dsh-completion-guard 0.5.0 → 0.5.2

package/dist/index.d.ts

@@ -1,5 +1,6 @@
-import { $ as ActiveProfileHostLock, $n as isFrozenV042RebindResponse, $r as VerificationContract, $t as Repairability, A as createProofManifest, Ai as semanticActionFromText, An as HostPlatform, Ar as DerivedEnvelope, At as parseGitCommandManifest, B as COMMAND_SURFACE_MANIFEST, Bn as selectHostCohort, Br as GuardEvidence, Bt as parseShellCommand, C as ProofKind, Ci as SemanticAction, Cn as HostCapabilityRequest, Cr as qualifyBoundary, Ct as GitTargetIdentity, D as SessionQuery, Di as requestedTargetAuthorizesMutation, Dn as HostLockContext, Dr as DeriveConfig, Dt as createGitPrestateEnvelope, E as ProofSurface, Ei as isStatefulAction, En as HostCohortSelectionReason, Er as DeferAuthorization, Et as commitTreeSnapshotDigest, F as EvidenceFacetCoverage, Fi as normalizeClause, Fn as bindLiveGoalCapability, Fr as ExpectedTransition, Ft as ParsedShell, G as ClaimedMessage, Gn as authorityCaptureCounts, Gr as GuardOperation, Gt as ToolSubject, H as ManifestIssue, Hn as AuthorityBlock, Hr as GuardItem, Ht as hasCurrentCertificate, I as bindingSatisfies, Ii as sanitizeClauseText, In as evaluateExternalWaitCapability, Ir as ExternalOperation, It as ShellParseStatus, J as FirstStepPreviewInput, Jn as UserInteractionKind, Jr as PersistenceAuthorization, Jt as extractToolSubject, K as FIRST_STEP_GUIDANCE, Kn as segmentAuthorityBlocks, Kr as GuardProjection, Kt as evidenceFromPersistedToolResult, L as evidenceCoverage, Li as sanitizeUrl, Ln as evaluateHostCapability, Lr as GoalRef, Lt as canonicalArgvFromCommand, M as proofEvidenceConstraints, Mi as validateActionTarget, Mn as HostToolSurface, Mr as EvidenceOutcome, Mt as verifiedLinearCommitReadback, N as sessionQuery, Ni as canonicalizePath, Nn as LEGACY_HOST_COHORTS, Nr as EvidenceParseStatus, Nt as CanonicalArgv, O as bindProofToProjection, Oi as requestedTargetMatchesResolved, On as HostLockEvaluation, Or as DeriveResult, Ot as executeRevalidatedGitEffect, P as validateProofManifest, Pi as digestStrings, Pn as bindExecutableIdentity, Pr as EvidenceRole, Pt as CanonicalCommandSurface, Q as previewFirstStepInjection, Qn as ParsedConfirmation, Qr as TargetValue, Qt as DiagnosisNextAction, R as evidenceMatchesItem, Ri as sha256, Rn as evaluateHostLock, Rr as GuardBoundary, Rt as isRunExecutable, S as PROOF_PROTOCOL_VERSION, Si as SUPPORTED_EVIDENCE_ADAPTERS, Sn as HostCapabilityId, Sr as isCurrentAcceptedBoundary, St as GitPrestateEnvelope, T as ProofObligation, Ti as actionCompatible, Tn as HostCohortSelection, Tr as BoundaryQualificationKind, Tt as commitIndexSnapshotDigest, U as OperationVerbEntry, Un as AuthorityBlockKind, Ur as GuardItemKind, Ut as ToolCallInput, V as CommandSurfaceManifest, Vn as currentContractDigest, Vr as GuardIntegrity, Vt as goalCompletionDenial, W as validateManifest, Wn as AuthorityKind, Wr as GuardItemStatus, Wt as ToolResultInput, X as claimedBatchHasRealRootInput, Xn as classifyUserInteraction, Xr as TargetCaptureStatus, Xt as withDurability, Y as LifecyclePhase, Yn as classifyTaskIntent, Yr as TargetCaptureReasonCode, Yt as isDeterministicCheck, Z as lifecyclePhase, Zn as CONFIRM_LINE_PATTERN, Zr as TargetTuple, Zt as CertificationSupport, _ as openItems, _i as ActionSpec, _n as ExecutableIdentityBinding, _r as BoundaryRequest, _t as GitCommandParseResult, a as classifyCompletionClaim, ai as RebindArgs, an as relevantEvidence, ar as ClassifiedClause, at as inspectTargetHostGraph, b as ALPHA3_HOST_PACKAGES, bi as STATEFUL_ACTIONS, bn as HOST_COHORTS, br as availableBoundaryQualifications, bt as GitEffectRunner, c as isWholeTaskCompletionClaim, ci as proposeRebind, cn as PROTOCOL_V4_NOTICE, cr as captureItem, ct as readActiveHostGraph, d as snapshotSessionEvents, di as rebindAttemptKey, dn as ALPHA2_HOST_PACKAGES, dr as extractMethod, dt as verifyComposedHostLockDump, ei as WaitAuthorization, en as TaskKind, er as parseConfirmationMessage, et as HostProfileError, f as RC1_HOST_PACKAGES, fi as rebindResponse, fn as AuditedExecutable, fr as extractOperation, ft as GIT_COMMAND_MANIFEST_IDS, g as closingHint, gi as ActionManifest, gn as ExecutableIdentity, gr as BoundaryQualification, gt as GitCommandManifest, h as RecoveryOptions, hi as ACTION_MANIFEST_VERSION, hn as EXPECTED_HOST_PACKAGES, hr as BoundaryEffectuation, ht as GitCommandAccepted, i as TurnStoppingDecision, ii as ProposeOutcome, in as itemDiagnosis, ir as CaptureScope, it as injectActiveProfileHostLock, j as proofDigest, ji as validateActionManifest, jn as HostProfileKind, jr as EvidenceBinding, jt as revalidateGitPrestate, k as canonicalProjection, ki as semanticActionFromCommand, kn as HostLockStatus, kr as DeriveScope, kt as gitCommandMatchesTarget, l as latestAssistantText, li as proposeRebindOutcome, ln as deriveProjection, lr as classifyClause, lt as resolveActiveProfileHostLock, m as MIN_RECOVERY_CHAR_BUDGET, mi as ACTION_MANIFEST, mn as DEFAULT_HOST_LOCK, mr as segmentClauses, mt as GitAdapterAction, n as AssistantOutcomeObservation, ni as PackageRow, nn as deriveItemDiagnosis, nr as RejectedBinding, nt as hostLockContextFromComposedDump, o as decideTurnBoundary, oi as RebindProposal, on as CAPTURE_V042_NOTICE, or as ClauseSegment, ot as packageRowsFromActiveGraph, p as DEFAULT_RECOVERY_CHAR_BUDGET, pi as replayRebindResult, pn as BASE_HOST_PACKAGES, pr as isInformationalMessage, pt as GIT_COMMAND_TEMPLATES, q as FirstStepInjection, qn as TaskIntent, qr as HostStatus, qt as extractTextContent, r as CompletionDisposition, ri as BoundedSource, rn as evidenceAvailabilityReason, rr as certifyCheckpoint, rt as hostLockRowsFromComposedDump, s as decideTurnStopping, si as confirmRebind, sn as PROTOCOL_V3_NOTICE, sr as captureClause, st as packageRowsFromPnpmLock, t as supersedeItem, ti as createProjection, tn as UnifiedItemDiagnosis, tr as CheckpointResult, tt as TargetHostGraph, u as observeAssistantOutcome, ui as proposeRebindV042, un as ALPHA2_DSHMARKET_139_HOST_PACKAGES, ur as extractArtifactPaths, ut as resolveInstalledHostLock, v as recoveryDigest, vi as CERTIFICATE_VERSION, vn as GOAL_HOST_PACKAGES, vr as GoalActivationState, vt as GitCommandRejected, w as ProofManifest, wi as StatefulAction, wn as HostCohort, wr as BoundaryDisposition, wt as LinearCommitReadback, x as PROOF_KINDS, xi as STOP_PROTOCOL_VERSION, xn as HostCapabilityEvaluation, xr as effectuateBoundary, xt as GitPrestateCheck, y as renderRecoveryPacket, yi as SEMANTIC_ACTIONS, yn as HOST_CAPABILITY_PACKAGE_GROUPS, yr as GoalBoundaryAccess, yt as GitEffectExecution, z as isVerifyingCapability, zn as evaluateToolSurfaceCapability, zr as GuardCheckpoint, zt as parsePwshCommand } from "./index-Cd3wXBLi.js";
+import { $ as COMMAND_SURFACE_MANIFEST, $i as kindOfScope, $n as bindLiveGoalCapability, $r as BindingActionClosure, $t as parsePwshCommand, A as openItems, Ai as WaitAuthorization, An as BASE_HOST_PACKAGES, Ar as parseConfirmationMessage, At as GitCommandManifest, B as SessionQuery, Bi as proposeRebindV042, Bn as HostCapabilityId, Br as extractMethod, Bt as commitTreeSnapshotDigest, C as RC015_RC2_HOST_PACKAGES, Ca as canonicalizePath, Ci as HostStatus, Cn as deriveProjection, Cr as TaskIntent, Ct as resolveActiveProfileHostLock, D as MIN_RECOVERY_CHAR_BUDGET, Da as sanitizeUrl, Di as TargetTuple, Dn as ALPHA2_DSHMARKET_139_HOST_PACKAGES, Dr as CONFIRM_LINE_PATTERN, Dt as GIT_COMMAND_TEMPLATES, E as DEFAULT_RECOVERY_CHAR_BUDGET, Ea as sanitizeClauseText, Ei as TargetCaptureStatus, En as ACTIVE_HOST_LAUNCHER_VERSION, Er as classifyUserInteraction, Et as GIT_COMMAND_MANIFEST_IDS, F as PROOF_PROTOCOL_VERSION, Fi as RebindArgs, Fn as GOAL_HOST_PACKAGES, Fr as ClauseSegment, Ft as GitPrestateCheck, G as proofEvidenceConstraints, Gi as DirectiveClass, Gn as HostLockContext, Gr as BoundaryQualification, Gt as revalidateGitPrestate, H as canonicalProjection, Hi as rebindResponse, Hn as HostCohort, Hr as isInformationalMessage, Ht as executeRevalidatedGitEffect, I as ProofKind, Ii as RebindProposal, In as HOST_CAPABILITY_PACKAGE_GROUPS, Ir as captureClause, It as GitPrestateEnvelope, J as EvidenceFacetCoverage, Ji as ScopeInterpretation, Jn as HostPlatform, Jr as GoalBoundaryAccess, Jt as CanonicalCommandSurface, K as sessionQuery, Ki as Executee, Kn as HostLockEvaluation, Kr as BoundaryRequest, Kt as verifiedLinearCommitReadback, L as ProofManifest, Li as confirmRebind, Ln as HOST_COHORTS, Lr as captureItem, Lt as GitTargetIdentity, M as renderRecoveryPacket, Mi as PackageRow, Mn as EXPECTED_HOST_PACKAGES, Mr as RejectedBinding, Mt as GitCommandRejected, N as ALPHA3_HOST_PACKAGES, Ni as BoundedSource, Nn as ExecutableIdentity, Nr as certifyCheckpoint, Nt as GitEffectExecution, O as RecoveryOptions, Oa as sha256, Oi as TargetValue, On as ALPHA2_HOST_PACKAGES, Or as ParsedConfirmation, Ot as GitAdapterAction, P as PROOF_KINDS, Pi as ProposeOutcome, Pn as ExecutableIdentityBinding, Pr as CaptureScope, Pt as GitEffectRunner, Q as isVerifyingCapability, Qi as isOpenObligation, Qn as bindExecutableIdentity, Qr as qualifyBoundary, Qt as isRunExecutable, R as ProofObligation, Ri as proposeRebind, Rn as HostAuditProvenance, Rr as classifyClause, Rt as LinearCommitReadback, S as snapshotSessionEvents, Sa as validateActionTarget, Si as GuardProjection, Sn as PROTOCOL_V4_NOTICE, Sr as segmentAuthorityBlocks, St as readActiveHostGraph, T as RC1_HOST_PACKAGES, Ta as normalizeClause, Ti as TargetCaptureReasonCode, Tn as ACTIVE_HOST_COHORT_IDS, Tr as classifyTaskIntent, Tt as verifyComposedHostLockDump, U as createProofManifest, Ui as replayRebindResult, Un as HostCohortSelection, Ur as segmentClauses, Ut as gitCommandMatchesTarget, V as bindProofToProjection, Vi as rebindAttemptKey, Vn as HostCapabilityRequest, Vr as extractOperation, Vt as createGitPrestateEnvelope, W as proofDigest, Wi as AuthorityDisposition, Wn as HostCohortSelectionReason, Wr as BoundaryEffectuation, Wt as parseGitCommandManifest, X as evidenceCoverage, Xi as interpretMessage, Xn as HostToolSurface, Xr as effectuateBoundary, Xt as ShellParseStatus, Y as bindingSatisfies, Yi as interpretClause, Yn as HostProfileKind, Yr as availableBoundaryQualifications, Yt as ParsedShell, Z as evidenceMatchesItem, Zi as isExecutableItem, Zn as LEGACY_HOST_COHORTS, Zr as isCurrentAcceptedBoundary, Zt as canonicalArgvFromCommand, _ as progressFingerprint, _a as requestedTargetAuthorizesMutation, _i as GuardIntegrity, _n as evidenceAvailabilityReason, _r as currentContractDigest, _t as hostLockRowsFromComposedDump, a as NO_PROGRESS_RECORD_PREFIX, aa as ACTION_MANIFEST_VERSION, ai as DeriveScope, an as ToolSubject, ar as selectHostCohort, at as FIRST_STEP_GUIDANCE, b as SessionApiError, ba as semanticActionFromText, bi as GuardItemStatus, bn as CAPTURE_V042_NOTICE, br as AuthorityKind, bt as packageRowsFromActiveGraph, c as classifyCompletionClaim, ca as CERTIFICATE_VERSION, ci as EvidenceOutcome, cn as extractToolSubject, cr as LATEST_SUPPORTED_HOST_VERSION, ct as LifecyclePhase, d as decisionBoundaryKey, da as STOP_PROTOCOL_VERSION, di as ExpectedTransition, dn as CertificationSupport, dr as SUPPORTED_HOST_RANGE, dt as previewFirstStepInjection, ea as maskCodeSpans, ei as BoundaryDisposition, en as parseShellCommand, er as evaluateExternalWaitCapability, et as CommandSurfaceManifest, f as isRootPauseRequest, fa as SUPPORTED_EVIDENCE_ADAPTERS, fi as ExternalOperation, fn as DiagnosisNextAction, fr as SUPPORTED_HOST_VERSIONS, ft as ActiveProfileHostLock, g as observeAssistantOutcome, ga as isStatefulAction, gi as GuardEvidence, gn as deriveItemDiagnosis, gr as satisfiesSupportedHostRange, gt as hostLockContextFromComposedDump, h as latestRootInstruction, ha as actionCompatible, hi as GuardCheckpoint, hn as UnifiedItemDiagnosis, hr as parseHostVersion, ht as combineHostPolicy, i as CompletionDisposition, ia as ACTION_MANIFEST, ii as DeriveResult, in as ToolResultInput, ir as hostVersionFromPackages, it as ClaimedMessage, j as recoveryDigest, ji as createProjection, jn as DEFAULT_HOST_LOCK, jr as CheckpointResult, jt as GitCommandParseResult, k as closingHint, ki as VerificationContract, kn as AuditedExecutable, kr as isFrozenV042RebindResponse, kt as GitCommandAccepted, l as decideTurnBoundary, la as SEMANTIC_ACTIONS, li as EvidenceParseStatus, ln as isDeterministicCheck, lr as MIN_SUPPORTED_HOST_VERSION, lt as claimedBatchHasRealRootInput, m as latestAssistantText, ma as StatefulAction, mi as GuardBoundary, mn as TaskKind, mr as evaluateMinimumHostVersion, mt as TargetHostGraph, n as AssistantOutcomeObservation, na as semanticActionOfScope, ni as DeferAuthorization, nn as hasCurrentCertificate, nr as evaluateHostLock, nt as OperationVerbEntry, o as NO_PROGRESS_TURNS_BEFORE_STOP, oa as ActionManifest, oi as DerivedEnvelope, on as evidenceFromPersistedToolResult, or as HostVersionDecision, ot as FirstStepInjection, p as isWholeTaskCompletionClaim, pa as SemanticAction, pi as GoalRef, pn as Repairability, pr as compareHostVersions, pt as HostProfileError, q as validateProofManifest, qi as InterpretOptions, qn as HostLockStatus, qr as GoalActivationState, qt as CanonicalArgv, r as CONTROL_RECORD_PREFIX, ra as statefulActionsOfScope, ri as DeriveConfig, rn as ToolCallInput, rr as evaluateToolSurfaceCapability, rt as validateManifest, s as TurnStoppingDecision, sa as ActionSpec, si as EvidenceBinding, sn as extractTextContent, sr as HostVersionStatus, st as FirstStepPreviewInput, t as supersedeItem, ta as namedActions, ti as BoundaryQualificationKind, tn as goalCompletionDenial, tr as evaluateHostCapability, tt as ManifestIssue, u as decideTurnStopping, ua as STATEFUL_ACTIONS, ui as EvidenceRole, un as withDurability, ur as ParsedHostVersion, ut as lifecyclePhase, v as SESSION_API_UNSUPPORTED, va as requestedTargetMatchesResolved, vi as GuardItem, vn as itemDiagnosis, vr as AuthorityBlock, vt as injectActiveProfileHostLock, w as RC015_HOST_PACKAGES, wa as digestStrings, wi as PersistenceAuthorization, wn as ACTIVE_HOST_COHORT_ID, wr as UserInteractionKind, wt as resolveInstalledHostLock, x as V3SessionLike, xa as validateActionManifest, xi as GuardOperation, xn as PROTOCOL_V3_NOTICE, xr as authorityCaptureCounts, xt as packageRowsFromPnpmLock, y as SESSION_EVENT_ENVELOPE_INVALID, ya as semanticActionFromCommand, yi as GuardItemKind, yn as relevantEvidence, yr as AuthorityBlockKind, yt as inspectTargetHostGraph, z as ProofSurface, zi as proposeRebindOutcome, zn as HostCapabilityEvaluation, zr as extractArtifactPaths, zt as commitIndexSnapshotDigest } from "./index-BTaiOcE-.js";
 import "@deepseek-ai/dsh-tools";
+import "@deepseek-ai/dsh-session";
 import { Context } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
 
@@ -27,4 +28,4 @@ declare function apply(ctx: Context, rawConfig?: {
   hostLockProfileRoot?: unknown;
 }): void;
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityKind, BASE_HOST_PACKAGES, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, BoundedSource, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CertificationSupport, CheckpointResult, ClaimedMessage, ClassifiedClause, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, DiagnosisNextAction, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, ExpectedTransition, ExternalOperation, FIRST_STEP_GUIDANCE, FirstStepInjection, FirstStepPreviewInput, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, LEGACY_HOST_COHORTS, LifecyclePhase, LinearCommitReadback, MIN_RECOVERY_CHAR_BUDGET, ManifestIssue, OperationVerbEntry, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, ParsedConfirmation, ParsedShell, PersistenceAuthorization, ProofKind, ProofManifest, ProofObligation, ProofSurface, ProposeOutcome, RC1_HOST_PACKAGES, RebindArgs, RebindProposal, RecoveryOptions, RejectedBinding, Repairability, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SemanticAction, SessionQuery, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetHostGraph, TargetTuple, TargetValue, TaskIntent, TaskKind, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UnifiedItemDiagnosis, UserInteractionKind, VerificationContract, WaitAuthorization, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, inspectTargetHostGraph, isCurrentAcceptedBoundary, isDeterministicCheck, isFrozenV042RebindResponse, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, latestAssistantText, lifecyclePhase, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parsePwshCommand, parseShellCommand, previewFirstStepInjection, proofDigest, proofEvidenceConstraints, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sessionQuery, sha256, snapshotSessionEvents, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, ActionManifest, ActionSpec, ActiveProfileHostLock, AssistantOutcomeObservation, AuditedExecutable, AuthorityBlock, AuthorityBlockKind, AuthorityDisposition, AuthorityKind, BASE_HOST_PACKAGES, BindingActionClosure, BoundaryDisposition, BoundaryEffectuation, BoundaryQualification, BoundaryQualificationKind, BoundaryRequest, BoundedSource, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, CanonicalArgv, CanonicalCommandSurface, CaptureScope, CertificationSupport, CheckpointResult, ClaimedMessage, ClauseSegment, CommandSurfaceManifest, CompletionDisposition, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DeferAuthorization, DeriveConfig, DeriveResult, DeriveScope, DerivedEnvelope, DiagnosisNextAction, DirectiveClass, EXPECTED_HOST_PACKAGES, EvidenceBinding, EvidenceFacetCoverage, EvidenceOutcome, EvidenceParseStatus, EvidenceRole, ExecutableIdentity, ExecutableIdentityBinding, Executee, ExpectedTransition, ExternalOperation, FIRST_STEP_GUIDANCE, FirstStepInjection, FirstStepPreviewInput, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GitAdapterAction, GitCommandAccepted, GitCommandManifest, GitCommandParseResult, GitCommandRejected, GitEffectExecution, GitEffectRunner, GitPrestateCheck, GitPrestateEnvelope, GitTargetIdentity, GoalActivationState, GoalBoundaryAccess, GoalRef, GuardBoundary, GuardCheckpoint, GuardEvidence, GuardIntegrity, GuardItem, GuardItemKind, GuardItemStatus, GuardOperation, GuardProjection, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostAuditProvenance, HostCapabilityEvaluation, HostCapabilityId, HostCapabilityRequest, HostCohort, HostCohortSelection, HostCohortSelectionReason, HostLockContext, HostLockEvaluation, HostLockStatus, HostPlatform, HostProfileError, HostProfileKind, HostStatus, HostToolSurface, HostVersionDecision, HostVersionStatus, InterpretOptions, LATEST_SUPPORTED_HOST_VERSION, LEGACY_HOST_COHORTS, LifecyclePhase, LinearCommitReadback, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, ManifestIssue, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, OperationVerbEntry, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, ParsedConfirmation, ParsedHostVersion, ParsedShell, PersistenceAuthorization, ProofKind, ProofManifest, ProofObligation, ProofSurface, ProposeOutcome, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, RebindArgs, RebindProposal, RecoveryOptions, RejectedBinding, Repairability, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, ScopeInterpretation, SemanticAction, SessionApiError, SessionQuery, ShellParseStatus, StatefulAction, TargetCaptureReasonCode, TargetCaptureStatus, TargetHostGraph, TargetTuple, TargetValue, TaskIntent, TaskKind, ToolCallInput, ToolResultInput, ToolSubject, TurnStoppingDecision, UnifiedItemDiagnosis, UserInteractionKind, V3SessionLike, VerificationContract, WaitAuthorization, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isFrozenV042RebindResponse, isInformationalMessage, isOpenObligation, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, kindOfScope, latestAssistantText, latestRootInstruction, lifecyclePhase, maskCodeSpans, name, namedActions, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, previewFirstStepInjection, progressFingerprint, proofDigest, proofEvidenceConstraints, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sha256, snapshotSessionEvents, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };

package/dist/index.js

@@ -1,8 +1,8 @@
-import { $ as isRunExecutable, $t as itemDiagnosis, A as revalidateGitPrestate, An as canonicalizePath, At as MIN_RECOVERY_CHAR_BUDGET, B as lifecyclePhase, Bt as createProjection, C as GIT_COMMAND_TEMPLATES, Cn as semanticActionFromText, Ct as segmentAuthorityBlocks, D as executeRevalidatedGitEffect, Dn as validateManifest, Dt as qualifyBoundary, E as createGitPrestateEnvelope, En as COMMAND_SURFACE_MANIFEST, Et as isCurrentAcceptedBoundary, F as isWholeTaskCompletionClaim, Fn as sha256, Ft as bindingSatisfies, G as deriveProjection, Gt as rebindAttemptKey, H as CAPTURE_V042_NOTICE, Ht as proposeRebind, I as latestAssistantText, It as evidenceCoverage, J as extractTextContent, Jt as CONFIRM_LINE_PATTERN, K as supersedeItem, Kt as rebindResponse, L as observeAssistantOutcome, Lt as evidenceMatchesItem, M as classifyCompletionClaim, Mn as normalizeClause, Mt as openItems, N as decideTurnBoundary, Nn as sanitizeClauseText, Nt as recoveryDigest, O as gitCommandMatchesTarget, On as classifyTaskIntent, Ot as certifyCheckpoint, P as decideTurnStopping, Pn as sanitizeUrl, Pt as renderRecoveryPacket, Q as canonicalArgvFromCommand, Qt as evidenceAvailabilityReason, R as FIRST_STEP_GUIDANCE, Rt as isVerifyingCapability, S as GIT_COMMAND_MANIFEST_IDS, Sn as semanticActionFromCommand, St as authorityCaptureCounts, T as commitTreeSnapshotDigest, Tn as validateActionTarget, Tt as effectuateBoundary, U as PROTOCOL_V3_NOTICE, Ut as proposeRebindOutcome, V as previewFirstStepInjection, Vt as confirmRebind, W as PROTOCOL_V4_NOTICE, Wt as proposeRebindV042, X as isDeterministicCheck, Xt as parseConfirmationMessage, Y as extractToolSubject, Yt as isFrozenV042RebindResponse, Z as withDurability, Zt as deriveItemDiagnosis, _ as readActiveHostGraph, _n as SUPPORTED_EVIDENCE_ADAPTERS, _t as evaluateHostLock, a as createProofManifest, an as extractMethod, at as ALPHA2_HOST_PACKAGES, b as verifyComposedHostLockDump, bn as requestedTargetAuthorizesMutation, bt as RC1_HOST_PACKAGES, c as sessionQuery, cn as segmentClauses, ct as EXPECTED_HOST_PACKAGES, d as hostLockContextFromComposedDump, dn as ACTION_MANIFEST, dt as HOST_COHORTS, en as relevantEvidence, et as parsePwshCommand, f as hostLockRowsFromComposedDump, fn as ACTION_MANIFEST_VERSION, ft as LEGACY_HOST_COHORTS, g as packageRowsFromPnpmLock, gn as STOP_PROTOCOL_VERSION, gt as evaluateHostCapability, h as packageRowsFromActiveGraph, hn as STATEFUL_ACTIONS, ht as evaluateExternalWaitCapability, i as canonicalProjection, in as extractArtifactPaths, it as ALPHA2_DSHMARKET_139_HOST_PACKAGES, j as verifiedLinearCommitReadback, jn as digestStrings, jt as closingHint, k as parseGitCommandManifest, kn as classifyUserInteraction, kt as DEFAULT_RECOVERY_CHAR_BUDGET, l as validateProofManifest, ln as canonicalRegistryBase, lt as GOAL_HOST_PACKAGES, m as inspectTargetHostGraph, mn as SEMANTIC_ACTIONS, mt as bindLiveGoalCapability, n as PROOF_PROTOCOL_VERSION, nn as captureItem, nt as goalCompletionDenial, o as proofDigest, on as extractOperation, ot as BASE_HOST_PACKAGES, p as injectActiveProfileHostLock, pn as CERTIFICATE_VERSION, pt as bindExecutableIdentity, q as evidenceFromPersistedToolResult, qt as replayRebindResult, r as bindProofToProjection, rn as classifyClause, rt as hasCurrentCertificate, s as proofEvidenceConstraints, sn as isInformationalMessage, st as DEFAULT_HOST_LOCK, t as PROOF_KINDS, tn as captureClause, tt as parseShellCommand, u as HostProfileError, un as npmEscapedPackageName, ut as HOST_CAPABILITY_PACKAGE_GROUPS, v as resolveActiveProfileHostLock, vn as actionCompatible, vt as evaluateToolSurfaceCapability, w as commitIndexSnapshotDigest, wn as validateActionManifest, wt as availableBoundaryQualifications, x as snapshotSessionEvents, xn as requestedTargetMatchesResolved, xt as ALPHA3_HOST_PACKAGES, y as resolveInstalledHostLock, yn as isStatefulAction, yt as selectHostCohort, z as claimedBatchHasRealRootInput, zt as currentContractDigest } from "./domain-Cx8vpxSj.js";
+import { $ as parseShellCommand, $n as isStatefulAction, $t as isWholeTaskCompletionClaim, A as createGitPrestateEnvelope, An as extractMethod, At as RC1_HOST_PACKAGES, B as CAPTURE_V042_NOTICE, Bn as namedActions, Bt as renderRecoveryPacket, C as SESSION_EVENT_ENVELOPE_INVALID, Cn as evidenceAvailabilityReason, Ct as SUPPORTED_HOST_VERSIONS, D as GIT_COMMAND_TEMPLATES, Dn as captureItem, Dt as satisfiesSupportedHostRange, E as GIT_COMMAND_MANIFEST_IDS, En as captureClause, Et as parseHostVersion, F as verifiedLinearCommitReadback, Fn as interpretMessage, Ft as DEFAULT_RECOVERY_CHAR_BUDGET, G as evidenceFromPersistedToolResult, Gn as ACTION_MANIFEST, Gt as CONTROL_RECORD_PREFIX, H as PROTOCOL_V4_NOTICE, Hn as statefulActionsOfScope, Ht as evidenceCoverage, I as FIRST_STEP_GUIDANCE, In as isExecutableItem, It as MIN_RECOVERY_CHAR_BUDGET, J as isDeterministicCheck, Jn as SEMANTIC_ACTIONS, Jt as classifyCompletionClaim, K as extractTextContent, Kn as ACTION_MANIFEST_VERSION, Kt as NO_PROGRESS_RECORD_PREFIX, L as claimedBatchHasRealRootInput, Ln as isOpenObligation, Lt as closingHint, M as gitCommandMatchesTarget, Mn as isInformationalMessage, Mt as authorityCaptureCounts, N as parseGitCommandManifest, Nn as segmentClauses, Nt as segmentAuthorityBlocks, O as commitIndexSnapshotDigest, On as classifyClause, Ot as RC015_RC2_HOST_PACKAGES, P as revalidateGitPrestate, Pn as interpretClause, Pt as certifyCheckpoint, Q as parsePwshCommand, Qn as actionCompatible, Qt as isRootPauseRequest, R as lifecyclePhase, Rn as kindOfScope, Rt as openItems, S as SESSION_API_UNSUPPORTED, Sn as deriveItemDiagnosis, St as SUPPORTED_HOST_RANGE, T as snapshotSessionEvents, Tn as relevantEvidence, Tt as evaluateMinimumHostVersion, U as deriveProjection, Un as canonicalRegistryBase, Ut as evidenceMatchesItem, V as PROTOCOL_V3_NOTICE, Vn as semanticActionOfScope, Vt as bindingSatisfies, W as supersedeItem, Wn as npmEscapedPackageName, Wt as isVerifyingCapability, X as canonicalArgvFromCommand, Xn as STOP_PROTOCOL_VERSION, Xt as decideTurnStopping, Y as withDurability, Yn as STATEFUL_ACTIONS, Yt as decideTurnBoundary, Z as isRunExecutable, Zn as SUPPORTED_EVIDENCE_ADAPTERS, Zt as decisionBoundaryKey, _ as packageRowsFromPnpmLock, _n as rebindResponse, _t as evaluateToolSurfaceCapability, a as createProofManifest, an as hasCurrentCertificate, ar as validateActionTarget, at as BASE_HOST_PACKAGES, b as resolveInstalledHostLock, bn as isFrozenV042RebindResponse, bt as LATEST_SUPPORTED_HOST_VERSION, c as sessionQuery, cn as isCurrentAcceptedBoundary, cr as classifyTaskIntent, ct as GOAL_HOST_PACKAGES, d as combineHostPolicy, dn as createProjection, dr as digestStrings, dt as LEGACY_HOST_COHORTS, en as latestAssistantText, er as requestedTargetAuthorizesMutation, et as ACTIVE_HOST_COHORT_ID, f as hostLockContextFromComposedDump, fn as confirmRebind, fr as normalizeClause, ft as bindExecutableIdentity, g as packageRowsFromActiveGraph, gn as rebindAttemptKey, gt as evaluateHostLock, h as inspectTargetHostGraph, hn as proposeRebindV042, hr as sha256, ht as evaluateHostCapability, i as canonicalProjection, in as goalCompletionDenial, ir as validateActionManifest, it as ALPHA2_HOST_PACKAGES, j as executeRevalidatedGitEffect, jn as extractOperation, jt as ALPHA3_HOST_PACKAGES, k as commitTreeSnapshotDigest, kn as extractArtifactPaths, kt as RC015_HOST_PACKAGES, l as validateProofManifest, ln as qualifyBoundary, lr as classifyUserInteraction, lt as HOST_CAPABILITY_PACKAGE_GROUPS, m as injectActiveProfileHostLock, mn as proposeRebindOutcome, mr as sanitizeUrl, mt as evaluateExternalWaitCapability, n as PROOF_PROTOCOL_VERSION, nn as observeAssistantOutcome, nr as semanticActionFromCommand, nt as ACTIVE_HOST_LAUNCHER_VERSION, o as proofDigest, on as availableBoundaryQualifications, or as COMMAND_SURFACE_MANIFEST, ot as DEFAULT_HOST_LOCK, p as hostLockRowsFromComposedDump, pn as proposeRebind, pr as sanitizeClauseText, pt as bindLiveGoalCapability, q as extractToolSubject, qn as CERTIFICATE_VERSION, qt as NO_PROGRESS_TURNS_BEFORE_STOP, r as bindProofToProjection, rn as progressFingerprint, rr as semanticActionFromText, rt as ALPHA2_DSHMARKET_139_HOST_PACKAGES, s as proofEvidenceConstraints, sn as effectuateBoundary, sr as validateManifest, st as EXPECTED_HOST_PACKAGES, t as PROOF_KINDS, tn as latestRootInstruction, tr as requestedTargetMatchesResolved, tt as ACTIVE_HOST_COHORT_IDS, u as HostProfileError, un as currentContractDigest, ur as canonicalizePath, ut as HOST_COHORTS, v as readActiveHostGraph, vn as replayRebindResult, vt as hostVersionFromPackages, w as SessionApiError, wn as itemDiagnosis, wt as compareHostVersions, x as verifyComposedHostLockDump, xn as parseConfirmationMessage, xt as MIN_SUPPORTED_HOST_VERSION, y as resolveActiveProfileHostLock, yn as CONFIRM_LINE_PATTERN, yt as selectHostCohort, z as previewFirstStepInjection, zn as maskCodeSpans, zt as recoveryDigest } from "./domain-RuX9l07o.js";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { createHash } from "node:crypto";
 import { basename, delimiter, dirname, isAbsolute, join, resolve } from "node:path";
-import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm";
+import { boundContextSummary, createToolResultMessage, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { execFile } from "node:child_process";
 import { constants, existsSync, readFileSync } from "node:fs";
 import { access, readFile, realpath } from "node:fs/promises";
@@ -10,6 +10,7 @@ import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { gunzip } from "node:zlib";
+import { SESSION_FORMAT_VERSION } from "@deepseek-ai/dsh-session";
 
 //#region src/tools/rebind.ts
 function createRebindTool(getProjection, prepare) {
@@ -414,6 +415,33 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 						state_evidence_ids: {
 							type: "array",
 							items: { type: "string" }
+						},
+						action_bindings: {
+							type: "array",
+							items: {
+								type: "object",
+								additionalProperties: false,
+								properties: {
+									action: {
+										type: "string",
+										required: true
+									},
+									evidence_ids: {
+										type: "array",
+										required: true,
+										items: { type: "string" }
+									},
+									resolved_target: {
+										type: "object",
+										required: true,
+										additionalProperties: true
+									},
+									order: {
+										type: "integer",
+										required: true
+									}
+								}
+							}
 						}
 					}
 				}
@@ -619,7 +647,13 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 				} } : {},
 				...binding.resolution_evidence_id ? { resolutionEvidenceId: binding.resolution_evidence_id } : {},
 				...binding.effect_evidence_id ? { effectEvidenceId: binding.effect_evidence_id } : {},
-				...binding.state_evidence_ids ? { stateEvidenceIds: binding.state_evidence_ids } : {}
+				...binding.state_evidence_ids ? { stateEvidenceIds: binding.state_evidence_ids } : {},
+				...binding.action_bindings ? { actionBindings: binding.action_bindings.map((closure) => ({
+					action: closure.action,
+					evidenceIds: closure.evidence_ids,
+					resolvedTarget: closure.resolved_target,
+					order: closure.order
+				})) } : {}
 			})), `C${projection.checkpoints.length + 1}`, false);
 			if (!result.checkpoint) onRejected();
 			const available_evidence = [...projection.evidence.values()].filter((evidence) => evidence.epoch === projection.epoch && (args.evidence_scope === "history" || [...projection.items.values()].some((item) => item.status === "pending" && relevantEvidence(projection, item, evidence)))).sort((a, b) => b.toolResultSeq - a.toolResultSeq || (a.id < b.id ? -1 : 1)).map((evidence) => ({
@@ -689,7 +723,7 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 function createBoundaryTool(getProjection, prepare, onRejected) {
 	return defineTool({
 		name: "context_guard_boundary",
-		description: "Persist a qualified user_wait, external_wait, or deferred boundary. Free-form notes never qualify a boundary.",
+		description: "Persist a qualified user_wait, external_wait, deferred, or guard_bounded_stop boundary. Free-form notes never qualify a boundary.",
 		parameters: {
 			disposition: {
 				type: "string",
@@ -697,7 +731,8 @@ function createBoundaryTool(getProjection, prepare, onRejected) {
 				enum: [
 					"user_wait",
 					"external_wait",
-					"deferred"
+					"deferred",
+					"guard_bounded_stop"
 				]
 			},
 			qualification_kind: {
@@ -707,7 +742,8 @@ function createBoundaryTool(getProjection, prepare, onRejected) {
 					"user_decision_item",
 					"root_explicit_wait",
 					"external_operation_pending",
-					"root_explicit_defer"
+					"root_explicit_defer",
+					"guard_no_progress"
 				]
 			},
 			qualification_ids: {
@@ -886,6 +922,7 @@ function createPrepareTool(options) {
 			] : ["state (matching durable evidence for the requested verification)"];
 			const missingTargetFields = manifestEntry?.stateful && plannedAction ? manifestEntry.resolvedTargetKeys.filter((key) => !(item.requestedTarget?.[key] !== void 0 || args.requested_target?.[key] !== void 0)) : [];
 			const capability = plannedAction && options.hostCapability ? options.hostCapability(plannedAction) : void 0;
+			const commandShape = options.commandTemplate && plannedAction ? options.commandTemplate(plannedAction) : void 0;
 			return {
 				status: "prepared",
 				item: {
@@ -893,15 +930,15 @@ function createPrepareTool(options) {
 					revision: item.revision
 				},
 				diagnosis,
-				planned_action: plannedAction,
-				supported_command_shape: options.commandTemplate && plannedAction ? options.commandTemplate(plannedAction) ?? void 0 : void 0,
+				...plannedAction !== void 0 ? { planned_action: plannedAction } : {},
+				...commandShape !== void 0 ? { supported_command_shape: commandShape } : {},
 				required_evidence_order: requiredOrder,
 				reusable_references: reusable,
 				missing_target_fields: missingTargetFields,
-				host_capability: capability ? {
+				...capability ? { host_capability: {
 					status: capability.status,
 					reason_code: capability.reasonCode
-				} : void 0,
+				} } : {},
 				note: "Preparation performs no action. A default or guessed target is not user authority; explicit root instruction is required for missing target fields."
 			};
 		}
@@ -2578,7 +2615,7 @@ function createContextGuardCommand(projectionFor, setEnabled, clearContract, lif
 }
 
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+cosmokit@1.8.2/node_modules/@deepseek-ai/cosmokit/lib/index.js
+//#region node_modules/.pnpm/@deepseek-ai+cosmokit@1.8.3/node_modules/@deepseek-ai/cosmokit/lib/index.js
 /** Return true when a value is `null` or `undefined`. */
 function isNullable(value) {
 	return value === null || value === void 0;
@@ -2779,7 +2816,7 @@ var Time;
 })(Time || (Time = {}));
 
 //#endregion
-//#region node_modules/.pnpm/@deepseek-ai+schemastery@3.18.1/node_modules/@deepseek-ai/schemastery/lib/index.mjs
+//#region node_modules/.pnpm/@deepseek-ai+schemastery@3.18.2/node_modules/@deepseek-ai/schemastery/lib/index.mjs
 const kSchema = Symbol.for("schemastery");
 const kValidationError = Symbol.for("ValidationError");
 globalThis.__schemastery_index__ ??= 0;
@@ -3462,6 +3499,14 @@ function authorizeMutationFromProjection(projection, request) {
 		status: "denied",
 		reasonCode: "mutation_contract_item_not_pending"
 	};
+	if (item.authorityDisposition === "conditional_wait" || item.waitAuthorization) return {
+		status: "denied",
+		reasonCode: item.authorityDisposition === "conditional_wait" ? "mutation_awaiting_root_condition" : "mutation_awaiting_root_wait"
+	};
+	if (item.authorityDisposition === "human_actor") return {
+		status: "denied",
+		reasonCode: "mutation_human_executor"
+	};
 	if (item.kind !== "requirement" || item.verification.enforced !== true) return {
 		status: "denied",
 		reasonCode: "mutation_contract_item_not_authorizing"
@@ -3503,13 +3548,159 @@ function authorizeMutationFromProjection(projection, request) {
 	};
 }
 const PROTOCOL_CORRECTION_NOTICE = "Context Guard protocol correction: root-authorized work remains pending; continue with tools or obtain a typed boundary.";
+/**
+* Establish a boundary Guard itself owns, through the same durable record the
+* boundary tool writes.
+*
+* Replay reads boundaries from the `context_guard_boundary` call/result pair, so
+* a Guard-created boundary is written in exactly that wire shape rather than in
+* a private side channel — otherwise it would not survive a reload, and a
+* boundary that only exists in memory is not a persisted wait or stop.
+*
+* Returns the boundary only after the durable flush succeeded. A failed flush
+* reports the failure instead of a boundary, because an unflushed record must
+* never be read back as an established boundary.
+*/
+async function establishBoundary(agent, runtime, flush, request) {
+	const projection = runtime.projection;
+	const candidate = qualifyBoundary(projection, request);
+	if (candidate.persistedResult !== "accepted") return { reasonCode: candidate.reasonCode };
+	const session = agent.session;
+	const callId = `guard-boundary-${candidate.id}`;
+	session.append("tool/call", {
+		turn: 0,
+		step: session.seq,
+		callId,
+		name: "context_guard_boundary",
+		arguments: JSON.stringify({
+			disposition: request.disposition,
+			qualification_kind: request.qualificationKind,
+			qualification_ids: request.qualificationIds
+		})
+	});
+	session.append("tool/result", {
+		turn: 0,
+		step: session.seq,
+		message: createToolResultMessage({
+			callId,
+			content: [{
+				type: "text",
+				text: JSON.stringify({
+					status: candidate.persistedResult,
+					reason_code: candidate.reasonCode,
+					boundary: { candidate_sha256: candidate.candidateSha256 }
+				})
+			}],
+			isError: false
+		})
+	}, { surfaceOp: "append" });
+	let durable = false;
+	try {
+		durable = await flush();
+	} catch {
+		durable = false;
+	}
+	runtime.setDurability(durable);
+	runtime.sync();
+	if (!durable) return { reasonCode: "boundary_flush_failed" };
+	return {
+		boundary: candidate,
+		reasonCode: candidate.reasonCode
+	};
+}
+/**
+* Effectuate a boundary Guard established in this turn, with the Goal revision
+* re-checked at the moment of the side effect.
+*
+* The progress fingerprint deliberately ignores the Goal revision, because an
+* edited Goal text is not progress. That is a statement about *detecting*
+* progress, not permission to act on a stale reference: before disarming, the
+* boundary's own Goal identity and revision are compared with the live readback,
+* so a Goal that changed under the boundary is refused rather than disarmed.
+*/
+async function effectuateOwnBoundary(runtime, boundary, access$1) {
+	const goalAccess = access$1.goalAccess ?? {
+		get: async () => void 0,
+		disarm: async () => void 0
+	};
+	const recorded = boundary.goalRef;
+	const effect = await effectuateBoundary(boundary, {
+		...goalAccess,
+		requalify: async () => {
+			const live = await goalAccess.get();
+			if (!live || !recorded) return false;
+			return live.id === recorded.id && live.revision === recorded.revision && live.activation === "armed";
+		}
+	});
+	if (effect.resumeRequired) {
+		runtime.projection.integrity = "unknown";
+		runtime.projection.integrityViolations.push(effect.reasonCode);
+	}
+	return effect.reasonCode;
+}
 /** Production Stop boundary: durable replay first, then immutable/live checks. */
 async function handleGuardTurnStopping(agent, runtime, access$1) {
-	const durable = await access$1.flush();
+	let durable = false;
+	try {
+		durable = await access$1.flush();
+	} catch {
+		durable = false;
+	}
 	runtime.setDurability(durable);
 	runtime.sync();
 	if (!durable) return "boundary_flush_failed";
+	const rootInstruction = latestRootInstruction(agent.session?.snapshotEvents?.() ?? []);
+	if (rootInstruction !== void 0 && isRootPauseRequest(rootInstruction.text) && !runtime.projection.handledControlSeqs.has(rootInstruction.seq) && access$1.pauseAccess) {
+		agent.session.append("user/message", createUserMessage({
+			content: [{
+				type: "text",
+				text: `${CONTROL_RECORD_PREFIX}${JSON.stringify({
+					kind: "root_pause",
+					rootSeq: rootInstruction.seq
+				})}`
+			}],
+			source: {
+				kind: "plugin",
+				plugin: "context-guard",
+				form: "notice",
+				summary: boundContextSummary("carrying the root pause request to the host")
+			}
+		}), { surfaceOp: "append" });
+		const current = await access$1.pauseAccess.get();
+		const paused = current?.phase === "paused" && current.activation === "disarmed" ? current : await access$1.pauseAccess.pause();
+		const readback$1 = await access$1.pauseAccess.get();
+		if (!paused || paused.activation !== "disarmed" || readback$1?.activation !== "disarmed") {
+			runtime.projection.integrity = "unknown";
+			runtime.projection.integrityViolations.push("root_pause_readback_failed");
+			return "root_pause_readback_failed";
+		}
+		return "root_pause_routed";
+	}
 	const decision = decideTurnBoundary(runtime.projection);
+	if (decision.noProgressClaim) {
+		const record$1 = `${NO_PROGRESS_RECORD_PREFIX}${JSON.stringify(decision.noProgressClaim)}`;
+		agent.session.append("user/message", createUserMessage({
+			content: [{
+				type: "text",
+				text: record$1
+			}],
+			source: {
+				kind: "plugin",
+				plugin: "context-guard",
+				form: "notice",
+				summary: boundContextSummary("recording a turn boundary without relevant progress")
+			}
+		}), { surfaceOp: "append" });
+		let recorded = false;
+		try {
+			recorded = await access$1.flush();
+		} catch {
+			recorded = false;
+		}
+		runtime.setDurability(recorded);
+		runtime.sync();
+		if (!recorded) return "boundary_flush_failed";
+	}
 	if (decision.action === "continue") {
 		agent.steer(createUserMessage({
 			content: [{
@@ -3525,6 +3716,39 @@ async function handleGuardTurnStopping(agent, runtime, access$1) {
 		}));
 		return decision.reason ?? "protocol_correction_steer";
 	}
+	if (decision.reason === "no_progress_bounded_disarm") {
+		if (!access$1.goalAccess || !access$1.hostSupported) {
+			runtime.projection.integrity = "unknown";
+			runtime.projection.integrityViolations.push("boundary_host_lock_unsupported");
+			return "boundary_host_lock_unsupported";
+		}
+		const established = await establishBoundary(agent, runtime, access$1.flush, {
+			disposition: "guard_bounded_stop",
+			qualificationKind: "guard_no_progress",
+			qualificationIds: [progressFingerprint(runtime.projection)]
+		});
+		if (!established.boundary) return established.reasonCode;
+		return await effectuateOwnBoundary(runtime, established.boundary, access$1);
+	}
+	if (decision.reason === "goal_round_driver_owns_continuation" && access$1.goalAccess) {
+		const waiting = [...runtime.projection.items.values()].filter((item) => item.status === "pending" && item.waitAuthorization).map((item) => item.waitAuthorization.id).sort();
+		const current = runtime.projection.boundaries.at(-1);
+		const alreadyCurrent = current && isCurrentAcceptedBoundary(runtime.projection, current) && current.disposition === "user_wait" && current.qualificationIds.slice().sort().join(",") === waiting.join(",");
+		if (waiting.length > 0 && !alreadyCurrent) {
+			if (!access$1.hostSupported) {
+				runtime.projection.integrity = "unknown";
+				runtime.projection.integrityViolations.push("boundary_host_lock_unsupported");
+				return "boundary_host_lock_unsupported";
+			}
+			const established = await establishBoundary(agent, runtime, access$1.flush, {
+				disposition: "user_wait",
+				qualificationKind: "root_explicit_wait",
+				qualificationIds: waiting
+			});
+			if (established.boundary) return await effectuateOwnBoundary(runtime, established.boundary, access$1);
+			return established.reasonCode;
+		}
+	}
 	if (decision.reason !== "accepted_boundary_pending_effectuation") return decision.reason ?? "safe_yield_pending_preserved";
 	const boundary = runtime.projection.boundaries.at(-1);
 	if (!boundary || !isCurrentAcceptedBoundary(runtime.projection, boundary)) return "boundary_candidate_stale";
@@ -3553,15 +3777,29 @@ async function handleGuardTurnStopping(agent, runtime, access$1) {
 function createHostCapabilityEvaluator(hostLock) {
 	return (action) => evaluateHostCapability(hostLock, { action });
 }
+/**
+* Durable session identity for the certificate binding, read from the
+* DSH Session V3 header plus the Session-owned inherited prefix length.
+*
+* Session V3 stamps `version: 3`, requires the `isSeeded` fork-lineage marker,
+* and moved the inherited-prefix length off the header onto the `Session`
+* (`inheritedEventCount`). Anything else is not a V3 identity: returning
+* `undefined` makes the projection report `session_ref_unavailable` instead of
+* certifying against a guessed identity.
+*/
 function sessionHeaderForDigest(session) {
 	const raw = session.header;
-	if (!raw || typeof raw.version !== "number" || typeof raw.id !== "string" || typeof raw.createdAt !== "number") return void 0;
+	if (!raw || raw.version !== SESSION_FORMAT_VERSION) return void 0;
+	if (typeof raw.id !== "string" || typeof raw.createdAt !== "number") return void 0;
+	if (typeof raw.isSeeded !== "boolean") return void 0;
+	const inherited = session.inheritedEventCount;
+	if (typeof inherited !== "number" || !Number.isSafeInteger(inherited) || inherited < 0) return void 0;
 	return {
 		version: raw.version,
 		id: raw.id,
 		createdAt: raw.createdAt,
 		...typeof raw.parentSession === "string" ? { parentSession: raw.parentSession } : {},
-		...typeof raw.seedLength === "number" ? { seedLength: raw.seedLength } : {},
+		seedLength: inherited,
 		...typeof raw.agentPreset === "string" ? { agentPreset: raw.agentPreset } : {},
 		...typeof raw.origin === "string" ? { origin: raw.origin } : {},
 		delegationDepth: typeof raw.delegationDepth === "number" ? raw.delegationDepth : 0
@@ -3584,11 +3822,25 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 		if (refreshHostLock) hostLock = refreshHostLock();
 		const header = session.header;
 		const priorRecoveryDigest = projection.lastRecoveryDigest;
-		const derived = deriveProjection(snapshotSessionEvents(session), { activation: config.activation }, {
+		const sessionHeader = sessionHeaderForDigest(session);
+		let events;
+		try {
+			events = snapshotSessionEvents(session);
+		} catch (error) {
+			const code = error instanceof SessionApiError ? error.code : "session_snapshot_failed";
+			projection.integrity = "unknown";
+			if (!projection.integrityViolations.includes(code)) projection.integrityViolations.push(code);
+			return;
+		}
+		const derived = deriveProjection(events, { activation: config.activation }, {
 			cwd: typeof header?.cwd === "string" ? header.cwd : "",
-			sessionHeader: sessionHeaderForDigest(session)
+			sessionHeader
 		}, durabilityConfirmed, hostLock);
 		Object.assign(projection, derived.projection);
+		if (!sessionHeader) {
+			projection.integrity = "unknown";
+			if (!projection.integrityViolations.includes("session_ref_unavailable")) projection.integrityViolations.push("session_ref_unavailable");
+		}
 		if (readGoalState) try {
 			const state = normalizeGoalState(readGoalState());
 			if (state && projection.currentGoalRef?.id === state.id && projection.currentGoalRef.revision === state.revision) {
@@ -3970,4 +4222,4 @@ function normalizeGoalState(value) {
 }
 
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, LEGACY_HOST_COHORTS, MIN_RECOVERY_CHAR_BUDGET, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, commitIndexSnapshotDigest, commitTreeSnapshotDigest, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, inject, injectActiveProfileHostLock, inspectTargetHostGraph, isCurrentAcceptedBoundary, isDeterministicCheck, isFrozenV042RebindResponse, isInformationalMessage, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, latestAssistantText, lifecyclePhase, name, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parsePwshCommand, parseShellCommand, previewFirstStepInjection, proofDigest, proofEvidenceConstraints, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, sessionQuery, sha256, snapshotSessionEvents, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, LATEST_SUPPORTED_HOST_VERSION, LEGACY_HOST_COHORTS, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_KINDS, PROOF_PROTOCOL_VERSION, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, SessionApiError, actionCompatible, apply, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindingSatisfies, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, captureClause, captureItem, certifyCheckpoint, claimedBatchHasRealRootInput, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, gitCommandMatchesTarget, goalCompletionDenial, hasCurrentCertificate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isFrozenV042RebindResponse, isInformationalMessage, isOpenObligation, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, kindOfScope, latestAssistantText, latestRootInstruction, lifecyclePhase, maskCodeSpans, name, namedActions, normalizeClause, observeAssistantOutcome, openItems, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, previewFirstStepInjection, progressFingerprint, proofDigest, proofEvidenceConstraints, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualifyBoundary, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, renderRecoveryPacket, replayRebindResult, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, resolveActiveProfileHostLock, resolveInstalledHostLock, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sha256, snapshotSessionEvents, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };

package/docs/ARCHITECTURE.md

@@ -20,7 +20,12 @@ The effective plugin configuration and the DSH Session append-only log are the i
 - effective plugin configuration — initial enablement (`opt-in` starts disabled; `always` starts enabled before log replay);
 - `command/run` — later enablement (`/context-guard on|off|clear`) and epoch transitions;
 - `user/message` — captured contract clauses;
-- `tool/call` + `tool/result` — bounded evidence and completion-certificate attempts.
+- `tool/call` + `tool/result` — bounded evidence and completion-certificate attempts;
+- `tool/ptc-dispatch-start` + `tool/ptc-dispatch` — evidence for sub-calls dispatched from a `run_code` program. These are the current names; the retired `tool/code-dispatch*` vocabulary is ignored and mints nothing;
+- `compaction/summary` — the compaction cut that re-arms the recovery reminder;
+- `goal/change` — the recorded Goal reference, revision, and phase used by the completion gate.
+
+Everything else in the DSH log is deliberately ignored. In particular a V3 `system/message` is a plugin-sourced surface node rather than root authority, a compaction checkpoint `user/message` stays plugin context, and `request/header`, `request/context`, `assistant/attempt`, `session/end-seed` and raw `assistant` streams carry no contract state.
 
 The in-memory `GuardProjection` is a rebuildable cache: `deriveProjection` applies the effective activation configuration, replays the native log deterministically, recomputes every contract, evidence, and certificate, and flags `corrupt` when a recorded certificate no longer re-derives from the evidence in the log. The projection and its evidence are session-scoped: a new DSH session starts a new projection and cannot import, look up, or certify evidence IDs from another session. A completed workflow that needs a certificate must therefore produce its evidence and call `context_guard_checkpoint` in the same session. Under `always`, replay begins enabled; changing an existing profile from `opt-in` to `always` can therefore bring earlier persisted user messages into the derived contract. A recorded `/context-guard off` disables capture from that point until a later `on`. A recorded `/context-guard clear` supersedes every pending requirement and acceptance under a `CLEAR:<revision>` sentinel (prohibitions are retained) and bumps the contract revision, so a fresh empty-binding checkpoint can certify while the guard stays enabled. Captured contracts always carry a concrete subject/surface, so no unrelated evidence can close a requirement.
 
@@ -28,7 +33,7 @@ The in-memory `GuardProjection` is a rebuildable cache: `deriveProjection` appli
 
 The runtime separates what it injects from what it certifies. An internal lifecycle phase — `armed` (protection enabled, waiting for the first real root input), `active` (real input entered a step), `disabled` (explicitly off) — expresses the startup strategy only; certification still depends solely on durable events, the current contract, and the evidence chain.
 
-Session start (`agent/session-start`) registers tools and the runtime, reads history, and arms recovery for resume/compact. It appends nothing, so a fresh session stays blank (`seq === 0`) and a DSH preset can still be selected while the session is new. The rc.1 Web surface treats a session as blank until a `turn/start` (server preset lock) and falls back to `seq === 0` for cold list entries; Guard writes no message at T0, so both stay satisfiable.
+Session start (`agent/session-start`) registers tools and the runtime, reads history, and arms recovery for resume/compact. It appends nothing, so a fresh session stays blank (`seq === 0`) and a DSH preset can still be selected while the session is new. The Web surface treats a session as blank until a `turn/start` (server preset lock) and falls back to `seq === 0` for cold list entries; Guard writes no message at T0, so both stay satisfiable. Guard reads history only through the DSH Session V3 `snapshotEvents()` API and refuses a session that does not expose it, so no V2 log can be projected as if it had V3 semantics.
 
 At `agent/pre-step` the loop has CLAIMED this step's input but has not persisted it yet. A pure preview reads only the validated claim: under `always`, the first claimed batch that carries a real root user message (non-empty text, or any image/attachment part) injects the `Context Guard protocol boundary: v4.0.0` notice and a compact first-step guidance message ahead of the claimed messages, inside the same step batch. The formal projection never derives from the preview — the boundary and the user message become durable events when the loop appends the batch, and the contract is re-derived from them exactly as from any other log. `opt-in` never auto-injects; delegated/subagent sessions receive no boundary, guidance, or activation (their scope arrives through the parent's delegation prompt). Rejection, cancellation, or a filtered batch injects nothing and retries on the next legal input.