mason-context 0.20.1 → 0.21.0

package/dist/mason-review.js

@@ -31,12 +31,12 @@ var init_types = __esm({
 });
 
 // src/review/cli.ts
-import path12 from "path";
+import path13 from "path";
 import { stripVTControlCharacters } from "util";
 
 // src/review/review.ts
-import fs6 from "fs/promises";
-import path11 from "path";
+import fs7 from "fs/promises";
+import path12 from "path";
 import { execFile as execFile3 } from "child_process";
 import { promisify as promisify3 } from "util";
 
@@ -62,7 +62,19 @@ async function profilePhase(label, run) {
 
 // src/utils/git-read.ts
 var execute = promisify(execFile);
-var commands = /* @__PURE__ */ new Set(["rev-parse", "symbolic-ref", "for-each-ref", "ls-files", "check-ignore", "status", "log", "diff", "ls-tree", "show", "merge-base"]);
+var commands = /* @__PURE__ */ new Set([
+  "rev-parse",
+  "symbolic-ref",
+  "for-each-ref",
+  "ls-files",
+  "check-ignore",
+  "status",
+  "log",
+  "diff",
+  "ls-tree",
+  "show",
+  "merge-base"
+]);
 function execGit(args, options) {
   const command = args.find((arg) => !arg.startsWith("-")) ?? "other";
   return profilePhase("git." + (commands.has(command) ? command : "other"), async () => {
@@ -84,6 +96,14 @@ import path6 from "path";
 // src/snapshot/snapshot.ts
 import path5 from "path";
 
+// src/utils/validation.ts
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+
 // src/utils/files.ts
 import fs from "fs/promises";
 import { constants } from "fs";
@@ -94,7 +114,8 @@ import fg from "fast-glob";
 import path from "path";
 function normalizeRepoPath(value) {
   const slash = value.replace(/\\/g, "/");
-  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash)) return null;
+  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash))
+    return null;
   if (slash.split("/").includes("..")) return null;
   const normalized = path.posix.normalize(slash).replace(/\/$/, "");
   return normalized === "." ? null : normalized;
@@ -109,11 +130,69 @@ function anchorMatches(anchor, file) {
   return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
 }
 function matchingPaths(anchors, files) {
-  return [...new Set(files)].filter((file) => anchors.some((anchor) => anchorMatches(anchor, file)));
+  return [...new Set(files)].filter(
+    (file) => anchors.some((anchor) => anchorMatches(anchor, file))
+  );
+}
+function indexMatchingPaths(scopes, files) {
+  const node = () => ({ children: /* @__PURE__ */ new Map(), scopes: /* @__PURE__ */ new Set() });
+  const root = node();
+  const matches = scopes.map(() => []);
+  scopes.forEach((anchors, index2) => {
+    for (const anchor of anchors) {
+      const normalized = normalizeRepoPath(anchor);
+      if (!normalized) continue;
+      let current = root;
+      for (const part of normalized.split("/")) {
+        if (!current.children.has(part)) current.children.set(part, node());
+        current = current.children.get(part);
+      }
+      current.scopes.add(index2);
+    }
+  });
+  for (const file of new Set(files)) {
+    const normalized = normalizeRepoPath(file);
+    if (!normalized) continue;
+    const selected = /* @__PURE__ */ new Set();
+    let current = root;
+    for (const part of normalized.split("/")) {
+      current = current.children.get(part);
+      if (!current) break;
+      for (const index2 of current.scopes) selected.add(index2);
+    }
+    for (const index2 of selected) matches[index2].push(file);
+  }
+  return matches;
 }
 
 // src/utils/files.ts
-var SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
+var SOURCE_EXTENSIONS = [
+  "ts",
+  "tsx",
+  "js",
+  "jsx",
+  "mts",
+  "cts",
+  "mjs",
+  "cjs",
+  "vue",
+  "svelte",
+  "kt",
+  "kts",
+  "java",
+  "py",
+  "go",
+  "rs",
+  "swift",
+  "rb",
+  "cs",
+  "cpp",
+  "c",
+  "h",
+  "hpp",
+  "dart",
+  "php"
+];
 var SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
 var SOURCE_IGNORE = [
   "**/node_modules/**",
@@ -141,11 +220,16 @@ var SOURCE_IGNORE = [
 var MAX_SOURCE_BYTES = 1024 * 1024;
 function isSensitiveFile(file) {
   return file.split(/[\\/]/).some(
-    (part) => /^(?:\.env(?:\..*)?|id_rsa.*|id_ed25519.*)$|\.(?:pem|key|p12|pfx|jks|keystore)$|credentials\.|secret|^local\.properties$/i.test(part)
+    (part) => /^(?:\.env(?:\..*)?|id_rsa.*|id_ed25519.*)$|\.(?:pem|key|p12|pfx|jks|keystore)$|credentials\.|secret|^local\.properties$/i.test(
+      part
+    )
   );
 }
 async function readBoundedFile(file, maxBytes) {
-  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  const handle = await fs.open(
+    file,
+    constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW
+  );
   try {
     const stat = await handle.stat();
     if (!stat.isFile() || stat.size > maxBytes) return null;
@@ -165,36 +249,44 @@ async function loadProjectConfig(root) {
   try {
     const canonicalRoot = await fs.realpath(root);
     const configPath = await fs.realpath(path2.join(root, ".mason/config.json"));
-    if (!isWithinRoot(canonicalRoot, configPath)) throw new Error("Project configuration resolves outside the repository");
+    if (!isWithinRoot(canonicalRoot, configPath))
+      throw new Error("Project configuration resolves outside the repository");
     const raw = await readBoundedFile(configPath, 64 * 1024);
-    if (raw === null) throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
+    if (raw === null)
+      throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
     const value = JSON.parse(raw);
-    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected a configuration object");
+    if (!isRecord(value)) throw new Error("Expected a configuration object");
     const config = {};
     for (const key of ["patterns", "alwaysInclude", "ignore"]) {
       if (value[key] === void 0) continue;
-      if (!Array.isArray(value[key]) || !value[key].every((s) => typeof s === "string")) {
+      if (!isStringArray(value[key])) {
         throw new Error(`Configuration ${key} must be an array of strings`);
       }
       config[key] = value[key];
     }
     if (value.audit !== void 0) {
       const audit = value.audit;
-      if (!audit || typeof audit !== "object" || Array.isArray(audit)) throw new Error("Configuration audit must be an object");
+      if (!isRecord(audit)) throw new Error("Configuration audit must be an object");
       const patterns = (raw2) => {
-        if (!Array.isArray(raw2) || raw2.length > 100 || !raw2.every((s) => typeof s === "string" && normalizeRepoPath(s) === s && !s.startsWith("!") && !/[\x00-\x1f]/.test(s))) {
-          throw new Error("Audit patterns must be at most 100 repository-relative globs without traversal or negation");
+        if (!isStringArray(raw2) || raw2.length > 100 || !raw2.every(
+          (s) => typeof s === "string" && normalizeRepoPath(s) === s && !s.startsWith("!") && !/[\x00-\x1f]/.test(s)
+        )) {
+          throw new Error(
+            "Audit patterns must be at most 100 repository-relative globs without traversal or negation"
+          );
         }
         return raw2;
       };
       config.audit = {};
       if (audit.include !== void 0) config.audit.include = patterns(audit.include);
       if (audit.exclude !== void 0) {
-        if (!audit.exclude || typeof audit.exclude !== "object" || Array.isArray(audit.exclude)) throw new Error("audit.exclude must map check names to patterns");
+        if (!isRecord(audit.exclude))
+          throw new Error("audit.exclude must map check names to patterns");
         const { ALL_CHECKS: ALL_CHECKS2 } = await Promise.resolve().then(() => (init_types(), types_exports));
         config.audit.exclude = {};
         for (const [check, globs] of Object.entries(audit.exclude)) {
-          if (!ALL_CHECKS2.includes(check)) throw new Error("Unknown audit check: " + check);
+          if (!ALL_CHECKS2.includes(check))
+            throw new Error("Unknown audit check: " + check);
           config.audit.exclude[check] = patterns(globs);
         }
       }
@@ -202,7 +294,10 @@ async function loadProjectConfig(root) {
     return config;
   } catch (error) {
     if (error.code === "ENOENT") return {};
-    throw new Error(`Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`);
+    throw new Error(
+      `Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error }
+    );
   }
 }
 async function createFileAccess(rootDir) {
@@ -212,7 +307,10 @@ async function createFileAccess(rootDir) {
   const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
   let gitFiles = null;
   try {
-    const { stdout } = await execGit(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
+    const { stdout } = await execGit(
+      ["ls-files", "-z", "--cached", "--others", "--exclude-standard"],
+      { cwd: root, maxBuffer: 50 * 1024 * 1024 }
+    );
     gitFiles = new Set(stdout.split("\0").filter(Boolean));
   } catch {
     let inGit = false;
@@ -225,14 +323,17 @@ async function createFileAccess(rootDir) {
   }
   async function resolve(file) {
     const relative = normalizeRepoPath(file);
-    if (!relative || isSensitiveFile(relative) || gitFiles && !gitFiles.has(relative)) return null;
+    if (!relative || isSensitiveFile(relative) || gitFiles && !gitFiles.has(relative))
+      return null;
     const candidate = path2.join(root, relative);
     try {
       const real = await fs.realpath(candidate);
-      if (!isWithinRoot(canonicalRoot, real) || isSensitiveFile(path2.relative(canonicalRoot, real))) return null;
+      if (!isWithinRoot(canonicalRoot, real) || isSensitiveFile(path2.relative(canonicalRoot, real)))
+        return null;
       const stat = await fs.stat(real);
       if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null;
-      if (gitFiles && !gitFiles.has(path2.relative(canonicalRoot, real).split(path2.sep).join("/"))) return null;
+      if (gitFiles && !gitFiles.has(path2.relative(canonicalRoot, real).split(path2.sep).join("/")))
+        return null;
       return real;
     } catch {
       return null;
@@ -248,7 +349,10 @@ async function createFileAccess(rootDir) {
     if (!relative) return null;
     const real = await resolve(relative);
     if (!real) return null;
-    for (const rel of /* @__PURE__ */ new Set([relative, path2.relative(canonicalRoot, real).split(path2.sep).join("/")])) {
+    for (const rel of /* @__PURE__ */ new Set([
+      relative,
+      path2.relative(canonicalRoot, real).split(path2.sep).join("/")
+    ])) {
       if (!(await fg(fg.escapePath(rel), { cwd: root, ignore, dot: true })).length) return null;
     }
     try {
@@ -258,7 +362,7 @@ async function createFileAccess(rootDir) {
       return null;
     }
   }
-  return { root, config, list, read };
+  return { root, config, list, read, inventory: () => gitFiles ? [...gitFiles].sort() : null };
 }
 
 // src/utils/storage.ts
@@ -300,16 +404,21 @@ async function readStoreJson(root, relative) {
     return parsed;
   } catch (error) {
     if (error.code === "ENOENT") return null;
-    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    throw new Error(
+      `Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error }
+    );
   }
 }
 
 // src/snapshot/snapshot.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 
 // src/utils/store-lock.ts
+import { z } from "zod";
 import fs3 from "fs/promises";
 import os from "os";
+var lockOwnerSchema = z.object({ host: z.string(), pid: z.number().int().positive() });
 
 // src/test-map.ts
 import path4 from "path";
@@ -382,30 +491,30 @@ function commonSegments(pathA, pathB) {
 }
 
 // src/snapshot/snapshot.ts
-var repoPath = z.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
+var repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
 var verificationFields = {
-  refreshedHash: z.string().optional(),
-  verifiedAt: z.string().optional(),
-  verifiedHash: z.string().optional(),
-  verificationToken: z.string().optional(),
-  verificationFailed: z.boolean().optional(),
-  verificationNote: z.string().optional()
+  refreshedHash: z2.string().optional(),
+  verifiedAt: z2.string().optional(),
+  verifiedHash: z2.string().optional(),
+  verificationToken: z2.string().optional(),
+  verificationFailed: z2.boolean().optional(),
+  verificationNote: z2.string().optional()
 };
-var featureSchema = z.object({
-  description: z.string(),
-  files: z.array(repoPath),
-  tests: z.array(repoPath).optional(),
-  type: z.enum(["capability", "infrastructure"]).optional(),
+var featureSchema = z2.object({
+  description: z2.string(),
+  files: z2.array(repoPath),
+  tests: z2.array(repoPath).optional(),
+  type: z2.enum(["capability", "infrastructure"]).optional(),
   ...verificationFields
 }).passthrough();
-var flowSchema = z.object({ description: z.string(), chain: z.array(repoPath), ...verificationFields }).passthrough();
-var snapshotSchema = z.object({
-  version: z.literal(2),
-  createdAt: z.string(),
-  updatedAt: z.string(),
-  gitHash: z.string(),
-  features: z.record(featureSchema),
-  flows: z.record(flowSchema)
+var flowSchema = z2.object({ description: z2.string(), chain: z2.array(repoPath), ...verificationFields }).passthrough();
+var snapshotSchema = z2.object({
+  version: z2.literal(2),
+  createdAt: z2.string(),
+  updatedAt: z2.string(),
+  gitHash: z2.string(),
+  features: z2.record(featureSchema),
+  flows: z2.record(flowSchema)
 }).passthrough();
 async function getCurrentGitHash(rootDir) {
   try {
@@ -428,18 +537,25 @@ function parseChanges(output) {
     if (!first) break;
     const second = /^[RC]/.test(code) ? fields[i++] : void 0;
     const change = second ? code.startsWith("R") ? { status: "renamed", path: second, previousPath: first } : { status: "added", path: second } : { status: code === "A" ? "added" : code === "D" ? "deleted" : "modified", path: first };
-    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/"))) continue;
+    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/")))
+      continue;
     changes.push(change);
   }
   return changes;
 }
 function touchedPaths(changes) {
-  return [...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))].sort();
+  return [
+    ...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))
+  ].sort();
 }
 async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
-  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
+  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-"))
+    return null;
   try {
-    const { stdout } = await execGit(["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
+    const { stdout } = await execGit(
+      ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"],
+      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
+    );
     return parseChanges(stdout);
   } catch {
     return null;
@@ -448,122 +564,340 @@ async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
 async function getWorkingTree(resolvedRoot) {
   try {
     const [diff, untracked] = await Promise.all([
-      execGit(["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
-      execGit(["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
+      execGit(["diff", "--name-status", "-z", "-M", "HEAD", "--"], {
+        cwd: resolvedRoot,
+        maxBuffer: 10 * 1024 * 1024
+      }),
+      execGit(["ls-files", "-z", "--others", "--exclude-standard"], {
+        cwd: resolvedRoot,
+        maxBuffer: 10 * 1024 * 1024
+      })
     ]);
     const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
-    return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
+    return {
+      available: true,
+      changedFiles: [
+        .../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])
+      ].sort(),
+      untrackedFiles
+    };
   } catch {
     return { available: false, changedFiles: [], untrackedFiles: [] };
   }
 }
 
 // src/decisions/provenance.ts
-import { z as z2 } from "zod";
+import { z as z4 } from "zod";
+import { createHash as createHash2 } from "crypto";
+
+// src/decisions/anchors.ts
+import { createHash } from "crypto";
+import fs5 from "fs/promises";
+import { constants as constants2 } from "fs";
+import { z as z3 } from "zod";
+import fg3 from "fast-glob";
+
+// src/audit/inspection.ts
+import fg2 from "fast-glob";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import path7 from "path";
+var inspections = new AsyncLocalStorage2();
+function inspectionRead(root, key, read) {
+  const inspection = inspections.getStore();
+  if (!inspection || inspection.root !== path7.resolve(root)) return read();
+  if (!inspection.reads.has(key)) {
+    const pending = read();
+    inspection.reads.set(key, pending);
+    void pending.catch(() => {
+      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
+    });
+  }
+  return inspection.reads.get(key);
+}
+function inspectionGit(args, options) {
+  return inspectionRead(
+    options.cwd,
+    "git:" + JSON.stringify([args, options]),
+    () => execGit(args, options)
+  );
+}
+var sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
+var sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+
+// src/decisions/anchors.ts
+var repoPath2 = z3.string().refine((p) => normalizeRepoPath(p) === p);
+var anchorCaptureSchema = z3.object({
+  anchors: z3.array(repoPath2),
+  files: z3.record(repoPath2, z3.string().regex(/^[a-f0-9]{64}$/)),
+  complete: z3.boolean()
+}).refine(
+  (capture) => JSON.stringify(capture.anchors) === JSON.stringify([...new Set(capture.anchors)].sort()) && matchingPaths(capture.anchors, Object.keys(capture.files)).length === Object.keys(capture.files).length,
+  "Capture paths must belong to its normalized, sorted anchor scope"
+);
+async function captureAnchorScopes(root, scopes) {
+  const union = [...new Set(scopes.flat())].sort();
+  let context;
+  const prepareContext = async () => {
+    const access = await inspectionRead(
+      root,
+      "decision-anchor-access",
+      () => createFileAccess(root)
+    );
+    const inventory = access.inventory();
+    if (!inventory) throw new Error("Git anchor inventory unavailable");
+    const ignored = await inspectionGit(
+      [
+        "ls-files",
+        "-z",
+        "--others",
+        "--ignored",
+        "--exclude-standard",
+        "--",
+        ...union.map((anchor) => `:(literal)${anchor}`)
+      ],
+      { cwd: root, maxBuffer: 8 * 1024 * 1024 }
+    );
+    const files = [
+      .../* @__PURE__ */ new Set([...inventory, ...ignored.stdout.split("\0").filter(Boolean)])
+    ].sort();
+    const patterns = await Promise.all(
+      union.map(async (anchor) => {
+        const literal = fg3.escapePath(anchor);
+        try {
+          return (await fs5.lstat(await storePath(root, anchor))).isDirectory() ? `${literal}/**/*` : literal;
+        } catch {
+          return literal;
+        }
+      })
+    );
+    const eligible = new Set(await access.list(patterns, { dot: true }));
+    const indexed = indexMatchingPaths(scopes, files);
+    const filesByScope = new Map(
+      scopes.map((scope, index2) => [JSON.stringify([...new Set(scope)].sort()), indexed[index2]])
+    );
+    return { filesByScope, eligible };
+  };
+  return Promise.all(
+    scopes.map((scope) => {
+      const anchors = [...new Set(scope)].sort();
+      return inspectionRead(
+        root,
+        "decision-anchor-capture:" + JSON.stringify(anchors),
+        async () => {
+          const capture = { anchors, files: {}, complete: true };
+          if (!anchors.length) return capture;
+          try {
+            const { eligible, filesByScope } = await (context ??= prepareContext());
+            const files = filesByScope.get(JSON.stringify(anchors));
+            if (files.length > 2e3) return { ...capture, complete: false };
+            for (const file of files) {
+              const evidence = await inspectionRead(
+                root,
+                "decision-anchor-file:" + file,
+                async () => {
+                  try {
+                    const absolute = await storePath(root, file);
+                    await fs5.lstat(absolute);
+                    if (!eligible.has(file)) return { complete: false };
+                    const handle = await fs5.open(
+                      absolute,
+                      constants2.O_RDONLY | constants2.O_NONBLOCK | constants2.O_NOFOLLOW
+                    );
+                    try {
+                      const stat = await handle.stat();
+                      if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES)
+                        return { complete: false };
+                      const bytes = Buffer.alloc(Math.min(stat.size + 1, MAX_SOURCE_BYTES + 1));
+                      let size = 0;
+                      while (size < bytes.length) {
+                        const read = await handle.read(bytes, size, bytes.length - size, null);
+                        if (!read.bytesRead) break;
+                        size += read.bytesRead;
+                      }
+                      if (size === bytes.length) return { complete: false };
+                      return {
+                        complete: true,
+                        hash: createHash("sha256").update(bytes.subarray(0, size)).digest("hex")
+                      };
+                    } finally {
+                      await handle.close();
+                    }
+                  } catch (error) {
+                    return { complete: error.code === "ENOENT" };
+                  }
+                }
+              );
+              if (!evidence.complete) capture.complete = false;
+              if (evidence.hash) capture.files[file] = evidence.hash;
+            }
+          } catch {
+            capture.complete = false;
+          }
+          return capture;
+        }
+      );
+    })
+  );
+}
+function changedCaptureFiles(before, after) {
+  return [.../* @__PURE__ */ new Set([...Object.keys(before.files), ...Object.keys(after.files)])].filter((file) => before.files[file] !== after.files[file]).sort();
+}
 
 // src/context/trust.ts
 function assessTrust(entry, freshness) {
   const verification = entry.verificationFailed ? "failed" : entry.verifiedAt ? "passed" : "unverified";
   const reasons = [];
-  if (freshness === "unknown") reasons.push("Anchors, history, or working-tree evidence are unavailable; verify before relying on this entry.");
-  if (freshness === "changed") reasons.push("Anchored files changed; verify against current code before relying on this entry.");
-  if (verification === "failed") reasons.push(`Verification failed: ${entry.verificationNote ?? "re-map this entry before relying on it"}`);
+  if (freshness === "unknown")
+    reasons.push(
+      "Anchors, history, or working-tree evidence are unavailable; verify before relying on this entry."
+    );
+  if (freshness === "changed")
+    reasons.push(
+      "Anchored files changed; verify against current code before relying on this entry."
+    );
+  if (verification === "failed")
+    reasons.push(
+      `Verification failed: ${entry.verificationNote ?? "re-map this entry before relying on it"}`
+    );
   if (verification === "unverified") reasons.push("No correctness verification has been recorded.");
-  return { freshness, verification, verifiedAt: entry.verifiedAt, verifiedHash: entry.verifiedHash, reasons };
+  return {
+    freshness,
+    verification,
+    verifiedAt: entry.verifiedAt,
+    verifiedHash: entry.verifiedHash,
+    reasons
+  };
 }
 
 // src/decisions/provenance.ts
-var text = (max) => z2.string().trim().min(1).max(max);
-var decisionSourceSchema = z2.object({
-  kind: z2.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
+var text = (max) => z4.string().trim().min(1).max(max);
+var decisionSourceSchema = z4.object({
+  kind: z4.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
   reference: text(1e3),
   note: text(500).optional()
 }).strict();
-var attributionSchema = z2.object({
+var attributionSchema = z4.object({
   owner: text(200).nullable().optional(),
-  sources: z2.array(decisionSourceSchema).max(20).optional(),
+  sources: z4.array(decisionSourceSchema).max(20).optional(),
   actor: text(200).optional()
 });
-var contentSchema = z2.object({
-  title: z2.string().min(1),
-  body: z2.string().min(1),
-  category: z2.enum(["decision", "gotcha", "deprecation", "convention"]),
-  files: z2.array(z2.string().refine((f) => normalizeRepoPath(f) !== null)),
+var contentSchema = z4.object({
+  title: z4.string().min(1),
+  body: z4.string().min(1),
+  category: z4.enum(["decision", "gotcha", "deprecation", "convention"]),
+  files: z4.array(z4.string().refine((f) => normalizeRepoPath(f) !== null)),
   owner: text(200).optional(),
-  sources: z2.array(decisionSourceSchema).max(20)
+  sources: z4.array(decisionSourceSchema).max(20)
 });
-var approvalSchema = z2.enum(["unreviewed", "proposed", "accepted"]);
-var statusSchema = z2.enum(["active", "superseded", "retired"]);
-var reviewEvidenceSchema = z2.object({
-  baseHash: z2.string(),
-  headHash: z2.string(),
-  historyAvailable: z2.boolean(),
-  changedFiles: z2.array(z2.string()),
-  localChanges: z2.array(z2.string())
+var approvalSchema = z4.enum(["unreviewed", "proposed", "accepted"]);
+var statusSchema = z4.enum(["active", "superseded", "retired"]);
+var reviewEvidenceSchema = z4.object({
+  baseHash: z4.string(),
+  headHash: z4.string(),
+  historyAvailable: z4.boolean(),
+  changedFiles: z4.array(z4.string()),
+  localChanges: z4.array(z4.string())
 });
-var eventSchema = z2.object({
-  kind: z2.enum(["imported", "created", "revised", "accepted", "reaffirmed", "retired", "superseded"]),
-  at: z2.string().datetime(),
+var eventSchema = z4.object({
+  kind: z4.enum([
+    "imported",
+    "created",
+    "revised",
+    "accepted",
+    "reaffirmed",
+    "retired",
+    "superseded"
+  ]),
+  at: z4.string().datetime(),
   actor: text(200).optional(),
   note: text(1500).optional(),
-  revision: z2.number().int().positive(),
+  revision: z4.number().int().positive(),
   content: contentSchema,
   approval: approvalSchema,
   status: statusSchema,
-  refreshedHash: z2.string(),
-  evidence: reviewEvidenceSchema.optional()
+  refreshedHash: z4.string(),
+  evidence: reviewEvidenceSchema.optional(),
+  capture: anchorCaptureSchema.optional()
 });
-var legacySchema = z2.object({
-  version: z2.literal(1),
-  id: z2.string().regex(/^[a-zA-Z0-9_-]+$/),
-  title: z2.string().min(1),
-  body: z2.string().min(1),
+var legacySchema = z4.object({
+  version: z4.literal(1),
+  id: z4.string().regex(/^[a-zA-Z0-9_-]+$/),
+  title: z4.string().min(1),
+  body: z4.string().min(1),
   category: contentSchema.shape.category,
   files: contentSchema.shape.files,
-  createdAt: z2.string(),
-  updatedAt: z2.string(),
-  refreshedHash: z2.string(),
-  status: z2.enum(["active", "superseded"]),
-  supersededBy: z2.string().optional()
+  createdAt: z4.string(),
+  updatedAt: z4.string(),
+  refreshedHash: z4.string(),
+  status: z4.enum(["active", "superseded"]),
+  supersededBy: z4.string().optional()
 }).passthrough();
 var currentSchema = legacySchema.extend({
-  version: z2.literal(2),
+  version: z4.literal(2),
   status: statusSchema,
   approval: approvalSchema,
-  revision: z2.number().int().positive(),
+  revision: z4.number().int().positive(),
   owner: text(200).optional(),
-  sources: z2.array(decisionSourceSchema).max(20),
-  history: z2.array(eventSchema).min(1)
+  sources: z4.array(decisionSourceSchema).max(20),
+  history: z4.array(eventSchema).min(1),
+  capture: anchorCaptureSchema.optional(),
+  inspections: z4.array(
+    z4.object({
+      at: z4.string().datetime(),
+      inspector: text(200),
+      note: text(1500),
+      outcome: z4.literal("no_contradiction_found"),
+      decisionDigest: z4.string().regex(/^[a-f0-9]{64}$/),
+      headHash: z4.string(),
+      capture: anchorCaptureSchema
+    })
+  ).max(200).optional()
 }).superRefine((record, ctx) => {
   const invalid = (message2) => ctx.addIssue({ code: "custom", message: message2 });
   const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
   let previous;
   for (const event of record.history) {
     if (!previous) {
-      if (!["created", "imported"].includes(event.kind) || event.revision !== 1) invalid("History must begin with creation or legacy import at revision 1");
-      if (event.approval !== (event.kind === "created" ? "proposed" : "unreviewed")) invalid("Initial records cannot claim acceptance");
+      if (!["created", "imported"].includes(event.kind) || event.revision !== 1)
+        invalid("History must begin with creation or legacy import at revision 1");
+      if (event.approval !== (event.kind === "created" ? "proposed" : "unreviewed"))
+        invalid("Initial records cannot claim acceptance");
     } else {
       if (["created", "imported"].includes(event.kind)) invalid("History cannot restart");
       if (previous.status !== "active") invalid("Archived decisions cannot be changed");
-      if (event.revision !== previous.revision + (event.kind === "revised" ? 1 : 0)) invalid("Invalid revision sequence");
-      if (event.kind !== "revised" && !same(event.content, previous.content)) invalid("A review cannot silently revise decision content");
-      if (event.kind === "reaffirmed" && previous.approval !== "accepted") invalid("Only accepted decisions can be reaffirmed");
-      if (event.kind === "accepted" && previous.approval === "accepted") invalid("Use reaffirmation for an accepted decision");
+      if (event.revision !== previous.revision + (event.kind === "revised" ? 1 : 0))
+        invalid("Invalid revision sequence");
+      if (event.kind !== "revised" && !same(event.content, previous.content))
+        invalid("A review cannot silently revise decision content");
+      if (event.kind === "reaffirmed" && previous.approval !== "accepted")
+        invalid("Only accepted decisions can be reaffirmed");
+      if (event.kind === "accepted" && previous.approval === "accepted")
+        invalid("Use reaffirmation for an accepted decision");
       const approval = event.kind === "revised" ? "proposed" : ["accepted", "reaffirmed"].includes(event.kind) ? "accepted" : previous.approval;
       if (event.approval !== approval) invalid("Approval disagrees with review history");
-      if (!["accepted", "reaffirmed"].includes(event.kind) && event.refreshedHash !== previous.refreshedHash) invalid("Only a review can refresh the evidence baseline");
+      if (!["accepted", "reaffirmed"].includes(event.kind) && event.refreshedHash !== previous.refreshedHash)
+        invalid("Only a review can refresh the evidence baseline");
     }
-    if (event.kind !== "imported" && event.status !== (event.kind === "retired" ? "retired" : event.kind === "superseded" ? "superseded" : "active")) invalid("Lifecycle disagrees with history");
-    if (["accepted", "reaffirmed", "retired"].includes(event.kind) && (!event.actor || !event.note || !event.evidence)) invalid("Reviews require a named reviewer, reason, and code evidence");
+    if (event.kind !== "imported" && event.status !== (event.kind === "retired" ? "retired" : event.kind === "superseded" ? "superseded" : "active"))
+      invalid("Lifecycle disagrees with history");
+    if (["accepted", "reaffirmed", "retired"].includes(event.kind) && (!event.actor || !event.note || !event.evidence))
+      invalid("Reviews require a named reviewer, reason, and code evidence");
     if (["accepted", "reaffirmed"].includes(event.kind)) {
-      if (!event.content.owner || !event.content.sources.length) invalid("Accepted decisions require an owner and source");
-      if (!event.evidence || !/^[a-f0-9]{40,64}$/.test(event.evidence.headHash) || event.refreshedHash !== event.evidence.headHash || event.evidence.localChanges.length) invalid("Acceptance requires a committed evidence baseline");
+      if (!event.content.owner || !event.content.sources.length)
+        invalid("Accepted decisions require an owner and source");
+      if (!event.evidence || !/^[a-f0-9]{40,64}$/.test(event.evidence.headHash) || event.refreshedHash !== event.evidence.headHash || event.evidence.localChanges.length)
+        invalid("Acceptance requires a committed evidence baseline");
     }
+    if (event.capture && !same([...event.content.files].sort(), event.capture.anchors))
+      invalid("Capture scope disagrees with decision anchors");
     previous = event;
   }
-  if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash) invalid("Decision does not match the final history event");
+  if (previous && !same(previous.capture, record.capture))
+    invalid("Capture does not match the final history event");
+  if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash)
+    invalid("Decision does not match the final history event");
 });
-var decisionSchema = z2.union([legacySchema, currentSchema]);
+var decisionSchema = z4.union([legacySchema, currentSchema]);
 function decisionContent(record) {
   return {
     title: record.title,
@@ -578,7 +912,8 @@ function decisionApproval(record) {
   return record.version === 1 ? "unreviewed" : record.approval;
 }
 function effectiveDecision(record) {
-  if (record.version !== 2 || record.status !== "active" || record.approval !== "proposed") return record;
+  if (record.version !== 2 || record.status !== "active" || record.approval !== "proposed")
+    return record;
   let index2 = record.history.length - 1;
   while (index2 >= 0 && !["accepted", "reaffirmed"].includes(record.history[index2].kind)) index2--;
   if (index2 < 0) return record;
@@ -590,13 +925,16 @@ function effectiveDecision(record) {
     approval: "accepted",
     revision: event.revision,
     refreshedHash: event.refreshedHash,
+    capture: event.capture,
     updatedAt: event.at,
     history: record.history.slice(0, index2 + 1)
   };
 }
 function decisionProvenance(record, freshness = "unknown") {
   const approval = decisionApproval(record);
-  const review = record.version === 2 ? [...record.history].reverse().find((e) => ["accepted", "reaffirmed"].includes(e.kind) && e.revision === record.revision) : void 0;
+  const review = record.version === 2 ? [...record.history].reverse().find(
+    (e) => ["accepted", "reaffirmed"].includes(e.kind) && e.revision === record.revision
+  ) : void 0;
   return {
     approval,
     revision: record.version === 2 ? record.revision : 0,
@@ -604,80 +942,192 @@ function decisionProvenance(record, freshness = "unknown") {
     sources: record.version === 2 ? record.sources : [],
     guidance: record.status !== "active" ? "historical" : approval === "accepted" ? "constraint" : approval === "proposed" ? "proposal" : "unreviewed",
     reviewRequired: record.status === "active" && (approval !== "accepted" || freshness !== "current"),
-    lastReview: review ? { reviewer: review.actor, at: review.at, note: review.note, gitHash: review.refreshedHash } : null
+    lastReview: review ? {
+      reviewer: review.actor,
+      at: review.at,
+      note: review.note,
+      gitHash: review.refreshedHash
+    } : null
   };
 }
 function decisionTrust(record, freshness) {
   const review = decisionProvenance(record, freshness).lastReview;
-  return assessTrust(review ? { verifiedAt: review.at, verifiedHash: review.gitHash } : {}, freshness);
+  return assessTrust(
+    review ? { verifiedAt: review.at, verifiedHash: review.gitHash } : {},
+    freshness
+  );
+}
+function decisionInspectionDigest(record) {
+  const effective = effectiveDecision(record);
+  return createHash2("sha256").update(
+    JSON.stringify([
+      record.status,
+      decisionApproval(record),
+      record.version === 2 ? record.revision : 0,
+      decisionContent(record),
+      decisionContent(effective),
+      effective.refreshedHash
+    ])
+  ).digest("hex");
+}
+function latestDecisionInspection(record) {
+  return record.version === 2 ? record.inspections?.filter((i) => i.decisionDigest === decisionInspectionDigest(record)).at(-1) : void 0;
 }
 function revisionKnowledge(record, freshness) {
-  return { ...decisionContent(record), ...decisionProvenance(record, freshness), trust: decisionTrust(record, freshness) };
+  return {
+    ...decisionContent(record),
+    ...decisionProvenance(record, freshness),
+    trust: decisionTrust(record, freshness)
+  };
 }
 function decisionKnowledge(record, freshness = "unknown", proposalFreshness = "unknown") {
   const effective = effectiveDecision(record);
+  const inspection = latestDecisionInspection(record);
   return {
     ...revisionKnowledge(effective, freshness),
+    ...inspection ? {
+      inspection: {
+        freshness,
+        at: inspection.at,
+        inspector: inspection.inspector,
+        note: inspection.note,
+        outcome: inspection.outcome,
+        headHash: inspection.headHash
+      }
+    } : {},
     ...effective !== record ? { pendingProposal: revisionKnowledge(record, proposalFreshness) } : {}
   };
 }
 
 // src/decisions/decisions.ts
-import fs5 from "fs/promises";
-import path8 from "path";
-import { createHash } from "crypto";
-import { z as z3 } from "zod";
+import fs6 from "fs/promises";
+import path9 from "path";
+import { createHash as createHash3 } from "crypto";
+import { z as z5 } from "zod";
 
 // src/context/lexical.ts
-import path7 from "path";
+import path8 from "path";
 
 // src/decisions/decisions.ts
 var TITLE_MAX_CHARS = 80;
 var BODY_RECOMMENDED_CHARS = 1500;
 var BODY_MAX_CHARS = 2500;
-var boundedText = (field, max, hint) => z3.string({
-  errorMap: (issue, ctx) => ({ message: issue.code === "too_big" ? `${field} has ${ctx.data.length} characters; maximum is ${max} (${ctx.data.length - max} over). ${hint}` : ctx.defaultError })
+var boundedText = (field, max, hint) => z5.string({
+  errorMap: (issue, ctx) => ({
+    message: issue.code === "too_big" && typeof ctx.data === "string" ? `${field} has ${ctx.data.length} characters; maximum is ${max} (${ctx.data.length - max} over). ${hint}` : ctx.defaultError
+  })
 }).trim().min(1, `${field} must be non-empty`).max(max);
-var decisionTitleSchema = boundedText("title", TITLE_MAX_CHARS, "Tighten it to a specific headline.");
+var decisionTitleSchema = boundedText(
+  "title",
+  TITLE_MAX_CHARS,
+  "Tighten it to a specific headline."
+);
 var decisionBodySchema = boundedText(
   "body",
   BODY_MAX_CHARS,
   `Aim for ${BODY_RECOMMENDED_CHARS} characters or fewer. Preserve the rule, reason, and exceptions; put supporting references in sources.`
 );
+async function readDecisionInputs(rootDir) {
+  return structuredClone(
+    await inspectionRead(rootDir, "decision-store:inputs", async () => {
+      const inputs = [];
+      const diagnostics = [];
+      let entries;
+      try {
+        entries = await fs6.readdir(await storePath(rootDir, ".mason/decisions"));
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          diagnostics.push({ path: ".mason/decisions", message: String(error) });
+        return { inputs, diagnostics };
+      }
+      for (const entry of entries.sort()) {
+        if (!entry.endsWith(".json")) continue;
+        const relative = `.mason/decisions/${entry}`;
+        try {
+          const raw = await readBoundedFile(await storePath(rootDir, relative), 10 * 1024 * 1024);
+          if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
+          inputs.push([relative, raw]);
+        } catch (error) {
+          if (error.code === "ENOENT") inputs.push([relative, null]);
+          else
+            diagnostics.push({
+              path: relative,
+              message: error instanceof Error ? error.message : String(error)
+            });
+        }
+      }
+      return { inputs, diagnostics };
+    })
+  );
+}
 async function loadDecisionStore(rootDir) {
-  const records = [];
-  const diagnostics = [];
-  let entries;
-  try {
-    entries = await fs5.readdir(await storePath(rootDir, ".mason/decisions"));
-  } catch (error) {
-    if (error.code !== "ENOENT") diagnostics.push({ path: ".mason/decisions", message: String(error) });
-    return { records, diagnostics };
-  }
-  for (const entry of entries.sort()) {
-    if (!entry.endsWith(".json")) continue;
-    const relative = `.mason/decisions/${entry}`;
-    try {
-      const record = decisionSchema.parse(await readStoreJson(rootDir, relative));
-      if (entry !== `${record.id}.json`) throw new Error("Record id does not match its filename");
-      records.push(record);
-    } catch (error) {
-      diagnostics.push({ path: relative, message: error instanceof Error ? error.message : String(error) });
-    }
-  }
-  return { records, diagnostics };
+  return structuredClone(
+    await inspectionRead(rootDir, "decision-store:parsed", async () => {
+      const raw = await readDecisionInputs(rootDir);
+      const records = [];
+      const diagnostics = [...raw.diagnostics];
+      for (const [relative, content] of raw.inputs) {
+        try {
+          const record = decisionSchema.parse(content === null ? null : JSON.parse(content));
+          if (relative !== `.mason/decisions/${record.id}.json`)
+            throw new Error("Record id does not match its filename");
+          records.push(record);
+        } catch (error) {
+          diagnostics.push({
+            path: relative,
+            message: error instanceof Error ? error.message : String(error)
+          });
+        }
+      }
+      return { records, diagnostics };
+    })
+  );
 }
 
 // src/decisions/drift.ts
-import path9 from "path";
+import path10 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path9.resolve(rootDir);
+  const resolvedRoot = path10.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
-  const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
-  const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
+  const report = {
+    historyAvailable: true,
+    totalDecisions: store.records.length,
+    staleDecisions: {},
+    freshness: {},
+    diagnostics: store.diagnostics
+  };
+  const [head, workingTree] = await Promise.all([
+    getCurrentGitHash(resolvedRoot),
+    getWorkingTree(resolvedRoot)
+  ]);
   const changesByHash = /* @__PURE__ */ new Map();
-  const inspect = async (record) => {
+  const baselines = store.records.filter((record) => record.status === "active").flatMap((record) => {
+    const inspection = latestDecisionInspection(record);
+    if (inspection) return [inspection.capture];
+    return [.../* @__PURE__ */ new Set([effectiveDecision(record), record])].flatMap(
+      (candidate) => candidate.version === 2 && candidate.capture ? [candidate.capture] : []
+    );
+  });
+  const captures = await captureAnchorScopes(
+    resolvedRoot,
+    baselines.map((baseline) => baseline.anchors)
+  );
+  const currentCaptures = new Map(
+    baselines.map((baseline, index2) => [JSON.stringify(baseline.anchors), captures[index2]])
+  );
+  const inspect = async (record, inspectionCapture) => {
     if (record.files.length === 0) return { freshness: "unknown", changedFiles: [] };
+    const baseline = inspectionCapture ?? (record.version === 2 ? record.capture : void 0);
+    if (baseline) {
+      const current = currentCaptures.get(JSON.stringify(baseline.anchors));
+      const hits2 = changedCaptureFiles(baseline, current).filter(
+        (file) => matchingPaths(record.files, [file]).length
+      );
+      return {
+        freshness: !baseline.complete || !current.complete ? "unknown" : hits2.length ? "changed" : "current",
+        changedFiles: hits2
+      };
+    }
     let touched = changesByHash.get(record.refreshedHash);
     if (touched === void 0) {
       const changes = record.refreshedHash === head && head !== "unknown" ? [] : await getChangesWithStatus(resolvedRoot, record.refreshedHash);
@@ -687,15 +1137,20 @@ async function computeDecisionDrift(rootDir, decisions) {
     if (touched === null) report.historyAvailable = false;
     const hits = touched ? matchingPaths(record.files, touched) : [];
     const localHits = matchingPaths(record.files, workingTree.changedFiles);
-    return { freshness: touched === null || !workingTree.available ? "unknown" : hits.length || localHits.length ? "changed" : "current", changedFiles: hits };
+    return {
+      freshness: touched === null || !workingTree.available ? "unknown" : hits.length || localHits.length ? "changed" : "current",
+      changedFiles: [.../* @__PURE__ */ new Set([...hits, ...localHits])].sort()
+    };
   };
   for (const record of store.records) {
     if (record.status !== "active") continue;
     const effective = effectiveDecision(record);
-    const state = await inspect(effective);
+    const inspection = latestDecisionInspection(record);
+    const state = await inspect(effective, inspection?.capture);
     report.freshness[record.id] = state.freshness;
     if (state.changedFiles.length) report.staleDecisions[record.id] = state.changedFiles;
-    if (effective !== record) (report.pendingProposals ??= {})[record.id] = await inspect(record);
+    if (effective !== record)
+      (report.pendingProposals ??= {})[record.id] = await inspect(record, inspection?.capture);
   }
   return report;
 }
@@ -711,7 +1166,9 @@ var MIN_COCHANGE_RATE = 0.6;
 var MAX_COMMIT_FILES = 30;
 async function buildMatrix(resolvedRoot) {
   try {
-    const { stdout: shallow } = await exec("git", ["rev-parse", "--is-shallow-repository"], { cwd: resolvedRoot });
+    const { stdout: shallow } = await exec("git", ["rev-parse", "--is-shallow-repository"], {
+      cwd: resolvedRoot
+    });
     if (shallow.trim() === "true") return null;
     const { stdout } = await exec(
       "git",
@@ -771,11 +1228,11 @@ async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, all
 }
 
 // src/review/evidence.ts
-import path10 from "path";
-import { z as z7 } from "zod";
+import path11 from "path";
+import { z as z9 } from "zod";
 
 // src/review/evidence/vitest.ts
-import { z as z4 } from "zod";
+import { z as z6 } from "zod";
 
 // src/review/evidence/paths.ts
 function evidencePath(value, sourceRoot, uri = false) {
@@ -811,26 +1268,30 @@ function messagePreview(message2) {
 }
 
 // src/review/evidence/vitest.ts
-var count = z4.number().int().nonnegative();
-var schema = z4.object({
-  success: z4.boolean(),
+var count = z6.number().int().nonnegative();
+var schema = z6.object({
+  success: z6.boolean(),
   numTotalTests: count,
   numPassedTests: count,
   numFailedTests: count,
   numPendingTests: count,
   numTodoTests: count,
   numFailedTestSuites: count,
-  testResults: z4.array(z4.object({
-    name: z4.string().min(1),
-    status: z4.enum(["passed", "failed"]),
-    message: z4.string().optional(),
-    assertionResults: z4.array(z4.object({
-      fullName: z4.string(),
-      status: z4.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
-      failureMessages: z4.array(z4.string()).nullable().optional(),
-      location: z4.object({ line: count, column: count }).nullable().optional()
-    }))
-  }))
+  testResults: z6.array(
+    z6.object({
+      name: z6.string().min(1),
+      status: z6.enum(["passed", "failed"]),
+      message: z6.string().optional(),
+      assertionResults: z6.array(
+        z6.object({
+          fullName: z6.string(),
+          status: z6.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
+          failureMessages: z6.array(z6.string()).nullable().optional(),
+          location: z6.object({ line: count, column: count }).nullable().optional()
+        })
+      )
+    })
+  )
 });
 function parseVitest(raw, sourceRoot) {
   const report = schema.parse(raw);
@@ -838,7 +1299,8 @@ function parseVitest(raw, sourceRoot) {
   let passed = 0, failed = 0, skipped = 0;
   for (const [index2, suite] of report.testResults.entries()) {
     const file = evidencePath(suite.name, sourceRoot);
-    if (!file) diagnostics.push(`Test path is outside the declared checkout or invalid: ${suite.name}`);
+    if (!file)
+      diagnostics.push(`Test path is outside the declared checkout or invalid: ${suite.name}`);
     let suiteFailures = 0;
     for (const [testIndex, test] of suite.assertionResults.entries()) {
       if (test.status === "passed") passed++;
@@ -850,58 +1312,118 @@ function parseVitest(raw, sourceRoot) {
           ...messagePreview([test.fullName, ...test.failureMessages ?? []].join("\n")),
           severity: "error",
           state: "active",
-          locations: file ? [{ file, ...test.location ? { line: test.location.line, column: test.location.column } : {} }] : []
+          locations: file ? [
+            {
+              file,
+              ...test.location ? { line: test.location.line, column: test.location.column } : {}
+            }
+          ] : []
         });
       } else skipped++;
     }
     if (suite.status === "failed" && !suiteFailures) {
-      findings.push({ id: `${index2}:suite`, ...messagePreview(suite.message || `Test suite failed: ${suite.name}`), severity: "error", state: "active", locations: file ? [{ file }] : [] });
+      findings.push({
+        id: `${index2}:suite`,
+        ...messagePreview(suite.message || `Test suite failed: ${suite.name}`),
+        severity: "error",
+        state: "active",
+        locations: file ? [{ file }] : []
+      });
     }
   }
   if (passed !== report.numPassedTests || failed !== report.numFailedTests || skipped !== report.numPendingTests + report.numTodoTests || passed + failed + skipped !== report.numTotalTests) {
     throw new Error("Vitest summary counts disagree with its assertion results");
   }
   const hasFailures = failed > 0 || report.numFailedTestSuites > 0 || report.testResults.some((s) => s.status === "failed");
-  if (report.success && hasFailures) throw new Error("Vitest success conflicts with failed tests or suites");
+  if (report.success && hasFailures)
+    throw new Error("Vitest success conflicts with failed tests or suites");
   const outcome = hasFailures || !report.success ? "failed" : !report.numTotalTests ? "unavailable" : !passed ? "skipped" : "passed";
-  if (!report.numTotalTests) diagnostics.push("No tests executed; an empty report is not passing test evidence.");
+  if (!report.numTotalTests)
+    diagnostics.push("No tests executed; an empty report is not passing test evidence.");
   if (skipped) diagnostics.push(`${skipped} tests were skipped, pending, disabled, or todo.`);
   return {
     outcome,
     findings,
-    counts: { total: report.numTotalTests, passed, failed, skipped, failedSuites: report.numFailedTestSuites },
+    counts: {
+      total: report.numTotalTests,
+      passed,
+      failed,
+      skipped,
+      failedSuites: report.numFailedTestSuites
+    },
     incomplete: skipped > 0 || diagnostics.length > 0,
     diagnostics
   };
 }
 
 // src/review/evidence/sarif.ts
-import { z as z5 } from "zod";
-var index = z5.number().int().nonnegative();
-var artifact = z5.object({ uri: z5.string().optional(), uriBaseId: z5.string().optional(), index: index.optional() });
-var message = z5.object({ text: z5.string().optional(), markdown: z5.string().optional(), id: z5.string().optional(), arguments: z5.array(z5.string()).optional() });
-var level = z5.enum(["error", "warning", "note", "none"]);
-var location = z5.object({ physicalLocation: z5.object({ artifactLocation: artifact.optional(), region: z5.object({ startLine: index.optional(), startColumn: index.optional() }).optional() }).optional() });
-var schema2 = z5.object({
-  version: z5.literal("2.1.0"),
-  runs: z5.array(z5.object({
-    tool: z5.object({ driver: z5.object({ name: z5.string().min(1), rules: z5.array(z5.object({ id: z5.string(), defaultConfiguration: z5.object({ level: level.optional() }).optional(), messageStrings: z5.record(message).optional() })).optional(), globalMessageStrings: z5.record(message).optional() }) }),
-    invocations: z5.array(z5.object({ executionSuccessful: z5.boolean(), commandLine: z5.string().optional(), toolExecutionNotifications: z5.array(z5.object({ level: level.optional(), message })).optional() })).optional(),
-    versionControlProvenance: z5.array(z5.object({ revisionId: z5.string().optional() })).optional(),
-    originalUriBaseIds: z5.record(artifact).optional(),
-    artifacts: z5.array(z5.object({ location: artifact.optional() })).optional(),
-    results: z5.array(z5.object({
-      ruleId: z5.string().optional(),
-      ruleIndex: index.optional(),
-      message,
-      level: level.optional(),
-      kind: z5.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
-      baselineState: z5.enum(["new", "unchanged", "updated", "absent"]).optional(),
-      suppressions: z5.array(z5.object({ kind: z5.enum(["inSource", "external"]), status: z5.enum(["accepted", "underReview", "rejected"]).optional() })).nullable().optional(),
-      locations: z5.array(location).optional(),
-      relatedLocations: z5.array(location).optional()
-    })).optional()
-  }))
+import { z as z7 } from "zod";
+var index = z7.number().int().nonnegative();
+var artifact = z7.object({
+  uri: z7.string().optional(),
+  uriBaseId: z7.string().optional(),
+  index: index.optional()
+});
+var message = z7.object({
+  text: z7.string().optional(),
+  markdown: z7.string().optional(),
+  id: z7.string().optional(),
+  arguments: z7.array(z7.string()).optional()
+});
+var level = z7.enum(["error", "warning", "note", "none"]);
+var location = z7.object({
+  physicalLocation: z7.object({
+    artifactLocation: artifact.optional(),
+    region: z7.object({ startLine: index.optional(), startColumn: index.optional() }).optional()
+  }).optional()
+});
+var schema2 = z7.object({
+  version: z7.literal("2.1.0"),
+  runs: z7.array(
+    z7.object({
+      tool: z7.object({
+        driver: z7.object({
+          name: z7.string().min(1),
+          rules: z7.array(
+            z7.object({
+              id: z7.string(),
+              defaultConfiguration: z7.object({ level: level.optional() }).optional(),
+              messageStrings: z7.record(message).optional()
+            })
+          ).optional(),
+          globalMessageStrings: z7.record(message).optional()
+        })
+      }),
+      invocations: z7.array(
+        z7.object({
+          executionSuccessful: z7.boolean(),
+          commandLine: z7.string().optional(),
+          toolExecutionNotifications: z7.array(z7.object({ level: level.optional(), message })).optional()
+        })
+      ).optional(),
+      versionControlProvenance: z7.array(z7.object({ revisionId: z7.string().optional() })).optional(),
+      originalUriBaseIds: z7.record(artifact).optional(),
+      artifacts: z7.array(z7.object({ location: artifact.optional() })).optional(),
+      results: z7.array(
+        z7.object({
+          ruleId: z7.string().optional(),
+          ruleIndex: index.optional(),
+          message,
+          level: level.optional(),
+          kind: z7.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
+          baselineState: z7.enum(["new", "unchanged", "updated", "absent"]).optional(),
+          suppressions: z7.array(
+            z7.object({
+              kind: z7.enum(["inSource", "external"]),
+              status: z7.enum(["accepted", "underReview", "rejected"]).optional()
+            })
+          ).nullable().optional(),
+          locations: z7.array(location).optional(),
+          relatedLocations: z7.array(location).optional()
+        })
+      ).optional()
+    })
+  )
 });
 function parseSarif(raw, sourceRoot) {
   const report = schema2.parse(raw), findings = [], diagnostics = [];
@@ -910,13 +1432,17 @@ function parseSarif(raw, sourceRoot) {
   const reportedCommits = [], reportedCommands = [], reportedTools = [];
   for (const [runIndex, run] of report.runs.entries()) {
     reportedTools.push(run.tool.driver.name);
-    reportedCommits.push(...(run.versionControlProvenance ?? []).flatMap((v) => v.revisionId ? [v.revisionId] : []));
+    reportedCommits.push(
+      ...(run.versionControlProvenance ?? []).flatMap((v) => v.revisionId ? [v.revisionId] : [])
+    );
     if (!run.invocations?.length) executed = false;
     for (const invocation of run.invocations ?? []) {
       if (invocation.commandLine) reportedCommands.push(invocation.commandLine);
       if (!invocation.executionSuccessful) executionFailed = true;
       for (const notification of invocation.toolExecutionNotifications ?? []) {
-        diagnostics.push(notification.message.text ?? notification.message.markdown ?? "SARIF tool execution notification");
+        diagnostics.push(
+          notification.message.text ?? notification.message.markdown ?? "SARIF tool execution notification"
+        );
         if (notification.level === "error") executionFailed = true;
       }
     }
@@ -959,22 +1485,39 @@ function parseSarif(raw, sourceRoot) {
       const rule = result.ruleIndex !== void 0 ? run.tool.driver.rules?.[result.ruleIndex] : run.tool.driver.rules?.find((rule2) => rule2.id === result.ruleId);
       const template = result.message.id ? rule?.messageStrings?.[result.message.id] ?? run.tool.driver.globalMessageStrings?.[result.message.id] : void 0;
       const rawMessage = result.message.text ?? result.message.markdown ?? template?.text ?? template?.markdown;
-      if (!rawMessage) diagnostics.push(`Message cannot be resolved for result ${runIndex}:${resultIndex}.`);
+      if (!rawMessage)
+        diagnostics.push(`Message cannot be resolved for result ${runIndex}:${resultIndex}.`);
       const rendered = (rawMessage ?? `Unresolved SARIF message ${result.message.id ?? ""}`).replace(/\{(\d+)\}/g, (match, n) => result.message.arguments?.[Number(n)] ?? match);
       const locations = [];
       for (const entry of [...result.locations ?? [], ...result.relatedLocations ?? []]) {
         const ref = entry.physicalLocation?.artifactLocation;
         const uri = ref ? resolve(ref) : null;
         const file = uri ? evidencePath(uri, sourceRoot, true) : null;
-        if (file) locations.push({ file, line: entry.physicalLocation?.region?.startLine, column: entry.physicalLocation?.region?.startColumn });
-        else diagnostics.push(`Unresolved or out-of-checkout location for result ${runIndex}:${resultIndex}.`);
+        if (file)
+          locations.push({
+            file,
+            line: entry.physicalLocation?.region?.startLine,
+            column: entry.physicalLocation?.region?.startColumn
+          });
+        else
+          diagnostics.push(
+            `Unresolved or out-of-checkout location for result ${runIndex}:${resultIndex}.`
+          );
       }
       const severity = result.level ?? rule?.defaultConfiguration?.level ?? (kind === "fail" ? "warning" : "none");
-      findings.push({ id: `${runIndex}:${resultIndex}`, ruleId: result.ruleId ?? rule?.id, ...messagePreview(rendered), severity: severity === "none" ? "note" : severity, state, locations });
+      findings.push({
+        id: `${runIndex}:${resultIndex}`,
+        ruleId: result.ruleId ?? rule?.id,
+        ...messagePreview(rendered),
+        severity: severity === "none" ? "note" : severity,
+        state,
+        locations
+      });
     }
   }
   if (!report.runs.length) diagnostics.push("SARIF contains no analysis runs.");
-  if (executionFailed) diagnostics.push("The SARIF tool reported an unsuccessful analysis invocation.");
+  if (executionFailed)
+    diagnostics.push("The SARIF tool reported an unsuccessful analysis invocation.");
   return {
     outcome: executionFailed || !report.runs.length || report.runs.some((r) => !r.results) ? "unavailable" : active ? "failed" : "passed",
     findings,
@@ -989,20 +1532,24 @@ function parseSarif(raw, sourceRoot) {
 }
 
 // src/review/evidence/check.ts
-import { z as z6 } from "zod";
-var schema3 = z6.object({
-  version: z6.literal(1),
-  commit: z6.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).optional(),
-  results: z6.array(z6.object({
-    name: z6.string().min(1).max(1e3),
-    status: z6.enum(["passed", "failed", "skipped"]),
-    message: z6.string().max(1e5).optional(),
-    locations: z6.array(z6.object({
-      file: z6.string().min(1).max(4e3),
-      line: z6.number().int().positive().optional(),
-      column: z6.number().int().positive().optional()
-    })).max(100).default([])
-  })).max(1e5)
+import { z as z8 } from "zod";
+var schema3 = z8.object({
+  version: z8.literal(1),
+  commit: z8.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).optional(),
+  results: z8.array(
+    z8.object({
+      name: z8.string().min(1).max(1e3),
+      status: z8.enum(["passed", "failed", "skipped"]),
+      message: z8.string().max(1e5).optional(),
+      locations: z8.array(
+        z8.object({
+          file: z8.string().min(1).max(4e3),
+          line: z8.number().int().positive().optional(),
+          column: z8.number().int().positive().optional()
+        })
+      ).max(100).default([])
+    })
+  ).max(1e5)
 });
 function parseCheck(raw, sourceRoot) {
   const report = schema3.parse(raw);
@@ -1013,21 +1560,26 @@ function parseCheck(raw, sourceRoot) {
     const locations = result.locations.flatMap((location2) => {
       const file = evidencePath(location2.file, sourceRoot);
       if (!file) {
-        diagnostics.push(`Check location is outside the declared checkout or invalid: ${location2.file}`);
+        diagnostics.push(
+          `Check location is outside the declared checkout or invalid: ${location2.file}`
+        );
         return [];
       }
       return [{ ...location2, file }];
     });
-    if (result.status === "failed") findings.push({
-      id: String(index2),
-      ...messagePreview([result.name, result.message].filter(Boolean).join("\n")),
-      severity: "error",
-      state: "active",
-      locations
-    });
+    if (result.status === "failed")
+      findings.push({
+        id: String(index2),
+        ...messagePreview([result.name, result.message].filter(Boolean).join("\n")),
+        severity: "error",
+        state: "active",
+        locations
+      });
   }
-  if (!counts.total) diagnostics.push("No check results were recorded; an empty report is not passing evidence.");
-  if (counts.skipped) diagnostics.push(`${counts.skipped} checks were skipped; verification is incomplete.`);
+  if (!counts.total)
+    diagnostics.push("No check results were recorded; an empty report is not passing evidence.");
+  if (counts.skipped)
+    diagnostics.push(`${counts.skipped} checks were skipped; verification is incomplete.`);
   return {
     outcome: counts.failed ? "failed" : !counts.total ? "unavailable" : !counts.passed ? "skipped" : "passed",
     counts,
@@ -1039,28 +1591,38 @@ function parseCheck(raw, sourceRoot) {
 }
 
 // src/review/evidence.ts
-var checkSchema = z7.object({
-  id: z7.string().min(1).max(100),
-  kind: z7.enum(["tests", "static-analysis", "security", "complexity", "duplication", "documentation"]),
-  tool: z7.string().min(1).max(200),
-  command: z7.string().min(1).max(2e3),
-  commit: z7.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
-  workingTreeClean: z7.boolean().optional(),
-  source: z7.string().max(2e3).optional(),
-  sourceRoot: z7.string().min(1).max(4e3).optional(),
-  status: z7.enum(["completed", "skipped", "unavailable"]).default("completed"),
-  reason: z7.string().min(1).max(2e3).optional(),
-  exitCode: z7.number().int().nullable().optional(),
-  environment: z7.object({
-    toolVersion: z7.string().min(1).max(200),
-    runtime: z7.string().min(1).max(200).optional(),
-    platform: z7.string().min(1).max(200).optional(),
-    configuration: z7.array(z7.string().min(1).max(4e3)).max(100).optional()
+var checkSchema = z9.object({
+  id: z9.string().min(1).max(100),
+  kind: z9.enum([
+    "tests",
+    "static-analysis",
+    "security",
+    "complexity",
+    "duplication",
+    "documentation"
+  ]),
+  tool: z9.string().min(1).max(200),
+  command: z9.string().min(1).max(2e3),
+  commit: z9.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
+  workingTreeClean: z9.boolean().optional(),
+  source: z9.string().max(2e3).optional(),
+  sourceRoot: z9.string().min(1).max(4e3).optional(),
+  status: z9.enum(["completed", "skipped", "unavailable"]).default("completed"),
+  reason: z9.string().min(1).max(2e3).optional(),
+  exitCode: z9.number().int().nullable().optional(),
+  environment: z9.object({
+    toolVersion: z9.string().min(1).max(200),
+    runtime: z9.string().min(1).max(200).optional(),
+    platform: z9.string().min(1).max(200).optional(),
+    configuration: z9.array(z9.string().min(1).max(4e3)).max(100).optional()
   }).optional(),
-  report: z7.object({ format: z7.enum(["vitest-json", "sarif", "mason-check-json"]), path: z7.string().min(1).max(4e3) }).optional()
+  report: z9.object({
+    format: z9.enum(["vitest-json", "sarif", "mason-check-json"]),
+    path: z9.string().min(1).max(4e3)
+  }).optional()
 });
 function relativeArtifact(root, file) {
-  const relative = path10.isAbsolute(file) ? path10.relative(root, file) : file;
+  const relative = path11.isAbsolute(file) ? path11.relative(root, file) : file;
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
   return normalized;
@@ -1070,17 +1632,37 @@ function linkFinding(finding, changed, pairs, decisions, freshness) {
   const paired = pairs.filter((pair) => located.includes(pair.test));
   const relatedChangedFiles = located.filter((file) => changed.has(file)).map((file) => ({ file, relationship: "direct" }));
   for (const pair of paired) {
-    if (changed.has(pair.source) && !relatedChangedFiles.some((f) => f.file === pair.source)) relatedChangedFiles.push({ file: pair.source, relationship: "paired-test", confidence: pair.confidence });
+    if (changed.has(pair.source) && !relatedChangedFiles.some((f) => f.file === pair.source))
+      relatedChangedFiles.push({
+        file: pair.source,
+        relationship: "paired-test",
+        confidence: pair.confidence
+      });
   }
   const allFiles = [.../* @__PURE__ */ new Set([...located, ...paired.map((pair) => pair.source)])];
   const acceptedDecisions = decisions.map(effectiveDecision).filter((d) => d.status === "active" && decisionApproval(d) === "accepted").map((d) => ({ d, viaFiles: matchingPaths(d.files, allFiles) })).filter((match) => match.viaFiles.length).map(({ d, viaFiles }) => {
     const state = freshness[d.id] ?? "unknown", provenance = decisionProvenance(d, state);
-    return { id: d.id, title: d.title, owner: provenance.owner, freshness: state, reviewRequired: provenance.reviewRequired, viaFiles };
+    return {
+      id: d.id,
+      title: d.title,
+      owner: provenance.owner,
+      freshness: state,
+      reviewRequired: provenance.reviewRequired,
+      viaFiles
+    };
   });
-  return { ...finding, relatedChangedFiles, acceptedDecisions: acceptedDecisions.slice(0, 5), totalAcceptedDecisions: acceptedDecisions.length };
+  return {
+    ...finding,
+    relatedChangedFiles,
+    acceptedDecisions: acceptedDecisions.slice(0, 5),
+    totalAcceptedDecisions: acceptedDecisions.length
+  };
 }
 async function collectReviewEvidence(root, manifests, changedFiles, decisions, decisionFreshness = {}, reviewedHead) {
-  const [headHash, workingTree] = await Promise.all([reviewedHead ?? getCurrentGitHash(root), getWorkingTree(root)]);
+  const [headHash, workingTree] = await Promise.all([
+    reviewedHead ?? getCurrentGitHash(root),
+    getWorkingTree(root)
+  ]);
   const output = {
     version: 1,
     scope: "committed",
@@ -1094,12 +1676,13 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
   };
   const seen = /* @__PURE__ */ new Set(), changed = new Set(changedFiles);
   let pairs;
-  if (manifests.length > 10) output.diagnostics.push("Only the first 10 evidence manifests were imported.");
+  if (manifests.length > 10)
+    output.diagnostics.push("Only the first 10 evidence manifests were imported.");
   for (const supplied of manifests.slice(0, 10)) {
     let manifest, raw;
     try {
       manifest = relativeArtifact(root, supplied);
-      raw = z7.object({ version: z7.literal(1), checks: z7.array(z7.unknown()) }).parse(await readStoreJson(root, manifest));
+      raw = z9.object({ version: z9.literal(1), checks: z9.array(z9.unknown()) }).parse(await readStoreJson(root, manifest));
     } catch (error) {
       output.diagnostics.push(`${supplied}: ${String(error)}`);
       continue;
@@ -1117,7 +1700,9 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
       }
       const check = input.data;
       if (seen.has(check.id)) {
-        output.diagnostics.push(`Duplicate check id ${check.id}; give different runs distinct ids.`);
+        output.diagnostics.push(
+          `Duplicate check id ${check.id}; give different runs distinct ids.`
+        );
         continue;
       }
       seen.add(check.id);
@@ -1142,22 +1727,34 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         ...check.environment ? { environment: check.environment } : {}
       };
       output.checks.push(result);
-      if (check.workingTreeClean !== true) result.diagnostics.push("The check's working tree was dirty or not recorded; its results cannot be attributed to the claimed commit alone.");
-      else if (result.commit && headHash !== "unknown") result.freshness = result.commit === headHash.toLowerCase() ? "current" : "stale";
+      if (check.workingTreeClean !== true)
+        result.diagnostics.push(
+          "The check's working tree was dirty or not recorded; its results cannot be attributed to the claimed commit alone."
+        );
+      else if (result.commit && headHash !== "unknown")
+        result.freshness = result.commit === headHash.toLowerCase() ? "current" : "stale";
       else result.diagnostics.push("The tested commit or reviewed HEAD is unknown.");
       if (check.status !== "completed") {
         result.outcome = check.status;
-        result.diagnostics.push(check.reason ?? "No reason was recorded for this skipped or unavailable check.");
+        result.diagnostics.push(
+          check.reason ?? "No reason was recorded for this skipped or unavailable check."
+        );
         continue;
       }
       try {
         if (!check.report) throw new Error("Completed check has no report artifact.");
-        if (check.report.format !== "mason-check-json" && check.kind === "tests" !== (check.report.format === "vitest-json")) throw new Error("Test checks require vitest-json or mason-check-json; analysis checks require sarif or mason-check-json.");
+        if (check.report.format !== "mason-check-json" && check.kind === "tests" !== (check.report.format === "vitest-json"))
+          throw new Error(
+            "Test checks require vitest-json or mason-check-json; analysis checks require sarif or mason-check-json."
+          );
         const file = relativeArtifact(root, check.report.path);
         const report = await readStoreJson(root, file);
         if (report === null) throw new Error(`Report artifact is missing: ${file}`);
         const sourceRoot = check.sourceRoot ?? root;
-        if (!path10.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot)) throw new Error("sourceRoot must identify the absolute checkout root on the check runner.");
+        if (!path11.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot))
+          throw new Error(
+            "sourceRoot must identify the absolute checkout root on the check runner."
+          );
         const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
         result.outcome = parsed.outcome;
         result.counts = parsed.counts;
@@ -1165,18 +1762,26 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         result.diagnostics.push(...parsed.diagnostics);
         result.reportedCommands = parsed.reportedCommands;
         result.reportedTools = parsed.reportedTools;
-        if (parsed.reportedCommits?.some((commit) => !result.commit || commit.toLowerCase() !== result.commit)) {
+        if (parsed.reportedCommits?.some(
+          (commit) => !result.commit || commit.toLowerCase() !== result.commit
+        )) {
           result.freshness = "unknown";
           result.incomplete = true;
-          result.diagnostics.push("Report revision metadata conflicts with, or cannot be tied to, the manifest's tested commit.");
+          result.diagnostics.push(
+            "Report revision metadata conflicts with, or cannot be tied to, the manifest's tested commit."
+          );
         }
         if (check.exitCode == null && !parsed.executed) {
           result.incomplete = true;
-          result.diagnostics.push("Neither an exit code nor successful analysis invocation was recorded; completion cannot be confirmed.");
+          result.diagnostics.push(
+            "Neither an exit code nor successful analysis invocation was recorded; completion cannot be confirmed."
+          );
         }
         if (check.exitCode != null && check.exitCode !== 0 && result.outcome === "passed") {
           result.outcome = "failed";
-          result.diagnostics.push(`Check command exited ${check.exitCode} despite a report with no active failures.`);
+          result.diagnostics.push(
+            `Check command exited ${check.exitCode} despite a report with no active failures.`
+          );
         }
         if (check.kind === "tests" && pairs === void 0) {
           try {
@@ -1188,11 +1793,18 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
         }
         result.totalFindings = parsed.findings.length;
         const testPairs = check.kind === "tests" ? pairs ?? [] : [];
-        const relevant = /* @__PURE__ */ new Set([...changed, ...testPairs.filter((p) => changed.has(p.source)).map((p) => p.test)]);
+        const relevant = /* @__PURE__ */ new Set([
+          ...changed,
+          ...testPairs.filter((p) => changed.has(p.source)).map((p) => p.test)
+        ]);
         const touchesChange = (f) => f.locations.some((l) => relevant.has(l.file));
-        parsed.findings.sort((a, b) => Number(b.state === "active") - Number(a.state === "active") || Number(touchesChange(b)) - Number(touchesChange(a)));
+        parsed.findings.sort(
+          (a, b) => Number(b.state === "active") - Number(a.state === "active") || Number(touchesChange(b)) - Number(touchesChange(a))
+        );
         result.findings = parsed.findings.slice(0, MAX_FINDINGS).map((f) => linkFinding(f, changed, testPairs, decisions, decisionFreshness));
-        result.truncated = parsed.findings.length > MAX_FINDINGS || result.findings.some((f) => f.truncated || f.totalAcceptedDecisions > f.acceptedDecisions.length);
+        result.truncated = parsed.findings.length > MAX_FINDINGS || result.findings.some(
+          (f) => f.truncated || f.totalAcceptedDecisions > f.acceptedDecisions.length
+        );
       } catch (error) {
         result.outcome = "unavailable";
         result.incomplete = true;
@@ -1205,9 +1817,12 @@ async function collectReviewEvidence(root, manifests, changedFiles, decisions, d
     output.summary[check.outcome]++;
     if (check.freshness !== "current") output.summary[check.freshness]++;
   }
-  if (output.checks.some((c) => c.outcome === "failed" && c.freshness === "current")) output.status = "failed";
-  else if (!output.checks.length || output.checks.every((c) => c.outcome === "unavailable")) output.status = "unavailable";
-  else if (output.diagnostics.length || output.checks.some((c) => c.outcome !== "passed" || c.freshness !== "current" || c.incomplete)) output.status = "incomplete";
+  if (output.checks.some((c) => c.outcome === "failed" && c.freshness === "current"))
+    output.status = "failed";
+  else if (!output.checks.length || output.checks.every((c) => c.outcome === "unavailable"))
+    output.status = "unavailable";
+  else if (output.diagnostics.length || output.checks.some((c) => c.outcome !== "passed" || c.freshness !== "current" || c.incomplete))
+    output.status = "incomplete";
   else output.status = "passed";
   return output;
 }
@@ -1241,7 +1856,7 @@ function anchorsTouched(record, changedFiles) {
   return matchingPaths(record.files, changedFiles);
 }
 async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path11.resolve(rootDir);
+  const resolvedRoot = path12.resolve(rootDir);
   const head = await getCurrentGitHash(resolvedRoot);
   if (head === "unknown") return null;
   const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
@@ -1264,15 +1879,26 @@ async function computeReview(rootDir, base, options = {}) {
   report.diagnostics = store.diagnostics;
   const decisionDrift = await computeDecisionDrift(resolvedRoot, store.records);
   if (options.evidence !== void 0) {
-    report.evidence = await collectReviewEvidence(resolvedRoot, options.evidence, changedFiles, store.records, decisionDrift.freshness, head);
+    report.evidence = await collectReviewEvidence(
+      resolvedRoot,
+      options.evidence,
+      changedFiles,
+      store.records,
+      decisionDrift.freshness,
+      head
+    );
     if (store.diagnostics.length) {
-      report.evidence.diagnostics.push("Invalid decision records make knowledge associations incomplete; consult review diagnostics.");
+      report.evidence.diagnostics.push(
+        "Invalid decision records make knowledge associations incomplete; consult review diagnostics."
+      );
       if (report.evidence.status === "passed") report.evidence.status = "incomplete";
     }
   }
   const finalize = async () => {
     if (report.evidence && await getCurrentGitHash(resolvedRoot) !== head) {
-      report.evidence.diagnostics.push("HEAD changed during the review; rerun to obtain consistent change and knowledge associations.");
+      report.evidence.diagnostics.push(
+        "HEAD changed during the review; rerun to obtain consistent change and knowledge associations."
+      );
       for (const check of report.evidence.checks) check.freshness = "unknown";
       report.evidence.summary.stale = 0;
       report.evidence.summary.unknown = report.evidence.checks.length;
@@ -1291,7 +1917,7 @@ async function computeReview(rootDir, base, options = {}) {
     analyzed,
     async (relPath) => {
       try {
-        await fs6.access(path11.join(resolvedRoot, relPath));
+        await fs7.access(path12.join(resolvedRoot, relPath));
         return true;
       } catch {
         return false;
@@ -1311,7 +1937,11 @@ async function computeReview(rootDir, base, options = {}) {
     const touched = anchorsTouched(effective, changedFiles);
     const proposalTouched = effective !== record ? anchorsTouched(record, changedFiles) : [];
     if (touched.length > 0 || proposalTouched.length > 0) {
-      const { pendingProposal, ...knowledge } = decisionKnowledge(record, decisionDrift.freshness?.[record.id] ?? "unknown", decisionDrift.pendingProposals?.[record.id]?.freshness ?? "unknown");
+      const { pendingProposal, ...knowledge } = decisionKnowledge(
+        record,
+        decisionDrift.freshness?.[record.id] ?? "unknown",
+        decisionDrift.pendingProposals?.[record.id]?.freshness ?? "unknown"
+      );
       report.touchedDecisions.push({
         ...knowledge,
         ...pendingProposal ? { pendingProposal: { ...pendingProposal, touchedFiles: proposalTouched } } : {},
@@ -1388,36 +2018,71 @@ function parseArgs(argv) {
       throw new Error(`Unknown argument: ${arg}`);
     }
   }
-  if (parsed.requireEvidence && !parsed.evidence.length) throw new Error("--require-evidence requires at least one --evidence manifest");
+  if (parsed.requireEvidence && !parsed.evidence.length)
+    throw new Error("--require-evidence requires at least one --evidence manifest");
   return parsed;
 }
 var display = (value, limit = 500) => stripVTControlCharacters(value).replace(/[\r\n\t]/g, " ").slice(0, limit);
 function evidenceSummary(report) {
   const evidence = report.evidence;
   if (!evidence) return [];
-  const lines = [`Imported CI evidence: ${evidence.status} (commit ${evidence.headHash.slice(0, 12)}; committed scope).`];
-  for (const diagnostic of evidence.diagnostics) lines.push(`  Evidence unavailable: ${display(diagnostic)}`);
+  const lines = [
+    `Imported CI evidence: ${evidence.status} (commit ${evidence.headHash.slice(0, 12)}; committed scope).`
+  ];
+  for (const diagnostic of evidence.diagnostics)
+    lines.push(`  Evidence unavailable: ${display(diagnostic)}`);
   for (const check of evidence.checks) {
-    lines.push(`  [${check.kind}] ${display(check.id)}: ${check.outcome}, ${check.freshness} (${display(check.tool)})`);
-    lines.push(`    command: ${display(check.command)}; tested commit: ${check.commit ?? "unknown"}`);
+    lines.push(
+      `  [${check.kind}] ${display(check.id)}: ${check.outcome}, ${check.freshness} (${display(check.tool)})`
+    );
+    lines.push(
+      `    command: ${display(check.command)}; tested commit: ${check.commit ?? "unknown"}`
+    );
     if (check.environment) {
-      lines.push(`    environment: ${display(check.tool)} ${display(check.environment.toolVersion)}` + (check.environment.runtime ? `; ${display(check.environment.runtime)}` : "") + (check.environment.platform ? `; ${display(check.environment.platform)}` : ""));
-      if (check.environment.configuration?.length) lines.push("    configuration: " + check.environment.configuration.map((value) => display(value)).join(", "));
+      lines.push(
+        `    environment: ${display(check.tool)} ${display(check.environment.toolVersion)}` + (check.environment.runtime ? `; ${display(check.environment.runtime)}` : "") + (check.environment.platform ? `; ${display(check.environment.platform)}` : "")
+      );
+      if (check.environment.configuration?.length)
+        lines.push(
+          "    configuration: " + check.environment.configuration.map((value) => display(value)).join(", ")
+        );
     }
-    lines.push(`    source: ${display(check.source ?? check.manifest)}; report: ${display(check.report?.path ?? "none")}`);
+    lines.push(
+      `    source: ${display(check.source ?? check.manifest)}; report: ${display(check.report?.path ?? "none")}`
+    );
     if (Object.keys(check.counts).length) lines.push(`    counts: ${JSON.stringify(check.counts)}`);
-    for (const diagnostic of check.diagnostics.slice(0, 5)) lines.push(`    note: ${display(diagnostic)}`);
+    for (const diagnostic of check.diagnostics.slice(0, 5))
+      lines.push(`    note: ${display(diagnostic)}`);
     for (const finding of check.findings.slice(0, 10)) {
       const locations = finding.locations.map((l) => `${l.file}${l.line ? `:${l.line}` : ""}`).join(", ") || "no resolved file location";
-      lines.push(`    [${finding.state}/${finding.severity}] ${display(finding.ruleId ?? finding.id)} ${display(locations)}: ${display(finding.message)}`);
-      if (finding.relatedChangedFiles.length) lines.push(`      changed files: ${finding.relatedChangedFiles.map((f) => `${display(f.file)} (${f.relationship}${f.confidence ? `, ${f.confidence}` : ""})`).join(", ")}`);
-      for (const decision of finding.acceptedDecisions) lines.push(`      related accepted decision: ${display(decision.id)}; owner ${display(decision.owner ?? "unknown")}; freshness ${decision.freshness}${decision.reviewRequired ? "; needs review" : ""}`);
+      lines.push(
+        `    [${finding.state}/${finding.severity}] ${display(finding.ruleId ?? finding.id)} ${display(locations)}: ${display(finding.message)}`
+      );
+      if (finding.relatedChangedFiles.length)
+        lines.push(
+          `      changed files: ${finding.relatedChangedFiles.map((f) => `${display(f.file)} (${f.relationship}${f.confidence ? `, ${f.confidence}` : ""})`).join(", ")}`
+        );
+      for (const decision of finding.acceptedDecisions)
+        lines.push(
+          `      related accepted decision: ${display(decision.id)}; owner ${display(decision.owner ?? "unknown")}; freshness ${decision.freshness}${decision.reviewRequired ? "; needs review" : ""}`
+        );
     }
-    if (check.totalFindings > 10 || check.truncated || check.diagnostics.length > 5) lines.push(`    Output abbreviated (${check.totalFindings} findings); inspect --json and the original artifact for full evidence.`);
+    if (check.totalFindings > 10 || check.truncated || check.diagnostics.length > 5)
+      lines.push(
+        `    Output abbreviated (${check.totalFindings} findings); inspect --json and the original artifact for full evidence.`
+      );
   }
-  if (!evidence.workingTree.available) lines.push("  Working-tree state unavailable; imported evidence only describes the recorded commit.");
-  else if (evidence.workingTree.changedFiles.length) lines.push(`  ${evidence.workingTree.changedFiles.length} uncommitted paths are outside this evidence's scope.`);
-  lines.push("  Related decisions are associations, not proven violations. Passing imported checks do not establish complete coverage.");
+  if (!evidence.workingTree.available)
+    lines.push(
+      "  Working-tree state unavailable; imported evidence only describes the recorded commit."
+    );
+  else if (evidence.workingTree.changedFiles.length)
+    lines.push(
+      `  ${evidence.workingTree.changedFiles.length} uncommitted paths are outside this evidence's scope.`
+    );
+  lines.push(
+    "  Related decisions are associations, not proven violations. Passing imported checks do not establish complete coverage."
+  );
   return lines;
 }
 function formatReviewSummary(report) {
@@ -1425,16 +2090,13 @@ function formatReviewSummary(report) {
   lines.push(
     `Diff vs ${report.base} (merge-base ${report.mergeBase.slice(0, 7)}): ${report.changedFiles.length} changed file${report.changedFiles.length === 1 ? "" : "s"}.`
   );
-  for (const diagnostic of report.diagnostics ?? []) lines.push(`Invalid decision record ${diagnostic.path}: ${diagnostic.message}`);
+  for (const diagnostic of report.diagnostics ?? [])
+    lines.push(`Invalid decision record ${diagnostic.path}: ${diagnostic.message}`);
   if (report.truncated) {
-    lines.push(
-      `Large diff \u2013 co-change analysis limited to the first ${50} files.`
-    );
+    lines.push(`Large diff \u2013 co-change analysis limited to the first ${50} files.`);
   }
   if (!report.historyAvailable) {
-    lines.push(
-      "Git history unavailable (shallow clone?) \u2013 co-change analysis skipped."
-    );
+    lines.push("Git history unavailable (shallow clone?) \u2013 co-change analysis skipped.");
   }
   if (report.missingPartners.length > 0) {
     lines.push("Possible forgotten co-change partners:");
@@ -1445,16 +2107,24 @@ function formatReviewSummary(report) {
     }
   }
   if (report.touchedDecisions.length > 0) {
-    lines.push("Recorded decisions touched by this diff (check approval and freshness before relying on them):");
+    lines.push(
+      "Recorded decisions touched by this diff (check approval and freshness before relying on them):"
+    );
     for (const d of report.touchedDecisions) {
       lines.push(
         `  [decision] ${d.title} (${d.category}; ${d.approval ?? "unreviewed"}; owner ${d.owner ?? "unknown"}; freshness ${d.freshness ?? "unknown"}; via ${d.touchedFiles.join(", ") || "pending proposal"})`
       );
-      if (d.sources?.length) lines.push(`    sources: ${d.sources.map((s) => s.reference).join(", ")}`);
-      if (d.lastReview) lines.push(`    last review: ${d.lastReview.reviewer} at ${d.lastReview.gitHash.slice(0, 7)}`);
+      if (d.sources?.length)
+        lines.push(`    sources: ${d.sources.map((s) => s.reference).join(", ")}`);
+      if (d.lastReview)
+        lines.push(
+          `    last review: ${d.lastReview.reviewer} at ${d.lastReview.gitHash.slice(0, 7)}`
+        );
       if (d.pendingProposal) {
         const p = d.pendingProposal;
-        lines.push(`    [proposed revision ${p.revision}] ${p.title} (owner ${p.owner ?? "unknown"}; freshness ${p.trust.freshness}; via ${p.touchedFiles.join(", ") || "no draft anchors touched"}); accepted revision ${d.revision} remains operative`);
+        lines.push(
+          `    [proposed revision ${p.revision}] ${p.title} (owner ${p.owner ?? "unknown"}; freshness ${p.trust.freshness}; via ${p.touchedFiles.join(", ") || "no draft anchors touched"}); accepted revision ${d.revision} remains operative`
+        );
       }
     }
   }
@@ -1482,7 +2152,7 @@ async function runReviewCli(argv, io = {
     io.out(USAGE);
     return 0;
   }
-  const rootDir = path12.resolve(args.dir);
+  const rootDir = path13.resolve(args.dir);
   const base = args.base ?? await defaultBase(rootDir);
   if (!base) {
     io.err(
@@ -1490,7 +2160,11 @@ async function runReviewCli(argv, io = {
     );
     return 2;
   }
-  const report = await computeReview(rootDir, base, args.evidence.length ? { evidence: args.evidence } : {});
+  const report = await computeReview(
+    rootDir,
+    base,
+    args.evidence.length ? { evidence: args.evidence } : {}
+  );
   if (!report) {
     io.err(
       `Could not resolve a merge base between ${base} and HEAD in ${rootDir} \u2013 not a git repository, unknown ref, or unrelated histories.`
@@ -1501,9 +2175,13 @@ async function runReviewCli(argv, io = {
     io.out(JSON.stringify(report, null, 2));
   } else {
     io.out(formatReviewSummary(report));
-    if (args.evidence.length && !args.requireEvidence) io.out("Imported evidence is advisory for exit codes; use --require-evidence to require current passing checks.");
+    if (args.evidence.length && !args.requireEvidence)
+      io.out(
+        "Imported evidence is advisory for exit codes; use --require-evidence to require current passing checks."
+      );
   }
-  if (args.requireEvidence && report.evidence?.status !== "passed") return report.evidence?.status === "failed" ? 1 : 2;
+  if (args.requireEvidence && report.evidence?.status !== "passed")
+    return report.evidence?.status === "failed" ? 1 : 2;
   return report.missingPartners.length > 0 ? 1 : 0;
 }