mason-context 0.20.2 → 0.21.0

package/dist/mason-hook.js

@@ -1,40 +1,56 @@
 #!/usr/bin/env node
 if (!import.meta.url.endsWith("/mason-runtime.js")) await import("./mason-runtime.js").then(m => m.registerRuntime());
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 
-// src/hook/hook.ts
-import fs6 from "fs/promises";
-import path10 from "path";
-import os2 from "os";
-
-// src/decisions/decisions.ts
-import fs4 from "fs/promises";
-import path7 from "path";
-import { createHash } from "crypto";
-import { z as z3 } from "zod";
+// src/audit/types.ts
+var types_exports = {};
+__export(types_exports, {
+  ALL_CHECKS: () => ALL_CHECKS
+});
+var ALL_CHECKS;
+var init_types = __esm({
+  "src/audit/types.ts"() {
+    "use strict";
+    ALL_CHECKS = [
+      "deleted-reference",
+      "new-module",
+      "stale-count",
+      "dead-command",
+      "deps-changed",
+      "decision-anchor-drift"
+    ];
+  }
+});
 
-// src/utils/storage.ts
-import fs2 from "fs/promises";
-import path3 from "path";
-import { randomUUID } from "crypto";
+// src/hook/hook.ts
+import { z as z6 } from "zod";
 
-// src/utils/paths.ts
-import path from "path";
-function normalizeRepoPath(value) {
-  const slash = value.replace(/\\/g, "/");
-  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash)) return null;
-  if (slash.split("/").includes("..")) return null;
-  const normalized = path.posix.normalize(slash).replace(/\/$/, "");
-  return normalized === "." ? null : normalized;
-}
-function anchorMatches(anchor, file) {
-  const a = normalizeRepoPath(anchor);
-  const f = normalizeRepoPath(file);
-  return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
+// src/utils/validation.ts
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function matchingPaths(anchors, files) {
-  return [...new Set(files)].filter((file) => anchors.some((anchor) => anchorMatches(anchor, file)));
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
 }
 
+// src/hook/hook.ts
+import fs7 from "fs/promises";
+import path11 from "path";
+import os2 from "os";
+
+// src/audit/inspection.ts
+import fg2 from "fast-glob";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import path3 from "path";
+
 // src/utils/git-read.ts
 import { execFile } from "child_process";
 import { promisify } from "util";
@@ -57,7 +73,19 @@ async function profilePhase(label, run) {
 
 // src/utils/git-read.ts
 var execute = promisify(execFile);
-var commands = /* @__PURE__ */ new Set(["rev-parse", "symbolic-ref", "for-each-ref", "ls-files", "check-ignore", "status", "log", "diff", "ls-tree", "show", "merge-base"]);
+var commands = /* @__PURE__ */ new Set([
+  "rev-parse",
+  "symbolic-ref",
+  "for-each-ref",
+  "ls-files",
+  "check-ignore",
+  "status",
+  "log",
+  "diff",
+  "ls-tree",
+  "show",
+  "merge-base"
+]);
 function execGit(args, options) {
   const command = args.find((arg) => !arg.startsWith("-")) ?? "other";
   return profilePhase("git." + (commands.has(command) ? command : "other"), async () => {
@@ -77,11 +105,127 @@ import fs from "fs/promises";
 import { constants } from "fs";
 import path2 from "path";
 import fg from "fast-glob";
-var SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
+
+// src/utils/paths.ts
+import path from "path";
+function normalizeRepoPath(value) {
+  const slash = value.replace(/\\/g, "/");
+  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash))
+    return null;
+  if (slash.split("/").includes("..")) return null;
+  const normalized = path.posix.normalize(slash).replace(/\/$/, "");
+  return normalized === "." ? null : normalized;
+}
+function isWithinRoot(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function anchorMatches(anchor, file) {
+  const a = normalizeRepoPath(anchor);
+  const f = normalizeRepoPath(file);
+  return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
+}
+function matchingPaths(anchors, files) {
+  return [...new Set(files)].filter(
+    (file) => anchors.some((anchor) => anchorMatches(anchor, file))
+  );
+}
+function indexMatchingPaths(scopes, files) {
+  const node = () => ({ children: /* @__PURE__ */ new Map(), scopes: /* @__PURE__ */ new Set() });
+  const root = node();
+  const matches = scopes.map(() => []);
+  scopes.forEach((anchors, index) => {
+    for (const anchor of anchors) {
+      const normalized = normalizeRepoPath(anchor);
+      if (!normalized) continue;
+      let current = root;
+      for (const part of normalized.split("/")) {
+        if (!current.children.has(part)) current.children.set(part, node());
+        current = current.children.get(part);
+      }
+      current.scopes.add(index);
+    }
+  });
+  for (const file of new Set(files)) {
+    const normalized = normalizeRepoPath(file);
+    if (!normalized) continue;
+    const selected = /* @__PURE__ */ new Set();
+    let current = root;
+    for (const part of normalized.split("/")) {
+      current = current.children.get(part);
+      if (!current) break;
+      for (const index of current.scopes) selected.add(index);
+    }
+    for (const index of selected) matches[index].push(file);
+  }
+  return matches;
+}
+
+// src/utils/files.ts
+var SOURCE_EXTENSIONS = [
+  "ts",
+  "tsx",
+  "js",
+  "jsx",
+  "mts",
+  "cts",
+  "mjs",
+  "cjs",
+  "vue",
+  "svelte",
+  "kt",
+  "kts",
+  "java",
+  "py",
+  "go",
+  "rs",
+  "swift",
+  "rb",
+  "cs",
+  "cpp",
+  "c",
+  "h",
+  "hpp",
+  "dart",
+  "php"
+];
 var SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
+var SOURCE_IGNORE = [
+  "**/node_modules/**",
+  "**/dist/**",
+  "**/build/**",
+  "**/.gradle/**",
+  "**/target/**",
+  "**/.git/**",
+  "**/.mason/**",
+  "**/vendor/**",
+  "**/__pycache__/**",
+  "**/venv/**",
+  "**/.venv/**",
+  "**/*.min.*",
+  "**/*.map",
+  "**/*.lock",
+  "**/generated/**",
+  "**/*.generated.*",
+  "**/R.java",
+  "**/BuildConfig.java",
+  "**/package-lock.json",
+  "**/yarn.lock",
+  "**/pnpm-lock.yaml"
+];
 var MAX_SOURCE_BYTES = 1024 * 1024;
+function isSensitiveFile(file) {
+  return file.split(/[\\/]/).some(
+    (part) => /^(?:\.env(?:\..*)?|id_rsa.*|id_ed25519.*)$|\.(?:pem|key|p12|pfx|jks|keystore)$|credentials\.|secret|^local\.properties$/i.test(
+      part
+    )
+  );
+}
 async function readBoundedFile(file, maxBytes) {
-  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  const handle = await fs.open(
+    file,
+    constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW
+  );
   try {
     const stat = await handle.stat();
     if (!stat.isFile() || stat.size > maxBytes) return null;
@@ -97,15 +241,168 @@ async function readBoundedFile(file, maxBytes) {
     await handle.close();
   }
 }
+async function loadProjectConfig(root) {
+  try {
+    const canonicalRoot = await fs.realpath(root);
+    const configPath = await fs.realpath(path2.join(root, ".mason/config.json"));
+    if (!isWithinRoot(canonicalRoot, configPath))
+      throw new Error("Project configuration resolves outside the repository");
+    const raw = await readBoundedFile(configPath, 64 * 1024);
+    if (raw === null)
+      throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
+    const value = JSON.parse(raw);
+    if (!isRecord(value)) throw new Error("Expected a configuration object");
+    const config = {};
+    for (const key of ["patterns", "alwaysInclude", "ignore"]) {
+      if (value[key] === void 0) continue;
+      if (!isStringArray(value[key])) {
+        throw new Error(`Configuration ${key} must be an array of strings`);
+      }
+      config[key] = value[key];
+    }
+    if (value.audit !== void 0) {
+      const audit = value.audit;
+      if (!isRecord(audit)) throw new Error("Configuration audit must be an object");
+      const patterns = (raw2) => {
+        if (!isStringArray(raw2) || raw2.length > 100 || !raw2.every(
+          (s) => typeof s === "string" && normalizeRepoPath(s) === s && !s.startsWith("!") && !/[\x00-\x1f]/.test(s)
+        )) {
+          throw new Error(
+            "Audit patterns must be at most 100 repository-relative globs without traversal or negation"
+          );
+        }
+        return raw2;
+      };
+      config.audit = {};
+      if (audit.include !== void 0) config.audit.include = patterns(audit.include);
+      if (audit.exclude !== void 0) {
+        if (!isRecord(audit.exclude))
+          throw new Error("audit.exclude must map check names to patterns");
+        const { ALL_CHECKS: ALL_CHECKS2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+        config.audit.exclude = {};
+        for (const [check, globs] of Object.entries(audit.exclude)) {
+          if (!ALL_CHECKS2.includes(check))
+            throw new Error("Unknown audit check: " + check);
+          config.audit.exclude[check] = patterns(globs);
+        }
+      }
+    }
+    return config;
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw new Error(
+      `Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error }
+    );
+  }
+}
+async function createFileAccess(rootDir) {
+  const root = path2.resolve(rootDir);
+  const canonicalRoot = await fs.realpath(root).catch(() => root);
+  const config = await loadProjectConfig(root);
+  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
+  let gitFiles = null;
+  try {
+    const { stdout } = await execGit(
+      ["ls-files", "-z", "--cached", "--others", "--exclude-standard"],
+      { cwd: root, maxBuffer: 50 * 1024 * 1024 }
+    );
+    gitFiles = new Set(stdout.split("\0").filter(Boolean));
+  } catch {
+    let inGit = false;
+    try {
+      await execGit(["rev-parse", "--git-dir"], { cwd: root });
+      inGit = true;
+    } catch {
+    }
+    if (inGit) throw new Error("Cannot enumerate Git files safely");
+  }
+  async function resolve(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative || isSensitiveFile(relative) || gitFiles && !gitFiles.has(relative))
+      return null;
+    const candidate = path2.join(root, relative);
+    try {
+      const real = await fs.realpath(candidate);
+      if (!isWithinRoot(canonicalRoot, real) || isSensitiveFile(path2.relative(canonicalRoot, real)))
+        return null;
+      const stat = await fs.stat(real);
+      if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null;
+      if (gitFiles && !gitFiles.has(path2.relative(canonicalRoot, real).split(path2.sep).join("/")))
+        return null;
+      return real;
+    } catch {
+      return null;
+    }
+  }
+  async function list(patterns = SOURCE_GLOB, options = {}) {
+    const found = await fg(patterns, { cwd: root, ignore, followSymbolicLinks: false, ...options });
+    const safe = await Promise.all(found.map(async (f) => await resolve(f) ? f : null));
+    return safe.filter((f) => f !== null).sort();
+  }
+  async function read(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative) return null;
+    const real = await resolve(relative);
+    if (!real) return null;
+    for (const rel of /* @__PURE__ */ new Set([
+      relative,
+      path2.relative(canonicalRoot, real).split(path2.sep).join("/")
+    ])) {
+      if (!(await fg(fg.escapePath(rel), { cwd: root, ignore, dot: true })).length) return null;
+    }
+    try {
+      const content = await readBoundedFile(real, MAX_SOURCE_BYTES);
+      return content === null ? null : { path: relative, content, totalLines: content.split("\n").length };
+    } catch {
+      return null;
+    }
+  }
+  return { root, config, list, read, inventory: () => gitFiles ? [...gitFiles].sort() : null };
+}
+
+// src/audit/inspection.ts
+var inspections = new AsyncLocalStorage2();
+function inspectionRead(root, key, read) {
+  const inspection = inspections.getStore();
+  if (!inspection || inspection.root !== path3.resolve(root)) return read();
+  if (!inspection.reads.has(key)) {
+    const pending = read();
+    inspection.reads.set(key, pending);
+    void pending.catch(() => {
+      if (inspection.reads.get(key) === pending) inspection.reads.delete(key);
+    });
+  }
+  return inspection.reads.get(key);
+}
+function inspectionGit(args, options) {
+  return inspectionRead(
+    options.cwd,
+    "git:" + JSON.stringify([args, options]),
+    () => execGit(args, options)
+  );
+}
+var sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
+var sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
+
+// src/decisions/anchors.ts
+import { createHash } from "crypto";
+import fs3 from "fs/promises";
+import { constants as constants2 } from "fs";
+import { z } from "zod";
+import fg3 from "fast-glob";
 
 // src/utils/storage.ts
+import fs2 from "fs/promises";
+import path4 from "path";
+import { randomUUID } from "crypto";
 async function storePath(root, relative, createParents = false) {
   const normalized = normalizeRepoPath(relative);
   if (!normalized) throw new Error(`Invalid store path: ${relative}`);
   let current = await fs2.realpath(root);
   const parts = normalized.split("/");
   for (let i = 0; i < parts.length; i++) {
-    current = path3.join(current, parts[i]);
+    current = path4.join(current, parts[i]);
     let stat;
     try {
       stat = await fs2.lstat(current);
@@ -124,56 +421,170 @@ async function storePath(root, relative, createParents = false) {
   }
   return current;
 }
-async function readStoreJson(root, relative) {
-  try {
-    const file = await storePath(root, relative);
-    const raw = await readBoundedFile(file, 10 * 1024 * 1024);
-    if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
-    const parsed = JSON.parse(raw);
-    if (parsed === null) throw new Error("expected a JSON object, received null");
-    return parsed;
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
-  }
+
+// src/decisions/anchors.ts
+var repoPath = z.string().refine((p) => normalizeRepoPath(p) === p);
+var anchorCaptureSchema = z.object({
+  anchors: z.array(repoPath),
+  files: z.record(repoPath, z.string().regex(/^[a-f0-9]{64}$/)),
+  complete: z.boolean()
+}).refine(
+  (capture) => JSON.stringify(capture.anchors) === JSON.stringify([...new Set(capture.anchors)].sort()) && matchingPaths(capture.anchors, Object.keys(capture.files)).length === Object.keys(capture.files).length,
+  "Capture paths must belong to its normalized, sorted anchor scope"
+);
+async function captureAnchorScopes(root, scopes) {
+  const union = [...new Set(scopes.flat())].sort();
+  let context;
+  const prepareContext = async () => {
+    const access = await inspectionRead(
+      root,
+      "decision-anchor-access",
+      () => createFileAccess(root)
+    );
+    const inventory = access.inventory();
+    if (!inventory) throw new Error("Git anchor inventory unavailable");
+    const ignored = await inspectionGit(
+      [
+        "ls-files",
+        "-z",
+        "--others",
+        "--ignored",
+        "--exclude-standard",
+        "--",
+        ...union.map((anchor) => `:(literal)${anchor}`)
+      ],
+      { cwd: root, maxBuffer: 8 * 1024 * 1024 }
+    );
+    const files = [
+      .../* @__PURE__ */ new Set([...inventory, ...ignored.stdout.split("\0").filter(Boolean)])
+    ].sort();
+    const patterns = await Promise.all(
+      union.map(async (anchor) => {
+        const literal = fg3.escapePath(anchor);
+        try {
+          return (await fs3.lstat(await storePath(root, anchor))).isDirectory() ? `${literal}/**/*` : literal;
+        } catch {
+          return literal;
+        }
+      })
+    );
+    const eligible = new Set(await access.list(patterns, { dot: true }));
+    const indexed = indexMatchingPaths(scopes, files);
+    const filesByScope = new Map(
+      scopes.map((scope, index) => [JSON.stringify([...new Set(scope)].sort()), indexed[index]])
+    );
+    return { filesByScope, eligible };
+  };
+  return Promise.all(
+    scopes.map((scope) => {
+      const anchors = [...new Set(scope)].sort();
+      return inspectionRead(
+        root,
+        "decision-anchor-capture:" + JSON.stringify(anchors),
+        async () => {
+          const capture = { anchors, files: {}, complete: true };
+          if (!anchors.length) return capture;
+          try {
+            const { eligible, filesByScope } = await (context ??= prepareContext());
+            const files = filesByScope.get(JSON.stringify(anchors));
+            if (files.length > 2e3) return { ...capture, complete: false };
+            for (const file of files) {
+              const evidence = await inspectionRead(
+                root,
+                "decision-anchor-file:" + file,
+                async () => {
+                  try {
+                    const absolute = await storePath(root, file);
+                    await fs3.lstat(absolute);
+                    if (!eligible.has(file)) return { complete: false };
+                    const handle = await fs3.open(
+                      absolute,
+                      constants2.O_RDONLY | constants2.O_NONBLOCK | constants2.O_NOFOLLOW
+                    );
+                    try {
+                      const stat = await handle.stat();
+                      if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES)
+                        return { complete: false };
+                      const bytes = Buffer.alloc(Math.min(stat.size + 1, MAX_SOURCE_BYTES + 1));
+                      let size = 0;
+                      while (size < bytes.length) {
+                        const read = await handle.read(bytes, size, bytes.length - size, null);
+                        if (!read.bytesRead) break;
+                        size += read.bytesRead;
+                      }
+                      if (size === bytes.length) return { complete: false };
+                      return {
+                        complete: true,
+                        hash: createHash("sha256").update(bytes.subarray(0, size)).digest("hex")
+                      };
+                    } finally {
+                      await handle.close();
+                    }
+                  } catch (error) {
+                    return { complete: error.code === "ENOENT" };
+                  }
+                }
+              );
+              if (!evidence.complete) capture.complete = false;
+              if (evidence.hash) capture.files[file] = evidence.hash;
+            }
+          } catch {
+            capture.complete = false;
+          }
+          return capture;
+        }
+      );
+    })
+  );
 }
+function changedCaptureFiles(before, after) {
+  return [.../* @__PURE__ */ new Set([...Object.keys(before.files), ...Object.keys(after.files)])].filter((file) => before.files[file] !== after.files[file]).sort();
+}
+
+// src/decisions/decisions.ts
+import fs5 from "fs/promises";
+import path8 from "path";
+import { createHash as createHash3 } from "crypto";
+import { z as z5 } from "zod";
 
 // src/snapshot/snapshot.ts
-import path5 from "path";
-import { z } from "zod";
+import path6 from "path";
+import { z as z3 } from "zod";
 
 // src/utils/store-lock.ts
-import fs3 from "fs/promises";
+import { z as z2 } from "zod";
+import fs4 from "fs/promises";
 import os from "os";
+var lockOwnerSchema = z2.object({ host: z2.string(), pid: z2.number().int().positive() });
 
 // src/test-map.ts
-import path4 from "path";
+import path5 from "path";
 
 // src/snapshot/snapshot.ts
-var repoPath = z.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
+var repoPath2 = z3.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
 var verificationFields = {
-  refreshedHash: z.string().optional(),
-  verifiedAt: z.string().optional(),
-  verifiedHash: z.string().optional(),
-  verificationToken: z.string().optional(),
-  verificationFailed: z.boolean().optional(),
-  verificationNote: z.string().optional()
+  refreshedHash: z3.string().optional(),
+  verifiedAt: z3.string().optional(),
+  verifiedHash: z3.string().optional(),
+  verificationToken: z3.string().optional(),
+  verificationFailed: z3.boolean().optional(),
+  verificationNote: z3.string().optional()
 };
-var featureSchema = z.object({
-  description: z.string(),
-  files: z.array(repoPath),
-  tests: z.array(repoPath).optional(),
-  type: z.enum(["capability", "infrastructure"]).optional(),
+var featureSchema = z3.object({
+  description: z3.string(),
+  files: z3.array(repoPath2),
+  tests: z3.array(repoPath2).optional(),
+  type: z3.enum(["capability", "infrastructure"]).optional(),
   ...verificationFields
 }).passthrough();
-var flowSchema = z.object({ description: z.string(), chain: z.array(repoPath), ...verificationFields }).passthrough();
-var snapshotSchema = z.object({
-  version: z.literal(2),
-  createdAt: z.string(),
-  updatedAt: z.string(),
-  gitHash: z.string(),
-  features: z.record(featureSchema),
-  flows: z.record(flowSchema)
+var flowSchema = z3.object({ description: z3.string(), chain: z3.array(repoPath2), ...verificationFields }).passthrough();
+var snapshotSchema = z3.object({
+  version: z3.literal(2),
+  createdAt: z3.string(),
+  updatedAt: z3.string(),
+  gitHash: z3.string(),
+  features: z3.record(featureSchema),
+  flows: z3.record(flowSchema)
 }).passthrough();
 async function getCurrentGitHash(rootDir) {
   try {
@@ -187,114 +598,167 @@ async function getCurrentGitHash(rootDir) {
 }
 
 // src/context/lexical.ts
-import path6 from "path";
+import path7 from "path";
 
 // src/decisions/provenance.ts
-import { z as z2 } from "zod";
+import { z as z4 } from "zod";
+import { createHash as createHash2 } from "crypto";
 
 // src/context/trust.ts
 function assessTrust(entry, freshness) {
   const verification = entry.verificationFailed ? "failed" : entry.verifiedAt ? "passed" : "unverified";
   const reasons = [];
-  if (freshness === "unknown") reasons.push("Anchors, history, or working-tree evidence are unavailable; verify before relying on this entry.");
-  if (freshness === "changed") reasons.push("Anchored files changed; verify against current code before relying on this entry.");
-  if (verification === "failed") reasons.push(`Verification failed: ${entry.verificationNote ?? "re-map this entry before relying on it"}`);
+  if (freshness === "unknown")
+    reasons.push(
+      "Anchors, history, or working-tree evidence are unavailable; verify before relying on this entry."
+    );
+  if (freshness === "changed")
+    reasons.push(
+      "Anchored files changed; verify against current code before relying on this entry."
+    );
+  if (verification === "failed")
+    reasons.push(
+      `Verification failed: ${entry.verificationNote ?? "re-map this entry before relying on it"}`
+    );
   if (verification === "unverified") reasons.push("No correctness verification has been recorded.");
-  return { freshness, verification, verifiedAt: entry.verifiedAt, verifiedHash: entry.verifiedHash, reasons };
+  return {
+    freshness,
+    verification,
+    verifiedAt: entry.verifiedAt,
+    verifiedHash: entry.verifiedHash,
+    reasons
+  };
 }
 
 // src/decisions/provenance.ts
-var text = (max) => z2.string().trim().min(1).max(max);
-var decisionSourceSchema = z2.object({
-  kind: z2.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
+var text = (max) => z4.string().trim().min(1).max(max);
+var decisionSourceSchema = z4.object({
+  kind: z4.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
   reference: text(1e3),
   note: text(500).optional()
 }).strict();
-var attributionSchema = z2.object({
+var attributionSchema = z4.object({
   owner: text(200).nullable().optional(),
-  sources: z2.array(decisionSourceSchema).max(20).optional(),
+  sources: z4.array(decisionSourceSchema).max(20).optional(),
   actor: text(200).optional()
 });
-var contentSchema = z2.object({
-  title: z2.string().min(1),
-  body: z2.string().min(1),
-  category: z2.enum(["decision", "gotcha", "deprecation", "convention"]),
-  files: z2.array(z2.string().refine((f) => normalizeRepoPath(f) !== null)),
+var contentSchema = z4.object({
+  title: z4.string().min(1),
+  body: z4.string().min(1),
+  category: z4.enum(["decision", "gotcha", "deprecation", "convention"]),
+  files: z4.array(z4.string().refine((f) => normalizeRepoPath(f) !== null)),
   owner: text(200).optional(),
-  sources: z2.array(decisionSourceSchema).max(20)
+  sources: z4.array(decisionSourceSchema).max(20)
 });
-var approvalSchema = z2.enum(["unreviewed", "proposed", "accepted"]);
-var statusSchema = z2.enum(["active", "superseded", "retired"]);
-var reviewEvidenceSchema = z2.object({
-  baseHash: z2.string(),
-  headHash: z2.string(),
-  historyAvailable: z2.boolean(),
-  changedFiles: z2.array(z2.string()),
-  localChanges: z2.array(z2.string())
+var approvalSchema = z4.enum(["unreviewed", "proposed", "accepted"]);
+var statusSchema = z4.enum(["active", "superseded", "retired"]);
+var reviewEvidenceSchema = z4.object({
+  baseHash: z4.string(),
+  headHash: z4.string(),
+  historyAvailable: z4.boolean(),
+  changedFiles: z4.array(z4.string()),
+  localChanges: z4.array(z4.string())
 });
-var eventSchema = z2.object({
-  kind: z2.enum(["imported", "created", "revised", "accepted", "reaffirmed", "retired", "superseded"]),
-  at: z2.string().datetime(),
+var eventSchema = z4.object({
+  kind: z4.enum([
+    "imported",
+    "created",
+    "revised",
+    "accepted",
+    "reaffirmed",
+    "retired",
+    "superseded"
+  ]),
+  at: z4.string().datetime(),
   actor: text(200).optional(),
   note: text(1500).optional(),
-  revision: z2.number().int().positive(),
+  revision: z4.number().int().positive(),
   content: contentSchema,
   approval: approvalSchema,
   status: statusSchema,
-  refreshedHash: z2.string(),
-  evidence: reviewEvidenceSchema.optional()
+  refreshedHash: z4.string(),
+  evidence: reviewEvidenceSchema.optional(),
+  capture: anchorCaptureSchema.optional()
 });
-var legacySchema = z2.object({
-  version: z2.literal(1),
-  id: z2.string().regex(/^[a-zA-Z0-9_-]+$/),
-  title: z2.string().min(1),
-  body: z2.string().min(1),
+var legacySchema = z4.object({
+  version: z4.literal(1),
+  id: z4.string().regex(/^[a-zA-Z0-9_-]+$/),
+  title: z4.string().min(1),
+  body: z4.string().min(1),
   category: contentSchema.shape.category,
   files: contentSchema.shape.files,
-  createdAt: z2.string(),
-  updatedAt: z2.string(),
-  refreshedHash: z2.string(),
-  status: z2.enum(["active", "superseded"]),
-  supersededBy: z2.string().optional()
+  createdAt: z4.string(),
+  updatedAt: z4.string(),
+  refreshedHash: z4.string(),
+  status: z4.enum(["active", "superseded"]),
+  supersededBy: z4.string().optional()
 }).passthrough();
 var currentSchema = legacySchema.extend({
-  version: z2.literal(2),
+  version: z4.literal(2),
   status: statusSchema,
   approval: approvalSchema,
-  revision: z2.number().int().positive(),
+  revision: z4.number().int().positive(),
   owner: text(200).optional(),
-  sources: z2.array(decisionSourceSchema).max(20),
-  history: z2.array(eventSchema).min(1)
+  sources: z4.array(decisionSourceSchema).max(20),
+  history: z4.array(eventSchema).min(1),
+  capture: anchorCaptureSchema.optional(),
+  inspections: z4.array(
+    z4.object({
+      at: z4.string().datetime(),
+      inspector: text(200),
+      note: text(1500),
+      outcome: z4.literal("no_contradiction_found"),
+      decisionDigest: z4.string().regex(/^[a-f0-9]{64}$/),
+      headHash: z4.string(),
+      capture: anchorCaptureSchema
+    })
+  ).max(200).optional()
 }).superRefine((record, ctx) => {
   const invalid = (message) => ctx.addIssue({ code: "custom", message });
   const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
   let previous;
   for (const event of record.history) {
     if (!previous) {
-      if (!["created", "imported"].includes(event.kind) || event.revision !== 1) invalid("History must begin with creation or legacy import at revision 1");
-      if (event.approval !== (event.kind === "created" ? "proposed" : "unreviewed")) invalid("Initial records cannot claim acceptance");
+      if (!["created", "imported"].includes(event.kind) || event.revision !== 1)
+        invalid("History must begin with creation or legacy import at revision 1");
+      if (event.approval !== (event.kind === "created" ? "proposed" : "unreviewed"))
+        invalid("Initial records cannot claim acceptance");
     } else {
       if (["created", "imported"].includes(event.kind)) invalid("History cannot restart");
       if (previous.status !== "active") invalid("Archived decisions cannot be changed");
-      if (event.revision !== previous.revision + (event.kind === "revised" ? 1 : 0)) invalid("Invalid revision sequence");
-      if (event.kind !== "revised" && !same(event.content, previous.content)) invalid("A review cannot silently revise decision content");
-      if (event.kind === "reaffirmed" && previous.approval !== "accepted") invalid("Only accepted decisions can be reaffirmed");
-      if (event.kind === "accepted" && previous.approval === "accepted") invalid("Use reaffirmation for an accepted decision");
+      if (event.revision !== previous.revision + (event.kind === "revised" ? 1 : 0))
+        invalid("Invalid revision sequence");
+      if (event.kind !== "revised" && !same(event.content, previous.content))
+        invalid("A review cannot silently revise decision content");
+      if (event.kind === "reaffirmed" && previous.approval !== "accepted")
+        invalid("Only accepted decisions can be reaffirmed");
+      if (event.kind === "accepted" && previous.approval === "accepted")
+        invalid("Use reaffirmation for an accepted decision");
       const approval = event.kind === "revised" ? "proposed" : ["accepted", "reaffirmed"].includes(event.kind) ? "accepted" : previous.approval;
       if (event.approval !== approval) invalid("Approval disagrees with review history");
-      if (!["accepted", "reaffirmed"].includes(event.kind) && event.refreshedHash !== previous.refreshedHash) invalid("Only a review can refresh the evidence baseline");
+      if (!["accepted", "reaffirmed"].includes(event.kind) && event.refreshedHash !== previous.refreshedHash)
+        invalid("Only a review can refresh the evidence baseline");
     }
-    if (event.kind !== "imported" && event.status !== (event.kind === "retired" ? "retired" : event.kind === "superseded" ? "superseded" : "active")) invalid("Lifecycle disagrees with history");
-    if (["accepted", "reaffirmed", "retired"].includes(event.kind) && (!event.actor || !event.note || !event.evidence)) invalid("Reviews require a named reviewer, reason, and code evidence");
+    if (event.kind !== "imported" && event.status !== (event.kind === "retired" ? "retired" : event.kind === "superseded" ? "superseded" : "active"))
+      invalid("Lifecycle disagrees with history");
+    if (["accepted", "reaffirmed", "retired"].includes(event.kind) && (!event.actor || !event.note || !event.evidence))
+      invalid("Reviews require a named reviewer, reason, and code evidence");
     if (["accepted", "reaffirmed"].includes(event.kind)) {
-      if (!event.content.owner || !event.content.sources.length) invalid("Accepted decisions require an owner and source");
-      if (!event.evidence || !/^[a-f0-9]{40,64}$/.test(event.evidence.headHash) || event.refreshedHash !== event.evidence.headHash || event.evidence.localChanges.length) invalid("Acceptance requires a committed evidence baseline");
+      if (!event.content.owner || !event.content.sources.length)
+        invalid("Accepted decisions require an owner and source");
+      if (!event.evidence || !/^[a-f0-9]{40,64}$/.test(event.evidence.headHash) || event.refreshedHash !== event.evidence.headHash || event.evidence.localChanges.length)
+        invalid("Acceptance requires a committed evidence baseline");
     }
+    if (event.capture && !same([...event.content.files].sort(), event.capture.anchors))
+      invalid("Capture scope disagrees with decision anchors");
     previous = event;
   }
-  if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash) invalid("Decision does not match the final history event");
+  if (previous && !same(previous.capture, record.capture))
+    invalid("Capture does not match the final history event");
+  if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash)
+    invalid("Decision does not match the final history event");
 });
-var decisionSchema = z2.union([legacySchema, currentSchema]);
+var decisionSchema = z4.union([legacySchema, currentSchema]);
 function decisionContent(record) {
   return {
     title: record.title,
@@ -309,7 +773,8 @@ function decisionApproval(record) {
   return record.version === 1 ? "unreviewed" : record.approval;
 }
 function effectiveDecision(record) {
-  if (record.version !== 2 || record.status !== "active" || record.approval !== "proposed") return record;
+  if (record.version !== 2 || record.status !== "active" || record.approval !== "proposed")
+    return record;
   let index = record.history.length - 1;
   while (index >= 0 && !["accepted", "reaffirmed"].includes(record.history[index].kind)) index--;
   if (index < 0) return record;
@@ -321,6 +786,7 @@ function effectiveDecision(record) {
     approval: "accepted",
     revision: event.revision,
     refreshedHash: event.refreshedHash,
+    capture: event.capture,
     updatedAt: event.at,
     history: record.history.slice(0, index + 1)
   };
@@ -330,7 +796,9 @@ function decisionAnchors(record) {
 }
 function decisionProvenance(record, freshness = "unknown") {
   const approval = decisionApproval(record);
-  const review = record.version === 2 ? [...record.history].reverse().find((e) => ["accepted", "reaffirmed"].includes(e.kind) && e.revision === record.revision) : void 0;
+  const review = record.version === 2 ? [...record.history].reverse().find(
+    (e) => ["accepted", "reaffirmed"].includes(e.kind) && e.revision === record.revision
+  ) : void 0;
   return {
     approval,
     revision: record.version === 2 ? record.revision : 0,
@@ -338,71 +806,149 @@ function decisionProvenance(record, freshness = "unknown") {
     sources: record.version === 2 ? record.sources : [],
     guidance: record.status !== "active" ? "historical" : approval === "accepted" ? "constraint" : approval === "proposed" ? "proposal" : "unreviewed",
     reviewRequired: record.status === "active" && (approval !== "accepted" || freshness !== "current"),
-    lastReview: review ? { reviewer: review.actor, at: review.at, note: review.note, gitHash: review.refreshedHash } : null
+    lastReview: review ? {
+      reviewer: review.actor,
+      at: review.at,
+      note: review.note,
+      gitHash: review.refreshedHash
+    } : null
   };
 }
 function decisionTrust(record, freshness) {
   const review = decisionProvenance(record, freshness).lastReview;
-  return assessTrust(review ? { verifiedAt: review.at, verifiedHash: review.gitHash } : {}, freshness);
+  return assessTrust(
+    review ? { verifiedAt: review.at, verifiedHash: review.gitHash } : {},
+    freshness
+  );
+}
+function decisionInspectionDigest(record) {
+  const effective = effectiveDecision(record);
+  return createHash2("sha256").update(
+    JSON.stringify([
+      record.status,
+      decisionApproval(record),
+      record.version === 2 ? record.revision : 0,
+      decisionContent(record),
+      decisionContent(effective),
+      effective.refreshedHash
+    ])
+  ).digest("hex");
+}
+function latestDecisionInspection(record) {
+  return record.version === 2 ? record.inspections?.filter((i) => i.decisionDigest === decisionInspectionDigest(record)).at(-1) : void 0;
 }
 function revisionKnowledge(record, freshness) {
-  return { ...decisionContent(record), ...decisionProvenance(record, freshness), trust: decisionTrust(record, freshness) };
+  return {
+    ...decisionContent(record),
+    ...decisionProvenance(record, freshness),
+    trust: decisionTrust(record, freshness)
+  };
 }
 function decisionKnowledge(record, freshness = "unknown", proposalFreshness = "unknown") {
   const effective = effectiveDecision(record);
+  const inspection = latestDecisionInspection(record);
   return {
     ...revisionKnowledge(effective, freshness),
+    ...inspection ? {
+      inspection: {
+        freshness,
+        at: inspection.at,
+        inspector: inspection.inspector,
+        note: inspection.note,
+        outcome: inspection.outcome,
+        headHash: inspection.headHash
+      }
+    } : {},
     ...effective !== record ? { pendingProposal: revisionKnowledge(record, proposalFreshness) } : {}
   };
 }
-var DECISION_GUIDANCE = "Accepted decisions are recorded team constraints, subject to freshness checks. A pendingProposal is an unaccepted replacement; the accepted revision remains operative until explicit acceptance or retirement. Proposals are suggestions; legacy unreviewed records need confirmation. Use review_decision to inspect provenance and record an authorized review; identities and sources are recorded assertions, not authenticated proof.";
+var DECISION_GUIDANCE = "Accepted decisions are recorded team constraints, subject to freshness checks. A pendingProposal is an unaccepted replacement; the accepted revision remains operative until explicit acceptance or retirement. Proposals are suggestions; legacy unreviewed records need confirmation. Use review_decision to prepare evidence and record a separate source inspection without human approval, or an authorized human review; identities and sources are recorded assertions, not authenticated proof.";
 
 // src/decisions/decisions.ts
 var TITLE_MAX_CHARS = 80;
 var BODY_RECOMMENDED_CHARS = 1500;
 var BODY_MAX_CHARS = 2500;
-var boundedText = (field, max, hint) => z3.string({
-  errorMap: (issue, ctx) => ({ message: issue.code === "too_big" ? `${field} has ${ctx.data.length} characters; maximum is ${max} (${ctx.data.length - max} over). ${hint}` : ctx.defaultError })
+var boundedText = (field, max, hint) => z5.string({
+  errorMap: (issue, ctx) => ({
+    message: issue.code === "too_big" && typeof ctx.data === "string" ? `${field} has ${ctx.data.length} characters; maximum is ${max} (${ctx.data.length - max} over). ${hint}` : ctx.defaultError
+  })
 }).trim().min(1, `${field} must be non-empty`).max(max);
-var decisionTitleSchema = boundedText("title", TITLE_MAX_CHARS, "Tighten it to a specific headline.");
+var decisionTitleSchema = boundedText(
+  "title",
+  TITLE_MAX_CHARS,
+  "Tighten it to a specific headline."
+);
 var decisionBodySchema = boundedText(
   "body",
   BODY_MAX_CHARS,
   `Aim for ${BODY_RECOMMENDED_CHARS} characters or fewer. Preserve the rule, reason, and exceptions; put supporting references in sources.`
 );
+async function readDecisionInputs(rootDir) {
+  return structuredClone(
+    await inspectionRead(rootDir, "decision-store:inputs", async () => {
+      const inputs = [];
+      const diagnostics = [];
+      let entries;
+      try {
+        entries = await fs5.readdir(await storePath(rootDir, ".mason/decisions"));
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          diagnostics.push({ path: ".mason/decisions", message: String(error) });
+        return { inputs, diagnostics };
+      }
+      for (const entry of entries.sort()) {
+        if (!entry.endsWith(".json")) continue;
+        const relative = `.mason/decisions/${entry}`;
+        try {
+          const raw = await readBoundedFile(await storePath(rootDir, relative), 10 * 1024 * 1024);
+          if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
+          inputs.push([relative, raw]);
+        } catch (error) {
+          if (error.code === "ENOENT") inputs.push([relative, null]);
+          else
+            diagnostics.push({
+              path: relative,
+              message: error instanceof Error ? error.message : String(error)
+            });
+        }
+      }
+      return { inputs, diagnostics };
+    })
+  );
+}
 async function loadDecisionStore(rootDir) {
-  const records = [];
-  const diagnostics = [];
-  let entries;
-  try {
-    entries = await fs4.readdir(await storePath(rootDir, ".mason/decisions"));
-  } catch (error) {
-    if (error.code !== "ENOENT") diagnostics.push({ path: ".mason/decisions", message: String(error) });
-    return { records, diagnostics };
-  }
-  for (const entry of entries.sort()) {
-    if (!entry.endsWith(".json")) continue;
-    const relative = `.mason/decisions/${entry}`;
-    try {
-      const record = decisionSchema.parse(await readStoreJson(rootDir, relative));
-      if (entry !== `${record.id}.json`) throw new Error("Record id does not match its filename");
-      records.push(record);
-    } catch (error) {
-      diagnostics.push({ path: relative, message: error instanceof Error ? error.message : String(error) });
-    }
-  }
-  return { records, diagnostics };
+  return structuredClone(
+    await inspectionRead(rootDir, "decision-store:parsed", async () => {
+      const raw = await readDecisionInputs(rootDir);
+      const records = [];
+      const diagnostics = [...raw.diagnostics];
+      for (const [relative, content] of raw.inputs) {
+        try {
+          const record = decisionSchema.parse(content === null ? null : JSON.parse(content));
+          if (relative !== `.mason/decisions/${record.id}.json`)
+            throw new Error("Record id does not match its filename");
+          records.push(record);
+        } catch (error) {
+          diagnostics.push({
+            path: relative,
+            message: error instanceof Error ? error.message : String(error)
+          });
+        }
+      }
+      return { records, diagnostics };
+    })
+  );
 }
 
 // src/hook/hook.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 
 // src/decisions/drift.ts
-import path9 from "path";
+import path10 from "path";
 
 // src/drift/drift.ts
-import fs5 from "fs/promises";
-import path8 from "path";
+import fs6 from "fs/promises";
+import path9 from "path";
 function parseChanges(output) {
   const fields = output.split("\0");
   const changes = [];
@@ -412,18 +958,25 @@ function parseChanges(output) {
     if (!first) break;
     const second = /^[RC]/.test(code) ? fields[i++] : void 0;
     const change = second ? code.startsWith("R") ? { status: "renamed", path: second, previousPath: first } : { status: "added", path: second } : { status: code === "A" ? "added" : code === "D" ? "deleted" : "modified", path: first };
-    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/"))) continue;
+    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/")))
+      continue;
     changes.push(change);
   }
   return changes;
 }
 function touchedPaths(changes) {
-  return [...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))].sort();
+  return [
+    ...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))
+  ].sort();
 }
 async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
-  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
+  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-"))
+    return null;
   try {
-    const { stdout } = await execGit(["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
+    const { stdout } = await execGit(
+      ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"],
+      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
+    );
     return parseChanges(stdout);
   } catch {
     return null;
@@ -432,11 +985,23 @@ async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
 async function getWorkingTree(resolvedRoot) {
   try {
     const [diff, untracked] = await Promise.all([
-      execGit(["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
-      execGit(["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
+      execGit(["diff", "--name-status", "-z", "-M", "HEAD", "--"], {
+        cwd: resolvedRoot,
+        maxBuffer: 10 * 1024 * 1024
+      }),
+      execGit(["ls-files", "-z", "--others", "--exclude-standard"], {
+        cwd: resolvedRoot,
+        maxBuffer: 10 * 1024 * 1024
+      })
     ]);
     const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
-    return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
+    return {
+      available: true,
+      changedFiles: [
+        .../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])
+      ].sort(),
+      untrackedFiles
+    };
   } catch {
     return { available: false, changedFiles: [], untrackedFiles: [] };
   }
@@ -444,13 +1009,47 @@ async function getWorkingTree(resolvedRoot) {
 
 // src/decisions/drift.ts
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path9.resolve(rootDir);
+  const resolvedRoot = path10.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
-  const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
-  const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
+  const report = {
+    historyAvailable: true,
+    totalDecisions: store.records.length,
+    staleDecisions: {},
+    freshness: {},
+    diagnostics: store.diagnostics
+  };
+  const [head, workingTree] = await Promise.all([
+    getCurrentGitHash(resolvedRoot),
+    getWorkingTree(resolvedRoot)
+  ]);
   const changesByHash = /* @__PURE__ */ new Map();
-  const inspect = async (record) => {
+  const baselines = store.records.filter((record) => record.status === "active").flatMap((record) => {
+    const inspection = latestDecisionInspection(record);
+    if (inspection) return [inspection.capture];
+    return [.../* @__PURE__ */ new Set([effectiveDecision(record), record])].flatMap(
+      (candidate) => candidate.version === 2 && candidate.capture ? [candidate.capture] : []
+    );
+  });
+  const captures = await captureAnchorScopes(
+    resolvedRoot,
+    baselines.map((baseline) => baseline.anchors)
+  );
+  const currentCaptures = new Map(
+    baselines.map((baseline, index) => [JSON.stringify(baseline.anchors), captures[index]])
+  );
+  const inspect = async (record, inspectionCapture) => {
     if (record.files.length === 0) return { freshness: "unknown", changedFiles: [] };
+    const baseline = inspectionCapture ?? (record.version === 2 ? record.capture : void 0);
+    if (baseline) {
+      const current = currentCaptures.get(JSON.stringify(baseline.anchors));
+      const hits2 = changedCaptureFiles(baseline, current).filter(
+        (file) => matchingPaths(record.files, [file]).length
+      );
+      return {
+        freshness: !baseline.complete || !current.complete ? "unknown" : hits2.length ? "changed" : "current",
+        changedFiles: hits2
+      };
+    }
     let touched = changesByHash.get(record.refreshedHash);
     if (touched === void 0) {
       const changes = record.refreshedHash === head && head !== "unknown" ? [] : await getChangesWithStatus(resolvedRoot, record.refreshedHash);
@@ -460,15 +1059,20 @@ async function computeDecisionDrift(rootDir, decisions) {
     if (touched === null) report.historyAvailable = false;
     const hits = touched ? matchingPaths(record.files, touched) : [];
     const localHits = matchingPaths(record.files, workingTree.changedFiles);
-    return { freshness: touched === null || !workingTree.available ? "unknown" : hits.length || localHits.length ? "changed" : "current", changedFiles: hits };
+    return {
+      freshness: touched === null || !workingTree.available ? "unknown" : hits.length || localHits.length ? "changed" : "current",
+      changedFiles: [.../* @__PURE__ */ new Set([...hits, ...localHits])].sort()
+    };
   };
   for (const record of store.records) {
     if (record.status !== "active") continue;
     const effective = effectiveDecision(record);
-    const state = await inspect(effective);
+    const inspection = latestDecisionInspection(record);
+    const state = await inspect(effective, inspection?.capture);
     report.freshness[record.id] = state.freshness;
     if (state.changedFiles.length) report.staleDecisions[record.id] = state.changedFiles;
-    if (effective !== record) (report.pendingProposals ??= {})[record.id] = await inspect(record);
+    if (effective !== record)
+      (report.pendingProposals ??= {})[record.id] = await inspect(record, inspection?.capture);
   }
   return report;
 }
@@ -477,9 +1081,17 @@ async function computeDecisionDrift(rootDir, decisions) {
 var MAX_INJECTED_DECISIONS = 3;
 var MAX_WALK_UP = 30;
 var SUPPORTED_TOOLS = /* @__PURE__ */ new Set(["Read", "Edit", "Write"]);
+var hookStdinSchema = z6.object({
+  session_id: z6.string().optional(),
+  agent_id: z6.string().optional(),
+  cwd: z6.string().optional(),
+  hook_event_name: z6.string().optional(),
+  tool_name: z6.string().optional(),
+  tool_input: z6.object({ file_path: z6.string().optional() }).optional()
+});
 async function exists(p) {
   try {
-    await fs6.access(p);
+    await fs7.access(p);
     return true;
   } catch {
     return false;
@@ -488,9 +1100,9 @@ async function exists(p) {
 async function findMasonRoot(startDir) {
   let dir = startDir;
   for (let i = 0; i < MAX_WALK_UP; i++) {
-    if (await exists(path10.join(dir, ".mason", "decisions"))) return dir;
-    if (await exists(path10.join(dir, ".git"))) return null;
-    const parent = path10.dirname(dir);
+    if (await exists(path11.join(dir, ".mason", "decisions"))) return dir;
+    if (await exists(path11.join(dir, ".git"))) return null;
+    const parent = path11.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -508,8 +1120,8 @@ function stateKey(input) {
 }
 async function loadInjected(stateFile) {
   try {
-    const parsed = JSON.parse(await fs6.readFile(stateFile, "utf-8"));
-    return new Set(Array.isArray(parsed) ? parsed.filter((x) => typeof x === "string") : []);
+    const parsed = JSON.parse(await fs7.readFile(stateFile, "utf-8"));
+    return new Set(isStringArray(parsed) ? parsed : []);
   } catch {
     return /* @__PURE__ */ new Set();
   }
@@ -517,7 +1129,7 @@ async function loadInjected(stateFile) {
 function formatContext(relPath, records, drift) {
   const lines = [];
   lines.push(
-    `Mason: decision knowledge relevant to ${relPath} or updated since this session saw it. This replaces earlier guidance for the same decision id. ${DECISION_GUIDANCE} Retired or superseded records are no longer active. Do not modify decision records in .mason/decisions/.`
+    `Mason: decision knowledge relevant to ${relPath} or updated since this session saw it. This replaces earlier guidance for the same decision id. ${DECISION_GUIDANCE} Retired or superseded records are no longer active. Use Mason tools to record decision changes and source inspections; do not edit the JSON in .mason/decisions/ directly.`
   );
   const append = (id, knowledge, label, freshness) => {
     const stale = freshness === "current" ? "" : freshness === "changed" ? " [recorded against changed files \u2013 verify against current code before relying on it]" : " [freshness unknown \u2013 verify against current code before relying on it]";
@@ -526,16 +1138,31 @@ function formatContext(relPath, records, drift) {
     );
   };
   for (const record of records) {
-    const knowledge = decisionKnowledge(record, drift.freshness?.[record.id] ?? "unknown", drift.pendingProposals?.[record.id]?.freshness ?? "unknown");
-    append(record.id, knowledge, record.status === "active" ? knowledge.approval : record.status, knowledge.trust.freshness);
-    if (knowledge.pendingProposal) append(record.id, knowledge.pendingProposal, "proposed", knowledge.pendingProposal.trust.freshness);
+    const knowledge = decisionKnowledge(
+      record,
+      drift.freshness?.[record.id] ?? "unknown",
+      drift.pendingProposals?.[record.id]?.freshness ?? "unknown"
+    );
+    append(
+      record.id,
+      knowledge,
+      record.status === "active" ? knowledge.approval : record.status,
+      knowledge.trust.freshness
+    );
+    if (knowledge.pendingProposal)
+      append(
+        record.id,
+        knowledge.pendingProposal,
+        "proposed",
+        knowledge.pendingProposal.trust.freshness
+      );
   }
   return lines.join("\n");
 }
 async function runHook(stdinText, env = {}) {
   let input;
   try {
-    input = JSON.parse(stdinText);
+    input = hookStdinSchema.parse(JSON.parse(stdinText));
   } catch {
     return null;
   }
@@ -543,18 +1170,23 @@ async function runHook(stdinText, env = {}) {
   if (input.tool_name && !SUPPORTED_TOOLS.has(input.tool_name)) return null;
   const filePath = input.tool_input?.file_path;
   if (!filePath || typeof filePath !== "string") return null;
-  const absPath = path10.isAbsolute(filePath) ? filePath : path10.resolve(input.cwd ?? process.cwd(), filePath);
-  const root = await findMasonRoot(path10.dirname(absPath));
+  const absPath = path11.isAbsolute(filePath) ? filePath : path11.resolve(input.cwd ?? process.cwd(), filePath);
+  const root = await findMasonRoot(path11.dirname(absPath));
   if (!root) return null;
-  const relPath = path10.relative(root, absPath).split(path10.sep).join("/");
+  const relPath = path11.relative(root, absPath).split(path11.sep).join("/");
   if (relPath.startsWith("..")) return null;
   const { records } = await loadDecisionStore(root);
   const stateDir = env.stateDir ?? os2.tmpdir();
-  const stateFile = path10.join(stateDir, `mason-hook-${createHash2("sha256").update(root).digest("hex").slice(0, 12)}-${stateKey(input)}.json`);
+  const stateFile = path11.join(
+    stateDir,
+    `mason-hook-${createHash4("sha256").update(root).digest("hex").slice(0, 12)}-${stateKey(input)}.json`
+  );
   const injected = await loadInjected(stateFile);
-  const recordKey = (record) => `${record.id}:${createHash2("sha256").update(JSON.stringify(record)).digest("hex")}`;
+  const recordKey = (record) => `${record.id}:${createHash4("sha256").update(JSON.stringify(record)).digest("hex")}`;
   const previouslyInjected = (record) => [...injected].some((key) => key === record.id || key.startsWith(`${record.id}:`));
-  const fresh = records.filter((r) => !injected.has(recordKey(r)) && (previouslyInjected(r) || r.status === "active" && anchorsCover(r, relPath)));
+  const fresh = records.filter(
+    (r) => !injected.has(recordKey(r)) && (previouslyInjected(r) || r.status === "active" && anchorsCover(r, relPath))
+  );
   if (fresh.length === 0) return null;
   fresh.sort((a, b) => {
     const withdrawn = Number(b.status !== "active") - Number(a.status !== "active");
@@ -567,7 +1199,7 @@ async function runHook(stdinText, env = {}) {
   const drift = await computeDecisionDrift(root, selected);
   for (const record of selected) injected.add(recordKey(record));
   try {
-    await fs6.writeFile(stateFile, JSON.stringify([...injected]), "utf-8");
+    await fs7.writeFile(stateFile, JSON.stringify([...injected]), "utf-8");
   } catch {
   }
   return JSON.stringify({
@@ -635,7 +1267,9 @@ async function readStdin() {
   if (process.stdin.isTTY) return "";
   const chunks = [];
   for await (const chunk of process.stdin) {
-    chunks.push(Buffer.from(chunk));
+    const value = chunk;
+    if (typeof value === "string" || value instanceof Uint8Array) chunks.push(Buffer.from(value));
+    else throw new Error("Unsupported stdin chunk.");
   }
   return Buffer.concat(chunks).toString("utf-8");
 }