dsh-completion-guard 0.10.0 → 0.12.0

package/dist/index.js

@@ -1,17 +1,17 @@
-import { $ as evidenceFromPersistedToolResult, $a as createActivationMigrationReceipt, $i as registryArchiveFiles, $n as evidenceAvailabilityReason, $r as presentExplanationHead, $t as renderRecoveryPacket, A as previewFirstStepInjection, Aa as BOUNDED_ARTIFACT_TYPES, Ai as resolveActiveProfileHostLock, An as certifiableOpenItems, Ao as digestStrings, Ar as clauseIsProtected, At as proofHostSurfacesOf, B as projectCoreV2, Ba as isStatefulAction, Bi as memoizedAsarFile, Bn as createProjection, Br as isExplanationScope, Bt as CLEANUP_CONDITION_RULE_COMPACT, C as revalidateGitPrestate, Ca as SUPPORTED_HOST_VERSIONS, Ci as inspectTargetHostGraph, Cn as observeAssistantOutcome, Co as normalizeReleaseContract, Cr as classifyUserInteraction, Ct as canonicalProjection, D as firstStepGuidance, Da as satisfiesSupportedHostRange, Di as prepareDesktopHostTrust, Dn as goalCompletionDenial, Do as releasePreEffectDecision, Dr as clarifiedSpanOf, Dt as proofDigest, E as claimedBatchHasRealRootInput, Ea as parseHostVersion, Ei as prepareActiveHostTrust, En as v6TestPredicate, Eo as releaseCoverage, Er as actionVerbMatches, Et as proofCapabilityReport, F as sourcedNamedTestRoot, Fa as STOP_PROTOCOL_VERSION, Fi as DESKTOP_IDENTITY_FACTS, Fn as availableBoundaryQualifications, Fo as privateStorageToolDenial, Fr as hasWorkPredicate, Ft as sessionQuery, G as PROTOCOL_V5_NOTICE, Ga as semanticActionFromText, Gi as readDesktopDependency, Gn as rebindAttemptKey, Gr as itemHoldsExecutionAuthority, Gt as V6_ORDINARY_COMPLETION_RULE_COMPACT, H as DEFAULT_DELEGATION_TOOL_NAMES, Ha as requestedTargetAuthorizesMutation, Hi as readAsarFile, Hn as proposeRebind, Hr as isOpenObligation, Ht as DEFAULT_RECOVERY_CHAR_BUDGET, I as SESSION_API_UNSUPPORTED, Ia as STOP_PROTOCOL_VERSION_V2, Ii as DESKTOP_PROFILE_PACKAGE_NAME, In as effectuateBoundary, Io as ownedJobLifecycle, Ir as interpretClause, It as sessionQueryV2, J as deriveProjection, Ja as RC021_RC2_HOST_PACKAGES, Ji as HostTrustError, Jn as CONFIRM_LINE_PATTERN, Jr as maskCodeSpans, Jt as cleanupConditionFor, K as PROTOCOL_V6_NOTICE, Ka as validateActionManifest, Ki as readDesktopTargetGraph, Kn as rebindResponse, Kr as kindOfScope, Kt as V6_ORDINARY_COMPLETION_RULE_SHORT, L as SESSION_EVENT_ENVELOPE_INVALID, La as SUPPORTED_EVIDENCE_ADAPTERS, Li as DESKTOP_RUNTIME_PACKAGE_NAME, Ln as isCurrentAcceptedBoundary, Lr as interpretMessage, Lt as validateProofManifest, M as sessionCoreSnapshot, Ma as CERTIFICATE_VERSION_V2, Mi as resolveInstalledHostLock, Mn as needsReviewObligations, Mo as sanitizeClauseText, Mr as governedClauseRestrictsExecution, Mt as proofV2Rejection, N as HOST_WORKDIR_PREFIX, Na as SEMANTIC_ACTIONS, Ni as revalidateDesktopCoreLock, Nn as unitDescendantIds, No as sanitizeUrl, Nr as hasOrderedCoordination, Nt as requiredSubjectsOf, O as firstStepGuidanceV6, Oa as ACTION_MANIFEST, Oi as prepareTargetHostTrust, On as hasCurrentCertificate, Oo as reservationFor, Or as clauseAsksOwnQuestion, Ot as proofDigestV2, P as captureHostWorkdir, Pa as STATEFUL_ACTIONS, Pi as verifyComposedHostLockDump, Pn as BOUNDARY_RECORD_PREFIX, Po as sha256, Pr as hasQuestionScope, Pt as scopeCoverageDigest, Q as NATIVE_GIT_ROOT_PARENT_OID, Qa as adoptActivationReceipt, Qi as qualifyHostTrust, Qn as deriveItemDiagnosis, Qr as opensWithDirective, Qt as recoveryTitle, R as SessionApiError, Ra as actionCompatible, Ri as auditDesktopInstalledImplementation, Rn as qualifyBoundary, Rr as introducesActionClause, Rt as validateProofManifestV2, S as parseGitCommandManifest, Sa as SUPPORTED_HOST_RANGE, Si as inspectDesktopTargetGraph, Sn as latestRootInstruction, So as inFlightReservation, Sr as classifyTaskIntent, St as bindProofV2ToProjection, T as FIRST_STEP_GUIDANCE, Ta as evaluateMinimumHostVersion, Ti as packageRowsFromPnpmLock, Tn as testOutcomePredicate, To as releaseContractFor, Tr as LEGACY_QUALIFICATION, Tt as createProofManifestV2, U as PROTOCOL_V3_NOTICE, Ua as requestedTargetMatchesResolved, Ui as readAsarIndex, Un as proposeRebindOutcome, Ur as isQuestionScopeNeedingReview, Ut as MIN_RECOVERY_CHAR_BUDGET, V as CAPTURE_V042_NOTICE, Va as requestedIdentityKey, Vi as memoizedAsarIndex, Vn as confirmRebind, Vr as isInformationalFragment, Vt as CLEANUP_CONDITION_RULE_SHORT, W as PROTOCOL_V4_NOTICE, Wa as semanticActionFromCommand, Wi as readDesktopAppRuntime, Wn as proposeRebindV042, Wr as isRestatement, Wt as V6_ORDINARY_COMPLETION_RULE, X as rootLocatorFlavor, Xa as __activationBindingInternals, Xi as hostTrustDigest, Xn as parseConfirmationMessage, Xr as namedActions, Xt as openItems, Y as legacyRecordsNeedingReview, Ya as createHostAuditSession, Yi as acquireHostTrust, Yn as isFrozenV042RebindResponse, Yr as maskQuotedSpans, Yt as closingHint, Z as supersedeItem, Za as activationBindingPath, Zi as parseHostTrust, Zn as capabilityRemedyPhrase, Zr as opensConditionLead, Zt as recoveryDigest, _ as commitIndexSnapshotDigest, _a as hostVersionFromPackages, _i as evaluateActiveHostLock, _n as decideTurnStopping, _o as readPrivateLedger, _r as extractOperation, _t as PROOF_KINDS_V2, a as scanActivationInventory, aa as DEFAULT_HOST_LOCK, ai as splitTextFragments, an as bindingSatisfies, ao as writeActivationBinding, ar as admissibleForRemoval, at as shellReadbackOutcome, b as executeRevalidatedGitEffect, ba as LATEST_TESTED_HOST_VERSION, bi as hostLockRowsFromComposedDump, bn as isWholeTaskCompletionClaim, bo as RELEASE_OPERATION_SURFACES, br as canonicalRegistryBase, bt as PROOF_PROTOCOL_VERSION_V2, c as validateActivationSelection, ca as HOST_CAPABILITY_PACKAGE_GROUPS, ci as COMMAND_SURFACE_MANIFEST, cn as isVerifyingCapability, co as activationJson, cr as partialFailureOf, ct as isRunExecutable, d as prepareActivationMigration, da as bindLiveGoalCapability, di as activeRendererModule, dn as NO_PROGRESS_TURNS_BEFORE_STOP, do as appendPrivateLedger, dr as captureClause, dt as authorityCaptureCounts, ea as registryArchiveModules, ei as qualificationOfClause, en as v6CurrentRootBoundaries, eo as readActivationBinding, er as itemDiagnosis, et as extractTextContent, f as verifyMigrationInventory, fa as evaluateExternalWaitCapability, fi as auditedDefaultWorkdirHost, fn as assessmentAction, fo as applyPrivateLedger, fr as captureItem, ft as segmentAuthorityBlocks, g as GIT_COMMAND_TEMPLATES, ga as evaluateToolSurfaceCapability, gi as combineHostPolicy, gn as decideTurnBoundary, go as privateLedgerTargetDigest, gr as extractMethod, gt as PROOF_KINDS, h as GIT_COMMAND_MANIFEST_IDS, ha as evaluateHostLock, hi as auditedHostImplementation, hn as currentActionBases, ho as privateLedgerContractDigest, hr as extractArtifactPaths, ht as PROOF_CAPABILITY_MATRIX, i as prepareSelectedActivationMigration, ia as BASE_HOST_PACKAGES, ii as semanticActionOfScope, in as sourceItemForCoreRequirement, io as validateActivationMigrationReceipt, ir as actionHasCertificationPath, it as persistedToolResultStatus, j as projectSessionCoreV2, ja as CERTIFICATE_VERSION, ji as resolveDesktopProfileHostLock, jn as certificateClosure, jo as normalizeClause, jr as explanationHasActionResidue, jt as proofOperationMatches, k as lifecyclePhase, ka as ACTION_MANIFEST_VERSION, ki as readActiveHostGraph, kn as ancestorConstraintForBinding, ko as canonicalizePath, kr as clauseIsGoverned, kt as proofEvidenceConstraints, l as verifySelectedMigrationInventory, la as HOST_COHORTS, li as validateManifest, ln as CONTROL_RECORD_PREFIX, lo as sessionBirthIdentity, lr as removalIsComplete, lt as parsePwshCommand, m as RC020_RC1_HOST_PACKAGES, ma as evaluateHostCapability, mi as auditedForegroundRenderers, mn as classifyCompletionClaim, mo as initializePrivateLedger, mr as environmentDefaultRepositoryTarget, mt as certifyCheckpoint, n as createActivationSelection, na as ACTIVE_HOST_COHORT_IDS, ni as reportingHeadGoverns, nn as currentV6Feedback, no as resolveActivationBindingsRoot, nr as relevantEvidence, nt as isDeterministicCheck, o as selectedActivationInventory, oa as EXPECTED_HOST_PACKAGES, oi as statefulActionsOfScope, on as evidenceCoverage, oo as activationCanonical, or as capabilityConsequence, ot as withDurability, p as RC020_RC2_HOST_PACKAGES, pa as evaluateGraphDerivedHostLock, pi as auditedDefaultWorkdirProvider, pn as assessmentOutcomePredicate, po as hasPrivateRestartIntent, pr as classifyClause, pt as bindingIndividuallyAccepted, q as applyUpgradeEligibility, qa as validateActionTarget, qi as writeDesktopRuntimeReceipt, qn as replayRebindResult, qr as legacyQuestionReadingIsInformational, qt as carriesCleanupCondition, r as isSelectedActivationReceipt, ra as ACTIVE_HOST_LAUNCHER_VERSION, ri as restatedContentOf, rn as isV6PendingRootWait, ro as resolveSessionActivation, rr as DEPENDENCY_FREE_ONLY_CONDITION, rt as nativeGitParentOidVerified, s as validateActivationInventorySnapshot, sa as GOAL_HOST_PACKAGES, si as verbIsNegated, sn as evidenceMatchesItem, so as activationDigest, sr as capabilityFactOf, st as canonicalArgvFromCommand, t as activationSelectionPending, ta as ACTIVE_HOST_COHORT_ID, ti as questionHeadsClause, tn as confirmedV6CoreDiagnostic, to as readActivationMigrationReceipt, tr as nativeFileTwoRole, tt as extractToolSubject, u as inspectActivationInventory, ua as bindExecutableIdentity, ui as HostProfileError, un as NO_PROGRESS_RECORD_PREFIX, uo as validateActivationBinding, ur as removalIsPartiallyKnown, ut as parseShellCommand, v as commitTreeSnapshotDigest, va as selectHostCohort, vi as evaluateConfiguredHostLock, vn as decisionBoundaryKey, vo as resolvePrivateLedgerRoot, vr as isInformationalMessage, vt as PROOF_MANIFEST_DOMAIN_V2, w as verifiedLinearCommitReadback, wa as compareHostVersions, wi as packageRowsFromActiveGraph, wn as progressFingerprint, wo as readbackSettlesContract, wr as GRANTED_QUALIFICATION, wt as createProofManifest, x as gitCommandMatchesTarget, xa as MIN_SUPPORTED_HOST_VERSION, xi as injectActiveProfileHostLock, xn as latestAssistantText, xo as contractById, xr as npmEscapedPackageName, xt as bindProofToProjection, y as createGitPrestateEnvelope, ya as HOST_VALIDATED_VERSIONS, yi as hostLockContextFromComposedDump, yn as isRootPauseRequest, yo as RELEASE_OPERATIONS, yr as segmentClauses, yt as PROOF_PROTOCOL_VERSION, z as snapshotSessionEvents, za as boundedArtifactChoiceMatches, zi as hasDesktopImporterState, zn as currentContractDigest, zr as isExecutableItem, zt as CLEANUP_CONDITION_RULE } from "./domain-Dqw5NrT-.js";
+import { $ as PROTOCOL_V6_NOTICE, $a as semanticActionFromCommand, $i as readDesktopAppRuntime, $n as proposeRebindV042, $r as isRestatement, $t as V6_ORDINARY_COMPLETION_RULE, A as revalidateGitPrestate, Aa as MIN_SUPPORTED_HOST_VERSION, Ai as injectActiveProfileHostLock, An as latestAssistantText, Ao as RELEASE_OPERATION_SURFACES, Ar as npmEscapedPackageName, At as bindProofToProjection, B as HOST_WORKDIR_PREFIX, Ba as CERTIFICATE_VERSION, Bi as resolveDesktopProfileHostLock, Bn as certificateClosure, Bo as digestStrings, Br as explanationHasActionResidue, Bt as proofOperationMatches, C as GIT_COMMAND_TEMPLATES, Ca as evaluateHostCapability, Ci as auditedForegroundRenderers, Cn as classifyCompletionClaim, Co as hasPrivateRestartIntent, Cr as environmentDefaultRepositoryTarget, Ct as certifyCheckpoint, D as executeRevalidatedGitEffect, Da as selectHostCohort, Di as evaluateConfiguredHostLock, Dn as decisionBoundaryKey, Do as readPrivateLedger, Dr as isInformationalMessage, Dt as PROOF_MANIFEST_DOMAIN_V2, E as createGitPrestateEnvelope, Ea as hostVersionFromPackages, Ei as evaluateActiveHostLock, En as decideTurnStopping, Eo as privateLedgerTargetDigest, Er as extractOperation, Et as PROOF_KINDS_V2, F as firstStepGuidanceV6, Fa as parseHostVersion, Fi as prepareActiveHostTrust, Fn as v6TestPredicate, Fo as releaseContractFor, Fr as actionVerbMatches, Ft as proofCapabilityReport, G as SessionApiError, Ga as STOP_PROTOCOL_VERSION_V2, Gi as DESKTOP_PROFILE_PACKAGE_NAME, Gn as effectuateBoundary, Go as stripUrlCredentials, Gr as interpretClause, Gt as sessionQueryV2, H as sourcedNamedTestRoot, Ha as SEMANTIC_ACTIONS, Hi as revalidateDesktopCoreLock, Hn as unitDescendantIds, Ho as sanitizeClauseText, Hr as hasOrderedCoordination, Ht as requiredSubjectsOf, I as lifecyclePhase, Ia as satisfiesSupportedHostRange, Ii as prepareDesktopHostTrust, In as goalCompletionDenial, Io as releaseCoverage, Ir as clarifiedSpanOf, It as proofDigest, J as CAPTURE_V042_NOTICE, Ja as boundedArtifactChoiceMatches, Ji as hasDesktopImporterState, Jn as currentContractDigest, Jr as isExecutableItem, Jt as CLEANUP_CONDITION_RULE, K as snapshotSessionEvents, Ka as SUPPORTED_EVIDENCE_ADAPTERS, Ki as DESKTOP_RUNTIME_PACKAGE_NAME, Kn as isCurrentAcceptedBoundary, Ko as privateStorageToolDenial, Kr as interpretMessage, Kt as validateProofManifest, L as previewFirstStepInjection, La as ACTION_MANIFEST, Li as prepareTargetHostTrust, Ln as hasCurrentCertificate, Lo as releasePreEffectDecision, Lr as clauseAsksOwnQuestion, Lt as proofDigestV2, M as FIRST_STEP_GUIDANCE, Ma as SUPPORTED_HOST_VERSIONS, Mi as inspectTargetHostGraph, Mn as observeAssistantOutcome, Mo as inFlightReservation, Mr as classifyUserInteraction, Mt as canonicalProjection, N as claimedBatchHasRealRootInput, Na as compareHostVersions, Ni as packageRowsFromActiveGraph, Nn as progressFingerprint, No as normalizeReleaseContract, Nr as GRANTED_QUALIFICATION, Nt as createProofManifest, O as gitCommandMatchesTarget, Oa as HOST_VALIDATED_VERSIONS, Oi as hostLockContextFromComposedDump, On as isRootPauseRequest, Oo as resolvePrivateLedgerRoot, Or as segmentClauses, Ot as PROOF_PROTOCOL_VERSION, P as firstStepGuidance, Pa as evaluateMinimumHostVersion, Pi as packageRowsFromPnpmLock, Pn as testOutcomePredicate, Po as readbackSettlesContract, Pr as LEGACY_QUALIFICATION, Pt as createProofManifestV2, Q as PROTOCOL_V5_NOTICE, Qa as requestedTargetMatchesResolved, Qi as readAsarIndex, Qn as proposeRebindOutcome, Qr as isQuestionScopeNeedingReview, Qt as MIN_RECOVERY_CHAR_BUDGET, R as projectSessionCoreV2, Ra as ACTION_MANIFEST_VERSION, Ri as readActiveHostGraph, Rn as ancestorConstraintForBinding, Ro as reservationFor, Rr as clauseIsGoverned, Rt as proofEvidenceConstraints, S as GIT_COMMAND_MANIFEST_IDS, Sa as evaluateGraphDerivedHostLock, Si as auditedDefaultWorkdirProvider, Sn as assessmentOutcomePredicate, So as applyPrivateLedger, Sr as classifyClause, St as bindingIndividuallyAccepted, T as commitTreeSnapshotDigest, Ta as evaluateToolSurfaceCapability, Ti as combineHostPolicy, Tn as decideTurnBoundary, To as privateLedgerContractDigest, Tr as extractMethod, Tt as PROOF_KINDS, U as SESSION_API_UNSUPPORTED, Ua as STATEFUL_ACTIONS, Ui as verifyComposedHostLockDump, Un as BOUNDARY_RECORD_PREFIX, Uo as sanitizeUrl, Ur as hasQuestionScope, Ut as scopeCoverageDigest, V as captureHostWorkdir, Va as CERTIFICATE_VERSION_V2, Vi as resolveInstalledHostLock, Vn as needsReviewObligations, Vo as normalizeClause, Vr as governedClauseRestrictsExecution, Vt as proofV2Rejection, W as SESSION_EVENT_ENVELOPE_INVALID, Wa as STOP_PROTOCOL_VERSION, Wi as DESKTOP_IDENTITY_FACTS, Wn as availableBoundaryQualifications, Wo as sha256, Wr as hasWorkPredicate, Wt as sessionQuery, X as PROTOCOL_V3_NOTICE, Xa as requestedIdentityKey, Xi as memoizedAsarIndex, Xn as confirmRebind, Xr as isInformationalFragment, Xt as CLEANUP_CONDITION_RULE_SHORT, Y as DEFAULT_DELEGATION_TOOL_NAMES, Ya as isStatefulAction, Yi as memoizedAsarFile, Yn as createProjection, Yr as isExplanationScope, Yt as CLEANUP_CONDITION_RULE_COMPACT, Z as PROTOCOL_V4_NOTICE, Za as requestedTargetAuthorizesMutation, Zi as readAsarFile, Zn as proposeRebind, Zr as isOpenObligation, Zt as DEFAULT_RECOVERY_CHAR_BUDGET, _ as prepareActivationMigration, _a as HOST_CAPABILITY_PACKAGE_GROUPS, _i as COMMAND_SURFACE_MANIFEST, _n as isVerifyingCapability, _o as activationDigest, _r as partialFailureOf, _t as parseShellCommand, a as resolveActivationPersistencePlugin, aa as hostTrustDigest, ai as namedActions, an as openItems, ao as createHostAuditSession, ar as parseConfirmationMessage, at as NATIVE_GIT_ROOT_PARENT_OID, b as RC020_RC2_HOST_PACKAGES, ba as bindLiveGoalCapability, bi as activeRendererModule, bn as NO_PROGRESS_TURNS_BEFORE_STOP, bo as validateActivationBinding, br as captureClause, bt as authorityCaptureCounts, c as createActivationSelection, ca as registryArchiveFiles, ci as presentExplanationHead, cn as renderRecoveryPacket, co as adoptActivationReceipt, cr as evidenceAvailabilityReason, ct as extractToolSubject, d as scanActivationInventory, da as ACTIVE_HOST_COHORT_IDS, di as reportingHeadGoverns, dn as currentV6Feedback, do as readActivationMigrationReceipt, dr as relevantEvidence, dt as persistedToolResultStatus, ea as readDesktopDependency, ei as itemHoldsExecutionAuthority, en as V6_ORDINARY_COMPLETION_RULE_COMPACT, eo as semanticActionFromText, er as rebindAttemptKey, et as applyUpgradeEligibility, f as selectedActivationInventory, fa as ACTIVE_HOST_LAUNCHER_VERSION, fi as restatedContentOf, fn as isV6PendingRootWait, fo as resolveActivationBindingsRoot, fr as DEPENDENCY_FREE_ONLY_CONDITION, ft as shellReadbackOutcome, g as inspectActivationInventory, ga as GOAL_HOST_PACKAGES, gi as verbIsNegated, gn as evidenceMatchesItem, go as activationCanonical, gr as capabilityFactOf, gt as parsePwshCommand, h as verifySelectedMigrationInventory, ha as EXPECTED_HOST_PACKAGES, hi as statefulActionsOfScope, hn as evidenceCoverage, ho as writeActivationBinding, hr as capabilityConsequence, ht as isRunExecutable, i as guardActivationInventory, ia as acquireHostTrust, ii as maskQuotedSpans, in as closingHint, io as RC021_RC3_HOST_PACKAGES, ir as isFrozenV042RebindResponse, it as supersedeItem, j as verifiedLinearCommitReadback, ja as SUPPORTED_HOST_RANGE, ji as inspectDesktopTargetGraph, jn as latestRootInstruction, jo as contractById, jr as classifyTaskIntent, jt as bindProofV2ToProjection, k as parseGitCommandManifest, ka as LATEST_TESTED_HOST_VERSION, ki as hostLockRowsFromComposedDump, kn as isWholeTaskCompletionClaim, ko as RELEASE_OPERATIONS, kr as canonicalRegistryBase, kt as PROOF_PROTOCOL_VERSION_V2, l as isSelectedActivationReceipt, la as registryArchiveModules, li as qualificationOfClause, ln as v6CurrentRootBoundaries, lo as createActivationMigrationReceipt, lr as itemDiagnosis, lt as isDeterministicCheck, m as validateActivationSelection, ma as DEFAULT_HOST_LOCK, mi as splitTextFragments, mn as bindingSatisfies, mo as validateActivationMigrationReceipt, mr as admissibleForRemoval, mt as canonicalArgvFromCommand, n as assertActivationPhysicalRows, na as writeDesktopRuntimeReceipt, ni as legacyQuestionReadingIsInformational, nn as carriesCleanupCondition, no as validateActionTarget, nr as replayRebindResult, nt as legacyRecordsNeedingReview, o as activationSelectionPending, oa as parseHostTrust, oi as opensConditionLead, on as recoveryDigest, oo as __activationBindingInternals, or as capabilityRemedyPhrase, ot as evidenceFromPersistedToolResult, p as validateActivationInventorySnapshot, pa as BASE_HOST_PACKAGES, pi as semanticActionOfScope, pn as sourceItemForCoreRequirement, po as resolveSessionActivation, pr as actionHasCertificationPath, pt as withDurability, q as projectCoreV2, qa as actionCompatible, qi as auditDesktopInstalledImplementation, qn as qualifyBoundary, qo as ownedJobLifecycle, qr as introducesActionClause, qt as validateProofManifestV2, r as captureActivationPhysicalInventory, ra as HostTrustError, ri as maskCodeSpans, rn as cleanupConditionFor, ro as RC021_RC5_HOST_PACKAGES, rr as CONFIRM_LINE_PATTERN, rt as rootLocatorFlavor, s as bindActivationInventoryPhysical, sa as qualifyHostTrust, si as opensWithDirective, sn as recoveryTitle, so as activationBindingPath, sr as deriveItemDiagnosis, st as extractTextContent, t as assertActivationBackendIdentity, ta as readDesktopTargetGraph, ti as kindOfScope, tn as V6_ORDINARY_COMPLETION_RULE_SHORT, to as validateActionManifest, tr as rebindResponse, tt as deriveProjection, u as prepareSelectedActivationMigration, ua as ACTIVE_HOST_COHORT_ID, ui as questionHeadsClause, un as confirmedV6CoreDiagnostic, uo as readActivationBinding, ur as nativeFileTwoRole, ut as nativeGitParentOidVerified, v as verifyMigrationInventory, va as HOST_COHORTS, vi as validateManifest, vn as CONTROL_RECORD_PREFIX, vo as activationJson, vr as removalIsComplete, vt as cwdEpochsFromEvents, w as commitIndexSnapshotDigest, wa as evaluateHostLock, wi as auditedHostImplementation, wn as currentActionBases, wo as initializePrivateLedger, wr as extractArtifactPaths, wt as PROOF_CAPABILITY_MATRIX, x as RC020_RC1_HOST_PACKAGES, xa as evaluateExternalWaitCapability, xi as auditedDefaultWorkdirHost, xn as assessmentAction, xo as appendPrivateLedger, xr as captureItem, xt as segmentAuthorityBlocks, y as RC021_RC2_HOST_PACKAGES, ya as bindExecutableIdentity, yi as HostProfileError, yn as NO_PROGRESS_RECORD_PREFIX, yo as sessionBirthIdentity, yr as removalIsPartiallyKnown, yt as effectiveCwdAt, z as sessionCoreSnapshot, za as BOUNDED_ARTIFACT_TYPES, zi as resolveActiveProfileHostLock, zn as certifiableOpenItems, zo as canonicalizePath, zr as clauseIsProtected, zt as proofHostSurfacesOf } from "./domain-DUS0V_Yv.js";
 import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { constants, existsSync, readFileSync } from "node:fs";
 import { basename, delimiter, dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
 import { homedir, tmpdir } from "node:os";
 import { createHash } from "node:crypto";
 import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
 import { gunzip } from "node:zlib";
 import { execFile } from "node:child_process";
 import { JobId } from "@deepseek-ai/dsh-jobs";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { promisify } from "node:util";
-import { access, readFile, realpath } from "node:fs/promises";
+import { access, open, readFile, realpath } from "node:fs/promises";
 import { SESSION_FORMAT_VERSION, Session, SessionId } from "@deepseek-ai/dsh-session";
 
 //#region src/tools/rebind.ts
@@ -1992,6 +1992,255 @@ function createInterpretTool(options) {
 	});
 }
 
+//#endregion
+//#region src/domain/tgz-archive.ts
+const gunzipAsync = promisify(gunzip);
+const DEFAULT_TGZ_BUDGET = {
+	maxCompressedBytes: 128 * 1024 * 1024,
+	maxDecompressedBytes: 256 * 1024 * 1024,
+	maxMemberBytes: 256 * 1024 * 1024,
+	maxMemberCount: 65536,
+	maxManifestBytes: 1024 * 1024
+};
+const BLOCK = 512;
+const OCTAL_SIZE = /^[0-7]+$/;
+const POSIX_MAGIC = Buffer.from("ustar\0", "ascii");
+const POSIX_VERSION = Buffer.from("00", "ascii");
+/** NUL-terminated string field; bytes after the first NUL must be NUL. */
+function tarStringField(block, start, end) {
+	const raw = block.subarray(start, end);
+	const terminator = raw.indexOf(0);
+	if (terminator >= 0 && raw.subarray(terminator + 1).some((byte) => byte !== 0)) return void 0;
+	return (terminator < 0 ? raw : raw.subarray(0, terminator)).toString("utf8");
+}
+/** Unsigned header checksum: the checksum field counts as eight spaces. */
+function tarChecksumValid(block) {
+	const field = block.subarray(148, 156);
+	let digitsEnd = field.findIndex((byte) => byte === 0 || byte === 32);
+	if (digitsEnd < 0) digitsEnd = field.length;
+	const stored = field.subarray(0, digitsEnd).toString("ascii");
+	if (!stored.length || !OCTAL_SIZE.test(stored)) return false;
+	let sum = 0;
+	for (let index = 0; index < block.length; index += 1) sum += index >= 148 && index < 156 ? 32 : block[index];
+	return Number.parseInt(stored, 8) === sum;
+}
+/**
+* npm-compatible path projection for one member: POSIX ustar prefix joins the
+* name, `.` and empty components collapse, `..`/backslash/absolute/Windows
+* drive components and anything outside `package/<nonempty...>` are refused.
+*/
+function normalizeMemberPath(prefix, name$1) {
+	if (name$1.includes("\\") || prefix.includes("\\")) return void 0;
+	const full = prefix ? `${prefix}/${name$1}` : name$1;
+	if (full.startsWith("/")) return void 0;
+	const parts = [];
+	for (const part of full.split("/")) {
+		if (part === "" || part === ".") continue;
+		if (part === ".." || /^[A-Za-z]:$/.test(part)) return void 0;
+		parts.push(part);
+	}
+	if (parts.length < 2 || parts[0] !== "package") return void 0;
+	return parts.join("/");
+}
+function parseTar(tar, budget) {
+	const seen = /* @__PURE__ */ new Set();
+	let manifest;
+	let members = 0;
+	let terminated = false;
+	for (let offset = 0; offset + BLOCK <= tar.length;) {
+		const header = tar.subarray(offset, offset + BLOCK);
+		if (header.every((byte) => byte === 0)) {
+			if (!tar.subarray(offset).every((byte) => byte === 0)) return {
+				status: "rejected",
+				reasonCode: "tgz_trailing_bytes"
+			};
+			terminated = true;
+			break;
+		}
+		members += 1;
+		if (members > budget.maxMemberCount) return {
+			status: "rejected",
+			reasonCode: "tgz_member_count_exceeded"
+		};
+		if (!tarChecksumValid(header)) return {
+			status: "rejected",
+			reasonCode: "tgz_tar_checksum_invalid"
+		};
+		const posix$1 = header.subarray(257, 263).equals(POSIX_MAGIC) && header.subarray(263, 265).equals(POSIX_VERSION);
+		const noMagic = header.subarray(257, 265).every((byte) => byte === 0);
+		if (!posix$1 && !noMagic) return {
+			status: "rejected",
+			reasonCode: "tgz_format_unsupported"
+		};
+		const typeflag = header[156];
+		if (typeflag !== 0 && typeflag !== 48 && typeflag !== 53) return {
+			status: "rejected",
+			reasonCode: "tgz_member_type_unsupported"
+		};
+		const name$1 = tarStringField(header, 0, 100);
+		const prefix = posix$1 ? tarStringField(header, 345, 500) : header.subarray(345, 500).every((byte) => byte === 0) ? "" : void 0;
+		if (name$1 === void 0 || prefix === void 0) return {
+			status: "rejected",
+			reasonCode: "tgz_tar_corrupt"
+		};
+		const sizeText = header.subarray(124, 136).toString("ascii").replace(/\0.*$/, "").trim();
+		if (!OCTAL_SIZE.test(sizeText)) return {
+			status: "rejected",
+			reasonCode: "tgz_tar_corrupt"
+		};
+		const size$1 = Number.parseInt(sizeText, 8);
+		const bodyStart = offset + BLOCK;
+		const bodyEnd = bodyStart + size$1;
+		if (!Number.isSafeInteger(size$1) || size$1 < 0 || bodyEnd > tar.length) return {
+			status: "rejected",
+			reasonCode: "tgz_tar_corrupt"
+		};
+		if (size$1 > budget.maxMemberBytes) return {
+			status: "rejected",
+			reasonCode: "tgz_member_budget_exceeded"
+		};
+		const path = normalizeMemberPath(prefix, name$1);
+		if (path === void 0) return {
+			status: "rejected",
+			reasonCode: "tgz_member_path_unsupported"
+		};
+		if (seen.has(path)) return {
+			status: "rejected",
+			reasonCode: "tgz_duplicate_member"
+		};
+		seen.add(path);
+		if (path === "package/package.json" && typeflag !== 53) {
+			if (size$1 > budget.maxManifestBytes) return {
+				status: "rejected",
+				reasonCode: "tgz_manifest_budget_exceeded"
+			};
+			manifest = tar.subarray(bodyStart, bodyEnd);
+		}
+		offset = bodyStart + Math.ceil(size$1 / BLOCK) * BLOCK;
+	}
+	if (!terminated) return {
+		status: "rejected",
+		reasonCode: "tgz_tar_corrupt"
+	};
+	if (manifest === void 0) return {
+		status: "rejected",
+		reasonCode: "tgz_manifest_missing"
+	};
+	return {
+		status: "ok",
+		manifest
+	};
+}
+/** Read the release identity of a local tgz under explicit resource budgets. */
+async function readTgzIdentity(path, options) {
+	const budget = options?.budget ?? DEFAULT_TGZ_BUDGET;
+	if (typeof path !== "string" || !isAbsolute(path) || !path.endsWith(".tgz")) return {
+		status: "rejected",
+		reasonCode: "tgz_path_invalid"
+	};
+	if (options?.signal?.aborted) return {
+		status: "rejected",
+		reasonCode: "tgz_cancelled"
+	};
+	let handle;
+	try {
+		handle = await open(path, "r");
+	} catch {
+		return {
+			status: "rejected",
+			reasonCode: "tgz_missing"
+		};
+	}
+	try {
+		if (!(await handle.stat()).isFile()) return {
+			status: "rejected",
+			reasonCode: "tgz_not_regular_file"
+		};
+		const chunks = [];
+		let received = 0;
+		let position = 0;
+		let eofStable = false;
+		while (!eofStable) {
+			if (options?.signal?.aborted) return {
+				status: "rejected",
+				reasonCode: "tgz_cancelled"
+			};
+			const chunk = Buffer.alloc(256 * 1024);
+			const { bytesRead } = await handle.read(chunk, 0, chunk.length, position);
+			if (bytesRead > 0) {
+				position += bytesRead;
+				received += bytesRead;
+				if (received > budget.maxCompressedBytes) return {
+					status: "rejected",
+					reasonCode: "tgz_compressed_budget_exceeded"
+				};
+				chunks.push(chunk.subarray(0, bytesRead));
+			}
+			if (bytesRead < chunk.length) eofStable = (await handle.stat()).size <= position;
+		}
+		if (received === 0) return {
+			status: "rejected",
+			reasonCode: "tgz_empty"
+		};
+		const bytes = Buffer.concat(chunks);
+		let tar;
+		try {
+			tar = await gunzipAsync(bytes, { maxOutputLength: budget.maxDecompressedBytes });
+		} catch (error) {
+			if (error.code === "ERR_BUFFER_TOO_LARGE") return {
+				status: "rejected",
+				reasonCode: "tgz_decompressed_budget_exceeded"
+			};
+			return {
+				status: "rejected",
+				reasonCode: "tgz_gzip_corrupt"
+			};
+		}
+		if (options?.signal?.aborted) return {
+			status: "rejected",
+			reasonCode: "tgz_cancelled"
+		};
+		const parsed = parseTar(tar, budget);
+		if (parsed.status !== "ok") return parsed;
+		let manifestJson;
+		try {
+			manifestJson = JSON.parse(parsed.manifest.toString("utf8"));
+		} catch {
+			return {
+				status: "rejected",
+				reasonCode: "tgz_manifest_invalid"
+			};
+		}
+		const manifest = manifestJson && typeof manifestJson === "object" && !Array.isArray(manifestJson) ? manifestJson : void 0;
+		if (!manifest) return {
+			status: "rejected",
+			reasonCode: "tgz_manifest_invalid"
+		};
+		const name$1 = typeof manifest.name === "string" ? manifest.name : void 0;
+		const version = typeof manifest.version === "string" ? manifest.version : void 0;
+		if (!name$1 || !version) return {
+			status: "rejected",
+			reasonCode: "tgz_manifest_invalid"
+		};
+		const gitHead = typeof manifest.gitHead === "string" && /^[0-9a-f]{40}$/.test(manifest.gitHead) ? manifest.gitHead : void 0;
+		const repositoryField = manifest.repository;
+		const repository = typeof repositoryField === "string" ? repositoryField : repositoryField && typeof repositoryField === "object" && !Array.isArray(repositoryField) && typeof repositoryField.url === "string" ? repositoryField.url : void 0;
+		return {
+			status: "ok",
+			identity: {
+				name: name$1,
+				version,
+				integrity: `sha512-${createHash("sha512").update(bytes).digest("base64")}`,
+				sha256: createHash("sha256").update(bytes).digest("hex"),
+				...gitHead ? { gitHead } : {},
+				...repository ? { repository } : {}
+			}
+		};
+	} finally {
+		await handle.close();
+	}
+}
+
 //#endregion
 //#region src/tools/evidence.ts
 const execFileAsync$1 = promisify(execFile);
@@ -2010,6 +2259,10 @@ const SUPPORTED = [
 	"pull",
 	"fetch"
 ];
+const DEFAULT_REGISTRY_READ_BUDGET = {
+	totalDeadlineMs: 3e4,
+	maxBodyBytes: 8 * 1024 * 1024
+};
 const RESTART_INTENT_PREFIX = "Context Guard restart intent v1: ";
 function restartIntent(events, resolutionCallId, target) {
 	for (const raw of events) {
@@ -2307,44 +2560,15 @@ async function readJson(path) {
 		return;
 	}
 }
-async function tgzIdentity(path) {
-	if (!isAbsolute(path) || !path.endsWith(".tgz")) return void 0;
-	const bytes = await readFile(path);
-	if (bytes.length === 0 || bytes.length > 128 * 1024 * 1024) return void 0;
-	const tar = await promisify(gunzip)(bytes);
-	let manifest;
-	for (let offset = 0; offset + 512 <= tar.length;) {
-		const header = tar.subarray(offset, offset + 512);
-		if (header.every((byte) => byte === 0)) break;
-		const name$1 = header.subarray(0, 100).toString("utf8").replace(/\0.*$/, "");
-		const sizeText = header.subarray(124, 136).toString("ascii").replace(/\0.*$/, "").trim();
-		if (!/^[0-7]+$/.test(sizeText)) return void 0;
-		const size$1 = Number.parseInt(sizeText, 8);
-		const bodyStart = offset + 512;
-		const bodyEnd = bodyStart + size$1;
-		if (!Number.isSafeInteger(size$1) || size$1 < 0 || bodyEnd > tar.length) return void 0;
-		if (name$1 === "package/package.json") {
-			if (manifest || size$1 > 1024 * 1024) return void 0;
-			try {
-				manifest = record$1(JSON.parse(tar.subarray(bodyStart, bodyEnd).toString("utf8")));
-			} catch {
-				return;
-			}
-		}
-		offset = bodyStart + Math.ceil(size$1 / 512) * 512;
-	}
-	if (typeof manifest?.name !== "string" || typeof manifest.version !== "string") return void 0;
-	const gitHead = typeof manifest.gitHead === "string" && /^[0-9a-f]{40}$/.test(manifest.gitHead) ? manifest.gitHead : void 0;
-	const repositoryField = manifest.repository;
-	const repository = typeof repositoryField === "string" ? repositoryField : record$1(repositoryField) && typeof record$1(repositoryField)?.url === "string" ? String(record$1(repositoryField).url) : void 0;
-	return {
-		name: manifest.name,
-		version: manifest.version,
-		integrity: `sha512-${createHash("sha512").update(bytes).digest("base64")}`,
-		sha256: createHash("sha256").update(bytes).digest("hex"),
-		...gitHead ? { gitHead } : {},
-		...repository ? { repository } : {}
-	};
+/**
+* Identity of a release tgz under the auditable tar subset (F01/F08): every
+* producer that needs the artifact's identity — resolution, pre-effect
+* revalidation and post-publish observation — consumes this one result, so no
+* stage can disagree with another about which manifest the bytes encode.
+*/
+async function tgzIdentity(path, signal) {
+	const result = await readTgzIdentity(path, signal ? { signal } : void 0);
+	return result.status === "ok" ? result.identity : void 0;
 }
 /**
 * Read the candidate identity of a publish from TRUSTED PRODUCERS only: the
@@ -2357,7 +2581,7 @@ async function tgzIdentity(path) {
 async function observePublishCandidate(resolution, roots, signal, cwd) {
 	const tgzPath = requireString(resolution.commandManifest, "tgz_path");
 	if (!tgzPath) return void 0;
-	const identity = await tgzIdentity(tgzPath);
+	const identity = await tgzIdentity(tgzPath, signal);
 	if (!identity) return void 0;
 	const registry = typeof resolution.target.registry === "string" ? resolution.target.registry : void 0;
 	return {
@@ -2470,19 +2694,85 @@ async function profilePackage(profilePath, packageId) {
 		return;
 	}
 }
+/**
+* One bounded registry read (F09/RF05): the caller's cancellation combined
+* with the plugin's own total deadline governs the WHOLE call — reads AND the
+* cleanup that releases the body — and a streamed hard byte budget covers the
+* DECODED bytes, so chunked or compressed transports cannot smuggle a larger
+* document past the counter. A cleanup cancel that itself hangs or rejects is
+* abandoned at the deadline instead of turning the release phase into an
+* unbounded wait; the timeout signal does not keep the event loop alive.
+*/
+async function boundedRegistryJson(url, init, fetcher, budget, signal) {
+	const deadline = AbortSignal.timeout(budget.totalDeadlineMs);
+	const combined = typeof AbortSignal.any === "function" ? AbortSignal.any([signal, deadline]) : deadline;
+	const releaseBounded = (releasing) => {
+		releasing.catch(() => {});
+		if (combined.aborted) return Promise.resolve();
+		return new Promise((resolve$1) => {
+			const onAbort = () => resolve$1();
+			combined.addEventListener("abort", onAbort, { once: true });
+			releasing.then(() => {
+				combined.removeEventListener("abort", onAbort);
+				resolve$1();
+			}, () => {
+				combined.removeEventListener("abort", onAbort);
+				resolve$1();
+			});
+		});
+	};
+	let response;
+	try {
+		response = await fetcher(url, {
+			...init,
+			signal: combined
+		});
+	} catch {
+		return;
+	}
+	if (!response.ok || !response.body) {
+		await releaseBounded(response.body?.cancel() ?? Promise.resolve());
+		return;
+	}
+	const reader = response.body.getReader();
+	const chunks = [];
+	let received = 0;
+	const readBounded = () => {
+		if (combined.aborted) return Promise.reject(/* @__PURE__ */ new Error("registry_read_budget_exhausted"));
+		let onAbort;
+		return Promise.race([reader.read(), new Promise((_resolve, reject) => {
+			onAbort = () => reject(/* @__PURE__ */ new Error("registry_read_budget_exhausted"));
+			combined.addEventListener("abort", onAbort, { once: true });
+		})]).finally(() => combined.removeEventListener("abort", onAbort));
+	};
+	try {
+		while (true) {
+			const { done, value } = await readBounded();
+			if (done) break;
+			received += value.byteLength;
+			if (received > budget.maxBodyBytes) return void 0;
+			chunks.push(value);
+		}
+	} catch {
+		return;
+	} finally {
+		await releaseBounded(reader.cancel().catch(() => {}));
+	}
+	try {
+		return record$1(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+	} catch {
+		return;
+	}
+}
 async function registryIntegrity(registry, packageId, version, roots, signal) {
 	const canonical = canonicalRegistryBase(registry, { allowLoopbackHttp: roots.allowLoopbackHttpRegistry });
 	if (!canonical || canonical !== registry) return void 0;
-	const response = await (roots.fetcher ?? fetch)(new URL(npmEscapedPackageName(packageId), canonical), {
-		signal,
+	const release = await boundedRegistryJson(new URL(`${npmEscapedPackageName(packageId)}/${encodeURIComponent(version)}`, canonical), {
 		headers: { accept: "application/json" },
 		redirect: "error"
-	});
-	if (!response.ok) return void 0;
-	const value = record$1(await response.json());
-	const release = record$1(record$1(value?.versions)?.[version]);
+	}, roots.fetcher ?? fetch, roots.registryReadBudget ?? DEFAULT_REGISTRY_READ_BUDGET, signal);
 	const dist = record$1(release?.dist);
-	return value?.name === packageId && release?.name === packageId && release.version === version && typeof dist?.integrity === "string" ? dist.integrity : void 0;
+	return release?.name === packageId && release?.version === version && typeof dist?.integrity === "string" ? dist.integrity : void 0;
 }
 function windowsBatchCommand(file, args) {
 	const values = [file, ...args];
@@ -2587,7 +2877,7 @@ async function executeGuardAction(action, resolution, roots, signal, executableI
 	const target = resolution.target;
 	if (action === "install" || action === "apply") {
 		const tgzPath = requireString(resolution.commandManifest, "tgz_path");
-		const identity = tgzPath ? await tgzIdentity(tgzPath) : void 0;
+		const identity = tgzPath ? await tgzIdentity(tgzPath, signal) : void 0;
 		if (!executableIdentity$1 || !tgzPath || !identity || identity.name !== target.package_id || identity.version !== target.version || identity.integrity !== target.integrity_digest || roots.profile?.name !== target.profile) return { status: "unavailable" };
 		if (roots.preEffectVeto?.() === false) return {
 			status: "unavailable",
@@ -2604,7 +2894,7 @@ async function executeGuardAction(action, resolution, roots, signal, executableI
 	}
 	if (action === "publish") {
 		const tgzPath = requireString(resolution.commandManifest, "tgz_path");
-		const identity = tgzPath ? await tgzIdentity(tgzPath) : void 0;
+		const identity = tgzPath ? await tgzIdentity(tgzPath, signal) : void 0;
 		const registry = typeof target.registry === "string" ? canonicalRegistryBase(target.registry, { allowLoopbackHttp: roots.allowLoopbackHttpRegistry }) : void 0;
 		if (!executableIdentity$1 || !tgzPath || !identity || identity.name !== target.artifact_id || identity.version !== target.version || identity.integrity !== target.integrity_digest || !registry || registry !== target.registry) return { status: "unavailable" };
 		if (roots.preEffectVeto?.() === false) return {
@@ -2882,7 +3172,7 @@ async function resolveTarget(action, selector, commandManifest, cwd, roots, sign
 		const tgzPath = requireString(commandManifest, "tgz_path");
 		const manifestId = action === "install" ? "dsh.plugin_add_tgz.install.v1" : "dsh.plugin_add_tgz.apply.v1";
 		if (!hasExactKeys(commandManifest, ["manifest_id", "tgz_path"]) || !packageId || !profile || profile !== trustedProfile?.name || commandManifest.manifest_id !== manifestId || !ACTION_MANIFEST.actions[action].commandManifestIds.includes(manifestId) || !tgzPath) return void 0;
-		const identity = await tgzIdentity(tgzPath);
+		const identity = await tgzIdentity(tgzPath, signal);
 		if (!identity || identity.name !== packageId || selector.version !== void 0 && selector.version !== identity.version) return void 0;
 		const installed = await profilePackage(trustedProfile.path, packageId);
 		if (action === "install" && installed) return void 0;
@@ -2910,7 +3200,7 @@ async function resolveTarget(action, selector, commandManifest, cwd, roots, sign
 		const registry = canonicalRegistryBase(requireString(selector, "registry") ?? "", { allowLoopbackHttp: roots.allowLoopbackHttpRegistry });
 		const tgzPath = requireString(commandManifest, "tgz_path");
 		if (!hasExactKeys(commandManifest, ["manifest_id", "tgz_path"]) || !registry || commandManifest.manifest_id !== "npm.publish_tgz.v1" || !ACTION_MANIFEST.actions.publish.commandManifestIds.includes("npm.publish_tgz.v1") || !tgzPath) return void 0;
-		const identity = await tgzIdentity(tgzPath);
+		const identity = await tgzIdentity(tgzPath, signal);
 		if (!identity || identity.name !== selector.artifact_id || identity.version !== selector.version) return void 0;
 		return { target: {
 			artifact_id: identity.name,
@@ -3136,6 +3426,7 @@ function normalizedRoots(options) {
 		...options.allowLoopbackHttpRegistry ? { allowLoopbackHttpRegistry: true } : {},
 		...options.releaseGate ? { releaseGate: options.releaseGate } : {},
 		...options.releaseSettle ? { releaseSettle: options.releaseSettle } : {},
+		...options.registryReadBudget ? { registryReadBudget: options.registryReadBudget } : {},
 		...options.preEffectVeto ? { preEffectVeto: options.preEffectVeto } : {}
 	};
 }
@@ -3913,12 +4204,13 @@ function createNativeFileObserver(host) {
 			const agent = exec.agent;
 			if (!agent || !host.fs || !host.flush) return missing("host_fs_unavailable");
 			if (!await host.flush(agent.session)) return missing("native_effect_not_durable");
+			const events = snapshotSessionEvents(agent.session);
 			let call;
 			let result;
 			let callSeq = -1;
 			let resultSeq = -1;
 			let duplicate = false;
-			for (const raw of snapshotSessionEvents(agent.session)) {
+			for (const raw of events) {
 				const event = record(raw);
 				const data = record(event?.data);
 				if (event?.type === "tool/call" && data?.callId === args.effect_call_id) {
@@ -3951,7 +4243,11 @@ function createNativeFileObserver(host) {
 			const filePath = effectArgs?.file_path;
 			if (typeof filePath !== "string" || !filePath) return missing("native_effect_target_missing");
 			const action = String(call.name).startsWith("write") ? "create" : "modify";
-			const cwd = record(agent.session.header)?.cwd;
+			const headerCwdRaw = record(agent.session.header)?.cwd;
+			const headerCwd = typeof headerCwdRaw === "string" ? headerCwdRaw : void 0;
+			const epochs = cwdEpochsFromEvents(events, headerCwd);
+			const cwd = epochs ? effectiveCwdAt(epochs, headerCwd, callSeq) : void 0;
+			if (!posix.isAbsolute(filePath) && !win32.isAbsolute(filePath) && typeof cwd !== "string") return missing("native_effect_cwd_unresolvable");
 			try {
 				const target = await host.fs.resolve(filePath, {
 					...typeof cwd === "string" ? { cwd } : {},
@@ -4714,7 +5010,7 @@ function createContextGuardCommand(projectionFor, setEnabled, clearContract, lif
 }
 
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+cosmokit@1.8.5/node_modules/@deepseek-ai/cosmokit/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+cosmokit@1.8.6/node_modules/@deepseek-ai/cosmokit/lib/index.js
 /** Return true when a value is `null` or `undefined`. */
 function isNullable(value) {
 	return value === null || value === void 0;
@@ -4973,7 +5269,7 @@ var Time;
 })(Time || (Time = {}));
 
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+schemastery@3.18.4/node_modules/@deepseek-ai/schemastery/lib/index.mjs
+//#region node_modules/.pnpm/@deepseek-ai+schemastery@3.18.5/node_modules/@deepseek-ai/schemastery/lib/index.mjs
 const kSchema = Symbol.for("schemastery");
 const kValidationError = Symbol.for("ValidationError");
 globalThis.__schemastery_index__ ??= 0;
@@ -6336,14 +6632,33 @@ function sessionCwd(session) {
 	const header = session.header;
 	return typeof header?.cwd === "string" && header.cwd.length > 0 ? header.cwd : void 0;
 }
+/**
+* The directory the host's working-directory service resolves relative paths
+* against RIGHT NOW: the last committed epoch, not the immutable header
+* project. `undefined` when the timeline cannot be proven, so the private
+* storage guard fails closed on relative targets instead of guessing.
+*/
+function effectiveSessionCwd(session) {
+	const header = sessionCwd(session);
+	if (header === void 0) return void 0;
+	const epochs = cwdEpochsFromEvents(snapshotSessionEvents(session), header);
+	return epochs ? effectiveCwdAt(epochs, header, Number.POSITIVE_INFINITY) : void 0;
+}
 /** A bounded signal for a short trusted readback performed by the gate. */
 function requestSignal() {
 	return AbortSignal.timeout(5e3);
 }
-/** Delegated/subagent sessions never receive root-conversation injections. */
+/**
+* Delegated/subagent sessions never receive root-conversation injections.
+* `parentSession` is FORK LINEAGE, not delegation: a plain user fork is a
+* root conversation (the host's roots registry admits resumed forks). Only
+* the host's explicit subagent markers — `origin=subagent` or a positive
+* `delegationDepth` — delegate, so contradictory or unknown fields stay
+* delegated and never gain root privileges.
+*/
 function isDelegatedSession(session) {
 	const header = session.header;
-	return header?.origin === "subagent" || typeof header?.delegationDepth === "number" && header.delegationDepth > 0 || typeof header?.parentSession === "string";
+	return header?.origin === "subagent" || typeof header?.delegationDepth === "number" && header.delegationDepth > 0;
 }
 /** Never reinterpret a legacy injected snapshot as freshly accepted core/v1. */
 function revalidateCoreLock(config, expected, providedSession) {
@@ -6537,14 +6852,33 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 					key: "identity"
 				};
 			}
+			let creationRetry = initialization.status === "unavailable" && initialization.reasonCode === "activation_writer_unavailable" ? {
+				source: startSources.get(agent),
+				attempts: 0,
+				deadline: Date.now() + 6e4
+			} : void 0;
 			const readMode = () => {
 				if (!birth) return initialization;
 				try {
-					const fresh = readActivationBinding(activationBindingsRoot, sessionBirthIdentity(agent.session.header, agent.session.inheritedEventCount), config.activationSource === "explicit" ? config.activation : void 0);
-					return fresh.status === "unavailable" && fresh.reasonCode === "activation_mode_unknown" && initialization.status === "unavailable" ? {
-						...initialization,
-						key: fresh.key
-					} : fresh;
+					const currentBirth = sessionBirthIdentity(agent.session.header, agent.session.inheritedEventCount);
+					const fresh = readActivationBinding(activationBindingsRoot, currentBirth, config.activationSource === "explicit" ? config.activation : void 0);
+					if (fresh.status === "bound") {
+						creationRetry = void 0;
+						return fresh;
+					}
+					if (fresh.status === "unavailable" && fresh.reasonCode === "activation_mode_unknown" && initialization.status === "unavailable") {
+						if (creationRetry !== void 0 && creationRetry.source === "startup" && creationRetry.attempts < 8 && Date.now() <= creationRetry.deadline && agentHostLock.status === "supported" && ctx.get?.("agents")?.get(agent.id) === agent && ctx.sessions.get?.(agent.session.id) === agent.session) {
+							creationRetry.attempts += 1;
+							const retried = resolveSessionActivation(activationBindingsRoot, currentBirth, config, creationRetry.source, true);
+							if (retried.status === "bound" || retried.reasonCode !== "activation_writer_unavailable") initialization = retried;
+							return retried;
+						}
+						return {
+							...initialization,
+							key: fresh.key
+						};
+					}
+					return fresh;
 				} catch {
 					return {
 						status: "unavailable",
@@ -6795,7 +7129,7 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 			}));
 			ownedTools.register(createExternalOperationTool((id, toolAgent) => readExternalOperation(ctx, toolAgent, id), () => evaluateExternalWaitCapability(hostLocks.get(agent) ?? installedHostLock)));
 			ownedTools.guard((exec) => {
-				const privateDenial = privateStorageToolDenial(exec.name, exec.arguments, sessionCwd(agent.session) ?? process.cwd(), [activationBindingsRoot, ...privateLedgerRoot ? [privateLedgerRoot] : []]);
+				const privateDenial = privateStorageToolDenial(exec.name, exec.arguments, effectiveSessionCwd(agent.session), [activationBindingsRoot, ...privateLedgerRoot ? [privateLedgerRoot] : []]);
 				if (privateDenial) return privateDenial;
 				if (exec.name === "update_goal" && exec.arguments?.action === "complete") {
 					runtime.sync();
@@ -7114,4 +7448,4 @@ async function replayRawV2(input) {
 }
 
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, BASE_HOST_PACKAGES, BOUNDARY_RECORD_PREFIX, BOUNDED_ARTIFACT_TYPES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, CERTIFICATE_VERSION_V2, CLEANUP_CONDITION_RULE, CLEANUP_CONDITION_RULE_COMPACT, CLEANUP_CONDITION_RULE_SHORT, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_DELEGATION_TOOL_NAMES, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DEPENDENCY_FREE_ONLY_CONDITION, DESKTOP_IDENTITY_FACTS, DESKTOP_PROFILE_PACKAGE_NAME, DESKTOP_RUNTIME_PACKAGE_NAME, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GRANTED_QUALIFICATION, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HOST_VALIDATED_VERSIONS, HostProfileError, HostTrustError, LATEST_TESTED_HOST_VERSION, LEGACY_QUALIFICATION, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NATIVE_GIT_ROOT_PARENT_OID, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_CAPABILITY_MATRIX, PROOF_KINDS, PROOF_KINDS_V2, PROOF_MANIFEST_DOMAIN_V2, PROOF_PROTOCOL_VERSION, PROOF_PROTOCOL_VERSION_V2, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, PROTOCOL_V5_NOTICE, PROTOCOL_V6_NOTICE, RC020_RC1_HOST_PACKAGES, RC020_RC2_HOST_PACKAGES, RC021_RC2_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, STOP_PROTOCOL_VERSION_V2, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, SessionApiError, V6_ORDINARY_COMPLETION_RULE, V6_ORDINARY_COMPLETION_RULE_COMPACT, V6_ORDINARY_COMPLETION_RULE_SHORT, __activationBindingInternals, acquireHostTrust, actionCompatible, actionHasCertificationPath, actionVerbMatches, activationBindingPath, activationCanonical, activationDigest, activationJson, activationSelectionPending, activeRendererModule, admissibleForRemoval, adoptActivationReceipt, apply, applyUpgradeEligibility, assessmentAction, assessmentOutcomePredicate, auditDesktopInstalledImplementation, auditedDefaultWorkdirHost, auditedDefaultWorkdirProvider, auditedForegroundRenderers, auditedHostImplementation, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindProofV2ToProjection, bindingIndividuallyAccepted, bindingSatisfies, boundedArtifactChoiceMatches, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, capabilityConsequence, capabilityFactOf, capabilityRemedyPhrase, captureClause, captureItem, carriesCleanupCondition, certifyCheckpoint, claimedBatchHasRealRootInput, clarifiedSpanOf, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, clauseAsksOwnQuestion, clauseIsGoverned, clauseIsProtected, cleanupConditionFor, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createActivationMigrationReceipt, createActivationSelection, createGitPrestateEnvelope, createProjection, createProofManifest, createProofManifestV2, currentActionBases, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, environmentDefaultRepositoryTarget, evaluateActiveHostLock, evaluateConfiguredHostLock, evaluateExternalWaitCapability, evaluateGraphDerivedHostLock, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, explanationHasActionResidue, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, firstStepGuidance, firstStepGuidanceV6, gitCommandMatchesTarget, goalCompletionDenial, governedClauseRestrictsExecution, hasCurrentCertificate, hasDesktopImporterState, hasOrderedCoordination, hasQuestionScope, hasWorkPredicate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostTrustDigest, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectActivationInventory, inspectDesktopTargetGraph, inspectTargetHostGraph, interpretClause, interpretMessage, introducesActionClause, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isExplanationScope, isFrozenV042RebindResponse, isInformationalFragment, isInformationalMessage, isOpenObligation, isQuestionScopeNeedingReview, isRestatement, isRootPauseRequest, isRunExecutable, isSelectedActivationReceipt, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, itemHoldsExecutionAuthority, kindOfScope, latestAssistantText, latestRootInstruction, legacyQuestionReadingIsInformational, legacyRecordsNeedingReview, lifecyclePhase, maskCodeSpans, maskQuotedSpans, memoizedAsarFile, memoizedAsarIndex, name, namedActions, nativeFileTwoRole, nativeGitParentOidVerified, normalizeClause, observeAssistantOutcome, openItems, opensConditionLead, opensWithDirective, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostTrust, parseHostVersion, parsePwshCommand, parseShellCommand, partialFailureOf, persistedToolResultStatus, prepareActivationMigration, prepareActiveHostTrust, prepareDesktopHostTrust, prepareSelectedActivationMigration, prepareTargetHostTrust, presentExplanationHead, previewFirstStepInjection, privateStorageToolDenial, progressFingerprint, projectCoreV2, projectSessionCoreV2, proofCapabilityReport, proofDigest, proofDigestV2, proofEvidenceConstraints, proofHostSurfacesOf, proofOperationMatches, proofV2Rejection, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualificationOfClause, qualifyBoundary, qualifyHostTrust, questionHeadsClause, readActivationBinding, readActivationMigrationReceipt, readActiveHostGraph, readAsarFile, readAsarIndex, readDesktopAppRuntime, readDesktopDependency, readDesktopTargetGraph, rebindAttemptKey, rebindResponse, recoveryDigest, recoveryTitle, registryArchiveFiles, registryArchiveModules, relevantEvidence, removalIsComplete, removalIsPartiallyKnown, renderRecoveryPacket, replayRawV2, replayRebindResult, reportingHeadGoverns, requestedIdentityKey, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, requiredSubjectsOf, resolveActivationBindingsRoot, resolveActiveProfileHostLock, resolveDesktopProfileHostLock, resolveInstalledHostLock, resolveSessionActivation, restatedContentOf, revalidateDesktopCoreLock, revalidateGitPrestate, rootLocatorFlavor, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, scanActivationInventory, scopeCoverageDigest, segmentAuthorityBlocks, segmentClauses, selectHostCohort, selectedActivationInventory, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionBirthIdentity, sessionQuery, sessionQueryV2, sha256, shellReadbackOutcome, snapshotSessionEvents, splitTextFragments, statefulActionsOfScope, supersedeItem, testOutcomePredicate, v6CurrentRootBoundaries, v6TestPredicate, validateActionManifest, validateActionTarget, validateActivationBinding, validateActivationInventorySnapshot, validateActivationMigrationReceipt, validateActivationSelection, validateManifest, validateProofManifest, validateProofManifestV2, verbIsNegated, verifiedLinearCommitReadback, verifyComposedHostLockDump, verifyMigrationInventory, verifySelectedMigrationInventory, withDurability, writeActivationBinding, writeDesktopRuntimeReceipt };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, BASE_HOST_PACKAGES, BOUNDARY_RECORD_PREFIX, BOUNDED_ARTIFACT_TYPES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, CERTIFICATE_VERSION_V2, CLEANUP_CONDITION_RULE, CLEANUP_CONDITION_RULE_COMPACT, CLEANUP_CONDITION_RULE_SHORT, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_DELEGATION_TOOL_NAMES, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DEPENDENCY_FREE_ONLY_CONDITION, DESKTOP_IDENTITY_FACTS, DESKTOP_PROFILE_PACKAGE_NAME, DESKTOP_RUNTIME_PACKAGE_NAME, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GRANTED_QUALIFICATION, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HOST_VALIDATED_VERSIONS, HostProfileError, HostTrustError, LATEST_TESTED_HOST_VERSION, LEGACY_QUALIFICATION, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NATIVE_GIT_ROOT_PARENT_OID, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_CAPABILITY_MATRIX, PROOF_KINDS, PROOF_KINDS_V2, PROOF_MANIFEST_DOMAIN_V2, PROOF_PROTOCOL_VERSION, PROOF_PROTOCOL_VERSION_V2, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, PROTOCOL_V5_NOTICE, PROTOCOL_V6_NOTICE, RC020_RC1_HOST_PACKAGES, RC020_RC2_HOST_PACKAGES, RC021_RC2_HOST_PACKAGES, RC021_RC3_HOST_PACKAGES, RC021_RC5_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, STOP_PROTOCOL_VERSION_V2, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, SessionApiError, V6_ORDINARY_COMPLETION_RULE, V6_ORDINARY_COMPLETION_RULE_COMPACT, V6_ORDINARY_COMPLETION_RULE_SHORT, __activationBindingInternals, acquireHostTrust, actionCompatible, actionHasCertificationPath, actionVerbMatches, activationBindingPath, activationCanonical, activationDigest, activationJson, activationSelectionPending, activeRendererModule, admissibleForRemoval, adoptActivationReceipt, apply, applyUpgradeEligibility, assertActivationBackendIdentity, assertActivationPhysicalRows, assessmentAction, assessmentOutcomePredicate, auditDesktopInstalledImplementation, auditedDefaultWorkdirHost, auditedDefaultWorkdirProvider, auditedForegroundRenderers, auditedHostImplementation, authorityCaptureCounts, availableBoundaryQualifications, bindActivationInventoryPhysical, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindProofV2ToProjection, bindingIndividuallyAccepted, bindingSatisfies, boundedArtifactChoiceMatches, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, capabilityConsequence, capabilityFactOf, capabilityRemedyPhrase, captureActivationPhysicalInventory, captureClause, captureItem, carriesCleanupCondition, certifyCheckpoint, claimedBatchHasRealRootInput, clarifiedSpanOf, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, clauseAsksOwnQuestion, clauseIsGoverned, clauseIsProtected, cleanupConditionFor, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createActivationMigrationReceipt, createActivationSelection, createGitPrestateEnvelope, createProjection, createProofManifest, createProofManifestV2, currentActionBases, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, environmentDefaultRepositoryTarget, evaluateActiveHostLock, evaluateConfiguredHostLock, evaluateExternalWaitCapability, evaluateGraphDerivedHostLock, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, explanationHasActionResidue, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, firstStepGuidance, firstStepGuidanceV6, gitCommandMatchesTarget, goalCompletionDenial, governedClauseRestrictsExecution, guardActivationInventory, hasCurrentCertificate, hasDesktopImporterState, hasOrderedCoordination, hasQuestionScope, hasWorkPredicate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostTrustDigest, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectActivationInventory, inspectDesktopTargetGraph, inspectTargetHostGraph, interpretClause, interpretMessage, introducesActionClause, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isExplanationScope, isFrozenV042RebindResponse, isInformationalFragment, isInformationalMessage, isOpenObligation, isQuestionScopeNeedingReview, isRestatement, isRootPauseRequest, isRunExecutable, isSelectedActivationReceipt, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, itemHoldsExecutionAuthority, kindOfScope, latestAssistantText, latestRootInstruction, legacyQuestionReadingIsInformational, legacyRecordsNeedingReview, lifecyclePhase, maskCodeSpans, maskQuotedSpans, memoizedAsarFile, memoizedAsarIndex, name, namedActions, nativeFileTwoRole, nativeGitParentOidVerified, normalizeClause, observeAssistantOutcome, openItems, opensConditionLead, opensWithDirective, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostTrust, parseHostVersion, parsePwshCommand, parseShellCommand, partialFailureOf, persistedToolResultStatus, prepareActivationMigration, prepareActiveHostTrust, prepareDesktopHostTrust, prepareSelectedActivationMigration, prepareTargetHostTrust, presentExplanationHead, previewFirstStepInjection, privateStorageToolDenial, progressFingerprint, projectCoreV2, projectSessionCoreV2, proofCapabilityReport, proofDigest, proofDigestV2, proofEvidenceConstraints, proofHostSurfacesOf, proofOperationMatches, proofV2Rejection, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualificationOfClause, qualifyBoundary, qualifyHostTrust, questionHeadsClause, readActivationBinding, readActivationMigrationReceipt, readActiveHostGraph, readAsarFile, readAsarIndex, readDesktopAppRuntime, readDesktopDependency, readDesktopTargetGraph, rebindAttemptKey, rebindResponse, recoveryDigest, recoveryTitle, registryArchiveFiles, registryArchiveModules, relevantEvidence, removalIsComplete, removalIsPartiallyKnown, renderRecoveryPacket, replayRawV2, replayRebindResult, reportingHeadGoverns, requestedIdentityKey, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, requiredSubjectsOf, resolveActivationBindingsRoot, resolveActivationPersistencePlugin, resolveActiveProfileHostLock, resolveDesktopProfileHostLock, resolveInstalledHostLock, resolveSessionActivation, restatedContentOf, revalidateDesktopCoreLock, revalidateGitPrestate, rootLocatorFlavor, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, scanActivationInventory, scopeCoverageDigest, segmentAuthorityBlocks, segmentClauses, selectHostCohort, selectedActivationInventory, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionBirthIdentity, sessionQuery, sessionQueryV2, sha256, shellReadbackOutcome, snapshotSessionEvents, splitTextFragments, statefulActionsOfScope, stripUrlCredentials, supersedeItem, testOutcomePredicate, v6CurrentRootBoundaries, v6TestPredicate, validateActionManifest, validateActionTarget, validateActivationBinding, validateActivationInventorySnapshot, validateActivationMigrationReceipt, validateActivationSelection, validateManifest, validateProofManifest, validateProofManifestV2, verbIsNegated, verifiedLinearCommitReadback, verifyComposedHostLockDump, verifyMigrationInventory, verifySelectedMigrationInventory, withDurability, writeActivationBinding, writeDesktopRuntimeReceipt };