mason-context 0.20.2 → 0.21.0

package/dist/mason-drift.js

@@ -31,7 +31,7 @@ var init_types = __esm({
 });
 
 // src/drift/cli.ts
-import path10 from "path";
+import path11 from "path";
 
 // src/utils/git-read.ts
 import { execFile } from "child_process";
@@ -55,7 +55,19 @@ async function profilePhase(label, run) {
 
 // src/utils/git-read.ts
 var execute = promisify(execFile);
-var commands = /* @__PURE__ */ new Set(["rev-parse", "symbolic-ref", "for-each-ref", "ls-files", "check-ignore", "status", "log", "diff", "ls-tree", "show", "merge-base"]);
+var commands = /* @__PURE__ */ new Set([
+  "rev-parse",
+  "symbolic-ref",
+  "for-each-ref",
+  "ls-files",
+  "check-ignore",
+  "status",
+  "log",
+  "diff",
+  "ls-tree",
+  "show",
+  "merge-base"
+]);
 function execGit(args, options) {
   const command = args.find((arg) => !arg.startsWith("-")) ?? "other";
   return profilePhase("git." + (commands.has(command) ? command : "other"), async () => {
@@ -77,6 +89,14 @@ import path6 from "path";
 // src/snapshot/snapshot.ts
 import path5 from "path";
 
+// src/utils/validation.ts
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+
 // src/utils/files.ts
 import fs from "fs/promises";
 import { constants } from "fs";
@@ -87,7 +107,8 @@ import fg from "fast-glob";
 import path from "path";
 function normalizeRepoPath(value) {
   const slash = value.replace(/\\/g, "/");
-  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash)) return null;
+  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash))
+    return null;
   if (slash.split("/").includes("..")) return null;
   const normalized = path.posix.normalize(slash).replace(/\/$/, "");
   return normalized === "." ? null : normalized;
@@ -102,11 +123,69 @@ function anchorMatches(anchor, file) {
   return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
 }
 function matchingPaths(anchors, files) {
-  return [...new Set(files)].filter((file) => anchors.some((anchor) => anchorMatches(anchor, file)));
+  return [...new Set(files)].filter(
+    (file) => anchors.some((anchor) => anchorMatches(anchor, file))
+  );
+}
+function indexMatchingPaths(scopes, files) {
+  const node = () => ({ children: /* @__PURE__ */ new Map(), scopes: /* @__PURE__ */ new Set() });
+  const root = node();
+  const matches = scopes.map(() => []);
+  scopes.forEach((anchors, index) => {
+    for (const anchor of anchors) {
+      const normalized = normalizeRepoPath(anchor);
+      if (!normalized) continue;
+      let current = root;
+      for (const part of normalized.split("/")) {
+        if (!current.children.has(part)) current.children.set(part, node());
+        current = current.children.get(part);
+      }
+      current.scopes.add(index);
+    }
+  });
+  for (const file of new Set(files)) {
+    const normalized = normalizeRepoPath(file);
+    if (!normalized) continue;
+    const selected = /* @__PURE__ */ new Set();
+    let current = root;
+    for (const part of normalized.split("/")) {
+      current = current.children.get(part);
+      if (!current) break;
+      for (const index of current.scopes) selected.add(index);
+    }
+    for (const index of selected) matches[index].push(file);
+  }
+  return matches;
 }
 
 // src/utils/files.ts
-var SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
+var SOURCE_EXTENSIONS = [
+  "ts",
+  "tsx",
+  "js",
+  "jsx",
+  "mts",
+  "cts",
+  "mjs",
+  "cjs",
+  "vue",
+  "svelte",
+  "kt",
+  "kts",
+  "java",
+  "py",
+  "go",
+  "rs",
+  "swift",
+  "rb",
+  "cs",
+  "cpp",
+  "c",
+  "h",
+  "hpp",
+  "dart",
+  "php"
+];
 var SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
 var SOURCE_IGNORE = [
   "**/node_modules/**",
@@ -134,11 +213,16 @@ var SOURCE_IGNORE = [
 var MAX_SOURCE_BYTES = 1024 * 1024;
 function isSensitiveFile(file) {
   return file.split(/[\\/]/).some(
-    (part) => /^(?:\.env(?:\..*)?|id_rsa.*|id_ed25519.*)$|\.(?:pem|key|p12|pfx|jks|keystore)$|credentials\.|secret|^local\.properties$/i.test(part)
+    (part) => /^(?:\.env(?:\..*)?|id_rsa.*|id_ed25519.*)$|\.(?:pem|key|p12|pfx|jks|keystore)$|credentials\.|secret|^local\.properties$/i.test(
+      part
+    )
   );
 }
 async function readBoundedFile(file, maxBytes) {
-  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  const handle = await fs.open(
+    file,
+    constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW
+  );
   try {
     const stat = await handle.stat();
     if (!stat.isFile() || stat.size > maxBytes) return null;
@@ -158,36 +242,44 @@ async function loadProjectConfig(root) {
   try {
     const canonicalRoot = await fs.realpath(root);
     const configPath = await fs.realpath(path2.join(root, ".mason/config.json"));
-    if (!isWithinRoot(canonicalRoot, configPath)) throw new Error("Project configuration resolves outside the repository");
+    if (!isWithinRoot(canonicalRoot, configPath))
+      throw new Error("Project configuration resolves outside the repository");
     const raw = await readBoundedFile(configPath, 64 * 1024);
-    if (raw === null) throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
+    if (raw === null)
+      throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
     const value = JSON.parse(raw);
-    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected a configuration object");
+    if (!isRecord(value)) throw new Error("Expected a configuration object");
     const config = {};
     for (const key of ["patterns", "alwaysInclude", "ignore"]) {
       if (value[key] === void 0) continue;
-      if (!Array.isArray(value[key]) || !value[key].every((s) => typeof s === "string")) {
+      if (!isStringArray(value[key])) {
         throw new Error(`Configuration ${key} must be an array of strings`);
       }
       config[key] = value[key];
     }
     if (value.audit !== void 0) {
       const audit = value.audit;
-      if (!audit || typeof audit !== "object" || Array.isArray(audit)) throw new Error("Configuration audit must be an object");
+      if (!isRecord(audit)) throw new Error("Configuration audit must be an object");
       const patterns = (raw2) => {
-        if (!Array.isArray(raw2) || raw2.length > 100 || !raw2.every((s) => typeof s === "string" && normalizeRepoPath(s) === s && !s.startsWith("!") && !/[\x00-\x1f]/.test(s))) {
-          throw new Error("Audit patterns must be at most 100 repository-relative globs without traversal or negation");
+        if (!isStringArray(raw2) || raw2.length > 100 || !raw2.every(
+          (s) => typeof s === "string" && normalizeRepoPath(s) === s && !s.startsWith("!") && !/[\x00-\x1f]/.test(s)
+        )) {
+          throw new Error(
+            "Audit patterns must be at most 100 repository-relative globs without traversal or negation"
+          );
         }
         return raw2;
       };
       config.audit = {};
       if (audit.include !== void 0) config.audit.include = patterns(audit.include);
       if (audit.exclude !== void 0) {
-        if (!audit.exclude || typeof audit.exclude !== "object" || Array.isArray(audit.exclude)) throw new Error("audit.exclude must map check names to patterns");
+        if (!isRecord(audit.exclude))
+          throw new Error("audit.exclude must map check names to patterns");
         const { ALL_CHECKS: ALL_CHECKS2 } = await Promise.resolve().then(() => (init_types(), types_exports));
         config.audit.exclude = {};
         for (const [check, globs] of Object.entries(audit.exclude)) {
-          if (!ALL_CHECKS2.includes(check)) throw new Error("Unknown audit check: " + check);
+          if (!ALL_CHECKS2.includes(check))
+            throw new Error("Unknown audit check: " + check);
           config.audit.exclude[check] = patterns(globs);
         }
       }
@@ -195,7 +287,10 @@ async function loadProjectConfig(root) {
     return config;
   } catch (error) {
     if (error.code === "ENOENT") return {};
-    throw new Error(`Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`);
+    throw new Error(
+      `Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error }
+    );
   }
 }
 async function createFileAccess(rootDir) {
@@ -205,7 +300,10 @@ async function createFileAccess(rootDir) {
   const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
   let gitFiles = null;
   try {
-    const { stdout } = await execGit(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
+    const { stdout } = await execGit(
+      ["ls-files", "-z", "--cached", "--others", "--exclude-standard"],
+      { cwd: root, maxBuffer: 50 * 1024 * 1024 }
+    );
     gitFiles = new Set(stdout.split("\0").filter(Boolean));
   } catch {
     let inGit = false;
@@ -218,14 +316,17 @@ async function createFileAccess(rootDir) {
   }
   async function resolve(file) {
     const relative = normalizeRepoPath(file);
-    if (!relative || isSensitiveFile(relative) || gitFiles && !gitFiles.has(relative)) return null;
+    if (!relative || isSensitiveFile(relative) || gitFiles && !gitFiles.has(relative))
+      return null;
     const candidate = path2.join(root, relative);
     try {
       const real = await fs.realpath(candidate);
-      if (!isWithinRoot(canonicalRoot, real) || isSensitiveFile(path2.relative(canonicalRoot, real))) return null;
+      if (!isWithinRoot(canonicalRoot, real) || isSensitiveFile(path2.relative(canonicalRoot, real)))
+        return null;
       const stat = await fs.stat(real);
       if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null;
-      if (gitFiles && !gitFiles.has(path2.relative(canonicalRoot, real).split(path2.sep).join("/"))) return null;
+      if (gitFiles && !gitFiles.has(path2.relative(canonicalRoot, real).split(path2.sep).join("/")))
+        return null;
       return real;
     } catch {
       return null;
@@ -241,7 +342,10 @@ async function createFileAccess(rootDir) {
     if (!relative) return null;
     const real = await resolve(relative);
     if (!real) return null;
-    for (const rel of /* @__PURE__ */ new Set([relative, path2.relative(canonicalRoot, real).split(path2.sep).join("/")])) {
+    for (const rel of /* @__PURE__ */ new Set([
+      relative,
+      path2.relative(canonicalRoot, real).split(path2.sep).join("/")
+    ])) {
       if (!(await fg(fg.escapePath(rel), { cwd: root, ignore, dot: true })).length) return null;
     }
     try {
@@ -251,7 +355,7 @@ async function createFileAccess(rootDir) {
       return null;
     }
   }
-  return { root, config, list, read };
+  return { root, config, list, read, inventory: () => gitFiles ? [...gitFiles].sort() : null };
 }
 
 // src/utils/storage.ts
@@ -293,45 +397,50 @@ async function readStoreJson(root, relative) {
     return parsed;
   } catch (error) {
     if (error.code === "ENOENT") return null;
-    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    throw new Error(
+      `Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error }
+    );
   }
 }
 
 // src/snapshot/snapshot.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 
 // src/utils/store-lock.ts
+import { z } from "zod";
 import fs3 from "fs/promises";
 import os from "os";
+var lockOwnerSchema = z.object({ host: z.string(), pid: z.number().int().positive() });
 
 // src/test-map.ts
 import path4 from "path";
 
 // src/snapshot/snapshot.ts
-var repoPath = z.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
+var repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
 var verificationFields = {
-  refreshedHash: z.string().optional(),
-  verifiedAt: z.string().optional(),
-  verifiedHash: z.string().optional(),
-  verificationToken: z.string().optional(),
-  verificationFailed: z.boolean().optional(),
-  verificationNote: z.string().optional()
+  refreshedHash: z2.string().optional(),
+  verifiedAt: z2.string().optional(),
+  verifiedHash: z2.string().optional(),
+  verificationToken: z2.string().optional(),
+  verificationFailed: z2.boolean().optional(),
+  verificationNote: z2.string().optional()
 };
-var featureSchema = z.object({
-  description: z.string(),
-  files: z.array(repoPath),
-  tests: z.array(repoPath).optional(),
-  type: z.enum(["capability", "infrastructure"]).optional(),
+var featureSchema = z2.object({
+  description: z2.string(),
+  files: z2.array(repoPath),
+  tests: z2.array(repoPath).optional(),
+  type: z2.enum(["capability", "infrastructure"]).optional(),
   ...verificationFields
 }).passthrough();
-var flowSchema = z.object({ description: z.string(), chain: z.array(repoPath), ...verificationFields }).passthrough();
-var snapshotSchema = z.object({
-  version: z.literal(2),
-  createdAt: z.string(),
-  updatedAt: z.string(),
-  gitHash: z.string(),
-  features: z.record(featureSchema),
-  flows: z.record(flowSchema)
+var flowSchema = z2.object({ description: z2.string(), chain: z2.array(repoPath), ...verificationFields }).passthrough();
+var snapshotSchema = z2.object({
+  version: z2.literal(2),
+  createdAt: z2.string(),
+  updatedAt: z2.string(),
+  gitHash: z2.string(),
+  features: z2.record(featureSchema),
+  flows: z2.record(flowSchema)
 }).passthrough();
 async function loadSnapshot(rootDir) {
   const parsed = await readStoreJson(rootDir, ".mason/snapshot.json");
@@ -366,18 +475,25 @@ function parseChanges(output) {
     if (!first) break;
     const second = /^[RC]/.test(code) ? fields[i++] : void 0;
     const change = second ? code.startsWith("R") ? { status: "renamed", path: second, previousPath: first } : { status: "added", path: second } : { status: code === "A" ? "added" : code === "D" ? "deleted" : "modified", path: first };
-    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/"))) continue;
+    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/")))
+      continue;
     changes.push(change);
   }
   return changes;
 }
 function touchedPaths(changes) {
-  return [...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))].sort();
+  return [
+    ...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))
+  ].sort();
 }
 async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
-  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
+  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-"))
+    return null;
   try {
-    const { stdout } = await execGit(["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
+    const { stdout } = await execGit(
+      ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"],
+      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
+    );
     return parseChanges(stdout);
   } catch {
     return null;
@@ -386,11 +502,23 @@ async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
 async function getWorkingTree(resolvedRoot) {
   try {
     const [diff, untracked] = await Promise.all([
-      execGit(["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
-      execGit(["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
+      execGit(["diff", "--name-status", "-z", "-M", "HEAD", "--"], {
+        cwd: resolvedRoot,
+        maxBuffer: 10 * 1024 * 1024
+      }),
+      execGit(["ls-files", "-z", "--others", "--exclude-standard"], {
+        cwd: resolvedRoot,
+        maxBuffer: 10 * 1024 * 1024
+      })
     ]);
     const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
-    return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
+    return {
+      available: true,
+      changedFiles: [
+        .../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])
+      ].sort(),
+      untrackedFiles
+    };
   } catch {
     return { available: false, changedFiles: [], untrackedFiles: [] };
   }
@@ -398,10 +526,9 @@ async function getWorkingTree(resolvedRoot) {
 async function countCommitsBehind(resolvedRoot, fromHash) {
   if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-")) return null;
   try {
-    const { stdout } = await execGit(
-      ["rev-list", "--count", `${fromHash}..HEAD`],
-      { cwd: resolvedRoot }
-    );
+    const { stdout } = await execGit(["rev-list", "--count", `${fromHash}..HEAD`], {
+      cwd: resolvedRoot
+    });
     const count = Number.parseInt(stdout.trim(), 10);
     return Number.isNaN(count) ? null : count;
   } catch {
@@ -434,14 +561,22 @@ async function computeDrift(rootDir) {
   const root = path6.resolve(rootDir);
   const snapshot = await loadSnapshot(root);
   if (!snapshot) return null;
-  const [headHash, workingTree] = await Promise.all([getCurrentGitHash(root), getWorkingTree(root)]);
+  const [headHash, workingTree] = await Promise.all([
+    getCurrentGitHash(root),
+    getWorkingTree(root)
+  ]);
   const hashFor = (entry) => entry.refreshedHash ?? snapshot.gitHash;
   const entries = [...Object.values(snapshot.features), ...Object.values(snapshot.flows)];
   const hashes = /* @__PURE__ */ new Set([snapshot.gitHash, ...entries.map(hashFor)]);
   const changesByHash = /* @__PURE__ */ new Map();
-  await Promise.all([...hashes].map(async (hash) => {
-    changesByHash.set(hash, hash === headHash && headHash !== "unknown" ? [] : await getChangesWithStatus(root, hash));
-  }));
+  await Promise.all(
+    [...hashes].map(async (hash) => {
+      changesByHash.set(
+        hash,
+        hash === headHash && headHash !== "unknown" ? [] : await getChangesWithStatus(root, hash)
+      );
+    })
+  );
   const historyAvailable = headHash !== "unknown" && [...changesByHash.values()].every((changes) => changes !== null);
   const mappedFiles = collectMappedFiles(snapshot);
   const report = {
@@ -467,7 +602,9 @@ async function computeDrift(rootDir) {
       failed: [...Object.entries(snapshot.features), ...Object.entries(snapshot.flows)].filter(([, e]) => e.verificationFailed).map(([name]) => name)
     }
   };
-  const counts = await Promise.all([...hashes].map((hash) => hash === headHash ? 0 : countCommitsBehind(root, hash)));
+  const counts = await Promise.all(
+    [...hashes].map(async (hash) => hash === headHash ? 0 : countCommitsBehind(root, hash))
+  );
   const knownCounts = counts.filter((n) => n !== null);
   report.commitsBehind = knownCounts.length ? Math.max(...knownCounts) : null;
   const check = (name, files, hash, staleEntries, freshness) => {
@@ -478,7 +615,13 @@ async function computeDrift(rootDir) {
     freshness[name] = files.length === 0 || changes === null || changes === void 0 || !workingTree.available ? "unknown" : committedHits.length || localHits.length || files.some((f) => report.ghostFiles.includes(f)) ? "changed" : "current";
   };
   for (const [name, feature] of Object.entries(snapshot.features)) {
-    check(name, [...feature.files, ...feature.tests ?? []], hashFor(feature), report.staleFeatures, report.featureFreshness);
+    check(
+      name,
+      [...feature.files, ...feature.tests ?? []],
+      hashFor(feature),
+      report.staleFeatures,
+      report.featureFreshness
+    );
   }
   for (const [name, flow] of Object.entries(snapshot.flows)) {
     check(name, flow.chain, hashFor(flow), report.staleFlows, report.flowFreshness);
@@ -488,7 +631,10 @@ async function computeDrift(rootDir) {
   const sourceFiles = new Set(await listSourceFiles(root));
   let committedFiles = /* @__PURE__ */ new Set();
   try {
-    const { stdout } = await execGit(["ls-tree", "-r", "--name-only", "-z", "HEAD"], { cwd: root, maxBuffer: 50 * 1024 * 1024 });
+    const { stdout } = await execGit(["ls-tree", "-r", "--name-only", "-z", "HEAD"], {
+      cwd: root,
+      maxBuffer: 50 * 1024 * 1024
+    });
     committedFiles = new Set(stdout.split("\0").filter(Boolean));
   } catch {
     report.historyAvailable = false;
@@ -497,123 +643,322 @@ async function computeDrift(rootDir) {
   report.unmappedFiles = [...sourceFiles].filter((f) => committedFiles.has(f) && !mappedFiles.has(f)).sort();
   const renames = /* @__PURE__ */ new Map();
   for (const change of allChanges) {
-    if (change.status === "renamed" && change.previousPath) renames.set(`${change.previousPath}\0${change.path}`, { from: change.previousPath, to: change.path });
+    if (change.status === "renamed" && change.previousPath)
+      renames.set(`${change.previousPath}\0${change.path}`, {
+        from: change.previousPath,
+        to: change.path
+      });
   }
   report.renames = [...renames.values()];
-  const changedMapped = /* @__PURE__ */ new Set([...Object.values(report.staleFeatures).flat(), ...Object.values(report.staleFlows).flat()]);
+  const changedMapped = /* @__PURE__ */ new Set([
+    ...Object.values(report.staleFeatures).flat(),
+    ...Object.values(report.staleFlows).flat()
+  ]);
   const committedGhosts = report.ghostFiles.filter((f) => !workingTree.changedFiles.includes(f));
   report.stale ||= changedMapped.size > 0 || report.unmappedFiles.length > 0 || committedGhosts.length > 0;
   if (!report.historyAvailable) report.recommendation = "full-rebuild";
   else if (!report.stale) report.recommendation = "up-to-date";
-  else report.recommendation = changedMapped.size >= FULL_REBUILD_MIN_CHANGED_MAPPED_FILES && changedMapped.size / Math.max(1, mappedFiles.size) > FULL_REBUILD_FRACTION ? "full-rebuild" : "incremental";
+  else
+    report.recommendation = changedMapped.size >= FULL_REBUILD_MIN_CHANGED_MAPPED_FILES && changedMapped.size / Math.max(1, mappedFiles.size) > FULL_REBUILD_FRACTION ? "full-rebuild" : "incremental";
   return report;
 }
 
+// src/decisions/anchors.ts
+import { createHash } from "crypto";
+import fs5 from "fs/promises";
+import { constants as constants2 } from "fs";
+import { z as z3 } from "zod";
+import fg3 from "fast-glob";
+
+// src/audit/inspection.ts
+import fg2 from "fast-glob";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import path7 from "path";
+var inspections = new AsyncLocalStorage2();
+function inspectionRead(root, key, read) {
+  const inspection = inspections.getStore();
+  if (!inspection || inspection.root !== path7.resolve(root)) return read();
+  if (!inspection.reads.has(key)) {
+    const pending = read();
+    inspection.reads.set(key, pending);
+    void pending.catch(() => {
+      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
+    });
+  }
+  return inspection.reads.get(key);
+}
+function inspectionGit(args, options) {
+  return inspectionRead(
+    options.cwd,
+    "git:" + JSON.stringify([args, options]),
+    () => execGit(args, options)
+  );
+}
+var sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
+var sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+
+// src/decisions/anchors.ts
+var repoPath2 = z3.string().refine((p) => normalizeRepoPath(p) === p);
+var anchorCaptureSchema = z3.object({
+  anchors: z3.array(repoPath2),
+  files: z3.record(repoPath2, z3.string().regex(/^[a-f0-9]{64}$/)),
+  complete: z3.boolean()
+}).refine(
+  (capture) => JSON.stringify(capture.anchors) === JSON.stringify([...new Set(capture.anchors)].sort()) && matchingPaths(capture.anchors, Object.keys(capture.files)).length === Object.keys(capture.files).length,
+  "Capture paths must belong to its normalized, sorted anchor scope"
+);
+async function captureAnchorScopes(root, scopes) {
+  const union = [...new Set(scopes.flat())].sort();
+  let context;
+  const prepareContext = async () => {
+    const access = await inspectionRead(
+      root,
+      "decision-anchor-access",
+      () => createFileAccess(root)
+    );
+    const inventory = access.inventory();
+    if (!inventory) throw new Error("Git anchor inventory unavailable");
+    const ignored = await inspectionGit(
+      [
+        "ls-files",
+        "-z",
+        "--others",
+        "--ignored",
+        "--exclude-standard",
+        "--",
+        ...union.map((anchor) => `:(literal)${anchor}`)
+      ],
+      { cwd: root, maxBuffer: 8 * 1024 * 1024 }
+    );
+    const files = [
+      .../* @__PURE__ */ new Set([...inventory, ...ignored.stdout.split("\0").filter(Boolean)])
+    ].sort();
+    const patterns = await Promise.all(
+      union.map(async (anchor) => {
+        const literal = fg3.escapePath(anchor);
+        try {
+          return (await fs5.lstat(await storePath(root, anchor))).isDirectory() ? `${literal}/**/*` : literal;
+        } catch {
+          return literal;
+        }
+      })
+    );
+    const eligible = new Set(await access.list(patterns, { dot: true }));
+    const indexed = indexMatchingPaths(scopes, files);
+    const filesByScope = new Map(
+      scopes.map((scope, index) => [JSON.stringify([...new Set(scope)].sort()), indexed[index]])
+    );
+    return { filesByScope, eligible };
+  };
+  return Promise.all(
+    scopes.map((scope) => {
+      const anchors = [...new Set(scope)].sort();
+      return inspectionRead(
+        root,
+        "decision-anchor-capture:" + JSON.stringify(anchors),
+        async () => {
+          const capture = { anchors, files: {}, complete: true };
+          if (!anchors.length) return capture;
+          try {
+            const { eligible, filesByScope } = await (context ??= prepareContext());
+            const files = filesByScope.get(JSON.stringify(anchors));
+            if (files.length > 2e3) return { ...capture, complete: false };
+            for (const file of files) {
+              const evidence = await inspectionRead(
+                root,
+                "decision-anchor-file:" + file,
+                async () => {
+                  try {
+                    const absolute = await storePath(root, file);
+                    await fs5.lstat(absolute);
+                    if (!eligible.has(file)) return { complete: false };
+                    const handle = await fs5.open(
+                      absolute,
+                      constants2.O_RDONLY | constants2.O_NONBLOCK | constants2.O_NOFOLLOW
+                    );
+                    try {
+                      const stat = await handle.stat();
+                      if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES)
+                        return { complete: false };
+                      const bytes = Buffer.alloc(Math.min(stat.size + 1, MAX_SOURCE_BYTES + 1));
+                      let size = 0;
+                      while (size < bytes.length) {
+                        const read = await handle.read(bytes, size, bytes.length - size, null);
+                        if (!read.bytesRead) break;
+                        size += read.bytesRead;
+                      }
+                      if (size === bytes.length) return { complete: false };
+                      return {
+                        complete: true,
+                        hash: createHash("sha256").update(bytes.subarray(0, size)).digest("hex")
+                      };
+                    } finally {
+                      await handle.close();
+                    }
+                  } catch (error) {
+                    return { complete: error.code === "ENOENT" };
+                  }
+                }
+              );
+              if (!evidence.complete) capture.complete = false;
+              if (evidence.hash) capture.files[file] = evidence.hash;
+            }
+          } catch {
+            capture.complete = false;
+          }
+          return capture;
+        }
+      );
+    })
+  );
+}
+function changedCaptureFiles(before, after) {
+  return [.../* @__PURE__ */ new Set([...Object.keys(before.files), ...Object.keys(after.files)])].filter((file) => before.files[file] !== after.files[file]).sort();
+}
+
 // src/decisions/drift.ts
-import path9 from "path";
+import path10 from "path";
 
 // src/decisions/decisions.ts
-import fs5 from "fs/promises";
-import path8 from "path";
-import { createHash } from "crypto";
-import { z as z3 } from "zod";
+import fs6 from "fs/promises";
+import path9 from "path";
+import { createHash as createHash3 } from "crypto";
+import { z as z5 } from "zod";
 
 // src/context/lexical.ts
-import path7 from "path";
+import path8 from "path";
 
 // src/decisions/provenance.ts
-import { z as z2 } from "zod";
-var text = (max) => z2.string().trim().min(1).max(max);
-var decisionSourceSchema = z2.object({
-  kind: z2.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
+import { z as z4 } from "zod";
+import { createHash as createHash2 } from "crypto";
+var text = (max) => z4.string().trim().min(1).max(max);
+var decisionSourceSchema = z4.object({
+  kind: z4.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
   reference: text(1e3),
   note: text(500).optional()
 }).strict();
-var attributionSchema = z2.object({
+var attributionSchema = z4.object({
   owner: text(200).nullable().optional(),
-  sources: z2.array(decisionSourceSchema).max(20).optional(),
+  sources: z4.array(decisionSourceSchema).max(20).optional(),
   actor: text(200).optional()
 });
-var contentSchema = z2.object({
-  title: z2.string().min(1),
-  body: z2.string().min(1),
-  category: z2.enum(["decision", "gotcha", "deprecation", "convention"]),
-  files: z2.array(z2.string().refine((f) => normalizeRepoPath(f) !== null)),
+var contentSchema = z4.object({
+  title: z4.string().min(1),
+  body: z4.string().min(1),
+  category: z4.enum(["decision", "gotcha", "deprecation", "convention"]),
+  files: z4.array(z4.string().refine((f) => normalizeRepoPath(f) !== null)),
   owner: text(200).optional(),
-  sources: z2.array(decisionSourceSchema).max(20)
+  sources: z4.array(decisionSourceSchema).max(20)
 });
-var approvalSchema = z2.enum(["unreviewed", "proposed", "accepted"]);
-var statusSchema = z2.enum(["active", "superseded", "retired"]);
-var reviewEvidenceSchema = z2.object({
-  baseHash: z2.string(),
-  headHash: z2.string(),
-  historyAvailable: z2.boolean(),
-  changedFiles: z2.array(z2.string()),
-  localChanges: z2.array(z2.string())
+var approvalSchema = z4.enum(["unreviewed", "proposed", "accepted"]);
+var statusSchema = z4.enum(["active", "superseded", "retired"]);
+var reviewEvidenceSchema = z4.object({
+  baseHash: z4.string(),
+  headHash: z4.string(),
+  historyAvailable: z4.boolean(),
+  changedFiles: z4.array(z4.string()),
+  localChanges: z4.array(z4.string())
 });
-var eventSchema = z2.object({
-  kind: z2.enum(["imported", "created", "revised", "accepted", "reaffirmed", "retired", "superseded"]),
-  at: z2.string().datetime(),
+var eventSchema = z4.object({
+  kind: z4.enum([
+    "imported",
+    "created",
+    "revised",
+    "accepted",
+    "reaffirmed",
+    "retired",
+    "superseded"
+  ]),
+  at: z4.string().datetime(),
   actor: text(200).optional(),
   note: text(1500).optional(),
-  revision: z2.number().int().positive(),
+  revision: z4.number().int().positive(),
   content: contentSchema,
   approval: approvalSchema,
   status: statusSchema,
-  refreshedHash: z2.string(),
-  evidence: reviewEvidenceSchema.optional()
+  refreshedHash: z4.string(),
+  evidence: reviewEvidenceSchema.optional(),
+  capture: anchorCaptureSchema.optional()
 });
-var legacySchema = z2.object({
-  version: z2.literal(1),
-  id: z2.string().regex(/^[a-zA-Z0-9_-]+$/),
-  title: z2.string().min(1),
-  body: z2.string().min(1),
+var legacySchema = z4.object({
+  version: z4.literal(1),
+  id: z4.string().regex(/^[a-zA-Z0-9_-]+$/),
+  title: z4.string().min(1),
+  body: z4.string().min(1),
   category: contentSchema.shape.category,
   files: contentSchema.shape.files,
-  createdAt: z2.string(),
-  updatedAt: z2.string(),
-  refreshedHash: z2.string(),
-  status: z2.enum(["active", "superseded"]),
-  supersededBy: z2.string().optional()
+  createdAt: z4.string(),
+  updatedAt: z4.string(),
+  refreshedHash: z4.string(),
+  status: z4.enum(["active", "superseded"]),
+  supersededBy: z4.string().optional()
 }).passthrough();
 var currentSchema = legacySchema.extend({
-  version: z2.literal(2),
+  version: z4.literal(2),
   status: statusSchema,
   approval: approvalSchema,
-  revision: z2.number().int().positive(),
+  revision: z4.number().int().positive(),
   owner: text(200).optional(),
-  sources: z2.array(decisionSourceSchema).max(20),
-  history: z2.array(eventSchema).min(1)
+  sources: z4.array(decisionSourceSchema).max(20),
+  history: z4.array(eventSchema).min(1),
+  capture: anchorCaptureSchema.optional(),
+  inspections: z4.array(
+    z4.object({
+      at: z4.string().datetime(),
+      inspector: text(200),
+      note: text(1500),
+      outcome: z4.literal("no_contradiction_found"),
+      decisionDigest: z4.string().regex(/^[a-f0-9]{64}$/),
+      headHash: z4.string(),
+      capture: anchorCaptureSchema
+    })
+  ).max(200).optional()
 }).superRefine((record, ctx) => {
   const invalid = (message) => ctx.addIssue({ code: "custom", message });
   const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
   let previous;
   for (const event of record.history) {
     if (!previous) {
-      if (!["created", "imported"].includes(event.kind) || event.revision !== 1) invalid("History must begin with creation or legacy import at revision 1");
-      if (event.approval !== (event.kind === "created" ? "proposed" : "unreviewed")) invalid("Initial records cannot claim acceptance");
+      if (!["created", "imported"].includes(event.kind) || event.revision !== 1)
+        invalid("History must begin with creation or legacy import at revision 1");
+      if (event.approval !== (event.kind === "created" ? "proposed" : "unreviewed"))
+        invalid("Initial records cannot claim acceptance");
     } else {
       if (["created", "imported"].includes(event.kind)) invalid("History cannot restart");
       if (previous.status !== "active") invalid("Archived decisions cannot be changed");
-      if (event.revision !== previous.revision + (event.kind === "revised" ? 1 : 0)) invalid("Invalid revision sequence");
-      if (event.kind !== "revised" && !same(event.content, previous.content)) invalid("A review cannot silently revise decision content");
-      if (event.kind === "reaffirmed" && previous.approval !== "accepted") invalid("Only accepted decisions can be reaffirmed");
-      if (event.kind === "accepted" && previous.approval === "accepted") invalid("Use reaffirmation for an accepted decision");
+      if (event.revision !== previous.revision + (event.kind === "revised" ? 1 : 0))
+        invalid("Invalid revision sequence");
+      if (event.kind !== "revised" && !same(event.content, previous.content))
+        invalid("A review cannot silently revise decision content");
+      if (event.kind === "reaffirmed" && previous.approval !== "accepted")
+        invalid("Only accepted decisions can be reaffirmed");
+      if (event.kind === "accepted" && previous.approval === "accepted")
+        invalid("Use reaffirmation for an accepted decision");
       const approval = event.kind === "revised" ? "proposed" : ["accepted", "reaffirmed"].includes(event.kind) ? "accepted" : previous.approval;
       if (event.approval !== approval) invalid("Approval disagrees with review history");
-      if (!["accepted", "reaffirmed"].includes(event.kind) && event.refreshedHash !== previous.refreshedHash) invalid("Only a review can refresh the evidence baseline");
+      if (!["accepted", "reaffirmed"].includes(event.kind) && event.refreshedHash !== previous.refreshedHash)
+        invalid("Only a review can refresh the evidence baseline");
     }
-    if (event.kind !== "imported" && event.status !== (event.kind === "retired" ? "retired" : event.kind === "superseded" ? "superseded" : "active")) invalid("Lifecycle disagrees with history");
-    if (["accepted", "reaffirmed", "retired"].includes(event.kind) && (!event.actor || !event.note || !event.evidence)) invalid("Reviews require a named reviewer, reason, and code evidence");
+    if (event.kind !== "imported" && event.status !== (event.kind === "retired" ? "retired" : event.kind === "superseded" ? "superseded" : "active"))
+      invalid("Lifecycle disagrees with history");
+    if (["accepted", "reaffirmed", "retired"].includes(event.kind) && (!event.actor || !event.note || !event.evidence))
+      invalid("Reviews require a named reviewer, reason, and code evidence");
     if (["accepted", "reaffirmed"].includes(event.kind)) {
-      if (!event.content.owner || !event.content.sources.length) invalid("Accepted decisions require an owner and source");
-      if (!event.evidence || !/^[a-f0-9]{40,64}$/.test(event.evidence.headHash) || event.refreshedHash !== event.evidence.headHash || event.evidence.localChanges.length) invalid("Acceptance requires a committed evidence baseline");
+      if (!event.content.owner || !event.content.sources.length)
+        invalid("Accepted decisions require an owner and source");
+      if (!event.evidence || !/^[a-f0-9]{40,64}$/.test(event.evidence.headHash) || event.refreshedHash !== event.evidence.headHash || event.evidence.localChanges.length)
+        invalid("Acceptance requires a committed evidence baseline");
     }
+    if (event.capture && !same([...event.content.files].sort(), event.capture.anchors))
+      invalid("Capture scope disagrees with decision anchors");
     previous = event;
   }
-  if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash) invalid("Decision does not match the final history event");
+  if (previous && !same(previous.capture, record.capture))
+    invalid("Capture does not match the final history event");
+  if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash)
+    invalid("Decision does not match the final history event");
 });
-var decisionSchema = z2.union([legacySchema, currentSchema]);
+var decisionSchema = z4.union([legacySchema, currentSchema]);
 function decisionContent(record) {
   return {
     title: record.title,
@@ -624,8 +969,12 @@ function decisionContent(record) {
     sources: Array.isArray(record.sources) ? record.sources : []
   };
 }
+function decisionApproval(record) {
+  return record.version === 1 ? "unreviewed" : record.approval;
+}
 function effectiveDecision(record) {
-  if (record.version !== 2 || record.status !== "active" || record.approval !== "proposed") return record;
+  if (record.version !== 2 || record.status !== "active" || record.approval !== "proposed")
+    return record;
   let index = record.history.length - 1;
   while (index >= 0 && !["accepted", "reaffirmed"].includes(record.history[index].kind)) index--;
   if (index < 0) return record;
@@ -637,57 +986,147 @@ function effectiveDecision(record) {
     approval: "accepted",
     revision: event.revision,
     refreshedHash: event.refreshedHash,
+    capture: event.capture,
     updatedAt: event.at,
     history: record.history.slice(0, index + 1)
   };
 }
+function decisionInspectionDigest(record) {
+  const effective = effectiveDecision(record);
+  return createHash2("sha256").update(
+    JSON.stringify([
+      record.status,
+      decisionApproval(record),
+      record.version === 2 ? record.revision : 0,
+      decisionContent(record),
+      decisionContent(effective),
+      effective.refreshedHash
+    ])
+  ).digest("hex");
+}
+function latestDecisionInspection(record) {
+  return record.version === 2 ? record.inspections?.filter((i) => i.decisionDigest === decisionInspectionDigest(record)).at(-1) : void 0;
+}
 
 // src/decisions/decisions.ts
 var TITLE_MAX_CHARS = 80;
 var BODY_RECOMMENDED_CHARS = 1500;
 var BODY_MAX_CHARS = 2500;
-var boundedText = (field, max, hint) => z3.string({
-  errorMap: (issue, ctx) => ({ message: issue.code === "too_big" ? `${field} has ${ctx.data.length} characters; maximum is ${max} (${ctx.data.length - max} over). ${hint}` : ctx.defaultError })
+var boundedText = (field, max, hint) => z5.string({
+  errorMap: (issue, ctx) => ({
+    message: issue.code === "too_big" && typeof ctx.data === "string" ? `${field} has ${ctx.data.length} characters; maximum is ${max} (${ctx.data.length - max} over). ${hint}` : ctx.defaultError
+  })
 }).trim().min(1, `${field} must be non-empty`).max(max);
-var decisionTitleSchema = boundedText("title", TITLE_MAX_CHARS, "Tighten it to a specific headline.");
+var decisionTitleSchema = boundedText(
+  "title",
+  TITLE_MAX_CHARS,
+  "Tighten it to a specific headline."
+);
 var decisionBodySchema = boundedText(
   "body",
   BODY_MAX_CHARS,
   `Aim for ${BODY_RECOMMENDED_CHARS} characters or fewer. Preserve the rule, reason, and exceptions; put supporting references in sources.`
 );
+async function readDecisionInputs(rootDir) {
+  return structuredClone(
+    await inspectionRead(rootDir, "decision-store:inputs", async () => {
+      const inputs = [];
+      const diagnostics = [];
+      let entries;
+      try {
+        entries = await fs6.readdir(await storePath(rootDir, ".mason/decisions"));
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          diagnostics.push({ path: ".mason/decisions", message: String(error) });
+        return { inputs, diagnostics };
+      }
+      for (const entry of entries.sort()) {
+        if (!entry.endsWith(".json")) continue;
+        const relative = `.mason/decisions/${entry}`;
+        try {
+          const raw = await readBoundedFile(await storePath(rootDir, relative), 10 * 1024 * 1024);
+          if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
+          inputs.push([relative, raw]);
+        } catch (error) {
+          if (error.code === "ENOENT") inputs.push([relative, null]);
+          else
+            diagnostics.push({
+              path: relative,
+              message: error instanceof Error ? error.message : String(error)
+            });
+        }
+      }
+      return { inputs, diagnostics };
+    })
+  );
+}
 async function loadDecisionStore(rootDir) {
-  const records = [];
-  const diagnostics = [];
-  let entries;
-  try {
-    entries = await fs5.readdir(await storePath(rootDir, ".mason/decisions"));
-  } catch (error) {
-    if (error.code !== "ENOENT") diagnostics.push({ path: ".mason/decisions", message: String(error) });
-    return { records, diagnostics };
-  }
-  for (const entry of entries.sort()) {
-    if (!entry.endsWith(".json")) continue;
-    const relative = `.mason/decisions/${entry}`;
-    try {
-      const record = decisionSchema.parse(await readStoreJson(rootDir, relative));
-      if (entry !== `${record.id}.json`) throw new Error("Record id does not match its filename");
-      records.push(record);
-    } catch (error) {
-      diagnostics.push({ path: relative, message: error instanceof Error ? error.message : String(error) });
-    }
-  }
-  return { records, diagnostics };
+  return structuredClone(
+    await inspectionRead(rootDir, "decision-store:parsed", async () => {
+      const raw = await readDecisionInputs(rootDir);
+      const records = [];
+      const diagnostics = [...raw.diagnostics];
+      for (const [relative, content] of raw.inputs) {
+        try {
+          const record = decisionSchema.parse(content === null ? null : JSON.parse(content));
+          if (relative !== `.mason/decisions/${record.id}.json`)
+            throw new Error("Record id does not match its filename");
+          records.push(record);
+        } catch (error) {
+          diagnostics.push({
+            path: relative,
+            message: error instanceof Error ? error.message : String(error)
+          });
+        }
+      }
+      return { records, diagnostics };
+    })
+  );
 }
 
 // src/decisions/drift.ts
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path9.resolve(rootDir);
+  const resolvedRoot = path10.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
-  const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
-  const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
+  const report = {
+    historyAvailable: true,
+    totalDecisions: store.records.length,
+    staleDecisions: {},
+    freshness: {},
+    diagnostics: store.diagnostics
+  };
+  const [head, workingTree] = await Promise.all([
+    getCurrentGitHash(resolvedRoot),
+    getWorkingTree(resolvedRoot)
+  ]);
   const changesByHash = /* @__PURE__ */ new Map();
-  const inspect = async (record) => {
+  const baselines = store.records.filter((record) => record.status === "active").flatMap((record) => {
+    const inspection = latestDecisionInspection(record);
+    if (inspection) return [inspection.capture];
+    return [.../* @__PURE__ */ new Set([effectiveDecision(record), record])].flatMap(
+      (candidate) => candidate.version === 2 && candidate.capture ? [candidate.capture] : []
+    );
+  });
+  const captures = await captureAnchorScopes(
+    resolvedRoot,
+    baselines.map((baseline) => baseline.anchors)
+  );
+  const currentCaptures = new Map(
+    baselines.map((baseline, index) => [JSON.stringify(baseline.anchors), captures[index]])
+  );
+  const inspect = async (record, inspectionCapture) => {
     if (record.files.length === 0) return { freshness: "unknown", changedFiles: [] };
+    const baseline = inspectionCapture ?? (record.version === 2 ? record.capture : void 0);
+    if (baseline) {
+      const current = currentCaptures.get(JSON.stringify(baseline.anchors));
+      const hits2 = changedCaptureFiles(baseline, current).filter(
+        (file) => matchingPaths(record.files, [file]).length
+      );
+      return {
+        freshness: !baseline.complete || !current.complete ? "unknown" : hits2.length ? "changed" : "current",
+        changedFiles: hits2
+      };
+    }
     let touched = changesByHash.get(record.refreshedHash);
     if (touched === void 0) {
       const changes = record.refreshedHash === head && head !== "unknown" ? [] : await getChangesWithStatus(resolvedRoot, record.refreshedHash);
@@ -697,15 +1136,20 @@ async function computeDecisionDrift(rootDir, decisions) {
     if (touched === null) report.historyAvailable = false;
     const hits = touched ? matchingPaths(record.files, touched) : [];
     const localHits = matchingPaths(record.files, workingTree.changedFiles);
-    return { freshness: touched === null || !workingTree.available ? "unknown" : hits.length || localHits.length ? "changed" : "current", changedFiles: hits };
+    return {
+      freshness: touched === null || !workingTree.available ? "unknown" : hits.length || localHits.length ? "changed" : "current",
+      changedFiles: [.../* @__PURE__ */ new Set([...hits, ...localHits])].sort()
+    };
   };
   for (const record of store.records) {
     if (record.status !== "active") continue;
     const effective = effectiveDecision(record);
-    const state = await inspect(effective);
+    const inspection = latestDecisionInspection(record);
+    const state = await inspect(effective, inspection?.capture);
     report.freshness[record.id] = state.freshness;
     if (state.changedFiles.length) report.staleDecisions[record.id] = state.changedFiles;
-    if (effective !== record) (report.pendingProposals ??= {})[record.id] = await inspect(record);
+    if (effective !== record)
+      (report.pendingProposals ??= {})[record.id] = await inspect(record, inspection?.capture);
   }
   return report;
 }
@@ -758,9 +1202,17 @@ function parseArgs(argv) {
 }
 function formatDriftSummary(report) {
   if (!report.stale) {
-    const lines2 = [`Concept map is up to date against committed source (HEAD ${report.headHash.slice(0, 7)}).`];
-    if (report.workingTree?.changedFiles.length) lines2.push(`Working tree has ${report.workingTree.changedFiles.length} changed files; live context checks report these separately.`);
-    if (report.verification?.failed.length) lines2.push(`Verification FAILED: ${report.verification.failed.join(", ")}. Correct these entries before relying on them.`);
+    const lines2 = [
+      `Concept map is up to date against committed source (HEAD ${report.headHash.slice(0, 7)}).`
+    ];
+    if (report.workingTree?.changedFiles.length)
+      lines2.push(
+        `Working tree has ${report.workingTree.changedFiles.length} changed files; live context checks report these separately.`
+      );
+    if (report.verification?.failed.length)
+      lines2.push(
+        `Verification FAILED: ${report.verification.failed.join(", ")}. Correct these entries before relying on them.`
+      );
     return lines2.join("\n");
   }
   const lines = [];
@@ -779,9 +1231,7 @@ function formatDriftSummary(report) {
     );
   }
   if (staleFlows.length > 0) {
-    lines.push(
-      `Stale flows (${staleFlows.length}/${report.totalFlows}): ${staleFlows.join(", ")}`
-    );
+    lines.push(`Stale flows (${staleFlows.length}/${report.totalFlows}): ${staleFlows.join(", ")}`);
   }
   if (report.unmappedFiles.length > 0) {
     lines.push(
@@ -840,11 +1290,12 @@ function formatRefreshPrompt(report, decisionDrift) {
     );
   }
   const changedProposals = Object.entries(decisionDrift.pendingProposals ?? {}).filter(([, state]) => state.freshness !== "current").map(([id]) => id);
-  if (changedProposals.length) lines.push(`NOTE: pending proposals [${changedProposals.join(", ")}] need source review. Their accepted revisions remain operative. Do NOT modify or accept these proposals during automated map refresh.`);
+  if (changedProposals.length)
+    lines.push(
+      `NOTE: pending proposals [${changedProposals.join(", ")}] need source review. Their accepted revisions remain operative. Do NOT modify or accept these proposals during automated map refresh.`
+    );
   lines.push("");
-  lines.push(
-    "Finish by confirming the map was saved and summarizing which entries changed."
-  );
+  lines.push("Finish by confirming the map was saved and summarizing which entries changed.");
   return lines.join("\n");
 }
 async function runDriftCli(argv, io = {
@@ -868,7 +1319,7 @@ async function runDriftCli(argv, io = {
     io.out(USAGE);
     return 0;
   }
-  const rootDir = path10.resolve(args.dir);
+  const rootDir = path11.resolve(args.dir);
   let report;
   try {
     report = await computeDrift(rootDir);
@@ -878,7 +1329,7 @@ async function runDriftCli(argv, io = {
   }
   if (!report) {
     io.err(
-      `No Mason snapshot found at ${path10.join(rootDir, ".mason", "snapshot.json")}. Build one via the Mason MCP server first.`
+      `No Mason snapshot found at ${path11.join(rootDir, ".mason", "snapshot.json")}. Build one via the Mason MCP server first.`
     );
     return 2;
   }
@@ -890,9 +1341,7 @@ async function runDriftCli(argv, io = {
   }
   const decisionDrift = await computeDecisionDrift(rootDir);
   if (args.refreshPrompt) {
-    io.out(
-      report.stale ? formatRefreshPrompt(report, decisionDrift) : formatDriftSummary(report)
-    );
+    io.out(report.stale ? formatRefreshPrompt(report, decisionDrift) : formatDriftSummary(report));
     return report.stale ? 1 : 0;
   }
   if (args.json) {
@@ -903,9 +1352,13 @@ async function runDriftCli(argv, io = {
     io.out(JSON.stringify(output, null, 2));
   } else {
     const lines = [formatDriftSummary(report)];
-    for (const diagnostic of decisionDrift.diagnostics ?? []) lines.push(`Invalid decision record ${diagnostic.path}: ${diagnostic.message}`);
+    for (const diagnostic of decisionDrift.diagnostics ?? [])
+      lines.push(`Invalid decision record ${diagnostic.path}: ${diagnostic.message}`);
     const unknownIds = Object.entries(decisionDrift.freshness ?? {}).filter(([, state]) => state === "unknown").map(([id]) => id);
-    if (unknownIds.length) lines.push(`Decision freshness unknown: ${unknownIds.join(", ")}. Verify before relying on them.`);
+    if (unknownIds.length)
+      lines.push(
+        `Decision freshness unknown: ${unknownIds.join(", ")}. Verify before relying on them.`
+      );
     const staleIds = Object.keys(decisionDrift.staleDecisions);
     if (staleIds.length > 0) {
       lines.push(
@@ -913,7 +1366,9 @@ async function runDriftCli(argv, io = {
       );
     }
     for (const [id, proposal] of Object.entries(decisionDrift.pendingProposals ?? {})) {
-      lines.push(`Pending proposal ${id}: freshness ${proposal.freshness}; the accepted revision remains operative.`);
+      lines.push(
+        `Pending proposal ${id}: freshness ${proposal.freshness}; the accepted revision remains operative.`
+      );
     }
     io.out(lines.join("\n"));
   }