dsh-completion-guard 0.5.0 → 0.5.1

package/dist/{index-Cd3wXBLi.d.ts → index-Dcee_NYF.d.ts}

@@ -53,6 +53,117 @@ declare function requestedTargetMatchesResolved(action: StatefulAction, requeste
 declare function requestedTargetAuthorizesMutation(action: StatefulAction, requested: TargetTuple | undefined, resolved: TargetTuple | undefined): boolean;
 declare function validateActionManifest(): string[];
 //#endregion
+//#region src/domain/semantics.d.ts
+/**
+* The single interpretation of a root-user instruction.
+*
+* Before 0.5.1, capture, mutation authorization and boundary qualification each
+* re-guessed what one sentence meant, and the guesses disagreed: the incident
+* instruction "按 P0—P4 完成本地实现、测试和文档，在跨平台验证前停止，不推送、
+* 不正式发布。" was captured as a *push* obligation, so the only certifiable item
+* demanded the very action its own text forbade.
+*
+* This module answers the question once. It partitions the message into
+* semantic scopes first, then reads the action inside each scope, so:
+*
+* 1. a prohibition's scope covers every coordinated action it governs, and a
+*    prohibition constrains execution instead of creating an obligation to
+*    perform the forbidden action;
+* 2. only an explicit, agent-owned, unconditional directive becomes an
+*    immediately executable duty — naming an action is not authorizing it;
+* 3. a conditional directive stays unexecuted until its condition holds, and a
+*    human-owned action never becomes agent work;
+* 4. quotation and code keep an action visible but never grant authority;
+* 5. an interpretation that cannot be resolved reads conservatively and is not
+*    executed.
+*
+* No rule here keys on a session id, an event sequence, a file name, or a fixed
+* phrase list for one incident sentence: the rules are polarity, scope,
+* executee and condition, so paraphrases, mixed languages, word-order changes
+* and punctuation changes agree with the original.
+*/
+/**
+* How one message is read.
+*
+* `coordinationSplit` is the one historical granularity switch: a message
+* captured before the 0.4.2 capture boundary keeps a coordinated action in one
+* clause, exactly as that release recorded it. Every semantic rule (polarity,
+* executee, condition, quotation) applies identically in both modes, so replay
+* stability never depends on re-reading an older message with newer semantics.
+*/
+interface InterpretOptions {
+  coordinationSplit?: boolean;
+}
+/** What one scope does with the action it names. */
+type DirectiveClass = "directive" | "prohibition" | "conditional" | "informational" | "narrative";
+/** Who is expected to perform the action. */
+type Executee = "agent" | "user" | "unresolved";
+/** How the scope's authority reads. */
+type AuthorityDisposition = "executable_now" | "conditional_wait" | "human_actor" | "informational" | "prohibition" | "unresolved";
+interface ScopeInterpretation {
+  /** Verbatim scope text, trimmed: the audit record of what was read. */
+  text: string;
+  /** The action-bearing text with leading connectors and negators removed. */
+  body: string;
+  directive: DirectiveClass;
+  executee: Executee;
+  /** The unresolved condition that must hold before the action may run. */
+  condition?: string;
+  /** The event that ends a human wait, when the source names one. */
+  resumeEvent?: string;
+  /** True only for an explicit, agent-owned, unconditional instruction. */
+  immediatelyExecutable: boolean;
+  authorityDisposition: AuthorityDisposition;
+  /** Explicitly named tool/method, when the scope names one. */
+  method?: string;
+  /** Stable identity of this interpretation, reproducible from the same bytes. */
+  fingerprint: string;
+}
+/**
+* The contract kind a scope maps to. A prohibition and an acceptance keep their
+* own lanes; everything else is a requirement. Acceptance is decided from the
+* clause's own head verb, so "确保构建通过" stays an acceptance while a
+* conditional or prohibition clause is never mislabelled.
+*/
+declare function kindOfScope(directive: DirectiveClass, body?: string): GuardItemKind;
+declare function maskCodeSpans(text: string): string;
+/** Interpret one already-segmented clause. */
+declare function interpretClause(text: string, options?: InterpretOptions): ScopeInterpretation;
+/** Interpret a whole message into independent scopes, in source order. */
+declare function interpretMessage(text: string, options?: InterpretOptions): ScopeInterpretation[];
+/**
+* Whether the item is an executable obligation right now. A prohibition is a
+* standing constraint, a human-owned action belongs to the user, a conditional
+* action waits for its condition, and an explanation is not work. None of them
+* may block completion or be certified as agent work.
+*
+* An item without an interpretation is a legacy or fixture item created before
+* this module existed; it keeps its historical executable reading.
+*/
+declare function isExecutableItem(item: {
+  kind?: string;
+  executee?: Executee;
+  authorityDisposition?: AuthorityDisposition;
+  waitAuthorization?: unknown;
+}): boolean;
+/** Whether an item is an open obligation for certification purposes. */
+declare function isOpenObligation(item: GuardItem): boolean;
+/**
+* The action a scope names. `semanticActionFromText` maps the command surface,
+* but a prohibition keeps a bare verb as its body ("不要提交并推送" → 提交并推送),
+* and the closed CJK vocabulary is consulted first so such a ban is still
+* recorded against the action it forbids.
+*/
+declare function semanticActionOfScope(body: string, source?: string, isProhibition?: boolean): ReturnType<typeof semanticActionFromText>;
+/**
+* Every stateful action the clause names, in source order. A clause may order
+* more than one ("安装插件，重启 DSH"); each is a separate evidence obligation
+* even though the clause stays one top-level item.
+*/
+declare function statefulActionsOfScope(body: string): StatefulAction[];
+/** Actions this interpretation names, in source order (diagnostics only). */
+declare function namedActions(text: string): string[];
+//#endregion
 //#region src/domain/rebind.d.ts
 interface RebindArgs {
   operation: "propose" | "query" | "withdraw";
@@ -143,10 +254,32 @@ type TypedObject = {
 };
 type Typed = boolean | number | string | TypedObject;
 interface SessionHeader {
+  /**
+  * DSH Session format version stamped into the durable header. Guard supports
+  * only the V3 session format (`3`); any other value is a different digest
+  * domain input rather than being reinterpreted as V3.
+  */
   version: number;
   id: string;
   createdAt: number;
   parentSession?: string;
+  /**
+  * Durable fork-inherited prefix length.
+  *
+  * DSH Session V3 moved this value out of the header onto the `Session`
+  * itself as `inheritedEventCount` (durably marked by `session/end-seed`); the
+  * meaning is unchanged, so the token keeps its historical name and the `v3`
+  * digest domain keeps every byte-mirrored vector identical.
+  *
+  * V3's `header.isSeeded` marker is deliberately NOT added as a digest input.
+  * It is not needed for identity — `parentSession`, `seedLength`,
+  * `delegationDepth` and `origin` already bind the fork lineage, and `id` plus
+  * `createdAt` separate distinct sessions — while adding any field (even an
+  * optional one) would change every existing digest, because an absent
+  * optional field still encodes a presence-0 row. Changing the shared digest
+  * domain is an upstream semantic decision with its own cross-repository
+  * parity gate; a host upgrade must not make it silently.
+  */
   seedLength?: number;
   agentPreset?: string;
   origin?: string;
@@ -231,6 +364,34 @@ interface GuardItem {
   legacyFlags?: Array<"legacy_generic_run" | "legacy_authority_unclassified">;
   /** v0.5 intent layer: inquiries keep the obligation but are not machine certifiable. */
   taskKind?: "inquiry" | "action";
+  /**
+  * v0.5.1 interpretation layer, derived from the same source bytes as
+  * {@link normalizedText} by `domain/semantics.ts`. These fields record what
+  * the message actually authorized, so a prohibition, a human-owned action, a
+  * conditional action and an explanation can never become an agent obligation.
+  * Absent on legacy items, which keep their historical executable reading.
+  */
+  directive?: DirectiveClass;
+  executee?: Executee;
+  authorityDisposition?: AuthorityDisposition;
+  /** The unresolved condition guarding a `conditional_wait` item. */
+  condition?: string;
+  /** The event that ends a human wait, when the source names one. */
+  resumeEvent?: string;
+  /** Stable identity of the interpretation these fields came from. */
+  interpretationFingerprint?: string;
+  /**
+  * Every stateful action this item's clause names, in source order, with the
+  * target captured for each. A clause may order more than one action
+  * ("安装插件，重启 DSH"): the item stays one top-level obligation, and every
+  * action it names needs its own matching evidence before it can close.
+  */
+  actionPlan?: Array<{
+    action: "install" | "apply" | "create" | "modify" | "restart" | "commit" | "push" | "publish" | "pull" | "fetch";
+    requestedTarget: TargetTuple;
+    targetCaptureStatus: TargetCaptureStatus;
+    targetCaptureReasonCode?: TargetCaptureReasonCode;
+  }>;
   waitAuthorization?: WaitAuthorization;
   deferAuthorization?: DeferAuthorization;
   persistenceAuthorization?: PersistenceAuthorization;
@@ -290,6 +451,20 @@ interface EvidenceBinding {
   resolutionEvidenceId?: string;
   effectEvidenceId?: string;
   stateEvidenceIds?: string[];
+  /**
+  * Per-action closure for a clause that ordered several actions. Every entry
+  * of {@link GuardItem.actionPlan} needs its own entry here: one action's
+  * evidence never covers another action, and two instances of the same action
+  * on different targets are two separate entries.
+  */
+  actionBindings?: BindingActionClosure[];
+}
+interface BindingActionClosure {
+  action: StatefulAction;
+  evidenceIds: string[];
+  resolvedTarget: TargetTuple;
+  /** Position of this action in the clause's instruction order. */
+  order: number;
 }
 interface GuardCheckpoint {
   id: string;
@@ -308,8 +483,8 @@ interface GuardCheckpoint {
   certificationDigest: string;
   result: "certified" | "incomplete" | "unknown";
 }
-type BoundaryDisposition = "user_wait" | "external_wait" | "deferred";
-type BoundaryQualificationKind = "user_decision_item" | "root_explicit_wait" | "external_operation_pending" | "root_explicit_defer";
+type BoundaryDisposition = "user_wait" | "external_wait" | "deferred" | "guard_bounded_stop";
+type BoundaryQualificationKind = "user_decision_item" | "root_explicit_wait" | "external_operation_pending" | "root_explicit_defer" | "guard_no_progress";
 interface GuardBoundary {
   protocolVersion: "1";
   id: string;
@@ -371,6 +546,32 @@ interface GuardProjection {
   continuationAttempts: Map<number, number>;
   /** Process-local one-shot fallback counters keyed by epoch + contract revision. */
   persistenceCorrectionAttempts: Map<string, number>;
+  /**
+  * The no-progress budget, rebuilt from the durable log.
+  *
+  * Keyed by progress fingerprint, then by the boundary the claim was decided
+  * at, holding the attempt number that boundary was given. Keyed by boundary
+  * rather than counted per fingerprint on purpose: the same boundary processed
+  * twice — a retry, with or without the projection being re-derived in between
+  * — maps to the same key and therefore the same attempt, so a retry cannot
+  * spend the budget twice, while a genuinely new boundary adds a new key.
+  */
+  noProgressClaims: Map<string, Map<string, number>>;
+  /**
+  * Root event sequences whose control request Guard already carried to the
+  * host. A pause is a one-shot input: once the host has paused, the same
+  * message stays in the log forever, and re-reading it must not re-pause a goal
+  * the human has since resumed.
+  */
+  handledControlSeqs: Set<number>;
+  /**
+  * The host turn the projection is currently in, taken from the host's own
+  * durable `turn/start` event. This is the turn boundary's identity: the host
+  * opens it before it claims input or runs pre-step, so it is stable across a
+  * reload, it does not move when Guard writes its own bookkeeping, and a retry
+  * of the same turn re-reads the same number.
+  */
+  hostTurn?: number;
   /** Log-derived count of rejected rebind attempts by stable attempt key; survives reload. */
   rebindRejections: Map<string, number>;
   integrity: GuardIntegrity;
@@ -451,11 +652,12 @@ interface BoundaryEffectuation {
 declare function effectuateBoundary(boundary: GuardBoundary, access: GoalBoundaryAccess): Promise<BoundaryEffectuation>;
 //#endregion
 //#region src/domain/capture.d.ts
-interface ClassifiedClause {
-  kind: GuardItemKind;
-  body: string;
-}
-declare function classifyClause(text: string): ClassifiedClause;
+/**
+* Whether a clause opens with an explicit ban. The lane question ("is this a
+* constraint or a duty?") is answered by {@link ScopeInterpretation}; this stays
+* exported because the framing/segmentation callers ask it directly.
+*/
+declare function classifyClause(text: string): GuardItemKind;
 /**
 * Detect an explicitly named tool/method in a clause ("使用 bash 创建",
 * "via bash", "bash to create"). Returns the canonical tool id (e.g. 'bash')
@@ -485,27 +687,40 @@ interface CaptureScope {
 declare function extractArtifactPaths(text: string): string[];
 /**
 * Split a single human message into independently tracked clauses. Sentence
-* boundaries and embedded prohibition keywords delimit segments so a compound
-* instruction such as "Modify src/a.ts and src/b.ts. Do not push." yields
-* separate items instead of collapsing into one artifact.
+* boundaries and negations delimit segments so a compound instruction such as
+* "Modify src/a.ts and src/b.ts. Do not push." yields separate items instead of
+* collapsing into one artifact.
+*
+* Segmentation asks {@link interpretMessage} where the semantic scopes are, so a
+* negation keeps its whole coordinated span ("不推送、不发布" is two
+* prohibitions, not one requirement) and a mixed sentence keeps both executees.
 */
 interface ClauseSegment {
   kind: GuardItemKind;
+  /** Action-bearing text used for target, method and operation extraction. */
   body: string;
+  /** Verbatim source scope, kept for the audit record. */
+  text: string;
   paths: string[];
+  /** The one interpretation this segment came from; never re-derived downstream. */
+  interpretation: ScopeInterpretation;
 }
-declare function segmentClauses(text: string, captureVersion?: "v041" | "v042"): ClauseSegment[];
+declare function segmentClauses(text: string, options?: InterpretOptions): ClauseSegment[];
 /**
 * Build a GuardItem from an already-classified clause body and a resolved
 * verification subject/surface.
+*
+* The optional `interpretation` carries the scope reading taken from the same
+* bytes. It is passed through rather than re-derived, so the obligation lane and
+* the authority of one clause cannot disagree between callers.
 */
-declare function captureItem(kind: GuardItemKind, body: string, sourceMessageId: string, id: string, revision: number, subject: string, surface: "artifact" | "scope", method?: string, operation?: GuardOperation, captureVersion?: "v041" | "v042"): GuardItem;
+declare function captureItem(kind: GuardItemKind, body: string, sourceMessageId: string, id: string, revision: number, subject: string, surface: "artifact" | "scope", method?: string, operation?: GuardOperation, interpretation?: ScopeInterpretation): GuardItem;
 /**
 * Capture one contract clause. Every captured item receives a concrete
 * verification contract: a named artifact path (artifact surface) or the
 * session scope (scope surface), so an unrelated file read can never close it.
 */
-declare function captureClause(text: string, sourceMessageId: string, id: string, revision: number, scope?: CaptureScope): GuardItem;
+declare function captureClause(text: string, sourceMessageId: string, id: string, revision: number, scope?: CaptureScope, options?: InterpretOptions): GuardItem;
 //#endregion
 //#region src/domain/checkpoint.d.ts
 interface RejectedBinding {
@@ -608,10 +823,91 @@ declare function authorityCaptureCounts(blocks: readonly AuthorityBlock[]): Reco
 /** One authoritative contract identity shared by checkpoints and boundaries. */
 declare function currentContractDigest(projection: GuardProjection): string;
 //#endregion
+//#region src/domain/host-version.d.ts
+/**
+* DSH host version support policy.
+*
+* Context Guard 0.5.1 supports **DSH >= 0.1.5-rc.1** and nothing older. The
+* policy is one value with one comparison, used by the install entry
+* (`peerDependencies`), by the runtime host readback, and by the decision tests
+* — so the advertised range and the enforced range cannot drift apart.
+*
+* ## Why a range is not enough on its own
+*
+* npm's SemVer prerelease rule is narrower than "0.1.5-rc.1 or newer": a
+* version carrying a prerelease satisfies a comparator set only when some
+* comparator in that set names the SAME `major.minor.patch` tuple and itself
+* carries a prerelease. For the range `>=0.1.5-rc.1` that means:
+*
+* | Candidate          | Satisfies `>=0.1.5-rc.1` | Why |
+* | ---                | ---                      | --- |
+* | `0.1.5-rc.1`       | yes | the bound itself |
+* | `0.1.5-rc.2`       | yes | same tuple, comparator has a prerelease |
+* | `0.1.5`            | yes | a release is ordered after its own prereleases |
+* | `0.1.6`, `0.2.0`   | yes | higher release |
+* | `0.1.6-rc.1`       | **no** | prerelease of a DIFFERENT tuple |
+* | `0.2.0-rc.1`       | **no** | prerelease of a DIFFERENT tuple |
+* | `0.1.4`, `0.1.5-alpha.9` | no | below the bound |
+*
+* No finite SemVer range expresses "every future prerelease at any base", and
+* an unconditional `*` would drop the lower bound entirely. The range is
+* therefore the honest, conservative install-time statement, and this module is
+* the explicit runtime/decision path for the policy itself: {@link
+* compareHostVersions} accepts a future different-base RC by the documented
+* policy while {@link evaluateMinimumHostVersion} still refuses anything below
+* the minimum. An unobserved new-base RC remains `unverified` for host-lock
+* purposes — the version policy never substitutes for the exact-graph host
+* audit.
+*/
+/** Lowest supported DSH host version. DSH packages version independently of Cordis. */
+declare const MIN_SUPPORTED_HOST_VERSION = "0.1.5-rc.1";
+/**
+* The exact npm range published in `peerDependencies`. It is deliberately the
+* plain lower bound plus the documented prerelease caveat above.
+*/
+declare const SUPPORTED_HOST_RANGE: string;
+interface ParsedHostVersion {
+  major: number;
+  minor: number;
+  patch: number;
+  /** Dot-separated prerelease identifiers; empty for a release version. */
+  prerelease: readonly string[];
+}
+declare function parseHostVersion(value: string): ParsedHostVersion | undefined;
+/**
+* SemVer precedence comparison, including the prerelease rules. Returns
+* `undefined` for a value that is not a version this module can order, so an
+* unparseable host version fails closed rather than sorting as "newer".
+*/
+declare function compareHostVersions(a: string, b: string): number | undefined;
+type HostVersionStatus = "supported" | "below_minimum" | "unparseable";
+interface HostVersionDecision {
+  status: HostVersionStatus;
+  version: string;
+  minimum: string;
+  reasonCode: "host_version_supported" | "host_version_below_minimum" | "host_version_unparseable";
+}
+/** Decide the version-policy half of host support. Never a substitute for the graph lock. */
+declare function evaluateMinimumHostVersion(version: string, minimum?: string): HostVersionDecision;
+/**
+* Whether npm's own range resolution would admit this version for
+* {@link SUPPORTED_HOST_RANGE}. Used by the decision tests to keep the
+* documented prerelease table true, and by diagnostics to explain why an
+* install did not resolve.
+*/
+declare function satisfiesSupportedHostRange(version: string): boolean;
+//#endregion
 //#region src/domain/host-lock.d.ts
 type HostLockStatus = "supported" | "unsupported" | "unavailable";
 type HostPlatform = "posix" | "windows";
 type HostProfileKind = "headless" | "web";
+/**
+* How a cohort's package rows were established. Bound into every host-lock
+* digest through the `host_audit_provenance` capability row, so a certificate
+* records whether the exact graph it used was loaded on a native host or only
+* resolved from the registry.
+*/
+type HostAuditProvenance = "native-audited" | "registry-derived-pending-native-audit";
 interface HostCohort {
   /** Stable cohort identity; bound into every hostLockDigest via `host_cohort`. */
   id: string;
@@ -619,10 +915,19 @@ interface HostCohort {
   supportedGoalVersions: string[];
   /**
   * Platforms where this cohort's exact package graph was extracted from a
-  * native host and audited. Other platforms fail closed; integrity must not
-  * be inferred across platforms.
+  * native host and audited. A cohort with no native audit has an empty list
+  * here even while it accepts evaluations — see {@link acceptedPlatforms}.
   */
   auditedPlatforms: readonly HostPlatform[];
+  /**
+  * Platforms on which the cohort may evaluate to `supported`. This is the
+  * gating list; a platform outside it fails closed with
+  * `host_cohort_platform_not_audited`. `auditedPlatforms` remains the stricter
+  * fact and `auditProvenance` states which one a certificate actually rests
+  * on, so a registry-derived graph is never silently reported as a native pass.
+  */
+  acceptedPlatforms: readonly HostPlatform[];
+  auditProvenance: HostAuditProvenance;
   packages: PackageRow[];
   capabilities: CapabilityRow[];
 }
@@ -644,27 +949,39 @@ declare const ALPHA2_DSHMARKET_139_HOST_PACKAGES: PackageRow[];
 /**
 * Historical audited host cohort registry. Every entry keeps the exact package
 * identities audited natively for a past Guard release (CG-DSH-001 whole-graph
-* contracts). These are historical verification facts only: since 0.5.0 the
-* active support target is `0.1.2-rc.1`, so an installed graph from any of
+* contracts). These are historical verification facts only: since 0.5.1 the
+* active support targets are `0.1.5-rc.1` and `0.1.5-rc.2`, so an installed graph from any of
 * these cohorts — including previous RCs and alphas — is no longer an active
 * support entry and fails closed in `evaluateHostLock`.
 */
 declare const LEGACY_HOST_COHORTS: readonly HostCohort[];
+/** Baseline cohort retained for callers that need a default fixture. */
+declare const ACTIVE_HOST_COHORT_ID = "dsh-0.1.5-rc.1";
+declare const ACTIVE_HOST_COHORT_IDS: readonly string[];
 /** Core-lock/v1 separates optional market identity from the audited DSH graph.
-* The active support target is exactly one audited cohort, `0.1.2-rc.1`:
+* The active support targets are the exact registered rc.1 and rc.2 graphs:
 * historical cohorts stay in `LEGACY_HOST_COHORTS` as verification data but are
 * never silently re-labelled as accepted active locks, and an installed
-* historical graph fails closed under `evaluateHostLock`.
+* historical graph fails closed under `evaluateHostLock`. The version policy
+* (`>=0.1.5-rc.1`) and the graph lock are separate judgments: a newer host that
+* has not been registered here is "unverified / pending audit", never
+* supported by range alone.
 */
 declare const HOST_COHORTS: readonly HostCohort[];
 /**
-* rc.1 audited package identities: the active support cohort since 0.5.0. The
-* audited cohort is an atomic whole-graph contract (CG-DSH-001): any drifted,
-* duplicated, unknown-version, unbound, OR MISSING row fails the whole lock
-* closed (`host_lock_missing`); no capability inherits independence from a
-* partially present graph.
+* Baseline fixture package identities (DSH 0.1.5-rc.1). The cohort
+* is an atomic whole-graph contract (CG-DSH-001): any drifted, duplicated,
+* unknown-version, unbound, OR MISSING row fails the whole lock closed
+* (`host_lock_missing`); no capability inherits independence from a partially
+* present graph.
 */
 declare const EXPECTED_HOST_PACKAGES: PackageRow[];
+/**
+* The `@deepseek-ai/dsh` launcher version of the baseline fixture, read from the
+* cohort rows rather than hardcoded, so a cohort bump cannot leave a stale
+* literal behind in the target-inspection path.
+*/
+declare const ACTIVE_HOST_LAUNCHER_VERSION: string | undefined;
 declare const BASE_HOST_PACKAGES: ReadonlySet<string>;
 declare const GOAL_HOST_PACKAGES: ReadonlySet<string>;
 type HostCapabilityId = "agent_loop" | "terminal_posix" | "terminal_windows" | "dsh_cli" | "plugin_inventory" | "web_control" | "jobs" | "filesystem";
@@ -681,14 +998,28 @@ interface HostLockEvaluation {
   status: HostLockStatus;
   digest: string;
   goalAvailable: boolean;
-  reasonCode?: "host_lock_migration_required" | "host_lock_installed_graph_drift" | "host_lock_missing" | "host_lock_version_mismatch" | "host_lock_integrity_mismatch" | "host_lock_unknown_package" | "host_lock_duplicate_package" | "host_lock_goal_graph_incomplete" | "host_lock_goal_capability_mismatch" | "host_lock_cohort_mixed_graph" | "host_lock_cohort_unbound_identity" | "host_lock_cohort_platform_not_audited";
+  reasonCode?: "host_lock_migration_required" | "host_lock_installed_graph_drift" | "host_lock_missing" | "host_lock_version_mismatch" | "host_lock_version_below_minimum" | "host_lock_version_unparseable" | "host_lock_integrity_mismatch" | "host_lock_unknown_package" | "host_lock_duplicate_package" | "host_lock_goal_graph_incomplete" | "host_lock_goal_capability_mismatch" | "host_lock_cohort_mixed_graph" | "host_lock_cohort_unbound_identity" | "host_lock_cohort_platform_not_audited";
   packages: PackageRow[];
   capabilities: Record<HostCapabilityId, HostCapabilityEvaluation>;
   platform?: HostPlatform;
   profileKind?: HostProfileKind;
   liveGoalAvailable?: boolean;
+  /**
+  * The version-policy half of host support, decided separately from the graph.
+  * A host below the minimum is refused here even when its graph matches an
+  * audited cohort, and an in-range version never substitutes for the
+  * exact-graph audit: the two are independent facts, both reported.
+  */
+  hostVersion?: HostVersionDecision;
   /** Readback of the audited cohort the supplied graph was evaluated against. */
   cohortId?: string;
+  /**
+  * Readback of how that cohort's rows were established. `registry-derived-
+  * pending-native-audit` means the exact published graph was verified but no
+  * native host load has happened yet; a certificate must never present that as
+  * a native pass.
+  */
+  auditProvenance?: HostAuditProvenance;
   /** Audited cohort rows absent from the supplied graph (diagnostic). */
   missingPackages?: string[];
 }
@@ -696,7 +1027,21 @@ interface HostLockContext {
   platform?: HostPlatform;
   profileKind?: HostProfileKind;
   capabilityId?: string;
+  /**
+  * The DSH host version the graph was read from, when the caller read one.
+  * Supplying it turns the version policy into a production decision; omitting
+  * it leaves the version question unanswered rather than assumed supported.
+  */
+  hostVersion?: string;
 }
+/**
+* The host version a package graph records, for the version-policy decision.
+*
+* Every DSH package versions with the host, so the graph's own `dsh` row is the
+* version the caller is running. A graph without that row leaves the version
+* unknown, and an unknown version is not treated as supported.
+*/
+declare function hostVersionFromPackages(rows: readonly PackageRow[]): string | undefined;
 type HostCohortSelectionReason = "host_cohort_unknown_package" | "host_cohort_version_mismatch" | "host_cohort_integrity_mismatch" | "host_cohort_mixed_graph" | "host_cohort_incomplete_graph" | "host_cohort_unbound_identity" | "host_cohort_platform_not_audited";
 interface HostCohortSelection {
   /**
@@ -783,7 +1128,7 @@ declare const PROTOCOL_V4_NOTICE = "Context Guard protocol boundary: v4.0.0";
 * Pure, deterministic re-derivation of the guard projection from the DSH
 * native event log. Context Guard never writes custom session events, so every
 * piece of state is derived from `command/run`, `user/message`, `tool/call`,
-* `tool/result`, `tool/code-dispatch-start`, `tool/code-dispatch`, and
+* `tool/result`, `tool/ptc-dispatch-start`, `tool/ptc-dispatch`, and
 * `compaction/summary`.
 */
 declare function deriveProjection(sourceEvents: readonly DerivedEnvelope[], config: DeriveConfig, scope: DeriveScope, durableConfirmed: boolean, hostLock?: HostLockEvaluation): DeriveResult;
@@ -1073,6 +1418,18 @@ declare class HostProfileError extends Error {
 * callers cannot silently select a nearest instance.
 */
 declare function packageRowsFromPnpmLock(text: string, names?: readonly string[]): PackageRow[];
+/**
+* The production host verdict: the version floor and the exact-graph audit,
+* combined into the one answer a caller acts on.
+*
+* The two facts stay separable — `hostVersion` is always reported on the
+* evaluation — but a host below the supported floor is refused here even when
+* its graph matches an audited cohort, because no graph can lift a version
+* floor. Keeping this combination out of `evaluateHostLock` leaves that
+* function a pure graph audit, so a graph verdict is never overwritten by a
+* version verdict inside it.
+*/
+declare function combineHostPolicy(evaluation: HostLockEvaluation): HostLockEvaluation;
 declare function resolveInstalledHostLock(moduleUrl?: string): HostLockEvaluation;
 /**
 * Resolve only package identities reachable from the active pnpm importer.
@@ -1356,22 +1713,130 @@ declare function renderRecoveryPacket(projection: GuardProjection, options?: Rec
 /** Exact 34-row rc.1 runtime/web graph from the 2026-09-03 native macOS audit. */
 declare const RC1_HOST_PACKAGES: PackageRow[];
 //#endregion
+//#region src/domain/rc015-host.d.ts
+/**
+* Exact 33-row DSH 0.1.5-rc.1 core graph.
+*
+* Provenance: every row is the npm registry `dist.integrity` of the exact
+* published tarball for the named version, read from
+* `https://registry.npmjs.org/<name>/0.1.5-rc.1` (and `4.0.2` for
+* `@deepseek-ai/cordis`, which is versioned independently of DSH). The single
+* resolver for this graph is an isolated DSH installation plus the repository
+* worktree lockfile, both installed from the public registry.
+*
+* This is a REGISTRY-DERIVED graph, not a natively audited one: the cohort
+* carries `auditedPlatforms: []` until a native macOS/Windows host audit runs,
+* and `auditProvenance: 'registry-derived-pending-native-audit'` is bound into
+* the host-lock digest so a certificate can never claim a native pass this round
+* did not produce. (`acceptedPlatforms` is the separate, wider gate: this cohort
+* accepts evaluation on both platforms while claiming an audit on neither.)
+* `dshmarket` is deliberately absent: market identity is verified independently
+* by the action adapter and never participates in the core lock.
+*
+* The row-name set is unchanged from the historical 0.1.2-rc.1 cohort's 33
+* core rows: no package entered or left the audited core graph, so a future
+* reader must not infer a graph change from the version bump alone. The count
+* is asserted from this list, never assumed.
+*/
+declare const RC015_HOST_PACKAGES: PackageRow[];
+//#endregion
+//#region src/domain/rc015-rc2-host.d.ts
+/** Exact npm registry identities for DSH 0.1.5-rc.2 (Cordis 4.0.2).
+* Native acceptance is recorded separately; these rows are registry-derived.
+*/
+declare const RC015_RC2_HOST_PACKAGES: PackageRow[];
+//#endregion
 //#region src/domain/session-events.d.ts
 /**
-* Read a stable snapshot from both legacy DSH Sessions and the rc.1 Session
-* API. rc.1 replaced the public `events` getter with `snapshotEvents()`; the
-* structural adapter keeps older audited cohorts working without widening the
-* accepted event contract.
+* Read a validated, stable event snapshot from the DSH Session V3 API.
+*
+* Session V3 replaced the V2 `events` getter with `snapshotEvents()`. Context
+* Guard supports only the V3 API: a session object that does not expose that
+* method is an unsupported host, never a reason to fall back to a legacy
+* accessor. Failing loud here keeps a V2-shaped object from being projected as
+* if its events had V3 semantics — the two vocabularies differ (surfaces,
+* `assistant/chunk` vs embedded streams, `session/end-seed` payload), so a
+* silent fallback would derive contract state from a log it cannot read.
+*
+* Guard is a READER of the durable log, so the envelope check below is the one
+* part of log validation it owns itself. The host validates a session it
+* constructs or restores; Guard additionally refuses a snapshot that is not a
+* sequence of event envelopes, because a projection that silently dropped or
+* mis-numbered an event would fabricate contract state rather than report a
+* damaged log.
+*
+* The V3 contract also asks a reader to refuse an unrecognized event type that
+* is not marked `ignorable`. Guard does NOT implement that half, deliberately:
+* the host's persistence reader already refuses such a log before publishing a
+* Session, and a whitelist of event types Guard happens to know would
+* false-refuse a healthy host whose composition registers a required event type
+* through a third-party plugin. The full rationale is in
+* `UPSTREAM_API_AUDIT.md`; revisit it there rather than adding a whitelist here.
 */
+declare const SESSION_API_UNSUPPORTED = "session_api_unsupported";
+declare const SESSION_EVENT_ENVELOPE_INVALID = "session_event_envelope_invalid";
+declare class SessionApiError extends Error {
+  readonly code: string;
+  constructor(message: string, code?: string);
+}
+/** The V3 session surface Guard reads: one bounded, immutable event snapshot. */
+interface V3SessionLike {
+  snapshotEvents(fromSeq?: number, toSeqExclusive?: number): readonly unknown[];
+}
 declare function snapshotSessionEvents(session: unknown): readonly unknown[];
 //#endregion
 //#region src/domain/stop-policy.d.ts
+/**
+* What "relevant progress" means, as one value.
+*
+* The inputs are the recorded state a caller could not have faked without
+* changing the work itself: the epoch and contract revision, the open items and
+* their blockers, the qualified evidence set, the boundary qualifications
+* available right now, and the Goal's identity and activation. Deliberately
+* absent: timestamps, event counts, wording, checkpoint bodies, and the Goal
+* *revision* — editing a Goal's text is not progress, and treating it as such
+* would let a re-statement reset the stop budget.
+*/
+/**
+* How many times the same progress fingerprint must be observed at a turn
+* boundary before Guard stops the automatic continuation.
+*
+* The first sighting is a baseline, not a stalled turn: it is the state a turn
+* either advanced to or started from, and the host's driver owns continuation
+* there. The second sighting is the first turn that produced nothing new, which
+* earns the one diagnosis and correction opportunity. The third is the bounded
+* stop. The count is a resource bound on repetition, never a way to declare the
+* task finished.
+*/
+declare const NO_PROGRESS_TURNS_BEFORE_STOP = 3;
+/** Marks the durable no-progress record; replay reads the budget from these. */
+declare const NO_PROGRESS_RECORD_PREFIX = "Context Guard no-progress record: ";
+/**
+* The identity of the turn boundary a decision is taken at.
+*
+* Guard does not own the host's turn counter, and a retry must be recognisable
+* as the same boundary rather than as a new one. The last durable event is that
+* identity: it is derivable from the log alone, it is stable across a reload,
+* and it only advances when the session actually records something new.
+*/
+declare function decisionBoundaryKey(projection: GuardProjection): number | undefined;
+declare function progressFingerprint(projection: GuardProjection): string;
 type CompletionDisposition = "complete" | "user_wait" | "external_wait" | "report";
 declare function isWholeTaskCompletionClaim(text: string): boolean;
 declare function classifyCompletionClaim(text: string): CompletionDisposition;
 interface TurnStoppingDecision {
   action: "continue" | "stop";
   reason?: string;
+  /**
+  * The no-progress attempt this decision asks the caller to record durably.
+  * Recording is the caller's job because it is a durable side effect; deciding
+  * is this function's job and must stay free of them.
+  */
+  noProgressClaim?: {
+    fingerprint: string;
+    boundaryKey: string;
+    attempt: number;
+  };
 }
 interface AssistantOutcomeObservation {
   kind: "completion_claim" | "user_wait_claim" | "external_wait_claim" | "report";
@@ -1388,6 +1853,27 @@ declare function observeAssistantOutcome(text: string): AssistantOutcomeObservat
 */
 declare function decideTurnBoundary(projection: GuardProjection): TurnStoppingDecision;
 declare function decideTurnStopping(projection: GuardProjection, _assistantText: string, _turn: number, _maxAttempts: number): TurnStoppingDecision;
+/**
+* Whether the last trusted ROOT instruction asked to pause.
+*
+* The source filter is the contract, not a heuristic: a quoted log, a tool
+* result, a plugin notice or a model message is not a `user/message` with
+* `source.kind === 'user'`, so none of them can reach this function at all, and
+* neither can the model's own summary of one. A negated pause ("不要暂停") is not
+* a pause request, and the check is anchored to a clause head so a pause word
+* mentioned inside a longer instruction is not a control request.
+*/
+declare function latestRootInstruction(events: readonly {
+  type: string;
+  seq?: number;
+  data: unknown;
+}[]): {
+  text: string;
+  seq: number;
+} | undefined;
+/** Marks a root control request Guard has already carried to the host. */
+declare const CONTROL_RECORD_PREFIX = "Context Guard control record: ";
+declare function isRootPauseRequest(text: string): boolean;
 declare function latestAssistantText(events: readonly {
   type: string;
   data: unknown;
@@ -1396,4 +1882,4 @@ declare function latestAssistantText(events: readonly {
 //#region src/domain/supersession.d.ts
 declare function supersedeItem(items: Map<string, GuardItem>, oldId: string, replacement: GuardItem): boolean;
 //#endregion
-export { ActiveProfileHostLock as $, isFrozenV042RebindResponse as $n, VerificationContract as $r, Repairability as $t, createProofManifest as A, semanticActionFromText as Ai, HostPlatform as An, DerivedEnvelope as Ar, parseGitCommandManifest as At, COMMAND_SURFACE_MANIFEST as B, selectHostCohort as Bn, GuardEvidence as Br, parseShellCommand as Bt, ProofKind as C, SemanticAction as Ci, HostCapabilityRequest as Cn, qualifyBoundary as Cr, GitTargetIdentity as Ct, SessionQuery as D, requestedTargetAuthorizesMutation as Di, HostLockContext as Dn, DeriveConfig as Dr, createGitPrestateEnvelope as Dt, ProofSurface as E, isStatefulAction as Ei, HostCohortSelectionReason as En, DeferAuthorization as Er, commitTreeSnapshotDigest as Et, EvidenceFacetCoverage as F, normalizeClause as Fi, bindLiveGoalCapability as Fn, ExpectedTransition as Fr, ParsedShell as Ft, ClaimedMessage as G, authorityCaptureCounts as Gn, GuardOperation as Gr, ToolSubject as Gt, ManifestIssue as H, AuthorityBlock as Hn, GuardItem as Hr, hasCurrentCertificate as Ht, bindingSatisfies as I, sanitizeClauseText as Ii, evaluateExternalWaitCapability as In, ExternalOperation as Ir, ShellParseStatus as It, FirstStepPreviewInput as J, UserInteractionKind as Jn, PersistenceAuthorization as Jr, extractToolSubject as Jt, FIRST_STEP_GUIDANCE as K, segmentAuthorityBlocks as Kn, GuardProjection as Kr, evidenceFromPersistedToolResult as Kt, evidenceCoverage as L, sanitizeUrl as Li, evaluateHostCapability as Ln, GoalRef as Lr, canonicalArgvFromCommand as Lt, proofEvidenceConstraints as M, validateActionTarget as Mi, HostToolSurface as Mn, EvidenceOutcome as Mr, verifiedLinearCommitReadback as Mt, sessionQuery as N, canonicalizePath as Ni, LEGACY_HOST_COHORTS as Nn, EvidenceParseStatus as Nr, CanonicalArgv as Nt, bindProofToProjection as O, requestedTargetMatchesResolved as Oi, HostLockEvaluation as On, DeriveResult as Or, executeRevalidatedGitEffect as Ot, validateProofManifest as P, digestStrings as Pi, bindExecutableIdentity as Pn, EvidenceRole as Pr, CanonicalCommandSurface as Pt, previewFirstStepInjection as Q, ParsedConfirmation as Qn, TargetValue as Qr, DiagnosisNextAction as Qt, evidenceMatchesItem as R, sha256 as Ri, evaluateHostLock as Rn, GuardBoundary as Rr, isRunExecutable as Rt, PROOF_PROTOCOL_VERSION as S, SUPPORTED_EVIDENCE_ADAPTERS as Si, HostCapabilityId as Sn, isCurrentAcceptedBoundary as Sr, GitPrestateEnvelope as St, ProofObligation as T, actionCompatible as Ti, HostCohortSelection as Tn, BoundaryQualificationKind as Tr, commitIndexSnapshotDigest as Tt, OperationVerbEntry as U, AuthorityBlockKind as Un, GuardItemKind as Ur, ToolCallInput as Ut, CommandSurfaceManifest as V, currentContractDigest as Vn, GuardIntegrity as Vr, goalCompletionDenial as Vt, validateManifest as W, AuthorityKind as Wn, GuardItemStatus as Wr, ToolResultInput as Wt, claimedBatchHasRealRootInput as X, classifyUserInteraction as Xn, TargetCaptureStatus as Xr, withDurability as Xt, LifecyclePhase as Y, classifyTaskIntent as Yn, TargetCaptureReasonCode as Yr, isDeterministicCheck as Yt, lifecyclePhase as Z, CONFIRM_LINE_PATTERN as Zn, TargetTuple as Zr, CertificationSupport as Zt, openItems as _, ActionSpec as _i, ExecutableIdentityBinding as _n, BoundaryRequest as _r, GitCommandParseResult as _t, classifyCompletionClaim as a, RebindArgs as ai, relevantEvidence as an, ClassifiedClause as ar, inspectTargetHostGraph as at, ALPHA3_HOST_PACKAGES as b, STATEFUL_ACTIONS as bi, HOST_COHORTS as bn, availableBoundaryQualifications as br, GitEffectRunner as bt, isWholeTaskCompletionClaim as c, proposeRebind as ci, PROTOCOL_V4_NOTICE as cn, captureItem as cr, readActiveHostGraph as ct, snapshotSessionEvents as d, rebindAttemptKey as di, ALPHA2_HOST_PACKAGES as dn, extractMethod as dr, verifyComposedHostLockDump as dt, WaitAuthorization as ei, TaskKind as en, parseConfirmationMessage as er, HostProfileError as et, RC1_HOST_PACKAGES as f, rebindResponse as fi, AuditedExecutable as fn, extractOperation as fr, GIT_COMMAND_MANIFEST_IDS as ft, closingHint as g, ActionManifest as gi, ExecutableIdentity as gn, BoundaryQualification as gr, GitCommandManifest as gt, RecoveryOptions as h, ACTION_MANIFEST_VERSION as hi, EXPECTED_HOST_PACKAGES as hn, BoundaryEffectuation as hr, GitCommandAccepted as ht, TurnStoppingDecision as i, ProposeOutcome as ii, itemDiagnosis as in, CaptureScope as ir, injectActiveProfileHostLock as it, proofDigest as j, validateActionManifest as ji, HostProfileKind as jn, EvidenceBinding as jr, revalidateGitPrestate as jt, canonicalProjection as k, semanticActionFromCommand as ki, HostLockStatus as kn, DeriveScope as kr, gitCommandMatchesTarget as kt, latestAssistantText as l, proposeRebindOutcome as li, deriveProjection as ln, classifyClause as lr, resolveActiveProfileHostLock as lt, MIN_RECOVERY_CHAR_BUDGET as m, ACTION_MANIFEST as mi, DEFAULT_HOST_LOCK as mn, segmentClauses as mr, GitAdapterAction as mt, AssistantOutcomeObservation as n, PackageRow as ni, deriveItemDiagnosis as nn, RejectedBinding as nr, hostLockContextFromComposedDump as nt, decideTurnBoundary as o, RebindProposal as oi, CAPTURE_V042_NOTICE as on, ClauseSegment as or, packageRowsFromActiveGraph as ot, DEFAULT_RECOVERY_CHAR_BUDGET as p, replayRebindResult as pi, BASE_HOST_PACKAGES as pn, isInformationalMessage as pr, GIT_COMMAND_TEMPLATES as pt, FirstStepInjection as q, TaskIntent as qn, HostStatus as qr, extractTextContent as qt, CompletionDisposition as r, BoundedSource as ri, evidenceAvailabilityReason as rn, certifyCheckpoint as rr, hostLockRowsFromComposedDump as rt, decideTurnStopping as s, confirmRebind as si, PROTOCOL_V3_NOTICE as sn, captureClause as sr, packageRowsFromPnpmLock as st, supersedeItem as t, createProjection as ti, UnifiedItemDiagnosis as tn, CheckpointResult as tr, TargetHostGraph as tt, observeAssistantOutcome as u, proposeRebindV042 as ui, ALPHA2_DSHMARKET_139_HOST_PACKAGES as un, extractArtifactPaths as ur, resolveInstalledHostLock as ut, recoveryDigest as v, CERTIFICATE_VERSION as vi, GOAL_HOST_PACKAGES as vn, GoalActivationState as vr, GitCommandRejected as vt, ProofManifest as w, StatefulAction as wi, HostCohort as wn, BoundaryDisposition as wr, LinearCommitReadback as wt, PROOF_KINDS as x, STOP_PROTOCOL_VERSION as xi, HostCapabilityEvaluation as xn, effectuateBoundary as xr, GitPrestateCheck as xt, renderRecoveryPacket as y, SEMANTIC_ACTIONS as yi, HOST_CAPABILITY_PACKAGE_GROUPS as yn, GoalBoundaryAccess as yr, GitEffectExecution as yt, isVerifyingCapability as z, evaluateToolSurfaceCapability as zn, GuardCheckpoint as zr, parsePwshCommand as zt };
+export { COMMAND_SURFACE_MANIFEST as $, namedActions as $i, bindLiveGoalCapability as $n, BoundaryQualificationKind as $r, parsePwshCommand as $t, openItems as A, PackageRow as Ai, BASE_HOST_PACKAGES as An, RejectedBinding as Ar, GitCommandManifest as At, SessionQuery as B, rebindResponse as Bi, HostCapabilityId as Bn, isInformationalMessage as Br, commitTreeSnapshotDigest as Bt, RC015_RC2_HOST_PACKAGES as C, normalizeClause as Ca, TargetCaptureReasonCode as Ci, deriveProjection as Cn, classifyTaskIntent as Cr, resolveActiveProfileHostLock as Ct, MIN_RECOVERY_CHAR_BUDGET as D, VerificationContract as Di, ALPHA2_DSHMARKET_139_HOST_PACKAGES as Dn, isFrozenV042RebindResponse as Dr, GIT_COMMAND_TEMPLATES as Dt, DEFAULT_RECOVERY_CHAR_BUDGET as E, sha256 as Ea, TargetValue as Ei, ACTIVE_HOST_LAUNCHER_VERSION as En, ParsedConfirmation as Er, GIT_COMMAND_MANIFEST_IDS as Et, PROOF_PROTOCOL_VERSION as F, confirmRebind as Fi, GOAL_HOST_PACKAGES as Fn, captureItem as Fr, GitPrestateCheck as Ft, proofEvidenceConstraints as G, InterpretOptions as Gi, HostLockContext as Gn, GoalActivationState as Gr, revalidateGitPrestate as Gt, canonicalProjection as H, AuthorityDisposition as Hi, HostCohort as Hn, BoundaryEffectuation as Hr, executeRevalidatedGitEffect as Ht, ProofKind as I, proposeRebind as Ii, HOST_CAPABILITY_PACKAGE_GROUPS as In, classifyClause as Ir, GitPrestateEnvelope as It, EvidenceFacetCoverage as J, interpretMessage as Ji, HostPlatform as Jn, effectuateBoundary as Jr, CanonicalCommandSurface as Jt, sessionQuery as K, ScopeInterpretation as Ki, HostLockEvaluation as Kn, GoalBoundaryAccess as Kr, verifiedLinearCommitReadback as Kt, ProofManifest as L, proposeRebindOutcome as Li, HOST_COHORTS as Ln, extractArtifactPaths as Lr, GitTargetIdentity as Lt, renderRecoveryPacket as M, ProposeOutcome as Mi, EXPECTED_HOST_PACKAGES as Mn, CaptureScope as Mr, GitCommandRejected as Mt, ALPHA3_HOST_PACKAGES as N, RebindArgs as Ni, ExecutableIdentity as Nn, ClauseSegment as Nr, GitEffectExecution as Nt, RecoveryOptions as O, WaitAuthorization as Oi, ALPHA2_HOST_PACKAGES as On, parseConfirmationMessage as Or, GitAdapterAction as Ot, PROOF_KINDS as P, RebindProposal as Pi, ExecutableIdentityBinding as Pn, captureClause as Pr, GitEffectRunner as Pt, isVerifyingCapability as Q, maskCodeSpans as Qi, bindExecutableIdentity as Qn, BoundaryDisposition as Qr, isRunExecutable as Qt, ProofObligation as R, proposeRebindV042 as Ri, HostAuditProvenance as Rn, extractMethod as Rr, LinearCommitReadback as Rt, snapshotSessionEvents as S, digestStrings as Sa, PersistenceAuthorization as Si, PROTOCOL_V4_NOTICE as Sn, UserInteractionKind as Sr, readActiveHostGraph as St, RC1_HOST_PACKAGES as T, sanitizeUrl as Ta, TargetTuple as Ti, ACTIVE_HOST_COHORT_IDS as Tn, CONFIRM_LINE_PATTERN as Tr, verifyComposedHostLockDump as Tt, createProofManifest as U, DirectiveClass as Ui, HostCohortSelection as Un, BoundaryQualification as Ur, gitCommandMatchesTarget as Ut, bindProofToProjection as V, replayRebindResult as Vi, HostCapabilityRequest as Vn, segmentClauses as Vr, createGitPrestateEnvelope as Vt, proofDigest as W, Executee as Wi, HostCohortSelectionReason as Wn, BoundaryRequest as Wr, parseGitCommandManifest as Wt, evidenceCoverage as X, isOpenObligation as Xi, HostToolSurface as Xn, qualifyBoundary as Xr, ShellParseStatus as Xt, bindingSatisfies as Y, isExecutableItem as Yi, HostProfileKind as Yn, isCurrentAcceptedBoundary as Yr, ParsedShell as Yt, evidenceMatchesItem as Z, kindOfScope as Zi, LEGACY_HOST_COHORTS as Zn, BindingActionClosure as Zr, canonicalArgvFromCommand as Zt, progressFingerprint as _, semanticActionFromCommand as _a, GuardItemKind as _i, evidenceAvailabilityReason as _n, AuthorityBlockKind as _r, hostLockRowsFromComposedDump as _t, NO_PROGRESS_RECORD_PREFIX as a, ActionSpec as aa, EvidenceBinding as ai, ToolSubject as an, selectHostCohort as ar, FIRST_STEP_GUIDANCE as at, SessionApiError as b, validateActionTarget as ba, GuardProjection as bi, CAPTURE_V042_NOTICE as bn, segmentAuthorityBlocks as br, packageRowsFromActiveGraph as bt, classifyCompletionClaim as c, STATEFUL_ACTIONS as ca, EvidenceRole as ci, extractToolSubject as cn, MIN_SUPPORTED_HOST_VERSION as cr, LifecyclePhase as ct, decisionBoundaryKey as d, SemanticAction as da, GoalRef as di, CertificationSupport as dn, compareHostVersions as dr, previewFirstStepInjection as dt, semanticActionOfScope as ea, DeferAuthorization as ei, parseShellCommand as en, evaluateExternalWaitCapability as er, CommandSurfaceManifest as et, isRootPauseRequest as f, StatefulAction as fa, GuardBoundary as fi, DiagnosisNextAction as fn, evaluateMinimumHostVersion as fr, ActiveProfileHostLock as ft, observeAssistantOutcome as g, requestedTargetMatchesResolved as ga, GuardItem as gi, deriveItemDiagnosis as gn, AuthorityBlock as gr, hostLockContextFromComposedDump as gt, latestRootInstruction as h, requestedTargetAuthorizesMutation as ha, GuardIntegrity as hi, UnifiedItemDiagnosis as hn, currentContractDigest as hr, combineHostPolicy as ht, CompletionDisposition as i, ActionManifest as ia, DerivedEnvelope as ii, ToolResultInput as in, hostVersionFromPackages as ir, ClaimedMessage as it, recoveryDigest as j, BoundedSource as ji, DEFAULT_HOST_LOCK as jn, certifyCheckpoint as jr, GitCommandParseResult as jt, closingHint as k, createProjection as ki, AuditedExecutable as kn, CheckpointResult as kr, GitCommandAccepted as kt, decideTurnBoundary as l, STOP_PROTOCOL_VERSION as la, ExpectedTransition as li, isDeterministicCheck as ln, ParsedHostVersion as lr, claimedBatchHasRealRootInput as lt, latestAssistantText as m, isStatefulAction as ma, GuardEvidence as mi, TaskKind as mn, satisfiesSupportedHostRange as mr, TargetHostGraph as mt, AssistantOutcomeObservation as n, ACTION_MANIFEST as na, DeriveResult as ni, hasCurrentCertificate as nn, evaluateHostLock as nr, OperationVerbEntry as nt, NO_PROGRESS_TURNS_BEFORE_STOP as o, CERTIFICATE_VERSION as oa, EvidenceOutcome as oi, evidenceFromPersistedToolResult as on, HostVersionDecision as or, FirstStepInjection as ot, isWholeTaskCompletionClaim as p, actionCompatible as pa, GuardCheckpoint as pi, Repairability as pn, parseHostVersion as pr, HostProfileError as pt, validateProofManifest as q, interpretClause as qi, HostLockStatus as qn, availableBoundaryQualifications as qr, CanonicalArgv as qt, CONTROL_RECORD_PREFIX as r, ACTION_MANIFEST_VERSION as ra, DeriveScope as ri, ToolCallInput as rn, evaluateToolSurfaceCapability as rr, validateManifest as rt, TurnStoppingDecision as s, SEMANTIC_ACTIONS as sa, EvidenceParseStatus as si, extractTextContent as sn, HostVersionStatus as sr, FirstStepPreviewInput as st, supersedeItem as t, statefulActionsOfScope as ta, DeriveConfig as ti, goalCompletionDenial as tn, evaluateHostCapability as tr, ManifestIssue as tt, decideTurnStopping as u, SUPPORTED_EVIDENCE_ADAPTERS as ua, ExternalOperation as ui, withDurability as un, SUPPORTED_HOST_RANGE as ur, lifecyclePhase as ut, SESSION_API_UNSUPPORTED as v, semanticActionFromText as va, GuardItemStatus as vi, itemDiagnosis as vn, AuthorityKind as vr, injectActiveProfileHostLock as vt, RC015_HOST_PACKAGES as w, sanitizeClauseText as wa, TargetCaptureStatus as wi, ACTIVE_HOST_COHORT_ID as wn, classifyUserInteraction as wr, resolveInstalledHostLock as wt, V3SessionLike as x, canonicalizePath as xa, HostStatus as xi, PROTOCOL_V3_NOTICE as xn, TaskIntent as xr, packageRowsFromPnpmLock as xt, SESSION_EVENT_ENVELOPE_INVALID as y, validateActionManifest as ya, GuardOperation as yi, relevantEvidence as yn, authorityCaptureCounts as yr, inspectTargetHostGraph as yt, ProofSurface as z, rebindAttemptKey as zi, HostCapabilityEvaluation as zn, extractOperation as zr, commitIndexSnapshotDigest as zt };