dsh-completion-guard 0.4.2 → 0.5.0

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as DEFAULT_HOST_LOCK, $t as SUPPORTED_EVIDENCE_ADAPTERS, A as decideTurnBoundary, At as bindingSatisfies, B as extractTextContent, Bt as extractArtifactPaths, C as createGitPrestateEnvelope, Ct as closingHint, D as revalidateGitPrestate, Dt as evidenceAvailabilityReason, E as parseGitCommandManifest, Et as renderRecoveryPacket, F as CAPTURE_V042_NOTICE, Ft as createProjection, G as isRunExecutable, Gt as canonicalRegistryBase, H as isDeterministicCheck, Ht as extractOperation, I as PROTOCOL_V3_NOTICE, It as rebindResponse, J as goalCompletionDenial, Jt as ACTION_MANIFEST_VERSION, K as parsePwshCommand, Kt as npmEscapedPackageName, L as deriveProjection, Lt as captureClause, M as isWholeTaskCompletionClaim, Mt as evidenceMatchesItem, N as latestAssistantText, Nt as isVerifyingCapability, O as verifiedLinearCommitReadback, Ot as itemDiagnosis, P as observeAssistantOutcome, Pt as currentContractDigest, Q as BASE_HOST_PACKAGES, Qt as STOP_PROTOCOL_VERSION, R as supersedeItem, Rt as captureItem, S as commitTreeSnapshotDigest, St as MIN_RECOVERY_CHAR_BUDGET, T as gitCommandMatchesTarget, Tt as recoveryDigest, U as withDurability, Ut as isInformationalMessage, V as extractToolSubject, Vt as extractMethod, W as canonicalArgvFromCommand, Wt as segmentClauses, X as ALPHA2_DSHMARKET_139_HOST_PACKAGES, Xt as SEMANTIC_ACTIONS, Y as hasCurrentCertificate, Yt as CERTIFICATE_VERSION, Z as ALPHA2_HOST_PACKAGES, Zt as STATEFUL_ACTIONS, _ as resolveInstalledHostLock, _t as effectuateBoundary, a as createProofManifest, an as semanticActionFromText, at as bindLiveGoalCapability, b as GIT_COMMAND_MANIFEST_IDS, bt as certifyCheckpoint, c as sessionQuery, cn as COMMAND_SURFACE_MANIFEST, ct as evaluateHostLock, d as hostLockContextFromComposedDump, dn as digestStrings, dt as RC1_HOST_PACKAGES, en as actionCompatible, et as EXPECTED_HOST_PACKAGES, f as hostLockRowsFromComposedDump, fn as normalizeClause, ft as ALPHA3_HOST_PACKAGES, g as resolveActiveProfileHostLock, gt as availableBoundaryQualifications, h as packageRowsFromPnpmLock, hn as sha256, ht as classifyUserInteraction, i as canonicalProjection, in as semanticActionFromCommand, it as bindExecutableIdentity, j as decideTurnStopping, jt as evidenceCoverage, k as classifyCompletionClaim, kt as relevantEvidence, l as validateProofManifest, ln as validateManifest, lt as evaluateToolSurfaceCapability, m as packageRowsFromActiveGraph, mn as sanitizeUrl, mt as segmentAuthorityBlocks, n as PROOF_PROTOCOL_VERSION, nn as requestedTargetAuthorizesMutation, nt as HOST_CAPABILITY_PACKAGE_GROUPS, o as proofDigest, on as validateActionManifest, ot as evaluateExternalWaitCapability, p as injectActiveProfileHostLock, pn as sanitizeClauseText, pt as authorityCaptureCounts, q as parseShellCommand, qt as ACTION_MANIFEST, r as bindProofToProjection, rn as requestedTargetMatchesResolved, rt as HOST_COHORTS, s as proofEvidenceConstraints, sn as validateActionTarget, st as evaluateHostCapability, t as PROOF_KINDS, tn as isStatefulAction, tt as GOAL_HOST_PACKAGES, u as HostProfileError, un as canonicalizePath, ut as selectHostCohort, v as verifyComposedHostLockDump, vt as isCurrentAcceptedBoundary, w as executeRevalidatedGitEffect, wt as openItems, x as commitIndexSnapshotDigest, xt as DEFAULT_RECOVERY_CHAR_BUDGET, y as snapshotSessionEvents, yt as qualifyBoundary, z as evidenceFromPersistedToolResult, zt as classifyClause } from "./domain-BXB_BPQg.js";
+import { $ as isRunExecutable, $t as itemDiagnosis, A as revalidateGitPrestate, An as canonicalizePath, At as MIN_RECOVERY_CHAR_BUDGET, B as lifecyclePhase, Bt as createProjection, C as GIT_COMMAND_TEMPLATES, Cn as semanticActionFromText, Ct as segmentAuthorityBlocks, D as executeRevalidatedGitEffect, Dn as validateManifest, Dt as qualifyBoundary, E as createGitPrestateEnvelope, En as COMMAND_SURFACE_MANIFEST, Et as isCurrentAcceptedBoundary, F as isWholeTaskCompletionClaim, Fn as sha256, Ft as bindingSatisfies, G as deriveProjection, Gt as rebindAttemptKey, H as CAPTURE_V042_NOTICE, Ht as proposeRebind, I as latestAssistantText, It as evidenceCoverage, J as extractTextContent, Jt as CONFIRM_LINE_PATTERN, K as supersedeItem, Kt as rebindResponse, L as observeAssistantOutcome, Lt as evidenceMatchesItem, M as classifyCompletionClaim, Mn as normalizeClause, Mt as openItems, N as decideTurnBoundary, Nn as sanitizeClauseText, Nt as recoveryDigest, O as gitCommandMatchesTarget, On as classifyTaskIntent, Ot as certifyCheckpoint, P as decideTurnStopping, Pn as sanitizeUrl, Pt as renderRecoveryPacket, Q as canonicalArgvFromCommand, Qt as evidenceAvailabilityReason, R as FIRST_STEP_GUIDANCE, Rt as isVerifyingCapability, S as GIT_COMMAND_MANIFEST_IDS, Sn as semanticActionFromCommand, St as authorityCaptureCounts, T as commitTreeSnapshotDigest, Tn as validateActionTarget, Tt as effectuateBoundary, U as PROTOCOL_V3_NOTICE, Ut as proposeRebindOutcome, V as previewFirstStepInjection, Vt as confirmRebind, W as PROTOCOL_V4_NOTICE, Wt as proposeRebindV042, X as isDeterministicCheck, Xt as parseConfirmationMessage, Y as extractToolSubject, Yt as isFrozenV042RebindResponse, Z as withDurability, Zt as deriveItemDiagnosis, _ as readActiveHostGraph, _n as SUPPORTED_EVIDENCE_ADAPTERS, _t as evaluateHostLock, a as createProofManifest, an as extractMethod, at as ALPHA2_HOST_PACKAGES, b as verifyComposedHostLockDump, bn as requestedTargetAuthorizesMutation, bt as RC1_HOST_PACKAGES, c as sessionQuery, cn as segmentClauses, ct as EXPECTED_HOST_PACKAGES, d as hostLockContextFromComposedDump, dn as ACTION_MANIFEST, dt as HOST_COHORTS, en as relevantEvidence, et as parsePwshCommand, f as hostLockRowsFromComposedDump, fn as ACTION_MANIFEST_VERSION, ft as LEGACY_HOST_COHORTS, g as packageRowsFromPnpmLock, gn as STOP_PROTOCOL_VERSION, gt as evaluateHostCapability, h as packageRowsFromActiveGraph, hn as STATEFUL_ACTIONS, ht as evaluateExternalWaitCapability, i as canonicalProjection, in as extractArtifactPaths, it as ALPHA2_DSHMARKET_139_HOST_PACKAGES, j as verifiedLinearCommitReadback, jn as digestStrings, jt as closingHint, k as parseGitCommandManifest, kn as classifyUserInteraction, kt as DEFAULT_RECOVERY_CHAR_BUDGET, l as validateProofManifest, ln as canonicalRegistryBase, lt as GOAL_HOST_PACKAGES, m as inspectTargetHostGraph, mn as SEMANTIC_ACTIONS, mt as bindLiveGoalCapability, n as PROOF_PROTOCOL_VERSION, nn as captureItem, nt as goalCompletionDenial, o as proofDigest, on as extractOperation, ot as BASE_HOST_PACKAGES, p as injectActiveProfileHostLock, pn as CERTIFICATE_VERSION, pt as bindExecutableIdentity, q as evidenceFromPersistedToolResult, qt as replayRebindResult, r as bindProofToProjection, rn as classifyClause, rt as hasCurrentCertificate, s as proofEvidenceConstraints, sn as isInformationalMessage, st as DEFAULT_HOST_LOCK, t as PROOF_KINDS, tn as captureClause, tt as parseShellCommand, u as HostProfileError, un as npmEscapedPackageName, ut as HOST_CAPABILITY_PACKAGE_GROUPS, v as resolveActiveProfileHostLock, vn as actionCompatible, vt as evaluateToolSurfaceCapability, w as commitIndexSnapshotDigest, wn as validateActionManifest, wt as availableBoundaryQualifications, x as snapshotSessionEvents, xn as requestedTargetMatchesResolved, xt as ALPHA3_HOST_PACKAGES, y as resolveInstalledHostLock, yn as isStatefulAction, yt as selectHostCohort, z as claimedBatchHasRealRootInput, zt as currentContractDigest } from "./domain-Cx8vpxSj.js";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { createHash } from "node:crypto";
 import { basename, delimiter, dirname, isAbsolute, join, resolve } from "node:path";
@@ -812,6 +812,102 @@ function createBoundaryTool(getProjection, prepare, onRejected) {
 	});
 }
 
+//#endregion
+//#region src/tools/prepare.ts
+/**
+* Thin READ-ONLY preparation surface (v0.5): before any stateful action it
+* reports the supported command shape, the required resolution/effect/state
+* evidence order, existing reusable references, and the exact missing fields.
+* It never executes, installs, commits, pushes, restarts, or probes authority
+* through side effects, and it never upgrades a default into user authority.
+*/
+function createPrepareTool(options) {
+	return defineTool({
+		name: "context_guard_prepare",
+		description: "Read-only pre-action preparation: report the supported command shape, required resolution/effect/state evidence order, existing references, and exact missing target fields for one contract item. Performs no action and grants no authority.",
+		parameters: {
+			item_id: {
+				type: "string",
+				required: true
+			},
+			item_revision: { type: "number" },
+			semantic_action: { type: "string" },
+			requested_target: {
+				type: "object",
+				additionalProperties: true
+			},
+			planned_operation: { type: "string" }
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: true
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: JSON.stringify(value)
+			}]
+		},
+		async execute(rawArgs) {
+			const args = rawArgs;
+			const p = options.getProjection();
+			if (!p || !p.enabled || p.integrity !== "valid") return {
+				status: "unknown",
+				reason_code: "guard_unavailable"
+			};
+			const item = p.items.get(args.item_id ?? "");
+			if (!item) return {
+				status: "rejected",
+				reason_code: "item_not_found"
+			};
+			if (args.item_revision !== void 0 && item.revision !== args.item_revision) return {
+				status: "rejected",
+				reason_code: "item_revision_mismatch",
+				item_revision: item.revision
+			};
+			const diagnosis = deriveItemDiagnosis(p, item);
+			const plannedAction = args.semantic_action ?? item.semanticAction;
+			const manifestEntry = plannedAction ? ACTION_MANIFEST.actions[plannedAction] : void 0;
+			if (plannedAction && !manifestEntry) return {
+				status: "rejected",
+				reason_code: "unsupported_action"
+			};
+			const reusable = [...p.evidence.values()].filter((evidence) => relevantEvidence(p, item, evidence) && evidenceAvailabilityReason(evidence) === void 0).sort((a, b) => b.toolResultSeq - a.toolResultSeq).slice(0, 8).map((evidence) => ({
+				evidence_id: evidence.id,
+				role: evidence.evidenceRole,
+				semantic_action: evidence.semanticAction,
+				resolved_target: evidence.resolvedTarget,
+				tool_result_seq: evidence.toolResultSeq
+			}));
+			const requiredOrder = manifestEntry?.stateful ? [
+				"resolution (prestate facts from a trusted read)",
+				"effect (the exact planned change)",
+				"state (independent post-state readback)"
+			] : ["state (matching durable evidence for the requested verification)"];
+			const missingTargetFields = manifestEntry?.stateful && plannedAction ? manifestEntry.resolvedTargetKeys.filter((key) => !(item.requestedTarget?.[key] !== void 0 || args.requested_target?.[key] !== void 0)) : [];
+			const capability = plannedAction && options.hostCapability ? options.hostCapability(plannedAction) : void 0;
+			return {
+				status: "prepared",
+				item: {
+					id: item.id,
+					revision: item.revision
+				},
+				diagnosis,
+				planned_action: plannedAction,
+				supported_command_shape: options.commandTemplate && plannedAction ? options.commandTemplate(plannedAction) ?? void 0 : void 0,
+				required_evidence_order: requiredOrder,
+				reusable_references: reusable,
+				missing_target_fields: missingTargetFields,
+				host_capability: capability ? {
+					status: capability.status,
+					reason_code: capability.reasonCode
+				} : void 0,
+				note: "Preparation performs no action. A default or guessed target is not user authority; explicit root instruction is required for missing target fields."
+			};
+		}
+	});
+}
+
 //#endregion
 //#region src/tools/evidence.ts
 const execFileAsync = promisify(execFile);
@@ -900,7 +996,7 @@ function tuple(value) {
 function adapterId(action) {
 	if (["create", "modify"].includes(action)) return "context-guard.artifact.v1";
 	if (["install", "apply"].includes(action)) return "context-guard.package.v1";
-	if (action === "restart") return "context-guard.service.v1";
+	if (action === "restart") return "context-guard.service.v2";
 	if (action === "publish") return "context-guard.registry.v1";
 	return "context-guard.git.v1";
 }
@@ -913,7 +1009,7 @@ function unavailable(action, role, reason) {
 		resolved_target: {},
 		observed_state: {},
 		adapter_id: adapterId(action),
-		adapter_version: PRODUCER_VERSION,
+		adapter_version: action === "restart" ? "2.0.0" : PRODUCER_VERSION,
 		target_digest: "",
 		command_manifest_digest: ""
 	};
@@ -927,7 +1023,7 @@ function supported(action, role, resolved, observed = {}, commandManifest = {},
 		resolved_target: jsonTuple(resolved),
 		observed_state: jsonTuple(observed),
 		adapter_id: adapterId(action),
-		adapter_version: PRODUCER_VERSION,
+		adapter_version: action === "restart" ? "2.0.0" : PRODUCER_VERSION,
 		target_digest: digest(resolved),
 		command_manifest_digest: digest(commandManifest),
 		...gitBinding ? { git_binding: gitBinding } : {},
@@ -972,7 +1068,7 @@ function findResolution(events, callId, action) {
 		}
 		if (event.type !== "tool/result") continue;
 		const meta = producerMeta(event);
-		if (meta?.semanticAction !== action || meta.evidenceRole !== "resolution" || meta.adapterVersion !== PRODUCER_VERSION || !selector || !commandManifest) return void 0;
+		if (meta?.semanticAction !== action || meta.evidenceRole !== "resolution" || meta.adapterVersion !== (action === "restart" ? "2.0.0" : PRODUCER_VERSION) || !selector || !commandManifest) return void 0;
 		const target = tuple(meta.resolvedTarget);
 		const rawBinding = record(meta.gitBinding);
 		const rawManifest = record(rawBinding?.manifest);
@@ -1155,13 +1251,13 @@ async function tgzIdentity(path) {
 		integrity: `sha512-${createHash("sha512").update(bytes).digest("base64")}`
 	};
 }
-const DSHMARKET_VERSION = "1.36.0";
-const DSHMARKET_INTEGRITY = "sha512-xX8CCoXdIALaxtLosj+5qGg8r1cykW2zo1AOPJcSQepg2r4Vd2K0NmERldDqfeyFV0pCuZsUoAPe1Q/BW7De/g==";
 const MARKET_SCHEMA = "dsh-market/update-api/v1";
+const MARKET_GENERATION_PREFIX = "dsh-market-instance/v1:";
 async function marketCapabilities(roots, signal) {
-	if (!roots.profile || !roots.marketOrigin) return void 0;
+	if (!roots.profile || !roots.marketOrigin || !roots.verifyMarketInstance) return void 0;
 	const installed = await profilePackage(roots.profile.path, "dshmarket");
-	if (installed?.version !== DSHMARKET_VERSION || installed.integrity !== DSHMARKET_INTEGRITY) return void 0;
+	const binding = await roots.verifyMarketInstance(signal);
+	if (!installed || !binding || binding.origin !== roots.marketOrigin || binding.profile !== roots.profile.name || binding.version !== installed.version || binding.integrity !== installed.integrity || !/^[0-9a-f]{64}$/.test(binding.loadedTreeSha256) || !binding.processIdentity || !binding.bootId) return void 0;
 	const response = await (roots.fetcher ?? fetch)(`${roots.marketOrigin}/dsh-market/api/v1/capabilities`, {
 		signal,
 		headers: { accept: "application/json" },
@@ -1169,8 +1265,32 @@ async function marketCapabilities(roots, signal) {
 	});
 	if (!response.ok) return void 0;
 	const value = record(await response.json());
-	if (value?.schema !== MARKET_SCHEMA || value.apiVersion !== 1 || value.marketVersion !== DSHMARKET_VERSION || value.profile !== roots.profile.name || typeof value.bootId !== "string") return void 0;
-	return value;
+	if (value?.schema !== MARKET_SCHEMA || value.apiVersion !== 1 || value.marketVersion !== binding.version || value.profile !== binding.profile || value.bootId !== binding.bootId) return void 0;
+	const features = record(value.features);
+	const restart = record(value.restart);
+	if (features?.restart !== true || restart?.supported !== true || restart.managedBy !== "market") return void 0;
+	const provider = createHash("sha256").update(JSON.stringify([
+		MARKET_SCHEMA,
+		binding.origin,
+		binding.profile,
+		binding.version,
+		binding.integrity,
+		binding.loadedTreeSha256,
+		"restart",
+		true,
+		"market"
+	])).digest("hex");
+	const instance = createHash("sha256").update(JSON.stringify([binding.processIdentity, binding.bootId])).digest("hex");
+	return {
+		...value,
+		generation: `${MARKET_GENERATION_PREFIX}${provider}:${instance}`
+	};
+}
+function sameMarketProvider(before, after) {
+	const pattern = /^dsh-market-instance\/v1:([0-9a-f]{64}):[0-9a-f]{64}$/;
+	const left = typeof before === "string" ? pattern.exec(before) : null;
+	const right = typeof after === "string" ? pattern.exec(after) : null;
+	return !!left && !!right && left[1] === right[1];
 }
 function importerLocator(text, packageId) {
 	const escaped = packageId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -1200,6 +1320,7 @@ async function profilePackage(profilePath, packageId) {
 	try {
 		const lock = await readFile(resolve(profilePath, "pnpm-lock.yaml"), "utf8");
 		const locator = importerLocator(lock, packageId);
+		if (packageId === "dshmarket" && (!locator || locator.split("(", 1)[0] !== manifest.version)) return void 0;
 		const integrity = locator ? lockIntegrity(lock, packageId, locator) : void 0;
 		return integrity ? {
 			version: manifest.version,
@@ -1354,7 +1475,8 @@ async function executeGuardAction(action, resolution, roots, signal, executableI
 	if (action === "restart") {
 		const capabilities = await marketCapabilities(roots, signal);
 		if (!capabilities || !roots.marketOrigin || !resolutionCallId || !agent) return "unavailable";
-		if (capabilities.bootId !== target.pre_generation) return restartIntent(snapshotSessionEvents(agent.session), resolutionCallId, target) ? "completed" : "unavailable";
+		if (!sameMarketProvider(target.pre_generation, capabilities.generation)) return "unavailable";
+		if (capabilities.generation !== target.pre_generation) return restartIntent(snapshotSessionEvents(agent.session), resolutionCallId, target) ? "completed" : "unavailable";
 		if (restartIntent(snapshotSessionEvents(agent.session), resolutionCallId, target)) return "handoff_pending";
 		if (!roots.persistRestartIntent || !await roots.persistRestartIntent(agent, {
 			resolutionCallId,
@@ -1629,7 +1751,7 @@ async function resolveTarget(action, selector, commandManifest, cwd, roots, sign
 		if (features?.restart !== true || restart?.supported !== true || restart.managedBy !== "market") return void 0;
 		return { target: {
 			service_id: service,
-			pre_generation: String(capabilities?.bootId)
+			pre_generation: String(capabilities?.generation)
 		} };
 	}
 	if (action === "publish") {
@@ -1770,9 +1892,9 @@ async function readback(action, target, roots, signal, executableIdentity$1) {
 	}
 	if (action === "restart") {
 		const capabilities = await marketCapabilities(roots, signal);
-		if (!capabilities || capabilities.bootId === target.pre_generation) return void 0;
+		if (!capabilities || !sameMarketProvider(target.pre_generation, capabilities.generation) || capabilities.generation === target.pre_generation) return void 0;
 		return {
-			new_generation: String(capabilities.bootId),
+			new_generation: String(capabilities.generation),
 			health: "healthy"
 		};
 	}
@@ -1850,6 +1972,7 @@ function normalizedRoots(options) {
 			path: resolve(options.profile.path)
 		} } : detectedProfile ? { profile: detectedProfile } : {},
 		...options.marketOrigin ? { marketOrigin: options.marketOrigin } : {},
+		...options.verifyMarketInstance ? { verifyMarketInstance: options.verifyMarketInstance } : {},
 		...options.fetcher ? { fetcher: options.fetcher } : {},
 		...options.commandRunner ? { commandRunner: options.commandRunner } : {},
 		...options.persistRestartIntent ? { persistRestartIntent: options.persistRestartIntent } : {},
@@ -2258,7 +2381,7 @@ function createEvidenceTool(options = {}) {
 					const executableBinding = executable$1 ? await (roots.readExecutableIdentity ?? executableIdentity)(executable$1, exec.signal) : void 0;
 					if (executable$1 && !executableBinding) return unavailable(action, role, "executable_identity_unavailable");
 					const resolved = await resolveTarget(action, record(args.selector) ?? {}, record(args.command_manifest) ?? {}, cwdOf(agent), roots, exec.signal, executableBinding);
-					if (!resolved) return unavailable(action, role, "resolution_unavailable");
+					if (!resolved) return unavailable(action, role, action === "restart" && !roots.verifyMarketInstance ? "market_instance_binding_unavailable" : "resolution_unavailable");
 					const gitBinding = resolved.gitBinding ? JSON.parse(JSON.stringify(resolved.gitBinding)) : void 0;
 					const commandManifest = record(args.command_manifest) ?? {};
 					const expectedTransition = await expectedTransitionForResolution(action, resolved.target, commandManifest);
@@ -2288,7 +2411,7 @@ function createEvidenceTool(options = {}) {
 				if (ownedEffect) {
 					const events = snapshotSessionEvents(agent.session);
 					const actionCall = actionCallMatches(events, args.effect_call_id, action, args.resolution_call_id, resolution.target);
-					if (!(action === "restart" ? actionCall && restartIntent(events, args.resolution_call_id, resolution.target) && (await marketCapabilities(roots, exec.signal))?.bootId !== resolution.target.pre_generation : actionCall && actionResultCompleted(events, args.effect_call_id))) return unavailable(action, role, "persisted_effect_mismatch");
+					if (!(action === "restart" ? actionCall && restartIntent(events, args.resolution_call_id, resolution.target) && !!await readback("restart", resolution.target, roots, exec.signal) : actionCall && actionResultCompleted(events, args.effect_call_id))) return unavailable(action, role, "persisted_effect_mismatch");
 					if (role === "effect") return supported(action, role, resolution.target, {}, resolution.commandManifest, void 0, currentExecutable);
 				} else {
 					const effect = findEffect(snapshotSessionEvents(agent.session), args.effect_call_id);
@@ -2384,7 +2507,7 @@ function createExternalOperationTool(read, capability) {
 function pendingCount(projection) {
 	return [...projection.items.values()].filter((item) => item.status === "pending").length;
 }
-function createContextGuardCommand(projectionFor, setEnabled, clearContract) {
+function createContextGuardCommand(projectionFor, setEnabled, clearContract, lifecycleFor) {
 	return {
 		name: "context-guard",
 		description: "Enable, disable, clear, inspect, or diagnose Context Guard for this session.",
@@ -2422,12 +2545,26 @@ function createContextGuardCommand(projectionFor, setEnabled, clearContract) {
 				text: "Usage: /context-guard on|off|clear|status|diagnose"
 			};
 			const passed = [...projection.items.values()].filter((item) => item.status === "passed").length;
+			let certifiable_missing_evidence = 0;
+			let unsupported = 0;
+			for (const item of projection.items.values()) {
+				if (item.status !== "pending") continue;
+				const diagnosis = deriveItemDiagnosis(projection, item);
+				if (diagnosis.repairability === "agent_repairable") certifiable_missing_evidence += 1;
+				else if (diagnosis.certification === "unsupported") unsupported += 1;
+			}
 			const response = {
 				enabled: projection.enabled,
+				lifecycle: lifecycleFor?.(agent) ?? (projection.enabled ? "active" : "disabled"),
 				epoch: projection.epoch,
 				contract_revision: projection.contractRevision,
 				pending: pendingCount(projection),
 				passed,
+				diagnosis: {
+					certified: passed,
+					certifiable_missing_evidence,
+					unsupported
+				},
 				evidence: projection.evidence.size,
 				integrity: projection.integrity,
 				last_source_seq: projection.lastObservedSourceSeq
@@ -3242,6 +3379,9 @@ const Config = Schema.object({
 	activation: Schema.string().default("opt-in"),
 	hostLockPlatform: Schema.string(),
 	hostLockProfile: Schema.string(),
+	hostLockPolicy: Schema.string(),
+	hostLockRuntimeRoot: Schema.string(),
+	hostLockProfileRoot: Schema.string(),
 	hostLockPackages: Schema.array(Schema.object({
 		name: Schema.string().required(),
 		version: Schema.string(),
@@ -3271,7 +3411,15 @@ function resolveConfig(config) {
 	if (config.hostLockProfile !== void 0 && config.hostLockProfile !== "headless" && config.hostLockProfile !== "web") throw new TypeError("hostLockProfile must be \"headless\" or \"web\"");
 	const hasHostRows = hostLockPackages !== void 0;
 	if (hasHostRows !== (config.hostLockPlatform !== void 0) || hasHostRows !== (config.hostLockProfile !== void 0)) throw new TypeError("hostLockPackages, hostLockPlatform, and hostLockProfile must be injected together");
+	for (const key of [
+		"hostLockPolicy",
+		"hostLockRuntimeRoot",
+		"hostLockProfileRoot"
+	]) if (config[key] !== void 0 && (typeof config[key] !== "string" || !config[key])) throw new TypeError(`${key} must be a non-empty string`);
 	return {
+		...typeof config.hostLockPolicy === "string" ? { hostLockPolicy: config.hostLockPolicy } : {},
+		...typeof config.hostLockRuntimeRoot === "string" ? { hostLockRuntimeRoot: config.hostLockRuntimeRoot } : {},
+		...typeof config.hostLockProfileRoot === "string" ? { hostLockProfileRoot: config.hostLockProfileRoot } : {},
 		activation,
 		...hostLockPackages ? { hostLockPackages } : {},
 		...config.hostLockPlatform ? { hostLockPlatform: config.hostLockPlatform } : {},
@@ -3419,7 +3567,7 @@ function sessionHeaderForDigest(session) {
 		delegationDepth: typeof raw.delegationDepth === "number" ? raw.delegationDepth : 0
 	};
 }
-function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalState) {
+function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalState, refreshHostLock) {
 	const projection = createProjection();
 	const session = agent.session;
 	let pendingRecovery = false;
@@ -3427,9 +3575,13 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 	let observedEpoch = -1;
 	let observedCompactionSeq = -1;
 	let observedContractRevision = -1;
+	let protocolV4Present = false;
+	let realRootInputSeen = false;
+	let lifecycle = "armed";
 	const continuationAttempts = projection.continuationAttempts;
 	const persistenceCorrectionAttempts = projection.persistenceCorrectionAttempts;
 	const rebuild = () => {
+		if (refreshHostLock) hostLock = refreshHostLock();
 		const header = session.header;
 		const priorRecoveryDigest = projection.lastRecoveryDigest;
 		const derived = deriveProjection(snapshotSessionEvents(session), { activation: config.activation }, {
@@ -3450,6 +3602,12 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 		projection.continuationAttempts = continuationAttempts;
 		projection.persistenceCorrectionAttempts = persistenceCorrectionAttempts;
 		projection.lastRecoveryDigest = priorRecoveryDigest;
+		protocolV4Present = derived.protocolV4Present;
+		realRootInputSeen = derived.realRootInputSeen;
+		lifecycle = lifecyclePhase({
+			enabled: projection.enabled,
+			realInputSeen: realRootInputSeen
+		});
 		if (observedEpoch >= 0 && derived.projection.epoch > observedEpoch) {
 			pendingRecovery = true;
 			projection.lastRecoveryDigest = void 0;
@@ -3484,6 +3642,12 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 	return {
 		projection,
 		session,
+		get lifecycle() {
+			return lifecycle;
+		},
+		get protocolV4Present() {
+			return protocolV4Present;
+		},
 		sync,
 		setEnabled,
 		setDurability,
@@ -3491,6 +3655,41 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 		consumeRecovery
 	};
 }
+/** Delegated/subagent sessions never receive root-conversation injections. */
+function isDelegatedSession(session) {
+	const header = session.header;
+	return header?.origin === "subagent" || typeof header?.delegationDepth === "number" && header.delegationDepth > 0 || typeof header?.parentSession === "string";
+}
+/** Never reinterpret a legacy injected snapshot as freshly accepted core/v1. */
+function revalidateCoreLock(config, expected) {
+	if (config.hostLockPolicy !== "dsh-core/v1" || !config.hostLockRuntimeRoot || !config.hostLockProfileRoot) return {
+		...expected,
+		status: "unavailable",
+		goalAvailable: false,
+		reasonCode: "host_lock_migration_required"
+	};
+	try {
+		const actual = evaluateHostLock(readActiveHostGraph(config.hostLockRuntimeRoot, config.hostLockProfileRoot), {
+			platform: config.hostLockPlatform,
+			profileKind: config.hostLockProfile
+		});
+		if (actual.status !== "supported") return actual;
+		if (actual.digest !== expected.digest) return {
+			...actual,
+			status: "unsupported",
+			goalAvailable: false,
+			reasonCode: "host_lock_installed_graph_drift"
+		};
+		return actual;
+	} catch {
+		return {
+			...expected,
+			status: "unavailable",
+			goalAvailable: false,
+			reasonCode: "host_lock_missing"
+		};
+	}
+}
 function apply(ctx, rawConfig = {}) {
 	const config = resolveConfig(rawConfig);
 	const installedHostLock = evaluateHostLock(config.hostLockPackages ?? [], {
@@ -3504,17 +3703,20 @@ function apply(ctx, rawConfig = {}) {
 		let runtime = runtimes.get(agent);
 		if (!runtime) {
 			const goals = optionalGoalService(ctx, agent);
-			const agentHostLock = bindLiveGoalCapability(installedHostLock, Boolean(goals) && hasPinnedUpdateGoalTool(agent));
-			runtime = createRuntime(agent, config, agentHostLock, goals ? () => goals.get(agent) : void 0);
+			const refreshHostLock = () => {
+				const current = bindLiveGoalCapability(revalidateCoreLock(config, installedHostLock), Boolean(goals) && hasPinnedUpdateGoalTool(agent));
+				hostLocks.set(agent, current);
+				return current;
+			};
+			const agentHostLock = refreshHostLock();
+			runtime = createRuntime(agent, config, agentHostLock, goals ? () => goals.get(agent) : void 0, refreshHostLock);
 			runtimes.set(agent, runtime);
 			hostLocks.set(agent, agentHostLock);
 		}
 		return runtime;
 	};
-	ctx.commands.register(createContextGuardCommand((agent) => ensure(agent).projection, (agent, enabled) => ensure(agent).setEnabled(enabled), (agent) => ensure(agent).sync()));
+	ctx.commands.register(createContextGuardCommand((agent) => ensure(agent).projection, (agent, enabled) => ensure(agent).setEnabled(enabled), (agent) => ensure(agent).sync(), (agent) => ensure(agent).lifecycle));
 	ctx.on("agent/session-start", ({ agent, source }) => {
-		ensureProtocolBoundary(agent);
-		ensureProtocolBoundary(agent, CAPTURE_V042_NOTICE);
 		const runtime = ensure(agent);
 		runtime.sync();
 		if (source === "resume" || source === "compact") {
@@ -3581,6 +3783,17 @@ function apply(ctx, rawConfig = {}) {
 		};
 		agent.ctx.tools.register(createEvidenceTool(evidenceOptions));
 		agent.ctx.tools.register(createActionTool(evidenceOptions));
+		agent.ctx.tools.register(createPrepareTool({
+			getProjection: () => runtime.projection,
+			hostCapability: (action) => {
+				const evaluation = createHostCapabilityEvaluator(hostLocks.get(agent) ?? installedHostLock)(action);
+				return {
+					status: evaluation.status,
+					reasonCode: evaluation.reasonCode
+				};
+			},
+			commandTemplate: (action) => GIT_COMMAND_TEMPLATES[action]
+		}));
 		agent.ctx.tools.register(createExternalOperationTool((id, toolAgent) => readExternalOperation(ctx, toolAgent, id), () => evaluateExternalWaitCapability(hostLocks.get(agent) ?? installedHostLock)));
 		agent.ctx.tools.guard((exec) => goalCompletionDenial(runtime.projection, exec.name, exec.arguments));
 	});
@@ -3590,12 +3803,33 @@ function apply(ctx, rawConfig = {}) {
 		runtime.setDurability(durability);
 		runtime.sync();
 		const decision = await next();
-		if (decision.kind === "enter" && runtime.projection.enabled && runtime.consumeRecovery()) {
-			const recovery = renderRecoveryPacket(runtime.projection, { charBudget: 4e3 });
+		if (decision.kind !== "enter") return decision;
+		const injected = [];
+		const delegated = isDelegatedSession(agent.session);
+		let boundaryPending = !runtime.protocolV4Present;
+		const firstStep = previewFirstStepInjection({
+			activation: config.activation,
+			enabled: runtime.projection.enabled,
+			boundaryPresent: runtime.protocolV4Present,
+			delegated
+		}, claimedBatchHasRealRootInput(decision.messages));
+		if (firstStep) {
+			injected.push(pluginNoticeMessage(firstStep.boundary, "Context Guard recorded a replay version boundary"));
+			if (runtime.lifecycle === "armed") injected.push(pluginNoticeMessage(firstStep.guidance, "Context Guard first-step protection guidance"));
+			boundaryPending = false;
+		}
+		if (runtime.projection.enabled && runtime.consumeRecovery()) {
+			const hasOpenWork = [...runtime.projection.items.values()].some((item) => item.status === "pending");
+			const hasRejections = (runtime.projection.lastCheckpointRejections?.length ?? 0) > 0;
+			const recovery = hasOpenWork || hasRejections ? renderRecoveryPacket(runtime.projection, { charBudget: 4e3 }) : void 0;
 			const digest$2 = recovery ? recoveryDigest(recovery, runtime.projection) : void 0;
 			if (recovery && digest$2 !== runtime.projection.lastRecoveryDigest) {
 				runtime.projection.lastRecoveryDigest = digest$2;
-				decision.messages = [...decision.messages, createUserMessage({
+				if (boundaryPending && !delegated) {
+					injected.push(pluginNoticeMessage(PROTOCOL_V4_NOTICE, "Context Guard recorded a replay version boundary"));
+					boundaryPending = false;
+				}
+				injected.push(createUserMessage({
 					content: [{
 						type: "text",
 						text: `Open task requirements (recovered after compaction or resume):\n${recovery}`
@@ -3606,9 +3840,10 @@ function apply(ctx, rawConfig = {}) {
 						form: "notice",
 						summary: boundContextSummary("recovering open task requirements")
 					}
-				})];
+				}));
 			}
 		}
+		if (injected.length > 0) decision.messages = [...injected, ...decision.messages];
 		return decision;
 	});
 	ctx.on("agent/turn-stopping", async ({ agent }) => {
@@ -3650,26 +3885,20 @@ function optionalMarketOrigin(ctx, agent) {
 		return `http://${service.host === "::1" ? "[::1]" : "127.0.0.1"}:${service.port}`;
 	} catch {}
 }
-function ensureProtocolBoundary(agent, notice = PROTOCOL_V3_NOTICE) {
-	if (snapshotSessionEvents(agent.session).some((event) => {
-		if (event.type !== "user/message" || !event.data || typeof event.data !== "object") return false;
-		const data = event.data;
-		const source = data.source && typeof data.source === "object" ? data.source : void 0;
-		const content = Array.isArray(data.content) ? data.content : [];
-		return (content.length === 1 && content[0] && typeof content[0] === "object" ? content[0].text : void 0) === notice && source?.kind === "plugin" && source.plugin === "context-guard" && source.form === "notice";
-	})) return;
-	agent.session.append.bind(agent.session)("user/message", createUserMessage({
+/** Build one host-approved plugin notice user/message for step-batch delivery. */
+function pluginNoticeMessage(text, summaryLabel) {
+	return createUserMessage({
 		content: [{
 			type: "text",
-			text: notice
+			text
 		}],
 		source: {
 			kind: "plugin",
 			plugin: "context-guard",
 			form: "notice",
-			summary: boundContextSummary("Context Guard recorded a replay version boundary")
+			summary: boundContextSummary(summaryLabel)
 		}
-	}), { surfaceOp: "append" });
+	});
 }
 function hasPinnedUpdateGoalTool(agent) {
 	try {
@@ -3741,4 +3970,4 @@ function normalizeGoalState(value) {
 }
 
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, GIT_COMMAND_MANIFEST_IDS, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, MIN_RECOVERY_CHAR_BUDGET, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, classifyClause, classifyCompletionClaim, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, isCurrentAcceptedBoundary, isDeterministicCheck, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, latestAssistantText, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseGitCommandManifest, parsePwshCommand, parseShellCommand, proofDigest, proofEvidenceConstraints, qualifyBoundary, recoveryDigest, renderRecoveryPacket, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sessionQuery, sha256, snapshotSessionEvents, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, LEGACY_HOST_COHORTS, MIN_RECOVERY_CHAR_BUDGET, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, inspectTargetHostGraph, isCurrentAcceptedBoundary, isDeterministicCheck, isFrozenV042RebindResponse, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, latestAssistantText, lifecyclePhase, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parsePwshCommand, parseShellCommand, previewFirstStepInjection, proofDigest, proofEvidenceConstraints, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sessionQuery, sha256, snapshotSessionEvents, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };

package/docs/ARCHITECTURE.md

@@ -24,11 +24,31 @@ The effective plugin configuration and the DSH Session append-only log are the i
 
 The in-memory `GuardProjection` is a rebuildable cache: `deriveProjection` applies the effective activation configuration, replays the native log deterministically, recomputes every contract, evidence, and certificate, and flags `corrupt` when a recorded certificate no longer re-derives from the evidence in the log. The projection and its evidence are session-scoped: a new DSH session starts a new projection and cannot import, look up, or certify evidence IDs from another session. A completed workflow that needs a certificate must therefore produce its evidence and call `context_guard_checkpoint` in the same session. Under `always`, replay begins enabled; changing an existing profile from `opt-in` to `always` can therefore bring earlier persisted user messages into the derived contract. A recorded `/context-guard off` disables capture from that point until a later `on`. A recorded `/context-guard clear` supersedes every pending requirement and acceptance under a `CLEAR:<revision>` sentinel (prohibitions are retained) and bumps the contract revision, so a fresh empty-binding checkpoint can certify while the guard stays enabled. Captured contracts always carry a concrete subject/surface, so no unrelated evidence can close a requirement.
 
+## Session lifecycle: silent start, first-message activation
+
+The runtime separates what it injects from what it certifies. An internal lifecycle phase — `armed` (protection enabled, waiting for the first real root input), `active` (real input entered a step), `disabled` (explicitly off) — expresses the startup strategy only; certification still depends solely on durable events, the current contract, and the evidence chain.
+
+Session start (`agent/session-start`) registers tools and the runtime, reads history, and arms recovery for resume/compact. It appends nothing, so a fresh session stays blank (`seq === 0`) and a DSH preset can still be selected while the session is new. The rc.1 Web surface treats a session as blank until a `turn/start` (server preset lock) and falls back to `seq === 0` for cold list entries; Guard writes no message at T0, so both stay satisfiable.
+
+At `agent/pre-step` the loop has CLAIMED this step's input but has not persisted it yet. A pure preview reads only the validated claim: under `always`, the first claimed batch that carries a real root user message (non-empty text, or any image/attachment part) injects the `Context Guard protocol boundary: v4.0.0` notice and a compact first-step guidance message ahead of the claimed messages, inside the same step batch. The formal projection never derives from the preview — the boundary and the user message become durable events when the loop appends the batch, and the contract is re-derived from them exactly as from any other log. `opt-in` never auto-injects; delegated/subagent sessions receive no boundary, guidance, or activation (their scope arrives through the parent's delegation prompt). Rejection, cancellation, or a filtered batch injects nothing and retries on the next legal input.
+
+Recovery packets keep the existing content-dedup and ride the next entered step. The first 0.5 write into a pre-0.5 session carries the v4 boundary with it — that message is the explicit version cut: obligations and certificates recorded before it keep the frozen 0.4 rules (including exact-shape rebind replay), while later messages use the 0.5 confirmation grammar.
+
+## Unified diagnosis and preparation
+
+`deriveItemDiagnosis` is the single pure judge shared by checkpoint, recovery, the rebind item query, `context_guard_prepare`, and `/context-guard status`. Per item it reports a task kind (`inquiry`/`action`/`constraint`/…), certification support (`unsupported`/`needs_target`/`needs_evidence`/`unavailable`/`supported`), repairability (agent-repairable, needs user input, unsupported, historical gap, none), the exact missing target fields and evidence facets, and one concrete next action with a resume condition and a stable attempt fingerprint. Inquiries stay captured obligations whose honest next step is to deliver the answer; they are never prescribed a rebind. An effect recorded without its resolution prestate is a historical gap: read back observed state, never re-execute to mint evidence.
+
+`context_guard_prepare` is read-only. Before a stateful action it renders the supported command shape from the same audited parser the executor uses, the required resolution/effect/state order, reusable evidence references, the host capability verdict, and the exact missing target fields. It performs no action and never turns a guessed default into user authority.
+
+A log-derived retry ledger keys each rejected rebind attempt by its stable inputs and outcome. An identical second attempt returns `unchanged` with the resume condition instead of a fresh rejection; new related evidence, a new root instruction, or a changed target produces a new key and re-opens evaluation.
+
 ## Synchronization
 
 The runtime rebuilds the projection from the log before each step. Before evidence is produced, the runtime awaits `ctx.sessions.flush(session)`; if no durability listener participated, evidence is marked `durability-unknown`, which fails closed.
 
-The v0.3 runtime accepts host identity only from `hostLockPackages` generated from the active runtime/profile graphs and bound to the active platform/profile kind. It does not infer identity from the nearest `pnpm-lock.yaml`: DSH core and profile plugins have separate locks, and the runtime lock can contain several historical versions. Missing, unreadable, duplicate, multi-version, or drifted identity disables the dependent capability. The audited values live in `manifests/supported-host.v1.json` as an exact host cohort registry: the whole graph must atomically match one audited cohort, mixed or unknown rows fail closed, and the selected cohort identity is part of every host lock digest, so switching cohorts invalidates certificate authority. `deriveProjection` receives this exact evaluation before it replays any checkpoint, so a certificate is never validated under a default lock and overwritten later; a changed digest retains historical evidence but makes current authority stale. Ordinary persisted `bash`/`pwsh` results are replayed only when the active platform's agent-loop and terminal group is exact; wrong-platform tool names fail closed. Ordinary `read`/`write`/`edit` results require the independent filesystem group, which pins the tool schemas and result/presentation contract together with the local/sandbox provider, observation policy, sandbox policy, and approval services. A filesystem-group failure disables only `create`/`modify` and filesystem-derived facts, not an independently valid terminal action.
+The host lock uses `dsh-core/v1`: one exact 33-package DSH core, independent of optional market versions. The resolver walks all reachable runtime/profile dependencies, including those introduced by plugins, and checks installed manifests against lock identities. Missing, duplicated, mixed or changed core rows fail closed. Every replay rechecks the configured graph sources against the injected core identity before deriving certificate authority.
+
+Core manifest version 2 and its policy/cohort values change the digest without changing the shared digest-v3 encoder. Legacy injected configuration requires explicit inspection and migration; historical records are never relabelled. Action capabilities are evaluated only after this core contract succeeds. Market restart additionally requires a trusted loaded-instance verifier. Current DSH supplies none, so restart is unavailable while unrelated guarded work remains supported. A requested restart stays pending. The version-2 service adapter distinguishes ordinary provider/instance drift from a persisted, target-bound restart handoff.
 
 Evidence is produced only from persisted `tool/call` + `tool/result` pairs. Guard never inserts context between a Code Mode sub-call and its durable result.
 
@@ -51,7 +71,11 @@ A legal plugin `user/message` notice marks the 0.4.2 capture boundary. Earlier e
 
 `context_guard_rebind` accepts `operation: propose|query|withdraw`, `item_id`, `proposal_id`, `clauses`, and optional `clarification_item_ids`. It has no model confirmation flag. A proposal's 1–8 clauses must concatenate to the complete original normalized text, and its serialized body must fit 8 KiB. Each clarification ID is either empty (keep the source clause) or names a later pending direct-root item that explicitly includes that clause and preserves captured identities and method constraints. The proposal records both root sources, item/revision identities, session, epoch, contract revision, candidate action/target/acceptance, and a digest. A GUI clause cannot be mapped to an installation-only result.
 
-The tool returns a candidate without mutating the projection. A matching durable tool result registers the proposal on replay. Only a complete canonical root message `确认重绑定 <proposal ID>` commits it. Confirmation rechecks the proposal against the current contract; changed, withdrawn, cross-session, or non-durable inputs keep the old item pending. Every child is constructed before the original is marked superseded. `supersededByItems` preserves the one-to-many relation, and `reboundFrom` preserves the proposal and confirmation source. A later root clarification keeps its own authority; partitioning alone cannot authorize a new mutation. Duplicate confirmation is idempotent.
+The tool returns a candidate without mutating the projection. A matching durable tool result registers the proposal on replay. Replay validation is versioned: 0.5-era results match on structured semantic fields (status, reason code, proposal identity and digest) while display text may evolve; results carrying the frozen 0.4 response shapes validate byte-for-byte against the frozen 0.4 rules. Anything else is tampered or unknown and never replays.
+
+A proposal that would keep every clause at `generic_run` when the original is already `generic_run` is refused as `no_certification_gain`: it would spend a user confirmation without improving certification. Partition mismatches return the bounded exact source (text, length, digest) instead of a generic error.
+
+Since 0.5.0 a durable root message is one atomic confirmation transaction. The first non-empty top-level line may be the control line `确认重绑定 <proposal ID>`; the confirmation validates against the state BEFORE that message, and the remaining lines keep their own semantics — an explanation request stays conversational, a new task is captured like any other instruction, and an explicit reversal ("先不要确认") makes the whole message ambiguous and unapplied. A control string buried in a sentence, inside quotes, or inside a code block is malformed and never confirms; a matching control line that is not in first position, or two control lines, is ambiguous with no partial effect. Confirmation rechecks the proposal against the current contract; changed, withdrawn, cross-session, or non-durable inputs keep the old item pending, and a matching confirmation observed in a not-yet-durable log is reported as `not_durable` — distinguishable from one that was never sent. Every child is constructed before the original is marked superseded. `supersededByItems` preserves the one-to-many relation, and `reboundFrom` preserves the proposal and confirmation source. A later root clarification keeps its own authority; partitioning alone cannot authorize a new mutation. Duplicate confirmation is idempotent.
 
 No digest-v3 wire format or upstream fixture changes are needed. A replacement changes the item/status set and contract revision, invalidating the earlier certificate; evidence is never copied into a passed state. A fresh checkpoint must revalidate the exact action, target, executor, host lock, and transition. Evidence predating the authoritative root clause referenced by a replacement is rejected while retaining its historical ID.