mason-context 0.21.0 → 0.22.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## Unreleased
+
+## 0.22.0 — 2026-10-12
+
+- Separate CLI scopes: `mason init` prepares shared repository integration without activating it; `mason setup` activates compatible existing configuration using local state only. `mason teardown` now disconnects locally; use `--project` explicitly for shared removal. Initialization and teardown support read-only `--dry-run` previews. Compatible older instructions, supported legacy hooks and JSON formatting do not force shared rewrites; status reports optional template updates separately. MCP exposes matching `init`/`setup` modes. Setup no longer triggers background update checks. Migrate scripts that used setup to generate configuration to `mason init` followed by `mason setup`; scripts removing shared configuration must add `teardown --project`.
+
+- Simplify project integration to MCP, reasoning instructions and decision hooks, prepared by `mason init` and activated locally by `mason setup`. Remove automatic documentation audits, committed-diff review, repair capture and statistics enrollment. Setup results expose a configuration receipt instead of audit findings/report paths; legacy receipt pointers and existing audit artifacts remain intact. Statistics are opt-in through `mason stats --enable`; existing preferences are unchanged. Run `mason init --host <host>` after upgrading to refresh the shorter shared project guidance, review and commit those changes, then run `mason setup --host <host>` locally.
+
+- Separate lifecycle decision checks from documentation-repair automation. Hooks check current decision anchors without discovering document claims, creating repair baselines, or verifying old audit findings. Preserve paired edit observation, source-inspection and human-review boundaries, Stop deduplication, guidance delivery and explicit audit checks. Reuse the event/receipt store with a separate guidance report pointer; status and setup output label verification scope. Old baselines and assessments stay available to explicit checks.
+
+- Consolidate documentation repair and advisory assessment on the existing CLI: remove the duplicate `mason_repair` and `review_advisory` MCP tools. Use `mason audit --prepare-repair`, `mason audit --verify-repair <baselinePath>`, and `mason audit review`. Update project instructions, work orders and hook notices to point to these commands. Run `mason init --host <host>` after upgrading to refresh shared instructions. Existing baselines, review records, hooks and decision review semantics remain supported.
+
+- Remove managed architecture-map creation (`generate_snapshot_batch`, `save_partial_snapshot`, `reduce_snapshot`, and `mason_init` map mode) and general orientation (`full_analysis`, `analyze_project`, `get_code_samples`). Remove batch prompts, partial-store management, the orientation analyzer and sampler. Keep existing map reading, direct saving, drift and verification; direct saves merge supported updates and no longer consume or clear old partials. Missing maps return a short decision-context pointer. Refresh instructions use the agent's source tools and direct saving. Keep 0.21.0 for the old managed build workflow and run `mason init --host <host>` after upgrading to refresh shared project instructions.
+
+- Remove Confluence publishing (`mason_set_confluence`, `export_to_confluence`) and its standalone LLM provider/configuration layer to focus maintenance on engineering reasoning. Remove the Anthropic/OpenAI SDK dependencies. Existing wiki pages, legacy feature settings, and user credentials are left untouched; Mason no longer reads or updates them. `mason_complete_init` no longer accepts `confluenceConfigured` or advertises Confluence status. Users needing wiki publishing should keep 0.21.0 until they migrate that workflow to a separate publisher.
+
+- Deliver file-scoped decision knowledge through standard Claude hooks after `Read` and before `Edit`/`Write`, reusing the existing injector and session deduplication. Confine delivery to the active checkout, retain approval/freshness labels and audit diagnostics, and preserve the standalone PostToolUse contract. Shell commands and Codex remain outside direct lesson injection.
+- Flatten hook commands to `mason install`, `mason config`, and `mason hook --host claude|codex`. Generate shorter hook handlers and migrate existing configurations without duplicates. Retain `mason auto …` aliases and the standalone decision injector for compatibility.
+
 ## 0.21.0 — 2026-10-10
 
 - Continue Claude once at Stop when outstanding decision drift overlaps observed session anchor edits. Require source inspection, preserve human approval boundaries, and keep repeat Stops and Codex advisory. Add local `mason auto config --stop-block off|drift` controls and status reporting. Include uncommitted anchor changes in drift findings for accepted and legacy decisions using Git baselines.

package/README.md

@@ -2,9 +2,9 @@
 
 # Mason
 
-### Your agents are creating tech debt. Mason helps you prevent it.
+### Preserve why your code was built this way.
 
-**Remember why decisions were made · Catch outdated guidance · Find what else needs updating**
+**Record the reason · Review the lesson · Surface applicable guidance · Reconsider it as code changes**
 
 [![npm version](https://img.shields.io/npm/v/mason-context?style=flat-square&labelColor=334155&color=2563eb)](https://www.npmjs.com/package/mason-context)
 [![CI](https://img.shields.io/github/actions/workflow/status/adrianczuczka/mason/ci.yml?branch=main&style=flat-square&labelColor=334155&label=CI)](https://github.com/adrianczuczka/mason/actions/workflows/ci.yml)
@@ -18,6 +18,8 @@
 
 </div>
 
+Mason preserves reviewed engineering reasoning with your repository, so future maintainers and coding agents can retrieve the evidence behind consequential decisions. Record workarounds, rejected approaches and constraints while their reasons are available; revisit them when the underlying code changes.
+
 ## Get started
 
 Install on macOS or Linux:
@@ -39,11 +41,12 @@ New standard standalone installs update automatically in the background. Updates
 Run this in your Git repository (open a new terminal if the installer asks):
 
 ```bash
-mason setup --host codex
+mason init --host codex    # Maintainer: prepare shared configuration for review/commit
+mason setup --host codex   # Each developer: activate locally
 # For Claude Code, use --host claude.
 ```
 
-Setup connects MCP, hooks, and project instructions. Review your host's trust settings, start a new session, and give your agent a normal task.
+If the repository already has compatible Mason configuration, run only `mason setup`. Initialization prepares MCP, hooks and project instructions; setup leaves shared files untouched. Review your host's trust settings, start a new session, and give your agent a normal task.
 
 Check that Mason is being used:
 
@@ -71,7 +74,7 @@ The audit checks claims in README and agent instruction files throughout the rep
 | Old decisions lose their context. | Retrieving recorded rationale and review status, and flagging changes to the code they apply to. |
 | A repair gets interrupted. | Retaining the original findings and verifying them through the final documentation commit. |
 
-After resolving an incident or settling a constraint, ask your agent to record the reason with Mason. Later tasks can retrieve it. Proposals and accepted decisions stay distinct.
+After resolving an incident or settling a constraint, ask your agent to record a sourced proposal with Mason. Review it before accepting it as project guidance. Later tasks can retrieve the operative accepted revision while proposed replacements remain distinct, and changes to referenced code can prompt inspection, revision or retirement.
 
 Mason complements tests, linters, and code review. Findings are evidence to inspect; unavailable checks stay explicit.
 
@@ -79,6 +82,8 @@ Mason complements tests, linters, and code review. Findings are evidence to insp
 
 Earlier read-only decision-retrieval evaluations scored **9.0/10 with Mason vs 7.0/10 without**. The initial ten-task patch comparison tied at **10/10 for both**. Improved patch outcomes remain to be demonstrated. [Results, methodology, and limitations](docs/benchmarks.md)
 
+Maintained notes also succeeded in the reuse trials. Recent hook experiments verified supported file delivery, with additional context cost and no demonstrated correctness gain; direct delivery for ordinary Bash workflows remains open. The current focus is useful preservation and reuse of engineering reasoning during ordinary work, with capture and maintenance effort that feels worthwhile. Preventing repeat mistakes is one intended benefit; comparative superiority remains unestablished. [Positioning and validation plan](ROADMAP.md#historical-context-focus--2026-10-12) · [Current evidence](ROADMAP.md#current-evidence-and-boundaries)
+
 ## Documentation
 
 - [Setup, hooks, and upgrades](docs/setup.md)

package/dist/mason-audit.js

@@ -775,17 +775,7 @@ var init_lock = __esm({
   }
 });
 
-// src/test-map.ts
-import path6 from "path";
-var init_test_map = __esm({
-  "src/test-map.ts"() {
-    "use strict";
-    init_files();
-  }
-});
-
 // src/snapshot/snapshot.ts
-import path7 from "path";
 import { z as z2 } from "zod";
 async function getCurrentGitHash(rootDir) {
   try {
@@ -803,11 +793,9 @@ var init_snapshot = __esm({
     "use strict";
     init_git_read();
     init_files();
-    init_files();
     init_storage();
     init_lock();
     init_paths();
-    init_test_map();
     repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
     verificationFields = {
       refreshedHash: z2.string().optional(),
@@ -838,7 +826,7 @@ var init_snapshot = __esm({
 
 // src/drift/drift.ts
 import fs5 from "fs/promises";
-import path8 from "path";
+import path6 from "path";
 function parseChanges(output) {
   const fields = output.split("\0");
   const changes = [];
@@ -906,7 +894,7 @@ var init_drift = __esm({
 });
 
 // src/audit/commands.ts
-import path9 from "path";
+import path7 from "path";
 function splitCommands(line) {
   const parts = [];
   let quote = "", start = 0;
@@ -942,7 +930,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
     const cd = text2.match(/^cd\s+(.+)$/);
     if (cd) {
       const directory = literal(cd[1]);
-      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path9.posix.join(cwd ?? ".", directory);
+      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path7.posix.join(cwd ?? ".", directory);
       continue;
     }
     for (const match of text2.matchAll(COMMAND)) {
@@ -954,7 +942,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
         scopeUnknown = "Unsupported shell wrapper or options before the script.";
       if (selector) {
         const selected = literal(selector[1]);
-        directory = selected === null || cwd === null ? null : path9.posix.join(cwd ?? ".", selected);
+        directory = selected === null || cwd === null ? null : path7.posix.join(cwd ?? ".", selected);
       } else if (flags) scopeUnknown = "Unsupported package-manager options before run: " + flags;
       const tail = text2.slice(match.index + match[0].length).split(/\s--(?:\s|$)/)[0];
       if (/(?:^|\s)(?:--workspace(?:s)?|-w|--filter|-F|--prefix|--dir|-C|--if-present)(?:\s|=|$)/.test(
@@ -989,7 +977,7 @@ var init_commands = __esm({
     );
     literal = (value) => {
       const unquoted = value.replace(/^(["'])(.*)\1$/, "$2");
-      return /[$`*?[\]{}~\\\x00-\x1f]/.test(unquoted) || path9.posix.isAbsolute(unquoted) ? null : unquoted;
+      return /[$`*?[\]{}~\\\x00-\x1f]/.test(unquoted) || path7.posix.isAbsolute(unquoted) ? null : unquoted;
     };
   }
 });
@@ -1372,7 +1360,7 @@ var init_git = __esm({
 
 // src/audit/docs.ts
 import fs6 from "fs/promises";
-import path10 from "path";
+import path8 from "path";
 import fg5 from "fast-glob";
 async function dirtyDocs(resolvedRoot, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
@@ -1468,15 +1456,15 @@ async function localDocPaths(root) {
     }
     for (const entry of entries)
       if (/^(?:agents|claude|readme)\.md$/i.test(entry.name)) {
-        paths.push(path10.posix.join(dir, entry.name));
+        paths.push(path8.posix.join(dir, entry.name));
       }
   }
   return paths;
 }
 function documentScope(file) {
-  if (!/^(readme|agents|claude)\.md$/i.test(path10.posix.basename(file))) return ".";
-  const parent = path10.posix.dirname(file);
-  return path10.posix.basename(parent).toLowerCase() === ".claude" ? path10.posix.dirname(parent) : parent;
+  if (!/^(readme|agents|claude)\.md$/i.test(path8.posix.basename(file))) return ".";
+  const parent = path8.posix.dirname(file);
+  return path8.posix.basename(parent).toLowerCase() === ".claude" ? path8.posix.dirname(parent) : parent;
 }
 async function discoverDocs(resolvedRoot) {
   return profilePhase("audit.documents", () => readDocs(resolvedRoot));
@@ -1499,7 +1487,7 @@ async function readDocs(resolvedRoot) {
             path: candidate,
             content,
             scope: documentScope(candidate),
-            kind: /^readme\.md$/i.test(path10.posix.basename(candidate)) ? "readme" : /^(agents|claude)\.md$/i.test(path10.posix.basename(candidate)) ? "instructions" : "guide",
+            kind: /^readme\.md$/i.test(path8.posix.basename(candidate)) ? "readme" : /^(agents|claude)\.md$/i.test(path8.posix.basename(candidate)) ? "instructions" : "guide",
             lineCount: content.split("\n").length,
             lastCommit,
             dirty: dirty.has(candidate),
@@ -1528,15 +1516,15 @@ var init_docs = __esm({
 
 // src/audit/scope.ts
 import fs7 from "fs/promises";
-import path11 from "path";
+import path9 from "path";
 function scopedPath(directory, value) {
-  if (path11.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value))
+  if (path9.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value))
     return null;
-  const resolved = path11.posix.normalize(path11.posix.join(directory, value));
+  const resolved = path9.posix.normalize(path9.posix.join(directory, value));
   return resolved === ".." || resolved.startsWith("../") ? null : resolved;
 }
 function pathClaimScope(doc, claim) {
-  const directory = claim.relativeTo === "document" ? path11.posix.dirname(doc) : documentScope(doc);
+  const directory = claim.relativeTo === "document" ? path9.posix.dirname(doc) : documentScope(doc);
   const local = scopedPath(directory, claim.path);
   if (!local) return null;
   const candidates = claim.relativeTo === "document" || directory === "." ? [local] : [...new Set([local, scopedPath(".", claim.path)].filter((p) => p !== null))];
@@ -1570,7 +1558,7 @@ var init_scope = __esm({
 });
 
 // src/audit/checks/deleted-reference.ts
-import path12 from "path";
+import path10 from "path";
 async function checkDeletedReferences(ctx) {
   const result = emptyResult();
   for (const doc of ctx.docs) {
@@ -1605,7 +1593,7 @@ async function checkDeletedReferences(ctx) {
         scope.candidates.map(async (file) => ({
           file,
           tracked: await lastCommitOf(ctx.root, file),
-          parent: await pathExists(ctx.root, path12.posix.dirname(file))
+          parent: await pathExists(ctx.root, path10.posix.dirname(file))
         }))
       );
       const candidate = candidates.find((c) => c.tracked || renames.has(c.file)) ?? candidates.find((c) => c.parent);
@@ -1658,7 +1646,7 @@ var init_deleted_reference = __esm({
 // src/audit/checks/new-module.ts
 import fg6 from "fast-glob";
 import fs8 from "fs/promises";
-import path13 from "path";
+import path11 from "path";
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -1694,7 +1682,7 @@ async function checkNewModules(ctx) {
 }
 function moduleDocumentation(docs) {
   return docs.map(
-    (doc) => doc.content + "\n" + (path13.posix.dirname(doc.path) === "." ? "" : path13.posix.dirname(doc.path) + "/")
+    (doc) => doc.content + "\n" + (path11.posix.dirname(doc.path) === "." ? "" : path11.posix.dirname(doc.path) + "/")
   ).join("\n");
 }
 function moduleCandidates(root, combinedDocs) {
@@ -1720,9 +1708,9 @@ async function collectModuleCandidates(root, combinedDocs) {
           });
           const dirs = entries.filter(
             (entry) => (entry.isDirectory() || entry.isSymbolicLink() && sources.some(
-              (file) => file.startsWith(path13.posix.join(dir, entry.name) + "/")
+              (file) => file.startsWith(path11.posix.join(dir, entry.name) + "/")
             )) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)
-          ).map((entry) => path13.posix.join(dir, entry.name));
+          ).map((entry) => path11.posix.join(dir, entry.name));
           byParent.set(dir, dirs);
         })
       );
@@ -1742,7 +1730,7 @@ async function collectModuleCandidates(root, combinedDocs) {
           onlyDirectories: true,
           label: "Module directory discovery",
           select: (file) => visible.has(file)
-        })).map((file) => path13.posix.basename(file))
+        })).map((file) => path11.posix.basename(file))
       );
     }
     return result;
@@ -1824,7 +1812,7 @@ var init_new_module = __esm({
 });
 
 // src/audit/checks/stale-count.ts
-import path14 from "path";
+import path12 from "path";
 async function countGradleModules(root) {
   for (const name of ["settings.gradle.kts", "settings.gradle"]) {
     const content = await readAuditInput(root, name);
@@ -1861,7 +1849,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "package.json workspaces",
-        members: matched.map((m) => path14.dirname(m)).sort()
+        members: matched.map((m) => path12.dirname(m)).sort()
       };
     }
   }
@@ -1892,7 +1880,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "pnpm-workspace.yaml",
-        members: matched.map((m) => path14.dirname(m)).sort()
+        members: matched.map((m) => path12.dirname(m)).sort()
       };
     }
   }
@@ -1912,8 +1900,8 @@ async function countCargoCrates(root) {
         ignore: ["**/target/**"],
         label: "Cargo workspace discovery"
       });
-      for (const m of matched) members.add(path14.dirname(m));
-    } else if (await readAuditInput(root, path14.posix.join(entry, "Cargo.toml")) !== null) {
+      for (const m of matched) members.add(path12.dirname(m));
+    } else if (await readAuditInput(root, path12.posix.join(entry, "Cargo.toml")) !== null) {
       members.add(entry);
     }
   }
@@ -1933,7 +1921,7 @@ async function resolveCountSource(root, claim) {
 }
 async function resolveDocCountSource(root, doc, claim) {
   const scope = documentScope(doc);
-  const source = await resolveCountSource(path14.join(root, scope), claim);
+  const source = await resolveCountSource(path12.join(root, scope), claim);
   if (!source || scope === ".") return source;
   return {
     ...source,
@@ -1986,7 +1974,7 @@ var init_stale_count = __esm({
 });
 
 // src/audit/checks/dead-command.ts
-import path15 from "path";
+import path13 from "path";
 function scriptsOf(raw) {
   try {
     const pkg = JSON.parse(raw);
@@ -2030,7 +2018,7 @@ async function commandInputs(root, docs) {
       }
       let cursor = directory;
       while (true) {
-        const manifest = path15.posix.join(cursor, "package.json");
+        const manifest = path13.posix.join(cursor, "package.json");
         scope.candidates.push(manifest);
         const raw = await read(manifest);
         if (raw !== null) {
@@ -2041,7 +2029,7 @@ async function commandInputs(root, docs) {
           break;
         }
         if (claim.directory !== void 0 || cursor === ".") break;
-        cursor = path15.posix.dirname(cursor);
+        cursor = path13.posix.dirname(cursor);
       }
       if (!resolution.manifest && !resolution.problem) {
         resolution.problem = `No package.json for the command's scope (${directory}).`;
@@ -2127,7 +2115,7 @@ var init_dead_command = __esm({
 });
 
 // src/audit/dependency-claims.ts
-import path16 from "path";
+import path14 from "path";
 import { parse as parseToml } from "smol-toml";
 function dependencyText(content) {
   return content.replace(
@@ -2138,7 +2126,7 @@ function dependencyText(content) {
 function declarations(file, source) {
   const result = /* @__PURE__ */ new Map();
   if (!source) return result;
-  if (path16.posix.basename(file) === "package.json") {
+  if (path14.posix.basename(file) === "package.json") {
     const json = JSON.parse(source);
     if (!isRecord(json)) throw new Error("Invalid package manifest");
     for (const section of [
@@ -2591,7 +2579,7 @@ var init_anchors = __esm({
 });
 
 // src/context/lexical.ts
-import path17 from "path";
+import path15 from "path";
 var init_lexical = __esm({
   "src/context/lexical.ts"() {
     "use strict";
@@ -2660,8 +2648,19 @@ function decisionProvenance(record, freshness = "unknown") {
     } : null
   };
 }
-function decisionInspectionDigest(record) {
+function decisionInspectionDigest(record, scope = "all") {
   const effective = effectiveDecision(record);
+  if (scope === "operative")
+    return createHash2("sha256").update(
+      JSON.stringify([
+        "operative",
+        record.status,
+        decisionApproval(effective),
+        effective.version === 2 ? effective.revision : 0,
+        decisionContent(effective),
+        effective.refreshedHash
+      ])
+    ).digest("hex");
   return createHash2("sha256").update(
     JSON.stringify([
       record.status,
@@ -2673,8 +2672,10 @@ function decisionInspectionDigest(record) {
     ])
   ).digest("hex");
 }
-function latestDecisionInspection(record) {
-  return record.version === 2 ? record.inspections?.filter((i) => i.decisionDigest === decisionInspectionDigest(record)).at(-1) : void 0;
+function latestDecisionInspection(record, scope = "all") {
+  return record.version === 2 ? record.inspections?.filter(
+    (i) => (scope === "operative" || i.scope !== "operative") && i.decisionDigest === decisionInspectionDigest(record, i.scope ?? "all")
+  ).at(-1) : void 0;
 }
 var text, decisionSourceSchema, attributionSchema, contentSchema, approvalSchema, statusSchema, reviewEvidenceSchema, eventSchema, legacySchema, currentSchema, decisionSchema;
 var init_provenance = __esm({
@@ -2760,6 +2761,7 @@ var init_provenance = __esm({
           inspector: text(200),
           note: text(1500),
           outcome: z4.literal("no_contradiction_found"),
+          scope: z4.literal("operative").optional(),
           decisionDigest: z4.string().regex(/^[a-f0-9]{64}$/),
           headHash: z4.string(),
           capture: anchorCaptureSchema
@@ -2816,7 +2818,7 @@ var init_provenance = __esm({
 
 // src/decisions/decisions.ts
 import fs10 from "fs/promises";
-import path18 from "path";
+import path16 from "path";
 import { createHash as createHash3 } from "crypto";
 import { z as z5 } from "zod";
 async function readDecisionInputs(rootDir) {
@@ -2909,9 +2911,9 @@ var init_decisions = __esm({
 });
 
 // src/decisions/drift.ts
-import path19 from "path";
+import path17 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path19.resolve(rootDir);
+  const resolvedRoot = path17.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
   const report = {
     historyAvailable: true,
@@ -2926,11 +2928,15 @@ async function computeDecisionDrift(rootDir, decisions) {
   ]);
   const changesByHash = /* @__PURE__ */ new Map();
   const baselines = store.records.filter((record) => record.status === "active").flatMap((record) => {
-    const inspection = latestDecisionInspection(record);
-    if (inspection) return [inspection.capture];
-    return [.../* @__PURE__ */ new Set([effectiveDecision(record), record])].flatMap(
-      (candidate) => candidate.version === 2 && candidate.capture ? [candidate.capture] : []
-    );
+    const effective = effectiveDecision(record);
+    return [.../* @__PURE__ */ new Set([effective, record])].flatMap((candidate) => {
+      const inspection = latestDecisionInspection(
+        record,
+        candidate === effective && decisionApproval(effective) === "accepted" ? "operative" : "all"
+      );
+      const capture = inspection?.capture ?? (candidate.version === 2 ? candidate.capture : void 0);
+      return capture ? [capture] : [];
+    });
   });
   const captures = await captureAnchorScopes(
     resolvedRoot,
@@ -2969,12 +2975,18 @@ async function computeDecisionDrift(rootDir, decisions) {
   for (const record of store.records) {
     if (record.status !== "active") continue;
     const effective = effectiveDecision(record);
-    const inspection = latestDecisionInspection(record);
+    const inspection = latestDecisionInspection(
+      record,
+      decisionApproval(effective) === "accepted" ? "operative" : "all"
+    );
     const state = await inspect(effective, inspection?.capture);
     report.freshness[record.id] = state.freshness;
     if (state.changedFiles.length) report.staleDecisions[record.id] = state.changedFiles;
     if (effective !== record)
-      (report.pendingProposals ??= {})[record.id] = await inspect(record, inspection?.capture);
+      (report.pendingProposals ??= {})[record.id] = await inspect(
+        record,
+        latestDecisionInspection(record)?.capture
+      );
   }
   return report;
 }
@@ -3297,6 +3309,7 @@ var init_store = __esm({
       updatedAt: z9.string(),
       fingerprint: z9.string().nullable(),
       latest: z9.string().nullable(),
+      guidance: z9.object({ fingerprint: z9.string(), path: z9.string() }).optional(),
       notifications: notificationStateSchema.optional(),
       agentNotifications: notificationStateSchema.optional(),
       analysis: z9.object({ id: z9.string(), fingerprint: z9.string(), completedAt: z9.number(), path: z9.string() }).optional()
@@ -3319,7 +3332,7 @@ __export(repair_exports, {
   withRepairSession: () => withRepairSession
 });
 import fs11 from "fs/promises";
-import path20 from "path";
+import path18 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 import { z as z10 } from "zod";
 function recheckable(finding) {
@@ -3417,8 +3430,8 @@ async function prepareOriginal(rootDir, checks, options, session) {
 }
 async function loadRepairBaseline(rootDir, baselinePath) {
   const root = await fs11.realpath(rootDir);
-  const declaredRoot = path20.resolve(rootDir);
-  const relative = path20.isAbsolute(baselinePath) ? path20.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const declaredRoot = path18.resolve(rootDir);
+  const relative = path18.isAbsolute(baselinePath) ? path18.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
   const { digest: savedDigest, ...payload } = stored;
   if (digest(payload) !== savedDigest)
@@ -3779,7 +3792,10 @@ async function decisionAssessment(root, finding, baselineHead) {
     );
   const record = store.records.find((record2) => record2.id === evidence.decisionId);
   if (!record || record.version !== 2) return null;
-  const inspection = latestDecisionInspection(record);
+  const inspection = latestDecisionInspection(
+    record,
+    evidence.provenance?.approval === "accepted" ? "operative" : "all"
+  );
   if (inspection && record.status === "active") {
     const capture = await captureAnchors(root, inspection.capture.anchors);
     let ancestor = true;
@@ -4074,12 +4090,12 @@ var init_advisory_review = __esm({
 
 // src/audit/audit.ts
 import fs13 from "fs/promises";
-import path21 from "path";
+import path19 from "path";
 async function computeAudit(rootDir, options = {}) {
   return profilePhase("audit.current", () => auditCurrent(rootDir, options));
 }
 async function auditCurrent(rootDir, options) {
-  const resolvedRoot = path21.resolve(rootDir);
+  const resolvedRoot = path19.resolve(rootDir);
   const [docs, headHash] = await Promise.all([
     discoverDocs(resolvedRoot),
     getCurrentGitHash(resolvedRoot)
@@ -4117,7 +4133,7 @@ async function auditCurrent(rootDir, options) {
   }
   let decisionsPresent = false;
   try {
-    await fs13.access(path21.join(resolvedRoot, ".mason", "decisions"));
+    await fs13.access(path19.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -4186,11 +4202,11 @@ init_audit();
 init_types();
 init_repair();
 init_findings();
-import path23 from "path";
+import path21 from "path";
 
 // src/audit/advisory-cli.ts
 init_advisory_review();
-import path22 from "path";
+import path20 from "path";
 import { stripVTControlCharacters } from "util";
 var USAGE = `Usage: mason audit review --baseline <path> --finding <id> [options]
 
@@ -4250,7 +4266,7 @@ async function runAdvisoryCli(args, io = { out: (text2) => console.log(text2), e
       reviewToken: flags["--token"],
       reasonCode: flags["--reason"]
     };
-    const result = await reviewAdvisory(path22.resolve(flags["--dir"] ?? process.cwd()), input);
+    const result = await reviewAdvisory(path20.resolve(flags["--dir"] ?? process.cwd()), input);
     if (json) io.out(JSON.stringify(result, null, 2));
     else {
       const lines = [`Advisory review: ${result.status}.`];
@@ -4438,7 +4454,7 @@ function formatFixPrompt(report, baselinePath) {
   lines.push("");
   lines.push("RULES:");
   lines.push(
-    baselinePath ? `- Preserve the original repair baseline: ${JSON.stringify(baselinePath)}. Do not replace it after editing.` : "- Before the first edit, call mason_repair with action: prepare, or run mason-audit --prepare-repair --json with the same --dir and --checks. Keep the returned baselinePath through verification."
+    baselinePath ? `- Preserve the original repair baseline: ${JSON.stringify(baselinePath)}. Do not replace it after editing.` : "- Before the first edit, run mason audit --prepare-repair --json with the same --dir and --checks. Keep the returned baselinePath through verification."
   );
   lines.push(
     `- Edit ONLY these files: ${flaggedDocs.join(", ") || "none (advisory review only)"}. Bring the docs into agreement with verified source evidence; do not change source code or configs to silence findings.`
@@ -4461,7 +4477,7 @@ function formatFixPrompt(report, baselinePath) {
     "- new-module: review whether the directory needs documenting; an omission alone does not establish a defect. Preserve scope and describe only what you verified."
   );
   lines.push(
-    "- Specific historical ADVISORIES require a separate authorized assessment using review_advisory with the baselinePath and findingId from verification. Prepare and inspect evidence first; record addressed, inapplicable or deferred with the actual reviewer, note and reviewToken. Dependency notices marked resolution: informational require no review. Dependency advisories may be dismissed with action: dismiss, reasonCode (no-dependency-claims or unrelated-manifest-change), and note, without a reviewer or token. Decision findings use review_decision. Candidates marked resolution: recheck can be rerun to see whether the condition remains; this does not establish semantic approval. Report what remains unknown."
+    "- Specific historical ADVISORIES require a separate authorized assessment using mason audit review with --baseline and --finding from verification. Prepare and inspect evidence first; record addressed, inapplicable or deferred with the actual reviewer, note and reviewToken. Dependency notices marked resolution: informational require no review. Dependency advisories may be dismissed with --outcome dismiss, --reason (no-dependency-claims or unrelated-manifest-change), and --note, without a reviewer or token. Decision findings use review_decision. Candidates marked resolution: recheck can be rerun to see whether the condition remains; this does not establish semantic approval. Report what remains unknown."
   );
   lines.push("");
   lines.push(
@@ -4483,7 +4499,7 @@ function formatFixPrompt(report, baselinePath) {
   );
   lines.push("");
   lines.push(
-    "After edits, call mason_repair with action: verify and the original baselinePath, or mason-audit --verify-repair <baselinePath> --dir <project>. Repeat against the same baseline after any final documentation commit. Summarize resolved, unresolved, review-required, unverified, and new findings with their evidence. Do not report a suppressed or unavailable check as fixed. This audit covers the listed documents and supported claims; application behavior and code examples need their own validation."
+    "After edits, run mason audit --verify-repair <baselinePath> --dir <project>. Repeat against the same baseline after any final documentation commit. Summarize resolved, unresolved, review-required, unverified, and new findings with their evidence. Do not report a suppressed or unavailable check as fixed. This audit covers the listed documents and supported claims; application behavior and code examples need their own validation."
   );
   return lines.join("\n");
 }
@@ -4514,7 +4530,7 @@ async function runAuditCli(argv, io = {
     io.out(USAGE2);
     return 0;
   }
-  const rootDir = path23.resolve(args.dir);
+  const rootDir = path21.resolve(args.dir);
   if (args.baseline || args.prepareRepair) {
     try {
       if (args.baseline) {