dsh-completion-guard 0.5.2 → 0.6.0

package/dist/{domain-RuX9l07o.js → domain-COehX7MB.js}

@@ -358,6 +358,13 @@ function validateManifest(manifest = COMMAND_SURFACE_MANIFEST) {
 //#region src/domain/protocol-manifest.ts
 const STOP_PROTOCOL_VERSION = "2.0.0";
 const CERTIFICATE_VERSION = "1";
+/**
+* 0.6.0 v5-session identity (P0 §1): v2 certificates bind a work unit's
+* closure instead of the whole session. Version-1 identity keeps its
+* historical meaning for legacy sessions and is never silently re-read.
+*/
+const STOP_PROTOCOL_VERSION_V2 = "3.0.0";
+const CERTIFICATE_VERSION_V2 = "2";
 const ACTION_MANIFEST_VERSION = 1;
 const SUPPORTED_EVIDENCE_ADAPTERS = {
 	"context-guard.git.v1": "1.0.0",
@@ -656,17 +663,78 @@ const REQUESTED_IDENTITY_KEY = {
 	restart: "service_id",
 	publish: "artifact_id"
 };
+/** The single identity field a root instruction must name for this action. */
+function requestedIdentityKey(action) {
+	return REQUESTED_IDENTITY_KEY[action];
+}
 function stableTargetValue(value) {
 	if (Array.isArray(value)) return `[${value.map(stableTargetValue).join(",")}]`;
 	if (value && typeof value === "object") return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stableTargetValue(entry)}`).join(",")}}`;
 	return JSON.stringify(value);
 }
 /**
+* The 0.6.0 bounded file-choice vocabulary (C07/S03): artifact-type nouns a
+* root instruction may use instead of an exact path. The assistant may pick
+* the exact file INSIDE the captured scope and inside the type, and the
+* choice is frozen by the resolution producer before any effect. An absent
+* extension set (`file`) admits any file the producer accepts.
+*/
+const BOUNDED_ARTIFACT_TYPES = {
+	document: new Set([
+		"md",
+		"markdown",
+		"txt"
+	]),
+	readme: new Set([
+		"md",
+		"rst",
+		"txt"
+	]),
+	report: new Set(["md", "txt"]),
+	file: null
+};
+function extensionOf(path$1) {
+	const base = path$1.split(/[\\/]/).pop() ?? "";
+	const dot = base.lastIndexOf(".");
+	return dot > 0 ? base.slice(dot + 1).toLowerCase() : "";
+}
+function normalizeSlashes(value) {
+	return value.replace(/\\/g, "/");
+}
+/** Whether `artifact` lives inside `scope` (or exactly at it), slash-normalized. */
+function insideScope(artifact, scope) {
+	if (scope === "scope" || scope === "") return false;
+	const normalizedArtifact = normalizeSlashes(artifact);
+	const normalizedScope = normalizeSlashes(scope).replace(/\/+$/, "");
+	if (normalizedArtifact === normalizedScope) return false;
+	return normalizedArtifact.startsWith(`${normalizedScope}/`);
+}
+/**
+* Whether a bounded-choice requested target authorizes this resolved target:
+* the resolved artifact must live inside the captured scope and match the
+* captured type. The exact file name is the assistant's bounded decision,
+* frozen by resolution — never a root-named identity substitution.
+*/
+function boundedArtifactChoiceMatches(action, requested, resolved) {
+	if (action !== "create" && action !== "modify") return false;
+	const type = requested?.artifact_type;
+	const scope = requested?.scope;
+	if (typeof type !== "string" || typeof scope !== "string" || !(type in BOUNDED_ARTIFACT_TYPES)) return false;
+	const artifact = resolved?.artifact_id;
+	if (typeof artifact !== "string" || !artifact) return false;
+	if (!insideScope(artifact, scope)) return false;
+	const allowed = BOUNDED_ARTIFACT_TYPES[type];
+	return allowed === null || allowed.has(extensionOf(artifact));
+}
+/**
 * Compare identities captured from the root instruction with a complete
 * adapter-resolved target. Requested targets are partial by design: only
 * explicitly named identities (plus the active repository scope) are frozen.
+* A bounded artifact choice (scope + type, C07) matches when the resolved
+* exact file is inside the scope and of the captured type.
 */
 function requestedTargetMatchesResolved(action, requested, resolved) {
+	if (boundedArtifactChoiceMatches(action, requested, resolved)) return true;
 	const identityKey = REQUESTED_IDENTITY_KEY[action];
 	if (!identityKey || !requested || !resolved || !Object.hasOwn(requested, identityKey)) return false;
 	const allowed = new Set(ACTION_MANIFEST.actions[action].resolvedTargetKeys);
@@ -710,6 +778,7 @@ const MUTATION_AUTHORITY_KEYS = {
 };
 /** A mutation requires every user-selectable identity field, not a partial match. */
 function requestedTargetAuthorizesMutation(action, requested, resolved) {
+	if (boundedArtifactChoiceMatches(action, requested, resolved)) return true;
 	const required = MUTATION_AUTHORITY_KEYS[action];
 	return !!requested && required.every((key) => Object.hasOwn(requested, key)) && requestedTargetMatchesResolved(action, requested, resolved);
 }
@@ -1808,6 +1877,36 @@ function namedActions(text) {
 	return interpretMessage(text).map((scope) => semanticActionOfScope(scope.body)).filter((action) => action !== "generic_run");
 }
 
+//#endregion
+//#region src/domain/spans.ts
+/**
+* 0.6.0 source-span helpers (C01).
+*
+* Spans are UTF-8 BYTE half-open intervals `[start, end)` inside the original
+* root message text. All conversions go through TextEncoder byte counting —
+* JavaScript string indices are never allowed to masquerade as cross-language
+* positions, so a Python reader agrees with TypeScript on every boundary.
+*/
+const encoder = new TextEncoder();
+function utf8ByteLength(text) {
+	return encoder.encode(text).length;
+}
+/** Byte offset of `index` inside `text`: the UTF-8 length of the prefix. */
+function utf8ByteOffset(text, index) {
+	return utf8ByteLength(text.slice(0, index));
+}
+/**
+* The coverage class of one captured clause: a prohibition is a constraint,
+* an informational reading is a question, an adopted block stays adoption,
+* and everything else is an instruction. Nothing captured is left unclassed.
+*/
+function spanClassOf(kind, directive, authority) {
+	if (authority === "root_adoption") return "adoption";
+	if (kind === "prohibition") return "constraint";
+	if (directive === "informational" || directive === "narrative") return "question";
+	return "instruction";
+}
+
 //#endregion
 //#region src/domain/capture.ts
 /**
@@ -1953,16 +2052,112 @@ function parentScope(subject) {
 	if (separator === 2 && /^[A-Za-z]:[\\/]$/.test(subject.slice(0, 3))) return subject.slice(0, 3);
 	return subject.slice(0, separator);
 }
+/**
+* The artifact-type nouns the bounded file-choice vocabulary admits (C07).
+* A closed list pinned by the v2 fixture: the noun must be the OBJECT of the
+* action, so "更新文档" captures a bounded choice while "更新皮肤中心" stays
+* a genuine clarification. The generic "文件/file" admits any file type the
+* producer accepts.
+*/
+const BOUNDED_TYPE_NOUNS = [
+	[/文档/, "document"],
+	[/(?<!\w)readme(?!\w)/iu, "readme"],
+	[/报告/, "report"],
+	[/文件/, "file"],
+	[/(?<!\w)files?(?!\w)/iu, "file"]
+];
+function boundedArtifactTypeOf(text) {
+	const masked = text;
+	for (const [pattern, type] of BOUNDED_TYPE_NOUNS) if (pattern.test(masked)) return type;
+}
+/** A bounded choice needs a real path scope; the 'scope' sentinel is not one. */
+function scopeIsPath(subject) {
+	return subject !== "scope" && subject !== "" && /[\\/]/.test(subject);
+}
+/**
+* Whether the clause's FIRST action word is the change verb 更新/调整 (the
+* object-driven modify mapping). A later 更新 inside a referenced task name
+* ("把更新插件明确为 apply…") never qualifies — the head verb is what the
+* clause orders.
+*/
+function headVerbIsChangeWord(text) {
+	const candidates = [];
+	for (const word of ["更新", "调整"]) {
+		let at = text.indexOf(word);
+		while (at >= 0) {
+			candidates.push({
+				at,
+				word
+			});
+			at = text.indexOf(word, at + word.length);
+		}
+	}
+	for (const match of text.matchAll(/\b(?:update|adjust)\b/gi)) candidates.push({
+		at: match.index,
+		word: match[0]
+	});
+	if (candidates.length === 0) return false;
+	candidates.sort((a, b) => a.at - b.at);
+	const head = candidates[0];
+	return CJK_ACTION_WORD_AT(text, head.at) === void 0;
+}
+/** Any other known action word strictly before `before`, if one exists. */
+function CJK_ACTION_WORD_AT(text, before) {
+	const words = [
+		"创建",
+		"生成",
+		"新建",
+		"写入",
+		"修改",
+		"编辑",
+		"更改",
+		"读取",
+		"运行",
+		"执行",
+		"安装",
+		"部署",
+		"上传",
+		"提交",
+		"推送",
+		"发布",
+		"升级",
+		"重启",
+		"重新启动",
+		"合并",
+		"删除",
+		"下载",
+		"拉取",
+		"同步"
+	];
+	let best;
+	for (const word of words) {
+		const at = text.indexOf(word);
+		if (at >= 0 && at < before && (best === void 0 || at < best.at)) best = {
+			at,
+			word
+		};
+	}
+	for (const match of text.matchAll(/\b(?:build|create|write|modify|change|edit|run|fix|install|push|publish|commit|deploy|migrate|delete|restart|fetch|pull|update)\b/gi)) if (match.index < before && (best === void 0 || match.index < best.at)) best = {
+		at: match.index,
+		word: match[0]
+	};
+	return best?.word;
+}
 function captureRequestedTarget(action, text, subject, surface) {
 	if (action === "create" || action === "modify") {
-		if (surface !== "artifact") return {
-			target: {},
-			reasonCode: "requested_target_artifact_id_missing"
-		};
-		return { target: {
+		if (surface === "artifact") return { target: {
 			artifact_id: subject,
 			scope: parentScope(subject)
 		} };
+		const artifactType = boundedArtifactTypeOf(text);
+		if (artifactType && scopeIsPath(subject)) return { target: {
+			scope: subject,
+			artifact_type: artifactType
+		} };
+		return {
+			target: {},
+			reasonCode: "requested_target_artifact_id_missing"
+		};
 	}
 	if (action === "install" || action === "apply") {
 		const parsed = splitPackageSpec(actionObjectToken(text, action === "install" ? "install|add|安装" : "apply|应用", "package|plugin|包|插件"));
@@ -2065,7 +2260,8 @@ function segmentClauses(text, options = {}) {
 function captureItem(kind, body, sourceMessageId, id, revision, subject, surface, method, operation, interpretation) {
 	const sanitized = sanitizeClauseText(body);
 	const unsupportedVisual = /\bGUI\b|界面|视觉|截图|颜色|布局|视觉效果/i.test(sanitized);
-	const semanticAction = unsupportedVisual ? "generic_run" : semanticActionOfScope(sanitized, interpretation?.text ?? sanitized, kind === "prohibition");
+	let semanticAction = unsupportedVisual ? "generic_run" : semanticActionOfScope(sanitized, interpretation?.text ?? sanitized, kind === "prohibition");
+	if (semanticAction === "generic_run" && !unsupportedVisual && interpretation?.directive === "directive" && headVerbIsChangeWord(sanitized) && boundedArtifactTypeOf(sanitized) !== void 0) semanticAction = "modify";
 	const capturedTarget = captureRequestedTarget(semanticAction, sanitized, subject, surface);
 	const effectiveOperation = semanticAction === "verify" ? "verify" : operation;
 	const item = {
@@ -2147,7 +2343,202 @@ function captureClause(text, sourceMessageId, id, revision, scope = {}, options
 	const body = interpretation?.body ?? text;
 	const path$1 = extractArtifactPaths(sanitizeClauseText(body))[0] ?? "";
 	const surface = path$1 ? "artifact" : "scope";
-	return captureItem(kind, body, sourceMessageId, id, revision, path$1 || scope.cwd || "scope", surface, interpretation?.method ?? extractMethod(body), extractOperation(body), interpretation);
+	const item = captureItem(kind, body, sourceMessageId, id, revision, path$1 || scope.cwd || "scope", surface, interpretation?.method ?? extractMethod(body), extractOperation(body), interpretation);
+	if (interpretation) {
+		const at = text.indexOf(interpretation.text);
+		if (at >= 0) {
+			item.rawTextSha256 = sha256(text);
+			item.spans = [{
+				partIndex: 0,
+				start: utf8ByteOffset(text, at),
+				end: utf8ByteOffset(text, at) + utf8ByteLength(interpretation.text),
+				class: spanClassOf(kind, interpretation.directive, "root_instruction")
+			}];
+		}
+	}
+	return item;
+}
+
+//#endregion
+//#region src/domain/reason-class.ts
+const REASON_CLASS_TABLE = {
+	requested_target_package_id_missing: "parameter_missing",
+	requested_target_artifact_id_missing: "parameter_missing",
+	requested_target_repository_missing: "parameter_missing",
+	requested_target_service_id_missing: "parameter_missing",
+	requested_target_registry_missing_or_invalid: "parameter_missing",
+	target_clarification_required: "parameter_missing",
+	item_not_found: "parameter_missing",
+	item_revision_mismatch: "parameter_missing",
+	unsupported_action: "parameter_missing",
+	missing_evidence: "parameter_missing",
+	action_plan_target_missing: "parameter_missing",
+	action_plan_evidence_missing: "parameter_missing",
+	binding_missing_required_facet: "parameter_missing",
+	evidence_missing: "parameter_missing",
+	proof_subject_invalid: "parameter_missing",
+	proof_source_invalid: "parameter_missing",
+	proof_evidence_invalid: "parameter_missing",
+	generic_run_non_certifiable: "source_insufficient",
+	legacy_generic_run_non_certifiable: "source_insufficient",
+	legacy_authority_unclassified: "source_insufficient",
+	inquiry_non_certifiable: "source_insufficient",
+	inquiry_awaiting_delivery: "source_insufficient",
+	answer_delivered: "source_insufficient",
+	certified: "source_insufficient",
+	semantic_action_mismatch: "source_insufficient",
+	evidence_matches_no_facet: "source_insufficient",
+	requested_target_mismatch: "source_insufficient",
+	requested_resolved_target_mismatch: "source_insufficient",
+	binding_state_cross_pairing: "source_insufficient",
+	binding_resolution_cross_pairing: "source_insufficient",
+	binding_observed_state_mismatch: "source_insufficient",
+	binding_state_observation_overlap: "source_insufficient",
+	binding_expected_transition_mismatch: "source_insufficient",
+	binding_state_closure_rejected: "source_insufficient",
+	expected_transition_mismatch: "source_insufficient",
+	non_stateful_role_manifest_invalid: "source_insufficient",
+	resolved_target_incomplete: "source_insufficient",
+	state_closure_incomplete: "source_insufficient",
+	delegated_result_bounded: "source_insufficient",
+	proof_subject_unbound: "source_insufficient",
+	proof_source_unbound: "source_insufficient",
+	proof_surface_unbound: "source_insufficient",
+	proof_role_unbound: "source_insufficient",
+	proof_operation_unbound: "source_insufficient",
+	proof_scope_subject_unbound: "source_insufficient",
+	proof_scope_digest_mismatch: "source_insufficient",
+	proof_scope_digest_invalid: "source_insufficient",
+	proof_evidence_outcome_invalid: "source_insufficient",
+	proof_evidence_constraint_failed: "source_insufficient",
+	root_condition_pending: "condition_unmet",
+	prohibition_active: "condition_unmet",
+	ancestor_condition_unsatisfied: "condition_unmet",
+	ancestor_prohibition_active: "condition_unmet",
+	mutation_awaiting_root_condition: "condition_unmet",
+	mutation_awaiting_root_wait: "condition_unmet",
+	action_plan_order_mismatch: "condition_unmet",
+	adapter_unavailable: "producer_capability_unavailable",
+	host_unavailable: "producer_capability_unavailable",
+	stateful_adapter_unavailable: "producer_capability_unavailable",
+	proof_producer_capability_unavailable: "producer_capability_unavailable",
+	proof_readback_unavailable: "producer_capability_unavailable",
+	proof_external_fact_unavailable: "producer_capability_unavailable",
+	proof_external_fact_incomplete: "producer_capability_unavailable",
+	proof_source_bounded_delegation: "producer_capability_unavailable",
+	historical_evidence_gap: "historical_gap",
+	effect_only_insufficient_state_readback: "historical_gap",
+	rebind_evidence_predates_source: "historical_gap",
+	resolution_expected_transition_missing: "historical_gap",
+	resolution_expected_transition_digest_missing: "historical_gap",
+	resolution_expected_transition_digest_mismatch: "historical_gap",
+	resolution_expected_transition_invalid: "historical_gap",
+	integrity_invalid: "integrity_failure",
+	host_lock_unsupported: "integrity_failure",
+	certificate_missing: "integrity_failure",
+	certificate_replay_mismatch: "integrity_failure",
+	boundary_replay_mismatch: "integrity_failure",
+	proof_invalid: "integrity_failure",
+	proof_unbound: "integrity_failure",
+	proof_protocol_version_mismatch: "integrity_failure",
+	proof_digest_invalid: "integrity_failure",
+	proof_digest_mismatch: "integrity_failure",
+	proof_kind_unsupported: "integrity_failure",
+	proof_surface_unsupported: "integrity_failure",
+	proof_operation_unsupported: "integrity_failure",
+	proof_obligation_unbound: "integrity_failure",
+	proof_obligation_not_pending: "integrity_failure",
+	proof_evidence_unknown: "integrity_failure",
+	proof_evidence_wrong_epoch: "integrity_failure",
+	proof_manifest_invalid: "integrity_failure",
+	proof_obligations_missing: "integrity_failure",
+	proof_obligation_invalid: "integrity_failure",
+	proof_obligation_id_duplicate_or_invalid: "integrity_failure",
+	proof_asset_set_digest_invalid: "integrity_failure",
+	evidence_wrong_epoch: "integrity_failure",
+	evidence_outcome_not_success: "integrity_failure",
+	stale_host_lock: "integrity_failure",
+	stale_epoch: "integrity_failure",
+	stale_contract_revision: "integrity_failure",
+	stale_unit_ref: "integrity_failure",
+	stale_goal_ref: "integrity_failure",
+	legacy_certificate_in_v5_session: "integrity_failure",
+	certificate_version_unavailable: "integrity_failure",
+	mutation_integrity_unavailable: "integrity_failure",
+	item_missing_or_superseded: "integrity_failure",
+	unit_unavailable: "integrity_failure",
+	certificate_manifest_rejected: "integrity_failure",
+	session_ref_unavailable: "integrity_failure",
+	projection_durability_unavailable: "integrity_failure",
+	guard_unavailable: "integrity_failure",
+	binding_role_mismatch: "integrity_failure",
+	binding_role_order_invalid: "integrity_failure",
+	action_plan_evidence_reused: "integrity_failure",
+	action_plan_evidence_not_successful: "integrity_failure",
+	action_plan_evidence_predates_item: "integrity_failure",
+	action_plan_action_mismatch: "integrity_failure",
+	action_plan_incomplete: "integrity_failure",
+	action_plan_target_mismatch: "integrity_failure",
+	release_contract_required: "policy_boundary",
+	release_operation_not_adopted: "policy_boundary",
+	release_operation_unprotectable: "policy_boundary",
+	release_operation_unrouted: "policy_boundary",
+	release_runner_opaque: "policy_boundary",
+	release_contract_expired: "policy_boundary",
+	release_expiry_unevaluable: "policy_boundary",
+	release_expiry_invalid: "policy_boundary",
+	release_operations_missing: "policy_boundary",
+	release_operation_unknown: "policy_boundary",
+	release_candidate_missing: "policy_boundary",
+	release_candidate_ref_missing: "policy_boundary",
+	release_candidate_sha_invalid: "policy_boundary",
+	release_candidate_artifact_digest_invalid: "policy_boundary",
+	release_contract_malformed: "policy_boundary",
+	release_reservation_malformed: "policy_boundary",
+	release_settlement_malformed: "policy_boundary",
+	release_subcommand_unknown: "policy_boundary",
+	release_operation_consumed: "policy_boundary",
+	release_operation_in_flight: "policy_boundary",
+	release_candidate_sha_mismatch: "policy_boundary",
+	release_candidate_ref_mismatch: "policy_boundary",
+	release_candidate_repository_mismatch: "policy_boundary",
+	release_candidate_package_mismatch: "policy_boundary",
+	release_candidate_version_mismatch: "policy_boundary",
+	release_candidate_registry_mismatch: "policy_boundary",
+	release_candidate_artifact_mismatch: "policy_boundary",
+	release_candidate_artifact_sri_mismatch: "policy_boundary",
+	release_candidate_sha_unresolved: "policy_boundary",
+	release_candidate_ref_unresolved: "policy_boundary",
+	release_candidate_repository_unresolved: "policy_boundary",
+	release_candidate_package_unresolved: "policy_boundary",
+	release_candidate_version_unresolved: "policy_boundary",
+	release_candidate_registry_unresolved: "policy_boundary",
+	release_artifact_sha256_unresolved: "policy_boundary",
+	release_artifact_sri_unresolved: "policy_boundary",
+	release_artifact_identity_required: "policy_boundary",
+	release_candidate_sha256_invalid: "policy_boundary",
+	release_candidate_sri_invalid: "policy_boundary",
+	release_candidate_field_unknown: "policy_boundary",
+	release_candidate_unobservable: "policy_boundary",
+	release_contract_revoked: "policy_boundary",
+	release_contract_revocation_unknown: "policy_boundary",
+	release_state_damaged: "policy_boundary",
+	release_readiness_unresolved: "policy_boundary",
+	release_closure_unresolved: "policy_boundary",
+	release_target_package_mismatch: "policy_boundary",
+	release_target_version_mismatch: "policy_boundary",
+	release_target_registry_mismatch: "policy_boundary",
+	release_artifact_digest_unresolved: "policy_boundary",
+	release_target_unresolved: "policy_boundary",
+	release_contract_granted: "policy_boundary",
+	release_profile_not_adopted: "policy_boundary",
+	release_reservation_not_durable: "policy_boundary",
+	release_gate_unavailable: "policy_boundary",
+	strict_proof_required: "policy_boundary"
+};
+/** The seven-class label for one fine-grained reason code. */
+function reasonClassOf(reasonCode) {
+	return REASON_CLASS_TABLE[reasonCode] ?? "source_insufficient";
 }
 
 //#endregion
@@ -2183,7 +2574,20 @@ function evidenceFacets(p, item) {
 * adapter, an executed-without-evidence historical gap, or nothing to do —
 * and it NEVER recommends a rebind that cannot change certification.
 */
+/**
+* The unified diagnosis, with the frozen seven-class label attached (C12).
+*
+* The class is derived from whatever `reason_code` the judge decides, so a new
+* branch cannot drift from the classification table.
+*/
 function deriveItemDiagnosis(p, item) {
+	const diagnosis = judgeItemDiagnosis(p, item);
+	return {
+		...diagnosis,
+		reason_class: reasonClassOf(diagnosis.reason_code)
+	};
+}
+function judgeItemDiagnosis(p, item) {
 	const kind = taskKindOf(item);
 	const missing_facets = item.status === "pending" && kind !== "constraint" ? evidenceFacets(p, item) : [];
 	const base = {
@@ -2218,6 +2622,19 @@ function deriveItemDiagnosis(p, item) {
 		},
 		attempt_fingerprint: fingerprint(p, item, "certified")
 	};
+	if (item.status === "answered") return {
+		...base,
+		certification: "supported",
+		reason_code: "answer_delivered",
+		repairability: "none",
+		missing_fields: [],
+		missing_facets: [],
+		next_action: {
+			kind: "none",
+			resume_condition: "The host-confirmed final answer was delivered; no further binding needed."
+		},
+		attempt_fingerprint: fingerprint(p, item, "answer_delivered")
+	};
 	if (item.status === "pending" && item.waitAuthorization?.kind === "root_explicit_wait") return {
 		...base,
 		certification: "unavailable",
@@ -2231,6 +2648,22 @@ function deriveItemDiagnosis(p, item) {
 		},
 		attempt_fingerprint: fingerprint(p, item, "root_condition_pending")
 	};
+	if (kind === "inquiry") {
+		const closable = p.boundaryProtocol === 5;
+		return {
+			...base,
+			certification: "unsupported",
+			reason_code: closable ? "inquiry_awaiting_delivery" : "inquiry_non_certifiable",
+			repairability: "unsupported",
+			missing_fields: [],
+			missing_facets: [],
+			next_action: {
+				kind: "report_only",
+				resume_condition: closable ? "Deliver the actual answer; the host-confirmed final response of a completed turn closes this item." : "Complete the investigation and report the actual answer; the item stays recorded as uncertified. No confirmation or rebind changes this."
+			},
+			attempt_fingerprint: fingerprint(p, item, closable ? "inquiry_awaiting_delivery" : "inquiry_non_certifiable")
+		};
+	}
 	if (action !== "generic_run" && !item.legacyFlags?.length && item.targetCaptureStatus === "clarification_required") {
 		const missingFields = item.targetCaptureReasonCode ? [TARGET_FIELD_REASONS[item.targetCaptureReasonCode] ?? item.targetCaptureReasonCode] : [];
 		return {
@@ -2248,33 +2681,19 @@ function deriveItemDiagnosis(p, item) {
 			attempt_fingerprint: fingerprint(p, item, "target_clarification_required")
 		};
 	}
-	if (action === "generic_run" || item.legacyFlags?.length) {
-		if (kind === "inquiry") return {
-			...base,
-			certification: "unsupported",
-			reason_code: "inquiry_non_certifiable",
-			repairability: "unsupported",
-			missing_fields: [],
-			next_action: {
-				kind: "report_only",
-				resume_condition: "Complete the investigation and report the actual answer; the item stays recorded as uncertified. No confirmation or rebind changes this."
-			},
-			attempt_fingerprint: fingerprint(p, item, "inquiry_non_certifiable")
-		};
-		return {
-			...base,
-			certification: "unsupported",
-			reason_code: "generic_run_non_certifiable",
-			repairability: "user_input_required",
-			missing_fields: [],
-			next_action: {
-				kind: "report_only",
-				required_input: "a concrete supported action and target for this obligation",
-				resume_condition: "A fresh root-user instruction naming a supported action and exact target replaces the generic obligation; identical re-phrasing changes nothing."
-			},
-			attempt_fingerprint: fingerprint(p, item, "generic_run_non_certifiable")
-		};
-	}
+	if (action === "generic_run" || item.legacyFlags?.length) return {
+		...base,
+		certification: "unsupported",
+		reason_code: "generic_run_non_certifiable",
+		repairability: "user_input_required",
+		missing_fields: [],
+		next_action: {
+			kind: "report_only",
+			required_input: "a concrete supported action and target for this obligation",
+			resume_condition: "A rebind proposal mapping this obligation to a concrete supported action and target is the only thing that replaces it; after the durable confirmation the original is superseded atomically. Similar re-phrasing changes nothing."
+		},
+		attempt_fingerprint: fingerprint(p, item, "generic_run_non_certifiable")
+	};
 	if (p.hostStatus !== "supported") return {
 		...base,
 		certification: "unavailable",
@@ -2354,6 +2773,7 @@ const NATIVE_ADAPTERS = new Set([
 	"dsh.web.v1"
 ]);
 function evidenceAvailabilityReason(evidence) {
+	if (evidence.delegatedSubtask) return "delegated_result_bounded";
 	if (evidence.parseStatus !== "supported") return evidence.reasonCode ?? evidence.parseStatus ?? "adapter_unavailable";
 	if (!evidence.adapterId || !evidence.adapterVersion || (SUPPORTED_EVIDENCE_ADAPTERS[evidence.adapterId] ?? (NATIVE_ADAPTERS.has(evidence.adapterId) ? "1.0.0" : void 0)) !== evidence.adapterVersion) return "adapter_unavailable";
 	if (evidence.outcome !== "success") return "evidence_outcome_not_success";
@@ -2448,7 +2868,18 @@ function isFrozenV042RebindResponse(recorded) {
 /** Whether the partition changes certification at all: a same-generic split
 * is organizational at best and must not cost a user confirmation. */
 function certificationGain(item, candidates) {
-	if ((item.semanticAction ?? "generic_run") !== "generic_run") return true;
+	const current = item.semanticAction ?? "generic_run";
+	if (current !== "generic_run" && item.targetCaptureStatus === "clarification_required") return candidates.some((candidate) => {
+		if (candidate.action === void 0) return false;
+		if (candidate.action !== current && candidate.action !== "generic_run") return true;
+		const target = candidate.requestedTarget;
+		if (!target) return false;
+		const key = requestedIdentityKey(candidate.action);
+		if (key && Object.hasOwn(target, key)) return true;
+		if ((candidate.action === "create" || candidate.action === "modify") && target.artifact_type !== void 0 && target.scope !== void 0) return true;
+		return false;
+	});
+	if (current !== "generic_run") return true;
 	return candidates.some((candidate) => candidate.action !== void 0 && candidate.action !== "generic_run");
 }
 function preservesIdentity(old, clarified) {
@@ -2918,6 +3349,16 @@ function createProjection() {
 		checkpoints: [],
 		boundaries: [],
 		externalOperations: /* @__PURE__ */ new Map(),
+		units: /* @__PURE__ */ new Map(),
+		coverage: [],
+		releaseContracts: [],
+		releaseReservations: [],
+		releaseSettlements: [],
+		releaseDiagnostics: [],
+		releaseStateDamaged: false,
+		policy: "standard",
+		trustedSelections: [],
+		approvals: [],
 		sessionRefDigest: "11".repeat(32),
 		hostLockDigest: "22".repeat(32),
 		hostStatus: "supported",
@@ -2929,6 +3370,7 @@ function createProjection() {
 		noProgressClaims: /* @__PURE__ */ new Map(),
 		handledControlSeqs: /* @__PURE__ */ new Set(),
 		rebindRejections: /* @__PURE__ */ new Map(),
+		durabilityWatermark: "unknown",
 		integrity: "valid"
 	};
 }
@@ -3187,6 +3629,10 @@ function hasCurrentCertificate(projection) {
 	else if (checkpoint.sessionRefDigest !== projection.sessionRefDigest) reason = "foreign_session";
 	else if (checkpoint.hostLockDigest !== projection.hostLockDigest) reason = "stale_host_lock";
 	else if (checkpoint.contractRevision !== projection.contractRevision) reason = "stale_contract_revision";
+	else if (projection.boundaryProtocol === 5) {
+		if (checkpoint.certificateVersion !== "2") reason = "legacy_certificate_in_v5_session";
+		else if (checkpoint.unitId !== projection.currentUnitId) reason = "stale_unit_ref";
+	} else if (checkpoint.certificateVersion !== "1") reason = "certificate_version_unavailable";
 	else if (projection.currentGoalRef ? checkpoint.goalRef?.id !== projection.currentGoalRef.id || checkpoint.goalRef.revision !== projection.currentGoalRef.revision : checkpoint.goalRef !== void 0) reason = "stale_goal_ref";
 	projection.certificateStatusReason = reason;
 	return reason === void 0;
@@ -4073,6 +4519,74 @@ function certificationDigest(certificate) {
 	checkFieldCount(count);
 	return sha256Hex(Buffer.concat(parts));
 }
+const CERTIFICATE_V2_KEYS = [
+	"stopProtocolVersion",
+	"certificateVersion",
+	"epoch",
+	"sessionRefDigest",
+	"hostLockDigest",
+	"contractRevision",
+	"contractSha256",
+	"unitId",
+	"unitClosureDigest",
+	"evidenceSha256",
+	"bindingDigest",
+	"goalRef"
+];
+/**
+* 0.6.0 v2 certificate field table over the new `ccg.certificationDigest.v4`
+* domain (P0 §1): the certified scope is a work unit's closure instead of the
+* whole session. digest_v3 domains and their golden vectors stay frozen; this
+* function never re-reads a v1 record.
+*/
+function certificationDigestV2(certificate) {
+	requireExactKeys(certificate, CERTIFICATE_V2_KEYS, "certificateV2");
+	const parts = [Buffer.from("ccg.certificationDigest.v4\n", "utf8")];
+	let count = 0;
+	parts.push(field("stopProtocolVersion", typedToken(expectString(certificate.stopProtocolVersion, "stopProtocolVersion"))));
+	parts.push(field("certificateVersion", typedToken(expectString(certificate.certificateVersion, "certificateVersion"))));
+	parts.push(field("epoch", typedToken(expectInt(certificate.epoch, "epoch"))));
+	parts.push(field("sessionRefDigest", typedToken({
+		k: "x",
+		v: expectHex(certificate.sessionRefDigest)
+	})));
+	parts.push(field("hostLockDigest", typedToken({
+		k: "x",
+		v: expectHex(certificate.hostLockDigest)
+	})));
+	parts.push(field("contractRevision", typedToken(expectInt(certificate.contractRevision, "contractRevision"))));
+	parts.push(field("contractSha256", typedToken({
+		k: "x",
+		v: expectHex(certificate.contractSha256)
+	})));
+	count += 7;
+	parts.push(field("unitId", typedToken(expectString(certificate.unitId, "unitId"))));
+	parts.push(field("unitClosureDigest", typedToken({
+		k: "x",
+		v: expectHex(certificate.unitClosureDigest)
+	})));
+	parts.push(field("evidenceSha256", typedToken({
+		k: "x",
+		v: expectHex(certificate.evidenceSha256)
+	})));
+	parts.push(field("bindingDigest", typedToken({
+		k: "x",
+		v: expectHex(certificate.bindingDigest)
+	})));
+	count += 4;
+	const goalRef = certificate.goalRef;
+	if (goalRef !== void 0 && goalRef !== null) {
+		requireExactKeys(goalRef, GOAL_REF_KEYS, "goalRef");
+		parts.push(optField("goalRefId", expectString(goalRef.id, "goalRef.id"), (v) => typedToken(v)));
+		parts.push(optField("goalRefRevision", expectInt(goalRef.revision, "goalRef.revision"), (v) => typedToken(v)));
+	} else {
+		parts.push(optField("goalRefId", null, () => Buffer.alloc(0)));
+		parts.push(optField("goalRefRevision", null, () => Buffer.alloc(0)));
+	}
+	count += 2;
+	checkFieldCount(count);
+	return sha256Hex(Buffer.concat(parts));
+}
 /**
 * Verifier-side role matrix and binding closure. Digest derivation stays
 * pure; this mirrors the checks a proof verifier must run before accepting a
@@ -4389,7 +4903,7 @@ function closingHint(projection, item, evidenceIds) {
 	else parts.push("needs a state-verification evidence (read tool, or a deterministic check run in scope) matching the subject");
 	return parts.join("; ");
 }
-function openItems$1(projection) {
+function openItems(projection) {
 	return [...projection.items.values()].filter((item) => item.status === "pending").sort((a, b) => a.revision - b.revision || (a.id < b.id ? -1 : 1));
 }
 /**
@@ -4399,7 +4913,7 @@ function openItems$1(projection) {
 * injected once instead of looping (v0.2.1).
 */
 function recoveryDigest(packet, projection) {
-	const items = openItems$1(projection);
+	const items = openItems(projection);
 	const evidence = [...projection.evidence.values()].filter((row) => items.some((item) => relevantEvidence(projection, item, row)));
 	return sha256(JSON.stringify({
 		packet,
@@ -4413,7 +4927,7 @@ function renderRecoveryPacket(projection, options = {}) {
 	const budget = options.charBudget ?? DEFAULT_RECOVERY_CHAR_BUDGET;
 	if (!Number.isSafeInteger(budget) || budget < MIN_RECOVERY_CHAR_BUDGET) throw new RangeError("recovery charBudget must be an integer >= 512");
 	const clip = (text, size) => text.length <= size ? text : text.slice(0, size - 1) + "…";
-	const items = openItems$1(projection).sort((a, b) => Number(b.kind === "prohibition") - Number(a.kind === "prohibition") || b.revision - a.revision || a.id.localeCompare(b.id));
+	const items = openItems(projection).sort((a, b) => Number(b.kind === "prohibition") - Number(a.kind === "prohibition") || b.revision - a.revision || a.id.localeCompare(b.id));
 	const rejected$1 = options.rejectedBindings ?? (projection.lastCheckpointRejectionRevision === projection.contractRevision ? projection.lastCheckpointRejections : []) ?? [];
 	const compact = budget < 1e3;
 	const lines = [`Context Guard: ${items.length} pending; revision ${projection.contractRevision}.`, compact ? "Checkpoint required before completion. Qualified safe end preserves pending work; it is not completion." : COMPLETION_RULE];
@@ -4440,7 +4954,7 @@ function renderRecoveryPacket(projection, options = {}) {
 			if (add(`[${clip(item.id, 20)}] root_condition_pending; wait for trusted root: ${item.resumeEvent ?? item.condition ?? item.normalizedText}; do not execute before release`, compact ? 160 : 310)) count++;
 			return;
 		}
-		const remedy = diagnosis.repairability === "agent_repairable" ? "Collect matching evidence; checkpoint" : diagnosis.repairability === "historical_gap" ? "Read back observed state; do not re-execute" : diagnosis.certification === "unsupported" ? "Deliver honestly; stays uncertified unless a fresh instruction names a supported action" : "Restore audited host/adapter capability";
+		const remedy = diagnosis.repairability === "agent_repairable" ? "Collect matching evidence; checkpoint" : diagnosis.repairability === "historical_gap" ? "Read back observed state; do not re-execute" : diagnosis.next_action.kind === "clarify_target" ? "Supply the exact target; then collect evidence and checkpoint" : diagnosis.certification === "unsupported" ? "Deliver honestly; stays uncertified unless a fresh instruction names a supported action" : "Restore audited host/adapter capability";
 		if (add(`[${clip(item.id, 20)}] ${diagnosis.reason_code}; ${compact ? remedy : diagnosis.next_action.resume_condition ?? remedy}; ${clip(item.normalizedText, 70)}`, compact ? 110 : 310)) count++;
 	};
 	if (constraints[0]) constraint(constraints[0]);
@@ -4457,78 +4971,1044 @@ function renderRecoveryPacket(projection, options = {}) {
 }
 
 //#endregion
-//#region src/domain/checkpoint.ts
-function stable$2(value) {
-	if (Array.isArray(value)) return `[${value.map(stable$2).join(",")}]`;
-	if (value && typeof value === "object") return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, entry]) => `${JSON.stringify(key)}:${stable$2(entry)}`).join(",")}}`;
-	return JSON.stringify(value);
+//#region src/domain/work-unit.ts
+/**
+* Work-unit derivation rules (0.6.0, C04). Units are derived from the durable
+* message stream — nothing is ever written to the log — so the classification
+* below must stay deterministic and conservative: an ambiguous relation keeps
+* the current unit rather than inventing a new one, and a mis-assigned
+* obligation is recoverable through clarification, never through a silent
+* unit rewrite.
+*
+* The rules are the frozen P0 §3 C04 decision, in evaluation order:
+*
+* 1. The session's first root task message opens U001.
+* 2. A message explicitly linked to the current unit (item-ID reference,
+*    rebind control, a direct answer while an inquiry is open) stays in it.
+* 3. When the current unit has no open executable obligations left, a
+*    directive-bearing message opens a new unit; the old one is switched away,
+*    never retroactively closed.
+* 4. While the current unit still has open work, only an EXPLICIT switch
+*    marker (closed vocabulary, fixture-pinned) opens a new unit; anything
+*    else stays in the current unit.
+* 5. A DELEGATION-marked message opens a CHILD unit of the current unit. The
+*    child's open obligations are required descendants of the parent's
+*    closure (C04), so the parent cannot be certified while the delegated
+*    work is open, and the delegated result itself never closes the parent.
+*/
+/** Explicit task-switch markers; a closed vocabulary pinned by the v2 fixture. */
+const SWITCH_MARKER = new RegExp([
+	"^(?:另外|此外|另一(?:件事|个任务|个话题)|换个?话题|下一个任务|新任务|下一个问题|先做(?:另一|别的))[：:，,。。\\s]",
+	"^(?:now\\s+a\\s+)?(?:different|new|separate)\\s+task\\b",
+	"^next\\s+task\\b",
+	"^(?:on\\s+a\\s+related\\s+note|by\\s+the\\s+way)\\b"
+].join("|"), "i");
+/**
+* Explicit delegation markers; the same closed-vocabulary discipline as the
+* switch markers, pinned by the v2 fixture. Only a root message that actually
+* hands work to a subagent/subtask opens a child unit — "let the subagent …",
+* "delegate … to a subagent", "spawn a subagent …".
+*/
+const DELEGATION_MARKER = new RegExp([
+	"(?:让|由|交给|委派给?|派给|安排)(?:一个)?(?:子代理|子任务|子会话|小助手)",
+	"(?:子代理|子任务|子会话)(?:去|来|负责|执行|完成)",
+	"\\bdelegate\\s+(?:this|it|the\\s+\\w+|\\w+)\\s+to\\s+(?:a\\s+|the\\s+)?(?:subagent|sub-agent|child\\s+agent)\\b",
+	"\\b(?:spawn|dispatch|hand\\s+(?:this|it)\\s+off\\s+to)\\s+(?:a\\s+|the\\s+)?(?:subagent|sub-agent|child\\s+agent)\\b",
+	"\\bsub-?agent\\s+(?:should|must|to)\\s+\\w+"
+].join("|"), "i");
+/**
+* Whether a root message opens a new work unit rather than joining the
+* current one. `directiveBearing` says the message produced (or would
+* produce) requirement/acceptance work; `openWorkInCurrentUnit` is evaluated
+* against the state BEFORE the message is captured.
+*/
+function opensNewUnit(projection, text, directiveBearing, openWorkInCurrentUnit) {
+	if (!directiveBearing) return false;
+	if (DELEGATION_MARKER.test(text)) return true;
+	if (SWITCH_MARKER.test(text)) return true;
+	return !openWorkInCurrentUnit;
 }
-function tuplesEqual(left, right) {
-	return stable$2(left ?? {}) === stable$2(right ?? {});
+/**
+* Whether this message opens a child (delegated) unit of the current unit
+* rather than a sibling. Only meaningful together with {@link opensNewUnit}.
+*/
+function opensChildUnit(projection, text) {
+	return projection.currentUnitId !== void 0 && DELEGATION_MARKER.test(text);
 }
-function transitionsEqual(left, right) {
-	return stable$2(left) === stable$2(right);
+/** An explicit reference to a contract item identity (R001/A001/P001/U001). */
+const ITEM_REFERENCE = /\b([RAPU]\d{3})\b/g;
+/**
+* Whether the message explicitly links itself to the current unit's items.
+*
+* A reference counts only when it names an item that still exists as live work:
+* an ID that never existed, or one already `passed`/`superseded`, is history and
+* cannot pull a new instruction back into an old unit. A live item binds when it
+* belongs to the current unit's lineage — the current unit, an ancestor, or a
+* required descendant — while a unit-less (pre-v5) obligation is always a
+* legitimate continuation target.
+*/
+function explicitlyLinkedToCurrentUnit(projection, text) {
+	const current = projection.currentUnitId;
+	const lineage = current === void 0 ? void 0 : new Set([
+		current,
+		...unitAncestorIds(projection, current),
+		...unitDescendantIds(projection, current)
+	]);
+	for (const match of text.matchAll(ITEM_REFERENCE)) {
+		const item = projection.items.get(match[1]);
+		if (!item) continue;
+		if (item.status === "passed" || item.status === "superseded") continue;
+		if (lineage === void 0 || item.unitId === void 0) return true;
+		if (lineage.has(item.unitId)) return true;
+	}
+	return false;
 }
-function transitionIsSelfConsistent(action, transition) {
-	if (!transition?.parameters || transition.predicateId !== ACTION_MANIFEST.actions[action].predicateId || transition.version !== 1 || transition.predParamsKind !== "inline") return false;
-	const recomputed = predParamsDigest(transition.parameters, resolveAllowlist("product"));
-	return transition.parametersDigest === void 0 || transition.parametersDigest === recomputed;
+/** The next unit identity in the session's sequence. */
+function nextUnitId(projection) {
+	let max = 0;
+	for (const unitId of projection.units.keys()) {
+		const num = Number(unitId.slice(1));
+		if (Number.isInteger(num) && num > max) max = num;
+	}
+	return `U${String(max + 1).padStart(3, "0")}`;
 }
-function evidenceFact(evidence) {
-	return {
-		id: evidence.id,
-		outcome: evidence.outcome,
-		method: evidence.toolName,
-		operations: (evidence.operations ?? []).map((entry) => entry.op),
-		executables: evidence.executables ?? [],
-		subjects: evidence.subjects,
-		surfaces: evidence.surfaces,
-		semanticAction: evidence.semanticAction ?? "generic_run",
-		evidenceRole: evidence.evidenceRole ?? "effect",
-		resolvedTarget: evidence.resolvedTarget ?? {},
-		observedState: evidence.observedState,
-		parseStatus: evidence.parseStatus ?? "adapter_unavailable",
-		reasonCode: evidence.reasonCode ?? (evidence.parseStatus ? void 0 : "adapter_unavailable"),
-		adapterId: evidence.adapterId,
-		adapterVersion: evidence.adapterVersion
-	};
+/**
+* Open a work unit.
+*
+* A SIBLING unit (no parent) becomes current and switches the previous current
+* unit away: that is a task switch, and the old unit's residual work stays
+* visible but no longer blocks the new task.
+*
+* A CHILD unit (delegated sub-unit) does NOT become current. The parent keeps
+* owning the session's certified scope, so the parent's own obligations are
+* never dropped when it delegates part of the work — the child's obligations
+* join the parent's closure as required descendants instead (C04). The child
+* is only ever created under an existing parent; a stray parent id would
+* create an orphan lineage, so it is dropped.
+*/
+function openUnit(projection, seq, headline, parentUnitId) {
+	const unitId = nextUnitId(projection);
+	const parent = parentUnitId !== void 0 && projection.units.has(parentUnitId) ? parentUnitId : void 0;
+	if (parent === void 0) {
+		const previous = projection.currentUnitId !== void 0 ? projection.units.get(projection.currentUnitId) : void 0;
+		if (previous && previous.switchedAwayAtSeq === void 0) previous.switchedAwayAtSeq = seq;
+		projection.currentUnitId = unitId;
+	}
+	const unit = {
+		unitId,
+		openedAtSeq: seq,
+		rootInputRefs: [{ seq }],
+		headline,
+		...parent !== void 0 ? { parentUnitId: parent } : {}
+	};
+	projection.units.set(unitId, unit);
+	return unit;
+}
+/** Fold one later root message into the current unit's input references. */
+function foldIntoCurrentUnit(projection, seq) {
+	const unit = projection.currentUnitId !== void 0 ? projection.units.get(projection.currentUnitId) : void 0;
+	if (unit) unit.rootInputRefs.push({ seq });
 }
-function citedEvidence(projection, binding) {
-	return binding.evidenceIds.map((id) => projection.evidence.get(id)).filter((value) => value !== void 0);
+/**
+* The ancestors of `unitId`, nearest first. Lineage is derived from the
+* derived `parentUnitId` chain; a cycle (impossible from the derivation, but
+* possible in a hand-built projection) terminates instead of hanging.
+*/
+function unitAncestorIds(projection, unitId) {
+	const ancestors = [];
+	const seen = new Set([unitId]);
+	let cursor = projection.units.get(unitId)?.parentUnitId;
+	while (cursor !== void 0 && !seen.has(cursor)) {
+		ancestors.push(cursor);
+		seen.add(cursor);
+		cursor = projection.units.get(cursor)?.parentUnitId;
+	}
+	return ancestors;
 }
-function evidenceProblem(projection, item, binding) {
-	const missing = binding.evidenceIds.filter((id) => !projection.evidence.has(id));
-	if (missing.length) return {
-		itemId: item.id,
-		reason: "cited evidence is missing",
-		reasonCode: "evidence_missing",
-		offendingEvidenceIds: missing
-	};
-	if (item.reboundFrom) {
-		const sourceSeq = /^m(\d+)(?::|$)/.exec(item.sourceMessageId);
-		const tooEarly = binding.evidenceIds.filter((id) => !sourceSeq || projection.evidence.get(id).toolResultSeq < Number(sourceSeq[1]));
-		if (tooEarly.length) return {
-			itemId: item.id,
-			reason: "evidence predates the authoritative root clause used by this replacement",
-			reasonCode: "rebind_evidence_predates_source",
-			offendingEvidenceIds: tooEarly
-		};
+/**
+* Every required descendant of `unitId`, in stable unit order: the units whose
+* `parentUnitId` chain reaches `unitId`. The closure of a unit includes the
+* open obligations of this set (C04).
+*/
+function unitDescendantIds(projection, unitId) {
+	const descendants = [];
+	const seen = new Set([unitId]);
+	const queue = [unitId];
+	while (queue.length > 0) {
+		const current = queue.shift();
+		for (const unit of projection.units.values()) {
+			if (unit.parentUnitId !== current || seen.has(unit.unitId)) continue;
+			seen.add(unit.unitId);
+			descendants.push(unit.unitId);
+			queue.push(unit.unitId);
+		}
 	}
-	const wrongEpoch = binding.evidenceIds.filter((id) => projection.evidence.get(id)?.epoch !== projection.epoch);
-	if (wrongEpoch.length) return {
-		itemId: item.id,
-		reason: "cited evidence belongs to a different epoch",
-		reasonCode: "evidence_wrong_epoch",
-		offendingEvidenceIds: wrongEpoch
-	};
-	const notSuccess = binding.evidenceIds.filter((id) => projection.evidence.get(id)?.outcome !== "success");
-	if (notSuccess.length) return {
-		itemId: item.id,
-		reason: "cited evidence outcome is not success",
-		reasonCode: "evidence_outcome_not_success",
-		offendingEvidenceIds: notSuccess
-	};
-	const requiredAction = item.semanticAction ?? "generic_run";
+	return descendants.sort();
+}
+/** Record one delegated round-trip inside a unit as bounded audit evidence. */
+function recordDelegation(projection, unitId, ref) {
+	const unit = projection.units.get(unitId);
+	if (!unit) return;
+	const refs = unit.delegationRefs ?? [];
+	if (refs.some((entry) => entry.callId === ref.callId)) return;
+	refs.push({ ...ref });
+	unit.delegationRefs = refs;
+}
+/**
+* Whether the current unit still holds open executable work — the rule-3
+* handover test, evaluated BEFORE the new message's items are inserted.
+*
+* This is the SAME closure the certificate uses: the current unit's own open
+* work plus the open work of every required descendant unit. A parent whose own
+* items are all passed but whose delegated child is still open has not finished,
+* so an ordinary follow-up must not be treated as a handover to a new sibling
+* task — that would silently exclude the child from the certified scope.
+*/
+function currentUnitHasOpenWork(projection) {
+	const current = projection.currentUnitId;
+	if (current === void 0) return false;
+	const closure = new Set([current, ...unitDescendantIds(projection, current)]);
+	return [...projection.items.values()].some((item) => item.status === "pending" && item.unitId !== void 0 && closure.has(item.unitId) && item.kind !== "prohibition");
+}
+
+//#endregion
+//#region src/domain/closure.ts
+/**
+* The single open-closure implementation (0.6.0, C02/C04/D06-03/D06-07).
+*
+* Before 0.6.0, checkpoint, recovery, diagnostics, and the Goal gate each
+* filtered pending obligations with their own slightly different rule, and the
+* answers could disagree. Every question about "what is open" now goes through
+* this module:
+*
+* - {@link visiblePendingItems} — everything still pending, constraints first
+*   in spirit: display surfaces (recovery, status, checkpoint pages) show
+*   prohibitions too, because a constraint is never finished work.
+* - {@link certifiableOpenItems} — the obligations a completion certificate
+*   answers for: pending, not a prohibition. Prohibitions are standing
+*   constraints, never counted work; `answered` items closed by a trusted
+*   delivery are no longer open; `passed` and `superseded` never were.
+* - {@link unitClosureItemIds} — the v5 unit closure: the certified scope of
+*   one work unit, which is the unit's OWN open obligations PLUS the open
+*   obligations of every required descendant unit.
+* - {@link ancestorConstraints} / {@link ancestorConstraintForBinding} — the
+*   ancestor units' standing constraints (prohibitions and unsatisfied
+*   conditions) that stay in force for a descendant's matching obligations.
+*
+* Legacy sessions (no v5 boundary) have no units: they certify the whole
+* session, exactly what {@link certifiableOpenItems} returns.
+*/
+/** Every pending item, in stable display order. Constraints stay visible. */
+function visiblePendingItems(projection) {
+	return [...projection.items.values()].filter((item) => item.status === "pending").sort((a, b) => a.revision - b.revision || (a.id < b.id ? -1 : 1));
+}
+/** The obligations a completion certificate answers for: open work, no constraints. */
+function certifiableOpenItems(projection) {
+	return visiblePendingItems(projection).filter((item) => item.kind !== "prohibition");
+}
+/**
+* The certifiable open obligations inside one work unit's closure: the unit's
+* own open work plus the open work of every required descendant unit.
+*
+* A delegated child unit is REQUIRED work of its parent (C04): the parent has
+* not finished while the sub-unit it handed work to still has open
+* obligations, so the parent's certificate must answer for them too. The
+* reverse is deliberately not true — a child may be certified while unrelated
+* residual work exists in an ancestor or a sibling, which is what keeps a task
+* switch from being blocked by history.
+*/
+function unitClosureItemIds(projection, unitId) {
+	if (projection.boundaryProtocol !== 5) return [];
+	const inClosure = new Set([unitId, ...unitDescendantIds(projection, unitId)]);
+	return certifiableOpenItems(projection).filter((item) => item.unitId !== void 0 && inClosure.has(item.unitId)).map((item) => item.id);
+}
+/** Whether a prohibition declares no identity at all — a blanket ban on the action. */
+function isBlanketProhibition(action, requested) {
+	const key = requestedIdentityKey(action);
+	if (!key) return false;
+	return !requested || !Object.hasOwn(requested, key);
+}
+/** The ancestor obligations that act as standing constraints on this unit. */
+function standingAncestorConstraints(projection, unitId) {
+	if (projection.boundaryProtocol !== 5) return [];
+	const ancestors = unitAncestorIds(projection, unitId);
+	if (ancestors.length === 0) return [];
+	return visiblePendingItems(projection).filter((item) => {
+		if (item.unitId === void 0 || !ancestors.includes(item.unitId)) return false;
+		if (item.kind === "prohibition") return true;
+		return item.authorityDisposition === "conditional_wait" || item.waitAuthorization !== void 0;
+	});
+}
+/**
+* The ancestor constraint that blocks certifying `item` against a resolved
+* target, if any. This is the authoritative judge used by the certifier: the
+* ancestor constraint is compared with the SAME conservative identity rule the
+* mutation authorization uses, so a ban or an unsatisfied condition cannot be
+* discharged by certifying a descendant obligation that resolves the target
+* the ancestor constrained.
+*/
+function ancestorConstraintForBinding(projection, item, resolvedTarget) {
+	if (item.unitId === void 0) return void 0;
+	const action = item.semanticAction;
+	if (!action || action === "generic_run" || !isStatefulAction(action)) return void 0;
+	for (const constraint of standingAncestorConstraints(projection, item.unitId)) {
+		if (constraint.id === item.id || constraint.semanticAction !== action) continue;
+		if (!(constraint.kind === "prohibition" && isBlanketProhibition(action, constraint.requestedTarget) || requestedTargetMatchesResolved(action, constraint.requestedTarget, resolvedTarget))) continue;
+		return {
+			constraintId: constraint.id,
+			constraintUnitId: constraint.unitId,
+			itemId: item.id,
+			kind: constraint.kind === "prohibition" ? "prohibition" : "condition",
+			reasonCode: constraint.kind === "prohibition" ? "ancestor_prohibition_active" : "ancestor_condition_unsatisfied"
+		};
+	}
+}
+/**
+* The closure a completion certificate must answer for right now.
+*
+* Legacy sessions certify the whole session. v5 sessions certify the current
+* work unit's closure PLUS every pre-v5 obligation: items captured before the
+* boundary carry no unit and keep their birth rules, so a unit certificate
+* must never silently shrink their scope (migration table, P0 §6).
+*/
+function certificateClosure(projection) {
+	if (projection.boundaryProtocol === 5) {
+		const legacyIds = certifiableOpenItems(projection).filter((item) => item.unitId === void 0).map((item) => item.id);
+		const unitIds = projection.currentUnitId !== void 0 ? unitClosureItemIds(projection, projection.currentUnitId) : [];
+		return {
+			unitId: projection.currentUnitId,
+			itemIds: [...legacyIds, ...unitIds]
+		};
+	}
+	return { itemIds: certifiableOpenItems(projection).map((item) => item.id) };
+}
+
+//#endregion
+//#region src/domain/proof.ts
+const PROOF_PROTOCOL_VERSION = "0.4.0";
+const PROOF_KINDS = [
+	"subject_readback",
+	"scope_coverage",
+	"state_verification"
+];
+function stable$2(value) {
+	if (Array.isArray(value)) return `[${value.map(stable$2).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${JSON.stringify(k)}:${stable$2(v)}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+function digest(value) {
+	return createHash("sha256").update("ccg.proofManifest.v1\n", "utf8").update(stable$2(value), "utf8").digest("hex");
+}
+function validDigest(value) {
+	return /^[0-9a-f]{64}$/.test(value);
+}
+/**
+* The manifest digest root includes every integrity-bearing field, so a
+* tampered asset-set digest is exactly as detectable as a tampered obligation.
+*/
+function proofDigest(obligations, assetSetSha256) {
+	return digest({
+		proofProtocolVersion: PROOF_PROTOCOL_VERSION,
+		obligations: [...obligations],
+		...assetSetSha256 !== void 0 ? { assetSetSha256 } : {}
+	});
+}
+function validateProofManifest(manifest) {
+	const errors = [];
+	if (!manifest || typeof manifest !== "object") return ["proof_manifest_invalid"];
+	const value = manifest;
+	if (value.proofProtocolVersion !== PROOF_PROTOCOL_VERSION) errors.push("proof_protocol_version_mismatch");
+	if (!Array.isArray(value.obligations)) errors.push("proof_obligations_missing");
+	if (value.assetSetSha256 !== void 0 && (typeof value.assetSetSha256 !== "string" || !validDigest(value.assetSetSha256))) errors.push("proof_asset_set_digest_invalid");
+	if (typeof value.proofSha256 !== "string" || !validDigest(value.proofSha256)) errors.push("proof_digest_invalid");
+	const obligations = Array.isArray(value.obligations) ? value.obligations : [];
+	const ids = /* @__PURE__ */ new Set();
+	for (const raw of obligations) {
+		if (!raw || typeof raw !== "object") {
+			errors.push("proof_obligation_invalid");
+			continue;
+		}
+		const obligation = raw;
+		if (typeof obligation.obligationId !== "string" || ids.has(obligation.obligationId)) errors.push("proof_obligation_id_duplicate_or_invalid");
+		if (typeof obligation.obligationId === "string") ids.add(obligation.obligationId);
+		if (!PROOF_KINDS.includes(obligation.kind)) errors.push("proof_kind_unsupported");
+		if (![
+			"artifact",
+			"ui",
+			"visual",
+			"scope"
+		].includes(String(obligation.surface))) errors.push("proof_surface_unsupported");
+		if (!Array.isArray(obligation.subjectIds) || obligation.subjectIds.length === 0 || obligation.subjectIds.some((id) => typeof id !== "string" || id.startsWith("codex:unsupported/"))) errors.push("proof_subject_invalid");
+		if (!Array.isArray(obligation.evidenceIds) || obligation.evidenceIds.length === 0 || new Set(obligation.evidenceIds).size !== obligation.evidenceIds.length) errors.push("proof_evidence_invalid");
+		const expected = obligation.expectedScopeDigest;
+		const observed = obligation.observedScopeDigest;
+		for (const digestValue of [expected, observed]) if (digestValue !== void 0 && (typeof digestValue !== "string" || !validDigest(digestValue))) errors.push("proof_scope_digest_invalid");
+		if (expected !== void 0 && observed !== expected) errors.push("proof_scope_digest_mismatch");
+		if (expected === void 0 && observed !== void 0) errors.push("proof_scope_digest_mismatch");
+	}
+	if (errors.length === 0) {
+		const assetSet = typeof value.assetSetSha256 === "string" ? value.assetSetSha256 : void 0;
+		if (value.proofSha256 !== proofDigest(obligations, assetSet)) errors.push("proof_digest_mismatch");
+	}
+	return [...new Set(errors)];
+}
+function createProofManifest(obligations, assetSetSha256) {
+	const normalized = obligations.map((obligation) => ({
+		obligationId: obligation.obligationId,
+		kind: obligation.kind,
+		surface: obligation.surface,
+		subjectIds: [...obligation.subjectIds].sort(),
+		evidenceIds: [...obligation.evidenceIds].sort(),
+		...obligation.expectedScopeDigest ? { expectedScopeDigest: obligation.expectedScopeDigest } : {},
+		...obligation.observedScopeDigest ? { observedScopeDigest: obligation.observedScopeDigest } : {}
+	})).sort((a, b) => a.obligationId.localeCompare(b.obligationId));
+	const manifest = {
+		proofProtocolVersion: PROOF_PROTOCOL_VERSION,
+		obligations: normalized,
+		...assetSetSha256 !== void 0 ? { assetSetSha256 } : {},
+		proofSha256: proofDigest(normalized, assetSetSha256)
+	};
+	const errors = validateProofManifest(manifest);
+	if (errors.length) throw new Error(`proof manifest rejected: ${errors.join(",")}`);
+	return manifest;
+}
+/**
+* Bind a structurally valid proof to the actual replayed projection: every
+* obligation must name a pending item, every evidence id must exist in the
+* projection, and every bound evidence must satisfy the obligation's kind,
+* surface, subject, and outcome constraints. An empty projection therefore
+* rejects any proof, and cross-item or foreign evidence can never bind.
+*/
+function bindProofToProjection(projection, proof) {
+	const errors = [];
+	const items = projection.items;
+	const evidence = projection.evidence;
+	for (const obligation of proof.obligations) {
+		const item = items.get(obligation.obligationId);
+		if (!item) {
+			errors.push("proof_obligation_unbound");
+			continue;
+		}
+		if (item.status !== "pending") {
+			errors.push("proof_obligation_not_pending");
+			continue;
+		}
+		if (item.verification.surface !== void 0 && item.verification.surface !== obligation.surface) errors.push("proof_surface_unbound");
+		const seen = /* @__PURE__ */ new Set();
+		for (const evidenceId of obligation.evidenceIds) {
+			const record = evidence.get(evidenceId);
+			if (!record) {
+				errors.push("proof_evidence_unknown");
+				continue;
+			}
+			if (!seen.has(evidenceId)) seen.add(evidenceId);
+			if (record.outcome !== "success") {
+				errors.push("proof_evidence_outcome_invalid");
+				continue;
+			}
+			if (!proofEvidenceConstraints(record, obligation)) errors.push("proof_evidence_constraint_failed");
+		}
+		if (obligation.kind === "scope_coverage") {
+			const itemScope = item.requestedTarget?.scope;
+			const itemSubject = item.verification.subject;
+			if (!obligation.subjectIds.every((subject) => subject === itemScope || subject === itemSubject)) errors.push("proof_scope_subject_unbound");
+		}
+	}
+	return [...new Set(errors)];
+}
+function canonicalProjection(projection) {
+	return {
+		epoch: projection.epoch,
+		contractRevision: projection.contractRevision,
+		sessionRefDigest: projection.sessionRefDigest,
+		hostLockDigest: projection.hostLockDigest,
+		hostStatus: projection.hostStatus,
+		hostCohortId: projection.hostCohortId,
+		integrity: projection.integrity,
+		items: [...projection.items.values()].map(({ id, revision, kind, status, semanticAction, requestedTarget, verification }) => ({
+			id,
+			revision,
+			kind,
+			status,
+			semanticAction,
+			requestedTarget,
+			verification
+		})).sort((a, b) => a.id.localeCompare(b.id)),
+		evidence: [...projection.evidence.values()].map(({ id, epoch, toolName, outcome, capabilities, subjects, surfaces: surfaces$1, operations, semanticAction, evidenceRole, resolvedTarget, observedState }) => ({
+			id,
+			epoch,
+			toolName,
+			outcome,
+			capabilities,
+			subjects,
+			surfaces: surfaces$1,
+			operations,
+			semanticAction,
+			evidenceRole,
+			resolvedTarget,
+			observedState
+		})).sort((a, b) => a.id.localeCompare(b.id)),
+		checkpoints: projection.checkpoints.map(({ id, certificationDigest: certificationDigest$1, result }) => ({
+			id,
+			certificationDigest: certificationDigest$1,
+			result
+		}))
+	};
+}
+function sessionQuery(projection, proof) {
+	if (proof) {
+		if (validateProofManifest(proof).length) return {
+			sessionRefDigest: projection.sessionRefDigest,
+			epoch: projection.epoch,
+			contractRevision: projection.contractRevision,
+			state: "corrupt",
+			reasonCode: "proof_invalid",
+			cohortId: projection.hostCohortId
+		};
+		if (bindProofToProjection(projection, proof).length) return {
+			sessionRefDigest: projection.sessionRefDigest,
+			epoch: projection.epoch,
+			contractRevision: projection.contractRevision,
+			state: "corrupt",
+			reasonCode: "proof_unbound",
+			cohortId: projection.hostCohortId
+		};
+	}
+	const state = projection.integrity === "valid" ? projection.hostStatus === "supported" ? "valid" : "unknown" : projection.integrity;
+	return {
+		sessionRefDigest: projection.sessionRefDigest,
+		epoch: projection.epoch,
+		contractRevision: projection.contractRevision,
+		state,
+		...proof ? { proof } : {},
+		cohortId: projection.hostCohortId
+	};
+}
+function proofEvidenceConstraints(evidence, obligation) {
+	if (evidence.outcome !== "success" || evidence.surfaces.length !== 1 || evidence.surfaces[0] !== obligation.surface) return false;
+	if (!obligation.subjectIds.every((subject) => evidence.subjects.includes(subject))) return false;
+	if (obligation.kind === "subject_readback" && !(evidence.operations ?? []).some(({ op }) => op === "read" || op === "verify")) return false;
+	if (obligation.kind === "scope_coverage" && !(evidence.operations ?? []).some(({ op }) => op === "run" || op === "verify")) return false;
+	if (obligation.kind === "state_verification" && evidence.evidenceRole !== "state") return false;
+	return true;
+}
+const PROOF_PROTOCOL_VERSION_V2 = "0.6.0";
+/** The v2 digest domain; the v1 domain string is untouched. */
+const PROOF_MANIFEST_DOMAIN_V2 = "ccg.proofManifest.v2";
+const PROOF_KINDS_V2 = [
+	"subject_readback",
+	"scope_coverage",
+	"state_verification",
+	"input_asset_check",
+	"output_visual_readback",
+	"object_url_readback",
+	"execution_fact",
+	"external_fact"
+];
+const ALL_SURFACES = [
+	"native_read",
+	"native_write_edit",
+	"shell",
+	"web",
+	"jobs",
+	"subagent",
+	"visual_capture"
+];
+function surfaces(supported) {
+	return {
+		supportedSurfaces: [...supported],
+		unavailableSurfaces: ALL_SURFACES.filter((surface) => !supported.includes(surface))
+	};
+}
+const PROOF_CAPABILITY_MATRIX = {
+	subject_readback: {
+		kind: "subject_readback",
+		capabilities: [
+			"filesystem-read",
+			"verify",
+			"deterministic-check"
+		],
+		readbackRequired: true,
+		operationOnSubject: true,
+		...surfaces(["native_read", "shell"])
+	},
+	scope_coverage: {
+		kind: "scope_coverage",
+		capabilities: [
+			"filesystem-read",
+			"verify",
+			"deterministic-check",
+			"web-fetch"
+		],
+		readbackRequired: true,
+		operationOnSubject: false,
+		...surfaces([
+			"native_read",
+			"shell",
+			"web"
+		])
+	},
+	state_verification: {
+		kind: "state_verification",
+		capabilities: [
+			"filesystem-read",
+			"web-fetch",
+			"deterministic-check"
+		],
+		readbackRequired: true,
+		requiredRole: "state",
+		operationOnSubject: false,
+		...surfaces(["native_read", "web"])
+	},
+	input_asset_check: {
+		kind: "input_asset_check",
+		capabilities: ["filesystem-read", "web-fetch"],
+		readbackRequired: true,
+		requiredRole: "resolution",
+		operationOnSubject: true,
+		...surfaces(["native_read", "web"])
+	},
+	output_visual_readback: {
+		kind: "output_visual_readback",
+		capabilities: ["visual-readback"],
+		readbackRequired: true,
+		operationOnSubject: true,
+		...surfaces(["visual_capture"])
+	},
+	object_url_readback: {
+		kind: "object_url_readback",
+		capabilities: ["web-fetch"],
+		readbackRequired: true,
+		operationOnSubject: true,
+		...surfaces(["web"])
+	},
+	execution_fact: {
+		kind: "execution_fact",
+		capabilities: [],
+		readbackRequired: false,
+		requiredRole: "effect",
+		operationOnSubject: false,
+		...surfaces([
+			"shell",
+			"native_write_edit",
+			"native_read",
+			"web",
+			"jobs",
+			"subagent"
+		])
+	},
+	external_fact: {
+		kind: "external_fact",
+		capabilities: [],
+		readbackRequired: false,
+		operationOnSubject: false,
+		...surfaces(["jobs", "subagent"])
+	}
+};
+/** The host surface names a fact's tool/adapter identity maps to. */
+function proofHostSurfacesOf(evidence) {
+	const surface = /* @__PURE__ */ new Set();
+	if (evidence.externalOperationRef) surface.add("jobs");
+	if (evidence.delegatedSubtask) surface.add("subagent");
+	if (evidence.capabilities.includes("visual-readback")) surface.add("visual_capture");
+	if (evidence.capabilities.includes("web-fetch")) surface.add("web");
+	if (new Set([
+		"write",
+		"edit",
+		"write_file",
+		"edit_file"
+	]).has(evidence.toolName)) surface.add("native_write_edit");
+	if (new Set([
+		"read",
+		"read_file",
+		"web_fetch",
+		"web_fetch_url",
+		"web_search"
+	]).has(evidence.toolName)) surface.add("native_read");
+	if ([
+		"bash",
+		"shell",
+		"pwsh"
+	].includes(evidence.toolName)) surface.add("shell");
+	if (evidence.capabilities.includes("filesystem-read")) surface.add("native_read");
+	return [...surface].sort();
+}
+function digestV2(value) {
+	return createHash("sha256").update(`${PROOF_MANIFEST_DOMAIN_V2}\n`, "utf8").update(stable$2(value), "utf8").digest("hex");
+}
+function proofDigestV2(obligations) {
+	return digestV2({
+		proofProtocolVersion: PROOF_PROTOCOL_VERSION_V2,
+		obligations: [...obligations]
+	});
+}
+function createProofManifestV2(obligations) {
+	const normalized = obligations.map((obligation) => ({
+		obligationId: obligation.obligationId,
+		kind: obligation.kind,
+		surface: obligation.surface,
+		subjectIds: [...obligation.subjectIds].sort(),
+		sourceIds: [...obligation.sourceIds].sort(),
+		operation: obligation.operation,
+		evidenceIds: [...obligation.evidenceIds].sort(),
+		...obligation.expectedScopeDigest ? { expectedScopeDigest: obligation.expectedScopeDigest } : {},
+		...obligation.observedScopeDigest ? { observedScopeDigest: obligation.observedScopeDigest } : {}
+	})).sort((a, b) => a.obligationId.localeCompare(b.obligationId));
+	const manifest = {
+		proofProtocolVersion: PROOF_PROTOCOL_VERSION_V2,
+		obligations: normalized,
+		proofSha256: proofDigestV2(normalized)
+	};
+	const errors = validateProofManifestV2(manifest);
+	if (errors.length) throw new Error(`proof v2 manifest rejected: ${errors.join(",")}`);
+	return manifest;
+}
+function validateProofManifestV2(manifest) {
+	const errors = [];
+	if (!manifest || typeof manifest !== "object") return ["proof_manifest_invalid"];
+	const value = manifest;
+	if (value.proofProtocolVersion !== PROOF_PROTOCOL_VERSION_V2) errors.push("proof_protocol_version_mismatch");
+	if (!Array.isArray(value.obligations)) errors.push("proof_obligations_missing");
+	if (typeof value.proofSha256 !== "string" || !validDigest(value.proofSha256)) errors.push("proof_digest_invalid");
+	const obligations = Array.isArray(value.obligations) ? value.obligations : [];
+	const ids = /* @__PURE__ */ new Set();
+	for (const raw of obligations) {
+		if (!raw || typeof raw !== "object") {
+			errors.push("proof_obligation_invalid");
+			continue;
+		}
+		const obligation = raw;
+		if (typeof obligation.obligationId !== "string" || !obligation.obligationId || ids.has(obligation.obligationId)) errors.push("proof_obligation_id_duplicate_or_invalid");
+		if (typeof obligation.obligationId === "string") ids.add(obligation.obligationId);
+		if (!PROOF_KINDS_V2.includes(obligation.kind)) errors.push("proof_kind_unsupported");
+		if (![
+			"artifact",
+			"ui",
+			"visual",
+			"scope"
+		].includes(String(obligation.surface))) errors.push("proof_surface_unsupported");
+		if (![
+			"create",
+			"write",
+			"modify",
+			"read",
+			"run",
+			"verify"
+		].includes(String(obligation.operation))) errors.push("proof_operation_unsupported");
+		if (!Array.isArray(obligation.subjectIds) || obligation.subjectIds.length === 0 || obligation.subjectIds.some((id) => typeof id !== "string" || !id)) errors.push("proof_subject_invalid");
+		if (!Array.isArray(obligation.sourceIds) || obligation.sourceIds.length === 0 || obligation.sourceIds.some((id) => typeof id !== "string" || !id)) errors.push("proof_source_invalid");
+		if (!Array.isArray(obligation.evidenceIds) || obligation.evidenceIds.length === 0 || obligation.evidenceIds.some((id) => typeof id !== "string" || !id) || new Set(obligation.evidenceIds).size !== obligation.evidenceIds.length) errors.push("proof_evidence_invalid");
+		const expected = obligation.expectedScopeDigest;
+		const observed = obligation.observedScopeDigest;
+		for (const digestValue of [expected, observed]) if (digestValue !== void 0 && (typeof digestValue !== "string" || !validDigest(digestValue))) errors.push("proof_scope_digest_invalid");
+		if (expected !== observed) errors.push("proof_scope_digest_mismatch");
+	}
+	if (errors.length === 0 && value.proofSha256 !== proofDigestV2(obligations)) errors.push("proof_digest_mismatch");
+	return [...new Set(errors)];
+}
+/**
+* Why one fact cannot discharge one v2 obligation, or `undefined` when it can.
+* The checks are ordered so the reported reason names the first unmet
+* requirement: missing producer capability, wrong role, absent readback, wrong
+* source, wrong subject, wrong operation.
+*/
+function proofV2Rejection(evidence, obligation) {
+	const spec = PROOF_CAPABILITY_MATRIX[obligation.kind];
+	if (evidence.delegatedSubtask) return "proof_source_bounded_delegation";
+	if (obligation.sourceIds.length > 0 && !obligation.sourceIds.includes(evidence.toolName) && !obligation.sourceIds.includes(evidence.adapterId ?? "")) return "proof_source_unbound";
+	if (evidence.outcome !== "success") return "proof_evidence_outcome_invalid";
+	if (obligation.kind === "external_fact") {
+		if (!evidence.externalOperationRef) return "proof_external_fact_unavailable";
+		if (evidence.externalOperationRef.status !== "completed") return "proof_external_fact_incomplete";
+	}
+	const available = proofHostSurfacesOf(evidence);
+	if (available.length === 0 || !available.some((surface) => spec.supportedSurfaces.includes(surface))) return "proof_producer_capability_unavailable";
+	if (spec.capabilities.length > 0 && !spec.capabilities.some((capability) => evidence.capabilities.includes(capability))) return "proof_producer_capability_unavailable";
+	if (spec.requiredRole !== void 0 && evidence.evidenceRole !== spec.requiredRole) return "proof_role_unbound";
+	if (spec.readbackRequired) {
+		if (!(evidence.operations ?? []).some((entry) => entry.op === "read" || entry.op === "verify")) return "proof_readback_unavailable";
+		if (spec.operationOnSubject && obligation.subjectIds.length > 0) {
+			const subjects = evidence.subjects;
+			if (!obligation.subjectIds.every((subject) => subjects.some((value) => value === subject))) return "proof_subject_unbound";
+		}
+	}
+	if (obligation.kind === "state_verification" && evidence.surfaces.length > 0 && !evidence.surfaces.includes(obligation.surface)) return "proof_surface_unbound";
+	if (obligation.kind === "execution_fact" && !(evidence.operations ?? []).some((entry) => entry.op === obligation.operation)) return "proof_operation_unbound";
+}
+/**
+* The subjects an item's own obligation requires. They come from the item's
+* frozen verification contract and captured target — never from the proof
+* manifest, which is exactly what a proof must be checked against.
+*/
+function requiredSubjectsOf(item) {
+	const values = /* @__PURE__ */ new Set();
+	const subject = item.verification.subject;
+	if (typeof subject === "string" && subject.length > 0 && subject !== "scope") values.add(subject);
+	const target = item.requestedTarget ?? {};
+	if (item.verification.surface === "scope") {
+		const scope = target.scope;
+		if (typeof scope === "string" && scope.length > 0 && scope !== "scope") values.add(scope);
+	}
+	for (const key of [
+		"artifact_id",
+		"package_id",
+		"service_id",
+		"repository"
+	]) {
+		const value = target[key];
+		if (typeof value === "string" && value.length > 0 && value !== "scope") values.add(value);
+	}
+	return [...values].sort();
+}
+/** The frozen coverage digest of a subject set: sorted, then hashed. */
+function scopeCoverageDigest(subjects) {
+	return createHash("sha256").update("ccg.proofScopeCoverage.v2\n", "utf8").update(JSON.stringify([...subjects].sort()), "utf8").digest("hex");
+}
+/**
+* Operations a fact may perform to discharge one proof kind. `execution_fact`
+* is bound to the obligation's own declared operation; the readback kinds
+* accept only an actual read or verify, so a bare successful call never
+* satisfies them.
+*/
+const KIND_OPERATIONS = {
+	subject_readback: ["read", "verify"],
+	scope_coverage: ["run", "verify"],
+	state_verification: ["read", "verify"],
+	input_asset_check: ["read", "verify"],
+	output_visual_readback: ["read", "verify"],
+	object_url_readback: ["read", "verify"],
+	execution_fact: "declared",
+	external_fact: []
+};
+/** Whether the fact performed an operation the kind accepts. */
+function proofOperationMatches(evidence, obligation) {
+	const allowed = KIND_OPERATIONS[obligation.kind];
+	const operations = evidence.operations ?? [];
+	if (allowed === "declared") return operations.some((entry) => entry.op === obligation.operation);
+	if (allowed.length === 0) return true;
+	return operations.some((entry) => allowed.includes(entry.op));
+}
+/**
+* Bind a v2 manifest to the live projection; [] means every obligation binds.
+*
+* The binding is the whole chain the review demanded, in one place:
+* the user's obligation (frozen subject and scope on the ITEM) → the trusted
+* producer fact (qualified by the same availability rules ordinary evidence
+* uses) → the declared source → the declared operation and its order relative
+* to the effect → the real coverage set. Only then is the obligation
+* discharged. A manifest that describes a different subject than the item
+* asked about fails even when the manifest and the facts agree with each
+* other.
+*/
+function bindProofV2ToProjection(projection, manifest) {
+	const errors = [];
+	for (const obligation of manifest.obligations) {
+		const item = projection.items.get(obligation.obligationId);
+		if (!item) {
+			errors.push("proof_obligation_unbound");
+			continue;
+		}
+		if (item.status !== "pending") {
+			errors.push("proof_obligation_not_pending");
+			continue;
+		}
+		if (item.verification.surface !== void 0 && item.verification.surface !== obligation.surface) errors.push("proof_surface_unbound");
+		const required = requiredSubjectsOf(item);
+		if (required.length > 0) {
+			if (!obligation.subjectIds.every((subject) => required.includes(subject))) {
+				errors.push("proof_subject_unbound");
+				continue;
+			}
+			if (!required.every((subject) => obligation.subjectIds.includes(subject))) {
+				errors.push("proof_scope_incomplete");
+				continue;
+			}
+		}
+		const cited = [];
+		for (const evidenceId of obligation.evidenceIds) {
+			const evidence = projection.evidence.get(evidenceId);
+			if (!evidence) {
+				errors.push("proof_evidence_unknown");
+				continue;
+			}
+			const availability = evidenceAvailabilityReason(evidence);
+			if (availability !== void 0) {
+				errors.push(availability);
+				continue;
+			}
+			if (evidence.epoch !== projection.epoch) {
+				errors.push("proof_evidence_wrong_epoch");
+				continue;
+			}
+			if (obligation.subjectIds.length > 0 && !evidence.subjects.some((subject) => obligation.subjectIds.includes(subject))) {
+				errors.push("proof_subject_unbound");
+				continue;
+			}
+			if (!proofOperationMatches(evidence, obligation)) {
+				errors.push("proof_operation_unbound");
+				continue;
+			}
+			const rejection = proofV2Rejection(evidence, obligation);
+			if (rejection) {
+				errors.push(rejection);
+				continue;
+			}
+			cited.push(evidence);
+		}
+		if (cited.length === 0 && obligation.evidenceIds.length > 0) continue;
+		if (required.length > 0 && !required.every((subject) => cited.some((fact) => fact.subjects.includes(subject)))) {
+			errors.push("proof_scope_incomplete");
+			continue;
+		}
+		if (obligation.kind === "input_asset_check") {
+			const firstCheck = Math.min(...cited.map((fact) => fact.toolResultSeq));
+			if ([...projection.evidence.values()].some((fact) => fact.evidenceRole === "effect" && required.some((subject) => fact.subjects.includes(subject)) && fact.toolResultSeq < firstCheck)) {
+				errors.push("proof_input_check_after_effect");
+				continue;
+			}
+		}
+		if (obligation.kind === "scope_coverage") {
+			const covered = [...new Set(cited.flatMap((fact) => fact.subjects))].sort();
+			if (obligation.expectedScopeDigest !== void 0 && obligation.expectedScopeDigest !== scopeCoverageDigest(required)) {
+				errors.push("proof_scope_digest_unbound");
+				continue;
+			}
+			if (obligation.observedScopeDigest !== void 0 && obligation.observedScopeDigest !== scopeCoverageDigest(covered)) {
+				errors.push("proof_scope_digest_unbound");
+				continue;
+			}
+		}
+	}
+	return [...new Set(errors)];
+}
+function sessionQueryV2(projection, proof) {
+	if (proof) {
+		if (validateProofManifestV2(proof).length) return {
+			sessionRefDigest: projection.sessionRefDigest,
+			epoch: projection.epoch,
+			contractRevision: projection.contractRevision,
+			state: "corrupt",
+			reasonCode: "proof_invalid",
+			cohortId: projection.hostCohortId
+		};
+		if (bindProofV2ToProjection(projection, proof).length) return {
+			sessionRefDigest: projection.sessionRefDigest,
+			epoch: projection.epoch,
+			contractRevision: projection.contractRevision,
+			state: "corrupt",
+			reasonCode: "proof_unbound",
+			cohortId: projection.hostCohortId
+		};
+	}
+	const state = projection.integrity === "valid" ? projection.hostStatus === "supported" ? "valid" : "unknown" : projection.integrity;
+	return {
+		sessionRefDigest: projection.sessionRefDigest,
+		epoch: projection.epoch,
+		contractRevision: projection.contractRevision,
+		state,
+		...proof ? { proof } : {},
+		cohortId: projection.hostCohortId
+	};
+}
+/**
+* The capability report for one proof kind against the facts a cohort actually
+* produced: `unavailable` with a stable reason when no producer is observable,
+* never a silent pass.
+*/
+function proofCapabilityReport(kind, facts) {
+	for (const fact of facts) {
+		if (fact.outcome !== "success") continue;
+		const probe = {
+			obligationId: "probe",
+			kind,
+			surface: "artifact",
+			subjectIds: fact.subjects.slice(0, 1),
+			sourceIds: [],
+			operation: "verify",
+			evidenceIds: []
+		};
+		if (probe.subjectIds.length === 0) probe.subjectIds = ["probe"];
+		if (proofV2Rejection(fact, probe) === void 0) return { status: "supported" };
+	}
+	return {
+		status: "unavailable",
+		reasonCode: "proof_producer_capability_unavailable"
+	};
+}
+
+//#endregion
+//#region src/domain/checkpoint.ts
+function stable$1(value) {
+	if (Array.isArray(value)) return `[${value.map(stable$1).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, entry]) => `${JSON.stringify(key)}:${stable$1(entry)}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+function tuplesEqual(left, right) {
+	return stable$1(left ?? {}) === stable$1(right ?? {});
+}
+function transitionsEqual(left, right) {
+	return stable$1(left) === stable$1(right);
+}
+function transitionIsSelfConsistent(action, transition) {
+	if (!transition?.parameters || transition.predicateId !== ACTION_MANIFEST.actions[action].predicateId || transition.version !== 1 || transition.predParamsKind !== "inline") return false;
+	const recomputed = predParamsDigest(transition.parameters, resolveAllowlist("product"));
+	return transition.parametersDigest === void 0 || transition.parametersDigest === recomputed;
+}
+function evidenceFact(evidence) {
+	return {
+		id: evidence.id,
+		outcome: evidence.outcome,
+		method: evidence.toolName,
+		operations: (evidence.operations ?? []).map((entry) => entry.op),
+		executables: evidence.executables ?? [],
+		subjects: evidence.subjects,
+		surfaces: evidence.surfaces,
+		semanticAction: evidence.semanticAction ?? "generic_run",
+		evidenceRole: evidence.evidenceRole ?? "effect",
+		resolvedTarget: evidence.resolvedTarget ?? {},
+		observedState: evidence.observedState,
+		parseStatus: evidence.parseStatus ?? "adapter_unavailable",
+		reasonCode: evidence.reasonCode ?? (evidence.parseStatus ? void 0 : "adapter_unavailable"),
+		adapterId: evidence.adapterId,
+		adapterVersion: evidence.adapterVersion
+	};
+}
+function citedEvidence(projection, binding) {
+	return binding.evidenceIds.map((id) => projection.evidence.get(id)).filter((value) => value !== void 0);
+}
+function evidenceProblem(projection, item, binding) {
+	const missing = binding.evidenceIds.filter((id) => !projection.evidence.has(id));
+	if (missing.length) return {
+		itemId: item.id,
+		reason: "cited evidence is missing",
+		reasonCode: "evidence_missing",
+		offendingEvidenceIds: missing
+	};
+	if (item.reboundFrom) {
+		const sourceSeq = /^m(\d+)(?::|$)/.exec(item.sourceMessageId);
+		const tooEarly = binding.evidenceIds.filter((id) => !sourceSeq || projection.evidence.get(id).toolResultSeq < Number(sourceSeq[1]));
+		if (tooEarly.length) return {
+			itemId: item.id,
+			reason: "evidence predates the authoritative root clause used by this replacement",
+			reasonCode: "rebind_evidence_predates_source",
+			offendingEvidenceIds: tooEarly
+		};
+	}
+	const wrongEpoch = binding.evidenceIds.filter((id) => projection.evidence.get(id)?.epoch !== projection.epoch);
+	if (wrongEpoch.length) return {
+		itemId: item.id,
+		reason: "cited evidence belongs to a different epoch",
+		reasonCode: "evidence_wrong_epoch",
+		offendingEvidenceIds: wrongEpoch
+	};
+	const notSuccess = binding.evidenceIds.filter((id) => projection.evidence.get(id)?.outcome !== "success");
+	if (notSuccess.length) return {
+		itemId: item.id,
+		reason: "cited evidence outcome is not success",
+		reasonCode: "evidence_outcome_not_success",
+		offendingEvidenceIds: notSuccess
+	};
+	const requiredAction = item.semanticAction ?? "generic_run";
 	const compatibleWith = [requiredAction, ...(item.actionPlan ?? []).map((entry) => entry.action)];
 	const facts = citedEvidence(projection, binding);
 	const incompatible = facts.filter((fact) => !compatibleWith.some((action) => actionCompatible(action, fact.semanticAction ?? "generic_run")));
@@ -4556,6 +6036,37 @@ function evidenceProblem(projection, item, binding) {
 		};
 	}
 }
+/**
+* The strict-policy proof obligation (C06). Only the surfaces the USER asked
+* for add a requirement, and the requirement is a real readback from the v2
+* capability matrix: a visual verification needs a fact that actually observed
+* the output, a complete-scope verification needs a fact that actually covered
+* the scope. Standard policy does not run this, and no ordinary action gains an
+* approval step.
+*/
+function strictProofProblem(projection, item, binding) {
+	const surface = item.verification.surface;
+	if (surface !== "visual" && surface !== "scope") return void 0;
+	const kind = surface === "visual" ? "output_visual_readback" : "scope_coverage";
+	const obligation = {
+		obligationId: item.id,
+		kind,
+		surface,
+		subjectIds: [item.verification.subject ?? item.requestedTarget?.scope ?? "scope"].filter((value) => typeof value === "string" && value.length > 0),
+		sourceIds: [],
+		operation: item.verification.operation ?? "verify",
+		evidenceIds: binding.evidenceIds
+	};
+	const cited = citedEvidence(projection, binding);
+	if (cited.some((fact) => fact.outcome === "success" && fact.subjects.some((subject) => obligation.subjectIds.includes(subject)) && proofV2Rejection(fact, obligation) === void 0)) return void 0;
+	return {
+		itemId: item.id,
+		reason: `strict policy: the requested ${surface} verification needs a real readback fact from the current projection`,
+		reasonCode: "strict_proof_required",
+		offendingEvidenceIds: cited.map((fact) => fact.id),
+		hint: closingHint(projection, item, binding.evidenceIds)
+	};
+}
 function expectedTransitionMatches(action, transition, resolved, observed) {
 	const expectedPredicate = ACTION_MANIFEST.actions[action].predicateId;
 	if (transition.predicateId !== expectedPredicate || transition.version !== 1 || transition.predParamsKind !== "inline" || !transition.parameters) return false;
@@ -4570,14 +6081,14 @@ function expectedTransitionMatches(action, transition, resolved, observed) {
 			"version",
 			"integrity_digest",
 			...action === "publish" ? ["registry"] : ["profile"]
-		].every((key) => stable$2(observed[key]) === stable$2(resolved[key]) && stable$2(params[key]) === stable$2(resolved[key]));
+		].every((key) => stable$1(observed[key]) === stable$1(resolved[key]) && stable$1(params[key]) === stable$1(resolved[key]));
 		case "create":
-		case "modify": return stable$2(observed.post_digest) === stable$2(params.post_digest);
-		case "restart": return stable$2(params.pre_generation) === stable$2(resolved.pre_generation) && stable$2(observed.new_generation) !== stable$2(resolved.pre_generation) && stable$2(observed.health) === stable$2(params.health);
-		case "commit": return stable$2(params.pre_head_oid) === stable$2(resolved.pre_head_oid) && stable$2(params.change_set_digest) === stable$2(resolved.change_set_digest) && stable$2(observed.pre_head_oid) === stable$2(resolved.pre_head_oid) && stable$2(observed.post_head_oid) !== stable$2(resolved.pre_head_oid);
-		case "push": return stable$2(observed.remote_oid) === stable$2(resolved.local_oid) && stable$2(params.local_oid) === stable$2(resolved.local_oid);
-		case "pull": return stable$2(resolved.pull_mode) === stable$2("ff-only") && stable$2(params.pull_mode) === stable$2("ff-only") && stable$2(params.upstream_oid) === stable$2(resolved.upstream_oid) && stable$2(params.pre_head_oid) === stable$2(resolved.pre_head_oid) && stable$2(observed.post_head_oid) === stable$2(resolved.upstream_oid) && stable$2(observed.tracking_ref_oid) === stable$2(resolved.upstream_oid);
-		case "fetch": return stable$2(params.upstream_oid) === stable$2(resolved.upstream_oid) && stable$2(params.pre_head_oid) === stable$2(resolved.pre_head_oid) && stable$2(observed.tracking_ref_oid) === stable$2(resolved.upstream_oid) && stable$2(observed.post_head_oid) === stable$2(resolved.pre_head_oid);
+		case "modify": return stable$1(observed.post_digest) === stable$1(params.post_digest);
+		case "restart": return stable$1(params.pre_generation) === stable$1(resolved.pre_generation) && stable$1(observed.new_generation) !== stable$1(resolved.pre_generation) && stable$1(observed.health) === stable$1(params.health);
+		case "commit": return stable$1(params.pre_head_oid) === stable$1(resolved.pre_head_oid) && stable$1(params.change_set_digest) === stable$1(resolved.change_set_digest) && stable$1(observed.pre_head_oid) === stable$1(resolved.pre_head_oid) && stable$1(observed.post_head_oid) !== stable$1(resolved.pre_head_oid);
+		case "push": return stable$1(observed.remote_oid) === stable$1(resolved.local_oid) && stable$1(params.local_oid) === stable$1(resolved.local_oid);
+		case "pull": return stable$1(resolved.pull_mode) === stable$1("ff-only") && stable$1(params.pull_mode) === stable$1("ff-only") && stable$1(params.upstream_oid) === stable$1(resolved.upstream_oid) && stable$1(params.pre_head_oid) === stable$1(resolved.pre_head_oid) && stable$1(observed.post_head_oid) === stable$1(resolved.upstream_oid) && stable$1(observed.tracking_ref_oid) === stable$1(resolved.upstream_oid);
+		case "fetch": return stable$1(params.upstream_oid) === stable$1(resolved.upstream_oid) && stable$1(params.pre_head_oid) === stable$1(resolved.pre_head_oid) && stable$1(observed.tracking_ref_oid) === stable$1(resolved.upstream_oid) && stable$1(observed.post_head_oid) === stable$1(resolved.pre_head_oid);
 		default: return true;
 	}
 }
@@ -4586,8 +6097,8 @@ function nonStatefulTransitionMatches(action, transition, resolved, observed) {
 	const params = transition.parameters;
 	const recomputed = predParamsDigest(params, resolveAllowlist("product"));
 	if (transition.parametersDigest && transition.parametersDigest !== recomputed) return false;
-	if (action === "inspect_remote_updates") return ["remote", "version"].every((key) => stable$2(params[key]) === stable$2(resolved[key])) && stable$2(params.upstream_oid) === stable$2(observed.upstream_oid);
-	return stable$2(params) === stable$2({
+	if (action === "inspect_remote_updates") return ["remote", "version"].every((key) => stable$1(params[key]) === stable$1(resolved[key])) && stable$1(params.upstream_oid) === stable$1(observed.upstream_oid);
+	return stable$1(params) === stable$1({
 		expected_outcome: {
 			k: "e",
 			v: "success"
@@ -4694,7 +6205,7 @@ function richStatefulRecord(projection, item, binding) {
 		reason: "resolution fact does not bind an expected transition digest",
 		reasonCode: "resolution_expected_transition_digest_missing"
 	} };
-	if (resolution.expectedTransitionDigest !== sha256(stable$2(resolution.expectedTransition))) return { rejected: {
+	if (resolution.expectedTransitionDigest !== sha256(stable$1(resolution.expectedTransition))) return { rejected: {
 		itemId: item.id,
 		reason: "resolution expected transition digest does not match its stable payload",
 		reasonCode: "resolution_expected_transition_digest_mismatch"
@@ -4789,7 +6300,7 @@ function simpleRecord(projection, item, binding) {
 	const effectAction = effect.semanticAction ?? "generic_run";
 	const effectTarget = effect.resolvedTarget ?? {};
 	const effectObserved = effect.observedState ?? {};
-	if (!(Object.entries(binding.resolvedTarget ?? {}).every(([key, value]) => Object.hasOwn(effectTarget, key) && stable$2(value) === stable$2(effectTarget[key])) && Object.entries(binding.observedState ?? {}).every(([key, value]) => Object.hasOwn(effectObserved, key) && stable$2(value) === stable$2(effectObserved[key]))) || effectAction === action && (!tuplesEqual(binding.resolvedTarget, effectTarget) || !tuplesEqual(binding.observedState, effectObserved))) return { rejected: {
+	if (!(Object.entries(binding.resolvedTarget ?? {}).every(([key, value]) => Object.hasOwn(effectTarget, key) && stable$1(value) === stable$1(effectTarget[key])) && Object.entries(binding.observedState ?? {}).every(([key, value]) => Object.hasOwn(effectObserved, key) && stable$1(value) === stable$1(effectObserved[key]))) || effectAction === action && (!tuplesEqual(binding.resolvedTarget, effectTarget) || !tuplesEqual(binding.observedState, effectObserved))) return { rejected: {
 		itemId: item.id,
 		reason: "binding target does not match the cited effect evidence",
 		reasonCode: "binding_state_cross_pairing"
@@ -4828,7 +6339,7 @@ function certifyCheckpoint(projection, bindings, id, commit = true) {
 	if (projection.integrity !== "valid" || projection.hostStatus !== "supported") return {
 		status: "unknown",
 		contractRevision: projection.contractRevision,
-		openItems: openItems(projection),
+		openItems: certifiableOpenItems(projection).map((item) => item.id),
 		rejectedBindings: []
 	};
 	const rejectedBindings = [];
@@ -4860,6 +6371,16 @@ function certifyCheckpoint(projection, bindings, id, commit = true) {
 			});
 			continue;
 		}
+		const ancestorBlock = ancestorConstraintForBinding(projection, item, binding.resolvedTarget);
+		if (ancestorBlock) {
+			rejectedBindings.push({
+				itemId: item.id,
+				reason: ancestorBlock.kind === "prohibition" ? `an ancestor unit (${ancestorBlock.constraintUnitId}) holds prohibition ${ancestorBlock.constraintId} on this action and target` : `an ancestor unit (${ancestorBlock.constraintUnitId}) holds the unsatisfied condition ${ancestorBlock.constraintId} that reserves this action`,
+				reasonCode: ancestorBlock.reasonCode,
+				hint: closingHint(projection, item)
+			});
+			continue;
+		}
 		if (item.targetCaptureStatus === "clarification_required") {
 			rejectedBindings.push({
 				itemId: item.id,
@@ -4890,6 +6411,13 @@ function certifyCheckpoint(projection, bindings, id, commit = true) {
 			rejectedBindings.push(problem);
 			continue;
 		}
+		if (projection.policy === "strict") {
+			const strictProblem = strictProofProblem(projection, item, binding);
+			if (strictProblem) {
+				rejectedBindings.push(strictProblem);
+				continue;
+			}
+		}
 		if ((item.semanticAction ?? "generic_run") === "generic_run") {
 			rejectedBindings.push({
 				itemId: item.id,
@@ -4906,48 +6434,95 @@ function certifyCheckpoint(projection, bindings, id, commit = true) {
 		records.push(built.record);
 		referencedFacts.push(...citedEvidence(projection, binding).map(evidenceFact));
 	}
-	const open = openItems(projection).filter((itemId) => !bindings.some((binding) => binding.itemId === itemId));
+	const closure = certificateClosure(projection);
+	const open = closure.itemIds.filter((itemId) => !bindings.some((binding) => binding.itemId === itemId));
 	if (rejectedBindings.length || open.length) return {
 		status: "incomplete",
 		contractRevision: projection.contractRevision,
-		openItems: openItems(projection),
+		openItems: closure.itemIds,
 		rejectedBindings
 	};
+	if (projection.boundaryProtocol === 5 && closure.unitId === void 0) return {
+		status: "incomplete",
+		contractRevision: projection.contractRevision,
+		openItems: closure.itemIds,
+		rejectedBindings: [{
+			itemId: "*",
+			reason: "no current work unit is available for a v2 certificate",
+			reasonCode: "unit_unavailable"
+		}]
+	};
 	try {
 		const contractSha256 = currentContractDigest(projection);
-		const openDigest = digestStrings(openItems(projection));
+		const openDigest = digestStrings(closure.itemIds);
 		const evidenceSha256 = evidenceSha256Digest(referencedFacts);
 		const bindingDigest$1 = bindingDigest(records, resolveAllowlist("product"));
-		const certification = certificationDigest({
-			stopProtocolVersion: STOP_PROTOCOL_VERSION,
-			certificateVersion: CERTIFICATE_VERSION,
-			epoch: projection.epoch,
-			sessionRefDigest: projection.sessionRefDigest,
-			hostLockDigest: projection.hostLockDigest,
-			contractRevision: projection.contractRevision,
-			contractSha256,
-			...projection.currentGoalRef ? { goalRef: projection.currentGoalRef } : {},
-			openDigest,
-			evidenceSha256,
-			bindingDigest: bindingDigest$1
-		});
-		const checkpoint = {
-			id,
-			stopProtocolVersion: STOP_PROTOCOL_VERSION,
-			certificateVersion: CERTIFICATE_VERSION,
-			epoch: projection.epoch,
-			sessionRefDigest: projection.sessionRefDigest,
-			hostLockDigest: projection.hostLockDigest,
-			contractRevision: projection.contractRevision,
-			contractSha256,
-			openDigest,
-			evidenceSha256,
-			bindingDigest: bindingDigest$1,
-			bindings,
-			...projection.currentGoalRef ? { goalRef: { ...projection.currentGoalRef } } : {},
-			certificationDigest: certification,
-			result: "certified"
-		};
+		const checkpoint = projection.boundaryProtocol === 5 ? (() => {
+			const certification = certificationDigestV2({
+				stopProtocolVersion: STOP_PROTOCOL_VERSION_V2,
+				certificateVersion: CERTIFICATE_VERSION_V2,
+				epoch: projection.epoch,
+				sessionRefDigest: projection.sessionRefDigest,
+				hostLockDigest: projection.hostLockDigest,
+				contractRevision: projection.contractRevision,
+				contractSha256,
+				unitId: closure.unitId,
+				unitClosureDigest: openDigest,
+				evidenceSha256,
+				bindingDigest: bindingDigest$1,
+				goalRef: projection.currentGoalRef ?? null
+			});
+			return {
+				id,
+				stopProtocolVersion: STOP_PROTOCOL_VERSION_V2,
+				certificateVersion: CERTIFICATE_VERSION_V2,
+				epoch: projection.epoch,
+				sessionRefDigest: projection.sessionRefDigest,
+				hostLockDigest: projection.hostLockDigest,
+				contractRevision: projection.contractRevision,
+				contractSha256,
+				openDigest,
+				evidenceSha256,
+				bindingDigest: bindingDigest$1,
+				bindings,
+				...projection.currentGoalRef ? { goalRef: { ...projection.currentGoalRef } } : {},
+				unitId: closure.unitId,
+				unitClosureDigest: openDigest,
+				certificationDigest: certification,
+				result: "certified"
+			};
+		})() : (() => {
+			const certification = certificationDigest({
+				stopProtocolVersion: STOP_PROTOCOL_VERSION,
+				certificateVersion: CERTIFICATE_VERSION,
+				epoch: projection.epoch,
+				sessionRefDigest: projection.sessionRefDigest,
+				hostLockDigest: projection.hostLockDigest,
+				contractRevision: projection.contractRevision,
+				contractSha256,
+				...projection.currentGoalRef ? { goalRef: projection.currentGoalRef } : {},
+				openDigest,
+				evidenceSha256,
+				bindingDigest: bindingDigest$1
+			});
+			return {
+				id,
+				stopProtocolVersion: STOP_PROTOCOL_VERSION,
+				certificateVersion: CERTIFICATE_VERSION,
+				epoch: projection.epoch,
+				sessionRefDigest: projection.sessionRefDigest,
+				hostLockDigest: projection.hostLockDigest,
+				contractRevision: projection.contractRevision,
+				contractSha256,
+				openDigest,
+				evidenceSha256,
+				bindingDigest: bindingDigest$1,
+				bindings,
+				...projection.currentGoalRef ? { goalRef: { ...projection.currentGoalRef } } : {},
+				certificationDigest: certification,
+				result: "certified"
+			};
+		})();
 		if (commit) {
 			projection.checkpoints.push(checkpoint);
 			for (const binding of bindings) projection.items.get(binding.itemId).status = "passed";
@@ -4964,7 +6539,7 @@ function certifyCheckpoint(projection, bindings, id, commit = true) {
 		return {
 			status: "incomplete",
 			contractRevision: projection.contractRevision,
-			openItems: openItems(projection),
+			openItems: closure.itemIds,
 			rejectedBindings: [{
 				itemId: "*",
 				reason: error instanceof Error ? error.message : "certificate manifest rejected",
@@ -5056,9 +6631,6 @@ function bindingActionPlanProblem(projection, item, binding) {
 		}
 	}
 }
-function openItems(projection) {
-	return [...projection.items.values()].filter((item) => item.status === "pending" && item.kind !== "prohibition").map((item) => item.id);
-}
 
 //#endregion
 //#region src/domain/contract-segment.ts
@@ -7662,13 +9234,13 @@ function parseArguments$1(raw) {
 		return {};
 	}
 }
-function asRecord$1(value) {
+function asRecord$2(value) {
 	return typeof value === "object" && value !== null ? value : void 0;
 }
 function extractTextContent(content) {
 	const parts = [];
 	for (const block$1 of content) {
-		const record = asRecord$1(block$1);
+		const record = asRecord$2(block$1);
 		if (!record) continue;
 		if (record.type === "text" && typeof record.text === "string") parts.push(record.text);
 		if (record.type === "tool-result" && Array.isArray(record.content)) parts.push(extractTextContent(record.content));
@@ -7676,10 +9248,10 @@ function extractTextContent(content) {
 	return parts.join("\n");
 }
 function metaPaths(meta) {
-	const record = asRecord$1(meta);
+	const record = asRecord$2(meta);
 	if (!record) return [];
 	if (typeof record.path === "string") return [record.path];
-	if (Array.isArray(record.diffs)) return record.diffs.map((diff) => asRecord$1(diff)?.path).filter((path$1) => typeof path$1 === "string");
+	if (Array.isArray(record.diffs)) return record.diffs.map((diff) => asRecord$2(diff)?.path).filter((path$1) => typeof path$1 === "string");
 	return [];
 }
 function argsPaths(args) {
@@ -7693,24 +9265,24 @@ function resolveCommandPath(reference, cwd) {
 	if (/^[A-Za-z]:[\\/]/.test(reference) || reference.startsWith("//") || reference.startsWith("\\\\") || reference.startsWith("/") || reference.startsWith("\\")) return reference;
 	return `${cwd.replace(/[\\/]+$/, "")}/${reference}`;
 }
-function stable$1(value) {
-	if (Array.isArray(value)) return `[${value.map(stable$1).join(",")}]`;
-	if (value && typeof value === "object") return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stable$1(entry)}`).join(",")}}`;
+function stable(value) {
+	if (Array.isArray(value)) return `[${value.map(stable).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stable(entry)}`).join(",")}}`;
 	return JSON.stringify(value);
 }
 function structuredGuardMeta(meta, toolName) {
 	if (toolName !== "context_guard_evidence") return void 0;
-	const outer = asRecord$1(meta);
-	const value = asRecord$1(outer?.contextGuard ?? outer?.context_guard);
+	const outer = asRecord$2(meta);
+	const value = asRecord$2(outer?.contextGuard ?? outer?.context_guard);
 	if (!value) return void 0;
 	const action = value.semanticAction ?? value.semantic_action;
 	const role = value.evidenceRole ?? value.evidence_role;
-	const resolved = asRecord$1(value.resolvedTarget ?? value.resolved_target);
-	const observed = asRecord$1(value.observedState ?? value.observed_state);
-	const rawExpected = asRecord$1(value.expectedTransition);
-	const expectedParameters = asRecord$1(rawExpected?.parameters);
+	const resolved = asRecord$2(value.resolvedTarget ?? value.resolved_target);
+	const observed = asRecord$2(value.observedState ?? value.observed_state);
+	const rawExpected = asRecord$2(value.expectedTransition);
+	const expectedParameters = asRecord$2(rawExpected?.parameters);
 	const expectedDigest = value.expectedTransitionDigest;
-	const expectedTransition = rawExpected && typeof rawExpected.predicateId === "string" && rawExpected.version === 1 && rawExpected.predParamsKind === "inline" && expectedParameters && typeof expectedDigest === "string" && expectedDigest === sha256(stable$1(rawExpected)) ? rawExpected : void 0;
+	const expectedTransition = rawExpected && typeof rawExpected.predicateId === "string" && rawExpected.version === 1 && rawExpected.predParamsKind === "inline" && expectedParameters && typeof expectedDigest === "string" && expectedDigest === sha256(stable(rawExpected)) ? rawExpected : void 0;
 	if (typeof value.adapterId !== "string" || typeof value.adapterVersion !== "string") return void 0;
 	if (SUPPORTED_EVIDENCE_ADAPTERS[value.adapterId] !== value.adapterVersion) return void 0;
 	if (typeof action !== "string" || typeof role !== "string" || !resolved) return void 0;
@@ -7807,7 +9379,7 @@ const PERSISTENT_TIMEOUT_INTRO = /^Your command timed out after \d+ seconds or e
 * the fallback.
 */
 function structuredTerminalFacts(meta) {
-	const record = asRecord$1(meta);
+	const record = asRecord$2(meta);
 	if (!record) return void 0;
 	const rawExit = record.exitCode ?? record.exit_code;
 	const rawSignal = record.signal;
@@ -7858,10 +9430,10 @@ function extractTerminalFacts(textContent) {
 	};
 }
 function metaUrls(meta) {
-	const record = asRecord$1(meta);
+	const record = asRecord$2(meta);
 	if (!record) return [];
 	if (typeof record.url === "string") return [sanitizeUrl(record.url)];
-	if (Array.isArray(record.sources)) return record.sources.map((source) => asRecord$1(source)?.url).filter((url) => typeof url === "string").map((url) => sanitizeUrl(url));
+	if (Array.isArray(record.sources)) return record.sources.map((source) => asRecord$2(source)?.url).filter((url) => typeof url === "string").map((url) => sanitizeUrl(url));
 	return [];
 }
 const DETERMINISTIC_CHECK_PATTERNS = [
@@ -7918,7 +9490,7 @@ function resolveSubjectPaths(values, cwd) {
 function extractToolSubject(call, result, defaultCwd, hostLock) {
 	const args = parseArguments$1(call.arguments);
 	if (call.name === "context_guard_external_operation") {
-		const external = asRecord$1(asRecord$1(result.meta)?.contextGuardExternalOperation);
+		const external = asRecord$2(asRecord$2(result.meta)?.contextGuardExternalOperation);
 		const status = external?.status;
 		if (typeof external?.id === "string" && typeof external.adapterId === "string" && (status === "running" || status === "pending" || status === "completed" || status === "failed" || status === "unknown")) return {
 			capabilities: ["external-operation-readback"],
@@ -7949,7 +9521,7 @@ function extractToolSubject(call, result, defaultCwd, hostLock) {
 	}
 	const structured = structuredGuardMeta(result.meta, call.name);
 	if (call.name === "context_guard_evidence" && !structured) {
-		const disposition = asRecord$1(asRecord$1(result.meta)?.contextGuardDisposition);
+		const disposition = asRecord$2(asRecord$2(result.meta)?.contextGuardDisposition);
 		return {
 			capabilities: ["guard-state-readback"],
 			subjects: [],
@@ -8165,8 +9737,760 @@ function supersedeItem(items, oldId, replacement) {
 	return true;
 }
 
+//#endregion
+//#region src/domain/delivery.ts
+function assistantTextOf(data) {
+	return (data?.message?.content ?? []).filter((part) => part?.type === "text").map((part) => part?.text ?? "").join("\n");
+}
+function integerField(data, field$1) {
+	const value = data?.[field$1];
+	return typeof value === "number" && Number.isSafeInteger(value) ? value : void 0;
+}
+/**
+* Derive the trusted deliveries from the event log. Deterministic: a replay of
+* identical events yields identical facts.
+*/
+function deriveTrustedDeliveries(events) {
+	const turns = /* @__PURE__ */ new Map();
+	const factsFor = (turn) => {
+		let facts = turns.get(turn);
+		if (!facts) {
+			facts = {
+				started: false,
+				steps: /* @__PURE__ */ new Set(),
+				assistants: [],
+				ends: []
+			};
+			turns.set(turn, facts);
+		}
+		return facts;
+	};
+	for (const event of events) switch (event.type) {
+		case "turn/start": {
+			const turn = integerField(event.data, "turn");
+			if (turn !== void 0) factsFor(turn).started = true;
+			break;
+		}
+		case "step/start":
+		case "step/end": {
+			const turn = integerField(event.data, "turn");
+			const step = integerField(event.data, "step");
+			if (turn !== void 0 && step !== void 0) factsFor(turn).steps.add(step);
+			break;
+		}
+		case "assistant/message": {
+			const turn = integerField(event.data, "turn");
+			const step = integerField(event.data, "step");
+			if (turn === void 0 || step === void 0) break;
+			const facts = factsFor(turn);
+			facts.steps.add(step);
+			facts.assistants.push({
+				seq: event.seq,
+				step,
+				text: assistantTextOf(event.data),
+				interrupted: event.data?.interrupted === true
+			});
+			break;
+		}
+		case "turn/end": {
+			const turn = integerField(event.data, "turn");
+			if (turn === void 0) break;
+			const reason = event.data?.reason;
+			factsFor(turn).ends.push({
+				seq: event.seq,
+				kind: typeof reason?.kind === "string" ? reason.kind : ""
+			});
+			break;
+		}
+		default: break;
+	}
+	const deliveries = [];
+	for (const [turn, facts] of turns) {
+		if (!facts.started) continue;
+		if (facts.ends.length !== 1) continue;
+		const end = facts.ends[0];
+		if (end.kind !== "completed") continue;
+		if (facts.steps.size === 0) continue;
+		const finalStep = Math.max(...facts.steps);
+		const inFinalStep = facts.assistants.filter((row) => row.step === finalStep && row.seq < end.seq && !row.interrupted && row.text.trim().length > 0);
+		if (inFinalStep.length === 0) continue;
+		const final = inFinalStep.reduce((left, right) => right.seq > left.seq ? right : left);
+		if (facts.assistants.some((row) => row.seq > final.seq && row.seq < end.seq)) continue;
+		deliveries.push({
+			turn,
+			turnEndSeq: end.seq,
+			responseSeq: final.seq,
+			responseSha256: sha256(final.text)
+		});
+	}
+	return deliveries.sort((left, right) => left.turnEndSeq - right.turnEndSeq);
+}
+/**
+* The information-slot items a delivery closes: obligations captured from a
+* root message inside the delivered turn, in the unit that turn's input
+* belonged to (or in one of that unit's delegated sub-units), whose semantic
+* slot is information (an inquiry or an explanation request). Execution,
+* constraints, and unknowns are never closed by delivery, and neither are
+* questions from earlier messages.
+*/
+function informationItemIdsForDelivery(items, delivery, turnRootInputSeqs, eligibleUnitIds) {
+	const closed = [];
+	for (const [itemId, item] of items) {
+		if (item.status !== "pending") continue;
+		if (item.kind === "prohibition") continue;
+		if (eligibleUnitIds !== void 0 && (item.unitId === void 0 || !eligibleUnitIds.has(item.unitId))) continue;
+		const sourceSeq = /^m(\d+)(?::|$)/.exec(item.sourceMessageId);
+		if (!sourceSeq || !turnRootInputSeqs.has(Number(sourceSeq[1]))) continue;
+		if (item.taskKind === "inquiry" || item.authorityDisposition === "informational" && item.kind === "requirement") closed.push(itemId);
+	}
+	return closed;
+}
+
+//#endregion
+//#region src/domain/host-selection.ts
+/**
+* The default question-tool allowlist. The real names are a host tool-bundle
+* surface: native acceptance pins the audited names for the running cohort,
+* and the runtime may override this list per cohort.
+*/
+const DEFAULT_QUESTION_TOOL_NAMES = ["question", "ask_user"];
+function parseQuestionCall(rawArguments) {
+	if (typeof rawArguments !== "string") return void 0;
+	let args;
+	try {
+		args = JSON.parse(rawArguments);
+	} catch {
+		return;
+	}
+	if (!args || typeof args !== "object" || Array.isArray(args)) return void 0;
+	const record = args;
+	const rawOptions = record.options ?? record.choices;
+	if (!Array.isArray(rawOptions) || rawOptions.length === 0) return void 0;
+	const options = [];
+	for (const entry of rawOptions) {
+		if (typeof entry !== "string" || !entry.trim()) return void 0;
+		options.push(entry.trim());
+	}
+	return {
+		questionId: typeof record.question_id === "string" ? record.question_id : typeof record.questionId === "string" ? record.questionId : void 0,
+		question: typeof record.question === "string" ? record.question : void 0,
+		options
+	};
+}
+function parseSelectionAnswer(content, options) {
+	if (!Array.isArray(content)) return void 0;
+	const text = content.filter((part) => !!part && typeof part === "object").filter((part) => part.type === "text").map((part) => part.text ?? "").join("\n");
+	if (!text.trim()) return void 0;
+	const trimmed = text.trim();
+	if (options.includes(trimmed)) return trimmed;
+	try {
+		const parsed = JSON.parse(trimmed);
+		const answer = parsed.answer ?? parsed.selected ?? parsed.value;
+		if (typeof answer === "string" && options.includes(answer.trim())) return answer.trim();
+	} catch {}
+}
+function looksLikeDirectory(value) {
+	return /^[~.]?(?:[\\/][^\n]*)+$/.test(value);
+}
+/**
+* Derive the trusted selections from the durable log. Deterministic: a replay
+* of identical events yields identical selections.
+*/
+function deriveTrustedSelections(events, options) {
+	const names = new Set(options.questionToolNames);
+	const pending = /* @__PURE__ */ new Map();
+	const selections = [];
+	for (const event of events) {
+		if (event.type === "tool/call") {
+			const data$1 = event.data ?? {};
+			const name = String(data$1.name ?? "");
+			if (!names.has(name)) continue;
+			const shape = parseQuestionCall(data$1.arguments);
+			if (!shape) continue;
+			pending.set(String(data$1.callId ?? ""), {
+				callId: String(data$1.callId ?? ""),
+				seq: event.seq,
+				turn: typeof data$1.turn === "number" ? data$1.turn : void 0,
+				toolName: name,
+				shape
+			});
+			continue;
+		}
+		if (event.type !== "tool/result") continue;
+		const data = event.data ?? {};
+		const callId = String(data.message?.source?.callId ?? "");
+		const call = pending.get(callId);
+		if (!call) continue;
+		pending.delete(callId);
+		if (data.error !== void 0) continue;
+		const selected = parseSelectionAnswer(data.message?.content, call.shape.options);
+		if (!selected) continue;
+		selections.push({
+			callId,
+			resultSeq: event.seq,
+			turn: call.turn,
+			toolName: call.toolName,
+			questionId: call.shape.questionId,
+			question: call.shape.question,
+			options: call.shape.options,
+			selected,
+			kind: looksLikeDirectory(selected) ? "directory" : "value"
+		});
+	}
+	return selections;
+}
+
+//#endregion
+//#region src/domain/release.ts
+/**
+* Explicit release adoption and single-use tickets (0.6.0 C10 / DS06-F).
+*
+* A release is never implicit. "release", a loaded Skill, or an installation
+* never activates this profile: a root user must explicitly ADOPT a release
+* contract that names the exact candidate, and every effect must then match
+* that contract and spend a one-shot reservation.
+*
+* Three durable records carry the state machine (P0 §5), all written through
+* the plugin-notice channel the host already persists:
+*
+* - `contract`    — the adopted scope: operations, the exact candidate, the
+*                   readiness/closure references and an optional expiry.
+* - `reservation` — written BEFORE any effect; the operation is `in_flight`
+*                   from that moment, so a crash cannot be mistaken for "never
+*                   started" and the operation is never blindly re-sent.
+* - `settlement`  — written after the effect. Its outcome distinguishes a
+*                   PROVEN no-effect (`not_effected`, which releases the lock)
+*                   from an UNKNOWN effect (`unknown`/`failed`/`unconfirmed`,
+*                   which keeps the lock until a trusted readback reconciles
+*                   it) and from a `settled` release.
+*
+* CANDIDATE IDENTITY IS TYPED, NOT CONFLATED. A release artifact has several
+* genuinely different identities — the commit it was built from, the SHA-256 of
+* the exact bytes, npm's SHA-512 SRI, the package name, the version, the
+* repository, the ref and the target registry. Each is a separate field and is
+* compared with its own observed value read from a trusted producer. Comparing,
+* say, a 64-hex SHA-256 against an SRI can never succeed, so a legitimate
+* release would have been permanently refused; and accepting a model-supplied
+* SHA instead of the artifact's embedded one would bind nothing. Every field
+* the contract declares must be OBSERVED, so omitting evidence is a refusal,
+* never a bypass.
+*
+* COVERAGE SURFACE (frozen wording): only the surfaces Guard itself routes can
+* be protected. Operations with no Guard execution surface are refused before
+* any effect, and the plugin never suggests falling back to a plain shell
+* command. A trusted in-process caller that bypasses Guard entirely is a host
+* trust boundary and is disclosed as such in the documentation, not pretended
+* away.
+*/
+const RELEASE_CONTRACT_PREFIX = "Context Guard release contract v1: ";
+const RELEASE_RESERVATION_PREFIX = "Context Guard release reservation v1: ";
+const RELEASE_SETTLEMENT_PREFIX = "Context Guard release settlement v1: ";
+const RELEASE_REVOCATION_PREFIX = "Context Guard release revocation v1: ";
+const RELEASE_OPERATIONS = [
+	"npm_publish",
+	"git_tag",
+	"github_release_create",
+	"github_release_update",
+	"github_release_delete",
+	"composite_runner"
+];
+/**
+* The routing table for this release. `git_tag` and the GitHub Release
+* operations have no Guard-owned execution route yet; the coordinator
+* explicitly approved that staged scope reduction on 2026-09-14, and the new
+* route is the way each of them becomes protectable. A composite runner stays
+* opaque by construction.
+*/
+const RELEASE_OPERATION_SURFACES = {
+	npm_publish: {
+		surface: "context_guard_action",
+		protectable: true,
+		reasonCode: "release_operation_protectable",
+		attribution: "implemented"
+	},
+	git_tag: {
+		surface: "none",
+		protectable: false,
+		reasonCode: "release_operation_unrouted",
+		attribution: "scope_reduction"
+	},
+	github_release_create: {
+		surface: "none",
+		protectable: false,
+		reasonCode: "release_operation_unrouted",
+		attribution: "scope_reduction"
+	},
+	github_release_update: {
+		surface: "none",
+		protectable: false,
+		reasonCode: "release_operation_unrouted",
+		attribution: "scope_reduction"
+	},
+	github_release_delete: {
+		surface: "none",
+		protectable: false,
+		reasonCode: "release_operation_unrouted",
+		attribution: "scope_reduction"
+	},
+	composite_runner: {
+		surface: "none",
+		protectable: false,
+		reasonCode: "release_runner_opaque",
+		attribution: "host_boundary"
+	}
+};
+const FULL_SHA40 = /^[0-9a-f]{40}$/;
+const SHA256 = /^[0-9a-f]{64}$/;
+const SRI = /^sha(?:256|384|512)-[A-Za-z0-9+/]+={0,2}$/;
+/**
+* How strongly an outcome resolves the reservation. A `settled` release is
+* never downgraded by a later record, while a stronger record reconciles a
+* weaker one — that is how a trusted readback recovers an earlier unconfirmed
+* attempt instead of being discarded.
+*/
+const OUTCOME_STRENGTH = {
+	not_effected: 0,
+	unknown: 1,
+	failed: 1,
+	unconfirmed: 2,
+	settled: 3
+};
+function asRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function optionalString(value) {
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+/**
+* Normalize a candidate release contract from a root adoption payload. Every
+* field is validated: an unparsable or partial adoption is refused rather than
+* approximated, because a half-specified contract would authorize an
+* unspecified candidate.
+*/
+function normalizeReleaseContract(raw, adoptedBy, adoptedAtRevision = 0) {
+	const errors = [];
+	const value = asRecord$1(raw);
+	if (!value) return { errors: ["release_contract_malformed"] };
+	const operations = [];
+	if (!Array.isArray(value.operations) || value.operations.length === 0) errors.push("release_operations_missing");
+	else for (const entry of value.operations) {
+		if (typeof entry !== "string" || !RELEASE_OPERATIONS.includes(entry)) {
+			errors.push("release_operation_unknown");
+			continue;
+		}
+		const operation = entry;
+		if (!RELEASE_OPERATION_SURFACES[operation].protectable) {
+			errors.push(RELEASE_OPERATION_SURFACES[operation].reasonCode);
+			continue;
+		}
+		if (!operations.includes(operation)) operations.push(operation);
+	}
+	const candidate = asRecord$1(value.candidate);
+	if (!candidate) errors.push("release_candidate_missing");
+	const CANDIDATE_FIELDS = [
+		"fullSha40",
+		"ref",
+		"repository",
+		"packageId",
+		"version",
+		"artifactSha256",
+		"artifactSri",
+		"registry",
+		"artifactDigest"
+	];
+	for (const key of Object.keys(candidate ?? {})) if (!CANDIDATE_FIELDS.includes(key)) errors.push("release_candidate_field_unknown");
+	const fullSha40 = optionalString(candidate?.fullSha40) ?? "";
+	if (!FULL_SHA40.test(fullSha40)) errors.push("release_candidate_sha_invalid");
+	const ref = optionalString(candidate?.ref);
+	const repository = optionalString(candidate?.repository);
+	const packageId = optionalString(candidate?.packageId);
+	const version = optionalString(candidate?.version);
+	let artifactSha256 = optionalString(candidate?.artifactSha256);
+	let artifactSri = optionalString(candidate?.artifactSri);
+	const legacyDigest = optionalString(candidate?.artifactDigest);
+	if (legacyDigest !== void 0) if (SHA256.test(legacyDigest)) artifactSha256 ??= legacyDigest;
+	else if (SRI.test(legacyDigest)) artifactSri ??= legacyDigest;
+	else errors.push("release_candidate_artifact_digest_invalid");
+	const registry = optionalString(candidate?.registry);
+	if (artifactSha256 !== void 0 && !SHA256.test(artifactSha256)) errors.push("release_candidate_sha256_invalid");
+	if (artifactSri !== void 0 && !SRI.test(artifactSri)) errors.push("release_candidate_sri_invalid");
+	const readinessRefs = Array.isArray(value.readinessRefs) ? value.readinessRefs.filter((entry) => typeof entry === "string" && entry.length > 0) : [];
+	const closureCertRef = optionalString(value.closureCertRef);
+	let expiresAtEpochMs;
+	if (value.expiresAtEpochMs !== void 0) if (typeof value.expiresAtEpochMs !== "number" || !Number.isSafeInteger(value.expiresAtEpochMs) || value.expiresAtEpochMs <= 0) errors.push("release_expiry_invalid");
+	else expiresAtEpochMs = value.expiresAtEpochMs;
+	if (errors.length) return { errors: [...new Set(errors)] };
+	const suppliedId = optionalString(value.contractId);
+	const body = {
+		operations: [...operations].sort(),
+		candidate: {
+			fullSha40,
+			...ref ? { ref } : {},
+			...repository ? { repository } : {},
+			...packageId ? { packageId } : {},
+			...version ? { version } : {},
+			...artifactSha256 ? { artifactSha256 } : {},
+			...artifactSri ? { artifactSri } : {},
+			...registry ? { registry } : {}
+		},
+		readinessRefs: [...readinessRefs].sort(),
+		...closureCertRef ? { closureCertRef } : {},
+		...expiresAtEpochMs !== void 0 ? { expiresAtEpochMs } : {}
+	};
+	return {
+		contract: {
+			contractId: suppliedId ?? `rel-${sha256(JSON.stringify(body)).slice(0, 16)}`,
+			adoptedBy,
+			adoptedAtRevision,
+			operations: operations.sort(),
+			candidate: body.candidate,
+			readinessRefs: body.readinessRefs,
+			...closureCertRef ? { closureCertRef } : {},
+			...expiresAtEpochMs !== void 0 ? { expiresAtEpochMs } : {}
+		},
+		errors: []
+	};
+}
+function normalizeReservation(raw) {
+	const value = asRecord$1(raw);
+	if (!value) return void 0;
+	const contractId = optionalString(value.contractId);
+	const operation = optionalString(value.operation);
+	const callId = optionalString(value.callId);
+	const startedAtSeq = value.startedAtSeq;
+	if (!contractId || !callId) return void 0;
+	if (!operation || !RELEASE_OPERATIONS.includes(operation)) return void 0;
+	if (typeof startedAtSeq !== "number" || !Number.isSafeInteger(startedAtSeq)) return void 0;
+	const observedArtifactSri = optionalString(value.observedArtifactSri);
+	return {
+		contractId,
+		operation,
+		callId,
+		startedAtSeq,
+		status: "in_flight",
+		...observedArtifactSri ? { observedArtifactSri } : {}
+	};
+}
+const RELEASE_OUTCOMES = [
+	"settled",
+	"unconfirmed",
+	"unknown",
+	"failed",
+	"not_effected"
+];
+function normalizeSettlement(raw) {
+	const value = asRecord$1(raw);
+	if (!value) return void 0;
+	const contractId = optionalString(value.contractId);
+	const operation = optionalString(value.operation);
+	const callId = optionalString(value.callId);
+	const settledAtSeq = value.settledAtSeq;
+	const outcome = optionalString(value.outcome);
+	if (!contractId || !callId) return void 0;
+	if (!operation || !RELEASE_OPERATIONS.includes(operation)) return void 0;
+	if (typeof settledAtSeq !== "number" || !Number.isSafeInteger(settledAtSeq)) return void 0;
+	if (!outcome || !RELEASE_OUTCOMES.includes(outcome)) return void 0;
+	const readbackRaw = asRecord$1(value.readback);
+	const kind = readbackRaw?.kind;
+	return {
+		contractId,
+		operation,
+		callId,
+		settledAtSeq,
+		readback: readbackRaw && (kind === "npm_integrity" || kind === "git_ref" || kind === "github_release") && optionalString(readbackRaw.identity) ? {
+			kind,
+			identity: optionalString(readbackRaw.identity)
+		} : "unavailable",
+		outcome
+	};
+}
+/** The adopted, not-revoked contract that covers an operation, newest first. */
+function releaseContractFor(projection, operation, contractId) {
+	const contracts = projection.releaseContracts.filter((contract) => contract.revokedAtSeq === void 0 && (contractId === void 0 || contract.contractId === contractId) && contract.operations.includes(operation));
+	return contracts.length ? contracts[contracts.length - 1] : void 0;
+}
+/** Whether a contract was explicitly revoked by a durable root command. */
+function isContractRevoked(projection, contractId) {
+	return projection.releaseContracts.some((contract) => contract.contractId === contractId && contract.revokedAtSeq !== void 0);
+}
+/**
+* The reconciled settlement per (contract, operation, callId): the strongest
+* outcome wins, ties resolve to the later record. A `settled` release is never
+* revoked by a later weaker record.
+*/
+function reconciledSettlements(projection, contractId, operation) {
+	const byCall = /* @__PURE__ */ new Map();
+	for (const settlement of projection.releaseSettlements) {
+		if (settlement.contractId !== contractId || settlement.operation !== operation) continue;
+		const existing = byCall.get(settlement.callId);
+		if (!existing) {
+			byCall.set(settlement.callId, settlement);
+			continue;
+		}
+		const stronger = OUTCOME_STRENGTH[settlement.outcome] > OUTCOME_STRENGTH[existing.outcome];
+		const newer = OUTCOME_STRENGTH[settlement.outcome] === OUTCOME_STRENGTH[existing.outcome] && settlement.settledAtSeq >= existing.settledAtSeq;
+		if (stronger || newer) byCall.set(settlement.callId, settlement);
+	}
+	return [...byCall.values()];
+}
+/** Whether a settlement releases the one-shot lock: settled, or proven no-effect. */
+function releasesLock(settlement) {
+	return settlement.outcome === "settled" || settlement.outcome === "not_effected";
+}
+/** The in-flight (unresolved) reservation for one contract operation, if any. */
+function inFlightReservation(projection, contractId, operation) {
+	const settled = reconciledSettlements(projection, contractId, operation);
+	for (const reservation of projection.releaseReservations) {
+		if (reservation.contractId !== contractId || reservation.operation !== operation) continue;
+		const resolution = settled.find((settlement) => settlement.callId === reservation.callId);
+		if (!resolution || !releasesLock(resolution)) return reservation;
+	}
+}
+/** Whether a contract operation has already been consumed by a settled effect. */
+function settledOperations(projection, contractId) {
+	const consumed = [];
+	for (const settlement of projection.releaseSettlements) {
+		if (settlement.contractId !== contractId) continue;
+		if (settlement.outcome !== "settled") continue;
+		if (!consumed.includes(settlement.operation)) consumed.push(settlement.operation);
+	}
+	return consumed.sort();
+}
+const CANDIDATE_FIELD_CODES = [
+	{
+		field: "fullSha40",
+		label: "commit",
+		unresolvedCode: "release_candidate_sha_unresolved",
+		mismatchCode: "release_candidate_sha_mismatch"
+	},
+	{
+		field: "ref",
+		label: "ref",
+		unresolvedCode: "release_candidate_ref_unresolved",
+		mismatchCode: "release_candidate_ref_mismatch"
+	},
+	{
+		field: "repository",
+		label: "repository",
+		unresolvedCode: "release_candidate_repository_unresolved",
+		mismatchCode: "release_candidate_repository_mismatch"
+	},
+	{
+		field: "packageId",
+		label: "package",
+		unresolvedCode: "release_candidate_package_unresolved",
+		mismatchCode: "release_candidate_package_mismatch"
+	},
+	{
+		field: "version",
+		label: "version",
+		unresolvedCode: "release_candidate_version_unresolved",
+		mismatchCode: "release_candidate_version_mismatch"
+	},
+	{
+		field: "artifactSha256",
+		label: "artifact SHA-256",
+		unresolvedCode: "release_artifact_sha256_unresolved",
+		mismatchCode: "release_candidate_artifact_mismatch"
+	},
+	{
+		field: "artifactSri",
+		label: "artifact SRI",
+		unresolvedCode: "release_artifact_sri_unresolved",
+		mismatchCode: "release_candidate_artifact_sri_mismatch"
+	},
+	{
+		field: "registry",
+		label: "registry",
+		unresolvedCode: "release_candidate_registry_unresolved",
+		mismatchCode: "release_candidate_registry_mismatch"
+	}
+];
+/** A readiness reference resolves to a real, already-established fact. */
+function readinessResolves(projection, ref) {
+	if (projection.checkpoints.some((checkpoint) => checkpoint.id === ref && checkpoint.result === "certified")) return true;
+	if (projection.boundaries.some((boundary) => boundary.id === ref)) return true;
+	return projection.items.get(ref)?.status === "passed";
+}
+/**
+* The pre-effect release decision. Order matters: an unprotectable surface and
+* a damaged release state are refused before expiry or candidate checks,
+* because running an unprotected operation is never made acceptable by a valid
+* ticket, and because unreadable release state must not authorize anything.
+*/
+function releasePreEffectDecision(projection, request) {
+	const surface = RELEASE_OPERATION_SURFACES[request.operation];
+	if (!surface.protectable) return {
+		status: "denied",
+		reasonCode: surface.reasonCode
+	};
+	if (projection.releaseStateDamaged) return {
+		status: "denied",
+		reasonCode: "release_state_damaged"
+	};
+	const contract = releaseContractFor(projection, request.operation, request.contractId);
+	if (!contract) {
+		if (projection.releaseContracts.some((entry) => entry.revokedAtSeq !== void 0 && entry.operations.includes(request.operation) && (request.contractId === void 0 || entry.contractId === request.contractId))) return {
+			status: "denied",
+			reasonCode: "release_contract_revoked"
+		};
+		if (request.contractId !== void 0 && isContractRevoked(projection, request.contractId)) return {
+			status: "denied",
+			reasonCode: "release_contract_revoked"
+		};
+		return {
+			status: "denied",
+			reasonCode: projection.releaseContracts.length === 0 ? "release_contract_required" : "release_operation_not_adopted"
+		};
+	}
+	if (contract.expiresAtEpochMs !== void 0) {
+		if (request.nowEpochMs === void 0) return {
+			status: "denied",
+			reasonCode: "release_expiry_unevaluable",
+			contractId: contract.contractId
+		};
+		if (request.nowEpochMs >= contract.expiresAtEpochMs) return {
+			status: "denied",
+			reasonCode: "release_contract_expired",
+			contractId: contract.contractId
+		};
+	}
+	if (settledOperations(projection, contract.contractId).includes(request.operation)) return {
+		status: "denied",
+		reasonCode: "release_operation_consumed",
+		contractId: contract.contractId
+	};
+	if (inFlightReservation(projection, contract.contractId, request.operation)) return {
+		status: "denied",
+		reasonCode: "release_operation_in_flight",
+		contractId: contract.contractId
+	};
+	for (const ref of contract.readinessRefs) if (!readinessResolves(projection, ref)) return {
+		status: "denied",
+		reasonCode: "release_readiness_unresolved",
+		contractId: contract.contractId
+	};
+	const frozen = contract.frozenClosure;
+	const closure = frozen !== void 0 ? projection.checkpoints.find((checkpoint) => checkpoint.id === frozen.id) : void 0;
+	if (!frozen || frozen.contractRevision !== contract.adoptedAtRevision || frozen.id !== contract.closureCertRef || !closure || closure.result !== "certified" || closure.certificationDigest !== frozen.certificationDigest || closure.epoch !== projection.epoch) return {
+		status: "denied",
+		reasonCode: "release_closure_unresolved",
+		contractId: contract.contractId
+	};
+	if (contract.candidate.artifactSha256 === void 0 && contract.candidate.artifactSri === void 0) return {
+		status: "denied",
+		reasonCode: "release_artifact_identity_required",
+		contractId: contract.contractId
+	};
+	const candidate = contract.candidate;
+	const observedIdentity = request.observed ?? {};
+	const compared = [];
+	for (const entry of CANDIDATE_FIELD_CODES) {
+		const declared = candidate[entry.field];
+		if (typeof declared !== "string") continue;
+		compared.push([entry, declared]);
+	}
+	for (const [entry, declared] of compared) {
+		const observed = observedIdentity[entry.field];
+		if (observed === void 0) return {
+			status: "denied",
+			reasonCode: entry.unresolvedCode,
+			contractId: contract.contractId
+		};
+		if (observed !== declared) return {
+			status: "denied",
+			reasonCode: entry.mismatchCode,
+			contractId: contract.contractId
+		};
+	}
+	if (candidate.ref !== void 0 && observedIdentity.refSha !== void 0 && observedIdentity.fullSha40 !== void 0 && observedIdentity.refSha !== observedIdentity.fullSha40) return {
+		status: "denied",
+		reasonCode: "release_ref_commit_mismatch",
+		contractId: contract.contractId
+	};
+	const resolved = request.resolvedTarget;
+	if (resolved === void 0) return {
+		status: "denied",
+		reasonCode: "release_target_unresolved",
+		contractId: contract.contractId
+	};
+	if (resolved.version === void 0) return {
+		status: "denied",
+		reasonCode: "release_target_unresolved",
+		contractId: contract.contractId
+	};
+	if (candidate.packageId !== void 0 && resolved.artifact_id !== candidate.packageId) return {
+		status: "denied",
+		reasonCode: "release_target_package_mismatch",
+		contractId: contract.contractId
+	};
+	if (candidate.version !== void 0 && resolved.version !== candidate.version) return {
+		status: "denied",
+		reasonCode: "release_target_version_mismatch",
+		contractId: contract.contractId
+	};
+	if (candidate.registry !== void 0 && resolved.registry !== candidate.registry) return {
+		status: "denied",
+		reasonCode: "release_target_registry_mismatch",
+		contractId: contract.contractId
+	};
+	return {
+		status: "granted",
+		reasonCode: "release_contract_granted",
+		contractId: contract.contractId
+	};
+}
+/**
+* Whether a trusted readback settles the attempt: the readback must name the
+* SAME artifact identity the contract froze. A registry that answers with a
+* different integrity proves the wrong bytes are published, which is an
+* unknown outcome for this contract, never a settlement.
+*/
+function readbackSettlesContract(contract, readback, reservationSri) {
+	if (readback === "unavailable") return "unconfirmed";
+	if (readback.kind !== "npm_integrity") return "unconfirmed";
+	const expected = contract.candidate.artifactSri ?? reservationSri;
+	if (expected === void 0) return "unconfirmed";
+	return readback.identity === expected ? "settled" : "mismatch";
+}
+/**
+* The reservation for one call, including revoked contracts: reconciling an
+* operation that was already in flight when its contract was revoked is the
+* recovery case, not an authority question.
+*/
+function reservationFor(projection, contractId, callId) {
+	return projection.releaseReservations.find((entry) => entry.contractId === contractId && entry.callId === callId);
+}
+/** A contract by id, INCLUDING revoked ones, for recovery lookups. */
+function contractById(projection, contractId) {
+	return projection.releaseContracts.find((entry) => entry.contractId === contractId);
+}
+/** The coverage report for one contract: which adopted operations Guard can protect. */
+function releaseCoverage(contract) {
+	return [...contract.operations].sort().map((operation) => ({
+		operation,
+		...RELEASE_OPERATION_SURFACES[operation]
+	}));
+}
+
 //#endregion
 //#region src/domain/derive.ts
+/**
+* Audited delegation tool names (C04/DS06-B). A tool result from one of these
+* is a subagent's answer: bounded evidence for the unit that asked for it, and
+* never a parent completion. The real names are a host tool-bundle surface —
+* native acceptance pins the audited cohort, exactly like the question-tool
+* allowlist — so this list is the production default and can be overridden by
+* an audited cohort.
+*/
+const DEFAULT_DELEGATION_TOOL_NAMES = [
+	"task",
+	"delegate",
+	"delegate_task",
+	"subagent",
+	"subagent_fork",
+	"spawn_agent"
+];
 const CAPTURE_V042_NOTICE = "Context Guard capture boundary: v0.4.2";
 const PROTOCOL_V3_NOTICE = "Context Guard protocol boundary: v3.0.0";
 /**
@@ -8177,6 +10501,15 @@ const PROTOCOL_V3_NOTICE = "Context Guard protocol boundary: v3.0.0";
 * their historical meaning for replay.
 */
 const PROTOCOL_V4_NOTICE = "Context Guard protocol boundary: v4.0.0";
+/**
+* 0.6.0 first-step boundary: same placement discipline as v4. It cuts the
+* work-unit, delivery, and certificate-v2 semantics (P0 §1): messages before
+* it keep their historical rules, messages after it are captured into work
+* units and close through unit-closure certificates and trusted deliveries.
+* An old binary ignores this notice (plugin source, unmatched pattern), so the
+* fail direction on rollback is closed, never a misread.
+*/
+const PROTOCOL_V5_NOTICE = "Context Guard protocol boundary: v5.0.0";
 function isProtocolBoundaryNotice(event, notice = PROTOCOL_V3_NOTICE) {
 	if (event.type !== "user/message") return false;
 	const data = asRecord(event.data);
@@ -8196,6 +10529,39 @@ function parseArguments(raw) {
 function asRecord(value) {
 	return typeof value === "object" && value !== null ? value : void 0;
 }
+/** Stable JSON, used for the release adoption digest. */
+function stableJson(value) {
+	if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+/**
+* Bounded release diagnostic ledger (last 16 entries). A rejected record also
+* marks the release state damaged: an unreadable reservation, settlement or
+* contract must block release operations rather than being silently forgotten,
+* and it must not touch the projection's own integrity, which governs ordinary
+* work.
+*/
+function pushReleaseDiagnostic(projection, seq, reasonCode, damaging = false) {
+	if (damaging) projection.releaseStateDamaged = true;
+	if (projection.releaseDiagnostics.some((entry) => entry.seq === seq && entry.reasonCode === reasonCode)) return;
+	projection.releaseDiagnostics.push({
+		seq,
+		reasonCode
+	});
+	if (projection.releaseDiagnostics.length > 16) projection.releaseDiagnostics.shift();
+}
+/**
+* Whether a recorded certificate is exactly the certificate this log re-derives.
+*
+* The comparison is by FIELD SEMANTICS, not by JSON text: a tool output is a
+* JSON object whose property order is an artifact of serialization, so
+* `JSON.stringify` equality made an identical certificate replay as corrupt
+* whenever the writer emitted `unit_id` before `goal_ref` (or vice versa). The
+* field set is still exact — an extra, missing, or renamed field stays a
+* mismatch — and values are compared by canonical encoding, so tampering is as
+* detectable as before.
+*/
 function recordedCertificateMatches(recorded, checkpoint) {
 	const value = asRecord(recorded);
 	if (!value) return false;
@@ -8214,6 +10580,10 @@ function recordedCertificateMatches(recorded, checkpoint) {
 		certification_digest: checkpoint.certificationDigest,
 		goal_ref: checkpoint.goalRef ?? null
 	};
+	if (checkpoint.unitId !== void 0) {
+		exact.unit_id = checkpoint.unitId;
+		exact.unit_closure_digest = checkpoint.unitClosureDigest;
+	}
 	const normalized = {
 		...value,
 		goal_ref: goal ? {
@@ -8221,7 +10591,61 @@ function recordedCertificateMatches(recorded, checkpoint) {
 			revision: goal.revision
 		} : value.goal_ref
 	};
-	return JSON.stringify(normalized) === JSON.stringify(exact);
+	const expectedKeys = Object.keys(exact).sort();
+	const actualKeys = Object.keys(normalized).sort();
+	if (expectedKeys.length !== actualKeys.length) return false;
+	return expectedKeys.every((key, index) => key === actualKeys[index] && stableJson(normalized[key]) === stableJson(exact[key]));
+}
+/**
+* The proof binding state the log itself implies for one checkpoint call. This
+* is the same computation the signing tool performs, replayed against the
+* projection derived up to that call.
+*/
+function replayProofState(projection, proof) {
+	if (proof === void 0) return {
+		status: "absent",
+		reason_codes: []
+	};
+	const structural = validateProofManifestV2(proof);
+	if (structural.length) return {
+		status: "invalid",
+		reason_codes: [...structural].sort()
+	};
+	const binding = bindProofV2ToProjection(projection, proof);
+	return binding.length ? {
+		status: "rejected",
+		reason_codes: [...binding].sort()
+	} : {
+		status: "bound",
+		reason_codes: []
+	};
+}
+/** Bounded set equality for reason-code lists, order-insensitive. */
+function sameStringSet(recorded, expected) {
+	if (!Array.isArray(recorded)) return false;
+	const left = [...new Set(recorded.filter((entry) => typeof entry === "string"))].sort();
+	const right = [...new Set(expected)].sort();
+	return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+/**
+* Freeze the closure certificate the adopter relied on, resolved AT the
+* adoption watermark. Only the checkpoints restored so far existed then, so a
+* certificate that appears LATER in the log can never ratify an earlier
+* adoption; an unresolvable reference is recorded as unresolved rather than
+* left open for a future entry to satisfy.
+*/
+function freezeAdoptionClosure(projection, contract) {
+	const ref = contract.closureCertRef;
+	const closure = ref !== void 0 ? projection.checkpoints.find((checkpoint) => checkpoint.id === ref && checkpoint.result === "certified") : void 0;
+	return closure === void 0 ? contract : {
+		...contract,
+		frozenClosure: {
+			id: closure.id,
+			certificationDigest: closure.certificationDigest,
+			epoch: closure.epoch,
+			contractRevision: closure.contractRevision
+		}
+	};
 }
 function restoreHistoricalCheckpoint(recorded, bindings, id) {
 	const stringField = (name) => typeof recorded[name] === "string" ? recorded[name] : void 0;
@@ -8241,6 +10665,7 @@ function restoreHistoricalCheckpoint(recorded, bindings, id) {
 		"certification_digest"
 	].some((name) => !stringField(name))) return void 0;
 	if (goal && (typeof goal.id !== "string" || !Number.isSafeInteger(goal.revision))) return void 0;
+	if (recorded.unit_id !== void 0 && (typeof recorded.unit_id !== "string" || !stringField("unit_closure_digest"))) return void 0;
 	return {
 		id,
 		stopProtocolVersion: stringField("stop_protocol_version"),
@@ -8258,6 +10683,10 @@ function restoreHistoricalCheckpoint(recorded, bindings, id) {
 			id: goal.id,
 			revision: goal.revision
 		} } : {},
+		...typeof recorded.unit_id === "string" ? {
+			unitId: recorded.unit_id,
+			unitClosureDigest: stringField("unit_closure_digest")
+		} : {},
 		certificationDigest: stringField("certification_digest"),
 		result: "certified"
 	};
@@ -8295,11 +10724,39 @@ function resolveArtifact(path$1, scope) {
 * an item whose action/target could not be derived deterministically stays
 * `legacy_authority_unclassified` instead of being retroactively authorized.
 */
-function captureRootText(projection, text, seq, scope, legacy, priorRootMessages, prefix = `m${seq}`, coordinationSplit = true) {
+function captureRootText(projection, text, seq, scope, legacy, priorRootMessages, prefix = `m${seq}`, coordinationSplit = true, unitId, clarification = false) {
 	const blocks = segmentAuthorityBlocks(text, priorRootMessages);
+	const provenance = legacy ? void 0 : {
+		rawTextSha256: sha256(text),
+		rawText: text
+	};
+	let coveredSpans = 0;
+	let blockCursor = 0;
 	for (const block$1 of blocks) {
 		if (!block$1.capture) continue;
-		insertItems(projection, block$1.text, `${prefix}:${block$1.blockId}`, scope, block$1.authority === "root_adoption" ? "root_adoption" : "root_instruction", legacy, block$1.kind === "instruction" || block$1.authority === "root_adoption", coordinationSplit);
+		let blockOffset;
+		if (provenance) {
+			const at = provenance.rawText.indexOf(block$1.text, blockCursor);
+			if (at >= 0) {
+				blockCursor = at + 1;
+				blockOffset = utf8ByteOffset(provenance.rawText, at);
+			}
+		}
+		coveredSpans += insertItems(projection, block$1.text, `${prefix}:${block$1.blockId}`, scope, block$1.authority === "root_adoption" ? "root_adoption" : "root_instruction", legacy, block$1.kind === "instruction" || block$1.authority === "root_adoption", coordinationSplit, unitId, provenance ? {
+			...provenance,
+			blockOffset,
+			blockText: block$1.text,
+			blockAuthority: block$1.authority
+		} : void 0, clarification ? text : void 0);
+	}
+	if (provenance) {
+		projection.coverage.push({
+			seq,
+			rawTextSha256: provenance.rawTextSha256,
+			byteLength: utf8ByteLength(provenance.rawText),
+			coveredSpans
+		});
+		if (projection.coverage.length > 16) projection.coverage.shift();
 	}
 	priorRootMessages.push(text);
 	if (priorRootMessages.length > 16) priorRootMessages.shift();
@@ -8310,16 +10767,40 @@ function captureRootText(projection, text, seq, scope, legacy, priorRootMessages
 * item, so evidence for one file cannot close a message that also covers other
 * files or embeds prohibitions.
 */
-function insertItems(projection, text, sourceMessageId, scope, authority = "root_instruction", legacy = false, legacyAuthorityProven = false, coordinationSplit = true) {
+function insertItems(projection, text, sourceMessageId, scope, authority = "root_instruction", legacy = false, legacyAuthorityProven = false, coordinationSplit = true, unitId, provenance, clarificationText) {
 	const before = new Set(projection.items.keys());
+	let coveredSpans = 0;
+	const usedOccurrences = /* @__PURE__ */ new Set();
 	for (const segment of segmentClauses(text, { coordinationSplit })) {
 		if (classifyUserInteraction(segment.body) === "conversational") continue;
 		if (segment.kind === "requirement" && segment.paths.length === 0 && isInstructionFraming(segment.body)) continue;
+		let span;
+		if (provenance) {
+			let at = provenance.blockText.indexOf(segment.text);
+			while (at >= 0 && usedOccurrences.has(at)) at = provenance.blockText.indexOf(segment.text, at + 1);
+			if (at >= 0) {
+				usedOccurrences.add(at);
+				const start = (provenance.blockOffset ?? 0) + utf8ByteOffset(provenance.blockText, at);
+				span = {
+					partIndex: 0,
+					start,
+					end: start + utf8ByteLength(segment.text),
+					class: spanClassOf(segment.kind, segment.interpretation.directive, provenance.blockAuthority)
+				};
+			}
+		}
+		if (span) coveredSpans += 1;
 		if (segment.paths.length === 0) {
-			insert(projection, segment, sourceMessageId, scope.cwd || "scope", "scope");
+			insert(projection, segment, sourceMessageId, scope.cwd || "scope", "scope", unitId, provenance ? {
+				rawTextSha256: provenance.rawTextSha256,
+				span
+			} : void 0);
 			continue;
 		}
-		for (const path$1 of segment.paths) insert(projection, segment, sourceMessageId, resolveArtifact(path$1, scope), "artifact");
+		for (const path$1 of segment.paths) insert(projection, segment, sourceMessageId, resolveArtifact(path$1, scope), "artifact", unitId, provenance ? {
+			rawTextSha256: provenance.rawTextSha256,
+			span
+		} : void 0);
 	}
 	for (const [id, item] of projection.items) {
 		if (before.has(id)) continue;
@@ -8335,6 +10816,24 @@ function insertItems(projection, text, sourceMessageId, scope, authority = "root
 			break;
 		}
 	}
+	if (clarificationText) for (const [id, item] of projection.items) {
+		if (before.has(id)) continue;
+		if (item.kind === "prohibition" || item.status !== "pending") continue;
+		if (item.authorityDisposition !== "executable_now") continue;
+		if (!item.semanticAction || item.semanticAction === "generic_run") continue;
+		for (const [otherId, other] of projection.items) {
+			if (otherId === id || !before.has(otherId)) continue;
+			if (other.status !== "pending" || other.kind === "prohibition") continue;
+			if (other.waitAuthorization || other.legacyFlags?.length) continue;
+			if (other.semanticAction !== "generic_run" || other.authorityDisposition !== "executable_now") continue;
+			if (other.normalizedText.length < 4) continue;
+			if (!clarificationText.includes(other.normalizedText)) continue;
+			if (other.verification.subject !== item.verification.subject) continue;
+			supersedeItem(projection.items, otherId, item);
+			item.clarifiesItemId = otherId;
+			break;
+		}
+	}
 	for (const [id, item] of projection.items) {
 		if (before.has(id)) continue;
 		if (legacy) if (legacyAuthorityProven && item.semanticAction !== void 0 && item.semanticAction !== "generic_run" && item.targetCaptureStatus === "resolved") {
@@ -8347,13 +10846,19 @@ function insertItems(projection, text, sourceMessageId, scope, authority = "root
 		}
 		else item.authority = authority;
 	}
+	return coveredSpans;
 }
-function insert(projection, segment, sourceMessageId, subject, surface) {
+function insert(projection, segment, sourceMessageId, subject, surface, unitId, provenance) {
 	const revision = projection.contractRevision + 1;
 	const id = nextId(projection.items, segment.kind);
 	const method = extractMethod(segment.body);
 	const operation = extractOperation(segment.body);
 	const item = captureItem(segment.kind, segment.body, sourceMessageId, id, revision, subject, surface, method, operation, segment.interpretation);
+	if (unitId !== void 0) item.unitId = unitId;
+	if (provenance) {
+		item.rawTextSha256 = provenance.rawTextSha256;
+		if (provenance.span) item.spans = [provenance.span];
+	}
 	const duplicate = [...projection.items.values()].find((existing) => existing.kind === segment.kind && existing.status === "pending" && existing.textSha256 === item.textSha256 && existing.verification.subject === subject);
 	if (duplicate) supersedeItem(projection.items, duplicate.id, item);
 	else projection.items.set(id, item);
@@ -8368,6 +10873,7 @@ function insert(projection, segment, sourceMessageId, subject, surface) {
 */
 function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLock = DEFAULT_HOST_LOCK) {
 	const projection = createProjection();
+	projection.policy = config.policy ?? "standard";
 	if (scope.sessionHeader) projection.sessionRefDigest = sessionRefDigest(scope.sessionHeader);
 	projection.hostLockDigest = hostLock.digest;
 	projection.hostStatus = hostLock.status;
@@ -8380,14 +10886,44 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 	let enablementTransitioned = false;
 	let lastCompactionSeq = -1;
 	const pendingCalls = /* @__PURE__ */ new Map();
+	const v5BoundarySeq = sourceEvents.find((event) => isProtocolBoundaryNotice(event, PROTOCOL_V5_NOTICE))?.seq;
 	const v4BoundarySeq = sourceEvents.find((event) => isProtocolBoundaryNotice(event, PROTOCOL_V4_NOTICE))?.seq;
-	const protocolBoundarySeq = sourceEvents.find((event) => isProtocolBoundaryNotice(event) || isProtocolBoundaryNotice(event, PROTOCOL_V4_NOTICE))?.seq;
-	const captureBoundarySeq = sourceEvents.find((event) => isProtocolBoundaryNotice(event, CAPTURE_V042_NOTICE) || isProtocolBoundaryNotice(event, PROTOCOL_V4_NOTICE))?.seq;
+	const protocolBoundarySeq = sourceEvents.find((event) => isProtocolBoundaryNotice(event) || isProtocolBoundaryNotice(event, PROTOCOL_V4_NOTICE) || isProtocolBoundaryNotice(event, PROTOCOL_V5_NOTICE))?.seq;
+	const captureBoundarySeq = sourceEvents.find((event) => isProtocolBoundaryNotice(event, CAPTURE_V042_NOTICE) || isProtocolBoundaryNotice(event, PROTOCOL_V4_NOTICE) || isProtocolBoundaryNotice(event, PROTOCOL_V5_NOTICE))?.seq;
 	const priorRootMessages = [];
 	let realRootInputSeen = false;
+	const trustedDeliveries = (v5BoundarySeq !== void 0 ? deriveTrustedDeliveries(sourceEvents) : []).filter((delivery) => delivery.turnEndSeq > v5BoundarySeq);
+	let deliveryCursor = 0;
+	const applyDeliveriesUpTo = (seq) => {
+		while (deliveryCursor < trustedDeliveries.length && trustedDeliveries[deliveryCursor].turnEndSeq <= seq) {
+			const delivery = trustedDeliveries[deliveryCursor];
+			deliveryCursor += 1;
+			const inputSeqs = turnRootInputSeqs.get(delivery.turn);
+			if (!inputSeqs) continue;
+			const owningUnitId = turnUnitIds.get(delivery.turn);
+			const eligibleUnitIds = owningUnitId === void 0 ? void 0 : new Set([owningUnitId, ...unitDescendantIds(projection, owningUnitId)]);
+			for (const itemId of informationItemIdsForDelivery(projection.items, delivery, inputSeqs, eligibleUnitIds)) {
+				const item = projection.items.get(itemId);
+				if (!item || item.status !== "pending") continue;
+				const sourceSeq = /^m(\d+)(?::|$)/.exec(item.sourceMessageId);
+				if (!sourceSeq || Number(sourceSeq[1]) <= v5BoundarySeq) continue;
+				item.status = "answered";
+				item.answeredBy = {
+					turn: delivery.turn,
+					responseSeq: delivery.responseSeq,
+					responseSha256: delivery.responseSha256
+				};
+			}
+		}
+	};
+	const turnRootInputSeqs = /* @__PURE__ */ new Map();
+	const turnUnitIds = /* @__PURE__ */ new Map();
+	let activeTurn;
+	const unitSemanticsActive = () => v5BoundarySeq !== void 0 && !scope.sessionHeader?.parentSession && !scope.sessionHeader?.delegationDepth && scope.sessionHeader?.origin !== "subagent";
 	for (const event of sourceEvents) {
 		projection.enabled = enabled;
 		projection.lastObservedSourceSeq = Math.max(projection.lastObservedSourceSeq, event.seq);
+		applyDeliveriesUpTo(event.seq);
 		switch (event.type) {
 			case "command/run": {
 				const data = asRecord(event.data);
@@ -8408,6 +10944,26 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 						item.supersededBy = `CLEAR:${revision}`;
 					}
 					projection.contractRevision = revision;
+				} else if (subcommand === "release") {
+					const rest = typeof data.args === "string" ? data.args.trim().slice(7).trim() : "";
+					const revoke = /^revoke(?:\s+(\S+))?$/.exec(rest);
+					if (revoke) {
+						const contractId = revoke[1] ?? "";
+						const contract = projection.releaseContracts.find((entry) => entry.contractId === contractId);
+						if (!contract) pushReleaseDiagnostic(projection, event.seq, "release_contract_revocation_unknown");
+						else if (contract.revokedAtSeq === void 0) contract.revokedAtSeq = event.seq;
+						break;
+					}
+					const match = /^adopt(?:\s+([\s\S]+))?$/.exec(rest);
+					if (match) {
+						const payload = parseArguments((match[1] ?? "").trim());
+						const normalized = normalizeReleaseContract(payload, {
+							seq: event.seq,
+							digest: sha256(stableJson(payload))
+						}, projection.contractRevision);
+						if (!normalized.contract) for (const code of normalized.errors) pushReleaseDiagnostic(projection, event.seq, code);
+						else if (!projection.releaseContracts.some((contract) => contract.contractId === normalized.contract.contractId)) projection.releaseContracts.push(freezeAdoptionClosure(projection, normalized.contract));
+					} else if (rest.length > 0 && !/^status$/.test(rest)) pushReleaseDiagnostic(projection, event.seq, "release_subcommand_unknown");
 				}
 				break;
 			}
@@ -8417,10 +10973,22 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 				break;
 			case "turn/start": {
 				const started = asRecord(event.data);
-				if (typeof started?.turn === "number" && Number.isSafeInteger(started.turn)) projection.hostTurn = started.turn;
+				if (typeof started?.turn === "number" && Number.isSafeInteger(started.turn)) {
+					projection.hostTurn = started.turn;
+					activeTurn = started.turn;
+				}
+				break;
+			}
+			case "turn/end": {
+				const ended = asRecord(event.data);
+				if (typeof ended?.turn === "number" && Number.isSafeInteger(ended.turn)) activeTurn = void 0;
 				break;
 			}
 			case "user/message": {
+				if (isProtocolBoundaryNotice(event, PROTOCOL_V5_NOTICE)) {
+					projection.boundaryProtocol = 5;
+					break;
+				}
 				if (isProtocolBoundaryNotice(event) || isProtocolBoundaryNotice(event, CAPTURE_V042_NOTICE) || isProtocolBoundaryNotice(event, PROTOCOL_V4_NOTICE)) break;
 				{
 					const record = asRecord(event.data);
@@ -8444,17 +11012,76 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 						if (rootSeq !== void 0) projection.handledControlSeqs.add(rootSeq);
 						break;
 					}
+					if (recordSource?.kind === "plugin" && recordSource.plugin === "context-guard") {
+						if (recordText.startsWith(RELEASE_CONTRACT_PREFIX)) {
+							const payload = parseArguments(recordText.slice(RELEASE_CONTRACT_PREFIX.length));
+							const adoptionSeq = typeof payload.adoptedBySeq === "number" && Number.isSafeInteger(payload.adoptedBySeq) ? payload.adoptedBySeq : event.seq;
+							const normalized = normalizeReleaseContract(asRecord(payload.contract) ?? payload, {
+								seq: adoptionSeq,
+								digest: sha256(stableJson(payload.contract ?? null))
+							}, projection.contractRevision);
+							if (!normalized.contract) for (const code of normalized.errors) pushReleaseDiagnostic(projection, event.seq, code, true);
+							else if (!projection.releaseContracts.some((contract) => contract.contractId === normalized.contract.contractId)) projection.releaseContracts.push(freezeAdoptionClosure(projection, normalized.contract));
+							break;
+						}
+						if (recordText.startsWith(RELEASE_RESERVATION_PREFIX)) {
+							const reservation = normalizeReservation(parseArguments(recordText.slice(RELEASE_RESERVATION_PREFIX.length)));
+							if (!reservation) pushReleaseDiagnostic(projection, event.seq, "release_reservation_malformed", true);
+							else if (!projection.releaseReservations.some((entry) => entry.callId === reservation.callId)) projection.releaseReservations.push({
+								...reservation,
+								startedAtSeq: event.seq
+							});
+							break;
+						}
+						if (recordText.startsWith(RELEASE_REVOCATION_PREFIX)) {
+							const payload = asRecord(parseArguments(recordText.slice(RELEASE_REVOCATION_PREFIX.length)));
+							const contractId = typeof payload?.contractId === "string" ? payload.contractId : "";
+							const contract = projection.releaseContracts.find((entry) => entry.contractId === contractId);
+							if (!contract) pushReleaseDiagnostic(projection, event.seq, "release_contract_revocation_unknown");
+							else if (contract.revokedAtSeq === void 0) contract.revokedAtSeq = event.seq;
+							break;
+						}
+						if (recordText.startsWith(RELEASE_SETTLEMENT_PREFIX)) {
+							const settlement = normalizeSettlement(parseArguments(recordText.slice(RELEASE_SETTLEMENT_PREFIX.length)));
+							if (!settlement) pushReleaseDiagnostic(projection, event.seq, "release_settlement_malformed", true);
+							else {
+								const pinned = {
+									...settlement,
+									settledAtSeq: event.seq
+								};
+								const key = (row) => `${row.contractId}\u0000${row.operation}\u0000${row.callId}`;
+								const index = projection.releaseSettlements.findIndex((entry) => key(entry) === key(pinned));
+								if (index < 0) projection.releaseSettlements.push(pinned);
+								else if (OUTCOME_STRENGTH[pinned.outcome] >= OUTCOME_STRENGTH[projection.releaseSettlements[index].outcome]) projection.releaseSettlements[index] = pinned;
+							}
+							break;
+						}
+					}
 				}
 				if (!enabled) break;
 				const data = asRecord(event.data);
 				if (asRecord(data?.source)?.kind !== "user") break;
 				const content = data?.content ?? [];
 				const text = extractTextContent(content);
-				if (text.trim() || content.some((part) => part && typeof part === "object" && part.type !== "text")) realRootInputSeen = true;
+				if (text.trim() || content.some((part) => part && typeof part === "object" && part.type !== "text")) {
+					realRootInputSeen = true;
+					if (activeTurn !== void 0) {
+						const seqs = turnRootInputSeqs.get(activeTurn) ?? /* @__PURE__ */ new Set();
+						seqs.add(event.seq);
+						turnRootInputSeqs.set(activeTurn, seqs);
+					}
+				}
+				const unitSemantics = unitSemanticsActive() && v5BoundarySeq !== void 0 && event.seq > v5BoundarySeq;
+				const foldUnitId = () => {
+					if (!unitSemantics) return void 0;
+					foldIntoCurrentUnit(projection, event.seq);
+					if (activeTurn !== void 0) turnUnitIds.set(activeTurn, projection.currentUnitId);
+					return projection.currentUnitId;
+				};
 				const legacyMessage = protocolBoundarySeq !== void 0 && event.seq < protocolBoundarySeq;
 				const coordinationSplit = !(protocolBoundarySeq !== void 0 && (captureBoundarySeq === void 0 || event.seq < captureBoundarySeq));
-				const captureAssets = () => {
-					if (v4BoundarySeq !== void 0 && event.seq > v4BoundarySeq) content.forEach((part, index) => {
+				const captureAssets = (unitId) => {
+					if ((v4BoundarySeq ?? v5BoundarySeq) !== void 0 && event.seq > (v4BoundarySeq ?? v5BoundarySeq)) content.forEach((part, index) => {
 						if (!part || typeof part !== "object" || part.type === "text") return;
 						const identity = sha256(JSON.stringify(part));
 						insert(projection, {
@@ -8471,15 +11098,16 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 								authorityDisposition: "executable_now",
 								fingerprint: `asset:${identity.slice(0, 16)}`
 							}
-						}, `m${event.seq}:asset:${index}`, scope.cwd || "scope", "scope");
+						}, `m${event.seq}:asset:${index}`, scope.cwd || "scope", "scope", unitId);
 					});
 				};
 				if (!text.trim()) {
-					captureAssets();
+					captureAssets(unitSemantics ? foldUnitId() : void 0);
 					break;
 				}
 				if (!scope.sessionHeader?.parentSession && !scope.sessionHeader?.delegationDepth && scope.sessionHeader?.origin !== "subagent") {
-					const parsed = v4BoundarySeq !== void 0 && event.seq > v4BoundarySeq ? parseConfirmationMessage(text) : (() => {
+					const confirmGrammarSeq = v4BoundarySeq ?? v5BoundarySeq;
+					const parsed = confirmGrammarSeq !== void 0 && event.seq > confirmGrammarSeq ? parseConfirmationMessage(text) : (() => {
 						const match = CONFIRM_LINE_PATTERN.exec(text.trim());
 						return match ? {
 							kind: "confirm",
@@ -8489,12 +11117,14 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 					})();
 					if (parsed.kind === "confirm") {
 						if (confirmRebind(projection, parsed.proposalId, `m${event.seq}`, durableConfirmed)) {
-							captureAssets();
-							if (parsed.remainder) captureRootText(projection, parsed.remainder, event.seq, scope, legacyMessage, priorRootMessages, `m${event.seq}:r`, coordinationSplit);
+							const unitId = unitSemantics ? foldUnitId() : void 0;
+							captureAssets(unitId);
+							if (parsed.remainder) captureRootText(projection, parsed.remainder, event.seq, scope, legacyMessage, priorRootMessages, `m${event.seq}:r`, coordinationSplit, unitId, unitSemantics);
 							break;
 						}
 					} else if (parsed.kind !== "none") {
-						captureAssets();
+						const unitId = unitSemantics ? foldUnitId() : void 0;
+						captureAssets(unitId);
 						projection.lastConfirmationRejection = {
 							eventSeq: event.seq,
 							kind: parsed.kind,
@@ -8502,14 +11132,23 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 						};
 						const stripped = text.split(/\r?\n/).filter((line) => !CONFIRM_LINE_PATTERN.test(line.trim())).join("\n");
 						if (!stripped.trim()) break;
-						captureRootText(projection, stripped, event.seq, scope, legacyMessage, priorRootMessages, `m${event.seq}`, coordinationSplit);
+						captureRootText(projection, stripped, event.seq, scope, legacyMessage, priorRootMessages, `m${event.seq}`, coordinationSplit, unitId, unitSemantics);
 						break;
 					}
 				}
-				captureAssets();
+				const directiveBearing = text.trim().length > 0 && !isInformationalMessage(text) && classifyUserInteraction(text) !== "conversational";
+				let captureUnitId;
+				if (unitSemantics && directiveBearing) {
+					if (!explicitlyLinkedToCurrentUnit(projection, text) && opensNewUnit(projection, text, true, currentUnitHasOpenWork(projection))) {
+						const parentUnitId = opensChildUnit(projection, text) ? projection.currentUnitId : void 0;
+						captureUnitId = openUnit(projection, event.seq, text.slice(0, 200), parentUnitId).unitId;
+					} else captureUnitId = foldUnitId();
+					if (activeTurn !== void 0) turnUnitIds.set(activeTurn, projection.currentUnitId);
+				}
+				captureAssets(captureUnitId ?? (unitSemantics ? foldUnitId() : void 0));
 				if (isInformationalMessage(text)) break;
 				if (classifyUserInteraction(text) === "conversational") break;
-				captureRootText(projection, text, event.seq, scope, legacyMessage, priorRootMessages, `m${event.seq}`, coordinationSplit);
+				captureRootText(projection, text, event.seq, scope, legacyMessage, priorRootMessages, `m${event.seq}`, coordinationSplit, captureUnitId, unitSemantics);
 				break;
 			}
 			case "goal/change": {
@@ -8546,10 +11185,12 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 				const call = {
 					name: String(data?.name ?? ""),
 					arguments: String(data?.arguments ?? ""),
-					rootCallId: typeof data?.rootCallId === "string" ? data.rootCallId : void 0
+					rootCallId: typeof data?.rootCallId === "string" ? data.rootCallId : void 0,
+					...projection.currentUnitId !== void 0 ? { unitIdAtCall: projection.currentUnitId } : {}
 				};
 				if (call.name === "context_guard_checkpoint") {
 					const args = parseArguments(call.arguments);
+					if (asRecord(args.proof)) call.proof = args.proof;
 					call.bindings = Array.isArray(args.bindings) ? args.bindings.map((binding) => {
 						const record = asRecord(binding);
 						const transition = asRecord(record?.expected_transition);
@@ -8639,6 +11280,18 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 						}
 						break;
 					}
+					const recordedProof = asRecord(recorded.proof_state);
+					const recomputedProof = replayProofState(projection, call.proof);
+					if ((recordedProof !== void 0 || call.proof !== void 0) && (recordedProof === void 0 || String(recordedProof.status ?? "") !== recomputedProof.status || !sameStringSet(recordedProof.reason_codes, recomputedProof.reason_codes))) {
+						projection.integrity = "corrupt";
+						projection.integrityViolations.push("proof_replay_mismatch");
+						break;
+					}
+					if (recomputedProof.status === "invalid" || recomputedProof.status === "rejected") {
+						projection.integrity = "corrupt";
+						projection.integrityViolations.push("proof_replay_mismatch");
+						break;
+					}
 					if (!asRecord(recorded.certificate)) {
 						for (const binding of call.bindings ?? []) {
 							const item = projection.items.get(binding.itemId);
@@ -8689,7 +11342,8 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 					break;
 				}
 				evidenceCounter += 1;
-				const evidence = withDurability(evidenceFromPersistedToolResult({
+				const delegated = DEFAULT_DELEGATION_TOOL_NAMES.includes(call.name);
+				const baseEvidence = withDurability(evidenceFromPersistedToolResult({
 					callId,
 					name: call.name,
 					arguments: call.arguments,
@@ -8703,7 +11357,17 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 					meta: data?.meta,
 					textContent
 				}, epoch, `E${String(evidenceCounter).padStart(4, "0")}`, scope.cwd || void 0, hostLock), durableConfirmed);
+				const evidence = delegated ? {
+					...baseEvidence,
+					delegatedSubtask: true
+				} : baseEvidence;
 				projection.evidence.set(evidence.id, evidence);
+				if (delegated && call.unitIdAtCall !== void 0) recordDelegation(projection, call.unitIdAtCall, {
+					callId,
+					resultSeq: event.seq,
+					toolName: call.name,
+					status: data?.error !== void 0 ? "failed" : "completed"
+				});
 				if (evidence.externalOperationRef) projection.externalOperations.set(evidence.externalOperationRef.id, evidence.externalOperationRef);
 				break;
 			}
@@ -8712,13 +11376,58 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 	}
 	projection.enabled = enabled;
 	projection.epoch = epoch;
+	projection.trustedSelections = deriveTrustedSelections(sourceEvents, { questionToolNames: DEFAULT_QUESTION_TOOL_NAMES });
+	if (projection.trustedSelections.length > 16) projection.trustedSelections = projection.trustedSelections.slice(-16);
+	const approvalAsked = /* @__PURE__ */ new Map();
+	for (const event of sourceEvents) {
+		const data = asRecord(event.data);
+		if (event.type === "approval/asked") {
+			const id = typeof data?.id === "string" ? data.id : "";
+			const toolName = typeof data?.toolName === "string" ? data.toolName : void 0;
+			if (id) approvalAsked.set(id, {
+				id,
+				seq: event.seq,
+				toolName
+			});
+			continue;
+		}
+		if (event.type === "approval/decided") {
+			const id = typeof data?.id === "string" ? data.id : "";
+			const asked = approvalAsked.get(id);
+			if (!asked) continue;
+			const outcome = String(data?.outcome ?? "");
+			if (![
+				"allowed-once",
+				"rejected",
+				"cancelled",
+				"unavailable"
+			].includes(outcome)) continue;
+			projection.approvals.push({
+				id: asked.id,
+				seq: asked.seq,
+				toolName: asked.toolName,
+				outcome
+			});
+			approvalAsked.delete(id);
+		}
+	}
+	if (projection.approvals.length > 16) projection.approvals = projection.approvals.slice(-16);
+	if (!projection.releaseStateDamaged) projection.releaseStateDamaged = projection.releaseSettlements.some((settlement) => {
+		if (settlement.readback === "unavailable") return false;
+		const contract = projection.releaseContracts.find((entry) => entry.contractId === settlement.contractId);
+		if (!contract || settlement.readback.kind !== "npm_integrity") return false;
+		const reservation = projection.releaseReservations.find((entry) => entry.contractId === settlement.contractId && entry.operation === settlement.operation && entry.callId === settlement.callId);
+		const expected = contract.candidate.artifactSri ?? reservation?.observedArtifactSri;
+		return expected !== void 0 && expected !== settlement.readback.identity;
+	});
 	return {
 		projection,
 		compacted,
 		enablementTransitioned,
 		lastCompactionSeq,
 		realRootInputSeen,
-		protocolV4Present: v4BoundarySeq !== void 0
+		protocolV4Present: v4BoundarySeq !== void 0,
+		boundaryV5: v5BoundarySeq !== void 0
 	};
 }
 
@@ -8770,12 +11479,17 @@ function claimedBatchHasRealRootInput(messages) {
 * persisted step batch; guidance is compact and never claims a recovery that
 * did not happen. `opt-in` reaches this path only after its explicit `on` command. Delegated sessions receive neither: their
 * scope arrives through the parent's delegation prompt (A04).
+*
+* A session without a v5 boundary receives the 0.6 boundary: it cuts the
+* work-unit/delivery/certificate-v2 semantics at exactly this message. A
+* session that already has v5 injects nothing.
 */
 function previewFirstStepInjection(input, claimedRealInput) {
-	if (!input.enabled || input.boundaryPresent || input.delegated) return void 0;
+	if (!input.enabled || input.delegated) return void 0;
 	if (!claimedRealInput) return void 0;
+	if (input.boundaryV5Present) return void 0;
 	return {
-		boundary: PROTOCOL_V4_NOTICE,
+		boundary: PROTOCOL_V5_NOTICE,
 		guidance: FIRST_STEP_GUIDANCE
 	};
 }
@@ -9693,214 +12407,4 @@ function verifyComposedHostLockDump(text, expected, roots) {
 }
 
 //#endregion
-//#region src/domain/proof.ts
-const PROOF_PROTOCOL_VERSION = "0.4.0";
-const PROOF_KINDS = [
-	"subject_readback",
-	"scope_coverage",
-	"state_verification"
-];
-function stable(value) {
-	if (Array.isArray(value)) return `[${value.map(stable).join(",")}]`;
-	if (value && typeof value === "object") return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${JSON.stringify(k)}:${stable(v)}`).join(",")}}`;
-	return JSON.stringify(value);
-}
-function digest(value) {
-	return createHash("sha256").update("ccg.proofManifest.v1\n", "utf8").update(stable(value), "utf8").digest("hex");
-}
-function validDigest(value) {
-	return /^[0-9a-f]{64}$/.test(value);
-}
-/**
-* The manifest digest root includes every integrity-bearing field, so a
-* tampered asset-set digest is exactly as detectable as a tampered obligation.
-*/
-function proofDigest(obligations, assetSetSha256) {
-	return digest({
-		proofProtocolVersion: PROOF_PROTOCOL_VERSION,
-		obligations: [...obligations],
-		...assetSetSha256 !== void 0 ? { assetSetSha256 } : {}
-	});
-}
-function validateProofManifest(manifest) {
-	const errors = [];
-	if (!manifest || typeof manifest !== "object") return ["proof_manifest_invalid"];
-	const value = manifest;
-	if (value.proofProtocolVersion !== PROOF_PROTOCOL_VERSION) errors.push("proof_protocol_version_mismatch");
-	if (!Array.isArray(value.obligations)) errors.push("proof_obligations_missing");
-	if (value.assetSetSha256 !== void 0 && (typeof value.assetSetSha256 !== "string" || !validDigest(value.assetSetSha256))) errors.push("proof_asset_set_digest_invalid");
-	if (typeof value.proofSha256 !== "string" || !validDigest(value.proofSha256)) errors.push("proof_digest_invalid");
-	const obligations = Array.isArray(value.obligations) ? value.obligations : [];
-	const ids = /* @__PURE__ */ new Set();
-	for (const raw of obligations) {
-		if (!raw || typeof raw !== "object") {
-			errors.push("proof_obligation_invalid");
-			continue;
-		}
-		const obligation = raw;
-		if (typeof obligation.obligationId !== "string" || ids.has(obligation.obligationId)) errors.push("proof_obligation_id_duplicate_or_invalid");
-		if (typeof obligation.obligationId === "string") ids.add(obligation.obligationId);
-		if (!PROOF_KINDS.includes(obligation.kind)) errors.push("proof_kind_unsupported");
-		if (![
-			"artifact",
-			"ui",
-			"visual",
-			"scope"
-		].includes(String(obligation.surface))) errors.push("proof_surface_unsupported");
-		if (!Array.isArray(obligation.subjectIds) || obligation.subjectIds.length === 0 || obligation.subjectIds.some((id) => typeof id !== "string" || id.startsWith("codex:unsupported/"))) errors.push("proof_subject_invalid");
-		if (!Array.isArray(obligation.evidenceIds) || obligation.evidenceIds.length === 0 || new Set(obligation.evidenceIds).size !== obligation.evidenceIds.length) errors.push("proof_evidence_invalid");
-		const expected = obligation.expectedScopeDigest;
-		const observed = obligation.observedScopeDigest;
-		for (const digestValue of [expected, observed]) if (digestValue !== void 0 && (typeof digestValue !== "string" || !validDigest(digestValue))) errors.push("proof_scope_digest_invalid");
-		if (expected !== void 0 && observed !== expected) errors.push("proof_scope_digest_mismatch");
-		if (expected === void 0 && observed !== void 0) errors.push("proof_scope_digest_mismatch");
-	}
-	if (errors.length === 0) {
-		const assetSet = typeof value.assetSetSha256 === "string" ? value.assetSetSha256 : void 0;
-		if (value.proofSha256 !== proofDigest(obligations, assetSet)) errors.push("proof_digest_mismatch");
-	}
-	return [...new Set(errors)];
-}
-function createProofManifest(obligations, assetSetSha256) {
-	const normalized = obligations.map((obligation) => ({
-		obligationId: obligation.obligationId,
-		kind: obligation.kind,
-		surface: obligation.surface,
-		subjectIds: [...obligation.subjectIds].sort(),
-		evidenceIds: [...obligation.evidenceIds].sort(),
-		...obligation.expectedScopeDigest ? { expectedScopeDigest: obligation.expectedScopeDigest } : {},
-		...obligation.observedScopeDigest ? { observedScopeDigest: obligation.observedScopeDigest } : {}
-	})).sort((a, b) => a.obligationId.localeCompare(b.obligationId));
-	const manifest = {
-		proofProtocolVersion: PROOF_PROTOCOL_VERSION,
-		obligations: normalized,
-		...assetSetSha256 !== void 0 ? { assetSetSha256 } : {},
-		proofSha256: proofDigest(normalized, assetSetSha256)
-	};
-	const errors = validateProofManifest(manifest);
-	if (errors.length) throw new Error(`proof manifest rejected: ${errors.join(",")}`);
-	return manifest;
-}
-/**
-* Bind a structurally valid proof to the actual replayed projection: every
-* obligation must name a pending item, every evidence id must exist in the
-* projection, and every bound evidence must satisfy the obligation's kind,
-* surface, subject, and outcome constraints. An empty projection therefore
-* rejects any proof, and cross-item or foreign evidence can never bind.
-*/
-function bindProofToProjection(projection, proof) {
-	const errors = [];
-	const items = projection.items;
-	const evidence = projection.evidence;
-	for (const obligation of proof.obligations) {
-		const item = items.get(obligation.obligationId);
-		if (!item) {
-			errors.push("proof_obligation_unbound");
-			continue;
-		}
-		if (item.status !== "pending") {
-			errors.push("proof_obligation_not_pending");
-			continue;
-		}
-		if (item.verification.surface !== void 0 && item.verification.surface !== obligation.surface) errors.push("proof_surface_unbound");
-		const seen = /* @__PURE__ */ new Set();
-		for (const evidenceId of obligation.evidenceIds) {
-			const record = evidence.get(evidenceId);
-			if (!record) {
-				errors.push("proof_evidence_unknown");
-				continue;
-			}
-			if (!seen.has(evidenceId)) seen.add(evidenceId);
-			if (record.outcome !== "success") {
-				errors.push("proof_evidence_outcome_invalid");
-				continue;
-			}
-			if (!proofEvidenceConstraints(record, obligation)) errors.push("proof_evidence_constraint_failed");
-		}
-		if (obligation.kind === "scope_coverage") {
-			const itemScope = item.requestedTarget?.scope;
-			const itemSubject = item.verification.subject;
-			if (!obligation.subjectIds.every((subject) => subject === itemScope || subject === itemSubject)) errors.push("proof_scope_subject_unbound");
-		}
-	}
-	return [...new Set(errors)];
-}
-function canonicalProjection(projection) {
-	return {
-		epoch: projection.epoch,
-		contractRevision: projection.contractRevision,
-		sessionRefDigest: projection.sessionRefDigest,
-		hostLockDigest: projection.hostLockDigest,
-		hostStatus: projection.hostStatus,
-		hostCohortId: projection.hostCohortId,
-		integrity: projection.integrity,
-		items: [...projection.items.values()].map(({ id, revision, kind, status, semanticAction, requestedTarget, verification }) => ({
-			id,
-			revision,
-			kind,
-			status,
-			semanticAction,
-			requestedTarget,
-			verification
-		})).sort((a, b) => a.id.localeCompare(b.id)),
-		evidence: [...projection.evidence.values()].map(({ id, epoch, toolName, outcome, capabilities, subjects, surfaces, operations, semanticAction, evidenceRole, resolvedTarget, observedState }) => ({
-			id,
-			epoch,
-			toolName,
-			outcome,
-			capabilities,
-			subjects,
-			surfaces,
-			operations,
-			semanticAction,
-			evidenceRole,
-			resolvedTarget,
-			observedState
-		})).sort((a, b) => a.id.localeCompare(b.id)),
-		checkpoints: projection.checkpoints.map(({ id, certificationDigest: certificationDigest$1, result }) => ({
-			id,
-			certificationDigest: certificationDigest$1,
-			result
-		}))
-	};
-}
-function sessionQuery(projection, proof) {
-	if (proof) {
-		if (validateProofManifest(proof).length) return {
-			sessionRefDigest: projection.sessionRefDigest,
-			epoch: projection.epoch,
-			contractRevision: projection.contractRevision,
-			state: "corrupt",
-			reasonCode: "proof_invalid",
-			cohortId: projection.hostCohortId
-		};
-		if (bindProofToProjection(projection, proof).length) return {
-			sessionRefDigest: projection.sessionRefDigest,
-			epoch: projection.epoch,
-			contractRevision: projection.contractRevision,
-			state: "corrupt",
-			reasonCode: "proof_unbound",
-			cohortId: projection.hostCohortId
-		};
-	}
-	const state = projection.integrity === "valid" ? projection.hostStatus === "supported" ? "valid" : "unknown" : projection.integrity;
-	return {
-		sessionRefDigest: projection.sessionRefDigest,
-		epoch: projection.epoch,
-		contractRevision: projection.contractRevision,
-		state,
-		...proof ? { proof } : {},
-		cohortId: projection.hostCohortId
-	};
-}
-function proofEvidenceConstraints(evidence, obligation) {
-	if (evidence.outcome !== "success" || evidence.surfaces.length !== 1 || evidence.surfaces[0] !== obligation.surface) return false;
-	if (!obligation.subjectIds.every((subject) => evidence.subjects.includes(subject))) return false;
-	if (obligation.kind === "subject_readback" && !(evidence.operations ?? []).some(({ op }) => op === "read" || op === "verify")) return false;
-	if (obligation.kind === "scope_coverage" && !(evidence.operations ?? []).some(({ op }) => op === "run" || op === "verify")) return false;
-	if (obligation.kind === "state_verification" && evidence.evidenceRole !== "state") return false;
-	return true;
-}
-
-//#endregion
-export { parseShellCommand as $, isStatefulAction as $n, isWholeTaskCompletionClaim as $t, createGitPrestateEnvelope as A, extractMethod as An, RC1_HOST_PACKAGES as At, CAPTURE_V042_NOTICE as B, namedActions as Bn, renderRecoveryPacket as Bt, SESSION_EVENT_ENVELOPE_INVALID as C, evidenceAvailabilityReason as Cn, SUPPORTED_HOST_VERSIONS as Ct, GIT_COMMAND_TEMPLATES as D, captureItem as Dn, satisfiesSupportedHostRange as Dt, GIT_COMMAND_MANIFEST_IDS as E, captureClause as En, parseHostVersion as Et, verifiedLinearCommitReadback as F, interpretMessage as Fn, DEFAULT_RECOVERY_CHAR_BUDGET as Ft, evidenceFromPersistedToolResult as G, ACTION_MANIFEST as Gn, CONTROL_RECORD_PREFIX as Gt, PROTOCOL_V4_NOTICE as H, statefulActionsOfScope as Hn, evidenceCoverage as Ht, FIRST_STEP_GUIDANCE as I, isExecutableItem as In, MIN_RECOVERY_CHAR_BUDGET as It, isDeterministicCheck as J, SEMANTIC_ACTIONS as Jn, classifyCompletionClaim as Jt, extractTextContent as K, ACTION_MANIFEST_VERSION as Kn, NO_PROGRESS_RECORD_PREFIX as Kt, claimedBatchHasRealRootInput as L, isOpenObligation as Ln, closingHint as Lt, gitCommandMatchesTarget as M, isInformationalMessage as Mn, authorityCaptureCounts as Mt, parseGitCommandManifest as N, segmentClauses as Nn, segmentAuthorityBlocks as Nt, commitIndexSnapshotDigest as O, classifyClause as On, RC015_RC2_HOST_PACKAGES as Ot, revalidateGitPrestate as P, interpretClause as Pn, certifyCheckpoint as Pt, parsePwshCommand as Q, actionCompatible as Qn, isRootPauseRequest as Qt, lifecyclePhase as R, kindOfScope as Rn, openItems$1 as Rt, SESSION_API_UNSUPPORTED as S, deriveItemDiagnosis as Sn, SUPPORTED_HOST_RANGE as St, snapshotSessionEvents as T, relevantEvidence as Tn, evaluateMinimumHostVersion as Tt, deriveProjection as U, canonicalRegistryBase as Un, evidenceMatchesItem as Ut, PROTOCOL_V3_NOTICE as V, semanticActionOfScope as Vn, bindingSatisfies as Vt, supersedeItem as W, npmEscapedPackageName as Wn, isVerifyingCapability as Wt, canonicalArgvFromCommand as X, STOP_PROTOCOL_VERSION as Xn, decideTurnStopping as Xt, withDurability as Y, STATEFUL_ACTIONS as Yn, decideTurnBoundary as Yt, isRunExecutable as Z, SUPPORTED_EVIDENCE_ADAPTERS as Zn, decisionBoundaryKey as Zt, packageRowsFromPnpmLock as _, rebindResponse as _n, evaluateToolSurfaceCapability as _t, createProofManifest as a, hasCurrentCertificate as an, validateActionTarget as ar, BASE_HOST_PACKAGES as at, resolveInstalledHostLock as b, isFrozenV042RebindResponse as bn, LATEST_SUPPORTED_HOST_VERSION as bt, sessionQuery as c, isCurrentAcceptedBoundary as cn, classifyTaskIntent as cr, GOAL_HOST_PACKAGES as ct, combineHostPolicy as d, createProjection as dn, digestStrings as dr, LEGACY_HOST_COHORTS as dt, latestAssistantText as en, requestedTargetAuthorizesMutation as er, ACTIVE_HOST_COHORT_ID as et, hostLockContextFromComposedDump as f, confirmRebind as fn, normalizeClause as fr, bindExecutableIdentity as ft, packageRowsFromActiveGraph as g, rebindAttemptKey as gn, evaluateHostLock as gt, inspectTargetHostGraph as h, proposeRebindV042 as hn, sha256 as hr, evaluateHostCapability as ht, canonicalProjection as i, goalCompletionDenial as in, validateActionManifest as ir, ALPHA2_HOST_PACKAGES as it, executeRevalidatedGitEffect as j, extractOperation as jn, ALPHA3_HOST_PACKAGES as jt, commitTreeSnapshotDigest as k, extractArtifactPaths as kn, RC015_HOST_PACKAGES as kt, validateProofManifest as l, qualifyBoundary as ln, classifyUserInteraction as lr, HOST_CAPABILITY_PACKAGE_GROUPS as lt, injectActiveProfileHostLock as m, proposeRebindOutcome as mn, sanitizeUrl as mr, evaluateExternalWaitCapability as mt, PROOF_PROTOCOL_VERSION as n, observeAssistantOutcome as nn, semanticActionFromCommand as nr, ACTIVE_HOST_LAUNCHER_VERSION as nt, proofDigest as o, availableBoundaryQualifications as on, COMMAND_SURFACE_MANIFEST as or, DEFAULT_HOST_LOCK as ot, hostLockRowsFromComposedDump as p, proposeRebind as pn, sanitizeClauseText as pr, bindLiveGoalCapability as pt, extractToolSubject as q, CERTIFICATE_VERSION as qn, NO_PROGRESS_TURNS_BEFORE_STOP as qt, bindProofToProjection as r, progressFingerprint as rn, semanticActionFromText as rr, ALPHA2_DSHMARKET_139_HOST_PACKAGES as rt, proofEvidenceConstraints as s, effectuateBoundary as sn, validateManifest as sr, EXPECTED_HOST_PACKAGES as st, PROOF_KINDS as t, latestRootInstruction as tn, requestedTargetMatchesResolved as tr, ACTIVE_HOST_COHORT_IDS as tt, HostProfileError as u, currentContractDigest as un, canonicalizePath as ur, HOST_COHORTS as ut, readActiveHostGraph as v, replayRebindResult as vn, hostVersionFromPackages as vt, SessionApiError as w, itemDiagnosis as wn, compareHostVersions as wt, verifyComposedHostLockDump as x, parseConfirmationMessage as xn, MIN_SUPPORTED_HOST_VERSION as xt, resolveActiveProfileHostLock as y, CONFIRM_LINE_PATTERN as yn, selectHostCohort as yt, previewFirstStepInjection as z, maskCodeSpans as zn, recoveryDigest as zt };
+export { isDeterministicCheck as $, deriveItemDiagnosis as $n, proofDigestV2 as $t, previewFirstStepInjection as A, isWholeTaskCompletionClaim as An, STOP_PROTOCOL_VERSION_V2 as Ar, evaluateMinimumHostVersion as At, RELEASE_SETTLEMENT_PREFIX as B, qualifyBoundary as Bn, validateActionManifest as Br, PROOF_CAPABILITY_MATRIX as Bt, gitCommandMatchesTarget as C, NO_PROGRESS_RECORD_PREFIX as Cn, ACTION_MANIFEST_VERSION as Cr, hostVersionFromPackages as Ct, FIRST_STEP_GUIDANCE as D, decideTurnStopping as Dn, SEMANTIC_ACTIONS as Dr, SUPPORTED_HOST_RANGE as Dt, verifiedLinearCommitReadback as E, decideTurnBoundary as En, CERTIFICATE_VERSION_V2 as Er, MIN_SUPPORTED_HOST_VERSION as Et, PROTOCOL_V5_NOTICE as F, goalCompletionDenial as Fn, requestedIdentityKey as Fr, RC1_HOST_PACKAGES as Ft, releaseContractFor as G, proposeRebindOutcome as Gn, classifyUserInteraction as Gr, PROOF_PROTOCOL_VERSION_V2 as Gt, inFlightReservation as H, createProjection as Hn, COMMAND_SURFACE_MANIFEST as Hr, PROOF_KINDS_V2 as Ht, deriveProjection as I, hasCurrentCertificate as In, requestedTargetAuthorizesMutation as Ir, ALPHA3_HOST_PACKAGES as It, reservationFor as J, rebindResponse as Jn, normalizeClause as Jr, canonicalProjection as Jt, releaseCoverage as K, proposeRebindV042 as Kn, canonicalizePath as Kr, bindProofToProjection as Kt, RELEASE_OPERATIONS as L, availableBoundaryQualifications as Ln, requestedTargetMatchesResolved as Lr, authorityCaptureCounts as Lt, DEFAULT_DELEGATION_TOOL_NAMES as M, latestRootInstruction as Mn, actionCompatible as Mr, satisfiesSupportedHostRange as Mt, PROTOCOL_V3_NOTICE as N, observeAssistantOutcome as Nn, boundedArtifactChoiceMatches as Nr, RC015_RC2_HOST_PACKAGES as Nt, claimedBatchHasRealRootInput as O, decisionBoundaryKey as On, STATEFUL_ACTIONS as Or, SUPPORTED_HOST_VERSIONS as Ot, PROTOCOL_V4_NOTICE as P, progressFingerprint as Pn, isStatefulAction as Pr, RC015_HOST_PACKAGES as Pt, extractToolSubject as Q, parseConfirmationMessage as Qn, proofDigest as Qt, RELEASE_OPERATION_SURFACES as R, effectuateBoundary as Rn, semanticActionFromCommand as Rr, segmentAuthorityBlocks as Rt, executeRevalidatedGitEffect as S, CONTROL_RECORD_PREFIX as Sn, ACTION_MANIFEST as Sr, evaluateToolSurfaceCapability as St, revalidateGitPrestate as T, classifyCompletionClaim as Tn, CERTIFICATE_VERSION as Tr, LATEST_SUPPORTED_HOST_VERSION as Tt, normalizeReleaseContract as U, confirmRebind as Un, validateManifest as Ur, PROOF_MANIFEST_DOMAIN_V2 as Ut, contractById as V, currentContractDigest as Vn, validateActionTarget as Vr, PROOF_KINDS as Vt, readbackSettlesContract as W, proposeRebind as Wn, classifyTaskIntent as Wr, PROOF_PROTOCOL_VERSION as Wt, evidenceFromPersistedToolResult as X, CONFIRM_LINE_PATTERN as Xn, sanitizeUrl as Xr, createProofManifestV2 as Xt, supersedeItem as Y, replayRebindResult as Yn, sanitizeClauseText as Yr, createProofManifest as Yt, extractTextContent as Z, isFrozenV042RebindResponse as Zn, sha256 as Zr, proofCapabilityReport as Zt, GIT_COMMAND_MANIFEST_IDS as _, renderRecoveryPacket as _n, namedActions as _r, bindExecutableIdentity as _t, injectActiveProfileHostLock as a, scopeCoverageDigest as an, classifyClause as ar, ACTIVE_HOST_COHORT_ID as at, commitTreeSnapshotDigest as b, evidenceMatchesItem as bn, canonicalRegistryBase as br, evaluateHostCapability as bt, packageRowsFromPnpmLock as c, validateProofManifest as cn, extractOperation as cr, ALPHA2_DSHMARKET_139_HOST_PACKAGES as ct, resolveInstalledHostLock as d, certificateClosure as dn, interpretClause as dr, DEFAULT_HOST_LOCK as dt, proofEvidenceConstraints as en, evidenceAvailabilityReason as er, withDurability as et, verifyComposedHostLockDump as f, DEFAULT_RECOVERY_CHAR_BUDGET as fn, interpretMessage as fr, EXPECTED_HOST_PACKAGES as ft, snapshotSessionEvents as g, recoveryDigest as gn, maskCodeSpans as gr, LEGACY_HOST_COHORTS as gt, SessionApiError as h, openItems as hn, kindOfScope as hr, HOST_COHORTS as ht, hostLockRowsFromComposedDump as i, requiredSubjectsOf as in, captureItem as ir, parseShellCommand as it, CAPTURE_V042_NOTICE as j, latestAssistantText as jn, SUPPORTED_EVIDENCE_ADAPTERS as jr, parseHostVersion as jt, lifecyclePhase as k, isRootPauseRequest as kn, STOP_PROTOCOL_VERSION as kr, compareHostVersions as kt, readActiveHostGraph as l, validateProofManifestV2 as ln, isInformationalMessage as lr, ALPHA2_HOST_PACKAGES as lt, SESSION_EVENT_ENVELOPE_INVALID as m, closingHint as mn, isOpenObligation as mr, HOST_CAPABILITY_PACKAGE_GROUPS as mt, combineHostPolicy as n, proofOperationMatches as nn, relevantEvidence as nr, isRunExecutable as nt, inspectTargetHostGraph as o, sessionQuery as on, extractArtifactPaths as or, ACTIVE_HOST_COHORT_IDS as ot, SESSION_API_UNSUPPORTED as p, MIN_RECOVERY_CHAR_BUDGET as pn, isExecutableItem as pr, GOAL_HOST_PACKAGES as pt, releasePreEffectDecision as q, rebindAttemptKey as qn, digestStrings as qr, bindProofV2ToProjection as qt, hostLockContextFromComposedDump as r, proofV2Rejection as rn, captureClause as rr, parsePwshCommand as rt, packageRowsFromActiveGraph as s, sessionQueryV2 as sn, extractMethod as sr, ACTIVE_HOST_LAUNCHER_VERSION as st, HostProfileError as t, proofHostSurfacesOf as tn, itemDiagnosis as tr, canonicalArgvFromCommand as tt, resolveActiveProfileHostLock as u, certifiableOpenItems as un, segmentClauses as ur, BASE_HOST_PACKAGES as ut, GIT_COMMAND_TEMPLATES as v, bindingSatisfies as vn, semanticActionOfScope as vr, bindLiveGoalCapability as vt, parseGitCommandManifest as w, NO_PROGRESS_TURNS_BEFORE_STOP as wn, BOUNDED_ARTIFACT_TYPES as wr, selectHostCohort as wt, createGitPrestateEnvelope as x, isVerifyingCapability as xn, npmEscapedPackageName as xr, evaluateHostLock as xt, commitIndexSnapshotDigest as y, evidenceCoverage as yn, statefulActionsOfScope as yr, evaluateExternalWaitCapability as yt, RELEASE_RESERVATION_PREFIX as z, isCurrentAcceptedBoundary as zn, semanticActionFromText as zr, certifyCheckpoint as zt };