mason-context 0.19.0 → 0.19.2

package/dist/mason-mcp.js

@@ -58,8 +58,471 @@ var init_git_read = __esm({
   }
 });
 
+// src/utils/paths.ts
+import path from "path";
+function normalizeRepoPath(value) {
+  const slash = value.replace(/\\/g, "/");
+  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash)) return null;
+  if (slash.split("/").includes("..")) return null;
+  const normalized = path.posix.normalize(slash).replace(/\/$/, "");
+  return normalized === "." ? null : normalized;
+}
+function sanitizeRepoPaths(files) {
+  return [...new Set(files.map(normalizeRepoPath).filter((p) => p !== null))];
+}
+function isWithinRoot(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function anchorMatches(anchor, file) {
+  const a = normalizeRepoPath(anchor);
+  const f = normalizeRepoPath(file);
+  return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
+}
+function matchingPaths(anchors, files) {
+  return [...new Set(files)].filter((file) => anchors.some((anchor) => anchorMatches(anchor, file)));
+}
+var init_paths = __esm({
+  "src/utils/paths.ts"() {
+    "use strict";
+  }
+});
+
+// src/audit/types.ts
+var types_exports = {};
+__export(types_exports, {
+  ALL_CHECKS: () => ALL_CHECKS
+});
+var ALL_CHECKS;
+var init_types = __esm({
+  "src/audit/types.ts"() {
+    "use strict";
+    ALL_CHECKS = [
+      "deleted-reference",
+      "new-module",
+      "stale-count",
+      "dead-command",
+      "deps-changed",
+      "decision-anchor-drift"
+    ];
+  }
+});
+
+// src/utils/files.ts
+import fs from "fs/promises";
+import { constants } from "fs";
+import path2 from "path";
+import fg from "fast-glob";
+function isSensitiveFile(file) {
+  return file.split(/[\\/]/).some(
+    (part) => /^(?:\.env(?:\..*)?|id_rsa.*|id_ed25519.*)$|\.(?:pem|key|p12|pfx|jks|keystore)$|credentials\.|secret|^local\.properties$/i.test(part)
+  );
+}
+async function readBoundedFile(file, maxBytes) {
+  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  try {
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.size > maxBytes) return null;
+    const buffer = Buffer.alloc(Math.min(maxBytes + 1, stat.size + 1));
+    let bytes = 0;
+    while (bytes < buffer.length) {
+      const result = await handle.read(buffer, bytes, buffer.length - bytes, null);
+      if (result.bytesRead === 0) break;
+      bytes += result.bytesRead;
+    }
+    return bytes === buffer.length ? null : buffer.subarray(0, bytes).toString("utf8");
+  } finally {
+    await handle.close();
+  }
+}
+async function loadProjectConfig(root) {
+  try {
+    const canonicalRoot = await fs.realpath(root);
+    const configPath2 = await fs.realpath(path2.join(root, ".mason/config.json"));
+    if (!isWithinRoot(canonicalRoot, configPath2)) throw new Error("Project configuration resolves outside the repository");
+    const raw = await readBoundedFile(configPath2, 64 * 1024);
+    if (raw === null) throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected a configuration object");
+    const config = {};
+    for (const key of ["patterns", "alwaysInclude", "ignore"]) {
+      if (value[key] === void 0) continue;
+      if (!Array.isArray(value[key]) || !value[key].every((s) => typeof s === "string")) {
+        throw new Error(`Configuration ${key} must be an array of strings`);
+      }
+      config[key] = value[key];
+    }
+    if (value.audit !== void 0) {
+      const audit = value.audit;
+      if (!audit || typeof audit !== "object" || Array.isArray(audit)) throw new Error("Configuration audit must be an object");
+      const patterns = (raw2) => {
+        if (!Array.isArray(raw2) || raw2.length > 100 || !raw2.every((s) => typeof s === "string" && normalizeRepoPath(s) === s && !s.startsWith("!") && !/[\x00-\x1f]/.test(s))) {
+          throw new Error("Audit patterns must be at most 100 repository-relative globs without traversal or negation");
+        }
+        return raw2;
+      };
+      config.audit = {};
+      if (audit.include !== void 0) config.audit.include = patterns(audit.include);
+      if (audit.exclude !== void 0) {
+        if (!audit.exclude || typeof audit.exclude !== "object" || Array.isArray(audit.exclude)) throw new Error("audit.exclude must map check names to patterns");
+        const { ALL_CHECKS: ALL_CHECKS2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+        config.audit.exclude = {};
+        for (const [check, globs] of Object.entries(audit.exclude)) {
+          if (!ALL_CHECKS2.includes(check)) throw new Error("Unknown audit check: " + check);
+          config.audit.exclude[check] = patterns(globs);
+        }
+      }
+    }
+    return config;
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw new Error(`Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function createFileAccess(rootDir) {
+  const root = path2.resolve(rootDir);
+  const canonicalRoot = await fs.realpath(root).catch(() => root);
+  const config = await loadProjectConfig(root);
+  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
+  let gitFiles = null;
+  try {
+    const { stdout } = await execGit(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
+    gitFiles = new Set(stdout.split("\0").filter(Boolean));
+  } catch {
+    let inGit = false;
+    try {
+      await execGit(["rev-parse", "--git-dir"], { cwd: root });
+      inGit = true;
+    } catch {
+    }
+    if (inGit) throw new Error("Cannot enumerate Git files safely");
+  }
+  async function resolve2(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative || isSensitiveFile(relative) || gitFiles && !gitFiles.has(relative)) return null;
+    const candidate = path2.join(root, relative);
+    try {
+      const real = await fs.realpath(candidate);
+      if (!isWithinRoot(canonicalRoot, real) || isSensitiveFile(path2.relative(canonicalRoot, real))) return null;
+      const stat = await fs.stat(real);
+      if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null;
+      if (gitFiles && !gitFiles.has(path2.relative(canonicalRoot, real).split(path2.sep).join("/"))) return null;
+      return real;
+    } catch {
+      return null;
+    }
+  }
+  async function list(patterns = SOURCE_GLOB, options = {}) {
+    const found = await fg(patterns, { cwd: root, ignore, followSymbolicLinks: false, ...options });
+    const safe = await Promise.all(found.map(async (f) => await resolve2(f) ? f : null));
+    return safe.filter((f) => f !== null).sort();
+  }
+  async function read(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative) return null;
+    const real = await resolve2(relative);
+    if (!real) return null;
+    for (const rel of /* @__PURE__ */ new Set([relative, path2.relative(canonicalRoot, real).split(path2.sep).join("/")])) {
+      if (!(await fg(fg.escapePath(rel), { cwd: root, ignore, dot: true })).length) return null;
+    }
+    try {
+      const content2 = await readBoundedFile(real, MAX_SOURCE_BYTES);
+      return content2 === null ? null : { path: relative, content: content2, totalLines: content2.split("\n").length };
+    } catch {
+      return null;
+    }
+  }
+  return { root, config, list, read };
+}
+var SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
+var init_files = __esm({
+  "src/utils/files.ts"() {
+    "use strict";
+    init_git_read();
+    init_paths();
+    SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
+    SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
+    SOURCE_IGNORE = [
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/build/**",
+      "**/.gradle/**",
+      "**/target/**",
+      "**/.git/**",
+      "**/.mason/**",
+      "**/vendor/**",
+      "**/__pycache__/**",
+      "**/venv/**",
+      "**/.venv/**",
+      "**/*.min.*",
+      "**/*.map",
+      "**/*.lock",
+      "**/generated/**",
+      "**/*.generated.*",
+      "**/R.java",
+      "**/BuildConfig.java",
+      "**/package-lock.json",
+      "**/yarn.lock",
+      "**/pnpm-lock.yaml"
+    ];
+    MAX_SOURCE_BYTES = 1024 * 1024;
+  }
+});
+
+// src/utils/storage.ts
+import fs2 from "fs/promises";
+import path3 from "path";
+import { randomUUID } from "crypto";
+async function storePath(root, relative, createParents = false) {
+  const normalized = normalizeRepoPath(relative);
+  if (!normalized) throw new Error(`Invalid store path: ${relative}`);
+  let current = await fs2.realpath(root);
+  const parts = normalized.split("/");
+  for (let i = 0; i < parts.length; i++) {
+    current = path3.join(current, parts[i]);
+    let stat;
+    try {
+      stat = await fs2.lstat(current);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      if (createParents && i < parts.length - 1) {
+        try {
+          await fs2.mkdir(current);
+        } catch (mkdirError) {
+          if (mkdirError.code !== "EEXIST") throw mkdirError;
+        }
+        stat = await fs2.lstat(current);
+      }
+    }
+    if (stat?.isSymbolicLink()) throw new Error(`Symlink in store path: ${relative}`);
+  }
+  return current;
+}
+async function readStoreJson(root, relative) {
+  try {
+    const file = await storePath(root, relative);
+    const raw = await readBoundedFile(file, 10 * 1024 * 1024);
+    if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
+    const parsed = JSON.parse(raw);
+    if (parsed === null) throw new Error("expected a JSON object, received null");
+    return parsed;
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+  }
+}
+async function writeStoreJson(root, relative, value) {
+  const payload = JSON.stringify(value, null, 2) + "\n";
+  if (Buffer.byteLength(payload) > 10 * 1024 * 1024) {
+    throw new Error(`Mason store ${relative} exceeds 10 MiB`);
+  }
+  const file = await storePath(root, relative, true);
+  const temporary = path3.join(path3.dirname(file), `.${path3.basename(file)}.${randomUUID()}.tmp`);
+  try {
+    const handle = await fs2.open(temporary, "wx", 384);
+    try {
+      await handle.writeFile(payload, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await fs2.rename(temporary, file);
+  } finally {
+    await fs2.rm(temporary, { force: true });
+  }
+}
+var init_storage = __esm({
+  "src/utils/storage.ts"() {
+    "use strict";
+    init_paths();
+    init_files();
+  }
+});
+
+// src/audit/inspection.ts
+import fg2 from "fast-glob";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import path4 from "path";
+function withRepositoryInspection(root, run) {
+  return inspections.run({ root: path4.resolve(root), reads: /* @__PURE__ */ new Map() }, run);
+}
+function inspectionRead(root, key, read) {
+  const inspection = inspections.getStore();
+  if (!inspection || inspection.root !== path4.resolve(root)) return read();
+  if (!inspection.reads.has(key)) {
+    const pending = read();
+    inspection.reads.set(key, pending);
+    void pending.catch(() => {
+      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
+    });
+  }
+  return inspection.reads.get(key);
+}
+function inspectionGit(args, options) {
+  return inspectionRead(options.cwd, "git:" + JSON.stringify([args, options]), () => execGit(args, options));
+}
+async function auditGitPaths(root, kind) {
+  const custom = (await loadProjectConfig(root)).audit?.include ?? [];
+  const shared = inspections.getStore()?.root === path4.resolve(root) && !custom.length;
+  const expanded = fg2.generateTasks(custom).flatMap((task) => task.positive);
+  if (expanded.length > 1e3) throw new Error("Audit include patterns expand to more than 1,000 globs");
+  const documentSpecs = [...docSpecs, ...expanded.map((pattern) => `:(glob)${pattern}`)];
+  const specs = shared ? [...documentSpecs, ...sourceSpecs] : kind === "documents" ? documentSpecs : sourceSpecs;
+  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
+  const { stdout } = await inspectionGit(
+    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
+    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
+  );
+  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? custom.length > 0 || /^(readme|agents|claude)\.md$/i.test(path4.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
+  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
+  return paths.sort();
+}
+var inspections, sourceSpecs, docSpecs, sourceSuffixes;
+var init_inspection = __esm({
+  "src/audit/inspection.ts"() {
+    "use strict";
+    init_git_read();
+    init_files();
+    inspections = new AsyncLocalStorage2();
+    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
+    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
+    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+  }
+});
+
+// src/audit/inputs.ts
+import fs3 from "fs/promises";
+import * as nativeFs from "fs";
+import path5 from "path";
+import fg3 from "fast-glob";
+async function auditInputPath(root, file) {
+  if (file === ".") return fs3.realpath(root);
+  try {
+    return await storePath(root, file);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Symlink")) {
+      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
+    }
+    throw error;
+  }
+}
+async function readAuditInput(root, file) {
+  try {
+    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
+    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
+    return value;
+  } catch (error) {
+    if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return null;
+    throw error;
+  }
+}
+async function auditGlob(root, patterns, options) {
+  if (Array.isArray(patterns) && !patterns.length) return [];
+  const directories = /* @__PURE__ */ new Set();
+  const readdir2 = ((directory, opts, callback) => {
+    const relative = path5.relative(root, directory).split(path5.sep).join("/") || ".";
+    directories.add(relative);
+    if (directories.size > MAX_INPUTS) {
+      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
+      return;
+    }
+    auditInputPath(root, relative).then(() => {
+      nativeFs.readdir(directory, opts, callback);
+    }, callback);
+  });
+  const lstat2 = ((file, callback) => {
+    const relative = path5.relative(root, file).split(path5.sep).join("/") || ".";
+    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
+  });
+  const stream = fg3.stream(patterns, {
+    cwd: root,
+    ignore: options.ignore,
+    onlyFiles: false,
+    onlyDirectories: options.onlyDirectories,
+    objectMode: true,
+    followSymbolicLinks: options.followSymbolicLinks ?? true,
+    fs: { readdir: readdir2, lstat: lstat2 },
+    concurrency: 16
+  });
+  const matches = [];
+  try {
+    for await (const value of stream) {
+      const entry = value;
+      const file = entry.path;
+      if (options.select && !options.select(file)) continue;
+      await auditInputPath(root, file);
+      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
+      matches.push(file);
+      if (matches.length > MAX_INPUTS) {
+        const largest = [...matches.reduce((counts, item) => {
+          const dir = item.split("/")[0];
+          counts.set(dir, (counts.get(dir) ?? 0) + 1);
+          return counts;
+        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
+        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count4]) => `${dir} (${count4})`).join(", ")}. Narrow this check's inputs.`);
+      }
+    }
+  } finally {
+    stream.destroy();
+  }
+  return matches.sort();
+}
+async function gitSourcePaths(root) {
+  return auditGitPaths(root, "sources");
+}
+async function gitIgnoredPaths(root, files) {
+  if (!files.length) return /* @__PURE__ */ new Set();
+  const ignored = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < files.length; offset += 1e3) {
+    try {
+      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
+        cwd: root,
+        maxBuffer: 4 * 1024 * 1024,
+        timeout: 1e4,
+        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
+      });
+      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
+    } catch (error) {
+      if (error.code !== 1) throw error;
+    }
+  }
+  return ignored;
+}
+var MAX_INPUTS;
+var init_inputs = __esm({
+  "src/audit/inputs.ts"() {
+    "use strict";
+    init_files();
+    init_storage();
+    init_git_read();
+    init_inspection();
+    MAX_INPUTS = 1e5;
+  }
+});
+
+// src/audit/policy.ts
+import fg4 from "fast-glob";
+async function includedCheckPaths(root, paths, exclude) {
+  if (!exclude.length) return new Set(paths);
+  const included = /* @__PURE__ */ new Set();
+  for (let offset = 0; offset < paths.length; offset += 256) {
+    for (const file of await auditGlob(root, paths.slice(offset, offset + 256).map((file2) => fg4.escapePath(file2)), {
+      ignore: exclude,
+      followSymbolicLinks: false,
+      label: "Audit check exclusions"
+    })) included.add(file);
+  }
+  return included;
+}
+var init_policy = __esm({
+  "src/audit/policy.ts"() {
+    "use strict";
+    init_inputs();
+  }
+});
+
 // src/audit/commands.ts
-import path from "path";
+import path6 from "path";
 function splitCommands(line) {
   const parts = [];
   let quote2 = "", start = 0;
@@ -95,7 +558,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
     const cd = text2.match(/^cd\s+(.+)$/);
     if (cd) {
       const directory = literal(cd[1]);
-      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path.posix.join(cwd ?? ".", directory);
+      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path6.posix.join(cwd ?? ".", directory);
       continue;
     }
     for (const match of text2.matchAll(COMMAND)) {
@@ -106,7 +569,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
       if (shell && match.index !== 0 || match[3].startsWith("-")) scopeUnknown = "Unsupported shell wrapper or options before the script.";
       if (selector) {
         const selected = literal(selector[1]);
-        directory = selected === null || cwd === null ? null : path.posix.join(cwd ?? ".", selected);
+        directory = selected === null || cwd === null ? null : path6.posix.join(cwd ?? ".", selected);
       } else if (flags) scopeUnknown = "Unsupported package-manager options before run: " + flags;
       const tail = text2.slice(match.index + match[0].length).split(/\s--(?:\s|$)/)[0];
       if (/(?:^|\s)(?:--workspace(?:s)?|-w|--filter|-F|--prefix|--dir|-C|--if-present)(?:\s|=|$)/.test(tail)) {
@@ -136,7 +599,7 @@ var init_commands = __esm({
     COMMAND = new RegExp(`\\b(npm|pnpm|yarn)((?:[ \\t]+${TOKEN})*?)[ \\t]+run[ \\t]+([A-Za-z0-9:_.-]+)`, "g");
     literal = (value) => {
       const unquoted = value.replace(/^(["'])(.*)\1$/, "$2");
-      return /[$`*?\[\]{}~\\\x00-\x1f]/.test(unquoted) || path.posix.isAbsolute(unquoted) ? null : unquoted;
+      return /[$`*?\[\]{}~\\\x00-\x1f]/.test(unquoted) || path6.posix.isAbsolute(unquoted) ? null : unquoted;
     };
   }
 });
@@ -382,278 +845,62 @@ function extractClaims(content2) {
         excerpt: m[0]
       });
     }
-    for (const match of line.matchAll(/`([^`]+)`/g)) {
-      for (const claim of commandClaims(match[1], lineNo, void 0, true).claims) addCommand(claim);
-    }
-    for (const claim of commandClaims(line.replace(/`[^`]+`/g, ""), lineNo).claims) addCommand(claim);
-  }
-  if (inFence) processBlock();
-  return {
-    paths: [...paths.values()],
-    counts,
-    commands: [...commands2.values()]
-  };
-}
-var ROOT_FILE_NAMES, SHELL_FENCE_INFOS, markdown, COUNT_RE, COUNT_DENYLIST_RE, IGNORE_LINE, IGNORE_START, IGNORE_END;
-var init_claims = __esm({
-  "src/audit/claims.ts"() {
-    "use strict";
-    init_commands();
-    init_tree();
-    ROOT_FILE_NAMES = /* @__PURE__ */ new Set([
-      "package.json",
-      "package-lock.json",
-      "pnpm-workspace.yaml",
-      "tsconfig.json",
-      "tsup.config.ts",
-      "vitest.config.ts",
-      "Makefile",
-      "Dockerfile",
-      "docker-compose.yml",
-      "Cargo.toml",
-      "go.mod",
-      "go.sum",
-      "pyproject.toml",
-      "requirements.txt",
-      "Gemfile",
-      "composer.json",
-      "settings.gradle.kts",
-      "settings.gradle",
-      "build.gradle.kts",
-      "build.gradle",
-      "manifest.json",
-      "server.json",
-      "README.md",
-      "CHANGELOG.md",
-      "LICENSE",
-      "CLAUDE.md",
-      "AGENTS.md",
-      ".gitignore",
-      ".env.example"
-    ]);
-    SHELL_FENCE_INFOS = /* @__PURE__ */ new Set(["", "bash", "sh", "shell", "console", "zsh"]);
-    markdown = new MarkdownIt("commonmark", { html: false });
-    COUNT_RE = /(\d+)\s+(modules?|packages?|workspaces?|crates?)\b/gi;
-    COUNT_DENYLIST_RE = /^\s*(manager|registr|lock|json)/i;
-    IGNORE_LINE = "<!-- mason:ignore -->";
-    IGNORE_START = "<!-- mason:ignore-start -->";
-    IGNORE_END = "<!-- mason:ignore-end -->";
-  }
-});
-
-// src/utils/paths.ts
-import path2 from "path";
-function normalizeRepoPath(value) {
-  const slash = value.replace(/\\/g, "/");
-  if (!slash || slash.includes("\0") || path2.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash)) return null;
-  if (slash.split("/").includes("..")) return null;
-  const normalized = path2.posix.normalize(slash).replace(/\/$/, "");
-  return normalized === "." ? null : normalized;
-}
-function sanitizeRepoPaths(files) {
-  return [...new Set(files.map(normalizeRepoPath).filter((p) => p !== null))];
-}
-function isWithinRoot(root, candidate) {
-  const relative = path2.relative(root, candidate);
-  return relative !== ".." && !relative.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative);
-}
-function anchorMatches(anchor, file) {
-  const a = normalizeRepoPath(anchor);
-  const f = normalizeRepoPath(file);
-  return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
-}
-function matchingPaths(anchors, files) {
-  return [...new Set(files)].filter((file) => anchors.some((anchor) => anchorMatches(anchor, file)));
-}
-var init_paths = __esm({
-  "src/utils/paths.ts"() {
-    "use strict";
-  }
-});
-
-// src/utils/files.ts
-import fs from "fs/promises";
-import { constants } from "fs";
-import path3 from "path";
-import fg from "fast-glob";
-function isSensitiveFile(file) {
-  return file.split(/[\\/]/).some(
-    (part) => /^(?:\.env(?:\..*)?|id_rsa.*|id_ed25519.*)$|\.(?:pem|key|p12|pfx|jks|keystore)$|credentials\.|secret|^local\.properties$/i.test(part)
-  );
-}
-async function readBoundedFile(file, maxBytes) {
-  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
-  try {
-    const stat = await handle.stat();
-    if (!stat.isFile() || stat.size > maxBytes) return null;
-    const buffer = Buffer.alloc(Math.min(maxBytes + 1, stat.size + 1));
-    let bytes = 0;
-    while (bytes < buffer.length) {
-      const result = await handle.read(buffer, bytes, buffer.length - bytes, null);
-      if (result.bytesRead === 0) break;
-      bytes += result.bytesRead;
-    }
-    return bytes === buffer.length ? null : buffer.subarray(0, bytes).toString("utf8");
-  } finally {
-    await handle.close();
-  }
-}
-async function loadProjectConfig(root) {
-  try {
-    const canonicalRoot = await fs.realpath(root);
-    const configPath2 = await fs.realpath(path3.join(root, ".mason/config.json"));
-    if (!isWithinRoot(canonicalRoot, configPath2)) throw new Error("Project configuration resolves outside the repository");
-    const raw = await readBoundedFile(configPath2, 64 * 1024);
-    if (raw === null) throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
-    const value = JSON.parse(raw);
-    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected a configuration object");
-    const config = {};
-    for (const key of ["patterns", "alwaysInclude", "ignore"]) {
-      if (value[key] === void 0) continue;
-      if (!Array.isArray(value[key]) || !value[key].every((s) => typeof s === "string")) {
-        throw new Error(`Configuration ${key} must be an array of strings`);
-      }
-      config[key] = value[key];
-    }
-    return config;
-  } catch (error) {
-    if (error.code === "ENOENT") return {};
-    throw new Error(`Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`);
-  }
-}
-async function createFileAccess(rootDir) {
-  const root = path3.resolve(rootDir);
-  const canonicalRoot = await fs.realpath(root).catch(() => root);
-  const config = await loadProjectConfig(root);
-  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
-  let gitFiles = null;
-  try {
-    const { stdout } = await execGit(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
-    gitFiles = new Set(stdout.split("\0").filter(Boolean));
-  } catch {
-    let inGit = false;
-    try {
-      await execGit(["rev-parse", "--git-dir"], { cwd: root });
-      inGit = true;
-    } catch {
-    }
-    if (inGit) throw new Error("Cannot enumerate Git files safely");
-  }
-  async function resolve2(file) {
-    const relative = normalizeRepoPath(file);
-    if (!relative || isSensitiveFile(relative) || gitFiles && !gitFiles.has(relative)) return null;
-    const candidate = path3.join(root, relative);
-    try {
-      const real = await fs.realpath(candidate);
-      if (!isWithinRoot(canonicalRoot, real) || isSensitiveFile(path3.relative(canonicalRoot, real))) return null;
-      const stat = await fs.stat(real);
-      if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null;
-      if (gitFiles && !gitFiles.has(path3.relative(canonicalRoot, real).split(path3.sep).join("/"))) return null;
-      return real;
-    } catch {
-      return null;
-    }
-  }
-  async function list(patterns = SOURCE_GLOB, options = {}) {
-    const found = await fg(patterns, { cwd: root, ignore, followSymbolicLinks: false, ...options });
-    const safe = await Promise.all(found.map(async (f) => await resolve2(f) ? f : null));
-    return safe.filter((f) => f !== null).sort();
-  }
-  async function read(file) {
-    const relative = normalizeRepoPath(file);
-    if (!relative) return null;
-    const real = await resolve2(relative);
-    if (!real) return null;
-    for (const rel of /* @__PURE__ */ new Set([relative, path3.relative(canonicalRoot, real).split(path3.sep).join("/")])) {
-      if (!(await fg(fg.escapePath(rel), { cwd: root, ignore, dot: true })).length) return null;
-    }
-    try {
-      const content2 = await readBoundedFile(real, MAX_SOURCE_BYTES);
-      return content2 === null ? null : { path: relative, content: content2, totalLines: content2.split("\n").length };
-    } catch {
-      return null;
-    }
-  }
-  return { root, config, list, read };
-}
-var SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
-var init_files = __esm({
-  "src/utils/files.ts"() {
-    "use strict";
-    init_git_read();
-    init_paths();
-    SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
-    SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
-    SOURCE_IGNORE = [
-      "**/node_modules/**",
-      "**/dist/**",
-      "**/build/**",
-      "**/.gradle/**",
-      "**/target/**",
-      "**/.git/**",
-      "**/.mason/**",
-      "**/vendor/**",
-      "**/__pycache__/**",
-      "**/venv/**",
-      "**/.venv/**",
-      "**/*.min.*",
-      "**/*.map",
-      "**/*.lock",
-      "**/generated/**",
-      "**/*.generated.*",
-      "**/R.java",
-      "**/BuildConfig.java",
-      "**/package-lock.json",
-      "**/yarn.lock",
-      "**/pnpm-lock.yaml"
-    ];
-    MAX_SOURCE_BYTES = 1024 * 1024;
-  }
-});
-
-// src/audit/inspection.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-import path4 from "path";
-function withRepositoryInspection(root, run) {
-  return inspections.run({ root: path4.resolve(root), reads: /* @__PURE__ */ new Map() }, run);
-}
-function inspectionRead(root, key, read) {
-  const inspection = inspections.getStore();
-  if (!inspection || inspection.root !== path4.resolve(root)) return read();
-  if (!inspection.reads.has(key)) {
-    const pending = read();
-    inspection.reads.set(key, pending);
-    void pending.catch(() => {
-      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
-    });
+    for (const match of line.matchAll(/`([^`]+)`/g)) {
+      for (const claim of commandClaims(match[1], lineNo, void 0, true).claims) addCommand(claim);
+    }
+    for (const claim of commandClaims(line.replace(/`[^`]+`/g, ""), lineNo).claims) addCommand(claim);
   }
-  return inspection.reads.get(key);
-}
-function inspectionGit(args, options) {
-  return inspectionRead(options.cwd, "git:" + JSON.stringify([args, options]), () => execGit(args, options));
-}
-async function auditGitPaths(root, kind) {
-  const shared = inspections.getStore()?.root === path4.resolve(root);
-  const specs = shared ? [...docSpecs, ...sourceSpecs] : kind === "documents" ? docSpecs : sourceSpecs;
-  const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
-  const { stdout } = await inspectionGit(
-    ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
-    { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
-  );
-  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? /^(readme|agents|claude)\.md$/i.test(path4.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
-  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
-  return paths.sort();
+  if (inFence) processBlock();
+  return {
+    paths: [...paths.values()],
+    counts,
+    commands: [...commands2.values()]
+  };
 }
-var inspections, sourceSpecs, docSpecs, sourceSuffixes;
-var init_inspection = __esm({
-  "src/audit/inspection.ts"() {
+var ROOT_FILE_NAMES, SHELL_FENCE_INFOS, markdown, COUNT_RE, COUNT_DENYLIST_RE, IGNORE_LINE, IGNORE_START, IGNORE_END;
+var init_claims = __esm({
+  "src/audit/claims.ts"() {
     "use strict";
-    init_git_read();
-    init_files();
-    inspections = new AsyncLocalStorage2();
-    sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
-    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
-    sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+    init_commands();
+    init_tree();
+    ROOT_FILE_NAMES = /* @__PURE__ */ new Set([
+      "package.json",
+      "package-lock.json",
+      "pnpm-workspace.yaml",
+      "tsconfig.json",
+      "tsup.config.ts",
+      "vitest.config.ts",
+      "Makefile",
+      "Dockerfile",
+      "docker-compose.yml",
+      "Cargo.toml",
+      "go.mod",
+      "go.sum",
+      "pyproject.toml",
+      "requirements.txt",
+      "Gemfile",
+      "composer.json",
+      "settings.gradle.kts",
+      "settings.gradle",
+      "build.gradle.kts",
+      "build.gradle",
+      "manifest.json",
+      "server.json",
+      "README.md",
+      "CHANGELOG.md",
+      "LICENSE",
+      "CLAUDE.md",
+      "AGENTS.md",
+      ".gitignore",
+      ".env.example"
+    ]);
+    SHELL_FENCE_INFOS = /* @__PURE__ */ new Set(["", "bash", "sh", "shell", "console", "zsh"]);
+    markdown = new MarkdownIt("commonmark", { html: false });
+    COUNT_RE = /(\d+)\s+(modules?|packages?|workspaces?|crates?)\b/gi;
+    COUNT_DENYLIST_RE = /^\s*(manager|registr|lock|json)/i;
+    IGNORE_LINE = "<!-- mason:ignore -->";
+    IGNORE_START = "<!-- mason:ignore-start -->";
+    IGNORE_END = "<!-- mason:ignore-end -->";
   }
 });
 
@@ -720,212 +967,32 @@ async function commitsTouchingSince(resolvedRoot, fromHash, pathspecs) {
       ],
       { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
     );
-    const commits = [];
-    for (const block of stdout.split("
")) {
-      if (!block.trim()) continue;
-      const lines = block.split("\n").filter((l) => l.trim().length > 0);
-      const ref = parseCommitLine(lines[0]);
-      if (!ref) continue;
-      commits.push({ ...ref, files: lines.slice(1).map((l) => l.trim()) });
-    }
-    return { commits, total: commits.length };
-  } catch {
-    return null;
-  }
-}
-var COMMIT_FORMAT;
-var init_git = __esm({
-  "src/audit/git.ts"() {
-    "use strict";
-    init_inspection();
-    COMMIT_FORMAT = "%H%x09%cI%x09%s";
-  }
-});
-
-// src/utils/storage.ts
-import fs2 from "fs/promises";
-import path5 from "path";
-import { randomUUID } from "crypto";
-async function storePath(root, relative, createParents = false) {
-  const normalized = normalizeRepoPath(relative);
-  if (!normalized) throw new Error(`Invalid store path: ${relative}`);
-  let current = await fs2.realpath(root);
-  const parts = normalized.split("/");
-  for (let i = 0; i < parts.length; i++) {
-    current = path5.join(current, parts[i]);
-    let stat;
-    try {
-      stat = await fs2.lstat(current);
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-      if (createParents && i < parts.length - 1) {
-        try {
-          await fs2.mkdir(current);
-        } catch (mkdirError) {
-          if (mkdirError.code !== "EEXIST") throw mkdirError;
-        }
-        stat = await fs2.lstat(current);
-      }
-    }
-    if (stat?.isSymbolicLink()) throw new Error(`Symlink in store path: ${relative}`);
-  }
-  return current;
-}
-async function readStoreJson(root, relative) {
-  try {
-    const file = await storePath(root, relative);
-    const raw = await readBoundedFile(file, 10 * 1024 * 1024);
-    if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
-    const parsed = JSON.parse(raw);
-    if (parsed === null) throw new Error("expected a JSON object, received null");
-    return parsed;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
-  }
-}
-async function writeStoreJson(root, relative, value) {
-  const payload = JSON.stringify(value, null, 2) + "\n";
-  if (Buffer.byteLength(payload) > 10 * 1024 * 1024) {
-    throw new Error(`Mason store ${relative} exceeds 10 MiB`);
-  }
-  const file = await storePath(root, relative, true);
-  const temporary = path5.join(path5.dirname(file), `.${path5.basename(file)}.${randomUUID()}.tmp`);
-  try {
-    const handle = await fs2.open(temporary, "wx", 384);
-    try {
-      await handle.writeFile(payload, "utf8");
-      await handle.sync();
-    } finally {
-      await handle.close();
-    }
-    await fs2.rename(temporary, file);
-  } finally {
-    await fs2.rm(temporary, { force: true });
-  }
-}
-var init_storage = __esm({
-  "src/utils/storage.ts"() {
-    "use strict";
-    init_paths();
-    init_files();
-  }
-});
-
-// src/audit/inputs.ts
-import fs3 from "fs/promises";
-import * as nativeFs from "fs";
-import path6 from "path";
-import fg2 from "fast-glob";
-async function auditInputPath(root, file) {
-  if (file === ".") return fs3.realpath(root);
-  try {
-    return await storePath(root, file);
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith("Symlink")) {
-      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
-    }
-    throw error;
-  }
-}
-async function readAuditInput(root, file) {
-  try {
-    const value = await readBoundedFile(await auditInputPath(root, file), 10 * 1024 * 1024);
-    if (value === null) throw new Error(`Unreadable or oversized audit input: ${file}`);
-    return value;
-  } catch (error) {
-    if (["ENOENT", "ENOTDIR"].includes(error.code ?? "")) return null;
-    throw error;
-  }
-}
-async function auditGlob(root, patterns, options) {
-  if (Array.isArray(patterns) && !patterns.length) return [];
-  const directories = /* @__PURE__ */ new Set();
-  const readdir2 = ((directory, opts, callback) => {
-    const relative = path6.relative(root, directory).split(path6.sep).join("/") || ".";
-    directories.add(relative);
-    if (directories.size > MAX_INPUTS) {
-      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
-      return;
-    }
-    auditInputPath(root, relative).then(() => {
-      nativeFs.readdir(directory, opts, callback);
-    }, callback);
-  });
-  const lstat2 = ((file, callback) => {
-    const relative = path6.relative(root, file).split(path6.sep).join("/") || ".";
-    auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
-  });
-  const stream = fg2.stream(patterns, {
-    cwd: root,
-    ignore: options.ignore,
-    onlyFiles: false,
-    onlyDirectories: options.onlyDirectories,
-    objectMode: true,
-    followSymbolicLinks: options.followSymbolicLinks ?? true,
-    fs: { readdir: readdir2, lstat: lstat2 },
-    concurrency: 16
-  });
-  const matches = [];
-  try {
-    for await (const value of stream) {
-      const entry = value;
-      const file = entry.path;
-      if (options.select && !options.select(file)) continue;
-      await auditInputPath(root, file);
-      if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
-      matches.push(file);
-      if (matches.length > MAX_INPUTS) {
-        const largest = [...matches.reduce((counts, item) => {
-          const dir = item.split("/")[0];
-          counts.set(dir, (counts.get(dir) ?? 0) + 1);
-          return counts;
-        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
-        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count4]) => `${dir} (${count4})`).join(", ")}. Narrow this check's inputs.`);
-      }
-    }
-  } finally {
-    stream.destroy();
-  }
-  return matches.sort();
-}
-async function gitSourcePaths(root) {
-  return auditGitPaths(root, "sources");
-}
-async function gitIgnoredPaths(root, files) {
-  if (!files.length) return /* @__PURE__ */ new Set();
-  const ignored = /* @__PURE__ */ new Set();
-  for (let offset = 0; offset < files.length; offset += 1e3) {
-    try {
-      const { stdout } = await execGit(["check-ignore", "-z", "--stdin"], {
-        cwd: root,
-        maxBuffer: 4 * 1024 * 1024,
-        timeout: 1e4,
-        input: files.slice(offset, offset + 1e3).join("\0") + "\0"
-      });
-      for (const file of stdout.split("\0").filter(Boolean)) ignored.add(file);
-    } catch (error) {
-      if (error.code !== 1) throw error;
+    const commits = [];
+    for (const block of stdout.split("
")) {
+      if (!block.trim()) continue;
+      const lines = block.split("\n").filter((l) => l.trim().length > 0);
+      const ref = parseCommitLine(lines[0]);
+      if (!ref) continue;
+      commits.push({ ...ref, files: lines.slice(1).map((l) => l.trim()) });
     }
+    return { commits, total: commits.length };
+  } catch {
+    return null;
   }
-  return ignored;
 }
-var MAX_INPUTS;
-var init_inputs = __esm({
-  "src/audit/inputs.ts"() {
+var COMMIT_FORMAT;
+var init_git = __esm({
+  "src/audit/git.ts"() {
     "use strict";
-    init_files();
-    init_storage();
-    init_git_read();
     init_inspection();
-    MAX_INPUTS = 1e5;
+    COMMIT_FORMAT = "%H%x09%cI%x09%s";
   }
 });
 
 // src/audit/docs.ts
 import fs4 from "fs/promises";
 import path7 from "path";
-import fg3 from "fast-glob";
+import fg5 from "fast-glob";
 async function dirtyDocs(resolvedRoot, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
   try {
@@ -977,7 +1044,7 @@ async function discoverDocPaths(root) {
   const paths = [];
   const unique = [...new Set(candidates)].sort();
   for (let offset = 0; offset < unique.length; offset += 256) {
-    paths.push(...await auditGlob(root, unique.slice(offset, offset + 256).map((p) => fg3.escapePath(p)), {
+    paths.push(...await auditGlob(root, unique.slice(offset, offset + 256).map((p) => fg5.escapePath(p)), {
       ignore: excluded,
       followSymbolicLinks: false,
       label: "Documentation discovery"
@@ -1007,6 +1074,7 @@ async function localDocPaths(root) {
   return paths;
 }
 function documentScope(file) {
+  if (!/^(readme|agents|claude)\.md$/i.test(path7.posix.basename(file))) return ".";
   const parent = path7.posix.dirname(file);
   return path7.posix.basename(parent).toLowerCase() === ".claude" ? path7.posix.dirname(parent) : parent;
 }
@@ -1028,7 +1096,7 @@ async function readDocs(resolvedRoot) {
         path: candidate,
         content: content2,
         scope: documentScope(candidate),
-        kind: /^readme\.md$/i.test(path7.posix.basename(candidate)) ? "readme" : "instructions",
+        kind: /^readme\.md$/i.test(path7.posix.basename(candidate)) ? "readme" : /^(agents|claude)\.md$/i.test(path7.posix.basename(candidate)) ? "instructions" : "guide",
         lineCount: content2.split("\n").length,
         lastCommit,
         dirty: dirty.has(candidate),
@@ -1585,22 +1653,6 @@ var init_drift = __esm({
   }
 });
 
-// src/audit/types.ts
-var ALL_CHECKS;
-var init_types = __esm({
-  "src/audit/types.ts"() {
-    "use strict";
-    ALL_CHECKS = [
-      "deleted-reference",
-      "new-module",
-      "stale-count",
-      "dead-command",
-      "deps-changed",
-      "decision-anchor-drift"
-    ];
-  }
-});
-
 // src/audit/checks/deleted-reference.ts
 import path12 from "path";
 async function checkDeletedReferences(ctx) {
@@ -1669,7 +1721,7 @@ var init_deleted_reference = __esm({
 });
 
 // src/audit/checks/new-module.ts
-import fg4 from "fast-glob";
+import fg6 from "fast-glob";
 import fs8 from "fs/promises";
 import path13 from "path";
 function escapeRegExp(text2) {
@@ -1731,7 +1783,7 @@ async function collectModuleCandidates(root, combinedDocs) {
     const result = /* @__PURE__ */ new Map();
     for (const dir of parents) {
       const visible = new Set(byParent.get(dir).filter((candidate) => !ignored.has(candidate) || sources.some((file) => file.startsWith(candidate + "/"))));
-      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg4.escapePath(dir)}/*`, {
+      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg6.escapePath(dir)}/*`, {
         ignore,
         onlyDirectories: true,
         label: "Module directory discovery",
@@ -1744,7 +1796,7 @@ async function collectModuleCandidates(root, combinedDocs) {
     const files = sources.filter((file) => file.startsWith(dir + "/"));
     let count4 = 0;
     for (let offset = 0; offset < files.length; offset += 256) {
-      count4 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg4.escapePath(file)), {
+      count4 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg6.escapePath(file)), {
         ignore,
         followSymbolicLinks: false,
         label: `Source discovery in ${dir}`
@@ -2079,6 +2131,87 @@ var init_dead_command = __esm({
   }
 });
 
+// src/audit/dependency-claims.ts
+import path16 from "path";
+import { parse as parseToml } from "smol-toml";
+function dependencyText(content2) {
+  return content2.replace(/<!-- mason:start -->[\s\S]*?<!-- mason:end -->/g, (text2) => text2.replace(/[^\n]/g, " ")).replace(/<!--[\s\S]*?-->/g, (text2) => text2.replace(/[^\n]/g, " "));
+}
+function declarations(file, source) {
+  const result = /* @__PURE__ */ new Map();
+  if (!source) return result;
+  if (path16.posix.basename(file) === "package.json") {
+    const json = JSON.parse(source);
+    for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies", "engines"]) {
+      for (const [name, value] of Object.entries(json[section] ?? {})) {
+        if (typeof value === "string") result.set(name, [...result.has(name) ? [result.get(name)] : [], value].join("; "));
+      }
+    }
+  } else if (file.endsWith("libs.versions.toml")) {
+    const catalog = parseToml(source);
+    for (const section of ["libraries", "plugins"]) for (const [alias, entry] of Object.entries(catalog[section] ?? {})) {
+      if (typeof entry === "string") {
+        const parts = entry.split(":");
+        if (parts.length >= 3) result.set(parts.slice(0, -1).join(":"), parts.at(-1));
+      } else if (entry && typeof entry === "object") {
+        const name = entry.module ?? (entry.group && entry.name ? `${entry.group}:${entry.name}` : entry.id);
+        const version = typeof entry.version === "string" ? entry.version : catalog.versions?.[entry.version?.ref];
+        if (typeof name === "string") result.set(name, typeof version === "string" ? version : "unspecified");
+      }
+    }
+  } else if (/build\.gradle(?:\.kts)?$/.test(file)) {
+    for (const match of source.matchAll(/["']([\w.-]+:[\w.-]+):([^"'\s]+)["']/g)) result.set(match[1], match[2]);
+    for (const match of source.matchAll(/\bid\s*\(?\s*["']([\w.-]+)["']\s*\)?\s*version\s*["']([^"']+)["']/g)) result.set(match[1], match[2]);
+  }
+  return result;
+}
+async function matchDependencyChanges(root, from, head, files, content2) {
+  const matches = [];
+  const lines = dependencyText(content2).split("\n");
+  let incomplete = files.length > 64;
+  for (const file of files.slice(0, 64)) {
+    if (!/(?:^|\/)(?:package\.json|libs\.versions\.toml|build\.gradle(?:\.kts)?)$/.test(file)) {
+      incomplete = true;
+      continue;
+    }
+    try {
+      const read = async (revision) => {
+        const { stdout: entry } = await inspectionGit(["ls-tree", revision, "--", `:(literal)${file}`], { cwd: root, timeout: 1e4 });
+        if (!entry) return "";
+        if (!entry.startsWith("100644 ") && !entry.startsWith("100755 ")) throw new Error("Unsupported manifest mode");
+        return (await inspectionGit(["show", `${revision}:${file}`], { cwd: root, maxBuffer: 1024 * 1024, timeout: 1e4 })).stdout;
+      };
+      const [before, after] = await Promise.all([read(from), read(head)]);
+      const old = declarations(file, before), next = declarations(file, after);
+      for (const dependency of /* @__PURE__ */ new Set([...old.keys(), ...next.keys()])) {
+        if (old.get(dependency) === next.get(dependency)) continue;
+        const escaped = dependency.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        const mention = new RegExp(`(^|[^a-zA-Z0-9_@./-])${escaped}(?![a-zA-Z0-9_/-]|\\.[a-zA-Z0-9_])`, "i");
+        const line = lines.findIndex((text2) => mention.test(text2));
+        if (line < 0) continue;
+        matches.push({
+          dependency,
+          manifest: file,
+          before: old.get(dependency) ?? null,
+          after: next.get(dependency) ?? null,
+          line: line + 1,
+          excerpt: lines[line].trim().slice(0, 500)
+        });
+        if (matches.length >= 100) return { matches, incomplete: true };
+      }
+    } catch {
+      incomplete = true;
+    }
+  }
+  return { matches, incomplete };
+}
+var init_dependency_claims = __esm({
+  "src/audit/dependency-claims.ts"() {
+    "use strict";
+    init_inspection();
+  }
+});
+
 // src/audit/release-metadata.ts
 async function git(root, args) {
   return (await execGit(args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
@@ -2158,13 +2291,6 @@ async function checkDepsChanged(ctx) {
       });
       continue;
     }
-    if (doc.dirty) {
-      result.skipped.push({
-        check: "deps-changed",
-        doc: doc.path,
-        reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
-      });
-    }
     let content2 = doc.content;
     if (doc.dirty) {
       try {
@@ -2177,7 +2303,6 @@ async function checkDepsChanged(ctx) {
         continue;
       }
     }
-    if (!hasDependencyContent(content2)) continue;
     const range = await commitsTouchingSince(
       ctx.root,
       doc.lastCommit.hash,
@@ -2201,16 +2326,32 @@ async function checkDepsChanged(ctx) {
     range.commits = relevant;
     range.total = relevant.length;
     if (range.total === 0) continue;
-    const latest = range.commits[0];
+    const relevance = await matchDependencyChanges(
+      ctx.root,
+      doc.lastCommit.hash,
+      ctx.headHash,
+      [...new Set(range.commits.flatMap((commit) => commit.files))],
+      content2
+    );
+    if (!relevance.matches.length && !hasDependencyContent(content2)) continue;
+    const match = relevance.matches[0];
+    if (doc.dirty && match) result.skipped.push({
+      check: "deps-changed",
+      doc: doc.path,
+      reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
+    });
     (doc.dirty ? result.suppressedAdvisories : result.advisories).push({
       type: "deps-changed",
-      message: `dependency manifests touched by ${range.total} commit${range.total === 1 ? "" : "s"} since ${doc.path} was last committed (latest: ${latest.hash.slice(0, 7)} "${latest.subject}")`,
-      anchor: { doc: doc.path, line: null, excerpt: null },
+      ...match ? {} : { resolution: "informational" },
+      message: match ? `${match.dependency} changed from ${match.before ?? "absent"} to ${match.after ?? "removed"} in ${match.manifest}; review ${doc.path}:${match.line}: ${match.excerpt}${relevance.matches.length > 1 ? ` (${relevance.matches.length - 1} more matches in evidence)` : ""}` : `Dependency manifests changed after the document baseline ${doc.lastCommit.hash.slice(0, 7)} (${doc.lastCommit.date.slice(0, 10)}); no specific affected passage was established. Informational only.${relevance.incomplete ? " Some manifest declarations could not be matched." : ""}`,
+      anchor: { doc: doc.path, line: match?.line ?? null, excerpt: match?.excerpt ?? null },
       evidence: {
         kind: "doc-behind-manifests",
         docLastCommit: doc.lastCommit,
         manifestCommits: range.commits.slice(0, MANIFEST_COMMITS_CAP),
-        totalCommits: range.total
+        totalCommits: range.total,
+        matches: relevance.matches,
+        matchingIncomplete: relevance.incomplete
       }
     });
   }
@@ -2220,6 +2361,7 @@ var MANIFEST_COMMITS_CAP, MANIFEST_PATHSPECS;
 var init_deps_changed = __esm({
   "src/audit/checks/deps-changed.ts"() {
     "use strict";
+    init_dependency_claims();
     init_docs();
     init_release_metadata();
     init_git();
@@ -2244,7 +2386,7 @@ var init_deps_changed = __esm({
 });
 
 // src/context/lexical.ts
-import path16 from "path";
+import path17 from "path";
 function tokenize(text2) {
   return text2.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length > 2 && !STOPWORDS.has(t));
 }
@@ -2257,7 +2399,7 @@ function tokenSet(text2) {
 function scoreEntry(taskTokens, entry) {
   const nameTokens = tokenSet(entry.name);
   const descTokens = tokenSet(entry.description);
-  const fileTokens = tokenSet(entry.files.map((f) => path16.basename(f)).join(" "));
+  const fileTokens = tokenSet(entry.files.map((f) => path17.basename(f)).join(" "));
   let score = 0;
   for (const token of taskTokens) {
     if (nameTokens.has(token)) score += 3;
@@ -2591,7 +2733,7 @@ __export(decisions_exports, {
   withDecisionWrite: () => withDecisionWrite
 });
 import fs9 from "fs/promises";
-import path17 from "path";
+import path18 from "path";
 import { createHash } from "crypto";
 import { z as z3 } from "zod";
 async function loadDecisionStore(rootDir) {
@@ -2689,7 +2831,7 @@ async function upsertDecision(rootDir, input) {
     if (input.files && files.length < input.files.length) warnings.push("some anchor paths were outside the repo or duplicated and were dropped");
     for (const file of files) {
       try {
-        await fs9.access(path17.join(rootDir, file));
+        await fs9.access(path18.join(rootDir, file));
       } catch {
         warnings.push(`anchor file does not exist on disk: ${file}`);
       }
@@ -2814,9 +2956,9 @@ var init_decisions = __esm({
 });
 
 // src/decisions/drift.ts
-import path18 from "path";
+import path19 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path18.resolve(rootDir);
+  const resolvedRoot = path19.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
   const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
   const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
@@ -3012,7 +3154,9 @@ var init_findings = __esm({
         kind: z4.literal("doc-behind-manifests"),
         docLastCommit: commitSchema,
         manifestCommits: z4.array(commitSchema.extend({ files: z4.array(z4.string()) })),
-        totalCommits: count
+        totalCommits: count,
+        matches: z4.array(z4.object({ dependency: z4.string(), manifest: z4.string(), before: z4.string().nullable(), after: z4.string().nullable(), line: z4.number().int().positive(), excerpt: z4.string() })).optional(),
+        matchingIncomplete: z4.boolean().optional()
       }),
       z4.object({
         kind: z4.literal("decision-anchor"),
@@ -3028,7 +3172,7 @@ var init_findings = __esm({
       type: z4.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
       confidence: z4.enum(["certain", "likely"])
     });
-    advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z4.literal("recheck").optional() });
+    advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z4.enum(["recheck", "informational"]).optional() });
     checkResultSchema = z4.object({
       issues: z4.array(issueSchema),
       advisories: z4.array(advisorySchema),
@@ -3038,8 +3182,121 @@ var init_findings = __esm({
   }
 });
 
-// src/automation/store.ts
+// src/automation/notifications.ts
 import { z as z5 } from "zod";
+function condition(finding) {
+  const source = finding.current ?? finding.original;
+  const e = source.evidence;
+  const id = e.kind === "decision-anchor" ? digest([source.type, source.anchor.doc, e.decisionId]) : finding.id;
+  const result = { level: "confidence" in source ? 2 : 1, facts: [] };
+  switch (e.kind) {
+    case "count-mismatch":
+      result.magnitude = Math.abs(e.actual - e.claimed);
+      break;
+    case "unmentioned-dir":
+      result.magnitude = e.sourceFileCount;
+      break;
+    case "decision-anchor":
+      result.facts = [...e.changedFiles].sort();
+      break;
+    case "doc-behind-manifests":
+      result.facts = (e.matches ?? []).map((m) => JSON.stringify([m.manifest, m.dependency, m.after])).sort();
+      break;
+  }
+  return { id, condition: result };
+}
+function notificationConditions(findings) {
+  const active = findings.filter((f) => f.status !== "resolved");
+  const currentIds = new Set(active.filter((f) => f.current).map((f) => condition(f).id));
+  const result = {};
+  for (const f of active) {
+    const value = condition(f);
+    if (!f.current && currentIds.has(value.id)) continue;
+    const previous = result[value.id];
+    result[value.id] = previous ? {
+      level: Math.max(previous.level, value.condition.level),
+      facts: [.../* @__PURE__ */ new Set([...previous.facts, ...value.condition.facts])].sort(),
+      ...previous.magnitude !== void 0 || value.condition.magnitude !== void 0 ? { magnitude: Math.max(previous.magnitude ?? 0, value.condition.magnitude ?? 0) } : {}
+    } : value.condition;
+  }
+  return result;
+}
+function createNotificationState(findings, head) {
+  return { version: 1, baselineHead: head, baseline: notificationConditions(findings), delivered: {}, cleared: [] };
+}
+function worsened(current, previous) {
+  return !previous || current.level > previous.level || (current.magnitude ?? 0) > (previous.magnitude ?? 0) || current.facts.some((fact) => !previous.facts.includes(fact));
+}
+function completionFindings(state, findings) {
+  const current = notificationConditions(findings);
+  const cleared = new Set(state.cleared);
+  const resolvedIds = new Set(findings.filter((f) => f.status === "resolved").map((f) => condition(f).id));
+  for (const id of Object.keys(state.baseline)) if (resolvedIds.has(id) && !current[id]) cleared.add(id);
+  state.cleared = [...cleared];
+  const selected = [];
+  const selectedIds = /* @__PURE__ */ new Set();
+  const delivered = { ...state.delivered };
+  for (const finding of findings) {
+    const value = condition(finding);
+    const previous = state.delivered[value.id];
+    value.condition = current[value.id] ?? value.condition;
+    if (finding.status === "unverified" || !finding.current && finding.status !== "resolved") {
+      continue;
+    }
+    if (finding.status === "resolved") {
+      if (!current[value.id]) delete delivered[value.id];
+      continue;
+    }
+    const eligible = cleared.has(value.id) || worsened(value.condition, state.baseline[value.id]);
+    if (!eligible) continue;
+    if (!selectedIds.has(value.id) && worsened(value.condition, previous)) {
+      selectedIds.add(value.id);
+      const source = finding.current;
+      selected.push(source.evidence.kind === "decision-anchor" ? { ...finding, current: { ...source, evidence: { ...source.evidence, changedFiles: value.condition.facts } } } : finding);
+      if (selected.length <= MAX_COMPLETION_FINDINGS) delivered[value.id] = value.condition;
+    }
+  }
+  state.delivered = delivered;
+  return selected;
+}
+function completionSummary(findings, reportPath) {
+  if (!findings.length) return null;
+  const safe = (value) => value.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 250);
+  return [
+    `Mason: ${findings.length} new or worsened finding(s) since the retained baseline.`,
+    ...findings.slice(0, MAX_COMPLETION_FINDINGS).map((f) => {
+      const source = f.current ?? f.original;
+      const detail = source.evidence.kind === "decision-anchor" ? `Changes to ${source.evidence.changedFiles.join(", ")} may affect decision "${source.evidence.title}". Inspect the diff if relevant; acceptance is not required.` : source.message;
+      return `[${f.status === "unresolved" ? "issue" : "advisory"}] ${safe(source.anchor.doc)}: ${safe(detail)}`;
+    }),
+    ...findings.length > MAX_COMPLETION_FINDINGS ? [`${findings.length - MAX_COMPLETION_FINDINGS} more in the report; pending later feedback.`] : [],
+    `Evidence: ${reportPath}. Explicit audit: mason_automation(action: "check").`,
+    "Inspect findings within the authorized work. Concurrent changes may also contribute; this summary does not establish who introduced them."
+  ].join("\n");
+}
+var conditionSchema, MAX_COMPLETION_FINDINGS, notificationStateSchema;
+var init_notifications = __esm({
+  "src/automation/notifications.ts"() {
+    "use strict";
+    init_findings();
+    conditionSchema = z5.object({
+      level: z5.number(),
+      facts: z5.array(z5.string()),
+      magnitude: z5.number().optional()
+    });
+    MAX_COMPLETION_FINDINGS = 4;
+    notificationStateSchema = z5.object({
+      version: z5.literal(1),
+      baselineHead: z5.string(),
+      baseline: z5.record(conditionSchema),
+      delivered: z5.record(conditionSchema),
+      cleared: z5.array(z5.string())
+    });
+  }
+});
+
+// src/automation/store.ts
+import { z as z6 } from "zod";
 function parseState(raw) {
   try {
     return stateSchema.parse(raw);
@@ -3055,50 +3312,53 @@ var init_store = __esm({
   "src/automation/store.ts"() {
     "use strict";
     init_store_lock();
-    hostSchema = z5.enum(["claude", "codex"]);
+    init_notifications();
+    hostSchema = z6.enum(["claude", "codex"]);
     events = ["session_start", "turn_start", "before_tool", "after_tool", "task_end"];
-    stateSchema = z5.object({
-      version: z5.literal(1),
-      root: z5.string(),
-      gitDir: z5.string(),
-      branch: z5.string(),
-      baselines: z5.array(z5.object({ path: z5.string(), at: z5.string(), event: z5.string(), fingerprint: z5.string() })).max(128),
-      sessions: z5.record(z5.object({
+    stateSchema = z6.object({
+      version: z6.literal(1),
+      root: z6.string(),
+      gitDir: z6.string(),
+      branch: z6.string(),
+      baselines: z6.array(z6.object({ path: z6.string(), at: z6.string(), event: z6.string(), fingerprint: z6.string() })).max(128),
+      sessions: z6.record(z6.object({
         host: hostSchema,
-        seen: z5.string().nullable(),
-        continued: z5.boolean(),
-        initialIssues: z5.array(z5.string()),
-        initialDocs: z5.record(z5.string().nullable()),
-        lastUsed: z5.string(),
-        mutationObserved: z5.boolean(),
-        pending: z5.record(z5.string()),
-        coverageGaps: z5.array(z5.string()),
-        events: z5.record(z5.object({ at: z5.string(), count: z5.number().int().positive() }))
+        lastUsed: z6.string(),
+        notifiedDiagnostics: z6.array(z6.string()).default([]),
+        pending: z6.record(z6.string()),
+        coverageGaps: z6.array(z6.string()),
+        events: z6.record(z6.object({ at: z6.string(), count: z6.number().int().positive() }))
       })),
-      updatedAt: z5.string(),
-      fingerprint: z5.string().nullable(),
-      latest: z5.string().nullable(),
-      analysis: z5.object({ id: z5.string(), fingerprint: z5.string(), completedAt: z5.number(), path: z5.string() }).optional()
+      updatedAt: z6.string(),
+      fingerprint: z6.string().nullable(),
+      latest: z6.string().nullable(),
+      notifications: notificationStateSchema.optional(),
+      agentNotifications: notificationStateSchema.optional(),
+      analysis: z6.object({ id: z6.string(), fingerprint: z6.string(), completedAt: z6.number(), path: z6.string() }).optional()
     });
   }
 });
 
 // src/audit/advisory-review.ts
 import fs10 from "fs/promises";
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 async function readRecord(root, id) {
   const raw = await readStoreJson(root, recordPath(id));
   if (raw === null) return null;
   const record = recordSchema.parse(raw);
   const { digest: stored, ...payload } = record;
-  if (record.id !== id || digest(payload) !== stored || record.events.some((event) => findingId(event.finding) !== id || event.evidence.fingerprint !== digest([event.evidence.scope, event.evidence.tree, event.evidence.lastScopeCommit, event.evidence.paths]))) {
+  if (record.id !== id || digest(payload) !== stored || record.events.some((event) => findingId(event.finding) !== id || (event.outcome === "dismissed" ? !event.reasonCode || event.finding.type !== "deps-changed" : !event.reviewer || !!event.reasonCode) || event.evidence.fingerprint !== evidenceFingerprint(event.evidence, event.reasonCode))) {
     throw new Error("Advisory review record is inconsistent or modified; inspect its history.");
   }
   return record;
 }
-function scopes(finding) {
+function evidenceFingerprint(evidence, reason2) {
+  return digest([evidence.scope, evidence.tree, ...reason2 === "no-dependency-claims" ? [] : [evidence.lastScopeCommit], evidence.paths]);
+}
+function scopes(finding, reason2) {
   const files = [finding.anchor.doc], e = finding.evidence;
   if (e.kind === "decision-anchor") throw new Error("Use review_decision for decision acceptance, reaffirmation or retirement.");
+  if (reason2 === "no-dependency-claims" && e.kind === "doc-behind-manifests") return [`:(literal)${finding.anchor.doc}`];
   if (e.kind === "doc-behind-manifests") return [`:(literal)${finding.anchor.doc}`, ...manifestPathspecs(finding.anchor.doc)];
   if (e.kind === "missing-path") files.push(...e.scope?.candidates ?? [e.resolvedPath ?? e.claimed]);
   else if (e.kind === "missing-script") files.push(...e.manifestsChecked, ...e.scope?.candidates ?? []);
@@ -3109,9 +3369,9 @@ function scopes(finding) {
     return `:(literal)${file}`;
   }).sort();
 }
-async function reviewEvidence(root, finding) {
+async function reviewEvidence(root, finding, reason2) {
   if (normalizeRepoPath(finding.anchor.doc) !== finding.anchor.doc) throw new Error("Invalid advisory document path.");
-  const scope = scopes(finding);
+  const scope = scopes(finding, reason2);
   const head = (await git2(root, "rev-parse", "HEAD")).trim();
   const tracked = (await git2(root, "ls-files", "--cached", "-z", "--", ...scope)).split("\0").filter(Boolean);
   if (tracked.length > 2e4) throw new Error("Advisory scope exceeds 20,000 tracked files.");
@@ -3137,7 +3397,7 @@ async function reviewEvidence(root, finding) {
       if (!tracked.includes(file) && await pathExists(root, file)) dirty = true;
     }
   }
-  const fingerprint = digest([scope, tree, lastScopeCommit, paths]);
+  const fingerprint = evidenceFingerprint({ head, scope, tree, lastScopeCommit, paths, fingerprint: "" }, reason2);
   if ((await git2(root, "rev-parse", "HEAD")).trim() !== head) throw new Error("HEAD changed while collecting review evidence.");
   return {
     ...evidenceSchema2.parse({ head, scope, tree, lastScopeCommit, paths, fingerprint }),
@@ -3184,7 +3444,7 @@ async function assessAdvisory(root, finding, baselineHead) {
     const record = await readRecord(root, id);
     if (!record) return null;
     const event = record.events.at(-1);
-    const current = await reviewEvidence(root, event.finding);
+    const current = await reviewEvidence(root, event.finding, event.reasonCode);
     await git2(root, "merge-base", "--is-ancestor", event.evidence.head, current.head);
     const base = {
       id,
@@ -3194,7 +3454,7 @@ async function assessAdvisory(root, finding, baselineHead) {
       outcome: event.outcome,
       reviewedHead: event.evidence.head
     };
-    if (current.dirty || current.fingerprint !== event.evidence.fingerprint || digest(scopes(finding)) !== digest(event.evidence.scope)) return { ...base, status: "reopened", reason: "Relevant document or repository evidence changed after the assessment; prepare a new review." };
+    if (current.dirty || current.fingerprint !== event.evidence.fingerprint || digest(scopes(finding, event.reasonCode)) !== digest(event.evidence.scope)) return { ...base, status: "reopened", reason: "Relevant document or repository evidence changed after the assessment; prepare a new review." };
     return { ...base, status: event.outcome === "deferred" ? "deferred" : "current", reason: event.outcome === "deferred" ? "The review was deferred and remains outstanding." : "An explicit assessment covers the current committed scope. This does not approve an engineering decision or certify correctness." };
   } catch (error) {
     return { id, status: "unverified", reason: error instanceof Error ? error.message : String(error) };
@@ -3222,9 +3482,13 @@ async function reviewAdvisory(rootDir, input) {
     decisionId: finding.evidence.decisionId,
     hint: "Use review_decision to prepare evidence and record authorized acceptance, reaffirmation or retirement, then verify this original repair baseline. An advisory assessment cannot approve a decision."
   };
+  if (request.action === "dismiss") {
+    if (finding.type !== "deps-changed" || finding.evidence.kind !== "doc-behind-manifests") throw new Error("One-step dismissal is only available for dependency advisories.");
+    if (!request.reasonCode || !request.note) throw new Error("Dismissal requires reasonCode and note; it does not require a reviewer or prepared token.");
+  } else if (request.reasonCode) throw new Error("reasonCode is only used with dismiss.");
   const prepare = async () => {
     const record = await readRecord(root, request.findingId);
-    const evidence = await reviewEvidence(root, finding);
+    const evidence = await reviewEvidence(root, finding, request.reasonCode);
     await git2(root, "merge-base", "--is-ancestor", baseline.original.headHash, evidence.head);
     const token = digest({ baseline: baseline.original, finding, evidence, record });
     return { record, evidence, token };
@@ -3253,10 +3517,10 @@ async function reviewAdvisory(rootDir, input) {
       hint: "Inspect the original finding, scoped document and relevant code changes. Record addressed, inapplicable or deferred only when the user or cited project review authorizes that assessment. Supply the actual reviewer, reason in note and reviewToken. Relevant edits must be committed first. Deferral remains outstanding. Review identities are recorded assertions, not authenticated approvals."
     };
   }
-  if (!request.reviewer || !request.note || !request.reviewToken) throw new Error("Prepare first; recording an assessment requires reviewToken, reviewer and note.");
+  if (request.action !== "dismiss" && (!request.reviewer || !request.note || !request.reviewToken)) throw new Error("Prepare first; recording an assessment requires reviewToken, reviewer and note.");
   return withLock(root, ".mason/reports/advisory-review-locks/" + request.findingId, async () => {
     const state = await prepare();
-    if (state.token !== request.reviewToken) throw new Error("Review conflict: evidence or review history changed since preparation. Prepare and inspect a new review.");
+    if (request.action !== "dismiss" && state.token !== request.reviewToken) throw new Error("Review conflict: evidence or review history changed since preparation. Prepare and inspect a new review.");
     if (state.evidence.dirty) throw new Error("Commit relevant document and repository edits before recording the assessment. Unrelated local work may remain.");
     if ((state.record?.events.length ?? 0) >= 200) throw new Error("Review history limit reached; existing events were retained.");
     const { dirty, documentDigest, ...evidence } = state.evidence;
@@ -3264,7 +3528,8 @@ async function reviewAdvisory(rootDir, input) {
       at: (/* @__PURE__ */ new Date()).toISOString(),
       reviewer: request.reviewer,
       note: request.note,
-      outcome: request.action,
+      outcome: request.action === "dismiss" ? "dismissed" : request.action,
+      reasonCode: request.reasonCode,
       finding,
       evidence
     });
@@ -3275,11 +3540,11 @@ async function reviewAdvisory(rootDir, input) {
       status: "recorded",
       recordPath: recordPath(request.findingId),
       event,
-      hint: "Review and commit this assessment record through the normal project workflow, then verify the original repair baseline. Relevant changes reopen the assessment; deferral remains outstanding."
+      hint: request.action === "dismiss" ? "Dismissal saved and effective locally. Commit the record to share it. No-dependency-claims dismissals reopen on document content changes; unrelated-manifest-change dismissals reopen on scoped document or manifest changes. This does not approve a decision." : "Review and commit this assessment record through the normal project workflow, then verify the original repair baseline. Relevant changes reopen the assessment; deferral remains outstanding."
     };
   });
 }
-var git2, hashSchema, commitSchema2, evidenceSchema2, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
+var git2, hashSchema, commitSchema2, evidenceSchema2, dismissalReasonSchema, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
 var init_advisory_review = __esm({
   "src/audit/advisory-review.ts"() {
     "use strict";
@@ -3295,39 +3560,42 @@ var init_advisory_review = __esm({
     init_decisions();
     init_drift2();
     git2 = async (root, ...args) => (await (["log", "ls-tree", "ls-files", "merge-base"].includes(args[0]) ? inspectionGit : execGit)(args, { cwd: root, timeout: 1e4, maxBuffer: 8 * 1024 * 1024 })).stdout;
-    hashSchema = z6.string().regex(/^[a-f0-9]{64}$/);
-    commitSchema2 = z6.string().regex(/^[a-f0-9]{40,64}$/);
-    evidenceSchema2 = z6.object({
+    hashSchema = z7.string().regex(/^[a-f0-9]{64}$/);
+    commitSchema2 = z7.string().regex(/^[a-f0-9]{40,64}$/);
+    evidenceSchema2 = z7.object({
       head: commitSchema2,
       fingerprint: hashSchema,
-      scope: z6.array(z6.string()).min(1).max(1e3),
-      tree: z6.string().max(2 * 1024 * 1024),
+      scope: z7.array(z7.string()).min(1).max(1e3),
+      tree: z7.string().max(2 * 1024 * 1024),
       lastScopeCommit: commitSchema2,
-      paths: z6.array(z6.object({ path: z6.string(), exists: z6.boolean() })).max(1e3)
+      paths: z7.array(z7.object({ path: z7.string(), exists: z7.boolean() })).max(1e3)
     });
-    eventSchema2 = z6.object({
-      at: z6.string().datetime(),
-      reviewer: z6.string().trim().min(1).max(200),
-      note: z6.string().trim().min(1).max(2500),
-      outcome: z6.enum(["addressed", "inapplicable", "deferred"]),
+    dismissalReasonSchema = z7.enum(["no-dependency-claims", "unrelated-manifest-change"]);
+    eventSchema2 = z7.object({
+      at: z7.string().datetime(),
+      reviewer: z7.string().trim().min(1).max(200).optional(),
+      note: z7.string().trim().min(1).max(2500),
+      outcome: z7.enum(["addressed", "inapplicable", "deferred", "dismissed"]),
+      reasonCode: dismissalReasonSchema.optional(),
       finding: advisorySchema.refine((finding) => finding.evidence.kind !== "decision-anchor", "Decision findings use decision reviews"),
       evidence: evidenceSchema2
     });
-    recordSchema = z6.object({ version: z6.literal(1), id: hashSchema, events: z6.array(eventSchema2).min(1).max(200), digest: hashSchema });
-    reviewSummarySchema = z6.object({
+    recordSchema = z7.object({ version: z7.literal(1), id: hashSchema, events: z7.array(eventSchema2).min(1).max(200), digest: hashSchema });
+    reviewSummarySchema = z7.object({
       id: hashSchema,
-      status: z6.enum(["current", "reopened", "deferred", "unverified"]),
-      reason: z6.string(),
-      recordPath: z6.string().optional(),
-      reviewer: z6.string().optional(),
-      note: z6.string().optional(),
-      outcome: z6.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired"]).optional(),
-      reviewedHead: z6.string().optional()
+      status: z7.enum(["current", "reopened", "deferred", "unverified"]),
+      reason: z7.string(),
+      recordPath: z7.string().optional(),
+      reviewer: z7.string().optional(),
+      note: z7.string().optional(),
+      outcome: z7.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired", "dismissed"]).optional(),
+      reviewedHead: z7.string().optional()
     });
-    advisoryReviewRequest = z6.object({
-      baselinePath: z6.string().min(1),
+    advisoryReviewRequest = z7.object({
+      baselinePath: z7.string().min(1),
       findingId: hashSchema,
-      action: z6.enum(["prepare", "addressed", "inapplicable", "deferred"]).default("prepare"),
+      action: z7.enum(["prepare", "addressed", "inapplicable", "deferred", "dismiss"]).default("prepare"),
+      reasonCode: dismissalReasonSchema.optional(),
       reviewer: eventSchema2.shape.reviewer.optional(),
       note: eventSchema2.shape.note.optional(),
       reviewToken: hashSchema.optional()
@@ -3338,12 +3606,12 @@ var init_advisory_review = __esm({
 
 // src/audit/audit.ts
 import fs11 from "fs/promises";
-import path19 from "path";
+import path20 from "path";
 async function computeAudit(rootDir, options = {}) {
   return profilePhase("audit.current", () => auditCurrent(rootDir, options));
 }
 async function auditCurrent(rootDir, options) {
-  const resolvedRoot = path19.resolve(rootDir);
+  const resolvedRoot = path20.resolve(rootDir);
   const [docs, headHash] = await Promise.all([discoverDocs(resolvedRoot), getCurrentGitHash(resolvedRoot)]);
   if (docs.length === 0) return null;
   const report = {
@@ -3377,7 +3645,7 @@ async function auditCurrent(rootDir, options) {
   }
   let decisionsPresent = false;
   try {
-    await fs11.access(path19.join(resolvedRoot, ".mason", "decisions"));
+    await fs11.access(path20.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -3389,13 +3657,21 @@ async function auditCurrent(rootDir, options) {
     changesSinceDoc,
     decisionsPresent
   };
+  const policy = (await loadProjectConfig(resolvedRoot)).audit;
   const selected = options.checks ?? ALL_CHECKS;
   for (const name of ALL_CHECKS) {
     if (!selected.includes(name)) continue;
-    const { issues, advisories, suppressedAdvisories, skipped } = await (options.runCheck ? options.runCheck(name, ctx) : CHECKS[name](ctx));
+    const exclusions = policy?.exclude?.[name] ?? [];
+    const included = await includedCheckPaths(resolvedRoot, docs.map((doc) => doc.path), exclusions);
+    const excluded = docs.filter((doc) => !included.has(doc.path)).map((doc) => ({ check: name, doc: doc.path }));
+    if (excluded.length) (report.excludedChecks ??= []).push(...excluded);
+    const scoped = { ...ctx, docs: docs.filter((doc) => included.has(doc.path)) };
+    const { issues, advisories, suppressedAdvisories, skipped } = await (options.runCheck ? options.runCheck(name, scoped) : CHECKS[name](scoped));
     report.checksRun.push(name);
     report.issues.push(...issues);
-    report.advisories.push(...advisories);
+    const advisoryPaths = await includedCheckPaths(resolvedRoot, [...new Set(advisories.map((f) => f.anchor.doc))], exclusions);
+    report.advisories.push(...advisories.filter((f) => advisoryPaths.has(f.anchor.doc)));
+    for (const f of advisories) if (!advisoryPaths.has(f.anchor.doc)) (report.excludedChecks ??= []).push({ check: name, doc: f.anchor.doc });
     report.suppressedAdvisories.push(...suppressedAdvisories ?? []);
     report.skippedChecks.push(...skipped);
   }
@@ -3407,6 +3683,8 @@ async function auditCurrent(rootDir, options) {
 var init_audit = __esm({
   "src/audit/audit.ts"() {
     "use strict";
+    init_files();
+    init_policy();
     init_profile();
     init_drift();
     init_snapshot();
@@ -3432,9 +3710,9 @@ __export(repair_exports, {
   withRepairSession: () => withRepairSession
 });
 import fs12 from "fs/promises";
-import path20 from "path";
+import path21 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 function recheckable(finding) {
   return !("confidence" in finding) && finding.resolution === "recheck" && ["deleted-reference", "dead-command", "new-module"].includes(finding.type) && ["missing-path", "missing-script", "unmentioned-dir"].includes(finding.evidence.kind);
 }
@@ -3453,7 +3731,7 @@ async function docState(root) {
       docs.push([doc, null]);
     }
   }
-  return digest(docs);
+  return digest([docs, (await loadProjectConfig(root)).audit]);
 }
 async function stableAudit(root, checks, options = {}) {
   return profilePhase("repair.audit", () => readStableAudit(root, checks, options));
@@ -3505,7 +3783,7 @@ async function withRepairSession(root, options, run, validate, cachedAudit) {
 }
 async function prepareOriginal(rootDir, checks, options, session) {
   const root = await fs12.realpath(rootDir);
-  const selected = z7.array(checkSchema).nonempty().parse(checks);
+  const selected = z8.array(checkSchema).nonempty().parse(checks);
   const report = await (session ? session.audit(selected) : stableAudit(root, selected, options));
   if (!report) throw new Error("No context files found to prepare a repair.");
   if (!report.gitAvailable) throw new Error("Readable Git history is required to prepare a repair.");
@@ -3522,8 +3800,8 @@ async function prepareOriginal(rootDir, checks, options, session) {
 }
 async function loadRepairBaseline(rootDir, baselinePath) {
   const root = await fs12.realpath(rootDir);
-  const declaredRoot = path20.resolve(rootDir);
-  const relative = path20.isAbsolute(baselinePath) ? path20.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const declaredRoot = path21.resolve(rootDir);
+  const relative = path21.isAbsolute(baselinePath) ? path21.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
   const { digest: savedDigest, ...payload } = stored;
   if (digest(payload) !== savedDigest) throw new Error("Repair baseline was modified; use the original baseline.");
@@ -3572,6 +3850,9 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
     if (now && ("confidence" in finding || "confidence" in now)) {
       return { ...base, status: "unresolved", reason: "The original check still reports this claim." };
     }
+    if (current.excludedChecks?.some((excluded) => excluded.check === finding.type && excluded.doc === finding.anchor.doc)) {
+      return { ...base, status: "resolved", reason: "Excluded by project audit policy; this is not a correctness assessment. Original evidence is retained." };
+    }
     const skipped = current.skippedChecks.filter((s) => s.check === finding.type && (!s.doc || s.doc === finding.anchor.doc));
     if (!current.checksRun?.includes(finding.type) || skipped.length) {
       return { ...base, status: "unverified", reason: skipped.map((s) => s.reason).join("; ") || "The original check did not run." };
@@ -3582,6 +3863,9 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
       if (review.status === "current") return { ...base, review, status: "resolved", reason: review.reason };
       return { ...base, review, status: "review-required", reason: review.reason };
     }
+    if (!("confidence" in finding) && finding.evidence.kind === "doc-behind-manifests" && !finding.evidence.matches?.length && (!now || !("confidence" in now) && now.resolution === "informational")) {
+      return { ...base, status: "resolved", reason: "Manifest recency alone establishes no affected passage. Retained as information; no assessment is required." };
+    }
     if (!("confidence" in finding) && (!recheckable(finding) || now)) {
       return {
         ...base,
@@ -3610,7 +3894,7 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
   const reviewedIds = new Set(current?.advisoryReviews?.filter((review) => review.status === "current").map((review) => review.id));
   const counts = { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 };
   for (const f of findings) counts[f.status]++;
-  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f) && !reviewedIds.has(findingId(f)));
+  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f) && f.resolution !== "informational" && !reviewedIds.has(findingId(f)));
   const issuesRemain = counts.unresolved > 0 || newFindings.some((f) => "confidence" in f);
   return {
     version: 1,
@@ -3633,7 +3917,7 @@ function repairExitCode(report) {
 function formatRepairSummary(report) {
   return [
     "Repair verification: " + report.status + ". Baseline: " + report.baselinePath,
-    ...report.findings.map((f) => "  [" + f.status + "] " + f.original.type + " " + f.original.anchor.doc + ": " + f.original.message + "\n    " + f.reason + "\n    findingId: " + f.id),
+    ...report.findings.map((f) => "  [" + f.status + "] " + f.original.type + " " + f.original.anchor.doc + ": " + (f.current?.message ?? "Historical evidence at " + report.baselineHead.slice(0, 7) + ": " + f.original.message) + "\n    " + f.reason + "\n    findingId: " + f.id),
     ...report.newFindings.map((f) => "  [new] " + f.type + " " + f.anchor.doc + ": " + f.message),
     ...report.diagnostics.map((d) => "  [unverified] " + d),
     ...(report.currentAudit?.skippedChecks ?? []).map((s) => "  [skipped] " + s.check + ": " + s.reason),
@@ -3656,41 +3940,42 @@ var init_repair = __esm({
     init_findings();
     init_advisory_review();
     init_findings();
-    count2 = z7.number().int().nonnegative();
-    reportSchema = z7.object({
-      version: z7.literal(1),
-      root: z7.string(),
-      gitAvailable: z7.literal(true),
+    count2 = z8.number().int().nonnegative();
+    reportSchema = z8.object({
+      version: z8.literal(1),
+      root: z8.string(),
+      gitAvailable: z8.literal(true),
       headHash: commitSchema.shape.hash,
-      checksRun: z7.array(checkSchema).nonempty(),
-      docs: z7.array(z7.object({
-        path: z7.string().refine((value) => normalizeRepoPath(value) === value),
-        scope: z7.string().optional(),
-        kind: z7.enum(["instructions", "readme"]).optional(),
+      checksRun: z8.array(checkSchema).nonempty(),
+      docs: z8.array(z8.object({
+        path: z8.string().refine((value) => normalizeRepoPath(value) === value),
+        scope: z8.string().optional(),
+        kind: z8.enum(["instructions", "readme", "guide"]).optional(),
         lastCommit: commitSchema.nullable(),
-        dirty: z7.boolean(),
+        dirty: z8.boolean(),
         lineCount: count2
       })).nonempty(),
-      decisionsChecked: z7.boolean(),
-      clean: z7.boolean(),
-      issues: z7.array(issueSchema),
-      advisories: z7.array(advisorySchema),
-      suppressedAdvisories: z7.array(advisorySchema).optional(),
-      skippedChecks: z7.array(z7.object({ check: z7.string(), reason: z7.string(), doc: z7.string().optional() }))
+      decisionsChecked: z8.boolean(),
+      clean: z8.boolean(),
+      excludedChecks: z8.array(z8.object({ check: checkSchema, doc: z8.string() })).optional(),
+      issues: z8.array(issueSchema),
+      advisories: z8.array(advisorySchema),
+      suppressedAdvisories: z8.array(advisorySchema).optional(),
+      skippedChecks: z8.array(z8.object({ check: z8.string(), reason: z8.string(), doc: z8.string().optional() }))
     });
-    baselineSchema = z7.object({
-      kind: z7.literal("mason-audit-repair"),
-      version: z7.literal(1),
-      createdAt: z7.string().datetime(),
+    baselineSchema = z8.object({
+      kind: z8.literal("mason-audit-repair"),
+      version: z8.literal(1),
+      createdAt: z8.string().datetime(),
       report: reportSchema,
-      digest: z7.string().regex(/^[a-f0-9]{64}$/)
+      digest: z8.string().regex(/^[a-f0-9]{64}$/)
     });
-    repairFindingSchema = z7.object({
-      id: z7.string(),
-      original: z7.union([issueSchema, advisorySchema]),
-      status: z7.enum(["resolved", "unresolved", "review-required", "unverified"]),
-      reason: z7.string(),
-      current: z7.union([issueSchema, advisorySchema]).optional(),
+    repairFindingSchema = z8.object({
+      id: z8.string(),
+      original: z8.union([issueSchema, advisorySchema]),
+      status: z8.enum(["resolved", "unresolved", "review-required", "unverified"]),
+      reason: z8.string(),
+      current: z8.union([issueSchema, advisorySchema]).optional(),
       review: reviewSummarySchema.optional()
     });
   }
@@ -3698,10 +3983,10 @@ var init_repair = __esm({
 
 // src/automation/evidence.ts
 import fs13 from "fs/promises";
-import path21 from "path";
+import path22 from "path";
 import { createHash as createHash3 } from "crypto";
-import fg5 from "fast-glob";
-import { z as z8 } from "zod";
+import fg7 from "fast-glob";
+import { z as z9 } from "zod";
 async function git3(root, ...args) {
   return profilePhase("automation.git", async () => (await execGit(args, { cwd: root, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 })).stdout);
 }
@@ -3718,6 +4003,11 @@ async function readInputs(root) {
 }
 async function collectInputs(root) {
   const docPaths = await discoverDocPaths(root);
+  const auditPolicy = (await loadProjectConfig(root)).audit;
+  const allowed = /* @__PURE__ */ new Map();
+  for (const name of ["deleted-reference", "new-module", "stale-count", "dead-command"]) {
+    allowed.set(name, await includedCheckPaths(root, docPaths, auditPolicy?.exclude?.[name] ?? []));
+  }
   const [headText, docStatus, shallowPath, replacements] = await Promise.all([
     git3(root, "rev-parse", "HEAD"),
     docPaths.length ? git3(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...docPaths.map((p) => `:(literal)${p}`)) : "",
@@ -3727,7 +4017,7 @@ async function collectInputs(root) {
   const head = headText.trim();
   let shallow = null;
   try {
-    shallow = await fs13.readFile(path21.resolve(root, shallowPath.trim()), "utf8");
+    shallow = await fs13.readFile(path22.resolve(root, shallowPath.trim()), "utf8");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
@@ -3746,18 +4036,18 @@ async function collectInputs(root) {
     docContents.push([file, text2]);
     const parsed = { path: file, content: text2 ?? "", claims: extractClaims(text2 ?? "") };
     parsedDocs.push(parsed);
-    for (const claim of parsed.claims.paths) {
+    for (const claim of allowed.get("deleted-reference").has(file) ? parsed.claims.paths : []) {
       const scope = pathClaimScope(file, claim);
       if (scope?.candidates.some(gitMetadataPath)) continue;
       for (const candidate of scope?.candidates ?? []) {
         if (optionalMasonPath(candidate)) continue;
-        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path21.posix.dirname(candidate))]);
+        const [filePresent, parentPresent] = await Promise.all([exists(candidate), exists(path22.posix.dirname(candidate))]);
         claims.push([candidate, filePresent, parentPresent]);
       }
     }
   }
-  const combinedDocs = moduleDocumentation(parsedDocs);
-  const countClaims = parsedDocs.flatMap((doc) => doc.claims.counts.map((claim) => ({ doc: doc.path, claim })));
+  const combinedDocs = moduleDocumentation(parsedDocs.filter((doc) => allowed.get("new-module").has(doc.path)));
+  const countClaims = parsedDocs.filter((doc) => allowed.get("stale-count").has(doc.path)).flatMap((doc) => doc.claims.counts.map((claim) => ({ doc: doc.path, claim })));
   const decisionDirectory = await storePath(root, ".mason/decisions");
   const decisionPresence = await fs13.lstat(decisionDirectory).then((stat) => stat.isDirectory() ? "directory" : "file", (error) => {
     if (error.code === "ENOENT") return "absent";
@@ -3766,8 +4056,8 @@ async function collectInputs(root) {
   const [modules, counts, commands2, decisionFiles] = await Promise.all([
     combinedDocs ? moduleCandidates(root, combinedDocs) : [],
     Promise.all(countClaims.map(({ doc, claim }) => resolveDocCountSource(root, doc, claim))),
-    commandInputs(root, parsedDocs),
-    fg5(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
+    commandInputs(root, parsedDocs.filter((doc) => allowed.get("dead-command").has(doc.path))),
+    fg7(".mason/decisions/*.json", { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false })
   ]);
   const decisions = await Promise.all(decisionFiles.sort().map(async (file) => {
     await storePath(root, file);
@@ -3777,7 +4067,7 @@ async function collectInputs(root) {
     git3(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".", ":(exclude).mason/reports"),
     git3(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
   ]) : ["", ""];
-  const common = [6, engineVersion, head, shallow, replacements, docContents];
+  const common = [7, engineVersion, head, shallow, replacements, docContents, auditPolicy];
   const keys = {
     "deleted-reference": hash([common, claims, docStatus]),
     "new-module": hash([common, modules]),
@@ -3824,6 +4114,8 @@ var engineVersion, hash, content, cacheSchema;
 var init_evidence = __esm({
   "src/automation/evidence.ts"() {
     "use strict";
+    init_policy();
+    init_files();
     init_git_read();
     init_profile();
     init_docs();
@@ -3837,10 +4129,10 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     init_advisory_review();
-    engineVersion = true ? "0.19.0" : "development";
+    engineVersion = true ? "0.19.2" : "development";
     hash = (value) => createHash3("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
-    cacheSchema = z8.object({ version: z8.literal(1), entries: z8.record(z8.object({ key: z8.string(), result: checkResultSchema })), digest: z8.string() });
+    cacheSchema = z9.object({ version: z9.literal(1), entries: z9.record(z9.object({ key: z9.string(), result: checkResultSchema })), digest: z9.string() });
   }
 });
 
@@ -3856,9 +4148,9 @@ __export(model_exports, {
   setupHostSchema: () => setupHostSchema,
   setupSchema: () => setupSchema
 });
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 import fs14 from "fs/promises";
-import path22 from "path";
+import path23 from "path";
 async function loadSetup(root) {
   const raw = await readStoreJson(root, SETUP_PATH);
   if (raw === null) return null;
@@ -3867,7 +4159,7 @@ async function loadSetup(root) {
 async function effectiveSetup(root) {
   const local = await loadSetup(root);
   if (local) return { root, setup: local };
-  const common = await fs14.realpath(path22.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim()));
+  const common = await fs14.realpath(path23.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim()));
   const own = await fs14.realpath((await git3(root, "rev-parse", "--absolute-git-dir")).trim());
   if (common === own) return { root, setup: null };
   const primary = (await git3(root, "worktree", "list", "--porcelain", "-z")).split("\0\0")[0].split("\0");
@@ -3880,7 +4172,7 @@ async function effectiveSetup(root) {
     if (/must be run in a work tree/.test(String(error.stderr))) return { root, setup: null };
     throw error;
   }
-  const inheritedCommon = await fs14.realpath(path22.resolve(
+  const inheritedCommon = await fs14.realpath(path23.resolve(
     inheritedRoot,
     (await git3(inheritedRoot, "rev-parse", "--git-common-dir")).trim()
   ));
@@ -3903,29 +4195,29 @@ var init_model = __esm({
     "use strict";
     init_evidence();
     init_storage();
-    setupHostSchema = z9.object({
-      configuredVersion: z9.string(),
-      revision: z9.string().uuid(),
-      fingerprint: z9.string(),
-      mcpFingerprint: z9.string(),
-      instructions: z9.array(z9.string())
+    setupHostSchema = z10.object({
+      configuredVersion: z10.string(),
+      revision: z10.string().uuid(),
+      fingerprint: z10.string(),
+      mcpFingerprint: z10.string(),
+      instructions: z10.array(z10.string())
     });
-    setupSchema = z9.object({ version: z9.literal(2), hosts: z9.object({
+    setupSchema = z10.object({ version: z10.literal(2), hosts: z10.object({
       codex: setupHostSchema.optional(),
       claude: setupHostSchema.optional()
     }) });
     SETUP_PATH = ".mason/local/setup.json";
     INACTIVE_HOSTS_PATH = ".mason/local/inactive-hosts.json";
-    inactiveHostsSchema = z9.object({ version: z9.literal(1), hosts: z9.array(z9.enum(["claude", "codex"])) });
-    receiptSchema = z9.object({
-      version: z9.literal(1),
-      host: z9.enum(["codex", "claude"]),
-      status: z9.enum(["installing", "configured"]),
-      initialReportPath: z9.string(),
-      initialBaselinePaths: z9.array(z9.string()),
-      root: z9.string(),
-      revision: z9.string().uuid(),
-      configuredAt: z9.string().optional()
+    inactiveHostsSchema = z10.object({ version: z10.literal(1), hosts: z10.array(z10.enum(["claude", "codex"])) });
+    receiptSchema = z10.object({
+      version: z10.literal(1),
+      host: z10.enum(["codex", "claude"]),
+      status: z10.enum(["installing", "configured"]),
+      initialReportPath: z10.string(),
+      initialBaselinePaths: z10.array(z10.string()),
+      root: z10.string(),
+      revision: z10.string().uuid(),
+      configuredAt: z10.string().optional()
     });
   }
 });
@@ -3963,7 +4255,7 @@ var init_launcher = __esm({
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.19.0" : "development";
+    executingVersion = () => true ? "0.19.2" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
     hookCommand = (host) => `mason --setup-host ${host} auto`;
   }
@@ -4089,7 +4381,7 @@ __export(files_exports, {
   readText: () => readText
 });
 import fs18 from "fs/promises";
-import path26 from "path";
+import path27 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 async function readText(root, file) {
   try {
@@ -4122,7 +4414,7 @@ async function applyEdit(root, edit) {
     return true;
   }
   const file = await storePath(root, edit.path, true);
-  const temporary = path26.join(path26.dirname(file), ".mason-setup-" + randomUUID3() + ".tmp");
+  const temporary = path27.join(path27.dirname(file), ".mason-setup-" + randomUUID3() + ".tmp");
   try {
     const mode = await fs18.stat(file).then((s) => s.mode & 511, () => 384);
     const handle = await fs18.open(temporary, "wx", mode);
@@ -4160,7 +4452,7 @@ __export(execution_exports, {
 import os2 from "os";
 import fs19 from "fs/promises";
 import { randomUUID as randomUUID4 } from "crypto";
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function parseExecution(raw) {
   try {
     return executionSchema.parse(raw);
@@ -4178,7 +4470,7 @@ function automationFailure(error) {
     codes.add(String(cause.code));
     cause = cause.cause;
   }
-  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message2) ? "inputs-changed" : /Automation is busy/.test(message2) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message2) ? "history-unavailable" : error instanceof z12.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message2) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message2) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
+  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message2) ? "inputs-changed" : /Automation is busy/.test(message2) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(message2) ? "history-unavailable" : error instanceof z13.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message2) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(message2) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
   return { code, message: message2, retryable: ["inputs-changed", "storage-full", "busy", "io-error"].includes(code), receiptRecorded: false };
 }
 function failureMessage(error) {
@@ -4307,38 +4599,100 @@ var init_execution = __esm({
     init_store();
     init_evidence();
     init_storage();
-    failureSchema = z12.object({
-      code: z12.enum(["inputs-changed", "storage-full", "busy", "invalid-input", "history-unavailable", "invalid-evidence", "io-error", "internal"]),
-      message: z12.string(),
-      retryable: z12.boolean(),
-      receiptRecorded: z12.boolean()
+    failureSchema = z13.object({
+      code: z13.enum(["inputs-changed", "storage-full", "busy", "invalid-input", "history-unavailable", "invalid-evidence", "io-error", "internal"]),
+      message: z13.string(),
+      retryable: z13.boolean(),
+      receiptRecorded: z13.boolean()
     });
-    attemptSchema = z12.object({
-      id: z12.string().regex(/^[a-zA-Z0-9_-]+$/),
-      lease: z12.literal(true).optional(),
-      event: z12.string(),
-      startedAt: z12.string(),
-      finishedAt: z12.string().optional(),
-      durationMs: z12.number().nonnegative().optional(),
-      pid: z12.number().int().positive(),
-      host: z12.string(),
-      status: z12.enum(["running", "completed", "failed", "unknown"]),
-      verificationStatus: z12.string().optional(),
-      reportPath: z12.string().optional(),
+    attemptSchema = z13.object({
+      id: z13.string().regex(/^[a-zA-Z0-9_-]+$/),
+      lease: z13.literal(true).optional(),
+      event: z13.string(),
+      startedAt: z13.string(),
+      finishedAt: z13.string().optional(),
+      durationMs: z13.number().nonnegative().optional(),
+      pid: z13.number().int().positive(),
+      host: z13.string(),
+      status: z13.enum(["running", "completed", "failed", "unknown"]),
+      verificationStatus: z13.string().optional(),
+      reportPath: z13.string().optional(),
       failure: failureSchema.optional()
     });
-    executionSchema = z12.object({ version: z12.literal(1), attempts: z12.array(attemptSchema).max(160), discardedAttempts: z12.number().int().nonnegative().default(0) });
-    notificationsSchema = z12.object({ version: z12.literal(1), sessions: z12.record(z12.object({
-      signature: z12.string(),
+    executionSchema = z13.object({ version: z13.literal(1), attempts: z13.array(attemptSchema).max(160), discardedAttempts: z13.number().int().nonnegative().default(0) });
+    notificationsSchema = z13.object({ version: z13.literal(1), sessions: z13.record(z13.object({
+      signature: z13.string(),
       code: failureSchema.shape.code,
-      message: z12.string(),
-      count: z12.number().int().positive(),
-      lastAt: z12.string()
+      message: z13.string(),
+      count: z13.number().int().positive(),
+      lastAt: z13.string()
     })) });
     leasePath = (directory, id) => `${directory}/executions/${id}.json`;
   }
 });
 
+// src/decisions/pending.ts
+var pending_exports = {};
+__export(pending_exports, {
+  pendingKnowledge: () => pendingKnowledge
+});
+async function pendingKnowledge(root, now = Date.now()) {
+  try {
+    const [store, status] = await Promise.all([
+      loadDecisionStore(root),
+      execGit(
+        ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".mason/decisions"],
+        { cwd: root, timeout: 1e4, maxBuffer: 1024 * 1024 }
+      )
+    ]);
+    const changed = /* @__PURE__ */ new Set();
+    const entries = status.stdout.split("\0");
+    for (let i = 0; i < entries.length; i++) {
+      const entry = entries[i];
+      if (!entry) continue;
+      const file = entry.slice(3);
+      if (/^\.mason\/decisions\/[^/]+\.json$/.test(file)) changed.add(file);
+      if (/[RC]/.test(entry.slice(0, 2))) i++;
+    }
+    const records = new Map(store.records.map((record) => [`.mason/decisions/${record.id}.json`, record]));
+    const age = (at) => {
+      const time = at ? Date.parse(at) : NaN;
+      return Number.isFinite(time) ? `${Math.max(0, Math.floor((now - time) / 864e5))} days` : "unknown age";
+    };
+    const safe = (value) => value.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ");
+    const list = (items) => items.slice(0, 5).map(safe).join("; ") + (items.length > 5 ? `; ${items.length - 5} more` : "");
+    const proposals = store.records.filter((record) => record.status === "active" && decisionApproval(record) === "proposed").map((record) => {
+      const history = record.version === 2 ? record.history : [];
+      let lastReview = -1;
+      history.forEach((event, index2) => {
+        if (event.kind === "accepted" || event.kind === "reaffirmed") lastReview = index2;
+      });
+      const since = history.slice(lastReview + 1).find((event) => event.kind === "created" || event.kind === "revised")?.at ?? record.createdAt;
+      return { record, since };
+    }).sort((a, b) => {
+      const timestamp = (value) => Number.isFinite(Date.parse(value)) ? Date.parse(value) : Infinity;
+      return timestamp(a.since) - timestamp(b.since) || a.record.id.localeCompare(b.record.id);
+    });
+    const lines = [];
+    if (changed.size) lines.push(`${changed.size} uncommitted decision record(s): ${list([...changed].sort().map((file) => `${file} (saved-record age: ${age(records.get(file)?.updatedAt)})`))}.`);
+    if (proposals.length) lines.push(`${proposals.length} proposal(s) awaiting review (oldest first): ${list(proposals.map(({ record, since }) => `.mason/decisions/${record.id}.json (${age(since)})`))}.`);
+    if (store.diagnostics.length) lines.push(`${store.diagnostics.length} decision record(s) could not be read; pending knowledge summary is incomplete.`);
+    return lines.length ? `Mason pending knowledge:
+${lines.join("\n")}
+Informational only; review and commit through the normal project workflow. No approval is implied.` : null;
+  } catch {
+    return "Mason pending knowledge: unavailable; decision records or Git status could not be read.";
+  }
+}
+var init_pending = __esm({
+  "src/decisions/pending.ts"() {
+    "use strict";
+    init_git_read();
+    init_decisions();
+    init_provenance();
+  }
+});
+
 // src/automation/runtime.ts
 var runtime_exports = {};
 __export(runtime_exports, {
@@ -4348,7 +4702,7 @@ __export(runtime_exports, {
   summarize: () => summarize
 });
 import { randomUUID as randomUUID5 } from "crypto";
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 async function observeReadOnlyTool(dir, event) {
   const ws = await profilePhase("automation.workspace", () => workspace(dir));
   await withLock(ws.root, ws.directory, async () => {
@@ -4570,6 +4924,19 @@ async function automate(dir, event) {
       const state = await loadState(ws);
       if (state.analysis?.id !== result.analysis.id) throw new Error("Automation evidence changed during publication; retry against the current inputs.");
       const report = structuredClone(result.analysis.report);
+      if (!state.notifications) {
+        let baseline = { findings: report.findings, head: report.head };
+        if (state.latest) {
+          try {
+            const previous = z14.object({ findings: z14.array(repairFindingSchema), head: z14.string() }).safeParse(await readStoreJson(ws.root, state.latest));
+            if (!previous.success) throw new Error("Unsupported saved report");
+            baseline = previous.data;
+          } catch {
+            report.diagnostics.push("The saved notification baseline could not be read; initialized from the current audit. Original repair evidence is retained. Run an explicit check for all outstanding findings.");
+          }
+        }
+        state.notifications = createNotificationState(baseline.findings, baseline.head);
+      }
       if (result.shared) report.checks = { ...report.checks, ran: [], reused: [.../* @__PURE__ */ new Set([...report.checks.ran, ...report.checks.reused])], shared: true };
       report.reportPath = ws.directory + "/checks/" + randomUUID5() + ".json";
       const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -4582,12 +4949,8 @@ async function automate(dir, event) {
         if (Object.keys(state.sessions).length >= 128) throw new Error("Too many sessions with unfinished tool calls; original evidence was retained.");
         state.sessions[key] = {
           host: event.host,
-          seen: null,
-          continued: false,
-          initialIssues: report.findings.filter((f) => f.status === "unresolved").map((f) => f.id),
-          initialDocs: inputs.docs,
+          notifiedDiagnostics: [],
           lastUsed: now,
-          mutationObserved: false,
           pending: {},
           coverageGaps: [],
           events: {}
@@ -4602,7 +4965,6 @@ async function automate(dir, event) {
           session.pending[event.toolId] = inputs.fingerprint;
         }
         if (event.event === "after_tool" && event.mutating) {
-          session.mutationObserved = true;
           if (!event.toolId || !session.pending[event.toolId]) {
             const gap = "A tool completed without an observed matching pre-tool capture in this checkout; pre-edit coverage is unknown. The tool may have changed checkouts; captures are kept separately for each worktree.";
             if (!session.coverageGaps.includes(gap)) session.coverageGaps.push(gap);
@@ -4613,31 +4975,39 @@ async function automate(dir, event) {
         if (session.coverageGaps.length && report.status !== "unavailable") report.status = "incomplete";
         report.capture = report.status !== "unavailable" && !session.coverageGaps.length && (session.events.session_start || session.events.before_tool) ? "observed" : "unknown";
       }
-      const signature = hash([report.status, report.findings, report.diagnostics, report.checks.skipped]);
-      const relevant = report.findings.some((f) => f.status === "unresolved" && session && (!session.initialIssues.includes(f.id) || session.initialDocs[f.original.anchor.doc] !== inputs.docs[f.original.anchor.doc]));
-      const continueOnce = event.event === "task_end" && !!session?.mutationObserved && relevant && !session.continued && !event.stopHookActive;
-      const notify = !session || newSession || signature !== session.seen || continueOnce;
-      if (session) {
-        session.seen = signature;
-        if (continueOnce) session.continued = true;
-      }
-      const persistReport = !state.latest || state.fingerprint !== inputs.fingerprint || notify || event.event === "task_end";
+      const selected = session && event.event === "task_end" ? completionFindings(state.notifications, report.findings) : [];
+      state.agentNotifications ??= { ...structuredClone(state.notifications), delivered: {} };
+      const feedback = session && ["turn_start", "after_tool"].includes(event.event) ? completionFindings(state.agentNotifications, report.findings) : [];
+      const diagnostics = session ? report.diagnostics.filter((d) => !session.notifiedDiagnostics.includes(d)).slice(0, 2) : [];
+      if (session) session.notifiedDiagnostics = [.../* @__PURE__ */ new Set([
+        ...session.notifiedDiagnostics.filter((d) => report.diagnostics.includes(d)),
+        ...diagnostics
+      ])];
+      const message2 = !session ? summarize(report) : [
+        completionSummary(selected, report.reportPath),
+        completionSummary(feedback, report.reportPath),
+        ...diagnostics.length ? [`Mason: verification limited. ${diagnostics.slice(0, 2).map(cleanText).join(" ")} Evidence: ${report.reportPath}.`] : []
+      ].filter(Boolean).join("\n") || null;
+      const notify = message2 !== null;
+      const persistReport = !state.latest || state.fingerprint !== inputs.fingerprint || notify || newSession || event.event === "task_end";
       if (!persistReport) report.reportPath = state.latest;
       state.updatedAt = now;
       state.fingerprint = inputs.fingerprint;
       state.latest = report.reportPath;
       if (persistReport) await writeStoreJson(ws.root, report.reportPath, report);
       await writeStoreJson(ws.root, ws.directory + "/state.json", state);
-      return { report, message: notify ? summarize(report) : null, continueOnce };
+      return { report, message: message2 };
     }));
   }));
 }
 async function automationStatus(dir) {
+  const { pendingKnowledge: pendingKnowledge2 } = await Promise.resolve().then(() => (init_pending(), pending_exports));
   const ws = await profilePhase("automation.workspace", () => workspace(dir));
+  const knowledge = await pendingKnowledge2(ws.root);
   const execution = await executionStatus(ws.root, ws.directory);
   const notifications = await failureNotifications(ws.root, ws.directory);
   const raw = await readStoreJson(ws.root, ws.directory + "/state.json");
-  if (raw === null) return { version: 1, status: execution.status === "not-observed" ? "not-observed" : "unavailable", root: ws.root, branch: ws.branch, baselinePaths: [], hosts: {}, execution, notifications };
+  if (raw === null) return { version: 1, status: execution.status === "not-observed" ? "not-observed" : "unavailable", root: ws.root, branch: ws.branch, baselinePaths: [], hosts: {}, execution, notifications, knowledge };
   const state = parseState(raw);
   if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch) throw new Error("Automation state belongs to another workspace.");
   const inputs = await readInputs(ws.root);
@@ -4660,6 +5030,8 @@ async function automationStatus(dir) {
     hosts,
     execution,
     notifications,
+    knowledge,
+    notificationBaselineHead: state.notifications?.baselineHead ?? null,
     note: "Observed events do not prove all tool paths are intercepted. Run check to verify the retained evidence."
   };
 }
@@ -4667,6 +5039,7 @@ var SCOPE, priority, cleanText, analysisSchema, sharedSchema, baselineDigest;
 var init_runtime = __esm({
   "src/automation/runtime.ts"() {
     "use strict";
+    init_notifications();
     init_profile();
     init_inspection();
     init_execution();
@@ -4678,34 +5051,34 @@ var init_runtime = __esm({
     SCOPE = "Documentation audit evidence only. Hook receipts show observed events, not complete interception. Resolved findings no longer fail their checks or have a recorded assessment covering current evidence. Repair and review only within the user's task authorization.";
     priority = { resolved: 0, "review-required": 1, unresolved: 2, unverified: 3 };
     cleanText = (text2) => text2.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 250);
-    analysisSchema = z13.object({
-      id: z13.string(),
-      fingerprint: z13.string(),
-      completedAt: z13.number(),
-      baselineDigest: z13.string(),
+    analysisSchema = z14.object({
+      id: z14.string(),
+      fingerprint: z14.string(),
+      completedAt: z14.number(),
+      baselineDigest: z14.string(),
       currentAudit: reportSchema.nullable().optional(),
-      report: z13.object({
-        version: z13.literal(1),
-        status: z13.enum(["verified", "issues-remain", "incomplete", "unavailable"]),
-        root: z13.string(),
-        branch: z13.string(),
-        head: z13.string(),
-        baselinePaths: z13.array(z13.string()),
-        reportPath: z13.string(),
-        findings: z13.array(repairFindingSchema),
-        diagnostics: z13.array(z13.string()),
-        checks: z13.object({
-          ran: z13.array(z13.string()),
-          reused: z13.array(z13.string()),
-          skipped: z13.array(z13.object({ check: z13.string(), reason: z13.string(), doc: z13.string().optional() })),
-          auditReused: z13.boolean().optional()
+      report: z14.object({
+        version: z14.literal(1),
+        status: z14.enum(["verified", "issues-remain", "incomplete", "unavailable"]),
+        root: z14.string(),
+        branch: z14.string(),
+        head: z14.string(),
+        baselinePaths: z14.array(z14.string()),
+        reportPath: z14.string(),
+        findings: z14.array(repairFindingSchema),
+        diagnostics: z14.array(z14.string()),
+        checks: z14.object({
+          ran: z14.array(z14.string()),
+          reused: z14.array(z14.string()),
+          skipped: z14.array(z14.object({ check: z14.string(), reason: z14.string(), doc: z14.string().optional() })),
+          auditReused: z14.boolean().optional()
         }),
-        counts: z13.object({ resolved: z13.number(), unresolved: z13.number(), "review-required": z13.number(), unverified: z13.number() }),
-        capture: z13.enum(["observed", "unknown"]),
-        scope: z13.string()
+        counts: z14.object({ resolved: z14.number(), unresolved: z14.number(), "review-required": z14.number(), unverified: z14.number() }),
+        capture: z14.enum(["observed", "unknown"]),
+        scope: z14.string()
       })
     });
-    sharedSchema = z13.object({ analysis: analysisSchema, digest: z13.string() });
+    sharedSchema = z14.object({ analysis: analysisSchema, digest: z14.string() });
     baselineDigest = async (ws, state) => profilePhase("automation.baselines", async () => hash(await Promise.all(
       state.baselines.map(async (b) => [b.path, await readStoreJson(ws.root, b.path)])
     )));
@@ -4714,7 +5087,7 @@ var init_runtime = __esm({
 
 // src/automation/hook-root.ts
 import fs20 from "fs/promises";
-import path27 from "path";
+import path28 from "path";
 var init_hook_root = __esm({
   "src/automation/hook-root.ts"() {
     "use strict";
@@ -4723,7 +5096,7 @@ var init_hook_root = __esm({
 });
 
 // src/automation/adapters.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 function managedHookCommand(host, platform = process.platform) {
   const command = `mason --setup-host ${host} auto hook --host ${host}`;
   return platform === "win32" ? `cmd.exe /d /s /c "where mason >nul 2>nul & if errorlevel 1 (exit /b 0) else (${command})"` : `if command -v mason >/dev/null 2>&1; then ${command}; fi`;
@@ -4749,15 +5122,15 @@ var init_adapters = __esm({
     init_runtime();
     init_store();
     init_hook_root();
-    inputSchema = z14.object({
-      cwd: z14.string().min(1),
-      session_id: z14.string().min(1).max(500),
-      hook_event_name: z14.enum(["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"]),
-      tool_name: z14.string().optional(),
-      tool_use_id: z14.string().max(500).optional(),
-      tool_input: z14.unknown().optional(),
-      stop_hook_active: z14.boolean().optional(),
-      permission_mode: z14.string().optional()
+    inputSchema = z15.object({
+      cwd: z15.string().min(1),
+      session_id: z15.string().min(1).max(500),
+      hook_event_name: z15.enum(["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"]),
+      tool_name: z15.string().optional(),
+      tool_use_id: z15.string().max(500).optional(),
+      tool_input: z15.unknown().optional(),
+      stop_hook_active: z15.boolean().optional(),
+      permission_mode: z15.string().optional()
     });
     HOOK_EVENTS = ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"];
   }
@@ -4773,7 +5146,7 @@ __export(ownership_exports, {
   ownershipEdit: () => ownershipEdit,
   ownershipSchema: () => ownershipSchema
 });
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 import { parse } from "smol-toml";
 function blockSpan(text2, start, end) {
   const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
@@ -4824,15 +5197,15 @@ var init_ownership = __esm({
       ["<!-- mason:agents:start -->", "<!-- mason:agents:end -->"],
       ["# mason:mcp:start", "# mason:mcp:end"]
     ];
-    fileSchema = z15.object({
-      created: z15.boolean(),
-      initialHash: z15.string(),
-      blocks: z15.record(z15.string()),
-      mcpHash: z15.string().optional(),
-      hookCommands: z15.array(z15.string()).optional(),
-      hooks: z15.record(z15.array(z15.string())).optional()
+    fileSchema = z16.object({
+      created: z16.boolean(),
+      initialHash: z16.string(),
+      blocks: z16.record(z16.string()),
+      mcpHash: z16.string().optional(),
+      hookCommands: z16.array(z16.string()).optional(),
+      hooks: z16.record(z16.array(z16.string())).optional()
     });
-    ownershipSchema = z15.object({ version: z15.literal(1), files: z15.record(fileSchema) });
+    ownershipSchema = z16.object({ version: z16.literal(1), files: z16.record(fileSchema) });
   }
 });
 
@@ -4847,7 +5220,7 @@ __export(install_exports, {
   planAutomationInstall: () => planAutomationInstall,
   recordSchema: () => recordSchema2
 });
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 async function installationRecord(root) {
   return recordSchema2.parse(await readStoreJson(root, AUTOMATION_PATH) ?? { version: 1, hosts: {} });
 }
@@ -4928,9 +5301,9 @@ var init_install = __esm({
     init_store();
     init_files2();
     init_ownership();
-    groupSchema = z16.object({ hooks: z16.array(z16.object({ type: z16.string(), command: z16.string().optional() }).passthrough()) }).passthrough();
-    automationConfigSchema = z16.object({ hooks: z16.record(z16.array(groupSchema)).optional() }).passthrough();
-    recordSchema2 = z16.object({ version: z16.literal(1), hosts: z16.record(z16.object({ command: z16.string() })) });
+    groupSchema = z17.object({ hooks: z17.array(z17.object({ type: z17.string(), command: z17.string().optional() }).passthrough()) }).passthrough();
+    automationConfigSchema = z17.object({ hooks: z17.record(z17.array(groupSchema)).optional() }).passthrough();
+    recordSchema2 = z17.object({ version: z17.literal(1), hosts: z17.record(z17.object({ command: z17.string() })) });
     AUTOMATION_PATH = ".mason/local/automation.json";
     configPath = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
   }
@@ -4948,7 +5321,7 @@ __export(config_exports, {
 });
 import { isDeepStrictEqual } from "util";
 import { parse as parse2, stringify } from "smol-toml";
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 async function instructionEdits(root, host) {
   const found = await Promise.all(DOC_CANDIDATES.map(async (file) => ({ path: file, text: await readText(root, file) })));
   const existing = found.find((f) => f.text !== null);
@@ -5059,7 +5432,7 @@ var init_config = __esm({
     init_install();
     init_files2();
     init_launcher();
-    object = z17.record(z17.unknown());
+    object = z18.record(z18.unknown());
     mcpPath = (host) => host === "codex" ? ".codex/config.toml" : ".mcp.json";
     TOML_START = "# mason:mcp:start";
     TOML_END = "# mason:mcp:end";
@@ -5069,7 +5442,7 @@ var init_config = __esm({
 });
 
 // src/mcp/init.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 async function loadProjectMarker(rootDir) {
   const raw = await readStoreJson(rootDir, ".mason/local/project.json");
   if (raw === null) return null;
@@ -5077,8 +5450,8 @@ async function loadProjectMarker(rootDir) {
   return { ...marker, features: await loadProjectFeatures(rootDir) };
 }
 async function loadProjectFeatures(rootDir) {
-  const config = z18.record(z18.unknown()).parse(await readStoreJson(rootDir, ".mason/config.json") ?? {});
-  return z18.object({ confluence: z18.boolean().optional() }).passthrough().parse(config.features ?? {});
+  const config = z19.record(z19.unknown()).parse(await readStoreJson(rootDir, ".mason/config.json") ?? {});
+  return z19.object({ confluence: z19.boolean().optional() }).passthrough().parse(config.features ?? {});
 }
 async function saveProjectMarker(rootDir, marker) {
   const { ancillaryEdits: ancillaryEdits2 } = await Promise.resolve().then(() => (init_config(), config_exports));
@@ -5090,8 +5463,8 @@ async function projectMarkerEdits(rootDir, marker) {
   const edits = [{ path: file, before: await readText(rootDir, file), after: JSON.stringify(local, null, 2) + "\n" }];
   if (features && Object.keys(features).length) {
     const configPath2 = ".mason/config.json", before = await readText(rootDir, configPath2);
-    const config = z18.record(z18.unknown()).parse(JSON.parse(before ?? "{}"));
-    config.features = { ...z18.record(z18.unknown()).parse(config.features ?? {}), ...features };
+    const config = z19.record(z19.unknown()).parse(JSON.parse(before ?? "{}"));
+    config.features = { ...z19.record(z19.unknown()).parse(config.features ?? {}), ...features };
     edits.push({ path: configPath2, before, after: JSON.stringify(config, null, 2) + "\n" });
   }
   return edits;
@@ -5105,10 +5478,10 @@ var init_init = __esm({
     "use strict";
     init_storage();
     init_files2();
-    markerSchema = z18.object({
-      version: z18.literal(1),
-      initializedAt: z18.string(),
-      features: z18.object({ confluence: z18.boolean().optional() }).passthrough().optional()
+    markerSchema = z19.object({
+      version: z19.literal(1),
+      initializedAt: z19.string(),
+      features: z19.object({ confluence: z19.boolean().optional() }).passthrough().optional()
     }).passthrough();
     CLAUDE_MD_SECTION = `<!-- mason:start -->
 ## Mason project knowledge
@@ -5117,16 +5490,19 @@ Mason provides recorded decisions and file impact over MCP. A concept map is opt
 
 - Task, bug, change request, or investigation of why the project works this way \u2192 \`get_context\` with the task text and known files: matching decisions, related tests, impact, and any available map entries.
 - Before editing a file \u2192 \`get_impact\` to check references, tests, and historical change partners.
-- Investigation or correction reveals a reusable project lesson \u2192 \`save_decision\` before finishing. Capture only the lasting constraint and reason, with anchors and known sources, owner, and recorder. This creates a proposal; never infer approval. Preserve uncertain causes and unknown attribution. Route project lessons here; keep personal preferences in agent memory. Skip code summaries, current checkout status, temporary task permissions, session trivia, and secrets. No qualifying lesson means no record.
+- Investigation or correction reveals a reusable project lesson \u2192 \`save_decision\` as soon as the lesson is supported by evidence; do not wait for implementation, task completion, or merge. Record the established observation now and identify unimplemented remedies as tentative. Capture only the lasting constraint and reason, with anchors and known sources, owner, and recorder. This creates a proposal; never infer approval. Preserve uncertain causes and unknown attribution. Route project lessons here; keep personal preferences in agent memory. Skip code summaries, current checkout status, temporary task permissions, session trivia, and secrets. No qualifying lesson means no record.
 - Before saving, compare the lesson with matching \`get_context\` records and any pending proposal. If new evidence changes the same lesson's assumptions, scope, or recommended action, revise it with \`save_decision(id: existingId)\`, including when it is accepted. Preserve supported rationale and sources, replace obsolete instructions, and add the new evidence. Create a separate record for a genuinely distinct lesson; skip unchanged restatements. Revision preserves history and leaves the accepted version operative until authorized review.
 - Consult trust metadata before relying on entries: unknown or changed freshness requires inspection, stale or unknown map verification requires a fresh evidence review, and a recorded failed verdict means the description must be corrected. Check approval too: proposals are suggestions, legacy records are unreviewed, and accepted decisions are recorded constraints subject to freshness checks. An accepted revision remains operative while a pending proposal is reviewed; keep both versions and their freshness distinct.
+- Asked to review pending project knowledge \u2192 \`mason_automation(action: "status")\` lists pending proposals and uncommitted records. For ordinary tasks, inspect matching proposals through \`get_context\`; do not request acceptance merely because a proposal exists.
 - Asked to review or re-verify a decision \u2192 \`review_decision\` first to inspect content, sources, history, and code changes. Record acceptance, reaffirmation, or retirement only when authorized by the user or a cited team review, with the actual reviewer and reason. Never infer approval from unchanged code. Review and commit the local record through the normal project workflow.
 - For an architectural overview, use \`get_snapshot\` if a map is available. If \`map.status\` is missing or invalid, use available decisions and source evidence; do not start building a map unless requested.
 - \`mason_init\` returns documentation audit and committed-diff review results, plus a short setup guide. Pass \`evidence\` with local CI manifest paths to include test and analysis results; the CLI equivalent is \`mason-review --evidence <manifest>\`. State skipped, unavailable, stale, or unknown checks explicitly. Related accepted decisions identify review context, not proven violations.
 
-- When documentation repair is authorized, use \`mason_repair(action: "prepare")\` before edits, keep its baselinePath, and use \`mason_repair(action: "verify", baselinePath)\` after edits and any final doc commit. Report every original finding's outcome and any new findings. Suppressed advisories remain unresolved; editing a doc does not approve it.
+- When documentation repair is authorized, use \`mason_repair(action: "prepare")\` before edits, keep its baselinePath, and use \`mason_repair(action: "verify", baselinePath)\` after edits and any final doc commit. Report every original finding's outcome and any new findings. Specific suppressed advisories remain unresolved; editing a doc does not approve it. Informational dependency notices require no review.
 - When advisory assessment is authorized, use \`review_advisory(action: "prepare", baselinePath, findingId)\` to inspect original evidence and history. Record \`addressed\`, \`inapplicable\`, or \`deferred\` with the actual reviewer, reason in note, and returned reviewToken only after relevant edits are committed. Commit the assessment and verify the same baseline again. Relevant evidence changes reopen it; deferral stays outstanding. Decision findings use \`review_decision\`; advisory closure never approves a decision.
 
+- For a dependency advisory, \`review_advisory(action: "dismiss", baselinePath, findingId, reasonCode, note)\` records a one-step dismissal without reviewer or token. Use \`no-dependency-claims\` for a document with no dependency claims (reopens on document content changes), or \`unrelated-manifest-change\` for reviewed changes that do not affect its guidance (reopens on document or manifest changes). Keep the relevant scope committed; commit the dismissal to share it. This never approves a decision.
+
 - When Mason automation is installed, use \`mason_automation(action: "status")\` to inspect configured hooks and observed events, and \`mason_automation(action: "check")\` to resume its retained repair evidence. CLI fallback: \`mason-auto status\` / \`mason-auto check\`. Preserve existing baselines across sessions. Automatic checks do not authorize unrelated repairs or approve advisories.
 
 Inspect source for what the retrieved context does not answer.
@@ -5141,7 +5517,7 @@ ${CLAUDE_MD_SECTION}`;
 
 1. Explain the actionable findings with their source evidence. Separate audit issues, advisories, and skipped checks. The review covers committed changes from the merge base to HEAD; workingTree paths are not included in that review. An unavailable or empty check is not proof that the project is correct. Use the CLI for full output if a summary is truncated.
 2. Address findings within the user's requested scope. Setup alone authorizes Mason host configuration, hooks, instructions, and ignore rules; rewriting existing project claims requires repair scope. If repair is authorized, call \`mason_repair(dir, action: "prepare")\` before editing; it saves the full original findings even when this summary is truncated. Inspect relevant source, make grounded edits, then call \`mason_repair(dir, action: "verify", baselinePath)\` with that same baseline, including after any final doc commit. Report resolved, unresolved, review-required, unverified, and new findings. Keep suppressed advisories visible even when setup has already dirtied a doc. Do not invent a decision just to populate the store.
-3. When the task reveals a real lesson or constraint, compare matching \`get_context\` records first. If its assumptions, scope, or recommended action changed, revise that record using \`save_decision(id: existingId)\`; create a separate record for a genuinely distinct lesson and skip unchanged restatements. Include title, body, category, anchors, and known owner/source/actor information. Preserve supported rationale and sources, replace obsolete instructions, and add new evidence. Missing attribution can be added later. The tool writes a local proposal; editing it preserves revision history and requires a new acceptance, while any earlier accepted revision remains operative. An unchanged save never refreshes its evidence. When decision review is requested, \`review_decision\` prepares the record and code evidence before any authorized verdict. Review and commit records through the normal workflow. Retrieve it on the next relevant task with \`get_context(dir, task, files)\`.
+3. Capture a supported lesson as soon as it is established; do not wait for implementation, task completion, or merge. Keep unimplemented remedies tentative. When the task reveals a real lesson or constraint, compare matching \`get_context\` records first. If its assumptions, scope, or recommended action changed, revise that record using \`save_decision(id: existingId)\`; create a separate record for a genuinely distinct lesson and skip unchanged restatements. Include title, body, category, anchors, and known owner/source/actor information. Preserve supported rationale and sources, replace obsolete instructions, and add new evidence. Missing attribution can be added later. The tool writes a local proposal; editing it preserves revision history and requires a new acceptance, while any earlier accepted revision remains operative. An unchanged save never refreshes its evidence. When decision review is requested, \`review_decision\` prepares the record and code evidence before any authorized verdict. Review and commit records through the normal workflow. Retrieve it on the next relevant task with \`get_context(dir, task, files)\`.
 
 ${ASSISTANT_SETUP}
 
@@ -5304,7 +5680,7 @@ var init_types2 = __esm({
 });
 
 // src/review/evidence/vitest.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 function parseVitest(raw, sourceRoot) {
   const report = schema.parse(raw);
   const findings = [], diagnostics = [];
@@ -5353,24 +5729,24 @@ var init_vitest = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    count3 = z19.number().int().nonnegative();
-    schema = z19.object({
-      success: z19.boolean(),
+    count3 = z20.number().int().nonnegative();
+    schema = z20.object({
+      success: z20.boolean(),
       numTotalTests: count3,
       numPassedTests: count3,
       numFailedTests: count3,
       numPendingTests: count3,
       numTodoTests: count3,
       numFailedTestSuites: count3,
-      testResults: z19.array(z19.object({
-        name: z19.string().min(1),
-        status: z19.enum(["passed", "failed"]),
-        message: z19.string().optional(),
-        assertionResults: z19.array(z19.object({
-          fullName: z19.string(),
-          status: z19.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
-          failureMessages: z19.array(z19.string()).nullable().optional(),
-          location: z19.object({ line: count3, column: count3 }).nullable().optional()
+      testResults: z20.array(z20.object({
+        name: z20.string().min(1),
+        status: z20.enum(["passed", "failed"]),
+        message: z20.string().optional(),
+        assertionResults: z20.array(z20.object({
+          fullName: z20.string(),
+          status: z20.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
+          failureMessages: z20.array(z20.string()).nullable().optional(),
+          location: z20.object({ line: count3, column: count3 }).nullable().optional()
         }))
       }))
     });
@@ -5378,7 +5754,7 @@ var init_vitest = __esm({
 });
 
 // src/review/evidence/sarif.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 function parseSarif(raw, sourceRoot) {
   const report = schema2.parse(raw), findings = [], diagnostics = [];
   let active = 0, suppressed = 0, absent = 0, unresolved = 0;
@@ -5469,29 +5845,29 @@ var init_sarif = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    index = z20.number().int().nonnegative();
-    artifact = z20.object({ uri: z20.string().optional(), uriBaseId: z20.string().optional(), index: index.optional() });
-    message = z20.object({ text: z20.string().optional(), markdown: z20.string().optional(), id: z20.string().optional(), arguments: z20.array(z20.string()).optional() });
-    level = z20.enum(["error", "warning", "note", "none"]);
-    location = z20.object({ physicalLocation: z20.object({ artifactLocation: artifact.optional(), region: z20.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
-    schema2 = z20.object({
-      version: z20.literal("2.1.0"),
-      runs: z20.array(z20.object({
-        tool: z20.object({ driver: z20.object({ name: z20.string().min(1), rules: z20.array(z20.object({ id: z20.string(), defaultConfiguration: z20.object({ level: level.optional() }).optional(), messageStrings: z20.record(message).optional() })).optional(), globalMessageStrings: z20.record(message).optional() }) }),
-        invocations: z20.array(z20.object({ executionSuccessful: z20.boolean(), commandLine: z20.string().optional(), toolExecutionNotifications: z20.array(z20.object({ level: level.optional(), message })).optional() })).optional(),
-        versionControlProvenance: z20.array(z20.object({ revisionId: z20.string().optional() })).optional(),
-        originalUriBaseIds: z20.record(artifact).optional(),
-        artifacts: z20.array(z20.object({ location: artifact.optional() })).optional(),
-        results: z20.array(z20.object({
-          ruleId: z20.string().optional(),
+    index = z21.number().int().nonnegative();
+    artifact = z21.object({ uri: z21.string().optional(), uriBaseId: z21.string().optional(), index: index.optional() });
+    message = z21.object({ text: z21.string().optional(), markdown: z21.string().optional(), id: z21.string().optional(), arguments: z21.array(z21.string()).optional() });
+    level = z21.enum(["error", "warning", "note", "none"]);
+    location = z21.object({ physicalLocation: z21.object({ artifactLocation: artifact.optional(), region: z21.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
+    schema2 = z21.object({
+      version: z21.literal("2.1.0"),
+      runs: z21.array(z21.object({
+        tool: z21.object({ driver: z21.object({ name: z21.string().min(1), rules: z21.array(z21.object({ id: z21.string(), defaultConfiguration: z21.object({ level: level.optional() }).optional(), messageStrings: z21.record(message).optional() })).optional(), globalMessageStrings: z21.record(message).optional() }) }),
+        invocations: z21.array(z21.object({ executionSuccessful: z21.boolean(), commandLine: z21.string().optional(), toolExecutionNotifications: z21.array(z21.object({ level: level.optional(), message })).optional() })).optional(),
+        versionControlProvenance: z21.array(z21.object({ revisionId: z21.string().optional() })).optional(),
+        originalUriBaseIds: z21.record(artifact).optional(),
+        artifacts: z21.array(z21.object({ location: artifact.optional() })).optional(),
+        results: z21.array(z21.object({
+          ruleId: z21.string().optional(),
           ruleIndex: index.optional(),
           message,
           level: level.optional(),
-          kind: z20.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
-          baselineState: z20.enum(["new", "unchanged", "updated", "absent"]).optional(),
-          suppressions: z20.array(z20.object({ kind: z20.enum(["inSource", "external"]), status: z20.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
-          locations: z20.array(location).optional(),
-          relatedLocations: z20.array(location).optional()
+          kind: z21.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
+          baselineState: z21.enum(["new", "unchanged", "updated", "absent"]).optional(),
+          suppressions: z21.array(z21.object({ kind: z21.enum(["inSource", "external"]), status: z21.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
+          locations: z21.array(location).optional(),
+          relatedLocations: z21.array(location).optional()
         })).optional()
       }))
     });
@@ -5499,7 +5875,7 @@ var init_sarif = __esm({
 });
 
 // src/review/evidence/check.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 function parseCheck(raw, sourceRoot) {
   const report = schema3.parse(raw);
   const diagnostics = [], findings = [];
@@ -5539,17 +5915,17 @@ var init_check = __esm({
     "use strict";
     init_paths2();
     init_types2();
-    schema3 = z21.object({
-      version: z21.literal(1),
-      commit: z21.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).optional(),
-      results: z21.array(z21.object({
-        name: z21.string().min(1).max(1e3),
-        status: z21.enum(["passed", "failed", "skipped"]),
-        message: z21.string().max(1e5).optional(),
-        locations: z21.array(z21.object({
-          file: z21.string().min(1).max(4e3),
-          line: z21.number().int().positive().optional(),
-          column: z21.number().int().positive().optional()
+    schema3 = z22.object({
+      version: z22.literal(1),
+      commit: z22.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).optional(),
+      results: z22.array(z22.object({
+        name: z22.string().min(1).max(1e3),
+        status: z22.enum(["passed", "failed", "skipped"]),
+        message: z22.string().max(1e5).optional(),
+        locations: z22.array(z22.object({
+          file: z22.string().min(1).max(4e3),
+          line: z22.number().int().positive().optional(),
+          column: z22.number().int().positive().optional()
         })).max(100).default([])
       })).max(1e5)
     });
@@ -5557,10 +5933,10 @@ var init_check = __esm({
 });
 
 // src/review/evidence.ts
-import path28 from "path";
-import { z as z22 } from "zod";
+import path29 from "path";
+import { z as z23 } from "zod";
 function relativeArtifact(root, file) {
-  const relative = path28.isAbsolute(file) ? path28.relative(root, file) : file;
+  const relative = path29.isAbsolute(file) ? path29.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -5599,7 +5975,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
     let manifest, raw;
     try {
       manifest = relativeArtifact(root, supplied);
-      raw = z22.object({ version: z22.literal(1), checks: z22.array(z22.unknown()) }).parse(await readStoreJson(root, manifest));
+      raw = z23.object({ version: z23.literal(1), checks: z23.array(z23.unknown()) }).parse(await readStoreJson(root, manifest));
     } catch (error) {
       output.diagnostics.push(`${supplied}: ${String(error)}`);
       continue;
@@ -5657,7 +6033,7 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path28.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path29.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -5754,32 +6130,32 @@ var init_evidence2 = __esm({
     init_sarif();
     init_check();
     init_types2();
-    checkSchema2 = z22.object({
-      id: z22.string().min(1).max(100),
-      kind: z22.enum(["tests", "static-analysis", "security", "complexity", "duplication", "documentation"]),
-      tool: z22.string().min(1).max(200),
-      command: z22.string().min(1).max(2e3),
-      commit: z22.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
-      workingTreeClean: z22.boolean().optional(),
-      source: z22.string().max(2e3).optional(),
-      sourceRoot: z22.string().min(1).max(4e3).optional(),
-      status: z22.enum(["completed", "skipped", "unavailable"]).default("completed"),
-      reason: z22.string().min(1).max(2e3).optional(),
-      exitCode: z22.number().int().nullable().optional(),
-      environment: z22.object({
-        toolVersion: z22.string().min(1).max(200),
-        runtime: z22.string().min(1).max(200).optional(),
-        platform: z22.string().min(1).max(200).optional(),
-        configuration: z22.array(z22.string().min(1).max(4e3)).max(100).optional()
+    checkSchema2 = z23.object({
+      id: z23.string().min(1).max(100),
+      kind: z23.enum(["tests", "static-analysis", "security", "complexity", "duplication", "documentation"]),
+      tool: z23.string().min(1).max(200),
+      command: z23.string().min(1).max(2e3),
+      commit: z23.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
+      workingTreeClean: z23.boolean().optional(),
+      source: z23.string().max(2e3).optional(),
+      sourceRoot: z23.string().min(1).max(4e3).optional(),
+      status: z23.enum(["completed", "skipped", "unavailable"]).default("completed"),
+      reason: z23.string().min(1).max(2e3).optional(),
+      exitCode: z23.number().int().nullable().optional(),
+      environment: z23.object({
+        toolVersion: z23.string().min(1).max(200),
+        runtime: z23.string().min(1).max(200).optional(),
+        platform: z23.string().min(1).max(200).optional(),
+        configuration: z23.array(z23.string().min(1).max(4e3)).max(100).optional()
       }).optional(),
-      report: z22.object({ format: z22.enum(["vitest-json", "sarif", "mason-check-json"]), path: z22.string().min(1).max(4e3) }).optional()
+      report: z23.object({ format: z23.enum(["vitest-json", "sarif", "mason-check-json"]), path: z23.string().min(1).max(4e3) }).optional()
     });
   }
 });
 
 // src/review/review.ts
 import fs21 from "fs/promises";
-import path29 from "path";
+import path30 from "path";
 import { execFile as execFile7 } from "child_process";
 import { promisify as promisify7 } from "util";
 async function resolveMergeBase(resolvedRoot, base, head) {
@@ -5808,7 +6184,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path29.resolve(rootDir);
+  const resolvedRoot = path30.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -5858,7 +6234,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs21.access(path29.join(resolvedRoot, relPath));
+        await fs21.access(path30.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -5993,7 +6369,7 @@ var init_onboarding = __esm({
 });
 
 // src/impact/references.ts
-import path30 from "path";
+import path31 from "path";
 function templateEnd(content2, start) {
   let i = start + 1, interpolation = 0;
   while (i < content2.length) {
@@ -6119,10 +6495,10 @@ function jvmImports(content2) {
 }
 function resolveImport(file, specifier, available) {
   if (!specifier.startsWith("./") && !specifier.startsWith("../")) return null;
-  const relative = path30.posix.normalize(path30.posix.join(path30.posix.dirname(file), specifier));
+  const relative = path31.posix.normalize(path31.posix.join(path31.posix.dirname(file), specifier));
   if (relative.startsWith("../")) return null;
   if (available.has(relative)) return relative;
-  const ext = path30.posix.extname(relative);
+  const ext = path31.posix.extname(relative);
   const replacements = { ".js": [".ts", ".tsx"], ".mjs": [".mts"], ".cjs": [".cts"] };
   const candidates = ext ? (replacements[ext] ?? []).map((e) => relative.slice(0, -ext.length) + e) : jsExtensions.flatMap((e) => [relative + e, relative + "/index" + e]);
   const found = candidates.filter((f) => available.has(f));
@@ -6134,13 +6510,13 @@ function mentionsPath(content2, target) {
 function createReferenceMatcher(targets2, available, targetContents = /* @__PURE__ */ new Map()) {
   const counts = /* @__PURE__ */ new Map();
   for (const file of available) {
-    const name = path30.posix.basename(file, path30.posix.extname(file));
+    const name = path31.posix.basename(file, path31.posix.extname(file));
     counts.set(name, (counts.get(name) ?? 0) + 1);
   }
   const jvmTargets = new Map([...targetContents].filter(([file]) => /\.(?:kt|kts|java)$/.test(file)).map(([file, content2]) => [file, declaredSymbols(content2)]));
   return (source) => {
     if (targets2.includes(source.path)) return [];
-    const resolved = new Set(jsExtensions.includes(path30.posix.extname(source.path)) ? imports(source.content).map((s) => resolveImport(source.path, s, available)).filter(Boolean) : []);
+    const resolved = new Set(jsExtensions.includes(path31.posix.extname(source.path)) ? imports(source.content).map((s) => resolveImport(source.path, s, available)).filter(Boolean) : []);
     if (/\.(?:kt|kts|java)$/.test(source.path)) {
       const imported = jvmImports(source.content);
       for (const [target, symbols] of jvmTargets) if (symbols.some((symbol) => imported.some((name) => name === symbol || name.startsWith(symbol + ".")))) resolved.add(target);
@@ -6156,7 +6532,7 @@ function createReferenceMatcher(targets2, available, targetContents = /* @__PURE
         add("explicit-path", target);
         continue;
       }
-      const ext = path30.posix.extname(target), name = path30.posix.basename(target, ext);
+      const ext = path31.posix.extname(target), name = path31.posix.basename(target, ext);
       if (!/\.(?:[cm]?[jt]sx?|py|kt|java|go|rs|swift|rb|cs|cpp|c|h|hpp|dart|php)$/.test(ext) || name.startsWith(".") || name.length < 3 || genericNames.has(name.toLowerCase()) || counts.get(name) !== 1) continue;
       if (word(name).test(source.content)) {
         add("name-candidate", name);
@@ -6185,11 +6561,11 @@ var impact_exports = {};
 __export(impact_exports, {
   analyzeImpact: () => analyzeImpact
 });
-import path31 from "path";
+import path32 from "path";
 import { execFile as execFile8 } from "child_process";
 import { promisify as promisify8 } from "util";
 async function analyzeImpact(rootDir, targetFiles) {
-  const resolvedRoot = path31.resolve(rootDir);
+  const resolvedRoot = path32.resolve(rootDir);
   const resolvedTargets = await resolveTargetFiles(resolvedRoot, targetFiles);
   const [cochange, references, tests] = await Promise.all([
     getCochangeFiles(resolvedRoot, resolvedTargets),
@@ -6303,9 +6679,9 @@ async function getRelatedTests(rootDir, targetFiles) {
   const testFiles = await (await createFileAccess(rootDir)).list(testPatterns);
   const results = [];
   for (const target of targetFiles) {
-    const targetBaseName = path31.basename(target).replace(/\.[^.]+$/, "");
+    const targetBaseName = path32.basename(target).replace(/\.[^.]+$/, "");
     for (const testFile of testFiles) {
-      const testBaseName = path31.basename(testFile).replace(/\.[^.]+$/, "");
+      const testBaseName = path32.basename(testFile).replace(/\.[^.]+$/, "");
       const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
       if (sourceName === targetBaseName) {
         results.push({
@@ -6333,13 +6709,13 @@ var assemble_exports = {};
 __export(assemble_exports, {
   assembleContext: () => assembleContext
 });
-import path32 from "path";
+import path33 from "path";
 import fs22 from "fs/promises";
 async function collectImpact(root, candidates) {
   const targets2 = /* @__PURE__ */ new Set();
   let sourceFiles;
   for (const candidate of sanitizeRepoPaths(candidates)) {
-    const stat = await fs22.stat(path32.join(root, candidate)).catch(() => null);
+    const stat = await fs22.stat(path33.join(root, candidate)).catch(() => null);
     if (stat?.isDirectory()) {
       sourceFiles ??= await (await createFileAccess(root)).list();
       for (const file of sourceFiles) {
@@ -6365,7 +6741,7 @@ async function collectImpact(root, candidates) {
   };
 }
 async function assembleContext(rootDir, task, files) {
-  const resolvedRoot = path32.resolve(rootDir);
+  const resolvedRoot = path33.resolve(rootDir);
   const mapState = await inspectSnapshot(resolvedRoot);
   const snapshot = mapState.snapshot;
   const store = await loadDecisionStore(resolvedRoot);
@@ -6562,7 +6938,7 @@ __export(observations_exports, {
   readObservation: () => readObservation
 });
 import fs23 from "fs/promises";
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 function observationPath(directory, host, revision, version = executingVersion()) {
   return `${directory}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
 }
@@ -6633,19 +7009,19 @@ var init_observations = __esm({
     init_storage();
     init_model();
     init_launcher();
-    observationSchema = z23.object({
-      version: z23.literal(1),
-      masonVersion: z23.string(),
-      root: z23.string(),
-      revision: z23.string(),
-      host: z23.enum(["codex", "claude"]),
-      contextCalls: z23.number().int().nonnegative(),
-      lastContextAt: z23.string().optional(),
-      sessions: z23.record(z23.object({
-        events: z23.array(z23.enum(events)),
-        at: z23.string(),
-        verificationStatus: z23.string().optional(),
-        reportPath: z23.string().optional()
+    observationSchema = z24.object({
+      version: z24.literal(1),
+      masonVersion: z24.string(),
+      root: z24.string(),
+      revision: z24.string(),
+      host: z24.enum(["codex", "claude"]),
+      contextCalls: z24.number().int().nonnegative(),
+      lastContextAt: z24.string().optional(),
+      sessions: z24.record(z24.object({
+        events: z24.array(z24.enum(events)),
+        at: z24.string(),
+        verificationStatus: z24.string().optional(),
+        reportPath: z24.string().optional()
       }))
     });
   }
@@ -6908,8 +7284,8 @@ __export(client_exports, {
 function createConfluenceClient(config, fetchFn = fetch) {
   const baseUrl = config.baseUrl.replace(/\/+$/, "");
   const auth = "Basic " + Buffer.from(`${config.email}:${config.apiToken}`).toString("base64");
-  async function call(method, path42, body) {
-    const res = await fetchFn(`${baseUrl}${path42}`, {
+  async function call(method, path43, body) {
+    const res = await fetchFn(`${baseUrl}${path43}`, {
       method,
       headers: {
         Authorization: auth,
@@ -6921,7 +7297,7 @@ function createConfluenceClient(config, fetchFn = fetch) {
     if (!res.ok) {
       const text2 = await res.text();
       throw new Error(
-        `Confluence ${method} ${path42} failed: ${res.status} ${res.statusText} \u2014 ${text2}`
+        `Confluence ${method} ${path43} failed: ${res.status} ${res.statusText} \u2014 ${text2}`
       );
     }
     if (res.status === 204) return null;
@@ -7023,15 +7399,15 @@ __export(config_exports2, {
   validateProvider: () => validateProvider
 });
 import fs24 from "fs/promises";
-import path33 from "path";
+import path34 from "path";
 import os3 from "os";
 import { execFile as execFile9 } from "child_process";
 import { promisify as promisify9 } from "util";
 function configDir() {
-  return path33.join(os3.homedir(), ".mason");
+  return path34.join(os3.homedir(), ".mason");
 }
 function configFile() {
-  return path33.join(configDir(), "config.json");
+  return path34.join(configDir(), "config.json");
 }
 async function loadConfig() {
   try {
@@ -7204,16 +7580,16 @@ var init_renderer = __esm({
 
 // src/confluence/diff.ts
 import fs25 from "fs/promises";
-import path34 from "path";
+import path35 from "path";
 import { createHash as createHash6 } from "crypto";
 function hashDescription(description) {
   return createHash6("sha256").update(description, "utf8").digest("hex");
 }
 function syncStateDir(rootDir) {
-  return path34.join(rootDir, ".mason");
+  return path35.join(rootDir, ".mason");
 }
 function syncStatePath(rootDir) {
-  return path34.join(syncStateDir(rootDir), "confluence-sync.json");
+  return path35.join(syncStateDir(rootDir), "confluence-sync.json");
 }
 async function loadSyncState(rootDir) {
   try {
@@ -7780,13 +8156,13 @@ init_advisory_review();
 init_decisions();
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 
 // src/mcp/tools.ts
 init_repair();
 init_advisory_review();
 import fs26 from "fs/promises";
-import path35 from "path";
+import path36 from "path";
 import { execFile as execFile11 } from "child_process";
 import { promisify as promisify11 } from "util";
 
@@ -7795,11 +8171,11 @@ init_audit();
 init_types();
 init_repair();
 init_findings();
-import path24 from "path";
+import path25 from "path";
 
 // src/audit/advisory-cli.ts
 init_advisory_review();
-import path23 from "path";
+import path24 from "path";
 import { stripVTControlCharacters } from "util";
 
 // src/audit/cli.ts
@@ -7866,7 +8242,7 @@ function formatFixPrompt(report, baselinePath) {
     "- new-module: review whether the directory needs documenting; an omission alone does not establish a defect. Preserve scope and describe only what you verified."
   );
   lines.push(
-    "- Historical ADVISORIES require a separate authorized assessment using review_advisory with the baselinePath and findingId from verification. Prepare and inspect evidence first; record addressed, inapplicable or deferred with the actual reviewer, note and reviewToken. Decision findings use review_decision. Candidates marked resolution: recheck can be rerun to see whether the condition remains; this does not establish semantic approval. Report what remains unknown."
+    "- Specific historical ADVISORIES require a separate authorized assessment using review_advisory with the baselinePath and findingId from verification. Prepare and inspect evidence first; record addressed, inapplicable or deferred with the actual reviewer, note and reviewToken. Dependency notices marked resolution: informational require no review. Dependency advisories may be dismissed with action: dismiss, reasonCode (no-dependency-claims or unrelated-manifest-change), and note, without a reviewer or token. Decision findings use review_decision. Candidates marked resolution: recheck can be rerun to see whether the condition remains; this does not establish semantic approval. Report what remains unknown."
   );
   lines.push("");
   lines.push("AUDIT REPORT (current context files and repository evidence, including local edits):");
@@ -7897,10 +8273,10 @@ import { promisify as promisify3 } from "util";
 
 // src/analyzers/base.ts
 import fs16 from "fs/promises";
-import fg6 from "fast-glob";
+import fg8 from "fast-glob";
 var BaseAnalyzer = class {
   async findFiles(patterns, root) {
-    return fg6(patterns, {
+    return fg8(patterns, {
       cwd: root,
       ignore: ["**/node_modules/**", "**/dist/**", "**/.git/**"],
       absolute: true
@@ -8112,7 +8488,7 @@ async function isGitRepo(dir) {
 
 // src/mcp/sampler.ts
 init_files();
-import path25 from "path";
+import path26 from "path";
 import { execFile as execFile4 } from "child_process";
 import { promisify as promisify4 } from "util";
 var exec2 = promisify4(execFile4);
@@ -8220,8 +8596,8 @@ async function sampleFiles(rootDir, maxFiles = 25) {
   const projectConfig = access.config;
   for (const filePath of projectConfig.alwaysInclude ?? []) {
     if (selected.size >= maxFiles) break;
-    const resolvedPath = path25.resolve(rootDir, filePath);
-    if (!resolvedPath.startsWith(path25.resolve(rootDir))) continue;
+    const resolvedPath = path26.resolve(rootDir, filePath);
+    if (!resolvedPath.startsWith(path26.resolve(rootDir))) continue;
     selected.set(filePath, "always-include (project config)");
   }
   let configCount = 0;
@@ -8287,7 +8663,7 @@ async function sampleFiles(rootDir, maxFiles = 25) {
       if (!line) continue;
       if (line.includes("node_modules") || line.includes("/build/") || line.includes(".gradle") || line.includes("/generated/"))
         continue;
-      const ext = path25.extname(line).slice(1);
+      const ext = path26.extname(line).slice(1);
       if (!SOURCE_EXTENSIONS.includes(ext)) continue;
       fileCounts.set(line, (fileCounts.get(line) ?? 0) + 1);
     }
@@ -8409,14 +8785,14 @@ init_files();
 import { createHash as createHash4 } from "crypto";
 import { execFile as execFile5 } from "child_process";
 import { promisify as promisify5 } from "util";
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var exec3 = promisify5(execFile5);
-var requestSchema = z10.object({
-  id: z10.string().regex(/^[a-zA-Z0-9_-]+$/),
-  action: z10.enum(["prepare", "accept", "reaffirm", "retire"]).default("prepare"),
-  reviewer: z10.string().trim().min(1).max(200).optional(),
-  note: z10.string().trim().min(1).max(1500).optional(),
-  reviewToken: z10.string().regex(/^[a-f0-9]{64}$/).optional()
+var requestSchema = z11.object({
+  id: z11.string().regex(/^[a-zA-Z0-9_-]+$/),
+  action: z11.enum(["prepare", "accept", "reaffirm", "retire"]).default("prepare"),
+  reviewer: z11.string().trim().min(1).max(200).optional(),
+  note: z11.string().trim().min(1).max(1500).optional(),
+  reviewToken: z11.string().regex(/^[a-f0-9]{64}$/).optional()
 });
 async function reviewState(root, record) {
   const [headHash, workingTree, changes] = await Promise.all([
@@ -8643,16 +9019,16 @@ init_lock();
 init_storage();
 init_snapshot();
 import fs17 from "fs/promises";
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var DIRECTORY = ".mason/partial-snapshots";
-var partialSchema = z11.object({
-  batchId: z11.string().regex(/^[a-zA-Z0-9_-]+$/),
-  offset: z11.number().int().nonnegative(),
-  features: z11.record(featureSchema),
-  flows: z11.record(flowSchema),
-  savedAt: z11.string()
+var partialSchema = z12.object({
+  batchId: z12.string().regex(/^[a-zA-Z0-9_-]+$/),
+  offset: z12.number().int().nonnegative(),
+  features: z12.record(featureSchema),
+  flows: z12.record(flowSchema),
+  savedAt: z12.string()
 });
-var scopeSchema2 = z11.object({ files: z11.array(z11.string()), savedAt: z11.string() });
+var scopeSchema2 = z12.object({ files: z12.array(z12.string()), savedAt: z12.string() });
 async function savePartial(rootDir, partial) {
   if (!/^[a-zA-Z0-9_-]+$/.test(partial.batchId)) throw new Error(`Invalid batchId: ${partial.batchId}`);
   await withSnapshotWrite(rootDir, () => writeStoreJson(rootDir, `${DIRECTORY}/${partial.batchId}.json`, partialSchema.parse(partial)));
@@ -8704,7 +9080,7 @@ async function buildContext(dir) {
   };
 }
 async function analyzeProject(dir) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const context = await buildContext(rootDir);
   const results = await runAll(context);
   const projectSnapshot = await detectProjectSnapshot(rootDir);
@@ -8759,7 +9135,7 @@ async function detectProjectSnapshot(rootDir) {
   const present = [];
   for (const file of buildFiles) {
     try {
-      await fs26.access(path35.join(rootDir, file));
+      await fs26.access(path36.join(rootDir, file));
       present.push(file);
     } catch {
     }
@@ -8801,7 +9177,7 @@ async function detectProjectSnapshot(rootDir) {
   const sourceFiles = await access.list();
   const fileCounts = {};
   for (const file of sourceFiles) {
-    const ext = path35.extname(file).slice(1);
+    const ext = path36.extname(file).slice(1);
     fileCounts[ext] = (fileCounts[ext] ?? 0) + 1;
   }
   return {
@@ -8812,7 +9188,7 @@ async function detectProjectSnapshot(rootDir) {
   };
 }
 async function getCodeSamples(dir, count4 = 15) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const samples = await sampleFiles(rootDir, count4);
   const output = {
     note: "These are previews (first ~60 lines). Read the file directly with your own tools to see it in full.",
@@ -8855,7 +9231,7 @@ async function unmappedContextResponse(rootDir) {
   });
 }
 async function getProjectStructure(dir) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const allFiles = await (await createFileAccess(rootDir)).list("**/*");
   const dirInfo = /* @__PURE__ */ new Map();
   for (const file of allFiles) {
@@ -8867,7 +9243,7 @@ async function getProjectStructure(dir) {
       }
       const info = dirInfo.get(dirPath);
       info.fileCount++;
-      const ext = path35.extname(file).slice(1);
+      const ext = path36.extname(file).slice(1);
       if (ext) {
         info.extensions.set(ext, (info.extensions.get(ext) ?? 0) + 1);
       }
@@ -8912,7 +9288,7 @@ async function buildChangedFilePreviews(rootDir, changedFiles) {
   return previews2;
 }
 async function getSnapshot(dir) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const snapshot = await loadSnapshot(rootDir);
   if (!snapshot) {
     return unmappedContextResponse(rootDir);
@@ -9013,7 +9389,7 @@ function driftHint(report) {
   return "Read the changed files under staleFeatures/staleFlows, update those entries (fold unmappedFiles into the right features), and call save_snapshot with only the affected entries \u2014 unchanged entries are preserved. Drop ghostFiles from any entries that reference them, and delete features/flows that no longer exist via save_snapshot's removeFeatures/removeFlows.";
 }
 async function checkDrift(dir) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const report = await computeDrift(rootDir);
   if (!report) {
     return JSON.stringify({
@@ -9044,7 +9420,7 @@ async function checkDrift(dir) {
   return JSON.stringify({ exists: true, ...report, verification, hint });
 }
 async function generateSnapshotBatch(dir, offset = 0, batchSize = DEFAULT_BATCH_SIZE, files) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const scoped = files !== void 0 && files.length > 0;
   const scopeFiles = scoped ? sanitizePaths(rootDir, files) : void 0;
   const batch = await prepareSnapshotBatch(dir, offset, batchSize, scopeFiles);
@@ -9091,7 +9467,7 @@ async function generateSnapshotBatch(dir, offset = 0, batchSize = DEFAULT_BATCH_
   );
 }
 async function saveSnapshotPartial(dir, batchId, offset, features, flows) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   for (const feat of Object.values(features)) {
     feat.files = sanitizePaths(rootDir, feat.files);
     if (feat.tests) feat.tests = sanitizePaths(rootDir, feat.tests);
@@ -9120,7 +9496,7 @@ async function saveSnapshotPartial(dir, batchId, offset, features, flows) {
   );
 }
 async function reduceSnapshot(dir) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const partials = await loadAllPartials(rootDir);
   if (partials.length === 0) {
     return JSON.stringify(
@@ -9182,7 +9558,7 @@ async function reduceSnapshot(dir) {
   );
 }
 async function fullAnalysis(dir) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const [analysis, structure, samples, testMap, snapshot] = await Promise.all([
     analyzeProject(dir),
     getProjectStructure(dir),
@@ -9211,7 +9587,7 @@ function sanitizePaths(rootDir, files) {
   return sanitizeRepoPaths(files);
 }
 async function saveSnapshotData(dir, features, flows, removeFeatures = [], removeFlows = []) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   return updateSnapshot(rootDir, async (previous) => {
     const gitHash = await getCurrentGitHash(rootDir);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -9291,14 +9667,14 @@ async function saveSnapshotData(dir, features, flows, removeFeatures = [], remov
   });
 }
 async function getImpact(dir, files) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const { analyzeImpact: analyzeImpact2 } = await Promise.resolve().then(() => (init_impact(), impact_exports));
   const result = await analyzeImpact2(rootDir, files);
   return JSON.stringify(result, null, 2);
 }
 var VERIFY_DEFAULT_SAMPLE = 5;
 async function verifySnapshot(dir, sample = VERIFY_DEFAULT_SAMPLE) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const snapshot = await loadSnapshot(rootDir);
   if (!snapshot) {
     return JSON.stringify({
@@ -9351,7 +9727,7 @@ async function verifySnapshot(dir, sample = VERIFY_DEFAULT_SAMPLE) {
   });
 }
 async function saveVerification(dir, verdicts) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   return updateSnapshot(rootDir, async (snapshot) => {
     if (!snapshot) {
       return { snapshot: null, result: JSON.stringify({ exists: false, stamped: [], hint: "No concept map exists. Build it and run verify_snapshot before recording verdicts." }) };
@@ -9425,16 +9801,16 @@ async function saveVerification(dir, verdicts) {
   });
 }
 async function saveDecision(dir, input) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const { upsertDecision: upsertDecision2 } = await Promise.resolve().then(() => (init_decisions(), decisions_exports));
   const result = await upsertDecision2(rootDir, input);
   return JSON.stringify(result);
 }
 async function reviewDecision2(dir, input) {
-  return JSON.stringify(await reviewDecision(path35.resolve(dir), input));
+  return JSON.stringify(await reviewDecision(path36.resolve(dir), input));
 }
 async function getContext(dir, task, files) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const { assembleContext: assembleContext2 } = await Promise.resolve().then(() => (init_assemble(), assemble_exports));
   const bundle = await assembleContext2(rootDir, task, files);
   return JSON.stringify(bundle);
@@ -9483,7 +9859,7 @@ async function masonInit(dir, options = {}) {
     return JSON.stringify(await setupProject2(dir, options), null, 2);
   }
   if (options.host) throw new Error("host applies only to mode: setup.");
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const marker = await loadProjectMarker(rootDir);
   const { loadSetup: loadSetup2 } = await Promise.resolve().then(() => (init_model(), model_exports));
   const setup = await loadSetup2(rootDir);
@@ -9503,7 +9879,7 @@ async function masonInit(dir, options = {}) {
   );
 }
 async function masonCompleteInit(dir, options = {}) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const existing = await loadProjectMarker(rootDir);
   const features = await loadProjectFeatures(rootDir);
   const marker = {
@@ -9612,7 +9988,7 @@ async function masonSetConfluence(input) {
   );
 }
 async function exportToConfluenceTool(dir, overrides) {
-  const rootDir = path35.resolve(dir);
+  const rootDir = path36.resolve(dir);
   const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config2(), config_exports2));
   const { exportToConfluence: exportToConfluence2 } = await Promise.resolve().then(() => (init_sync(), sync_exports));
   const config = await loadConfig2();
@@ -9651,21 +10027,21 @@ function createMcpServer() {
   const server = new McpServer(
     {
       name: "mason",
-      version: "0.19.0"
+      version: "0.19.2"
     },
     {
-      instructions: (setupNotice ? setupNotice + "\n\n" : "") + 'Mason retrieves recorded decisions, file impact, and optional feature/flow maps. Use get_context with the task and known files, and get_impact before editing. Save learned rationale and constraints with save_decision; review and commit the local records through the project workflow. These tools work without initialization or a concept map. Consult trust and diagnostics: changed or unknown freshness needs source inspection, stale or unknown map verification needs a fresh review, recorded failed verdicts need correction, and proposals are suggestions and legacy records are unreviewed. Accepted decisions are recorded team constraints, still subject to freshness checks. Use review_decision to prepare code evidence and record only authorized acceptance, reaffirmation, or retirement. Never invent a reviewer or treat these recorded identities as authenticated approval. mason_init returns documentation audit and committed-diff review findings with a quickstart guide. Use mode: "map" only when a full architecture map is requested. A missing map is not a setup failure; use decisions and source evidence. get_snapshot provides architecture navigation when a map is available. The mason-audit and mason-review CLIs also work without setup.'
+      instructions: (setupNotice ? setupNotice + "\n\n" : "") + 'Mason retrieves recorded decisions, file impact, and optional feature/flow maps. Use get_context with the task and known files, and get_impact before editing. Save learned rationale and constraints with save_decision as soon as evidence supports them, without waiting for implementation or merge; review and commit the local records through the project workflow. These tools work without initialization or a concept map. Consult trust and diagnostics: changed or unknown freshness needs source inspection, stale or unknown map verification needs a fresh review, recorded failed verdicts need correction, and proposals are suggestions and legacy records are unreviewed. Accepted decisions are recorded team constraints, still subject to freshness checks. Use review_decision to prepare code evidence and record only authorized acceptance, reaffirmation, or retirement. Never invent a reviewer or treat these recorded identities as authenticated approval. mason_init returns documentation audit and committed-diff review findings with a quickstart guide. Use mode: "map" only when a full architecture map is requested. A missing map is not a setup failure; use decisions and source evidence. get_snapshot provides architecture navigation when a map is available. The mason-audit and mason-review CLIs also work without setup.'
     }
   );
   server.tool(
     "mason_init",
     "Inspect this project now: returns documentation audit findings, committed-diff review findings, decision/map status, and a quickstart playbook. Quickstart and map modes are read-only and deterministic. Explicit mode: setup configures MCP, instructions and lifecycle hooks to use mason on PATH while retaining original audit evidence; use it only when the user requests setup. Optional host selects codex or claude. Optional base selects the review comparison; evidence imports CI manifests with check outcomes, commit freshness, and links to changed files and accepted decisions. mode: map returns the full Map-Reduce build workflow. Repeat calls refresh findings even after setup.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory"),
-      mode: z24.enum(["quickstart", "map", "setup"]).optional().default("quickstart").describe("Quickstart inspects without edits; map requests an architecture build; setup installs the shared onboarding flow."),
-      host: z24.enum(["codex", "claude"]).optional().describe("Assistant to configure in setup mode; inferred only when unambiguous."),
-      base: z24.string().optional().describe("Git ref for committed-diff review. Defaults to the first available main branch ref."),
-      evidence: z24.array(z24.string()).max(10).optional().describe("Repository-local CI evidence manifests to include in the review. Imports Vitest JSON, SARIF, and native-validator mason-check-json results without executing check commands.")
+      dir: z25.string().describe("Absolute path to the project root directory"),
+      mode: z25.enum(["quickstart", "map", "setup"]).optional().default("quickstart").describe("Quickstart inspects without edits; map requests an architecture build; setup installs the shared onboarding flow."),
+      host: z25.enum(["codex", "claude"]).optional().describe("Assistant to configure in setup mode; inferred only when unambiguous."),
+      base: z25.string().optional().describe("Git ref for committed-diff review. Defaults to the first available main branch ref."),
+      evidence: z25.array(z25.string()).max(10).optional().describe("Repository-local CI evidence manifests to include in the review. Imports Vitest JSON, SARIF, and native-validator mason-check-json results without executing check commands.")
     },
     async ({ dir, mode, host, base, evidence }) => {
       const result = await masonInit(dir, { mode, host, base, evidence });
@@ -9674,10 +10050,10 @@ function createMcpServer() {
   );
   server.tool(
     "mason_automation",
-    "Inspect installed automation and observed host events, or resume/check retained documentation repair evidence across sessions. status is read-only; check saves local baselines and verification reports without editing source or approving advisories. Returns concise results with a full report path. Works without a map.",
+    "Inspect installed automation, observed host events, pending decision records and the notification baseline, or check all retained documentation findings across sessions. status is read-only; check saves local baselines and verification reports without editing source, approving advisories or consuming pending completion notices. Returns concise results with a full report path. Works without a map.",
     {
-      dir: z24.string().describe("Absolute path to the project directory"),
-      action: z24.enum(["status", "check"]).describe("Inspect configuration and receipts, or capture/resume and verify original audit evidence.")
+      dir: z25.string().describe("Absolute path to the project directory"),
+      action: z25.enum(["status", "check"]).describe("Inspect configuration and receipts, or capture/resume and verify original audit evidence.")
     },
     async ({ dir, action }) => ({ content: [{ type: "text", text: await masonAutomation(dir, action) }] })
   );
@@ -9685,10 +10061,10 @@ function createMcpServer() {
     "mason_repair",
     "Track documentation repairs against original audit evidence. prepare saves a local baseline and returns a scoped work order; verify reads that baseline and reports resolved, unresolved, review-required, unverified, and new findings. Suppressed advisories remain unresolved. Does not edit documentation or approve decisions. No map required.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory"),
-      action: z24.enum(["prepare", "verify"]),
-      baselinePath: z24.string().optional().describe("Original baseline path returned by prepare; required for verify."),
-      checks: z24.array(z24.enum(["deleted-reference", "new-module", "stale-count", "dead-command", "deps-changed", "decision-anchor-drift"])).min(1).optional().describe("Optional audit check subset for prepare. Verification always uses the original checks.")
+      dir: z25.string().describe("Absolute path to the project root directory"),
+      action: z25.enum(["prepare", "verify"]),
+      baselinePath: z25.string().optional().describe("Original baseline path returned by prepare; required for verify."),
+      checks: z25.array(z25.enum(["deleted-reference", "new-module", "stale-count", "dead-command", "deps-changed", "decision-anchor-drift"])).min(1).optional().describe("Optional audit check subset for prepare. Verification always uses the original checks.")
     },
     async ({ dir, action, baselinePath, checks }) => {
       const result = await masonRepair(dir, { action, baselinePath, checks });
@@ -9697,16 +10073,16 @@ function createMcpServer() {
   );
   server.tool(
     "review_advisory",
-    "Prepare an assessment of an original repair advisory and its exact repository scope, then record authorized addressed, inapplicable or deferred outcomes with reviewToken, reviewer and note. Relevant changes reopen reviews; unrelated commits preserve them. Records belong in Git. Decision findings route to review_decision; this tool never approves decisions. Recorded identities are assertions, not authenticated approvals.",
-    { dir: z24.string().describe("Absolute path to the project root"), ...advisoryReviewRequest.shape },
+    "Prepare an assessment of an original repair advisory and its exact repository scope, then record authorized addressed, inapplicable or deferred outcomes with reviewToken, reviewer and note. Relevant changes reopen reviews; unrelated commits preserve them. Records belong in Git. Decision findings route to review_decision; this tool never approves decisions. Recorded identities are assertions, not authenticated approvals. For dependency advisories, action dismiss with reasonCode and note records a one-step dismissal without a token or reviewer. no-dependency-claims reopens only on document content changes; unrelated-manifest-change also tracks scoped manifests.",
+    { dir: z25.string().describe("Absolute path to the project root"), ...advisoryReviewRequest.shape },
     async ({ dir, ...request }) => ({ content: [{ type: "text", text: await masonReviewAdvisory(dir, request) }] })
   );
   server.tool(
     "mason_complete_init",
     "Record assistant instruction setup locally in ignored .mason/local/project.json, with feature settings in shared .mason/config.json. Other tools work without this marker. Repeated calls preserve the original setup time and existing settings; pass confluenceConfigured only to change that setting.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory"),
-      confluenceConfigured: z24.boolean().optional().describe("Set the Confluence setup status; omit to preserve the existing value")
+      dir: z25.string().describe("Absolute path to the project root directory"),
+      confluenceConfigured: z25.boolean().optional().describe("Set the Confluence setup status; omit to preserve the existing value")
     },
     async ({ dir, confluenceConfigured }) => {
       const result = await masonCompleteInit(dir, { confluenceConfigured });
@@ -9717,11 +10093,11 @@ function createMcpServer() {
     "mason_set_confluence",
     "Configure Confluence credentials. Two-step flow: (1) call without `spaceKey` to validate the credentials and receive a list of available spaces \u2014 relay them to the user. (2) call again with the same `baseUrl`/`email`/`apiToken` plus the chosen `spaceKey` to persist. Credentials are stored in `~/.mason/config.json`. Warn the user that the API token will be visible in chat history before they paste it.",
     {
-      baseUrl: z24.string().describe("Confluence base URL. Accepts `acme`, `acme.atlassian.net`, or `https://acme.atlassian.net` (normalized automatically)."),
-      email: z24.string().describe("User's Atlassian account email"),
-      apiToken: z24.string().describe("API token from id.atlassian.com/manage-profile/security/api-tokens"),
-      spaceKey: z24.string().optional().describe("Confluence space key. Omit on the first call to list available spaces."),
-      parentPageId: z24.string().optional().describe("Optional parent page ID under which Mason's index page is created")
+      baseUrl: z25.string().describe("Confluence base URL. Accepts `acme`, `acme.atlassian.net`, or `https://acme.atlassian.net` (normalized automatically)."),
+      email: z25.string().describe("User's Atlassian account email"),
+      apiToken: z25.string().describe("API token from id.atlassian.com/manage-profile/security/api-tokens"),
+      spaceKey: z25.string().optional().describe("Confluence space key. Omit on the first call to list available spaces."),
+      parentPageId: z25.string().optional().describe("Optional parent page ID under which Mason's index page is created")
     },
     async ({ baseUrl, email, apiToken, spaceKey, parentPageId }) => {
       const result = await masonSetConfluence({
@@ -9738,7 +10114,7 @@ function createMcpServer() {
     "full_analysis",
     "One-shot orientation for a project WITHOUT a concept map (get_snapshot returned exists:false). Returns git history stats, project structure with file counts, curated code sample previews (~60 lines each), and test-to-source mapping. On a mapped project, prefer get_snapshot \u2014 it is cheaper and answers feature/architecture questions directly.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory")
+      dir: z25.string().describe("Absolute path to the project root directory")
     },
     async ({ dir }) => {
       const result = await fullAnalysis(dir);
@@ -9751,7 +10127,7 @@ function createMcpServer() {
     "analyze_project",
     "Run git history analysis on a codebase. Returns commit convention patterns, stale directories, and frequently changed files. These are aggregate stats across hundreds of commits that would be expensive to compute manually.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory")
+      dir: z25.string().describe("Absolute path to the project root directory")
     },
     async ({ dir }) => {
       const result = await analyzeProject(dir);
@@ -9764,8 +10140,8 @@ function createMcpServer() {
     "get_code_samples",
     "Get previews (first ~60 lines) of representative source files from the codebase. Includes entry points, config files, hot files (frequently changed), test examples, and one file per directory for breadth. Read files natively for full content.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory"),
-      count: z24.number().optional().default(15).describe("Maximum number of files to sample (default: 15)")
+      dir: z25.string().describe("Absolute path to the project root directory"),
+      count: z25.number().optional().default(15).describe("Maximum number of files to sample (default: 15)")
     },
     async ({ dir, count: count4 }) => {
       const result = await getCodeSamples(dir, count4);
@@ -9778,7 +10154,7 @@ function createMcpServer() {
     "get_snapshot",
     "Return the optional feature-to-file architecture map with drift and trust evidence. Map verification is rechecked against sampled source contents; stale or unknown verification requires a fresh review, and recordedVerdict preserves the historical verdict. If no map exists, returns exists:false plus project structure, Git signals, and test pairs. Decision capture, get_context, and get_impact still work. No initialization required.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory")
+      dir: z25.string().describe("Absolute path to the project root directory")
     },
     async ({ dir }) => {
       const result = await getSnapshot(dir);
@@ -9791,9 +10167,9 @@ function createMcpServer() {
     "get_context",
     "Assemble task context: matching decisions with rationale, approval, owner, sources, last review, and freshness, plus related tests, file impact, and any available map entries. Map verification is rechecked against sampled source contents; stale or unknown verification requires a fresh review, and recordedVerdict preserves the historical verdict. Proposals are suggestions; legacy records are unreviewed; accepted decisions are constraints subject to freshness. No initialization or map required. Pass task and optional files. map.status and diagnostics preserve missing or invalid knowledge. Impact covers up to three unique files, expanding directory anchors.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory"),
-      task: z24.string().describe("The task, bug, or change request in natural language \u2014 e.g. 'add rate limiting to the API client' or a ticket description"),
-      files: z24.array(z24.string()).optional().describe("Optional file paths already known to be involved (e.g. from a diff or stack trace). Entries containing them are boosted above pure text matches.")
+      dir: z25.string().describe("Absolute path to the project root directory"),
+      task: z25.string().describe("The task, bug, or change request in natural language \u2014 e.g. 'add rate limiting to the API client' or a ticket description"),
+      files: z25.array(z25.string()).optional().describe("Optional file paths already known to be involved (e.g. from a diff or stack trace). Entries containing them are boosted above pure text matches.")
     },
     async ({ dir, task, files }) => {
       const result = await getContext(dir, task, files);
@@ -9809,10 +10185,10 @@ function createMcpServer() {
     "generate_snapshot_batch",
     "Map step of the concept-map build. Returns one batch of source files (skeletons of every file in the batch plus a few deeper-read bodies for grounding), along with a system prompt instructing you to derive features and flows for ONLY this batch. Call repeatedly with the returned `nextOffset` until it is null, calling `save_partial_snapshot` between each call. Use product-natural feature names so partials merge cleanly in the reduce step.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory"),
-      offset: z24.number().int().optional().describe("0-indexed file offset to start the batch at. Omit on the first call; pass the `nextOffset` from the previous response for subsequent calls."),
-      batchSize: z24.number().int().optional().describe("Files per batch. Defaults to 50."),
-      files: z24.array(z24.string()).optional().describe("Scope the batch walk to this explicit file list \u2014 e.g. the drift set from mason_check_drift (changedFiles + unmappedFiles). Pass the SAME list on every batch call of one refresh run. Triggers refresh mode: reduce_snapshot will merge the partials into the existing map instead of rebuilding it.")
+      dir: z25.string().describe("Absolute path to the project root directory"),
+      offset: z25.number().int().optional().describe("0-indexed file offset to start the batch at. Omit on the first call; pass the `nextOffset` from the previous response for subsequent calls."),
+      batchSize: z25.number().int().optional().describe("Files per batch. Defaults to 50."),
+      files: z25.array(z25.string()).optional().describe("Scope the batch walk to this explicit file list \u2014 e.g. the drift set from mason_check_drift (changedFiles + unmappedFiles). Pass the SAME list on every batch call of one refresh run. Triggers refresh mode: reduce_snapshot will merge the partials into the existing map instead of rebuilding it.")
     },
     async ({ dir, offset, batchSize, files }) => {
       const result = await generateSnapshotBatch(dir, offset, batchSize, files);
@@ -9825,23 +10201,23 @@ function createMcpServer() {
     "save_partial_snapshot",
     "Persist the partial concept map you derived for one batch. Call this once per batch, with the `batchId` from the `generate_snapshot_batch` response. Partials accumulate in `.mason/partial-snapshots/` and are merged in the reduce step.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory"),
-      batchId: z24.string().describe("The `batchId` returned by `generate_snapshot_batch`."),
-      offset: z24.number().int().describe("The `offset` returned by `generate_snapshot_batch`. Used to order partials in the reduce step."),
-      features: z24.record(
-        z24.object({
-          description: z24.string(),
-          files: z24.array(z24.string()),
-          tests: z24.array(z24.string()).optional(),
-          type: z24.enum(["capability", "infrastructure"]).optional().describe(
+      dir: z25.string().describe("Absolute path to the project root directory"),
+      batchId: z25.string().describe("The `batchId` returned by `generate_snapshot_batch`."),
+      offset: z25.number().int().describe("The `offset` returned by `generate_snapshot_batch`. Used to order partials in the reduce step."),
+      features: z25.record(
+        z25.object({
+          description: z25.string(),
+          files: z25.array(z25.string()),
+          tests: z25.array(z25.string()).optional(),
+          type: z25.enum(["capability", "infrastructure"]).optional().describe(
             '"capability" (user-facing functionality) or "infrastructure" (internal plumbing with no end user \u2014 DI/service wiring, config, logging, adapters). Defaults to "capability".'
           )
         })
       ).describe("Partial features for this batch only \u2014 files outside the batch will be added by other partials."),
-      flows: z24.record(
-        z24.object({
-          description: z24.string(),
-          chain: z24.array(z24.string())
+      flows: z25.record(
+        z25.object({
+          description: z25.string(),
+          chain: z25.array(z25.string())
         })
       ).describe("Partial flows whose entire chain is in this batch. Cross-batch flows are reconstructed in reduce.")
     },
@@ -9856,7 +10232,7 @@ function createMcpServer() {
     "reduce_snapshot",
     "Reduce step of the concept-map build. Returns every partial snapshot plus a system prompt asking you to merge them into one coherent project-wide map. Resolve platform variants into single product features, dedupe near-duplicates, and ensure no file is dropped. After producing the unified map, call `save_snapshot` to persist it (this also clears the partials).",
     {
-      dir: z24.string().describe("Absolute path to the project root directory")
+      dir: z25.string().describe("Absolute path to the project root directory")
     },
     async ({ dir }) => {
       const result = await reduceSnapshot(dir);
@@ -9869,25 +10245,25 @@ function createMcpServer() {
     "save_snapshot",
     "Save a concept-to-files map as a persistent project snapshot. Maps feature names and data flows to the files that implement them. Persists across conversations \u2014 future sessions can call get_snapshot to instantly find relevant files. No API key needed \u2014 you are the LLM generating the map.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory"),
-      features: z24.record(
-        z24.object({
-          description: z24.string().describe("One-line description of the feature"),
-          files: z24.array(z24.string()).describe("File paths that implement this feature"),
-          tests: z24.array(z24.string()).optional().describe("Test file paths for this feature"),
-          type: z24.enum(["capability", "infrastructure"]).optional().describe(
+      dir: z25.string().describe("Absolute path to the project root directory"),
+      features: z25.record(
+        z25.object({
+          description: z25.string().describe("One-line description of the feature"),
+          files: z25.array(z25.string()).describe("File paths that implement this feature"),
+          tests: z25.array(z25.string()).optional().describe("Test file paths for this feature"),
+          type: z25.enum(["capability", "infrastructure"]).optional().describe(
             'Classification: "capability" for user-facing functionality, "infrastructure" for internal plumbing with no end user (DI/service wiring, config, logging, adapters). Capabilities are published to Confluence; infrastructure stays in the AI concept map only. Defaults to "capability".'
           )
         })
       ).describe("Map of feature names to their implementing files"),
-      flows: z24.record(
-        z24.object({
-          description: z24.string().describe("One-line description of the flow"),
-          chain: z24.array(z24.string()).describe("Ordered list of file paths showing data/call flow")
+      flows: z25.record(
+        z25.object({
+          description: z25.string().describe("One-line description of the flow"),
+          chain: z25.array(z25.string()).describe("Ordered list of file paths showing data/call flow")
         })
       ).describe("Map of flow names to ordered file chains"),
-      removeFeatures: z24.array(z24.string()).optional().describe("Feature names to delete from the existing map \u2014 for features that were renamed or no longer exist. Applied before merging; only meaningful on incremental saves."),
-      removeFlows: z24.array(z24.string()).optional().describe("Flow names to delete from the existing map. Applied before merging; only meaningful on incremental saves.")
+      removeFeatures: z25.array(z25.string()).optional().describe("Feature names to delete from the existing map \u2014 for features that were renamed or no longer exist. Applied before merging; only meaningful on incremental saves."),
+      removeFlows: z25.array(z25.string()).optional().describe("Flow names to delete from the existing map. Applied before merging; only meaningful on incremental saves.")
     },
     async ({ dir, features, flows, removeFeatures, removeFlows }) => {
       const result = await saveSnapshotData(
@@ -9904,19 +10280,19 @@ function createMcpServer() {
   );
   server.tool(
     "save_decision",
-    "Capture or revise a decision proposal with rationale, anchors, optional owner, sources, and a known actor. Compare matching get_context records and pending proposals before saving. When new evidence changes the same lesson's assumptions, scope, or recommended action, pass its existing id, including for accepted records. Preserve supported rationale and sources and replace obsolete instructions. Create a new record for a genuinely distinct lesson; skip unchanged restatements. No setup or map required. Writes a local record and preserves content history. Changes create a pending proposal while the last accepted revision remains operative; unchanged content does not re-verify or refresh it. Use review_decision for authorized acceptance or reaffirmation. A proposal cannot supersede a record with an operative accepted revision; review its replacement and retire the original separately.",
+    "Capture or revise a decision proposal as soon as the lesson is supported by evidence, without waiting for implementation or merge. Keep unimplemented remedies tentative. Include rationale, anchors, optional owner, sources, and a known actor. Compare matching get_context records and pending proposals before saving. When new evidence changes the same lesson's assumptions, scope, or recommended action, pass its existing id, including for accepted records. Preserve supported rationale and sources and replace obsolete instructions. Create a new record for a genuinely distinct lesson; skip unchanged restatements. No setup or map required. Writes a local record and preserves content history. Changes create a pending proposal while the last accepted revision remains operative; unchanged content does not re-verify or refresh it. Use review_decision for authorized acceptance or reaffirmation. A proposal cannot supersede a record with an operative accepted revision; review its replacement and retire the original separately.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory"),
+      dir: z25.string().describe("Absolute path to the project root directory"),
       title: decisionTitleSchema.describe(`Short, specific headline (max ${TITLE_MAX_CHARS} characters). Generates a stable id on creation; revising the title keeps the existing id.`),
       body: decisionBodySchema.describe(`The knowledge itself: what was tried/decided, why, and what to avoid. Must contain information NOT derivable by reading the code. Aim for ${BODY_RECOMMENDED_CHARS} characters or fewer; up to ${BODY_MAX_CHARS} is accepted with a warning above the target. Matching context and hooks include the full body. Preserve exceptions; use sources for supporting references.`),
-      category: z24.enum(["decision", "gotcha", "deprecation", "convention"]),
-      files: z24.array(z24.string()).optional().describe("Repo-relative files or directory prefixes this applies to. Matching is shared by retrieval, hooks, review, and drift checking; changes flag the decision for re-verification."),
-      id: z24.string().optional().describe("Pass the matching record's existing id when evidence changes that lesson's assumptions, scope, or recommended action, including for accepted records. Changed content becomes a proposal while the accepted version remains operative; unchanged content leaves review and freshness untouched."),
-      supersedes: z24.string().optional().describe("Id of an unreviewed record or proposal with no accepted revision to replace. Operative accepted decisions require separate review and retirement."),
+      category: z25.enum(["decision", "gotcha", "deprecation", "convention"]),
+      files: z25.array(z25.string()).optional().describe("Repo-relative files or directory prefixes this applies to. Matching is shared by retrieval, hooks, review, and drift checking; changes flag the decision for re-verification."),
+      id: z25.string().optional().describe("Pass the matching record's existing id when evidence changes that lesson's assumptions, scope, or recommended action, including for accepted records. Changed content becomes a proposal while the accepted version remains operative; unchanged content leaves review and freshness untouched."),
+      supersedes: z25.string().optional().describe("Id of an unreviewed record or proposal with no accepted revision to replace. Operative accepted decisions require separate review and retirement."),
       owner: attributionSchema.shape.owner.describe("Responsible person or team, when known. Null clears it. Required for acceptance."),
       sources: attributionSchema.shape.sources.describe("Known PR, issue, incident, discussion, or document references. Omit to preserve; [] clears. At least one is required for acceptance."),
       actor: attributionSchema.shape.actor.describe("Known person or agent recording this revision. Omit if unknown; do not infer from Git identity."),
-      force: z24.boolean().optional().describe("Save even when a near-duplicate was detected")
+      force: z25.boolean().optional().describe("Save even when a near-duplicate was detected")
     },
     async ({ dir, title, body, category, files, id, supersedes, force, owner, sources, actor }) => {
       const result = await saveDecision(dir, {
@@ -9938,12 +10314,12 @@ function createMcpServer() {
     "review_decision",
     "Prepare a decision review: returns the full record and history, any operative accepted revision, provenance, changes and previews for both sets of anchors, and a reviewToken. Then record accept, reaffirm, or retire with that token, the authorized reviewer, and a reason. Acceptance replaces the operative revision; retirement withdraws the entire record including its proposal. Acceptance requires owner, source, readable Git HEAD, and committed anchor changes. Changed records or code invalidate the token. Identities and approvals are recorded assertions for normal PR review, not authenticated proof.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory"),
-      id: z24.string().regex(/^[a-zA-Z0-9_-]+$/).describe("Decision id from get_context or save_decision"),
-      action: z24.enum(["prepare", "accept", "reaffirm", "retire"]).optional().default("prepare").describe("Prepare is read-only. Other actions record an explicitly authorized review."),
-      reviewer: z24.string().trim().min(1).max(200).optional().describe("Identity of the actual reviewer; required for a verdict. Never invent one."),
-      note: z24.string().trim().min(1).max(1500).optional().describe("Review rationale; required for a verdict. Cite evidence for the decision."),
-      reviewToken: z24.string().regex(/^[a-f0-9]{64}$/).optional().describe("Token from the prepared review; rejects stale record or code revisions")
+      dir: z25.string().describe("Absolute path to the project root directory"),
+      id: z25.string().regex(/^[a-zA-Z0-9_-]+$/).describe("Decision id from get_context or save_decision"),
+      action: z25.enum(["prepare", "accept", "reaffirm", "retire"]).optional().default("prepare").describe("Prepare is read-only. Other actions record an explicitly authorized review."),
+      reviewer: z25.string().trim().min(1).max(200).optional().describe("Identity of the actual reviewer; required for a verdict. Never invent one."),
+      note: z25.string().trim().min(1).max(1500).optional().describe("Review rationale; required for a verdict. Cite evidence for the decision."),
+      reviewToken: z25.string().regex(/^[a-f0-9]{64}$/).optional().describe("Token from the prepared review; rejects stale record or code revisions")
     },
     async ({ dir, ...input }) => {
       const result = await reviewDecision2(dir, input);
@@ -9954,7 +10330,7 @@ function createMcpServer() {
     "mason_check_drift",
     "Check how far the concept map has drifted from HEAD. Deterministic (git + filesystem, no LLM). Returns which features/flows are stale and the changed files behind them, new source files not yet mapped, ghost files (mapped but deleted), renames, and a `recommendation`: `up-to-date` (nothing to do), `incremental` (update just the stale entries via save_snapshot), or `full-rebuild` (re-run the Map-Reduce build). Call this before trusting the map in a long session, or periodically to keep the map and any synced wikis fresh.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory")
+      dir: z25.string().describe("Absolute path to the project root directory")
     },
     async ({ dir }) => {
       const result = await checkDrift(dir);
@@ -9967,8 +10343,8 @@ function createMcpServer() {
     "verify_snapshot",
     "Spot-check the concept map's CORRECTNESS (drift checks freshness; this checks entries were right to begin with). Returns a sample of entries \u2014 always the never-verified and least-recently-verified first \u2014 with skeletons of their claimed files, for you to judge whether the files actually implement what the entry claims. Report verdicts back via save_verification with each entry\u2019s kind and reviewToken. Tokens bind the entry and bounded source evidence; changed evidence requires a fresh review. Run periodically, or after an automated refresh wrote entries no human reviewed.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory"),
-      sample: z24.number().int().optional().describe("Entries to sample (default 5)")
+      dir: z25.string().describe("Absolute path to the project root directory"),
+      sample: z25.number().int().optional().describe("Entries to sample (default 5)")
     },
     async ({ dir, sample }) => {
       const result = await verifySnapshot(dir, sample);
@@ -9979,13 +10355,13 @@ function createMcpServer() {
     "save_verification",
     "Record verify_snapshot verdicts using each entry\u2019s kind and reviewToken. Missing tokens request a fresh review; changed or deleted entries return conflicts without being stamped. Entries judged ok are stamped verifiedAt; failures are flagged verificationFailed with your note and surface in get_context, get_snapshot, and mason_check_drift until corrected. Verdict notes are required for failures.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory"),
-      verdicts: z24.record(
-        z24.object({
-          kind: z24.enum(["feature", "flow"]).optional().describe("Entry kind returned by verify_snapshot; required to record a verdict"),
-          reviewToken: z24.string().optional().describe("Copy the reviewToken from verify_snapshot after inspecting its evidence; required to record a verdict"),
-          ok: z24.boolean(),
-          note: z24.string().optional().describe("One line on what's wrong \u2014 required when ok is false")
+      dir: z25.string().describe("Absolute path to the project root directory"),
+      verdicts: z25.record(
+        z25.object({
+          kind: z25.enum(["feature", "flow"]).optional().describe("Entry kind returned by verify_snapshot; required to record a verdict"),
+          reviewToken: z25.string().optional().describe("Copy the reviewToken from verify_snapshot after inspecting its evidence; required to record a verdict"),
+          ok: z25.boolean(),
+          note: z25.string().optional().describe("One line on what's wrong \u2014 required when ok is false")
         })
       ).describe("Entry name \u2192 verdict, exactly as returned by verify_snapshot")
     },
@@ -9998,8 +10374,8 @@ function createMcpServer() {
     "get_impact",
     "Trace historical co-change partners, related tests, and references with evidence: resolved imports, explicit paths, or uncertain name candidates. Candidates are not proven dependencies. Deterministic and read-only; no initialization or concept map required.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory"),
-      files: z24.array(z24.string()).describe("File paths or names to analyze (e.g., ['WeatherRepository.kt'] or ['src/services/auth.ts'])")
+      dir: z25.string().describe("Absolute path to the project root directory"),
+      files: z25.array(z25.string()).describe("File paths or names to analyze (e.g., ['WeatherRepository.kt'] or ['src/services/auth.ts'])")
     },
     async ({ dir, files }) => {
       const result = await getImpact(dir, files);
@@ -10012,12 +10388,12 @@ function createMcpServer() {
     "export_to_confluence",
     "Sync the project's concept map to Confluence as product-readable wiki pages: an index page, one page per feature (PM-language descriptions, no file paths), and a changelog page. Mason replaces managed page bodies; manual edits to those bodies are overwritten. Requires `mason_set_confluence` to have been called first.",
     {
-      dir: z24.string().describe("Absolute path to the project root directory"),
-      spaceKey: z24.string().optional().describe("Override the configured space key"),
-      parentPageId: z24.string().optional().describe("Override the configured parent page ID"),
-      indexPageTitle: z24.string().optional().describe("Title of the index page (default: 'Mason \u2014 System Map')"),
-      changelogPageTitle: z24.string().optional().describe("Title of the changelog page (default: 'Mason \u2014 Changelog')"),
-      featurePagePrefix: z24.string().optional().describe("Prefix for each feature page title (default: 'Feature: ')")
+      dir: z25.string().describe("Absolute path to the project root directory"),
+      spaceKey: z25.string().optional().describe("Override the configured space key"),
+      parentPageId: z25.string().optional().describe("Override the configured parent page ID"),
+      indexPageTitle: z25.string().optional().describe("Title of the index page (default: 'Mason \u2014 System Map')"),
+      changelogPageTitle: z25.string().optional().describe("Title of the changelog page (default: 'Mason \u2014 Changelog')"),
+      featurePagePrefix: z25.string().optional().describe("Prefix for each feature page title (default: 'Feature: ')")
     },
     async ({ dir, spaceKey, parentPageId, indexPageTitle, changelogPageTitle, featurePagePrefix }) => {
       const result = await exportToConfluenceTool(dir, {
@@ -10043,38 +10419,38 @@ async function startMcpServer(onClose) {
 init_store();
 init_storage();
 import fs33 from "fs/promises";
-import path41 from "path";
+import path42 from "path";
 import { spawn as spawn3 } from "child_process";
 import { randomUUID as randomUUID11 } from "crypto";
-import { z as z30 } from "zod";
+import { z as z31 } from "zod";
 
 // src/distribution/state.ts
 init_storage();
 import os5 from "os";
-import path37 from "path";
+import path38 from "path";
 import { fileURLToPath } from "url";
 import fs28 from "fs/promises";
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 
 // src/distribution/path.ts
 import fs27 from "fs/promises";
 import os4 from "os";
-import path36 from "path";
+import path37 from "path";
 import { execFile as execFile12 } from "child_process";
 import { promisify as promisify12 } from "util";
 import { createHash as createHash7, randomUUID as randomUUID7 } from "crypto";
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 var execute2 = promisify12(execFile12);
-var pathChangeSchema = z25.discriminatedUnion("kind", [
-  z25.object({ kind: z25.literal("profile"), file: z25.string(), block: z25.string(), created: z25.boolean() }),
-  z25.object({ kind: z25.literal("windows"), entry: z25.string(), created: z25.boolean() })
+var pathChangeSchema = z26.discriminatedUnion("kind", [
+  z26.object({ kind: z26.literal("profile"), file: z26.string(), block: z26.string(), created: z26.boolean() }),
+  z26.object({ kind: z26.literal("windows"), entry: z26.string(), created: z26.boolean() })
 ]);
 var quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
 async function configurePath(bin, previous, save, options = {}) {
   const env = options.env ?? process.env, platform = options.platform ?? process.platform;
   const changes = [...previous];
   const currentPath = platform === "win32" ? Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] : env.PATH;
-  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path36.posix.isAbsolute(entry) && path36.posix.resolve(entry) === path36.posix.resolve(bin));
+  const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some((entry) => path37.posix.isAbsolute(entry) && path37.posix.resolve(entry) === path37.posix.resolve(bin));
   const setupHint = "To connect a project, run one of these inside its directory:\n  Codex:       mason setup --host codex\n  Claude Code: mason setup --host claude";
   const message2 = (alreadyOnPath ? "" : "Open a new terminal to use mason.\n") + setupHint;
   const manual = (reason2) => ({ status: "manual", changes, message: `${reason2}
@@ -10094,15 +10470,15 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
       }
       return { status: "configured", changes, message: message2 };
     }
-    const shell = path36.basename(env.SHELL ?? os4.userInfo().shell ?? "");
+    const shell = path37.basename(env.SHELL ?? os4.userInfo().shell ?? "");
     const userHome = options.userHome ?? os4.homedir();
     let profiles2;
     if (!["bash", "zsh", "sh"].includes(shell)) return manual(`Automatic PATH setup is unavailable for ${shell || "an unknown shell"}.`);
-    if (env.MASON_PROFILE) profiles2 = [path36.resolve(env.MASON_PROFILE)];
-    else if (shell === "zsh") profiles2 = [path36.join(env.ZDOTDIR || userHome, ".zshrc")];
-    else if (shell === "sh") profiles2 = [path36.join(userHome, ".profile")];
+    if (env.MASON_PROFILE) profiles2 = [path37.resolve(env.MASON_PROFILE)];
+    else if (shell === "zsh") profiles2 = [path37.join(env.ZDOTDIR || userHome, ".zshrc")];
+    else if (shell === "sh") profiles2 = [path37.join(userHome, ".profile")];
     else {
-      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path36.join(userHome, name));
+      const candidates = [".bash_profile", ".bash_login", ".profile"].map((name) => path37.join(userHome, name));
       let login = candidates[2];
       for (const file of candidates) if (await fs27.lstat(file).then(() => true, (error) => {
         if (error.code === "ENOENT") return false;
@@ -10111,7 +10487,7 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
         login = file;
         break;
       }
-      profiles2 = [path36.join(userHome, ".bashrc"), login];
+      profiles2 = [path37.join(userHome, ".bashrc"), login];
     }
     const marker = `# >>> mason PATH ${createHash7("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
     for (const profile of profiles2) {
@@ -10119,7 +10495,7 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
         if (error.code === "ENOENT") return null;
         throw error;
       });
-      const file = stat?.isSymbolicLink() ? await fs27.realpath(profile) : path36.resolve(profile);
+      const file = stat?.isSymbolicLink() ? await fs27.realpath(profile) : path37.resolve(profile);
       const original = await fs27.readFile(file).catch((error) => {
         if (error.code === "ENOENT" && !stat) return null;
         throw error;
@@ -10135,7 +10511,7 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
         changes.push({ kind: "profile", file, block, created: original === null });
         await save(changes);
       }
-      await fs27.mkdir(path36.dirname(file), { recursive: true });
+      await fs27.mkdir(path37.dirname(file), { recursive: true });
       const handle = await fs27.open(file, original === null ? "ax+" : "a+", 384);
       try {
         if (!(await handle.readFile()).equals(original ?? Buffer.alloc(0))) throw new Error(`Shell profile changed during installation: ${profile}`);
@@ -10150,7 +10526,7 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
     return manual(`Could not configure PATH: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
-var normalizeWindowsEntry = (value) => path36.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
+var normalizeWindowsEntry = (value) => path37.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
 var hasWindowsEntry = (value, entry, env = process.env) => {
   const variables = new Map(Object.entries(env).map(([key, value2]) => [key.toLowerCase(), value2]));
   const expand = (part) => part.replace(/%([^%]+)%/g, (match, key) => variables.get(key.toLowerCase()) ?? match);
@@ -10187,26 +10563,26 @@ try {
 }
 
 // src/distribution/state.ts
-var releaseVersion = z26.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/);
-var bundleId = z26.string().regex(/^[a-f0-9]{24}$/);
-var updatePolicySchema = z26.object({
-  enabled: z26.boolean(),
-  revision: z26.string(),
+var releaseVersion = z27.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/);
+var bundleId = z27.string().regex(/^[a-f0-9]{24}$/);
+var updatePolicySchema = z27.object({
+  enabled: z27.boolean(),
+  revision: z27.string(),
   pinnedVersion: releaseVersion.optional(),
-  mirror: z26.string().optional()
+  mirror: z27.string().optional()
 });
-var recordSchema3 = z26.object({
-  format: z26.literal(1),
-  home: z26.string(),
-  bin: z26.string(),
+var recordSchema3 = z27.object({
+  format: z27.literal(1),
+  home: z27.string(),
+  bin: z27.string(),
   current: bundleId,
   version: releaseVersion,
-  launchers: z26.record(z26.string()),
-  previousLaunchers: z26.record(z26.string()).optional(),
-  pathChanges: z26.array(pathChangeSchema).optional(),
+  launchers: z27.record(z27.string()),
+  previousLaunchers: z27.record(z27.string()).optional(),
+  pathChanges: z27.array(pathChangeSchema).optional(),
   updates: updatePolicySchema.optional(),
-  previous: z26.object({ id: bundleId, version: releaseVersion }).optional(),
-  pending: z26.object({ id: bundleId, version: releaseVersion, policyRevision: z26.string() }).optional()
+  previous: z27.object({ id: bundleId, version: releaseVersion }).optional(),
+  pending: z27.object({ id: bundleId, version: releaseVersion, policyRevision: z27.string() }).optional()
 });
 async function readInstallation(home) {
   const raw = await readStoreJson(home, "install.json");
@@ -10216,9 +10592,9 @@ async function readInstallation(home) {
   return record;
 }
 function standaloneLocation() {
-  const bundle = path37.resolve(path37.dirname(fileURLToPath(import.meta.url)), "../..");
-  const home = path37.dirname(path37.dirname(bundle));
-  if (path37.dirname(bundle) !== path37.join(home, "versions") || !/^[a-f0-9]{24}$/.test(path37.basename(bundle))) {
+  const bundle = path38.resolve(path38.dirname(fileURLToPath(import.meta.url)), "../..");
+  const home = path38.dirname(path38.dirname(bundle));
+  if (path38.dirname(bundle) !== path38.join(home, "versions") || !/^[a-f0-9]{24}$/.test(path38.basename(bundle))) {
     return null;
   }
   return { home, bundle };
@@ -10245,17 +10621,17 @@ function newerStableVersion(candidate, installed) {
 // src/distribution/bundle.ts
 init_storage();
 import fs29 from "fs/promises";
-import path38 from "path";
+import path39 from "path";
 import { createHash as createHash8 } from "crypto";
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 var targets = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-arm64", "win32-x64"];
-var digest2 = z27.string().regex(/^[a-f0-9]{64}$/);
-var bundleSchema = z27.object({
-  format: z27.literal(1),
-  version: z27.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
-  target: z27.enum(targets),
-  nodeVersion: z27.string(),
-  files: z27.record(digest2)
+var digest2 = z28.string().regex(/^[a-f0-9]{64}$/);
+var bundleSchema = z28.object({
+  format: z28.literal(1),
+  version: z28.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
+  target: z28.enum(targets),
+  nodeVersion: z28.string(),
+  files: z28.record(digest2)
 }).strict();
 var sha256 = (bytes) => createHash8("sha256").update(bytes).digest("hex");
 async function readBundle(root) {
@@ -10263,7 +10639,7 @@ async function readBundle(root) {
   const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
   const windows = manifest.target.startsWith("win32-");
   for (const file of Object.keys(manifest.files)) {
-    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path38.isAbsolute(file)) {
+    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path39.isAbsolute(file)) {
       throw new Error("Unsafe path in Mason bundle: " + file);
     }
   }
@@ -10289,15 +10665,20 @@ init_storage();
 import fs30 from "fs/promises";
 import { unlinkSync } from "fs";
 import os6 from "os";
-import path39 from "path";
+import path40 from "path";
 import { randomUUID as randomUUID8 } from "crypto";
-import { z as z28 } from "zod";
-var leaseSchema = z28.object({ pid: z28.number().int().positive(), host: z28.string(), bundle: z28.string().regex(/^[a-f0-9]{24}$/) });
+import { z as z29 } from "zod";
+
+// src/distribution/trust.ts
+import tls from "tls";
+
+// src/distribution/runtime.ts
+var leaseSchema = z29.object({ pid: z29.number().int().positive(), host: z29.string(), bundle: z29.string().regex(/^[a-f0-9]{24}$/) });
 
 // src/distribution/install.ts
 import fs32 from "fs/promises";
 import os8 from "os";
-import path40 from "path";
+import path41 from "path";
 import { execFile as execFile13, spawn as spawn2 } from "child_process";
 import { promisify as promisify13 } from "util";
 import { randomUUID as randomUUID10 } from "crypto";
@@ -10309,8 +10690,8 @@ init_storage();
 import fs31 from "fs/promises";
 import os7 from "os";
 import { randomUUID as randomUUID9 } from "crypto";
-import { z as z29 } from "zod";
-var leaseSchema2 = z29.object({ pid: z29.number().int().positive(), host: z29.string() });
+import { z as z30 } from "zod";
+var leaseSchema2 = z30.object({ pid: z30.number().int().positive(), host: z30.string() });
 async function hasRunningMcp(home) {
   const directory = await storePath(home, "sessions");
   const files = await fs31.readdir(directory).catch((error) => {
@@ -10372,13 +10753,13 @@ async function installLocked2(home, source, bundle, progress, options, alreadySt
   if (options.stageOnly) assertUpdatePolicy(previous, bundle.manifest.version, options.policyRevision);
   if (!previous) for (const file of await fs32.readdir(home)) {
     if (file === ".install-lock") continue;
-    const directory = path40.join(home, file);
+    const directory = path41.join(home, file);
     const stat = await fs32.lstat(directory);
     if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs32.readdir(directory)).length) {
       throw new Error("Mason installation directory is not empty and has no ownership receipt.");
     }
   }
-  const selectedBin = path40.resolve(process.env.MASON_BIN_DIR ?? previous?.bin ?? (process.platform === "win32" ? path40.join(home, "bin") : path40.join(os8.homedir(), ".local/bin")));
+  const selectedBin = path41.resolve(process.env.MASON_BIN_DIR ?? previous?.bin ?? (process.platform === "win32" ? path41.join(home, "bin") : path41.join(os8.homedir(), ".local/bin")));
   await fs32.mkdir(selectedBin, { recursive: true });
   const bin = await fs32.realpath(selectedBin);
   if (previous && (previous.home !== home || previous.bin !== bin)) throw new Error("Installation paths differ from the existing Mason receipt.");
@@ -10396,10 +10777,10 @@ $previousToken = $env:MASON_UNINSTALL_TOKEN
 $token = [Guid]::NewGuid().ToString()
 $env:MASON_UNINSTALL_TOKEN = $token
 try {
-  & ${psQuote(path40.join(destination, "node.exe"))} ${psQuote(path40.join(destination, "app/dist/mason.js"))} @args
+  & ${psQuote(path41.join(destination, "node.exe"))} ${psQuote(path41.join(destination, "app/dist/mason.js"))} @args
   $code = $LASTEXITCODE
   if ($code -eq 0 -and $args.Count -eq 1 -and $args[0] -eq 'uninstall') {
-    if ([IO.File]::ReadAllText(${psQuote(path40.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
+    if ([IO.File]::ReadAllText(${psQuote(path41.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
     Remove-Item -LiteralPath ${psQuote(home)} -Recurse -Force
     Write-Output ${psQuote("Removed standalone installation: " + home)}
   }
@@ -10408,7 +10789,7 @@ try {
 finally { $env:MASON_UNINSTALL_TOKEN = $previousToken }
 `
   } : { mason: `#!/bin/sh
-exec ${shQuote(path40.join(destination, "node"))} ${shQuote(path40.join(destination, "app/dist/mason.js"))} "$@"
+exec ${shQuote(path41.join(destination, "node"))} ${shQuote(path41.join(destination, "app/dist/mason.js"))} "$@"
 ` };
   for (const [name, content2] of Object.entries(launchers)) {
     const file = await storePath(bin, name);
@@ -10540,14 +10921,14 @@ async function prepareStandaloneMcp(home) {
 // src/distribution/updates.ts
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var RELEASE_AGE_MS = 24 * 60 * 60 * 1e3;
-var releaseListSchema = z30.array(z30.object({ tag_name: z30.string(), draft: z30.boolean(), prerelease: z30.boolean(), published_at: z30.string().nullable() }));
-var updateManifestSchema = z30.object({
-  format: z30.literal(1),
-  version: z30.string().regex(/^\d+\.\d+\.\d+$/),
-  publishedAt: z30.string().datetime(),
-  assets: z30.record(z30.string().regex(/^[a-f0-9]{64}$/))
+var releaseListSchema = z31.array(z31.object({ tag_name: z31.string(), draft: z31.boolean(), prerelease: z31.boolean(), published_at: z31.string().nullable() }));
+var updateManifestSchema = z31.object({
+  format: z31.literal(1),
+  version: z31.string().regex(/^\d+\.\d+\.\d+$/),
+  publishedAt: z31.string().datetime(),
+  assets: z31.record(z31.string().regex(/^[a-f0-9]{64}$/))
 }).strict();
-var statusSchema2 = z30.object({ lastAttempt: z30.number(), availableVersion: z30.string().optional(), error: z30.string().optional() });
+var statusSchema2 = z31.object({ lastAttempt: z31.number(), availableVersion: z31.string().optional(), error: z31.string().optional() });
 async function scheduleAutomaticUpdate() {
   try {
     const { home, record } = await currentInstallation();
@@ -10557,8 +10938,8 @@ async function scheduleAutomaticUpdate() {
     if (status.success && status.data.lastAttempt <= now && now - status.data.lastAttempt < CHECK_INTERVAL_MS) return;
     const bundle = await storePath(home, "versions/" + record.current);
     const child = spawn3(
-      path41.join(bundle, process.platform === "win32" ? "node.exe" : "node"),
-      [path41.join(bundle, "app/dist/mason.js"), "internal-update"],
+      path42.join(bundle, process.platform === "win32" ? "node.exe" : "node"),
+      [path42.join(bundle, "app/dist/mason.js"), "internal-update"],
       { cwd: home, env: process.env, stdio: "ignore", detached: true, windowsHide: true }
     );
     child.on("error", () => {
@@ -10576,8 +10957,8 @@ async function startMcpWithUpdates(start) {
   const session = await prepareStandaloneMcp(current.home);
   if (session.bundle !== current.bundle) {
     const child = spawn3(
-      path41.join(session.bundle, process.platform === "win32" ? "node.exe" : "node"),
-      [path41.join(session.bundle, "app/dist/mason-mcp.js"), ...process.argv.slice(2)],
+      path42.join(session.bundle, process.platform === "win32" ? "node.exe" : "node"),
+      [path42.join(session.bundle, "app/dist/mason-mcp.js"), ...process.argv.slice(2)],
       { stdio: "inherit", windowsHide: true }
     );
     const interrupt = () => {