mason-context 0.20.2 → 0.22.0

package/dist/mason-audit.js

@@ -10,6 +10,19 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/utils/validation.ts
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+var init_validation = __esm({
+  "src/utils/validation.ts"() {
+    "use strict";
+  }
+});
+
 // src/utils/profile.ts
 import { AsyncLocalStorage } from "async_hooks";
 async function profilePhase(label, run) {
@@ -54,7 +67,19 @@ var init_git_read = __esm({
     "use strict";
     init_profile();
     execute = promisify(execFile);
-    commands = /* @__PURE__ */ new Set(["rev-parse", "symbolic-ref", "for-each-ref", "ls-files", "check-ignore", "status", "log", "diff", "ls-tree", "show", "merge-base"]);
+    commands = /* @__PURE__ */ new Set([
+      "rev-parse",
+      "symbolic-ref",
+      "for-each-ref",
+      "ls-files",
+      "check-ignore",
+      "status",
+      "log",
+      "diff",
+      "ls-tree",
+      "show",
+      "merge-base"
+    ]);
   }
 });
 
@@ -62,7 +87,8 @@ var init_git_read = __esm({
 import path from "path";
 function normalizeRepoPath(value) {
   const slash = value.replace(/\\/g, "/");
-  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash)) return null;
+  if (!slash || slash.includes("\0") || path.posix.isAbsolute(slash) || /^[A-Za-z]:/.test(slash))
+    return null;
   if (slash.split("/").includes("..")) return null;
   const normalized = path.posix.normalize(slash).replace(/\/$/, "");
   return normalized === "." ? null : normalized;
@@ -77,7 +103,39 @@ function anchorMatches(anchor, file) {
   return a !== null && f !== null && (a === f || f.startsWith(`${a}/`));
 }
 function matchingPaths(anchors, files) {
-  return [...new Set(files)].filter((file) => anchors.some((anchor) => anchorMatches(anchor, file)));
+  return [...new Set(files)].filter(
+    (file) => anchors.some((anchor) => anchorMatches(anchor, file))
+  );
+}
+function indexMatchingPaths(scopes2, files) {
+  const node = () => ({ children: /* @__PURE__ */ new Map(), scopes: /* @__PURE__ */ new Set() });
+  const root = node();
+  const matches = scopes2.map(() => []);
+  scopes2.forEach((anchors, index) => {
+    for (const anchor of anchors) {
+      const normalized = normalizeRepoPath(anchor);
+      if (!normalized) continue;
+      let current = root;
+      for (const part of normalized.split("/")) {
+        if (!current.children.has(part)) current.children.set(part, node());
+        current = current.children.get(part);
+      }
+      current.scopes.add(index);
+    }
+  });
+  for (const file of new Set(files)) {
+    const normalized = normalizeRepoPath(file);
+    if (!normalized) continue;
+    const selected = /* @__PURE__ */ new Set();
+    let current = root;
+    for (const part of normalized.split("/")) {
+      current = current.children.get(part);
+      if (!current) break;
+      for (const index of current.scopes) selected.add(index);
+    }
+    for (const index of selected) matches[index].push(file);
+  }
+  return matches;
 }
 var init_paths = __esm({
   "src/utils/paths.ts"() {
@@ -110,8 +168,18 @@ import fs from "fs/promises";
 import { constants } from "fs";
 import path2 from "path";
 import fg from "fast-glob";
+function isSensitiveFile(file) {
+  return file.split(/[\\/]/).some(
+    (part) => /^(?:\.env(?:\..*)?|id_rsa.*|id_ed25519.*)$|\.(?:pem|key|p12|pfx|jks|keystore)$|credentials\.|secret|^local\.properties$/i.test(
+      part
+    )
+  );
+}
 async function readBoundedFile(file, maxBytes) {
-  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
+  const handle = await fs.open(
+    file,
+    constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW
+  );
   try {
     const stat = await handle.stat();
     if (!stat.isFile() || stat.size > maxBytes) return null;
@@ -131,36 +199,44 @@ async function loadProjectConfig(root) {
   try {
     const canonicalRoot = await fs.realpath(root);
     const configPath = await fs.realpath(path2.join(root, ".mason/config.json"));
-    if (!isWithinRoot(canonicalRoot, configPath)) throw new Error("Project configuration resolves outside the repository");
+    if (!isWithinRoot(canonicalRoot, configPath))
+      throw new Error("Project configuration resolves outside the repository");
     const raw = await readBoundedFile(configPath, 64 * 1024);
-    if (raw === null) throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
+    if (raw === null)
+      throw new Error("Project configuration is not a regular file or exceeds 64 KiB");
     const value = JSON.parse(raw);
-    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected a configuration object");
+    if (!isRecord(value)) throw new Error("Expected a configuration object");
     const config = {};
     for (const key of ["patterns", "alwaysInclude", "ignore"]) {
       if (value[key] === void 0) continue;
-      if (!Array.isArray(value[key]) || !value[key].every((s) => typeof s === "string")) {
+      if (!isStringArray(value[key])) {
         throw new Error(`Configuration ${key} must be an array of strings`);
       }
       config[key] = value[key];
     }
     if (value.audit !== void 0) {
       const audit = value.audit;
-      if (!audit || typeof audit !== "object" || Array.isArray(audit)) throw new Error("Configuration audit must be an object");
+      if (!isRecord(audit)) throw new Error("Configuration audit must be an object");
       const patterns = (raw2) => {
-        if (!Array.isArray(raw2) || raw2.length > 100 || !raw2.every((s) => typeof s === "string" && normalizeRepoPath(s) === s && !s.startsWith("!") && !/[\x00-\x1f]/.test(s))) {
-          throw new Error("Audit patterns must be at most 100 repository-relative globs without traversal or negation");
+        if (!isStringArray(raw2) || raw2.length > 100 || !raw2.every(
+          (s) => typeof s === "string" && normalizeRepoPath(s) === s && !s.startsWith("!") && !/[\x00-\x1f]/.test(s)
+        )) {
+          throw new Error(
+            "Audit patterns must be at most 100 repository-relative globs without traversal or negation"
+          );
         }
         return raw2;
       };
       config.audit = {};
       if (audit.include !== void 0) config.audit.include = patterns(audit.include);
       if (audit.exclude !== void 0) {
-        if (!audit.exclude || typeof audit.exclude !== "object" || Array.isArray(audit.exclude)) throw new Error("audit.exclude must map check names to patterns");
+        if (!isRecord(audit.exclude))
+          throw new Error("audit.exclude must map check names to patterns");
         const { ALL_CHECKS: ALL_CHECKS2 } = await Promise.resolve().then(() => (init_types(), types_exports));
         config.audit.exclude = {};
         for (const [check, globs] of Object.entries(audit.exclude)) {
-          if (!ALL_CHECKS2.includes(check)) throw new Error("Unknown audit check: " + check);
+          if (!ALL_CHECKS2.includes(check))
+            throw new Error("Unknown audit check: " + check);
           config.audit.exclude[check] = patterns(globs);
         }
       }
@@ -168,16 +244,110 @@ async function loadProjectConfig(root) {
     return config;
   } catch (error) {
     if (error.code === "ENOENT") return {};
-    throw new Error(`Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`);
+    throw new Error(
+      `Cannot apply project file policy: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error }
+    );
+  }
+}
+async function createFileAccess(rootDir) {
+  const root = path2.resolve(rootDir);
+  const canonicalRoot = await fs.realpath(root).catch(() => root);
+  const config = await loadProjectConfig(root);
+  const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
+  let gitFiles = null;
+  try {
+    const { stdout } = await execGit(
+      ["ls-files", "-z", "--cached", "--others", "--exclude-standard"],
+      { cwd: root, maxBuffer: 50 * 1024 * 1024 }
+    );
+    gitFiles = new Set(stdout.split("\0").filter(Boolean));
+  } catch {
+    let inGit = false;
+    try {
+      await execGit(["rev-parse", "--git-dir"], { cwd: root });
+      inGit = true;
+    } catch {
+    }
+    if (inGit) throw new Error("Cannot enumerate Git files safely");
+  }
+  async function resolve(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative || isSensitiveFile(relative) || gitFiles && !gitFiles.has(relative))
+      return null;
+    const candidate = path2.join(root, relative);
+    try {
+      const real = await fs.realpath(candidate);
+      if (!isWithinRoot(canonicalRoot, real) || isSensitiveFile(path2.relative(canonicalRoot, real)))
+        return null;
+      const stat = await fs.stat(real);
+      if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null;
+      if (gitFiles && !gitFiles.has(path2.relative(canonicalRoot, real).split(path2.sep).join("/")))
+        return null;
+      return real;
+    } catch {
+      return null;
+    }
+  }
+  async function list(patterns = SOURCE_GLOB, options = {}) {
+    const found = await fg(patterns, { cwd: root, ignore, followSymbolicLinks: false, ...options });
+    const safe = await Promise.all(found.map(async (f) => await resolve(f) ? f : null));
+    return safe.filter((f) => f !== null).sort();
+  }
+  async function read(file) {
+    const relative = normalizeRepoPath(file);
+    if (!relative) return null;
+    const real = await resolve(relative);
+    if (!real) return null;
+    for (const rel of /* @__PURE__ */ new Set([
+      relative,
+      path2.relative(canonicalRoot, real).split(path2.sep).join("/")
+    ])) {
+      if (!(await fg(fg.escapePath(rel), { cwd: root, ignore, dot: true })).length) return null;
+    }
+    try {
+      const content = await readBoundedFile(real, MAX_SOURCE_BYTES);
+      return content === null ? null : { path: relative, content, totalLines: content.split("\n").length };
+    } catch {
+      return null;
+    }
   }
+  return { root, config, list, read, inventory: () => gitFiles ? [...gitFiles].sort() : null };
 }
 var SOURCE_EXTENSIONS, SOURCE_GLOB, SOURCE_IGNORE, MAX_SOURCE_BYTES;
 var init_files = __esm({
   "src/utils/files.ts"() {
     "use strict";
+    init_validation();
     init_git_read();
     init_paths();
-    SOURCE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mts", "cts", "mjs", "cjs", "vue", "svelte", "kt", "kts", "java", "py", "go", "rs", "swift", "rb", "cs", "cpp", "c", "h", "hpp", "dart", "php"];
+    SOURCE_EXTENSIONS = [
+      "ts",
+      "tsx",
+      "js",
+      "jsx",
+      "mts",
+      "cts",
+      "mjs",
+      "cjs",
+      "vue",
+      "svelte",
+      "kt",
+      "kts",
+      "java",
+      "py",
+      "go",
+      "rs",
+      "swift",
+      "rb",
+      "cs",
+      "cpp",
+      "c",
+      "h",
+      "hpp",
+      "dart",
+      "php"
+    ];
     SOURCE_GLOB = `**/*.{${SOURCE_EXTENSIONS.join(",")}}`;
     SOURCE_IGNORE = [
       "**/node_modules/**",
@@ -245,7 +415,10 @@ async function readStoreJson(root, relative) {
     return parsed;
   } catch (error) {
     if (error.code === "ENOENT") return null;
-    throw new Error(`Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    throw new Error(
+      `Invalid Mason store ${relative}: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error }
+    );
   }
 }
 async function writeStoreJson(root, relative, value) {
@@ -293,13 +466,18 @@ function inspectionRead(root, key, read) {
   return inspection.reads.get(key);
 }
 function inspectionGit(args, options) {
-  return inspectionRead(options.cwd, "git:" + JSON.stringify([args, options]), () => execGit(args, options));
+  return inspectionRead(
+    options.cwd,
+    "git:" + JSON.stringify([args, options]),
+    () => execGit(args, options)
+  );
 }
 async function auditGitPaths(root, kind) {
   const custom = (await loadProjectConfig(root)).audit?.include ?? [];
   const shared = inspections.getStore()?.root === path4.resolve(root) && !custom.length;
   const expanded = fg2.generateTasks(custom).flatMap((task) => task.positive);
-  if (expanded.length > 1e3) throw new Error("Audit include patterns expand to more than 1,000 globs");
+  if (expanded.length > 1e3)
+    throw new Error("Audit include patterns expand to more than 1,000 globs");
   const documentSpecs = [...docSpecs, ...expanded.map((pattern) => `:(glob)${pattern}`)];
   const specs = shared ? [...documentSpecs, ...sourceSpecs] : kind === "documents" ? documentSpecs : sourceSpecs;
   const limit = kind === "documents" ? 16 * 1024 * 1024 : 32 * 1024 * 1024;
@@ -307,8 +485,14 @@ async function auditGitPaths(root, kind) {
     ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...specs],
     { cwd: root, maxBuffer: shared ? 48 * 1024 * 1024 : limit, timeout: 1e4 }
   );
-  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter((file) => kind === "documents" ? custom.length > 0 || /^(readme|agents|claude)\.md$/i.test(path4.posix.basename(file)) : sourceSuffixes.has(file.slice(file.lastIndexOf("."))));
-  if (Buffer.byteLength(paths.join("\0")) > limit) throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
+  const paths = [...new Set(stdout.split("\0").filter(Boolean))].filter(
+    (file) => kind === "documents" ? custom.length > 0 || /^(readme|agents|claude)\.md$/i.test(path4.posix.basename(file)) : (
+      // Git's *.ts also matches a file named .ts, unlike path.extname().
+      sourceSuffixes.has(file.slice(file.lastIndexOf(".")))
+    )
+  );
+  if (Buffer.byteLength(paths.join("\0")) > limit)
+    throw new Error("Git " + kind + " inventory exceeds its bounded read limit.");
   return paths.sort();
 }
 var inspections, sourceSpecs, docSpecs, sourceSuffixes;
@@ -319,7 +503,11 @@ var init_inspection = __esm({
     init_files();
     inspections = new AsyncLocalStorage2();
     sourceSpecs = SOURCE_EXTENSIONS.map((extension) => `:(glob)**/*.${extension}`);
-    docSpecs = [":(icase,glob)**/readme.md", ":(icase,glob)**/agents.md", ":(icase,glob)**/claude.md"];
+    docSpecs = [
+      ":(icase,glob)**/readme.md",
+      ":(icase,glob)**/agents.md",
+      ":(icase,glob)**/claude.md"
+    ];
     sourceSuffixes = new Set(SOURCE_EXTENSIONS.map((extension) => "." + extension));
   }
 });
@@ -335,7 +523,10 @@ async function auditInputPath(root, file) {
     return await storePath(root, file);
   } catch (error) {
     if (error instanceof Error && error.message.startsWith("Symlink")) {
-      throw new Error(`Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`, { cause: error });
+      throw new Error(
+        `Audit input contains a symbolic link: ${file}. Its evidence could not be verified.`,
+        { cause: error }
+      );
     }
     throw error;
   }
@@ -357,11 +548,19 @@ async function auditGlob(root, patterns, options) {
     const relative = path5.relative(root, directory).split(path5.sep).join("/") || ".";
     directories.add(relative);
     if (directories.size > MAX_INPUTS) {
-      callback(new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`));
+      callback(
+        new Error(
+          `${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} directories while inspecting ${relative}. Narrow this check's inputs.`
+        )
+      );
       return;
     }
     auditInputPath(root, relative).then(() => {
-      nativeFs.readdir(directory, opts, callback);
+      nativeFs.readdir(
+        directory,
+        opts,
+        callback
+      );
     }, callback);
   });
   const lstat2 = ((file, callback) => {
@@ -388,12 +587,16 @@ async function auditGlob(root, patterns, options) {
       if (!options.onlyDirectories && !entry.dirent.isFile()) continue;
       matches.push(file);
       if (matches.length > MAX_INPUTS) {
-        const largest = [...matches.reduce((counts, item) => {
-          const dir = item.split("/")[0];
-          counts.set(dir, (counts.get(dir) ?? 0) + 1);
-          return counts;
-        }, /* @__PURE__ */ new Map())].sort((a, b) => b[1] - a[1]).slice(0, 3);
-        throw new Error(`${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count3]) => `${dir} (${count3})`).join(", ")}. Narrow this check's inputs.`);
+        const largest = [
+          ...matches.reduce((counts, item) => {
+            const dir = item.split("/")[0];
+            counts.set(dir, (counts.get(dir) ?? 0) + 1);
+            return counts;
+          }, /* @__PURE__ */ new Map())
+        ].sort((a, b) => b[1] - a[1]).slice(0, 3);
+        throw new Error(
+          `${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count3]) => `${dir} (${count3})`).join(", ")}. Narrow this check's inputs.`
+        );
       }
     }
   } finally {
@@ -440,11 +643,16 @@ async function includedCheckPaths(root, paths, exclude) {
   if (!exclude.length) return new Set(paths);
   const included = /* @__PURE__ */ new Set();
   for (let offset = 0; offset < paths.length; offset += 256) {
-    for (const file of await auditGlob(root, paths.slice(offset, offset + 256).map((file2) => fg4.escapePath(file2)), {
-      ignore: exclude,
-      followSymbolicLinks: false,
-      label: "Audit check exclusions"
-    })) included.add(file);
+    for (const file of await auditGlob(
+      root,
+      paths.slice(offset, offset + 256).map((file2) => fg4.escapePath(file2)),
+      {
+        ignore: exclude,
+        followSymbolicLinks: false,
+        label: "Audit check exclusions"
+      }
+    ))
+      included.add(file);
   }
   return included;
 }
@@ -456,28 +664,32 @@ var init_policy = __esm({
 });
 
 // src/utils/store-lock.ts
+import { z } from "zod";
 import fs4 from "fs/promises";
 import os from "os";
 async function lockDiagnostic(file) {
   let reason;
   try {
-    const owner = JSON.parse(await fs4.readFile(file, "utf8"));
-    if (!owner || typeof owner.host !== "string" || !Number.isInteger(owner.pid) || owner.pid <= 0) {
+    const owner = lockOwnerSchema.safeParse(JSON.parse(await fs4.readFile(file, "utf8")));
+    if (!owner.success) {
       reason = "Lock owner data is incomplete or malformed.";
-    } else if (owner.host !== os.hostname()) {
+    } else if (owner.data.host !== os.hostname()) {
       reason = "The lock belongs to another host; its process cannot be checked locally.";
     } else {
       try {
-        process.kill(owner.pid, 0);
-        reason = `Local owner PID ${owner.pid} is still running.`;
+        process.kill(owner.data.pid, 0);
+        reason = `Local owner PID ${owner.data.pid} is still running.`;
       } catch (error) {
-        reason = error.code === "ESRCH" ? `Local owner PID ${owner.pid} has exited, but lock recovery has not completed.` : `Local owner PID ${owner.pid} could not be checked.`;
+        reason = error.code === "ESRCH" ? `Local owner PID ${owner.data.pid} has exited, but lock recovery has not completed.` : `Local owner PID ${owner.data.pid} could not be checked.`;
       }
     }
   } catch (error) {
     reason = error instanceof SyntaxError ? "Lock owner data is incomplete or malformed." : "Lock owner data could not be read; the lock may have changed.";
   }
-  if (await fs4.lstat(file + ".reclaim").then(() => true, () => false)) {
+  if (await fs4.lstat(file + ".reclaim").then(
+    () => true,
+    () => false
+  )) {
     reason += " A recovery guard also needs inspection: " + file + ".reclaim.";
   }
   return reason + " Retry if a writer is active. For manual recovery, stop all Mason writers for this checkout, confirm they have exited (including other hosts), then remove only confirmed abandoned lock and lock.reclaim files. See docs/reference.md#snapshot-repairs-and-verification.";
@@ -497,7 +709,7 @@ async function withStoreLock(root, directory, run, waitMs = 5e3, label = "Mason
       }
       if (error.code !== "EEXIST") throw error;
       try {
-        const owner = JSON.parse(await fs4.readFile(file, "utf8"));
+        const owner = lockOwnerSchema.parse(JSON.parse(await fs4.readFile(file, "utf8")));
         if (owner.host === os.hostname() && Number.isInteger(owner.pid) && owner.pid > 0) {
           try {
             process.kill(owner.pid, 0);
@@ -507,7 +719,7 @@ async function withStoreLock(root, directory, run, waitMs = 5e3, label = "Mason
               let guard;
               try {
                 guard = await fs4.open(reclaim, "wx", 384);
-                const current = JSON.parse(await fs4.readFile(file, "utf8"));
+                const current = lockOwnerSchema.parse(JSON.parse(await fs4.readFile(file, "utf8")));
                 if (current.pid === owner.pid && current.host === owner.host) await fs4.unlink(file);
               } finally {
                 if (guard) {
@@ -520,7 +732,11 @@ async function withStoreLock(root, directory, run, waitMs = 5e3, label = "Mason
         }
       } catch {
       }
-      if (Date.now() >= deadline) throw new Error(label + " is busy or its lock needs inspection: " + file + ". " + await lockDiagnostic(file));
+      if (Date.now() >= deadline)
+        throw new Error(
+          label + " is busy or its lock needs inspection: " + file + ". " + await lockDiagnostic(file),
+          { cause: error }
+        );
       await new Promise((resolve) => setTimeout(resolve, 40));
     }
     if (handle) {
@@ -542,10 +758,12 @@ async function withStoreLock(root, directory, run, waitMs = 5e3, label = "Mason
     await fs4.unlink(file);
   }
 }
+var lockOwnerSchema;
 var init_store_lock = __esm({
   "src/utils/store-lock.ts"() {
     "use strict";
     init_storage();
+    lockOwnerSchema = z.object({ host: z.string(), pid: z.number().int().positive() });
   }
 });
 
@@ -557,18 +775,8 @@ var init_lock = __esm({
   }
 });
 
-// src/test-map.ts
-import path6 from "path";
-var init_test_map = __esm({
-  "src/test-map.ts"() {
-    "use strict";
-    init_files();
-  }
-});
-
 // src/snapshot/snapshot.ts
-import path7 from "path";
-import { z } from "zod";
+import { z as z2 } from "zod";
 async function getCurrentGitHash(rootDir) {
   try {
     const { stdout } = await execGit(["rev-parse", "HEAD"], {
@@ -585,42 +793,40 @@ var init_snapshot = __esm({
     "use strict";
     init_git_read();
     init_files();
-    init_files();
     init_storage();
     init_lock();
     init_paths();
-    init_test_map();
-    repoPath = z.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
+    repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
     verificationFields = {
-      refreshedHash: z.string().optional(),
-      verifiedAt: z.string().optional(),
-      verifiedHash: z.string().optional(),
-      verificationToken: z.string().optional(),
-      verificationFailed: z.boolean().optional(),
-      verificationNote: z.string().optional()
+      refreshedHash: z2.string().optional(),
+      verifiedAt: z2.string().optional(),
+      verifiedHash: z2.string().optional(),
+      verificationToken: z2.string().optional(),
+      verificationFailed: z2.boolean().optional(),
+      verificationNote: z2.string().optional()
     };
-    featureSchema = z.object({
-      description: z.string(),
-      files: z.array(repoPath),
-      tests: z.array(repoPath).optional(),
-      type: z.enum(["capability", "infrastructure"]).optional(),
+    featureSchema = z2.object({
+      description: z2.string(),
+      files: z2.array(repoPath),
+      tests: z2.array(repoPath).optional(),
+      type: z2.enum(["capability", "infrastructure"]).optional(),
       ...verificationFields
     }).passthrough();
-    flowSchema = z.object({ description: z.string(), chain: z.array(repoPath), ...verificationFields }).passthrough();
-    snapshotSchema = z.object({
-      version: z.literal(2),
-      createdAt: z.string(),
-      updatedAt: z.string(),
-      gitHash: z.string(),
-      features: z.record(featureSchema),
-      flows: z.record(flowSchema)
+    flowSchema = z2.object({ description: z2.string(), chain: z2.array(repoPath), ...verificationFields }).passthrough();
+    snapshotSchema = z2.object({
+      version: z2.literal(2),
+      createdAt: z2.string(),
+      updatedAt: z2.string(),
+      gitHash: z2.string(),
+      features: z2.record(featureSchema),
+      flows: z2.record(flowSchema)
     }).passthrough();
   }
 });
 
 // src/drift/drift.ts
 import fs5 from "fs/promises";
-import path8 from "path";
+import path6 from "path";
 function parseChanges(output) {
   const fields = output.split("\0");
   const changes = [];
@@ -630,18 +836,25 @@ function parseChanges(output) {
     if (!first) break;
     const second = /^[RC]/.test(code) ? fields[i++] : void 0;
     const change = second ? code.startsWith("R") ? { status: "renamed", path: second, previousPath: first } : { status: "added", path: second } : { status: code === "A" ? "added" : code === "D" ? "deleted" : "modified", path: first };
-    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/"))) continue;
+    if (change.path.startsWith(".mason/") && (!change.previousPath || change.previousPath.startsWith(".mason/")))
+      continue;
     changes.push(change);
   }
   return changes;
 }
 function touchedPaths(changes) {
-  return [...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))].sort();
+  return [
+    ...new Set(changes.flatMap((c) => c.previousPath ? [c.previousPath, c.path] : [c.path]))
+  ].sort();
 }
 async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
-  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-")) return null;
+  if (!fromHash || fromHash === "unknown" || fromHash.startsWith("-") || !toHash || toHash === "unknown" || toHash.startsWith("-"))
+    return null;
   try {
-    const { stdout } = await execGit(["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 });
+    const { stdout } = await execGit(
+      ["diff", "--name-status", "-z", "-M", fromHash, toHash, "--"],
+      { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }
+    );
     return parseChanges(stdout);
   } catch {
     return null;
@@ -650,11 +863,23 @@ async function getChangesWithStatus(resolvedRoot, fromHash, toHash = "HEAD") {
 async function getWorkingTree(resolvedRoot) {
   try {
     const [diff, untracked] = await Promise.all([
-      execGit(["diff", "--name-status", "-z", "-M", "HEAD", "--"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 }),
-      execGit(["ls-files", "-z", "--others", "--exclude-standard"], { cwd: resolvedRoot, maxBuffer: 10 * 1024 * 1024 })
+      execGit(["diff", "--name-status", "-z", "-M", "HEAD", "--"], {
+        cwd: resolvedRoot,
+        maxBuffer: 10 * 1024 * 1024
+      }),
+      execGit(["ls-files", "-z", "--others", "--exclude-standard"], {
+        cwd: resolvedRoot,
+        maxBuffer: 10 * 1024 * 1024
+      })
     ]);
     const untrackedFiles = untracked.stdout.split("\0").filter((f) => f && !f.startsWith(".mason/"));
-    return { available: true, changedFiles: [.../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])].sort(), untrackedFiles };
+    return {
+      available: true,
+      changedFiles: [
+        .../* @__PURE__ */ new Set([...touchedPaths(parseChanges(diff.stdout)), ...untrackedFiles])
+      ].sort(),
+      untrackedFiles
+    };
   } catch {
     return { available: false, changedFiles: [], untrackedFiles: [] };
   }
@@ -669,7 +894,7 @@ var init_drift = __esm({
 });
 
 // src/audit/commands.ts
-import path9 from "path";
+import path7 from "path";
 function splitCommands(line) {
   const parts = [];
   let quote = "", start = 0;
@@ -705,7 +930,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
     const cd = text2.match(/^cd\s+(.+)$/);
     if (cd) {
       const directory = literal(cd[1]);
-      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path9.posix.join(cwd ?? ".", directory);
+      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path7.posix.join(cwd ?? ".", directory);
       continue;
     }
     for (const match of text2.matchAll(COMMAND)) {
@@ -713,13 +938,16 @@ function commandClaims(line, lineNo, cwd, shell = false) {
       const selector = flags.match(/^(?:--prefix|--dir|-C)(?:\s+|=)(.+)$/);
       let directory = cwd;
       let scopeUnknown;
-      if (shell && match.index !== 0 || match[3].startsWith("-")) scopeUnknown = "Unsupported shell wrapper or options before the script.";
+      if (shell && match.index !== 0 || match[3].startsWith("-"))
+        scopeUnknown = "Unsupported shell wrapper or options before the script.";
       if (selector) {
         const selected = literal(selector[1]);
-        directory = selected === null || cwd === null ? null : path9.posix.join(cwd ?? ".", selected);
+        directory = selected === null || cwd === null ? null : path7.posix.join(cwd ?? ".", selected);
       } else if (flags) scopeUnknown = "Unsupported package-manager options before run: " + flags;
       const tail = text2.slice(match.index + match[0].length).split(/\s--(?:\s|$)/)[0];
-      if (/(?:^|\s)(?:--workspace(?:s)?|-w|--filter|-F|--prefix|--dir|-C|--if-present)(?:\s|=|$)/.test(tail)) {
+      if (/(?:^|\s)(?:--workspace(?:s)?|-w|--filter|-F|--prefix|--dir|-C|--if-present)(?:\s|=|$)/.test(
+        tail
+      )) {
         scopeUnknown = "Package selection or conditional options after the script need review.";
       }
       if (/[|()]/.test(text2) || /\b(?:pushd|popd|if|for|while)\b/.test(text2) || directory === null) {
@@ -743,10 +971,13 @@ var init_commands = __esm({
   "src/audit/commands.ts"() {
     "use strict";
     TOKEN = `(?:"[^"\\n]*"|'[^'\\n]*'|[^\\s\`;&|]+)`;
-    COMMAND = new RegExp(`\\b(npm|pnpm|yarn)((?:[ \\t]+${TOKEN})*?)[ \\t]+run[ \\t]+([A-Za-z0-9:_.-]+)`, "g");
+    COMMAND = new RegExp(
+      `\\b(npm|pnpm|yarn)((?:[ \\t]+${TOKEN})*?)[ \\t]+run[ \\t]+([A-Za-z0-9:_.-]+)`,
+      "g"
+    );
     literal = (value) => {
       const unquoted = value.replace(/^(["'])(.*)\1$/, "$2");
-      return /[$`*?\[\]{}~\\\x00-\x1f]/.test(unquoted) || path9.posix.isAbsolute(unquoted) ? null : unquoted;
+      return /[$`*?[\]{}~\\\x00-\x1f]/.test(unquoted) || path7.posix.isAbsolute(unquoted) ? null : unquoted;
     };
   }
 });
@@ -806,11 +1037,7 @@ function extractTreeClaims(blockLines, blockStartLine) {
     }
     const isDir = name.endsWith("/");
     const cleanName = name.replace(/\/+$/, "");
-    const segments = [
-      ...rootPrefix ? [rootPrefix] : [],
-      ...stack.map((s) => s.name),
-      cleanName
-    ];
+    const segments = [...rootPrefix ? [rootPrefix] : [], ...stack.map((s) => s.name), cleanName];
     claims.push({
       path: segments.join("/"),
       line: blockStartLine + i,
@@ -907,7 +1134,7 @@ function extractClaims(content) {
     let line = token.map[0] + 1;
     for (const child of token.children ?? []) {
       const target = child.type === "link_open" ? child.attrGet("href") : child.type === "image" ? child.attrGet("src") : null;
-      if (target && !/^(?:[a-z][a-z0-9+.-]*:|[\/#~])/i.test(target)) {
+      if (target && !/^(?:[a-z][a-z0-9+.-]*:|[/#~])/i.test(target)) {
         let pathname = null;
         try {
           pathname = decodeURIComponent(target.split(/[?#]/)[0]);
@@ -993,9 +1220,11 @@ function extractClaims(content) {
       });
     }
     for (const match of line.matchAll(/`([^`]+)`/g)) {
-      for (const claim of commandClaims(match[1], lineNo, void 0, true).claims) addCommand(claim);
+      for (const claim of commandClaims(match[1], lineNo, void 0, true).claims)
+        addCommand(claim);
     }
-    for (const claim of commandClaims(line.replace(/`[^`]+`/g, ""), lineNo).claims) addCommand(claim);
+    for (const claim of commandClaims(line.replace(/`[^`]+`/g, ""), lineNo).claims)
+      addCommand(claim);
   }
   if (inFence) processBlock();
   return {
@@ -1072,14 +1301,7 @@ async function lastCommitOf(resolvedRoot, relPath) {
 async function deletingCommitOf(resolvedRoot, relPath) {
   try {
     const { stdout } = await inspectionGit(
-      [
-        "log",
-        "-1",
-        "--diff-filter=D",
-        `--format=${COMMIT_FORMAT}`,
-        "--",
-        `:(literal)${relPath}`
-      ],
+      ["log", "-1", "--diff-filter=D", `--format=${COMMIT_FORMAT}`, "--", `:(literal)${relPath}`],
       { cwd: resolvedRoot }
     );
     const line = stdout.trim().split("\n")[0];
@@ -1138,7 +1360,7 @@ var init_git = __esm({
 
 // src/audit/docs.ts
 import fs6 from "fs/promises";
-import path10 from "path";
+import path8 from "path";
 import fg5 from "fast-glob";
 async function dirtyDocs(resolvedRoot, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
@@ -1146,7 +1368,14 @@ async function dirtyDocs(resolvedRoot, files) {
     const dirty = /* @__PURE__ */ new Set();
     for (let offset = 0; offset < files.length; offset += 256) {
       const { stdout } = await execGit(
-        ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...files.slice(offset, offset + 256).map((file) => `:(literal)${file}`)],
+        [
+          "status",
+          "--porcelain=v1",
+          "-z",
+          "--untracked-files=all",
+          "--",
+          ...files.slice(offset, offset + 256).map((file) => `:(literal)${file}`)
+        ],
         { cwd: resolvedRoot, maxBuffer: 16 * 1024 * 1024, timeout: 1e4 }
       );
       const entries = stdout.split("\0");
@@ -1163,7 +1392,7 @@ async function dirtyDocs(resolvedRoot, files) {
   }
 }
 async function discoverDocPaths(root) {
-  let candidates = [];
+  let candidates;
   try {
     candidates = await auditGitPaths(root, "documents");
   } catch (error) {
@@ -1191,15 +1420,26 @@ async function discoverDocPaths(root) {
   const paths = [];
   const unique = [...new Set(candidates)].sort();
   for (let offset = 0; offset < unique.length; offset += 256) {
-    paths.push(...await auditGlob(root, unique.slice(offset, offset + 256).map((p) => fg5.escapePath(p)), {
-      ignore: excluded,
-      followSymbolicLinks: false,
-      label: "Documentation discovery"
-    }));
-    if (paths.length > 1e4) throw new Error("Documentation discovery exceeds 10,000 relevant files; narrow .mason/config.json ignore patterns.");
+    paths.push(
+      ...await auditGlob(
+        root,
+        unique.slice(offset, offset + 256).map((p) => fg5.escapePath(p)),
+        {
+          ignore: excluded,
+          followSymbolicLinks: false,
+          label: "Documentation discovery"
+        }
+      )
+    );
+    if (paths.length > 1e4)
+      throw new Error(
+        "Documentation discovery exceeds 10,000 relevant files; narrow .mason/config.json ignore patterns."
+      );
   }
   const priority = (file) => {
-    const index = DOC_CANDIDATES.findIndex((p) => p.toLowerCase() === file.toLowerCase());
+    const index = DOC_CANDIDATES.findIndex(
+      (p) => p.toLowerCase() === file.toLowerCase()
+    );
     return index < 0 ? DOC_CANDIDATES.length : index;
   };
   return paths.sort((a, b) => priority(a) - priority(b) || a.localeCompare(b));
@@ -1214,16 +1454,17 @@ async function localDocPaths(root) {
       if (error.code === "ENOENT") continue;
       throw error;
     }
-    for (const entry of entries) if (/^(?:agents|claude|readme)\.md$/i.test(entry.name)) {
-      paths.push(path10.posix.join(dir, entry.name));
-    }
+    for (const entry of entries)
+      if (/^(?:agents|claude|readme)\.md$/i.test(entry.name)) {
+        paths.push(path8.posix.join(dir, entry.name));
+      }
   }
   return paths;
 }
 function documentScope(file) {
-  if (!/^(readme|agents|claude)\.md$/i.test(path10.posix.basename(file))) return ".";
-  const parent = path10.posix.dirname(file);
-  return path10.posix.basename(parent).toLowerCase() === ".claude" ? path10.posix.dirname(parent) : parent;
+  if (!/^(readme|agents|claude)\.md$/i.test(path8.posix.basename(file))) return ".";
+  const parent = path8.posix.dirname(file);
+  return path8.posix.basename(parent).toLowerCase() === ".claude" ? path8.posix.dirname(parent) : parent;
 }
 async function discoverDocs(resolvedRoot) {
   return profilePhase("audit.documents", () => readDocs(resolvedRoot));
@@ -1233,23 +1474,28 @@ async function readDocs(resolvedRoot) {
   const files = await discoverDocPaths(resolvedRoot);
   const dirty = await dirtyDocs(resolvedRoot, files);
   for (let offset = 0; offset < files.length; offset += 4) {
-    docs.push(...await Promise.all(files.slice(offset, offset + 4).map(async (candidate) => {
-      const [content, lastCommit] = await Promise.all([
-        readAuditInput(resolvedRoot, candidate),
-        profilePhase("audit.document-history", () => lastCommitOf(resolvedRoot, candidate))
-      ]);
-      if (content === null) throw new Error("Document disappeared during discovery: " + candidate);
-      return {
-        path: candidate,
-        content,
-        scope: documentScope(candidate),
-        kind: /^readme\.md$/i.test(path10.posix.basename(candidate)) ? "readme" : /^(agents|claude)\.md$/i.test(path10.posix.basename(candidate)) ? "instructions" : "guide",
-        lineCount: content.split("\n").length,
-        lastCommit,
-        dirty: dirty.has(candidate),
-        claims: extractClaims(content)
-      };
-    })));
+    docs.push(
+      ...await Promise.all(
+        files.slice(offset, offset + 4).map(async (candidate) => {
+          const [content, lastCommit] = await Promise.all([
+            readAuditInput(resolvedRoot, candidate),
+            profilePhase("audit.document-history", () => lastCommitOf(resolvedRoot, candidate))
+          ]);
+          if (content === null)
+            throw new Error("Document disappeared during discovery: " + candidate);
+          return {
+            path: candidate,
+            content,
+            scope: documentScope(candidate),
+            kind: /^readme\.md$/i.test(path8.posix.basename(candidate)) ? "readme" : /^(agents|claude)\.md$/i.test(path8.posix.basename(candidate)) ? "instructions" : "guide",
+            lineCount: content.split("\n").length,
+            lastCommit,
+            dirty: dirty.has(candidate),
+            claims: extractClaims(content)
+          };
+        })
+      )
+    );
   }
   return docs;
 }
@@ -1264,24 +1510,21 @@ var init_docs = __esm({
     init_inputs();
     init_files();
     init_inspection();
-    DOC_CANDIDATES = [
-      "AGENTS.md",
-      "CLAUDE.md",
-      ".claude/CLAUDE.md"
-    ];
+    DOC_CANDIDATES = ["AGENTS.md", "CLAUDE.md", ".claude/CLAUDE.md"];
   }
 });
 
 // src/audit/scope.ts
 import fs7 from "fs/promises";
-import path11 from "path";
+import path9 from "path";
 function scopedPath(directory, value) {
-  if (path11.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value)) return null;
-  const resolved = path11.posix.normalize(path11.posix.join(directory, value));
+  if (path9.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value))
+    return null;
+  const resolved = path9.posix.normalize(path9.posix.join(directory, value));
   return resolved === ".." || resolved.startsWith("../") ? null : resolved;
 }
 function pathClaimScope(doc, claim) {
-  const directory = claim.relativeTo === "document" ? path11.posix.dirname(doc) : documentScope(doc);
+  const directory = claim.relativeTo === "document" ? path9.posix.dirname(doc) : documentScope(doc);
   const local = scopedPath(directory, claim.path);
   if (!local) return null;
   const candidates = claim.relativeTo === "document" || directory === "." ? [local] : [...new Set([local, scopedPath(".", claim.path)].filter((p) => p !== null))];
@@ -1315,12 +1558,14 @@ var init_scope = __esm({
 });
 
 // src/audit/checks/deleted-reference.ts
-import path12 from "path";
+import path10 from "path";
 async function checkDeletedReferences(ctx) {
   const result = emptyResult();
   for (const doc of ctx.docs) {
     const changes = ctx.changesSinceDoc.get(doc.path);
-    const renames = new Map((changes ?? []).filter((c) => c.status === "renamed" && c.previousPath).map((c) => [c.previousPath, c.path]));
+    const renames = new Map(
+      (changes ?? []).filter((c) => c.status === "renamed" && c.previousPath).map((c) => [c.previousPath, c.path])
+    );
     for (const claim of doc.claims.paths) {
       const scope = pathClaimScope(doc.path, claim);
       if (!scope) {
@@ -1340,12 +1585,17 @@ async function checkDeletedReferences(ctx) {
         });
         continue;
       }
-      if ((await Promise.all(scope.candidates.map((file) => pathExists(ctx.root, file)))).some(Boolean)) continue;
-      const candidates = await Promise.all(scope.candidates.map(async (file) => ({
-        file,
-        tracked: await lastCommitOf(ctx.root, file),
-        parent: await pathExists(ctx.root, path12.posix.dirname(file))
-      })));
+      if ((await Promise.all(scope.candidates.map((file) => pathExists(ctx.root, file)))).some(
+        Boolean
+      ))
+        continue;
+      const candidates = await Promise.all(
+        scope.candidates.map(async (file) => ({
+          file,
+          tracked: await lastCommitOf(ctx.root, file),
+          parent: await pathExists(ctx.root, path10.posix.dirname(file))
+        }))
+      );
       const candidate = candidates.find((c) => c.tracked || renames.has(c.file)) ?? candidates.find((c) => c.parent);
       if (!candidate && claim.relativeTo !== "document") continue;
       const resolvedPath = candidate?.file ?? scope.candidates[0];
@@ -1364,9 +1614,21 @@ async function checkDeletedReferences(ctx) {
       const anchor = { doc: doc.path, line: claim.line, excerpt: claim.excerpt };
       const message = renamedTo ? `\`${resolvedPath}\` was renamed to \`${renamedTo}\`` : `\`${resolvedPath}\` does not exist` + (deletedInCommit ? ` \u2013 deleted in ${deletedInCommit.hash.slice(0, 7)} "${deletedInCommit.subject}" (${deletedInCommit.date.slice(0, 10)})` : "");
       if (scope.basis !== "document" && (renamedTo || candidate?.tracked)) {
-        result.issues.push({ type: "deleted-reference", message, anchor, confidence: "certain", evidence });
+        result.issues.push({
+          type: "deleted-reference",
+          message,
+          anchor,
+          confidence: "certain",
+          evidence
+        });
       } else {
-        result.advisories.push({ resolution: "recheck", type: "deleted-reference", message: message + (scope.basis === "document" ? "; the bare path's document/repository scope needs review." : "; no tracked history establishes it as a required file. Review for a typo, generated output, or example."), anchor, evidence });
+        result.advisories.push({
+          resolution: "recheck",
+          type: "deleted-reference",
+          message: message + (scope.basis === "document" ? "; the bare path's document/repository scope needs review." : "; no tracked history establishes it as a required file. Review for a typo, generated output, or example."),
+          anchor,
+          evidence
+        });
       }
     }
   }
@@ -1384,15 +1646,12 @@ var init_deleted_reference = __esm({
 // src/audit/checks/new-module.ts
 import fg6 from "fast-glob";
 import fs8 from "fs/promises";
-import path13 from "path";
+import path11 from "path";
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function isMentioned(combinedDocs, name) {
-  const re = new RegExp(
-    `(^|[^A-Za-z0-9_-])${escapeRegExp(name)}(/|[^A-Za-z0-9_-]|$)`,
-    "im"
-  );
+  const re = new RegExp(`(^|[^A-Za-z0-9_-])${escapeRegExp(name)}(/|[^A-Za-z0-9_-]|$)`, "im");
   return re.test(combinedDocs);
 }
 async function checkNewModules(ctx) {
@@ -1422,34 +1681,57 @@ async function checkNewModules(ctx) {
   return result;
 }
 function moduleDocumentation(docs) {
-  return docs.map((doc) => doc.content + "\n" + (path13.posix.dirname(doc.path) === "." ? "" : path13.posix.dirname(doc.path) + "/")).join("\n");
+  return docs.map(
+    (doc) => doc.content + "\n" + (path11.posix.dirname(doc.path) === "." ? "" : path11.posix.dirname(doc.path) + "/")
+  ).join("\n");
 }
 function moduleCandidates(root, combinedDocs) {
-  return inspectionRead(root, "modules:" + combinedDocs, () => collectModuleCandidates(root, combinedDocs));
+  return inspectionRead(
+    root,
+    "modules:" + combinedDocs,
+    () => collectModuleCandidates(root, combinedDocs)
+  );
 }
 async function collectModuleCandidates(root, combinedDocs) {
   const [config, sourcePaths] = await Promise.all([loadProjectConfig(root), gitSourcePaths(root)]);
   const ignore = [...SOURCE_IGNORE, ...config.ignore ?? []];
-  const sources = sourcePaths.filter((file) => !file.split("/").some((part) => part.startsWith(".")));
+  const sources = sourcePaths.filter(
+    (file) => !file.split("/").some((part) => part.startsWith("."))
+  );
   const listSubdirs = async (parents) => {
     const byParent = /* @__PURE__ */ new Map();
     for (let offset = 0; offset < parents.length; offset += 16) {
-      await Promise.all(parents.slice(offset, offset + 16).map(async (dir) => {
-        const entries = await fs8.readdir(await auditInputPath(root, dir), { withFileTypes: true });
-        const dirs = entries.filter((entry) => (entry.isDirectory() || entry.isSymbolicLink() && sources.some((file) => file.startsWith(path13.posix.join(dir, entry.name) + "/"))) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)).map((entry) => path13.posix.join(dir, entry.name));
-        byParent.set(dir, dirs);
-      }));
+      await Promise.all(
+        parents.slice(offset, offset + 16).map(async (dir) => {
+          const entries = await fs8.readdir(await auditInputPath(root, dir), {
+            withFileTypes: true
+          });
+          const dirs = entries.filter(
+            (entry) => (entry.isDirectory() || entry.isSymbolicLink() && sources.some(
+              (file) => file.startsWith(path11.posix.join(dir, entry.name) + "/")
+            )) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)
+          ).map((entry) => path11.posix.join(dir, entry.name));
+          byParent.set(dir, dirs);
+        })
+      );
     }
     const ignored = await gitIgnoredPaths(root, [...byParent.values()].flat());
     const result = /* @__PURE__ */ new Map();
     for (const dir of parents) {
-      const visible = new Set(byParent.get(dir).filter((candidate) => !ignored.has(candidate) || sources.some((file) => file.startsWith(candidate + "/"))));
-      result.set(dir, (await auditGlob(root, dir === "." ? "*" : `${fg6.escapePath(dir)}/*`, {
-        ignore,
-        onlyDirectories: true,
-        label: "Module directory discovery",
-        select: (file) => visible.has(file)
-      })).map((file) => path13.posix.basename(file)));
+      const visible = new Set(
+        byParent.get(dir).filter(
+          (candidate) => !ignored.has(candidate) || sources.some((file) => file.startsWith(candidate + "/"))
+        )
+      );
+      result.set(
+        dir,
+        (await auditGlob(root, dir === "." ? "*" : `${fg6.escapePath(dir)}/*`, {
+          ignore,
+          onlyDirectories: true,
+          label: "Module directory discovery",
+          select: (file) => visible.has(file)
+        })).map((file) => path11.posix.basename(file))
+      );
     }
     return result;
   };
@@ -1457,12 +1739,19 @@ async function collectModuleCandidates(root, combinedDocs) {
     const files = sources.filter((file) => file.startsWith(dir + "/"));
     let count3 = 0;
     for (let offset = 0; offset < files.length; offset += 256) {
-      count3 += (await auditGlob(root, files.slice(offset, offset + 256).map((file) => fg6.escapePath(file)), {
-        ignore,
-        followSymbolicLinks: false,
-        label: `Source discovery in ${dir}`
-      })).length;
-      if (count3 > 1e5) throw new Error(`Source discovery in ${dir} exceeds 100,000 relevant files. Exclude generated source with .mason/config.json ignore patterns or narrow this audit's checks.`);
+      count3 += (await auditGlob(
+        root,
+        files.slice(offset, offset + 256).map((file) => fg6.escapePath(file)),
+        {
+          ignore,
+          followSymbolicLinks: false,
+          label: `Source discovery in ${dir}`
+        }
+      )).length;
+      if (count3 > 1e5)
+        throw new Error(
+          `Source discovery in ${dir} exceeds 100,000 relevant files. Exclude generated source with .mason/config.json ignore patterns or narrow this audit's checks.`
+        );
     }
     return count3;
   };
@@ -1523,7 +1812,7 @@ var init_new_module = __esm({
 });
 
 // src/audit/checks/stale-count.ts
-import path14 from "path";
+import path12 from "path";
 async function countGradleModules(root) {
   for (const name of ["settings.gradle.kts", "settings.gradle"]) {
     const content = await readAuditInput(root, name);
@@ -1545,7 +1834,10 @@ async function countNpmWorkspaces(root) {
     let globs = [];
     try {
       const pkg = JSON.parse(pkgRaw);
-      globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : Array.isArray(pkg.workspaces?.packages) ? pkg.workspaces.packages : [];
+      if (!isRecord(pkg)) return null;
+      const workspaces = isRecord(pkg.workspaces) ? pkg.workspaces.packages : pkg.workspaces;
+      if (workspaces !== void 0 && !isStringArray(workspaces)) return null;
+      globs = workspaces ?? [];
     } catch {
     }
     if (globs.length > 0) {
@@ -1557,7 +1849,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "package.json workspaces",
-        members: matched.map((m) => path14.dirname(m)).sort()
+        members: matched.map((m) => path12.dirname(m)).sort()
       };
     }
   }
@@ -1588,7 +1880,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "pnpm-workspace.yaml",
-        members: matched.map((m) => path14.dirname(m)).sort()
+        members: matched.map((m) => path12.dirname(m)).sort()
       };
     }
   }
@@ -1599,9 +1891,7 @@ async function countCargoCrates(root) {
   if (content === null) return null;
   const membersBlock = content.match(/members\s*=\s*\[([\s\S]*?)\]/);
   if (!membersBlock) return null;
-  const entries = [...membersBlock[1].matchAll(/["']([^"']+)["']/g)].map(
-    (m) => m[1]
-  );
+  const entries = [...membersBlock[1].matchAll(/["']([^"']+)["']/g)].map((m) => m[1]);
   if (entries.length === 0) return null;
   const members = /* @__PURE__ */ new Set();
   for (const entry of entries) {
@@ -1610,8 +1900,8 @@ async function countCargoCrates(root) {
         ignore: ["**/target/**"],
         label: "Cargo workspace discovery"
       });
-      for (const m of matched) members.add(path14.dirname(m));
-    } else if (await readAuditInput(root, path14.posix.join(entry, "Cargo.toml")) !== null) {
+      for (const m of matched) members.add(path12.dirname(m));
+    } else if (await readAuditInput(root, path12.posix.join(entry, "Cargo.toml")) !== null) {
       members.add(entry);
     }
   }
@@ -1631,7 +1921,7 @@ async function resolveCountSource(root, claim) {
 }
 async function resolveDocCountSource(root, doc, claim) {
   const scope = documentScope(doc);
-  const source = await resolveCountSource(path14.join(root, scope), claim);
+  const source = await resolveCountSource(path12.join(root, scope), claim);
   if (!source || scope === ".") return source;
   return {
     ...source,
@@ -1675,6 +1965,7 @@ var MEMBERS_CAP;
 var init_stale_count = __esm({
   "src/audit/checks/stale-count.ts"() {
     "use strict";
+    init_validation();
     init_docs();
     init_inputs();
     init_checks();
@@ -1683,13 +1974,13 @@ var init_stale_count = __esm({
 });
 
 // src/audit/checks/dead-command.ts
-import path15 from "path";
+import path13 from "path";
 function scriptsOf(raw) {
   try {
     const pkg = JSON.parse(raw);
-    if (!pkg || typeof pkg !== "object" || Array.isArray(pkg)) return null;
+    if (!isRecord(pkg)) return null;
     if (pkg.scripts === void 0) return [];
-    return pkg.scripts && typeof pkg.scripts === "object" && !Array.isArray(pkg.scripts) && Object.values(pkg.scripts).every((value) => typeof value === "string") ? Object.keys(pkg.scripts) : null;
+    return isRecord(pkg.scripts) && Object.values(pkg.scripts).every((value) => typeof value === "string") ? Object.keys(pkg.scripts) : null;
   } catch {
     return null;
   }
@@ -1703,50 +1994,60 @@ async function commandInputs(root, docs) {
   await read("package.json");
   let inventory;
   const resolutions = [];
-  for (const doc of docs) for (const claim of doc.claims.commands) {
-    const base = documentScope(doc.path);
-    const directory = scopedPath(base, claim.directory ?? ".");
-    const scope = {
-      basis: claim.directory === void 0 ? "document" : "explicit",
-      directory: directory ?? base,
-      candidates: []
-    };
-    const resolution = { doc: doc.path, claim, scope, manifest: null, scripts: [], elsewhere: [] };
-    resolutions.push(resolution);
-    if (claim.scopeUnknown || directory === null) {
-      resolution.problem = claim.scopeUnknown ?? "The command's directory leaves the repository.";
-      continue;
-    }
-    let cursor = directory;
-    while (true) {
-      const manifest = path15.posix.join(cursor, "package.json");
-      scope.candidates.push(manifest);
-      const raw = await read(manifest);
-      if (raw !== null) {
-        resolution.manifest = manifest;
+  for (const doc of docs)
+    for (const claim of doc.claims.commands) {
+      const base = documentScope(doc.path);
+      const directory = scopedPath(base, claim.directory ?? ".");
+      const scope = {
+        basis: claim.directory === void 0 ? "document" : "explicit",
+        directory: directory ?? base,
+        candidates: []
+      };
+      const resolution = {
+        doc: doc.path,
+        claim,
+        scope,
+        manifest: null,
+        scripts: [],
+        elsewhere: []
+      };
+      resolutions.push(resolution);
+      if (claim.scopeUnknown || directory === null) {
+        resolution.problem = claim.scopeUnknown ?? "The command's directory leaves the repository.";
+        continue;
+      }
+      let cursor = directory;
+      while (true) {
+        const manifest = path13.posix.join(cursor, "package.json");
+        scope.candidates.push(manifest);
+        const raw = await read(manifest);
+        if (raw !== null) {
+          resolution.manifest = manifest;
+          const scripts = scriptsOf(raw);
+          if (scripts === null) resolution.problem = "Invalid package manifest: " + manifest;
+          else resolution.scripts = scripts;
+          break;
+        }
+        if (claim.directory !== void 0 || cursor === ".") break;
+        cursor = path13.posix.dirname(cursor);
+      }
+      if (!resolution.manifest && !resolution.problem) {
+        resolution.problem = `No package.json for the command's scope (${directory}).`;
+      }
+      if (resolution.problem || resolution.scripts.includes(claim.scriptName) || claim.directory !== void 0)
+        continue;
+      inventory ??= await commandManifests(root);
+      for (const manifest of [.../* @__PURE__ */ new Set(["package.json", ...inventory])].sort()) {
+        if (scope.candidates.includes(manifest)) continue;
+        scope.candidates.push(manifest);
+        const raw = await read(manifest);
+        if (raw === null) continue;
         const scripts = scriptsOf(raw);
-        if (scripts === null) resolution.problem = "Invalid package manifest: " + manifest;
-        else resolution.scripts = scripts;
-        break;
+        if (scripts === null)
+          resolution.problem = "Cannot establish script availability: invalid manifest " + manifest;
+        else if (scripts.includes(claim.scriptName)) resolution.elsewhere.push(manifest);
       }
-      if (claim.directory !== void 0 || cursor === ".") break;
-      cursor = path15.posix.dirname(cursor);
-    }
-    if (!resolution.manifest && !resolution.problem) {
-      resolution.problem = `No package.json for the command's scope (${directory}).`;
-    }
-    if (resolution.problem || resolution.scripts.includes(claim.scriptName) || claim.directory !== void 0) continue;
-    inventory ??= await commandManifests(root);
-    for (const manifest of [.../* @__PURE__ */ new Set(["package.json", ...inventory])].sort()) {
-      if (scope.candidates.includes(manifest)) continue;
-      scope.candidates.push(manifest);
-      const raw = await read(manifest);
-      if (raw === null) continue;
-      const scripts = scriptsOf(raw);
-      if (scripts === null) resolution.problem = "Cannot establish script availability: invalid manifest " + manifest;
-      else if (scripts.includes(claim.scriptName)) resolution.elsewhere.push(manifest);
     }
-  }
   return { manifests: [...contents].sort(([a], [b]) => a.localeCompare(b)), resolutions };
 }
 async function checkDeadCommands(ctx) {
@@ -1769,14 +2070,34 @@ async function checkDeadCommands(ctx) {
     const anchor = { doc, line: claim.line, excerpt: claim.excerpt };
     const message = `\`${claim.invocation}\` names script "${claim.scriptName}", which is absent from ${manifest}`;
     const certain = documentScope(doc) === "." && (scope.basis === "explicit" || !elsewhere.length);
-    if (certain) result.issues.push({ type: "dead-command", message, anchor, confidence: "certain", evidence });
-    else result.advisories.push({ resolution: "recheck", type: "dead-command", message: message + (elsewhere.length ? `; it exists in ${elsewhere.join(", ")}. Clarify the intended working directory.` : "; the intended working directory needs review."), anchor, evidence });
+    if (certain)
+      result.issues.push({
+        type: "dead-command",
+        message,
+        anchor,
+        confidence: "certain",
+        evidence
+      });
+    else
+      result.advisories.push({
+        resolution: "recheck",
+        type: "dead-command",
+        message: message + (elsewhere.length ? `; it exists in ${elsewhere.join(", ")}. Clarify the intended working directory.` : "; the intended working directory needs review."),
+        anchor,
+        evidence
+      });
   }
   return result;
 }
 function commandManifests(root) {
   return auditGlob(root, "**/package.json", {
-    ignore: ["**/node_modules/**", "**/dist/**", "**/build/**", ".mason/reports/**", "package.json"],
+    ignore: [
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/build/**",
+      ".mason/reports/**",
+      "package.json"
+    ],
     label: "Command manifest discovery"
   });
 }
@@ -1784,6 +2105,7 @@ var AVAILABLE_SCRIPTS_CAP;
 var init_dead_command = __esm({
   "src/audit/checks/dead-command.ts"() {
     "use strict";
+    init_validation();
     init_inputs();
     init_docs();
     init_scope();
@@ -1793,36 +2115,63 @@ var init_dead_command = __esm({
 });
 
 // src/audit/dependency-claims.ts
-import path16 from "path";
+import path14 from "path";
 import { parse as parseToml } from "smol-toml";
 function dependencyText(content) {
-  return content.replace(/<!-- mason:start -->[\s\S]*?<!-- mason:end -->/g, (text2) => text2.replace(/[^\n]/g, " ")).replace(/<!--[\s\S]*?-->/g, (text2) => text2.replace(/[^\n]/g, " "));
+  return content.replace(
+    /<!-- mason:start -->[\s\S]*?<!-- mason:end -->/g,
+    (text2) => text2.replace(/[^\n]/g, " ")
+  ).replace(/<!--[\s\S]*?-->/g, (text2) => text2.replace(/[^\n]/g, " "));
 }
 function declarations(file, source) {
   const result = /* @__PURE__ */ new Map();
   if (!source) return result;
-  if (path16.posix.basename(file) === "package.json") {
+  if (path14.posix.basename(file) === "package.json") {
     const json = JSON.parse(source);
-    for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies", "engines"]) {
-      for (const [name, value] of Object.entries(json[section] ?? {})) {
-        if (typeof value === "string") result.set(name, [...result.has(name) ? [result.get(name)] : [], value].join("; "));
+    if (!isRecord(json)) throw new Error("Invalid package manifest");
+    for (const section of [
+      "dependencies",
+      "devDependencies",
+      "peerDependencies",
+      "optionalDependencies",
+      "engines"
+    ]) {
+      const entries = json[section];
+      if (entries === void 0) continue;
+      if (!isRecord(entries) || !Object.values(entries).every((value) => typeof value === "string"))
+        throw new Error("Invalid dependency declarations: " + section);
+      for (const [name, value] of Object.entries(entries)) {
+        if (typeof value === "string")
+          result.set(name, [...result.has(name) ? [result.get(name)] : [], value].join("; "));
       }
     }
   } else if (file.endsWith("libs.versions.toml")) {
     const catalog = parseToml(source);
-    for (const section of ["libraries", "plugins"]) for (const [alias, entry] of Object.entries(catalog[section] ?? {})) {
-      if (typeof entry === "string") {
-        const parts = entry.split(":");
-        if (parts.length >= 3) result.set(parts.slice(0, -1).join(":"), parts.at(-1));
-      } else if (entry && typeof entry === "object") {
-        const name = entry.module ?? (entry.group && entry.name ? `${entry.group}:${entry.name}` : entry.id);
-        const version = typeof entry.version === "string" ? entry.version : catalog.versions?.[entry.version?.ref];
-        if (typeof name === "string") result.set(name, typeof version === "string" ? version : "unspecified");
+    const versions = catalog.versions;
+    for (const section of ["libraries", "plugins"]) {
+      const entries = catalog[section];
+      if (entries === void 0) continue;
+      if (!isRecord(entries)) throw new Error("Invalid version catalog: " + section);
+      for (const entry of Object.values(entries)) {
+        if (typeof entry === "string") {
+          const parts = entry.split(":");
+          if (parts.length >= 3) result.set(parts.slice(0, -1).join(":"), parts.at(-1));
+        } else if (isRecord(entry)) {
+          const name = entry.module ?? (typeof entry.group === "string" && typeof entry.name === "string" ? `${entry.group}:${entry.name}` : entry.id);
+          const version = typeof entry.version === "string" ? entry.version : isRecord(entry.version) && typeof entry.version.ref === "string" && isRecord(versions) ? versions[entry.version.ref] : void 0;
+          if (typeof name === "string")
+            result.set(name, typeof version === "string" ? version : "unspecified");
+          else throw new Error("Invalid version catalog entry");
+        } else throw new Error("Invalid version catalog entry");
       }
     }
   } else if (/build\.gradle(?:\.kts)?$/.test(file)) {
-    for (const match of source.matchAll(/["']([\w.-]+:[\w.-]+):([^"'\s]+)["']/g)) result.set(match[1], match[2]);
-    for (const match of source.matchAll(/\bid\s*\(?\s*["']([\w.-]+)["']\s*\)?\s*version\s*["']([^"']+)["']/g)) result.set(match[1], match[2]);
+    for (const match of source.matchAll(/["']([\w.-]+:[\w.-]+):([^"'\s]+)["']/g))
+      result.set(match[1], match[2]);
+    for (const match of source.matchAll(
+      /\bid\s*\(?\s*["']([\w.-]+)["']\s*\)?\s*version\s*["']([^"']+)["']/g
+    ))
+      result.set(match[1], match[2]);
   }
   return result;
 }
@@ -1837,17 +2186,28 @@ async function matchDependencyChanges(root, from, head, files, content) {
     }
     try {
       const read = async (revision) => {
-        const { stdout: entry } = await inspectionGit(["ls-tree", revision, "--", `:(literal)${file}`], { cwd: root, timeout: 1e4 });
+        const { stdout: entry } = await inspectionGit(
+          ["ls-tree", revision, "--", `:(literal)${file}`],
+          { cwd: root, timeout: 1e4 }
+        );
         if (!entry) return "";
-        if (!entry.startsWith("100644 ") && !entry.startsWith("100755 ")) throw new Error("Unsupported manifest mode");
-        return (await inspectionGit(["show", `${revision}:${file}`], { cwd: root, maxBuffer: 1024 * 1024, timeout: 1e4 })).stdout;
+        if (!entry.startsWith("100644 ") && !entry.startsWith("100755 "))
+          throw new Error("Unsupported manifest mode");
+        return (await inspectionGit(["show", `${revision}:${file}`], {
+          cwd: root,
+          maxBuffer: 1024 * 1024,
+          timeout: 1e4
+        })).stdout;
       };
       const [before, after] = await Promise.all([read(from), read(head)]);
       const old = declarations(file, before), next = declarations(file, after);
       for (const dependency of /* @__PURE__ */ new Set([...old.keys(), ...next.keys()])) {
         if (old.get(dependency) === next.get(dependency)) continue;
         const escaped = dependency.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-        const mention = new RegExp(`(^|[^a-zA-Z0-9_@./-])${escaped}(?![a-zA-Z0-9_/-]|\\.[a-zA-Z0-9_])`, "i");
+        const mention = new RegExp(
+          `(^|[^a-zA-Z0-9_@./-])${escaped}(?![a-zA-Z0-9_/-]|\\.[a-zA-Z0-9_])`,
+          "i"
+        );
         const line = lines.findIndex((text2) => mention.test(text2));
         if (line < 0) continue;
         matches.push({
@@ -1869,6 +2229,7 @@ async function matchDependencyChanges(root, from, head, files, content) {
 var init_dependency_claims = __esm({
   "src/audit/dependency-claims.ts"() {
     "use strict";
+    init_validation();
     init_inspection();
   }
 });
@@ -1878,15 +2239,23 @@ async function git(root, args) {
   return (await execGit(args, { cwd: root, timeout: 1e4, maxBuffer: 2 * 1024 * 1024 })).stdout;
 }
 function withoutAndroidReleaseValues(text2) {
-  if (/\/\*|"""|'''/.test(text2) || !/id\s*\(?\s*["']com\.android\.(application|library)["']/.test(text2)) return null;
+  if (/\/\*|"""|'''/.test(text2) || !/id\s*\(?\s*["']com\.android\.(application|library)["']/.test(text2))
+    return null;
   const scopes2 = [];
   const normalized = [];
   let assignments = 0;
   for (const line of text2.split("\n")) {
-    const code = line.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\/\/.*$/g, (token) => token.startsWith("//") ? "" : '""');
-    const assignment = line.match(/^(\s*)(versionName|versionCode)(\s*(?:=\s*|\s+))("[A-Za-z0-9._+-]+"|'[A-Za-z0-9._+-]+'|\d+)(\s*)$/);
+    const code = line.replace(
+      /"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\/\/.*$/g,
+      (token) => token.startsWith("//") ? "" : '""'
+    );
+    const assignment = line.match(
+      /^(\s*)(versionName|versionCode)(\s*(?:=\s*|\s+))("[A-Za-z0-9._+-]+"|'[A-Za-z0-9._+-]+'|\d+)(\s*)$/
+    );
     if (assignment && scopes2.join("/") === "android/defaultConfig" && (assignment[2] === "versionCode" ? /^\d+$/.test(assignment[4]) : /^["']/.test(assignment[4]))) {
-      normalized.push(assignment[1] + assignment[2] + assignment[3] + "<release-value>" + assignment[5]);
+      normalized.push(
+        assignment[1] + assignment[2] + assignment[3] + "<release-value>" + assignment[5]
+      );
       assignments++;
     } else {
       if (/\bversion(?:Name|Code)\b/.test(line)) return null;
@@ -1902,12 +2271,24 @@ function withoutAndroidReleaseValues(text2) {
   return assignments && !scopes2.length ? normalized.join("\n") : null;
 }
 async function releaseMetadataOnly(root, commit) {
-  if (!commit.files.length || !commit.files.every((file) => /(^|\/)build\.gradle(?:\.kts)?$/.test(file))) return false;
+  if (!commit.files.length || !commit.files.every((file) => /(^|\/)build\.gradle(?:\.kts)?$/.test(file)))
+    return false;
   try {
     const parents = (await git(root, ["rev-list", "--parents", "-n", "1", commit.hash])).trim().split(/\s+/);
     if (parents.length !== 2) return false;
     for (const file of commit.files) {
-      const raw = await git(root, ["diff", "--raw", "-z", "--no-renames", "--no-ext-diff", "--no-textconv", parents[1], commit.hash, "--", file]);
+      const raw = await git(root, [
+        "diff",
+        "--raw",
+        "-z",
+        "--no-renames",
+        "--no-ext-diff",
+        "--no-textconv",
+        parents[1],
+        commit.hash,
+        "--",
+        file
+      ]);
       if (!/^:(100644|100755) \1 [a-f0-9]+ [a-f0-9]+ M\0/.test(raw)) return false;
       const [before, after] = await Promise.all([
         git(root, ["show", parents[1] + ":" + file]),
@@ -1931,13 +2312,21 @@ var init_release_metadata = __esm({
 // src/audit/checks/deps-changed.ts
 function hasDependencyContent(content) {
   const text2 = content.replace(/<!-- mason:start -->[\s\S]*?<!-- mason:end -->/g, "").replace(/<!--[\s\S]*?-->/g, "");
-  return /\b(?:dependenc(?:y|ies)|librar(?:y|ies)|frameworks?|tech(?:nology)? stack|prerequisites|requirements)\b/i.test(text2) || /\b(?:package\.json|build\.gradle(?:\.kts)?|settings\.gradle(?:\.kts)?|libs\.versions\.toml|Cargo\.toml|go\.mod|pyproject\.toml|requirements\.txt|Gemfile|composer\.json)\b/i.test(text2) || /\b(?:node(?:\.js)?|npm|pnpm|yarn|bun|deno|python|ruby|rust|go|java|jdk|kotlin|gradle|swift|php|react|vue|angular|compose|ktor|room)\s*(?:version\s*)?[`*:=>~^v\s-]*\d+(?:\.\d+)*\b/i.test(text2) || /\b(?:npm|pnpm|yarn|pip3?|cargo|gem|composer)\s+(?:install|add|require)\b/i.test(text2);
+  return /\b(?:dependenc(?:y|ies)|librar(?:y|ies)|frameworks?|tech(?:nology)? stack|prerequisites|requirements)\b/i.test(
+    text2
+  ) || /\b(?:package\.json|build\.gradle(?:\.kts)?|settings\.gradle(?:\.kts)?|libs\.versions\.toml|Cargo\.toml|go\.mod|pyproject\.toml|requirements\.txt|Gemfile|composer\.json)\b/i.test(
+    text2
+  ) || /\b(?:node(?:\.js)?|npm|pnpm|yarn|bun|deno|python|ruby|rust|go|java|jdk|kotlin|gradle|swift|php|react|vue|angular|compose|ktor|room)\s*(?:version\s*)?[`*:=>~^v\s-]*\d+(?:\.\d+)*\b/i.test(
+    text2
+  ) || /\b(?:npm|pnpm|yarn|pip3?|cargo|gem|composer)\s+(?:install|add|require)\b/i.test(text2);
 }
 function manifestPathspecs(doc) {
   const scope = documentScope(doc);
   if (scope === ".") return MANIFEST_PATHSPECS;
-  const escaped = scope.replace(/[\\*?\[\]]/g, "\\$&");
-  return MANIFEST_PATHSPECS.map((spec) => spec.startsWith(":(glob)") ? ":(glob)" + escaped + "/" + spec.slice(":(glob)".length) : ":(literal)" + scope + "/" + spec);
+  const escaped = scope.replace(/[\\*?[\]]/g, "\\$&");
+  return MANIFEST_PATHSPECS.map(
+    (spec) => spec.startsWith(":(glob)") ? ":(glob)" + escaped + "/" + spec.slice(":(glob)".length) : ":(literal)" + scope + "/" + spec
+  );
 }
 async function checkDepsChanged(ctx) {
   const result = emptyResult();
@@ -1955,12 +2344,17 @@ async function checkDepsChanged(ctx) {
     let content = doc.content;
     if (doc.dirty) {
       try {
-        content = (await inspectionGit(
-          ["show", `${doc.lastCommit.hash}:${doc.path}`],
-          { cwd: ctx.root, maxBuffer: 10 * 1024 * 1024, timeout: 1e4 }
-        )).stdout;
+        content = (await inspectionGit(["show", `${doc.lastCommit.hash}:${doc.path}`], {
+          cwd: ctx.root,
+          maxBuffer: 10 * 1024 * 1024,
+          timeout: 1e4
+        })).stdout;
       } catch {
-        result.skipped.push({ check: "deps-changed", doc: doc.path, reason: `${doc.path}: committed dependency content is unavailable` });
+        result.skipped.push({
+          check: "deps-changed",
+          doc: doc.path,
+          reason: `${doc.path}: committed dependency content is unavailable`
+        });
         continue;
       }
     }
@@ -1996,11 +2390,12 @@ async function checkDepsChanged(ctx) {
     );
     if (!relevance.matches.length && !hasDependencyContent(content)) continue;
     const match = relevance.matches[0];
-    if (doc.dirty && match) result.skipped.push({
-      check: "deps-changed",
-      doc: doc.path,
-      reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
-    });
+    if (doc.dirty && match)
+      result.skipped.push({
+        check: "deps-changed",
+        doc: doc.path,
+        reason: `${doc.path} has uncommitted edits \u2013 suppressed while in flight`
+      });
     (doc.dirty ? result.suppressedAdvisories : result.advisories).push({
       type: "deps-changed",
       ...match ? {} : { resolution: "informational" },
@@ -2046,8 +2441,145 @@ var init_deps_changed = __esm({
   }
 });
 
+// src/decisions/anchors.ts
+import { createHash } from "crypto";
+import fs9 from "fs/promises";
+import { constants as constants2 } from "fs";
+import { z as z3 } from "zod";
+import fg7 from "fast-glob";
+async function captureAnchorScopes(root, scopes2) {
+  const union = [...new Set(scopes2.flat())].sort();
+  let context;
+  const prepareContext = async () => {
+    const access = await inspectionRead(
+      root,
+      "decision-anchor-access",
+      () => createFileAccess(root)
+    );
+    const inventory = access.inventory();
+    if (!inventory) throw new Error("Git anchor inventory unavailable");
+    const ignored = await inspectionGit(
+      [
+        "ls-files",
+        "-z",
+        "--others",
+        "--ignored",
+        "--exclude-standard",
+        "--",
+        ...union.map((anchor) => `:(literal)${anchor}`)
+      ],
+      { cwd: root, maxBuffer: 8 * 1024 * 1024 }
+    );
+    const files = [
+      .../* @__PURE__ */ new Set([...inventory, ...ignored.stdout.split("\0").filter(Boolean)])
+    ].sort();
+    const patterns = await Promise.all(
+      union.map(async (anchor) => {
+        const literal2 = fg7.escapePath(anchor);
+        try {
+          return (await fs9.lstat(await storePath(root, anchor))).isDirectory() ? `${literal2}/**/*` : literal2;
+        } catch {
+          return literal2;
+        }
+      })
+    );
+    const eligible = new Set(await access.list(patterns, { dot: true }));
+    const indexed = indexMatchingPaths(scopes2, files);
+    const filesByScope = new Map(
+      scopes2.map((scope, index) => [JSON.stringify([...new Set(scope)].sort()), indexed[index]])
+    );
+    return { filesByScope, eligible };
+  };
+  return Promise.all(
+    scopes2.map((scope) => {
+      const anchors = [...new Set(scope)].sort();
+      return inspectionRead(
+        root,
+        "decision-anchor-capture:" + JSON.stringify(anchors),
+        async () => {
+          const capture = { anchors, files: {}, complete: true };
+          if (!anchors.length) return capture;
+          try {
+            const { eligible, filesByScope } = await (context ??= prepareContext());
+            const files = filesByScope.get(JSON.stringify(anchors));
+            if (files.length > 2e3) return { ...capture, complete: false };
+            for (const file of files) {
+              const evidence = await inspectionRead(
+                root,
+                "decision-anchor-file:" + file,
+                async () => {
+                  try {
+                    const absolute = await storePath(root, file);
+                    await fs9.lstat(absolute);
+                    if (!eligible.has(file)) return { complete: false };
+                    const handle = await fs9.open(
+                      absolute,
+                      constants2.O_RDONLY | constants2.O_NONBLOCK | constants2.O_NOFOLLOW
+                    );
+                    try {
+                      const stat = await handle.stat();
+                      if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES)
+                        return { complete: false };
+                      const bytes = Buffer.alloc(Math.min(stat.size + 1, MAX_SOURCE_BYTES + 1));
+                      let size = 0;
+                      while (size < bytes.length) {
+                        const read = await handle.read(bytes, size, bytes.length - size, null);
+                        if (!read.bytesRead) break;
+                        size += read.bytesRead;
+                      }
+                      if (size === bytes.length) return { complete: false };
+                      return {
+                        complete: true,
+                        hash: createHash("sha256").update(bytes.subarray(0, size)).digest("hex")
+                      };
+                    } finally {
+                      await handle.close();
+                    }
+                  } catch (error) {
+                    return { complete: error.code === "ENOENT" };
+                  }
+                }
+              );
+              if (!evidence.complete) capture.complete = false;
+              if (evidence.hash) capture.files[file] = evidence.hash;
+            }
+          } catch {
+            capture.complete = false;
+          }
+          return capture;
+        }
+      );
+    })
+  );
+}
+async function captureAnchors(root, anchors) {
+  return (await captureAnchorScopes(root, [anchors]))[0];
+}
+function changedCaptureFiles(before, after) {
+  return [.../* @__PURE__ */ new Set([...Object.keys(before.files), ...Object.keys(after.files)])].filter((file) => before.files[file] !== after.files[file]).sort();
+}
+var repoPath2, anchorCaptureSchema;
+var init_anchors = __esm({
+  "src/decisions/anchors.ts"() {
+    "use strict";
+    init_inspection();
+    init_files();
+    init_paths();
+    init_storage();
+    repoPath2 = z3.string().refine((p) => normalizeRepoPath(p) === p);
+    anchorCaptureSchema = z3.object({
+      anchors: z3.array(repoPath2),
+      files: z3.record(repoPath2, z3.string().regex(/^[a-f0-9]{64}$/)),
+      complete: z3.boolean()
+    }).refine(
+      (capture) => JSON.stringify(capture.anchors) === JSON.stringify([...new Set(capture.anchors)].sort()) && matchingPaths(capture.anchors, Object.keys(capture.files)).length === Object.keys(capture.files).length,
+      "Capture paths must belong to its normalized, sorted anchor scope"
+    );
+  }
+});
+
 // src/context/lexical.ts
-import path17 from "path";
+import path15 from "path";
 var init_lexical = __esm({
   "src/context/lexical.ts"() {
     "use strict";
@@ -2062,7 +2594,8 @@ var init_trust = __esm({
 });
 
 // src/decisions/provenance.ts
-import { z as z2 } from "zod";
+import { z as z4 } from "zod";
+import { createHash as createHash2 } from "crypto";
 function decisionContent(record) {
   return {
     title: record.title,
@@ -2077,7 +2610,8 @@ function decisionApproval(record) {
   return record.version === 1 ? "unreviewed" : record.approval;
 }
 function effectiveDecision(record) {
-  if (record.version !== 2 || record.status !== "active" || record.approval !== "proposed") return record;
+  if (record.version !== 2 || record.status !== "active" || record.approval !== "proposed")
+    return record;
   let index = record.history.length - 1;
   while (index >= 0 && !["accepted", "reaffirmed"].includes(record.history[index].kind)) index--;
   if (index < 0) return record;
@@ -2089,13 +2623,16 @@ function effectiveDecision(record) {
     approval: "accepted",
     revision: event.revision,
     refreshedHash: event.refreshedHash,
+    capture: event.capture,
     updatedAt: event.at,
     history: record.history.slice(0, index + 1)
   };
 }
 function decisionProvenance(record, freshness = "unknown") {
   const approval = decisionApproval(record);
-  const review = record.version === 2 ? [...record.history].reverse().find((e) => ["accepted", "reaffirmed"].includes(e.kind) && e.revision === record.revision) : void 0;
+  const review = record.version === 2 ? [...record.history].reverse().find(
+    (e) => ["accepted", "reaffirmed"].includes(e.kind) && e.revision === record.revision
+  ) : void 0;
   return {
     approval,
     revision: record.version === 2 ? record.revision : 0,
@@ -2103,141 +2640,250 @@ function decisionProvenance(record, freshness = "unknown") {
     sources: record.version === 2 ? record.sources : [],
     guidance: record.status !== "active" ? "historical" : approval === "accepted" ? "constraint" : approval === "proposed" ? "proposal" : "unreviewed",
     reviewRequired: record.status === "active" && (approval !== "accepted" || freshness !== "current"),
-    lastReview: review ? { reviewer: review.actor, at: review.at, note: review.note, gitHash: review.refreshedHash } : null
+    lastReview: review ? {
+      reviewer: review.actor,
+      at: review.at,
+      note: review.note,
+      gitHash: review.refreshedHash
+    } : null
   };
 }
+function decisionInspectionDigest(record, scope = "all") {
+  const effective = effectiveDecision(record);
+  if (scope === "operative")
+    return createHash2("sha256").update(
+      JSON.stringify([
+        "operative",
+        record.status,
+        decisionApproval(effective),
+        effective.version === 2 ? effective.revision : 0,
+        decisionContent(effective),
+        effective.refreshedHash
+      ])
+    ).digest("hex");
+  return createHash2("sha256").update(
+    JSON.stringify([
+      record.status,
+      decisionApproval(record),
+      record.version === 2 ? record.revision : 0,
+      decisionContent(record),
+      decisionContent(effective),
+      effective.refreshedHash
+    ])
+  ).digest("hex");
+}
+function latestDecisionInspection(record, scope = "all") {
+  return record.version === 2 ? record.inspections?.filter(
+    (i) => (scope === "operative" || i.scope !== "operative") && i.decisionDigest === decisionInspectionDigest(record, i.scope ?? "all")
+  ).at(-1) : void 0;
+}
 var text, decisionSourceSchema, attributionSchema, contentSchema, approvalSchema, statusSchema, reviewEvidenceSchema, eventSchema, legacySchema, currentSchema, decisionSchema;
 var init_provenance = __esm({
   "src/decisions/provenance.ts"() {
     "use strict";
+    init_anchors();
     init_paths();
     init_trust();
-    text = (max) => z2.string().trim().min(1).max(max);
-    decisionSourceSchema = z2.object({
-      kind: z2.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
+    text = (max) => z4.string().trim().min(1).max(max);
+    decisionSourceSchema = z4.object({
+      kind: z4.enum(["pull_request", "issue", "incident", "discussion", "document", "other"]),
       reference: text(1e3),
       note: text(500).optional()
     }).strict();
-    attributionSchema = z2.object({
+    attributionSchema = z4.object({
       owner: text(200).nullable().optional(),
-      sources: z2.array(decisionSourceSchema).max(20).optional(),
+      sources: z4.array(decisionSourceSchema).max(20).optional(),
       actor: text(200).optional()
     });
-    contentSchema = z2.object({
-      title: z2.string().min(1),
-      body: z2.string().min(1),
-      category: z2.enum(["decision", "gotcha", "deprecation", "convention"]),
-      files: z2.array(z2.string().refine((f) => normalizeRepoPath(f) !== null)),
+    contentSchema = z4.object({
+      title: z4.string().min(1),
+      body: z4.string().min(1),
+      category: z4.enum(["decision", "gotcha", "deprecation", "convention"]),
+      files: z4.array(z4.string().refine((f) => normalizeRepoPath(f) !== null)),
       owner: text(200).optional(),
-      sources: z2.array(decisionSourceSchema).max(20)
+      sources: z4.array(decisionSourceSchema).max(20)
     });
-    approvalSchema = z2.enum(["unreviewed", "proposed", "accepted"]);
-    statusSchema = z2.enum(["active", "superseded", "retired"]);
-    reviewEvidenceSchema = z2.object({
-      baseHash: z2.string(),
-      headHash: z2.string(),
-      historyAvailable: z2.boolean(),
-      changedFiles: z2.array(z2.string()),
-      localChanges: z2.array(z2.string())
+    approvalSchema = z4.enum(["unreviewed", "proposed", "accepted"]);
+    statusSchema = z4.enum(["active", "superseded", "retired"]);
+    reviewEvidenceSchema = z4.object({
+      baseHash: z4.string(),
+      headHash: z4.string(),
+      historyAvailable: z4.boolean(),
+      changedFiles: z4.array(z4.string()),
+      localChanges: z4.array(z4.string())
     });
-    eventSchema = z2.object({
-      kind: z2.enum(["imported", "created", "revised", "accepted", "reaffirmed", "retired", "superseded"]),
-      at: z2.string().datetime(),
+    eventSchema = z4.object({
+      kind: z4.enum([
+        "imported",
+        "created",
+        "revised",
+        "accepted",
+        "reaffirmed",
+        "retired",
+        "superseded"
+      ]),
+      at: z4.string().datetime(),
       actor: text(200).optional(),
       note: text(1500).optional(),
-      revision: z2.number().int().positive(),
+      revision: z4.number().int().positive(),
       content: contentSchema,
       approval: approvalSchema,
       status: statusSchema,
-      refreshedHash: z2.string(),
-      evidence: reviewEvidenceSchema.optional()
+      refreshedHash: z4.string(),
+      evidence: reviewEvidenceSchema.optional(),
+      capture: anchorCaptureSchema.optional()
     });
-    legacySchema = z2.object({
-      version: z2.literal(1),
-      id: z2.string().regex(/^[a-zA-Z0-9_-]+$/),
-      title: z2.string().min(1),
-      body: z2.string().min(1),
+    legacySchema = z4.object({
+      version: z4.literal(1),
+      id: z4.string().regex(/^[a-zA-Z0-9_-]+$/),
+      title: z4.string().min(1),
+      body: z4.string().min(1),
       category: contentSchema.shape.category,
       files: contentSchema.shape.files,
-      createdAt: z2.string(),
-      updatedAt: z2.string(),
-      refreshedHash: z2.string(),
-      status: z2.enum(["active", "superseded"]),
-      supersededBy: z2.string().optional()
+      createdAt: z4.string(),
+      updatedAt: z4.string(),
+      refreshedHash: z4.string(),
+      status: z4.enum(["active", "superseded"]),
+      supersededBy: z4.string().optional()
     }).passthrough();
     currentSchema = legacySchema.extend({
-      version: z2.literal(2),
+      version: z4.literal(2),
       status: statusSchema,
       approval: approvalSchema,
-      revision: z2.number().int().positive(),
+      revision: z4.number().int().positive(),
       owner: text(200).optional(),
-      sources: z2.array(decisionSourceSchema).max(20),
-      history: z2.array(eventSchema).min(1)
+      sources: z4.array(decisionSourceSchema).max(20),
+      history: z4.array(eventSchema).min(1),
+      capture: anchorCaptureSchema.optional(),
+      inspections: z4.array(
+        z4.object({
+          at: z4.string().datetime(),
+          inspector: text(200),
+          note: text(1500),
+          outcome: z4.literal("no_contradiction_found"),
+          scope: z4.literal("operative").optional(),
+          decisionDigest: z4.string().regex(/^[a-f0-9]{64}$/),
+          headHash: z4.string(),
+          capture: anchorCaptureSchema
+        })
+      ).max(200).optional()
     }).superRefine((record, ctx) => {
       const invalid = (message) => ctx.addIssue({ code: "custom", message });
       const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
       let previous;
       for (const event of record.history) {
         if (!previous) {
-          if (!["created", "imported"].includes(event.kind) || event.revision !== 1) invalid("History must begin with creation or legacy import at revision 1");
-          if (event.approval !== (event.kind === "created" ? "proposed" : "unreviewed")) invalid("Initial records cannot claim acceptance");
+          if (!["created", "imported"].includes(event.kind) || event.revision !== 1)
+            invalid("History must begin with creation or legacy import at revision 1");
+          if (event.approval !== (event.kind === "created" ? "proposed" : "unreviewed"))
+            invalid("Initial records cannot claim acceptance");
         } else {
           if (["created", "imported"].includes(event.kind)) invalid("History cannot restart");
           if (previous.status !== "active") invalid("Archived decisions cannot be changed");
-          if (event.revision !== previous.revision + (event.kind === "revised" ? 1 : 0)) invalid("Invalid revision sequence");
-          if (event.kind !== "revised" && !same(event.content, previous.content)) invalid("A review cannot silently revise decision content");
-          if (event.kind === "reaffirmed" && previous.approval !== "accepted") invalid("Only accepted decisions can be reaffirmed");
-          if (event.kind === "accepted" && previous.approval === "accepted") invalid("Use reaffirmation for an accepted decision");
+          if (event.revision !== previous.revision + (event.kind === "revised" ? 1 : 0))
+            invalid("Invalid revision sequence");
+          if (event.kind !== "revised" && !same(event.content, previous.content))
+            invalid("A review cannot silently revise decision content");
+          if (event.kind === "reaffirmed" && previous.approval !== "accepted")
+            invalid("Only accepted decisions can be reaffirmed");
+          if (event.kind === "accepted" && previous.approval === "accepted")
+            invalid("Use reaffirmation for an accepted decision");
           const approval = event.kind === "revised" ? "proposed" : ["accepted", "reaffirmed"].includes(event.kind) ? "accepted" : previous.approval;
           if (event.approval !== approval) invalid("Approval disagrees with review history");
-          if (!["accepted", "reaffirmed"].includes(event.kind) && event.refreshedHash !== previous.refreshedHash) invalid("Only a review can refresh the evidence baseline");
+          if (!["accepted", "reaffirmed"].includes(event.kind) && event.refreshedHash !== previous.refreshedHash)
+            invalid("Only a review can refresh the evidence baseline");
         }
-        if (event.kind !== "imported" && event.status !== (event.kind === "retired" ? "retired" : event.kind === "superseded" ? "superseded" : "active")) invalid("Lifecycle disagrees with history");
-        if (["accepted", "reaffirmed", "retired"].includes(event.kind) && (!event.actor || !event.note || !event.evidence)) invalid("Reviews require a named reviewer, reason, and code evidence");
+        if (event.kind !== "imported" && event.status !== (event.kind === "retired" ? "retired" : event.kind === "superseded" ? "superseded" : "active"))
+          invalid("Lifecycle disagrees with history");
+        if (["accepted", "reaffirmed", "retired"].includes(event.kind) && (!event.actor || !event.note || !event.evidence))
+          invalid("Reviews require a named reviewer, reason, and code evidence");
         if (["accepted", "reaffirmed"].includes(event.kind)) {
-          if (!event.content.owner || !event.content.sources.length) invalid("Accepted decisions require an owner and source");
-          if (!event.evidence || !/^[a-f0-9]{40,64}$/.test(event.evidence.headHash) || event.refreshedHash !== event.evidence.headHash || event.evidence.localChanges.length) invalid("Acceptance requires a committed evidence baseline");
+          if (!event.content.owner || !event.content.sources.length)
+            invalid("Accepted decisions require an owner and source");
+          if (!event.evidence || !/^[a-f0-9]{40,64}$/.test(event.evidence.headHash) || event.refreshedHash !== event.evidence.headHash || event.evidence.localChanges.length)
+            invalid("Acceptance requires a committed evidence baseline");
         }
+        if (event.capture && !same([...event.content.files].sort(), event.capture.anchors))
+          invalid("Capture scope disagrees with decision anchors");
         previous = event;
       }
-      if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash) invalid("Decision does not match the final history event");
+      if (previous && !same(previous.capture, record.capture))
+        invalid("Capture does not match the final history event");
+      if (!previous || !same(previous.content, decisionContent(record)) || previous.approval !== record.approval || previous.status !== record.status || previous.revision !== record.revision || previous.refreshedHash !== record.refreshedHash)
+        invalid("Decision does not match the final history event");
     });
-    decisionSchema = z2.union([legacySchema, currentSchema]);
+    decisionSchema = z4.union([legacySchema, currentSchema]);
   }
 });
 
 // src/decisions/decisions.ts
-import fs9 from "fs/promises";
-import path18 from "path";
-import { createHash } from "crypto";
-import { z as z3 } from "zod";
+import fs10 from "fs/promises";
+import path16 from "path";
+import { createHash as createHash3 } from "crypto";
+import { z as z5 } from "zod";
+async function readDecisionInputs(rootDir) {
+  return structuredClone(
+    await inspectionRead(rootDir, "decision-store:inputs", async () => {
+      const inputs = [];
+      const diagnostics = [];
+      let entries;
+      try {
+        entries = await fs10.readdir(await storePath(rootDir, ".mason/decisions"));
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          diagnostics.push({ path: ".mason/decisions", message: String(error) });
+        return { inputs, diagnostics };
+      }
+      for (const entry of entries.sort()) {
+        if (!entry.endsWith(".json")) continue;
+        const relative = `.mason/decisions/${entry}`;
+        try {
+          const raw = await readBoundedFile(await storePath(rootDir, relative), 10 * 1024 * 1024);
+          if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
+          inputs.push([relative, raw]);
+        } catch (error) {
+          if (error.code === "ENOENT") inputs.push([relative, null]);
+          else
+            diagnostics.push({
+              path: relative,
+              message: error instanceof Error ? error.message : String(error)
+            });
+        }
+      }
+      return { inputs, diagnostics };
+    })
+  );
+}
 async function loadDecisionStore(rootDir) {
-  const records = [];
-  const diagnostics = [];
-  let entries;
-  try {
-    entries = await fs9.readdir(await storePath(rootDir, ".mason/decisions"));
-  } catch (error) {
-    if (error.code !== "ENOENT") diagnostics.push({ path: ".mason/decisions", message: String(error) });
-    return { records, diagnostics };
-  }
-  for (const entry of entries.sort()) {
-    if (!entry.endsWith(".json")) continue;
-    const relative = `.mason/decisions/${entry}`;
-    try {
-      const record = decisionSchema.parse(await readStoreJson(rootDir, relative));
-      if (entry !== `${record.id}.json`) throw new Error("Record id does not match its filename");
-      records.push(record);
-    } catch (error) {
-      diagnostics.push({ path: relative, message: error instanceof Error ? error.message : String(error) });
-    }
-  }
-  return { records, diagnostics };
+  return structuredClone(
+    await inspectionRead(rootDir, "decision-store:parsed", async () => {
+      const raw = await readDecisionInputs(rootDir);
+      const records = [];
+      const diagnostics = [...raw.diagnostics];
+      for (const [relative, content] of raw.inputs) {
+        try {
+          const record = decisionSchema.parse(content === null ? null : JSON.parse(content));
+          if (relative !== `.mason/decisions/${record.id}.json`)
+            throw new Error("Record id does not match its filename");
+          records.push(record);
+        } catch (error) {
+          diagnostics.push({
+            path: relative,
+            message: error instanceof Error ? error.message : String(error)
+          });
+        }
+      }
+      return { records, diagnostics };
+    })
+  );
 }
 var TITLE_MAX_CHARS, BODY_RECOMMENDED_CHARS, BODY_MAX_CHARS, boundedText, decisionTitleSchema, decisionBodySchema;
 var init_decisions = __esm({
   "src/decisions/decisions.ts"() {
     "use strict";
+    init_inspection();
+    init_files();
+    init_anchors();
     init_storage();
     init_paths();
     init_snapshot();
@@ -2246,10 +2892,16 @@ var init_decisions = __esm({
     TITLE_MAX_CHARS = 80;
     BODY_RECOMMENDED_CHARS = 1500;
     BODY_MAX_CHARS = 2500;
-    boundedText = (field, max, hint) => z3.string({
-      errorMap: (issue, ctx) => ({ message: issue.code === "too_big" ? `${field} has ${ctx.data.length} characters; maximum is ${max} (${ctx.data.length - max} over). ${hint}` : ctx.defaultError })
+    boundedText = (field, max, hint) => z5.string({
+      errorMap: (issue, ctx) => ({
+        message: issue.code === "too_big" && typeof ctx.data === "string" ? `${field} has ${ctx.data.length} characters; maximum is ${max} (${ctx.data.length - max} over). ${hint}` : ctx.defaultError
+      })
     }).trim().min(1, `${field} must be non-empty`).max(max);
-    decisionTitleSchema = boundedText("title", TITLE_MAX_CHARS, "Tighten it to a specific headline.");
+    decisionTitleSchema = boundedText(
+      "title",
+      TITLE_MAX_CHARS,
+      "Tighten it to a specific headline."
+    );
     decisionBodySchema = boundedText(
       "body",
       BODY_MAX_CHARS,
@@ -2259,15 +2911,53 @@ var init_decisions = __esm({
 });
 
 // src/decisions/drift.ts
-import path19 from "path";
+import path17 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path19.resolve(rootDir);
+  const resolvedRoot = path17.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
-  const report = { historyAvailable: true, totalDecisions: store.records.length, staleDecisions: {}, freshness: {}, diagnostics: store.diagnostics };
-  const [head, workingTree] = await Promise.all([getCurrentGitHash(resolvedRoot), getWorkingTree(resolvedRoot)]);
+  const report = {
+    historyAvailable: true,
+    totalDecisions: store.records.length,
+    staleDecisions: {},
+    freshness: {},
+    diagnostics: store.diagnostics
+  };
+  const [head, workingTree] = await Promise.all([
+    getCurrentGitHash(resolvedRoot),
+    getWorkingTree(resolvedRoot)
+  ]);
   const changesByHash = /* @__PURE__ */ new Map();
-  const inspect = async (record) => {
+  const baselines = store.records.filter((record) => record.status === "active").flatMap((record) => {
+    const effective = effectiveDecision(record);
+    return [.../* @__PURE__ */ new Set([effective, record])].flatMap((candidate) => {
+      const inspection = latestDecisionInspection(
+        record,
+        candidate === effective && decisionApproval(effective) === "accepted" ? "operative" : "all"
+      );
+      const capture = inspection?.capture ?? (candidate.version === 2 ? candidate.capture : void 0);
+      return capture ? [capture] : [];
+    });
+  });
+  const captures = await captureAnchorScopes(
+    resolvedRoot,
+    baselines.map((baseline) => baseline.anchors)
+  );
+  const currentCaptures = new Map(
+    baselines.map((baseline, index) => [JSON.stringify(baseline.anchors), captures[index]])
+  );
+  const inspect = async (record, inspectionCapture) => {
     if (record.files.length === 0) return { freshness: "unknown", changedFiles: [] };
+    const baseline = inspectionCapture ?? (record.version === 2 ? record.capture : void 0);
+    if (baseline) {
+      const current = currentCaptures.get(JSON.stringify(baseline.anchors));
+      const hits2 = changedCaptureFiles(baseline, current).filter(
+        (file) => matchingPaths(record.files, [file]).length
+      );
+      return {
+        freshness: !baseline.complete || !current.complete ? "unknown" : hits2.length ? "changed" : "current",
+        changedFiles: hits2
+      };
+    }
     let touched = changesByHash.get(record.refreshedHash);
     if (touched === void 0) {
       const changes = record.refreshedHash === head && head !== "unknown" ? [] : await getChangesWithStatus(resolvedRoot, record.refreshedHash);
@@ -2277,21 +2967,33 @@ async function computeDecisionDrift(rootDir, decisions) {
     if (touched === null) report.historyAvailable = false;
     const hits = touched ? matchingPaths(record.files, touched) : [];
     const localHits = matchingPaths(record.files, workingTree.changedFiles);
-    return { freshness: touched === null || !workingTree.available ? "unknown" : hits.length || localHits.length ? "changed" : "current", changedFiles: hits };
+    return {
+      freshness: touched === null || !workingTree.available ? "unknown" : hits.length || localHits.length ? "changed" : "current",
+      changedFiles: [.../* @__PURE__ */ new Set([...hits, ...localHits])].sort()
+    };
   };
   for (const record of store.records) {
     if (record.status !== "active") continue;
     const effective = effectiveDecision(record);
-    const state = await inspect(effective);
+    const inspection = latestDecisionInspection(
+      record,
+      decisionApproval(effective) === "accepted" ? "operative" : "all"
+    );
+    const state = await inspect(effective, inspection?.capture);
     report.freshness[record.id] = state.freshness;
     if (state.changedFiles.length) report.staleDecisions[record.id] = state.changedFiles;
-    if (effective !== record) (report.pendingProposals ??= {})[record.id] = await inspect(record);
+    if (effective !== record)
+      (report.pendingProposals ??= {})[record.id] = await inspect(
+        record,
+        latestDecisionInspection(record)?.capture
+      );
   }
   return report;
 }
 var init_drift2 = __esm({
   "src/decisions/drift.ts"() {
     "use strict";
+    init_anchors();
     init_drift();
     init_paths();
     init_snapshot();
@@ -2306,7 +3008,11 @@ async function checkDecisionAnchors(ctx) {
   if (!ctx.decisionsPresent) return result;
   const store = await loadDecisionStore(ctx.root);
   const records = store.records;
-  for (const diagnostic of store.diagnostics) result.skipped.push({ check: "decision-anchor-drift", reason: `${diagnostic.path}: ${diagnostic.message}` });
+  for (const diagnostic of store.diagnostics)
+    result.skipped.push({
+      check: "decision-anchor-drift",
+      reason: `${diagnostic.path}: ${diagnostic.message}`
+    });
   const drift = await computeDecisionDrift(ctx.root, records);
   if (!drift.historyAvailable) {
     result.skipped.push({
@@ -2314,17 +3020,30 @@ async function checkDecisionAnchors(ctx) {
       reason: "some decision base commits are unreachable (shallow clone?)"
     });
   }
-  const changed = records.flatMap((record) => [
-    { record: effectiveDecision(record), changedFiles: drift.staleDecisions[record.id] ?? [], freshness: drift.freshness?.[record.id] ?? "unknown" },
-    { record, changedFiles: drift.pendingProposals?.[record.id]?.changedFiles ?? [], freshness: drift.pendingProposals?.[record.id]?.freshness ?? "unknown" }
-  ]);
+  const changed = records.filter((record) => record.status === "active").flatMap(
+    (record) => [
+      {
+        record: effectiveDecision(record),
+        changedFiles: drift.staleDecisions[record.id] ?? [],
+        freshness: drift.freshness?.[record.id] ?? "unknown"
+      },
+      ...drift.pendingProposals?.[record.id] ? [{ record, ...drift.pendingProposals[record.id] }] : []
+    ]
+  );
   for (const { record, changedFiles, freshness } of changed) {
+    if (freshness === "unknown" && record.files.length) {
+      result.skipped.push({
+        check: "decision-anchor-drift",
+        reason: `Anchor evidence for decision ${record.id} is incomplete or unreadable`
+      });
+      continue;
+    }
     if (!changedFiles.length) continue;
     const id = record.id;
     const provenance = decisionProvenance(record, freshness);
     result.advisories.push({
       type: "decision-anchor-drift",
-      message: `decision "${record.title}" (${provenance.approval}) has anchor files that changed since its evidence baseline \u2013 needs human review`,
+      message: `decision "${record.title}" (${provenance.approval}) has anchors changed since capture or review; consistency is unchecked`,
       anchor: {
         doc: `.mason/decisions/${id}.json`,
         line: null,
@@ -2378,8 +3097,8 @@ var init_checks = __esm({
 });
 
 // src/audit/findings.ts
-import { createHash as createHash2 } from "crypto";
-import { z as z4 } from "zod";
+import { createHash as createHash4 } from "crypto";
+import { z as z6 } from "zod";
 function findingId(finding) {
   const e = finding.evidence;
   let key;
@@ -2409,106 +3128,154 @@ var digest, checkSchema, commitSchema, anchorSchema, count, scopeSchema, evidenc
 var init_findings = __esm({
   "src/audit/findings.ts"() {
     "use strict";
-    digest = (value) => createHash2("sha256").update(JSON.stringify(value)).digest("hex");
-    checkSchema = z4.enum(["deleted-reference", "new-module", "stale-count", "dead-command", "deps-changed", "decision-anchor-drift"]);
-    commitSchema = z4.object({ hash: z4.string().regex(/^[a-f0-9]{40,64}$/), date: z4.string(), subject: z4.string() });
-    anchorSchema = z4.object({ doc: z4.string(), line: z4.number().int().positive().nullable(), excerpt: z4.string().nullable() });
-    count = z4.number().int().nonnegative();
-    scopeSchema = z4.object({
-      basis: z4.enum(["repository", "document", "document-link", "explicit"]),
-      directory: z4.string(),
-      candidates: z4.array(z4.string())
+    digest = (value) => createHash4("sha256").update(JSON.stringify(value)).digest("hex");
+    checkSchema = z6.enum([
+      "deleted-reference",
+      "new-module",
+      "stale-count",
+      "dead-command",
+      "deps-changed",
+      "decision-anchor-drift"
+    ]);
+    commitSchema = z6.object({
+      hash: z6.string().regex(/^[a-f0-9]{40,64}$/),
+      date: z6.string(),
+      subject: z6.string()
+    });
+    anchorSchema = z6.object({
+      doc: z6.string(),
+      line: z6.number().int().positive().nullable(),
+      excerpt: z6.string().nullable()
     });
-    evidenceSchema = z4.discriminatedUnion("kind", [
-      z4.object({
-        kind: z4.literal("missing-path"),
-        claimed: z4.string(),
-        renamedTo: z4.string().nullable(),
+    count = z6.number().int().nonnegative();
+    scopeSchema = z6.object({
+      basis: z6.enum(["repository", "document", "document-link", "explicit"]),
+      directory: z6.string(),
+      candidates: z6.array(z6.string())
+    });
+    evidenceSchema = z6.discriminatedUnion("kind", [
+      z6.object({
+        kind: z6.literal("missing-path"),
+        claimed: z6.string(),
+        renamedTo: z6.string().nullable(),
         deletedInCommit: commitSchema.nullable(),
-        everTracked: z4.boolean(),
-        parentDirExists: z4.boolean(),
-        resolvedPath: z4.string().optional(),
+        everTracked: z6.boolean(),
+        parentDirExists: z6.boolean(),
+        resolvedPath: z6.string().optional(),
         scope: scopeSchema.optional()
       }),
-      z4.object({
-        kind: z4.literal("unmentioned-dir"),
-        dir: z4.string(),
+      z6.object({
+        kind: z6.literal("unmentioned-dir"),
+        dir: z6.string(),
         sourceFileCount: count,
         firstCommit: commitSchema.nullable(),
-        checkedDocs: z4.array(z4.string())
+        checkedDocs: z6.array(z6.string())
       }),
-      z4.object({
-        kind: z4.literal("count-mismatch"),
+      z6.object({
+        kind: z6.literal("count-mismatch"),
         claimed: count,
         actual: count,
-        unit: z4.string(),
-        countedFrom: z4.string(),
-        members: z4.array(z4.string())
+        unit: z6.string(),
+        countedFrom: z6.string(),
+        members: z6.array(z6.string())
       }),
-      z4.object({
-        kind: z4.literal("missing-script"),
-        scriptName: z4.string(),
-        invocation: z4.string(),
-        manifestsChecked: z4.array(z4.string()),
-        availableScripts: z4.array(z4.string()),
+      z6.object({
+        kind: z6.literal("missing-script"),
+        scriptName: z6.string(),
+        invocation: z6.string(),
+        manifestsChecked: z6.array(z6.string()),
+        availableScripts: z6.array(z6.string()),
         scope: scopeSchema.optional()
       }),
-      z4.object({
-        kind: z4.literal("doc-behind-manifests"),
+      z6.object({
+        kind: z6.literal("doc-behind-manifests"),
         docLastCommit: commitSchema,
-        manifestCommits: z4.array(commitSchema.extend({ files: z4.array(z4.string()) })),
+        manifestCommits: z6.array(commitSchema.extend({ files: z6.array(z6.string()) })),
         totalCommits: count,
-        matches: z4.array(z4.object({ dependency: z4.string(), manifest: z4.string(), before: z4.string().nullable(), after: z4.string().nullable(), line: z4.number().int().positive(), excerpt: z4.string() })).optional(),
-        matchingIncomplete: z4.boolean().optional()
+        matches: z6.array(
+          z6.object({
+            dependency: z6.string(),
+            manifest: z6.string(),
+            before: z6.string().nullable(),
+            after: z6.string().nullable(),
+            line: z6.number().int().positive(),
+            excerpt: z6.string()
+          })
+        ).optional(),
+        matchingIncomplete: z6.boolean().optional()
       }),
-      z4.object({
-        kind: z4.literal("decision-anchor"),
-        decisionId: z4.string(),
-        title: z4.string(),
-        changedFiles: z4.array(z4.string()),
-        refreshedHash: z4.string(),
-        provenance: z4.object({}).passthrough().optional()
+      z6.object({
+        kind: z6.literal("decision-anchor"),
+        decisionId: z6.string(),
+        title: z6.string(),
+        changedFiles: z6.array(z6.string()),
+        refreshedHash: z6.string(),
+        provenance: z6.object({}).passthrough().optional()
       })
     ]);
-    findingSchema = z4.object({ message: z4.string(), anchor: anchorSchema, evidence: evidenceSchema });
+    findingSchema = z6.object({
+      message: z6.string(),
+      anchor: anchorSchema,
+      evidence: evidenceSchema
+    });
     issueSchema = findingSchema.extend({
-      type: z4.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
-      confidence: z4.enum(["certain", "likely"])
+      type: z6.enum(["deleted-reference", "new-module", "stale-count", "dead-command"]),
+      confidence: z6.enum(["certain", "likely"])
+    });
+    advisorySchema = findingSchema.extend({
+      type: checkSchema,
+      resolution: z6.enum(["recheck", "informational"]).optional()
     });
-    advisorySchema = findingSchema.extend({ type: checkSchema, resolution: z4.enum(["recheck", "informational"]).optional() });
-    checkResultSchema = z4.object({
-      issues: z4.array(issueSchema),
-      advisories: z4.array(advisorySchema),
-      suppressedAdvisories: z4.array(advisorySchema).optional(),
-      skipped: z4.array(z4.object({ check: z4.string(), reason: z4.string(), doc: z4.string().optional() }))
+    checkResultSchema = z6.object({
+      issues: z6.array(issueSchema),
+      advisories: z6.array(advisorySchema),
+      suppressedAdvisories: z6.array(advisorySchema).optional(),
+      skipped: z6.array(z6.object({ check: z6.string(), reason: z6.string(), doc: z6.string().optional() }))
+    });
+  }
+});
+
+// src/automation/stop-review.ts
+import { z as z7 } from "zod";
+var evidenceSchema2, stopReviewSchema;
+var init_stop_review = __esm({
+  "src/automation/stop-review.ts"() {
+    "use strict";
+    init_anchors();
+    init_findings();
+    evidenceSchema2 = z7.record(z7.object({ digest: z7.string(), capture: anchorCaptureSchema }));
+    stopReviewSchema = z7.object({
+      pending: z7.record(z7.object({ head: z7.string(), evidence: evidenceSchema2 })),
+      edited: z7.record(z7.record(z7.string().nullable())),
+      delivered: z7.record(z7.object({ digest: z7.string(), files: z7.record(z7.string().nullable()) }))
     });
   }
 });
 
 // src/automation/notifications.ts
-import { z as z5 } from "zod";
+import { z as z8 } from "zod";
 var conditionSchema, notificationStateSchema;
 var init_notifications = __esm({
   "src/automation/notifications.ts"() {
     "use strict";
     init_findings();
-    conditionSchema = z5.object({
-      level: z5.number(),
-      facts: z5.array(z5.string()),
-      magnitude: z5.number().optional()
+    conditionSchema = z8.object({
+      level: z8.number(),
+      facts: z8.array(z8.string()),
+      magnitude: z8.number().optional()
     });
-    notificationStateSchema = z5.object({
-      version: z5.literal(1),
-      baselineHead: z5.string(),
-      baseline: z5.record(conditionSchema),
-      delivered: z5.record(conditionSchema),
-      cleared: z5.array(z5.string())
+    notificationStateSchema = z8.object({
+      version: z8.literal(1),
+      baselineHead: z8.string(),
+      baseline: z8.record(conditionSchema),
+      delivered: z8.record(conditionSchema),
+      cleared: z8.array(z8.string())
     });
   }
 });
 
 // src/automation/store.ts
-import { z as z6 } from "zod";
+import { z as z9 } from "zod";
 function withLock(root, directory, run, waitMs = 5e3) {
   return withStoreLock(root, directory, run, waitMs, "Automation");
 }
@@ -2517,28 +3284,35 @@ var init_store = __esm({
   "src/automation/store.ts"() {
     "use strict";
     init_store_lock();
+    init_stop_review();
     init_notifications();
-    hostSchema = z6.enum(["claude", "codex"]);
-    stateSchema = z6.object({
-      version: z6.literal(1),
-      root: z6.string(),
-      gitDir: z6.string(),
-      branch: z6.string(),
-      baselines: z6.array(z6.object({ path: z6.string(), at: z6.string(), event: z6.string(), fingerprint: z6.string() })).max(128),
-      sessions: z6.record(z6.object({
-        host: hostSchema,
-        lastUsed: z6.string(),
-        notifiedDiagnostics: z6.array(z6.string()).default([]),
-        pending: z6.record(z6.string()),
-        coverageGaps: z6.array(z6.string()),
-        events: z6.record(z6.object({ at: z6.string(), count: z6.number().int().positive() }))
-      })),
-      updatedAt: z6.string(),
-      fingerprint: z6.string().nullable(),
-      latest: z6.string().nullable(),
+    hostSchema = z9.enum(["claude", "codex"]);
+    stateSchema = z9.object({
+      version: z9.literal(1),
+      root: z9.string(),
+      gitDir: z9.string(),
+      branch: z9.string(),
+      baselines: z9.array(
+        z9.object({ path: z9.string(), at: z9.string(), event: z9.string(), fingerprint: z9.string() })
+      ).max(128),
+      sessions: z9.record(
+        z9.object({
+          host: hostSchema,
+          lastUsed: z9.string(),
+          notifiedDiagnostics: z9.array(z9.string()).default([]),
+          pending: z9.record(z9.string()),
+          stopReview: stopReviewSchema.optional(),
+          coverageGaps: z9.array(z9.string()),
+          events: z9.record(z9.object({ at: z9.string(), count: z9.number().int().positive() }))
+        })
+      ),
+      updatedAt: z9.string(),
+      fingerprint: z9.string().nullable(),
+      latest: z9.string().nullable(),
+      guidance: z9.object({ fingerprint: z9.string(), path: z9.string() }).optional(),
       notifications: notificationStateSchema.optional(),
       agentNotifications: notificationStateSchema.optional(),
-      analysis: z6.object({ id: z6.string(), fingerprint: z6.string(), completedAt: z6.number(), path: z6.string() }).optional()
+      analysis: z9.object({ id: z9.string(), fingerprint: z9.string(), completedAt: z9.number(), path: z9.string() }).optional()
     });
   }
 });
@@ -2557,10 +3331,10 @@ __export(repair_exports, {
   verifyRepair: () => verifyRepair,
   withRepairSession: () => withRepairSession
 });
-import fs10 from "fs/promises";
-import path20 from "path";
+import fs11 from "fs/promises";
+import path18 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
-import { z as z7 } from "zod";
+import { z as z10 } from "zod";
 function recheckable(finding) {
   return !("confidence" in finding) && finding.resolution === "recheck" && ["deleted-reference", "dead-command", "new-module"].includes(finding.type) && ["missing-path", "missing-script", "unmentioned-dir"].includes(finding.evidence.kind);
 }
@@ -2572,7 +3346,8 @@ async function docState(root) {
   for (const doc of await discoverDocPaths(root)) {
     try {
       const content = await readBoundedFile(await storePath(root, doc), 10 * 1024 * 1024);
-      if (content === null) throw new Error("Context file is not regular or exceeds 10 MiB: " + doc);
+      if (content === null)
+        throw new Error("Context file is not regular or exceeds 10 MiB: " + doc);
       docs.push([doc, digest(content)]);
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
@@ -2589,7 +3364,9 @@ async function readStableAudit(root, checks, options) {
   const before = await docState(root);
   const report = await computeAudit(root, { ...options, checks });
   if (head !== await getCurrentGitHash(root) || before !== await docState(root) || report && report.headHash !== head) {
-    throw new Error("HEAD or context files changed during the audit; retry against a stable checkout.");
+    throw new Error(
+      "HEAD or context files changed during the audit; retry against a stable checkout."
+    );
   }
   return report;
 }
@@ -2617,7 +3394,11 @@ async function withRepairSession(root, options, run, validate, cachedAudit) {
       }
       return computeAudit(root, { ...options, checks });
     }),
-    document: (file) => memo(documents, file, async () => readBoundedFile(await storePath(root, file), 10 * 1024 * 1024)),
+    document: (file) => memo(
+      documents,
+      file,
+      async () => readBoundedFile(await storePath(root, file), 10 * 1024 * 1024)
+    ),
     history: (head2) => memo(history, head2, () => getChangesWithStatus(root, head2)),
     assessment: (dir, finding, head2) => memo(assessments, digest([dir, finding, head2]), () => assessAdvisory(dir, finding, head2))
   };
@@ -2630,11 +3411,12 @@ async function withRepairSession(root, options, run, validate, cachedAudit) {
   return result;
 }
 async function prepareOriginal(rootDir, checks, options, session) {
-  const root = await fs10.realpath(rootDir);
-  const selected = z7.array(checkSchema).nonempty().parse(checks);
+  const root = await fs11.realpath(rootDir);
+  const selected = z10.array(checkSchema).nonempty().parse(checks);
   const report = await (session ? session.audit(selected) : stableAudit(root, selected, options));
   if (!report) throw new Error("No context files found to prepare a repair.");
-  if (!report.gitAvailable) throw new Error("Readable Git history is required to prepare a repair.");
+  if (!report.gitAvailable)
+    throw new Error("Readable Git history is required to prepare a repair.");
   const storedReport = reportSchema.parse(report);
   const payload = {
     kind: "mason-audit-repair",
@@ -2647,13 +3429,15 @@ async function prepareOriginal(rootDir, checks, options, session) {
   return { version: 1, action: "prepare", baselinePath, report };
 }
 async function loadRepairBaseline(rootDir, baselinePath) {
-  const root = await fs10.realpath(rootDir);
-  const declaredRoot = path20.resolve(rootDir);
-  const relative = path20.isAbsolute(baselinePath) ? path20.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const root = await fs11.realpath(rootDir);
+  const declaredRoot = path18.resolve(rootDir);
+  const relative = path18.isAbsolute(baselinePath) ? path18.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
   const { digest: savedDigest, ...payload } = stored;
-  if (digest(payload) !== savedDigest) throw new Error("Repair baseline was modified; use the original baseline.");
-  if (stored.report.root !== root) throw new Error("Repair baseline belongs to a different repository.");
+  if (digest(payload) !== savedDigest)
+    throw new Error("Repair baseline was modified; use the original baseline.");
+  if (stored.report.root !== root)
+    throw new Error("Repair baseline belongs to a different repository.");
   const original = stored.report;
   return { root, relative, original };
 }
@@ -2671,14 +3455,19 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
     if (!current) diagnostics.push("No context files remain available to audit.");
     else if (!current.gitAvailable) diagnostics.push("Git history is unavailable.");
     for (const doc of original.docs) {
-      if (!allFindings(original).some((f) => f.anchor.doc === doc.path) || !current?.docs.some((d) => d.path === doc.path)) continue;
+      if (!allFindings(original).some((f) => f.anchor.doc === doc.path) || !current?.docs.some((d) => d.path === doc.path))
+        continue;
       const content = await (session ? session.document(doc.path) : readBoundedFile(await storePath(root, doc.path), 10 * 1024 * 1024));
       if (content === null || !content.trim()) {
-        diagnostics.push("Original context file " + doc.path + " is empty or unreadable; losing its claims does not verify a repair.");
+        diagnostics.push(
+          "Original context file " + doc.path + " is empty or unreadable; losing its claims does not verify a repair."
+        );
       }
     }
     if (await (session ? session.history(original.headHash) : getChangesWithStatus(root, original.headHash)) === null) {
-      diagnostics.push("The original audit commit is unavailable; repair history cannot be verified.");
+      diagnostics.push(
+        "The original audit commit is unavailable; repair history cannot be verified."
+      );
     }
   } catch (error) {
     diagnostics.push(error instanceof Error ? error.message : String(error));
@@ -2686,63 +3475,116 @@ async function verifyOriginal(rootDir, baselinePath, options, session) {
   const currentById = new Map((current ? allFindings(current) : []).map((f) => [findingId(f), f]));
   const originalFindings = allFindings(original);
   const originalIds = new Set(originalFindings.map(findingId));
-  const missingDocs = original.docs.filter((doc) => !current?.docs.some((d) => d.path === doc.path));
-  for (const doc of missingDocs) diagnostics.push("Original context file " + doc.path + " is unavailable; removing it does not verify a repair.");
-  const findings = await Promise.all(originalFindings.map(async (finding) => {
-    const id = findingId(finding);
-    const now = currentById.get(id);
-    const base = { id, original: finding, ...now ? { current: now } : {} };
-    if (diagnostics.length || !current) {
-      return { ...base, status: "unverified", reason: "The original audit scope could not be verified. See diagnostics." };
-    }
-    if (now && ("confidence" in finding || "confidence" in now)) {
-      return { ...base, status: "unresolved", reason: "The original check still reports this claim." };
-    }
-    if (current.excludedChecks?.some((excluded) => excluded.check === finding.type && excluded.doc === finding.anchor.doc)) {
-      return { ...base, status: "resolved", reason: "Excluded by project audit policy; this is not a correctness assessment. Original evidence is retained." };
-    }
-    const skipped = current.skippedChecks.filter((s) => s.check === finding.type && (!s.doc || s.doc === finding.anchor.doc));
-    if (!current.checksRun?.includes(finding.type) || skipped.length) {
-      return { ...base, status: "unverified", reason: skipped.map((s) => s.reason).join("; ") || "The original check did not run." };
-    }
-    const review = await (session?.assessment ?? assessAdvisory)(root, now ?? finding, original.headHash);
-    if (review) {
-      if (review.status === "unverified") return { ...base, review, status: "unverified", reason: review.reason };
-      if (review.status === "current") return { ...base, review, status: "resolved", reason: review.reason };
-      return { ...base, review, status: "review-required", reason: review.reason };
-    }
-    if (!("confidence" in finding) && finding.evidence.kind === "doc-behind-manifests" && !finding.evidence.matches?.length && (!now || !("confidence" in now) && now.resolution === "informational")) {
-      return { ...base, status: "resolved", reason: "Manifest recency alone establishes no affected passage. Retained as information; no assessment is required." };
-    }
-    if (!("confidence" in finding) && (!recheckable(finding) || now)) {
+  const missingDocs = original.docs.filter(
+    (doc) => !current?.docs.some((d) => d.path === doc.path)
+  );
+  for (const doc of missingDocs)
+    diagnostics.push(
+      "Original context file " + doc.path + " is unavailable; removing it does not verify a repair."
+    );
+  const findings = await Promise.all(
+    originalFindings.map(async (finding) => {
+      const id = findingId(finding);
+      const now = currentById.get(id);
+      const base = { id, original: finding, ...now ? { current: now } : {} };
+      if (diagnostics.length || !current) {
+        return {
+          ...base,
+          status: "unverified",
+          reason: "The original audit scope could not be verified. See diagnostics."
+        };
+      }
+      if (now && ("confidence" in finding || "confidence" in now)) {
+        return {
+          ...base,
+          status: "unresolved",
+          reason: "The original check still reports this claim."
+        };
+      }
+      if (current.excludedChecks?.some(
+        (excluded) => excluded.check === finding.type && excluded.doc === finding.anchor.doc
+      )) {
+        return {
+          ...base,
+          status: "resolved",
+          reason: "Excluded by project audit policy; this is not a correctness assessment. Original evidence is retained."
+        };
+      }
+      const skipped = current.skippedChecks.filter(
+        (s) => s.check === finding.type && (!s.doc || s.doc === finding.anchor.doc)
+      );
+      if (!current.checksRun?.includes(finding.type) || skipped.length) {
+        return {
+          ...base,
+          status: "unverified",
+          reason: skipped.map((s) => s.reason).join("; ") || "The original check did not run."
+        };
+      }
+      const review = await (session?.assessment ?? assessAdvisory)(
+        root,
+        now ?? finding,
+        original.headHash
+      );
+      if (review) {
+        if (review.status === "unverified")
+          return { ...base, review, status: "unverified", reason: review.reason };
+        if (review.status === "current")
+          return { ...base, review, status: "resolved", reason: review.reason };
+        return { ...base, review, status: "review-required", reason: review.reason };
+      }
+      if (!("confidence" in finding) && finding.evidence.kind === "doc-behind-manifests" && !finding.evidence.matches?.length && (!now || !("confidence" in now) && now.resolution === "informational")) {
+        return {
+          ...base,
+          status: "resolved",
+          reason: "Manifest recency alone establishes no affected passage. Retained as information; no assessment is required."
+        };
+      }
+      if (!("confidence" in finding) && (!recheckable(finding) || now)) {
+        return {
+          ...base,
+          status: "review-required",
+          reason: (now ? "The current check still reports this advisory. " : finding.type === "deps-changed" ? "The current check no longer reports this condition; the historical advisory remains awaiting assessment. " : "The current check no longer reports the original finding; retained evidence still requires assessment. ") + "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
+        };
+      }
       return {
         ...base,
-        status: "review-required",
-        reason: (now ? "The current check still reports this advisory. " : finding.type === "deps-changed" ? "The current check no longer reports this condition; the historical advisory remains awaiting assessment. " : "The current check no longer reports the original finding; retained evidence still requires assessment. ") + "An audit cannot establish that this advisory was reviewed. Retain its original evidence and report a separate assessment; editing or committing the doc is not approval."
+        status: "resolved",
+        reason: "The original check ran and no longer reports this claim. Inspect the edit for semantic correctness."
       };
-    }
-    return { ...base, status: "resolved", reason: "The original check ran and no longer reports this claim. Inspect the edit for semantic correctness." };
-  }));
-  if (!session) try {
-    if (reviewDigest !== digest(await advisoryReviewInventory(root)) || current?.headHash !== await getCurrentGitHash(root)) {
-      diagnostics.push("HEAD or advisory review records changed during verification; repeat against stable evidence.");
+    })
+  );
+  if (!session)
+    try {
+      if (reviewDigest !== digest(await advisoryReviewInventory(root)) || current?.headHash !== await getCurrentGitHash(root)) {
+        diagnostics.push(
+          "HEAD or advisory review records changed during verification; repeat against stable evidence."
+        );
+        for (const finding of findings) {
+          finding.status = "unverified";
+          finding.reason = diagnostics.at(-1);
+        }
+      }
+    } catch (error) {
+      diagnostics.push(String(error));
       for (const finding of findings) {
         finding.status = "unverified";
-        finding.reason = diagnostics.at(-1);
+        finding.reason = "Advisory review evidence became unavailable during verification.";
       }
     }
-  } catch (error) {
-    diagnostics.push(String(error));
-    for (const finding of findings) {
-      finding.status = "unverified";
-      finding.reason = "Advisory review evidence became unavailable during verification.";
-    }
-  }
   const newFindings = [...currentById].filter(([id]) => !originalIds.has(id)).map(([, f]) => f);
-  const reviewedIds = new Set(current?.advisoryReviews?.filter((review) => review.status === "current").map((review) => review.id));
-  const counts = { resolved: 0, unresolved: 0, "review-required": 0, unverified: 0 };
+  const reviewedIds = new Set(
+    current?.advisoryReviews?.filter((review) => review.status === "current").map((review) => review.id)
+  );
+  const counts = {
+    resolved: 0,
+    unresolved: 0,
+    "review-required": 0,
+    unverified: 0
+  };
   for (const f of findings) counts[f.status]++;
-  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some((f) => !("confidence" in f) && f.resolution !== "informational" && !reviewedIds.has(findingId(f)));
+  const incomplete = diagnostics.length > 0 || counts.unverified > 0 || counts["review-required"] > 0 || (current?.skippedChecks.length ?? 0) > 0 || newFindings.some(
+    (f) => !("confidence" in f) && f.resolution !== "informational" && !reviewedIds.has(findingId(f))
+  );
   const issuesRemain = counts.unresolved > 0 || newFindings.some((f) => "confidence" in f);
   return {
     version: 1,
@@ -2765,10 +3607,14 @@ function repairExitCode(report) {
 function formatRepairSummary(report) {
   return [
     "Repair verification: " + report.status + ". Baseline: " + report.baselinePath,
-    ...report.findings.map((f) => "  [" + f.status + "] " + f.original.type + " " + f.original.anchor.doc + ": " + (f.current?.message ?? "Historical evidence at " + report.baselineHead.slice(0, 7) + ": " + f.original.message) + "\n    " + f.reason + "\n    findingId: " + f.id),
+    ...report.findings.map(
+      (f) => "  [" + f.status + "] " + f.original.type + " " + f.original.anchor.doc + ": " + (f.current?.message ?? "Historical evidence at " + report.baselineHead.slice(0, 7) + ": " + f.original.message) + "\n    " + f.reason + "\n    findingId: " + f.id
+    ),
     ...report.newFindings.map((f) => "  [new] " + f.type + " " + f.anchor.doc + ": " + f.message),
     ...report.diagnostics.map((d) => "  [unverified] " + d),
-    ...(report.currentAudit?.skippedChecks ?? []).map((s) => "  [skipped] " + s.check + ": " + s.reason),
+    ...(report.currentAudit?.skippedChecks ?? []).map(
+      (s) => "  [skipped] " + s.check + ": " + s.reason
+    ),
     report.scope
   ].join("\n");
 }
@@ -2788,109 +3634,149 @@ var init_repair = __esm({
     init_findings();
     init_advisory_review();
     init_findings();
-    count2 = z7.number().int().nonnegative();
-    reportSchema = z7.object({
-      version: z7.literal(1),
-      root: z7.string(),
-      gitAvailable: z7.literal(true),
+    count2 = z10.number().int().nonnegative();
+    reportSchema = z10.object({
+      version: z10.literal(1),
+      root: z10.string(),
+      gitAvailable: z10.literal(true),
       headHash: commitSchema.shape.hash,
-      checksRun: z7.array(checkSchema).nonempty(),
-      docs: z7.array(z7.object({
-        path: z7.string().refine((value) => normalizeRepoPath(value) === value),
-        scope: z7.string().optional(),
-        kind: z7.enum(["instructions", "readme", "guide"]).optional(),
-        lastCommit: commitSchema.nullable(),
-        dirty: z7.boolean(),
-        lineCount: count2
-      })).nonempty(),
-      decisionsChecked: z7.boolean(),
-      clean: z7.boolean(),
-      excludedChecks: z7.array(z7.object({ check: checkSchema, doc: z7.string() })).optional(),
-      issues: z7.array(issueSchema),
-      advisories: z7.array(advisorySchema),
-      suppressedAdvisories: z7.array(advisorySchema).optional(),
-      skippedChecks: z7.array(z7.object({ check: z7.string(), reason: z7.string(), doc: z7.string().optional() }))
+      checksRun: z10.array(checkSchema).nonempty(),
+      docs: z10.array(
+        z10.object({
+          path: z10.string().refine((value) => normalizeRepoPath(value) === value),
+          scope: z10.string().optional(),
+          kind: z10.enum(["instructions", "readme", "guide"]).optional(),
+          lastCommit: commitSchema.nullable(),
+          dirty: z10.boolean(),
+          lineCount: count2
+        })
+      ).nonempty(),
+      decisionsChecked: z10.boolean(),
+      clean: z10.boolean(),
+      excludedChecks: z10.array(z10.object({ check: checkSchema, doc: z10.string() })).optional(),
+      issues: z10.array(issueSchema),
+      advisories: z10.array(advisorySchema),
+      suppressedAdvisories: z10.array(advisorySchema).optional(),
+      skippedChecks: z10.array(
+        z10.object({ check: z10.string(), reason: z10.string(), doc: z10.string().optional() })
+      )
     });
-    baselineSchema = z7.object({
-      kind: z7.literal("mason-audit-repair"),
-      version: z7.literal(1),
-      createdAt: z7.string().datetime(),
+    baselineSchema = z10.object({
+      kind: z10.literal("mason-audit-repair"),
+      version: z10.literal(1),
+      createdAt: z10.string().datetime(),
       report: reportSchema,
-      digest: z7.string().regex(/^[a-f0-9]{64}$/)
+      digest: z10.string().regex(/^[a-f0-9]{64}$/)
     });
-    repairFindingSchema = z7.object({
-      id: z7.string(),
-      original: z7.union([issueSchema, advisorySchema]),
-      status: z7.enum(["resolved", "unresolved", "review-required", "unverified"]),
-      reason: z7.string(),
-      current: z7.union([issueSchema, advisorySchema]).optional(),
+    repairFindingSchema = z10.object({
+      id: z10.string(),
+      original: z10.union([issueSchema, advisorySchema]),
+      status: z10.enum(["resolved", "unresolved", "review-required", "unverified"]),
+      reason: z10.string(),
+      current: z10.union([issueSchema, advisorySchema]).optional(),
       review: reviewSummarySchema.optional()
     });
   }
 });
 
 // src/audit/advisory-review.ts
-import fs11 from "fs/promises";
-import { z as z8 } from "zod";
+import fs12 from "fs/promises";
+import { z as z11 } from "zod";
 async function readRecord(root, id) {
   const raw = await readStoreJson(root, recordPath(id));
   if (raw === null) return null;
   const record = recordSchema.parse(raw);
   const { digest: stored, ...payload } = record;
-  if (record.id !== id || digest(payload) !== stored || record.events.some((event) => findingId(event.finding) !== id || (event.outcome === "dismissed" ? !event.reasonCode || event.finding.type !== "deps-changed" : !event.reviewer || !!event.reasonCode) || event.evidence.fingerprint !== evidenceFingerprint(event.evidence, event.reasonCode))) {
+  if (record.id !== id || digest(payload) !== stored || record.events.some(
+    (event) => findingId(event.finding) !== id || (event.outcome === "dismissed" ? !event.reasonCode || event.finding.type !== "deps-changed" : !event.reviewer || !!event.reasonCode) || event.evidence.fingerprint !== evidenceFingerprint(event.evidence, event.reasonCode)
+  )) {
     throw new Error("Advisory review record is inconsistent or modified; inspect its history.");
   }
   return record;
 }
 function evidenceFingerprint(evidence, reason) {
-  return digest([evidence.scope, evidence.tree, ...reason === "no-dependency-claims" ? [] : [evidence.lastScopeCommit], evidence.paths]);
+  return digest([
+    evidence.scope,
+    evidence.tree,
+    ...reason === "no-dependency-claims" ? [] : [evidence.lastScopeCommit],
+    evidence.paths
+  ]);
 }
 function scopes(finding, reason) {
   const files = [finding.anchor.doc], e = finding.evidence;
-  if (e.kind === "decision-anchor") throw new Error("Use review_decision for decision acceptance, reaffirmation or retirement.");
-  if (reason === "no-dependency-claims" && e.kind === "doc-behind-manifests") return [`:(literal)${finding.anchor.doc}`];
-  if (e.kind === "doc-behind-manifests") return [`:(literal)${finding.anchor.doc}`, ...manifestPathspecs(finding.anchor.doc)];
-  if (e.kind === "missing-path") files.push(...e.scope?.candidates ?? [e.resolvedPath ?? e.claimed]);
-  else if (e.kind === "missing-script") files.push(...e.manifestsChecked, ...e.scope?.candidates ?? []);
+  if (e.kind === "decision-anchor")
+    throw new Error("Use review_decision for decision acceptance, reaffirmation or retirement.");
+  if (reason === "no-dependency-claims" && e.kind === "doc-behind-manifests")
+    return [`:(literal)${finding.anchor.doc}`];
+  if (e.kind === "doc-behind-manifests")
+    return [`:(literal)${finding.anchor.doc}`, ...manifestPathspecs(finding.anchor.doc)];
+  if (e.kind === "missing-path")
+    files.push(...e.scope?.candidates ?? [e.resolvedPath ?? e.claimed]);
+  else if (e.kind === "missing-script")
+    files.push(...e.manifestsChecked, ...e.scope?.candidates ?? []);
   else if (e.kind === "unmentioned-dir") files.push(e.dir, ...e.checkedDocs);
   else throw new Error("This advisory has no supported review scope.");
   return [...new Set(files)].map((file) => {
-    if (normalizeRepoPath(file) !== file) throw new Error("Advisory contains an invalid scoped path: " + file);
+    if (normalizeRepoPath(file) !== file)
+      throw new Error("Advisory contains an invalid scoped path: " + file);
     return `:(literal)${file}`;
   }).sort();
 }
 async function reviewEvidence(root, finding, reason) {
-  if (normalizeRepoPath(finding.anchor.doc) !== finding.anchor.doc) throw new Error("Invalid advisory document path.");
+  if (normalizeRepoPath(finding.anchor.doc) !== finding.anchor.doc)
+    throw new Error("Invalid advisory document path.");
   const scope = scopes(finding, reason);
   const head = (await git2(root, "rev-parse", "HEAD")).trim();
   const tracked = (await git2(root, "ls-files", "--cached", "-z", "--", ...scope)).split("\0").filter(Boolean);
   if (tracked.length > 2e4) throw new Error("Advisory scope exceeds 20,000 tracked files.");
   const [tree, status, lastScopeCommit, document] = await Promise.all([
-    tracked.length ? git2(root, "ls-tree", "-r", "-z", "HEAD", "--", ...tracked.map((file) => `:(literal)${file}`)) : "",
+    tracked.length ? git2(
+      root,
+      "ls-tree",
+      "-r",
+      "-z",
+      "HEAD",
+      "--",
+      ...tracked.map((file) => `:(literal)${file}`)
+    ) : "",
     git2(root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...scope),
     git2(root, "log", "-1", "--format=%H", "HEAD", "--", ...scope).then((value) => value.trim()),
     readAuditInput(root, finding.anchor.doc)
   ]);
-  if (!document?.trim()) throw new Error("Original advisory document is missing, empty or unreadable.");
-  if (tree.length > 2 * 1024 * 1024 || tree.split("\0").length > 2e4) throw new Error("Advisory scope is too large for a complete review; narrow the documentation scope.");
+  if (!document?.trim())
+    throw new Error("Original advisory document is missing, empty or unreadable.");
+  if (tree.length > 2 * 1024 * 1024 || tree.split("\0").length > 2e4)
+    throw new Error(
+      "Advisory scope is too large for a complete review; narrow the documentation scope."
+    );
   for (const entry of tree.split("\0").filter(Boolean)) {
     const tab = entry.indexOf("	"), file = entry.slice(tab + 1);
-    if (entry.startsWith("120000 ") || entry.startsWith("160000 ")) throw new Error("Symlink or submodule in advisory review scope: " + file);
+    if (entry.startsWith("120000 ") || entry.startsWith("160000 "))
+      throw new Error("Symlink or submodule in advisory review scope: " + file);
     await storePath(root, file);
   }
   const paths = finding.evidence.kind === "missing-path" ? await Promise.all(
-    (finding.evidence.scope?.candidates ?? [finding.evidence.resolvedPath ?? finding.evidence.claimed]).map(async (file) => ({ path: file, exists: await pathExists(root, file) }))
+    (finding.evidence.scope?.candidates ?? [
+      finding.evidence.resolvedPath ?? finding.evidence.claimed
+    ]).map(async (file) => ({ path: file, exists: await pathExists(root, file) }))
   ) : [];
   let dirty = status.length > 0;
   if (finding.evidence.kind === "missing-script") {
-    for (const file of [...finding.evidence.manifestsChecked, ...finding.evidence.scope?.candidates ?? []]) {
+    for (const file of [
+      ...finding.evidence.manifestsChecked,
+      ...finding.evidence.scope?.candidates ?? []
+    ]) {
       if (!tracked.includes(file) && await pathExists(root, file)) dirty = true;
     }
   }
-  const fingerprint = evidenceFingerprint({ head, scope, tree, lastScopeCommit, paths, fingerprint: "" }, reason);
-  if ((await git2(root, "rev-parse", "HEAD")).trim() !== head) throw new Error("HEAD changed while collecting review evidence.");
+  const fingerprint = evidenceFingerprint(
+    { head, scope, tree, lastScopeCommit, paths, fingerprint: "" },
+    reason
+  );
+  if ((await git2(root, "rev-parse", "HEAD")).trim() !== head)
+    throw new Error("HEAD changed while collecting review evidence.");
   return {
-    ...evidenceSchema2.parse({ head, scope, tree, lastScopeCommit, paths, fingerprint }),
+    ...evidenceSchema3.parse({ head, scope, tree, lastScopeCommit, paths, fingerprint }),
     dirty,
     documentDigest: digest(document)
   };
@@ -2900,12 +3786,42 @@ async function decisionAssessment(root, finding, baselineHead) {
   if (evidence.kind !== "decision-anchor") return null;
   const id = findingId(finding);
   const store = await loadDecisionStore(root);
-  if (store.diagnostics.length) throw new Error("Decision records have unavailable or malformed evidence; review cannot be confirmed.");
+  if (store.diagnostics.length)
+    throw new Error(
+      "Decision records have unavailable or malformed evidence; review cannot be confirmed."
+    );
   const record = store.records.find((record2) => record2.id === evidence.decisionId);
   if (!record || record.version !== 2) return null;
-  const events = record.history.filter((event2) => ["accepted", "reaffirmed", "retired"].includes(event2.kind));
+  const inspection = latestDecisionInspection(
+    record,
+    evidence.provenance?.approval === "accepted" ? "operative" : "all"
+  );
+  if (inspection && record.status === "active") {
+    const capture = await captureAnchors(root, inspection.capture.anchors);
+    let ancestor = true;
+    try {
+      await git2(root, "merge-base", "--is-ancestor", baselineHead, inspection.headHash);
+    } catch {
+      ancestor = false;
+    }
+    if (ancestor)
+      return {
+        id,
+        status: !capture.complete || !inspection.capture.complete ? "unverified" : changedCaptureFiles(inspection.capture, capture).length ? "reopened" : "current",
+        outcome: "no_contradiction_found",
+        reviewer: inspection.inspector,
+        note: inspection.note,
+        reviewedHead: inspection.headHash,
+        recordPath: `.mason/decisions/${record.id}.json`,
+        reason: "A separate source inspection reports no contradiction; this does not accept or reaffirm the decision. Relevant anchor changes reopen the advisory."
+      };
+  }
+  const events = record.history.filter(
+    (event2) => ["accepted", "reaffirmed", "retired"].includes(event2.kind)
+  );
   const event = events.at(-1);
-  if (!event?.evidence || !event.actor || !event.note || !event.evidence.historyAvailable || event.evidence.localChanges.length) return null;
+  if (!event?.evidence || !event.actor || !event.note || !event.evidence.historyAvailable || event.evidence.localChanges.length)
+    return null;
   try {
     await git2(root, "merge-base", "--is-ancestor", baselineHead, event.evidence.headHash);
   } catch {
@@ -2930,7 +3846,8 @@ async function assessAdvisory(root, finding, baselineHead) {
   if ("confidence" in finding) return null;
   const id = findingId(finding);
   try {
-    if (finding.evidence.kind === "decision-anchor") return await decisionAssessment(root, finding, baselineHead);
+    if (finding.evidence.kind === "decision-anchor")
+      return await decisionAssessment(root, finding, baselineHead);
     const record = await readRecord(root, id);
     if (!record) return null;
     const event = record.events.at(-1);
@@ -2944,37 +3861,63 @@ async function assessAdvisory(root, finding, baselineHead) {
       outcome: event.outcome,
       reviewedHead: event.evidence.head
     };
-    if (current.dirty || current.fingerprint !== event.evidence.fingerprint || digest(scopes(finding, event.reasonCode)) !== digest(event.evidence.scope)) return { ...base, status: "reopened", reason: "Relevant document or repository evidence changed after the assessment; prepare a new review." };
-    return { ...base, status: event.outcome === "deferred" ? "deferred" : "current", reason: event.outcome === "deferred" ? "The review was deferred and remains outstanding." : "An explicit assessment covers the current committed scope. This does not approve an engineering decision or certify correctness." };
+    if (current.dirty || current.fingerprint !== event.evidence.fingerprint || digest(scopes(finding, event.reasonCode)) !== digest(event.evidence.scope))
+      return {
+        ...base,
+        status: "reopened",
+        reason: "Relevant document or repository evidence changed after the assessment; prepare a new review."
+      };
+    return {
+      ...base,
+      status: event.outcome === "deferred" ? "deferred" : "current",
+      reason: event.outcome === "deferred" ? "The review was deferred and remains outstanding." : "An explicit assessment covers the current committed scope. This does not approve an engineering decision or certify correctness."
+    };
   } catch (error) {
-    return { id, status: "unverified", reason: error instanceof Error ? error.message : String(error) };
+    return {
+      id,
+      status: "unverified",
+      reason: error instanceof Error ? error.message : String(error)
+    };
   }
 }
 async function advisoryReviewInventory(root) {
   let names;
   try {
-    names = await fs11.readdir(await storePath(root, ".mason/reviews/advisories"));
+    names = await fs12.readdir(await storePath(root, ".mason/reviews/advisories"));
   } catch (error) {
     if (error.code === "ENOENT") return [];
     throw error;
   }
   if (names.length > 5e3) throw new Error("Advisory review inventory exceeds 5,000 records.");
-  return Promise.all(names.filter((name) => name.endsWith(".json")).sort().map(async (name) => [name, await readAuditInput(root, ".mason/reviews/advisories/" + name)]));
+  return Promise.all(
+    names.filter((name) => name.endsWith(".json")).sort().map(async (name) => [name, await readAuditInput(root, ".mason/reviews/advisories/" + name)])
+  );
 }
 async function reviewAdvisory(rootDir, input) {
-  const root = await fs11.realpath(rootDir), request = advisoryReviewRequest.parse(input);
+  const root = await fs12.realpath(rootDir), request = advisoryReviewRequest.parse(input);
   const { loadRepairBaseline: loadRepairBaseline2 } = await Promise.resolve().then(() => (init_repair(), repair_exports));
   const baseline = await loadRepairBaseline2(root, request.baselinePath);
-  const finding = [...baseline.original.advisories, ...baseline.original.suppressedAdvisories ?? []].find((f) => findingId(f) === request.findingId);
-  if (!finding) throw new Error("No advisory with this findingId in the original baseline. Provable issues must be repaired and rechecked.");
-  if (finding.evidence.kind === "decision-anchor") return {
-    status: "decision-review-required",
-    decisionId: finding.evidence.decisionId,
-    hint: "Use review_decision to prepare evidence and record authorized acceptance, reaffirmation or retirement, then verify this original repair baseline. An advisory assessment cannot approve a decision."
-  };
+  const finding = [
+    ...baseline.original.advisories,
+    ...baseline.original.suppressedAdvisories ?? []
+  ].find((f) => findingId(f) === request.findingId);
+  if (!finding)
+    throw new Error(
+      "No advisory with this findingId in the original baseline. Provable issues must be repaired and rechecked."
+    );
+  if (finding.evidence.kind === "decision-anchor")
+    return {
+      status: "decision-review-required",
+      decisionId: finding.evidence.decisionId,
+      hint: "Use review_decision to prepare evidence and record a source inspection without human approval, or an authorized acceptance, reaffirmation or retirement, then verify this original repair baseline. An advisory assessment cannot approve a decision."
+    };
   if (request.action === "dismiss") {
-    if (finding.type !== "deps-changed" || finding.evidence.kind !== "doc-behind-manifests") throw new Error("One-step dismissal is only available for dependency advisories.");
-    if (!request.reasonCode || !request.note) throw new Error("Dismissal requires reasonCode and note; it does not require a reviewer or prepared token.");
+    if (finding.type !== "deps-changed" || finding.evidence.kind !== "doc-behind-manifests")
+      throw new Error("One-step dismissal is only available for dependency advisories.");
+    if (!request.reasonCode || !request.note)
+      throw new Error(
+        "Dismissal requires reasonCode and note; it does not require a reviewer or prepared token."
+      );
   } else if (request.reasonCode) throw new Error("reasonCode is only used with dismiss.");
   const prepare = async () => {
     const record = await readRecord(root, request.findingId);
@@ -2988,13 +3931,27 @@ async function reviewAdvisory(rootDir, input) {
     let diff = null, diffNote;
     const from = finding.evidence.kind === "doc-behind-manifests" ? finding.evidence.docLastCommit.hash : baseline.original.headHash;
     try {
-      const full = await git2(root, "diff", "--no-ext-diff", "--no-textconv", "--no-color", "--no-renames", "-U3", from, state.evidence.head, "--", ...state.evidence.scope);
+      const full = await git2(
+        root,
+        "diff",
+        "--no-ext-diff",
+        "--no-textconv",
+        "--no-color",
+        "--no-renames",
+        "-U3",
+        from,
+        state.evidence.head,
+        "--",
+        ...state.evidence.scope
+      );
       diff = full.slice(0, 16e3);
-      if (full.length > diff.length) diffNote = "Diff preview truncated; inspect the full scoped diff before reviewing.";
+      if (full.length > diff.length)
+        diffNote = "Diff preview truncated; inspect the full scoped diff before reviewing.";
     } catch {
       diffNote = "Diff preview unavailable; inspect the original cited evidence directly before reviewing.";
     }
-    if ((await prepare()).token !== state.token) throw new Error("Review evidence changed during preparation; retry.");
+    if ((await prepare()).token !== state.token)
+      throw new Error("Review evidence changed during preparation; retry.");
     return {
       status: "prepared",
       findingId: request.findingId,
@@ -3007,12 +3964,22 @@ async function reviewAdvisory(rootDir, input) {
       hint: "Inspect the original finding, scoped document and relevant code changes. Record addressed, inapplicable or deferred only when the user or cited project review authorizes that assessment. Supply the actual reviewer, reason in note and reviewToken. Relevant edits must be committed first. Deferral remains outstanding. Review identities are recorded assertions, not authenticated approvals."
     };
   }
-  if (request.action !== "dismiss" && (!request.reviewer || !request.note || !request.reviewToken)) throw new Error("Prepare first; recording an assessment requires reviewToken, reviewer and note.");
+  if (request.action !== "dismiss" && (!request.reviewer || !request.note || !request.reviewToken))
+    throw new Error(
+      "Prepare first; recording an assessment requires reviewToken, reviewer and note."
+    );
   return withLock(root, ".mason/reports/advisory-review-locks/" + request.findingId, async () => {
     const state = await prepare();
-    if (request.action !== "dismiss" && state.token !== request.reviewToken) throw new Error("Review conflict: evidence or review history changed since preparation. Prepare and inspect a new review.");
-    if (state.evidence.dirty) throw new Error("Commit relevant document and repository edits before recording the assessment. Unrelated local work may remain.");
-    if ((state.record?.events.length ?? 0) >= 200) throw new Error("Review history limit reached; existing events were retained.");
+    if (request.action !== "dismiss" && state.token !== request.reviewToken)
+      throw new Error(
+        "Review conflict: evidence or review history changed since preparation. Prepare and inspect a new review."
+      );
+    if (state.evidence.dirty)
+      throw new Error(
+        "Commit relevant document and repository edits before recording the assessment. Unrelated local work may remain."
+      );
+    if ((state.record?.events.length ?? 0) >= 200)
+      throw new Error("Review history limit reached; existing events were retained.");
     const { dirty, documentDigest, ...evidence } = state.evidence;
     const event = eventSchema2.parse({
       at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -3023,9 +3990,17 @@ async function reviewAdvisory(rootDir, input) {
       finding,
       evidence
     });
-    const payload = { version: 1, id: request.findingId, events: [...state.record?.events ?? [], event] };
-    if ((await prepare()).token !== state.token) throw new Error("Review conflict: evidence changed while recording the assessment.");
-    await writeStoreJson(root, recordPath(request.findingId), { ...payload, digest: digest(payload) });
+    const payload = {
+      version: 1,
+      id: request.findingId,
+      events: [...state.record?.events ?? [], event]
+    };
+    if ((await prepare()).token !== state.token)
+      throw new Error("Review conflict: evidence changed while recording the assessment.");
+    await writeStoreJson(root, recordPath(request.findingId), {
+      ...payload,
+      digest: digest(payload)
+    });
     return {
       status: "recorded",
       recordPath: recordPath(request.findingId),
@@ -3034,7 +4009,7 @@ async function reviewAdvisory(rootDir, input) {
     };
   });
 }
-var git2, hashSchema, commitSchema2, evidenceSchema2, dismissalReasonSchema, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
+var git2, hashSchema, commitSchema2, evidenceSchema3, dismissalReasonSchema, eventSchema2, recordSchema, reviewSummarySchema, advisoryReviewRequest, recordPath;
 var init_advisory_review = __esm({
   "src/audit/advisory-review.ts"() {
     "use strict";
@@ -3048,43 +4023,62 @@ var init_advisory_review = __esm({
     init_paths();
     init_store();
     init_decisions();
+    init_provenance();
+    init_anchors();
     init_drift2();
     git2 = async (root, ...args) => (await (["log", "ls-tree", "ls-files", "merge-base"].includes(args[0]) ? inspectionGit : execGit)(args, { cwd: root, timeout: 1e4, maxBuffer: 8 * 1024 * 1024 })).stdout;
-    hashSchema = z8.string().regex(/^[a-f0-9]{64}$/);
-    commitSchema2 = z8.string().regex(/^[a-f0-9]{40,64}$/);
-    evidenceSchema2 = z8.object({
+    hashSchema = z11.string().regex(/^[a-f0-9]{64}$/);
+    commitSchema2 = z11.string().regex(/^[a-f0-9]{40,64}$/);
+    evidenceSchema3 = z11.object({
       head: commitSchema2,
       fingerprint: hashSchema,
-      scope: z8.array(z8.string()).min(1).max(1e3),
-      tree: z8.string().max(2 * 1024 * 1024),
+      scope: z11.array(z11.string()).min(1).max(1e3),
+      tree: z11.string().max(2 * 1024 * 1024),
       lastScopeCommit: commitSchema2,
-      paths: z8.array(z8.object({ path: z8.string(), exists: z8.boolean() })).max(1e3)
+      paths: z11.array(z11.object({ path: z11.string(), exists: z11.boolean() })).max(1e3)
     });
-    dismissalReasonSchema = z8.enum(["no-dependency-claims", "unrelated-manifest-change"]);
-    eventSchema2 = z8.object({
-      at: z8.string().datetime(),
-      reviewer: z8.string().trim().min(1).max(200).optional(),
-      note: z8.string().trim().min(1).max(2500),
-      outcome: z8.enum(["addressed", "inapplicable", "deferred", "dismissed"]),
+    dismissalReasonSchema = z11.enum(["no-dependency-claims", "unrelated-manifest-change"]);
+    eventSchema2 = z11.object({
+      at: z11.string().datetime(),
+      reviewer: z11.string().trim().min(1).max(200).optional(),
+      note: z11.string().trim().min(1).max(2500),
+      outcome: z11.enum(["addressed", "inapplicable", "deferred", "dismissed"]),
       reasonCode: dismissalReasonSchema.optional(),
-      finding: advisorySchema.refine((finding) => finding.evidence.kind !== "decision-anchor", "Decision findings use decision reviews"),
-      evidence: evidenceSchema2
+      finding: advisorySchema.refine(
+        (finding) => finding.evidence.kind !== "decision-anchor",
+        "Decision findings use decision reviews"
+      ),
+      evidence: evidenceSchema3
+    });
+    recordSchema = z11.object({
+      version: z11.literal(1),
+      id: hashSchema,
+      events: z11.array(eventSchema2).min(1).max(200),
+      digest: hashSchema
     });
-    recordSchema = z8.object({ version: z8.literal(1), id: hashSchema, events: z8.array(eventSchema2).min(1).max(200), digest: hashSchema });
-    reviewSummarySchema = z8.object({
+    reviewSummarySchema = z11.object({
       id: hashSchema,
-      status: z8.enum(["current", "reopened", "deferred", "unverified"]),
-      reason: z8.string(),
-      recordPath: z8.string().optional(),
-      reviewer: z8.string().optional(),
-      note: z8.string().optional(),
-      outcome: z8.enum(["addressed", "inapplicable", "deferred", "accepted", "reaffirmed", "retired", "dismissed"]).optional(),
-      reviewedHead: z8.string().optional()
+      status: z11.enum(["current", "reopened", "deferred", "unverified"]),
+      reason: z11.string(),
+      recordPath: z11.string().optional(),
+      reviewer: z11.string().optional(),
+      note: z11.string().optional(),
+      outcome: z11.enum([
+        "addressed",
+        "inapplicable",
+        "deferred",
+        "accepted",
+        "reaffirmed",
+        "retired",
+        "dismissed",
+        "no_contradiction_found"
+      ]).optional(),
+      reviewedHead: z11.string().optional()
     });
-    advisoryReviewRequest = z8.object({
-      baselinePath: z8.string().min(1),
+    advisoryReviewRequest = z11.object({
+      baselinePath: z11.string().min(1),
       findingId: hashSchema,
-      action: z8.enum(["prepare", "addressed", "inapplicable", "deferred", "dismiss"]).default("prepare"),
+      action: z11.enum(["prepare", "addressed", "inapplicable", "deferred", "dismiss"]).default("prepare"),
       reasonCode: dismissalReasonSchema.optional(),
       reviewer: eventSchema2.shape.reviewer.optional(),
       note: eventSchema2.shape.note.optional(),
@@ -3095,14 +4089,17 @@ var init_advisory_review = __esm({
 });
 
 // src/audit/audit.ts
-import fs12 from "fs/promises";
-import path21 from "path";
+import fs13 from "fs/promises";
+import path19 from "path";
 async function computeAudit(rootDir, options = {}) {
   return profilePhase("audit.current", () => auditCurrent(rootDir, options));
 }
 async function auditCurrent(rootDir, options) {
-  const resolvedRoot = path21.resolve(rootDir);
-  const [docs, headHash] = await Promise.all([discoverDocs(resolvedRoot), getCurrentGitHash(resolvedRoot)]);
+  const resolvedRoot = path19.resolve(rootDir);
+  const [docs, headHash] = await Promise.all([
+    discoverDocs(resolvedRoot),
+    getCurrentGitHash(resolvedRoot)
+  ]);
   if (docs.length === 0) return null;
   const report = {
     version: 1,
@@ -3130,12 +4127,13 @@ async function auditCurrent(rootDir, options) {
   const changesByCommit = /* @__PURE__ */ new Map();
   for (const doc of docs) {
     const hash = doc.lastCommit?.hash;
-    if (hash && !changesByCommit.has(hash)) changesByCommit.set(hash, await getChangesWithStatus(resolvedRoot, hash));
+    if (hash && !changesByCommit.has(hash))
+      changesByCommit.set(hash, await getChangesWithStatus(resolvedRoot, hash));
     changesSinceDoc.set(doc.path, hash ? changesByCommit.get(hash) : null);
   }
   let decisionsPresent = false;
   try {
-    await fs12.access(path21.join(resolvedRoot, ".mason", "decisions"));
+    await fs13.access(path19.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -3152,21 +4150,35 @@ async function auditCurrent(rootDir, options) {
   for (const name of ALL_CHECKS) {
     if (!selected.includes(name)) continue;
     const exclusions = policy?.exclude?.[name] ?? [];
-    const included = await includedCheckPaths(resolvedRoot, docs.map((doc) => doc.path), exclusions);
+    const included = await includedCheckPaths(
+      resolvedRoot,
+      docs.map((doc) => doc.path),
+      exclusions
+    );
     const excluded = docs.filter((doc) => !included.has(doc.path)).map((doc) => ({ check: name, doc: doc.path }));
     if (excluded.length) (report.excludedChecks ??= []).push(...excluded);
     const scoped = { ...ctx, docs: docs.filter((doc) => included.has(doc.path)) };
     const { issues, advisories, suppressedAdvisories, skipped } = await (options.runCheck ? options.runCheck(name, scoped) : CHECKS[name](scoped));
     report.checksRun.push(name);
     report.issues.push(...issues);
-    const advisoryPaths = await includedCheckPaths(resolvedRoot, [...new Set(advisories.map((f) => f.anchor.doc))], exclusions);
+    const advisoryPaths = await includedCheckPaths(
+      resolvedRoot,
+      [...new Set(advisories.map((f) => f.anchor.doc))],
+      exclusions
+    );
     report.advisories.push(...advisories.filter((f) => advisoryPaths.has(f.anchor.doc)));
-    for (const f of advisories) if (!advisoryPaths.has(f.anchor.doc)) (report.excludedChecks ??= []).push({ check: name, doc: f.anchor.doc });
+    for (const f of advisories)
+      if (!advisoryPaths.has(f.anchor.doc))
+        (report.excludedChecks ??= []).push({ check: name, doc: f.anchor.doc });
     report.suppressedAdvisories.push(...suppressedAdvisories ?? []);
     report.skippedChecks.push(...skipped);
   }
   report.clean = report.issues.length === 0;
-  const reviews = (await Promise.all([...report.advisories, ...report.suppressedAdvisories].map((finding) => assessAdvisory(resolvedRoot, finding, headHash)))).filter((review) => review !== null);
+  const reviews = (await Promise.all(
+    [...report.advisories, ...report.suppressedAdvisories].map(
+      (finding) => assessAdvisory(resolvedRoot, finding, headHash)
+    )
+  )).filter((review) => review !== null);
   if (reviews.length) report.advisoryReviews = reviews;
   return report;
 }
@@ -3190,11 +4202,11 @@ init_audit();
 init_types();
 init_repair();
 init_findings();
-import path23 from "path";
+import path21 from "path";
 
 // src/audit/advisory-cli.ts
 init_advisory_review();
-import path22 from "path";
+import path20 from "path";
 import { stripVTControlCharacters } from "util";
 var USAGE = `Usage: mason audit review --baseline <path> --finding <id> [options]
 
@@ -3228,12 +4240,23 @@ async function runAdvisoryCli(args, io = { out: (text2) => console.log(text2), e
         json = true;
         continue;
       }
-      if (!["--dir", "--baseline", "--finding", "--outcome", "--reviewer", "--note", "--token", "--reason"].includes(flag) || flags[flag]) throw new Error("Unexpected or repeated argument: " + flag);
+      if (![
+        "--dir",
+        "--baseline",
+        "--finding",
+        "--outcome",
+        "--reviewer",
+        "--note",
+        "--token",
+        "--reason"
+      ].includes(flag) || flags[flag])
+        throw new Error("Unexpected or repeated argument: " + flag);
       const value = args[++i];
       if (!value || value.startsWith("--")) throw new Error(flag + " requires a value.");
       flags[flag] = value;
     }
-    if (!flags["--outcome"] && ["--reviewer", "--note", "--token", "--reason"].some((key) => flags[key])) throw new Error("Use --outcome to record an assessment.");
+    if (!flags["--outcome"] && ["--reviewer", "--note", "--token", "--reason"].some((key) => flags[key]))
+      throw new Error("Use --outcome to record an assessment.");
     const input = {
       baselinePath: flags["--baseline"],
       findingId: flags["--finding"],
@@ -3243,20 +4266,25 @@ async function runAdvisoryCli(args, io = { out: (text2) => console.log(text2), e
       reviewToken: flags["--token"],
       reasonCode: flags["--reason"]
     };
-    const result = await reviewAdvisory(path22.resolve(flags["--dir"] ?? process.cwd()), input);
+    const result = await reviewAdvisory(path20.resolve(flags["--dir"] ?? process.cwd()), input);
     if (json) io.out(JSON.stringify(result, null, 2));
     else {
       const lines = [`Advisory review: ${result.status}.`];
-      if ("finding" in result && result.finding && result.evidence) lines.push(
-        `[${result.finding.type}] ${result.finding.anchor.doc}: ${result.finding.message}`,
-        `Finding: ${result.findingId}`,
-        `Prepared against commit ${result.evidence.head.slice(0, 12)}.`,
-        result.evidence.dirty ? "Relevant files have uncommitted edits; commit them and prepare again before recording." : "Relevant files are committed.",
-        `Review token: ${result.reviewToken}`,
-        ...result.diff ? ["Scoped changes:", result.diff] : [],
-        ...result.diffNote ? [result.diffNote] : []
-      );
-      if ("event" in result) lines.push(`${result.event.outcome} \u2014 ${result.event.reviewer}: ${result.event.note}`, `Record: ${result.recordPath}`);
+      if ("finding" in result && result.finding && result.evidence)
+        lines.push(
+          `[${result.finding.type}] ${result.finding.anchor.doc}: ${result.finding.message}`,
+          `Finding: ${result.findingId}`,
+          `Prepared against commit ${result.evidence.head.slice(0, 12)}.`,
+          result.evidence.dirty ? "Relevant files have uncommitted edits; commit them and prepare again before recording." : "Relevant files are committed.",
+          `Review token: ${result.reviewToken}`,
+          ...result.diff ? ["Scoped changes:", result.diff] : [],
+          ...result.diffNote ? [result.diffNote] : []
+        );
+      if ("event" in result)
+        lines.push(
+          `${result.event.outcome} \u2014 ${result.event.reviewer}: ${result.event.note}`,
+          `Record: ${result.recordPath}`
+        );
       lines.push(result.hint);
       io.out(stripVTControlCharacters(lines.join("\n")));
     }
@@ -3318,7 +4346,8 @@ function parseArgs(argv) {
       parsed.prepareRepair = true;
     } else if (arg === "--verify-repair") {
       const value = argv[++i];
-      if (!value || value.startsWith("--")) throw new Error("--verify-repair requires a baseline path");
+      if (!value || value.startsWith("--"))
+        throw new Error("--verify-repair requires a baseline path");
       parsed.baseline = value;
     } else if (arg === "--help" || arg === "-h") {
       parsed.help = true;
@@ -3333,9 +4362,7 @@ function parseArgs(argv) {
       if (!names.length) throw new Error("--checks requires at least one check");
       for (const name of names) {
         if (!ALL_CHECKS.includes(name)) {
-          throw new Error(
-            `Unknown check: ${name} (valid: ${ALL_CHECKS.join(", ")})`
-          );
+          throw new Error(`Unknown check: ${name} (valid: ${ALL_CHECKS.join(", ")})`);
         }
       }
       parsed.checks = names;
@@ -3354,9 +4381,15 @@ function issueLine(issue) {
 }
 function formatAuditSummary(report) {
   const lines = [];
-  const reviewed = new Set(report.advisoryReviews?.filter((review) => review.status === "current").map((review) => review.id));
-  const open = report.advisories.filter((finding) => finding.resolution !== "informational" && !reviewed.has(findingId(finding)));
-  const suppressed = (report.suppressedAdvisories ?? []).filter((finding) => finding.resolution !== "informational" && !reviewed.has(findingId(finding)));
+  const reviewed = new Set(
+    report.advisoryReviews?.filter((review) => review.status === "current").map((review) => review.id)
+  );
+  const open = report.advisories.filter(
+    (finding) => finding.resolution !== "informational" && !reviewed.has(findingId(finding))
+  );
+  const suppressed = (report.suppressedAdvisories ?? []).filter(
+    (finding) => finding.resolution !== "informational" && !reviewed.has(findingId(finding))
+  );
   const reviewCount = open.length + suppressed.length;
   for (const doc of report.docs) {
     const docIssues = report.issues.filter((i) => i.anchor.doc === doc.path);
@@ -3374,9 +4407,17 @@ function formatAuditSummary(report) {
   for (const issue of report.issues) {
     if (!docPaths.has(issue.anchor.doc)) lines.push(issueLine(issue));
   }
-  const information = [...report.advisories, ...report.suppressedAdvisories ?? []].filter((f) => f.resolution === "informational");
-  if (information.length) lines.push(`${information.length} informational dependency notices; no review required (see --json).`);
-  if (report.excludedChecks?.length) lines.push(`${report.excludedChecks.length} document/check pairs excluded by project policy (see --json).`);
+  const information = [...report.advisories, ...report.suppressedAdvisories ?? []].filter(
+    (f) => f.resolution === "informational"
+  );
+  if (information.length)
+    lines.push(
+      `${information.length} informational dependency notices; no review required (see --json).`
+    );
+  if (report.excludedChecks?.length)
+    lines.push(
+      `${report.excludedChecks.length} document/check pairs excluded by project policy (see --json).`
+    );
   if (open.length > 0) {
     lines.push("Advisories (do not affect the exit code):");
     for (const advisory of open) {
@@ -3388,10 +4429,16 @@ function formatAuditSummary(report) {
       lines.push(`  [skipped] ${skip.check}: ${skip.reason}`);
     }
   }
-  if (reviewed.size) lines.push(`${reviewed.size} advisories have recorded assessments covering current evidence (see --json).`);
-  for (const review of report.advisoryReviews ?? []) if (review.status !== "current") lines.push(`  [${review.status}] ${review.reason}`);
+  if (reviewed.size)
+    lines.push(
+      `${reviewed.size} advisories have recorded assessments covering current evidence (see --json).`
+    );
+  for (const review of report.advisoryReviews ?? [])
+    if (review.status !== "current") lines.push(`  [${review.status}] ${review.reason}`);
   for (const advisory of suppressed) {
-    lines.push(`  [suppressed; unresolved] ${advisory.type} ${advisory.anchor.doc}: ${advisory.message}`);
+    lines.push(
+      `  [suppressed; unresolved] ${advisory.type} ${advisory.anchor.doc}: ${advisory.message}`
+    );
   }
   lines.push(
     report.clean ? reviewCount || report.skippedChecks.length ? `No audit issues detected (${report.docs.length} docs audited); ${reviewCount} advisories remain for review, ${report.skippedChecks.length} checks skipped.` : `Context files are clean (${report.docs.length} doc${report.docs.length === 1 ? "" : "s"} audited).` : `${report.issues.length} issue${report.issues.length === 1 ? "" : "s"} across ${report.docs.length} doc${report.docs.length === 1 ? "" : "s"}.`
@@ -3406,23 +4453,23 @@ function formatFixPrompt(report, baselinePath) {
   );
   lines.push("");
   lines.push("RULES:");
-  lines.push(baselinePath ? `- Preserve the original repair baseline: ${JSON.stringify(baselinePath)}. Do not replace it after editing.` : "- Before the first edit, call mason_repair with action: prepare, or run mason-audit --prepare-repair --json with the same --dir and --checks. Keep the returned baselinePath through verification.");
   lines.push(
-    `- Edit ONLY these files: ${flaggedDocs.join(", ") || "none (advisory review only)"}. Bring the docs into agreement with verified source evidence; do not change source code or configs to silence findings.`
+    baselinePath ? `- Preserve the original repair baseline: ${JSON.stringify(baselinePath)}. Do not replace it after editing.` : "- Before the first edit, run mason audit --prepare-repair --json with the same --dir and --checks. Keep the returned baselinePath through verification."
   );
   lines.push(
-    "- Keep diffs minimal: change the smallest span that makes each claim true."
+    `- Edit ONLY these files: ${flaggedDocs.join(", ") || "none (advisory review only)"}. Bring the docs into agreement with verified source evidence; do not change source code or configs to silence findings.`
   );
+  lines.push("- Keep diffs minimal: change the smallest span that makes each claim true.");
   lines.push(
     "- Never invent content. Every replacement must be grounded in the evidence below or in files you read from this repository."
   );
-  lines.push("- Inspect likely findings before editing: heuristic evidence may describe an intentional omission or an example.");
   lines.push(
-    "- deleted-reference: if evidence shows renamedTo, update the path; otherwise remove the reference, or rephrase to past tense if the sentence is about history. Deleted paths inside directory trees: delete the tree line."
+    "- Inspect likely findings before editing: heuristic evidence may describe an intentional omission or an example."
   );
   lines.push(
-    "- stale-count: replace the number with the actual count from the evidence."
+    "- deleted-reference: if evidence shows renamedTo, update the path; otherwise remove the reference, or rephrase to past tense if the sentence is about history. Deleted paths inside directory trees: delete the tree line."
   );
+  lines.push("- stale-count: replace the number with the actual count from the evidence.");
   lines.push(
     "- dead-command: replace with the correct script from availableScripts if an obvious rename exists; otherwise remove the command mention."
   );
@@ -3430,10 +4477,12 @@ function formatFixPrompt(report, baselinePath) {
     "- new-module: review whether the directory needs documenting; an omission alone does not establish a defect. Preserve scope and describe only what you verified."
   );
   lines.push(
-    "- Specific historical ADVISORIES require a separate authorized assessment using review_advisory with the baselinePath and findingId from verification. Prepare and inspect evidence first; record addressed, inapplicable or deferred with the actual reviewer, note and reviewToken. Dependency notices marked resolution: informational require no review. Dependency advisories may be dismissed with action: dismiss, reasonCode (no-dependency-claims or unrelated-manifest-change), and note, without a reviewer or token. Decision findings use review_decision. Candidates marked resolution: recheck can be rerun to see whether the condition remains; this does not establish semantic approval. Report what remains unknown."
+    "- Specific historical ADVISORIES require a separate authorized assessment using mason audit review with --baseline and --finding from verification. Prepare and inspect evidence first; record addressed, inapplicable or deferred with the actual reviewer, note and reviewToken. Dependency notices marked resolution: informational require no review. Dependency advisories may be dismissed with --outcome dismiss, --reason (no-dependency-claims or unrelated-manifest-change), and --note, without a reviewer or token. Decision findings use review_decision. Candidates marked resolution: recheck can be rerun to see whether the condition remains; this does not establish semantic approval. Report what remains unknown."
   );
   lines.push("");
-  lines.push("AUDIT REPORT (current context files and repository evidence, including local edits):");
+  lines.push(
+    "AUDIT REPORT (current context files and repository evidence, including local edits):"
+  );
   lines.push(
     JSON.stringify(
       {
@@ -3450,7 +4499,7 @@ function formatFixPrompt(report, baselinePath) {
   );
   lines.push("");
   lines.push(
-    "After edits, call mason_repair with action: verify and the original baselinePath, or mason-audit --verify-repair <baselinePath> --dir <project>. Repeat against the same baseline after any final documentation commit. Summarize resolved, unresolved, review-required, unverified, and new findings with their evidence. Do not report a suppressed or unavailable check as fixed. This audit covers the listed documents and supported claims; application behavior and code examples need their own validation."
+    "After edits, run mason audit --verify-repair <baselinePath> --dir <project>. Repeat against the same baseline after any final documentation commit. Summarize resolved, unresolved, review-required, unverified, and new findings with their evidence. Do not report a suppressed or unavailable check as fixed. This audit covers the listed documents and supported claims; application behavior and code examples need their own validation."
   );
   return lines.join("\n");
 }
@@ -3468,7 +4517,9 @@ async function runAuditCli(argv, io = {
       throw new Error("--json and --fix-prompt are mutually exclusive");
     }
     if (args.baseline && (args.prepareRepair || args.checks || args.fixPrompt)) {
-      throw new Error("--verify-repair cannot be combined with --prepare-repair, --checks, or --fix-prompt; verification uses the original scope");
+      throw new Error(
+        "--verify-repair cannot be combined with --prepare-repair, --checks, or --fix-prompt; verification uses the original scope"
+      );
     }
   } catch (error) {
     io.err(error instanceof Error ? error.message : String(error));
@@ -3479,17 +4530,25 @@ async function runAuditCli(argv, io = {
     io.out(USAGE2);
     return 0;
   }
-  const rootDir = path23.resolve(args.dir);
+  const rootDir = path21.resolve(args.dir);
   if (args.baseline || args.prepareRepair) {
     try {
       if (args.baseline) {
         const verification = await verifyRepair(rootDir, args.baseline);
-        io.out(args.json ? JSON.stringify(verification, null, 2) : formatRepairSummary(verification));
+        io.out(
+          args.json ? JSON.stringify(verification, null, 2) : formatRepairSummary(verification)
+        );
         return repairExitCode(verification);
       }
       const prepared = await prepareRepair(rootDir, args.checks);
-      io.out(args.json ? JSON.stringify({ ...prepared, workOrder: formatFixPrompt(prepared.report, prepared.baselinePath) }, null, 2) : args.fixPrompt ? formatFixPrompt(prepared.report, prepared.baselinePath) : `Repair baseline: ${prepared.baselinePath}
-${formatAuditSummary(prepared.report)}`);
+      io.out(
+        args.json ? JSON.stringify(
+          { ...prepared, workOrder: formatFixPrompt(prepared.report, prepared.baselinePath) },
+          null,
+          2
+        ) : args.fixPrompt ? formatFixPrompt(prepared.report, prepared.baselinePath) : `Repair baseline: ${prepared.baselinePath}
+${formatAuditSummary(prepared.report)}`
+      );
       return prepared.report.clean ? 0 : 1;
     } catch (error) {
       io.err(error instanceof Error ? error.message : String(error));
@@ -3498,9 +4557,7 @@ ${formatAuditSummary(prepared.report)}`);
   }
   const report = await computeAudit(rootDir, { checks: args.checks });
   if (!report) {
-    io.err(
-      `No README.md or agent instruction files found in ${rootDir}.`
-    );
+    io.err(`No README.md or agent instruction files found in ${rootDir}.`);
     return 2;
   }
   if (!report.gitAvailable) {