mason-context 0.21.0 → 0.23.0

package/dist/mason-audit.js

@@ -405,11 +405,12 @@ async function storePath(root, relative, createParents = false) {
   }
   return current;
 }
-async function readStoreJson(root, relative) {
+async function readStoreJson(root, relative, maxBytes = STORE_MAX_BYTES) {
   try {
     const file = await storePath(root, relative);
-    const raw = await readBoundedFile(file, 10 * 1024 * 1024);
-    if (raw === null) throw new Error("file is not regular or exceeds 10 MiB");
+    const raw = await readBoundedFile(file, maxBytes);
+    if (raw === null)
+      throw new Error(`file is not regular or exceeds ${maxBytes / 1024 / 1024} MiB`);
     const parsed = JSON.parse(raw);
     if (parsed === null) throw new Error("expected a JSON object, received null");
     return parsed;
@@ -421,9 +422,9 @@ async function readStoreJson(root, relative) {
     );
   }
 }
-async function writeStoreJson(root, relative, value) {
-  const payload = JSON.stringify(value, null, 2) + "\n";
-  if (Buffer.byteLength(payload) > 10 * 1024 * 1024) {
+async function writeStoreJson(root, relative, value, options = {}) {
+  const payload = JSON.stringify(value, null, options.compact ? void 0 : 2) + "\n";
+  if (Buffer.byteLength(payload) > STORE_MAX_BYTES) {
     throw new Error(`Mason store ${relative} exceeds 10 MiB`);
   }
   const file = await storePath(root, relative, true);
@@ -441,11 +442,13 @@ async function writeStoreJson(root, relative, value) {
     await fs2.rm(temporary, { force: true });
   }
 }
+var STORE_MAX_BYTES;
 var init_storage = __esm({
   "src/utils/storage.ts"() {
     "use strict";
     init_paths();
     init_files();
+    STORE_MAX_BYTES = 10 * 1024 * 1024;
   }
 });
 
@@ -775,17 +778,7 @@ var init_lock = __esm({
   }
 });
 
-// src/test-map.ts
-import path6 from "path";
-var init_test_map = __esm({
-  "src/test-map.ts"() {
-    "use strict";
-    init_files();
-  }
-});
-
 // src/snapshot/snapshot.ts
-import path7 from "path";
 import { z as z2 } from "zod";
 async function getCurrentGitHash(rootDir) {
   try {
@@ -803,11 +796,9 @@ var init_snapshot = __esm({
     "use strict";
     init_git_read();
     init_files();
-    init_files();
     init_storage();
     init_lock();
     init_paths();
-    init_test_map();
     repoPath = z2.string().refine((value) => normalizeRepoPath(value) !== null, "Expected a relative repository path");
     verificationFields = {
       refreshedHash: z2.string().optional(),
@@ -838,7 +829,7 @@ var init_snapshot = __esm({
 
 // src/drift/drift.ts
 import fs5 from "fs/promises";
-import path8 from "path";
+import path6 from "path";
 function parseChanges(output) {
   const fields = output.split("\0");
   const changes = [];
@@ -906,7 +897,7 @@ var init_drift = __esm({
 });
 
 // src/audit/commands.ts
-import path9 from "path";
+import path7 from "path";
 function splitCommands(line) {
   const parts = [];
   let quote = "", start = 0;
@@ -942,7 +933,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
     const cd = text2.match(/^cd\s+(.+)$/);
     if (cd) {
       const directory = literal(cd[1]);
-      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path9.posix.join(cwd ?? ".", directory);
+      cwd = directory === null || cwd === null || /\s/.test(directory) && !/^["']/.test(cd[1]) ? null : path7.posix.join(cwd ?? ".", directory);
       continue;
     }
     for (const match of text2.matchAll(COMMAND)) {
@@ -954,7 +945,7 @@ function commandClaims(line, lineNo, cwd, shell = false) {
         scopeUnknown = "Unsupported shell wrapper or options before the script.";
       if (selector) {
         const selected = literal(selector[1]);
-        directory = selected === null || cwd === null ? null : path9.posix.join(cwd ?? ".", selected);
+        directory = selected === null || cwd === null ? null : path7.posix.join(cwd ?? ".", selected);
       } else if (flags) scopeUnknown = "Unsupported package-manager options before run: " + flags;
       const tail = text2.slice(match.index + match[0].length).split(/\s--(?:\s|$)/)[0];
       if (/(?:^|\s)(?:--workspace(?:s)?|-w|--filter|-F|--prefix|--dir|-C|--if-present)(?:\s|=|$)/.test(
@@ -989,7 +980,7 @@ var init_commands = __esm({
     );
     literal = (value) => {
       const unquoted = value.replace(/^(["'])(.*)\1$/, "$2");
-      return /[$`*?[\]{}~\\\x00-\x1f]/.test(unquoted) || path9.posix.isAbsolute(unquoted) ? null : unquoted;
+      return /[$`*?[\]{}~\\\x00-\x1f]/.test(unquoted) || path7.posix.isAbsolute(unquoted) ? null : unquoted;
     };
   }
 });
@@ -1372,7 +1363,7 @@ var init_git = __esm({
 
 // src/audit/docs.ts
 import fs6 from "fs/promises";
-import path10 from "path";
+import path8 from "path";
 import fg5 from "fast-glob";
 async function dirtyDocs(resolvedRoot, files) {
   if (!files.length) return /* @__PURE__ */ new Set();
@@ -1468,15 +1459,15 @@ async function localDocPaths(root) {
     }
     for (const entry of entries)
       if (/^(?:agents|claude|readme)\.md$/i.test(entry.name)) {
-        paths.push(path10.posix.join(dir, entry.name));
+        paths.push(path8.posix.join(dir, entry.name));
       }
   }
   return paths;
 }
 function documentScope(file) {
-  if (!/^(readme|agents|claude)\.md$/i.test(path10.posix.basename(file))) return ".";
-  const parent = path10.posix.dirname(file);
-  return path10.posix.basename(parent).toLowerCase() === ".claude" ? path10.posix.dirname(parent) : parent;
+  if (!/^(readme|agents|claude)\.md$/i.test(path8.posix.basename(file))) return ".";
+  const parent = path8.posix.dirname(file);
+  return path8.posix.basename(parent).toLowerCase() === ".claude" ? path8.posix.dirname(parent) : parent;
 }
 async function discoverDocs(resolvedRoot) {
   return profilePhase("audit.documents", () => readDocs(resolvedRoot));
@@ -1499,7 +1490,7 @@ async function readDocs(resolvedRoot) {
             path: candidate,
             content,
             scope: documentScope(candidate),
-            kind: /^readme\.md$/i.test(path10.posix.basename(candidate)) ? "readme" : /^(agents|claude)\.md$/i.test(path10.posix.basename(candidate)) ? "instructions" : "guide",
+            kind: /^readme\.md$/i.test(path8.posix.basename(candidate)) ? "readme" : /^(agents|claude)\.md$/i.test(path8.posix.basename(candidate)) ? "instructions" : "guide",
             lineCount: content.split("\n").length,
             lastCommit,
             dirty: dirty.has(candidate),
@@ -1528,15 +1519,15 @@ var init_docs = __esm({
 
 // src/audit/scope.ts
 import fs7 from "fs/promises";
-import path11 from "path";
+import path9 from "path";
 function scopedPath(directory, value) {
-  if (path11.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value))
+  if (path9.posix.isAbsolute(value) || value.includes("\\") || /[\x00-\x1f]/.test(value))
     return null;
-  const resolved = path11.posix.normalize(path11.posix.join(directory, value));
+  const resolved = path9.posix.normalize(path9.posix.join(directory, value));
   return resolved === ".." || resolved.startsWith("../") ? null : resolved;
 }
 function pathClaimScope(doc, claim) {
-  const directory = claim.relativeTo === "document" ? path11.posix.dirname(doc) : documentScope(doc);
+  const directory = claim.relativeTo === "document" ? path9.posix.dirname(doc) : documentScope(doc);
   const local = scopedPath(directory, claim.path);
   if (!local) return null;
   const candidates = claim.relativeTo === "document" || directory === "." ? [local] : [...new Set([local, scopedPath(".", claim.path)].filter((p) => p !== null))];
@@ -1570,7 +1561,7 @@ var init_scope = __esm({
 });
 
 // src/audit/checks/deleted-reference.ts
-import path12 from "path";
+import path10 from "path";
 async function checkDeletedReferences(ctx) {
   const result = emptyResult();
   for (const doc of ctx.docs) {
@@ -1605,7 +1596,7 @@ async function checkDeletedReferences(ctx) {
         scope.candidates.map(async (file) => ({
           file,
           tracked: await lastCommitOf(ctx.root, file),
-          parent: await pathExists(ctx.root, path12.posix.dirname(file))
+          parent: await pathExists(ctx.root, path10.posix.dirname(file))
         }))
       );
       const candidate = candidates.find((c) => c.tracked || renames.has(c.file)) ?? candidates.find((c) => c.parent);
@@ -1658,7 +1649,7 @@ var init_deleted_reference = __esm({
 // src/audit/checks/new-module.ts
 import fg6 from "fast-glob";
 import fs8 from "fs/promises";
-import path13 from "path";
+import path11 from "path";
 function escapeRegExp(text2) {
   return text2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -1694,7 +1685,7 @@ async function checkNewModules(ctx) {
 }
 function moduleDocumentation(docs) {
   return docs.map(
-    (doc) => doc.content + "\n" + (path13.posix.dirname(doc.path) === "." ? "" : path13.posix.dirname(doc.path) + "/")
+    (doc) => doc.content + "\n" + (path11.posix.dirname(doc.path) === "." ? "" : path11.posix.dirname(doc.path) + "/")
   ).join("\n");
 }
 function moduleCandidates(root, combinedDocs) {
@@ -1720,9 +1711,9 @@ async function collectModuleCandidates(root, combinedDocs) {
           });
           const dirs = entries.filter(
             (entry) => (entry.isDirectory() || entry.isSymbolicLink() && sources.some(
-              (file) => file.startsWith(path13.posix.join(dir, entry.name) + "/")
+              (file) => file.startsWith(path11.posix.join(dir, entry.name) + "/")
             )) && !entry.name.startsWith(".") && !DIR_DENYLIST.has(entry.name)
-          ).map((entry) => path13.posix.join(dir, entry.name));
+          ).map((entry) => path11.posix.join(dir, entry.name));
           byParent.set(dir, dirs);
         })
       );
@@ -1742,7 +1733,7 @@ async function collectModuleCandidates(root, combinedDocs) {
           onlyDirectories: true,
           label: "Module directory discovery",
           select: (file) => visible.has(file)
-        })).map((file) => path13.posix.basename(file))
+        })).map((file) => path11.posix.basename(file))
       );
     }
     return result;
@@ -1824,7 +1815,7 @@ var init_new_module = __esm({
 });
 
 // src/audit/checks/stale-count.ts
-import path14 from "path";
+import path12 from "path";
 async function countGradleModules(root) {
   for (const name of ["settings.gradle.kts", "settings.gradle"]) {
     const content = await readAuditInput(root, name);
@@ -1861,7 +1852,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "package.json workspaces",
-        members: matched.map((m) => path14.dirname(m)).sort()
+        members: matched.map((m) => path12.dirname(m)).sort()
       };
     }
   }
@@ -1892,7 +1883,7 @@ async function countNpmWorkspaces(root) {
       return {
         actual: matched.length,
         countedFrom: "pnpm-workspace.yaml",
-        members: matched.map((m) => path14.dirname(m)).sort()
+        members: matched.map((m) => path12.dirname(m)).sort()
       };
     }
   }
@@ -1912,8 +1903,8 @@ async function countCargoCrates(root) {
         ignore: ["**/target/**"],
         label: "Cargo workspace discovery"
       });
-      for (const m of matched) members.add(path14.dirname(m));
-    } else if (await readAuditInput(root, path14.posix.join(entry, "Cargo.toml")) !== null) {
+      for (const m of matched) members.add(path12.dirname(m));
+    } else if (await readAuditInput(root, path12.posix.join(entry, "Cargo.toml")) !== null) {
       members.add(entry);
     }
   }
@@ -1933,7 +1924,7 @@ async function resolveCountSource(root, claim) {
 }
 async function resolveDocCountSource(root, doc, claim) {
   const scope = documentScope(doc);
-  const source = await resolveCountSource(path14.join(root, scope), claim);
+  const source = await resolveCountSource(path12.join(root, scope), claim);
   if (!source || scope === ".") return source;
   return {
     ...source,
@@ -1986,7 +1977,7 @@ var init_stale_count = __esm({
 });
 
 // src/audit/checks/dead-command.ts
-import path15 from "path";
+import path13 from "path";
 function scriptsOf(raw) {
   try {
     const pkg = JSON.parse(raw);
@@ -2030,7 +2021,7 @@ async function commandInputs(root, docs) {
       }
       let cursor = directory;
       while (true) {
-        const manifest = path15.posix.join(cursor, "package.json");
+        const manifest = path13.posix.join(cursor, "package.json");
         scope.candidates.push(manifest);
         const raw = await read(manifest);
         if (raw !== null) {
@@ -2041,7 +2032,7 @@ async function commandInputs(root, docs) {
           break;
         }
         if (claim.directory !== void 0 || cursor === ".") break;
-        cursor = path15.posix.dirname(cursor);
+        cursor = path13.posix.dirname(cursor);
       }
       if (!resolution.manifest && !resolution.problem) {
         resolution.problem = `No package.json for the command's scope (${directory}).`;
@@ -2127,7 +2118,7 @@ var init_dead_command = __esm({
 });
 
 // src/audit/dependency-claims.ts
-import path16 from "path";
+import path14 from "path";
 import { parse as parseToml } from "smol-toml";
 function dependencyText(content) {
   return content.replace(
@@ -2138,7 +2129,7 @@ function dependencyText(content) {
 function declarations(file, source) {
   const result = /* @__PURE__ */ new Map();
   if (!source) return result;
-  if (path16.posix.basename(file) === "package.json") {
+  if (path14.posix.basename(file) === "package.json") {
     const json = JSON.parse(source);
     if (!isRecord(json)) throw new Error("Invalid package manifest");
     for (const section of [
@@ -2470,7 +2461,12 @@ async function captureAnchorScopes(root, scopes2) {
     );
     const inventory = access.inventory();
     if (!inventory) throw new Error("Git anchor inventory unavailable");
-    const ignored = await inspectionGit(
+    const visible = indexMatchingPaths(
+      union.map((anchor) => [anchor]),
+      inventory
+    );
+    const hidden = new Set(union.filter((_, index) => !visible[index].length));
+    const ignored = hidden.size ? (await inspectionGit(
       [
         "ls-files",
         "-z",
@@ -2478,13 +2474,11 @@ async function captureAnchorScopes(root, scopes2) {
         "--ignored",
         "--exclude-standard",
         "--",
-        ...union.map((anchor) => `:(literal)${anchor}`)
+        ...[...hidden].map((anchor) => `:(literal)${anchor}`)
       ],
       { cwd: root, maxBuffer: 8 * 1024 * 1024 }
-    );
-    const files = [
-      .../* @__PURE__ */ new Set([...inventory, ...ignored.stdout.split("\0").filter(Boolean)])
-    ].sort();
+    )).stdout.split("\0").filter(Boolean) : [];
+    const files = [.../* @__PURE__ */ new Set([...inventory, ...ignored])].sort();
     const patterns = await Promise.all(
       union.map(async (anchor) => {
         const literal2 = fg7.escapePath(anchor);
@@ -2500,7 +2494,7 @@ async function captureAnchorScopes(root, scopes2) {
     const filesByScope = new Map(
       scopes2.map((scope, index) => [JSON.stringify([...new Set(scope)].sort()), indexed[index]])
     );
-    return { filesByScope, eligible };
+    return { filesByScope, eligible, hidden, ignored: new Set(ignored) };
   };
   return Promise.all(
     scopes2.map((scope) => {
@@ -2512,8 +2506,10 @@ async function captureAnchorScopes(root, scopes2) {
           const capture = { anchors, files: {}, complete: true };
           if (!anchors.length) return capture;
           try {
-            const { eligible, filesByScope } = await (context ??= prepareContext());
-            const files = filesByScope.get(JSON.stringify(anchors));
+            const { eligible, filesByScope, hidden, ignored } = await (context ??= prepareContext());
+            const files = filesByScope.get(JSON.stringify(anchors)).filter(
+              (file) => !ignored.has(file) || anchors.some((anchor) => hidden.has(anchor) && anchorMatches(anchor, file))
+            );
             if (files.length > 2e3) return { ...capture, complete: false };
             for (const file of files) {
               const evidence = await inspectionRead(
@@ -2591,7 +2587,7 @@ var init_anchors = __esm({
 });
 
 // src/context/lexical.ts
-import path17 from "path";
+import path15 from "path";
 var init_lexical = __esm({
   "src/context/lexical.ts"() {
     "use strict";
@@ -2660,8 +2656,19 @@ function decisionProvenance(record, freshness = "unknown") {
     } : null
   };
 }
-function decisionInspectionDigest(record) {
+function decisionInspectionDigest(record, scope = "all") {
   const effective = effectiveDecision(record);
+  if (scope === "operative")
+    return createHash2("sha256").update(
+      JSON.stringify([
+        "operative",
+        record.status,
+        decisionApproval(effective),
+        effective.version === 2 ? effective.revision : 0,
+        decisionContent(effective),
+        effective.refreshedHash
+      ])
+    ).digest("hex");
   return createHash2("sha256").update(
     JSON.stringify([
       record.status,
@@ -2673,8 +2680,10 @@ function decisionInspectionDigest(record) {
     ])
   ).digest("hex");
 }
-function latestDecisionInspection(record) {
-  return record.version === 2 ? record.inspections?.filter((i) => i.decisionDigest === decisionInspectionDigest(record)).at(-1) : void 0;
+function latestDecisionInspection(record, scope = "all") {
+  return record.version === 2 ? record.inspections?.filter(
+    (i) => (scope === "operative" || i.scope !== "operative") && i.decisionDigest === decisionInspectionDigest(record, i.scope ?? "all")
+  ).at(-1) : void 0;
 }
 var text, decisionSourceSchema, attributionSchema, contentSchema, approvalSchema, statusSchema, reviewEvidenceSchema, eventSchema, legacySchema, currentSchema, decisionSchema;
 var init_provenance = __esm({
@@ -2760,6 +2769,7 @@ var init_provenance = __esm({
           inspector: text(200),
           note: text(1500),
           outcome: z4.literal("no_contradiction_found"),
+          scope: z4.literal("operative").optional(),
           decisionDigest: z4.string().regex(/^[a-f0-9]{64}$/),
           headHash: z4.string(),
           capture: anchorCaptureSchema
@@ -2816,7 +2826,7 @@ var init_provenance = __esm({
 
 // src/decisions/decisions.ts
 import fs10 from "fs/promises";
-import path18 from "path";
+import path16 from "path";
 import { createHash as createHash3 } from "crypto";
 import { z as z5 } from "zod";
 async function readDecisionInputs(rootDir) {
@@ -2908,10 +2918,39 @@ var init_decisions = __esm({
   }
 });
 
+// src/decisions/excerpts.ts
+import { createHash as createHash4 } from "crypto";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+function driftBaseline(record) {
+  const effective = effectiveDecision(record);
+  const inspection = latestDecisionInspection(
+    record,
+    decisionApproval(effective) === "accepted" ? "operative" : "all"
+  );
+  return {
+    record: effective,
+    capture: inspection?.capture ?? (effective.version === 2 ? effective.capture : void 0),
+    commits: [inspection?.headHash, effective.refreshedHash].filter(
+      (hash) => !!hash && /^[a-f0-9]{40,64}$/.test(hash)
+    )
+  };
+}
+var exec;
+var init_excerpts = __esm({
+  "src/decisions/excerpts.ts"() {
+    "use strict";
+    init_files();
+    init_paths();
+    init_provenance();
+    exec = promisify2(execFile2);
+  }
+});
+
 // src/decisions/drift.ts
-import path19 from "path";
+import path17 from "path";
 async function computeDecisionDrift(rootDir, decisions) {
-  const resolvedRoot = path19.resolve(rootDir);
+  const resolvedRoot = path17.resolve(rootDir);
   const store = decisions ? { records: decisions, diagnostics: [] } : await loadDecisionStore(resolvedRoot);
   const report = {
     historyAvailable: true,
@@ -2926,11 +2965,15 @@ async function computeDecisionDrift(rootDir, decisions) {
   ]);
   const changesByHash = /* @__PURE__ */ new Map();
   const baselines = store.records.filter((record) => record.status === "active").flatMap((record) => {
-    const inspection = latestDecisionInspection(record);
-    if (inspection) return [inspection.capture];
-    return [.../* @__PURE__ */ new Set([effectiveDecision(record), record])].flatMap(
-      (candidate) => candidate.version === 2 && candidate.capture ? [candidate.capture] : []
-    );
+    const effective = effectiveDecision(record);
+    return [.../* @__PURE__ */ new Set([effective, record])].flatMap((candidate) => {
+      const inspection = latestDecisionInspection(
+        record,
+        candidate === effective && decisionApproval(effective) === "accepted" ? "operative" : "all"
+      );
+      const capture = inspection?.capture ?? (candidate.version === 2 ? candidate.capture : void 0);
+      return capture ? [capture] : [];
+    });
   });
   const captures = await captureAnchorScopes(
     resolvedRoot,
@@ -2968,13 +3011,15 @@ async function computeDecisionDrift(rootDir, decisions) {
   };
   for (const record of store.records) {
     if (record.status !== "active") continue;
-    const effective = effectiveDecision(record);
-    const inspection = latestDecisionInspection(record);
-    const state = await inspect(effective, inspection?.capture);
+    const baseline = driftBaseline(record);
+    const state = await inspect(baseline.record, baseline.capture);
     report.freshness[record.id] = state.freshness;
     if (state.changedFiles.length) report.staleDecisions[record.id] = state.changedFiles;
-    if (effective !== record)
-      (report.pendingProposals ??= {})[record.id] = await inspect(record, inspection?.capture);
+    if (baseline.record !== record)
+      (report.pendingProposals ??= {})[record.id] = await inspect(
+        record,
+        latestDecisionInspection(record)?.capture
+      );
   }
   return report;
 }
@@ -2986,13 +3031,14 @@ var init_drift2 = __esm({
     init_paths();
     init_snapshot();
     init_decisions();
+    init_excerpts();
     init_provenance();
   }
 });
 
 // src/audit/checks/decision-anchor.ts
 async function checkDecisionAnchors(ctx) {
-  const result = emptyResult();
+  const result = { ...emptyResult(), incompleteDecisions: [] };
   if (!ctx.decisionsPresent) return result;
   const store = await loadDecisionStore(ctx.root);
   const records = store.records;
@@ -3024,6 +3070,7 @@ async function checkDecisionAnchors(ctx) {
         check: "decision-anchor-drift",
         reason: `Anchor evidence for decision ${record.id} is incomplete or unreadable`
       });
+      result.incompleteDecisions.push(record.id);
       continue;
     }
     if (!changedFiles.length) continue;
@@ -3085,7 +3132,7 @@ var init_checks = __esm({
 });
 
 // src/audit/findings.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { z as z6 } from "zod";
 function findingId(finding) {
   const e = finding.evidence;
@@ -3116,7 +3163,7 @@ var digest, checkSchema, commitSchema, anchorSchema, count, scopeSchema, evidenc
 var init_findings = __esm({
   "src/audit/findings.ts"() {
     "use strict";
-    digest = (value) => createHash4("sha256").update(JSON.stringify(value)).digest("hex");
+    digest = (value) => createHash5("sha256").update(JSON.stringify(value)).digest("hex");
     checkSchema = z6.enum([
       "deleted-reference",
       "new-module",
@@ -3223,6 +3270,13 @@ var init_findings = __esm({
   }
 });
 
+// src/automation/pending-tools.ts
+var init_pending_tools = __esm({
+  "src/automation/pending-tools.ts"() {
+    "use strict";
+  }
+});
+
 // src/automation/stop-review.ts
 import { z as z7 } from "zod";
 var evidenceSchema2, stopReviewSchema;
@@ -3231,6 +3285,7 @@ var init_stop_review = __esm({
     "use strict";
     init_anchors();
     init_findings();
+    init_pending_tools();
     evidenceSchema2 = z7.record(z7.object({ digest: z7.string(), capture: anchorCaptureSchema }));
     stopReviewSchema = z7.object({
       pending: z7.record(z7.object({ head: z7.string(), evidence: evidenceSchema2 })),
@@ -3267,13 +3322,14 @@ import { z as z9 } from "zod";
 function withLock(root, directory, run, waitMs = 5e3) {
   return withStoreLock(root, directory, run, waitMs, "Automation");
 }
-var hostSchema, stateSchema;
+var hostSchema, stateSchema, IDLE_PENDING_MS, STATE_READ_MAX_BYTES;
 var init_store = __esm({
   "src/automation/store.ts"() {
     "use strict";
     init_store_lock();
     init_stop_review();
     init_notifications();
+    init_storage();
     hostSchema = z9.enum(["claude", "codex"]);
     stateSchema = z9.object({
       version: z9.literal(1),
@@ -3288,6 +3344,8 @@ var init_store = __esm({
           host: hostSchema,
           lastUsed: z9.string(),
           notifiedDiagnostics: z9.array(z9.string()).default([]),
+          /** Digest of the upstream drift notice already shown to this session. */
+          upstreamNotice: z9.string().optional(),
           pending: z9.record(z9.string()),
           stopReview: stopReviewSchema.optional(),
           coverageGaps: z9.array(z9.string()),
@@ -3297,10 +3355,13 @@ var init_store = __esm({
       updatedAt: z9.string(),
       fingerprint: z9.string().nullable(),
       latest: z9.string().nullable(),
+      guidance: z9.object({ fingerprint: z9.string(), path: z9.string() }).optional(),
       notifications: notificationStateSchema.optional(),
       agentNotifications: notificationStateSchema.optional(),
       analysis: z9.object({ id: z9.string(), fingerprint: z9.string(), completedAt: z9.number(), path: z9.string() }).optional()
     });
+    IDLE_PENDING_MS = 24 * 60 * 60 * 1e3;
+    STATE_READ_MAX_BYTES = 64 * 1024 * 1024;
   }
 });
 
@@ -3319,7 +3380,7 @@ __export(repair_exports, {
   withRepairSession: () => withRepairSession
 });
 import fs11 from "fs/promises";
-import path20 from "path";
+import path18 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 import { z as z10 } from "zod";
 function recheckable(finding) {
@@ -3417,8 +3478,8 @@ async function prepareOriginal(rootDir, checks, options, session) {
 }
 async function loadRepairBaseline(rootDir, baselinePath) {
   const root = await fs11.realpath(rootDir);
-  const declaredRoot = path20.resolve(rootDir);
-  const relative = path20.isAbsolute(baselinePath) ? path20.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
+  const declaredRoot = path18.resolve(rootDir);
+  const relative = path18.isAbsolute(baselinePath) ? path18.relative(isWithinRoot(declaredRoot, baselinePath) ? declaredRoot : root, baselinePath) : baselinePath;
   const stored = baselineSchema.parse(await readStoreJson(root, relative));
   const { digest: savedDigest, ...payload } = stored;
   if (digest(payload) !== savedDigest)
@@ -3779,7 +3840,10 @@ async function decisionAssessment(root, finding, baselineHead) {
     );
   const record = store.records.find((record2) => record2.id === evidence.decisionId);
   if (!record || record.version !== 2) return null;
-  const inspection = latestDecisionInspection(record);
+  const inspection = latestDecisionInspection(
+    record,
+    evidence.provenance?.approval === "accepted" ? "operative" : "all"
+  );
   if (inspection && record.status === "active") {
     const capture = await captureAnchors(root, inspection.capture.anchors);
     let ancestor = true;
@@ -4074,12 +4138,12 @@ var init_advisory_review = __esm({
 
 // src/audit/audit.ts
 import fs13 from "fs/promises";
-import path21 from "path";
+import path19 from "path";
 async function computeAudit(rootDir, options = {}) {
   return profilePhase("audit.current", () => auditCurrent(rootDir, options));
 }
 async function auditCurrent(rootDir, options) {
-  const resolvedRoot = path21.resolve(rootDir);
+  const resolvedRoot = path19.resolve(rootDir);
   const [docs, headHash] = await Promise.all([
     discoverDocs(resolvedRoot),
     getCurrentGitHash(resolvedRoot)
@@ -4117,7 +4181,7 @@ async function auditCurrent(rootDir, options) {
   }
   let decisionsPresent = false;
   try {
-    await fs13.access(path21.join(resolvedRoot, ".mason", "decisions"));
+    await fs13.access(path19.join(resolvedRoot, ".mason", "decisions"));
     decisionsPresent = true;
   } catch {
   }
@@ -4186,11 +4250,11 @@ init_audit();
 init_types();
 init_repair();
 init_findings();
-import path23 from "path";
+import path21 from "path";
 
 // src/audit/advisory-cli.ts
 init_advisory_review();
-import path22 from "path";
+import path20 from "path";
 import { stripVTControlCharacters } from "util";
 var USAGE = `Usage: mason audit review --baseline <path> --finding <id> [options]
 
@@ -4250,7 +4314,7 @@ async function runAdvisoryCli(args, io = { out: (text2) => console.log(text2), e
       reviewToken: flags["--token"],
       reasonCode: flags["--reason"]
     };
-    const result = await reviewAdvisory(path22.resolve(flags["--dir"] ?? process.cwd()), input);
+    const result = await reviewAdvisory(path20.resolve(flags["--dir"] ?? process.cwd()), input);
     if (json) io.out(JSON.stringify(result, null, 2));
     else {
       const lines = [`Advisory review: ${result.status}.`];
@@ -4438,7 +4502,7 @@ function formatFixPrompt(report, baselinePath) {
   lines.push("");
   lines.push("RULES:");
   lines.push(
-    baselinePath ? `- Preserve the original repair baseline: ${JSON.stringify(baselinePath)}. Do not replace it after editing.` : "- Before the first edit, call mason_repair with action: prepare, or run mason-audit --prepare-repair --json with the same --dir and --checks. Keep the returned baselinePath through verification."
+    baselinePath ? `- Preserve the original repair baseline: ${JSON.stringify(baselinePath)}. Do not replace it after editing.` : "- Before the first edit, run mason audit --prepare-repair --json with the same --dir and --checks. Keep the returned baselinePath through verification."
   );
   lines.push(
     `- Edit ONLY these files: ${flaggedDocs.join(", ") || "none (advisory review only)"}. Bring the docs into agreement with verified source evidence; do not change source code or configs to silence findings.`
@@ -4461,7 +4525,7 @@ function formatFixPrompt(report, baselinePath) {
     "- new-module: review whether the directory needs documenting; an omission alone does not establish a defect. Preserve scope and describe only what you verified."
   );
   lines.push(
-    "- Specific historical ADVISORIES require a separate authorized assessment using review_advisory with the baselinePath and findingId from verification. Prepare and inspect evidence first; record addressed, inapplicable or deferred with the actual reviewer, note and reviewToken. Dependency notices marked resolution: informational require no review. Dependency advisories may be dismissed with action: dismiss, reasonCode (no-dependency-claims or unrelated-manifest-change), and note, without a reviewer or token. Decision findings use review_decision. Candidates marked resolution: recheck can be rerun to see whether the condition remains; this does not establish semantic approval. Report what remains unknown."
+    "- Specific historical ADVISORIES require a separate authorized assessment using mason audit review with --baseline and --finding from verification. Prepare and inspect evidence first; record addressed, inapplicable or deferred with the actual reviewer, note and reviewToken. Dependency notices marked resolution: informational require no review. Dependency advisories may be dismissed with --outcome dismiss, --reason (no-dependency-claims or unrelated-manifest-change), and --note, without a reviewer or token. Decision findings use review_decision. Candidates marked resolution: recheck can be rerun to see whether the condition remains; this does not establish semantic approval. Report what remains unknown."
   );
   lines.push("");
   lines.push(
@@ -4483,7 +4547,7 @@ function formatFixPrompt(report, baselinePath) {
   );
   lines.push("");
   lines.push(
-    "After edits, call mason_repair with action: verify and the original baselinePath, or mason-audit --verify-repair <baselinePath> --dir <project>. Repeat against the same baseline after any final documentation commit. Summarize resolved, unresolved, review-required, unverified, and new findings with their evidence. Do not report a suppressed or unavailable check as fixed. This audit covers the listed documents and supported claims; application behavior and code examples need their own validation."
+    "After edits, run mason audit --verify-repair <baselinePath> --dir <project>. Repeat against the same baseline after any final documentation commit. Summarize resolved, unresolved, review-required, unverified, and new findings with their evidence. Do not report a suppressed or unavailable check as fixed. This audit covers the listed documents and supported claims; application behavior and code examples need their own validation."
   );
   return lines.join("\n");
 }
@@ -4514,7 +4578,7 @@ async function runAuditCli(argv, io = {
     io.out(USAGE2);
     return 0;
   }
-  const rootDir = path23.resolve(args.dir);
+  const rootDir = path21.resolve(args.dir);
   if (args.baseline || args.prepareRepair) {
     try {
       if (args.baseline) {