dsh-completion-guard 0.10.0 → 0.12.0

package/CHANGELOG.md

@@ -7,10 +7,55 @@ Each entry describes that version. Historical host ranges, defaults, plans and c
 <details>
 <summary>Version index</summary>
 
-[0.10.0](#0100) · [0.9.0](#090) · [0.8.4](#084) · [0.8.3](#083) · [0.8.2](#082) · [0.8.1](#081) · [0.8.0](#080) · [0.7.1](#071---2026-09-22) · [0.7.0](#070---2026-09-21) · [0.6.3](#063---2026-09-18) · [0.6.2](#062---2026-09-16) · [0.6.1](#061-2026-09-15) · [0.6.0](#060---2026-09-14) · [0.5.3](#053---2026-09-14) · [0.5.2](#052---2026-09-11) · [0.5.1](#051---2026-09-10) · [0.5.0](#050---2026-09-10) · [0.4.3](#043---2026-09-08) · [0.4.2](#042---2026-09-07) · [0.4.1-rc.1](#041-rc1---2026-09-04) · [0.4.0](#040---2026-09-02) · [0.3.2](#032---2026-09-01) · [0.3.1](#031---2026-08-31) · [0.3.0](#030---2026-08-31) · [0.2.1](#021---2026-08-28) · [0.2.0](#020---2026-08-28) · [0.1.2](#012---2026-08-27) · [0.1.1](#011---2026-08-27) · [0.1.0](#010---2026-08-27)
+[0.12.0](#0120) · [0.11.0](#0110) · [0.10.0](#0100) · [0.9.0](#090) · [0.8.4](#084) · [0.8.3](#083) · [0.8.2](#082) · [0.8.1](#081) · [0.8.0](#080) · [0.7.1](#071---2026-09-22) · [0.7.0](#070---2026-09-21) · [0.6.3](#063---2026-09-18) · [0.6.2](#062---2026-09-16) · [0.6.1](#061-2026-09-15) · [0.6.0](#060---2026-09-14) · [0.5.3](#053---2026-09-14) · [0.5.2](#052---2026-09-11) · [0.5.1](#051---2026-09-10) · [0.5.0](#050---2026-09-10) · [0.4.3](#043---2026-09-08) · [0.4.2](#042---2026-09-07) · [0.4.1-rc.1](#041-rc1---2026-09-04) · [0.4.0](#040---2026-09-02) · [0.3.2](#032---2026-09-01) · [0.3.1](#031---2026-08-31) · [0.3.0](#030---2026-08-31) · [0.2.1](#021---2026-08-28) · [0.2.0](#020---2026-08-28) · [0.1.2](#012---2026-08-27) · [0.1.1](#011---2026-08-27) · [0.1.0](#010---2026-08-27)
 
 </details>
 
+## 0.12.0
+
+- **Complete, unambiguous locator names no longer create verification actions by themselves.** Complete, unambiguous filenames, paths and link destinations are excluded from classification; adjacent instructions and link labels remain visible. Original text, source hashes and spans are preserved, and these names do not grant execution authority.
+- **Guard 0.12.0 requires DSH `0.2.1-rc.3` or later.** Package declarations and runtime admission retain the rc.3 floor. The default reviewed baseline is rc.5 (`dsh-0.2.1-rc.5-core-v1`); an rc.3 host uses its own reviewed cohort, while rc.2 remains below the floor. Existing session and Guard data protocols remain compatible; changed host locks require fresh checks. Migration receipts now bind a physical inventory proof, so older receipts without it must be regenerated.
+- **The rc.3→rc.5 cumulative study found no Guard-consumed interface change.** All 13 upstream commits and 388 changed files between `dsh-v0.2.1-rc.3` and `dsh-v0.2.1-rc.5` were reviewed: the non-manifest changes are client-UI thinking-block rendering and two ACP stdout diagnostics reroutes, none Guard-consumed. All 47 core-cohort packages were re-verified against the registry (SRI + SHA-256): zero executable-byte changes across the cohort, dependency routing structurally unchanged, Cordis shared at 4.0.5. The new `manifests/rc021-rc5-byte-audit.json` binds those verified identities.
+- **Host trust equivalence now spans three reviewed baselines** (rc.2, rc.3, rc.5), selected by the acquired graph's launcher version; a graph qualifies only when its loading digest AND module bytes match ONE reviewed published state.
+- **Activation inventory detects hidden physical sessions.** JSONL backends with reviewed-equivalent executable bytes and loader shape are checked against a read-only physical census and streaming file digests. Hidden, corrupt, future or unknown layouts fail closed; prior proofless receipts require new inventory and inspection. The proof covers the supplied root, not whether it is the active configuration. See [migration limits](docs/ACTIVATION_MIGRATION.md).
+- **Activation migration accepts Guard `0.11.x` as trusted predecessors.** The prior-mode toolkit previously stopped at `0.10.x`, so an upgrade from 0.11.0 had no documented migration path; `0.0.x`–`0.11.x` are now accepted and the current/future versions still refuse to impersonate a predecessor. unknown/off/conflict/pending boundaries are unchanged.
+- **Official rc.5 Desktop distributions are registered separately for macOS arm64 and Windows x64.** Both use the official distribution digest and an independently verified installed carrier. macOS codesign and Windows Authenticode passed; each signed ASAR header matches its measured header, with desktop/runtime metadata and dependency bytes checked separately. These identities do not establish Guard installation or lifecycle acceptance; rc.3/rc.2 pins are not reused.
+- **Known upstream risk, unchanged:** the rc.3 and rc.5 hosts still exact-pin `undici` 8.11.2 (`dsh-http-proxy`) and `zod` 4.4.3 (`dsh-commands`), and the upstream default branch still pins the same Undici — no disclosed gap is closed by this adaptation. On 2026-11-02 the maintainer separately accepted the same three Undici 8.11.2 high-risk findings for this 0.12.0 validation, including their residual risk and exception-eligibility waiver, and extended the expiry to **2026-11-30 inclusive**. From 2026-12-01 the gate blocks those findings again unless re-justified. This acceptance does not repair the signed host or establish whole-host unreachability. The two longer-term exceptions keep their scope and expiry. Four new moderate Undici findings and four fast-uri moderate/low findings on the 0.12.0 dev-chain lockfile are recorded, non-blocking. See [the dependency advisory gate](docs/DEPENDENCY_SCAN.md).
+- **Acceptance-receipt recovery is available without re-running acceptance.** A missing transfer receipt can be recovered from the original transfer intent plus the already-saved acceptance result; recovery never re-executes the run and never turns a failed result into a passing one.
+- **Failed, interrupted and timed-out acceptance initializations keep their evidence.** Init failures, interruptions and timeouts now preserve the owned fixture and record an explicit failed-cleanup state with process-group and child cleanup; an unknown liveness state retains the fixture for ownership diagnosis instead of disposing of it.
+- **Candidate CI selects its coverage by changed risk.** Static, package and documentation contracts run once; the Ubuntu/Node 22 lane runs the full deterministic suite; other platform/Node lanes usually run the smoke set; sensitive or unknown inputs expand all six lanes to the full suite, and manual dispatch always requests the full matrix.
+- **Warm-host route checks have a versioned native supplement.** The same frozen tgz is exercised in real isolated Web and Headless processes: redirect and deny must refuse without a new mock publish effect, and restoring the route must allow the same unconsumed resolution. Results bind source, artifact, driver and platform; this validation tool does not establish a GUI or real-model pass.
+- Development dependencies run on the pinned `0.2.1-rc.5` host cohort, and the shipped floor is pinned against the official app-boot consumer's real admission decisions (`semver-matrix-v120.json`).
+
+## 0.11.0
+
+- **Upgrade DSH to `0.2.1-rc.3` or later before installing Guard 0.11.0.** Package declarations, runtime admission and the default audited cohort now use rc.3 as the minimum. Existing session and Guard data protocols remain compatible; rc.2 identities are retained as historical evidence.
+
+- **Host-lock injection preserves JSON-shaped patch sequences.** The managed entry stays inside the sequence, with user entries retained. Existing block YAML, inline flow values, activation and disabled-only overrides remain supported. Invalid syntax, duplicate keys, ambiguous Guard fields and malformed managed markers refuse before profile mutation; the bundled YAML reader does not evaluate `!!js` expressions. Full composition and native loading remain separate checks.
+
+- **Known upstream risk:** for this 0.11.0 release, the maintainer explicitly accepted three Undici 8.11.2 high-risk findings through **2026-11-05 inclusive**. The signed host remains unfixed; see the [risk scope and expiry](docs/DEPENDENCY_SCAN.md). We will update after the upstream fixed chain is verified.
+
+- Default host audits check declared files and dependency routes without scanning unrelated directories. Audits backed by a qualification receipt continue to check the complete file inventory.
+
+- **Reviewed Chinese instruction forms such as 请分别执行 no longer create false bans.** Words such as 分别 stay intact in those forms; genuine bans such as 这个别推送 and 完成前别 remain in force.
+
+- **Long host-lock configuration exports now reach pipes in full.** `verify-dump` explicitly reports that it checks only Guard lock fields; complete configuration parsing and host loading remain separate checks.
+
+- **The activation CLI supports official rc.3 persistence exports.** Inventory and explicit mode adoption accept both the default-plugin and namespace-plugin module shapes, and reject invalid modules before persistence access.
+
+- **Release tgz identity is now read through one auditable tar subset.** Guard, npm and every release stage agree on which `package.json` the bytes encode: resolution, the final pre-effect check and post-publish readback all use one strict reader that validates header checksums, models ustar prefixes and npm's path normalization, and refuses links, PAX/GNU extensions, duplicate normalized names and paths outside `package/`. A crafted archive whose two manifests disagree (prefix shadowing plus `./` aliasing) is rejected before any authorization, so a publish can no longer be bound to one package name while npm installs another. Reading is bounded on every axis — compressed bytes actually read, decompressed output, member size, member count and manifest size — so a high-ratio archive can no longer stall the host before authorization completes.
+- **The registry readback owns its deadline and body budget.** Post-publish reconciliation reads the exact-version registry document under a plugin-owned total deadline combined with the caller's cancellation, streams the response under a hard byte budget, and releases the reader on every exit. A slow, hanging or oversized registry ends within the recorded budget with a stable refusal; the attempt stays in flight, no settlement is written from a refused readback, and a publish is never re-sent.
+- **Private storage protection follows the official working directory.** The Bash/Pwsh guard now reads the official `workdir` parameter (absolute, relative or symlink-aliased) instead of a field no host sends, resolves relative file targets against the caller's trusted effective directory — the last committed working-directory epoch — and fails closed when a relative target has no provable base. The same matrix is enforced through the registered production guard, not just the helper.
+- **File readback binds to the directory that governed the call.** After a committed `working-directory/change`, the independent file observer reads a relative edit target against the cwd epoch of the call's own sequence, not the immutable header directory and not the current end-of-log directory. A later directory change can no longer rebind a completed effect to a different same-named file; an unreadable timeline refuses relative targets while absolute targets stay observable.
+- **Sanitization now strips URL credentials and the documented token families.** `user:password@` is removed from URLs by structure, and the bounded GitHub token spellings (`ghp_`/`gho_`/`ghu_`/`ghs_`/`ghr_`/`github_pat_`) are redacted before normalized text, URL subjects or recovery packets are stored. The [privacy note](docs/PRIVACY.md) states the exact pattern set and its limits; capture→replay digests stay deterministic and historical digests are never silently recomputed.
+- **One interrupted anchor write no longer damages other sessions.** A torn final line in the shared session-anchors file is treated as an uncommitted append: every complete line stays authoritative for its session, the next lock holder repairs the tail before appending, and invalid middle lines or conflicting anchors still refuse for every session.
+- **A qualified first creation survives a brief writer-lock race.** When a new startup session's activation write loses a short lock race, the runtime retries the same creation while its intent is still provable — within a bounded budget — and then reports the explicit `activation_writer_unavailable` status. The retry is same-value and idempotent, and never applies to resume, late attach or a deleted binding.
+- **Plain forks are root conversations again.** `parentSession` is fork lineage, not delegation: first-step boundary and guidance, work units and confirmation semantics now apply to ordinary and resumed forks, while the host's explicit subagent markers (`origin=subagent`, positive `delegationDepth`) keep the delegated restrictions. Contradictory markers stay delegated.
+- The rc.3 core graph has registry-verified package identities and implementation digests. Its official macOS arm64 and Windows x64 Desktop distributions have separately registered vendor signatures and signed archive identities. Installation, lifecycle, real-model and UI performance acceptance remain separate gates.
+- **The release tgz identity survives file growth.** The audited tar reader now reads to a confirmed end of file in bounded chunks and binds the identity to the complete bytes actually read, so an artifact that grows after the metadata check can no longer be accepted on its old prefix digest. Private-storage protection refuses a shell or file call whose default directory cannot be proven (no trusted working directory), and URL credential stripping follows URL authority semantics for any scheme, case-insensitively, without treating a legal authority quote as a terminator. Observing an activation binding from any writer permanently retires the new-session first-creation retry, so a later deletion can never recreate the file. Registry reconciliation releases every response body — including error responses and bodies that stall — under the combined deadline. The dependency advisory gate now honors the scanner's exit protocol (a failed scan never reads as clean), matches exceptions against every installed finding version, and records real GitHub advisory identifiers. Anchor writes inject real boundary faults (partial write, failed fsync, failed tail repair) in the regression suite: committed peers stay readable and the next writer repairs an uncommitted tail.
+- **Migration inventories accept `0.10.x` as the previous package version**, so upgrading from 0.10.0 keeps the documented activation-migration path; earlier-version rules are unchanged.
+- **A fail-closed dependency advisory gate is now part of required CI.** The new `dependency-scan` job blocks on any unaccepted high/critical advisory and fails when the scan itself cannot complete; accepted exceptions live in a validated, expiring table documented in [the dependency advisory gate](docs/DEPENDENCY_SCAN.md). The development chain moved to vitest 4.1.12 (dropping the vulnerable tinypool 1.x pool) with compatible vite and source-map-js floors.
+
 ## 0.10.0
 
 - **Upgrade DSH before installing Guard 0.10.0.** The minimum host is `0.2.1-rc.2`, with no implied upper limit. Preserve old-session modes and configuration, upgrade the host, install Guard, then rebuild and read back each profile's host lock before re-enabling it. Old locks and completion certificates do not transfer to a changed graph. See [compatibility and upgrade boundaries](docs/COMPATIBILITY.md#0100-dsh-021-rc2) for the reviewed host identities and the separate market, load and admission checks.

package/CHANGELOG.zh-CN.md

@@ -7,10 +7,55 @@
 <details>
 <summary>版本索引</summary>
 
-[0.10.0](#0100) · [0.9.0](#090) · [0.8.4](#084) · [0.8.3](#083) · [0.8.2](#082) · [0.8.1](#081) · [0.8.0](#080) · [0.7.1](#0712026-09-22) · [0.7.0](#0702026-09-21) · [0.6.3](#0632026-09-18) · [0.6.2](#0622026-09-16) · [0.6.1](#0612026-09-15) · [0.6.0](#060---2026-09-14) · [0.5.3](#053---2026-09-14) · [0.5.2](#052---2026-09-11) · [0.5.1](#051---2026-09-10) · [0.5.0](#050---2026-09-10) · [0.4.3](#043---2026-09-08) · [0.4.2](#042---2026-09-07) · [0.4.1-rc.1](#041-rc1---2026-09-04) · [0.4.0](#040---2026-09-02) · [0.3.2](#032---2026-09-01) · [0.3.1](#031---2026-08-31) · [0.3.0](#030---2026-08-31) · [0.2.1](#021---2026-08-28) · [0.2.0](#020---2026-08-28) · [0.1.2](#012---2026-08-27) · [0.1.1](#011---2026-08-27) · [0.1.0](#010---2026-08-27)
+[0.12.0](#0120) · [0.11.0](#0110) · [0.10.0](#0100) · [0.9.0](#090) · [0.8.4](#084) · [0.8.3](#083) · [0.8.2](#082) · [0.8.1](#081) · [0.8.0](#080) · [0.7.1](#0712026-09-22) · [0.7.0](#0702026-09-21) · [0.6.3](#0632026-09-18) · [0.6.2](#0622026-09-16) · [0.6.1](#0612026-09-15) · [0.6.0](#060---2026-09-14) · [0.5.3](#053---2026-09-14) · [0.5.2](#052---2026-09-11) · [0.5.1](#051---2026-09-10) · [0.5.0](#050---2026-09-10) · [0.4.3](#043---2026-09-08) · [0.4.2](#042---2026-09-07) · [0.4.1-rc.1](#041-rc1---2026-09-04) · [0.4.0](#040---2026-09-02) · [0.3.2](#032---2026-09-01) · [0.3.1](#031---2026-08-31) · [0.3.0](#030---2026-08-31) · [0.2.1](#021---2026-08-28) · [0.2.0](#020---2026-08-28) · [0.1.2](#012---2026-08-27) · [0.1.1](#011---2026-08-27) · [0.1.0](#010---2026-08-27)
 
 </details>
 
+## 0.12.0
+
+- **完整且无歧义的定位符名称本身不再生成验证动作。** 分类时排除完整且无歧义的文件名、路径和链接目标，保留相邻指令与链接文字；原文、来源哈希和范围不变，这些名称也不会产生执行权限。
+- **Guard 0.12.0 要求 DSH `0.2.1-rc.3` 或更高版本。** 包声明和运行时准入保留 rc.3 下限；默认审查基线为 rc.5（`dsh-0.2.1-rc.5-core-v1`），rc.3 宿主使用自己的审查队列，rc.2 仍低于下限。旧会话与 Guard 数据协议保持兼容；宿主锁变化后仍须重新核验。迁移收据新增物理库存证明，缺少该证明的旧收据须重新生成。
+- **rc.3→rc.5 累计研究未发现 Guard 消费接口变化。** 已审查 `dsh-v0.2.1-rc.3` 到 `dsh-v0.2.1-rc.5` 之间全部 13 个上游提交与 388 个变更文件：非 manifest 变更只有客户端 UI 思考块渲染与两处 ACP stdout 诊断改道，均与 Guard 无关。47 个核心闭包包全部重新对照官方 registry 核验（SRI + SHA-256）：闭包内可执行字节零变化、依赖路由结构不变、Cordis 保持共享的 4.0.5。新增 `manifests/rc021-rc5-byte-audit.json` 绑定这些已核验身份。
+- **宿主信任等价基线扩展为三个已审查发布状态**（rc.2、rc.3、rc.5），按已获取图的启动器版本选择；只有 loading 摘要与模块字节来自同一已审查状态时才判定等价。
+- **激活库存检测物理隐藏会话。** 对可执行字节及加载结构与已审查基线等价的 JSONL 后端执行只读物理盘点和文件流式摘要；隐藏、损坏、未来格式或未知布局按失败关闭。缺少证明的旧收据须重新 inventory 和 inspect。证明只覆盖所传目录，不能证明其就是当前配置，见[迁移限制](docs/ACTIVATION_MIGRATION.md)。
+- **激活迁移接受 Guard `0.11.x` 作为可信前驱。** 旧模式工具此前仅接受到 `0.10.x`，从 0.11.0 升级没有既定迁移路径；现在接受 `0.0.x`–`0.11.x`，当前及未来版本仍不得冒充前驱。unknown/off/冲突/pending 边界保持不变。
+- **官方 rc.5 Desktop 分发行分别登记 macOS arm64 与 Windows x64 身份。** 两端均核对官方分发包摘要及独立读取的已安装载体；macOS codesign、Windows Authenticode 通过，签名绑定的 ASAR header 与实测值一致，desktop/runtime 元数据及依赖字节分别核验。身份登记不代表 Guard 安装或生命周期验收通过，rc.3/rc.2 pin 不复用。
+- **上游已知风险不变：** rc.3 与 rc.5 宿主仍精确锁定 `undici` 8.11.2（`dsh-http-proxy`）与 `zod` 4.4.3（`dsh-commands`），上游默认分支仍锁定同一 Undici——本次适配没有关闭任何已披露缺口。维护者于 2026-11-02 单独接受本次 0.12.0 验收中相同三条 Undici 8.11.2 高危发现的剩余风险并特批例外准入，期限延至 **2026-11-30（含）**。自 2026-12-01 起，未经重新论证的例外恢复阻断。该接受不修复签名宿主，也不证明整个宿主不可达。原有两条例外保持其范围与到期日。0.12.0 开发链 lockfile 新增四条 moderate Undici 与四条 fast-uri moderate/low 公告，已记录、不阻断。见[依赖告警门禁](docs/DEPENDENCY_SCAN.md)。
+- **验收回执可恢复且无需重跑验收。** 缺失的 transfer receipt 可由原始 transfer intent 与已保存的验收结果恢复；恢复过程不重新执行验收，也不会把失败结果变成通过。
+- **失败、中断与超时的验收初始化保留现场。** 初始化失败、中断与超时会保留自有 fixture 并记录明确的 failed-cleanup 状态，含进程组与子进程清理；存活状态未知时保留 fixture 供归属诊断，不做处置。
+- **候选 CI 按变更风险选择覆盖。** 静态、打包与文档合同单跑一次；Ubuntu/Node 22 lane 跑完整确定性套件；其余平台/Node 组合通常跑 smoke；敏感或未知输入将六个 lane 全部扩展为完整套件，手动 dispatch 始终请求完整矩阵。
+- **暖宿主路由检查增加版本化原生补充入口。** 同一冻结 tgz 分别在真实、隔离的 Web 与 Headless 进程中运行：redirect、deny 必须拒绝且无新增模拟发布效果，恢复路由后同一未消费 resolution 必须成功。结果绑定源码、制品、驱动及平台；该验证工具不代表 GUI 或真实模型已通过。
+- 开发依赖固定在 `0.2.1-rc.5` 宿主闭包上，发布下限由官方 app-boot 消费者的真实准入决策钉住（`semver-matrix-v120.json`）。
+
+## 0.11.0
+
+- **安装 Guard 0.11.0 前，请先将 DSH 升级到 `0.2.1-rc.3` 或更高版本。** 包声明、运行时准入和默认审查基线统一以 rc.3 为下限。旧会话及 Guard 数据协议保持兼容；rc.2 身份记录作为历史证据保留。
+
+- **宿主锁注入不再损坏 JSON 形式的 patch 序列。** 受管条目写入序列内部，用户条目保持原样；原有 block YAML、字段内的 flow 值、activation 和仅 disabled 的覆盖继续受支持。语法错误、重复 key、歧义 Guard 字段及损坏的受管标记会在修改 profile 前拒绝；内置 YAML reader 不执行 `!!js` 表达式。完整配置组合与原生载入仍须分别验收。
+
+- **上游已知风险：**维护者为本次 0.11.0 明确临时接受三条 Undici 8.11.2 高危发现，期限**包含 2026-11-05 当日**。签名宿主仍未修复，详见[风险范围与到期规则](docs/DEPENDENCY_SCAN.md)；上游修复链通过核验后再继续更新。
+
+- 默认宿主审计核对声明文件和依赖路由，跳过无关目录扫描；使用资格回执的审计仍核对完整文件清单。
+
+- **“请分别执行”“依次分别执行”等已核对句式不再产生误读的禁止。** 这些句式中的“分别”等词保持完整；“这个别推送”“完成前别”等真正的禁止仍然有效。
+
+- **较长的宿主锁配置现在能完整输出到管道。** `verify-dump` 明确报告只核验 Guard 锁字段；完整配置解析和宿主载入仍须分别检查。
+
+- **激活 CLI 兼容官方 rc.3 持久化导出。** 清点与显式模式接纳支持 default 和 namespace 两种有效插件形态，无效模块在访问持久化数据前拒绝。
+
+- **发布 tgz 的包身份现在经由同一套可审计 tar 子集读取。** Guard、npm 与发布各阶段对"这些字节编码的是哪个 package.json"达成一致：resolution、执行前最终复核与发布后回读共用一个严格读取器——校验 header 校验和、理解 ustar prefix 与 npm 路径规范化，拒绝链接、PAX/GNU 扩展、规范化后重名及 `package/` 之外的路径。两个 manifest 互相矛盾的伪造档案（prefix 遮蔽加 `./` 别名）会在任何授权前被拒绝，发布授权不再可能绑定一个包名而 npm 实际安装另一个。读取在所有维度有预算——实际读取的压缩字节、解压输出、单成员大小、成员数量与 manifest 大小——高压缩比档案无法再在授权完成前拖垮宿主。
+- **registry 回读拥有自己的总时限与响应体预算。** 发布后的对账在插件自有总期限（与调用方取消组合）内读取精确版本的 registry 文档，按硬性字节预算流式接收响应体，并在每条退出路径释放 reader。缓慢、挂起或超量的 registry 都会在记录的预算内以稳定拒绝结束：尝试保持 in-flight，被拒绝的回读不写任何结算，也绝不重发 publish。
+- **私有存储保护跟随官方工作目录参数。** Bash/Pwsh 防护现在读取官方 `workdir` 参数（绝对、相对或符号链接别名），而不是宿主根本不发送的字段；相对文件目标按调用方可信的有效目录（最近一次提交的工作目录纪元）解析，相对目标无可证明基底时失败关闭。同一矩阵通过生产注册 guard 强制，而不只是 helper。
+- **文件回读绑定调用当时的目录。** 已提交 `working-directory/change` 之后，独立文件观察器按调用自身序号的 cwd 纪元解析相对目标，而不是不可变 header 目录，也不是当前日志末尾目录。后来的目录变化不能再把已完成 effect 重绑定到另一个同名文件；不可读时间线拒绝相对目标，绝对目标仍可观察。
+- **脱敏现在清除 URL 凭据与已记录的令牌族。** URL 中的 `user:password@` 按结构移除，有边界的 GitHub 令牌拼写（`ghp_`/`gho_`/`ghu_`/`ghs_`/`ghr_`/`github_pat_`）在归一化文本、URL 主体或恢复提示被存储前脱敏。[隐私说明](docs/PRIVACY.md)写明精确模式集及其边界；capture→replay 摘要保持确定性，历史摘要绝不静默重算。
+- **一次中断的 anchor 写入不再影响其他会话。** 共享 session-anchors 文件末尾被撕裂的一行按未提交追加处理：每条完整行对其会话保持权威，下一位持锁写者在追加前修复尾字节；中间坏行与冲突 anchor 仍对所有会话拒绝。
+- **合格首次创建可以在短暂写锁竞争后恢复。** 新 startup 会话的激活写入因短暂锁竞争失败时，运行时在其首创意图仍可证明期间按有界预算重试同一创建，随后返回明确的 `activation_writer_unavailable` 状态。重试同值幂等，绝不适用于 resume、迟挂载或已被删除的绑定。
+- **普通 fork 重新成为根会话。** `parentSession` 是分叉谱系而非委派：首次边界与指导、工作单元和确认语义现在适用于普通及恢复的 fork，宿主的显式子代理标记（`origin=subagent`、正 `delegationDepth`）继续保留委派限制。矛盾标记按委派处理。
+- rc.3 核心图已登记经 registry 核验的包身份与实现摘要；macOS arm64、Windows x64 官方 Desktop 分发行分别登记厂商签名及签名绑定的归档身份。安装、生命周期、真实模型和 UI 性能仍须分别验收。
+- **发布 tgz 身份在文件增长后仍然成立。** 可审计 tar 读取器按有界分块读到确认的 EOF，把身份绑定到实际读取的完整字节——元数据检查之后增长的制品不再可能按旧前缀摘要被接受。私有存储防护在默认目录不可证明（无可信工作目录）时拒绝 shell/文件调用；URL 凭据剥离按 URL authority 语义处理任意 scheme、大小写不敏感，合法 authority 引号不再被当作终结符。任何写者写入的激活绑定一旦被观察到，新会话首次创建重试即永久终止，删除后绝不重建文件。registry 对账在组合 deadline 下释放每一条响应体——包括错误响应与停滞的 body。依赖公告门禁现在遵守扫描器退出协议（失败的扫描绝不读作干净）、对每个安装版本逐一匹配例外，并记录真实 GitHub 公告编号。anchor 写入在回归套件中注入真实边界故障（部分写、fsync 失败、尾修复失败）：已提交同伴保持可读，下一位写者修复未提交尾。
+- **迁移库存接受 `0.10.x` 作为旧包版本**，从 0.10.0 升级沿用既有启用模式迁移路径；更早版本的规则不变。
+- **失败关闭的依赖公告门禁成为必需 CI 的一部分。** 新 `dependency-scan` job 对任何未接受的高危/严重公告阻断，扫描本身无法完成时同样失败；已接受例外保存在带校验、带到期日的表中，见[依赖公告门禁](docs/DEPENDENCY_SCAN.md)。开发链升级至 vitest 4.1.12（随之移除带漏洞的 tinypool 1.x pool），并设定兼容的 vite 与 source-map-js 下限。
+
 ## 0.10.0
 
 - **安装 Guard 0.10.0 前先升级 DSH。** 最低宿主为 `0.2.1-rc.2`，没有隐式上限。保留旧会话模式和配置，升级宿主、安装 Guard，再为各 profile 重建并回读宿主锁，核验后恢复启用。旧锁和完成证书不能转移到变化后的包图。[兼容性说明](docs/COMPATIBILITY.md#0100-dsh-021-rc2)保留已审查宿主身份，以及市场卡片、插件加载和 Guard 准入各自的边界。

package/README.md

@@ -10,17 +10,19 @@ DSH Completion Guard is a DeepSeek Harness plugin that keeps your task requireme
 
 ## Install or upgrade
 
-Requires DSH `>=0.2.1-rc.2`, Cordis `>=4.0.4`, Node.js `>=22` and pnpm `>=11`. Web, Headless and the official Desktop app have separate profiles. The reviewed host baseline is DSH `0.2.1-rc.2` / Cordis `4.0.5`; a later host must pass the same compatibility checks.
+Requires DSH `>=0.2.1-rc.3`, Cordis `>=4.0.4`, Node.js `>=22` and pnpm `>=11`. Upgrade DSH if it is below the minimum before installing Guard 0.12.0. Web, Headless and the official Desktop app have separate profiles. DSH `0.2.1-rc.5` with Cordis `4.0.5` is the recommended default reviewed baseline; rc.3 uses its own reviewed cohort, and all hosts require compatibility checks.
+
+**Known upstream risk:** the official rc.3 and rc.5 hosts still contain affected dependencies — `@deepseek-ai/dsh-http-proxy` exact-pins `undici` 8.11.2 and `@deepseek-ai/dsh-commands` exact-pins `zod` 4.4.3, so the previously disclosed high-risk findings remain present in the signed host. On 2026-11-02 the maintainer separately accepted the three disclosed high-risk Undici findings for 0.12.0 through **2026-11-30 inclusive**. The signed host remains unfixed; whole-host unreachability is not established and the process-crash risk cannot be excluded. See the [dependency advisory policy](docs/DEPENDENCY_SCAN.md) for the recorded findings, their scope and the standing publication gate.
 
 Choose your path before replacing any package:
 
 1. **First installation, no old Guard sessions:** stop the host, install Guard in the intended profile, then check and bind that installation before starting it.
-2. **Upgrading with old sessions:** stop the relevant writers and preserve the old installed package and its effective mode sources. Prepare a frozen session inventory and migration receipt **before upgrading**. After installation, rebuild the host lock and complete mode `adopt` and `verify` while writers remain stopped. Do not start the upgraded host until those checks pass for the intended scope. Unknown old modes stay pending.
+2. **Upgrading with old sessions:** stop the relevant writers and preserve the old installed package and its effective mode sources. First independently verify the persistence root and compression against the active configuration; the inventory proof covers only the supplied root ([migration guide](docs/ACTIVATION_MIGRATION.md)). Prepare a frozen session inventory and migration receipt **before upgrading**. After installation, rebuild the host lock and complete mode `adopt` and `verify` while writers remain stopped. Do not start the upgraded host until those checks pass for the intended scope. Unknown old modes stay pending. Receipts created without the physical inventory proof must be regenerated with `inventory` and `inspect`.
 
 For Web, after the applicable preparation:
 
 ```sh
-dsh plugin --profile web add dsh-completion-guard@0.10.0
+dsh plugin --profile web add dsh-completion-guard@0.12.0
 ```
 
 Installation alone is not enough. The **host lock** records the actual packages and directories this profile loads; check it with `inspect`, write it with `inject`, then check the composed configuration with `verify-dump`. Back up `cordis.patch.yml` before injection. [Installation and first load](docs/GETTING_STARTED.md) provides the Web commands, Windows and Desktop routes, and the final checks before startup. [Old-session migration](docs/ACTIVATION_MIGRATION.md) provides the preparation, commands and copyable AI prompts for an upgrade.
@@ -39,6 +41,8 @@ An **old session** keeps its verified pre-upgrade mode, including an empty old s
 
 Ask DSH to edit a file or run a test as usual. DSH executes the tools; Guard records the request and checks the saved result and any required readback. For example, “edit the configuration and make the tests pass” needs evidence of the changed file and a passing test, not just the assistant saying it is done. `context_guard_prepare` explains missing evidence; `context_guard_checkpoint` checks completion.
 
+Compared with 0.11, Guard also distinguishes complete, unambiguous file names and paths from verification requests: a name such as `verify.pdf` does not by itself create a verification check. Actual instructions beside the name still count.
+
 The default policy is still `standard`. Automatic protection grants no extra editing, execution or publication permission, and does not issue a certificate automatically.
 
 ## Mode and everyday commands

package/README.zh-CN.md

@@ -10,17 +10,19 @@ DSH Completion Guard 是 DeepSeek Harness 插件，负责保存任务要求，
 
 ## 安装或升级
 
-需要 DSH `>=0.2.1-rc.2`、Cordis `>=4.0.4`、Node.js `>=22` 和 pnpm `>=11`。Web、Headless 和官方 Desktop 应用使用各自的配置目录。已审查的宿主基线是 DSH `0.2.1-rc.2` / Cordis `4.0.5`，更新版本仍须通过兼容性核验。
+需要 DSH `>=0.2.1-rc.3`、Cordis `>=4.0.4`、Node.js `>=22` 和 pnpm `>=11`。安装 Guard 0.12.0 前，低于下限的 DSH 须先升级。Web、Headless 和官方 Desktop 应用使用各自的配置目录。推荐的默认审查基线为 DSH `0.2.1-rc.5` 和 Cordis `4.0.5`；rc.3 使用自己的审查队列，所有宿主仍须通过兼容性核验。
+
+**上游已知风险：**官方 rc.3 和 rc.5 宿主仍包含受影响依赖——`@deepseek-ai/dsh-http-proxy` 精确锁定 `undici` 8.11.2，`@deepseek-ai/dsh-commands` 精确锁定 `zod` 4.4.3，此前披露的高危发现仍在签名宿主内。维护者于 2026-11-02 单独接受本次 0.12.0 的三条已披露 Undici 高危剩余风险，并将期限延至 **2026-11-30（含）**。签名宿主未修复，不能证明整个宿主不可达，也不能排除进程崩溃风险。已记录的发现、范围与常设发布门槛见[依赖通告策略](docs/DEPENDENCY_SCAN.md)。
 
 先选好路径，再替换任何包：
 
 1. **首次安装，没有旧 Guard 会话**：停止宿主，在使用的 profile 中安装 Guard，核验并绑定本次安装后再启动。
-2. **已有旧会话，需要升级**：先停止相关写者，保留旧安装包及其有效模式来源。**升级前**冻结会话库存并准备迁移收据。安装后重建宿主锁，保持写者停止，完成旧模式的 `adopt` 和 `verify`；目标范围核验通过前不能启动升级后的宿主。无法核实的旧模式保持待处理。
+2. **已有旧会话，需要升级**：先停止相关写者，保留旧安装包及其有效模式来源。先独立核对实际配置使用的持久化目录及压缩方式；库存证明只覆盖所传目录（见[迁移指南](docs/ACTIVATION_MIGRATION.md)）。**升级前**冻结会话库存并准备迁移收据。安装后重建宿主锁，保持写者停止，完成旧模式的 `adopt` 和 `verify`；目标范围核验通过前不能启动升级后的宿主。无法核实的旧模式保持待处理。没有物理库存完整性证明的旧收据须重新执行 `inventory` 和 `inspect`。
 
 Web 在完成相应准备后安装：
 
 ```sh
-dsh plugin --profile web add dsh-completion-guard@0.10.0
+dsh plugin --profile web add dsh-completion-guard@0.12.0
 ```
 
 装好插件还需核验环境。**宿主锁**记录这个 profile 实际加载的包和目录：先用 `inspect` 检查，再用 `inject` 写入，最后以 `verify-dump` 核对组合配置；注入前备份 `cordis.patch.yml`。[安装与首次载入](docs/GETTING_STARTED.md)给出 Web 命令、Windows 和 Desktop 路径及启动前的最后核验。[旧会话迁移指南](docs/ACTIVATION_MIGRATION.md)提供升级准备、完整命令和可复制的 AI 提示词。
@@ -39,6 +41,8 @@ dsh plugin --profile web add dsh-completion-guard@0.10.0
 
 照常让 DSH 改文件、跑测试即可。DSH 执行工具，Guard 保存要求，并核对已记录的结果和必要的回读。例如，“修改配置并让测试通过”需要修改后的文件证据和通过的测试结果，助手说“已完成”还不够。`context_guard_prepare` 说明缺什么证据，`context_guard_checkpoint` 检查能否认证完成。
 
+相比 0.11，Guard 还会区分完整且无歧义的文件名、路径与验证要求：例如 `verify.pdf` 本身不会生成验证项；文件名旁的真实指令仍会保留。
+
 默认策略仍是 `standard`。自动参与保护不会增加修改、执行或发布权限，也不会自动签发完成证书。
 
 ## 模式和常用命令

package/bin/dsh-completion-guard-activation.mjs

@@ -1,13 +1,16 @@
 #!/usr/bin/env node
-import { readFileSync, writeFileSync, realpathSync } from 'node:fs'
+import { readFileSync, writeFileSync, realpathSync, readdirSync } from 'node:fs'
 import { createRequire } from 'node:module'
-import { pathToFileURL } from 'node:url'
-import { resolve } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import { dirname, join, resolve } from 'node:path'
+import { createHash } from 'node:crypto'
 import { homedir } from 'node:os'
 import { activationJson, activationCanonical, inspectActivationInventory, prepareActivationMigration,
   readActivationMigrationReceipt, verifyMigrationInventory, adoptActivationReceipt, resolveActivationBindingsRoot,
   scanActivationInventory, createActivationSelection, validateActivationSelection, activationSelectionPending,
-  prepareSelectedActivationMigration, verifySelectedMigrationInventory, isSelectedActivationReceipt } from '../dist/domain/index.js'
+  prepareSelectedActivationMigration, verifySelectedMigrationInventory, isSelectedActivationReceipt,
+  validateActivationInventorySnapshot, bindActivationInventoryPhysical, createActivationMigrationReceipt, activationDigest,
+  captureActivationPhysicalInventory, guardActivationInventory, resolveActivationPersistencePlugin, assertActivationBackendIdentity } from '../dist/domain/index.js'
 
 const operation = process.argv[2]
 const common = ['--runtime-anchor', '--persistence-root', '--compression']
@@ -37,29 +40,87 @@ async function main() {
     options.set(key, value)
   }
   if (operation === 'select') {
-    const selection = createActivationSelection(readJson(option('--inventory')), readJson(option('--include-file')))
+    const source = validateActivationInventorySnapshot(readJson(option('--inventory')))
+    if (!source.physicalSha256) throw new Error('activation_inventory_proof_required')
+    const selection = createActivationSelection(source, readJson(option('--include-file')))
     save(option('--output'), selection)
     print({ status: 'selection_ready', includedCount: selection.include.length, selectionSha256: selection.sha256 })
     return
   }
   const selection = option('--selection', true) ? validateActivationSelection(readJson(option('--selection'))) : undefined
   const receipt = ['adopt', 'verify'].includes(operation) ? readActivationMigrationReceipt(resolve(option('--receipt'))) : undefined
+  if (receipt && !receipt.inputs.physical_inventory) throw new Error('activation_inventory_proof_required')
   if (receipt && !selection && isSelectedActivationReceipt(receipt)) throw new Error('activation_selection_required')
   const anchor = realpathSync(option('--runtime-anchor'))
   const require = createRequire(anchor)
-  const { Context } = await import(pathToFileURL(require.resolve('@deepseek-ai/cordis')).href)
   const backendPath = require.resolve('@deepseek-ai/dsh-session-persistence-jsonl')
-  const { default: Jsonl } = await import(pathToFileURL(backendPath).href)
+  // The physical layout is qualified by reviewed module bytes and loader
+  // shape; a version relabel alone does not change that capability.
+  const backendFile = realpathSync(backendPath)
+  const backendRoot = dirname(dirname(backendFile))
+  const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)))
+  const digest = bytes => createHash('sha256').update(bytes).digest('hex')
+  const checkedBackend = () => {
+    const packageBytes = readFileSync(join(backendRoot, 'package.json'))
+    const manifest = JSON.parse(packageBytes.toString('utf8'))
+    const audit = JSON.parse(readFileSync(join(packageRoot, 'manifests', 'rc021-rc5-byte-audit.json'), 'utf8'))
+    const row = audit.packages.find(row => row.name === '@deepseek-ai/dsh-session-persistence-jsonl')
+    if (!row || backendFile !== realpathSync(join(backendRoot, 'lib/index.js'))) throw new Error('activation_backend_unreviewed')
+    const moduleTree = root => {
+      const files = {}
+      const walk = (directory, prefix = '') => {
+        for (const entry of readdirSync(directory, { withFileTypes: true })) {
+          if (entry.name === 'node_modules') continue
+          const name = prefix + entry.name, path = join(directory, entry.name)
+          if (entry.isSymbolicLink()) throw new Error('activation_backend_unreviewed')
+          if (entry.isDirectory()) walk(path, `${name}/`)
+          else if (entry.isFile() && /\.(?:[cm]?js|json|node)$/u.test(name) && name !== 'package.json') files[name] = digest(readFileSync(path))
+          else if (!entry.isFile()) throw new Error('activation_backend_unreviewed')
+        }
+      }
+      walk(root)
+      return files
+    }
+    const modules = moduleTree(backendRoot)
+    assertActivationBackendIdentity(manifest, modules, row.modules)
+    const backendRequire = createRequire(backendFile)
+    const dependencies = ['@deepseek-ai/dsh-session-format', '@deepseek-ai/dsh-session-format-catalog',
+      '@deepseek-ai/dsh-session-format-catalog/message-projections', '@deepseek-ai/dsh-session-format-v3-to-v4',
+      '@deepseek-ai/dsh-session-persistence', '@deepseek-ai/dsh-session', '@deepseek-ai/cordis',
+      '@deepseek-ai/node-addon-system/flock'].map(specifier => {
+      const file = realpathSync(backendRequire.resolve(specifier))
+      const name = specifier.split('/').slice(0, 2).join('/')
+      const metadata = realpathSync(backendRequire.resolve(`${name}/package.json`))
+      return { specifier, file, sha256: digest(readFileSync(file)), metadata, metadataSha256: digest(readFileSync(metadata)), modules: moduleTree(dirname(metadata)) }
+    })
+    return activationDigest({ name: manifest.name, version: manifest.version, backendFile, packageSha256: digest(packageBytes), modules,
+      dependencies, node: process.versions.node, zstd: process.versions.zstd ?? null })
+  }
+  const backendSha256 = checkedBackend()
+  const jsonlModule = await import(pathToFileURL(backendFile).href)
+  const Jsonl = resolveActivationPersistencePlugin(jsonlModule)
+  const { Context } = await import(pathToFileURL(require.resolve('@deepseek-ai/cordis')).href)
   // Resolve the same dependency instance used by this physical JSONL backend.
   const { SessionFormatUnsupportedError } = await import(pathToFileURL(createRequire(backendPath).resolve('@deepseek-ai/dsh-session-persistence')).href)
   const ctx = new Context()
   const compression = option('--compression', true)
   if (compression && !['none', 'zstd'].includes(compression)) throw new Error('invalid compression')
-  const backend = ctx.plugin(Jsonl, { root: resolve(option('--persistence-root')), ...(compression ? { compression } : {}) })
+  const persistenceRoot = resolve(option('--persistence-root'))
+  const physical = () => {
+    if (checkedBackend() !== backendSha256) throw new Error('activation_inventory_changed')
+    return captureActivationPhysicalInventory(persistenceRoot, compression ?? 'zstd', backendSha256)
+  }
+  const backend = ctx.plugin(Jsonl, { root: persistenceRoot, ...(compression ? { compression } : {}) })
   try {
     await backend.await()
+    const persistence = ctx.sessionPersistence
+    if (!persistence || ['list', 'open', 'stat'].some(name => typeof persistence[name] !== 'function')) throw new Error('activation_backend_unreviewed')
+    const fence = guardActivationInventory(persistence, physical)
+    const initial = fence.initial, checkPhysical = fence.check
+    const guarded = { list: fence.list,
+      open: (...args) => persistence.open(...args), stat: (...args) => persistence.stat(...args) }
     const snapshot = operation === 'inventory' || selection
-      ? await scanActivationInventory(ctx.sessionPersistence, error => error instanceof SessionFormatUnsupportedError) : undefined
+      ? bindActivationInventoryPhysical(await scanActivationInventory(guarded, error => error instanceof SessionFormatUnsupportedError), checkPhysical().sha256) : undefined
     if (operation === 'inventory') {
       save(option('--output'), snapshot)
       print({ status: 'inventory_scanned', totalCount: snapshot.rows.length,
@@ -67,14 +128,19 @@ async function main() {
         unsupportedCount: snapshot.rows.filter(row => row.status === 'unsupported').length, inventorySha256: snapshot.sha256 })
       return
     }
-    const inventory = selection ? undefined : await inspectActivationInventory(ctx.sessionPersistence)
+    const inventory = selection ? undefined : await inspectActivationInventory(guarded)
+    checkPhysical()
+    if (receipt && receipt.inputs.physical_inventory !== initial.sha256) throw new Error('activation_inventory_changed')
     const scope = selection ? { scope: 'receipt_selected', wholeInventoryStatus: 'not_claimed',
       includedCount: selection.include.length, inventoryCount: snapshot.rows.length,
       pending: activationSelectionPending(snapshot, selection) } : {}
     if (operation === 'inspect') {
       const prior = readJson(option('--prior-modes'))
       const result = selection ? prepareSelectedActivationMigration(snapshot, selection, prior) : prepareActivationMigration(inventory, prior)
-      if (result.receipt) save(option('--output'), result.receipt)
+      if (result.receipt) {
+        result.receipt = createActivationMigrationReceipt(result.receipt.entries, { ...result.receipt.inputs, physical_inventory: checkPhysical().sha256 })
+        save(option('--output'), result.receipt)
+      }
       print({ ...result, receipt: undefined, ...scope, count: selection ? selection.include.length : inventory.length,
         ...(result.receipt ? { receiptSha256: result.receipt.sha256 } : {}) })
       if (result.status !== 'ready') process.exitCode = 2
@@ -82,7 +148,9 @@ async function main() {
       if (selection) verifySelectedMigrationInventory(receipt, snapshot, selection)
       else verifyMigrationInventory(receipt, inventory)
       const root = resolveActivationBindingsRoot(option('--dsh-home', true) ?? process.env.DSH_HOME, homedir())
+      checkPhysical()
       const result = adoptActivationReceipt(root, receipt, operation === 'verify')
+      checkPhysical()
       print({ ...result, ...scope, status: selection ? (result.status === 'complete' ? 'selected_complete' : 'selected_partial') : result.status })
       if (result.status !== 'complete') process.exitCode = 2
     }

package/bin/dsh-completion-guard-host-lock.mjs

@@ -71,6 +71,21 @@ function summary(evaluation) {
   }
 }
 
+async function writeOutput(stream, text) {
+  await new Promise((resolve, reject) => {
+    const onError = error => reject(error)
+    stream.once('error', onError)
+    try {
+      stream.write(text, error => {
+        if (error) { reject(error); return } // The error event is consumed by onError.
+        stream.removeListener('error', onError)
+        resolve()
+      })
+    } catch (error) { stream.removeListener('error', onError); reject(error) }
+  })
+}
+
+async function main() {
 try {
   const command = process.argv[2]
   if (!['inspect', 'inspect-graph', 'inject', 'verify-dump', 'dump-desktop'].includes(command)) {
@@ -89,7 +104,7 @@ try {
       platform: process.platform === 'win32' ? 'windows' : 'posix',
       profileKind: 'desktop',
     }, trust ? JSON.stringify(trust) : undefined, profileRoot)
-    process.stdout.write(`${JSON.stringify({
+    await writeOutput(process.stdout, `${JSON.stringify({
       ...summary(evaluation),
       inspection_scope: 'pre_install_target',
       profile_graph: target.profileGraph,
@@ -104,7 +119,8 @@ try {
       },
       packages: target.packages,
     })}\n`)
-    process.exit(evaluation.status === 'supported' ? 0 : 1)
+    process.exitCode = evaluation.status === 'supported' ? 0 : 1
+    return
   }
   if (command === 'inspect-graph') {
     const trust = hasFlag('--rebind-registry')
@@ -115,8 +131,9 @@ try {
       platform: process.platform === 'win32' ? 'windows' : 'posix',
       ...(target.profileGraph.state === 'dependency_free_headless' ? { profileKind: 'headless' } : {}),
     }, trust ? JSON.stringify(trust) : undefined, option('--profile-root'))
-    process.stdout.write(`${JSON.stringify({ ...summary(evaluation), inspection_scope: 'pre_install_target', profile_graph: target.profileGraph, packages: rows })}\n`)
-    process.exit(evaluation.status === 'supported' ? 0 : 1)
+    await writeOutput(process.stdout, `${JSON.stringify({ ...summary(evaluation), inspection_scope: 'pre_install_target', profile_graph: target.profileGraph, packages: rows })}\n`)
+    process.exitCode = evaluation.status === 'supported' ? 0 : 1
+    return
   }
   // Explicit registry rebind. Existing baseline inspection stays offline.
   const trust = hasFlag('--rebind-registry')
@@ -160,18 +177,22 @@ try {
       env: { ...process.env, ELECTRON_RUN_AS_NODE: '1', DSH_HOME: dirname(dirname(profileRoot)) },
       stdio: ['ignore', 'pipe', 'pipe'],
     })
-    process.stdout.write(output)
-    process.exit(0)
+    await writeOutput(process.stdout, output)
+    return
   }
   if (command === 'inject') injectActiveProfileHostLock(active)
   if (command === 'verify-dump') {
     verifyComposedHostLockDump(readFileSync(option('--dump-config') === '-' ? 0 : option('--dump-config'), 'utf8'), active.evaluation, active)
   }
-  process.stdout.write(`${JSON.stringify({ ...summary(active.evaluation),
+  await writeOutput(process.stdout, `${JSON.stringify({ ...summary(active.evaluation),
     ...(command === 'inspect' ? { inspection_scope: 'active_profile' } : {}),
+    ...(command === 'verify-dump' ? { verification_scope: 'guard_host_lock_fields', configuration_syntax: 'not_checked' } : {}),
   })}\n`)
 } catch (error) {
   const code = error && typeof error === 'object' && 'code' in error ? String(error.code) : 'host_lock_command_failed'
-  process.stderr.write(`${JSON.stringify({ status: 'unavailable', reason_code: code })}\n`)
   process.exitCode = 1
+  try { await writeOutput(process.stderr, `${JSON.stringify({ status: 'unavailable', reason_code: code })}\n`) } catch { /* A closed diagnostic pipe still fails. */ }
+}
+
 }
+await main()

package/dist/domain/index.d.ts

@@ -1,2 +1,2 @@
-import { $ as assessmentOutcomePredicate, $a as CheckpointResult, $c as SUPPORTED_EVIDENCE_ADAPTERS, $i as EXPECTED_HOST_PACKAGES, $n as inspectTargetHostGraph, $o as JobLifecycleRecord, $r as executeRevalidatedGitEffect, $s as ExecutionQualification, $t as bindProofToProjection, A as InitialActivation, Aa as LATEST_TESTED_HOST_VERSION, Ac as namedActions, Ai as UnifiedItemDiagnosis, An as FirstStepPreviewInput, Ao as DeferAuthorization, Ar as HostTrustedPackage, As as replayRebindResult, At as closingHint, B as RC020_RC2_HOST_PACKAGES, Ba as AuthorityBlock, Bc as statefulActionsOfScope, Bi as PROTOCOL_V4_NOTICE, Bn as TargetHostGraph, Bo as ExpectedTransition, Br as GitCommandAccepted, Bs as ProcessFactSource, Bt as PROOF_PROTOCOL_VERSION, C as createActivationMigrationReceipt, Ca as evaluateHostLock, Cc as isQuestionScopeNeedingReview, Ci as persistedToolResultStatus, Cn as CommandSurfaceManifest, Co as qualifyBoundary, Cr as readDesktopAppRuntime, Cs as RebindProposal, Ct as RecoveryCause, D as resolveSessionActivation, Da as HOST_VALIDATED_VERSIONS, Dc as legacyQuestionReadingIsInformational, Di as DiagnosisNextAction, Dn as ClaimedMessage, Do as BoundaryDisposition, Dr as HostRebindTrust, Ds as proposeRebindV042, Dt as V6_ORDINARY_COMPLETION_RULE_SHORT, E as resolveActivationBindingsRoot, Ea as selectHostCohort, Ec as kindOfScope, Ei as CertificationSupport, En as validateManifest, Eo as BindingActionClosure, Er as writeDesktopRuntimeReceipt, Es as proposeRebindOutcome, Et as V6_ORDINARY_COMPLETION_RULE_COMPACT, F as activationDigest, Fa as compareHostVersions, Fc as questionHeadsClause, Fi as nativeFileTwoRole, Fn as lifecyclePhase, Fo as DerivedEnvelope, Fr as registryArchiveFiles, Fs as DeclaredOperationResult, Ft as v6CurrentRootBoundaries, G as AssistantOutcomeObservation, Ga as TaskIntent, Gc as ActionSpec, Gi as legacyRecordsNeedingReview, Gn as auditedHostImplementation, Go as GuardEvidence, Gr as GitEffectRunner, Gs as capabilityConsequence, Gt as ProofKindV2, H as projectSessionCoreV2, Ha as AuthorityKind, Hc as ACTION_MANIFEST, Hi as PROTOCOL_V6_NOTICE, Hn as auditedDefaultWorkdirHost, Ho as GoalRef, Hr as GitCommandParseResult, Hs as RemovalOutcomeReport, Ht as ProofHostSurface, I as activationJson, Ia as evaluateMinimumHostVersion, Ic as reportingHeadGoverns, Ii as relevantEvidence, In as previewFirstStepInjection, Io as EvidenceBinding, Ir as registryArchiveModules, Is as DependencyStatus, It as PROOF_CAPABILITY_MATRIX, J as CurrentActionBasis, Ja as classifyUserInteraction, Jc as CERTIFICATE_VERSION_V2, Ji as ACTIVE_HOST_COHORT_IDS, Jn as evaluateConfiguredHostLock, Jo as GuardItemKind, Jr as GitTargetIdentity, Js as removalIsComplete, Jt as ProofObligation, K as CONTROL_RECORD_PREFIX, Ka as UserInteractionKind, Kc as BOUNDED_ARTIFACT_TYPES, Ki as rootLocatorFlavor, Kn as combineHostPolicy, Ko as GuardIntegrity, Kr as GitPrestateCheck, Ks as capabilityFactOf, Kt as ProofManifest, L as sessionBirthIdentity, La as parseHostVersion, Lc as restatedContentOf, Li as CAPTURE_V042_NOTICE, Ln as ActiveProfileHostLock, Lo as EvidenceOutcome, Lr as GIT_COMMAND_MANIFEST_IDS, Ls as DerivedProcessFacts, Lt as PROOF_KINDS, M as SessionActivationRead, Ma as ParsedHostVersion, Mc as opensWithDirective, Mi as deriveItemDiagnosis, Mn as claimedBatchHasRealRootInput, Mo as DeriveConfig, Mr as hostTrustDigest, Ms as CapabilityGap, Mt as recoveryDigest, N as SessionBirthIdentity, Na as SUPPORTED_HOST_RANGE, Nc as presentExplanationHead, Ni as evidenceAvailabilityReason, Nn as firstStepGuidance, No as DeriveResult, Nr as parseHostTrust, Ns as CapabilityRemedy, Nt as recoveryTitle, O as validateActivationMigrationReceipt, Oa as HostVersionDecision, Oc as maskCodeSpans, Oi as Repairability, On as FIRST_STEP_GUIDANCE, Oo as BoundaryQualificationKind, Or as HostTrustAcquisitionOptions, Os as rebindAttemptKey, Ot as carriesCleanupCondition, P as activationCanonical, Pa as SUPPORTED_HOST_VERSIONS, Pc as qualificationOfClause, Pi as itemDiagnosis, Pn as firstStepGuidanceV6, Po as DeriveScope, Pr as qualifyHostTrust, Ps as DEPENDENCY_FREE_ONLY_CONDITION, Pt as renderRecoveryPacket, Q as assessmentAction, Qa as parseConfirmationMessage, Qc as STOP_PROTOCOL_VERSION_V2, Qi as DEFAULT_HOST_LOCK, Qn as inspectDesktopTargetGraph, Qo as HostStatus, Qr as createGitPrestateEnvelope, Qs as Executee, Qt as SessionQueryV2, R as validateActivationBinding, Ra as satisfiesSupportedHostRange, Rc as semanticActionOfScope, Ri as DEFAULT_DELEGATION_TOOL_NAMES, Rn as AuditedPackageExpectation, Ro as EvidenceParseStatus, Rr as GIT_COMMAND_TEMPLATES, Rs as OperationAttribution, Rt as PROOF_KINDS_V2, S as adoptActivationReceipt, Sa as evaluateHostCapability, Sc as isOpenObligation, Si as nativeGitParentOidVerified, Sn as COMMAND_SURFACE_MANIFEST, So as isCurrentAcceptedBoundary, Sr as readAsarIndex, Ss as RebindArgs, St as MIN_RECOVERY_CHAR_BUDGET, T as readActivationMigrationReceipt, Ta as hostVersionFromPackages, Tc as itemHoldsExecutionAuthority, Ti as withDurability, Tn as OperationVerbEntry, To as AssetObligation, Tr as readDesktopTargetGraph, Ts as proposeRebind, Tt as V6_ORDINARY_COMPLETION_RULE, U as projectCoreV2, Ua as authorityCaptureCounts, Uc as ACTION_MANIFEST_VERSION, Ui as applyUpgradeEligibility, Un as auditedDefaultWorkdirProvider, Uo as GuardBoundary, Ur as GitCommandRejected, Us as actionHasCertificationPath, Ut as ProofKind, V as RC020_RC1_HOST_PACKAGES, Va as AuthorityBlockKind, Vc as verbIsNegated, Vi as PROTOCOL_V5_NOTICE, Vn as activeRendererModule, Vo as ExternalOperation, Vr as GitCommandManifest, Vs as ProcessOutcomeReason, Vt as PROOF_PROTOCOL_VERSION_V2, W as supersedeItem, Wa as segmentAuthorityBlocks, Wc as ActionManifest, Wi as deriveProjection, Wn as auditedForegroundRenderers, Wo as GuardCheckpoint, Wr as GitEffectExecution, Ws as admissibleForRemoval, Wt as ProofKindCapability, X as NO_PROGRESS_TURNS_BEFORE_STOP, Xa as ParsedConfirmation, Xc as STATEFUL_ACTIONS, Xi as AuditedExecutable, Xn as hostLockRowsFromComposedDump, Xo as GuardOperation, Xr as commitIndexSnapshotDigest, Xs as AuthorityDisposition, Xt as ProofSurface, Y as NO_PROGRESS_RECORD_PREFIX, Ya as CONFIRM_LINE_PATTERN, Yc as SEMANTIC_ACTIONS, Yi as ACTIVE_HOST_LAUNCHER_VERSION, Yn as hostLockContextFromComposedDump, Yo as GuardItemStatus, Yr as LinearCommitReadback, Ys as removalIsPartiallyKnown, Yt as ProofObligationV2, Z as TurnStoppingDecision, Za as isFrozenV042RebindResponse, Zc as STOP_PROTOCOL_VERSION, Zi as BASE_HOST_PACKAGES, Zn as injectActiveProfileHostLock, Zo as GuardProjection, Zr as commitTreeSnapshotDigest, Zs as DirectiveClass, Zt as SessionQuery, _ as verifyMigrationInventory, _a as HostToolSurface, _c as interpretMessage, _i as ToolSubject, _l as sha256, _n as EvidenceFacetCoverage, _o as BoundaryRequest, _r as auditDesktopInstalledImplementation, _t as snapshotSessionEvents, a as isSelectedActivationReceipt, aa as HostAuditProvenance, ac as ScopeInterpretation, ai as CanonicalCommandSurface, al as requestedIdentityKey, an as proofDigest, ao as captureClause, ar as readActiveHostGraph, as as TargetCaptureReasonCode, at as isRootPauseRequest, b as __activationBindingInternals, ba as evaluateExternalWaitCapability, bc as isExplanationScope, bi as extractToolSubject, bn as evidenceMatchesItem, bo as availableBoundaryQualifications, br as memoizedAsarIndex, bs as BoundedSource, bt as CLEANUP_CONDITION_RULE_SHORT, c as selectedActivationInventory, ca as HostCapabilityRequest, cc as clauseAsksOwnQuestion, ci as canonicalArgvFromCommand, cl as semanticActionFromCommand, cn as proofHostSurfacesOf, co as environmentDefaultRepositoryTarget, cr as resolveInstalledHostLock, cs as TargetSourceKind, ct as latestRootInstruction, d as verifySelectedMigrationInventory, da as HostCohortSelectionReason, dc as explanationHasActionResidue, di as parseShellCommand, dl as validateActionTarget, dn as requiredSubjectsOf, do as extractOperation, dr as AsarIndex, ds as VerificationContract, dt as testOutcomePredicate, ea as ExecutableIdentity, ec as GRANTED_QUALIFICATION, ei as gitCommandMatchesTarget, el as SemanticAction, en as bindProofV2ToProjection, eo as RejectedBinding, er as packageRowsFromActiveGraph, es as MessageCoverage, et as classifyCompletionClaim, f as privateStorageToolDenial, fa as HostLockContext, fc as governedClauseRestrictsExecution, fi as goalCompletionDenial, fl as canonicalizePath, fn as scopeCoverageDigest, fo as isInformationalMessage, fr as DESKTOP_IDENTITY_FACTS, fs as WaitAuthorization, ft as v6TestPredicate, g as prepareActivationMigration, ga as HostProfileKind, gc as interpretClause, gi as ToolResultInput, gl as sanitizeUrl, gn as validateProofManifestV2, go as BoundaryQualification, gr as DesktopTargetGraph, gt as V4SessionLike, h as inspectActivationInventory, ha as HostPlatform, hc as hasWorkPredicate, hi as ToolCallInput, hl as sanitizeClauseText, hn as validateProofManifest, ho as BoundaryEffectuation, hr as DesktopAppRuntime, ht as SessionApiError, i as createActivationSelection, ia as HOST_COHORTS, ic as QualificationStatus, ii as CanonicalArgv, il as isStatefulAction, in as proofCapabilityReport, io as ClauseSegment, ir as prepareTargetHostTrust, is as SourceSpan, it as decisionBoundaryKey, j as SessionActivationBinding, ja as MIN_SUPPORTED_HOST_VERSION, jc as opensConditionLead, ji as capabilityRemedyPhrase, jn as LifecyclePhase, jo as DelegationRef, jr as acquireHostTrust, js as CapabilityFact, jt as openItems, k as writeActivationBinding, ka as HostVersionStatus, kc as maskQuotedSpans, ki as TaskKind, kn as FirstStepInjection, ko as CwdEpoch, kr as HostTrustError, ks as rebindResponse, kt as cleanupConditionFor, l as validateActivationInventorySnapshot, la as HostCohort, lc as clauseIsGoverned, li as isRunExecutable, ll as semanticActionFromText, ln as proofOperationMatches, lo as extractArtifactPaths, lr as revalidateDesktopCoreLock, ls as TargetTuple, lt as observeAssistantOutcome, m as ActivationPriorModes, ma as HostLockStatus, mc as hasQuestionScope, mi as NATIVE_GIT_ROOT_PARENT_OID, ml as normalizeClause, mn as sessionQueryV2, mo as BOUNDARY_RECORD_PREFIX, mr as DESKTOP_RUNTIME_PACKAGE_NAME, ms as createProjection, mt as SESSION_EVENT_ENVELOPE_INVALID, n as ActivationMigrationSelection, na as GOAL_HOST_PACKAGES, nc as LEGACY_QUALIFICATION, ni as revalidateGitPrestate, nl as actionCompatible, nn as createProofManifest, no as certifyCheckpoint, nr as prepareActiveHostTrust, ns as NeedsReviewReason, nt as decideTurnBoundary, o as prepareSelectedActivationMigration, oa as HostCapabilityEvaluation, oc as actionVerbMatches, oi as ParsedShell, ol as requestedTargetAuthorizesMutation, on as proofDigestV2, oo as captureItem, or as resolveActiveProfileHostLock, os as TargetCaptureStatus, ot as isWholeTaskCompletionClaim, p as ActivationInventoryPersistence, pa as HostLockEvaluation, pc as hasOrderedCoordination, pi as hasCurrentCertificate, pl as digestStrings, pn as sessionQuery, po as segmentClauses, pr as DESKTOP_PROFILE_PACKAGE_NAME, ps as WorkUnit, pt as SESSION_API_UNSUPPORTED, q as CompletionDisposition, qa as classifyTaskIntent, qc as CERTIFICATE_VERSION, qi as ACTIVE_HOST_COHORT_ID, qn as evaluateActiveHostLock, qo as GuardItem, qr as GitPrestateEnvelope, qs as partialFailureOf, qt as ProofManifestV2, r as activationSelectionPending, ra as HOST_CAPABILITY_PACKAGE_GROUPS, rc as QualificationReason, ri as verifiedLinearCommitReadback, rl as boundedArtifactChoiceMatches, rn as createProofManifestV2, ro as CaptureScope, rr as prepareDesktopHostTrust, rs as PersistenceAuthorization, rt as decideTurnStopping, s as scanActivationInventory, sa as HostCapabilityId, sc as clarifiedSpanOf, si as ShellParseStatus, sl as requestedTargetMatchesResolved, sn as proofEvidenceConstraints, so as classifyClause, sr as resolveDesktopProfileHostLock, ss as TargetSource, st as latestAssistantText, t as ActivationInventorySnapshot, ta as ExecutableIdentityBinding, tc as InterpretOptions, ti as parseGitCommandManifest, tl as StatefulAction, tn as canonicalProjection, to as bindingIndividuallyAccepted, tr as packageRowsFromPnpmLock, ts as NeedsReviewFact, tt as currentActionBases, u as validateActivationSelection, ua as HostCohortSelection, uc as clauseIsProtected, ui as parsePwshCommand, ul as validateActionManifest, un as proofV2Rejection, uo as extractMethod, ur as verifyComposedHostLockDump, us as TargetValue, ut as progressFingerprint, v as ActivationMigrationEntry, va as bindExecutableIdentity, vc as introducesActionClause, vi as evidenceFromPersistedToolResult, vn as bindingSatisfies, vo as GoalActivationState, vr as hasDesktopImporterState, vt as CLEANUP_CONDITION_RULE, w as readActivationBinding, wa as evaluateToolSurfaceCapability, wc as isRestatement, wi as shellReadbackOutcome, wn as ManifestIssue, wo as AssetInterpretationFact, wr as readDesktopDependency, ws as confirmRebind, wt as RecoveryOptions, x as activationBindingPath, xa as evaluateGraphDerivedHostLock, xc as isInformationalFragment, xi as isDeterministicCheck, xn as isVerifyingCapability, xo as effectuateBoundary, xr as readAsarFile, xs as ProposeOutcome, xt as DEFAULT_RECOVERY_CHAR_BUDGET, y as ActivationMigrationReceipt, ya as bindLiveGoalCapability, yc as isExecutableItem, yi as extractTextContent, yn as evidenceCoverage, yo as GoalBoundaryAccess, yr as memoizedAsarFile, yt as CLEANUP_CONDITION_RULE_COMPACT, z as RC021_RC2_HOST_PACKAGES, za as currentContractDigest, zc as splitTextFragments, zi as PROTOCOL_V3_NOTICE, zn as HostProfileError, zo as EvidenceRole, zr as GitAdapterAction, zs as ProcessExitStatus, zt as PROOF_MANIFEST_DOMAIN_V2 } from "../index-rCqdIg5B.js";
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ActionManifest, ActionSpec, ActivationInventoryPersistence, ActivationInventorySnapshot, ActivationMigrationEntry, ActivationMigrationReceipt, ActivationMigrationSelection, ActivationPriorModes, ActiveProfileHostLock, AsarIndex, AssetInterpretationFact, AssetObligation, AssistantOutcomeObservation, AuditedExecutable, AuditedPackageExpectation, AuthorityBlock, AuthorityBlockKind, AuthorityDisposition, AuthorityKind, BASE_HOST_PACKAGES, BOUNDARY_RECORD_PREFIX, BOUNDED_ARTIFACT_TYPES, BindingActionClosure, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, BoundedSource, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, CERTIFICATE_VERSION_V2, CLEANUP_CONDITION_RULE, CLEANUP_CONDITION_RULE_COMPACT, CLEANUP_CONDITION_RULE_SHORT, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, CanonicalArgv, CanonicalCommandSurface, CapabilityFact, CapabilityGap, CapabilityRemedy, CaptureScope, CertificationSupport, CheckpointResult, ClaimedMessage, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, CurrentActionBasis, CwdEpoch, DEFAULT_DELEGATION_TOOL_NAMES, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DEPENDENCY_FREE_ONLY_CONDITION, DESKTOP_IDENTITY_FACTS, DESKTOP_PROFILE_PACKAGE_NAME, DESKTOP_RUNTIME_PACKAGE_NAME, DeclaredOperationResult, DeferAuthorization, DelegationRef, DependencyStatus, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, DerivedProcessFacts, DesktopAppRuntime, DesktopTargetGraph, DiagnosisNextAction, DirectiveClass, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, Executee, ExecutionQualification, ExpectedTransition, ExternalOperation, FIRST_STEP_GUIDANCE, FirstStepInjection, FirstStepPreviewInput, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GRANTED_QUALIFICATION, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HOST_VALIDATED_VERSIONS, HostAuditProvenance, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostRebindTrust, HostStatus, HostToolSurface, HostTrustAcquisitionOptions, HostTrustError, HostTrustedPackage, HostVersionDecision, HostVersionStatus, InitialActivation, InterpretOptions, JobLifecycleRecord, LATEST_TESTED_HOST_VERSION, LEGACY_QUALIFICATION, LifecyclePhase, LinearCommitReadback, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, ManifestIssue, MessageCoverage, NATIVE_GIT_ROOT_PARENT_OID, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, NeedsReviewFact, NeedsReviewReason, OperationAttribution, OperationVerbEntry, PROOF_CAPABILITY_MATRIX, PROOF_KINDS, PROOF_KINDS_V2, PROOF_MANIFEST_DOMAIN_V2, PROOF_PROTOCOL_VERSION, PROOF_PROTOCOL_VERSION_V2, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, PROTOCOL_V5_NOTICE, PROTOCOL_V6_NOTICE, ParsedConfirmation, ParsedHostVersion, ParsedShell, PersistenceAuthorization, ProcessExitStatus, ProcessFactSource, ProcessOutcomeReason, ProofHostSurface, ProofKind, ProofKindCapability, ProofKindV2, ProofManifest, ProofManifestV2, ProofObligation, ProofObligationV2, ProofSurface, ProposeOutcome, QualificationReason, QualificationStatus, RC020_RC1_HOST_PACKAGES, RC020_RC2_HOST_PACKAGES, RC021_RC2_HOST_PACKAGES, RebindArgs, RebindProposal, RecoveryCause, RecoveryOptions, RejectedBinding, RemovalOutcomeReport, Repairability, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, STOP_PROTOCOL_VERSION_V2, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, ScopeInterpretation, SemanticAction, SessionActivationBinding, SessionActivationRead, SessionApiError, SessionBirthIdentity, SessionQuery, SessionQueryV2, ShellParseStatus, SourceSpan, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetHostGraph, TargetSource, TargetSourceKind, TargetTuple, TargetValue, TaskIntent, TaskKind, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UnifiedItemDiagnosis, UserInteractionKind, V4SessionLike, V6_ORDINARY_COMPLETION_RULE, V6_ORDINARY_COMPLETION_RULE_COMPACT, V6_ORDINARY_COMPLETION_RULE_SHORT, VerificationContract, WaitAuthorization, WorkUnit, __activationBindingInternals, acquireHostTrust, actionCompatible, actionHasCertificationPath, actionVerbMatches, activationBindingPath, activationCanonical, activationDigest, activationJson, activationSelectionPending, activeRendererModule, admissibleForRemoval, adoptActivationReceipt, applyUpgradeEligibility, assessmentAction, assessmentOutcomePredicate, auditDesktopInstalledImplementation, auditedDefaultWorkdirHost, auditedDefaultWorkdirProvider, auditedForegroundRenderers, auditedHostImplementation, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindProofV2ToProjection, bindingIndividuallyAccepted, bindingSatisfies, boundedArtifactChoiceMatches, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, capabilityConsequence, capabilityFactOf, capabilityRemedyPhrase, captureClause, captureItem, carriesCleanupCondition, certifyCheckpoint, claimedBatchHasRealRootInput, clarifiedSpanOf, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, clauseAsksOwnQuestion, clauseIsGoverned, clauseIsProtected, cleanupConditionFor, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createActivationMigrationReceipt, createActivationSelection, createGitPrestateEnvelope, createProjection, createProofManifest, createProofManifestV2, currentActionBases, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, environmentDefaultRepositoryTarget, evaluateActiveHostLock, evaluateConfiguredHostLock, evaluateExternalWaitCapability, evaluateGraphDerivedHostLock, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, explanationHasActionResidue, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, firstStepGuidance, firstStepGuidanceV6, gitCommandMatchesTarget, goalCompletionDenial, governedClauseRestrictsExecution, hasCurrentCertificate, hasDesktopImporterState, hasOrderedCoordination, hasQuestionScope, hasWorkPredicate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostTrustDigest, hostVersionFromPackages, injectActiveProfileHostLock, inspectActivationInventory, inspectDesktopTargetGraph, inspectTargetHostGraph, interpretClause, interpretMessage, introducesActionClause, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isExplanationScope, isFrozenV042RebindResponse, isInformationalFragment, isInformationalMessage, isOpenObligation, isQuestionScopeNeedingReview, isRestatement, isRootPauseRequest, isRunExecutable, isSelectedActivationReceipt, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, itemHoldsExecutionAuthority, kindOfScope, latestAssistantText, latestRootInstruction, legacyQuestionReadingIsInformational, legacyRecordsNeedingReview, lifecyclePhase, maskCodeSpans, maskQuotedSpans, memoizedAsarFile, memoizedAsarIndex, namedActions, nativeFileTwoRole, nativeGitParentOidVerified, normalizeClause, observeAssistantOutcome, openItems, opensConditionLead, opensWithDirective, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostTrust, parseHostVersion, parsePwshCommand, parseShellCommand, partialFailureOf, persistedToolResultStatus, prepareActivationMigration, prepareActiveHostTrust, prepareDesktopHostTrust, prepareSelectedActivationMigration, prepareTargetHostTrust, presentExplanationHead, previewFirstStepInjection, privateStorageToolDenial, progressFingerprint, projectCoreV2, projectSessionCoreV2, proofCapabilityReport, proofDigest, proofDigestV2, proofEvidenceConstraints, proofHostSurfacesOf, proofOperationMatches, proofV2Rejection, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualificationOfClause, qualifyBoundary, qualifyHostTrust, questionHeadsClause, readActivationBinding, readActivationMigrationReceipt, readActiveHostGraph, readAsarFile, readAsarIndex, readDesktopAppRuntime, readDesktopDependency, readDesktopTargetGraph, rebindAttemptKey, rebindResponse, recoveryDigest, recoveryTitle, registryArchiveFiles, registryArchiveModules, relevantEvidence, removalIsComplete, removalIsPartiallyKnown, renderRecoveryPacket, replayRebindResult, reportingHeadGoverns, requestedIdentityKey, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, requiredSubjectsOf, resolveActivationBindingsRoot, resolveActiveProfileHostLock, resolveDesktopProfileHostLock, resolveInstalledHostLock, resolveSessionActivation, restatedContentOf, revalidateDesktopCoreLock, revalidateGitPrestate, rootLocatorFlavor, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, scanActivationInventory, scopeCoverageDigest, segmentAuthorityBlocks, segmentClauses, selectHostCohort, selectedActivationInventory, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionBirthIdentity, sessionQuery, sessionQueryV2, sha256, shellReadbackOutcome, snapshotSessionEvents, splitTextFragments, statefulActionsOfScope, supersedeItem, testOutcomePredicate, v6CurrentRootBoundaries, v6TestPredicate, validateActionManifest, validateActionTarget, validateActivationBinding, validateActivationInventorySnapshot, validateActivationMigrationReceipt, validateActivationSelection, validateManifest, validateProofManifest, validateProofManifestV2, verbIsNegated, verifiedLinearCommitReadback, verifyComposedHostLockDump, verifyMigrationInventory, verifySelectedMigrationInventory, withDurability, writeActivationBinding, writeDesktopRuntimeReceipt };
+import { $ as supersedeItem, $a as segmentAuthorityBlocks, $c as ActionManifest, $i as deriveProjection, $n as auditedForegroundRenderers, $o as GuardCheckpoint, $r as GitEffectExecution, $s as admissibleForRemoval, $t as ProofKindCapability, A as createActivationMigrationReceipt, Aa as evaluateGraphDerivedHostLock, Ac as isInformationalFragment, Ai as isDeterministicCheck, An as isVerifyingCapability, Ao as effectuateBoundary, Ar as readAsarFile, As as ProposeOutcome, At as DEFAULT_RECOVERY_CHAR_BUDGET, B as SessionBirthIdentity, Ba as MIN_SUPPORTED_HOST_VERSION, Bc as opensConditionLead, Bi as capabilityRemedyPhrase, Bn as LifecyclePhase, Bo as DelegationRef, Br as acquireHostTrust, Bs as CapabilityFact, Bt as openItems, C as prepareActivationMigration, Ca as HostLockStatus, Cc as hasQuestionScope, Ci as NATIVE_GIT_ROOT_PARENT_OID, Cl as normalizeClause, Cn as sessionQueryV2, Co as BOUNDARY_RECORD_PREFIX, Cr as DESKTOP_RUNTIME_PACKAGE_NAME, Cs as createProjection, Ct as SESSION_EVENT_ENVELOPE_INVALID, D as __activationBindingInternals, Da as bindExecutableIdentity, Dc as introducesActionClause, Di as evidenceFromPersistedToolResult, Dl as stripUrlCredentials, Dn as bindingSatisfies, Do as GoalActivationState, Dr as hasDesktopImporterState, Dt as CLEANUP_CONDITION_RULE, E as ActivationMigrationReceipt, Ea as HostToolSurface, Ec as interpretMessage, Ei as ToolSubject, El as sha256, En as EvidenceFacetCoverage, Eo as BoundaryRequest, Er as auditDesktopInstalledImplementation, Et as snapshotSessionEvents, F as validateActivationMigrationReceipt, Fa as selectHostCohort, Fc as kindOfScope, Fi as CertificationSupport, Fn as validateManifest, Fo as BindingActionClosure, Fr as writeDesktopRuntimeReceipt, Fs as proposeRebindOutcome, Ft as V6_ORDINARY_COMPLETION_RULE_COMPACT, G as validateActivationBinding, Ga as evaluateMinimumHostVersion, Gc as reportingHeadGoverns, Gi as relevantEvidence, Gn as previewFirstStepInjection, Go as EvidenceBinding, Gr as registryArchiveModules, Gs as DependencyStatus, Gt as PROOF_CAPABILITY_MATRIX, H as activationDigest, Ha as SUPPORTED_HOST_RANGE, Hc as presentExplanationHead, Hi as evidenceAvailabilityReason, Hn as firstStepGuidance, Ho as DeriveResult, Hr as parseHostTrust, Hs as CapabilityRemedy, Ht as recoveryTitle, I as writeActivationBinding, Ia as HOST_VALIDATED_VERSIONS, Ic as legacyQuestionReadingIsInformational, Ii as DiagnosisNextAction, In as ClaimedMessage, Io as BoundaryDisposition, Ir as HostRebindTrust, Is as proposeRebindV042, It as V6_ORDINARY_COMPLETION_RULE_SHORT, J as RC021_RC2_HOST_PACKAGES, Ja as currentContractDigest, Jc as splitTextFragments, Ji as PROTOCOL_V3_NOTICE, Jn as HostProfileError, Jo as EvidenceRole, Jr as GitAdapterAction, Js as ProcessExitStatus, Jt as PROOF_MANIFEST_DOMAIN_V2, K as RC021_RC5_HOST_PACKAGES, Ka as parseHostVersion, Kc as restatedContentOf, Ki as CAPTURE_V042_NOTICE, Kn as ActiveProfileHostLock, Ko as EvidenceOutcome, Kr as GIT_COMMAND_MANIFEST_IDS, Ks as DerivedProcessFacts, Kt as PROOF_KINDS, L as InitialActivation, La as HostVersionDecision, Lc as maskCodeSpans, Li as Repairability, Ln as FIRST_STEP_GUIDANCE, Lo as BoundaryQualificationKind, Lr as HostTrustAcquisitionOptions, Ls as rebindAttemptKey, Lt as carriesCleanupCondition, M as readActivationMigrationReceipt, Ma as evaluateHostLock, Mc as isQuestionScopeNeedingReview, Mi as persistedToolResultStatus, Mn as CommandSurfaceManifest, Mo as qualifyBoundary, Mr as readDesktopAppRuntime, Ms as RebindProposal, Mt as RecoveryCause, N as resolveActivationBindingsRoot, Na as evaluateToolSurfaceCapability, Nc as isRestatement, Ni as shellReadbackOutcome, Nn as ManifestIssue, No as AssetInterpretationFact, Nr as readDesktopDependency, Ns as confirmRebind, Nt as RecoveryOptions, O as activationBindingPath, Oa as bindLiveGoalCapability, Oc as isExecutableItem, Oi as extractTextContent, On as evidenceCoverage, Oo as GoalBoundaryAccess, Or as memoizedAsarFile, Ot as CLEANUP_CONDITION_RULE_COMPACT, P as resolveSessionActivation, Pa as hostVersionFromPackages, Pc as itemHoldsExecutionAuthority, Pi as withDurability, Pn as OperationVerbEntry, Po as AssetObligation, Pr as readDesktopTargetGraph, Ps as proposeRebind, Pt as V6_ORDINARY_COMPLETION_RULE, Q as projectCoreV2, Qa as authorityCaptureCounts, Qc as ACTION_MANIFEST_VERSION, Qi as applyUpgradeEligibility, Qn as auditedDefaultWorkdirProvider, Qo as GuardBoundary, Qr as GitCommandRejected, Qs as actionHasCertificationPath, Qt as ProofKind, R as SessionActivationBinding, Ra as HostVersionStatus, Rc as maskQuotedSpans, Ri as TaskKind, Rn as FirstStepInjection, Ro as CwdEpoch, Rr as HostTrustError, Rs as rebindResponse, Rt as cleanupConditionFor, S as inspectActivationInventory, Sa as HostLockEvaluation, Sc as hasOrderedCoordination, Si as hasCurrentCertificate, Sl as digestStrings, Sn as sessionQuery, So as segmentClauses, Sr as DESKTOP_PROFILE_PACKAGE_NAME, Ss as WorkUnit, St as SESSION_API_UNSUPPORTED, T as ActivationMigrationEntry, Ta as HostProfileKind, Tc as interpretClause, Ti as ToolResultInput, Tl as sanitizeUrl, Tn as validateProofManifestV2, To as BoundaryQualification, Tr as DesktopTargetGraph, Tt as V4SessionLike, U as activationJson, Ua as SUPPORTED_HOST_VERSIONS, Uc as qualificationOfClause, Ui as itemDiagnosis, Un as firstStepGuidanceV6, Uo as DeriveScope, Ur as qualifyHostTrust, Us as DEPENDENCY_FREE_ONLY_CONDITION, Ut as renderRecoveryPacket, V as activationCanonical, Va as ParsedHostVersion, Vc as opensWithDirective, Vi as deriveItemDiagnosis, Vn as claimedBatchHasRealRootInput, Vo as DeriveConfig, Vr as hostTrustDigest, Vs as CapabilityGap, Vt as recoveryDigest, W as sessionBirthIdentity, Wa as compareHostVersions, Wc as questionHeadsClause, Wi as nativeFileTwoRole, Wn as lifecyclePhase, Wo as DerivedEnvelope, Wr as registryArchiveFiles, Ws as DeclaredOperationResult, Wt as v6CurrentRootBoundaries, X as RC020_RC1_HOST_PACKAGES, Xa as AuthorityBlockKind, Xc as verbIsNegated, Xi as PROTOCOL_V5_NOTICE, Xn as activeRendererModule, Xo as ExternalOperation, Xr as GitCommandManifest, Xs as ProcessOutcomeReason, Xt as PROOF_PROTOCOL_VERSION_V2, Y as RC020_RC2_HOST_PACKAGES, Ya as AuthorityBlock, Yc as statefulActionsOfScope, Yi as PROTOCOL_V4_NOTICE, Yn as TargetHostGraph, Yo as ExpectedTransition, Yr as GitCommandAccepted, Ys as ProcessFactSource, Yt as PROOF_PROTOCOL_VERSION, Z as projectSessionCoreV2, Za as AuthorityKind, Zc as ACTION_MANIFEST, Zi as PROTOCOL_V6_NOTICE, Zn as auditedDefaultWorkdirHost, Zo as GoalRef, Zr as GitCommandParseResult, Zs as RemovalOutcomeReport, Zt as ProofHostSurface, _ as validateActivationSelection, _a as HostCapabilityRequest, _c as clauseAsksOwnQuestion, _i as canonicalArgvFromCommand, _l as semanticActionFromCommand, _n as proofHostSurfacesOf, _o as environmentDefaultRepositoryTarget, _r as resolveInstalledHostLock, _s as TargetSourceKind, _t as latestRootInstruction, a as guardActivationInventory, aa as AuditedExecutable, ac as AuthorityDisposition, ai as commitIndexSnapshotDigest, al as STATEFUL_ACTIONS, an as ProofSurface, ao as ParsedConfirmation, ar as hostLockRowsFromComposedDump, as as GuardOperation, at as NO_PROGRESS_TURNS_BEFORE_STOP, b as ActivationInventoryPersistence, ba as HostCohortSelectionReason, bc as explanationHasActionResidue, bi as parseShellCommand, bl as validateActionTarget, bn as requiredSubjectsOf, bo as extractOperation, br as AsarIndex, bs as VerificationContract, bt as testOutcomePredicate, c as ActivationMigrationSelection, ca as EXPECTED_HOST_PACKAGES, cc as ExecutionQualification, ci as executeRevalidatedGitEffect, cl as SUPPORTED_EVIDENCE_ADAPTERS, cn as bindProofToProjection, co as CheckpointResult, cr as inspectTargetHostGraph, cs as JobLifecycleRecord, ct as assessmentOutcomePredicate, d as createActivationSelection, da as GOAL_HOST_PACKAGES, dc as LEGACY_QUALIFICATION, di as revalidateGitPrestate, dl as actionCompatible, dn as createProofManifest, do as certifyCheckpoint, dr as prepareActiveHostTrust, ds as NeedsReviewReason, dt as decideTurnBoundary, ea as legacyRecordsNeedingReview, ec as capabilityConsequence, ei as GitEffectRunner, el as ActionSpec, en as ProofKindV2, eo as TaskIntent, er as auditedHostImplementation, es as GuardEvidence, et as AssistantOutcomeObservation, f as isSelectedActivationReceipt, fa as HOST_CAPABILITY_PACKAGE_GROUPS, fc as QualificationReason, fi as verifiedLinearCommitReadback, fl as boundedArtifactChoiceMatches, fn as createProofManifestV2, fo as CaptureScope, fr as prepareDesktopHostTrust, fs as PersistenceAuthorization, ft as decideTurnStopping, g as validateActivationInventorySnapshot, ga as HostCapabilityId, gc as clarifiedSpanOf, gi as ShellParseStatus, gl as requestedTargetMatchesResolved, gn as proofEvidenceConstraints, go as classifyClause, gr as resolveDesktopProfileHostLock, gs as TargetSource, gt as latestAssistantText, h as selectedActivationInventory, ha as HostCapabilityEvaluation, hc as actionVerbMatches, hi as ParsedShell, hl as requestedTargetAuthorizesMutation, hn as proofDigestV2, ho as captureItem, hr as resolveActiveProfileHostLock, hs as TargetCaptureStatus, ht as isWholeTaskCompletionClaim, i as captureActivationPhysicalInventory, ia as ACTIVE_HOST_LAUNCHER_VERSION, ic as removalIsPartiallyKnown, ii as LinearCommitReadback, il as SEMANTIC_ACTIONS, in as ProofObligationV2, io as CONFIRM_LINE_PATTERN, ir as hostLockContextFromComposedDump, is as GuardItemStatus, it as NO_PROGRESS_RECORD_PREFIX, j as readActivationBinding, ja as evaluateHostCapability, jc as isOpenObligation, ji as nativeGitParentOidVerified, jn as COMMAND_SURFACE_MANIFEST, jo as isCurrentAcceptedBoundary, jr as readAsarIndex, js as RebindArgs, jt as MIN_RECOVERY_CHAR_BUDGET, k as adoptActivationReceipt, ka as evaluateExternalWaitCapability, kc as isExplanationScope, ki as extractToolSubject, kn as evidenceMatchesItem, ko as availableBoundaryQualifications, kr as memoizedAsarIndex, ks as BoundedSource, kt as CLEANUP_CONDITION_RULE_SHORT, l as activationSelectionPending, la as ExecutableIdentity, lc as GRANTED_QUALIFICATION, li as gitCommandMatchesTarget, ll as SemanticAction, ln as bindProofV2ToProjection, lo as RejectedBinding, lr as packageRowsFromActiveGraph, ls as MessageCoverage, lt as classifyCompletionClaim, m as scanActivationInventory, ma as HostAuditProvenance, mc as ScopeInterpretation, mi as CanonicalCommandSurface, ml as requestedIdentityKey, mn as proofDigest, mo as captureClause, mr as readActiveHostGraph, ms as TargetCaptureReasonCode, mt as isRootPauseRequest, n as assertActivationBackendIdentity, na as ACTIVE_HOST_COHORT_ID, nc as partialFailureOf, ni as GitPrestateEnvelope, nl as CERTIFICATE_VERSION, nn as ProofManifestV2, no as classifyTaskIntent, nr as evaluateActiveHostLock, ns as GuardItem, nt as CompletionDisposition, o as resolveActivationPersistencePlugin, oa as BASE_HOST_PACKAGES, oc as DirectiveClass, oi as commitTreeSnapshotDigest, ol as STOP_PROTOCOL_VERSION, on as SessionQuery, oo as isFrozenV042RebindResponse, or as injectActiveProfileHostLock, os as GuardProjection, ot as TurnStoppingDecision, p as prepareSelectedActivationMigration, pa as HOST_COHORTS, pc as QualificationStatus, pi as CanonicalArgv, pl as isStatefulAction, pn as proofCapabilityReport, po as ClauseSegment, pr as prepareTargetHostTrust, ps as SourceSpan, pt as decisionBoundaryKey, q as RC021_RC3_HOST_PACKAGES, qa as satisfiesSupportedHostRange, qc as semanticActionOfScope, qi as DEFAULT_DELEGATION_TOOL_NAMES, qn as AuditedPackageExpectation, qo as EvidenceParseStatus, qr as GIT_COMMAND_TEMPLATES, qs as OperationAttribution, qt as PROOF_KINDS_V2, r as assertActivationPhysicalRows, ra as ACTIVE_HOST_COHORT_IDS, rc as removalIsComplete, ri as GitTargetIdentity, rl as CERTIFICATE_VERSION_V2, rn as ProofObligation, ro as classifyUserInteraction, rr as evaluateConfiguredHostLock, rs as GuardItemKind, rt as CurrentActionBasis, s as ActivationInventorySnapshot, sa as DEFAULT_HOST_LOCK, sc as Executee, si as createGitPrestateEnvelope, sl as STOP_PROTOCOL_VERSION_V2, sn as SessionQueryV2, so as parseConfirmationMessage, sr as inspectDesktopTargetGraph, ss as HostStatus, st as assessmentAction, t as ActivationPhysicalInventory, ta as rootLocatorFlavor, tc as capabilityFactOf, ti as GitPrestateCheck, tl as BOUNDED_ARTIFACT_TYPES, tn as ProofManifest, to as UserInteractionKind, tr as combineHostPolicy, ts as GuardIntegrity, tt as CONTROL_RECORD_PREFIX, u as bindActivationInventoryPhysical, ua as ExecutableIdentityBinding, uc as InterpretOptions, ui as parseGitCommandManifest, ul as StatefulAction, un as canonicalProjection, uo as bindingIndividuallyAccepted, ur as packageRowsFromPnpmLock, us as NeedsReviewFact, ut as currentActionBases, v as verifySelectedMigrationInventory, va as HostCohort, vc as clauseIsGoverned, vi as isRunExecutable, vl as semanticActionFromText, vn as proofOperationMatches, vo as extractArtifactPaths, vr as revalidateDesktopCoreLock, vs as TargetTuple, vt as observeAssistantOutcome, w as verifyMigrationInventory, wa as HostPlatform, wc as hasWorkPredicate, wi as ToolCallInput, wl as sanitizeClauseText, wn as validateProofManifest, wo as BoundaryEffectuation, wr as DesktopAppRuntime, wt as SessionApiError, x as ActivationPriorModes, xa as HostLockContext, xc as governedClauseRestrictsExecution, xi as goalCompletionDenial, xl as canonicalizePath, xn as scopeCoverageDigest, xo as isInformationalMessage, xr as DESKTOP_IDENTITY_FACTS, xs as WaitAuthorization, xt as v6TestPredicate, y as privateStorageToolDenial, ya as HostCohortSelection, yc as clauseIsProtected, yi as parsePwshCommand, yl as validateActionManifest, yn as proofV2Rejection, yo as extractMethod, yr as verifyComposedHostLockDump, ys as TargetValue, yt as progressFingerprint, z as SessionActivationRead, za as LATEST_TESTED_HOST_VERSION, zc as namedActions, zi as UnifiedItemDiagnosis, zn as FirstStepPreviewInput, zo as DeferAuthorization, zr as HostTrustedPackage, zs as replayRebindResult, zt as closingHint } from "../index-B1AGTJF6.js";
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ActionManifest, ActionSpec, ActivationInventoryPersistence, ActivationInventorySnapshot, ActivationMigrationEntry, ActivationMigrationReceipt, ActivationMigrationSelection, ActivationPhysicalInventory, ActivationPriorModes, ActiveProfileHostLock, AsarIndex, AssetInterpretationFact, AssetObligation, AssistantOutcomeObservation, AuditedExecutable, AuditedPackageExpectation, AuthorityBlock, AuthorityBlockKind, AuthorityDisposition, AuthorityKind, BASE_HOST_PACKAGES, BOUNDARY_RECORD_PREFIX, BOUNDED_ARTIFACT_TYPES, BindingActionClosure, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, BoundedSource, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, CERTIFICATE_VERSION_V2, CLEANUP_CONDITION_RULE, CLEANUP_CONDITION_RULE_COMPACT, CLEANUP_CONDITION_RULE_SHORT, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, CanonicalArgv, CanonicalCommandSurface, CapabilityFact, CapabilityGap, CapabilityRemedy, CaptureScope, CertificationSupport, CheckpointResult, ClaimedMessage, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, CurrentActionBasis, CwdEpoch, DEFAULT_DELEGATION_TOOL_NAMES, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DEPENDENCY_FREE_ONLY_CONDITION, DESKTOP_IDENTITY_FACTS, DESKTOP_PROFILE_PACKAGE_NAME, DESKTOP_RUNTIME_PACKAGE_NAME, DeclaredOperationResult, DeferAuthorization, DelegationRef, DependencyStatus, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, DerivedProcessFacts, DesktopAppRuntime, DesktopTargetGraph, DiagnosisNextAction, DirectiveClass, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, Executee, ExecutionQualification, ExpectedTransition, ExternalOperation, FIRST_STEP_GUIDANCE, FirstStepInjection, FirstStepPreviewInput, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GRANTED_QUALIFICATION, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HOST_VALIDATED_VERSIONS, HostAuditProvenance, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostRebindTrust, HostStatus, HostToolSurface, HostTrustAcquisitionOptions, HostTrustError, HostTrustedPackage, HostVersionDecision, HostVersionStatus, InitialActivation, InterpretOptions, JobLifecycleRecord, LATEST_TESTED_HOST_VERSION, LEGACY_QUALIFICATION, LifecyclePhase, LinearCommitReadback, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, ManifestIssue, MessageCoverage, NATIVE_GIT_ROOT_PARENT_OID, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, NeedsReviewFact, NeedsReviewReason, OperationAttribution, OperationVerbEntry, PROOF_CAPABILITY_MATRIX, PROOF_KINDS, PROOF_KINDS_V2, PROOF_MANIFEST_DOMAIN_V2, PROOF_PROTOCOL_VERSION, PROOF_PROTOCOL_VERSION_V2, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, PROTOCOL_V5_NOTICE, PROTOCOL_V6_NOTICE, ParsedConfirmation, ParsedHostVersion, ParsedShell, PersistenceAuthorization, ProcessExitStatus, ProcessFactSource, ProcessOutcomeReason, ProofHostSurface, ProofKind, ProofKindCapability, ProofKindV2, ProofManifest, ProofManifestV2, ProofObligation, ProofObligationV2, ProofSurface, ProposeOutcome, QualificationReason, QualificationStatus, RC020_RC1_HOST_PACKAGES, RC020_RC2_HOST_PACKAGES, RC021_RC2_HOST_PACKAGES, RC021_RC3_HOST_PACKAGES, RC021_RC5_HOST_PACKAGES, RebindArgs, RebindProposal, RecoveryCause, RecoveryOptions, RejectedBinding, RemovalOutcomeReport, Repairability, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, STOP_PROTOCOL_VERSION_V2, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, ScopeInterpretation, SemanticAction, SessionActivationBinding, SessionActivationRead, SessionApiError, SessionBirthIdentity, SessionQuery, SessionQueryV2, ShellParseStatus, SourceSpan, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetHostGraph, TargetSource, TargetSourceKind, TargetTuple, TargetValue, TaskIntent, TaskKind, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UnifiedItemDiagnosis, UserInteractionKind, V4SessionLike, V6_ORDINARY_COMPLETION_RULE, V6_ORDINARY_COMPLETION_RULE_COMPACT, V6_ORDINARY_COMPLETION_RULE_SHORT, VerificationContract, WaitAuthorization, WorkUnit, __activationBindingInternals, acquireHostTrust, actionCompatible, actionHasCertificationPath, actionVerbMatches, activationBindingPath, activationCanonical, activationDigest, activationJson, activationSelectionPending, activeRendererModule, admissibleForRemoval, adoptActivationReceipt, applyUpgradeEligibility, assertActivationBackendIdentity, assertActivationPhysicalRows, assessmentAction, assessmentOutcomePredicate, auditDesktopInstalledImplementation, auditedDefaultWorkdirHost, auditedDefaultWorkdirProvider, auditedForegroundRenderers, auditedHostImplementation, authorityCaptureCounts, availableBoundaryQualifications, bindActivationInventoryPhysical, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindProofV2ToProjection, bindingIndividuallyAccepted, bindingSatisfies, boundedArtifactChoiceMatches, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, capabilityConsequence, capabilityFactOf, capabilityRemedyPhrase, captureActivationPhysicalInventory, captureClause, captureItem, carriesCleanupCondition, certifyCheckpoint, claimedBatchHasRealRootInput, clarifiedSpanOf, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, clauseAsksOwnQuestion, clauseIsGoverned, clauseIsProtected, cleanupConditionFor, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createActivationMigrationReceipt, createActivationSelection, createGitPrestateEnvelope, createProjection, createProofManifest, createProofManifestV2, currentActionBases, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, environmentDefaultRepositoryTarget, evaluateActiveHostLock, evaluateConfiguredHostLock, evaluateExternalWaitCapability, evaluateGraphDerivedHostLock, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, explanationHasActionResidue, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, firstStepGuidance, firstStepGuidanceV6, gitCommandMatchesTarget, goalCompletionDenial, governedClauseRestrictsExecution, guardActivationInventory, hasCurrentCertificate, hasDesktopImporterState, hasOrderedCoordination, hasQuestionScope, hasWorkPredicate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostTrustDigest, hostVersionFromPackages, injectActiveProfileHostLock, inspectActivationInventory, inspectDesktopTargetGraph, inspectTargetHostGraph, interpretClause, interpretMessage, introducesActionClause, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isExplanationScope, isFrozenV042RebindResponse, isInformationalFragment, isInformationalMessage, isOpenObligation, isQuestionScopeNeedingReview, isRestatement, isRootPauseRequest, isRunExecutable, isSelectedActivationReceipt, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, itemHoldsExecutionAuthority, kindOfScope, latestAssistantText, latestRootInstruction, legacyQuestionReadingIsInformational, legacyRecordsNeedingReview, lifecyclePhase, maskCodeSpans, maskQuotedSpans, memoizedAsarFile, memoizedAsarIndex, namedActions, nativeFileTwoRole, nativeGitParentOidVerified, normalizeClause, observeAssistantOutcome, openItems, opensConditionLead, opensWithDirective, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostTrust, parseHostVersion, parsePwshCommand, parseShellCommand, partialFailureOf, persistedToolResultStatus, prepareActivationMigration, prepareActiveHostTrust, prepareDesktopHostTrust, prepareSelectedActivationMigration, prepareTargetHostTrust, presentExplanationHead, previewFirstStepInjection, privateStorageToolDenial, progressFingerprint, projectCoreV2, projectSessionCoreV2, proofCapabilityReport, proofDigest, proofDigestV2, proofEvidenceConstraints, proofHostSurfacesOf, proofOperationMatches, proofV2Rejection, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualificationOfClause, qualifyBoundary, qualifyHostTrust, questionHeadsClause, readActivationBinding, readActivationMigrationReceipt, readActiveHostGraph, readAsarFile, readAsarIndex, readDesktopAppRuntime, readDesktopDependency, readDesktopTargetGraph, rebindAttemptKey, rebindResponse, recoveryDigest, recoveryTitle, registryArchiveFiles, registryArchiveModules, relevantEvidence, removalIsComplete, removalIsPartiallyKnown, renderRecoveryPacket, replayRebindResult, reportingHeadGoverns, requestedIdentityKey, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, requiredSubjectsOf, resolveActivationBindingsRoot, resolveActivationPersistencePlugin, resolveActiveProfileHostLock, resolveDesktopProfileHostLock, resolveInstalledHostLock, resolveSessionActivation, restatedContentOf, revalidateDesktopCoreLock, revalidateGitPrestate, rootLocatorFlavor, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, scanActivationInventory, scopeCoverageDigest, segmentAuthorityBlocks, segmentClauses, selectHostCohort, selectedActivationInventory, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionBirthIdentity, sessionQuery, sessionQueryV2, sha256, shellReadbackOutcome, snapshotSessionEvents, splitTextFragments, statefulActionsOfScope, stripUrlCredentials, supersedeItem, testOutcomePredicate, v6CurrentRootBoundaries, v6TestPredicate, validateActionManifest, validateActionTarget, validateActivationBinding, validateActivationInventorySnapshot, validateActivationMigrationReceipt, validateActivationSelection, validateManifest, validateProofManifest, validateProofManifestV2, verbIsNegated, verifiedLinearCommitReadback, verifyComposedHostLockDump, verifyMigrationInventory, verifySelectedMigrationInventory, withDurability, writeActivationBinding, writeDesktopRuntimeReceipt };