
@@ -3721,6 +4088,7 @@ var SCOPE, priority, cleanText, analysisSchema, sharedSchema, baselineDigest;
 var init_runtime = __esm({
   "src/automation/runtime.ts"() {
     "use strict";
+    init_notifications();
     init_profile();
     init_inspection();
     init_execution();
@@ -3732,34 +4100,34 @@ var init_runtime = __esm({
     SCOPE = "Documentation audit evidence only. Hook receipts show observed events, not complete interception. Resolved findings no longer fail their checks or have a recorded assessment covering current evidence. Repair and review only within the user's task authorization.";
     priority = { resolved: 0, "review-required": 1, unresolved: 2, unverified: 3 };
     cleanText = (text2) => text2.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 250);
-    analysisSchema = z10.object({
-      id: z10.string(),
-      fingerprint: z10.string(),
-      completedAt: z10.number(),
-      baselineDigest: z10.string(),
+    analysisSchema = z11.object({
+      id: z11.string(),
+      fingerprint: z11.string(),
+      completedAt: z11.number(),
+      baselineDigest: z11.string(),
       currentAudit: reportSchema.nullable().optional(),
-      report: z10.object({
-        version: z10.literal(1),
-        status: z10.enum(["verified", "issues-remain", "incomplete", "unavailable"]),
-        root: z10.string(),
-        branch: z10.string(),
-        head: z10.string(),
-        baselinePaths: z10.array(z10.string()),
-        reportPath: z10.string(),
-        findings: z10.array(repairFindingSchema),
-        diagnostics: z10.array(z10.string()),
-        checks: z10.object({
-          ran: z10.array(z10.string()),
-          reused: z10.array(z10.string()),
-          skipped: z10.array(z10.object({ check: z10.string(), reason: z10.string(), doc: z10.string().optional() })),
-          auditReused: z10.boolean().optional()
+      report: z11.object({
+        version: z11.literal(1),
+        status: z11.enum(["verified", "issues-remain", "incomplete", "unavailable"]),
+        root: z11.string(),
+        branch: z11.string(),
+        head: z11.string(),
+        baselinePaths: z11.array(z11.string()),
+        reportPath: z11.string(),
+        findings: z11.array(repairFindingSchema),
+        diagnostics: z11.array(z11.string()),
+        checks: z11.object({
+          ran: z11.array(z11.string()),
+          reused: z11.array(z11.string()),
+          skipped: z11.array(z11.object({ check: z11.string(), reason: z11.string(), doc: z11.string().optional() })),
+          auditReused: z11.boolean().optional()
         }),
-        counts: z10.object({ resolved: z10.number(), unresolved: z10.number(), "review-required": z10.number(), unverified: z10.number() }),
-        capture: z10.enum(["observed", "unknown"]),
-        scope: z10.string()
+        counts: z11.object({ resolved: z11.number(), unresolved: z11.number(), "review-required": z11.number(), unverified: z11.number() }),
+        capture: z11.enum(["observed", "unknown"]),
+        scope: z11.string()
       })
     });
-    sharedSchema = z10.object({ analysis: analysisSchema, digest: z10.string() });
+    sharedSchema = z11.object({ analysis: analysisSchema, digest: z11.string() });
     baselineDigest = async (ws, state) => profilePhase("automation.baselines", async () => hash(await Promise.all(
       state.baselines.map(async (b) => [b.path, await readStoreJson(ws.root, b.path)])
     )));
@@ -3768,9 +4136,9 @@ var init_runtime = __esm({
 
 // src/automation/hook-root.ts
 import fs15 from "fs/promises";
-import path22 from "path";
+import path23 from "path";
 async function repositoryRoot(dir) {
-  if (!path22.isAbsolute(dir)) throw new Error("Hook input working directory must be absolute.");
+  if (!path23.isAbsolute(dir)) throw new Error("Hook input working directory must be absolute.");
   try {
     return await fs15.realpath((await git3(dir, "rev-parse", "--show-toplevel")).trim());
   } catch (error) {
@@ -3800,9 +4168,9 @@ var init_hook_root = __esm({
 });
 
 // src/setup/model.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 import fs16 from "fs/promises";
-import path23 from "path";
+import path24 from "path";
 async function loadSetup(root) {
   const raw = await readStoreJson(root, SETUP_PATH);
   if (raw === null) return null;
@@ -3811,7 +4179,7 @@ async function loadSetup(root) {
 async function effectiveSetup(root) {
   const local = await loadSetup(root);
   if (local) return { root, setup: local };
-  const common = await fs16.realpath(path23.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim()));
+  const common = await fs16.realpath(path24.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim()));
   const own = await fs16.realpath((await git3(root, "rev-parse", "--absolute-git-dir")).trim());
   if (common === own) return { root, setup: null };
   const primary = (await git3(root, "worktree", "list", "--porcelain", "-z")).split("\0\0")[0].split("\0");
@@ -3824,7 +4192,7 @@ async function effectiveSetup(root) {
     if (/must be run in a work tree/.test(String(error.stderr))) return { root, setup: null };
     throw error;
   }
-  const inheritedCommon = await fs16.realpath(path23.resolve(
+  const inheritedCommon = await fs16.realpath(path24.resolve(
     inheritedRoot,
     (await git3(inheritedRoot, "rev-parse", "--git-common-dir")).trim()
   ));
@@ -3847,29 +4215,29 @@ var init_model = __esm({
     "use strict";
     init_evidence();
     init_storage();
-    setupHostSchema = z11.object({
-      configuredVersion: z11.string(),
-      revision: z11.string().uuid(),
-      fingerprint: z11.string(),
-      mcpFingerprint: z11.string(),
-      instructions: z11.array(z11.string())
+    setupHostSchema = z12.object({
+      configuredVersion: z12.string(),
+      revision: z12.string().uuid(),
+      fingerprint: z12.string(),
+      mcpFingerprint: z12.string(),
+      instructions: z12.array(z12.string())
     });
-    setupSchema = z11.object({ version: z11.literal(2), hosts: z11.object({
+    setupSchema = z12.object({ version: z12.literal(2), hosts: z12.object({
       codex: setupHostSchema.optional(),
       claude: setupHostSchema.optional()
     }) });
     SETUP_PATH = ".mason/local/setup.json";
     INACTIVE_HOSTS_PATH = ".mason/local/inactive-hosts.json";
-    inactiveHostsSchema = z11.object({ version: z11.literal(1), hosts: z11.array(z11.enum(["claude", "codex"])) });
-    receiptSchema = z11.object({
-      version: z11.literal(1),
-      host: z11.enum(["codex", "claude"]),
-      status: z11.enum(["installing", "configured"]),
-      initialReportPath: z11.string(),
-      initialBaselinePaths: z11.array(z11.string()),
-      root: z11.string(),
-      revision: z11.string().uuid(),
-      configuredAt: z11.string().optional()
+    inactiveHostsSchema = z12.object({ version: z12.literal(1), hosts: z12.array(z12.enum(["claude", "codex"])) });
+    receiptSchema = z12.object({
+      version: z12.literal(1),
+      host: z12.enum(["codex", "claude"]),
+      status: z12.enum(["installing", "configured"]),
+      initialReportPath: z12.string(),
+      initialBaselinePaths: z12.array(z12.string()),
+      root: z12.string(),
+      revision: z12.string().uuid(),
+      configuredAt: z12.string().optional()
     });
   }
 });
@@ -3930,7 +4298,7 @@ var init_launcher = __esm({
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.19.0" : "development";
+    executingVersion = () => true ? "0.19.2" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -3944,7 +4312,7 @@ __export(observations_exports, {
   readObservation: () => readObservation
 });
 import fs18 from "fs/promises";
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function observationPath(directory, host, revision, version = executingVersion()) {
   return `${directory}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
 }
@@ -4015,26 +4383,26 @@ var init_observations = __esm({
     init_storage();
     init_model();
     init_launcher();
-    observationSchema = z12.object({
-      version: z12.literal(1),
-      masonVersion: z12.string(),
-      root: z12.string(),
-      revision: z12.string(),
-      host: z12.enum(["codex", "claude"]),
-      contextCalls: z12.number().int().nonnegative(),
-      lastContextAt: z12.string().optional(),
-      sessions: z12.record(z12.object({
-        events: z12.array(z12.enum(events)),
-        at: z12.string(),
-        verificationStatus: z12.string().optional(),
-        reportPath: z12.string().optional()
+    observationSchema = z13.object({
+      version: z13.literal(1),
+      masonVersion: z13.string(),
+      root: z13.string(),
+      revision: z13.string(),
+      host: z13.enum(["codex", "claude"]),
+      contextCalls: z13.number().int().nonnegative(),
+      lastContextAt: z13.string().optional(),
+      sessions: z13.record(z13.object({
+        events: z13.array(z13.enum(events)),
+        at: z13.string(),
+        verificationStatus: z13.string().optional(),
+        reportPath: z13.string().optional()
       }))
     });
   }
 });
 
 // src/automation/adapters.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 function normalizeHook(host, raw) {
   hostSchema.parse(host);
   const input = inputSchema.parse(raw);
@@ -4044,8 +4412,7 @@ function normalizeHook(host, raw) {
     host,
     sessionId: input.session_id,
     toolId: input.tool_use_id,
-    mutating: !!input.tool_name && !readOnly,
-    stopHookActive: input.stop_hook_active || input.permission_mode === "plan"
+    mutating: !!input.tool_name && !readOnly
   } };
 }
 async function runAutomationHook(host, stdin, options = {}) {
@@ -4083,7 +4450,7 @@ async function runAutomationHook(host, stdin, options = {}) {
     if (warning) result.message = [result.message, warning].filter(Boolean).join("\n");
     if (!result.message) return null;
     if (name === "Stop") {
-      return result.continueOnce ? { decision: "block", reason: result.message } : { systemMessage: result.message };
+      return { systemMessage: result.message };
     }
     return { hookSpecificOutput: { hookEventName: name, additionalContext: result.message } };
   } catch (error) {
@@ -4117,15 +4484,15 @@ var init_adapters = __esm({
     init_runtime();
     init_store();
     init_hook_root();
-    inputSchema = z13.object({
-      cwd: z13.string().min(1),
-      session_id: z13.string().min(1).max(500),
-      hook_event_name: z13.enum(["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"]),
-      tool_name: z13.string().optional(),
-      tool_use_id: z13.string().max(500).optional(),
-      tool_input: z13.unknown().optional(),
-      stop_hook_active: z13.boolean().optional(),
-      permission_mode: z13.string().optional()
+    inputSchema = z14.object({
+      cwd: z14.string().min(1),
+      session_id: z14.string().min(1).max(500),
+      hook_event_name: z14.enum(["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"]),
+      tool_name: z14.string().optional(),
+      tool_use_id: z14.string().max(500).optional(),
+      tool_input: z14.unknown().optional(),
+      stop_hook_active: z14.boolean().optional(),
+      permission_mode: z14.string().optional()
     });
     lifecycle = {
       SessionStart: "session_start",
@@ -4146,7 +4513,7 @@ __export(files_exports, {
   readText: () => readText
 });
 import fs19 from "fs/promises";
-import path24 from "path";
+import path25 from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 async function readText(root, file) {
   try {
@@ -4179,7 +4546,7 @@ async function applyEdit(root, edit) {
     return true;
   }
   const file = await storePath(root, edit.path, true);
-  const temporary = path24.join(path24.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  const temporary = path25.join(path25.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
   try {
     const mode = await fs19.stat(file).then((s) => s.mode & 511, () => 384);
     const handle = await fs19.open(temporary, "wx", mode);
@@ -4214,7 +4581,7 @@ __export(ownership_exports, {
   ownershipEdit: () => ownershipEdit,
   ownershipSchema: () => ownershipSchema
 });
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 import { parse } from "smol-toml";
 function blockSpan(text2, start, end) {
   const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
@@ -4265,30 +4632,30 @@ var init_ownership = __esm({
       ["<!-- mason:agents:start -->", "<!-- mason:agents:end -->"],
       ["# mason:mcp:start", "# mason:mcp:end"]
     ];
-    fileSchema = z14.object({
-      created: z14.boolean(),
-      initialHash: z14.string(),
-      blocks: z14.record(z14.string()),
-      mcpHash: z14.string().optional(),
-      hookCommands: z14.array(z14.string()).optional(),
-      hooks: z14.record(z14.array(z14.string())).optional()
+    fileSchema = z15.object({
+      created: z15.boolean(),
+      initialHash: z15.string(),
+      blocks: z15.record(z15.string()),
+      mcpHash: z15.string().optional(),
+      hookCommands: z15.array(z15.string()).optional(),
+      hooks: z15.record(z15.array(z15.string())).optional()
     });
-    ownershipSchema = z14.object({ version: z14.literal(1), files: z14.record(fileSchema) });
+    ownershipSchema = z15.object({ version: z15.literal(1), files: z15.record(fileSchema) });
   }
 });
 
 // src/mcp/init.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var markerSchema, CLAUDE_MD_SECTION, ASSISTANT_SETUP, QUICKSTART_PLAYBOOK, MAP_PLAYBOOK;
 var init_init = __esm({
   "src/mcp/init.ts"() {
     "use strict";
     init_storage();
     init_files2();
-    markerSchema = z15.object({
-      version: z15.literal(1),
-      initializedAt: z15.string(),
-      features: z15.object({ confluence: z15.boolean().optional() }).passthrough().optional()
+    markerSchema = z16.object({
+      version: z16.literal(1),
+      initializedAt: z16.string(),
+      features: z16.object({ confluence: z16.boolean().optional() }).passthrough().optional()
     }).passthrough();
     CLAUDE_MD_SECTION = `<!-- mason:start -->
 ## Mason project knowledge
@@ -4297,16 +4664,19 @@ Mason provides recorded decisions and file impact over MCP. A concept map is opt
 
 - Task, bug, change request, or investigation of why the project works this way \u2192 \`get_context\` with the task text and known files: matching decisions, related tests, impact, and any available map entries.
 - Before editing a file \u2192 \`get_impact\` to check references, tests, and historical change partners.
-- Investigation or correction reveals a reusable project lesson \u2192 \`save_decision\` before finishing. Capture only the lasting constraint and reason, with anchors and known sources, owner, and recorder. This creates a proposal; never infer approval. Preserve uncertain causes and unknown attribution. Route project lessons here; keep personal preferences in agent memory. Skip code summaries, current checkout status, temporary task permissions, session trivia, and secrets. No qualifying lesson means no record.
+- Investigation or correction reveals a reusable project lesson \u2192 \`save_decision\` as soon as the lesson is supported by evidence; do not wait for implementation, task completion, or merge. Record the established observation now and identify unimplemented remedies as tentative. Capture only the lasting constraint and reason, with anchors and known sources, owner, and recorder. This creates a proposal; never infer approval. Preserve uncertain causes and unknown attribution. Route project lessons here; keep personal preferences in agent memory. Skip code summaries, current checkout status, temporary task permissions, session trivia, and secrets. No qualifying lesson means no record.
 - Before saving, compare the lesson with matching \`get_context\` records and any pending proposal. If new evidence changes the same lesson's assumptions, scope, or recommended action, revise it with \`save_decision(id: existingId)\`, including when it is accepted. Preserve supported rationale and sources, replace obsolete instructions, and add the new evidence. Create a separate record for a genuinely distinct lesson; skip unchanged restatements. Revision preserves history and leaves the accepted version operative until authorized review.
 - Consult trust metadata before relying on entries: unknown or changed freshness requires inspection, stale or unknown map verification requires a fresh evidence review, and a recorded failed verdict means the description must be corrected. Check approval too: proposals are suggestions, legacy records are unreviewed, and accepted decisions are recorded constraints subject to freshness checks. An accepted revision remains operative while a pending proposal is reviewed; keep both versions and their freshness distinct.
+- Asked to review pending project knowledge \u2192 \`mason_automation(action: "status")\` lists pending proposals and uncommitted records. For ordinary tasks, inspect matching proposals through \`get_context\`; do not request acceptance merely because a proposal exists.
 - Asked to review or re-verify a decision \u2192 \`review_decision\` first to inspect content, sources, history, and code changes. Record acceptance, reaffirmation, or retirement only when authorized by the user or a cited team review, with the actual reviewer and reason. Never infer approval from unchanged code. Review and commit the local record through the normal project workflow.
 - For an architectural overview, use \`get_snapshot\` if a map is available. If \`map.status\` is missing or invalid, use available decisions and source evidence; do not start building a map unless requested.
 - \`mason_init\` returns documentation audit and committed-diff review results, plus a short setup guide. Pass \`evidence\` with local CI manifest paths to include test and analysis results; the CLI equivalent is \`mason-review --evidence <manifest>\`. State skipped, unavailable, stale, or unknown checks explicitly. Related accepted decisions identify review context, not proven violations.
 
-- When documentation repair is authorized, use \`mason_repair(action: "prepare")\` before edits, keep its baselinePath, and use \`mason_repair(action: "verify", baselinePath)\` after edits and any final doc commit. Report every original finding's outcome and any new findings. Suppressed advisories remain unresolved; editing a doc does not approve it.
+- When documentation repair is authorized, use \`mason_repair(action: "prepare")\` before edits, keep its baselinePath, and use \`mason_repair(action: "verify", baselinePath)\` after edits and any final doc commit. Report every original finding's outcome and any new findings. Specific suppressed advisories remain unresolved; editing a doc does not approve it. Informational dependency notices require no review.
 - When advisory assessment is authorized, use \`review_advisory(action: "prepare", baselinePath, findingId)\` to inspect original evidence and history. Record \`addressed\`, \`inapplicable\`, or \`deferred\` with the actual reviewer, reason in note, and returned reviewToken only after relevant edits are committed. Commit the assessment and verify the same baseline again. Relevant evidence changes reopen it; deferral stays outstanding. Decision findings use \`review_decision\`; advisory closure never approves a decision.
 
+- For a dependency advisory, \`review_advisory(action: "dismiss", baselinePath, findingId, reasonCode, note)\` records a one-step dismissal without reviewer or token. Use \`no-dependency-claims\` for a document with no dependency claims (reopens on document content changes), or \`unrelated-manifest-change\` for reviewed changes that do not affect its guidance (reopens on document or manifest changes). Keep the relevant scope committed; commit the dismissal to share it. This never approves a decision.
+
 - When Mason automation is installed, use \`mason_automation(action: "status")\` to inspect configured hooks and observed events, and \`mason_automation(action: "check")\` to resume its retained repair evidence. CLI fallback: \`mason-auto status\` / \`mason-auto check\`. Preserve existing baselines across sessions. Automatic checks do not authorize unrelated repairs or approve advisories.
 
 Inspect source for what the retrieved context does not answer.
@@ -4321,7 +4691,7 @@ ${CLAUDE_MD_SECTION}`;
 
 1. Explain the actionable findings with their source evidence. Separate audit issues, advisories, and skipped checks. The review covers committed changes from the merge base to HEAD; workingTree paths are not included in that review. An unavailable or empty check is not proof that the project is correct. Use the CLI for full output if a summary is truncated.
 2. Address findings within the user's requested scope. Setup alone authorizes Mason host configuration, hooks, instructions, and ignore rules; rewriting existing project claims requires repair scope. If repair is authorized, call \`mason_repair(dir, action: "prepare")\` before editing; it saves the full original findings even when this summary is truncated. Inspect relevant source, make grounded edits, then call \`mason_repair(dir, action: "verify", baselinePath)\` with that same baseline, including after any final doc commit. Report resolved, unresolved, review-required, unverified, and new findings. Keep suppressed advisories visible even when setup has already dirtied a doc. Do not invent a decision just to populate the store.
-3. When the task reveals a real lesson or constraint, compare matching \`get_context\` records first. If its assumptions, scope, or recommended action changed, revise that record using \`save_decision(id: existingId)\`; create a separate record for a genuinely distinct lesson and skip unchanged restatements. Include title, body, category, anchors, and known owner/source/actor information. Preserve supported rationale and sources, replace obsolete instructions, and add new evidence. Missing attribution can be added later. The tool writes a local proposal; editing it preserves revision history and requires a new acceptance, while any earlier accepted revision remains operative. An unchanged save never refreshes its evidence. When decision review is requested, \`review_decision\` prepares the record and code evidence before any authorized verdict. Review and commit records through the normal workflow. Retrieve it on the next relevant task with \`get_context(dir, task, files)\`.
+3. Capture a supported lesson as soon as it is established; do not wait for implementation, task completion, or merge. Keep unimplemented remedies tentative. When the task reveals a real lesson or constraint, compare matching \`get_context\` records first. If its assumptions, scope, or recommended action changed, revise that record using \`save_decision(id: existingId)\`; create a separate record for a genuinely distinct lesson and skip unchanged restatements. Include title, body, category, anchors, and known owner/source/actor information. Preserve supported rationale and sources, replace obsolete instructions, and add new evidence. Missing attribution can be added later. The tool writes a local proposal; editing it preserves revision history and requires a new acceptance, while any earlier accepted revision remains operative. An unchanged save never refreshes its evidence. When decision review is requested, \`review_decision\` prepares the record and code evidence before any authorized verdict. Review and commit records through the normal workflow. Retrieve it on the next relevant task with \`get_context(dir, task, files)\`.
 
 ${ASSISTANT_SETUP}
 
@@ -4374,7 +4744,7 @@ __export(config_exports, {
 });
 import { isDeepStrictEqual } from "util";
 import { parse as parse2, stringify } from "smol-toml";
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 async function instructionEdits(root, host) {
   const found = await Promise.all(DOC_CANDIDATES.map(async (file) => ({ path: file, text: await readText(root, file) })));
   const existing = found.find((f) => f.text !== null);
@@ -4485,7 +4855,7 @@ var init_config = __esm({
     init_install();
     init_files2();
     init_launcher();
-    object = z16.record(z16.unknown());
+    object = z17.record(z17.unknown());
     mcpPath = (host) => host === "codex" ? ".codex/config.toml" : ".mcp.json";
     TOML_START = "# mason:mcp:start";
     TOML_END = "# mason:mcp:end";
@@ -4505,7 +4875,7 @@ __export(install_exports, {
   planAutomationInstall: () => planAutomationInstall,
   recordSchema: () => recordSchema2
 });
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 async function installationRecord(root) {
   return recordSchema2.parse(await readStoreJson(root, AUTOMATION_PATH) ?? { version: 1, hosts: {} });
 }
@@ -4586,9 +4956,9 @@ var init_install = __esm({
     init_store();
     init_files2();
     init_ownership();
-    groupSchema = z17.object({ hooks: z17.array(z17.object({ type: z17.string(), command: z17.string().optional() }).passthrough()) }).passthrough();
-    automationConfigSchema = z17.object({ hooks: z17.record(z17.array(groupSchema)).optional() }).passthrough();
-    recordSchema2 = z17.object({ version: z17.literal(1), hosts: z17.record(z17.object({ command: z17.string() })) });
+    groupSchema = z18.object({ hooks: z18.array(z18.object({ type: z18.string(), command: z18.string().optional() }).passthrough()) }).passthrough();
+    automationConfigSchema = z18.object({ hooks: z18.record(z18.array(groupSchema)).optional() }).passthrough();
+    recordSchema2 = z18.object({ version: z18.literal(1), hosts: z18.record(z18.object({ command: z18.string() })) });
     AUTOMATION_PATH = ".mason/local/automation.json";
     configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
   }
@@ -4602,10 +4972,10 @@ __export(teardown_exports, {
 });
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 import fs20 from "fs/promises";
-import path25 from "path";
+import path26 from "path";
 import { parse as parse3, stringify as stringify2 } from "smol-toml";
-import fg6 from "fast-glob";
-import { z as z18 } from "zod";
+import fg8 from "fast-glob";
+import { z as z19 } from "zod";
 async function planTeardown(root, selected) {
   const edits = [], diagnostics = [];
   const inputs = /* @__PURE__ */ new Map();
@@ -4625,7 +4995,7 @@ async function planTeardown(root, selected) {
   const setupBefore = await read(SETUP_PATH);
   const setup = setupBefore === null ? null : setupSchema.parse(JSON.parse(setupBefore));
   const linked = (await workspace(root)).gitDir !== await fs20.realpath(
-    path25.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim())
+    path26.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim())
   );
   const inactiveBefore = linked && !setup ? await read(INACTIVE_HOSTS_PATH) : null;
   const inactive = inactiveBefore === null ? { version: 1, hosts: [] } : inactiveHostsSchema.parse(JSON.parse(inactiveBefore));
@@ -4748,7 +5118,7 @@ async function planTeardown(root, selected) {
   if (diagnostics.length) edits.splice(instructionEditStart);
   if (!diagnostics.length) {
     const cleanup = [];
-    const receiptFiles = await fg6(
+    const receiptFiles = await fg8(
       selected.map((host) => ".mason/reports/automation/*/setup-" + host + ".json"),
       { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false }
     );
@@ -4761,7 +5131,7 @@ async function planTeardown(root, selected) {
     if (!remainingHost) await attempt(".mason/local/project.json", async () => {
       const before = await read(".mason/local/project.json");
       if (before === null) return;
-      z18.object({ version: z18.literal(1), initializedAt: z18.string() }).strict().parse(JSON.parse(before));
+      z19.object({ version: z19.literal(1), initializedAt: z19.string() }).strict().parse(JSON.parse(before));
       cleanup.push({ path: ".mason/local/project.json", before, after: null });
     });
     if (!diagnostics.length) {
@@ -4842,7 +5212,7 @@ var init_teardown = __esm({
     init_model();
     init_ownership();
     hosts = ["codex", "claude"];
-    object2 = z18.record(z18.unknown());
+    object2 = z19.record(z19.unknown());
     json = (value) => JSON.stringify(value, null, 2) + "\n";
   }
 });
@@ -4969,7 +5339,7 @@ var init_types2 = __esm({
 });
 
 // src/review/evidence/vitest.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 function parseVitest(raw, sourceRoot) {
   const report = schema.parse(raw);
   const findings = [], diagnostics = [];
@@ -5018,24 +5388,24 @@ var init_vitest = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    count3 = z19.number().int().nonnegative();
-    schema = z19.object({
-      success: z19.boolean(),
+    count3 = z20.number().int().nonnegative();
+    schema = z20.object({
+      success: z20.boolean(),
       numTotalTests: count3,
       numPassedTests: count3,
       numFailedTests: count3,
       numPendingTests: count3,
       numTodoTests: count3,
       numFailedTestSuites: count3,
-      testResults: z19.array(z19.object({
-        name: z19.string().min(1),
-        status: z19.enum(["passed", "failed"]),
-        message: z19.string().optional(),
-        assertionResults: z19.array(z19.object({
-          fullName: z19.string(),
-          status: z19.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
-          failureMessages: z19.array(z19.string()).nullable().optional(),
-          location: z19.object({ line: count3, column: count3 }).nullable().optional()
+      testResults: z20.array(z20.object({
+        name: z20.string().min(1),
+        status: z20.enum(["passed", "failed"]),
+        message: z20.string().optional(),
+        assertionResults: z20.array(z20.object({
+          fullName: z20.string(),
+          status: z20.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
+          failureMessages: z20.array(z20.string()).nullable().optional(),
+          location: z20.object({ line: count3, column: count3 }).nullable().optional()
         }))
       }))
     });
@@ -5043,7 +5413,7 @@ var init_vitest = __esm({
 });
 
 // src/review/evidence/sarif.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 function parseSarif(raw, sourceRoot) {
   const report = schema2.parse(raw), findings = [], diagnostics = [];
   let active = 0, suppressed = 0, absent = 0, unresolved = 0;
@@ -5134,29 +5504,29 @@ var init_sarif = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    index = z20.number().int().nonnegative();
-    artifact = z20.object({ uri: z20.string().optional(), uriBaseId: z20.string().optional(), index: index.optional() });
-    message = z20.object({ text: z20.string().optional(), markdown: z20.string().optional(), id: z20.string().optional(), arguments: z20.array(z20.string()).optional() });
-    level = z20.enum(["error", "warning", "note", "none"]);
-    location = z20.object({ physicalLocation: z20.object({ artifactLocation: artifact.optional(), region: z20.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
-    schema2 = z20.object({
-      version: z20.literal("2.1.0"),
-      runs: z20.array(z20.object({
-        tool: z20.object({ driver: z20.object({ name: z20.string().min(1), rules: z20.array(z20.object({ id: z20.string(), defaultConfiguration: z20.object({ level: level.optional() }).optional(), messageStrings: z20.record(message).optional() })).optional(), globalMessageStrings: z20.record(message).optional() }) }),
-        invocations: z20.array(z20.object({ executionSuccessful: z20.boolean(), commandLine: z20.string().optional(), toolExecutionNotifications: z20.array(z20.object({ level: level.optional(), message })).optional() })).optional(),
-        versionControlProvenance: z20.array(z20.object({ revisionId: z20.string().optional() })).optional(),
-        originalUriBaseIds: z20.record(artifact).optional(),
-        artifacts: z20.array(z20.object({ location: artifact.optional() })).optional(),
-        results: z20.array(z20.object({
-          ruleId: z20.string().optional(),
+    index = z21.number().int().nonnegative();
+    artifact = z21.object({ uri: z21.string().optional(), uriBaseId: z21.string().optional(), index: index.optional() });
+    message = z21.object({ text: z21.string().optional(), markdown: z21.string().optional(), id: z21.string().optional(), arguments: z21.array(z21.string()).optional() });
+    level = z21.enum(["error", "warning", "note", "none"]);
+    location = z21.object({ physicalLocation: z21.object({ artifactLocation: artifact.optional(), region: z21.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
+    schema2 = z21.object({
+      version: z21.literal("2.1.0"),
+      runs: z21.array(z21.object({
+        tool: z21.object({ driver: z21.object({ name: z21.string().min(1), rules: z21.array(z21.object({ id: z21.string(), defaultConfiguration: z21.object({ level: level.optional() }).optional(), messageStrings: z21.record(message).optional() })).optional(), globalMessageStrings: z21.record(message).optional() }) }),
+        invocations: z21.array(z21.object({ executionSuccessful: z21.boolean(), commandLine: z21.string().optional(), toolExecutionNotifications: z21.array(z21.object({ level: level.optional(), message })).optional() })).optional(),
+        versionControlProvenance: z21.array(z21.object({ revisionId: z21.string().optional() })).optional(),
+        originalUriBaseIds: z21.record(artifact).optional(),
+        artifacts: z21.array(z21.object({ location: artifact.optional() })).optional(),
+        results: z21.array(z21.object({
+          ruleId: z21.string().optional(),
           ruleIndex: index.optional(),
           message,
           level: level.optional(),
-          kind: z20.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
-          baselineState: z20.enum(["new", "unchanged", "updated", "absent"]).optional(),
-          suppressions: z20.array(z20.object({ kind: z20.enum(["inSource", "external"]), status: z20.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
-          locations: z20.array(location).optional(),
-          relatedLocations: z20.array(location).optional()
+          kind: z21.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
+          baselineState: z21.enum(["new", "unchanged", "updated", "absent"]).optional(),
+          suppressions: z21.array(z21.object({ kind: z21.enum(["inSource", "external"]), status: z21.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
+          locations: z21.array(location).optional(),
+          relatedLocations: z21.array(location).optional()
         })).optional()
       }))
     });
@@ -5164,7 +5534,7 @@ var init_sarif = __esm({
 });
 
 // src/review/evidence/check.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 function parseCheck(raw, sourceRoot) {
   const report = schema3.parse(raw);
   const diagnostics = [], findings = [];
@@ -5204,17 +5574,17 @@ var init_check = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    schema3 = z21.object({
-      version: z21.literal(1),
-      commit: z21.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).optional(),
-      results: z21.array(z21.object({
-        name: z21.string().min(1).max(1e3),
-        status: z21.enum(["passed", "failed", "skipped"]),
-        message: z21.string().max(1e5).optional(),
-        locations: z21.array(z21.object({
-          file: z21.string().min(1).max(4e3),
-          line: z21.number().int().positive().optional(),
-          column: z21.number().int().positive().optional()
+    schema3 = z22.object({
+      version: z22.literal(1),
+      commit: z22.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).optional(),
+      results: z22.array(z22.object({
+        name: z22.string().min(1).max(1e3),
+        status: z22.enum(["passed", "failed", "skipped"]),
+        message: z22.string().max(1e5).optional(),
+        locations: z22.array(z22.object({
+          file: z22.string().min(1).max(4e3),
+          line: z22.number().int().positive().optional(),
+          column: z22.number().int().positive().optional()
         })).max(100).default([])
       })).max(1e5)
     });
@@ -5222,10 +5592,10 @@ var init_check = __esm({
 });
 
 // src/review/evidence.ts
-import path26 from "path";
-import { z as z22 } from "zod";
+import path27 from "path";
+import { z as z23 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path26.isAbsolute(file) ? path26.relative(root, file) : file;
+  const relative = path27.isAbsolute(file) ? path27.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -5264,7 +5634,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
     let manifest, raw;
     try {
       manifest = relativeArtifact(root, supplied);
-      raw = z22.object({ version: z22.literal(1), checks: z22.array(z22.unknown()) }).parse(await readStoreJson(root, manifest));
+      raw = z23.object({ version: z23.literal(1), checks: z23.array(z23.unknown()) }).parse(await readStoreJson(root, manifest));
     } catch (error) {
       output.diagnostics.push(`${supplied}: ${String(error)}`);
       continue;
@@ -5322,7 +5692,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path26.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path27.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -5419,32 +5789,32 @@ var init_evidence2 = __esm({
     init_sarif();
     init_check();
     init_types2();
-    checkSchema2 = z22.object({
-      id: z22.string().min(1).max(100),
-      kind: z22.enum(["tests", "static-analysis", "security", "complexity", "duplication", "documentation"]),
-      tool: z22.string().min(1).max(200),
-      command: z22.string().min(1).max(2e3),
-      commit: z22.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
-      workingTreeClean: z22.boolean().optional(),
-      source: z22.string().max(2e3).optional(),
-      sourceRoot: z22.string().min(1).max(4e3).optional(),
-      status: z22.enum(["completed", "skipped", "unavailable"]).default("completed"),
-      reason: z22.string().min(1).max(2e3).optional(),
-      exitCode: z22.number().int().nullable().optional(),
-      environment: z22.object({
-        toolVersion: z22.string().min(1).max(200),
-        runtime: z22.string().min(1).max(200).optional(),
-        platform: z22.string().min(1).max(200).optional(),
-        configuration: z22.array(z22.string().min(1).max(4e3)).max(100).optional()
+    checkSchema2 = z23.object({
+      id: z23.string().min(1).max(100),
+      kind: z23.enum(["tests", "static-analysis", "security", "complexity", "duplication", "documentation"]),
+      tool: z23.string().min(1).max(200),
+      command: z23.string().min(1).max(2e3),
+      commit: z23.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
+      workingTreeClean: z23.boolean().optional(),
+      source: z23.string().max(2e3).optional(),
+      sourceRoot: z23.string().min(1).max(4e3).optional(),
+      status: z23.enum(["completed", "skipped", "unavailable"]).default("completed"),
+      reason: z23.string().min(1).max(2e3).optional(),
+      exitCode: z23.number().int().nullable().optional(),
+      environment: z23.object({
+        toolVersion: z23.string().min(1).max(200),
+        runtime: z23.string().min(1).max(200).optional(),
+        platform: z23.string().min(1).max(200).optional(),
+        configuration: z23.array(z23.string().min(1).max(4e3)).max(100).optional()
       }).optional(),
-      report: z22.object({ format: z22.enum(["vitest-json", "sarif", "mason-check-json"]), path: z22.string().min(1).max(4e3) }).optional()
+      report: z23.object({ format: z23.enum(["vitest-json", "sarif", "mason-check-json"]), path: z23.string().min(1).max(4e3) }).optional()
     });
   }
 });
 
 // src/review/review.ts
 import fs21 from "fs/promises";
-import path27 from "path";
+import path28 from "path";
 import { execFile as execFile4 } from "child_process";
 import { promisify as promisify4 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
@@ -5473,7 +5843,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path27.resolve(rootDir);
+  const resolvedRoot = path28.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -5523,7 +5893,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs21.access(path27.join(resolvedRoot, relPath));
+        await fs21.access(path28.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -5909,16 +6279,16 @@ var init_setup = __esm({
 // src/distribution/path.ts
 import fs22 from "fs/promises";
 import os3 from "os";
-import path28 from "path";
+import path29 from "path";
 import { execFile as execFile5 } from "child_process";
 import { promisify as promisify5 } from "util";
 import { createHash as createHash4, randomUUID as randomUUID7 } from "crypto";
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 async function configurePath(bin, previous, save, options = {}) {
   const env = options.env ?? process.env, platform = options.platform ?? process.platform;
   const changes = [...previous];
   const currentPath = platform === "win32" ? Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] : env.PATH;
-  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path28.posix.isAbsolute(entry) && path28.posix.resolve(entry) === path28.posix.resolve(bin));
+  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path29.posix.isAbsolute(entry) && path29.posix.resolve(entry) === path29.posix.resolve(bin));
   const setupHint = "To connect a project, run one of these inside its directory:\n  Codex:       mason setup --host codex\n  Claude Code: mason setup --host claude";
   const message2 = (alreadyOnPath ? "" : "Open a new terminal to use mason.\n") + setupHint;
   const manual = (reason2) => ({ status: "manual", changes, message: `${reason2}
@@ -5938,15 +6308,15 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
       }
       return { status: "configured", changes, message: message2 };
     }
-    const shell = path28.basename(env.SHELL ?? os3.userInfo().shell ?? "");
+    const shell = path29.basename(env.SHELL ?? os3.userInfo().shell ?? "");
     const userHome = options.userHome ?? os3.homedir();
     let profiles2;
     if (!["bash", "zsh", "sh"].includes(shell)) return manual(`Automatic PATH setup is unavailable for ${shell || "an unknown shell"}.`);
-    if (env.MASON_PROFILE) profiles2 = [path28.resolve(env.MASON_PROFILE)];
-    else if (shell === "zsh") profiles2 = [path28.join(env.ZDOTDIR || userHome, ".zshrc")];
-    else if (shell === "sh") profiles2 = [path28.join(userHome, ".profile")];
+    if (env.MASON_PROFILE) profiles2 = [path29.resolve(env.MASON_PROFILE)];
+    else if (shell === "zsh") profiles2 = [path29.join(env.ZDOTDIR || userHome, ".zshrc")];
+    else if (shell === "sh") profiles2 = [path29.join(userHome, ".profile")];
     else {
-      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path28.join(userHome, name));
+      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path29.join(userHome, name));
       let login = candidates[2];
       for (const file of candidates) if (await fs22.lstat(file).then(() => true, (error) => {
         if (error.code === "ENOENT") return false;
@@ -5955,7 +6325,7 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
         login = file;
         break;
       }
-      profiles2 = [path28.join(userHome, ".bashrc"), login];
+      profiles2 = [path29.join(userHome, ".bashrc"), login];
     }
     const marker = `# >>> mason PATH ${createHash4("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
     for (const profile of profiles2) {
@@ -5963,7 +6333,7 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
         if (error.code === "ENOENT") return null;
         throw error;
       });
-      const file = stat?.isSymbolicLink() ? await fs22.realpath(profile) : path28.resolve(profile);
+      const file = stat?.isSymbolicLink() ? await fs22.realpath(profile) : path29.resolve(profile);
       const original = await fs22.readFile(file).catch((error) => {
         if (error.code === "ENOENT" && !stat) return null;
         throw error;
@@ -5979,7 +6349,7 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
         changes.push({ kind: "profile", file, block, created: original === null });
         await save(changes);
       }
-      await fs22.mkdir(path28.dirname(file), { recursive: true });
+      await fs22.mkdir(path29.dirname(file), { recursive: true });
       const handle = await fs22.open(file, original === null ? "ax+" : "a+", 384);
       try {
         if (!(await handle.readFile()).equals(original ?? Buffer.alloc(0))) throw new Error(`Shell profile changed during installation: ${profile}`);
@@ -6075,12 +6445,12 @@ var init_path = __esm({
   "src/distribution/path.ts"() {
     "use strict";
     execute2 = promisify5(execFile5);
-    pathChangeSchema = z23.discriminatedUnion("kind", [
-      z23.object({ kind: z23.literal("profile"), file: z23.string(), block: z23.string(), created: z23.boolean() }),
-      z23.object({ kind: z23.literal("windows"), entry: z23.string(), created: z23.boolean() })
+    pathChangeSchema = z24.discriminatedUnion("kind", [
+      z24.object({ kind: z24.literal("profile"), file: z24.string(), block: z24.string(), created: z24.boolean() }),
+      z24.object({ kind: z24.literal("windows"), entry: z24.string(), created: z24.boolean() })
     ]);
     quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
-    normalizeWindowsEntry = (value) => path28.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
+    normalizeWindowsEntry = (value) => path29.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
     hasWindowsEntry = (value, entry, env = process.env) => {
       const variables = new Map(Object.entries(env).map(([key, value2]) => [key.toLowerCase(), value2]));
       const expand = (part) => part.replace(/%([^%]+)%/g, (match, key) => variables.get(key.toLowerCase()) ?? match);
@@ -6103,10 +6473,10 @@ __export(state_exports, {
   updatePolicySchema: () => updatePolicySchema
 });
 import os4 from "os";
-import path29 from "path";
+import path30 from "path";
 import { fileURLToPath } from "url";
 import fs23 from "fs/promises";
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 async function readInstallation(home) {
   const raw = await readStoreJson(home, "install.json");
   if (!raw) throw new Error("Run this command from a standalone installation. npm users can upgrade with npm.");
@@ -6115,9 +6485,9 @@ async function readInstallation(home) {
   return record;
 }
 function standaloneLocation() {
-  const bundle = path29.resolve(path29.dirname(fileURLToPath(import.meta.url)), "../..");
-  const home = path29.dirname(path29.dirname(bundle));
-  if (path29.dirname(bundle) !== path29.join(home, "versions") || !/^[a-f0-9]{24}$/.test(path29.basename(bundle))) {
+  const bundle = path30.resolve(path30.dirname(fileURLToPath(import.meta.url)), "../..");
+  const home = path30.dirname(path30.dirname(bundle));
+  if (path30.dirname(bundle) !== path30.join(home, "versions") || !/^[a-f0-9]{24}$/.test(path30.basename(bundle))) {
     return null;
   }
   return { home, bundle };
@@ -6146,42 +6516,42 @@ var init_state = __esm({
     "use strict";
     init_storage();
     init_path();
-    releaseVersion = z24.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/);
-    bundleId = z24.string().regex(/^[a-f0-9]{24}$/);
-    updatePolicySchema = z24.object({
-      enabled: z24.boolean(),
-      revision: z24.string(),
+    releaseVersion = z25.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/);
+    bundleId = z25.string().regex(/^[a-f0-9]{24}$/);
+    updatePolicySchema = z25.object({
+      enabled: z25.boolean(),
+      revision: z25.string(),
       pinnedVersion: releaseVersion.optional(),
-      mirror: z24.string().optional()
+      mirror: z25.string().optional()
     });
-    recordSchema3 = z24.object({
-      format: z24.literal(1),
-      home: z24.string(),
-      bin: z24.string(),
+    recordSchema3 = z25.object({
+      format: z25.literal(1),
+      home: z25.string(),
+      bin: z25.string(),
       current: bundleId,
       version: releaseVersion,
-      launchers: z24.record(z24.string()),
-      previousLaunchers: z24.record(z24.string()).optional(),
-      pathChanges: z24.array(pathChangeSchema).optional(),
+      launchers: z25.record(z25.string()),
+      previousLaunchers: z25.record(z25.string()).optional(),
+      pathChanges: z25.array(pathChangeSchema).optional(),
       updates: updatePolicySchema.optional(),
-      previous: z24.object({ id: bundleId, version: releaseVersion }).optional(),
-      pending: z24.object({ id: bundleId, version: releaseVersion, policyRevision: z24.string() }).optional()
+      previous: z25.object({ id: bundleId, version: releaseVersion }).optional(),
+      pending: z25.object({ id: bundleId, version: releaseVersion, policyRevision: z25.string() }).optional()
     });
-    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path29.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path29.join(os4.homedir(), ".local/share/mason"));
+    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path30.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path30.join(os4.homedir(), ".local/share/mason"));
   }
 });
 
 // src/distribution/bundle.ts
 import fs24 from "fs/promises";
-import path30 from "path";
+import path31 from "path";
 import { createHash as createHash5 } from "crypto";
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 async function readBundle(root) {
   const bytes = await fs24.readFile(await storePath(root, "bundle.json"));
   const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
   const windows = manifest.target.startsWith("win32-");
   for (const file of Object.keys(manifest.files)) {
-    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path30.isAbsolute(file)) {
+    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path31.isAbsolute(file)) {
       throw new Error("Unsafe path in Mason bundle: " + file);
     }
   }
@@ -6206,25 +6576,41 @@ var init_bundle = __esm({
     "use strict";
     init_storage();
     targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
-    digest2 = z25.string().regex(/^[a-f0-9]{64}$/);
-    bundleSchema = z25.object({
-      format: z25.literal(1),
-      version: z25.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
-      target: z25.enum(targets),
-      nodeVersion: z25.string(),
-      files: z25.record(digest2)
+    digest2 = z26.string().regex(/^[a-f0-9]{64}$/);
+    bundleSchema = z26.object({
+      format: z26.literal(1),
+      version: z26.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
+      target: z26.enum(targets),
+      nodeVersion: z26.string(),
+      files: z26.record(digest2)
     }).strict();
     sha256 = (bytes) => createHash5("sha256").update(bytes).digest("hex");
   }
 });
 
+// src/distribution/trust.ts
+import tls from "tls";
+function releaseRequestError(error) {
+  const cause = error instanceof Error ? error.cause : void 0;
+  const code = cause && typeof cause === "object" && "code" in cause ? String(cause.code) : void 0;
+  const detail = code ?? (error instanceof Error ? error.message : String(error));
+  const certificateError = code && /CERT|SELF_SIGNED|UNABLE_TO_VERIFY_LEAF_SIGNATURE/.test(code);
+  const hint = certificateError ? " Check that your company's CA certificate is trusted by your operating system, or provide its PEM file with NODE_EXTRA_CA_CERTS." : " Check network and proxy access to GitHub.";
+  return new Error(`Could not check the latest Mason release on GitHub (${detail}).${hint}`, { cause: error });
+}
+var init_trust2 = __esm({
+  "src/distribution/trust.ts"() {
+    "use strict";
+  }
+});
+
 // src/distribution/runtime.ts
 import fs25 from "fs/promises";
 import { unlinkSync } from "fs";
 import os5 from "os";
-import path31 from "path";
+import path32 from "path";
 import { randomUUID as randomUUID8 } from "crypto";
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 async function pruneUnusedVersions(home) {
   const versions = await storePath(home, "versions");
   const candidates = [];
@@ -6292,7 +6678,8 @@ var init_runtime2 = __esm({
     init_storage();
     init_state();
     init_bundle();
-    leaseSchema = z26.object({ pid: z26.number().int().positive(), host: z26.string(), bundle: z26.string().regex(/^[a-f0-9]{24}$/) });
+    init_trust2();
+    leaseSchema = z27.object({ pid: z27.number().int().positive(), host: z27.string(), bundle: z27.string().regex(/^[a-f0-9]{24}$/) });
   }
 });
 
@@ -6300,7 +6687,7 @@ var init_runtime2 = __esm({
 import fs26 from "fs/promises";
 import os6 from "os";
 import { randomUUID as randomUUID9 } from "crypto";
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 async function hasRunningMcp(home) {
   const directory = await storePath(home, "sessions");
   const files = await fs26.readdir(directory).catch((error) => {
@@ -6341,7 +6728,7 @@ var init_sessions = __esm({
   "src/distribution/sessions.ts"() {
     "use strict";
     init_storage();
-    leaseSchema2 = z27.object({ pid: z27.number().int().positive(), host: z27.string() });
+    leaseSchema2 = z28.object({ pid: z28.number().int().positive(), host: z28.string() });
   }
 });
 
@@ -6358,7 +6745,7 @@ __export(install_exports2, {
 });
 import fs27 from "fs/promises";
 import os7 from "os";
-import path32 from "path";
+import path33 from "path";
 import { execFile as execFile6, spawn } from "child_process";
 import { promisify as promisify6 } from "util";
 import { randomUUID as randomUUID10 } from "crypto";
@@ -6374,7 +6761,7 @@ async function replace(file, content2, mode = 384) {
 async function installStandalone(source, progress2, options = {}) {
   progress2?.step("Checking installation files and location");
   const bundle = await verifyBundle(source);
-  const selectedHome = path32.resolve(defaultHome());
+  const selectedHome = path33.resolve(defaultHome());
   if (!options.stageOnly) await fs27.mkdir(selectedHome, { recursive: true });
   const home = await fs27.realpath(selectedHome);
   if (options.stageOnly) {
@@ -6382,8 +6769,8 @@ async function installStandalone(source, progress2, options = {}) {
     const destination = await storePath(home, "versions/" + bundle.manifestHash.slice(0, 24));
     await copyBundle(home, source, destination, bundle);
     const { stdout } = await promisify6(execFile6)(
-      path32.join(destination, process.platform === "win32" ? "node.exe" : "node"),
-      [path32.join(destination, "app/dist/mason.js"), "--version"],
+      path33.join(destination, process.platform === "win32" ? "node.exe" : "node"),
+      [path33.join(destination, "app/dist/mason.js"), "--version"],
       { timeout: 3e4, windowsHide: true, env: { ...process.env, MASON_NO_AUTO_UPDATE: "1" } }
     );
     if (stdout.trim() !== bundle.manifest.version) throw new Error("Downloaded Mason failed its version health check.");
@@ -6401,13 +6788,13 @@ async function installLocked2(home, source, bundle, progress2, options, alreadyS
   if (options.stageOnly) assertUpdatePolicy(previous, bundle.manifest.version, options.policyRevision);
   if (!previous) for (const file of await fs27.readdir(home)) {
     if (file === ".install-lock") continue;
-    const directory = path32.join(home, file);
+    const directory = path33.join(home, file);
     const stat = await fs27.lstat(directory);
     if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs27.readdir(directory)).length) {
       throw new Error("Mason installation directory is not empty and has no ownership receipt.");
     }
   }
-  const selectedBin = path32.resolve(process.env.MASON_BIN_DIR ?? previous?.bin ?? (process.platform === "win32" ? path32.join(home, "bin") : path32.join(os7.homedir(), ".local/bin")));
+  const selectedBin = path33.resolve(process.env.MASON_BIN_DIR ?? previous?.bin ?? (process.platform === "win32" ? path33.join(home, "bin") : path33.join(os7.homedir(), ".local/bin")));
   await fs27.mkdir(selectedBin, { recursive: true });
   const bin = await fs27.realpath(selectedBin);
   if (previous && (previous.home !== home || previous.bin !== bin)) throw new Error("Installation paths differ from the existing Mason receipt.");
@@ -6425,10 +6812,10 @@ $previousToken = $env:MASON_UNINSTALL_TOKEN
 $token = [Guid]::NewGuid().ToString()
 $env:MASON_UNINSTALL_TOKEN = $token
 try {
-  & ${psQuote(path32.join(destination, "node.exe"))} ${psQuote(path32.join(destination, "app/dist/mason.js"))} @args
+  & ${psQuote(path33.join(destination, "node.exe"))} ${psQuote(path33.join(destination, "app/dist/mason.js"))} @args
   $code = $LASTEXITCODE
   if ($code -eq 0 -and $args.Count -eq 1 -and $args[0] -eq 'uninstall') {
-    if ([IO.File]::ReadAllText(${psQuote(path32.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
+    if ([IO.File]::ReadAllText(${psQuote(path33.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
     Remove-Item -LiteralPath ${psQuote(home)} -Recurse -Force
     Write-Output ${psQuote("Removed standalone installation: " + home)}
   }
@@ -6437,7 +6824,7 @@ try {
 finally { $env:MASON_UNINSTALL_TOKEN = $previousToken }
 `
   } : { mason: `#!/bin/sh
-exec ${shQuote(path32.join(destination, "node"))} ${shQuote(path32.join(destination, "app/dist/mason.js"))} "$@"
+exec ${shQuote(path33.join(destination, "node"))} ${shQuote(path33.join(destination, "app/dist/mason.js"))} "$@"
 ` };
   for (const [name, content2] of Object.entries(launchers)) {
     const file = await storePath(bin, name);
@@ -6582,13 +6969,48 @@ async function upgradeStandalone(version, progress2) {
   progress2?.step("Checking current installation");
   const { home, bundle, record } = await currentInstallation();
   await verifyBundle(bundle);
+  const mirror = process.env.MASON_RELEASE_BASE || record.updates?.mirror || "";
+  if (mirror && !version) throw new Error("Specify a version when upgrading from a company mirror; no public latest-version lookup was made.");
+  let selected = version?.replace(/^v/, "");
+  if (!selected) {
+    progress2?.step("Checking the latest release");
+    const response = await fetch("https://github.com/adrianczuczka/mason/releases/latest", {
+      method: "HEAD",
+      redirect: "follow",
+      signal: AbortSignal.timeout(3e4)
+    }).catch((error) => {
+      throw releaseRequestError(error);
+    });
+    if (!response.ok) throw new Error(`Latest release request failed (HTTP ${response.status}).`);
+    selected = new URL(response.url).pathname.split("/").pop()?.replace(/^v/, "");
+    if (!selected || !/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/.test(selected)) throw new Error("Invalid Mason release version.");
+  }
+  const alreadyInstalled = await withLock(home, ".install-lock", async () => {
+    const current = await readInstallation(home);
+    if (current.version !== selected) return false;
+    await verifyBundle(await storePath(home, "versions/" + current.current));
+    current.updates = {
+      ...current.updates ?? { enabled: false },
+      revision: randomUUID10(),
+      pinnedVersion: version ? selected : void 0,
+      mirror: mirror || void 0
+    };
+    delete current.pending;
+    await writeStoreJson(home, "install.json", current);
+    return true;
+  });
+  if (alreadyInstalled) {
+    progress2?.stop();
+    console.log(`Mason ${selected} is already installed.`);
+    return 0;
+  }
   const windows = process.platform === "win32";
-  const script = path32.join(bundle, windows ? "install.ps1" : "install.sh");
+  const script = path33.join(bundle, windows ? "install.ps1" : "install.sh");
   progress2?.stop();
-  return new Promise((resolve, reject) => {
+  const code = await new Promise((resolve, reject) => {
     const child = spawn(
       windows ? "powershell.exe" : "sh",
-      windows ? ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", script] : [script],
+      windows ? ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", script, selected] : [script, selected],
       { stdio: "inherit", windowsHide: true, env: {
         ...process.env,
         MASON_HOME: home,
@@ -6600,8 +7022,10 @@ async function upgradeStandalone(version, progress2) {
       } }
     );
     child.on("error", reject);
-    child.on("exit", (code) => resolve(code ?? 2));
+    child.on("exit", (code2) => resolve(code2 ?? 2));
   });
+  if (code === 0) console.log("Restart running assistants to use this installation. Existing project integrations use mason from PATH.");
+  return code;
 }
 async function uninstallStandalone() {
   const { home, record } = await currentInstallation();
@@ -6636,6 +7060,7 @@ var init_install2 = __esm({
     init_path();
     init_state();
     init_sessions();
+    init_trust2();
     init_state();
     shQuote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
     psQuote = (s) => "'" + s.replace(/'/g, "''") + "'";
@@ -6658,10 +7083,10 @@ __export(updates_exports, {
   updateStatus: () => updateStatus
 });
 import fs28 from "fs/promises";
-import path33 from "path";
+import path34 from "path";
 import { spawn as spawn2 } from "child_process";
 import { randomUUID as randomUUID11 } from "crypto";
-import { z as z28 } from "zod";
+import { z as z29 } from "zod";
 async function boundedDownload(url) {
   const response = await fetch(url, { signal: AbortSignal.timeout(15e3), redirect: "follow" });
   if (!response.ok || !response.body) throw new Error(`Update metadata request failed (HTTP ${response.status}).`);
@@ -6712,7 +7137,7 @@ async function runInstaller(home, version, digest3, revision) {
   const record = await readInstallation(home);
   const bundle = await storePath(home, "versions/" + record.current);
   await verifyBundle(bundle);
-  const windows = process.platform === "win32", script = path33.join(bundle, windows ? "install.ps1" : "install.sh");
+  const windows = process.platform === "win32", script = path34.join(bundle, windows ? "install.ps1" : "install.sh");
   await new Promise((resolve, reject) => {
     const child = spawn2(windows ? "powershell.exe" : "sh", windows ? ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", script] : [script], {
       cwd: home,
@@ -6764,7 +7189,7 @@ async function runAutomaticUpdate(home, dependencies = { fetchRelease: fetchVeri
     } catch (error) {
       status.error = error instanceof Error ? error.message : String(error);
     }
-    if (await fs28.access(path33.join(home, "install.json")).then(() => true, () => false)) await writeStoreJson(home, "update-status.json", status);
+    if (await fs28.access(path34.join(home, "install.json")).then(() => true, () => false)) await writeStoreJson(home, "update-status.json", status);
   }, 0);
 }
 async function scheduleAutomaticUpdate() {
@@ -6776,8 +7201,8 @@ async function scheduleAutomaticUpdate() {
     if (status.success && status.data.lastAttempt <= now && now - status.data.lastAttempt < CHECK_INTERVAL_MS) return;
     const bundle = await storePath(home, "versions/" + record.current);
     const child = spawn2(
-      path33.join(bundle, process.platform === "win32" ? "node.exe" : "node"),
-      [path33.join(bundle, "app/dist/mason.js"), "internal-update"],
+      path34.join(bundle, process.platform === "win32" ? "node.exe" : "node"),
+      [path34.join(bundle, "app/dist/mason.js"), "internal-update"],
       { cwd: home, env: process.env, stdio: "ignore", detached: true, windowsHide: true }
     );
     child.on("error", () => {
@@ -6822,8 +7247,8 @@ async function startMcpWithUpdates(start) {
   const session = await prepareStandaloneMcp(current.home);
   if (session.bundle !== current.bundle) {
     const child = spawn2(
-      path33.join(session.bundle, process.platform === "win32" ? "node.exe" : "node"),
-      [path33.join(session.bundle, "app/dist/mason-mcp.js"), ...process.argv.slice(2)],
+      path34.join(session.bundle, process.platform === "win32" ? "node.exe" : "node"),
+      [path34.join(session.bundle, "app/dist/mason-mcp.js"), ...process.argv.slice(2)],
       { stdio: "inherit", windowsHide: true }
     );
     const interrupt = () => {
@@ -6874,14 +7299,14 @@ var init_updates = __esm({
     CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
     RELEASE_AGE_MS = 24 * 60 * 60 * 1e3;
     releaseBase = "https://github.com/adrianczuczka/mason/releases";
-    releaseListSchema = z28.array(z28.object({ tag_name: z28.string(), draft: z28.boolean(), prerelease: z28.boolean(), published_at: z28.string().nullable() }));
-    updateManifestSchema = z28.object({
-      format: z28.literal(1),
-      version: z28.string().regex(/^\d+\.\d+\.\d+$/),
-      publishedAt: z28.string().datetime(),
-      assets: z28.record(z28.string().regex(/^[a-f0-9]{64}$/))
+    releaseListSchema = z29.array(z29.object({ tag_name: z29.string(), draft: z29.boolean(), prerelease: z29.boolean(), published_at: z29.string().nullable() }));
+    updateManifestSchema = z29.object({
+      format: z29.literal(1),
+      version: z29.string().regex(/^\d+\.\d+\.\d+$/),
+      publishedAt: z29.string().datetime(),
+      assets: z29.record(z29.string().regex(/^[a-f0-9]{64}$/))
     }).strict();
-    statusSchema2 = z28.object({ lastAttempt: z28.number(), availableVersion: z28.string().optional(), error: z28.string().optional() });
+    statusSchema2 = z29.object({ lastAttempt: z29.number(), availableVersion: z29.string().optional(), error: z29.string().optional() });
   }
 });
 
@@ -7053,7 +7478,7 @@ async function runAutomationCli(argv, stdin = "", io = defaultIo, options = {})
       const { setupStatus: setupStatus2, summarizeActivation: summarizeActivation2 } = await Promise.resolve().then(() => (init_status(), status_exports));
       const setup = await setupStatus2(dir);
       const result = { ...await automationStatus(dir), configured: await installedAutomation(dir), setup };
-      io.out(values.json || !process.stdout.isTTY ? JSON.stringify(result, null, 2) : summarizeActivation2(setup));
+      io.out(values.json || !process.stdout.isTTY ? JSON.stringify(result, null, 2) : [summarizeActivation2(setup), result.knowledge].filter(Boolean).join("\n\n"));
       return 0;
     }
     if (action !== "check") throw new Error("Unknown automation command: " + action);
@@ -7078,7 +7503,7 @@ var inputArgs = process.argv.slice(2);
 var managedLaunch = inputArgs[0] === "--setup-host";
 var setupHost = managedLaunch ? inputArgs.splice(0, 2)[1] : void 0;
 var [command, ...args] = inputArgs;
-var usage = `Mason ${"0.19.0"}
+var usage = `Mason ${"0.19.2"}
 
 Usage: mason <command> [options]
 
@@ -7107,9 +7532,9 @@ try {
       await prepareLaunch2(setupHost, { allowInactive: command === "mcp" });
     }
   }
-  if (command === "internal-integration-version") console.log(JSON.stringify({ protocol: 1, version: "0.19.0" }));
+  if (command === "internal-integration-version") console.log(JSON.stringify({ protocol: 1, version: "0.19.2" }));
   else if (!command || ["--help", "-h", "help"].includes(command)) console.log(usage);
-  else if (["--version", "-v"].includes(command)) console.log("0.19.0");
+  else if (["--version", "-v"].includes(command)) console.log("0.19.2");
   else if (command === "internal-update") {
     if (args.length) throw new Error("internal-update takes no arguments.");
     const { currentInstallation: currentInstallation2 } = await Promise.resolve().then(() => (init_state(), state_exports));
@@ -7176,7 +7601,6 @@ Automatic updates: ${status.effective ? "enabled" : "inactive"} (preference: ${s
       if (command === "upgrade") {
         progress = createProgress();
         process.exitCode = await upgradeStandalone2(args[0], progress);
-        if (process.exitCode === 0) console.log("Restart running assistants to use this installation. Existing project integrations use mason from PATH.");
       } else console.log((process.platform === "win32" ? "Finishing installation cleanup after runtime exit: " : "Removed standalone installation: ") + await uninstallStandalone2() + ". Project configuration and knowledge were retained. Reinstall Mason to use its integrations.");
     }
   } else if (["setup", "teardown", "status", "check", "auto"].includes(command)) {