dsh-completion-guard 0.4.2 → 0.4.3

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as resolveInstalledHostLock, $n as DeriveResult, $t as HostCapabilityEvaluation, A as createProofManifest, An as ClassifiedClause, Ar as ActionManifest, At as hasCurrentCertificate, B as COMMAND_SURFACE_MANIFEST, Bn as BoundaryEffectuation, Br as isStatefulAction, Bt as PROTOCOL_V3_NOTICE, C as ProofKind, Cn as segmentAuthorityBlocks, Cr as TargetValue, Ct as ParsedShell, D as SessionQuery, Dn as RejectedBinding, Dr as PackageRow, Dt as parsePwshCommand, E as ProofSurface, En as CheckpointResult, Er as createProjection, Et as isRunExecutable, F as EvidenceFacetCoverage, Fn as extractArtifactPaths, Fr as STOP_PROTOCOL_VERSION, Ft as extractTextContent, G as ActiveProfileHostLock, Gn as availableBoundaryQualifications, Gr as validateActionManifest, Gt as BASE_HOST_PACKAGES, H as ManifestIssue, Hn as BoundaryRequest, Hr as requestedTargetMatchesResolved, Ht as ALPHA2_DSHMARKET_139_HOST_PACKAGES, I as bindingSatisfies, In as extractMethod, Ir as SUPPORTED_EVIDENCE_ADAPTERS, It as extractToolSubject, J as hostLockRowsFromComposedDump, Jn as qualifyBoundary, Jr as digestStrings, Jt as ExecutableIdentity, K as HostProfileError, Kn as effectuateBoundary, Kr as validateActionTarget, Kt as DEFAULT_HOST_LOCK, L as evidenceCoverage, Ln as extractOperation, Lr as SemanticAction, Lt as isDeterministicCheck, M as proofEvidenceConstraints, Mn as captureClause, Mr as CERTIFICATE_VERSION, Mt as ToolResultInput, N as sessionQuery, Nn as captureItem, Nr as SEMANTIC_ACTIONS, Nt as ToolSubject, O as bindProofToProjection, On as certifyCheckpoint, Or as ACTION_MANIFEST, Ot as parseShellCommand, P as validateProofManifest, Pn as classifyClause, Pr as STATEFUL_ACTIONS, Pt as evidenceFromPersistedToolResult, Q as resolveActiveProfileHostLock, Qn as DeriveConfig, Qr as sha256, Qt as HOST_COHORTS, R as evidenceMatchesItem, Rn as isInformationalMessage, Rr as StatefulAction, Rt as withDurability, S as PROOF_PROTOCOL_VERSION, Sn as authorityCaptureCounts, Sr as TargetTuple, St as CanonicalCommandSurface, T as ProofObligation, Tn as classifyUserInteraction, Tr as WaitAuthorization, Tt as canonicalArgvFromCommand, U as OperationVerbEntry, Un as GoalActivationState, Ur as semanticActionFromCommand, Ut as ALPHA2_HOST_PACKAGES, V as CommandSurfaceManifest, Vn as BoundaryQualification, Vr as requestedTargetAuthorizesMutation, Vt as deriveProjection, W as validateManifest, Wn as GoalBoundaryAccess, Wr as semanticActionFromText, Wt as AuditedExecutable, X as packageRowsFromActiveGraph, Xn as BoundaryQualificationKind, Xr as sanitizeClauseText, Xt as GOAL_HOST_PACKAGES, Y as injectActiveProfileHostLock, Yn as BoundaryDisposition, Yr as normalizeClause, Yt as ExecutableIdentityBinding, Z as packageRowsFromPnpmLock, Zn as DeferAuthorization, Zr as sanitizeUrl, Zt as HOST_CAPABILITY_PACKAGE_GROUPS, _ as openItems, _n as selectHostCohort, _r as GuardProjection, _t as gitCommandMatchesTarget, a as classifyCompletionClaim, an as HostLockContext, ar as EvidenceRole, at as GitCommandParseResult, b as ALPHA3_HOST_PACKAGES, bn as AuthorityBlockKind, br as TargetCaptureReasonCode, bt as verifiedLinearCommitReadback, c as isWholeTaskCompletionClaim, cn as HostPlatform, cr as GoalRef, ct as GitEffectRunner, d as snapshotSessionEvents, dn as bindExecutableIdentity, dr as GuardEvidence, dt as GitTargetIdentity, en as HostCapabilityId, er as DeriveScope, et as verifyComposedHostLockDump, f as RC1_HOST_PACKAGES, fn as bindLiveGoalCapability, fr as GuardIntegrity, ft as LinearCommitReadback, g as closingHint, gn as evaluateToolSurfaceCapability, gr as GuardOperation, gt as executeRevalidatedGitEffect, h as RecoveryOptions, hn as evaluateHostLock, hr as GuardItemStatus, ht as createGitPrestateEnvelope, i as TurnStoppingDecision, in as HostCohortSelectionReason, ir as EvidenceParseStatus, it as GitCommandManifest, j as proofDigest, jn as ClauseSegment, jr as ActionSpec, jt as ToolCallInput, k as canonicalProjection, kn as CaptureScope, kr as ACTION_MANIFEST_VERSION, kt as goalCompletionDenial, l as latestAssistantText, ln as HostProfileKind, lr as GuardBoundary, lt as GitPrestateCheck, m as MIN_RECOVERY_CHAR_BUDGET, mn as evaluateHostCapability, mr as GuardItemKind, mt as commitTreeSnapshotDigest, n as AssistantOutcomeObservation, nn as HostCohort, nr as EvidenceBinding, nt as GitAdapterAction, o as decideTurnBoundary, on as HostLockEvaluation, or as ExpectedTransition, ot as GitCommandRejected, p as DEFAULT_RECOVERY_CHAR_BUDGET, pn as evaluateExternalWaitCapability, pr as GuardItem, pt as commitIndexSnapshotDigest, q as hostLockContextFromComposedDump, qn as isCurrentAcceptedBoundary, qr as canonicalizePath, qt as EXPECTED_HOST_PACKAGES, r as CompletionDisposition, rn as HostCohortSelection, rr as EvidenceOutcome, rt as GitCommandAccepted, s as decideTurnStopping, sn as HostLockStatus, sr as ExternalOperation, st as GitEffectExecution, t as supersedeItem, tn as HostCapabilityRequest, tr as DerivedEnvelope, tt as GIT_COMMAND_MANIFEST_IDS, u as observeAssistantOutcome, un as HostToolSurface, ur as GuardCheckpoint, ut as GitPrestateEnvelope, v as recoveryDigest, vn as currentContractDigest, vr as HostStatus, vt as parseGitCommandManifest, w as ProofManifest, wn as UserInteractionKind, wr as VerificationContract, wt as ShellParseStatus, x as PROOF_KINDS, xn as AuthorityKind, xr as TargetCaptureStatus, xt as CanonicalArgv, y as renderRecoveryPacket, yn as AuthorityBlock, yr as PersistenceAuthorization, yt as revalidateGitPrestate, z as isVerifyingCapability, zn as segmentClauses, zr as actionCompatible, zt as CAPTURE_V042_NOTICE } from "./index-DNF0OTi-.js";
+import { $ as packageRowsFromPnpmLock, $n as BoundaryDisposition, $r as normalizeClause, $t as GOAL_HOST_PACKAGES, A as createProofManifest, An as CheckpointResult, Ar as createProjection, At as parsePwshCommand, B as COMMAND_SURFACE_MANIFEST, Bn as extractMethod, Br as SUPPORTED_EVIDENCE_ADAPTERS, Bt as isDeterministicCheck, C as ProofKind, Cn as AuthorityBlock, Cr as PersistenceAuthorization, Ct as verifiedLinearCommitReadback, D as SessionQuery, Dn as segmentAuthorityBlocks, Dr as TargetValue, Dt as ShellParseStatus, E as ProofSurface, En as authorityCaptureCounts, Er as TargetTuple, Et as ParsedShell, F as EvidenceFacetCoverage, Fn as ClauseSegment, Fr as ActionSpec, Ft as ToolResultInput, G as ActiveProfileHostLock, Gn as BoundaryQualification, Gr as requestedTargetAuthorizesMutation, Gt as ALPHA2_DSHMARKET_139_HOST_PACKAGES, H as ManifestIssue, Hn as isInformationalMessage, Hr as StatefulAction, Ht as CAPTURE_V042_NOTICE, I as bindingSatisfies, In as captureClause, Ir as CERTIFICATE_VERSION, It as ToolSubject, J as hostLockContextFromComposedDump, Jn as GoalBoundaryAccess, Jr as semanticActionFromText, Jt as BASE_HOST_PACKAGES, K as HostProfileError, Kn as BoundaryRequest, Kr as requestedTargetMatchesResolved, Kt as ALPHA2_HOST_PACKAGES, L as evidenceCoverage, Ln as captureItem, Lr as SEMANTIC_ACTIONS, Lt as evidenceFromPersistedToolResult, M as proofEvidenceConstraints, Mn as certifyCheckpoint, Mr as ACTION_MANIFEST, Mt as goalCompletionDenial, N as sessionQuery, Nn as CaptureScope, Nr as ACTION_MANIFEST_VERSION, Nt as hasCurrentCertificate, O as bindProofToProjection, On as UserInteractionKind, Or as VerificationContract, Ot as canonicalArgvFromCommand, P as validateProofManifest, Pn as ClassifiedClause, Pr as ActionManifest, Pt as ToolCallInput, Q as packageRowsFromActiveGraph, Qn as qualifyBoundary, Qr as digestStrings, Qt as ExecutableIdentityBinding, R as evidenceMatchesItem, Rn as classifyClause, Rr as STATEFUL_ACTIONS, Rt as extractTextContent, S as PROOF_PROTOCOL_VERSION, Sn as currentContractDigest, Sr as HostStatus, St as revalidateGitPrestate, T as ProofObligation, Tn as AuthorityKind, Tr as TargetCaptureStatus, Tt as CanonicalCommandSurface, U as OperationVerbEntry, Un as segmentClauses, Ur as actionCompatible, Ut as PROTOCOL_V3_NOTICE, V as CommandSurfaceManifest, Vn as extractOperation, Vr as SemanticAction, Vt as withDurability, W as validateManifest, Wn as BoundaryEffectuation, Wr as isStatefulAction, Wt as deriveProjection, X as injectActiveProfileHostLock, Xn as effectuateBoundary, Xr as validateActionTarget, Xt as EXPECTED_HOST_PACKAGES, Y as hostLockRowsFromComposedDump, Yn as availableBoundaryQualifications, Yr as validateActionManifest, Yt as DEFAULT_HOST_LOCK, Z as inspectTargetHostGraph, Zn as isCurrentAcceptedBoundary, Zr as canonicalizePath, Zt as ExecutableIdentity, _ as openItems, _n as evaluateExternalWaitCapability, _r as GuardItem, _t as commitTreeSnapshotDigest, a as classifyCompletionClaim, an as HostCohort, ar as DerivedEnvelope, at as GitAdapterAction, b as ALPHA3_HOST_PACKAGES, bn as evaluateToolSurfaceCapability, br as GuardOperation, bt as gitCommandMatchesTarget, c as isWholeTaskCompletionClaim, cn as HostLockContext, cr as EvidenceParseStatus, ct as GitCommandParseResult, d as snapshotSessionEvents, dn as HostPlatform, dr as ExternalOperation, dt as GitEffectRunner, ei as sanitizeClauseText, en as HOST_CAPABILITY_PACKAGE_GROUPS, er as BoundaryQualificationKind, et as readActiveHostGraph, f as RC1_HOST_PACKAGES, fn as HostProfileKind, fr as GoalRef, ft as GitPrestateCheck, g as closingHint, gn as bindLiveGoalCapability, gr as GuardIntegrity, gt as commitIndexSnapshotDigest, h as RecoveryOptions, hn as bindExecutableIdentity, hr as GuardEvidence, ht as LinearCommitReadback, i as TurnStoppingDecision, in as HostCapabilityRequest, ir as DeriveScope, it as GIT_COMMAND_MANIFEST_IDS, j as proofDigest, jn as RejectedBinding, jr as PackageRow, jt as parseShellCommand, k as canonicalProjection, kn as classifyUserInteraction, kr as WaitAuthorization, kt as isRunExecutable, l as latestAssistantText, ln as HostLockEvaluation, lr as EvidenceRole, lt as GitCommandRejected, m as MIN_RECOVERY_CHAR_BUDGET, mn as LEGACY_HOST_COHORTS, mr as GuardCheckpoint, mt as GitTargetIdentity, n as AssistantOutcomeObservation, ni as sha256, nn as HostCapabilityEvaluation, nr as DeriveConfig, nt as resolveInstalledHostLock, o as decideTurnBoundary, on as HostCohortSelection, or as EvidenceBinding, ot as GitCommandAccepted, p as DEFAULT_RECOVERY_CHAR_BUDGET, pn as HostToolSurface, pr as GuardBoundary, pt as GitPrestateEnvelope, q as TargetHostGraph, qn as GoalActivationState, qr as semanticActionFromCommand, qt as AuditedExecutable, r as CompletionDisposition, rn as HostCapabilityId, rr as DeriveResult, rt as verifyComposedHostLockDump, s as decideTurnStopping, sn as HostCohortSelectionReason, sr as EvidenceOutcome, st as GitCommandManifest, t as supersedeItem, ti as sanitizeUrl, tn as HOST_COHORTS, tr as DeferAuthorization, tt as resolveActiveProfileHostLock, u as observeAssistantOutcome, un as HostLockStatus, ur as ExpectedTransition, ut as GitEffectExecution, v as recoveryDigest, vn as evaluateHostCapability, vr as GuardItemKind, vt as createGitPrestateEnvelope, w as ProofManifest, wn as AuthorityBlockKind, wr as TargetCaptureReasonCode, wt as CanonicalArgv, x as PROOF_KINDS, xn as selectHostCohort, xr as GuardProjection, xt as parseGitCommandManifest, y as renderRecoveryPacket, yn as evaluateHostLock, yr as GuardItemStatus, yt as executeRevalidatedGitEffect, z as isVerifyingCapability, zn as extractArtifactPaths, zr as STOP_PROTOCOL_VERSION, zt as extractToolSubject } from "./index-BZYtgqlu.js";
 import "@deepseek-ai/dsh-tools";
 import { Context } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
@@ -9,6 +9,9 @@ declare const Config: z<{
   hostLockPackages?: PackageRow[];
   hostLockPlatform?: HostPlatform;
   hostLockProfile?: HostProfileKind;
+  hostLockPolicy?: string;
+  hostLockRuntimeRoot?: string;
+  hostLockProfileRoot?: string;
 }>;
 //#endregion
 //#region src/runtime.d.ts
@@ -19,6 +22,9 @@ declare function apply(ctx: Context, rawConfig?: {
   hostLockPackages?: unknown;
   hostLockPlatform?: unknown;
   hostLockProfile?: unknown;
+  hostLockPolicy?: unknown;
+  hostLockRuntimeRoot?: unknown;
+  hostLockProfileRoot?: unknown;
 }): void;
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityKind, BASE_HOST_PACKAGES, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CheckpointResult, ClassifiedClause, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, ExpectedTransition, ExternalOperation, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, LinearCommitReadback, MIN_RECOVERY_CHAR_BUDGET, ManifestIssue, OperationVerbEntry, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, ParsedShell, PersistenceAuthorization, ProofKind, ProofManifest, ProofObligation, ProofSurface, RC1_HOST_PACKAGES, RecoveryOptions, RejectedBinding, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SemanticAction, SessionQuery, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetTuple, TargetValue, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UserInteractionKind, VerificationContract, WaitAuthorization, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, proofDigest, proofEvidenceConstraints, qualifyBoundary, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sessionQuery, sha256, snapshotSessionEvents, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityKind, BASE_HOST_PACKAGES, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CheckpointResult, ClassifiedClause, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, ExpectedTransition, ExternalOperation, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, LEGACY_HOST_COHORTS, LinearCommitReadback, MIN_RECOVERY_CHAR_BUDGET, ManifestIssue, OperationVerbEntry, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, ParsedShell, PersistenceAuthorization, ProofKind, ProofManifest, ProofObligation, ProofSurface, RC1_HOST_PACKAGES, RecoveryOptions, RejectedBinding, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SemanticAction, SessionQuery, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetHostGraph, TargetTuple, TargetValue, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UserInteractionKind, VerificationContract, WaitAuthorization, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, inspectTargetHostGraph, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, proofDigest, proofEvidenceConstraints, qualifyBoundary, readActiveHostGraph, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sessionQuery, sha256, snapshotSessionEvents, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as DEFAULT_HOST_LOCK, $t as SUPPORTED_EVIDENCE_ADAPTERS, A as decideTurnBoundary, At as bindingSatisfies, B as extractTextContent, Bt as extractArtifactPaths, C as createGitPrestateEnvelope, Ct as closingHint, D as revalidateGitPrestate, Dt as evidenceAvailabilityReason, E as parseGitCommandManifest, Et as renderRecoveryPacket, F as CAPTURE_V042_NOTICE, Ft as createProjection, G as isRunExecutable, Gt as canonicalRegistryBase, H as isDeterministicCheck, Ht as extractOperation, I as PROTOCOL_V3_NOTICE, It as rebindResponse, J as goalCompletionDenial, Jt as ACTION_MANIFEST_VERSION, K as parsePwshCommand, Kt as npmEscapedPackageName, L as deriveProjection, Lt as captureClause, M as isWholeTaskCompletionClaim, Mt as evidenceMatchesItem, N as latestAssistantText, Nt as isVerifyingCapability, O as verifiedLinearCommitReadback, Ot as itemDiagnosis, P as observeAssistantOutcome, Pt as currentContractDigest, Q as BASE_HOST_PACKAGES, Qt as STOP_PROTOCOL_VERSION, R as supersedeItem, Rt as captureItem, S as commitTreeSnapshotDigest, St as MIN_RECOVERY_CHAR_BUDGET, T as gitCommandMatchesTarget, Tt as recoveryDigest, U as withDurability, Ut as isInformationalMessage, V as extractToolSubject, Vt as extractMethod, W as canonicalArgvFromCommand, Wt as segmentClauses, X as ALPHA2_DSHMARKET_139_HOST_PACKAGES, Xt as SEMANTIC_ACTIONS, Y as hasCurrentCertificate, Yt as CERTIFICATE_VERSION, Z as ALPHA2_HOST_PACKAGES, Zt as STATEFUL_ACTIONS, _ as resolveInstalledHostLock, _t as effectuateBoundary, a as createProofManifest, an as semanticActionFromText, at as bindLiveGoalCapability, b as GIT_COMMAND_MANIFEST_IDS, bt as certifyCheckpoint, c as sessionQuery, cn as COMMAND_SURFACE_MANIFEST, ct as evaluateHostLock, d as hostLockContextFromComposedDump, dn as digestStrings, dt as RC1_HOST_PACKAGES, en as actionCompatible, et as EXPECTED_HOST_PACKAGES, f as hostLockRowsFromComposedDump, fn as normalizeClause, ft as ALPHA3_HOST_PACKAGES, g as resolveActiveProfileHostLock, gt as availableBoundaryQualifications, h as packageRowsFromPnpmLock, hn as sha256, ht as classifyUserInteraction, i as canonicalProjection, in as semanticActionFromCommand, it as bindExecutableIdentity, j as decideTurnStopping, jt as evidenceCoverage, k as classifyCompletionClaim, kt as relevantEvidence, l as validateProofManifest, ln as validateManifest, lt as evaluateToolSurfaceCapability, m as packageRowsFromActiveGraph, mn as sanitizeUrl, mt as segmentAuthorityBlocks, n as PROOF_PROTOCOL_VERSION, nn as requestedTargetAuthorizesMutation, nt as HOST_CAPABILITY_PACKAGE_GROUPS, o as proofDigest, on as validateActionManifest, ot as evaluateExternalWaitCapability, p as injectActiveProfileHostLock, pn as sanitizeClauseText, pt as authorityCaptureCounts, q as parseShellCommand, qt as ACTION_MANIFEST, r as bindProofToProjection, rn as requestedTargetMatchesResolved, rt as HOST_COHORTS, s as proofEvidenceConstraints, sn as validateActionTarget, st as evaluateHostCapability, t as PROOF_KINDS, tn as isStatefulAction, tt as GOAL_HOST_PACKAGES, u as HostProfileError, un as canonicalizePath, ut as selectHostCohort, v as verifyComposedHostLockDump, vt as isCurrentAcceptedBoundary, w as executeRevalidatedGitEffect, wt as openItems, x as commitIndexSnapshotDigest, xt as DEFAULT_RECOVERY_CHAR_BUDGET, y as snapshotSessionEvents, yt as qualifyBoundary, z as evidenceFromPersistedToolResult, zt as classifyClause } from "./domain-BXB_BPQg.js";
+import { $ as ALPHA2_HOST_PACKAGES, $t as SEMANTIC_ACTIONS, A as verifiedLinearCommitReadback, At as evidenceAvailabilityReason, B as supersedeItem, Bt as captureClause, C as commitIndexSnapshotDigest, Ct as certifyCheckpoint, D as gitCommandMatchesTarget, Dt as openItems, E as executeRevalidatedGitEffect, Et as closingHint, F as latestAssistantText, Ft as evidenceMatchesItem, G as withDurability, Gt as extractOperation, H as extractTextContent, Ht as classifyClause, I as observeAssistantOutcome, It as isVerifyingCapability, J as parsePwshCommand, Jt as canonicalRegistryBase, K as canonicalArgvFromCommand, Kt as isInformationalMessage, L as CAPTURE_V042_NOTICE, Lt as currentContractDigest, M as decideTurnBoundary, Mt as relevantEvidence, N as decideTurnStopping, Nt as bindingSatisfies, O as parseGitCommandManifest, Ot as recoveryDigest, P as isWholeTaskCompletionClaim, Pt as evidenceCoverage, Q as ALPHA2_DSHMARKET_139_HOST_PACKAGES, Qt as CERTIFICATE_VERSION, R as PROTOCOL_V3_NOTICE, Rt as createProjection, S as GIT_COMMAND_MANIFEST_IDS, St as qualifyBoundary, T as createGitPrestateEnvelope, Tt as MIN_RECOVERY_CHAR_BUDGET, U as extractToolSubject, Ut as extractArtifactPaths, V as evidenceFromPersistedToolResult, Vt as captureItem, W as isDeterministicCheck, Wt as extractMethod, X as goalCompletionDenial, Xt as ACTION_MANIFEST, Y as parseShellCommand, Yt as npmEscapedPackageName, Z as hasCurrentCertificate, Zt as ACTION_MANIFEST_VERSION, _ as readActiveHostGraph, _n as sanitizeUrl, _t as segmentAuthorityBlocks, a as createProofManifest, an as requestedTargetAuthorizesMutation, at as HOST_COHORTS, b as verifyComposedHostLockDump, bt as effectuateBoundary, c as sessionQuery, cn as semanticActionFromText, ct as bindLiveGoalCapability, d as hostLockContextFromComposedDump, dn as COMMAND_SURFACE_MANIFEST, dt as evaluateHostLock, en as STATEFUL_ACTIONS, et as BASE_HOST_PACKAGES, f as hostLockRowsFromComposedDump, fn as validateManifest, ft as evaluateToolSurfaceCapability, g as packageRowsFromPnpmLock, gn as sanitizeClauseText, gt as authorityCaptureCounts, h as packageRowsFromActiveGraph, hn as normalizeClause, ht as ALPHA3_HOST_PACKAGES, i as canonicalProjection, in as isStatefulAction, it as HOST_CAPABILITY_PACKAGE_GROUPS, j as classifyCompletionClaim, jt as itemDiagnosis, k as revalidateGitPrestate, kt as renderRecoveryPacket, l as validateProofManifest, ln as validateActionManifest, lt as evaluateExternalWaitCapability, m as inspectTargetHostGraph, mn as digestStrings, mt as RC1_HOST_PACKAGES, n as PROOF_PROTOCOL_VERSION, nn as SUPPORTED_EVIDENCE_ADAPTERS, nt as EXPECTED_HOST_PACKAGES, o as proofDigest, on as requestedTargetMatchesResolved, ot as LEGACY_HOST_COHORTS, p as injectActiveProfileHostLock, pn as canonicalizePath, pt as selectHostCohort, q as isRunExecutable, qt as segmentClauses, r as bindProofToProjection, rn as actionCompatible, rt as GOAL_HOST_PACKAGES, s as proofEvidenceConstraints, sn as semanticActionFromCommand, st as bindExecutableIdentity, t as PROOF_KINDS, tn as STOP_PROTOCOL_VERSION, tt as DEFAULT_HOST_LOCK, u as HostProfileError, un as validateActionTarget, ut as evaluateHostCapability, v as resolveActiveProfileHostLock, vn as sha256, vt as classifyUserInteraction, w as commitTreeSnapshotDigest, wt as DEFAULT_RECOVERY_CHAR_BUDGET, x as snapshotSessionEvents, xt as isCurrentAcceptedBoundary, y as resolveInstalledHostLock, yt as availableBoundaryQualifications, z as deriveProjection, zt as rebindResponse } from "./domain-DebMrpyX.js";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { createHash } from "node:crypto";
 import { basename, delimiter, dirname, isAbsolute, join, resolve } from "node:path";
@@ -900,7 +900,7 @@ function tuple(value) {
 function adapterId(action) {
 	if (["create", "modify"].includes(action)) return "context-guard.artifact.v1";
 	if (["install", "apply"].includes(action)) return "context-guard.package.v1";
-	if (action === "restart") return "context-guard.service.v1";
+	if (action === "restart") return "context-guard.service.v2";
 	if (action === "publish") return "context-guard.registry.v1";
 	return "context-guard.git.v1";
 }
@@ -913,7 +913,7 @@ function unavailable(action, role, reason) {
 		resolved_target: {},
 		observed_state: {},
 		adapter_id: adapterId(action),
-		adapter_version: PRODUCER_VERSION,
+		adapter_version: action === "restart" ? "2.0.0" : PRODUCER_VERSION,
 		target_digest: "",
 		command_manifest_digest: ""
 	};
@@ -927,7 +927,7 @@ function supported(action, role, resolved, observed = {}, commandManifest = {},
 		resolved_target: jsonTuple(resolved),
 		observed_state: jsonTuple(observed),
 		adapter_id: adapterId(action),
-		adapter_version: PRODUCER_VERSION,
+		adapter_version: action === "restart" ? "2.0.0" : PRODUCER_VERSION,
 		target_digest: digest(resolved),
 		command_manifest_digest: digest(commandManifest),
 		...gitBinding ? { git_binding: gitBinding } : {},
@@ -972,7 +972,7 @@ function findResolution(events, callId, action) {
 		}
 		if (event.type !== "tool/result") continue;
 		const meta = producerMeta(event);
-		if (meta?.semanticAction !== action || meta.evidenceRole !== "resolution" || meta.adapterVersion !== PRODUCER_VERSION || !selector || !commandManifest) return void 0;
+		if (meta?.semanticAction !== action || meta.evidenceRole !== "resolution" || meta.adapterVersion !== (action === "restart" ? "2.0.0" : PRODUCER_VERSION) || !selector || !commandManifest) return void 0;
 		const target = tuple(meta.resolvedTarget);
 		const rawBinding = record(meta.gitBinding);
 		const rawManifest = record(rawBinding?.manifest);
@@ -1155,13 +1155,13 @@ async function tgzIdentity(path) {
 		integrity: `sha512-${createHash("sha512").update(bytes).digest("base64")}`
 	};
 }
-const DSHMARKET_VERSION = "1.36.0";
-const DSHMARKET_INTEGRITY = "sha512-xX8CCoXdIALaxtLosj+5qGg8r1cykW2zo1AOPJcSQepg2r4Vd2K0NmERldDqfeyFV0pCuZsUoAPe1Q/BW7De/g==";
 const MARKET_SCHEMA = "dsh-market/update-api/v1";
+const MARKET_GENERATION_PREFIX = "dsh-market-instance/v1:";
 async function marketCapabilities(roots, signal) {
-	if (!roots.profile || !roots.marketOrigin) return void 0;
+	if (!roots.profile || !roots.marketOrigin || !roots.verifyMarketInstance) return void 0;
 	const installed = await profilePackage(roots.profile.path, "dshmarket");
-	if (installed?.version !== DSHMARKET_VERSION || installed.integrity !== DSHMARKET_INTEGRITY) return void 0;
+	const binding = await roots.verifyMarketInstance(signal);
+	if (!installed || !binding || binding.origin !== roots.marketOrigin || binding.profile !== roots.profile.name || binding.version !== installed.version || binding.integrity !== installed.integrity || !/^[0-9a-f]{64}$/.test(binding.loadedTreeSha256) || !binding.processIdentity || !binding.bootId) return void 0;
 	const response = await (roots.fetcher ?? fetch)(`${roots.marketOrigin}/dsh-market/api/v1/capabilities`, {
 		signal,
 		headers: { accept: "application/json" },
@@ -1169,8 +1169,32 @@ async function marketCapabilities(roots, signal) {
 	});
 	if (!response.ok) return void 0;
 	const value = record(await response.json());
-	if (value?.schema !== MARKET_SCHEMA || value.apiVersion !== 1 || value.marketVersion !== DSHMARKET_VERSION || value.profile !== roots.profile.name || typeof value.bootId !== "string") return void 0;
-	return value;
+	if (value?.schema !== MARKET_SCHEMA || value.apiVersion !== 1 || value.marketVersion !== binding.version || value.profile !== binding.profile || value.bootId !== binding.bootId) return void 0;
+	const features = record(value.features);
+	const restart = record(value.restart);
+	if (features?.restart !== true || restart?.supported !== true || restart.managedBy !== "market") return void 0;
+	const provider = createHash("sha256").update(JSON.stringify([
+		MARKET_SCHEMA,
+		binding.origin,
+		binding.profile,
+		binding.version,
+		binding.integrity,
+		binding.loadedTreeSha256,
+		"restart",
+		true,
+		"market"
+	])).digest("hex");
+	const instance = createHash("sha256").update(JSON.stringify([binding.processIdentity, binding.bootId])).digest("hex");
+	return {
+		...value,
+		generation: `${MARKET_GENERATION_PREFIX}${provider}:${instance}`
+	};
+}
+function sameMarketProvider(before, after) {
+	const pattern = /^dsh-market-instance\/v1:([0-9a-f]{64}):[0-9a-f]{64}$/;
+	const left = typeof before === "string" ? pattern.exec(before) : null;
+	const right = typeof after === "string" ? pattern.exec(after) : null;
+	return !!left && !!right && left[1] === right[1];
 }
 function importerLocator(text, packageId) {
 	const escaped = packageId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -1200,6 +1224,7 @@ async function profilePackage(profilePath, packageId) {
 	try {
 		const lock = await readFile(resolve(profilePath, "pnpm-lock.yaml"), "utf8");
 		const locator = importerLocator(lock, packageId);
+		if (packageId === "dshmarket" && (!locator || locator.split("(", 1)[0] !== manifest.version)) return void 0;
 		const integrity = locator ? lockIntegrity(lock, packageId, locator) : void 0;
 		return integrity ? {
 			version: manifest.version,
@@ -1354,7 +1379,8 @@ async function executeGuardAction(action, resolution, roots, signal, executableI
 	if (action === "restart") {
 		const capabilities = await marketCapabilities(roots, signal);
 		if (!capabilities || !roots.marketOrigin || !resolutionCallId || !agent) return "unavailable";
-		if (capabilities.bootId !== target.pre_generation) return restartIntent(snapshotSessionEvents(agent.session), resolutionCallId, target) ? "completed" : "unavailable";
+		if (!sameMarketProvider(target.pre_generation, capabilities.generation)) return "unavailable";
+		if (capabilities.generation !== target.pre_generation) return restartIntent(snapshotSessionEvents(agent.session), resolutionCallId, target) ? "completed" : "unavailable";
 		if (restartIntent(snapshotSessionEvents(agent.session), resolutionCallId, target)) return "handoff_pending";
 		if (!roots.persistRestartIntent || !await roots.persistRestartIntent(agent, {
 			resolutionCallId,
@@ -1629,7 +1655,7 @@ async function resolveTarget(action, selector, commandManifest, cwd, roots, sign
 		if (features?.restart !== true || restart?.supported !== true || restart.managedBy !== "market") return void 0;
 		return { target: {
 			service_id: service,
-			pre_generation: String(capabilities?.bootId)
+			pre_generation: String(capabilities?.generation)
 		} };
 	}
 	if (action === "publish") {
@@ -1770,9 +1796,9 @@ async function readback(action, target, roots, signal, executableIdentity$1) {
 	}
 	if (action === "restart") {
 		const capabilities = await marketCapabilities(roots, signal);
-		if (!capabilities || capabilities.bootId === target.pre_generation) return void 0;
+		if (!capabilities || !sameMarketProvider(target.pre_generation, capabilities.generation) || capabilities.generation === target.pre_generation) return void 0;
 		return {
-			new_generation: String(capabilities.bootId),
+			new_generation: String(capabilities.generation),
 			health: "healthy"
 		};
 	}
@@ -1850,6 +1876,7 @@ function normalizedRoots(options) {
 			path: resolve(options.profile.path)
 		} } : detectedProfile ? { profile: detectedProfile } : {},
 		...options.marketOrigin ? { marketOrigin: options.marketOrigin } : {},
+		...options.verifyMarketInstance ? { verifyMarketInstance: options.verifyMarketInstance } : {},
 		...options.fetcher ? { fetcher: options.fetcher } : {},
 		...options.commandRunner ? { commandRunner: options.commandRunner } : {},
 		...options.persistRestartIntent ? { persistRestartIntent: options.persistRestartIntent } : {},
@@ -2258,7 +2285,7 @@ function createEvidenceTool(options = {}) {
 					const executableBinding = executable$1 ? await (roots.readExecutableIdentity ?? executableIdentity)(executable$1, exec.signal) : void 0;
 					if (executable$1 && !executableBinding) return unavailable(action, role, "executable_identity_unavailable");
 					const resolved = await resolveTarget(action, record(args.selector) ?? {}, record(args.command_manifest) ?? {}, cwdOf(agent), roots, exec.signal, executableBinding);
-					if (!resolved) return unavailable(action, role, "resolution_unavailable");
+					if (!resolved) return unavailable(action, role, action === "restart" && !roots.verifyMarketInstance ? "market_instance_binding_unavailable" : "resolution_unavailable");
 					const gitBinding = resolved.gitBinding ? JSON.parse(JSON.stringify(resolved.gitBinding)) : void 0;
 					const commandManifest = record(args.command_manifest) ?? {};
 					const expectedTransition = await expectedTransitionForResolution(action, resolved.target, commandManifest);
@@ -2288,7 +2315,7 @@ function createEvidenceTool(options = {}) {
 				if (ownedEffect) {
 					const events = snapshotSessionEvents(agent.session);
 					const actionCall = actionCallMatches(events, args.effect_call_id, action, args.resolution_call_id, resolution.target);
-					if (!(action === "restart" ? actionCall && restartIntent(events, args.resolution_call_id, resolution.target) && (await marketCapabilities(roots, exec.signal))?.bootId !== resolution.target.pre_generation : actionCall && actionResultCompleted(events, args.effect_call_id))) return unavailable(action, role, "persisted_effect_mismatch");
+					if (!(action === "restart" ? actionCall && restartIntent(events, args.resolution_call_id, resolution.target) && !!await readback("restart", resolution.target, roots, exec.signal) : actionCall && actionResultCompleted(events, args.effect_call_id))) return unavailable(action, role, "persisted_effect_mismatch");
 					if (role === "effect") return supported(action, role, resolution.target, {}, resolution.commandManifest, void 0, currentExecutable);
 				} else {
 					const effect = findEffect(snapshotSessionEvents(agent.session), args.effect_call_id);
@@ -3242,6 +3269,9 @@ const Config = Schema.object({
 	activation: Schema.string().default("opt-in"),
 	hostLockPlatform: Schema.string(),
 	hostLockProfile: Schema.string(),
+	hostLockPolicy: Schema.string(),
+	hostLockRuntimeRoot: Schema.string(),
+	hostLockProfileRoot: Schema.string(),
 	hostLockPackages: Schema.array(Schema.object({
 		name: Schema.string().required(),
 		version: Schema.string(),
@@ -3271,7 +3301,15 @@ function resolveConfig(config) {
 	if (config.hostLockProfile !== void 0 && config.hostLockProfile !== "headless" && config.hostLockProfile !== "web") throw new TypeError("hostLockProfile must be \"headless\" or \"web\"");
 	const hasHostRows = hostLockPackages !== void 0;
 	if (hasHostRows !== (config.hostLockPlatform !== void 0) || hasHostRows !== (config.hostLockProfile !== void 0)) throw new TypeError("hostLockPackages, hostLockPlatform, and hostLockProfile must be injected together");
+	for (const key of [
+		"hostLockPolicy",
+		"hostLockRuntimeRoot",
+		"hostLockProfileRoot"
+	]) if (config[key] !== void 0 && (typeof config[key] !== "string" || !config[key])) throw new TypeError(`${key} must be a non-empty string`);
 	return {
+		...typeof config.hostLockPolicy === "string" ? { hostLockPolicy: config.hostLockPolicy } : {},
+		...typeof config.hostLockRuntimeRoot === "string" ? { hostLockRuntimeRoot: config.hostLockRuntimeRoot } : {},
+		...typeof config.hostLockProfileRoot === "string" ? { hostLockProfileRoot: config.hostLockProfileRoot } : {},
 		activation,
 		...hostLockPackages ? { hostLockPackages } : {},
 		...config.hostLockPlatform ? { hostLockPlatform: config.hostLockPlatform } : {},
@@ -3419,7 +3457,7 @@ function sessionHeaderForDigest(session) {
 		delegationDepth: typeof raw.delegationDepth === "number" ? raw.delegationDepth : 0
 	};
 }
-function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalState) {
+function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalState, refreshHostLock) {
 	const projection = createProjection();
 	const session = agent.session;
 	let pendingRecovery = false;
@@ -3430,6 +3468,7 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 	const continuationAttempts = projection.continuationAttempts;
 	const persistenceCorrectionAttempts = projection.persistenceCorrectionAttempts;
 	const rebuild = () => {
+		if (refreshHostLock) hostLock = refreshHostLock();
 		const header = session.header;
 		const priorRecoveryDigest = projection.lastRecoveryDigest;
 		const derived = deriveProjection(snapshotSessionEvents(session), { activation: config.activation }, {
@@ -3491,6 +3530,36 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 		consumeRecovery
 	};
 }
+/** Never reinterpret a legacy injected snapshot as freshly accepted core/v1. */
+function revalidateCoreLock(config, expected) {
+	if (config.hostLockPolicy !== "dsh-core/v1" || !config.hostLockRuntimeRoot || !config.hostLockProfileRoot) return {
+		...expected,
+		status: "unavailable",
+		goalAvailable: false,
+		reasonCode: "host_lock_migration_required"
+	};
+	try {
+		const actual = evaluateHostLock(readActiveHostGraph(config.hostLockRuntimeRoot, config.hostLockProfileRoot), {
+			platform: config.hostLockPlatform,
+			profileKind: config.hostLockProfile
+		});
+		if (actual.status !== "supported") return actual;
+		if (actual.digest !== expected.digest) return {
+			...actual,
+			status: "unsupported",
+			goalAvailable: false,
+			reasonCode: "host_lock_installed_graph_drift"
+		};
+		return actual;
+	} catch {
+		return {
+			...expected,
+			status: "unavailable",
+			goalAvailable: false,
+			reasonCode: "host_lock_missing"
+		};
+	}
+}
 function apply(ctx, rawConfig = {}) {
 	const config = resolveConfig(rawConfig);
 	const installedHostLock = evaluateHostLock(config.hostLockPackages ?? [], {
@@ -3504,8 +3573,13 @@ function apply(ctx, rawConfig = {}) {
 		let runtime = runtimes.get(agent);
 		if (!runtime) {
 			const goals = optionalGoalService(ctx, agent);
-			const agentHostLock = bindLiveGoalCapability(installedHostLock, Boolean(goals) && hasPinnedUpdateGoalTool(agent));
-			runtime = createRuntime(agent, config, agentHostLock, goals ? () => goals.get(agent) : void 0);
+			const refreshHostLock = () => {
+				const current = bindLiveGoalCapability(revalidateCoreLock(config, installedHostLock), Boolean(goals) && hasPinnedUpdateGoalTool(agent));
+				hostLocks.set(agent, current);
+				return current;
+			};
+			const agentHostLock = refreshHostLock();
+			runtime = createRuntime(agent, config, agentHostLock, goals ? () => goals.get(agent) : void 0, refreshHostLock);
 			runtimes.set(agent, runtime);
 			hostLocks.set(agent, agentHostLock);
 		}
@@ -3741,4 +3815,4 @@ function normalizeGoalState(value) {
 }
 
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, MIN_RECOVERY_CHAR_BUDGET, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, proofDigest, proofEvidenceConstraints, qualifyBoundary, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sessionQuery, sha256, snapshotSessionEvents, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, LEGACY_HOST_COHORTS, MIN_RECOVERY_CHAR_BUDGET, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, inspectTargetHostGraph, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, proofDigest, proofEvidenceConstraints, qualifyBoundary, readActiveHostGraph, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sessionQuery, sha256, snapshotSessionEvents, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };

package/docs/ARCHITECTURE.md

@@ -28,7 +28,9 @@ The in-memory `GuardProjection` is a rebuildable cache: `deriveProjection` appli
 
 The runtime rebuilds the projection from the log before each step. Before evidence is produced, the runtime awaits `ctx.sessions.flush(session)`; if no durability listener participated, evidence is marked `durability-unknown`, which fails closed.
 
-The v0.3 runtime accepts host identity only from `hostLockPackages` generated from the active runtime/profile graphs and bound to the active platform/profile kind. It does not infer identity from the nearest `pnpm-lock.yaml`: DSH core and profile plugins have separate locks, and the runtime lock can contain several historical versions. Missing, unreadable, duplicate, multi-version, or drifted identity disables the dependent capability. The audited values live in `manifests/supported-host.v1.json` as an exact host cohort registry: the whole graph must atomically match one audited cohort, mixed or unknown rows fail closed, and the selected cohort identity is part of every host lock digest, so switching cohorts invalidates certificate authority. `deriveProjection` receives this exact evaluation before it replays any checkpoint, so a certificate is never validated under a default lock and overwritten later; a changed digest retains historical evidence but makes current authority stale. Ordinary persisted `bash`/`pwsh` results are replayed only when the active platform's agent-loop and terminal group is exact; wrong-platform tool names fail closed. Ordinary `read`/`write`/`edit` results require the independent filesystem group, which pins the tool schemas and result/presentation contract together with the local/sandbox provider, observation policy, sandbox policy, and approval services. A filesystem-group failure disables only `create`/`modify` and filesystem-derived facts, not an independently valid terminal action.
+The host lock uses `dsh-core/v1`: one exact 33-package DSH core, independent of optional market versions. The resolver walks all reachable runtime/profile dependencies, including those introduced by plugins, and checks installed manifests against lock identities. Missing, duplicated, mixed or changed core rows fail closed. Every replay rechecks the configured graph sources against the injected core identity before deriving certificate authority.
+
+Core manifest version 2 and its policy/cohort values change the digest without changing the shared digest-v3 encoder. Legacy injected configuration requires explicit inspection and migration; historical records are never relabelled. Action capabilities are evaluated only after this core contract succeeds. Market restart additionally requires a trusted loaded-instance verifier. Current DSH supplies none, so restart is unavailable while unrelated guarded work remains supported. A requested restart stays pending. The version-2 service adapter distinguishes ordinary provider/instance drift from a persisted, target-bound restart handoff.
 
 Evidence is produced only from persisted `tool/call` + `tool/result` pairs. Guard never inserts context between a Code Mode sub-call and its durable result.
 

package/docs/COMPATIBILITY.md

@@ -2,11 +2,11 @@
 
 Compatibility is pinned to exact host package sets. A nearby version or a partial package match is not treated as supported.
 
-## 0.4.2 source candidate (unreleased)
+## 0.4.3 core-lock policy
 
-The repair candidate retains the existing five audited host cohorts and peer dependency ranges. It does not change the Codex upstream pin, host package identities, or digest-v3 fixtures. The package version is `0.4.2`; no CI, frozen-package, native-platform or publication result is implied by that version field.
+`dsh-core/v1` uses manifest version 2 and four exact 33-package DSH core graphs, retaining the previously audited DSH and Cordis versions. Market is not a core row. Its transitive dependencies remain part of active-graph traversal, so replacing or duplicating a core dependency still blocks certification. No floating DSH version range is introduced.
 
-For old pending requirements, use the new proposal/confirmation flow rather than editing the session log. Old events remain under their recorded capture version. Checkpoint output is paged and byte-bounded; clients must follow each list's cursor or query an ID instead of assuming that `open_items` or `available_evidence` on the first page is exhaustive. `bindings` and the top-level `certified|incomplete|unknown` meanings are unchanged. Generic execution and GUI/visual checks still cannot certify user-level completion. See the [architecture](ARCHITECTURE.md) for the schema and the [acceptance record](LOCAL_ACCEPTANCE.md) for remaining gates.
+The package keeps the same Codex semantic fixtures and digest-v3 encoder. The new manifest/cohort/policy values create a different host identity; an old injected lock requires fresh inspection and injection, and an old certificate stays historical. See [migration](HOST_LOCK_UPGRADE.md). Package version alone does not establish CI, native acceptance or publication.
 
 ## Recorded 0.4.0 release baseline
 
@@ -32,12 +32,12 @@ DSH rc.1 replaces the public `Session.events` getter with `snapshotEvents()` and
 
 ## Upstream adaptation policy
 
-Version 0.4.0 remains frozen on the alpha.3 setup above. Alpha.4 and later alpha releases are not new adaptation targets. Compatibility work resumed with DSH `0.1.2-rc.1`; that cohort is included in the published `0.4.1-rc.1` prerelease and retained by the 0.4.2 candidate. The upstream [tags page](https://github.com/deepseek-ai/deepseek-harness/tags) tracks later releases; a newer tag does not establish support.
+Version 0.4.0 remains frozen on the alpha.3 setup above. Alpha.4 and later alpha releases are not new adaptation targets. Compatibility work resumed with DSH `0.1.2-rc.1`; that cohort is included in the published `0.4.1-rc.1` prerelease and retained by the 0.4.2 release. The upstream [tags page](https://github.com/deepseek-ai/deepseek-harness/tags) tracks later releases; a newer tag does not establish support.
 
 ## Platform and release evidence
 
 - **Source and CI:** the release commit must pass the repository matrix and the Ubuntu, macOS, and Windows Node.js 22/24 CI jobs.
-- **Exact package:** the repository packer emits one deterministic 26-file tgz with its full source commit in `gitHead`. That same SHA-256 must be used on both native platforms and published to npm without repacking.
+- **Exact package:** the repository packer emits one deterministic tgz with the declared package inventory with its full source commit in `gitHead`. That same SHA-256 must be used on both native platforms and published to npm without repacking.
 - **Native scope:** macOS and Windows acceptance separately cover isolated Web and Headless installation, complete host-lock readback, repeated injection, Web restart and recovery, intentional Headless credential failure, daily-profile preservation, and scoped cleanup.
 - **Public identity:** the annotated tag, npm manifest and downloaded tgz, GitHub Release target, checksum, and platform annexes must all resolve to the same release commit and package bytes.
 - **Daily profiles:** upgrading a user's daily DSH profile is a separate action and is not implied by release acceptance.
@@ -50,11 +50,9 @@ Version 0.4.0 remains frozen on the alpha.3 setup above. Alpha.4 and later alpha
 
 ## Rejection rules
 
-The five exact host sets are recorded in [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json). Each set is a complete list of required packages and versions. Every row must match one set.
+Current core graphs and original historical cohorts are recorded separately in [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json). All core rows must match one complete graph. Missing, mixed, duplicate, unknown or integrity-drifted core rows reject certification.
 
-Missing, mixed, duplicate, unidentified, unknown, or integrity-drifted rows leave the Guard unavailable. Unregistered substitutions such as alpha.3 with dshmarket `1.38.1` are rejected as mixed graphs. dshmarket is an authoritative lock input; skin-center is not.
-
-The selected set is part of the host-lock digest. Changing sets invalidates earlier certificates, and a platform is marked supported only after its complete set passes native checks there.
+Market versions do not select a core cohort. Market restart has its own protocol and loaded-instance checks; an unavailable adapter does not disable the core or erase pending restart work. Changing the actual core graph changes its digest and invalidates earlier certificates.
 
 ## Evidence links
 
@@ -72,7 +70,7 @@ The plugin accepts an `activation` configuration value of `opt-in` or `always`.
 
 Before the Guard can certify work, generate and verify the host lock from the active DSH runtime and profile. Use the packaged `dsh-completion-guard-host-lock inspect|inject|verify-dump` flow in the README. The default patch has no `hostLockPackages`, so the Guard fails closed until this flow succeeds.
 
-Version 0.3 accepts the generated `hostLockPackages`, `hostLockPlatform`, and `hostLockProfile` values. Each critical package row records the exact resolved version and registry tarball integrity. The Guard does not infer a missing identity from a nearby lockfile: missing, duplicate, multi-version, or drifted rows fail closed. The audited identities are defined in [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json).
+Version 0.4.3 injects `hostLockPolicy: dsh-core/v1`, the runtime/profile source roots, `hostLockPackages`, `hostLockPlatform`, and `hostLockProfile` together. Replay rechecks those actual graph sources; legacy configuration without the policy and roots reports `host_lock_migration_required`. Each critical package row records the exact resolved version and registry tarball integrity. The Guard does not infer a missing identity from a nearby lockfile: missing, duplicate, multi-version, or drifted rows fail closed. The audited identities are defined in [`../manifests/supported-host.v1.json`](../manifests/supported-host.v1.json).
 
 ### Capability groups
 
@@ -87,9 +85,9 @@ The host lock evaluates these groups independently:
 - Web control; and
 - jobs.
 
-A missing platform- or action-specific group disables only the path that depends on it. For example, a valid terminal or jobs group remains usable when the filesystem group is unavailable.
+Action-specific checks select their required groups only after the complete core graph is valid. An invalid core graph blocks certification; a missing optional market adapter blocks only its dependent operation.
 
-The filesystem group has a narrower contract of its own. It freezes the registered `read`, `write`, and `edit` tools; their closed result and presentation shapes; the local or sandbox `ctx.fs` implementation; the read-before-mutation observation policy; the sandbox policy; and the approval provider. A missing or drifted filesystem row disables `create`, `modify`, and ordinary filesystem facts without disabling unrelated capability groups.
+The filesystem group has a narrower contract of its own. It freezes the registered `read`, `write`, and `edit` tools; their closed result and presentation shapes; the local or sandbox `ctx.fs` implementation; the read-before-mutation observation policy; the sandbox policy; and the approval provider. A missing or drifted filesystem core row keeps the core lock unavailable.
 
 ## Peer dependencies
 
@@ -134,7 +132,9 @@ certifying capability, and has unknown outcome.
 
 ## Verified surfaces
 
-### Current visible behavior
+### Previously verified runtime behavior
+
+These observations belong to the historical native records linked below. Each new core-lock artifact requires fresh native acceptance.
 
 - `dsh --profile web --dump-config` and `--profile headless --dump-config` both include `context-guard`.
 - A real Headless boot loads the plugin: `apply`, `ctx.sessions` access, and listener registration succeed before the run reaches the intentional missing-provider-credentials boundary.
@@ -203,7 +203,7 @@ The action is rejected before executable inspection, command execution, HTTP, or
 ### Package operations
 
 - `install` requires the exact package id, version, and profile, and the package must be absent.
-- `apply` requires the exact package id, version, and profile, plus an existing package with a changed version or integrity.
+- `apply` requires the exact package id, version, and profile, plus an existing package with a changed version or integrity. It executes through the DSH CLI and verifies disk package identity. It does not prove a live process, UI or restart outcome; those requirements remain separate.
 - `publish` requires the exact artifact id, version, and canonical registry. Version 0.3 does not authorize `latest` or a version range.
 
 Publish executes the exact resolved tgz with `--ignore-scripts`. Capture, argv, and standard packument readback use the same canonical HTTPS registry base. Registries containing credentials, a query, fragment, encoded separator, control character, or ambiguous path segment are rejected.
@@ -222,7 +222,9 @@ Create and modify bind to the frozen target and expected transition described be
 
 ### Restart
 
-Restart requires the exact service id. It persists an intent before POST and closes only after the restored process reports a changed boot ID.
+Restart requires an exact service, compatible protocol and a trusted binding from the host to the loaded provider, profile, loopback origin, package identity and process generation. HTTP capability claims and disk manifests alone do not establish that binding. Current DSH provides no production verifier, so the market restart adapter is unavailable even when the core lock is supported.
+
+The version-2 service adapter binds provider and instance digests into its generation string. A persisted intent permits the intended new instance only for the same provider; arbitrary process drift, provider replacement and old version-1 credentials cannot close the action. This pre-execute check is not isolation against a concurrently malicious same-user process. Native direct market restart checks are not evidence that Guard can certify a market restart.
 
 ### Windows command shims
 

package/docs/HOST_LOCK_UPGRADE.md

@@ -0,0 +1,83 @@
+# Upgrading the core host lock
+
+The 0.4.3 line separates Guard's exact DSH core from optional market versions.
+A normal market update no longer changes the core digest. A plugin that changes
+which core packages actually resolve still invalidates the lock.
+
+## Upgrade an existing profile
+
+Choose the published Guard package and DSH version from the
+[compatibility guide](COMPATIBILITY.md). Keep the existing profile backup and
+its disabled/activation settings. Installation does not authorize enablement.
+Web and Headless are separate profiles and must be checked separately.
+
+If the profile still declares `dsh-context-guard`, replace it through DSH's
+plugin manager rather than loading both package names. Its internal
+`context-guard` id remains unchanged. Preserve session files and user settings;
+if a profile override names the old package, change only that package name.
+Headless does not need market added as part of this migration.
+
+After the new package is installed, use absolute paths for the actual runtime
+and profile. The following example targets a POSIX shell:
+
+```sh
+DSH_RUNTIME_ROOT=/absolute/path/to/.dsh-runtime
+DSH_PROFILE_ROOT=/absolute/path/to/.dsh/profiles/web
+GUARD_HOST_LOCK="$DSH_PROFILE_ROOT/node_modules/.bin/dsh-completion-guard-host-lock"
+"$GUARD_HOST_LOCK" inspect --runtime-root "$DSH_RUNTIME_ROOT" --profile-root "$DSH_PROFILE_ROOT"
+"$GUARD_HOST_LOCK" inject --runtime-root "$DSH_RUNTIME_ROOT" --profile-root "$DSH_PROFILE_ROOT"
+dsh --profile web --dump-config | "$GUARD_HOST_LOCK" verify-dump --runtime-root "$DSH_RUNTIME_ROOT" --profile-root "$DSH_PROFILE_ROOT" --dump-config -
+```
+
+For Headless, use its profile path and `--profile headless`. On Windows, use the
+installed `.cmd` launcher and Windows absolute paths. A strict repeat leaves
+the package and profile contents unchanged. Restarting or enabling a daily
+profile remains a separate user action.
+
+## Check a Headless profile before installation
+
+A DSH `0.1.2-rc.1` Headless profile can have no external dependencies and no private `node_modules` or lockfile. From an accepted package or matching source checkout, `node bin/dsh-completion-guard-host-lock.mjs inspect-graph --runtime-root <runtime> --profile-root <profile>` checks that state without initializing or launching the profile.
+
+This narrow case requires exactly the installation-owned `dsh-base` and `dsh-headless` bundles, a complete audited runtime core, and matching bundle versions, package-map origins and patch files. Declared but uninstalled dependencies, partial map/lock pairs, unexplained local modules and foreign parent-module fallbacks are rejected. Existing profiles with both graph files retain their active-importer checks; damaged files are not treated as an empty graph.
+
+The result labels `inspection_scope: pre_install_target` and `profile_graph.state: dependency_free_headless`, with the manifest hash and bundle identities. Its package rows describe the verified runtime core used for this installation target, not a private profile importer or a live boot. After installing Guard, the `inspect`, `inject` and runtime replay checks still require the profile's package map, lockfile and installed plugin binding. This pre-install result cannot replace those checks.
+
+## What changes in the lock
+
+The generator writes `hostLockPolicy: dsh-core/v1`, the actual runtime/profile
+source roots, platform/profile kind and the complete 33-row core graph. The
+core manifest is version 2. Runtime replay re-reads those graph sources and
+requires the same exact core before using certificate authority.
+
+An older injected configuration reports `host_lock_migration_required`.
+Removing its market row by hand is not migration. Reinspect, inject and verify
+the actual environment. Historical cohorts, requirements and session records
+are retained; old certificates do not become certificates for the new lock.
+The shared digest-v3 encoder and its upstream fixtures are unchanged.
+
+## Market and restart
+
+Core compatibility does not certify the optional market restart adapter.
+Market's current HTTP capability response and a matching disk manifest cannot
+prove which provider bytes the service has loaded. Current DSH provides no
+independent loaded-instance verifier, so this adapter remains unavailable.
+An explicit restart requirement stays pending with a binding-unavailable
+reason. Other guarded work continues; package apply proves disk state only.
+
+A trusted embedding can supply a loaded-instance verifier to the version-2
+service adapter. Its provider identity binds the actual version, integrity,
+loaded tree, profile, origin and protocol. Its instance identity additionally
+binds the process and boot. Only a persisted restart intent may connect the
+expected old instance to a verified new instance of the same provider.
+Provider replacement, arbitrary process drift and old version-1 credentials
+cannot close that intent. These checks do not isolate a process from a
+concurrently malicious process running as the same user.
+
+## Acceptance records
+
+Use the [native entrypoint](LOCAL_ACCEPTANCE.md) with explicit core targets
+and a Web market version. Supplied daily target paths are read-only preflight
+inputs. The driver creates its own isolated profiles, with no market in
+Headless. Real market HTTP lifecycle checks and protocol unit fixtures are
+separate from Guard adapter certification. Each native annex belongs to one
+exact artifact and platform; publication is recorded on its GitHub Release.