mason-context 0.21.0 → 0.22.0

package/dist/mason.js

@@ -38,7 +38,7 @@ function indexMatchingPaths(scopes2, files) {
   const node = () => ({ children: /* @__PURE__ */ new Map(), scopes: /* @__PURE__ */ new Set() });
   const root = node();
   const matches = scopes2.map(() => []);
-  scopes2.forEach((anchors, index2) => {
+  scopes2.forEach((anchors, index) => {
     for (const anchor of anchors) {
       const normalized = normalizeRepoPath(anchor);
       if (!normalized) continue;
@@ -47,7 +47,7 @@ function indexMatchingPaths(scopes2, files) {
         if (!current.children.has(part)) current.children.set(part, node());
         current = current.children.get(part);
       }
-      current.scopes.add(index2);
+      current.scopes.add(index);
     }
   });
   for (const file of new Set(files)) {
@@ -58,9 +58,9 @@ function indexMatchingPaths(scopes2, files) {
     for (const part of normalized.split("/")) {
       current = current.children.get(part);
       if (!current) break;
-      for (const index2 of current.scopes) selected.add(index2);
+      for (const index of current.scopes) selected.add(index);
     }
-    for (const index2 of selected) matches[index2].push(file);
+    for (const index of selected) matches[index].push(file);
   }
   return matches;
 }
@@ -581,7 +581,7 @@ async function captureAnchorScopes(root, scopes2) {
     const eligible = new Set(await access.list(patterns, { dot: true }));
     const indexed = indexMatchingPaths(scopes2, files);
     const filesByScope = new Map(
-      scopes2.map((scope, index2) => [JSON.stringify([...new Set(scope)].sort()), indexed[index2]])
+      scopes2.map((scope, index) => [JSON.stringify([...new Set(scope)].sort()), indexed[index]])
     );
     return { filesByScope, eligible };
   };
@@ -678,31 +678,31 @@ import { z as z2 } from "zod";
 import fs4 from "fs/promises";
 import os from "os";
 async function lockDiagnostic(file) {
-  let reason2;
+  let reason;
   try {
     const owner = lockOwnerSchema.safeParse(JSON.parse(await fs4.readFile(file, "utf8")));
     if (!owner.success) {
-      reason2 = "Lock owner data is incomplete or malformed.";
+      reason = "Lock owner data is incomplete or malformed.";
     } else if (owner.data.host !== os.hostname()) {
-      reason2 = "The lock belongs to another host; its process cannot be checked locally.";
+      reason = "The lock belongs to another host; its process cannot be checked locally.";
     } else {
       try {
         process.kill(owner.data.pid, 0);
-        reason2 = `Local owner PID ${owner.data.pid} is still running.`;
+        reason = `Local owner PID ${owner.data.pid} is still running.`;
       } catch (error) {
-        reason2 = error.code === "ESRCH" ? `Local owner PID ${owner.data.pid} has exited, but lock recovery has not completed.` : `Local owner PID ${owner.data.pid} could not be checked.`;
+        reason = error.code === "ESRCH" ? `Local owner PID ${owner.data.pid} has exited, but lock recovery has not completed.` : `Local owner PID ${owner.data.pid} could not be checked.`;
       }
     }
   } catch (error) {
-    reason2 = error instanceof SyntaxError ? "Lock owner data is incomplete or malformed." : "Lock owner data could not be read; the lock may have changed.";
+    reason = error instanceof SyntaxError ? "Lock owner data is incomplete or malformed." : "Lock owner data could not be read; the lock may have changed.";
   }
   if (await fs4.lstat(file + ".reclaim").then(
     () => true,
     () => false
   )) {
-    reason2 += " A recovery guard also needs inspection: " + file + ".reclaim.";
+    reason += " A recovery guard also needs inspection: " + file + ".reclaim.";
   }
-  return reason2 + " Retry if a writer is active. For manual recovery, stop all Mason writers for this checkout, confirm they have exited (including other hosts), then remove only confirmed abandoned lock and lock.reclaim files. See docs/reference.md#snapshot-repairs-and-verification.";
+  return reason + " Retry if a writer is active. For manual recovery, stop all Mason writers for this checkout, confirm they have exited (including other hosts), then remove only confirmed abandoned lock and lock.reclaim files. See docs/reference.md#snapshot-repairs-and-verification.";
 }
 async function withStoreLock(root, directory3, run, waitMs = 5e3, label = "Mason store") {
   const file = await storePath(root, directory3 + "/lock", true);
@@ -785,103 +785,8 @@ var init_lock = __esm({
   }
 });
 
-// src/test-map.ts
-import path5 from "path";
-async function buildTestMap(dir) {
-  const rootDir = path5.resolve(dir);
-  const access = await createFileAccess(rootDir);
-  const testPatterns = [
-    "**/*.test.*",
-    "**/*.spec.*",
-    "**/*Test.kt",
-    "**/*Test.java",
-    "**/*Tests.kt",
-    "**/*Tests.java",
-    "**/test_*.py",
-    "**/*_test.py",
-    "**/*_test.go",
-    "**/*Tests.swift",
-    "**/*Test.swift",
-    "**/*_test.rs"
-  ];
-  const testFiles = await access.list(testPatterns);
-  const sourceFiles = await access.list();
-  const sourceByBaseName = /* @__PURE__ */ new Map();
-  for (const file of sourceFiles) {
-    if (testFiles.includes(file)) continue;
-    const baseName = path5.basename(file).replace(/\.[^.]+$/, "");
-    const existing = sourceByBaseName.get(baseName) ?? [];
-    existing.push(file);
-    sourceByBaseName.set(baseName, existing);
-  }
-  const paired = [];
-  const unmatched = [];
-  for (const testFile of testFiles) {
-    const testBaseName = path5.basename(testFile).replace(/\.[^.]+$/, "");
-    const sourceName = testBaseName.replace(/Test$|Tests$|Spec$|\.test$|\.spec$/, "").replace(/^test_|_test$/, "");
-    if (!sourceName) {
-      unmatched.push(testFile);
-      continue;
-    }
-    const candidates = sourceByBaseName.get(sourceName);
-    if (candidates && candidates.length > 0) {
-      const testDir = path5.dirname(testFile);
-      const bestMatch = candidates.reduce((best, candidate) => {
-        const candidateDir = path5.dirname(candidate);
-        const bestDir = path5.dirname(best);
-        const candidateOverlap = commonSegments(testDir, candidateDir);
-        const bestOverlap = commonSegments(testDir, bestDir);
-        return candidateOverlap > bestOverlap ? candidate : best;
-      });
-      paired.push({
-        test: testFile,
-        source: bestMatch,
-        confidence: candidates.length === 1 ? "exact" : "best-guess"
-      });
-    } else {
-      unmatched.push(testFile);
-    }
-  }
-  return { totalTestFiles: testFiles.length, paired, unmatched };
-}
-function commonSegments(pathA, pathB) {
-  const segsA = pathA.split("/");
-  const segsB = pathB.split("/");
-  let count4 = 0;
-  for (let i = 0; i < Math.min(segsA.length, segsB.length); i++) {
-    if (segsA[i] === segsB[i]) count4++;
-    else break;
-  }
-  return count4;
-}
-var init_test_map = __esm({
-  "src/test-map.ts"() {
-    "use strict";
-    init_files();
-  }
-});
-
 // src/snapshot/snapshot.ts
-import path6 from "path";
 import { z as z3 } from "zod";
-async function inspectSnapshot(rootDir) {
-  try {
-    const raw = await readStoreJson(rootDir, ".mason/snapshot.json");
-    const snapshot = raw === null ? null : snapshotSchema.parse(raw);
-    return { status: snapshot ? "available" : "missing", snapshot, diagnostics: [] };
-  } catch (error) {
-    return {
-      status: "invalid",
-      snapshot: null,
-      diagnostics: [
-        {
-          path: ".mason/snapshot.json",
-          message: error instanceof Error ? error.message : String(error)
-        }
-      ]
-    };
-  }
-}
 async function getCurrentGitHash(rootDir) {
   try {
     const { stdout } = await execGit(["rev-parse", "HEAD"], {
@@ -898,11 +803,9 @@ var init_snapshot = __esm({
     "use strict";
     init_git_read();
     init_files();
-    init_files();
     init_storage();
     init_lock();
     init_paths();
-    init_test_map();
     repoPath2 = z3.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
     verificationFields = {
       refreshedHash: z3.string().optional(),
@@ -932,7 +835,7 @@ var init_snapshot = __esm({
 });
 
 // src/context/lexical.ts
-import path7 from "path";
+import path5 from "path";
 var init_lexical = __esm({
   "src/context/lexical.ts"() {
     "use strict";
@@ -989,10 +892,10 @@ function decisionApproval(record) {
 function effectiveDecision(record) {
   if (record.version !== 2 || record.status !== "active" || record.approval !== "proposed")
     return record;
-  let index2 = record.history.length - 1;
-  while (index2 >= 0 && !["accepted", "reaffirmed"].includes(record.history[index2].kind)) index2--;
-  if (index2 < 0) return record;
-  const event = record.history[index2];
+  let index = record.history.length - 1;
+  while (index >= 0 && !["accepted", "reaffirmed"].includes(record.history[index].kind)) index--;
+  if (index < 0) return record;
+  const event = record.history[index];
   return {
     ...record,
     ...event.content,
@@ -1002,7 +905,7 @@ function effectiveDecision(record) {
     refreshedHash: event.refreshedHash,
     capture: event.capture,
     updatedAt: event.at,
-    history: record.history.slice(0, index2 + 1)
+    history: record.history.slice(0, index + 1)
   };
 }
 function decisionAnchors(record) {
@@ -1035,8 +938,19 @@ function decisionTrust(record, freshness) {
     freshness
   );
 }
-function decisionInspectionDigest(record) {
+function decisionInspectionDigest(record, scope = "all") {
   const effective = effectiveDecision(record);
+  if (scope === "operative")
+    return createHash2("sha256").update(
+      JSON.stringify([
+        "operative",
+        record.status,
+        decisionApproval(effective),
+        effective.version === 2 ? effective.revision : 0,
+        decisionContent(effective),
+        effective.refreshedHash
+      ])
+    ).digest("hex");
   return createHash2("sha256").update(
     JSON.stringify([
       record.status,
@@ -1048,8 +962,10 @@ function decisionInspectionDigest(record) {
     ])
   ).digest("hex");
 }
-function latestDecisionInspection(record) {
-  return record.version === 2 ? record.inspections?.filter((i) => i.decisionDigest === decisionInspectionDigest(record)).at(-1) : void 0;
+function latestDecisionInspection(record, scope = "all") {
+  return record.version === 2 ? record.inspections?.filter(
+    (i) => (scope === "operative" || i.scope !== "operative") && i.decisionDigest === decisionInspectionDigest(record, i.scope ?? "all")
+  ).at(-1) : void 0;
 }
 function revisionKnowledge(record, freshness) {
   return {
@@ -1060,7 +976,10 @@ function revisionKnowledge(record, freshness) {
 }
 function decisionKnowledge(record, freshness = "unknown", proposalFreshness = "unknown") {
   const effective = effectiveDecision(record);
-  const inspection = latestDecisionInspection(record);
+  const inspection = latestDecisionInspection(
+    record,
+    decisionApproval(effective) === "accepted" ? "operative" : "all"
+  );
   return {
     ...revisionKnowledge(effective, freshness),
     ...inspection ? {
@@ -1070,13 +989,19 @@ function decisionKnowledge(record, freshness = "unknown", proposalFreshness = "u
         inspector: inspection.inspector,
         note: inspection.note,
         outcome: inspection.outcome,
+        scope: inspection.scope ?? "all",
         headHash: inspection.headHash
       }
     } : {},
-    ...effective !== record ? { pendingProposal: revisionKnowledge(record, proposalFreshness) } : {}
+    ...effective !== record ? {
+      pendingProposal: {
+        ...revisionKnowledge(record, proposalFreshness),
+        assessment: latestDecisionInspection(record) ? "no_contradiction_found" : "not_assessed"
+      }
+    } : {}
   };
 }
-var text, decisionSourceSchema, attributionSchema, contentSchema, approvalSchema, statusSchema, reviewEvidenceSchema, eventSchema, legacySchema, currentSchema, decisionSchema;
+var text, decisionSourceSchema, attributionSchema, contentSchema, approvalSchema, statusSchema, reviewEvidenceSchema, eventSchema, legacySchema, currentSchema, decisionSchema, DECISION_GUIDANCE;
 var init_provenance = __esm({
   "src/decisions/provenance.ts"() {
     "use strict";
@@ -1160,13 +1085,14 @@ var init_provenance = __esm({
           inspector: text(200),
           note: text(1500),
           outcome: z4.literal("no_contradiction_found"),
+          scope: z4.literal("operative").optional(),
           decisionDigest: z4.string().regex(/^[a-f0-9]{64}$/),
           headHash: z4.string(),
           capture: anchorCaptureSchema
         })
       ).max(200).optional()
     }).superRefine((record, ctx) => {
-      const invalid = (message2) => ctx.addIssue({ code: "custom", message: message2 });
+      const invalid = (message) => ctx.addIssue({ code: "custom", message });
       const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
       let previous;
       for (const event of record.history) {
@@ -1211,12 +1137,13 @@ var init_provenance = __esm({
         invalid("Decision does not match the final history event");
     });
     decisionSchema = z4.union([legacySchema, currentSchema]);
+    DECISION_GUIDANCE = "Accepted decisions are recorded team constraints, subject to freshness checks. A pendingProposal is an unaccepted replacement; the accepted revision remains operative until explicit acceptance or retirement. Proposals are suggestions; legacy unreviewed records need confirmation. Use review_decision to prepare evidence and record a separate source inspection without human approval, or an authorized human review; identities and sources are recorded assertions, not authenticated proof.";
   }
 });
 
 // src/decisions/decisions.ts
 import fs5 from "fs/promises";
-import path8 from "path";
+import path6 from "path";
 import { createHash as createHash3 } from "crypto";
 import { z as z5 } from "zod";
 async function readDecisionInputs(rootDir) {
@@ -1311,7 +1238,7 @@ var init_decisions = __esm({
 // src/audit/inputs.ts
 import fs6 from "fs/promises";
 import * as nativeFs from "fs";
-import path9 from "path";
+import path7 from "path";
 import fg4 from "fast-glob";
 async function auditInputPath(root, file) {
   if (file === ".") return fs6.realpath(root);
@@ -1341,7 +1268,7 @@ async function auditGlob(root, patterns, options) {
   if (Array.isArray(patterns) && !patterns.length) return [];
   const directories = /* @__PURE__ */ new Set();
   const readdir2 = ((directory3, opts, callback) => {
-    const relative = path9.relative(root, directory3).split(path9.sep).join("/") || ".";
+    const relative = path7.relative(root, directory3).split(path7.sep).join("/") || ".";
     directories.add(relative);
     if (directories.size > MAX_INPUTS) {
       callback(
@@ -1360,7 +1287,7 @@ async function auditGlob(root, patterns, options) {
     }, callback);
   });
   const lstat2 = ((file, callback) => {
-    const relative = path9.relative(root, file).split(path9.sep).join("/") || ".";
+    const relative = path7.relative(root, file).split(path7.sep).join("/") || ".";
     auditInputPath(root, relative).then(() => nativeFs.lstat(file, callback), callback);
   });
   const stream = fg4.stream(patterns, {
@@ -1391,7 +1318,7 @@ async function auditGlob(root, patterns, options) {
           }, /* @__PURE__ */ new Map())
         ].sort((a, b) => b[1] - a[1]).slice(0, 3);
         throw new Error(
-          `${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count4]) => `${dir} (${count4})`).join(", ")}. Narrow this check's inputs.`
+          `${options.label} exceeds ${MAX_INPUTS.toLocaleString("en-US")} relevant paths. Largest directories: ${largest.map(([dir, count3]) => `${dir} (${count3})`).join(", ")}. Narrow this check's inputs.`
         );
       }
     }
@@ -1460,7 +1387,7 @@ var init_policy = __esm({
 });
 
 // src/audit/commands.ts
-import path10 from "path";
+import path8 from "path";
 function splitCommands(line) {
   const parts = [];
   let quote2 = "", start = 0;
@@ -1496,7 +1423,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
     const cd = text2.match(/^cd\s+(.+)$/);
     if (cd) {
       const directory3 = literal(cd[1]);
-      cwd = directory3 === null || cwd === null || /\s/.test(directory3) && !/^["']/.test(cd[1]) ? null : path10.posix.join(cwd ?? ".", directory3);
+      cwd = directory3 === null || cwd === null || /\s/.test(directory3) && !/^["']/.test(cd[1]) ? null : path8.posix.join(cwd ?? ".", directory3);
       continue;
     }
     for (const match of text2.matchAll(COMMAND)) {
@@ -1508,7 +1435,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
         scopeUnknown = "Unsupported shell wrapper or options before the script.";
       if (selector) {
         const selected = literal(selector[1]);
-        directory3 = selected === null || cwd === null ? null : path10.posix.join(cwd ?? ".", selected);
+        directory3 = selected === null || cwd === null ? null : path8.posix.join(cwd ?? ".", selected);
       } else if (flags) scopeUnknown = "Unsupported package-manager options before run: " + flags;
       const tail = text2.slice(match.index + match[0].length).split(/\s--(?:\s|$)/)[0];
       if (/(?:^|\s)(?:--workspace(?:s)?|-w|--filter|-F|--prefix|--dir|-C|--if-present)(?:\s|=|$)/.test(
@@ -1543,7 +1470,7 @@ var init_commands = __esm({
     );
     literal = (value) => {
       const unquoted = value.replace(/^(["'])(.*)\1$/, "$2");
-      return /[$`*?[\]{}~\\\x00-\x1f]/.test(unquoted) || path10.posix.isAbsolute(unquoted) ? null : unquoted;
+      return /[$`*?[\]{}~\\\x00-\x1f]/.test(unquoted) || path8.posix.isAbsolute(unquoted) ? null : unquoted;
     };
   }
 });
@@ -1926,7 +1853,7 @@ var init_git = __esm({
 
 // src/audit/docs.ts
 import fs7 from "fs/promises";
-import path11 from "path";
+import path9 from "path";
 import fg6 from "fast-glob";
 async function dirtyDocs(resolvedRoot, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
@@ -2003,10 +1930,10 @@ async function discoverDocPaths(root) {
       );
   }
   const priority2 = (file) => {
-    const index2 = DOC_CANDIDATES.findIndex(
+    const index = DOC_CANDIDATES.findIndex(
       (p) => p.toLowerCase() === file.toLowerCase()
     );
-    return index2 < 0 ? DOC_CANDIDATES.length : index2;
+    return index < 0 ? DOC_CANDIDATES.length : index;
   };
   return paths.sort((a, b) => priority2(a) - priority2(b) || a.localeCompare(b));
 }
@@ -2022,15 +1949,15 @@ async function localDocPaths(root) {
     }
     for (const entry of entries)
       if (/^(?:agents|claude|readme)\.md$/i.test(entry.name)) {
-        paths.push(path11.posix.join(dir, entry.name));
+        paths.push(path9.posix.join(dir, entry.name));
       }
   }
   return paths;
 }
 function documentScope(file) {
-  if (!/^(readme|agents|claude)\.md$/i.test(path11.posix.basename(file))) return ".";
-  const parent = path11.posix.dirname(file);
-  return path11.posix.basename(parent).toLowerCase() === ".claude" ? path11.posix.dirname(parent) : parent;
+  if (!/^(readme|agents|claude)\.md$/i.test(path9.posix.basename(file))) return ".";
+  const parent = path9.posix.dirname(file);
+  return path9.posix.basename(parent).toLowerCase() === ".claude" ? path9.posix.dirname(parent) : parent;
 }
 async function discoverDocs(resolvedRoot) {
   return profilePhase("audit.documents", () => readDocs(resolvedRoot));
@@ -2053,7 +1980,7 @@ async function readDocs(resolvedRoot) {
             path: candidate,
             content: content2,
             scope: documentScope(candidate),
-            kind: /^readme\.md$/i.test(path11.posix.basename(candidate)) ? "readme" : /^(agents|claude)\.md$/i.test(path11.posix.basename(candidate)) ? "instructions" : "guide",
+            kind: /^readme\.md$/i.test(path9.posix.basename(candidate)) ? "readme" : /^(agents|claude)\.md$/i.test(path9.posix.basename(candidate)) ? "instructions" : "guide",
             lineCount: content2.split("\n").length,
             lastCommit,
             dirty: dirty.has(candidate),
@@ -2082,15 +2009,15 @@ var init_docs = __esm({
 
 // src/audit/scope.ts
 import fs8 from "fs/promises";
-import path12 from "path";
+import path10 from "path";
 function scopedPath(directory3, value) {
-  if (path12.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value))
+  if (path10.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value))
     return null;
-  const resolved = path12.posix.normalize(path12.posix.join(directory3, value));
+  const resolved = path10.posix.normalize(path10.posix.join(directory3, value));
   return resolved === ".." || resolved.startsWith("../") ? null : resolved;
 }
 function pathClaimScope(doc, claim) {
-  const directory3 = claim.relativeTo === "document" ? path12.posix.dirname(doc) : documentScope(doc);
+  const directory3 = claim.relativeTo === "document" ? path10.posix.dirname(doc) : documentScope(doc);
   const local = scopedPath(directory3, claim.path);
   if (!local) return null;
   const candidates = claim.relativeTo === "document" || directory3 === "." ? [local] : [...new Set([local, scopedPath(".", claim.path)].filter((p) => p !== null))];
@@ -2125,7 +2052,7 @@ var init_scope = __esm({
 
 // src/drift/drift.ts
 import fs9 from "fs/promises";
-import path13 from "path";
+import path11 from "path";
 function parseChanges(output) {
   const fields = output.split("\0");
   const changes = [];
@@ -2193,7 +2120,7 @@ var init_drift = __esm({
 });
 
 // src/audit/checks/deleted-reference.ts
-import path14 from "path";
+import path12 from "path";
 async function checkDeletedReferences(ctx) {
   const result = emptyResult();
   for (const doc of ctx.docs) {
@@ -2228,7 +2155,7 @@ async function checkDeletedReferences(ctx) {
         scope.candidates.map(async (file) => ({
           file,
           tracked: await lastCommitOf(ctx.root, file),
-          parent: await pathExists(ctx.root, path14.posix.dirname(file))
+          parent: await pathExists(ctx.root, path12.posix.dirname(file))
         }))
       );
       const candidate = candidates.find((c) => c.tracked || renames.has(c.file)) ?? candidates.find((c) => c.parent);
@@ -2247,11 +2174,11 @@ async function checkDeletedReferences(ctx) {
         parentDirExists: candidate?.parent ?? false
       };
       const anchor = { doc: doc.path, line: claim.line, excerpt: claim.excerpt };
-      const message2 = renamedTo ? `\`${resolvedPath}\` was renamed to \`${renamedTo}\`` : `\`${resolvedPath}\` does not exist` + (deletedInCommit ? ` \u2013 deleted in ${deletedInCommit.hash.slice(0, 7)} "${deletedInCommit.subject}" (${deletedInCommit.date.slice(0, 10)})` : "");
+      const message = renamedTo ? `\`${resolvedPath}\` was renamed to \`${renamedTo}\`` : `\`${resolvedPath}\` does not exist` + (deletedInCommit ? ` \u2013 deleted in ${deletedInCommit.hash.slice(0, 7)} "${deletedInCommit.subject}" (${deletedInCommit.date.slice(0, 10)})` : "");
       if (scope.basis !== "document" && (renamedTo || candidate?.tracked)) {
         result.issues.push({
           type: "deleted-reference",
-          message: message2,
+          message,
           anchor,
           confidence: "certain",
           evidence
@@ -2260,7 +2187,7 @@ async function checkDeletedReferences(ctx) {
         result.advisories.push({
           resolution: "recheck",
           type: "deleted-reference",
-          message: message2 + (scope.basis === "document" ? "; the bare path's document/repository scope needs review." : "; no tracked history establishes it as a required file. Review for a typo, generated output, or example."),
+          message: message + (scope.basis === "document" ? "; the bare path's document/repository scope needs review." : "; no tracked history establishes it as a required file. Review for a typo, generated output, or example."),
           anchor,
           evidence
         });
@@ -2281,7 +2208,7 @@ var init_deleted_reference = __esm({
 // src/audit/checks/new-module.ts
 import fg7 from "fast-glob";
 import fs10 from "fs/promises";
-import path15 from "path";
+import path13 from "path";
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -2317,7 +2244,7 @@ async function checkNewModules(ctx) {
 }
 function moduleDocumentation(docs) {
   return docs.map(
-    (doc) => doc.content + "\n" + (path15.posix.dirname(doc.path) === "." ? "" : path15.posix.dirname(doc.path) + "/")
+    (doc) => doc.content + "\n" + (path13.posix.dirname(doc.path) === "." ? "" : path13.posix.dirname(doc.path) + "/")
   ).join("\n");
 }
 function moduleCandidates(root, combinedDocs) {
@@ -2343,9 +2270,9 @@ async function collectModuleCandidates(root, combinedDocs) {
           });
           const dirs = entries.filter(
             (entry) => (entry.isDirectory() || entry.isSymbolicLink() && sources.some(
-              (file) => file.startsWith(path15.posix.join(dir, entry.name) + "/")
+              (file) => file.startsWith(path13.posix.join(dir, entry.name) + "/")
             )) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)
-          ).map((entry) => path15.posix.join(dir, entry.name));
+          ).map((entry) => path13.posix.join(dir, entry.name));
           byParent.set(dir, dirs);
         })
       );
@@ -2365,16 +2292,16 @@ async function collectModuleCandidates(root, combinedDocs) {
           onlyDirectories: true,
           label: "Module directory discovery",
           select: (file) => visible.has(file)
-        })).map((file) => path15.posix.basename(file))
+        })).map((file) => path13.posix.basename(file))
       );
     }
     return result;
   };
   const countSourceFiles = async (dir) => {
     const files = sources.filter((file) => file.startsWith(dir + "/"));
-    let count4 = 0;
+    let count3 = 0;
     for (let offset = 0; offset < files.length; offset += 256) {
-      count4 += (await auditGlob(
+      count3 += (await auditGlob(
         root,
         files.slice(offset, offset + 256).map((file) => fg7.escapePath(file)),
         {
@@ -2383,12 +2310,12 @@ async function collectModuleCandidates(root, combinedDocs) {
           label: `Source discovery in ${dir}`
         }
       )).length;
-      if (count4 > 1e5)
+      if (count3 > 1e5)
         throw new Error(
           `Source discovery in ${dir} exceeds 100,000 relevant files. Exclude generated source with .mason/config.json ignore patterns or narrow this audit's checks.`
         );
     }
-    return count4;
+    return count3;
   };
   const candidates = [];
   const topDirs = (await listSubdirs(["."])).get(".");
@@ -2396,8 +2323,8 @@ async function collectModuleCandidates(root, combinedDocs) {
   for (const topDir of topDirs) {
     const topMentioned = isMentioned(combinedDocs, topDir);
     if (!topMentioned) {
-      const count4 = await countSourceFiles(topDir);
-      if (count4 >= 1) candidates.push({ dir: topDir, sourceFileCount: count4 });
+      const count3 = await countSourceFiles(topDir);
+      if (count3 >= 1) candidates.push({ dir: topDir, sourceFileCount: count3 });
       continue;
     }
     const subdirs = nested.get(topDir);
@@ -2405,9 +2332,9 @@ async function collectModuleCandidates(root, combinedDocs) {
     if (mentioned.length < ENUMERATION_THRESHOLD) continue;
     for (const sub of subdirs) {
       if (isMentioned(combinedDocs, sub)) continue;
-      const count4 = await countSourceFiles(`${topDir}/${sub}`);
-      if (count4 >= SECOND_LEVEL_MIN_SOURCE_FILES) {
-        candidates.push({ dir: `${topDir}/${sub}`, sourceFileCount: count4 });
+      const count3 = await countSourceFiles(`${topDir}/${sub}`);
+      if (count3 >= SECOND_LEVEL_MIN_SOURCE_FILES) {
+        candidates.push({ dir: `${topDir}/${sub}`, sourceFileCount: count3 });
       }
     }
   }
@@ -2447,7 +2374,7 @@ var init_new_module = __esm({
 });
 
 // src/audit/checks/stale-count.ts
-import path16 from "path";
+import path14 from "path";
 async function countGradleModules(root) {
   for (const name of ["settings.gradle.kts", "settings.gradle"]) {
     const content2 = await readAuditInput(root, name);
@@ -2484,7 +2411,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "package.json workspaces",
-        members: matched.map((m) => path16.dirname(m)).sort()
+        members: matched.map((m) => path14.dirname(m)).sort()
       };
     }
   }
@@ -2515,7 +2442,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "pnpm-workspace.yaml",
-        members: matched.map((m) => path16.dirname(m)).sort()
+        members: matched.map((m) => path14.dirname(m)).sort()
       };
     }
   }
@@ -2535,8 +2462,8 @@ async function countCargoCrates(root) {
         ignore: ["**/target/**"],
         label: "Cargo workspace discovery"
       });
-      for (const m of matched) members.add(path16.dirname(m));
-    } else if (await readAuditInput(root, path16.posix.join(entry, "Cargo.toml")) !== null) {
+      for (const m of matched) members.add(path14.dirname(m));
+    } else if (await readAuditInput(root, path14.posix.join(entry, "Cargo.toml")) !== null) {
       members.add(entry);
     }
   }
@@ -2556,7 +2483,7 @@ async function resolveCountSource(root, claim) {
 }
 async function resolveDocCountSource(root, doc, claim) {
   const scope = documentScope(doc);
-  const source = await resolveCountSource(path16.join(root, scope), claim);
+  const source = await resolveCountSource(path14.join(root, scope), claim);
   if (!source || scope === ".") return source;
   return {
     ...source,
@@ -2609,7 +2536,7 @@ var init_stale_count = __esm({
 });
 
 // src/audit/checks/dead-command.ts
-import path17 from "path";
+import path15 from "path";
 function scriptsOf(raw) {
   try {
     const pkg = JSON.parse(raw);
@@ -2653,7 +2580,7 @@ async function commandInputs(root, docs) {
       }
       let cursor = directory3;
       while (true) {
-        const manifest = path17.posix.join(cursor, "package.json");
+        const manifest = path15.posix.join(cursor, "package.json");
         scope.candidates.push(manifest);
         const raw = await read(manifest);
         if (raw !== null) {
@@ -2664,7 +2591,7 @@ async function commandInputs(root, docs) {
           break;
         }
         if (claim.directory !== void 0 || cursor === ".") break;
-        cursor = path17.posix.dirname(cursor);
+        cursor = path15.posix.dirname(cursor);
       }
       if (!resolution.manifest && !resolution.problem) {
         resolution.problem = `No package.json for the command's scope (${directory3}).`;
@@ -2703,12 +2630,12 @@ async function checkDeadCommands(ctx) {
       scope
     };
     const anchor = { doc, line: claim.line, excerpt: claim.excerpt };
-    const message2 = `\`${claim.invocation}\` names script "${claim.scriptName}", which is absent from ${manifest}`;
+    const message = `\`${claim.invocation}\` names script "${claim.scriptName}", which is absent from ${manifest}`;
     const certain = documentScope(doc) === "." && (scope.basis === "explicit" || !elsewhere.length);
     if (certain)
       result.issues.push({
         type: "dead-command",
-        message: message2,
+        message,
         anchor,
         confidence: "certain",
         evidence
@@ -2717,7 +2644,7 @@ async function checkDeadCommands(ctx) {
       result.advisories.push({
         resolution: "recheck",
         type: "dead-command",
-        message: message2 + (elsewhere.length ? `; it exists in ${elsewhere.join(", ")}. Clarify the intended working directory.` : "; the intended working directory needs review."),
+        message: message + (elsewhere.length ? `; it exists in ${elsewhere.join(", ")}. Clarify the intended working directory.` : "; the intended working directory needs review."),
         anchor,
         evidence
       });
@@ -2750,7 +2677,7 @@ var init_dead_command = __esm({
 });
 
 // src/audit/dependency-claims.ts
-import path18 from "path";
+import path16 from "path";
 import { parse as parseToml } from "smol-toml";
 function dependencyText(content2) {
   return content2.replace(
@@ -2761,7 +2688,7 @@ function dependencyText(content2) {
 function declarations(file, source) {
   const result = /* @__PURE__ */ new Map();
   if (!source) return result;
-  if (path18.posix.basename(file) === "package.json") {
+  if (path16.posix.basename(file) === "package.json") {
     const json2 = JSON.parse(source);
     if (!isRecord(json2)) throw new Error("Invalid package manifest");
     for (const section of [
@@ -3077,9 +3004,9 @@ var init_deps_changed = __esm({
 });
 
 // src/decisions/drift.ts
-import path19 from "path";
+import path17 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path19.resolve(rootDir);
+  const resolvedRoot = path17.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
   const report = {
     historyAvailable: true,
@@ -3094,18 +3021,22 @@ async function computeDecisionDrift(rootDir, decisions) {
   ]);
   const changesByHash = /* @__PURE__ */ new Map();
   const baselines = store.records.filter((record) => record.status === "active").flatMap((record) => {
-    const inspection = latestDecisionInspection(record);
-    if (inspection) return [inspection.capture];
-    return [.../* @__PURE__ */ new Set([effectiveDecision(record), record])].flatMap(
-      (candidate) => candidate.version === 2 && candidate.capture ? [candidate.capture] : []
-    );
+    const effective = effectiveDecision(record);
+    return [.../* @__PURE__ */ new Set([effective, record])].flatMap((candidate) => {
+      const inspection = latestDecisionInspection(
+        record,
+        candidate === effective && decisionApproval(effective) === "accepted" ? "operative" : "all"
+      );
+      const capture = inspection?.capture ?? (candidate.version === 2 ? candidate.capture : void 0);
+      return capture ? [capture] : [];
+    });
   });
   const captures = await captureAnchorScopes(
     resolvedRoot,
     baselines.map((baseline) => baseline.anchors)
   );
   const currentCaptures = new Map(
-    baselines.map((baseline, index2) => [JSON.stringify(baseline.anchors), captures[index2]])
+    baselines.map((baseline, index) => [JSON.stringify(baseline.anchors), captures[index]])
   );
   const inspect = async (record, inspectionCapture) => {
     if (record.files.length === 0) return { freshness: "unknown", changedFiles: [] };
@@ -3137,12 +3068,18 @@ async function computeDecisionDrift(rootDir, decisions) {
   for (const record of store.records) {
     if (record.status !== "active") continue;
     const effective = effectiveDecision(record);
-    const inspection = latestDecisionInspection(record);
+    const inspection = latestDecisionInspection(
+      record,
+      decisionApproval(effective) === "accepted" ? "operative" : "all"
+    );
     const state = await inspect(effective, inspection?.capture);
     report.freshness[record.id] = state.freshness;
     if (state.changedFiles.length) report.staleDecisions[record.id] = state.changedFiles;
     if (effective !== record)
-      (report.pendingProposals ??= {})[record.id] = await inspect(record, inspection?.capture);
+      (report.pendingProposals ??= {})[record.id] = await inspect(
+        record,
+        latestDecisionInspection(record)?.capture
+      );
   }
   return report;
 }
@@ -3467,16 +3404,16 @@ function decisionStopReview(session, inputs, report, reentry) {
     };
   }
   const safe = (value) => value.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 250);
-  const reason2 = [
+  const reason = [
     "Mason: unresolved decision drift overlaps changes observed during this session. Before ending the turn, inspect these decisions:",
     ...[...decisions].map(
       ([id, value]) => `Decision ${JSON.stringify(safe(value.title))} (${safe(id)}): review_decision(action: "prepare", id: ${JSON.stringify(id)}).`
     ),
-    'Check the claims against the source and diff. If no contradiction is found, record action: "inspect" with the reviewToken, actual inspector, and a note explaining the evidence. "Expected changes" or "my own commits" are not evidence.',
+    'Check the claims against the source and diff. When an accepted revision exists, prepare and inspect with inspectionScope: "operative" to assess it separately; a contradictory pending draft remains unassessed and must not be promoted. For proposal-only or legacy records use the default all scope. If no contradiction is found in the selected scope, record action: "inspect" with the reviewToken, actual inspector, and a note explaining the evidence. "Expected changes" or "my own commits" are not evidence.',
     "If contradicted or uncertain, explain the mismatch to the user and request direction. Do not accept, reaffirm, or retire a decision without authorized human review. A revised proposal leaves the accepted revision operative until reviewed.",
     `Evidence: ${report.reportPath}. Concurrent changes can contribute; captures do not prove authorship. This reminder does not resolve the finding.`
   ].join("\n");
-  return { reason: reason2, block: !reentry && fresh };
+  return { reason, block: !reentry && fresh };
 }
 var evidenceSchema2, stopReviewSchema, empty;
 var init_stop_review = __esm({
@@ -3680,6 +3617,7 @@ var init_store = __esm({
       updatedAt: z9.string(),
       fingerprint: z9.string().nullable(),
       latest: z9.string().nullable(),
+      guidance: z9.object({ fingerprint: z9.string(), path: z9.string() }).optional(),
       notifications: notificationStateSchema.optional(),
       agentNotifications: notificationStateSchema.optional(),
       analysis: z9.object({ id: z9.string(), fingerprint: z9.string(), completedAt: z9.number(), path: z9.string() }).optional()
@@ -3702,19 +3640,19 @@ async function readRecord(root, id) {
   }
   return record;
 }
-function evidenceFingerprint(evidence, reason2) {
+function evidenceFingerprint(evidence, reason) {
   return digest([
     evidence.scope,
     evidence.tree,
-    ...reason2 === "no-dependency-claims" ? [] : [evidence.lastScopeCommit],
+    ...reason === "no-dependency-claims" ? [] : [evidence.lastScopeCommit],
     evidence.paths
   ]);
 }
-function scopes(finding, reason2) {
+function scopes(finding, reason) {
   const files = [finding.anchor.doc], e = finding.evidence;
   if (e.kind === "decision-anchor")
     throw new Error("Use review_decision for decision acceptance, reaffirmation or retirement.");
-  if (reason2 === "no-dependency-claims" && e.kind === "doc-behind-manifests")
+  if (reason === "no-dependency-claims" && e.kind === "doc-behind-manifests")
     return [`:(literal)${finding.anchor.doc}`];
   if (e.kind === "doc-behind-manifests")
     return [`:(literal)${finding.anchor.doc}`, ...manifestPathspecs(finding.anchor.doc)];
@@ -3730,10 +3668,10 @@ function scopes(finding, reason2) {
     return `:(literal)${file}`;
   }).sort();
 }
-async function reviewEvidence(root, finding, reason2) {
+async function reviewEvidence(root, finding, reason) {
   if (normalizeRepoPath(finding.anchor.doc) !== finding.anchor.doc)
     throw new Error("Invalid advisory document path.");
-  const scope = scopes(finding, reason2);
+  const scope = scopes(finding, reason);
   const head = (await git2(root, "rev-parse", "HEAD")).trim();
   const tracked = (await git2(root, "ls-files", "--cached", "-z", "--", ...scope)).split("\0").filter(Boolean);
   if (tracked.length > 2e4) throw new Error("Advisory scope exceeds 20,000 tracked files.");
@@ -3779,7 +3717,7 @@ async function reviewEvidence(root, finding, reason2) {
   }
   const fingerprint = evidenceFingerprint(
     { head, scope, tree, lastScopeCommit, paths, fingerprint: "" },
-    reason2
+    reason
   );
   if ((await git2(root, "rev-parse", "HEAD")).trim() !== head)
     throw new Error("HEAD changed while collecting review evidence.");
@@ -3800,7 +3738,10 @@ async function decisionAssessment(root, finding, baselineHead) {
     );
   const record = store.records.find((record2) => record2.id === evidence.decisionId);
   if (!record || record.version !== 2) return null;
-  const inspection = latestDecisionInspection(record);
+  const inspection = latestDecisionInspection(
+    record,
+    evidence.provenance?.approval === "accepted" ? "operative" : "all"
+  );
   if (inspection && record.status === "active") {
     const capture = await captureAnchors(root, inspection.capture.anchors);
     let ancestor = true;
@@ -3979,12 +3920,12 @@ var init_advisory_review = __esm({
 
 // src/audit/audit.ts
 import fs12 from "fs/promises";
-import path20 from "path";
+import path18 from "path";
 async function computeAudit(rootDir, options = {}) {
   return profilePhase("audit.current", () => auditCurrent(rootDir, options));
 }
 async function auditCurrent(rootDir, options) {
-  const resolvedRoot = path20.resolve(rootDir);
+  const resolvedRoot = path18.resolve(rootDir);
   const [docs, headHash] = await Promise.all([
     discoverDocs(resolvedRoot),
     getCurrentGitHash(resolvedRoot)
@@ -4022,7 +3963,7 @@ async function auditCurrent(rootDir, options) {
   }
   let decisionsPresent = false;
   try {
-    await fs12.access(path20.join(resolvedRoot, ".mason", "decisions"));
+    await fs12.access(path18.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -4088,7 +4029,7 @@ var init_audit = __esm({
 
 // src/audit/repair.ts
 import fs13 from "fs/promises";
-import path21 from "path";
+import path19 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 import { z as z11 } from "zod";
 function recheckable(finding) {
@@ -4183,8 +4124,8 @@ async function prepareOriginal(rootDir, checks, options, session) {
 }
 async function loadRepairBaseline(rootDir, baselinePath) {
   const root = await fs13.realpath(rootDir);
-  const declaredRoot = path21.resolve(rootDir);
-  const relative = path21.isAbsolute(baselinePath) ? path21.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const declaredRoot = path19.resolve(rootDir);
+  const relative = path19.isAbsolute(baselinePath) ? path19.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
   const { digest: savedDigest, ...payload } = stored;
   if (digest(payload) !== savedDigest)
@@ -4414,7 +4355,7 @@ var init_repair = __esm({
 
 // src/automation/evidence.ts
 import fs14 from "fs/promises";
-import path22 from "path";
+import path20 from "path";
 import { createHash as createHash5 } from "crypto";
 import { z as z12 } from "zod";
 async function git3(root, ...args2) {
@@ -4439,6 +4380,66 @@ async function workspace(dir) {
     directory: ".mason/reports/automation/" + hash([root, gitDir, branch]).slice(0, 24)
   };
 }
+async function captureDecisionEvidence(root, records) {
+  const scopes2 = new Map(
+    records.filter((record) => record.status === "active").map((record) => {
+      const anchors = decisionAnchors(record).sort();
+      return [JSON.stringify(anchors), anchors];
+    })
+  );
+  const captures = await captureAnchorScopes(root, [...scopes2.values()]);
+  const capturesByScope = new Map([...scopes2.keys()].map((key, index) => [key, captures[index]]));
+  const decisionEvidence = {};
+  for (const record of records.filter((record2) => record2.status === "active")) {
+    const key = JSON.stringify(decisionAnchors(record).sort());
+    decisionEvidence[record.id] = {
+      digest: decisionInspectionDigest(record),
+      capture: capturesByScope.get(key)
+    };
+  }
+  return decisionEvidence;
+}
+async function readGuidanceInputs(root) {
+  const [head, raw, store, shallowPath, replacements] = await Promise.all([
+    git3(root, "rev-parse", "HEAD").then((text2) => text2.trim()),
+    readDecisionInputs(root),
+    loadDecisionStore(root),
+    git3(root, "rev-parse", "--git-path", "shallow"),
+    git3(root, "for-each-ref", "--format=%(refname) %(objectname)", "refs/replace")
+  ]);
+  if (raw.diagnostics.length || store.diagnostics.length)
+    throw new Error(
+      "Cannot read decision inputs: " + [...raw.diagnostics, ...store.diagnostics].map((d) => `${d.path}: ${d.message}`).join("; ")
+    );
+  const decisionEvidence = await captureDecisionEvidence(root, store.records);
+  const shallow = await fs14.readFile(path20.resolve(root, shallowPath.trim()), "utf8").catch((error) => {
+    if (hasErrorCode(error, "ENOENT")) return null;
+    throw error;
+  });
+  const fingerprint = hash([
+    "guidance",
+    engineVersion,
+    head,
+    raw.inputs,
+    decisionEvidence,
+    shallow,
+    replacements
+  ]);
+  return {
+    fingerprint,
+    head,
+    decisionEvidence,
+    docs: {},
+    keys: {
+      "deleted-reference": "",
+      "new-module": "",
+      "stale-count": "",
+      "dead-command": "",
+      "deps-changed": "",
+      "decision-anchor-drift": fingerprint
+    }
+  };
+}
 async function readInputs(root) {
   return profilePhase("automation.inputs", () => collectInputs(root));
 }
@@ -4466,7 +4467,7 @@ async function collectInputs(root) {
   const head = headText.trim();
   let shallow = null;
   try {
-    shallow = await fs14.readFile(path22.resolve(root, shallowPath.trim()), "utf8");
+    shallow = await fs14.readFile(path20.resolve(root, shallowPath.trim()), "utf8");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
@@ -4475,7 +4476,7 @@ async function collectInputs(root) {
   const parsedDocs = [];
   const claims = [];
   const presence = /* @__PURE__ */ new Map();
-  const exists = (file) => {
+  const exists2 = (file) => {
     if (!presence.has(file)) presence.set(file, pathExists(root, file));
     return presence.get(file);
   };
@@ -4491,8 +4492,8 @@ async function collectInputs(root) {
       for (const candidate of scope?.candidates ?? []) {
         if (optionalMasonPath(candidate)) continue;
         const [filePresent, parentPresent] = await Promise.all([
-          exists(candidate),
-          exists(path22.posix.dirname(candidate))
+          exists2(candidate),
+          exists2(path20.posix.dirname(candidate))
         ]);
         claims.push([candidate, filePresent, parentPresent]);
       }
@@ -4524,7 +4525,7 @@ async function collectInputs(root) {
       "Cannot read decision inputs: " + decisionInputs.diagnostics.map((d) => `${d.path}: ${d.message}`).join("; ")
     );
   const decisions = decisionInputs.inputs;
-  const [status, index2] = decisions.length ? await Promise.all([
+  const [status, index] = decisions.length ? await Promise.all([
     git3(
       root,
       "status",
@@ -4538,23 +4539,8 @@ async function collectInputs(root) {
     git3(root, "ls-files", "--stage", "-z", "--", ".", ":(exclude).mason/reports")
   ]) : ["", ""];
   const records = decisions.length ? (await loadDecisionStore(root)).records : [];
-  const scopes2 = new Map(
-    records.filter((record) => record.status === "active").map((record) => {
-      const anchors = decisionAnchors(record).sort();
-      return [JSON.stringify(anchors), anchors];
-    })
-  );
-  const captures = await captureAnchorScopes(root, [...scopes2.values()]);
-  const capturesByScope = new Map([...scopes2.keys()].map((key, index3) => [key, captures[index3]]));
-  const decisionEvidence = {};
-  for (const record of records.filter((record2) => record2.status === "active")) {
-    const key = JSON.stringify(decisionAnchors(record).sort());
-    decisionEvidence[record.id] = {
-      digest: decisionInspectionDigest(record),
-      capture: capturesByScope.get(key)
-    };
-  }
-  const anchorContent = [...scopes2.keys()].map((key, index3) => [key, captures[index3]]);
+  const decisionEvidence = await captureDecisionEvidence(root, records);
+  const anchorContent = Object.entries(decisionEvidence);
   const common = [8, engineVersion, head, shallow, replacements, docContents, auditPolicy];
   const keys = {
     "deleted-reference": hash([common, claims, docStatus]),
@@ -4567,7 +4553,7 @@ async function collectInputs(root) {
       decisionPresence,
       decisions,
       status,
-      index2,
+      index,
       anchorContent
     ])
   };
@@ -4637,7 +4623,7 @@ var init_evidence = __esm({
     init_dead_command();
     init_storage();
     init_advisory_review();
-    engineVersion = true ? "0.21.0" : "development";
+    engineVersion = true ? "0.22.0" : "development";
     hash = (value) => createHash5("sha256").update(JSON.stringify(value)).digest("hex");
     content = readAuditInput;
     cacheSchema = z12.object({
@@ -4960,21 +4946,21 @@ function parseExecution(raw) {
 function automationFailure(error) {
   const recorded = failureSchema.safeParse(error?.failure);
   if (recorded.success) return recorded.data;
-  const message2 = (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 700);
+  const message = (error instanceof Error ? error.message : String(error)).replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").slice(0, 700);
   const codes = /* @__PURE__ */ new Set();
   let cause = error;
   for (let i = 0; cause && i < 8; i++) {
     codes.add(String(cause.code));
     cause = cause.cause;
   }
-  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message2) ? "inputs-changed" : /Automation is busy/.test(message2) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(
-    message2
-  ) ? "history-unavailable" : error instanceof z15.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message2) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(
-    message2
+  const code = codes.has("ENOSPC") || codes.has("EDQUOT") ? "storage-full" : /changed during|changed while|changed between/.test(message) ? "inputs-changed" : /Automation is busy/.test(message) ? "busy" : /not a git repository|unknown revision|bad revision|different history|unreachable/.test(
+    message
+  ) ? "history-unavailable" : error instanceof z15.ZodError || error instanceof SyntaxError || /Hook input|Expected one command|Unknown automation command|--host/.test(message) ? "invalid-input" : /store|baseline|modified|symbolic link|Symlink|automation state|state belongs/.test(
+    message
   ) ? "invalid-evidence" : [...codes].some((c) => /^E[A-Z]+$/.test(c)) ? "io-error" : "internal";
   return {
     code,
-    message: message2,
+    message,
     retryable: ["inputs-changed", "storage-full", "busy", "io-error"].includes(code),
     receiptRecorded: false
   };
@@ -5208,8 +5194,8 @@ async function pendingKnowledge(root, now = Date.now()) {
     const proposals = store.records.filter((record) => record.status === "active" && decisionApproval(record) === "proposed").map((record) => {
       const history = record.version === 2 ? record.history : [];
       let lastReview = -1;
-      history.forEach((event, index2) => {
-        if (event.kind === "accepted" || event.kind === "reaffirmed") lastReview = index2;
+      history.forEach((event, index) => {
+        if (event.kind === "accepted" || event.kind === "reaffirmed") lastReview = index;
       });
       const since = history.slice(lastReview + 1).find((event) => event.kind === "created" || event.kind === "revised")?.at ?? record.createdAt;
       return { record, since };
@@ -5288,7 +5274,7 @@ function summarize(report) {
     ...open.length > 4 ? [`${open.length - 4} more findings in the report.`] : [],
     ...report.diagnostics.slice(0, 2).map(cleanText),
     `Evidence: ${report.reportPath}. Resume/check with mason_automation(action: "check") or mason check.`,
-    "Keep original evidence. Address findings relevant to the authorized task; report unrelated findings with a brief scope reason and suggested follow-up. Use review_advisory for authorized assessments; otherwise leave advisories open without approving them."
+    "Keep original evidence. Address findings relevant to the authorized task; report unrelated findings with a brief scope reason and suggested follow-up. Use mason audit review for authorized assessments; otherwise leave advisories open without approving them."
   ].join("\n");
 }
 async function loadState(ws) {
@@ -5342,11 +5328,14 @@ async function matchingAnalysis(ws, state, inputs) {
     throw new Error("Repair baseline was modified; use the original baseline.");
   return { analysis: a };
 }
-async function verifyInputs(ws, inputs) {
+async function verifyInputs(ws, inputs, guidance = false) {
   return profilePhase(
     "automation.revalidate",
     () => withRepositoryInspection(ws.root, async () => {
-      const [after, currentWs] = await Promise.all([readInputs(ws.root), workspace(ws.root)]);
+      const [after, currentWs] = await Promise.all([
+        guidance ? readGuidanceInputs(ws.root) : readInputs(ws.root),
+        workspace(ws.root)
+      ]);
       if (after.fingerprint !== inputs.fingerprint || currentWs.directory !== ws.directory) {
         throw new Error(
           "Repository inputs or branch changed during automation; no current verification was recorded. Retry on a stable checkout."
@@ -5528,7 +5517,76 @@ async function analyze(ws, inputs, event, startedAt) {
     Math.max(0, 25e3 - (Date.now() - startedAt))
   );
 }
+async function guidanceAnalysis(ws, inputs) {
+  const checked = await checkDecisionAnchors({
+    root: ws.root,
+    docs: [],
+    headHash: inputs.head,
+    changesSinceDoc: /* @__PURE__ */ new Map(),
+    decisionsPresent: true
+  });
+  const findings = checked.advisories.map((current) => ({
+    id: findingId(current),
+    original: current,
+    current,
+    status: "review-required",
+    reason: "Current decision anchors changed; inspect their reasoning."
+  }));
+  const before = await loadState(ws);
+  if (before.guidance) {
+    const prior = z16.object({ findings: z16.array(repairFindingSchema) }).parse(await readStoreJson(ws.root, before.guidance.path));
+    const currentIds = new Set(findings.map((finding) => finding.id));
+    const records = (await loadDecisionStore(ws.root)).records;
+    for (const previous of prior.findings) {
+      if (currentIds.has(previous.id) || previous.original.evidence.kind !== "decision-anchor")
+        continue;
+      const evidence = previous.original.evidence;
+      const record = records.find((record2) => record2.id === evidence.decisionId);
+      const capture = record && inputs.decisionEvidence[record.id]?.capture;
+      const resolved = record?.status === "retired" || !!record && !!capture?.complete && capture.anchors.length > 0 && !checked.skipped.length;
+      findings.push({
+        id: previous.id,
+        original: previous.original,
+        status: resolved ? "resolved" : "unverified",
+        reason: resolved ? "Current decision evidence no longer reports this drift, or the retained record is retired." : "Decision evidence could not establish closure."
+      });
+    }
+  }
+  const counts = {
+    resolved: 0,
+    unresolved: 0,
+    "review-required": 0,
+    unverified: checked.skipped.length
+  };
+  for (const finding of findings) counts[finding.status]++;
+  const report = {
+    version: 1,
+    status: counts.unverified || counts["review-required"] ? "incomplete" : "verified",
+    root: ws.root,
+    branch: ws.branch,
+    head: inputs.head,
+    baselinePaths: [],
+    reportPath: "",
+    findings,
+    diagnostics: [
+      ...checked.skipped.map((item) => item.reason),
+      ...findings.filter((finding) => finding.status === "unverified").map((finding) => `Decision ${finding.id}: ${finding.reason}`)
+    ],
+    checks: { ran: ["decision-anchor-drift"], reused: [], skipped: checked.skipped },
+    counts,
+    capture: "unknown",
+    scope: "Decision anchor evidence only. Documentation audits and retained repair baselines were not checked. Source inspection remains separate from human approval."
+  };
+  await verifyInputs(ws, inputs, true);
+  return { analysis: { id: "guidance", report }, shared: false };
+}
 async function automate(dir, event) {
+  return runAutomation(dir, event, false);
+}
+async function observeDecisionLifecycle(dir, event) {
+  return runAutomation(dir, event, true);
+}
+async function runAutomation(dir, event, guidance) {
   const startedAt = Date.now();
   const ws = await profilePhase("automation.workspace", () => workspace(dir));
   const config = await readAutomationConfig(ws.root);
@@ -5537,12 +5595,12 @@ async function automate(dir, event) {
     ws.directory,
     event.event,
     () => withRepositoryInspection(ws.root, async () => {
-      const inputs = await readInputs(ws.root);
+      const inputs = await (guidance ? readGuidanceInputs(ws.root) : readInputs(ws.root));
       const result = await profilePhase(
         "automation.analysis",
-        () => analyze(ws, inputs, event, startedAt)
+        async () => guidance ? await guidanceAnalysis(ws, inputs) : await analyze(ws, inputs, event, startedAt)
       );
-      if (result.shared) {
+      if (!guidance && result.shared) {
         await verifyInputs(ws, inputs);
         if (result.analysis.baselineDigest !== await baselineDigest(ws, await loadState(ws))) {
           throw new Error(
@@ -5554,16 +5612,18 @@ async function automate(dir, event) {
         "automation.publish",
         () => withLock(ws.root, ws.directory, async () => {
           const state = await loadState(ws);
-          if (state.analysis?.id !== result.analysis.id)
+          if (!guidance && state.analysis?.id !== result.analysis.id)
             throw new Error(
               "Automation evidence changed during publication; retry against the current inputs."
             );
           const report = structuredClone(result.analysis.report);
+          if (guidance) await verifyInputs(ws, inputs, true);
           if (!state.notifications) {
             let baseline = { findings: report.findings, head: report.head };
-            if (state.latest) {
+            const previousPath2 = guidance ? state.guidance?.path : state.latest;
+            if (previousPath2) {
               try {
-                const previous = z16.object({ findings: z16.array(repairFindingSchema), head: z16.string() }).safeParse(await readStoreJson(ws.root, state.latest));
+                const previous = z16.object({ findings: z16.array(repairFindingSchema), head: z16.string() }).safeParse(await readStoreJson(ws.root, previousPath2));
                 if (!previous.success) throw new Error("Unsupported saved report");
                 baseline = previous.data;
               } catch {
@@ -5581,7 +5641,7 @@ async function automate(dir, event) {
               reused: [.../* @__PURE__ */ new Set([...report.checks.ran, ...report.checks.reused])],
               shared: true
             };
-          report.reportPath = ws.directory + "/checks/" + randomUUID4() + ".json";
+          report.reportPath = ws.directory + "/checks/" + (guidance ? "guidance-" : "") + randomUUID4() + ".json";
           const now = (/* @__PURE__ */ new Date()).toISOString();
           const key = event.host && event.sessionId ? hash([event.host, event.sessionId]) : null;
           const newSession = key !== null && !state.sessions[key];
@@ -5643,7 +5703,7 @@ async function automate(dir, event) {
               ])
             ];
           const stopReview = session && event.host === "claude" && event.event === "task_end" && config.stopBlock === "drift" ? decisionStopReview(session, inputs, report, !!event.stopHookActive) : { reason: null, block: false };
-          const message2 = !session ? summarize(report) : [
+          const message = !session ? summarize(report) : [
             stopReview.reason,
             completionSummary(selected, report.reportPath),
             completionSummary(feedback, report.reportPath),
@@ -5651,17 +5711,23 @@ async function automate(dir, event) {
               `Mason: verification limited. ${diagnostics.slice(0, 2).map(cleanText).join(" ")} Evidence: ${report.reportPath}.`
             ] : []
           ].filter(Boolean).join("\n") || null;
-          const notify = message2 !== null;
-          const persistReport = !state.latest || state.fingerprint !== inputs.fingerprint || notify || newSession || event.event === "task_end";
-          if (!persistReport) report.reportPath = state.latest;
+          const notify = message !== null;
+          const previousPath = guidance ? state.guidance?.path : state.latest;
+          const previousFingerprint = guidance ? state.guidance?.fingerprint : state.fingerprint;
+          const persistReport = !previousPath || previousFingerprint !== inputs.fingerprint || notify || newSession || event.event === "task_end";
+          if (!persistReport) report.reportPath = previousPath;
           state.updatedAt = now;
-          state.fingerprint = inputs.fingerprint;
-          state.latest = report.reportPath;
+          if (guidance)
+            state.guidance = { fingerprint: inputs.fingerprint, path: report.reportPath };
+          else {
+            state.fingerprint = inputs.fingerprint;
+            state.latest = report.reportPath;
+          }
           if (persistReport) await writeStoreJson(ws.root, report.reportPath, report);
           await writeStoreJson(ws.root, ws.directory + "/state.json", state);
           return {
             report,
-            message: message2,
+            message,
             stopBlockReason: stopReview.block ? stopReview.reason : null,
             observedAt: now,
             delivery: { agent: feedback.slice(0, 4), completion: selected.slice(0, 4) }
@@ -5705,6 +5771,8 @@ async function automationStatus(dir) {
       root: ws.root,
       branch: ws.branch,
       baselinePaths: [],
+      scope: "not-observed",
+      auditReportPath: null,
       hosts: {},
       execution,
       notifications,
@@ -5713,8 +5781,9 @@ async function automationStatus(dir) {
   const state = parseState(raw);
   if (state.root !== ws.root || state.gitDir !== ws.gitDir || state.branch !== ws.branch)
     throw new Error("Automation state belongs to another workspace.");
-  const inputs = await readInputs(ws.root);
-  const latest = state.latest ? await readStoreJson(ws.root, state.latest) : null;
+  const inputs = await (state.guidance ? readGuidanceInputs(ws.root) : readInputs(ws.root));
+  const reportPath = state.guidance?.path ?? state.latest;
+  const latest = reportPath ? await readStoreJson(ws.root, reportPath) : null;
   const hosts2 = {};
   for (const session of Object.values(state.sessions)) {
     const host = hosts2[session.host] ??= { sessions: 0, observedEvents: [] };
@@ -5725,24 +5794,28 @@ async function automationStatus(dir) {
   return {
     version: 1,
     stopBlock: config.stopBlock,
-    status: unfinished ? "unavailable" : inputs.fingerprint === state.fingerprint ? "current" : "changed",
+    status: unfinished ? "unavailable" : inputs.fingerprint === (state.guidance?.fingerprint ?? state.fingerprint) ? "current" : "changed",
     root: ws.root,
     branch: ws.branch,
     baselinePaths: state.baselines.map((b) => b.path),
-    reportPath: state.latest,
+    reportPath,
+    scope: state.guidance ? "decision-guidance" : "documentation-audit",
+    auditReportPath: state.latest,
     verificationStatus: unfinished ? "unavailable" : latest?.status ?? "unavailable",
     hosts: hosts2,
     execution,
     notifications,
     knowledge,
     notificationBaselineHead: state.notifications?.baselineHead ?? null,
-    note: "Observed events do not prove all tool paths are intercepted. Run check to verify the retained evidence."
+    note: "Status describes the reported scope only. Decision guidance does not verify documentation repairs. Observed events do not prove all tool paths are intercepted. Run mason check for retained audit evidence."
   };
 }
 var SCOPE, priority, cleanText, analysisSchema, sharedSchema, baselineDigest;
 var init_runtime = __esm({
   "src/automation/runtime.ts"() {
     "use strict";
+    init_decisions();
+    init_decision_anchor();
     init_config();
     init_stop_review();
     init_usefulness();
@@ -5806,9 +5879,9 @@ var init_runtime = __esm({
 
 // src/automation/hook-root.ts
 import fs17 from "fs/promises";
-import path23 from "path";
+import path21 from "path";
 async function repositoryRoot(dir) {
-  if (!path23.isAbsolute(dir)) throw new Error("Hook input working directory must be absolute.");
+  if (!path21.isAbsolute(dir)) throw new Error("Hook input working directory must be absolute.");
   try {
     return await fs17.realpath((await git3(dir, "rev-parse", "--show-toplevel")).trim());
   } catch (error) {
@@ -5852,10 +5925,160 @@ var init_hook_root = __esm({
   }
 });
 
-// src/setup/model.ts
+// src/hook/hook.ts
 import { z as z17 } from "zod";
 import fs18 from "fs/promises";
-import path24 from "path";
+import path22 from "path";
+import os3 from "os";
+import { createHash as createHash6 } from "crypto";
+async function exists(p) {
+  try {
+    await fs18.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function findMasonRoot(startDir) {
+  let dir = startDir;
+  for (let i = 0; i < MAX_WALK_UP; i++) {
+    if (await exists(path22.join(dir, ".mason", "decisions"))) return dir;
+    if (await exists(path22.join(dir, ".git"))) return null;
+    const parent = path22.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+function anchorsCover(record, relPath) {
+  return decisionAnchors(record).some((anchor) => anchorMatches(anchor, relPath));
+}
+function exactAnchor(record, relPath) {
+  return decisionAnchors(record).some((a) => a.replace(/\/+$/, "") === relPath);
+}
+function stateKey(input) {
+  const raw = `${input.session_id ?? "nosession"}${input.agent_id ? `-${input.agent_id}` : ""}`;
+  return raw.replace(/[^A-Za-z0-9_-]/g, "").slice(0, 120) || "nosession";
+}
+async function loadInjected(stateFile) {
+  try {
+    const parsed = JSON.parse(await fs18.readFile(stateFile, "utf-8"));
+    return new Set(isStringArray(parsed) ? parsed : []);
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+function formatContext(relPath, records, drift) {
+  const lines = [];
+  lines.push(
+    `Mason: decision knowledge relevant to ${relPath} or updated since this session saw it. This replaces earlier guidance for the same decision id. ${DECISION_GUIDANCE} Retired or superseded records are no longer active. Use Mason tools to record decision changes and source inspections; do not edit the JSON in .mason/decisions/ directly.`
+  );
+  const append = (id, knowledge, label, freshness) => {
+    const stale = freshness === "current" ? "" : freshness === "changed" ? " [recorded against changed files \u2013 verify against current code before relying on it]" : " [freshness unknown \u2013 verify against current code before relying on it]";
+    lines.push(
+      `- [${label}] [${knowledge.category}] ${knowledge.title}: ${knowledge.body} (id: ${id}; revision: ${knowledge.revision}; anchors: ${knowledge.files.join(", ")}; owner: ${knowledge.owner ?? "unknown"}; sources: ${knowledge.sources.slice(0, 2).map((s) => s.reference).join(", ") || "unrecorded"})${stale}`
+    );
+  };
+  for (const record of records) {
+    const knowledge = decisionKnowledge(
+      record,
+      drift.freshness?.[record.id] ?? "unknown",
+      drift.pendingProposals?.[record.id]?.freshness ?? "unknown"
+    );
+    append(
+      record.id,
+      knowledge,
+      record.status === "active" ? knowledge.approval : record.status,
+      knowledge.trust.freshness
+    );
+    if (knowledge.pendingProposal)
+      append(
+        record.id,
+        knowledge.pendingProposal,
+        "proposed",
+        knowledge.pendingProposal.trust.freshness
+      );
+  }
+  return lines.join("\n");
+}
+async function runHook(stdinText, env = {}) {
+  let input;
+  try {
+    input = hookStdinSchema.parse(JSON.parse(stdinText));
+  } catch {
+    return null;
+  }
+  if (!input || typeof input !== "object") return null;
+  if (input.tool_name && !SUPPORTED_TOOLS.has(input.tool_name)) return null;
+  const filePath = input.tool_input?.file_path;
+  if (!filePath || typeof filePath !== "string") return null;
+  const absPath = path22.isAbsolute(filePath) ? filePath : path22.resolve(input.cwd ?? process.cwd(), filePath);
+  const root = await findMasonRoot(path22.dirname(absPath));
+  if (!root) return null;
+  if (env.rootDir && await fs18.realpath(root) !== await fs18.realpath(env.rootDir)) return null;
+  const relPath = path22.relative(root, absPath).split(path22.sep).join("/");
+  if (relPath.startsWith("..")) return null;
+  const { records } = await loadDecisionStore(root);
+  const stateDir = env.stateDir ?? os3.tmpdir();
+  const stateFile = path22.join(
+    stateDir,
+    `mason-hook-${createHash6("sha256").update(root).digest("hex").slice(0, 12)}-${stateKey(input)}.json`
+  );
+  const injected = await loadInjected(stateFile);
+  const recordKey = (record) => `${record.id}:${createHash6("sha256").update(JSON.stringify(record)).digest("hex")}`;
+  const previouslyInjected = (record) => [...injected].some((key) => key === record.id || key.startsWith(`${record.id}:`));
+  const fresh = records.filter(
+    (r) => !injected.has(recordKey(r)) && (previouslyInjected(r) || r.status === "active" && anchorsCover(r, relPath))
+  );
+  if (fresh.length === 0) return null;
+  fresh.sort((a, b) => {
+    const withdrawn = Number(b.status !== "active") - Number(a.status !== "active");
+    if (withdrawn) return withdrawn;
+    const exactDiff = Number(exactAnchor(b, relPath)) - Number(exactAnchor(a, relPath));
+    if (exactDiff !== 0) return exactDiff;
+    return b.updatedAt.localeCompare(a.updatedAt);
+  });
+  const selected = fresh.slice(0, MAX_INJECTED_DECISIONS);
+  const drift = await computeDecisionDrift(root, selected);
+  for (const record of selected) injected.add(recordKey(record));
+  try {
+    await fs18.writeFile(stateFile, JSON.stringify([...injected]), "utf-8");
+  } catch {
+  }
+  return JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: env.hookEventName ?? "PostToolUse",
+      additionalContext: formatContext(relPath, selected, drift)
+    }
+  });
+}
+var MAX_INJECTED_DECISIONS, MAX_WALK_UP, SUPPORTED_TOOLS, hookStdinSchema;
+var init_hook = __esm({
+  "src/hook/hook.ts"() {
+    "use strict";
+    init_validation();
+    init_decisions();
+    init_provenance();
+    init_paths();
+    init_drift2();
+    MAX_INJECTED_DECISIONS = 3;
+    MAX_WALK_UP = 30;
+    SUPPORTED_TOOLS = /* @__PURE__ */ new Set(["Read", "Edit", "Write"]);
+    hookStdinSchema = z17.object({
+      session_id: z17.string().optional(),
+      agent_id: z17.string().optional(),
+      cwd: z17.string().optional(),
+      hook_event_name: z17.string().optional(),
+      tool_name: z17.string().optional(),
+      tool_input: z17.object({ file_path: z17.string().optional() }).optional()
+    });
+  }
+});
+
+// src/setup/model.ts
+import { z as z18 } from "zod";
+import fs19 from "fs/promises";
+import path23 from "path";
 async function loadSetup(root) {
   const raw = await readStoreJson(root, SETUP_PATH);
   if (raw === null) return null;
@@ -5864,17 +6087,17 @@ async function loadSetup(root) {
 async function effectiveSetup(root) {
   const local = await loadSetup(root);
   if (local) return { root, setup: local };
-  const common = await fs18.realpath(
-    path24.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim())
+  const common = await fs19.realpath(
+    path23.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim())
   );
-  const own = await fs18.realpath((await git3(root, "rev-parse", "--absolute-git-dir")).trim());
+  const own = await fs19.realpath((await git3(root, "rev-parse", "--absolute-git-dir")).trim());
   if (common === own) return { root, setup: null };
   const primary = (await git3(root, "worktree", "list", "--porcelain", "-z")).split("\0\0")[0].split("\0");
   const candidate = primary.find((field) => field.startsWith("worktree "))?.slice(9);
   if (!candidate || primary.includes("bare")) return { root, setup: null };
   let inheritedRoot;
   try {
-    inheritedRoot = await fs18.realpath(
+    inheritedRoot = await fs19.realpath(
       (await git3(candidate, "rev-parse", "--show-toplevel")).trim()
     );
   } catch (error) {
@@ -5882,8 +6105,8 @@ async function effectiveSetup(root) {
       return { root, setup: null };
     throw error;
   }
-  const inheritedCommon = await fs18.realpath(
-    path24.resolve(inheritedRoot, (await git3(inheritedRoot, "rev-parse", "--git-common-dir")).trim())
+  const inheritedCommon = await fs19.realpath(
+    path23.resolve(inheritedRoot, (await git3(inheritedRoot, "rev-parse", "--git-common-dir")).trim())
   );
   if (inheritedCommon !== common)
     throw new Error("Linked worktree setup does not belong to the same Git repository.");
@@ -5907,35 +6130,35 @@ var init_model = __esm({
     "use strict";
     init_evidence();
     init_storage();
-    setupHostSchema = z17.object({
-      configuredVersion: z17.string(),
-      revision: z17.string().uuid(),
-      fingerprint: z17.string(),
-      mcpFingerprint: z17.string(),
-      instructions: z17.array(z17.string())
+    setupHostSchema = z18.object({
+      configuredVersion: z18.string(),
+      revision: z18.string().uuid(),
+      fingerprint: z18.string(),
+      mcpFingerprint: z18.string(),
+      instructions: z18.array(z18.string())
     });
-    setupSchema = z17.object({
-      version: z17.literal(2),
-      hosts: z17.object({
+    setupSchema = z18.object({
+      version: z18.literal(2),
+      hosts: z18.object({
         codex: setupHostSchema.optional(),
         claude: setupHostSchema.optional()
       })
     });
     SETUP_PATH = ".mason/local/setup.json";
     INACTIVE_HOSTS_PATH = ".mason/local/inactive-hosts.json";
-    inactiveHostsSchema = z17.object({
-      version: z17.literal(1),
-      hosts: z17.array(z17.enum(["claude", "codex"]))
+    inactiveHostsSchema = z18.object({
+      version: z18.literal(1),
+      hosts: z18.array(z18.enum(["claude", "codex"]))
     });
-    receiptSchema = z17.object({
-      version: z17.literal(1),
-      host: z17.enum(["codex", "claude"]),
-      status: z17.enum(["installing", "configured"]),
-      initialReportPath: z17.string(),
-      initialBaselinePaths: z17.array(z17.string()),
-      root: z17.string(),
-      revision: z17.string().uuid(),
-      configuredAt: z17.string().optional()
+    receiptSchema = z18.object({
+      version: z18.literal(1),
+      host: z18.enum(["codex", "claude"]),
+      status: z18.enum(["installing", "configured"]),
+      initialReportPath: z18.string().optional(),
+      initialBaselinePaths: z18.array(z18.string()).optional(),
+      root: z18.string(),
+      revision: z18.string().uuid(),
+      configuredAt: z18.string().optional()
     });
   }
 });
@@ -5951,10 +6174,10 @@ __export(launcher_exports, {
   mcpCommand: () => mcpCommand,
   prepareLaunch: () => prepareLaunch
 });
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
-import fs19 from "fs/promises";
+import fs20 from "fs/promises";
 function globalCommand(args2, platform = process.platform) {
   return platform === "win32" ? { command: "cmd.exe", args: ["/d", "/s", "/c", "mason", ...args2] } : { command: "mason", args: args2 };
 }
@@ -5966,7 +6189,7 @@ async function installedCommand() {
       maxBuffer: 8192,
       windowsHide: true
     });
-    const result = z18.object({ protocol: z18.literal(1), version: z18.string() }).parse(JSON.parse(stdout));
+    const result = z19.object({ protocol: z19.literal(1), version: z19.string() }).parse(JSON.parse(stdout));
     if (result.protocol !== 1 || typeof result.version !== "string")
       throw new Error("Unsupported Mason integration protocol.");
     return { available: true, version: result.version, message: null };
@@ -5979,7 +6202,7 @@ async function installedCommand() {
   }
 }
 async function prepareLaunch(host, options = {}) {
-  const root = await fs19.realpath(
+  const root = await fs20.realpath(
     (await git3(options.dir ?? process.cwd(), "rev-parse", "--show-toplevel")).trim()
   );
   const entry = (await effectiveSetup(root)).setup?.hosts[host];
@@ -6007,9 +6230,9 @@ var init_launcher = __esm({
     "use strict";
     init_evidence();
     init_model();
-    executingVersion = () => true ? "0.21.0" : "development";
+    executingVersion = () => true ? "0.22.0" : "development";
     mcpCommand = (host) => globalCommand(["--setup-host", host, "mcp"]);
-    hookCommand = (host) => `mason --setup-host ${host} auto`;
+    hookCommand = (host) => `mason --setup-host ${host}`;
   }
 });
 
@@ -6020,8 +6243,8 @@ __export(observations_exports, {
   observeActivation: () => observeActivation,
   readObservation: () => readObservation
 });
-import fs20 from "fs/promises";
-import { z as z19 } from "zod";
+import fs21 from "fs/promises";
+import { z as z20 } from "zod";
 function observationPath(directory3, host, revision, version = executingVersion()) {
   return `${directory3}/activation/${host}-${revision}-${hash(version).slice(0, 12)}.json`;
 }
@@ -6044,8 +6267,8 @@ async function observeActivation(dir, event, options = {}) {
       return inactiveSetupMessage();
     }
     const capturedDirectory = options.directory?.match(/^\.mason\/reports\/automation\/[a-f0-9]{24}$/)?.[0] ?? options.reportPath?.match(/^(\.mason\/reports\/automation\/[a-f0-9]{24})\/checks\//)?.[1];
-    const ws = capturedDirectory ? { root: await fs20.realpath(dir), directory: capturedDirectory } : await workspace(dir);
-    if (ws.root !== await fs20.realpath(process.env.MASON_SETUP_ROOT)) return null;
+    const ws = capturedDirectory ? { root: await fs21.realpath(dir), directory: capturedDirectory } : await workspace(dir);
+    if (ws.root !== await fs21.realpath(process.env.MASON_SETUP_ROOT)) return null;
     const { setup } = await effectiveSetup(ws.root);
     if (setup?.hosts[host]?.revision !== revision)
       return "Mason setup changed; restart the assistant to observe the current integration.";
@@ -6096,20 +6319,20 @@ var init_observations = __esm({
     init_storage();
     init_model();
     init_launcher();
-    observationSchema = z19.object({
-      version: z19.literal(1),
-      masonVersion: z19.string(),
-      root: z19.string(),
-      revision: z19.string(),
-      host: z19.enum(["codex", "claude"]),
-      contextCalls: z19.number().int().nonnegative(),
-      lastContextAt: z19.string().optional(),
-      sessions: z19.record(
-        z19.object({
-          events: z19.array(z19.enum(events)),
-          at: z19.string(),
-          verificationStatus: z19.string().optional(),
-          reportPath: z19.string().optional()
+    observationSchema = z20.object({
+      version: z20.literal(1),
+      masonVersion: z20.string(),
+      root: z20.string(),
+      revision: z20.string(),
+      host: z20.enum(["codex", "claude"]),
+      contextCalls: z20.number().int().nonnegative(),
+      lastContextAt: z20.string().optional(),
+      sessions: z20.record(
+        z20.object({
+          events: z20.array(z20.enum(events)),
+          at: z20.string(),
+          verificationStatus: z20.string().optional(),
+          reportPath: z20.string().optional()
         })
       )
     });
@@ -6117,7 +6340,23 @@ var init_observations = __esm({
 });
 
 // src/automation/adapters.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
+async function decisionContext(host, raw, root) {
+  const input = inputSchema.parse(raw);
+  if (host !== "claude" || !(input.hook_event_name === "PostToolUse" && input.tool_name === "Read" || input.hook_event_name === "PreToolUse" && ["Edit", "Write"].includes(input.tool_name ?? "")))
+    return null;
+  try {
+    const output = await runHook(JSON.stringify(raw), {
+      rootDir: root,
+      hookEventName: input.hook_event_name
+    });
+    if (!output) return null;
+    const parsed = JSON.parse(output);
+    return z21.object({ hookSpecificOutput: z21.object({ additionalContext: z21.string() }) }).parse(parsed).hookSpecificOutput.additionalContext;
+  } catch (error) {
+    return failureMessage(error) + " Decision knowledge was not delivered.";
+  }
+}
 function normalizeHook(host, raw) {
   hostSchema.parse(host);
   const input = inputSchema.parse(raw);
@@ -6163,9 +6402,13 @@ async function runAutomationHook(host, stdin, options = {}) {
         sessionId: input.event.sessionId,
         directory: observed.directory
       });
-      return warning2 ? { systemMessage: warning2 } : null;
+      const knowledge2 = await decisionContext(host, raw, observed.root);
+      return knowledge2 ? {
+        ...warning2 ? { systemMessage: warning2 } : {},
+        hookSpecificOutput: { hookEventName: name, additionalContext: knowledge2 }
+      } : warning2 ? { systemMessage: warning2 } : null;
     }
-    const result = await automate(input.cwd, input.event);
+    const result = await observeDecisionLifecycle(input.cwd, input.event);
     const { observeActivation: observeActivation2 } = await Promise.resolve().then(() => (init_observations(), observations_exports));
     const warning = await observeActivation2(result.report.root, input.event.event, {
       sessionId: input.event.sessionId,
@@ -6173,6 +6416,8 @@ async function runAutomationHook(host, stdin, options = {}) {
       reportPath: result.report.reportPath
     });
     if (warning) result.message = [result.message, warning].filter(Boolean).join("\n");
+    const knowledge = await decisionContext(host, raw, result.report.root);
+    if (knowledge) result.message = [result.message, knowledge].filter(Boolean).join("\n\n");
     if (name === "Stop" && result.stopBlockReason) {
       return { decision: "block", reason: result.message ?? result.stopBlockReason };
     }
@@ -6182,35 +6427,42 @@ async function runAutomationHook(host, stdin, options = {}) {
     }
     return { hookSpecificOutput: { hookEventName: name, additionalContext: result.message } };
   } catch (error) {
-    const message2 = hook ? await hookFailureMessage(hook.cwd, host, hook.event.sessionId, error) : failureMessage(error);
-    if (!message2) return null;
+    const message = hook ? await hookFailureMessage(hook.cwd, host, hook.event.sessionId, error) : failureMessage(error);
+    if (!message) return null;
     return {
-      systemMessage: message2,
-      ...["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse"].includes(name) ? { hookSpecificOutput: { hookEventName: name, additionalContext: message2 } } : {}
+      systemMessage: message,
+      ...["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse"].includes(name) ? { hookSpecificOutput: { hookEventName: name, additionalContext: message } } : {}
     };
   }
 }
-function managedHookCommand(host, platform = process.platform) {
-  const command2 = `mason --setup-host ${host} auto hook --host ${host}`;
+function managedHookCommand(host, platform = process.platform, legacy = false) {
+  const command2 = `mason --setup-host ${host}${legacy ? " auto" : ""} hook --host ${host}`;
   return platform === "win32" ? `cmd.exe /d /s /c "where mason >nul 2>nul & if errorlevel 1 (exit /b 0) else (${command2})"` : `if command -v mason >/dev/null 2>&1; then ${command2}; fi`;
 }
 function knownManagedHookCommands(host) {
   return [
+    "npx --no-install --package mason-context mason auto hook --host " + host,
+    "npx --no-install --package mason-context mason hook --host " + host,
     managedHookCommand(host, "linux"),
     managedHookCommand(host, "win32"),
+    managedHookCommand(host, "linux", true),
+    managedHookCommand(host, "win32", true),
+    `mason --setup-host ${host} hook --host ${host}`,
     `mason --setup-host ${host} auto hook --host ${host}`
   ];
 }
 function compatibleManagedHookCommands(host, platform = process.platform) {
   return [
     managedHookCommand(host, platform),
+    managedHookCommand(host, platform, true),
+    `mason --setup-host ${host} hook --host ${host}`,
     `mason --setup-host ${host} auto hook --host ${host}`
   ];
 }
-function hookConfig(host, command2 = "npx --no-install --package mason-context mason auto") {
+function hookConfig(host, command2 = "npx --no-install --package mason-context mason") {
   const handler = {
     type: "command",
-    command: command2 === `mason --setup-host ${host} auto` ? managedHookCommand(host) : command2 + " hook --host " + host,
+    command: [`mason --setup-host ${host}`, `mason --setup-host ${host} auto`].includes(command2) ? managedHookCommand(host) : command2 + " hook --host " + host,
     timeout: 30
   };
   return {
@@ -6236,22 +6488,23 @@ var init_adapters = __esm({
     init_runtime();
     init_store();
     init_hook_root();
-    inputSchema = z20.object({
-      cwd: z20.string().min(1),
-      session_id: z20.string().min(1).max(500),
-      hook_event_name: z20.enum([
+    init_hook();
+    inputSchema = z21.object({
+      cwd: z21.string().min(1),
+      session_id: z21.string().min(1).max(500),
+      hook_event_name: z21.enum([
         "SessionStart",
         "UserPromptSubmit",
         "PreToolUse",
         "PostToolUse",
         "Stop"
       ]),
-      tool_name: z20.string().optional(),
-      tool_use_id: z20.string().max(500).optional(),
-      tool_response: z20.unknown().optional(),
-      tool_input: z20.unknown().optional(),
-      stop_hook_active: z20.boolean().optional(),
-      permission_mode: z20.string().optional()
+      tool_name: z21.string().optional(),
+      tool_use_id: z21.string().max(500).optional(),
+      tool_response: z21.unknown().optional(),
+      tool_input: z21.unknown().optional(),
+      stop_hook_active: z21.boolean().optional(),
+      permission_mode: z21.string().optional()
     });
     lifecycle = {
       SessionStart: "session_start",
@@ -6277,8 +6530,8 @@ __export(files_exports, {
   managedBlock: () => managedBlock,
   readText: () => readText
 });
-import fs21 from "fs/promises";
-import path25 from "path";
+import fs22 from "fs/promises";
+import path24 from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 async function readText(root, file) {
   try {
@@ -6315,17 +6568,17 @@ async function applyEdit(root, edit) {
     const file2 = await storePath(root, edit.path);
     if (await readText(root, edit.path) !== edit.before)
       throw new Error("Input changed during removal: " + edit.path);
-    await fs21.unlink(file2);
+    await fs22.unlink(file2);
     return true;
   }
   const file = await storePath(root, edit.path, true);
-  const temporary = path25.join(path25.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
+  const temporary = path24.join(path24.dirname(file), ".mason-setup-" + randomUUID5() + ".tmp");
   try {
-    const mode = await fs21.stat(file).then(
+    const mode = await fs22.stat(file).then(
       (s) => s.mode & 511,
       () => 384
     );
-    const handle = await fs21.open(temporary, "wx", mode);
+    const handle = await fs22.open(temporary, "wx", mode);
     try {
       await handle.writeFile(edit.after, "utf8");
       await handle.sync();
@@ -6334,10 +6587,10 @@ async function applyEdit(root, edit) {
     }
     if (await readText(root, edit.path) !== edit.before)
       throw new Error("Integration input changed during update: " + edit.path);
-    await fs21.rename(temporary, file);
+    await fs22.rename(temporary, file);
     return true;
   } finally {
-    await fs21.rm(temporary, { force: true });
+    await fs22.rm(temporary, { force: true });
   }
 }
 var init_files2 = __esm({
@@ -6358,7 +6611,7 @@ __export(ownership_exports, {
   ownershipEdit: () => ownershipEdit,
   ownershipSchema: () => ownershipSchema
 });
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 import { parse } from "smol-toml";
 function blockSpan(text2, start, end) {
   const starts = text2.split(start).length - 1, ends = text2.split(end).length - 1;
@@ -6384,9 +6637,9 @@ async function ownershipEdit(root, edits, hookCommands = {}) {
       )
     };
     const hostConfig = edit.path.endsWith(".json") ? JSON.parse(edit.after) : void 0;
-    const parsedHost = z21.object({
-      mcpServers: z21.record(z21.unknown()).optional(),
-      hooks: z21.record(z21.array(z21.object({ hooks: z21.array(z21.unknown()) }))).optional()
+    const parsedHost = z22.object({
+      mcpServers: z22.record(z22.unknown()).optional(),
+      hooks: z22.record(z22.array(z22.object({ hooks: z22.array(z22.unknown()) }))).optional()
     }).parse(hostConfig ?? {});
     const mcp = edit.path === ".codex/config.toml" ? parse(edit.after).mcp_servers?.mason : edit.path === ".mcp.json" ? parsedHost.mcpServers?.mason : void 0;
     const hooks = edit.path === ".codex/hooks.json" || edit.path === ".claude/settings.json" ? parsedHost.hooks : void 0;
@@ -6428,30 +6681,30 @@ var init_ownership = __esm({
       ["<!-- mason:agents:start -->", "<!-- mason:agents:end -->"],
       ["# mason:mcp:start", "# mason:mcp:end"]
     ];
-    fileSchema = z21.object({
-      created: z21.boolean(),
-      initialHash: z21.string(),
-      blocks: z21.record(z21.string()),
-      mcpHash: z21.string().optional(),
-      hookCommands: z21.array(z21.string()).optional(),
-      hooks: z21.record(z21.array(z21.string())).optional()
+    fileSchema = z22.object({
+      created: z22.boolean(),
+      initialHash: z22.string(),
+      blocks: z22.record(z22.string()),
+      mcpHash: z22.string().optional(),
+      hookCommands: z22.array(z22.string()).optional(),
+      hooks: z22.record(z22.array(z22.string())).optional()
     });
-    ownershipSchema = z21.object({ version: z21.literal(1), files: z21.record(fileSchema) });
+    ownershipSchema = z22.object({ version: z22.literal(1), files: z22.record(fileSchema) });
   }
 });
 
 // src/mcp/init.ts
-import { z as z22 } from "zod";
-var markerSchema, CLAUDE_MD_SECTION, ASSISTANT_SETUP, QUICKSTART_PLAYBOOK, MAP_PLAYBOOK;
+import { z as z23 } from "zod";
+var markerSchema, CLAUDE_MD_SECTION, ASSISTANT_SETUP, QUICKSTART_PLAYBOOK;
 var init_init = __esm({
   "src/mcp/init.ts"() {
     "use strict";
     init_storage();
     init_files2();
-    markerSchema = z22.object({
-      version: z22.literal(1),
-      initializedAt: z22.string(),
-      features: z22.object({ confluence: z22.boolean().optional() }).passthrough().optional()
+    markerSchema = z23.object({
+      version: z23.literal(1),
+      initializedAt: z23.string(),
+      features: z23.record(z23.unknown()).optional()
     }).passthrough();
     CLAUDE_MD_SECTION = `<!-- mason:start -->
 ## Mason project knowledge
@@ -6464,21 +6717,14 @@ Mason provides recorded decisions and file impact over MCP. A concept map is opt
 - Before saving, compare the lesson with matching \`get_context\` records and any pending proposal. If new evidence changes the same lesson's assumptions, scope, or recommended action, revise it with \`save_decision(id: existingId)\`, including when it is accepted. Preserve supported rationale and sources, replace obsolete instructions, and add the new evidence. Create a separate record for a genuinely distinct lesson; skip unchanged restatements. Revision preserves history and leaves the accepted version operative until authorized review.
 - Consult trust metadata before relying on entries: unknown or changed freshness requires inspection, stale or unknown map verification requires a fresh evidence review, and a recorded failed verdict means the description must be corrected. Check approval too: proposals are suggestions, legacy records are unreviewed, and accepted decisions are recorded constraints subject to freshness checks. An accepted revision remains operative while a pending proposal is reviewed; keep both versions and their freshness distinct.
 - Asked to review pending project knowledge \u2192 \`mason_automation(action: "status")\` lists pending proposals and uncommitted records. For ordinary tasks, inspect matching proposals through \`get_context\`; do not request acceptance merely because a proposal exists.
-- Asked to review or re-verify a decision \u2192 \`review_decision\` first to inspect content, sources, history, and code changes. After source inspection finds no contradiction, record action \`inspect\` with the actual inspector, note, and prepared token; this does not claim human approval. Record acceptance, reaffirmation, or retirement only when authorized by the user or a cited team review, with the actual reviewer and reason. Never infer approval from unchanged code. Review and commit the local record through the normal project workflow.
-- For an architectural overview, use \`get_snapshot\` if a map is available. If \`map.status\` is missing or invalid, use available decisions and source evidence; do not start building a map unless requested.
-- \`mason_init\` returns documentation audit and committed-diff review results, plus a short setup guide. Pass \`evidence\` with local CI manifest paths to include test and analysis results; the CLI equivalent is \`mason-review --evidence <manifest>\`. State skipped, unavailable, stale, or unknown checks explicitly. Related accepted decisions identify review context, not proven violations.
-
-- When documentation repair is authorized, use \`mason_repair(action: "prepare")\` before edits, keep its baselinePath, and use \`mason_repair(action: "verify", baselinePath)\` after edits and any final doc commit. Report every original finding's outcome and any new findings. Specific suppressed advisories remain unresolved; editing a doc does not approve it. Informational dependency notices require no review.
-- When advisory assessment is authorized, use \`review_advisory(action: "prepare", baselinePath, findingId)\` to inspect original evidence and history. Record \`addressed\`, \`inapplicable\`, or \`deferred\` with the actual reviewer, reason in note, and returned reviewToken only after relevant edits are committed. Commit the assessment and verify the same baseline again. Relevant evidence changes reopen it; deferral stays outstanding. Decision findings use \`review_decision\`; advisory closure never approves a decision.
-
-- For a dependency advisory, \`review_advisory(action: "dismiss", baselinePath, findingId, reasonCode, note)\` records a one-step dismissal without reviewer or token. Use \`no-dependency-claims\` for a document with no dependency claims (reopens on document content changes), or \`unrelated-manifest-change\` for reviewed changes that do not affect its guidance (reopens on document or manifest changes). Keep the relevant scope committed; commit the dismissal to share it. This never approves a decision.
-
-- When Mason automation is installed, use \`mason_automation(action: "status")\` to inspect configured hooks and observed events, and \`mason_automation(action: "check")\` to resume its retained repair evidence. CLI fallback: \`mason status\` / \`mason check\`. Preserve existing baselines across sessions. Automatic checks do not authorize unrelated repairs or approve advisories.
+- Asked to review or re-verify a decision \u2192 \`review_decision\` first to inspect content, sources, history, and code changes. To inspect accepted guidance separately, use inspectionScope \`operative\` on both preparation and inspection; a pending draft remains visible and unassessed. Default all scope covers both revisions. After source inspection finds no contradiction in the selected scope, record action \`inspect\` with the actual inspector, note, and prepared token; this does not claim human approval. Record acceptance, reaffirmation, or retirement only when authorized by the user or a cited team review, with the actual reviewer and reason. Never infer approval from unchanged code. Review and commit the local record through the normal project workflow.
+- Use \`mason status\` or \`mason_automation(action: "status")\` to inspect configuration and observed use. Lifecycle hooks check decision anchors and surface guidance; changed anchors request inspection and do not prove the rationale obsolete.
+- Audits and repair verification are explicit workflows. Run \`mason audit --help\` or \`mason check\` when that work is requested; setup does not perform an audit or prepare repairs.
 
 Inspect source for what the retrieved context does not answer.
 <!-- mason:end -->`;
     ASSISTANT_SETUP = `UNIFIED SETUP
-When the user requests Mason setup, call mason_init again with mode: "setup" and host: "codex" or "claude" for the assistant being configured. This uses the same engine as mason setup: retain the initial audit before instruction edits, use the installed mason command on PATH, merge project MCP configuration and hooks, update marker-delimited instructions and Git ignore rules, and record setup. A concept map is optional.
+When the user requests Mason setup, call mason_init again with mode: "setup" and host: "codex" or "claude" for the assistant being configured. Default setup validates existing shared configuration and writes local activation state only. To explicitly prepare or update shared configuration for review and commit, use mode: "init" (CLI: mason init); dryRun: true previews without writes. Initialization does not activate the checkout. This uses the same engine as mason init: use the installed mason command on PATH, merge project MCP configuration and hooks, update marker-delimited instructions and Git ignore rules, and record setup. A concept map is optional.
 If the user only requested inspection or review, report findings without running setup. The setup result distinguishes configured from observed activation. Explain the host's native trust step and request a new session; never trust hooks on the user's behalf or claim activation from generated configuration alone. After a normal task finishes, mason_automation(action: "status") or mason status reports observed context use and hook events. Existing findings remain reviewable; setup does not approve advisories or manufacture decisions.
 
 The managed project guidance is:
@@ -6486,45 +6732,13 @@ ${CLAUDE_MD_SECTION}`;
     QUICKSTART_PLAYBOOK = `Start with the audit and review results included in this response. No concept map is required.
 
 1. Explain the actionable findings with their source evidence. Separate audit issues, advisories, and skipped checks. The review covers committed changes from the merge base to HEAD; workingTree paths are not included in that review. An unavailable or empty check is not proof that the project is correct. Use the CLI for full output if a summary is truncated.
-2. Address findings within the user's requested scope. Setup alone authorizes Mason host configuration, hooks, instructions, and ignore rules; rewriting existing project claims requires repair scope. If repair is authorized, call \`mason_repair(dir, action: "prepare")\` before editing; it saves the full original findings even when this summary is truncated. Inspect relevant source, make grounded edits, then call \`mason_repair(dir, action: "verify", baselinePath)\` with that same baseline, including after any final doc commit. Report resolved, unresolved, review-required, unverified, and new findings. Keep suppressed advisories visible even when setup has already dirtied a doc. Do not invent a decision just to populate the store.
+2. Address findings within the user's requested scope. Initialization prepares shared configuration; setup only activates existing configuration locally; rewriting existing project claims requires repair scope. If repair is authorized, run \`mason audit --prepare-repair --json\` before editing; it saves the full original findings even when this summary is truncated. Inspect relevant source, make grounded edits, then run \`mason audit --verify-repair <baselinePath> --json\` with that same baseline, including after any final doc commit. Report resolved, unresolved, review-required, unverified, and new findings. Keep suppressed advisories visible even when initialization has already edited an instruction file. Do not invent a decision just to populate the store.
 3. Capture a supported lesson as soon as it is established; do not wait for implementation, task completion, or merge. Keep unimplemented remedies tentative. When the task reveals a real lesson or constraint, compare matching \`get_context\` records first. If its assumptions, scope, or recommended action changed, revise that record using \`save_decision(id: existingId)\`; create a separate record for a genuinely distinct lesson and skip unchanged restatements. Include title, body, category, anchors, and known owner/source/actor information. Preserve supported rationale and sources, replace obsolete instructions, and add new evidence. Missing attribution can be added later. The tool writes a local proposal; editing it preserves revision history and requires a new acceptance, while any earlier accepted revision remains operative. An unchanged save never refreshes its evidence. When decision review is requested, \`review_decision\` prepares the record and code evidence before any authorized verdict. Review and commit records through the normal workflow. Retrieve it on the next relevant task with \`get_context(dir, task, files)\`.
 
 ${ASSISTANT_SETUP}
 
 OPTIONAL ARCHITECTURE MAP
-A full map adds feature and flow navigation. Build it only if the user requests it, by calling \`mason_init(dir, mode: "map")\`. Decision capture and task context do not depend on that build.`;
-    MAP_PLAYBOOK = `The user has requested a full architecture map. Follow this Map-Reduce workflow to cover the codebase. Report the audit and review findings included in this response before beginning.
-
-PHASE 1 \u2014 Map (loop until done)
-Goal: process every file in the codebase, batch by batch, producing a partial concept map per batch.
-
-  1. Call \`generate_snapshot_batch(dir)\` (omit offset on the first call).
-     The response includes:
-     - \`batchId\`: identifier for this batch
-     - \`offset\`, \`nextOffset\`, \`totalFiles\`: progress markers
-     - \`instructions\`: the system prompt for the batch step
-     - \`prompt\`: the files in this batch (skeletons + a few deeper bodies)
-  2. Following the \`instructions\`, derive features and flows that involve ONLY the files in this batch. Use product-natural feature names ("home screen", not "HomeScreenAndroid") so the reduce step can merge platform variants.
-  3. Call \`save_partial_snapshot(dir, batchId, offset, features, flows)\` to persist the partial.
-  4. If \`nextOffset\` is null, the Map phase is done. Otherwise call \`generate_snapshot_batch(dir, offset=nextOffset)\` and repeat from step 2.
-
-  Briefly tell the user "Batch N of M done" each iteration so they see progress.
-
-  CRITICAL RULES FOR PHASE 1:
-  - Derive features and file paths ONLY from what appears verbatim in the \`prompt\` field of each batch response. NEVER invent paths from memory, prior projects, or what you assume a project of this kind would contain. If you have not seen a path in a batch \`prompt\`, do not put it in \`features.files\` or \`flows.chain\`.
-  - Process batches SEQUENTIALLY: one \`generate_snapshot_batch\` \u2192 derive \u2192 one \`save_partial_snapshot\` \u2192 next \`generate_snapshot_batch\`. Do not parallelise. Do not call \`save_snapshot\` during this phase \u2014 that is a Phase 2 step.
-  - You must walk every batch until \`nextOffset\` is null. Do not stop early. Do not skip ahead to reduce until every batch has been saved as a partial.
-
-PHASE 2 \u2014 Reduce (once)
-Goal: merge all partial maps into one coherent product-shaped catalog.
-
-  1. Call \`reduce_snapshot(dir)\`. It returns every partial map plus reconciliation instructions.
-  2. Follow the instructions to produce a unified \`features\` and \`flows\` map. Specifically: merge platform variants ("home Android" + "home iOS" \u2192 "home screen"), dedupe near-duplicates, reconcile descriptions, and ensure every file from every partial appears somewhere in the final map.
-  3. Call \`save_snapshot(dir, features, flows)\` ONCE with the unified map. Mason detects that partials exist and replaces the snapshot wholesale (rather than merging with any earlier state) and then clears the partials. Do not call \`save_snapshot\` more than once per Map-Reduce run.
-
-${ASSISTANT_SETUP}
-
-If a build is interrupted, its partials remain in \`.mason/partial-snapshots/\`. Re-run \`mason_init(dir, mode: "map")\` to obtain this workflow again.`;
+Existing maps remain readable for legacy projects. Managed map creation has been removed; use the agent's own source tools for architecture investigations.`;
   }
 });
 
@@ -6534,13 +6748,14 @@ __export(config_exports, {
   ancillaryEdits: () => ancillaryEdits,
   hookEdits: () => hookEdits,
   inspectHostConfig: () => inspectHostConfig,
+  inspectIntegration: () => inspectIntegration,
   instructionEdits: () => instructionEdits,
   mcpEdit: () => mcpEdit,
   mcpPath: () => mcpPath
 });
 import { isDeepStrictEqual } from "util";
 import { parse as parse2, stringify } from "smol-toml";
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 async function instructionEdits(root, host) {
   const found = await Promise.all(
     DOC_CANDIDATES.map(async (file) => ({ path: file, text: await readText(root, file) }))
@@ -6621,7 +6836,7 @@ async function mcpEdit(root, host) {
   if (servers?.mason && !managed) {
     const headers = [...base.matchAll(/^\s*\[\[?.+?\]\]?[^\S\r\n]*(?:#.*)?$/gm)];
     const spans = headers.flatMap(
-      (header, index2) => /^\s*\[mcp_servers\.mason(?:\.[A-Za-z0-9_-]+)*\]/.test(header[0]) ? [{ start: header.index, end: headers[index2 + 1]?.index ?? base.length }] : []
+      (header, index) => /^\s*\[mcp_servers\.mason(?:\.[A-Za-z0-9_-]+)*\]/.test(header[0]) ? [{ start: header.index, end: headers[index + 1]?.index ?? base.length }] : []
     );
     if (!spans.length)
       throw new Error(
@@ -6702,6 +6917,44 @@ async function inspectHostConfig(root, host, plannedMcp) {
     disabled: hooks.disableAllHooks === true || config.features?.hooks === false || config.features?.codex_hooks === false
   };
 }
+async function inspectIntegration(root, host) {
+  const config = await inspectHostConfig(root, host);
+  const instructions = await instructionEdits(root, host);
+  const primary = instructions[0]?.before ?? "";
+  const { blockSpan: blockSpan2 } = await Promise.resolve().then(() => (init_ownership(), ownership_exports));
+  const block = blockSpan2(primary, "<!-- mason:start -->", "<!-- mason:end -->");
+  const instructionCompatible = !!block && ["get_context", "save_decision", "review_decision"].every(
+    (tool) => block.text.includes(tool)
+  ) && instructions.slice(1).every((edit) => {
+    const imported = edit.path.startsWith(".claude/") ? "@../AGENTS.md" : "@AGENTS.md";
+    return (edit.before ?? "").split(/\r?\n/).some((line) => line.trim() === imported);
+  });
+  const expectedHooks = hookConfig(host, hookCommand(host)).hooks;
+  const normalizedHooks = Object.fromEntries(
+    Object.entries(config.hooks).map(([event, groups]) => [
+      event,
+      groups.map((group) => ({
+        ...group,
+        hooks: group.hooks.map((handler) => ({
+          ...handler,
+          command: expectedHooks.SessionStart[0].hooks[0].command
+        }))
+      }))
+    ])
+  );
+  const mcpCompatible = isDeepStrictEqual({ command: config.mcp?.command, args: config.mcp?.args }, mcpCommand(host)) && (config.mcp?.type === void 0 || config.mcp.type === "stdio");
+  const hooksCompatible = isDeepStrictEqual(normalizedHooks, expectedHooks);
+  return {
+    ...config,
+    instructions,
+    instructionCompatible,
+    instructionsCurrent: instructions.every((edit) => edit.before === edit.after),
+    mcpCompatible,
+    hooksCompatible,
+    hooksCurrent: isDeepStrictEqual(config.hooks, expectedHooks),
+    compatible: instructionCompatible && mcpCompatible && hooksCompatible
+  };
+}
 var object, mcpPath, TOML_START, TOML_END, POINTER_START, POINTER_END;
 var init_config2 = __esm({
   "src/setup/config.ts"() {
@@ -6712,7 +6965,7 @@ var init_config2 = __esm({
     init_install();
     init_files2();
     init_launcher();
-    object = z23.record(z23.unknown());
+    object = z24.record(z24.unknown());
     mcpPath = (host) => host === "codex" ? ".codex/config.toml" : ".mcp.json";
     TOML_START = "# mason:mcp:start";
     TOML_END = "# mason:mcp:end";
@@ -6732,7 +6985,7 @@ __export(install_exports, {
   planAutomationInstall: () => planAutomationInstall,
   recordSchema: () => recordSchema2
 });
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 async function installationRecord(root) {
   return recordSchema2.parse(
     await readStoreJson(root, AUTOMATION_PATH) ?? { version: 1, hosts: {} }
@@ -6833,13 +7086,13 @@ var init_install = __esm({
     init_store();
     init_files2();
     init_ownership();
-    groupSchema = z24.object({
-      hooks: z24.array(z24.object({ type: z24.string(), command: z24.string().optional() }).passthrough())
+    groupSchema = z25.object({
+      hooks: z25.array(z25.object({ type: z25.string(), command: z25.string().optional() }).passthrough())
     }).passthrough();
-    automationConfigSchema = z24.object({ hooks: z24.record(z24.array(groupSchema)).optional() }).passthrough();
-    recordSchema2 = z24.object({
-      version: z24.literal(1),
-      hosts: z24.record(z24.object({ command: z24.string() }))
+    automationConfigSchema = z25.object({ hooks: z25.record(z25.array(groupSchema)).optional() }).passthrough();
+    recordSchema2 = z25.object({
+      version: z25.literal(1),
+      hosts: z25.record(z25.object({ command: z25.string() }))
     });
     AUTOMATION_PATH = ".mason/local/automation.json";
     configPath3 = (host) => host === "claude" ? ".claude/settings.json" : ".codex/hooks.json";
@@ -6853,12 +7106,12 @@ __export(teardown_exports, {
   teardownProject: () => teardownProject
 });
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
-import fs22 from "fs/promises";
-import path26 from "path";
+import fs23 from "fs/promises";
+import path25 from "path";
 import { parse as parse3, stringify as stringify2 } from "smol-toml";
 import fg8 from "fast-glob";
-import { z as z25 } from "zod";
-async function planTeardown(root, selected) {
+import { z as z26 } from "zod";
+async function planProjectTeardown(root, selected) {
   const edits = [], diagnostics = [];
   const inputs = /* @__PURE__ */ new Map();
   const read = async (file) => {
@@ -6879,8 +7132,8 @@ async function planTeardown(root, selected) {
   const ownership = ownershipBefore === null ? { version: 1, files: {} } : ownershipSchema.parse(JSON.parse(ownershipBefore));
   const setupBefore = await read(SETUP_PATH);
   const setup = setupBefore === null ? null : setupSchema.parse(JSON.parse(setupBefore));
-  const linked = (await workspace(root)).gitDir !== await fs22.realpath(
-    path26.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim())
+  const linked = (await workspace(root)).gitDir !== await fs23.realpath(
+    path25.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim())
   );
   const inactiveBefore = linked && !setup ? await read(INACTIVE_HOSTS_PATH) : null;
   const inactive = inactiveBefore === null ? { version: 1, hosts: [] } : inactiveHostsSchema.parse(JSON.parse(inactiveBefore));
@@ -7059,7 +7312,7 @@ async function planTeardown(root, selected) {
       await attempt(".mason/local/project.json", async () => {
         const before = await read(".mason/local/project.json");
         if (before === null) return;
-        z25.object({ version: z25.literal(1), initializedAt: z25.string() }).strict().parse(JSON.parse(before));
+        z26.object({ version: z26.literal(1), initializedAt: z26.string() }).strict().parse(JSON.parse(before));
         cleanup.push({ path: ".mason/local/project.json", before, after: null });
       });
     if (!diagnostics.length) {
@@ -7104,11 +7357,60 @@ async function planTeardown(root, selected) {
     inputs
   };
 }
+async function planLocalTeardown(root, selected) {
+  const inputs = /* @__PURE__ */ new Map();
+  const read = async (file) => {
+    const value = await readText(root, file);
+    inputs.set(file, value);
+    return value;
+  };
+  const edits = [];
+  const setupBefore = await read(SETUP_PATH);
+  const setup = setupBefore === null ? null : setupSchema.parse(JSON.parse(setupBefore));
+  const automationBefore = await read(AUTOMATION_PATH);
+  const automation = automationBefore === null ? null : recordSchema2.parse(JSON.parse(automationBefore));
+  for (const host of selected) {
+    if (setup) delete setup.hosts[host];
+    if (automation) delete automation.hosts[host];
+  }
+  if (setup) edits.push({ path: SETUP_PATH, before: setupBefore, after: json(setup) });
+  if (automation)
+    edits.push({ path: AUTOMATION_PATH, before: automationBefore, after: json(automation) });
+  const linked = (await workspace(root)).gitDir !== await fs23.realpath(
+    path25.resolve(root, (await git3(root, "rev-parse", "--git-common-dir")).trim())
+  );
+  if (linked && !setup) {
+    const before = await read(INACTIVE_HOSTS_PATH);
+    const inactive = before === null ? { version: 1, hosts: [] } : inactiveHostsSchema.parse(JSON.parse(before));
+    edits.push({
+      path: INACTIVE_HOSTS_PATH,
+      before,
+      after: json({ version: 1, hosts: [.../* @__PURE__ */ new Set([...inactive.hosts, ...selected])].sort() })
+    });
+  }
+  const receipts = await fg8(
+    selected.map((host) => ".mason/reports/automation/*/setup-" + host + ".json"),
+    { cwd: root, dot: true, onlyFiles: false, followSymbolicLinks: false }
+  );
+  if (receipts.length > 1e3)
+    throw new Error("Too many setup receipts; inspect local setup history before teardown.");
+  for (const file of receipts) {
+    const host = file.endsWith("setup-codex.json") ? "codex" : "claude";
+    await loadSetupReceipt(root, file.slice(0, file.lastIndexOf("/")), host);
+    edits.push({ path: file, before: await read(file), after: null });
+  }
+  return {
+    edits: edits.filter((edit) => edit.before !== edit.after),
+    inputs,
+    diagnostics: [],
+    remainingHost: true
+  };
+}
 async function teardownProject(dir, options = {}) {
   const { root } = await workspace(dir);
   const selected = options.host ? [options.host] : [...hosts];
   const run = async (apply) => {
-    const plan = await planTeardown(root, selected);
+    const plan = options.project ? await planProjectTeardown(root, selected) : await planLocalTeardown(root, selected);
     if (apply) {
       for (const [file, before] of plan.inputs)
         if (await readText(root, file) !== before)
@@ -7118,6 +7420,7 @@ async function teardownProject(dir, options = {}) {
     return {
       version: 1,
       action: "teardown",
+      scope: options.project ? "project" : "local",
       status: plan.diagnostics.length ? "incomplete" : "complete",
       root,
       hosts: selected,
@@ -7128,23 +7431,32 @@ async function teardownProject(dir, options = {}) {
       })),
       diagnostics: plan.diagnostics,
       sharedInstructionsRetained: plan.remainingHost || !!plan.diagnostics.length,
-      next: plan.diagnostics.length ? "Inspect the retained entries, remove or correct them, then rerun teardown." : "Restart running assistants to unload the project integration. Run mason setup --host codex or --host claude to reconnect."
+      next: plan.diagnostics.length ? "Inspect the retained entries, remove or correct them, then rerun teardown." : options.project ? "Review and commit shared removals. Run mason init to restore shared configuration." : "Restart running assistants to unload the local integration. Shared configuration is retained; run mason setup to reconnect."
     };
   };
   const preview = await run(false);
   if (options.dryRun || !preview.changes.length) return preview;
+  if ((await git3(
+    root,
+    "ls-files",
+    "--",
+    ".mason/local",
+    ".mason/reports/setup-lock",
+    ...preview.changes.filter((change) => change.path.startsWith(".mason/reports/")).map((change) => change.path)
+  )).trim())
+    throw new Error("Mason local state must be untracked before teardown.");
   return withLock(root, ".mason/reports/setup-lock", () => run(true));
 }
 function summarizeTeardown(result) {
   return [
-    `Mason teardown${result.dryRun ? " preview" : ""}: ${result.status}.`,
+    `Mason ${result.scope} teardown${result.dryRun ? " preview" : ""}: ${result.status}.`,
     ...result.changes.map(
       (change) => `  ${result.dryRun ? "Would " : ""}${change.action}: ${change.path}`
     ),
     ...result.diagnostics.map((item) => `  Retained ${item.path}: ${item.message}`),
     ...!result.changes.length ? ["No changes."] : [],
     "Shared knowledge, repair evidence, ignore rules and the installed Mason command are retained.",
-    ...result.sharedInstructionsRetained ? [
+    ...result.scope === "project" && result.sharedInstructionsRetained ? [
       "Shared instruction cleanup is deferred while another host or incomplete removal needs inspection."
     ] : [],
     ...result.dryRun ? ["Preview only; no files were changed."] : [result.next]
@@ -7166,1043 +7478,17 @@ var init_teardown = __esm({
     init_model();
     init_ownership();
     hosts = ["codex", "claude"];
-    object2 = z25.record(z25.unknown());
+    object2 = z26.record(z26.unknown());
     json = (value) => JSON.stringify(value, null, 2) + "\n";
   }
 });
 
-// src/review/cochange.ts
-import { execFile as execFile3 } from "child_process";
-import { promisify as promisify3 } from "util";
-async function buildMatrix(resolvedRoot) {
-  try {
-    const { stdout: shallow } = await exec("git", ["rev-parse", "--is-shallow-repository"], {
-      cwd: resolvedRoot
-    });
-    if (shallow.trim() === "true") return null;
-    const { stdout } = await exec(
-      "git",
-      ["log", `-n${HISTORY_COMMITS}`, "--format=%x01", "--name-only", "-M"],
-      { cwd: resolvedRoot, maxBuffer: 100 * 1024 * 1024 }
-    );
-    const commitsByFile = /* @__PURE__ */ new Map();
-    const blocks = stdout.split("
");
-    let index2 = 0;
-    for (const block of blocks) {
-      const files = block.split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith(".mason/"));
-      if (files.length === 0 || files.length > MAX_COMMIT_FILES) continue;
-      for (const file of files) {
-        let set = commitsByFile.get(file);
-        if (!set) {
-          set = /* @__PURE__ */ new Set();
-          commitsByFile.set(file, set);
-        }
-        set.add(index2);
-      }
-      index2++;
-    }
-    return { commitsByFile, totalCommits: index2 };
-  } catch {
-    return null;
-  }
-}
-async function findMissingPartners(resolvedRoot, changedFiles, existsOnDisk, allChangedFiles = changedFiles) {
-  const matrix = await buildMatrix(resolvedRoot);
-  if (!matrix) return null;
-  const changedSet = new Set(allChangedFiles);
-  const findings = [];
-  for (const changedFile of changedFiles) {
-    const fileCommits = matrix.commitsByFile.get(changedFile);
-    if (!fileCommits || fileCommits.size < MIN_FILE_COMMITS) continue;
-    for (const [partner, partnerCommits] of matrix.commitsByFile) {
-      if (partner === changedFile || changedSet.has(partner)) continue;
-      let shared = 0;
-      for (const c of fileCommits) {
-        if (partnerCommits.has(c)) shared++;
-      }
-      if (shared < MIN_SHARED_COMMITS) continue;
-      const rate = shared / fileCommits.size;
-      if (rate < MIN_COCHANGE_RATE) continue;
-      if (!await existsOnDisk(partner)) continue;
-      findings.push({
-        changedFile,
-        missingPartner: partner,
-        sharedCommits: shared,
-        fileCommits: fileCommits.size,
-        rate: Math.round(rate * 100) / 100
-      });
-    }
-  }
-  findings.sort((a, b) => b.rate - a.rate || b.sharedCommits - a.sharedCommits);
-  return findings;
-}
-var exec, HISTORY_COMMITS, MIN_FILE_COMMITS, MIN_SHARED_COMMITS, MIN_COCHANGE_RATE, MAX_COMMIT_FILES;
-var init_cochange = __esm({
-  "src/review/cochange.ts"() {
-    "use strict";
-    exec = promisify3(execFile3);
-    HISTORY_COMMITS = 1500;
-    MIN_FILE_COMMITS = 5;
-    MIN_SHARED_COMMITS = 4;
-    MIN_COCHANGE_RATE = 0.6;
-    MAX_COMMIT_FILES = 30;
-  }
-});
-
-// src/review/evidence/paths.ts
-function evidencePath(value, sourceRoot, uri = false) {
-  if (value.length > 4e3) return null;
-  let file = value;
-  try {
-    if (uri) {
-      if (file.startsWith("file:")) {
-        const url = new URL(file);
-        if (url.hostname && url.hostname !== "localhost") return null;
-        file = decodeURIComponent(url.pathname).replace(/^\/([A-Za-z]:\/)/, "$1");
-      } else {
-        if (/^[a-z][a-z0-9+.-]*:/i.test(file)) return null;
-        file = decodeURIComponent(file);
-      }
-    }
-  } catch {
-    return null;
-  }
-  file = file.replace(/\\/g, "/");
-  const root = sourceRoot.replace(/\\/g, "/").replace(/\/+$/, "");
-  if (file.startsWith("/") || /^[A-Za-z]:/.test(file)) {
-    if (!file.startsWith(root + "/")) return null;
-    file = file.slice(root.length + 1);
-  }
-  return normalizeRepoPath(file);
-}
-var init_paths2 = __esm({
-  "src/review/evidence/paths.ts"() {
-    "use strict";
-    init_paths();
-  }
-});
-
-// src/review/evidence/types.ts
-function messagePreview(message2) {
-  return { message: message2.slice(0, 4e3), ...message2.length > 4e3 ? { truncated: true } : {} };
-}
-var MAX_FINDINGS;
-var init_types2 = __esm({
-  "src/review/evidence/types.ts"() {
-    "use strict";
-    MAX_FINDINGS = 200;
-  }
-});
-
-// src/review/evidence/vitest.ts
-import { z as z26 } from "zod";
-function parseVitest(raw, sourceRoot) {
-  const report = schema.parse(raw);
-  const findings = [], diagnostics = [];
-  let passed = 0, failed = 0, skipped = 0;
-  for (const [index2, suite] of report.testResults.entries()) {
-    const file = evidencePath(suite.name, sourceRoot);
-    if (!file)
-      diagnostics.push(`Test path is outside the declared checkout or invalid: ${suite.name}`);
-    let suiteFailures = 0;
-    for (const [testIndex, test] of suite.assertionResults.entries()) {
-      if (test.status === "passed") passed++;
-      else if (test.status === "failed") {
-        failed++;
-        suiteFailures++;
-        findings.push({
-          id: `${index2}:${testIndex}`,
-          ...messagePreview([test.fullName, ...test.failureMessages ?? []].join("\n")),
-          severity: "error",
-          state: "active",
-          locations: file ? [
-            {
-              file,
-              ...test.location ? { line: test.location.line, column: test.location.column } : {}
-            }
-          ] : []
-        });
-      } else skipped++;
-    }
-    if (suite.status === "failed" && !suiteFailures) {
-      findings.push({
-        id: `${index2}:suite`,
-        ...messagePreview(suite.message || `Test suite failed: ${suite.name}`),
-        severity: "error",
-        state: "active",
-        locations: file ? [{ file }] : []
-      });
-    }
-  }
-  if (passed !== report.numPassedTests || failed !== report.numFailedTests || skipped !== report.numPendingTests + report.numTodoTests || passed + failed + skipped !== report.numTotalTests) {
-    throw new Error("Vitest summary counts disagree with its assertion results");
-  }
-  const hasFailures = failed > 0 || report.numFailedTestSuites > 0 || report.testResults.some((s) => s.status === "failed");
-  if (report.success && hasFailures)
-    throw new Error("Vitest success conflicts with failed tests or suites");
-  const outcome = hasFailures || !report.success ? "failed" : !report.numTotalTests ? "unavailable" : !passed ? "skipped" : "passed";
-  if (!report.numTotalTests)
-    diagnostics.push("No tests executed; an empty report is not passing test evidence.");
-  if (skipped) diagnostics.push(`${skipped} tests were skipped, pending, disabled, or todo.`);
-  return {
-    outcome,
-    findings,
-    counts: {
-      total: report.numTotalTests,
-      passed,
-      failed,
-      skipped,
-      failedSuites: report.numFailedTestSuites
-    },
-    incomplete: skipped > 0 || diagnostics.length > 0,
-    diagnostics
-  };
-}
-var count3, schema;
-var init_vitest = __esm({
-  "src/review/evidence/vitest.ts"() {
-    "use strict";
-    init_paths2();
-    init_types2();
-    count3 = z26.number().int().nonnegative();
-    schema = z26.object({
-      success: z26.boolean(),
-      numTotalTests: count3,
-      numPassedTests: count3,
-      numFailedTests: count3,
-      numPendingTests: count3,
-      numTodoTests: count3,
-      numFailedTestSuites: count3,
-      testResults: z26.array(
-        z26.object({
-          name: z26.string().min(1),
-          status: z26.enum(["passed", "failed"]),
-          message: z26.string().optional(),
-          assertionResults: z26.array(
-            z26.object({
-              fullName: z26.string(),
-              status: z26.enum(["passed", "failed", "pending", "skipped", "todo", "disabled"]),
-              failureMessages: z26.array(z26.string()).nullable().optional(),
-              location: z26.object({ line: count3, column: count3 }).nullable().optional()
-            })
-          )
-        })
-      )
-    });
-  }
-});
-
-// src/review/evidence/sarif.ts
-import { z as z27 } from "zod";
-function parseSarif(raw, sourceRoot) {
-  const report = schema2.parse(raw), findings = [], diagnostics = [];
-  let active = 0, suppressed = 0, absent = 0, unresolved = 0;
-  let executed = report.runs.length > 0, executionFailed = false;
-  const reportedCommits = [], reportedCommands = [], reportedTools = [];
-  for (const [runIndex, run] of report.runs.entries()) {
-    reportedTools.push(run.tool.driver.name);
-    reportedCommits.push(
-      ...(run.versionControlProvenance ?? []).flatMap((v) => v.revisionId ? [v.revisionId] : [])
-    );
-    if (!run.invocations?.length) executed = false;
-    for (const invocation of run.invocations ?? []) {
-      if (invocation.commandLine) reportedCommands.push(invocation.commandLine);
-      if (!invocation.executionSuccessful) executionFailed = true;
-      for (const notification of invocation.toolExecutionNotifications ?? []) {
-        diagnostics.push(
-          notification.message.text ?? notification.message.markdown ?? "SARIF tool execution notification"
-        );
-        if (notification.level === "error") executionFailed = true;
-      }
-    }
-    if (!run.results) {
-      diagnostics.push(`Run ${runIndex} omits results; analysis output is unavailable.`);
-      executed = false;
-    }
-    const resolve = (ref, seen = /* @__PURE__ */ new Set()) => {
-      if (!ref.uri && ref.index !== void 0) {
-        const key = `artifact:${ref.index}`;
-        if (seen.has(key)) return null;
-        const entry = run.artifacts?.[ref.index]?.location;
-        return entry ? resolve(entry, /* @__PURE__ */ new Set([...seen, key])) : null;
-      }
-      if (!ref.uri) return null;
-      if (!ref.uriBaseId) return ref.uri;
-      if (seen.has(ref.uriBaseId)) return null;
-      const base = run.originalUriBaseIds?.[ref.uriBaseId];
-      if (!base) return null;
-      const prefix = resolve(base, /* @__PURE__ */ new Set([...seen, ref.uriBaseId]));
-      if (!prefix) return null;
-      return /^[a-z][a-z0-9+.-]*:/i.test(ref.uri) ? ref.uri : prefix + ref.uri;
-    };
-    for (const [resultIndex, result] of (run.results ?? []).entries()) {
-      const kind = result.kind ?? "fail";
-      const isSuppressed = result.suppressions?.some((s) => s.status === "accepted");
-      if (result.suppressions?.some((s) => !s.status || s.status === "underReview")) {
-        diagnostics.push(`Suppression state unresolved for result ${runIndex}:${resultIndex}.`);
-        unresolved++;
-      }
-      const state = result.baselineState === "absent" ? "absent" : isSuppressed ? "suppressed" : kind === "fail" ? "active" : "informational";
-      if (state === "active") active++;
-      if (state === "absent") absent++;
-      if (state === "suppressed") suppressed++;
-      if (["open", "review"].includes(kind) && state === "informational") {
-        unresolved++;
-        diagnostics.push(`Result ${runIndex}:${resultIndex} needs further analysis or review.`);
-      }
-      if (kind === "pass" || kind === "notApplicable") continue;
-      const rule = result.ruleIndex !== void 0 ? run.tool.driver.rules?.[result.ruleIndex] : run.tool.driver.rules?.find((rule2) => rule2.id === result.ruleId);
-      const template = result.message.id ? rule?.messageStrings?.[result.message.id] ?? run.tool.driver.globalMessageStrings?.[result.message.id] : void 0;
-      const rawMessage = result.message.text ?? result.message.markdown ?? template?.text ?? template?.markdown;
-      if (!rawMessage)
-        diagnostics.push(`Message cannot be resolved for result ${runIndex}:${resultIndex}.`);
-      const rendered = (rawMessage ?? `Unresolved SARIF message ${result.message.id ?? ""}`).replace(/\{(\d+)\}/g, (match, n) => result.message.arguments?.[Number(n)] ?? match);
-      const locations = [];
-      for (const entry of [...result.locations ?? [], ...result.relatedLocations ?? []]) {
-        const ref = entry.physicalLocation?.artifactLocation;
-        const uri = ref ? resolve(ref) : null;
-        const file = uri ? evidencePath(uri, sourceRoot, true) : null;
-        if (file)
-          locations.push({
-            file,
-            line: entry.physicalLocation?.region?.startLine,
-            column: entry.physicalLocation?.region?.startColumn
-          });
-        else
-          diagnostics.push(
-            `Unresolved or out-of-checkout location for result ${runIndex}:${resultIndex}.`
-          );
-      }
-      const severity = result.level ?? rule?.defaultConfiguration?.level ?? (kind === "fail" ? "warning" : "none");
-      findings.push({
-        id: `${runIndex}:${resultIndex}`,
-        ruleId: result.ruleId ?? rule?.id,
-        ...messagePreview(rendered),
-        severity: severity === "none" ? "note" : severity,
-        state,
-        locations
-      });
-    }
-  }
-  if (!report.runs.length) diagnostics.push("SARIF contains no analysis runs.");
-  if (executionFailed)
-    diagnostics.push("The SARIF tool reported an unsuccessful analysis invocation.");
-  return {
-    outcome: executionFailed || !report.runs.length || report.runs.some((r) => !r.results) ? "unavailable" : active ? "failed" : "passed",
-    findings,
-    counts: { active, suppressed, absent, unresolved },
-    incomplete: diagnostics.length > 0,
-    diagnostics,
-    reportedCommits,
-    reportedCommands,
-    reportedTools,
-    executed: executed && !executionFailed
-  };
-}
-var index, artifact, message, level, location, schema2;
-var init_sarif = __esm({
-  "src/review/evidence/sarif.ts"() {
-    "use strict";
-    init_paths2();
-    init_types2();
-    index = z27.number().int().nonnegative();
-    artifact = z27.object({
-      uri: z27.string().optional(),
-      uriBaseId: z27.string().optional(),
-      index: index.optional()
-    });
-    message = z27.object({
-      text: z27.string().optional(),
-      markdown: z27.string().optional(),
-      id: z27.string().optional(),
-      arguments: z27.array(z27.string()).optional()
-    });
-    level = z27.enum(["error", "warning", "note", "none"]);
-    location = z27.object({
-      physicalLocation: z27.object({
-        artifactLocation: artifact.optional(),
-        region: z27.object({ startLine: index.optional(), startColumn: index.optional() }).optional()
-      }).optional()
-    });
-    schema2 = z27.object({
-      version: z27.literal("2.1.0"),
-      runs: z27.array(
-        z27.object({
-          tool: z27.object({
-            driver: z27.object({
-              name: z27.string().min(1),
-              rules: z27.array(
-                z27.object({
-                  id: z27.string(),
-                  defaultConfiguration: z27.object({ level: level.optional() }).optional(),
-                  messageStrings: z27.record(message).optional()
-                })
-              ).optional(),
-              globalMessageStrings: z27.record(message).optional()
-            })
-          }),
-          invocations: z27.array(
-            z27.object({
-              executionSuccessful: z27.boolean(),
-              commandLine: z27.string().optional(),
-              toolExecutionNotifications: z27.array(z27.object({ level: level.optional(), message })).optional()
-            })
-          ).optional(),
-          versionControlProvenance: z27.array(z27.object({ revisionId: z27.string().optional() })).optional(),
-          originalUriBaseIds: z27.record(artifact).optional(),
-          artifacts: z27.array(z27.object({ location: artifact.optional() })).optional(),
-          results: z27.array(
-            z27.object({
-              ruleId: z27.string().optional(),
-              ruleIndex: index.optional(),
-              message,
-              level: level.optional(),
-              kind: z27.enum(["fail", "pass", "open", "informational", "notApplicable", "review"]).optional(),
-              baselineState: z27.enum(["new", "unchanged", "updated", "absent"]).optional(),
-              suppressions: z27.array(
-                z27.object({
-                  kind: z27.enum(["inSource", "external"]),
-                  status: z27.enum(["accepted", "underReview", "rejected"]).optional()
-                })
-              ).nullable().optional(),
-              locations: z27.array(location).optional(),
-              relatedLocations: z27.array(location).optional()
-            })
-          ).optional()
-        })
-      )
-    });
-  }
-});
-
-// src/review/evidence/check.ts
-import { z as z28 } from "zod";
-function parseCheck(raw, sourceRoot) {
-  const report = schema3.parse(raw);
-  const diagnostics = [], findings = [];
-  const counts = { total: report.results.length, passed: 0, failed: 0, skipped: 0 };
-  for (const [index2, result] of report.results.entries()) {
-    counts[result.status]++;
-    const locations = result.locations.flatMap((location2) => {
-      const file = evidencePath(location2.file, sourceRoot);
-      if (!file) {
-        diagnostics.push(
-          `Check location is outside the declared checkout or invalid: ${location2.file}`
-        );
-        return [];
-      }
-      return [{ ...location2, file }];
-    });
-    if (result.status === "failed")
-      findings.push({
-        id: String(index2),
-        ...messagePreview([result.name, result.message].filter(Boolean).join("\n")),
-        severity: "error",
-        state: "active",
-        locations
-      });
-  }
-  if (!counts.total)
-    diagnostics.push("No check results were recorded; an empty report is not passing evidence.");
-  if (counts.skipped)
-    diagnostics.push(`${counts.skipped} checks were skipped; verification is incomplete.`);
-  return {
-    outcome: counts.failed ? "failed" : !counts.total ? "unavailable" : !counts.passed ? "skipped" : "passed",
-    counts,
-    findings,
-    incomplete: diagnostics.length > 0,
-    diagnostics,
-    ...report.commit ? { reportedCommits: [report.commit] } : {}
-  };
-}
-var schema3;
-var init_check = __esm({
-  "src/review/evidence/check.ts"() {
-    "use strict";
-    init_paths2();
-    init_types2();
-    schema3 = z28.object({
-      version: z28.literal(1),
-      commit: z28.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).optional(),
-      results: z28.array(
-        z28.object({
-          name: z28.string().min(1).max(1e3),
-          status: z28.enum(["passed", "failed", "skipped"]),
-          message: z28.string().max(1e5).optional(),
-          locations: z28.array(
-            z28.object({
-              file: z28.string().min(1).max(4e3),
-              line: z28.number().int().positive().optional(),
-              column: z28.number().int().positive().optional()
-            })
-          ).max(100).default([])
-        })
-      ).max(1e5)
-    });
-  }
-});
-
-// src/review/evidence.ts
-import path27 from "path";
-import { z as z29 } from "zod";
-function relativeArtifact(root, file) {
-  const relative = path27.isAbsolute(file) ? path27.relative(root, file) : file;
-  const normalized = normalizeRepoPath(relative);
-  if (!normalized) throw new Error(`Evidence artifact must be inside the repository: ${file}`);
-  return normalized;
-}
-function linkFinding(finding, changed, pairs, decisions, freshness) {
-  const located = [...new Set(finding.locations.map((l) => l.file))];
-  const paired = pairs.filter((pair) => located.includes(pair.test));
-  const relatedChangedFiles = located.filter((file) => changed.has(file)).map((file) => ({ file, relationship: "direct" }));
-  for (const pair of paired) {
-    if (changed.has(pair.source) && !relatedChangedFiles.some((f) => f.file === pair.source))
-      relatedChangedFiles.push({
-        file: pair.source,
-        relationship: "paired-test",
-        confidence: pair.confidence
-      });
-  }
-  const allFiles = [.../* @__PURE__ */ new Set([...located, ...paired.map((pair) => pair.source)])];
-  const acceptedDecisions = decisions.map(effectiveDecision).filter((d) => d.status === "active" && decisionApproval(d) === "accepted").map((d) => ({ d, viaFiles: matchingPaths(d.files, allFiles) })).filter((match) => match.viaFiles.length).map(({ d, viaFiles }) => {
-    const state = freshness[d.id] ?? "unknown", provenance = decisionProvenance(d, state);
-    return {
-      id: d.id,
-      title: d.title,
-      owner: provenance.owner,
-      freshness: state,
-      reviewRequired: provenance.reviewRequired,
-      viaFiles
-    };
-  });
-  return {
-    ...finding,
-    relatedChangedFiles,
-    acceptedDecisions: acceptedDecisions.slice(0, 5),
-    totalAcceptedDecisions: acceptedDecisions.length
-  };
-}
-async function collectReviewEvidence(root, manifests, changedFiles, decisions, decisionFreshness = {}, reviewedHead) {
-  const [headHash, workingTree] = await Promise.all([
-    reviewedHead ?? getCurrentGitHash(root),
-    getWorkingTree(root)
-  ]);
-  const output = {
-    version: 1,
-    scope: "committed",
-    headHash,
-    status: "unavailable",
-    checks: [],
-    diagnostics: [],
-    workingTree,
-    summary: { passed: 0, failed: 0, skipped: 0, unavailable: 0, stale: 0, unknown: 0 },
-    hint: "Evidence describes the recorded check runs for a commit, not uncommitted edits or complete test coverage. Commands and CI provenance are imported assertions, not authenticated execution. File and test-pair associations identify relevant decisions; they do not prove a decision was violated. Missing checks must be declared in the manifest to be reported."
-  };
-  const seen = /* @__PURE__ */ new Set(), changed = new Set(changedFiles);
-  let pairs;
-  if (manifests.length > 10)
-    output.diagnostics.push("Only the first 10 evidence manifests were imported.");
-  for (const supplied of manifests.slice(0, 10)) {
-    let manifest, raw;
-    try {
-      manifest = relativeArtifact(root, supplied);
-      raw = z29.object({ version: z29.literal(1), checks: z29.array(z29.unknown()) }).parse(await readStoreJson(root, manifest));
-    } catch (error) {
-      output.diagnostics.push(`${supplied}: ${String(error)}`);
-      continue;
-    }
-    if (!raw.checks.length) output.diagnostics.push(`${manifest}: no checks declared.`);
-    for (const [index2, item] of raw.checks.entries()) {
-      if (output.checks.length >= 50) {
-        output.diagnostics.push("Only the first 50 checks were imported.");
-        break;
-      }
-      const input = checkSchema2.safeParse(item);
-      if (!input.success) {
-        output.diagnostics.push(`${manifest} check ${index2}: ${input.error.message}`);
-        continue;
-      }
-      const check = input.data;
-      if (seen.has(check.id)) {
-        output.diagnostics.push(
-          `Duplicate check id ${check.id}; give different runs distinct ids.`
-        );
-        continue;
-      }
-      seen.add(check.id);
-      const result = {
-        id: check.id,
-        kind: check.kind,
-        tool: check.tool,
-        command: check.command,
-        commit: check.commit?.toLowerCase() ?? null,
-        workingTreeClean: check.workingTreeClean ?? null,
-        source: check.source ?? null,
-        manifest,
-        report: check.report ?? null,
-        outcome: "unavailable",
-        freshness: "unknown",
-        findings: [],
-        totalFindings: 0,
-        counts: {},
-        incomplete: false,
-        diagnostics: [],
-        truncated: false,
-        ...check.environment ? { environment: check.environment } : {}
-      };
-      output.checks.push(result);
-      if (check.workingTreeClean !== true)
-        result.diagnostics.push(
-          "The check's working tree was dirty or not recorded; its results cannot be attributed to the claimed commit alone."
-        );
-      else if (result.commit && headHash !== "unknown")
-        result.freshness = result.commit === headHash.toLowerCase() ? "current" : "stale";
-      else result.diagnostics.push("The tested commit or reviewed HEAD is unknown.");
-      if (check.status !== "completed") {
-        result.outcome = check.status;
-        result.diagnostics.push(
-          check.reason ?? "No reason was recorded for this skipped or unavailable check."
-        );
-        continue;
-      }
-      try {
-        if (!check.report) throw new Error("Completed check has no report artifact.");
-        if (check.report.format !== "mason-check-json" && check.kind === "tests" !== (check.report.format === "vitest-json"))
-          throw new Error(
-            "Test checks require vitest-json or mason-check-json; analysis checks require sarif or mason-check-json."
-          );
-        const file = relativeArtifact(root, check.report.path);
-        const report = await readStoreJson(root, file);
-        if (report === null) throw new Error(`Report artifact is missing: ${file}`);
-        const sourceRoot = check.sourceRoot ?? root;
-        if (!path27.posix.isAbsolute(sourceRoot) && !/^[A-Za-z]:[\\/]/.test(sourceRoot))
-          throw new Error(
-            "sourceRoot must identify the absolute checkout root on the check runner."
-          );
-        const parsed = check.report.format === "vitest-json" ? parseVitest(report, sourceRoot) : check.report.format === "mason-check-json" ? parseCheck(report, sourceRoot) : parseSarif(report, sourceRoot);
-        result.outcome = parsed.outcome;
-        result.counts = parsed.counts;
-        result.incomplete = parsed.incomplete;
-        result.diagnostics.push(...parsed.diagnostics);
-        result.reportedCommands = parsed.reportedCommands;
-        result.reportedTools = parsed.reportedTools;
-        if (parsed.reportedCommits?.some(
-          (commit) => !result.commit || commit.toLowerCase() !== result.commit
-        )) {
-          result.freshness = "unknown";
-          result.incomplete = true;
-          result.diagnostics.push(
-            "Report revision metadata conflicts with, or cannot be tied to, the manifest's tested commit."
-          );
-        }
-        if (check.exitCode == null && !parsed.executed) {
-          result.incomplete = true;
-          result.diagnostics.push(
-            "Neither an exit code nor successful analysis invocation was recorded; completion cannot be confirmed."
-          );
-        }
-        if (check.exitCode != null && check.exitCode !== 0 && result.outcome === "passed") {
-          result.outcome = "failed";
-          result.diagnostics.push(
-            `Check command exited ${check.exitCode} despite a report with no active failures.`
-          );
-        }
-        if (check.kind === "tests" && pairs === void 0) {
-          try {
-            pairs = (await buildTestMap(root)).paired;
-          } catch (error) {
-            pairs = [];
-            output.diagnostics.push(`Test pairing unavailable: ${String(error)}`);
-          }
-        }
-        result.totalFindings = parsed.findings.length;
-        const testPairs = check.kind === "tests" ? pairs ?? [] : [];
-        const relevant = /* @__PURE__ */ new Set([
-          ...changed,
-          ...testPairs.filter((p) => changed.has(p.source)).map((p) => p.test)
-        ]);
-        const touchesChange = (f) => f.locations.some((l) => relevant.has(l.file));
-        parsed.findings.sort(
-          (a, b) => Number(b.state === "active") - Number(a.state === "active") || Number(touchesChange(b)) - Number(touchesChange(a))
-        );
-        result.findings = parsed.findings.slice(0, MAX_FINDINGS).map((f) => linkFinding(f, changed, testPairs, decisions, decisionFreshness));
-        result.truncated = parsed.findings.length > MAX_FINDINGS || result.findings.some(
-          (f) => f.truncated || f.totalAcceptedDecisions > f.acceptedDecisions.length
-        );
-      } catch (error) {
-        result.outcome = "unavailable";
-        result.incomplete = true;
-        result.diagnostics.push(String(error));
-      }
-    }
-  }
-  if (!output.checks.length) output.diagnostics.push("No readable checks were imported.");
-  for (const check of output.checks) {
-    output.summary[check.outcome]++;
-    if (check.freshness !== "current") output.summary[check.freshness]++;
-  }
-  if (output.checks.some((c) => c.outcome === "failed" && c.freshness === "current"))
-    output.status = "failed";
-  else if (!output.checks.length || output.checks.every((c) => c.outcome === "unavailable"))
-    output.status = "unavailable";
-  else if (output.diagnostics.length || output.checks.some((c) => c.outcome !== "passed" || c.freshness !== "current" || c.incomplete))
-    output.status = "incomplete";
-  else output.status = "passed";
-  return output;
-}
-function summarizeEvidence(evidence) {
-  const previews = (values, limit) => values.slice(0, limit).map((value) => value.slice(0, 2e3));
-  const checks = evidence.checks.slice(0, 10).map((check) => {
-    const findings = check.findings.slice(0, 5).map((finding) => ({
-      ...finding,
-      ruleId: finding.ruleId?.slice(0, 200),
-      locations: finding.locations.slice(0, 5),
-      totalLocations: finding.locations.length,
-      relatedChangedFiles: finding.relatedChangedFiles.slice(0, 5),
-      totalRelatedChangedFiles: finding.relatedChangedFiles.length,
-      acceptedDecisions: finding.acceptedDecisions.map((decision) => ({
-        ...decision,
-        viaFiles: decision.viaFiles.slice(0, 5)
-      })),
-      truncated: finding.truncated || finding.locations.length > 5 || finding.relatedChangedFiles.length > 5 || (finding.ruleId?.length ?? 0) > 200 || finding.acceptedDecisions.some((d) => d.viaFiles.length > 5)
-    }));
-    return {
-      ...check,
-      findings,
-      reportedCommands: check.reportedCommands ? previews(check.reportedCommands, 5) : void 0,
-      reportedTools: check.reportedTools ? previews(check.reportedTools, 5) : void 0,
-      diagnostics: previews(check.diagnostics, 10),
-      truncated: check.truncated || check.findings.length > 5 || findings.some((f) => f.truncated) || check.diagnostics.length > 10 || check.diagnostics.some((d) => d.length > 2e3) || [check.reportedCommands ?? [], check.reportedTools ?? []].some(
-        (values) => values.length > 5 || values.some((v) => v.length > 2e3)
-      )
-    };
-  });
-  return {
-    ...evidence,
-    checks,
-    diagnostics: previews(evidence.diagnostics, 20),
-    truncated: evidence.checks.length > 10 || evidence.diagnostics.length > 20 || evidence.diagnostics.some((d) => d.length > 2e3) || checks.some((c) => c.truncated)
-  };
-}
-var checkSchema2;
-var init_evidence2 = __esm({
-  "src/review/evidence.ts"() {
-    "use strict";
-    init_storage();
-    init_paths();
-    init_snapshot();
-    init_drift();
-    init_test_map();
-    init_provenance();
-    init_vitest();
-    init_sarif();
-    init_check();
-    init_types2();
-    checkSchema2 = z29.object({
-      id: z29.string().min(1).max(100),
-      kind: z29.enum([
-        "tests",
-        "static-analysis",
-        "security",
-        "complexity",
-        "duplication",
-        "documentation"
-      ]),
-      tool: z29.string().min(1).max(200),
-      command: z29.string().min(1).max(2e3),
-      commit: z29.string().regex(/^(?:[a-fA-F0-9]{40}|[a-fA-F0-9]{64})$/).nullable().optional(),
-      workingTreeClean: z29.boolean().optional(),
-      source: z29.string().max(2e3).optional(),
-      sourceRoot: z29.string().min(1).max(4e3).optional(),
-      status: z29.enum(["completed", "skipped", "unavailable"]).default("completed"),
-      reason: z29.string().min(1).max(2e3).optional(),
-      exitCode: z29.number().int().nullable().optional(),
-      environment: z29.object({
-        toolVersion: z29.string().min(1).max(200),
-        runtime: z29.string().min(1).max(200).optional(),
-        platform: z29.string().min(1).max(200).optional(),
-        configuration: z29.array(z29.string().min(1).max(4e3)).max(100).optional()
-      }).optional(),
-      report: z29.object({
-        format: z29.enum(["vitest-json", "sarif", "mason-check-json"]),
-        path: z29.string().min(1).max(4e3)
-      }).optional()
-    });
-  }
-});
-
-// src/review/review.ts
-import fs23 from "fs/promises";
-import path28 from "path";
-import { execFile as execFile4 } from "child_process";
-import { promisify as promisify4 } from "util";
-async function resolveMergeBase(resolvedRoot, base, head) {
-  try {
-    const { stdout } = await exec2("git", ["merge-base", base, head], {
-      cwd: resolvedRoot
-    });
-    return stdout.trim() || null;
-  } catch {
-    return null;
-  }
-}
-async function defaultBase(resolvedRoot) {
-  for (const ref of ["origin/HEAD", "origin/main", "origin/master", "main"]) {
-    try {
-      await exec2("git", ["rev-parse", "--verify", "--quiet", ref], {
-        cwd: resolvedRoot
-      });
-      return ref;
-    } catch {
-    }
-  }
-  return null;
-}
-function anchorsTouched(record, changedFiles) {
-  return matchingPaths(record.files, changedFiles);
-}
-async function computeReview(rootDir, base, options = {}) {
-  const resolvedRoot = path28.resolve(rootDir);
-  const head = await getCurrentGitHash(resolvedRoot);
-  if (head === "unknown") return null;
-  const mergeBase = await resolveMergeBase(resolvedRoot, base, head);
-  if (!mergeBase) return null;
-  const changes = await getChangesWithStatus(resolvedRoot, mergeBase, head);
-  if (changes === null) return null;
-  const changedFiles = touchedPaths(changes);
-  const report = {
-    version: 1,
-    root: resolvedRoot,
-    base,
-    mergeBase,
-    changedFiles,
-    missingPartners: [],
-    touchedDecisions: [],
-    historyAvailable: true,
-    truncated: false
-  };
-  const store = await loadDecisionStore(resolvedRoot);
-  report.diagnostics = store.diagnostics;
-  const decisionDrift = await computeDecisionDrift(resolvedRoot, store.records);
-  if (options.evidence !== void 0) {
-    report.evidence = await collectReviewEvidence(
-      resolvedRoot,
-      options.evidence,
-      changedFiles,
-      store.records,
-      decisionDrift.freshness,
-      head
-    );
-    if (store.diagnostics.length) {
-      report.evidence.diagnostics.push(
-        "Invalid decision records make knowledge associations incomplete; consult review diagnostics."
-      );
-      if (report.evidence.status === "passed") report.evidence.status = "incomplete";
-    }
-  }
-  const finalize = async () => {
-    if (report.evidence && await getCurrentGitHash(resolvedRoot) !== head) {
-      report.evidence.diagnostics.push(
-        "HEAD changed during the review; rerun to obtain consistent change and knowledge associations."
-      );
-      for (const check of report.evidence.checks) check.freshness = "unknown";
-      report.evidence.summary.stale = 0;
-      report.evidence.summary.unknown = report.evidence.checks.length;
-      if (report.evidence.status !== "unavailable") report.evidence.status = "incomplete";
-    }
-    return report;
-  };
-  if (changedFiles.length === 0) return finalize();
-  let analyzed = changedFiles;
-  if (changedFiles.length > MAX_ANALYZED_FILES) {
-    analyzed = changedFiles.slice(0, MAX_ANALYZED_FILES);
-    report.truncated = true;
-  }
-  const partners = await findMissingPartners(
-    resolvedRoot,
-    analyzed,
-    async (relPath) => {
-      try {
-        await fs23.access(path28.join(resolvedRoot, relPath));
-        return true;
-      } catch {
-        return false;
-      }
-    },
-    changedFiles
-  );
-  if (partners === null) {
-    report.historyAvailable = false;
-  } else {
-    report.missingPartners = partners;
-  }
-  const decisions = store.records;
-  for (const record of decisions) {
-    if (record.status !== "active") continue;
-    const effective = effectiveDecision(record);
-    const touched = anchorsTouched(effective, changedFiles);
-    const proposalTouched = effective !== record ? anchorsTouched(record, changedFiles) : [];
-    if (touched.length > 0 || proposalTouched.length > 0) {
-      const { pendingProposal, ...knowledge } = decisionKnowledge(
-        record,
-        decisionDrift.freshness?.[record.id] ?? "unknown",
-        decisionDrift.pendingProposals?.[record.id]?.freshness ?? "unknown"
-      );
-      report.touchedDecisions.push({
-        ...knowledge,
-        ...pendingProposal ? { pendingProposal: { ...pendingProposal, touchedFiles: proposalTouched } } : {},
-        id: record.id,
-        anchors: effective.files,
-        freshness: decisionDrift.freshness?.[record.id] ?? "unknown",
-        touchedFiles: touched
-      });
-    }
-  }
-  return finalize();
-}
-var exec2, MAX_ANALYZED_FILES;
-var init_review = __esm({
-  "src/review/review.ts"() {
-    "use strict";
-    init_drift();
-    init_provenance();
-    init_decisions();
-    init_paths();
-    init_drift2();
-    init_cochange();
-    init_evidence2();
-    init_snapshot();
-    exec2 = promisify4(execFile4);
-    MAX_ANALYZED_FILES = 50;
-  }
-});
-
-// src/mcp/onboarding.ts
-async function auditSummary(root) {
-  try {
-    const report = await computeAudit(root);
-    if (!report)
-      return {
-        status: "no-context-files",
-        reason: "No README.md or agent instruction files found to audit."
-      };
-    if (!report.gitAvailable)
-      return {
-        status: "unavailable",
-        reason: "Audit needs readable Git history to verify documentation claims.",
-        docs: report.docs
-      };
-    return {
-      ...report,
-      status: "complete",
-      issues: report.issues.slice(0, MAX_FINDINGS2),
-      advisories: report.advisories.slice(0, MAX_FINDINGS2),
-      suppressedAdvisories: (report.suppressedAdvisories ?? []).slice(0, MAX_FINDINGS2),
-      counts: {
-        issues: report.issues.length,
-        advisories: report.advisories.length,
-        suppressedAdvisories: report.suppressedAdvisories?.length ?? 0
-      },
-      truncated: report.issues.length > MAX_FINDINGS2 || report.advisories.length > MAX_FINDINGS2 || (report.suppressedAdvisories?.length ?? 0) > MAX_FINDINGS2
-    };
-  } catch (error) {
-    return { status: "unavailable", reason: reason(error) };
-  }
-}
-async function reviewSummary(root, requestedBase, evidence) {
-  const workingTree = await getWorkingTree(root);
-  const scope = "committed";
-  try {
-    const base = requestedBase ?? await defaultBase(root);
-    if (!base)
-      return {
-        status: "unavailable",
-        scope,
-        workingTree,
-        reason: "No default review base resolves. Pass base to mason_init, or run mason-review --base <ref>."
-      };
-    const report = await computeReview(root, base, { evidence });
-    if (!report)
-      return {
-        status: "unavailable",
-        scope,
-        base,
-        workingTree,
-        reason: "The review base, merge base, or committed diff could not be read."
-      };
-    return {
-      ...report,
-      scope,
-      workingTree,
-      ...report.evidence ? { evidence: summarizeEvidence(report.evidence) } : {},
-      status: !report.historyAvailable ? "unavailable" : report.changedFiles.length ? "complete" : "no-changes",
-      ...!report.historyAvailable ? { reason: "Co-change history could not be read; review findings are incomplete." } : {},
-      changedFiles: report.changedFiles.slice(0, MAX_FINDINGS2),
-      missingPartners: report.missingPartners.slice(0, MAX_FINDINGS2),
-      touchedDecisions: report.touchedDecisions.slice(0, MAX_FINDINGS2),
-      counts: {
-        changedFiles: report.changedFiles.length,
-        missingPartners: report.missingPartners.length,
-        touchedDecisions: report.touchedDecisions.length
-      },
-      truncated: report.truncated || [report.changedFiles, report.missingPartners, report.touchedDecisions].some(
-        (list) => list.length > MAX_FINDINGS2
-      ),
-      hint: "Reviews cover merge-base..HEAD. Uncommitted paths are reported separately in workingTree; they have not been reviewed."
-    };
-  } catch (error) {
-    return { status: "unavailable", scope, workingTree, reason: reason(error) };
-  }
-}
-async function inspectOnboarding(root, base, evidence) {
-  const [audit, review, map, decisions] = await Promise.all([
-    auditSummary(root),
-    reviewSummary(root, base, evidence),
-    inspectSnapshot(root),
-    loadDecisionStore(root)
-  ]);
-  return {
-    audit,
-    review,
-    map: { status: map.status },
-    decisions: {
-      active: decisions.records.filter((record) => record.status === "active").length,
-      ...Object.fromEntries(
-        ["accepted", "proposed", "unreviewed"].map((approval) => [
-          approval,
-          decisions.records.filter(
-            (record) => record.status === "active" && decisionApproval(effectiveDecision(record)) === approval
-          ).length
-        ])
-      ),
-      pendingProposals: decisions.records.filter((record) => effectiveDecision(record) !== record).length
-    },
-    diagnostics: [...map.diagnostics, ...decisions.diagnostics]
-  };
-}
-var MAX_FINDINGS2, reason;
-var init_onboarding = __esm({
-  "src/mcp/onboarding.ts"() {
-    "use strict";
-    init_audit();
-    init_review();
-    init_drift();
-    init_snapshot();
-    init_provenance();
-    init_evidence2();
-    init_decisions();
-    MAX_FINDINGS2 = 20;
-    reason = (error) => error instanceof Error ? error.message : String(error);
-  }
-});
-
 // src/setup/status.ts
 var status_exports = {};
 __export(status_exports, {
   setupStatus: () => setupStatus,
   summarizeActivation: () => summarizeActivation
 });
-import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 async function setupStatus(dir) {
   const ws = await workspace(dir);
   const activation = await effectiveSetup(ws.root);
@@ -8215,11 +7501,29 @@ async function setupStatus(dir) {
       }))
     );
     const pending = partial.filter((item) => item.receipt !== null).map((item) => item.host);
+    const configuration = {};
+    await Promise.all(
+      ["codex", "claude"].map(async (host) => {
+        try {
+          const inspected = await inspectIntegration(ws.root, host);
+          configuration[host] = {
+            compatible: inspected.compatible,
+            disabled: inspected.disabled || inspected.mcpDisabled
+          };
+        } catch (error) {
+          configuration[host] = {
+            compatible: false,
+            diagnostic: error instanceof Error ? error.message : String(error)
+          };
+        }
+      })
+    );
     return {
       version: 1,
       status: pending.length ? "incomplete" : "not-configured",
       hosts: {},
-      next: pending.length ? "Setup did not finish. Rerun mason setup --host " + pending[0] + " to resume using the retained original evidence." : "Project hooks are inactive until local setup. Run mason setup --host codex or --host claude."
+      configuration,
+      next: pending.length ? "Setup did not finish. Rerun mason setup --host " + pending[0] + " to resume local activation; use mason init if shared configuration needs updating." : "Project hooks are inactive. Run mason setup --host codex or --host claude for compatible shared configuration; a maintainer uses mason init to prepare missing or incompatible configuration."
     };
   }
   const hosts2 = {};
@@ -8228,25 +7532,11 @@ async function setupStatus(dir) {
   for (const host of ["codex", "claude"]) {
     const entry = setup.hosts[host];
     if (!entry) continue;
-    const instructions = await instructionEdits(ws.root, host);
-    const instructionsCurrent = instructions.every((edit) => edit.before === edit.after);
-    const config = await inspectHostConfig(ws.root, host, void 0);
-    const mcp = !config.mcpDisabled && hash(config.mcp) === entry.mcpFingerprint && isDeepStrictEqual3({ command: config.mcp?.command, args: config.mcp?.args }, mcpCommand(host));
-    const expectedHooks = hookConfig(host, hookCommand(host)).hooks;
-    const currentHooks = isDeepStrictEqual3(config.hooks, expectedHooks);
-    const compatibleHooks = Object.fromEntries(
-      Object.entries(config.hooks).map(([event, groups]) => [
-        event,
-        groups.map((group) => ({
-          ...group,
-          hooks: group.hooks.map((handler) => ({
-            ...handler,
-            command: expectedHooks.SessionStart[0].hooks[0].command
-          }))
-        }))
-      ])
-    );
-    const hooks = isDeepStrictEqual3(compatibleHooks, expectedHooks) && !config.disabled;
+    const config = await inspectIntegration(ws.root, host);
+    const instructionsCurrent = config.instructionsCurrent;
+    const mcp = config.mcpCompatible && !config.mcpDisabled && hash(config.mcp) === entry.mcpFingerprint;
+    const currentHooks = config.hooksCurrent;
+    const hooks = config.hooksCompatible && !config.disabled;
     const local = await loadSetupReceipt(ws.root, ws.directory, host);
     const configured = activation.root !== ws.root || local?.status === "configured" && local.root === ws.root && local.revision === entry.revision;
     const observation = await readObservation(
@@ -8265,9 +7555,9 @@ async function setupStatus(dir) {
     const observedEvents = complete?.events ?? sessions[0]?.events ?? [];
     const pending = [];
     if (!installed.available) pending.push(installed.message);
-    if (!mcp || !hooks || !instructionsCurrent || !configured)
+    if (!mcp || !hooks || !config.instructionCompatible || !configured)
       pending.push(
-        "Rerun setup to reconcile project configuration; inspect any disabled host settings."
+        "Run mason setup to activate existing configuration; incompatible shared configuration needs mason init and review. Inspect any disabled host settings."
       );
     if (!observation?.contextCalls)
       pending.push(
@@ -8281,19 +7571,20 @@ async function setupStatus(dir) {
       pending.push(
         "The latest automation attempt did not establish verification. Run mason check and inspect its diagnostics."
       );
-    const healthy = installed.available && mcp && hooks && instructionsCurrent && configured && automation.status !== "unavailable";
+    const healthy = installed.available && mcp && hooks && config.instructionCompatible && configured && automation.status !== "unavailable";
     hosts2[host] = {
       status: healthy ? complete && observation?.contextCalls ? "active" : "pending" : "attention",
       runtime: installed.available ? "global (" + installed.version + ")" : "unavailable-on-path",
       mcp: mcp ? "configured" : "changed",
-      instructions: instructionsCurrent ? "current" : "changed",
+      instructions: instructionsCurrent ? "current" : config.instructionCompatible ? "compatible" : "incompatible",
       hookConfiguration: hooks ? currentHooks ? "configured" : "compatible" : "disabled-or-changed",
       observedEvents,
       contextCalls: observation?.contextCalls ?? 0,
+      verificationScope: automation.scope,
       verificationStatus: automation.status === "current" ? automation.verificationStatus ?? "unavailable" : "unavailable",
       pending,
-      updates: hooks && !currentHooks ? [
-        "A newer hook template is available. Run mason setup --host " + host + " to update it when convenient; review and commit the configuration changes."
+      updates: config.compatible && (!currentHooks || !instructionsCurrent) ? [
+        "Updated integration templates are available. A maintainer can run mason init --host " + host + " to update it when convenient; review and commit the configuration changes."
       ] : []
     };
   }
@@ -8322,10 +7613,10 @@ function summarizeActivation(status) {
       `${host}: ${state.status}`,
       `  Runtime: ${state.runtime}; MCP: ${state.mcp}; instructions: ${state.instructions}.`,
       `  Hooks: ${state.hookConfiguration}; observed: ${state.observedEvents.join(", ") || "none"}.`,
-      `  Task context requests: ${state.contextCalls}; verification: ${state.verificationStatus}.`,
-      ...state.pending.map((message2) => "  Next: " + message2)
+      `  Task context requests: ${state.contextCalls}; verification: ${state.verificationStatus} (${state.verificationScope}).`,
+      ...state.pending.map((message) => "  Next: " + message)
     );
-    lines.push(...state.updates.map((message2) => "  Optional: " + message2));
+    lines.push(...state.updates.map((message) => "  Optional: " + message));
   }
   if ("decisionRecords" in status) lines.push(`Decision records: ${status.decisionRecords}.`);
   if (status.next) lines.push(status.next);
@@ -8338,7 +7629,6 @@ var init_status = __esm({
     init_store();
     init_runtime();
     init_decisions();
-    init_adapters();
     init_model();
     init_config2();
     init_launcher();
@@ -8349,8 +7639,10 @@ var init_status = __esm({
 // src/setup/setup.ts
 var setup_exports = {};
 __export(setup_exports, {
+  initializeProject: () => initializeProject,
   selectHost: () => selectHost,
   setupProject: () => setupProject,
+  summarizeInitialization: () => summarizeInitialization,
   summarizeSetup: () => summarizeSetup
 });
 import { randomUUID as randomUUID6 } from "crypto";
@@ -8370,27 +7662,45 @@ async function setupProject(dir, options = {}) {
   options.progress?.step("Checking project configuration");
   const ws = await workspace(dir);
   const host = await selectHost(ws.root, options.host);
+  if ((await git3(
+    ws.root,
+    "ls-files",
+    "--",
+    ".mason/local",
+    ws.directory,
+    ".mason/reports/setup-lock"
+  )).trim())
+    throw new Error("Mason local state must be untracked before setup can activate this checkout.");
   return withLock(ws.root, ".mason/reports/setup-lock", async () => {
     const existing = await loadSetup(ws.root);
     const previousReceipt = await loadSetupReceipt(ws.root, ws.directory, host);
     const installed = await installedCommand();
     if (!installed.available) throw new Error(installed.message);
-    const instructions = await instructionEdits(ws.root, host);
-    const mcp = await mcpEdit(ws.root, host);
+    const configured = await inspectIntegration(ws.root, host);
+    if (!configured.compatible)
+      throw new Error(
+        "Shared Mason configuration is missing or incompatible. A maintainer should run mason init --host " + host + " and review/commit the changes. Local setup did not edit shared files."
+      );
+    const privatePaths = [SETUP_PATH, ws.directory + "/setup-" + host + ".json"];
+    const ignored = (await git3(ws.root, "check-ignore", "--no-index", "--", ...privatePaths).catch(() => "")).trim().split("\n");
+    if (!privatePaths.every((file) => ignored.includes(file)))
+      throw new Error(
+        "Mason local state must be ignored. A maintainer should run mason init and commit the ignore rules."
+      );
+    const instructions = configured.instructions;
+    const sharedInputs = [
+      ...instructions.map((edit) => ({ path: edit.path, before: edit.before })),
+      { path: mcpPath(host), before: await readText(ws.root, mcpPath(host)) },
+      { path: configPath3(host), before: await readText(ws.root, configPath3(host)) }
+    ];
     const hooks = await hookEdits(ws.root, host);
-    const ancillary = await ancillaryEdits(ws.root);
-    const edits = [...ancillary, ...instructions, mcp, ...hooks];
+    const edits = hooks.slice(1);
     const setupBefore = await readText(ws.root, SETUP_PATH);
-    const mcpFingerprint = hash((await inspectHostConfig(ws.root, host, mcp.after)).mcp);
-    const desiredHooks = hookConfig(host, hookCommand(host)).hooks;
-    const configuredHook = desiredHooks.SessionStart[0].hooks[0].command;
-    const ownership = await ownershipEdit(ws.root, [...instructions, mcp, hooks[0]], {
-      [hooks[0].path]: configuredHook
-    });
+    const mcpFingerprint = hash(configured.mcp);
     const fingerprint = hash({
       command: "mason",
       mcp: mcpFingerprint,
-      hooks: desiredHooks,
+      hooks: configured.hooks,
       instructions: instructions.map((edit) => edit.path)
     });
     const previous = existing?.hosts[host];
@@ -8404,25 +7714,21 @@ async function setupProject(dir, options = {}) {
       mcpFingerprint,
       instructions: instructions.map((e) => e.path)
     };
-    options.progress?.step("Auditing documentation and preserving original findings");
-    const initial = await automate(ws.root, { event: "turn_start" });
-    options.progress?.step("Reviewing project context and committed changes");
-    const findings = await inspectOnboarding(ws.root, options.base, options.evidence);
     const receiptPath = ws.directory + "/setup-" + host + ".json";
-    const initialReportPath = previousReceipt?.initialReportPath ?? initial.report.reportPath;
-    const initialBaselinePaths = previousReceipt?.initialBaselinePaths ?? initial.report.baselinePaths;
-    options.progress?.step(`Configuring ${host === "codex" ? "Codex" : "Claude Code"} integration`);
+    const legacyEvidence = previousReceipt?.initialReportPath ? {
+      initialReportPath: previousReceipt.initialReportPath,
+      initialBaselinePaths: previousReceipt.initialBaselinePaths ?? []
+    } : {};
+    options.progress?.step(`Activating ${host === "codex" ? "Codex" : "Claude Code"} integration`);
     await writeStoreJson(ws.root, receiptPath, {
       version: 1,
       host,
       status: "installing",
-      initialReportPath,
-      initialBaselinePaths,
+      ...legacyEvidence,
       root: ws.root,
       revision
     });
     const changedFiles = [];
-    if (await applyEdit(ws.root, ownership)) changedFiles.push(ownership.path);
     for (const edit of edits) if (await applyEdit(ws.root, edit)) changedFiles.push(edit.path);
     if (await applyEdit(ws.root, {
       path: SETUP_PATH,
@@ -8430,25 +7736,15 @@ async function setupProject(dir, options = {}) {
       after: JSON.stringify(setup, null, 2) + "\n"
     }))
       changedFiles.push(SETUP_PATH);
-    if (await applyEdit(
-      ws.root,
-      await completedHookOwnership(ws.root, hooks[0].path, configuredHook)
-    ) && !changedFiles.includes(ownership.path))
-      changedFiles.push(ownership.path);
-    options.progress?.step("Checking configuration and retained findings");
-    const checked = await automate(ws.root, { event: "turn_start" });
-    const configured = await inspectHostConfig(ws.root, host, void 0);
-    const stats = await configureUsefulness(ws.root, true, { onlyIfUnset: true }).catch(() => ({
-      enabled: null,
-      storage: ".mason/local/usefulness",
-      note: "Local stats unavailable. Inspect mason stats --json, or use mason stats --disable to reset the preference. Existing observations were retained."
-    }));
+    options.progress?.step("Checking agent configuration");
+    for (const input of sharedInputs)
+      if (await readText(ws.root, input.path) !== input.before)
+        throw new Error(input.path + " changed during setup; inspect it and retry.");
     await writeStoreJson(ws.root, receiptPath, {
       version: 1,
       host,
       status: "configured",
-      initialReportPath,
-      initialBaselinePaths,
+      ...legacyEvidence,
       root: ws.root,
       revision,
       configuredAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -8456,50 +7752,91 @@ async function setupProject(dir, options = {}) {
     return {
       version: 1,
       action: "setup",
+      mode: "activate",
       status: "configured",
       host,
       root: ws.root,
       runtime: { kind: "global", command: "mason", version: installed.version },
       changedFiles,
-      initialReportPath,
-      findings,
-      reportPath: checked.report.reportPath,
+      receiptPath,
       activation: await setupStatus(ws.root),
-      stats,
       next: configured.disabled || configured.mcpDisabled ? "Mason hooks or MCP are disabled in project configuration. Review that setting before activation." : host === "codex" ? "Review/trust this project's MCP configuration and hooks in Codex (/hooks in the CLI), then start a new session and give it a normal task." : "Approve the project MCP server in Claude Code, then start a new session and give it a normal task."
     };
   });
 }
 function summarizeSetup(result) {
-  const audit = result.findings.audit;
   return [
     `Mason configured for ${result.host}.`,
     "  MCP server and lifecycle hooks use mason from PATH.",
-    "  Project instructions updated; original audit evidence retained.",
+    "  Existing shared configuration validated; only local activation state was written.",
     `  ${result.changedFiles.length} files changed.`,
-    result.stats.enabled === null ? result.stats.note : result.stats.enabled ? "Local stats enabled: metadata stays in .mason/local/usefulness/; nothing is uploaded. View with mason stats; disable with mason stats --disable." : "Local stats remain disabled by your saved preference. Enable with mason stats --enable.",
-    `Initial audit: ${audit.status}${"counts" in audit ? `; ${audit.counts.issues} issues, ${audit.counts.advisories + audit.counts.suppressedAdvisories} advisories` : ""}.`,
-    ..."issues" in audit ? audit.issues.slice(0, 3).map((f) => "  " + f.message) : [],
-    `Original evidence: ${result.initialReportPath}`,
     "Activation: " + result.activation.status + ".",
     result.next,
     "If the assistant cannot find mason, restart the desktop app so it picks up PATH.",
     "After the task finishes, run mason status. Configuration alone does not establish activation."
   ].join("\n");
 }
+async function initializeProject(dir, options = {}) {
+  const ws = await workspace(dir);
+  const host = await selectHost(ws.root, options.host);
+  const run = async (apply) => {
+    const instructions = await instructionEdits(ws.root, host);
+    const mcp = await mcpEdit(ws.root, host);
+    const hooks = await hookEdits(ws.root, host);
+    const edits = [...await ancillaryEdits(ws.root), ...instructions, mcp, hooks[0]];
+    const configuredHook = hookConfig(host, hookCommand(host)).hooks.SessionStart[0].hooks[0].command;
+    const ownership = await ownershipEdit(ws.root, [...instructions, mcp, hooks[0]], {
+      [hooks[0].path]: configuredHook
+    });
+    if (apply) {
+      options.progress?.step("Preparing shared agent configuration");
+      await applyEdit(ws.root, ownership);
+      for (const edit of edits) await applyEdit(ws.root, edit);
+      await applyEdit(
+        ws.root,
+        await completedHookOwnership(ws.root, hooks[0].path, configuredHook)
+      );
+    }
+    return {
+      version: 1,
+      action: "init",
+      status: options.dryRun ? "preview" : "initialized",
+      host,
+      root: ws.root,
+      dryRun: !!options.dryRun,
+      changes: edits.filter((edit) => edit.before !== edit.after).map((edit) => ({
+        path: edit.path,
+        action: edit.before === null ? "create" : "update"
+      })),
+      next: "Review and commit shared configuration, then run mason setup --host " + host + " in each developer's checkout."
+    };
+  };
+  if (options.dryRun) return run(false);
+  if ((await git3(ws.root, "ls-files", "--", ".mason/local", ".mason/reports/setup-lock")).trim())
+    throw new Error("Mason local bookkeeping must be untracked before initialization.");
+  return withLock(ws.root, ".mason/reports/setup-lock", () => run(true));
+}
+function summarizeInitialization(result) {
+  return [
+    `Mason initialization${result.dryRun ? " preview" : ""} for ${result.host}.`,
+    ...result.changes.map(
+      (change) => `  ${result.dryRun ? "Would " : ""}${change.action}: ${change.path}`
+    ),
+    ...!result.changes.length ? ["Shared configuration is current; no changes needed."] : [],
+    result.dryRun ? "Preview only; no files were changed." : result.next
+  ].join("\n");
+}
 var init_setup = __esm({
   "src/setup/setup.ts"() {
     "use strict";
-    init_usefulness();
     init_evidence();
     init_store();
-    init_runtime();
-    init_onboarding();
     init_storage();
     init_files2();
     init_config2();
-    init_launcher();
     init_adapters();
+    init_install();
+    init_launcher();
     init_model();
     init_status();
     init_ownership();
@@ -8508,25 +7845,25 @@ var init_setup = __esm({
 
 // src/distribution/path.ts
 import fs24 from "fs/promises";
-import os3 from "os";
-import path29 from "path";
-import { execFile as execFile5 } from "child_process";
-import { promisify as promisify5 } from "util";
-import { createHash as createHash6, randomUUID as randomUUID7 } from "crypto";
-import { z as z30 } from "zod";
+import os4 from "os";
+import path26 from "path";
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
+import { createHash as createHash7, randomUUID as randomUUID7 } from "crypto";
+import { z as z27 } from "zod";
 async function configurePath(bin, previous, save, options = {}) {
   const env = options.env ?? process.env, platform = options.platform ?? process.platform;
   const changes = [...previous];
   const currentPath = platform === "win32" ? Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] : env.PATH;
   const alreadyOnPath = platform === "win32" ? hasWindowsEntry(currentPath ?? null, bin, env) : (currentPath ?? "").split(":").some(
-    (entry) => path29.posix.isAbsolute(entry) && path29.posix.resolve(entry) === path29.posix.resolve(bin)
+    (entry) => path26.posix.isAbsolute(entry) && path26.posix.resolve(entry) === path26.posix.resolve(bin)
   );
-  const setupHint = "To connect a project, run one of these inside its directory:\n  Codex:       mason setup --host codex\n  Claude Code: mason setup --host claude";
-  const message2 = (alreadyOnPath ? "" : "Open a new terminal to use mason.\n") + setupHint;
-  const manual = (reason2) => ({
+  const setupHint = "To prepare a new project for review, run one of these inside its directory (use mason setup to activate existing team configuration):\n  Codex:       mason init --host codex\n  Claude Code: mason init --host claude";
+  const message = (alreadyOnPath ? "" : "Open a new terminal to use mason.\n") + setupHint;
+  const manual = (reason) => ({
     status: "manual",
     changes,
-    message: `${reason2}
+    message: `${reason}
 ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
 `}${setupHint}`
   });
@@ -8544,19 +7881,19 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
         }
         await windowsPath("add", bin, current);
       }
-      return { status: "configured", changes, message: message2 };
+      return { status: "configured", changes, message };
     }
-    const shell = path29.basename(env.SHELL ?? os3.userInfo().shell ?? "");
-    const userHome = options.userHome ?? os3.homedir();
+    const shell = path26.basename(env.SHELL ?? os4.userInfo().shell ?? "");
+    const userHome = options.userHome ?? os4.homedir();
     let profiles2;
     if (!["bash", "zsh", "sh"].includes(shell))
       return manual(`Automatic PATH setup is unavailable for ${shell || "an unknown shell"}.`);
-    if (env.MASON_PROFILE) profiles2 = [path29.resolve(env.MASON_PROFILE)];
-    else if (shell === "zsh") profiles2 = [path29.join(env.ZDOTDIR || userHome, ".zshrc")];
-    else if (shell === "sh") profiles2 = [path29.join(userHome, ".profile")];
+    if (env.MASON_PROFILE) profiles2 = [path26.resolve(env.MASON_PROFILE)];
+    else if (shell === "zsh") profiles2 = [path26.join(env.ZDOTDIR || userHome, ".zshrc")];
+    else if (shell === "sh") profiles2 = [path26.join(userHome, ".profile")];
     else {
       const candidates = [".bash_profile", ".bash_login", ".profile"].map(
-        (name) => path29.join(userHome, name)
+        (name) => path26.join(userHome, name)
       );
       let login = candidates[2];
       for (const file of candidates)
@@ -8570,15 +7907,15 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
           login = file;
           break;
         }
-      profiles2 = [path29.join(userHome, ".bashrc"), login];
+      profiles2 = [path26.join(userHome, ".bashrc"), login];
     }
-    const marker = `# >>> mason PATH ${createHash6("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
+    const marker = `# >>> mason PATH ${createHash7("sha256").update(bin).digest("hex").slice(0, 12)} >>>`;
     for (const profile of profiles2) {
       const stat = await fs24.lstat(profile).catch((error) => {
         if (hasErrorCode(error, "ENOENT")) return null;
         throw error;
       });
-      const file = stat?.isSymbolicLink() ? await fs24.realpath(profile) : path29.resolve(profile);
+      const file = stat?.isSymbolicLink() ? await fs24.realpath(profile) : path26.resolve(profile);
       const original = await fs24.readFile(file).catch((error) => {
         if (hasErrorCode(error, "ENOENT") && !stat) return null;
         throw error;
@@ -8598,7 +7935,7 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
         changes.push({ kind: "profile", file, block, created: original === null });
         await save(changes);
       }
-      await fs24.mkdir(path29.dirname(file), { recursive: true });
+      await fs24.mkdir(path26.dirname(file), { recursive: true });
       const handle = await fs24.open(file, original === null ? "ax+" : "a+", 384);
       try {
         if (!(await handle.readFile()).equals(original ?? Buffer.alloc(0)))
@@ -8609,7 +7946,7 @@ ${alreadyOnPath ? "" : `Add ${bin} to your PATH.
         await handle.close();
       }
     }
-    return { status: "configured", changes, message: message2 };
+    return { status: "configured", changes, message };
   } catch (error) {
     return manual(
       `Could not configure PATH: ${error instanceof Error ? error.message : String(error)}`
@@ -8635,10 +7972,10 @@ async function removePath(changes) {
       if (!stat.isFile()) throw new Error("profile type changed");
       const bytes = await fs24.readFile(change.file), text2 = bytes.toString("utf8");
       if (!Buffer.from(text2).equals(bytes)) throw new Error("profile encoding changed");
-      const index2 = text2.indexOf(change.block);
-      if (index2 < 0 || text2.indexOf(change.block, index2 + change.block.length) >= 0)
+      const index = text2.indexOf(change.block);
+      if (index < 0 || text2.indexOf(change.block, index + change.block.length) >= 0)
         throw new Error("PATH block was edited or removed");
-      const prefix = text2.slice(0, index2), suffix = text2.slice(index2 + change.block.length);
+      const prefix = text2.slice(0, index), suffix = text2.slice(index + change.block.length);
       const separator = prefix && suffix && !prefix.endsWith("\n") ? change.block.startsWith("\r\n") ? "\r\n" : "\n" : "";
       const next = Buffer.from(prefix + separator + suffix);
       const temporary = change.file + ".mason-" + randomUUID7();
@@ -8708,25 +8045,25 @@ try {
     ],
     { windowsHide: true, timeout: 15e3, maxBuffer: 1024 * 1024 }
   );
-  return z30.object({ value: z30.string().nullable(), kind: z30.string().nullable() }).parse(JSON.parse(stdout.replace(/^\uFEFF/, "").trim()));
+  return z27.object({ value: z27.string().nullable(), kind: z27.string().nullable() }).parse(JSON.parse(stdout.replace(/^\uFEFF/, "").trim()));
 }
 var execute2, pathChangeSchema, quote, normalizeWindowsEntry, hasWindowsEntry;
 var init_path = __esm({
   "src/distribution/path.ts"() {
     "use strict";
     init_validation();
-    execute2 = promisify5(execFile5);
-    pathChangeSchema = z30.discriminatedUnion("kind", [
-      z30.object({
-        kind: z30.literal("profile"),
-        file: z30.string(),
-        block: z30.string(),
-        created: z30.boolean()
+    execute2 = promisify3(execFile3);
+    pathChangeSchema = z27.discriminatedUnion("kind", [
+      z27.object({
+        kind: z27.literal("profile"),
+        file: z27.string(),
+        block: z27.string(),
+        created: z27.boolean()
       }),
-      z30.object({ kind: z30.literal("windows"), entry: z30.string(), created: z30.boolean() })
+      z27.object({ kind: z27.literal("windows"), entry: z27.string(), created: z27.boolean() })
     ]);
     quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
-    normalizeWindowsEntry = (value) => path29.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
+    normalizeWindowsEntry = (value) => path26.win32.normalize(value.trim().replace(/^"(.*)"$/, "$1")).replace(/[\\/]+$/, "").toLowerCase();
     hasWindowsEntry = (value, entry, env = process.env) => {
       const variables = new Map(Object.entries(env).map(([key, value2]) => [key.toLowerCase(), value2]));
       const expand = (part) => part.replace(/%([^%]+)%/g, (match, key) => variables.get(key.toLowerCase()) ?? match);
@@ -8748,11 +8085,11 @@ __export(state_exports, {
   standaloneLocation: () => standaloneLocation,
   updatePolicySchema: () => updatePolicySchema
 });
-import os4 from "os";
-import path30 from "path";
+import os5 from "os";
+import path27 from "path";
 import { fileURLToPath } from "url";
 import fs25 from "fs/promises";
-import { z as z31 } from "zod";
+import { z as z28 } from "zod";
 async function readInstallation(home) {
   const raw = await readStoreJson(home, "install.json");
   if (!raw)
@@ -8765,20 +8102,20 @@ async function readInstallation(home) {
   return record;
 }
 function standaloneLocation() {
-  const bundle = path30.resolve(path30.dirname(fileURLToPath(import.meta.url)), "../..");
-  const home = path30.dirname(path30.dirname(bundle));
-  if (path30.dirname(bundle) !== path30.join(home, "versions") || !/^[a-f0-9]{24}$/.test(path30.basename(bundle))) {
+  const bundle = path27.resolve(path27.dirname(fileURLToPath(import.meta.url)), "../..");
+  const home = path27.dirname(path27.dirname(bundle));
+  if (path27.dirname(bundle) !== path27.join(home, "versions") || !/^[a-f0-9]{24}$/.test(path27.basename(bundle))) {
     return null;
   }
   return { home, bundle };
 }
 async function currentInstallation() {
-  const location2 = standaloneLocation();
-  if (!location2)
+  const location = standaloneLocation();
+  if (!location)
     throw new Error(
       "Run this command from a standalone installation. npm users can upgrade with npm."
     );
-  const { home, bundle } = location2;
+  const { home, bundle } = location;
   const record = await readInstallation(home);
   return { home, bundle, record };
 }
@@ -8799,42 +8136,42 @@ var init_state = __esm({
     "use strict";
     init_storage();
     init_path();
-    releaseVersion = z31.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/);
-    bundleId = z31.string().regex(/^[a-f0-9]{24}$/);
-    updatePolicySchema = z31.object({
-      enabled: z31.boolean(),
-      revision: z31.string(),
+    releaseVersion = z28.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/);
+    bundleId = z28.string().regex(/^[a-f0-9]{24}$/);
+    updatePolicySchema = z28.object({
+      enabled: z28.boolean(),
+      revision: z28.string(),
       pinnedVersion: releaseVersion.optional(),
-      mirror: z31.string().optional()
+      mirror: z28.string().optional()
     });
-    recordSchema3 = z31.object({
-      format: z31.literal(1),
-      home: z31.string(),
-      bin: z31.string(),
+    recordSchema3 = z28.object({
+      format: z28.literal(1),
+      home: z28.string(),
+      bin: z28.string(),
       current: bundleId,
       version: releaseVersion,
-      launchers: z31.record(z31.string()),
-      previousLaunchers: z31.record(z31.string()).optional(),
-      pathChanges: z31.array(pathChangeSchema).optional(),
+      launchers: z28.record(z28.string()),
+      previousLaunchers: z28.record(z28.string()).optional(),
+      pathChanges: z28.array(pathChangeSchema).optional(),
       updates: updatePolicySchema.optional(),
-      previous: z31.object({ id: bundleId, version: releaseVersion }).optional(),
-      pending: z31.object({ id: bundleId, version: releaseVersion, policyRevision: z31.string() }).optional()
+      previous: z28.object({ id: bundleId, version: releaseVersion }).optional(),
+      pending: z28.object({ id: bundleId, version: releaseVersion, policyRevision: z28.string() }).optional()
     });
-    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path30.join(process.env.LOCALAPPDATA ?? os4.homedir(), "Mason") : path30.join(os4.homedir(), ".local/share/mason"));
+    defaultHome = () => process.env.MASON_HOME ?? (process.platform === "win32" ? path27.join(process.env.LOCALAPPDATA ?? os5.homedir(), "Mason") : path27.join(os5.homedir(), ".local/share/mason"));
   }
 });
 
 // src/distribution/bundle.ts
 import fs26 from "fs/promises";
-import path31 from "path";
-import { createHash as createHash7 } from "crypto";
-import { z as z32 } from "zod";
+import path28 from "path";
+import { createHash as createHash8 } from "crypto";
+import { z as z29 } from "zod";
 async function readBundle(root) {
   const bytes = await fs26.readFile(await storePath(root, "bundle.json"));
   const manifest = bundleSchema.parse(JSON.parse(bytes.toString("utf8")));
   const windows = manifest.target.startsWith("win32-");
   for (const file of Object.keys(manifest.files)) {
-    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path31.isAbsolute(file)) {
+    if (file.includes("\\") || file.split("/").some((p) => !p || p === "." || p === "..") || path28.isAbsolute(file)) {
       throw new Error("Unsafe path in Mason bundle: " + file);
     }
   }
@@ -8879,15 +8216,15 @@ var init_bundle = __esm({
       "win32-arm64",
       "win32-x64"
     ];
-    digest2 = z32.string().regex(/^[a-f0-9]{64}$/);
-    bundleSchema = z32.object({
-      format: z32.literal(1),
-      version: z32.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
-      target: z32.enum(targets),
-      nodeVersion: z32.string(),
-      files: z32.record(digest2)
+    digest2 = z29.string().regex(/^[a-f0-9]{64}$/);
+    bundleSchema = z29.object({
+      format: z29.literal(1),
+      version: z29.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
+      target: z29.enum(targets),
+      nodeVersion: z29.string(),
+      files: z29.record(digest2)
     }).strict();
-    sha256 = (bytes) => createHash7("sha256").update(bytes).digest("hex");
+    sha256 = (bytes) => createHash8("sha256").update(bytes).digest("hex");
   }
 });
 
@@ -8912,10 +8249,10 @@ var init_trust2 = __esm({
 // src/distribution/runtime.ts
 import fs27 from "fs/promises";
 import { unlinkSync } from "fs";
-import os5 from "os";
-import path32 from "path";
+import os6 from "os";
+import path29 from "path";
 import { randomUUID as randomUUID8 } from "crypto";
-import { z as z33 } from "zod";
+import { z as z30 } from "zod";
 async function pruneUnusedVersions(home) {
   const versions = await storePath(home, "versions");
   const candidates = [];
@@ -8950,7 +8287,7 @@ async function pruneUnusedVersions(home) {
         const raw = await readStoreJson(home, `runtimes/${name}`);
         if (raw === null) continue;
         const lease = leaseSchema.parse(raw);
-        if (lease.host !== os5.hostname()) return;
+        if (lease.host !== os6.hostname()) return;
         try {
           process.kill(lease.pid, 0);
           keep.add(lease.bundle);
@@ -8985,19 +8322,19 @@ var init_runtime2 = __esm({
     init_state();
     init_bundle();
     init_trust2();
-    leaseSchema = z33.object({
-      pid: z33.number().int().positive(),
-      host: z33.string(),
-      bundle: z33.string().regex(/^[a-f0-9]{24}$/)
+    leaseSchema = z30.object({
+      pid: z30.number().int().positive(),
+      host: z30.string(),
+      bundle: z30.string().regex(/^[a-f0-9]{24}$/)
     });
   }
 });
 
 // src/distribution/sessions.ts
 import fs28 from "fs/promises";
-import os6 from "os";
+import os7 from "os";
 import { randomUUID as randomUUID9 } from "crypto";
-import { z as z34 } from "zod";
+import { z as z31 } from "zod";
 async function hasRunningMcp(home) {
   const directory3 = await storePath(home, "sessions");
   const files = await fs28.readdir(directory3).catch((error) => {
@@ -9011,7 +8348,7 @@ async function hasRunningMcp(home) {
       const raw = await readStoreJson(home, relative);
       if (raw === null) continue;
       const lease = leaseSchema2.parse(raw);
-      if (lease.host !== os6.hostname()) return true;
+      if (lease.host !== os7.hostname()) return true;
       try {
         process.kill(lease.pid, 0);
         return true;
@@ -9027,7 +8364,7 @@ async function hasRunningMcp(home) {
 }
 async function registerMcp(home) {
   const name = `sessions/${randomUUID9()}.json`;
-  await writeStoreJson(home, name, { pid: process.pid, host: os6.hostname() });
+  await writeStoreJson(home, name, { pid: process.pid, host: os7.hostname() });
   return async () => {
     await fs28.rm(await storePath(home, name), { force: true }).catch(() => {
     });
@@ -9039,7 +8376,7 @@ var init_sessions = __esm({
     "use strict";
     init_validation();
     init_storage();
-    leaseSchema2 = z34.object({ pid: z34.number().int().positive(), host: z34.string() });
+    leaseSchema2 = z31.object({ pid: z31.number().int().positive(), host: z31.string() });
   }
 });
 
@@ -9055,10 +8392,10 @@ __export(install_exports2, {
   upgradeStandalone: () => upgradeStandalone
 });
 import fs29 from "fs/promises";
-import os7 from "os";
-import path33 from "path";
-import { execFile as execFile6, spawn } from "child_process";
-import { promisify as promisify6 } from "util";
+import os8 from "os";
+import path30 from "path";
+import { execFile as execFile4, spawn } from "child_process";
+import { promisify as promisify4 } from "util";
 import { randomUUID as randomUUID10 } from "crypto";
 async function replace(file, content2, mode = 384) {
   const temp = file + ".tmp-" + randomUUID10();
@@ -9072,7 +8409,7 @@ async function replace(file, content2, mode = 384) {
 async function installStandalone(source, progress2, options = {}) {
   progress2?.step("Checking installation files and location");
   const bundle = await verifyBundle(source);
-  const selectedHome = path33.resolve(defaultHome());
+  const selectedHome = path30.resolve(defaultHome());
   if (!options.stageOnly) await fs29.mkdir(selectedHome, { recursive: true });
   const home = await fs29.realpath(selectedHome);
   if (options.stageOnly) {
@@ -9083,9 +8420,9 @@ async function installStandalone(source, progress2, options = {}) {
     );
     const destination = await storePath(home, "versions/" + bundle.manifestHash.slice(0, 24));
     await copyBundle(home, source, destination, bundle);
-    const { stdout } = await promisify6(execFile6)(
-      path33.join(destination, process.platform === "win32" ? "node.exe" : "node"),
-      [path33.join(destination, "app/dist/mason.js"), "--version"],
+    const { stdout } = await promisify4(execFile4)(
+      path30.join(destination, process.platform === "win32" ? "node.exe" : "node"),
+      [path30.join(destination, "app/dist/mason.js"), "--version"],
       { timeout: 3e4, windowsHide: true, env: { ...process.env, MASON_NO_AUTO_UPDATE: "1" } }
     );
     if (stdout.trim() !== bundle.manifest.version)
@@ -9110,14 +8447,14 @@ async function installLocked2(home, source, bundle, progress2, options, alreadyS
   if (!previous)
     for (const file of await fs29.readdir(home)) {
       if (file === ".install-lock") continue;
-      const directory3 = path33.join(home, file);
+      const directory3 = path30.join(home, file);
       const stat = await fs29.lstat(directory3);
       if (!["versions", "bin"].includes(file) || !stat.isDirectory() || (await fs29.readdir(directory3)).length) {
         throw new Error("Mason installation directory is not empty and has no ownership receipt.");
       }
     }
-  const selectedBin = path33.resolve(
-    process.env.MASON_BIN_DIR ?? previous?.bin ?? (process.platform === "win32" ? path33.join(home, "bin") : path33.join(os7.homedir(), ".local/bin"))
+  const selectedBin = path30.resolve(
+    process.env.MASON_BIN_DIR ?? previous?.bin ?? (process.platform === "win32" ? path30.join(home, "bin") : path30.join(os8.homedir(), ".local/bin"))
   );
   await fs29.mkdir(selectedBin, { recursive: true });
   const bin = await fs29.realpath(selectedBin);
@@ -9146,10 +8483,10 @@ $previousToken = $env:MASON_UNINSTALL_TOKEN
 $token = [Guid]::NewGuid().ToString()
 $env:MASON_UNINSTALL_TOKEN = $token
 try {
-  & ${psQuote(path33.join(destination, "node.exe"))} ${psQuote(path33.join(destination, "app/dist/mason.js"))} @args
+  & ${psQuote(path30.join(destination, "node.exe"))} ${psQuote(path30.join(destination, "app/dist/mason.js"))} @args
   $code = $LASTEXITCODE
   if ($code -eq 0 -and $args.Count -eq 1 -and $args[0] -eq 'uninstall') {
-    if ([IO.File]::ReadAllText(${psQuote(path33.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
+    if ([IO.File]::ReadAllText(${psQuote(path30.join(home, ".uninstall-request.txt"))}) -cne $token) { throw 'Mason did not authorize installation cleanup.' }
     Remove-Item -LiteralPath ${psQuote(home)} -Recurse -Force
     Write-Output ${psQuote("Removed standalone installation: " + home)}
   }
@@ -9159,7 +8496,7 @@ finally { $env:MASON_UNINSTALL_TOKEN = $previousToken }
 `
   } : {
     mason: `#!/bin/sh
-exec ${shQuote(path33.join(destination, "node"))} ${shQuote(path33.join(destination, "app/dist/mason.js"))} "$@"
+exec ${shQuote(path30.join(destination, "node"))} ${shQuote(path30.join(destination, "app/dist/mason.js"))} "$@"
 `
   };
   for (const [name, content2] of Object.entries(launchers)) {
@@ -9252,14 +8589,14 @@ exec ${shQuote(path33.join(destination, "node"))} ${shQuote(path33.join(destinat
   };
 }
 async function copyBundle(home, source, destination, bundle) {
-  const exists = await fs29.lstat(destination).then(
+  const exists2 = await fs29.lstat(destination).then(
     () => true,
     (error) => {
       if (hasErrorCode(error, "ENOENT")) return false;
       throw error;
     }
   );
-  if (exists) {
+  if (exists2) {
     await verifyBundle(destination, bundle.manifestHash);
     return;
   }
@@ -9380,7 +8717,7 @@ async function upgradeStandalone(version, progress2) {
     return 0;
   }
   const windows = process.platform === "win32";
-  const script = path33.join(bundle, windows ? "install.ps1" : "install.sh");
+  const script = path30.join(bundle, windows ? "install.ps1" : "install.sh");
   progress2?.stop();
   const code = await new Promise((resolve, reject) => {
     const child = spawn(
@@ -9479,10 +8816,10 @@ __export(updates_exports, {
   updateStatus: () => updateStatus
 });
 import fs30 from "fs/promises";
-import path34 from "path";
+import path31 from "path";
 import { spawn as spawn2 } from "child_process";
 import { randomUUID as randomUUID11 } from "crypto";
-import { z as z35 } from "zod";
+import { z as z32 } from "zod";
 async function boundedDownload(url) {
   const response = await fetch(url, { signal: AbortSignal.timeout(15e3), redirect: "follow" });
   if (!response.ok || !response.body)
@@ -9552,7 +8889,7 @@ async function runInstaller(home, version, digest3, revision) {
   const record = await readInstallation(home);
   const bundle = await storePath(home, "versions/" + record.current);
   await verifyBundle(bundle);
-  const windows = process.platform === "win32", script = path34.join(bundle, windows ? "install.ps1" : "install.sh");
+  const windows = process.platform === "win32", script = path31.join(bundle, windows ? "install.ps1" : "install.sh");
   await new Promise((resolve, reject) => {
     const child = spawn2(
       windows ? "powershell.exe" : "sh",
@@ -9615,7 +8952,7 @@ async function runAutomaticUpdate(home, dependencies = { fetchRelease: fetchVeri
       } catch (error) {
         status.error = error instanceof Error ? error.message : String(error);
       }
-      if (await fs30.access(path34.join(home, "install.json")).then(
+      if (await fs30.access(path31.join(home, "install.json")).then(
         () => true,
         () => false
       ))
@@ -9634,8 +8971,8 @@ async function scheduleAutomaticUpdate() {
       return;
     const bundle = await storePath(home, "versions/" + record.current);
     const child = spawn2(
-      path34.join(bundle, process.platform === "win32" ? "node.exe" : "node"),
-      [path34.join(bundle, "app/dist/mason.js"), "internal-update"],
+      path31.join(bundle, process.platform === "win32" ? "node.exe" : "node"),
+      [path31.join(bundle, "app/dist/mason.js"), "internal-update"],
       { cwd: home, env: process.env, stdio: "ignore", detached: true, windowsHide: true }
     );
     child.on("error", () => {
@@ -9685,8 +9022,8 @@ async function startMcpWithUpdates(start) {
   const session = await prepareStandaloneMcp(current.home);
   if (session.bundle !== current.bundle) {
     const child = spawn2(
-      path34.join(session.bundle, process.platform === "win32" ? "node.exe" : "node"),
-      [path34.join(session.bundle, "app/dist/mason-mcp.js"), ...process.argv.slice(2)],
+      path31.join(session.bundle, process.platform === "win32" ? "node.exe" : "node"),
+      [path31.join(session.bundle, "app/dist/mason-mcp.js"), ...process.argv.slice(2)],
       { stdio: "inherit", windowsHide: true }
     );
     const interrupt = () => {
@@ -9741,24 +9078,24 @@ var init_updates = __esm({
     CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
     RELEASE_AGE_MS = 24 * 60 * 60 * 1e3;
     releaseBase = "https://github.com/adrianczuczka/mason/releases";
-    releaseListSchema = z35.array(
-      z35.object({
-        tag_name: z35.string(),
-        draft: z35.boolean(),
-        prerelease: z35.boolean(),
-        published_at: z35.string().nullable()
+    releaseListSchema = z32.array(
+      z32.object({
+        tag_name: z32.string(),
+        draft: z32.boolean(),
+        prerelease: z32.boolean(),
+        published_at: z32.string().nullable()
       })
     );
-    updateManifestSchema = z35.object({
-      format: z35.literal(1),
-      version: z35.string().regex(/^\d+\.\d+\.\d+$/),
-      publishedAt: z35.string().datetime(),
-      assets: z35.record(z35.string().regex(/^[a-f0-9]{64}$/))
+    updateManifestSchema = z32.object({
+      format: z32.literal(1),
+      version: z32.string().regex(/^\d+\.\d+\.\d+$/),
+      publishedAt: z32.string().datetime(),
+      assets: z32.record(z32.string().regex(/^[a-f0-9]{64}$/))
     }).strict();
-    statusSchema2 = z35.object({
-      lastAttempt: z35.number(),
-      availableVersion: z35.string().optional(),
-      error: z35.string().optional()
+    statusSchema2 = z32.object({
+      lastAttempt: z32.number(),
+      availableVersion: z32.string().optional(),
+      error: z32.string().optional()
     });
   }
 });
@@ -9784,34 +9121,34 @@ function createProgress(options = {}) {
   const interactive = options.interactive ?? (!!process.stderr.isTTY && process.env.TERM !== "dumb" && !process.env.CI);
   const columns = options.columns ?? (() => process.stderr.columns || 80);
   const frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
-  let message2 = "", started = 0, frame = 0;
+  let message = "", started = 0, frame = 0;
   let timer;
   const elapsed = () => {
     const seconds = Math.floor((Date.now() - started) / 1e3);
     return seconds ? ` (${seconds}s)` : "";
   };
   const render = (prefix) => {
-    const text2 = `${prefix} ${message2}${elapsed()}`;
+    const text2 = `${prefix} ${message}${elapsed()}`;
     const width = Math.max(1, columns() - 1);
     write("\r\x1B[2K" + (text2.length > width ? text2.slice(0, width - 1) + "\u2026" : text2));
   };
   const stop = (success = true) => {
     if (timer) clearInterval(timer);
     timer = void 0;
-    if (message2 && interactive) {
+    if (message && interactive) {
       render(success ? "\u2713" : "\u2717");
       write("\n");
     }
-    message2 = "";
+    message = "";
   };
   return {
     step(next) {
       stop();
-      message2 = next.replace(/[\x00-\x1f\x7f-\x9f]/g, " ");
+      message = next.replace(/[\x00-\x1f\x7f-\x9f]/g, " ");
       started = Date.now();
       frame = 0;
       if (!interactive) {
-        write(`Mason: ${message2}\u2026
+        write(`Mason: ${message}\u2026
 `);
         return;
       }
@@ -9827,11 +9164,12 @@ function createProgress(options = {}) {
 
 // src/automation/cli.ts
 init_profile();
-var TEARDOWN_USAGE = `Usage: mason teardown [options]
+var TEARDOWN_USAGE = `Usage: mason teardown [--project] [options]
 
-Disconnect Mason from this Git project. Defaults to all project hosts.
+Disconnect Mason locally. Defaults to all locally configured hosts.
 
   --host codex|claude         Disconnect only this host
+  --project                  Remove shared integration files for review and commit
   --dir <path>               Project directory (defaults to cwd; subdirectories work)
   --dry-run                  Preview changes without writing
   --json                     Machine-readable changes and diagnostics
@@ -9844,7 +9182,7 @@ var STATS_USAGE = `Usage: mason stats [options]
 
 Show aggregate local observations, or inspect one session.
 
-  --enable | --disable       Enable/disable collection (setup enables it)
+  --enable | --disable       Enable/disable collection (disabled by default)
   --json                     Include session/finding IDs and evidence paths
   --dir <path>               Project directory (defaults to cwd)
   --session <id>             Filter to one retained session
@@ -9852,10 +9190,11 @@ Show aggregate local observations, or inspect one session.
                              Supply feedback without changing audit status
 
 No uploads. Observed resolution does not establish causation.`;
-var USAGE = `Usage: mason auto <setup|teardown|install|config|status|check|hook|stats> [options]
+var USAGE = `Usage: mason <init|setup|teardown|install|config|status|check|hook|stats> [options]
 
-  setup [--host claude|codex]  Connect MCP, instructions and hooks to mason on PATH; retain the initial audit
-  teardown [--host claude|codex] Disconnect one host or all project hosts; retain knowledge and evidence
+  setup [--host claude|codex]  Activate existing shared configuration locally
+  init --host claude|codex     Prepare shared configuration for review and commit
+  teardown [--host claude|codex] Disconnect locally; --project removes shared configuration
   install --host claude|codex  Merge lifecycle hooks into this project's host config
   config --host claude|codex   Print the host config without writing
   config --stop-block off|drift Set local Claude Stop review behavior (default: drift)
@@ -9867,12 +9206,13 @@ var USAGE = `Usage: mason auto <setup|teardown|install|config|status|check|hook|
 
   --dir <path>                Project directory (defaults to cwd)
   --command <prefix>          Installed executable prefix for install/config
-  --dry-run                   Preview teardown without writing
+  --dry-run                   Preview init or teardown without writing
   --json                      Machine-readable output (status also uses JSON when piped)
   --profile                   Local phase timings on stderr for check/hook; no file contents
 
 check exits 0 for verified checks, 1 for issues, 2 for incomplete/unavailable.
 teardown exits 0 for complete/no-op, 2 when cleanup needs attention (also in dry runs).
+Hooks check decision anchors only, without creating or verifying repair baselines.
 Hooks exit 0; Claude Stop can block once for uninspected session anchor edits.
 Re-entry and Codex remain advisory; failed captures are reported explicitly.
 Local evidence is written under .mason/reports/. No LLM calls or source edits.`;
@@ -9887,6 +9227,7 @@ var parseCli = (argv) => parseArgs({
     json: { type: "boolean" },
     help: { type: "boolean", short: "h" },
     "dry-run": { type: "boolean" },
+    project: { type: "boolean" },
     profile: { type: "boolean" },
     enable: { type: "boolean" },
     disable: { type: "boolean" },
@@ -9922,6 +9263,8 @@ async function runAutomationCli(argv, stdin = "", io = defaultIo, options = {})
     [action] = positionals;
     if (values.profile && !["check", "hook"].includes(action))
       throw new Error("--profile applies only to check/hook.");
+    if (values.project !== void 0 && action !== "teardown")
+      throw new Error("--project applies only to teardown.");
     const trackingOptions = [
       values.enable,
       values.disable,
@@ -9933,8 +9276,8 @@ async function runAutomationCli(argv, stdin = "", io = defaultIo, options = {})
       throw new Error("Tracking options apply only to stats.");
     const measured = (run) => values.profile ? withProfile(run, io.err) : run();
     const dir = values.dir ?? process.cwd();
-    if (values["dry-run"] !== void 0 && action !== "teardown")
-      throw new Error("--dry-run applies only to teardown.");
+    if (values["dry-run"] !== void 0 && !["init", "teardown"].includes(action))
+      throw new Error("--dry-run applies only to init/teardown.");
     if (values["stop-block"] !== void 0) {
       if (action !== "config" || values.host || values.command)
         throw new Error(
@@ -9949,7 +9292,8 @@ async function runAutomationCli(argv, stdin = "", io = defaultIo, options = {})
       const { teardownProject: teardownProject2, summarizeTeardown: summarizeTeardown2 } = await Promise.resolve().then(() => (init_teardown(), teardown_exports));
       const result = await teardownProject2(dir, {
         host: values.host === void 0 ? void 0 : hostSchema.parse(values.host),
-        dryRun: values["dry-run"]
+        dryRun: values["dry-run"],
+        project: values.project
       });
       io.out(values.json ? JSON.stringify(result, null, 2) : summarizeTeardown2(result));
       return result.status === "complete" ? 0 : 2;
@@ -9964,10 +9308,10 @@ async function runAutomationCli(argv, stdin = "", io = defaultIo, options = {})
       if (output) io.out(JSON.stringify(output));
       return 0;
     }
-    if (action === "setup") {
+    if (action === "setup" || action === "init") {
       if (values.command)
         throw new Error("--command applies to install/config, not managed setup.");
-      const { setupProject: setupProject2, summarizeSetup: summarizeSetup2 } = await Promise.resolve().then(() => (init_setup(), setup_exports));
+      const { setupProject: setupProject2, summarizeSetup: summarizeSetup2, initializeProject: initializeProject2, summarizeInitialization: summarizeInitialization2 } = await Promise.resolve().then(() => (init_setup(), setup_exports));
       const host = values.host ? hostSchema.parse(values.host) : void 0;
       if (!values.json)
         progress2 = createProgress(
@@ -9976,9 +9320,15 @@ async function runAutomationCli(argv, stdin = "", io = defaultIo, options = {})
             interactive: false
           }
         );
-      const result = await setupProject2(dir, { host, progress: progress2 });
-      progress2?.stop();
-      io.out(values.json ? JSON.stringify(result, null, 2) : summarizeSetup2(result));
+      if (action === "init") {
+        const result = await initializeProject2(dir, { host, dryRun: values["dry-run"], progress: progress2 });
+        progress2?.stop();
+        io.out(values.json ? JSON.stringify(result, null, 2) : summarizeInitialization2(result));
+      } else {
+        const result = await setupProject2(dir, { host, progress: progress2 });
+        progress2?.stop();
+        io.out(values.json ? JSON.stringify(result, null, 2) : summarizeSetup2(result));
+      }
       return 0;
     }
     if (action === "install" || action === "config") {
@@ -10042,16 +9392,16 @@ async function runAutomationCli(argv, stdin = "", io = defaultIo, options = {})
     return report.status === "verified" ? 0 : report.status === "issues-remain" ? 1 : 2;
   } catch (error) {
     progress2?.stop(false);
-    const message2 = action === "setup" ? "Mason setup incomplete: " + automationFailure(error).message + ". Rerun the same setup command to resume; retained audit evidence is preserved." : action === "teardown" ? "Mason teardown incomplete: " + automationFailure(error).message + ". Inspect the reported input, then rerun teardown; knowledge and repair evidence are retained." : failureMessage(error);
+    const message = action === "setup" ? "Mason setup incomplete: " + automationFailure(error).message + ". Rerun the same setup command to resume configuration." : action === "teardown" ? "Mason teardown incomplete: " + automationFailure(error).message + ". Inspect the reported input, then rerun teardown; knowledge and repair evidence are retained." : failureMessage(error);
     if (action === "hook" || isHookCommand(argv)) {
-      io.out(JSON.stringify({ systemMessage: message2 }));
+      io.out(JSON.stringify({ systemMessage: message }));
       return 0;
     }
     if (argv.includes("--json"))
       io.out(
         JSON.stringify({
           version: 1,
-          ...["setup", "teardown"].includes(action) ? {
+          ...["init", "setup", "teardown"].includes(action) ? {
             action,
             status: "incomplete",
             next: "Inspect the reported input, then rerun the same command to resume."
@@ -10059,7 +9409,7 @@ async function runAutomationCli(argv, stdin = "", io = defaultIo, options = {})
           failure: automationFailure(error)
         })
       );
-    else io.err(message2);
+    else io.err(message);
     return 2;
   }
 }
@@ -10069,15 +9419,18 @@ var inputArgs = process.argv.slice(2);
 var managedLaunch = inputArgs[0] === "--setup-host";
 var setupHost = managedLaunch ? inputArgs.splice(0, 2)[1] : void 0;
 var [command, ...args] = inputArgs;
-var usage = `Mason ${"0.21.0"}
+var usage = `Mason ${"0.22.0"}
 
 Usage: mason <command> [options]
 
-  setup --host codex|claude   Connect this project to your assistant
-  teardown [--host codex|claude] Disconnect project integrations; retain knowledge
+  setup --host codex|claude   Activate this checkout without editing shared files
+  init --host codex|claude    Prepare shared configuration for review
+  teardown [--host codex|claude] Disconnect locally; --project removes shared configuration
   status                     Show configuration, observed use and verification
   stats                      Show local stats and feedback
-  auto                       Configure and run lifecycle hooks
+  install --host codex|claude  Install lifecycle hooks
+  config                     Configure lifecycle hooks and Stop behavior
+  hook --host codex|claude    Process an assistant lifecycle event
   check                      Resume and verify retained documentation findings
   audit                      Audit project instructions
   review --base <ref>         Review committed changes
@@ -10091,20 +9444,21 @@ Usage: mason <command> [options]
 
 Use mason <command> --help for options. npm users can also use
 mason-audit, mason-review, mason-drift, mason-hook and mason-mcp.`;
+var lifecycleHook = command === "auto" && isHookCommand(args) || command === "hook" && !args.includes("--print-config") && (managedLaunch || args.length > 0);
 var progress;
 try {
   if (managedLaunch) {
-    if (!setupHost || !["codex", "claude"].includes(setupHost) || !["mcp", "auto"].includes(command))
+    if (!setupHost || !["codex", "claude"].includes(setupHost) || !(["mcp", "auto"].includes(command) || lifecycleHook))
       throw new Error("Invalid setup invocation.");
-    if (!(command === "auto" && isHookCommand(args))) {
+    if (!lifecycleHook) {
       const { prepareLaunch: prepareLaunch2 } = await Promise.resolve().then(() => (init_launcher(), launcher_exports));
       await prepareLaunch2(setupHost, { allowInactive: command === "mcp" });
     }
   }
   if (command === "internal-integration-version")
-    console.log(JSON.stringify({ protocol: 1, version: "0.21.0" }));
+    console.log(JSON.stringify({ protocol: 1, version: "0.22.0" }));
   else if (!command || ["--help", "-h", "help"].includes(command)) console.log(usage);
-  else if (["--version", "-v"].includes(command)) console.log("0.21.0");
+  else if (["--version", "-v"].includes(command)) console.log("0.22.0");
   else if (command === "internal-update") {
     if (args.length) throw new Error("internal-update takes no arguments.");
     const { currentInstallation: currentInstallation2 } = await Promise.resolve().then(() => (init_state(), state_exports));
@@ -10211,7 +9565,9 @@ Automatic updates: ${status.effective ? "enabled" : "inactive"} (preference: ${s
           (process.platform === "win32" ? "Finishing installation cleanup after runtime exit: " : "Removed standalone installation: ") + await uninstallStandalone2() + ". Project configuration and knowledge were retained. Reinstall Mason to use its integrations."
         );
     }
-  } else if (["setup", "teardown", "status", "check", "stats", "auto"].includes(command)) {
+  } else if (["init", "setup", "teardown", "status", "check", "stats", "install", "config", "auto"].includes(
+    command
+  ) || lifecycleHook) {
     const forwarded = command === "auto" ? args : [command, ...args];
     let input = "";
     if (isHookCommand(forwarded) && !process.stdin.isTTY)
@@ -10225,10 +9581,6 @@ Automatic updates: ${status.effective ? "enabled" : "inactive"} (preference: ${s
     process.exitCode = await runAutomationCli(forwarded, input, void 0, {
       managedHost: managedLaunch ? setupHost : void 0
     });
-    if (command === "setup" && process.exitCode === 0 && !args.includes("--help")) {
-      const { scheduleAutomaticUpdate: scheduleAutomaticUpdate2 } = await Promise.resolve().then(() => (init_updates(), updates_exports));
-      void scheduleAutomaticUpdate2();
-    }
   } else if (["audit", "review", "drift", "hook", "mcp"].includes(command)) {
     const binary = new URL(`./mason-${command}.js`, import.meta.url);
     process.argv = [process.execPath, fileURLToPath2(binary), ...args];
@@ -10236,12 +9588,12 @@ Automatic updates: ${status.effective ? "enabled" : "inactive"} (preference: ${s
   } else throw new Error("Unknown command: " + command + ". Run mason --help.");
 } catch (error) {
   progress?.stop(false);
-  const message2 = "Mason: " + (error instanceof Error ? error.message : String(error));
-  if (command === "auto" && isHookCommand(args)) {
-    console.log(JSON.stringify({ systemMessage: message2 + " Verification was not established." }));
+  const message = "Mason: " + (error instanceof Error ? error.message : String(error));
+  if (lifecycleHook) {
+    console.log(JSON.stringify({ systemMessage: message + " Verification was not established." }));
     process.exitCode = 0;
   } else {
-    console.error(message2);
+    console.error(message);
     process.exitCode = 2;
   }
 }