@@ -55,10 +55,14 @@ Field names are the stable **trend/delta contract** consumed by #1424. Any chang
       "lockfile": { "path": "pnpm-lock.yaml", "sha256": "…" },
       // coverage and size are read artifacts this command does NOT produce, so they carry no
       // producing-commit stamp. They are hashed (so history keys on the bytes, not the commit) and
-      // flagged `stale` when a source file is newer than the artifact — the tree moved on without
-      // the producer being rerun. A consumer (#1424) must treat stale metrics as lagging `commit`.
-      "coverageSummary": { "path": "coverage/coverage-summary.json", "sha256": "…", "stale": false } | null,
-      "sizeReport": { "path": ".tmp/size-report.json", "sha256": "…", "stale": false } | null
+      // flagged `stale` when ANY of their `producerInputs` is newer than the artifact — coverage
+      // tracks sources + tests + vitest config + package.json; size tracks package.json + lockfile +
+      // tsdown/tsconfig + size-report.mjs, not just `src`. Unprovable freshness (no observable input)
+      // is reported stale. A consumer (#1424) must treat stale metrics as lagging `commit`.
+      "coverageSummary": { "path": "coverage/coverage-summary.json", "sha256": "…",
+                           "producerInputs": ["src/**/*.ts", "test", "…"], "stale": false } | null,
+      "sizeReport": { "path": ".tmp/size-report.json", "sha256": "…",
+                      "producerInputs": ["src/**/*.ts", "package.json", "…"], "stale": false } | null
     }
   },
   "metrics": {
 
@@ -6,6 +6,7 @@ import { buildGraph, type GraphData } from '../depgraph/model.ts';
 import { mainSequenceModules, zoneComponents } from './components.ts';
 import {
   artifactProvenance,
+  isArtifactStale,
   benchMetrics,
   buildSnapshot,
   coverageMetrics,
@@ -124,17 +125,32 @@ test('coverage and size degrade to unavailable when the artifact is absent', ()
   ).toBe(true);
 });
 
-test('artifactProvenance binds bytes and flags an artifact older than the tree as stale', () => {
-  const args = { path: 'coverage/coverage-summary.json', sha256: 'deadbeef' };
-  // Artifact newer than every source file: the metrics match the current tree.
-  expect(artifactProvenance({ ...args, artifactMtimeMs: 2000, newestSourceMtimeMs: 1000 })).toEqual(
-    { path: args.path, sha256: 'deadbeef', stale: false },
-  );
-  // Source edited after the artifact was produced: the metrics predate the tree and must be flagged
-  // so #1424 cannot persist them against the current commit as if they were fresh.
-  expect(artifactProvenance({ ...args, artifactMtimeMs: 1000, newestSourceMtimeMs: 2000 })).toEqual(
-    { path: args.path, sha256: 'deadbeef', stale: true },
-  );
+test('isArtifactStale flags an artifact predating ANY producer input, incl. non-src ones', () => {
+  const artifact = 1500;
+  const srcMtimes = [1000, 1200]; // all older than the artifact
+  // Freshness judged on src alone would (wrongly) call this fresh — the earlier false-negative.
+  expect(isArtifactStale(artifact, srcMtimes)).toBe(false);
+  // A non-src producer input (e.g. package.json / vitest config / tsdown config) edited after the
+  // artifact was produced must flip the verdict, so a coverage/size number is not paired with a
+  // commit it predates.
+  const packageJsonMtime = 1800;
+  expect(isArtifactStale(artifact, [...srcMtimes, packageJsonMtime])).toBe(true);
+  // No observable producer input => freshness cannot be proven => stale, never a false "fresh".
+  expect(isArtifactStale(artifact, [])).toBe(true);
+});
+
+test('artifactProvenance binds bytes, the producer input set, and the staleness verdict', () => {
+  const args = {
+    path: 'coverage/coverage-summary.json',
+    sha256: 'deadbeef',
+    producerInputs: ['src/**/*.ts', 'package.json'],
+  };
+  expect(
+    artifactProvenance({ ...args, artifactMtimeMs: 2000, producerInputMtimesMs: [1000, 1500] }),
+  ).toEqual({ ...args, stale: false });
+  expect(
+    artifactProvenance({ ...args, artifactMtimeMs: 1000, producerInputMtimesMs: [1500] }),
+  ).toEqual({ ...args, stale: true });
 });
 
 test('benchMetrics counts cases and distinct topics from the case registry', () => {
 
@@ -233,33 +233,47 @@ export function benchMetrics(cases: readonly { docs: readonly string[] }[]): Ben
  * Provenance for an analyzer artifact this snapshot READ but did not itself produce (coverage,
  * size). These artifacts carry no producing-commit stamp, so the snapshot cannot claim they match
  * `commit`. We instead record their content hash — so #1424 keys history on the bytes the metrics
- * came from, not on a commit they may predate — and an explicit `stale` flag: true when a
- * production source file is newer than the artifact, i.e. the tree moved on without the producer
- * being rerun. A consumer must treat stale metrics as lagging `commit`, never as current.
+ * came from, not on a commit they may predate — the `producerInputs` freshness was judged against,
+ * and an explicit `stale` flag. Freshness is bound to the artifact's WHOLE producer input set, not
+ * just `src` (coverage also depends on tests/config; size on package.json and packaging config), so
+ * a change to any of them re-flags the artifact. A consumer must treat stale metrics as lagging
+ * `commit`, never as current.
  */
 export type ArtifactProvenance = {
   path: string;
   sha256: string;
+  /** The producer input pathspecs whose freshness this verdict was computed against. */
+  producerInputs: string[];
   stale: boolean;
 };
 
 /**
- * Bind an artifact to the bytes and freshness it was read with. `stale` compares mtimes: an
- * artifact older than the newest production source predates the current working tree. mtime is a
- * local, offline signal (these artifacts are git-ignored, so there is no blob to diff), evaluated
- * against a single tree in one run, which is exactly the "edited code but did not rerun the
- * producer" case this guards against.
+ * Whether an artifact predates any of its producer inputs. mtime is a local, offline signal (these
+ * artifacts are git-ignored, so there is no blob to diff), evaluated against a single tree in one
+ * run. Freshness we cannot prove is reported as stale: an EMPTY input set (nothing observable) and
+ * any input newer than the artifact both mean the metrics may lag the tree — we never claim fresh
+ * on the strength of `src` alone, which was the earlier false-negative.
  */
+export function isArtifactStale(
+  artifactMtimeMs: number,
+  producerInputMtimesMs: readonly number[],
+): boolean {
+  return producerInputMtimesMs.length === 0 || Math.max(...producerInputMtimesMs) > artifactMtimeMs;
+}
+
+/** Bind an artifact to the bytes and the full producer input set its freshness was judged against. */
 export function artifactProvenance(params: {
   path: string;
   sha256: string;
+  producerInputs: string[];
   artifactMtimeMs: number;
-  newestSourceMtimeMs: number;
+  producerInputMtimesMs: readonly number[];
 }): ArtifactProvenance {
   return {
     path: params.path,
     sha256: params.sha256,
-    stale: params.newestSourceMtimeMs > params.artifactMtimeMs,
+    producerInputs: params.producerInputs,
+    stale: isArtifactStale(params.artifactMtimeMs, params.producerInputMtimesMs),
   };
 }
 
 
@@ -14,9 +14,10 @@
 // size are read from coverage/coverage-summary.json and .tmp/size-report.json when present and
 // degrade to `available: false` (with the producing command) when they are not, so a fresh
 // checkout still produces a complete, honest snapshot. Those two artifacts carry no producing-commit
-// stamp, so provenance hashes them and flags `stale` when a source file is newer (see
-// artifactProvenance in model.ts) — a consumer like #1424 must never pair stale metrics with the
-// current commit.
+// stamp, so provenance hashes them and flags `stale` when any of their producer inputs is newer
+// (PRODUCER_INPUTS below; see artifactProvenance in model.ts) — coverage tracks tests + config, size
+// tracks package.json + packaging config, not just `src`. A consumer like #1424 must never pair
+// stale metrics with the current commit.
 //
 // The one thing that can FAIL the command is the depgraph-vs-layering R6 consistency assertion:
 // the graph built here must reproduce scripts/layering/check.ts's TYPE_INVERSION_BASELINE. The
@@ -85,28 +86,66 @@ function lockfileProvenance(): { path: string; sha256: string } | null {
   return raw === null ? null : { path: LOCKFILE_PATH, sha256: shortSha(raw) };
 }
 
-/** The newest mtime across the production source tree, the freshness bar for read artifacts. */
-function newestSourceMtimeMs(files: readonly string[]): number {
-  let newest = 0;
+// The tracked inputs whose change can invalidate each READ artifact — NOT just `src`. Coverage is
+// the whole test run (sources + tests + vitest config + the scripts package.json wires); size runs
+// tsdown + `npm pack`, so packaging metadata and bundler/ts config are inputs. An old artifact is
+// flagged stale when ANY of these is newer than it, closing the src-only false-negative.
+const PRODUCER_INPUTS = {
+  coverage: [
+    'src/*.ts',
+    'src/**/*.ts',
+    'test',
+    'vitest.config.ts',
+    'vitest.*.config.ts',
+    'package.json',
+  ],
+  size: [
+    'src/*.ts',
+    'src/**/*.ts',
+    'package.json',
+    'pnpm-lock.yaml',
+    'tsdown.config.ts',
+    'tsconfig.json',
+    'tsconfig.lib.json',
+    'scripts/size-report.mjs',
+  ],
+} as const;
+
+/** Tracked files matching the pathspecs (offline, ignores untracked/generated); [] on failure. */
+function trackedFiles(pathspecs: readonly string[]): string[] {
+  try {
+    const out = execFileSync('git', ['ls-files', '-z', '--', ...pathspecs], {
+      cwd: repoRoot,
+      encoding: 'utf8',
+    });
+    return out.split('\0').filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+
+function mtimesMs(files: readonly string[]): number[] {
+  const out: number[] = [];
   for (const file of files) {
-    const mtimeMs = fs.statSync(absolute(file)).mtimeMs;
-    if (mtimeMs > newest) newest = mtimeMs;
+    const abs = absolute(file);
+    if (fs.existsSync(abs)) out.push(fs.statSync(abs).mtimeMs);
   }
-  return newest;
+  return out;
 }
 
-/** Hash a read artifact and flag it stale when a source file is newer; null when absent. */
+/** Hash a read artifact and judge freshness against its whole producer input set; null when absent. */
 function artifactInput(
   relativePath: string,
-  newestSourceMtimeMs: number,
+  producerInputs: readonly string[],
 ): ArtifactProvenance | null {
   const abs = absolute(relativePath);
   if (!fs.existsSync(abs)) return null;
   return artifactProvenance({
     path: relativePath,
     sha256: shortSha(fs.readFileSync(abs, 'utf8')),
+    producerInputs: [...producerInputs],
     artifactMtimeMs: fs.statSync(abs).mtimeMs,
-    newestSourceMtimeMs,
+    producerInputMtimesMs: mtimesMs(trackedFiles(producerInputs)),
   });
 }
 
@@ -168,16 +207,14 @@ function collectProvenance(
 }
 
 function collectSnapshot(): RepoHealthSnapshot {
-  const files = listSourceFiles();
-  const graph = buildGraphFromTree(files);
-  const newestSource = newestSourceMtimeMs(files);
+  const graph = buildGraphFromTree(listSourceFiles());
   const coverage = readJsonIfExists<import('./model.ts').CoverageSummary>(COVERAGE_SUMMARY_PATH);
   const size = readJsonIfExists<import('./model.ts').SizeReport>(SIZE_REPORT_PATH);
   return buildSnapshot({
     provenance: collectProvenance(
       graph,
-      artifactInput(COVERAGE_SUMMARY_PATH, newestSource),
-      artifactInput(SIZE_REPORT_PATH, newestSource),
+      artifactInput(COVERAGE_SUMMARY_PATH, PRODUCER_INPUTS.coverage),
+      artifactInput(SIZE_REPORT_PATH, PRODUCER_INPUTS.size),
     ),
     graph,
     fallow: {