dsh-completion-guard 0.5.3 → 0.6.1

package/dist/{domain-RuX9l07o.js → domain-DKr8sLZZ.js}

@@ -79,9 +79,11 @@ const PUNCT = String.raw`[\s。，、；：！？．,;:!?\-*"'“”‘’()（
 /**
 * Session-layer phrases that acknowledge or advance the conversation without
 * stating a task. Longer forms come first so the alternation consumes them
-* before their prefixes.
+* before their prefixes. A bare whole-message acknowledgment ("当然。",
+* "Of course.") is session talk: it is never captured as an obligation, so it
+* can never block certification either.
 */
-const PROGRESSION_SOURCE = String.raw`(?:继续执行|继续吧|请继续|继续|接着做|接着|下一步|没问题|知道了|明白了|了解|好的?|是的?|对的?|收到|可以|行|嗯+|continue|go on|go ahead|keep going|proceed|okay|ok|yes|sure|right|next)`;
+const PROGRESSION_SOURCE = String.raw`(?:继续执行|继续吧|请继续|继续|接着做|接着|下一步|没问题|知道了|明白了|了解|好的?|是的?|对的?|收到|可以|行|嗯+|当然|那当然|continue|go on|go ahead|keep going|proceed|okay|ok|yes|sure|right|next|of course)`;
 const PROGRESSION_WHOLE = new RegExp(`^${PUNCT}*${PROGRESSION_SOURCE}${PUNCT}*$`, "i");
 const PROGRESSION_LEAD = new RegExp(`^${PROGRESSION_SOURCE}${PUNCT}+`, "i");
 const PROGRESSION_ANYWHERE = new RegExp(PROGRESSION_SOURCE, "gi");
@@ -358,6 +360,13 @@ function validateManifest(manifest = COMMAND_SURFACE_MANIFEST) {
 //#region src/domain/protocol-manifest.ts
 const STOP_PROTOCOL_VERSION = "2.0.0";
 const CERTIFICATE_VERSION = "1";
+/**
+* 0.6.0 v5-session identity (P0 §1): v2 certificates bind a work unit's
+* closure instead of the whole session. Version-1 identity keeps its
+* historical meaning for legacy sessions and is never silently re-read.
+*/
+const STOP_PROTOCOL_VERSION_V2 = "3.0.0";
+const CERTIFICATE_VERSION_V2 = "2";
 const ACTION_MANIFEST_VERSION = 1;
 const SUPPORTED_EVIDENCE_ADAPTERS = {
 	"context-guard.git.v1": "1.0.0",
@@ -656,17 +665,78 @@ const REQUESTED_IDENTITY_KEY = {
 	restart: "service_id",
 	publish: "artifact_id"
 };
+/** The single identity field a root instruction must name for this action. */
+function requestedIdentityKey(action) {
+	return REQUESTED_IDENTITY_KEY[action];
+}
 function stableTargetValue(value) {
 	if (Array.isArray(value)) return `[${value.map(stableTargetValue).join(",")}]`;
 	if (value && typeof value === "object") return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stableTargetValue(entry)}`).join(",")}}`;
 	return JSON.stringify(value);
 }
 /**
+* The 0.6.0 bounded file-choice vocabulary (C07/S03): artifact-type nouns a
+* root instruction may use instead of an exact path. The assistant may pick
+* the exact file INSIDE the captured scope and inside the type, and the
+* choice is frozen by the resolution producer before any effect. An absent
+* extension set (`file`) admits any file the producer accepts.
+*/
+const BOUNDED_ARTIFACT_TYPES = {
+	document: new Set([
+		"md",
+		"markdown",
+		"txt"
+	]),
+	readme: new Set([
+		"md",
+		"rst",
+		"txt"
+	]),
+	report: new Set(["md", "txt"]),
+	file: null
+};
+function extensionOf(path$1) {
+	const base = path$1.split(/[\\/]/).pop() ?? "";
+	const dot = base.lastIndexOf(".");
+	return dot > 0 ? base.slice(dot + 1).toLowerCase() : "";
+}
+function normalizeSlashes(value) {
+	return value.replace(/\\/g, "/");
+}
+/** Whether `artifact` lives inside `scope` (or exactly at it), slash-normalized. */
+function insideScope(artifact, scope) {
+	if (scope === "scope" || scope === "") return false;
+	const normalizedArtifact = normalizeSlashes(artifact);
+	const normalizedScope = normalizeSlashes(scope).replace(/\/+$/, "");
+	if (normalizedArtifact === normalizedScope) return false;
+	return normalizedArtifact.startsWith(`${normalizedScope}/`);
+}
+/**
+* Whether a bounded-choice requested target authorizes this resolved target:
+* the resolved artifact must live inside the captured scope and match the
+* captured type. The exact file name is the assistant's bounded decision,
+* frozen by resolution — never a root-named identity substitution.
+*/
+function boundedArtifactChoiceMatches(action, requested, resolved) {
+	if (action !== "create" && action !== "modify") return false;
+	const type = requested?.artifact_type;
+	const scope = requested?.scope;
+	if (typeof type !== "string" || typeof scope !== "string" || !(type in BOUNDED_ARTIFACT_TYPES)) return false;
+	const artifact = resolved?.artifact_id;
+	if (typeof artifact !== "string" || !artifact) return false;
+	if (!insideScope(artifact, scope)) return false;
+	const allowed = BOUNDED_ARTIFACT_TYPES[type];
+	return allowed === null || allowed.has(extensionOf(artifact));
+}
+/**
 * Compare identities captured from the root instruction with a complete
 * adapter-resolved target. Requested targets are partial by design: only
 * explicitly named identities (plus the active repository scope) are frozen.
+* A bounded artifact choice (scope + type, C07) matches when the resolved
+* exact file is inside the scope and of the captured type.
 */
 function requestedTargetMatchesResolved(action, requested, resolved) {
+	if (boundedArtifactChoiceMatches(action, requested, resolved)) return true;
 	const identityKey = REQUESTED_IDENTITY_KEY[action];
 	if (!identityKey || !requested || !resolved || !Object.hasOwn(requested, identityKey)) return false;
 	const allowed = new Set(ACTION_MANIFEST.actions[action].resolvedTargetKeys);
@@ -710,6 +780,7 @@ const MUTATION_AUTHORITY_KEYS = {
 };
 /** A mutation requires every user-selectable identity field, not a partial match. */
 function requestedTargetAuthorizesMutation(action, requested, resolved) {
+	if (boundedArtifactChoiceMatches(action, requested, resolved)) return true;
 	const required = MUTATION_AUTHORITY_KEYS[action];
 	return !!requested && required.every((key) => Object.hasOwn(requested, key)) && requestedTargetMatchesResolved(action, requested, resolved);
 }
@@ -875,9 +946,16 @@ const ACTION_VERB = new RegExp(ACTION_VERB_PATTERN, "i");
 /** Operation verbs beyond the guard action surface (local work and diagnosis). */
 const WORK_VERB = /创建|生成|新建|写入|修改|编辑|运行|执行|编写|撰写|部署|安装|升级|提交|下载|上传|拉取|同步|重启|测试|检查|验证|确认|修复|更新|清理|整理|记录|构建|编译|重构|迁移|删除|回滚|发布|推送|合并|继续|恢复|还原|回滚|实现|\b(?:build|create|write|modify|change|edit|run|fix|update|install|push|publish|test|verify|check|commit|deploy|migrate|remove|delete|restart|revert|refactor|inspect|fetch|pull|implement)\b/i;
 /** Explanatory framings: an action named afterwards is an object, not an order. */
-const EXPLAIN_VERB = /解释|说明|讲解|介绍|阐述|分析|讨论|描述|科普|什么意思|是什么意思|有什么(?:作用|影响|区别)|\bexplain\b|\bdescribe\b|\bclarify\b|\bwhat\s+does\b|\bwhat\s+is\b|\bhow\s+does\b|\bmeaning\s+of\b/i;
+const EXPLAIN_VERB = /解释|说明|讲解|介绍|阐述|分析|讨论|描述|科普|什么意思|是什么意思|有什么(?:作用|影响|区别)|\bexplain\b|\bdescribe\b|\bclarify\b|\btell\b|\bhow\s+to\b|\bwhat\s+does\b|\bwhat\s+is\b|\bhow\s+does\b|\bmeaning\s+of\b/i;
 /** Interrogative framings that make a scope a question rather than an order. */
-const QUESTION_SCOPE = /[？?]|是否|是不是|为什么|为何|怎么|如何|什么|哪些|哪一种|能否|可否|要不要|该不该|由谁|是谁|\b(?:whether|which|why|should|could|would)\b/i;
+/**
+* Interrogative framings that make a scope a question rather than an order.
+* The bare English wh-words are matched only at the START of a scope ("What
+* changed in the build"), where they are genuine interrogatives; a mid-clause
+* match would misread the relative clause of a real order ("Create a file
+* where logs are stored") as a question — the 0.6.1 review regression.
+*/
+const QUESTION_SCOPE = /[？?]|是否|是不是|为什么|为何|怎么|如何|什么|哪些|哪一种|能否|可否|要不要|该不该|由谁|是谁|^\s*(?:what|how|when|where|who|which|whether|why)\b|\b(?:whether|which|why|should|could|would)\b/i;
 const NEGATORS = [
 	["不要", "zh"],
 	["不用", "zh"],
@@ -1028,7 +1106,17 @@ const NARRATIVE_PAST = /(?:已经|已|刚刚|刚才|此前|之前)(?:经)?(?:推
 */
 const NARRATIVE_ASPECT = /(?:完了|好了|过了)|(?:已经|已|刚刚|刚才|此前|之前)[\p{Script=Han}]{0,4}(?:了|过)|\b(?:was|were|has been|have been)\b/iu;
 const NARRATIVE_DIRECTIVE = /请|需要你|帮我|麻烦|务必|\b(?:please|must)\b/i;
-const UNRESOLVED_SCOPE = /^(?:看看|看一下|瞅瞅|研究一下|了解|随便|maybe|perhaps|somehow|figure\s+out)/i;
+/**
+* POSITIVE statement evidence (0.6.1 review): a clause with no resolvable
+* action reads as a statement only when one of these structural markers is
+* present — a passive (被/受到/遭到), a negator or progress marker
+* ("不要"/"没有"/"尚未"/"还没"/"从未"), or an English declarative shape
+* (finite aux/copula, or an article/possessive-led subject, which an
+* imperative can never start with). Everything else defaults to `unresolved`:
+* an unknown request ("Please sanitize these inputs", "处理这个问题") must
+* never degrade to information, where the turn's answer would auto-close it —
+* and no vocabulary can be complete, so the default never consults one.
+*/
 /**
 * A completed confirmation receipt: the root reports that the event it was
 * waiting for already happened. It reserves nothing, so it must not mint a
@@ -1291,8 +1379,11 @@ function scopeOf(raw, options = {}) {
 						...conditionText ? { condition: conditionText } : {}
 					}
 				});
-			}
-			if (head$1) pending.push({
+				if (head$1 && (clauseStart < 0 || firstActionVerb(maskCodeSpans(head$1)) >= 0)) pending.push({
+					text: head$1,
+					offset
+				});
+			} else if (head$1) pending.push({
 				text: head$1,
 				offset
 			});
@@ -1595,23 +1686,37 @@ function stripNegatorsPrefix(value) {
 function stripConnectors(text) {
 	return text.replace(new RegExp(`^${CONNECTOR_PATTERN}\\s*`, "i"), "").trim();
 }
-/** Classify a non-negated scope. */
+/**
+* Whether a past/aspect marker is the clause's ENTIRE predicate: the span
+* extends to the end of the clause (only particles and punctuation may
+* follow), so no modifier ("…的"), attributive chain, or coordinated demand
+* can hide behind the report (0.6.1 review round 8: distance thresholds and
+* coordinator lists cannot enumerate modifiers).
+*/
+function mainClauseTailReport(masked) {
+	for (const pattern of [NARRATIVE_PAST, NARRATIVE_ASPECT]) {
+		const match = pattern.exec(masked);
+		if (!match) continue;
+		if (/^[^，。；！？\s]*的/u.test(masked.slice(match.index + match[0].length))) continue;
+		if (/^(?:了|过)?[。，；！？、\s.!?]*$/u.test(masked.slice(match.index + match[0].length))) return true;
+	}
+	return false;
+}
 function classifyPositive(text) {
 	const masked = maskCodeSpans(text);
-	if (firstActionVerb(masked) < 0 && firstActionVerb(text) >= 0) return "informational";
-	const explain = EXPLAIN_VERB.exec(masked);
-	if (explain) {
-		const verb = firstActionVerb(masked);
-		if (verb < 0 || verb >= explain.index) return "informational";
-	}
+	const visibleVerb = firstActionVerb(masked);
+	if (visibleVerb < 0 && firstActionVerb(text) >= 0) return "informational";
 	if (QUESTION_SCOPE.test(masked)) return "informational";
-	if (UNRESOLVED_SCOPE.test(masked)) return "informational";
-	if ((NARRATIVE_PAST.test(masked) || NARRATIVE_ASPECT.test(masked)) && !NARRATIVE_DIRECTIVE.test(masked)) return "narrative";
+	if (mainClauseTailReport(masked) && !NARRATIVE_DIRECTIVE.test(masked)) return "narrative";
 	if (CONFIRMATION_RECEIPT.test(masked.trim())) return "narrative";
+	if (visibleVerb < 0) return "unresolved";
+	const explain = EXPLAIN_VERB.exec(masked);
+	if (explain && (visibleVerb < 0 || visibleVerb >= explain.index)) return "unresolved";
+	if (/了[。，；！？、\s.!?]*$/u.test(masked)) return "unresolved";
 	return "directive";
 }
 function executeeOf(text, directive) {
-	if (directive === "informational" || directive === "narrative" || directive === "conditional") return "unresolved";
+	if (directive !== "directive") return "unresolved";
 	const masked = maskCodeSpans(text);
 	if (USER_ACTOR_PATTERNS.some((pattern) => pattern.test(masked))) return "user";
 	if (AGENT_ACTOR_PATTERNS.some((pattern) => pattern.test(masked))) return "agent";
@@ -1624,6 +1729,7 @@ function isOutputRequest(text) {
 }
 function dispositionOf(scope, executee) {
 	if (scope.directive === "prohibition") return "prohibition";
+	if (scope.directive === "unresolved") return "unresolved";
 	if (scope.directive === "informational" || scope.directive === "narrative") return "informational";
 	if (scope.directive === "conditional") return "conditional_wait";
 	if (scope.condition) return "conditional_wait";
@@ -1694,7 +1800,7 @@ function interpretClause(text, options = {}) {
 		directive: "informational"
 	});
 	if (scopes.length === 1) return interpret(scopes[0]);
-	const directive = scopes.some((scope) => scope.directive === "directive") ? "directive" : scopes.some((scope) => scope.directive === "prohibition") ? "prohibition" : "informational";
+	const directive = scopes.some((scope) => scope.directive === "directive") ? "directive" : scopes.some((scope) => scope.directive === "prohibition") ? "prohibition" : scopes.some((scope) => scope.directive === "unresolved") ? "unresolved" : "informational";
 	return interpret({
 		text: normalized,
 		body: scopes.map((scope) => scope.body).join("；"),
@@ -1808,6 +1914,36 @@ function namedActions(text) {
 	return interpretMessage(text).map((scope) => semanticActionOfScope(scope.body)).filter((action) => action !== "generic_run");
 }
 
+//#endregion
+//#region src/domain/spans.ts
+/**
+* 0.6.0 source-span helpers (C01).
+*
+* Spans are UTF-8 BYTE half-open intervals `[start, end)` inside the original
+* root message text. All conversions go through TextEncoder byte counting —
+* JavaScript string indices are never allowed to masquerade as cross-language
+* positions, so a Python reader agrees with TypeScript on every boundary.
+*/
+const encoder = new TextEncoder();
+function utf8ByteLength(text) {
+	return encoder.encode(text).length;
+}
+/** Byte offset of `index` inside `text`: the UTF-8 length of the prefix. */
+function utf8ByteOffset(text, index) {
+	return utf8ByteLength(text.slice(0, index));
+}
+/**
+* The coverage class of one captured clause: a prohibition is a constraint,
+* an informational reading is a question, an adopted block stays adoption,
+* and everything else is an instruction. Nothing captured is left unclassed.
+*/
+function spanClassOf(kind, directive, authority) {
+	if (authority === "root_adoption") return "adoption";
+	if (kind === "prohibition") return "constraint";
+	if (directive === "informational" || directive === "narrative") return "question";
+	return "instruction";
+}
+
 //#endregion
 //#region src/domain/capture.ts
 /**
@@ -1953,16 +2089,112 @@ function parentScope(subject) {
 	if (separator === 2 && /^[A-Za-z]:[\\/]$/.test(subject.slice(0, 3))) return subject.slice(0, 3);
 	return subject.slice(0, separator);
 }
+/**
+* The artifact-type nouns the bounded file-choice vocabulary admits (C07).
+* A closed list pinned by the v2 fixture: the noun must be the OBJECT of the
+* action, so "更新文档" captures a bounded choice while "更新皮肤中心" stays
+* a genuine clarification. The generic "文件/file" admits any file type the
+* producer accepts.
+*/
+const BOUNDED_TYPE_NOUNS = [
+	[/文档/, "document"],
+	[/(?<!\w)readme(?!\w)/iu, "readme"],
+	[/报告/, "report"],
+	[/文件/, "file"],
+	[/(?<!\w)files?(?!\w)/iu, "file"]
+];
+function boundedArtifactTypeOf(text) {
+	const masked = text;
+	for (const [pattern, type] of BOUNDED_TYPE_NOUNS) if (pattern.test(masked)) return type;
+}
+/** A bounded choice needs a real path scope; the 'scope' sentinel is not one. */
+function scopeIsPath(subject) {
+	return subject !== "scope" && subject !== "" && /[\\/]/.test(subject);
+}
+/**
+* Whether the clause's FIRST action word is the change verb 更新/调整 (the
+* object-driven modify mapping). A later 更新 inside a referenced task name
+* ("把更新插件明确为 apply…") never qualifies — the head verb is what the
+* clause orders.
+*/
+function headVerbIsChangeWord(text) {
+	const candidates = [];
+	for (const word of ["更新", "调整"]) {
+		let at = text.indexOf(word);
+		while (at >= 0) {
+			candidates.push({
+				at,
+				word
+			});
+			at = text.indexOf(word, at + word.length);
+		}
+	}
+	for (const match of text.matchAll(/\b(?:update|adjust)\b/gi)) candidates.push({
+		at: match.index,
+		word: match[0]
+	});
+	if (candidates.length === 0) return false;
+	candidates.sort((a, b) => a.at - b.at);
+	const head = candidates[0];
+	return CJK_ACTION_WORD_AT(text, head.at) === void 0;
+}
+/** Any other known action word strictly before `before`, if one exists. */
+function CJK_ACTION_WORD_AT(text, before) {
+	const words = [
+		"创建",
+		"生成",
+		"新建",
+		"写入",
+		"修改",
+		"编辑",
+		"更改",
+		"读取",
+		"运行",
+		"执行",
+		"安装",
+		"部署",
+		"上传",
+		"提交",
+		"推送",
+		"发布",
+		"升级",
+		"重启",
+		"重新启动",
+		"合并",
+		"删除",
+		"下载",
+		"拉取",
+		"同步"
+	];
+	let best;
+	for (const word of words) {
+		const at = text.indexOf(word);
+		if (at >= 0 && at < before && (best === void 0 || at < best.at)) best = {
+			at,
+			word
+		};
+	}
+	for (const match of text.matchAll(/\b(?:build|create|write|modify|change|edit|run|fix|install|push|publish|commit|deploy|migrate|delete|restart|fetch|pull|update)\b/gi)) if (match.index < before && (best === void 0 || match.index < best.at)) best = {
+		at: match.index,
+		word: match[0]
+	};
+	return best?.word;
+}
 function captureRequestedTarget(action, text, subject, surface) {
 	if (action === "create" || action === "modify") {
-		if (surface !== "artifact") return {
-			target: {},
-			reasonCode: "requested_target_artifact_id_missing"
-		};
-		return { target: {
+		if (surface === "artifact") return { target: {
 			artifact_id: subject,
 			scope: parentScope(subject)
 		} };
+		const artifactType = boundedArtifactTypeOf(text);
+		if (artifactType && scopeIsPath(subject)) return { target: {
+			scope: subject,
+			artifact_type: artifactType
+		} };
+		return {
+			target: {},
+			reasonCode: "requested_target_artifact_id_missing"
+		};
 	}
 	if (action === "install" || action === "apply") {
 		const parsed = splitPackageSpec(actionObjectToken(text, action === "install" ? "install|add|安装" : "apply|应用", "package|plugin|包|插件"));
@@ -2065,7 +2297,8 @@ function segmentClauses(text, options = {}) {
 function captureItem(kind, body, sourceMessageId, id, revision, subject, surface, method, operation, interpretation) {
 	const sanitized = sanitizeClauseText(body);
 	const unsupportedVisual = /\bGUI\b|界面|视觉|截图|颜色|布局|视觉效果/i.test(sanitized);
-	const semanticAction = unsupportedVisual ? "generic_run" : semanticActionOfScope(sanitized, interpretation?.text ?? sanitized, kind === "prohibition");
+	let semanticAction = unsupportedVisual ? "generic_run" : semanticActionOfScope(sanitized, interpretation?.text ?? sanitized, kind === "prohibition");
+	if (semanticAction === "generic_run" && !unsupportedVisual && interpretation?.directive === "directive" && headVerbIsChangeWord(sanitized) && boundedArtifactTypeOf(sanitized) !== void 0) semanticAction = "modify";
 	const capturedTarget = captureRequestedTarget(semanticAction, sanitized, subject, surface);
 	const effectiveOperation = semanticAction === "verify" ? "verify" : operation;
 	const item = {
@@ -2147,7 +2380,210 @@ function captureClause(text, sourceMessageId, id, revision, scope = {}, options
 	const body = interpretation?.body ?? text;
 	const path$1 = extractArtifactPaths(sanitizeClauseText(body))[0] ?? "";
 	const surface = path$1 ? "artifact" : "scope";
-	return captureItem(kind, body, sourceMessageId, id, revision, path$1 || scope.cwd || "scope", surface, interpretation?.method ?? extractMethod(body), extractOperation(body), interpretation);
+	const item = captureItem(kind, body, sourceMessageId, id, revision, path$1 || scope.cwd || "scope", surface, interpretation?.method ?? extractMethod(body), extractOperation(body), interpretation);
+	if (interpretation) {
+		const at = text.indexOf(interpretation.text);
+		if (at >= 0) {
+			item.rawTextSha256 = sha256(text);
+			item.spans = [{
+				partIndex: 0,
+				start: utf8ByteOffset(text, at),
+				end: utf8ByteOffset(text, at) + utf8ByteLength(interpretation.text),
+				class: spanClassOf(kind, interpretation.directive, "root_instruction")
+			}];
+		}
+	}
+	return item;
+}
+
+//#endregion
+//#region src/domain/reason-class.ts
+const REASON_CLASS_TABLE = {
+	requested_target_package_id_missing: "parameter_missing",
+	requested_target_artifact_id_missing: "parameter_missing",
+	requested_target_repository_missing: "parameter_missing",
+	requested_target_service_id_missing: "parameter_missing",
+	requested_target_registry_missing_or_invalid: "parameter_missing",
+	target_clarification_required: "parameter_missing",
+	item_not_found: "parameter_missing",
+	item_revision_mismatch: "parameter_missing",
+	unsupported_action: "parameter_missing",
+	missing_evidence: "parameter_missing",
+	action_plan_target_missing: "parameter_missing",
+	action_plan_evidence_missing: "parameter_missing",
+	binding_missing_required_facet: "parameter_missing",
+	evidence_missing: "parameter_missing",
+	proof_subject_invalid: "parameter_missing",
+	proof_source_invalid: "parameter_missing",
+	proof_evidence_invalid: "parameter_missing",
+	generic_run_non_certifiable: "source_insufficient",
+	legacy_generic_run_non_certifiable: "source_insufficient",
+	legacy_authority_unclassified: "source_insufficient",
+	inquiry_non_certifiable: "source_insufficient",
+	inquiry_awaiting_delivery: "source_insufficient",
+	asset_interpretation_required: "source_insufficient",
+	information_non_certifiable: "source_insufficient",
+	information_awaiting_delivery: "source_insufficient",
+	interpretation_unresolved: "source_insufficient",
+	answer_delivered: "source_insufficient",
+	certified: "source_insufficient",
+	semantic_action_mismatch: "source_insufficient",
+	evidence_matches_no_facet: "source_insufficient",
+	requested_target_mismatch: "source_insufficient",
+	requested_resolved_target_mismatch: "source_insufficient",
+	binding_state_cross_pairing: "source_insufficient",
+	binding_resolution_cross_pairing: "source_insufficient",
+	binding_observed_state_mismatch: "source_insufficient",
+	binding_state_observation_overlap: "source_insufficient",
+	binding_expected_transition_mismatch: "source_insufficient",
+	binding_state_closure_rejected: "source_insufficient",
+	expected_transition_mismatch: "source_insufficient",
+	non_stateful_role_manifest_invalid: "source_insufficient",
+	resolved_target_incomplete: "source_insufficient",
+	state_closure_incomplete: "source_insufficient",
+	delegated_result_bounded: "source_insufficient",
+	proof_subject_unbound: "source_insufficient",
+	proof_source_unbound: "source_insufficient",
+	proof_surface_unbound: "source_insufficient",
+	proof_role_unbound: "source_insufficient",
+	proof_operation_unbound: "source_insufficient",
+	proof_scope_subject_unbound: "source_insufficient",
+	proof_scope_digest_mismatch: "source_insufficient",
+	proof_scope_digest_invalid: "source_insufficient",
+	proof_evidence_outcome_invalid: "source_insufficient",
+	proof_evidence_constraint_failed: "source_insufficient",
+	root_condition_pending: "condition_unmet",
+	prohibition_active: "condition_unmet",
+	ancestor_condition_unsatisfied: "condition_unmet",
+	ancestor_prohibition_active: "condition_unmet",
+	mutation_awaiting_root_condition: "condition_unmet",
+	mutation_awaiting_root_wait: "condition_unmet",
+	action_plan_order_mismatch: "condition_unmet",
+	adapter_unavailable: "producer_capability_unavailable",
+	host_unavailable: "producer_capability_unavailable",
+	stateful_adapter_unavailable: "producer_capability_unavailable",
+	proof_producer_capability_unavailable: "producer_capability_unavailable",
+	proof_readback_unavailable: "producer_capability_unavailable",
+	proof_external_fact_unavailable: "producer_capability_unavailable",
+	proof_external_fact_incomplete: "producer_capability_unavailable",
+	proof_source_bounded_delegation: "producer_capability_unavailable",
+	historical_evidence_gap: "historical_gap",
+	effect_already_applied: "historical_gap",
+	action_already_applied: "historical_gap",
+	effect_only_insufficient_state_readback: "historical_gap",
+	execution_unattributable: "historical_gap",
+	rebind_evidence_predates_source: "historical_gap",
+	resolution_expected_transition_missing: "historical_gap",
+	resolution_expected_transition_digest_missing: "historical_gap",
+	resolution_expected_transition_digest_mismatch: "historical_gap",
+	resolution_expected_transition_invalid: "historical_gap",
+	integrity_invalid: "integrity_failure",
+	host_lock_unsupported: "integrity_failure",
+	certificate_missing: "integrity_failure",
+	certificate_replay_mismatch: "integrity_failure",
+	boundary_replay_mismatch: "integrity_failure",
+	proof_invalid: "integrity_failure",
+	proof_unbound: "integrity_failure",
+	proof_protocol_version_mismatch: "integrity_failure",
+	proof_digest_invalid: "integrity_failure",
+	proof_digest_mismatch: "integrity_failure",
+	proof_kind_unsupported: "integrity_failure",
+	proof_surface_unsupported: "integrity_failure",
+	proof_operation_unsupported: "integrity_failure",
+	proof_obligation_unbound: "integrity_failure",
+	proof_obligation_not_pending: "integrity_failure",
+	proof_evidence_unknown: "integrity_failure",
+	proof_evidence_wrong_epoch: "integrity_failure",
+	proof_manifest_invalid: "integrity_failure",
+	proof_obligations_missing: "integrity_failure",
+	proof_obligation_invalid: "integrity_failure",
+	proof_obligation_id_duplicate_or_invalid: "integrity_failure",
+	proof_asset_set_digest_invalid: "integrity_failure",
+	evidence_wrong_epoch: "integrity_failure",
+	evidence_outcome_not_success: "integrity_failure",
+	stale_host_lock: "integrity_failure",
+	stale_epoch: "integrity_failure",
+	stale_contract_revision: "integrity_failure",
+	stale_unit_ref: "integrity_failure",
+	stale_goal_ref: "integrity_failure",
+	legacy_certificate_in_v5_session: "integrity_failure",
+	certificate_version_unavailable: "integrity_failure",
+	mutation_integrity_unavailable: "integrity_failure",
+	item_missing_or_superseded: "integrity_failure",
+	unit_unavailable: "integrity_failure",
+	certificate_manifest_rejected: "integrity_failure",
+	session_ref_unavailable: "integrity_failure",
+	projection_durability_unavailable: "integrity_failure",
+	interpretation_receipt_mismatch: "integrity_failure",
+	guard_unavailable: "integrity_failure",
+	binding_role_mismatch: "integrity_failure",
+	binding_role_order_invalid: "integrity_failure",
+	action_plan_evidence_reused: "integrity_failure",
+	action_plan_evidence_not_successful: "integrity_failure",
+	action_plan_evidence_predates_item: "integrity_failure",
+	action_plan_action_mismatch: "integrity_failure",
+	action_plan_incomplete: "integrity_failure",
+	action_plan_target_mismatch: "integrity_failure",
+	release_contract_required: "policy_boundary",
+	release_operation_not_adopted: "policy_boundary",
+	release_operation_unprotectable: "policy_boundary",
+	release_operation_unrouted: "policy_boundary",
+	release_runner_opaque: "policy_boundary",
+	release_contract_expired: "policy_boundary",
+	release_expiry_unevaluable: "policy_boundary",
+	release_expiry_invalid: "policy_boundary",
+	release_operations_missing: "policy_boundary",
+	release_operation_unknown: "policy_boundary",
+	release_candidate_missing: "policy_boundary",
+	release_candidate_ref_missing: "policy_boundary",
+	release_candidate_sha_invalid: "policy_boundary",
+	release_candidate_artifact_digest_invalid: "policy_boundary",
+	release_contract_malformed: "policy_boundary",
+	release_reservation_malformed: "policy_boundary",
+	release_settlement_malformed: "policy_boundary",
+	release_subcommand_unknown: "policy_boundary",
+	release_operation_consumed: "policy_boundary",
+	release_operation_in_flight: "policy_boundary",
+	release_candidate_sha_mismatch: "policy_boundary",
+	release_candidate_ref_mismatch: "policy_boundary",
+	release_candidate_repository_mismatch: "policy_boundary",
+	release_candidate_package_mismatch: "policy_boundary",
+	release_candidate_version_mismatch: "policy_boundary",
+	release_candidate_registry_mismatch: "policy_boundary",
+	release_candidate_artifact_mismatch: "policy_boundary",
+	release_candidate_artifact_sri_mismatch: "policy_boundary",
+	release_candidate_sha_unresolved: "policy_boundary",
+	release_candidate_ref_unresolved: "policy_boundary",
+	release_candidate_repository_unresolved: "policy_boundary",
+	release_candidate_package_unresolved: "policy_boundary",
+	release_candidate_version_unresolved: "policy_boundary",
+	release_candidate_registry_unresolved: "policy_boundary",
+	release_artifact_sha256_unresolved: "policy_boundary",
+	release_artifact_sri_unresolved: "policy_boundary",
+	release_artifact_identity_required: "policy_boundary",
+	release_candidate_sha256_invalid: "policy_boundary",
+	release_candidate_sri_invalid: "policy_boundary",
+	release_candidate_field_unknown: "policy_boundary",
+	release_candidate_unobservable: "policy_boundary",
+	release_contract_revoked: "policy_boundary",
+	release_contract_revocation_unknown: "policy_boundary",
+	release_state_damaged: "policy_boundary",
+	release_readiness_unresolved: "policy_boundary",
+	release_closure_unresolved: "policy_boundary",
+	release_target_package_mismatch: "policy_boundary",
+	release_target_version_mismatch: "policy_boundary",
+	release_target_registry_mismatch: "policy_boundary",
+	release_artifact_digest_unresolved: "policy_boundary",
+	release_target_unresolved: "policy_boundary",
+	release_contract_granted: "policy_boundary",
+	release_profile_not_adopted: "policy_boundary",
+	release_reservation_not_durable: "policy_boundary",
+	release_gate_unavailable: "policy_boundary",
+	strict_proof_required: "policy_boundary"
+};
+/** The seven-class label for one fine-grained reason code. */
+function reasonClassOf(reasonCode) {
+	return REASON_CLASS_TABLE[reasonCode] ?? "source_insufficient";
 }
 
 //#endregion
@@ -2165,17 +2601,51 @@ const TARGET_FIELD_REASONS = {
 	requested_target_service_id_missing: "service_id",
 	requested_target_registry_missing_or_invalid: "registry"
 };
+/**
+* The evidence roles the item's OWN obligation contract requires (0.6.1,
+* W060-04). A stateful change needs the full resolution/effect/state chain; a
+* read-only verification (inspect, test, verify, generic readback) needs ONE
+* matching fact in the `effect` role — exactly the manifest `simpleRecord`
+* accepts. Asking every obligation for all three roles made prepare and
+* diagnosis demand a change chain a read-only verification can never produce.
+*/
+function requiredEvidenceRoles(item) {
+	return isStatefulAction(item.semanticAction ?? "generic_run") ? [
+		"resolution",
+		"effect",
+		"state"
+	] : ["effect"];
+}
 function evidenceFacets(p, item) {
 	const present = /* @__PURE__ */ new Set();
 	for (const evidence of p.evidence.values()) {
 		if (!relevantEvidence(p, item, evidence)) continue;
 		if (evidence.evidenceRole) present.add(evidence.evidenceRole);
 	}
-	return [
-		"resolution",
-		"effect",
-		"state"
-	].filter((facet) => !present.has(facet));
+	return requiredEvidenceRoles(item).filter((facet) => !present.has(facet));
+}
+/**
+* An ordinary shell command whose TEXT ANCHORED at command position to this
+* obligation's action completed successfully, but which failed closed
+* parsing, so per-command execution cannot be established (0.6.1, W060-05).
+* Only the pre-existing head-anchored action signal counts: the guard does
+* NOT scan compound text for actions, because quoted data and short-circuit
+* control flow would fabricate observations. A failed command is not a
+* signal either.
+*/
+function unattributedExecutionOf(p, item) {
+	const action = item.semanticAction;
+	if (!action || action === "generic_run") return void 0;
+	for (const evidence of p.evidence.values()) {
+		if (evidence.outcome !== "success") continue;
+		if (evidence.parseStatus === void 0 || evidence.parseStatus === "supported") continue;
+		if (![
+			"bash",
+			"pwsh",
+			"shell"
+		].includes(evidence.toolName)) continue;
+		if (evidence.semanticAction !== void 0 && evidence.semanticAction !== "generic_run" && actionCompatible(action, evidence.semanticAction)) return evidence;
+	}
 }
 /**
 * The pure repair judge. It decides between: fixable from existing evidence,
@@ -2183,7 +2653,20 @@ function evidenceFacets(p, item) {
 * adapter, an executed-without-evidence historical gap, or nothing to do —
 * and it NEVER recommends a rebind that cannot change certification.
 */
+/**
+* The unified diagnosis, with the frozen seven-class label attached (C12).
+*
+* The class is derived from whatever `reason_code` the judge decides, so a new
+* branch cannot drift from the classification table.
+*/
 function deriveItemDiagnosis(p, item) {
+	const diagnosis = judgeItemDiagnosis(p, item);
+	return {
+		...diagnosis,
+		reason_class: reasonClassOf(diagnosis.reason_code)
+	};
+}
+function judgeItemDiagnosis(p, item) {
 	const kind = taskKindOf(item);
 	const missing_facets = item.status === "pending" && kind !== "constraint" ? evidenceFacets(p, item) : [];
 	const base = {
@@ -2218,6 +2701,19 @@ function deriveItemDiagnosis(p, item) {
 		},
 		attempt_fingerprint: fingerprint(p, item, "certified")
 	};
+	if (item.status === "answered") return {
+		...base,
+		certification: "supported",
+		reason_code: "answer_delivered",
+		repairability: "none",
+		missing_fields: [],
+		missing_facets: [],
+		next_action: {
+			kind: "none",
+			resume_condition: "The host-confirmed final answer was delivered; no further binding needed."
+		},
+		attempt_fingerprint: fingerprint(p, item, "answer_delivered")
+	};
 	if (item.status === "pending" && item.waitAuthorization?.kind === "root_explicit_wait") return {
 		...base,
 		certification: "unavailable",
@@ -2231,50 +2727,96 @@ function deriveItemDiagnosis(p, item) {
 		},
 		attempt_fingerprint: fingerprint(p, item, "root_condition_pending")
 	};
-	if (action !== "generic_run" && !item.legacyFlags?.length && item.targetCaptureStatus === "clarification_required") {
-		const missingFields = item.targetCaptureReasonCode ? [TARGET_FIELD_REASONS[item.targetCaptureReasonCode] ?? item.targetCaptureReasonCode] : [];
-		return {
+	if (kind === "inquiry") {
+		const closable = p.boundaryProtocol === 5;
+		if (item.asset !== void 0 && !p.interpretationFacts.some((fact) => fact.itemId === item.id)) return {
 			...base,
-			certification: "needs_target",
-			reason_code: "target_clarification_required",
-			repairability: "user_input_required",
-			missing_fields: missingFields,
+			certification: "unsupported",
+			reason_code: "asset_interpretation_required",
+			repairability: "unsupported",
+			missing_fields: [],
+			missing_facets: [],
 			next_action: {
-				kind: "clarify_target",
-				tool: "context_guard_prepare",
-				required_input: missingFields.length > 0 ? `the exact ${missingFields.join(" and ")} for this action` : "the exact target fields for this action",
-				resume_condition: "A root-user instruction supplying the exact target re-enables certification."
+				kind: "report_only",
+				tool: "context_guard_interpret",
+				required_input: `the item ID of the interpreted attachment (${item.id})`,
+				resume_condition: "Read the attachment, record it with context_guard_interpret for this item, and deliver the actual answer; the host-confirmed final response of a completed turn then closes this item. The record proves the asset was read, never that the interpretation is correct."
 			},
-			attempt_fingerprint: fingerprint(p, item, "target_clarification_required")
+			attempt_fingerprint: fingerprint(p, item, "asset_interpretation_required")
 		};
-	}
-	if (action === "generic_run" || item.legacyFlags?.length) {
-		if (kind === "inquiry") return {
+		return {
 			...base,
 			certification: "unsupported",
-			reason_code: "inquiry_non_certifiable",
+			reason_code: closable ? "inquiry_awaiting_delivery" : "inquiry_non_certifiable",
 			repairability: "unsupported",
 			missing_fields: [],
+			missing_facets: [],
 			next_action: {
 				kind: "report_only",
-				resume_condition: "Complete the investigation and report the actual answer; the item stays recorded as uncertified. No confirmation or rebind changes this."
+				resume_condition: closable ? "Deliver the actual answer; the host-confirmed final response of a completed turn closes this item." : "Complete the investigation and report the actual answer; the item stays recorded as uncertified. No confirmation or rebind changes this."
 			},
-			attempt_fingerprint: fingerprint(p, item, "inquiry_non_certifiable")
+			attempt_fingerprint: fingerprint(p, item, closable ? "inquiry_awaiting_delivery" : "inquiry_non_certifiable")
 		};
+	}
+	if (item.authorityDisposition === "informational") {
+		const closable = p.boundaryProtocol === 5;
 		return {
 			...base,
 			certification: "unsupported",
-			reason_code: "generic_run_non_certifiable",
-			repairability: "user_input_required",
+			reason_code: closable ? "information_awaiting_delivery" : "information_non_certifiable",
+			repairability: "unsupported",
 			missing_fields: [],
+			missing_facets: [],
 			next_action: {
 				kind: "report_only",
-				required_input: "a concrete supported action and target for this obligation",
-				resume_condition: "A fresh root-user instruction naming a supported action and exact target replaces the generic obligation; identical re-phrasing changes nothing."
+				resume_condition: closable ? "The trusted final response of this turn closes the recorded statement; it certifies the answer was delivered, never its accuracy." : "The recorded statement stays open as uncertified information; no confirmation, rebind, or execution changes this."
+			},
+			attempt_fingerprint: fingerprint(p, item, closable ? "information_awaiting_delivery" : "information_non_certifiable")
+		};
+	}
+	if (item.authorityDisposition === "unresolved") return {
+		...base,
+		certification: "unsupported",
+		reason_code: "interpretation_unresolved",
+		repairability: "none",
+		missing_fields: [],
+		missing_facets: [],
+		next_action: {
+			kind: "report_only",
+			resume_condition: "The clause could not be read as a concrete instruction; it stays recorded, non-executable, and never closes by delivery. A new explicit root instruction naming a supported action supersedes it."
+		},
+		attempt_fingerprint: fingerprint(p, item, "interpretation_unresolved")
+	};
+	if (action !== "generic_run" && !item.legacyFlags?.length && item.targetCaptureStatus === "clarification_required") {
+		const missingFields = item.targetCaptureReasonCode ? [TARGET_FIELD_REASONS[item.targetCaptureReasonCode] ?? item.targetCaptureReasonCode] : [];
+		return {
+			...base,
+			certification: "needs_target",
+			reason_code: "target_clarification_required",
+			repairability: "user_input_required",
+			missing_fields: missingFields,
+			next_action: {
+				kind: "clarify_target",
+				tool: "context_guard_prepare",
+				required_input: missingFields.length > 0 ? `the exact ${missingFields.join(" and ")} for this action` : "the exact target fields for this action",
+				resume_condition: "A root-user instruction supplying the exact target re-enables certification."
 			},
-			attempt_fingerprint: fingerprint(p, item, "generic_run_non_certifiable")
+			attempt_fingerprint: fingerprint(p, item, "target_clarification_required")
 		};
 	}
+	if (action === "generic_run" || item.legacyFlags?.length) return {
+		...base,
+		certification: "unsupported",
+		reason_code: "generic_run_non_certifiable",
+		repairability: "user_input_required",
+		missing_fields: [],
+		next_action: {
+			kind: "report_only",
+			required_input: "a concrete supported action and target for this obligation",
+			resume_condition: "A rebind proposal mapping this obligation to a concrete supported action and target is the only thing that replaces it; after the durable confirmation the original is superseded atomically. Similar re-phrasing changes nothing."
+		},
+		attempt_fingerprint: fingerprint(p, item, "generic_run_non_certifiable")
+	};
 	if (p.hostStatus !== "supported") return {
 		...base,
 		certification: "unavailable",
@@ -2299,7 +2841,20 @@ function deriveItemDiagnosis(p, item) {
 		},
 		attempt_fingerprint: fingerprint(p, item, "adapter_unavailable")
 	};
-	if (missing_facets.includes("resolution") && !missing_facets.includes("effect")) return {
+	const statefulChain = isStatefulAction(action);
+	if (requiredEvidenceRoles(item).some((role) => !missing_facets.includes(role)) ? void 0 : unattributedExecutionOf(p, item)) return {
+		...base,
+		certification: "unsupported",
+		reason_code: "execution_unattributable",
+		repairability: "historical_gap",
+		missing_fields: [],
+		next_action: {
+			kind: "report_only",
+			resume_condition: "An ordinary shell command beginning with this action succeeded earlier in the session, but the command could not be securely parsed, so whether it performed the action cannot be established. Check the actual current state with a read-only command first. The obligation stays uncertified; perform the action through the guarded producer path only if the state shows it has not happened and the instruction still calls for it; never repeat an action to mint evidence, and do not assert it never ran."
+		},
+		attempt_fingerprint: fingerprint(p, item, "execution_unattributable")
+	};
+	if (statefulChain && missing_facets.includes("resolution") && !missing_facets.includes("effect")) return {
 		...base,
 		certification: "unsupported",
 		reason_code: "historical_evidence_gap",
@@ -2320,7 +2875,7 @@ function deriveItemDiagnosis(p, item) {
 		next_action: {
 			kind: "collect_evidence",
 			tool: "context_guard_prepare",
-			resume_condition: "Collect the matching durable evidence in resolution/effect/state order, then checkpoint."
+			resume_condition: statefulChain ? "Collect the matching durable evidence in resolution/effect/state order, then checkpoint." : "Collect the single matching durable verification fact, then checkpoint."
 		},
 		attempt_fingerprint: fingerprint(p, item, "missing_evidence")
 	};
@@ -2354,6 +2909,7 @@ const NATIVE_ADAPTERS = new Set([
 	"dsh.web.v1"
 ]);
 function evidenceAvailabilityReason(evidence) {
+	if (evidence.delegatedSubtask) return "delegated_result_bounded";
 	if (evidence.parseStatus !== "supported") return evidence.reasonCode ?? evidence.parseStatus ?? "adapter_unavailable";
 	if (!evidence.adapterId || !evidence.adapterVersion || (SUPPORTED_EVIDENCE_ADAPTERS[evidence.adapterId] ?? (NATIVE_ADAPTERS.has(evidence.adapterId) ? "1.0.0" : void 0)) !== evidence.adapterVersion) return "adapter_unavailable";
 	if (evidence.outcome !== "success") return "evidence_outcome_not_success";
@@ -2448,7 +3004,18 @@ function isFrozenV042RebindResponse(recorded) {
 /** Whether the partition changes certification at all: a same-generic split
 * is organizational at best and must not cost a user confirmation. */
 function certificationGain(item, candidates) {
-	if ((item.semanticAction ?? "generic_run") !== "generic_run") return true;
+	const current = item.semanticAction ?? "generic_run";
+	if (current !== "generic_run" && item.targetCaptureStatus === "clarification_required") return candidates.some((candidate) => {
+		if (candidate.action === void 0) return false;
+		if (candidate.action !== current && candidate.action !== "generic_run") return true;
+		const target = candidate.requestedTarget;
+		if (!target) return false;
+		const key = requestedIdentityKey(candidate.action);
+		if (key && Object.hasOwn(target, key)) return true;
+		if ((candidate.action === "create" || candidate.action === "modify") && target.artifact_type !== void 0 && target.scope !== void 0) return true;
+		return false;
+	});
+	if (current !== "generic_run") return true;
 	return candidates.some((candidate) => candidate.action !== void 0 && candidate.action !== "generic_run");
 }
 function preservesIdentity(old, clarified) {
@@ -2918,6 +3485,17 @@ function createProjection() {
 		checkpoints: [],
 		boundaries: [],
 		externalOperations: /* @__PURE__ */ new Map(),
+		units: /* @__PURE__ */ new Map(),
+		coverage: [],
+		releaseContracts: [],
+		releaseReservations: [],
+		releaseSettlements: [],
+		releaseDiagnostics: [],
+		releaseStateDamaged: false,
+		policy: "standard",
+		trustedSelections: [],
+		interpretationFacts: [],
+		approvals: [],
 		sessionRefDigest: "11".repeat(32),
 		hostLockDigest: "22".repeat(32),
 		hostStatus: "supported",
@@ -2929,6 +3507,7 @@ function createProjection() {
 		noProgressClaims: /* @__PURE__ */ new Map(),
 		handledControlSeqs: /* @__PURE__ */ new Set(),
 		rebindRejections: /* @__PURE__ */ new Map(),
+		durabilityWatermark: "unknown",
 		integrity: "valid"
 	};
 }
@@ -3187,6 +3766,10 @@ function hasCurrentCertificate(projection) {
 	else if (checkpoint.sessionRefDigest !== projection.sessionRefDigest) reason = "foreign_session";
 	else if (checkpoint.hostLockDigest !== projection.hostLockDigest) reason = "stale_host_lock";
 	else if (checkpoint.contractRevision !== projection.contractRevision) reason = "stale_contract_revision";
+	else if (projection.boundaryProtocol === 5) {
+		if (checkpoint.certificateVersion !== "2") reason = "legacy_certificate_in_v5_session";
+		else if (checkpoint.unitId !== projection.currentUnitId) reason = "stale_unit_ref";
+	} else if (checkpoint.certificateVersion !== "1") reason = "certificate_version_unavailable";
 	else if (projection.currentGoalRef ? checkpoint.goalRef?.id !== projection.currentGoalRef.id || checkpoint.goalRef.revision !== projection.currentGoalRef.revision : checkpoint.goalRef !== void 0) reason = "stale_goal_ref";
 	projection.certificateStatusReason = reason;
 	return reason === void 0;
@@ -4073,6 +4656,74 @@ function certificationDigest(certificate) {
 	checkFieldCount(count);
 	return sha256Hex(Buffer.concat(parts));
 }
+const CERTIFICATE_V2_KEYS = [
+	"stopProtocolVersion",
+	"certificateVersion",
+	"epoch",
+	"sessionRefDigest",
+	"hostLockDigest",
+	"contractRevision",
+	"contractSha256",
+	"unitId",
+	"unitClosureDigest",
+	"evidenceSha256",
+	"bindingDigest",
+	"goalRef"
+];
+/**
+* 0.6.0 v2 certificate field table over the new `ccg.certificationDigest.v4`
+* domain (P0 §1): the certified scope is a work unit's closure instead of the
+* whole session. digest_v3 domains and their golden vectors stay frozen; this
+* function never re-reads a v1 record.
+*/
+function certificationDigestV2(certificate) {
+	requireExactKeys(certificate, CERTIFICATE_V2_KEYS, "certificateV2");
+	const parts = [Buffer.from("ccg.certificationDigest.v4\n", "utf8")];
+	let count = 0;
+	parts.push(field("stopProtocolVersion", typedToken(expectString(certificate.stopProtocolVersion, "stopProtocolVersion"))));
+	parts.push(field("certificateVersion", typedToken(expectString(certificate.certificateVersion, "certificateVersion"))));
+	parts.push(field("epoch", typedToken(expectInt(certificate.epoch, "epoch"))));
+	parts.push(field("sessionRefDigest", typedToken({
+		k: "x",
+		v: expectHex(certificate.sessionRefDigest)
+	})));
+	parts.push(field("hostLockDigest", typedToken({
+		k: "x",
+		v: expectHex(certificate.hostLockDigest)
+	})));
+	parts.push(field("contractRevision", typedToken(expectInt(certificate.contractRevision, "contractRevision"))));
+	parts.push(field("contractSha256", typedToken({
+		k: "x",
+		v: expectHex(certificate.contractSha256)
+	})));
+	count += 7;
+	parts.push(field("unitId", typedToken(expectString(certificate.unitId, "unitId"))));
+	parts.push(field("unitClosureDigest", typedToken({
+		k: "x",
+		v: expectHex(certificate.unitClosureDigest)
+	})));
+	parts.push(field("evidenceSha256", typedToken({
+		k: "x",
+		v: expectHex(certificate.evidenceSha256)
+	})));
+	parts.push(field("bindingDigest", typedToken({
+		k: "x",
+		v: expectHex(certificate.bindingDigest)
+	})));
+	count += 4;
+	const goalRef = certificate.goalRef;
+	if (goalRef !== void 0 && goalRef !== null) {
+		requireExactKeys(goalRef, GOAL_REF_KEYS, "goalRef");
+		parts.push(optField("goalRefId", expectString(goalRef.id, "goalRef.id"), (v) => typedToken(v)));
+		parts.push(optField("goalRefRevision", expectInt(goalRef.revision, "goalRef.revision"), (v) => typedToken(v)));
+	} else {
+		parts.push(optField("goalRefId", null, () => Buffer.alloc(0)));
+		parts.push(optField("goalRefRevision", null, () => Buffer.alloc(0)));
+	}
+	count += 2;
+	checkFieldCount(count);
+	return sha256Hex(Buffer.concat(parts));
+}
 /**
 * Verifier-side role matrix and binding closure. Digest derivation stays
 * pure; this mirrors the checks a proof verifier must run before accepting a
@@ -4389,7 +5040,7 @@ function closingHint(projection, item, evidenceIds) {
 	else parts.push("needs a state-verification evidence (read tool, or a deterministic check run in scope) matching the subject");
 	return parts.join("; ");
 }
-function openItems$1(projection) {
+function openItems(projection) {
 	return [...projection.items.values()].filter((item) => item.status === "pending").sort((a, b) => a.revision - b.revision || (a.id < b.id ? -1 : 1));
 }
 /**
@@ -4399,7 +5050,7 @@ function openItems$1(projection) {
 * injected once instead of looping (v0.2.1).
 */
 function recoveryDigest(packet, projection) {
-	const items = openItems$1(projection);
+	const items = openItems(projection);
 	const evidence = [...projection.evidence.values()].filter((row) => items.some((item) => relevantEvidence(projection, item, row)));
 	return sha256(JSON.stringify({
 		packet,
@@ -4413,7 +5064,7 @@ function renderRecoveryPacket(projection, options = {}) {
 	const budget = options.charBudget ?? DEFAULT_RECOVERY_CHAR_BUDGET;
 	if (!Number.isSafeInteger(budget) || budget < MIN_RECOVERY_CHAR_BUDGET) throw new RangeError("recovery charBudget must be an integer >= 512");
 	const clip = (text, size) => text.length <= size ? text : text.slice(0, size - 1) + "…";
-	const items = openItems$1(projection).sort((a, b) => Number(b.kind === "prohibition") - Number(a.kind === "prohibition") || b.revision - a.revision || a.id.localeCompare(b.id));
+	const items = openItems(projection).sort((a, b) => Number(b.kind === "prohibition") - Number(a.kind === "prohibition") || b.revision - a.revision || a.id.localeCompare(b.id));
 	const rejected$1 = options.rejectedBindings ?? (projection.lastCheckpointRejectionRevision === projection.contractRevision ? projection.lastCheckpointRejections : []) ?? [];
 	const compact = budget < 1e3;
 	const lines = [`Context Guard: ${items.length} pending; revision ${projection.contractRevision}.`, compact ? "Checkpoint required before completion. Qualified safe end preserves pending work; it is not completion." : COMPLETION_RULE];
@@ -4440,7 +5091,7 @@ function renderRecoveryPacket(projection, options = {}) {
 			if (add(`[${clip(item.id, 20)}] root_condition_pending; wait for trusted root: ${item.resumeEvent ?? item.condition ?? item.normalizedText}; do not execute before release`, compact ? 160 : 310)) count++;
 			return;
 		}
-		const remedy = diagnosis.repairability === "agent_repairable" ? "Collect matching evidence; checkpoint" : diagnosis.repairability === "historical_gap" ? "Read back observed state; do not re-execute" : diagnosis.certification === "unsupported" ? "Deliver honestly; stays uncertified unless a fresh instruction names a supported action" : "Restore audited host/adapter capability";
+		const remedy = diagnosis.repairability === "agent_repairable" ? "Collect matching evidence; checkpoint" : diagnosis.repairability === "historical_gap" ? "Read back observed state; do not re-execute" : diagnosis.repairability === "none" ? "Recorded as unresolved; only a fresh explicit instruction resolves it" : diagnosis.next_action.tool === "context_guard_interpret" ? "Read the attachment; record context_guard_interpret; then answer" : diagnosis.next_action.kind === "clarify_target" ? "Supply the exact target; then collect evidence and checkpoint" : diagnosis.certification === "unsupported" ? "Deliver honestly; stays uncertified unless a fresh instruction names a supported action" : "Restore audited host/adapter capability";
 		if (add(`[${clip(item.id, 20)}] ${diagnosis.reason_code}; ${compact ? remedy : diagnosis.next_action.resume_condition ?? remedy}; ${clip(item.normalizedText, 70)}`, compact ? 110 : 310)) count++;
 	};
 	if (constraints[0]) constraint(constraints[0]);
@@ -4457,28 +5108,994 @@ function renderRecoveryPacket(projection, options = {}) {
 }
 
 //#endregion
-//#region src/domain/checkpoint.ts
-function stable$2(value) {
-	if (Array.isArray(value)) return `[${value.map(stable$2).join(",")}]`;
-	if (value && typeof value === "object") return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, entry]) => `${JSON.stringify(key)}:${stable$2(entry)}`).join(",")}}`;
-	return JSON.stringify(value);
+//#region src/domain/work-unit.ts
+/**
+* Work-unit derivation rules (0.6.0, C04). Units are derived from the durable
+* message stream — nothing is ever written to the log — so the classification
+* below must stay deterministic and conservative: an ambiguous relation keeps
+* the current unit rather than inventing a new one, and a mis-assigned
+* obligation is recoverable through clarification, never through a silent
+* unit rewrite.
+*
+* The rules are the frozen P0 §3 C04 decision, in evaluation order:
+*
+* 1. The session's first root task message opens U001.
+* 2. A message explicitly linked to the current unit (item-ID reference,
+*    rebind control, a direct answer while an inquiry is open) stays in it.
+* 3. When the current unit has no open executable obligations left, a
+*    directive-bearing message opens a new unit; the old one is switched away,
+*    never retroactively closed.
+* 4. While the current unit still has open work, only an EXPLICIT switch
+*    marker (closed vocabulary, fixture-pinned) opens a new unit; anything
+*    else stays in the current unit.
+* 5. A DELEGATION-marked message opens a CHILD unit of the current unit. The
+*    child's open obligations are required descendants of the parent's
+*    closure (C04), so the parent cannot be certified while the delegated
+*    work is open, and the delegated result itself never closes the parent.
+*/
+/** Explicit task-switch markers; a closed vocabulary pinned by the v2 fixture. */
+const SWITCH_MARKER = new RegExp([
+	"^(?:另外|此外|另一(?:件事|个任务|个话题)|换个?话题|下一个任务|新任务|下一个问题|先做(?:另一|别的))[：:，,。。\\s]",
+	"^(?:now\\s+a\\s+)?(?:different|new|separate)\\s+task\\b",
+	"^next\\s+task\\b",
+	"^(?:on\\s+a\\s+related\\s+note|by\\s+the\\s+way)\\b"
+].join("|"), "i");
+/**
+* Explicit delegation markers; the same closed-vocabulary discipline as the
+* switch markers, pinned by the v2 fixture. Only a root message that actually
+* hands work to a subagent/subtask opens a child unit — "let the subagent …",
+* "delegate … to a subagent", "spawn a subagent …".
+*/
+const DELEGATION_MARKER = new RegExp([
+	"(?:让|由|交给|委派给?|派给|安排)(?:一个)?(?:子代理|子任务|子会话|小助手)",
+	"(?:子代理|子任务|子会话)(?:去|来|负责|执行|完成)",
+	"\\bdelegate\\s+(?:this|it|the\\s+\\w+|\\w+)\\s+to\\s+(?:a\\s+|the\\s+)?(?:subagent|sub-agent|child\\s+agent)\\b",
+	"\\b(?:spawn|dispatch|hand\\s+(?:this|it)\\s+off\\s+to)\\s+(?:a\\s+|the\\s+)?(?:subagent|sub-agent|child\\s+agent)\\b",
+	"\\bsub-?agent\\s+(?:should|must|to)\\s+\\w+"
+].join("|"), "i");
+/**
+* Whether a root message opens a new work unit rather than joining the
+* current one. `directiveBearing` says the message produced (or would
+* produce) requirement/acceptance work; `openWorkInCurrentUnit` is evaluated
+* against the state BEFORE the message is captured.
+*/
+function opensNewUnit(projection, text, directiveBearing, openWorkInCurrentUnit) {
+	if (!directiveBearing) return false;
+	if (DELEGATION_MARKER.test(text)) return true;
+	if (SWITCH_MARKER.test(text)) return true;
+	return !openWorkInCurrentUnit;
 }
-function tuplesEqual(left, right) {
-	return stable$2(left ?? {}) === stable$2(right ?? {});
+/**
+* Whether this message opens a child (delegated) unit of the current unit
+* rather than a sibling. Only meaningful together with {@link opensNewUnit}.
+*/
+function opensChildUnit(projection, text) {
+	return projection.currentUnitId !== void 0 && DELEGATION_MARKER.test(text);
 }
-function transitionsEqual(left, right) {
-	return stable$2(left) === stable$2(right);
+/** An explicit reference to a contract item identity (R001/A001/P001/U001). */
+const ITEM_REFERENCE = /\b([RAPU]\d{3})\b/g;
+/**
+* Whether the message explicitly links itself to the current unit's items.
+*
+* A reference counts only when it names an item that still exists as live work:
+* an ID that never existed, or one already `passed`/`superseded`, is history and
+* cannot pull a new instruction back into an old unit. A live item binds when it
+* belongs to the current unit's lineage — the current unit, an ancestor, or a
+* required descendant — while a unit-less (pre-v5) obligation is always a
+* legitimate continuation target.
+*/
+function explicitlyLinkedToCurrentUnit(projection, text) {
+	const current = projection.currentUnitId;
+	const lineage = current === void 0 ? void 0 : new Set([
+		current,
+		...unitAncestorIds(projection, current),
+		...unitDescendantIds(projection, current)
+	]);
+	for (const match of text.matchAll(ITEM_REFERENCE)) {
+		const item = projection.items.get(match[1]);
+		if (!item) continue;
+		if (item.status === "passed" || item.status === "superseded") continue;
+		if (lineage === void 0 || item.unitId === void 0) return true;
+		if (lineage.has(item.unitId)) return true;
+	}
+	return false;
 }
-function transitionIsSelfConsistent(action, transition) {
-	if (!transition?.parameters || transition.predicateId !== ACTION_MANIFEST.actions[action].predicateId || transition.version !== 1 || transition.predParamsKind !== "inline") return false;
-	const recomputed = predParamsDigest(transition.parameters, resolveAllowlist("product"));
-	return transition.parametersDigest === void 0 || transition.parametersDigest === recomputed;
+/** The next unit identity in the session's sequence. */
+function nextUnitId(projection) {
+	let max = 0;
+	for (const unitId of projection.units.keys()) {
+		const num = Number(unitId.slice(1));
+		if (Number.isInteger(num) && num > max) max = num;
+	}
+	return `U${String(max + 1).padStart(3, "0")}`;
 }
-function evidenceFact(evidence) {
-	return {
-		id: evidence.id,
-		outcome: evidence.outcome,
-		method: evidence.toolName,
+/**
+* Open a work unit.
+*
+* A SIBLING unit (no parent) becomes current and switches the previous current
+* unit away: that is a task switch, and the old unit's residual work stays
+* visible but no longer blocks the new task.
+*
+* A CHILD unit (delegated sub-unit) does NOT become current. The parent keeps
+* owning the session's certified scope, so the parent's own obligations are
+* never dropped when it delegates part of the work — the child's obligations
+* join the parent's closure as required descendants instead (C04). The child
+* is only ever created under an existing parent; a stray parent id would
+* create an orphan lineage, so it is dropped.
+*/
+function openUnit(projection, seq, headline, parentUnitId) {
+	const unitId = nextUnitId(projection);
+	const parent = parentUnitId !== void 0 && projection.units.has(parentUnitId) ? parentUnitId : void 0;
+	if (parent === void 0) {
+		const previous = projection.currentUnitId !== void 0 ? projection.units.get(projection.currentUnitId) : void 0;
+		if (previous && previous.switchedAwayAtSeq === void 0) previous.switchedAwayAtSeq = seq;
+		projection.currentUnitId = unitId;
+	}
+	const unit = {
+		unitId,
+		openedAtSeq: seq,
+		rootInputRefs: [{ seq }],
+		headline,
+		...parent !== void 0 ? { parentUnitId: parent } : {}
+	};
+	projection.units.set(unitId, unit);
+	return unit;
+}
+/** Fold one later root message into the current unit's input references. */
+function foldIntoCurrentUnit(projection, seq) {
+	const unit = projection.currentUnitId !== void 0 ? projection.units.get(projection.currentUnitId) : void 0;
+	if (unit) unit.rootInputRefs.push({ seq });
+}
+/**
+* The ancestors of `unitId`, nearest first. Lineage is derived from the
+* derived `parentUnitId` chain; a cycle (impossible from the derivation, but
+* possible in a hand-built projection) terminates instead of hanging.
+*/
+function unitAncestorIds(projection, unitId) {
+	const ancestors = [];
+	const seen = new Set([unitId]);
+	let cursor = projection.units.get(unitId)?.parentUnitId;
+	while (cursor !== void 0 && !seen.has(cursor)) {
+		ancestors.push(cursor);
+		seen.add(cursor);
+		cursor = projection.units.get(cursor)?.parentUnitId;
+	}
+	return ancestors;
+}
+/**
+* Every required descendant of `unitId`, in stable unit order: the units whose
+* `parentUnitId` chain reaches `unitId`. The closure of a unit includes the
+* open obligations of this set (C04).
+*/
+function unitDescendantIds(projection, unitId) {
+	const descendants = [];
+	const seen = new Set([unitId]);
+	const queue = [unitId];
+	while (queue.length > 0) {
+		const current = queue.shift();
+		for (const unit of projection.units.values()) {
+			if (unit.parentUnitId !== current || seen.has(unit.unitId)) continue;
+			seen.add(unit.unitId);
+			descendants.push(unit.unitId);
+			queue.push(unit.unitId);
+		}
+	}
+	return descendants.sort();
+}
+/** Record one delegated round-trip inside a unit as bounded audit evidence. */
+function recordDelegation(projection, unitId, ref) {
+	const unit = projection.units.get(unitId);
+	if (!unit) return;
+	const refs = unit.delegationRefs ?? [];
+	if (refs.some((entry) => entry.callId === ref.callId)) return;
+	refs.push({ ...ref });
+	unit.delegationRefs = refs;
+}
+/**
+* Whether the current unit still holds open executable work — the rule-3
+* handover test, evaluated BEFORE the new message's items are inserted.
+*
+* This is the SAME closure the certificate uses: the current unit's own open
+* work plus the open work of every required descendant unit. A parent whose own
+* items are all passed but whose delegated child is still open has not finished,
+* so an ordinary follow-up must not be treated as a handover to a new sibling
+* task — that would silently exclude the child from the certified scope.
+*/
+function currentUnitHasOpenWork(projection) {
+	const current = projection.currentUnitId;
+	if (current === void 0) return false;
+	const closure = new Set([current, ...unitDescendantIds(projection, current)]);
+	return [...projection.items.values()].some((item) => item.status === "pending" && item.unitId !== void 0 && closure.has(item.unitId) && item.kind !== "prohibition");
+}
+
+//#endregion
+//#region src/domain/closure.ts
+/**
+* The single open-closure implementation (0.6.0, C02/C04/D06-03/D06-07).
+*
+* Before 0.6.0, checkpoint, recovery, diagnostics, and the Goal gate each
+* filtered pending obligations with their own slightly different rule, and the
+* answers could disagree. Every question about "what is open" now goes through
+* this module:
+*
+* - {@link visiblePendingItems} — everything still pending, constraints first
+*   in spirit: display surfaces (recovery, status, checkpoint pages) show
+*   prohibitions too, because a constraint is never finished work.
+* - {@link certifiableOpenItems} — the obligations a completion certificate
+*   answers for: pending, not a prohibition. Prohibitions are standing
+*   constraints, never counted work; `answered` items closed by a trusted
+*   delivery are no longer open; `passed` and `superseded` never were.
+* - {@link unitClosureItemIds} — the v5 unit closure: the certified scope of
+*   one work unit, which is the unit's OWN open obligations PLUS the open
+*   obligations of every required descendant unit.
+* - {@link ancestorConstraints} / {@link ancestorConstraintForBinding} — the
+*   ancestor units' standing constraints (prohibitions and unsatisfied
+*   conditions) that stay in force for a descendant's matching obligations.
+*
+* Legacy sessions (no v5 boundary) have no units: they certify the whole
+* session, exactly what {@link certifiableOpenItems} returns.
+*/
+/** Every pending item, in stable display order. Constraints stay visible. */
+function visiblePendingItems(projection) {
+	return [...projection.items.values()].filter((item) => item.status === "pending").sort((a, b) => a.revision - b.revision || (a.id < b.id ? -1 : 1));
+}
+/** The obligations a completion certificate answers for: open work, no constraints. */
+function certifiableOpenItems(projection) {
+	return visiblePendingItems(projection).filter((item) => item.kind !== "prohibition");
+}
+/**
+* The certifiable open obligations inside one work unit's closure: the unit's
+* own open work plus the open work of every required descendant unit.
+*
+* A delegated child unit is REQUIRED work of its parent (C04): the parent has
+* not finished while the sub-unit it handed work to still has open
+* obligations, so the parent's certificate must answer for them too. The
+* reverse is deliberately not true — a child may be certified while unrelated
+* residual work exists in an ancestor or a sibling, which is what keeps a task
+* switch from being blocked by history.
+*/
+function unitClosureItemIds(projection, unitId) {
+	if (projection.boundaryProtocol !== 5) return [];
+	const inClosure = new Set([unitId, ...unitDescendantIds(projection, unitId)]);
+	return certifiableOpenItems(projection).filter((item) => item.unitId !== void 0 && inClosure.has(item.unitId)).map((item) => item.id);
+}
+/** Whether a prohibition declares no identity at all — a blanket ban on the action. */
+function isBlanketProhibition(action, requested) {
+	const key = requestedIdentityKey(action);
+	if (!key) return false;
+	return !requested || !Object.hasOwn(requested, key);
+}
+/** The ancestor obligations that act as standing constraints on this unit. */
+function standingAncestorConstraints(projection, unitId) {
+	if (projection.boundaryProtocol !== 5) return [];
+	const ancestors = unitAncestorIds(projection, unitId);
+	if (ancestors.length === 0) return [];
+	return visiblePendingItems(projection).filter((item) => {
+		if (item.unitId === void 0 || !ancestors.includes(item.unitId)) return false;
+		if (item.kind === "prohibition") return true;
+		return item.authorityDisposition === "conditional_wait" || item.waitAuthorization !== void 0;
+	});
+}
+/**
+* The ancestor constraint that blocks certifying `item` against a resolved
+* target, if any. This is the authoritative judge used by the certifier: the
+* ancestor constraint is compared with the SAME conservative identity rule the
+* mutation authorization uses, so a ban or an unsatisfied condition cannot be
+* discharged by certifying a descendant obligation that resolves the target
+* the ancestor constrained.
+*/
+function ancestorConstraintForBinding(projection, item, resolvedTarget) {
+	if (item.unitId === void 0) return void 0;
+	const action = item.semanticAction;
+	if (!action || action === "generic_run" || !isStatefulAction(action)) return void 0;
+	for (const constraint of standingAncestorConstraints(projection, item.unitId)) {
+		if (constraint.id === item.id || constraint.semanticAction !== action) continue;
+		if (!(constraint.kind === "prohibition" && isBlanketProhibition(action, constraint.requestedTarget) || requestedTargetMatchesResolved(action, constraint.requestedTarget, resolvedTarget))) continue;
+		return {
+			constraintId: constraint.id,
+			constraintUnitId: constraint.unitId,
+			itemId: item.id,
+			kind: constraint.kind === "prohibition" ? "prohibition" : "condition",
+			reasonCode: constraint.kind === "prohibition" ? "ancestor_prohibition_active" : "ancestor_condition_unsatisfied"
+		};
+	}
+}
+/**
+* The closure a completion certificate must answer for right now.
+*
+* Legacy sessions certify the whole session. v5 sessions certify the current
+* work unit's closure PLUS every pre-v5 obligation: items captured before the
+* boundary carry no unit and keep their birth rules, so a unit certificate
+* must never silently shrink their scope (migration table, P0 §6).
+*/
+function certificateClosure(projection) {
+	if (projection.boundaryProtocol === 5) {
+		const legacyIds = certifiableOpenItems(projection).filter((item) => item.unitId === void 0).map((item) => item.id);
+		const unitIds = projection.currentUnitId !== void 0 ? unitClosureItemIds(projection, projection.currentUnitId) : [];
+		return {
+			unitId: projection.currentUnitId,
+			itemIds: [...legacyIds, ...unitIds]
+		};
+	}
+	return { itemIds: certifiableOpenItems(projection).map((item) => item.id) };
+}
+
+//#endregion
+//#region src/domain/proof.ts
+const PROOF_PROTOCOL_VERSION = "0.4.0";
+const PROOF_KINDS = [
+	"subject_readback",
+	"scope_coverage",
+	"state_verification"
+];
+function stable$2(value) {
+	if (Array.isArray(value)) return `[${value.map(stable$2).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${JSON.stringify(k)}:${stable$2(v)}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+function digest(value) {
+	return createHash("sha256").update("ccg.proofManifest.v1\n", "utf8").update(stable$2(value), "utf8").digest("hex");
+}
+function validDigest(value) {
+	return /^[0-9a-f]{64}$/.test(value);
+}
+/**
+* The manifest digest root includes every integrity-bearing field, so a
+* tampered asset-set digest is exactly as detectable as a tampered obligation.
+*/
+function proofDigest(obligations, assetSetSha256) {
+	return digest({
+		proofProtocolVersion: PROOF_PROTOCOL_VERSION,
+		obligations: [...obligations],
+		...assetSetSha256 !== void 0 ? { assetSetSha256 } : {}
+	});
+}
+function validateProofManifest(manifest) {
+	const errors = [];
+	if (!manifest || typeof manifest !== "object") return ["proof_manifest_invalid"];
+	const value = manifest;
+	if (value.proofProtocolVersion !== PROOF_PROTOCOL_VERSION) errors.push("proof_protocol_version_mismatch");
+	if (!Array.isArray(value.obligations)) errors.push("proof_obligations_missing");
+	if (value.assetSetSha256 !== void 0 && (typeof value.assetSetSha256 !== "string" || !validDigest(value.assetSetSha256))) errors.push("proof_asset_set_digest_invalid");
+	if (typeof value.proofSha256 !== "string" || !validDigest(value.proofSha256)) errors.push("proof_digest_invalid");
+	const obligations = Array.isArray(value.obligations) ? value.obligations : [];
+	const ids = /* @__PURE__ */ new Set();
+	for (const raw of obligations) {
+		if (!raw || typeof raw !== "object") {
+			errors.push("proof_obligation_invalid");
+			continue;
+		}
+		const obligation = raw;
+		if (typeof obligation.obligationId !== "string" || ids.has(obligation.obligationId)) errors.push("proof_obligation_id_duplicate_or_invalid");
+		if (typeof obligation.obligationId === "string") ids.add(obligation.obligationId);
+		if (!PROOF_KINDS.includes(obligation.kind)) errors.push("proof_kind_unsupported");
+		if (![
+			"artifact",
+			"ui",
+			"visual",
+			"scope"
+		].includes(String(obligation.surface))) errors.push("proof_surface_unsupported");
+		if (!Array.isArray(obligation.subjectIds) || obligation.subjectIds.length === 0 || obligation.subjectIds.some((id) => typeof id !== "string" || id.startsWith("codex:unsupported/"))) errors.push("proof_subject_invalid");
+		if (!Array.isArray(obligation.evidenceIds) || obligation.evidenceIds.length === 0 || new Set(obligation.evidenceIds).size !== obligation.evidenceIds.length) errors.push("proof_evidence_invalid");
+		const expected = obligation.expectedScopeDigest;
+		const observed = obligation.observedScopeDigest;
+		for (const digestValue of [expected, observed]) if (digestValue !== void 0 && (typeof digestValue !== "string" || !validDigest(digestValue))) errors.push("proof_scope_digest_invalid");
+		if (expected !== void 0 && observed !== expected) errors.push("proof_scope_digest_mismatch");
+		if (expected === void 0 && observed !== void 0) errors.push("proof_scope_digest_mismatch");
+	}
+	if (errors.length === 0) {
+		const assetSet = typeof value.assetSetSha256 === "string" ? value.assetSetSha256 : void 0;
+		if (value.proofSha256 !== proofDigest(obligations, assetSet)) errors.push("proof_digest_mismatch");
+	}
+	return [...new Set(errors)];
+}
+function createProofManifest(obligations, assetSetSha256) {
+	const normalized = obligations.map((obligation) => ({
+		obligationId: obligation.obligationId,
+		kind: obligation.kind,
+		surface: obligation.surface,
+		subjectIds: [...obligation.subjectIds].sort(),
+		evidenceIds: [...obligation.evidenceIds].sort(),
+		...obligation.expectedScopeDigest ? { expectedScopeDigest: obligation.expectedScopeDigest } : {},
+		...obligation.observedScopeDigest ? { observedScopeDigest: obligation.observedScopeDigest } : {}
+	})).sort((a, b) => a.obligationId.localeCompare(b.obligationId));
+	const manifest = {
+		proofProtocolVersion: PROOF_PROTOCOL_VERSION,
+		obligations: normalized,
+		...assetSetSha256 !== void 0 ? { assetSetSha256 } : {},
+		proofSha256: proofDigest(normalized, assetSetSha256)
+	};
+	const errors = validateProofManifest(manifest);
+	if (errors.length) throw new Error(`proof manifest rejected: ${errors.join(",")}`);
+	return manifest;
+}
+/**
+* Bind a structurally valid proof to the actual replayed projection: every
+* obligation must name a pending item, every evidence id must exist in the
+* projection, and every bound evidence must satisfy the obligation's kind,
+* surface, subject, and outcome constraints. An empty projection therefore
+* rejects any proof, and cross-item or foreign evidence can never bind.
+*/
+function bindProofToProjection(projection, proof) {
+	const errors = [];
+	const items = projection.items;
+	const evidence = projection.evidence;
+	for (const obligation of proof.obligations) {
+		const item = items.get(obligation.obligationId);
+		if (!item) {
+			errors.push("proof_obligation_unbound");
+			continue;
+		}
+		if (item.status !== "pending") {
+			errors.push("proof_obligation_not_pending");
+			continue;
+		}
+		if (item.verification.surface !== void 0 && item.verification.surface !== obligation.surface) errors.push("proof_surface_unbound");
+		const seen = /* @__PURE__ */ new Set();
+		for (const evidenceId of obligation.evidenceIds) {
+			const record = evidence.get(evidenceId);
+			if (!record) {
+				errors.push("proof_evidence_unknown");
+				continue;
+			}
+			if (!seen.has(evidenceId)) seen.add(evidenceId);
+			if (record.outcome !== "success") {
+				errors.push("proof_evidence_outcome_invalid");
+				continue;
+			}
+			if (!proofEvidenceConstraints(record, obligation)) errors.push("proof_evidence_constraint_failed");
+		}
+		if (obligation.kind === "scope_coverage") {
+			const itemScope = item.requestedTarget?.scope;
+			const itemSubject = item.verification.subject;
+			if (!obligation.subjectIds.every((subject) => subject === itemScope || subject === itemSubject)) errors.push("proof_scope_subject_unbound");
+		}
+	}
+	return [...new Set(errors)];
+}
+function canonicalProjection(projection) {
+	return {
+		epoch: projection.epoch,
+		contractRevision: projection.contractRevision,
+		sessionRefDigest: projection.sessionRefDigest,
+		hostLockDigest: projection.hostLockDigest,
+		hostStatus: projection.hostStatus,
+		hostCohortId: projection.hostCohortId,
+		integrity: projection.integrity,
+		items: [...projection.items.values()].map(({ id, revision, kind, status, semanticAction, requestedTarget, verification }) => ({
+			id,
+			revision,
+			kind,
+			status,
+			semanticAction,
+			requestedTarget,
+			verification
+		})).sort((a, b) => a.id.localeCompare(b.id)),
+		evidence: [...projection.evidence.values()].map(({ id, epoch, toolName, outcome, capabilities, subjects, surfaces: surfaces$1, operations, semanticAction, evidenceRole, resolvedTarget, observedState }) => ({
+			id,
+			epoch,
+			toolName,
+			outcome,
+			capabilities,
+			subjects,
+			surfaces: surfaces$1,
+			operations,
+			semanticAction,
+			evidenceRole,
+			resolvedTarget,
+			observedState
+		})).sort((a, b) => a.id.localeCompare(b.id)),
+		checkpoints: projection.checkpoints.map(({ id, certificationDigest: certificationDigest$1, result }) => ({
+			id,
+			certificationDigest: certificationDigest$1,
+			result
+		}))
+	};
+}
+function sessionQuery(projection, proof) {
+	if (proof) {
+		if (validateProofManifest(proof).length) return {
+			sessionRefDigest: projection.sessionRefDigest,
+			epoch: projection.epoch,
+			contractRevision: projection.contractRevision,
+			state: "corrupt",
+			reasonCode: "proof_invalid",
+			cohortId: projection.hostCohortId
+		};
+		if (bindProofToProjection(projection, proof).length) return {
+			sessionRefDigest: projection.sessionRefDigest,
+			epoch: projection.epoch,
+			contractRevision: projection.contractRevision,
+			state: "corrupt",
+			reasonCode: "proof_unbound",
+			cohortId: projection.hostCohortId
+		};
+	}
+	const state = projection.integrity === "valid" ? projection.hostStatus === "supported" ? "valid" : "unknown" : projection.integrity;
+	return {
+		sessionRefDigest: projection.sessionRefDigest,
+		epoch: projection.epoch,
+		contractRevision: projection.contractRevision,
+		state,
+		...proof ? { proof } : {},
+		cohortId: projection.hostCohortId
+	};
+}
+function proofEvidenceConstraints(evidence, obligation) {
+	if (evidence.outcome !== "success" || evidence.surfaces.length !== 1 || evidence.surfaces[0] !== obligation.surface) return false;
+	if (!obligation.subjectIds.every((subject) => evidence.subjects.includes(subject))) return false;
+	if (obligation.kind === "subject_readback" && !(evidence.operations ?? []).some(({ op }) => op === "read" || op === "verify")) return false;
+	if (obligation.kind === "scope_coverage" && !(evidence.operations ?? []).some(({ op }) => op === "run" || op === "verify")) return false;
+	if (obligation.kind === "state_verification" && evidence.evidenceRole !== "state") return false;
+	return true;
+}
+const PROOF_PROTOCOL_VERSION_V2 = "0.6.0";
+/** The v2 digest domain; the v1 domain string is untouched. */
+const PROOF_MANIFEST_DOMAIN_V2 = "ccg.proofManifest.v2";
+const PROOF_KINDS_V2 = [
+	"subject_readback",
+	"scope_coverage",
+	"state_verification",
+	"input_asset_check",
+	"output_visual_readback",
+	"object_url_readback",
+	"execution_fact",
+	"external_fact"
+];
+const ALL_SURFACES = [
+	"native_read",
+	"native_write_edit",
+	"shell",
+	"web",
+	"jobs",
+	"subagent",
+	"visual_capture"
+];
+function surfaces(supported) {
+	return {
+		supportedSurfaces: [...supported],
+		unavailableSurfaces: ALL_SURFACES.filter((surface) => !supported.includes(surface))
+	};
+}
+const PROOF_CAPABILITY_MATRIX = {
+	subject_readback: {
+		kind: "subject_readback",
+		capabilities: [
+			"filesystem-read",
+			"verify",
+			"deterministic-check"
+		],
+		readbackRequired: true,
+		operationOnSubject: true,
+		...surfaces(["native_read", "shell"])
+	},
+	scope_coverage: {
+		kind: "scope_coverage",
+		capabilities: [
+			"filesystem-read",
+			"verify",
+			"deterministic-check",
+			"web-fetch"
+		],
+		readbackRequired: true,
+		operationOnSubject: false,
+		...surfaces([
+			"native_read",
+			"shell",
+			"web"
+		])
+	},
+	state_verification: {
+		kind: "state_verification",
+		capabilities: [
+			"filesystem-read",
+			"web-fetch",
+			"deterministic-check"
+		],
+		readbackRequired: true,
+		requiredRole: "state",
+		operationOnSubject: false,
+		...surfaces(["native_read", "web"])
+	},
+	input_asset_check: {
+		kind: "input_asset_check",
+		capabilities: ["filesystem-read", "web-fetch"],
+		readbackRequired: true,
+		requiredRole: "resolution",
+		operationOnSubject: true,
+		...surfaces(["native_read", "web"])
+	},
+	output_visual_readback: {
+		kind: "output_visual_readback",
+		capabilities: ["visual-readback"],
+		readbackRequired: true,
+		operationOnSubject: true,
+		...surfaces(["visual_capture"])
+	},
+	object_url_readback: {
+		kind: "object_url_readback",
+		capabilities: ["web-fetch"],
+		readbackRequired: true,
+		operationOnSubject: true,
+		...surfaces(["web"])
+	},
+	execution_fact: {
+		kind: "execution_fact",
+		capabilities: [],
+		readbackRequired: false,
+		requiredRole: "effect",
+		operationOnSubject: false,
+		...surfaces([
+			"shell",
+			"native_write_edit",
+			"native_read",
+			"web",
+			"jobs",
+			"subagent"
+		])
+	},
+	external_fact: {
+		kind: "external_fact",
+		capabilities: [],
+		readbackRequired: false,
+		operationOnSubject: false,
+		...surfaces(["jobs", "subagent"])
+	}
+};
+/** The host surface names a fact's tool/adapter identity maps to. */
+function proofHostSurfacesOf(evidence) {
+	const surface = /* @__PURE__ */ new Set();
+	if (evidence.externalOperationRef) surface.add("jobs");
+	if (evidence.delegatedSubtask) surface.add("subagent");
+	if (evidence.capabilities.includes("visual-readback")) surface.add("visual_capture");
+	if (evidence.capabilities.includes("web-fetch")) surface.add("web");
+	if (new Set([
+		"write",
+		"edit",
+		"write_file",
+		"edit_file"
+	]).has(evidence.toolName)) surface.add("native_write_edit");
+	if (new Set([
+		"read",
+		"read_file",
+		"web_fetch",
+		"web_fetch_url",
+		"web_search"
+	]).has(evidence.toolName)) surface.add("native_read");
+	if ([
+		"bash",
+		"shell",
+		"pwsh"
+	].includes(evidence.toolName)) surface.add("shell");
+	if (evidence.capabilities.includes("filesystem-read")) surface.add("native_read");
+	return [...surface].sort();
+}
+function digestV2(value) {
+	return createHash("sha256").update(`${PROOF_MANIFEST_DOMAIN_V2}\n`, "utf8").update(stable$2(value), "utf8").digest("hex");
+}
+function proofDigestV2(obligations) {
+	return digestV2({
+		proofProtocolVersion: PROOF_PROTOCOL_VERSION_V2,
+		obligations: [...obligations]
+	});
+}
+function createProofManifestV2(obligations) {
+	const normalized = obligations.map((obligation) => ({
+		obligationId: obligation.obligationId,
+		kind: obligation.kind,
+		surface: obligation.surface,
+		subjectIds: [...obligation.subjectIds].sort(),
+		sourceIds: [...obligation.sourceIds].sort(),
+		operation: obligation.operation,
+		evidenceIds: [...obligation.evidenceIds].sort(),
+		...obligation.expectedScopeDigest ? { expectedScopeDigest: obligation.expectedScopeDigest } : {},
+		...obligation.observedScopeDigest ? { observedScopeDigest: obligation.observedScopeDigest } : {}
+	})).sort((a, b) => a.obligationId.localeCompare(b.obligationId));
+	const manifest = {
+		proofProtocolVersion: PROOF_PROTOCOL_VERSION_V2,
+		obligations: normalized,
+		proofSha256: proofDigestV2(normalized)
+	};
+	const errors = validateProofManifestV2(manifest);
+	if (errors.length) throw new Error(`proof v2 manifest rejected: ${errors.join(",")}`);
+	return manifest;
+}
+function validateProofManifestV2(manifest) {
+	const errors = [];
+	if (!manifest || typeof manifest !== "object") return ["proof_manifest_invalid"];
+	const value = manifest;
+	if (value.proofProtocolVersion !== PROOF_PROTOCOL_VERSION_V2) errors.push("proof_protocol_version_mismatch");
+	if (!Array.isArray(value.obligations)) errors.push("proof_obligations_missing");
+	if (typeof value.proofSha256 !== "string" || !validDigest(value.proofSha256)) errors.push("proof_digest_invalid");
+	const obligations = Array.isArray(value.obligations) ? value.obligations : [];
+	const ids = /* @__PURE__ */ new Set();
+	for (const raw of obligations) {
+		if (!raw || typeof raw !== "object") {
+			errors.push("proof_obligation_invalid");
+			continue;
+		}
+		const obligation = raw;
+		if (typeof obligation.obligationId !== "string" || !obligation.obligationId || ids.has(obligation.obligationId)) errors.push("proof_obligation_id_duplicate_or_invalid");
+		if (typeof obligation.obligationId === "string") ids.add(obligation.obligationId);
+		if (!PROOF_KINDS_V2.includes(obligation.kind)) errors.push("proof_kind_unsupported");
+		if (![
+			"artifact",
+			"ui",
+			"visual",
+			"scope"
+		].includes(String(obligation.surface))) errors.push("proof_surface_unsupported");
+		if (![
+			"create",
+			"write",
+			"modify",
+			"read",
+			"run",
+			"verify"
+		].includes(String(obligation.operation))) errors.push("proof_operation_unsupported");
+		if (!Array.isArray(obligation.subjectIds) || obligation.subjectIds.length === 0 || obligation.subjectIds.some((id) => typeof id !== "string" || !id)) errors.push("proof_subject_invalid");
+		if (!Array.isArray(obligation.sourceIds) || obligation.sourceIds.length === 0 || obligation.sourceIds.some((id) => typeof id !== "string" || !id)) errors.push("proof_source_invalid");
+		if (!Array.isArray(obligation.evidenceIds) || obligation.evidenceIds.length === 0 || obligation.evidenceIds.some((id) => typeof id !== "string" || !id) || new Set(obligation.evidenceIds).size !== obligation.evidenceIds.length) errors.push("proof_evidence_invalid");
+		const expected = obligation.expectedScopeDigest;
+		const observed = obligation.observedScopeDigest;
+		for (const digestValue of [expected, observed]) if (digestValue !== void 0 && (typeof digestValue !== "string" || !validDigest(digestValue))) errors.push("proof_scope_digest_invalid");
+		if (expected !== observed) errors.push("proof_scope_digest_mismatch");
+	}
+	if (errors.length === 0 && value.proofSha256 !== proofDigestV2(obligations)) errors.push("proof_digest_mismatch");
+	return [...new Set(errors)];
+}
+/**
+* Why one fact cannot discharge one v2 obligation, or `undefined` when it can.
+* The checks are ordered so the reported reason names the first unmet
+* requirement: missing producer capability, wrong role, absent readback, wrong
+* source, wrong subject, wrong operation.
+*/
+function proofV2Rejection(evidence, obligation) {
+	const spec = PROOF_CAPABILITY_MATRIX[obligation.kind];
+	if (evidence.delegatedSubtask) return "proof_source_bounded_delegation";
+	if (obligation.sourceIds.length > 0 && !obligation.sourceIds.includes(evidence.toolName) && !obligation.sourceIds.includes(evidence.adapterId ?? "")) return "proof_source_unbound";
+	if (evidence.outcome !== "success") return "proof_evidence_outcome_invalid";
+	if (obligation.kind === "external_fact") {
+		if (!evidence.externalOperationRef) return "proof_external_fact_unavailable";
+		if (evidence.externalOperationRef.status !== "completed") return "proof_external_fact_incomplete";
+	}
+	const available = proofHostSurfacesOf(evidence);
+	if (available.length === 0 || !available.some((surface) => spec.supportedSurfaces.includes(surface))) return "proof_producer_capability_unavailable";
+	if (spec.capabilities.length > 0 && !spec.capabilities.some((capability) => evidence.capabilities.includes(capability))) return "proof_producer_capability_unavailable";
+	if (spec.requiredRole !== void 0 && evidence.evidenceRole !== spec.requiredRole) return "proof_role_unbound";
+	if (spec.readbackRequired) {
+		if (!(evidence.operations ?? []).some((entry) => entry.op === "read" || entry.op === "verify")) return "proof_readback_unavailable";
+		if (spec.operationOnSubject && obligation.subjectIds.length > 0) {
+			const subjects = evidence.subjects;
+			if (!obligation.subjectIds.every((subject) => subjects.some((value) => value === subject))) return "proof_subject_unbound";
+		}
+	}
+	if (obligation.kind === "state_verification" && evidence.surfaces.length > 0 && !evidence.surfaces.includes(obligation.surface)) return "proof_surface_unbound";
+	if (obligation.kind === "execution_fact" && !(evidence.operations ?? []).some((entry) => entry.op === obligation.operation)) return "proof_operation_unbound";
+}
+/**
+* The subjects an item's own obligation requires. They come from the item's
+* frozen verification contract and captured target — never from the proof
+* manifest, which is exactly what a proof must be checked against.
+*/
+function requiredSubjectsOf(item) {
+	const values = /* @__PURE__ */ new Set();
+	const subject = item.verification.subject;
+	if (typeof subject === "string" && subject.length > 0 && subject !== "scope") values.add(subject);
+	const target = item.requestedTarget ?? {};
+	if (item.verification.surface === "scope") {
+		const scope = target.scope;
+		if (typeof scope === "string" && scope.length > 0 && scope !== "scope") values.add(scope);
+	}
+	for (const key of [
+		"artifact_id",
+		"package_id",
+		"service_id",
+		"repository"
+	]) {
+		const value = target[key];
+		if (typeof value === "string" && value.length > 0 && value !== "scope") values.add(value);
+	}
+	return [...values].sort();
+}
+/** The frozen coverage digest of a subject set: sorted, then hashed. */
+function scopeCoverageDigest(subjects) {
+	return createHash("sha256").update("ccg.proofScopeCoverage.v2\n", "utf8").update(JSON.stringify([...subjects].sort()), "utf8").digest("hex");
+}
+/**
+* Operations a fact may perform to discharge one proof kind. `execution_fact`
+* is bound to the obligation's own declared operation; the readback kinds
+* accept only an actual read or verify, so a bare successful call never
+* satisfies them.
+*/
+const KIND_OPERATIONS = {
+	subject_readback: ["read", "verify"],
+	scope_coverage: ["run", "verify"],
+	state_verification: ["read", "verify"],
+	input_asset_check: ["read", "verify"],
+	output_visual_readback: ["read", "verify"],
+	object_url_readback: ["read", "verify"],
+	execution_fact: "declared",
+	external_fact: []
+};
+/** Whether the fact performed an operation the kind accepts. */
+function proofOperationMatches(evidence, obligation) {
+	const allowed = KIND_OPERATIONS[obligation.kind];
+	const operations = evidence.operations ?? [];
+	if (allowed === "declared") return operations.some((entry) => entry.op === obligation.operation);
+	if (allowed.length === 0) return true;
+	return operations.some((entry) => allowed.includes(entry.op));
+}
+/**
+* Bind a v2 manifest to the live projection; [] means every obligation binds.
+*
+* The binding is the whole chain the review demanded, in one place:
+* the user's obligation (frozen subject and scope on the ITEM) → the trusted
+* producer fact (qualified by the same availability rules ordinary evidence
+* uses) → the declared source → the declared operation and its order relative
+* to the effect → the real coverage set. Only then is the obligation
+* discharged. A manifest that describes a different subject than the item
+* asked about fails even when the manifest and the facts agree with each
+* other.
+*/
+function bindProofV2ToProjection(projection, manifest) {
+	const errors = [];
+	for (const obligation of manifest.obligations) {
+		const item = projection.items.get(obligation.obligationId);
+		if (!item) {
+			errors.push("proof_obligation_unbound");
+			continue;
+		}
+		if (item.status !== "pending") {
+			errors.push("proof_obligation_not_pending");
+			continue;
+		}
+		if (item.verification.surface !== void 0 && item.verification.surface !== obligation.surface) errors.push("proof_surface_unbound");
+		const required = requiredSubjectsOf(item);
+		if (required.length > 0) {
+			if (!obligation.subjectIds.every((subject) => required.includes(subject))) {
+				errors.push("proof_subject_unbound");
+				continue;
+			}
+			if (!required.every((subject) => obligation.subjectIds.includes(subject))) {
+				errors.push("proof_scope_incomplete");
+				continue;
+			}
+		}
+		const cited = [];
+		for (const evidenceId of obligation.evidenceIds) {
+			const evidence = projection.evidence.get(evidenceId);
+			if (!evidence) {
+				errors.push("proof_evidence_unknown");
+				continue;
+			}
+			const availability = evidenceAvailabilityReason(evidence);
+			if (availability !== void 0) {
+				errors.push(availability);
+				continue;
+			}
+			if (evidence.epoch !== projection.epoch) {
+				errors.push("proof_evidence_wrong_epoch");
+				continue;
+			}
+			if (obligation.subjectIds.length > 0 && !evidence.subjects.some((subject) => obligation.subjectIds.includes(subject))) {
+				errors.push("proof_subject_unbound");
+				continue;
+			}
+			if (!proofOperationMatches(evidence, obligation)) {
+				errors.push("proof_operation_unbound");
+				continue;
+			}
+			const rejection = proofV2Rejection(evidence, obligation);
+			if (rejection) {
+				errors.push(rejection);
+				continue;
+			}
+			cited.push(evidence);
+		}
+		if (cited.length === 0 && obligation.evidenceIds.length > 0) continue;
+		if (required.length > 0 && !required.every((subject) => cited.some((fact) => fact.subjects.includes(subject)))) {
+			errors.push("proof_scope_incomplete");
+			continue;
+		}
+		if (obligation.kind === "input_asset_check") {
+			const firstCheck = Math.min(...cited.map((fact) => fact.toolResultSeq));
+			if ([...projection.evidence.values()].some((fact) => fact.evidenceRole === "effect" && required.some((subject) => fact.subjects.includes(subject)) && fact.toolResultSeq < firstCheck)) {
+				errors.push("proof_input_check_after_effect");
+				continue;
+			}
+		}
+		if (obligation.kind === "scope_coverage") {
+			const covered = [...new Set(cited.flatMap((fact) => fact.subjects))].sort();
+			if (obligation.expectedScopeDigest !== void 0 && obligation.expectedScopeDigest !== scopeCoverageDigest(required)) {
+				errors.push("proof_scope_digest_unbound");
+				continue;
+			}
+			if (obligation.observedScopeDigest !== void 0 && obligation.observedScopeDigest !== scopeCoverageDigest(covered)) {
+				errors.push("proof_scope_digest_unbound");
+				continue;
+			}
+		}
+	}
+	return [...new Set(errors)];
+}
+function sessionQueryV2(projection, proof) {
+	if (proof) {
+		if (validateProofManifestV2(proof).length) return {
+			sessionRefDigest: projection.sessionRefDigest,
+			epoch: projection.epoch,
+			contractRevision: projection.contractRevision,
+			state: "corrupt",
+			reasonCode: "proof_invalid",
+			cohortId: projection.hostCohortId
+		};
+		if (bindProofV2ToProjection(projection, proof).length) return {
+			sessionRefDigest: projection.sessionRefDigest,
+			epoch: projection.epoch,
+			contractRevision: projection.contractRevision,
+			state: "corrupt",
+			reasonCode: "proof_unbound",
+			cohortId: projection.hostCohortId
+		};
+	}
+	const state = projection.integrity === "valid" ? projection.hostStatus === "supported" ? "valid" : "unknown" : projection.integrity;
+	return {
+		sessionRefDigest: projection.sessionRefDigest,
+		epoch: projection.epoch,
+		contractRevision: projection.contractRevision,
+		state,
+		...proof ? { proof } : {},
+		cohortId: projection.hostCohortId
+	};
+}
+/**
+* The capability report for one proof kind against the facts a cohort actually
+* produced: `unavailable` with a stable reason when no producer is observable,
+* never a silent pass.
+*/
+function proofCapabilityReport(kind, facts) {
+	for (const fact of facts) {
+		if (fact.outcome !== "success") continue;
+		const probe = {
+			obligationId: "probe",
+			kind,
+			surface: "artifact",
+			subjectIds: fact.subjects.slice(0, 1),
+			sourceIds: [],
+			operation: "verify",
+			evidenceIds: []
+		};
+		if (probe.subjectIds.length === 0) probe.subjectIds = ["probe"];
+		if (proofV2Rejection(fact, probe) === void 0) return { status: "supported" };
+	}
+	return {
+		status: "unavailable",
+		reasonCode: "proof_producer_capability_unavailable"
+	};
+}
+
+//#endregion
+//#region src/domain/checkpoint.ts
+function stable$1(value) {
+	if (Array.isArray(value)) return `[${value.map(stable$1).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, entry]) => `${JSON.stringify(key)}:${stable$1(entry)}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+function tuplesEqual(left, right) {
+	return stable$1(left ?? {}) === stable$1(right ?? {});
+}
+function transitionsEqual(left, right) {
+	return stable$1(left) === stable$1(right);
+}
+function transitionIsSelfConsistent(action, transition) {
+	if (!transition?.parameters || transition.predicateId !== ACTION_MANIFEST.actions[action].predicateId || transition.version !== 1 || transition.predParamsKind !== "inline") return false;
+	const recomputed = predParamsDigest(transition.parameters, resolveAllowlist("product"));
+	return transition.parametersDigest === void 0 || transition.parametersDigest === recomputed;
+}
+function evidenceFact(evidence) {
+	return {
+		id: evidence.id,
+		outcome: evidence.outcome,
+		method: evidence.toolName,
 		operations: (evidence.operations ?? []).map((entry) => entry.op),
 		executables: evidence.executables ?? [],
 		subjects: evidence.subjects,
@@ -4556,6 +6173,37 @@ function evidenceProblem(projection, item, binding) {
 		};
 	}
 }
+/**
+* The strict-policy proof obligation (C06). Only the surfaces the USER asked
+* for add a requirement, and the requirement is a real readback from the v2
+* capability matrix: a visual verification needs a fact that actually observed
+* the output, a complete-scope verification needs a fact that actually covered
+* the scope. Standard policy does not run this, and no ordinary action gains an
+* approval step.
+*/
+function strictProofProblem(projection, item, binding) {
+	const surface = item.verification.surface;
+	if (surface !== "visual" && surface !== "scope") return void 0;
+	const kind = surface === "visual" ? "output_visual_readback" : "scope_coverage";
+	const obligation = {
+		obligationId: item.id,
+		kind,
+		surface,
+		subjectIds: [item.verification.subject ?? item.requestedTarget?.scope ?? "scope"].filter((value) => typeof value === "string" && value.length > 0),
+		sourceIds: [],
+		operation: item.verification.operation ?? "verify",
+		evidenceIds: binding.evidenceIds
+	};
+	const cited = citedEvidence(projection, binding);
+	if (cited.some((fact) => fact.outcome === "success" && fact.subjects.some((subject) => obligation.subjectIds.includes(subject)) && proofV2Rejection(fact, obligation) === void 0)) return void 0;
+	return {
+		itemId: item.id,
+		reason: `strict policy: the requested ${surface} verification needs a real readback fact from the current projection`,
+		reasonCode: "strict_proof_required",
+		offendingEvidenceIds: cited.map((fact) => fact.id),
+		hint: closingHint(projection, item, binding.evidenceIds)
+	};
+}
 function expectedTransitionMatches(action, transition, resolved, observed) {
 	const expectedPredicate = ACTION_MANIFEST.actions[action].predicateId;
 	if (transition.predicateId !== expectedPredicate || transition.version !== 1 || transition.predParamsKind !== "inline" || !transition.parameters) return false;
@@ -4570,14 +6218,14 @@ function expectedTransitionMatches(action, transition, resolved, observed) {
 			"version",
 			"integrity_digest",
 			...action === "publish" ? ["registry"] : ["profile"]
-		].every((key) => stable$2(observed[key]) === stable$2(resolved[key]) && stable$2(params[key]) === stable$2(resolved[key]));
+		].every((key) => stable$1(observed[key]) === stable$1(resolved[key]) && stable$1(params[key]) === stable$1(resolved[key]));
 		case "create":
-		case "modify": return stable$2(observed.post_digest) === stable$2(params.post_digest);
-		case "restart": return stable$2(params.pre_generation) === stable$2(resolved.pre_generation) && stable$2(observed.new_generation) !== stable$2(resolved.pre_generation) && stable$2(observed.health) === stable$2(params.health);
-		case "commit": return stable$2(params.pre_head_oid) === stable$2(resolved.pre_head_oid) && stable$2(params.change_set_digest) === stable$2(resolved.change_set_digest) && stable$2(observed.pre_head_oid) === stable$2(resolved.pre_head_oid) && stable$2(observed.post_head_oid) !== stable$2(resolved.pre_head_oid);
-		case "push": return stable$2(observed.remote_oid) === stable$2(resolved.local_oid) && stable$2(params.local_oid) === stable$2(resolved.local_oid);
-		case "pull": return stable$2(resolved.pull_mode) === stable$2("ff-only") && stable$2(params.pull_mode) === stable$2("ff-only") && stable$2(params.upstream_oid) === stable$2(resolved.upstream_oid) && stable$2(params.pre_head_oid) === stable$2(resolved.pre_head_oid) && stable$2(observed.post_head_oid) === stable$2(resolved.upstream_oid) && stable$2(observed.tracking_ref_oid) === stable$2(resolved.upstream_oid);
-		case "fetch": return stable$2(params.upstream_oid) === stable$2(resolved.upstream_oid) && stable$2(params.pre_head_oid) === stable$2(resolved.pre_head_oid) && stable$2(observed.tracking_ref_oid) === stable$2(resolved.upstream_oid) && stable$2(observed.post_head_oid) === stable$2(resolved.pre_head_oid);
+		case "modify": return stable$1(observed.post_digest) === stable$1(params.post_digest);
+		case "restart": return stable$1(params.pre_generation) === stable$1(resolved.pre_generation) && stable$1(observed.new_generation) !== stable$1(resolved.pre_generation) && stable$1(observed.health) === stable$1(params.health);
+		case "commit": return stable$1(params.pre_head_oid) === stable$1(resolved.pre_head_oid) && stable$1(params.change_set_digest) === stable$1(resolved.change_set_digest) && stable$1(observed.pre_head_oid) === stable$1(resolved.pre_head_oid) && stable$1(observed.post_head_oid) !== stable$1(resolved.pre_head_oid);
+		case "push": return stable$1(observed.remote_oid) === stable$1(resolved.local_oid) && stable$1(params.local_oid) === stable$1(resolved.local_oid);
+		case "pull": return stable$1(resolved.pull_mode) === stable$1("ff-only") && stable$1(params.pull_mode) === stable$1("ff-only") && stable$1(params.upstream_oid) === stable$1(resolved.upstream_oid) && stable$1(params.pre_head_oid) === stable$1(resolved.pre_head_oid) && stable$1(observed.post_head_oid) === stable$1(resolved.upstream_oid) && stable$1(observed.tracking_ref_oid) === stable$1(resolved.upstream_oid);
+		case "fetch": return stable$1(params.upstream_oid) === stable$1(resolved.upstream_oid) && stable$1(params.pre_head_oid) === stable$1(resolved.pre_head_oid) && stable$1(observed.tracking_ref_oid) === stable$1(resolved.upstream_oid) && stable$1(observed.post_head_oid) === stable$1(resolved.pre_head_oid);
 		default: return true;
 	}
 }
@@ -4586,8 +6234,8 @@ function nonStatefulTransitionMatches(action, transition, resolved, observed) {
 	const params = transition.parameters;
 	const recomputed = predParamsDigest(params, resolveAllowlist("product"));
 	if (transition.parametersDigest && transition.parametersDigest !== recomputed) return false;
-	if (action === "inspect_remote_updates") return ["remote", "version"].every((key) => stable$2(params[key]) === stable$2(resolved[key])) && stable$2(params.upstream_oid) === stable$2(observed.upstream_oid);
-	return stable$2(params) === stable$2({
+	if (action === "inspect_remote_updates") return ["remote", "version"].every((key) => stable$1(params[key]) === stable$1(resolved[key])) && stable$1(params.upstream_oid) === stable$1(observed.upstream_oid);
+	return stable$1(params) === stable$1({
 		expected_outcome: {
 			k: "e",
 			v: "success"
@@ -4694,7 +6342,7 @@ function richStatefulRecord(projection, item, binding) {
 		reason: "resolution fact does not bind an expected transition digest",
 		reasonCode: "resolution_expected_transition_digest_missing"
 	} };
-	if (resolution.expectedTransitionDigest !== sha256(stable$2(resolution.expectedTransition))) return { rejected: {
+	if (resolution.expectedTransitionDigest !== sha256(stable$1(resolution.expectedTransition))) return { rejected: {
 		itemId: item.id,
 		reason: "resolution expected transition digest does not match its stable payload",
 		reasonCode: "resolution_expected_transition_digest_mismatch"
@@ -4789,7 +6437,7 @@ function simpleRecord(projection, item, binding) {
 	const effectAction = effect.semanticAction ?? "generic_run";
 	const effectTarget = effect.resolvedTarget ?? {};
 	const effectObserved = effect.observedState ?? {};
-	if (!(Object.entries(binding.resolvedTarget ?? {}).every(([key, value]) => Object.hasOwn(effectTarget, key) && stable$2(value) === stable$2(effectTarget[key])) && Object.entries(binding.observedState ?? {}).every(([key, value]) => Object.hasOwn(effectObserved, key) && stable$2(value) === stable$2(effectObserved[key]))) || effectAction === action && (!tuplesEqual(binding.resolvedTarget, effectTarget) || !tuplesEqual(binding.observedState, effectObserved))) return { rejected: {
+	if (!(Object.entries(binding.resolvedTarget ?? {}).every(([key, value]) => Object.hasOwn(effectTarget, key) && stable$1(value) === stable$1(effectTarget[key])) && Object.entries(binding.observedState ?? {}).every(([key, value]) => Object.hasOwn(effectObserved, key) && stable$1(value) === stable$1(effectObserved[key]))) || effectAction === action && (!tuplesEqual(binding.resolvedTarget, effectTarget) || !tuplesEqual(binding.observedState, effectObserved))) return { rejected: {
 		itemId: item.id,
 		reason: "binding target does not match the cited effect evidence",
 		reasonCode: "binding_state_cross_pairing"
@@ -4828,7 +6476,7 @@ function certifyCheckpoint(projection, bindings, id, commit = true) {
 	if (projection.integrity !== "valid" || projection.hostStatus !== "supported") return {
 		status: "unknown",
 		contractRevision: projection.contractRevision,
-		openItems: openItems(projection),
+		openItems: certifiableOpenItems(projection).map((item) => item.id),
 		rejectedBindings: []
 	};
 	const rejectedBindings = [];
@@ -4860,6 +6508,16 @@ function certifyCheckpoint(projection, bindings, id, commit = true) {
 			});
 			continue;
 		}
+		const ancestorBlock = ancestorConstraintForBinding(projection, item, binding.resolvedTarget);
+		if (ancestorBlock) {
+			rejectedBindings.push({
+				itemId: item.id,
+				reason: ancestorBlock.kind === "prohibition" ? `an ancestor unit (${ancestorBlock.constraintUnitId}) holds prohibition ${ancestorBlock.constraintId} on this action and target` : `an ancestor unit (${ancestorBlock.constraintUnitId}) holds the unsatisfied condition ${ancestorBlock.constraintId} that reserves this action`,
+				reasonCode: ancestorBlock.reasonCode,
+				hint: closingHint(projection, item)
+			});
+			continue;
+		}
 		if (item.targetCaptureStatus === "clarification_required") {
 			rejectedBindings.push({
 				itemId: item.id,
@@ -4890,6 +6548,13 @@ function certifyCheckpoint(projection, bindings, id, commit = true) {
 			rejectedBindings.push(problem);
 			continue;
 		}
+		if (projection.policy === "strict") {
+			const strictProblem = strictProofProblem(projection, item, binding);
+			if (strictProblem) {
+				rejectedBindings.push(strictProblem);
+				continue;
+			}
+		}
 		if ((item.semanticAction ?? "generic_run") === "generic_run") {
 			rejectedBindings.push({
 				itemId: item.id,
@@ -4906,48 +6571,95 @@ function certifyCheckpoint(projection, bindings, id, commit = true) {
 		records.push(built.record);
 		referencedFacts.push(...citedEvidence(projection, binding).map(evidenceFact));
 	}
-	const open = openItems(projection).filter((itemId) => !bindings.some((binding) => binding.itemId === itemId));
+	const closure = certificateClosure(projection);
+	const open = closure.itemIds.filter((itemId) => !bindings.some((binding) => binding.itemId === itemId));
 	if (rejectedBindings.length || open.length) return {
 		status: "incomplete",
 		contractRevision: projection.contractRevision,
-		openItems: openItems(projection),
+		openItems: closure.itemIds,
 		rejectedBindings
 	};
+	if (projection.boundaryProtocol === 5 && closure.unitId === void 0) return {
+		status: "incomplete",
+		contractRevision: projection.contractRevision,
+		openItems: closure.itemIds,
+		rejectedBindings: [{
+			itemId: "*",
+			reason: "no current work unit is available for a v2 certificate",
+			reasonCode: "unit_unavailable"
+		}]
+	};
 	try {
 		const contractSha256 = currentContractDigest(projection);
-		const openDigest = digestStrings(openItems(projection));
+		const openDigest = digestStrings(closure.itemIds);
 		const evidenceSha256 = evidenceSha256Digest(referencedFacts);
 		const bindingDigest$1 = bindingDigest(records, resolveAllowlist("product"));
-		const certification = certificationDigest({
-			stopProtocolVersion: STOP_PROTOCOL_VERSION,
-			certificateVersion: CERTIFICATE_VERSION,
-			epoch: projection.epoch,
-			sessionRefDigest: projection.sessionRefDigest,
-			hostLockDigest: projection.hostLockDigest,
-			contractRevision: projection.contractRevision,
-			contractSha256,
-			...projection.currentGoalRef ? { goalRef: projection.currentGoalRef } : {},
-			openDigest,
-			evidenceSha256,
-			bindingDigest: bindingDigest$1
-		});
-		const checkpoint = {
-			id,
-			stopProtocolVersion: STOP_PROTOCOL_VERSION,
-			certificateVersion: CERTIFICATE_VERSION,
-			epoch: projection.epoch,
-			sessionRefDigest: projection.sessionRefDigest,
-			hostLockDigest: projection.hostLockDigest,
-			contractRevision: projection.contractRevision,
-			contractSha256,
-			openDigest,
-			evidenceSha256,
-			bindingDigest: bindingDigest$1,
-			bindings,
-			...projection.currentGoalRef ? { goalRef: { ...projection.currentGoalRef } } : {},
-			certificationDigest: certification,
-			result: "certified"
-		};
+		const checkpoint = projection.boundaryProtocol === 5 ? (() => {
+			const certification = certificationDigestV2({
+				stopProtocolVersion: STOP_PROTOCOL_VERSION_V2,
+				certificateVersion: CERTIFICATE_VERSION_V2,
+				epoch: projection.epoch,
+				sessionRefDigest: projection.sessionRefDigest,
+				hostLockDigest: projection.hostLockDigest,
+				contractRevision: projection.contractRevision,
+				contractSha256,
+				unitId: closure.unitId,
+				unitClosureDigest: openDigest,
+				evidenceSha256,
+				bindingDigest: bindingDigest$1,
+				goalRef: projection.currentGoalRef ?? null
+			});
+			return {
+				id,
+				stopProtocolVersion: STOP_PROTOCOL_VERSION_V2,
+				certificateVersion: CERTIFICATE_VERSION_V2,
+				epoch: projection.epoch,
+				sessionRefDigest: projection.sessionRefDigest,
+				hostLockDigest: projection.hostLockDigest,
+				contractRevision: projection.contractRevision,
+				contractSha256,
+				openDigest,
+				evidenceSha256,
+				bindingDigest: bindingDigest$1,
+				bindings,
+				...projection.currentGoalRef ? { goalRef: { ...projection.currentGoalRef } } : {},
+				unitId: closure.unitId,
+				unitClosureDigest: openDigest,
+				certificationDigest: certification,
+				result: "certified"
+			};
+		})() : (() => {
+			const certification = certificationDigest({
+				stopProtocolVersion: STOP_PROTOCOL_VERSION,
+				certificateVersion: CERTIFICATE_VERSION,
+				epoch: projection.epoch,
+				sessionRefDigest: projection.sessionRefDigest,
+				hostLockDigest: projection.hostLockDigest,
+				contractRevision: projection.contractRevision,
+				contractSha256,
+				...projection.currentGoalRef ? { goalRef: projection.currentGoalRef } : {},
+				openDigest,
+				evidenceSha256,
+				bindingDigest: bindingDigest$1
+			});
+			return {
+				id,
+				stopProtocolVersion: STOP_PROTOCOL_VERSION,
+				certificateVersion: CERTIFICATE_VERSION,
+				epoch: projection.epoch,
+				sessionRefDigest: projection.sessionRefDigest,
+				hostLockDigest: projection.hostLockDigest,
+				contractRevision: projection.contractRevision,
+				contractSha256,
+				openDigest,
+				evidenceSha256,
+				bindingDigest: bindingDigest$1,
+				bindings,
+				...projection.currentGoalRef ? { goalRef: { ...projection.currentGoalRef } } : {},
+				certificationDigest: certification,
+				result: "certified"
+			};
+		})();
 		if (commit) {
 			projection.checkpoints.push(checkpoint);
 			for (const binding of bindings) projection.items.get(binding.itemId).status = "passed";
@@ -4964,7 +6676,7 @@ function certifyCheckpoint(projection, bindings, id, commit = true) {
 		return {
 			status: "incomplete",
 			contractRevision: projection.contractRevision,
-			openItems: openItems(projection),
+			openItems: closure.itemIds,
 			rejectedBindings: [{
 				itemId: "*",
 				reason: error instanceof Error ? error.message : "certificate manifest rejected",
@@ -5056,9 +6768,6 @@ function bindingActionPlanProblem(projection, item, binding) {
 		}
 	}
 }
-function openItems(projection) {
-	return [...projection.items.values()].filter((item) => item.status === "pending" && item.kind !== "prohibition").map((item) => item.id);
-}
 
 //#endregion
 //#region src/domain/contract-segment.ts
@@ -7662,13 +9371,13 @@ function parseArguments$1(raw) {
 		return {};
 	}
 }
-function asRecord$1(value) {
+function asRecord$2(value) {
 	return typeof value === "object" && value !== null ? value : void 0;
 }
 function extractTextContent(content) {
 	const parts = [];
 	for (const block$1 of content) {
-		const record = asRecord$1(block$1);
+		const record = asRecord$2(block$1);
 		if (!record) continue;
 		if (record.type === "text" && typeof record.text === "string") parts.push(record.text);
 		if (record.type === "tool-result" && Array.isArray(record.content)) parts.push(extractTextContent(record.content));
@@ -7676,10 +9385,10 @@ function extractTextContent(content) {
 	return parts.join("\n");
 }
 function metaPaths(meta) {
-	const record = asRecord$1(meta);
+	const record = asRecord$2(meta);
 	if (!record) return [];
 	if (typeof record.path === "string") return [record.path];
-	if (Array.isArray(record.diffs)) return record.diffs.map((diff) => asRecord$1(diff)?.path).filter((path$1) => typeof path$1 === "string");
+	if (Array.isArray(record.diffs)) return record.diffs.map((diff) => asRecord$2(diff)?.path).filter((path$1) => typeof path$1 === "string");
 	return [];
 }
 function argsPaths(args) {
@@ -7693,24 +9402,24 @@ function resolveCommandPath(reference, cwd) {
 	if (/^[A-Za-z]:[\\/]/.test(reference) || reference.startsWith("//") || reference.startsWith("\\\\") || reference.startsWith("/") || reference.startsWith("\\")) return reference;
 	return `${cwd.replace(/[\\/]+$/, "")}/${reference}`;
 }
-function stable$1(value) {
-	if (Array.isArray(value)) return `[${value.map(stable$1).join(",")}]`;
-	if (value && typeof value === "object") return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stable$1(entry)}`).join(",")}}`;
+function stable(value) {
+	if (Array.isArray(value)) return `[${value.map(stable).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stable(entry)}`).join(",")}}`;
 	return JSON.stringify(value);
 }
 function structuredGuardMeta(meta, toolName) {
 	if (toolName !== "context_guard_evidence") return void 0;
-	const outer = asRecord$1(meta);
-	const value = asRecord$1(outer?.contextGuard ?? outer?.context_guard);
+	const outer = asRecord$2(meta);
+	const value = asRecord$2(outer?.contextGuard ?? outer?.context_guard);
 	if (!value) return void 0;
 	const action = value.semanticAction ?? value.semantic_action;
 	const role = value.evidenceRole ?? value.evidence_role;
-	const resolved = asRecord$1(value.resolvedTarget ?? value.resolved_target);
-	const observed = asRecord$1(value.observedState ?? value.observed_state);
-	const rawExpected = asRecord$1(value.expectedTransition);
-	const expectedParameters = asRecord$1(rawExpected?.parameters);
+	const resolved = asRecord$2(value.resolvedTarget ?? value.resolved_target);
+	const observed = asRecord$2(value.observedState ?? value.observed_state);
+	const rawExpected = asRecord$2(value.expectedTransition);
+	const expectedParameters = asRecord$2(rawExpected?.parameters);
 	const expectedDigest = value.expectedTransitionDigest;
-	const expectedTransition = rawExpected && typeof rawExpected.predicateId === "string" && rawExpected.version === 1 && rawExpected.predParamsKind === "inline" && expectedParameters && typeof expectedDigest === "string" && expectedDigest === sha256(stable$1(rawExpected)) ? rawExpected : void 0;
+	const expectedTransition = rawExpected && typeof rawExpected.predicateId === "string" && rawExpected.version === 1 && rawExpected.predParamsKind === "inline" && expectedParameters && typeof expectedDigest === "string" && expectedDigest === sha256(stable(rawExpected)) ? rawExpected : void 0;
 	if (typeof value.adapterId !== "string" || typeof value.adapterVersion !== "string") return void 0;
 	if (SUPPORTED_EVIDENCE_ADAPTERS[value.adapterId] !== value.adapterVersion) return void 0;
 	if (typeof action !== "string" || typeof role !== "string" || !resolved) return void 0;
@@ -7807,7 +9516,7 @@ const PERSISTENT_TIMEOUT_INTRO = /^Your command timed out after \d+ seconds or e
 * the fallback.
 */
 function structuredTerminalFacts(meta) {
-	const record = asRecord$1(meta);
+	const record = asRecord$2(meta);
 	if (!record) return void 0;
 	const rawExit = record.exitCode ?? record.exit_code;
 	const rawSignal = record.signal;
@@ -7858,10 +9567,10 @@ function extractTerminalFacts(textContent) {
 	};
 }
 function metaUrls(meta) {
-	const record = asRecord$1(meta);
+	const record = asRecord$2(meta);
 	if (!record) return [];
 	if (typeof record.url === "string") return [sanitizeUrl(record.url)];
-	if (Array.isArray(record.sources)) return record.sources.map((source) => asRecord$1(source)?.url).filter((url) => typeof url === "string").map((url) => sanitizeUrl(url));
+	if (Array.isArray(record.sources)) return record.sources.map((source) => asRecord$2(source)?.url).filter((url) => typeof url === "string").map((url) => sanitizeUrl(url));
 	return [];
 }
 const DETERMINISTIC_CHECK_PATTERNS = [
@@ -7918,7 +9627,7 @@ function resolveSubjectPaths(values, cwd) {
 function extractToolSubject(call, result, defaultCwd, hostLock) {
 	const args = parseArguments$1(call.arguments);
 	if (call.name === "context_guard_external_operation") {
-		const external = asRecord$1(asRecord$1(result.meta)?.contextGuardExternalOperation);
+		const external = asRecord$2(asRecord$2(result.meta)?.contextGuardExternalOperation);
 		const status = external?.status;
 		if (typeof external?.id === "string" && typeof external.adapterId === "string" && (status === "running" || status === "pending" || status === "completed" || status === "failed" || status === "unknown")) return {
 			capabilities: ["external-operation-readback"],
@@ -7949,7 +9658,7 @@ function extractToolSubject(call, result, defaultCwd, hostLock) {
 	}
 	const structured = structuredGuardMeta(result.meta, call.name);
 	if (call.name === "context_guard_evidence" && !structured) {
-		const disposition = asRecord$1(asRecord$1(result.meta)?.contextGuardDisposition);
+		const disposition = asRecord$2(asRecord$2(result.meta)?.contextGuardDisposition);
 		return {
 			capabilities: ["guard-state-readback"],
 			subjects: [],
@@ -8165,8 +9874,781 @@ function supersedeItem(items, oldId, replacement) {
 	return true;
 }
 
+//#endregion
+//#region src/domain/delivery.ts
+function assistantTextOf(data) {
+	return (data?.message?.content ?? []).filter((part) => part?.type === "text").map((part) => part?.text ?? "").join("\n");
+}
+function integerField(data, field$1) {
+	const value = data?.[field$1];
+	return typeof value === "number" && Number.isSafeInteger(value) ? value : void 0;
+}
+/**
+* Derive the trusted deliveries from the event log. Deterministic: a replay of
+* identical events yields identical facts.
+*/
+function deriveTrustedDeliveries(events) {
+	const turns = /* @__PURE__ */ new Map();
+	const factsFor = (turn) => {
+		let facts = turns.get(turn);
+		if (!facts) {
+			facts = {
+				started: false,
+				steps: /* @__PURE__ */ new Set(),
+				assistants: [],
+				ends: []
+			};
+			turns.set(turn, facts);
+		}
+		return facts;
+	};
+	for (const event of events) switch (event.type) {
+		case "turn/start": {
+			const turn = integerField(event.data, "turn");
+			if (turn !== void 0) factsFor(turn).started = true;
+			break;
+		}
+		case "step/start":
+		case "step/end": {
+			const turn = integerField(event.data, "turn");
+			const step = integerField(event.data, "step");
+			if (turn !== void 0 && step !== void 0) factsFor(turn).steps.add(step);
+			break;
+		}
+		case "assistant/message": {
+			const turn = integerField(event.data, "turn");
+			const step = integerField(event.data, "step");
+			if (turn === void 0 || step === void 0) break;
+			const facts = factsFor(turn);
+			facts.steps.add(step);
+			facts.assistants.push({
+				seq: event.seq,
+				step,
+				text: assistantTextOf(event.data),
+				interrupted: event.data?.interrupted === true
+			});
+			break;
+		}
+		case "turn/end": {
+			const turn = integerField(event.data, "turn");
+			if (turn === void 0) break;
+			const reason = event.data?.reason;
+			factsFor(turn).ends.push({
+				seq: event.seq,
+				kind: typeof reason?.kind === "string" ? reason.kind : ""
+			});
+			break;
+		}
+		default: break;
+	}
+	const deliveries = [];
+	for (const [turn, facts] of turns) {
+		if (!facts.started) continue;
+		if (facts.ends.length !== 1) continue;
+		const end = facts.ends[0];
+		if (end.kind !== "completed") continue;
+		if (facts.steps.size === 0) continue;
+		const finalStep = Math.max(...facts.steps);
+		const inFinalStep = facts.assistants.filter((row) => row.step === finalStep && row.seq < end.seq && !row.interrupted && row.text.trim().length > 0);
+		if (inFinalStep.length === 0) continue;
+		const final = inFinalStep.reduce((left, right) => right.seq > left.seq ? right : left);
+		if (facts.assistants.some((row) => row.seq > final.seq && row.seq < end.seq)) continue;
+		deliveries.push({
+			turn,
+			turnEndSeq: end.seq,
+			responseSeq: final.seq,
+			responseSha256: sha256(final.text)
+		});
+	}
+	return deliveries.sort((left, right) => left.turnEndSeq - right.turnEndSeq);
+}
+/**
+* The information-slot items a delivery closes: obligations captured from a
+* root message inside the delivered turn, in the unit that turn's input
+* belonged to (or in one of that unit's delegated sub-units), whose semantic
+* slot is information (an inquiry or an explanation request). Execution,
+* constraints, and unknowns are never closed by delivery, and neither are
+* questions from earlier messages.
+*
+* An ATTACHMENT obligation (one with an `asset` identity) closes through its
+* CURRENT interpretation instead of its original message (0.6.1 W060-01
+* review): a re-interpreted old asset would otherwise never close, because
+* its root message can no longer belong to a live turn. The binding is the
+* interpretation fact itself — the delivery must be the answer of the turn
+* that recorded the interpretation, and the fact must exist at the delivery
+* watermark. The final answer — even a real one — still never interprets
+* images on the model's behalf.
+*/
+function informationItemIdsForDelivery(items, delivery, turnRootInputSeqs, eligibleUnitIds, interpretationFacts) {
+	const closed = [];
+	for (const [itemId, item] of items) {
+		if (item.status !== "pending") continue;
+		if (item.kind === "prohibition") continue;
+		const isAssetObligation = item.asset !== void 0 && item.asset !== null;
+		if (item.unitId !== void 0 && eligibleUnitIds !== void 0 && !eligibleUnitIds.has(item.unitId)) continue;
+		const informationSlot = item.taskKind === "inquiry" || item.authorityDisposition === "informational" && item.kind === "requirement";
+		item.asset !== void 0 && item.asset;
+		if (isAssetObligation) {
+			if (!(interpretationFacts ?? []).some((fact) => fact.itemId === itemId && fact.turn === delivery.turn && fact.resultSeq <= delivery.turnEndSeq)) continue;
+			closed.push(itemId);
+			continue;
+		}
+		if (informationSlot) {
+			const interpretedThisTurn = (interpretationFacts ?? []).some((fact) => fact.itemId === itemId && fact.turn === delivery.turn && fact.resultSeq <= delivery.turnEndSeq);
+			const sourceSeq = /^m(\d+)(?::|$)/.exec(item.sourceMessageId);
+			if (!interpretedThisTurn && (!sourceSeq || !turnRootInputSeqs.has(Number(sourceSeq[1])))) continue;
+			closed.push(itemId);
+			continue;
+		}
+	}
+	return closed;
+}
+
+//#endregion
+//#region src/domain/host-selection.ts
+/**
+* The default question-tool allowlist. The real names are a host tool-bundle
+* surface: native acceptance pins the audited names for the running cohort,
+* and the runtime may override this list per cohort.
+*/
+const DEFAULT_QUESTION_TOOL_NAMES = ["question", "ask_user"];
+function parseQuestionCall(rawArguments) {
+	if (typeof rawArguments !== "string") return void 0;
+	let args;
+	try {
+		args = JSON.parse(rawArguments);
+	} catch {
+		return;
+	}
+	if (!args || typeof args !== "object" || Array.isArray(args)) return void 0;
+	const record = args;
+	const rawOptions = record.options ?? record.choices;
+	if (!Array.isArray(rawOptions) || rawOptions.length === 0) return void 0;
+	const options = [];
+	for (const entry of rawOptions) {
+		if (typeof entry !== "string" || !entry.trim()) return void 0;
+		options.push(entry.trim());
+	}
+	return {
+		questionId: typeof record.question_id === "string" ? record.question_id : typeof record.questionId === "string" ? record.questionId : void 0,
+		question: typeof record.question === "string" ? record.question : void 0,
+		options
+	};
+}
+function parseSelectionAnswer(content, options) {
+	if (!Array.isArray(content)) return void 0;
+	const text = content.filter((part) => !!part && typeof part === "object").filter((part) => part.type === "text").map((part) => part.text ?? "").join("\n");
+	if (!text.trim()) return void 0;
+	const trimmed = text.trim();
+	if (options.includes(trimmed)) return trimmed;
+	try {
+		const parsed = JSON.parse(trimmed);
+		const answer = parsed.answer ?? parsed.selected ?? parsed.value;
+		if (typeof answer === "string" && options.includes(answer.trim())) return answer.trim();
+	} catch {}
+}
+function looksLikeDirectory(value) {
+	return /^[~.]?(?:[\\/][^\n]*)+$/.test(value);
+}
+/**
+* Derive the trusted selections from the durable log. Deterministic: a replay
+* of identical events yields identical selections.
+*/
+function deriveTrustedSelections(events, options) {
+	const names = new Set(options.questionToolNames);
+	const pending = /* @__PURE__ */ new Map();
+	const selections = [];
+	for (const event of events) {
+		if (event.type === "tool/call") {
+			const data$1 = event.data ?? {};
+			const name = String(data$1.name ?? "");
+			if (!names.has(name)) continue;
+			const shape = parseQuestionCall(data$1.arguments);
+			if (!shape) continue;
+			pending.set(String(data$1.callId ?? ""), {
+				callId: String(data$1.callId ?? ""),
+				seq: event.seq,
+				turn: typeof data$1.turn === "number" ? data$1.turn : void 0,
+				toolName: name,
+				shape
+			});
+			continue;
+		}
+		if (event.type !== "tool/result") continue;
+		const data = event.data ?? {};
+		const callId = String(data.message?.source?.callId ?? "");
+		const call = pending.get(callId);
+		if (!call) continue;
+		pending.delete(callId);
+		if (data.error !== void 0) continue;
+		const selected = parseSelectionAnswer(data.message?.content, call.shape.options);
+		if (!selected) continue;
+		selections.push({
+			callId,
+			resultSeq: event.seq,
+			turn: call.turn,
+			toolName: call.toolName,
+			questionId: call.shape.questionId,
+			question: call.shape.question,
+			options: call.shape.options,
+			selected,
+			kind: looksLikeDirectory(selected) ? "directory" : "value"
+		});
+	}
+	return selections;
+}
+
+//#endregion
+//#region src/domain/release.ts
+/**
+* Explicit release adoption and single-use tickets (0.6.0 C10 / DS06-F).
+*
+* A release is never implicit. "release", a loaded Skill, or an installation
+* never activates this profile: a root user must explicitly ADOPT a release
+* contract that names the exact candidate, and every effect must then match
+* that contract and spend a one-shot reservation.
+*
+* Three durable records carry the state machine (P0 §5), all written through
+* the plugin-notice channel the host already persists:
+*
+* - `contract`    — the adopted scope: operations, the exact candidate, the
+*                   readiness/closure references and an optional expiry.
+* - `reservation` — written BEFORE any effect; the operation is `in_flight`
+*                   from that moment, so a crash cannot be mistaken for "never
+*                   started" and the operation is never blindly re-sent.
+* - `settlement`  — written after the effect. Its outcome distinguishes a
+*                   PROVEN no-effect (`not_effected`, which releases the lock)
+*                   from an UNKNOWN effect (`unknown`/`failed`/`unconfirmed`,
+*                   which keeps the lock until a trusted readback reconciles
+*                   it) and from a `settled` release.
+*
+* CANDIDATE IDENTITY IS TYPED, NOT CONFLATED. A release artifact has several
+* genuinely different identities — the commit it was built from, the SHA-256 of
+* the exact bytes, npm's SHA-512 SRI, the package name, the version, the
+* repository, the ref and the target registry. Each is a separate field and is
+* compared with its own observed value read from a trusted producer. Comparing,
+* say, a 64-hex SHA-256 against an SRI can never succeed, so a legitimate
+* release would have been permanently refused; and accepting a model-supplied
+* SHA instead of the artifact's embedded one would bind nothing. Every field
+* the contract declares must be OBSERVED, so omitting evidence is a refusal,
+* never a bypass.
+*
+* COVERAGE SURFACE (frozen wording): only the surfaces Guard itself routes can
+* be protected. Operations with no Guard execution surface are refused before
+* any effect, and the plugin never suggests falling back to a plain shell
+* command. A trusted in-process caller that bypasses Guard entirely is a host
+* trust boundary and is disclosed as such in the documentation, not pretended
+* away.
+*/
+const RELEASE_CONTRACT_PREFIX = "Context Guard release contract v1: ";
+const RELEASE_RESERVATION_PREFIX = "Context Guard release reservation v1: ";
+const RELEASE_SETTLEMENT_PREFIX = "Context Guard release settlement v1: ";
+const RELEASE_REVOCATION_PREFIX = "Context Guard release revocation v1: ";
+const RELEASE_OPERATIONS = [
+	"npm_publish",
+	"git_tag",
+	"github_release_create",
+	"github_release_update",
+	"github_release_delete",
+	"composite_runner"
+];
+/**
+* The routing table for this release. `git_tag` and the GitHub Release
+* operations have no Guard-owned execution route yet; the coordinator
+* explicitly approved that staged scope reduction on 2026-09-14, and the new
+* route is the way each of them becomes protectable. A composite runner stays
+* opaque by construction.
+*/
+const RELEASE_OPERATION_SURFACES = {
+	npm_publish: {
+		surface: "context_guard_action",
+		protectable: true,
+		reasonCode: "release_operation_protectable",
+		attribution: "implemented"
+	},
+	git_tag: {
+		surface: "none",
+		protectable: false,
+		reasonCode: "release_operation_unrouted",
+		attribution: "scope_reduction"
+	},
+	github_release_create: {
+		surface: "none",
+		protectable: false,
+		reasonCode: "release_operation_unrouted",
+		attribution: "scope_reduction"
+	},
+	github_release_update: {
+		surface: "none",
+		protectable: false,
+		reasonCode: "release_operation_unrouted",
+		attribution: "scope_reduction"
+	},
+	github_release_delete: {
+		surface: "none",
+		protectable: false,
+		reasonCode: "release_operation_unrouted",
+		attribution: "scope_reduction"
+	},
+	composite_runner: {
+		surface: "none",
+		protectable: false,
+		reasonCode: "release_runner_opaque",
+		attribution: "host_boundary"
+	}
+};
+const FULL_SHA40 = /^[0-9a-f]{40}$/;
+const SHA256 = /^[0-9a-f]{64}$/;
+const SRI = /^sha(?:256|384|512)-[A-Za-z0-9+/]+={0,2}$/;
+/**
+* How strongly an outcome resolves the reservation. A `settled` release is
+* never downgraded by a later record, while a stronger record reconciles a
+* weaker one — that is how a trusted readback recovers an earlier unconfirmed
+* attempt instead of being discarded.
+*/
+const OUTCOME_STRENGTH = {
+	not_effected: 0,
+	unknown: 1,
+	failed: 1,
+	unconfirmed: 2,
+	settled: 3
+};
+function asRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function optionalString(value) {
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+/**
+* Normalize a candidate release contract from a root adoption payload. Every
+* field is validated: an unparsable or partial adoption is refused rather than
+* approximated, because a half-specified contract would authorize an
+* unspecified candidate.
+*/
+function normalizeReleaseContract(raw, adoptedBy, adoptedAtRevision = 0) {
+	const errors = [];
+	const value = asRecord$1(raw);
+	if (!value) return { errors: ["release_contract_malformed"] };
+	const operations = [];
+	if (!Array.isArray(value.operations) || value.operations.length === 0) errors.push("release_operations_missing");
+	else for (const entry of value.operations) {
+		if (typeof entry !== "string" || !RELEASE_OPERATIONS.includes(entry)) {
+			errors.push("release_operation_unknown");
+			continue;
+		}
+		const operation = entry;
+		if (!RELEASE_OPERATION_SURFACES[operation].protectable) {
+			errors.push(RELEASE_OPERATION_SURFACES[operation].reasonCode);
+			continue;
+		}
+		if (!operations.includes(operation)) operations.push(operation);
+	}
+	const candidate = asRecord$1(value.candidate);
+	if (!candidate) errors.push("release_candidate_missing");
+	const CANDIDATE_FIELDS = [
+		"fullSha40",
+		"ref",
+		"repository",
+		"packageId",
+		"version",
+		"artifactSha256",
+		"artifactSri",
+		"registry",
+		"artifactDigest"
+	];
+	for (const key of Object.keys(candidate ?? {})) if (!CANDIDATE_FIELDS.includes(key)) errors.push("release_candidate_field_unknown");
+	const fullSha40 = optionalString(candidate?.fullSha40) ?? "";
+	if (!FULL_SHA40.test(fullSha40)) errors.push("release_candidate_sha_invalid");
+	const ref = optionalString(candidate?.ref);
+	const repository = optionalString(candidate?.repository);
+	const packageId = optionalString(candidate?.packageId);
+	const version = optionalString(candidate?.version);
+	let artifactSha256 = optionalString(candidate?.artifactSha256);
+	let artifactSri = optionalString(candidate?.artifactSri);
+	const legacyDigest = optionalString(candidate?.artifactDigest);
+	if (legacyDigest !== void 0) if (SHA256.test(legacyDigest)) artifactSha256 ??= legacyDigest;
+	else if (SRI.test(legacyDigest)) artifactSri ??= legacyDigest;
+	else errors.push("release_candidate_artifact_digest_invalid");
+	const registry = optionalString(candidate?.registry);
+	if (artifactSha256 !== void 0 && !SHA256.test(artifactSha256)) errors.push("release_candidate_sha256_invalid");
+	if (artifactSri !== void 0 && !SRI.test(artifactSri)) errors.push("release_candidate_sri_invalid");
+	const readinessRefs = Array.isArray(value.readinessRefs) ? value.readinessRefs.filter((entry) => typeof entry === "string" && entry.length > 0) : [];
+	const closureCertRef = optionalString(value.closureCertRef);
+	let expiresAtEpochMs;
+	if (value.expiresAtEpochMs !== void 0) if (typeof value.expiresAtEpochMs !== "number" || !Number.isSafeInteger(value.expiresAtEpochMs) || value.expiresAtEpochMs <= 0) errors.push("release_expiry_invalid");
+	else expiresAtEpochMs = value.expiresAtEpochMs;
+	if (errors.length) return { errors: [...new Set(errors)] };
+	const suppliedId = optionalString(value.contractId);
+	const body = {
+		operations: [...operations].sort(),
+		candidate: {
+			fullSha40,
+			...ref ? { ref } : {},
+			...repository ? { repository } : {},
+			...packageId ? { packageId } : {},
+			...version ? { version } : {},
+			...artifactSha256 ? { artifactSha256 } : {},
+			...artifactSri ? { artifactSri } : {},
+			...registry ? { registry } : {}
+		},
+		readinessRefs: [...readinessRefs].sort(),
+		...closureCertRef ? { closureCertRef } : {},
+		...expiresAtEpochMs !== void 0 ? { expiresAtEpochMs } : {}
+	};
+	return {
+		contract: {
+			contractId: suppliedId ?? `rel-${sha256(JSON.stringify(body)).slice(0, 16)}`,
+			adoptedBy,
+			adoptedAtRevision,
+			operations: operations.sort(),
+			candidate: body.candidate,
+			readinessRefs: body.readinessRefs,
+			...closureCertRef ? { closureCertRef } : {},
+			...expiresAtEpochMs !== void 0 ? { expiresAtEpochMs } : {}
+		},
+		errors: []
+	};
+}
+function normalizeReservation(raw) {
+	const value = asRecord$1(raw);
+	if (!value) return void 0;
+	const contractId = optionalString(value.contractId);
+	const operation = optionalString(value.operation);
+	const callId = optionalString(value.callId);
+	const startedAtSeq = value.startedAtSeq;
+	if (!contractId || !callId) return void 0;
+	if (!operation || !RELEASE_OPERATIONS.includes(operation)) return void 0;
+	if (typeof startedAtSeq !== "number" || !Number.isSafeInteger(startedAtSeq)) return void 0;
+	const observedArtifactSri = optionalString(value.observedArtifactSri);
+	return {
+		contractId,
+		operation,
+		callId,
+		startedAtSeq,
+		status: "in_flight",
+		...observedArtifactSri ? { observedArtifactSri } : {}
+	};
+}
+const RELEASE_OUTCOMES = [
+	"settled",
+	"unconfirmed",
+	"unknown",
+	"failed",
+	"not_effected"
+];
+function normalizeSettlement(raw) {
+	const value = asRecord$1(raw);
+	if (!value) return void 0;
+	const contractId = optionalString(value.contractId);
+	const operation = optionalString(value.operation);
+	const callId = optionalString(value.callId);
+	const settledAtSeq = value.settledAtSeq;
+	const outcome = optionalString(value.outcome);
+	if (!contractId || !callId) return void 0;
+	if (!operation || !RELEASE_OPERATIONS.includes(operation)) return void 0;
+	if (typeof settledAtSeq !== "number" || !Number.isSafeInteger(settledAtSeq)) return void 0;
+	if (!outcome || !RELEASE_OUTCOMES.includes(outcome)) return void 0;
+	const readbackRaw = asRecord$1(value.readback);
+	const kind = readbackRaw?.kind;
+	return {
+		contractId,
+		operation,
+		callId,
+		settledAtSeq,
+		readback: readbackRaw && (kind === "npm_integrity" || kind === "git_ref" || kind === "github_release") && optionalString(readbackRaw.identity) ? {
+			kind,
+			identity: optionalString(readbackRaw.identity)
+		} : "unavailable",
+		outcome
+	};
+}
+/** The adopted, not-revoked contract that covers an operation, newest first. */
+function releaseContractFor(projection, operation, contractId) {
+	const contracts = projection.releaseContracts.filter((contract) => contract.revokedAtSeq === void 0 && (contractId === void 0 || contract.contractId === contractId) && contract.operations.includes(operation));
+	return contracts.length ? contracts[contracts.length - 1] : void 0;
+}
+/** Whether a contract was explicitly revoked by a durable root command. */
+function isContractRevoked(projection, contractId) {
+	return projection.releaseContracts.some((contract) => contract.contractId === contractId && contract.revokedAtSeq !== void 0);
+}
+/**
+* The reconciled settlement per (contract, operation, callId): the strongest
+* outcome wins, ties resolve to the later record. A `settled` release is never
+* revoked by a later weaker record.
+*/
+function reconciledSettlements(projection, contractId, operation) {
+	const byCall = /* @__PURE__ */ new Map();
+	for (const settlement of projection.releaseSettlements) {
+		if (settlement.contractId !== contractId || settlement.operation !== operation) continue;
+		const existing = byCall.get(settlement.callId);
+		if (!existing) {
+			byCall.set(settlement.callId, settlement);
+			continue;
+		}
+		const stronger = OUTCOME_STRENGTH[settlement.outcome] > OUTCOME_STRENGTH[existing.outcome];
+		const newer = OUTCOME_STRENGTH[settlement.outcome] === OUTCOME_STRENGTH[existing.outcome] && settlement.settledAtSeq >= existing.settledAtSeq;
+		if (stronger || newer) byCall.set(settlement.callId, settlement);
+	}
+	return [...byCall.values()];
+}
+/** Whether a settlement releases the one-shot lock: settled, or proven no-effect. */
+function releasesLock(settlement) {
+	return settlement.outcome === "settled" || settlement.outcome === "not_effected";
+}
+/** The in-flight (unresolved) reservation for one contract operation, if any. */
+function inFlightReservation(projection, contractId, operation) {
+	const settled = reconciledSettlements(projection, contractId, operation);
+	for (const reservation of projection.releaseReservations) {
+		if (reservation.contractId !== contractId || reservation.operation !== operation) continue;
+		const resolution = settled.find((settlement) => settlement.callId === reservation.callId);
+		if (!resolution || !releasesLock(resolution)) return reservation;
+	}
+}
+/** Whether a contract operation has already been consumed by a settled effect. */
+function settledOperations(projection, contractId) {
+	const consumed = [];
+	for (const settlement of projection.releaseSettlements) {
+		if (settlement.contractId !== contractId) continue;
+		if (settlement.outcome !== "settled") continue;
+		if (!consumed.includes(settlement.operation)) consumed.push(settlement.operation);
+	}
+	return consumed.sort();
+}
+const CANDIDATE_FIELD_CODES = [
+	{
+		field: "fullSha40",
+		label: "commit",
+		unresolvedCode: "release_candidate_sha_unresolved",
+		mismatchCode: "release_candidate_sha_mismatch"
+	},
+	{
+		field: "ref",
+		label: "ref",
+		unresolvedCode: "release_candidate_ref_unresolved",
+		mismatchCode: "release_candidate_ref_mismatch"
+	},
+	{
+		field: "repository",
+		label: "repository",
+		unresolvedCode: "release_candidate_repository_unresolved",
+		mismatchCode: "release_candidate_repository_mismatch"
+	},
+	{
+		field: "packageId",
+		label: "package",
+		unresolvedCode: "release_candidate_package_unresolved",
+		mismatchCode: "release_candidate_package_mismatch"
+	},
+	{
+		field: "version",
+		label: "version",
+		unresolvedCode: "release_candidate_version_unresolved",
+		mismatchCode: "release_candidate_version_mismatch"
+	},
+	{
+		field: "artifactSha256",
+		label: "artifact SHA-256",
+		unresolvedCode: "release_artifact_sha256_unresolved",
+		mismatchCode: "release_candidate_artifact_mismatch"
+	},
+	{
+		field: "artifactSri",
+		label: "artifact SRI",
+		unresolvedCode: "release_artifact_sri_unresolved",
+		mismatchCode: "release_candidate_artifact_sri_mismatch"
+	},
+	{
+		field: "registry",
+		label: "registry",
+		unresolvedCode: "release_candidate_registry_unresolved",
+		mismatchCode: "release_candidate_registry_mismatch"
+	}
+];
+/** A readiness reference resolves to a real, already-established fact. */
+function readinessResolves(projection, ref) {
+	if (projection.checkpoints.some((checkpoint) => checkpoint.id === ref && checkpoint.result === "certified")) return true;
+	if (projection.boundaries.some((boundary) => boundary.id === ref)) return true;
+	return projection.items.get(ref)?.status === "passed";
+}
+/**
+* The pre-effect release decision. Order matters: an unprotectable surface and
+* a damaged release state are refused before expiry or candidate checks,
+* because running an unprotected operation is never made acceptable by a valid
+* ticket, and because unreadable release state must not authorize anything.
+*/
+function releasePreEffectDecision(projection, request) {
+	const surface = RELEASE_OPERATION_SURFACES[request.operation];
+	if (!surface.protectable) return {
+		status: "denied",
+		reasonCode: surface.reasonCode
+	};
+	if (projection.releaseStateDamaged) return {
+		status: "denied",
+		reasonCode: "release_state_damaged"
+	};
+	const contract = releaseContractFor(projection, request.operation, request.contractId);
+	if (!contract) {
+		if (projection.releaseContracts.some((entry) => entry.revokedAtSeq !== void 0 && entry.operations.includes(request.operation) && (request.contractId === void 0 || entry.contractId === request.contractId))) return {
+			status: "denied",
+			reasonCode: "release_contract_revoked"
+		};
+		if (request.contractId !== void 0 && isContractRevoked(projection, request.contractId)) return {
+			status: "denied",
+			reasonCode: "release_contract_revoked"
+		};
+		return {
+			status: "denied",
+			reasonCode: projection.releaseContracts.length === 0 ? "release_contract_required" : "release_operation_not_adopted"
+		};
+	}
+	if (contract.expiresAtEpochMs !== void 0) {
+		if (request.nowEpochMs === void 0) return {
+			status: "denied",
+			reasonCode: "release_expiry_unevaluable",
+			contractId: contract.contractId
+		};
+		if (request.nowEpochMs >= contract.expiresAtEpochMs) return {
+			status: "denied",
+			reasonCode: "release_contract_expired",
+			contractId: contract.contractId
+		};
+	}
+	if (settledOperations(projection, contract.contractId).includes(request.operation)) return {
+		status: "denied",
+		reasonCode: "release_operation_consumed",
+		contractId: contract.contractId
+	};
+	if (inFlightReservation(projection, contract.contractId, request.operation)) return {
+		status: "denied",
+		reasonCode: "release_operation_in_flight",
+		contractId: contract.contractId
+	};
+	for (const ref of contract.readinessRefs) if (!readinessResolves(projection, ref)) return {
+		status: "denied",
+		reasonCode: "release_readiness_unresolved",
+		contractId: contract.contractId
+	};
+	const frozen = contract.frozenClosure;
+	const closure = frozen !== void 0 ? projection.checkpoints.find((checkpoint) => checkpoint.id === frozen.id) : void 0;
+	if (!frozen || frozen.contractRevision !== contract.adoptedAtRevision || frozen.id !== contract.closureCertRef || !closure || closure.result !== "certified" || closure.certificationDigest !== frozen.certificationDigest || closure.epoch !== projection.epoch) return {
+		status: "denied",
+		reasonCode: "release_closure_unresolved",
+		contractId: contract.contractId
+	};
+	if (contract.candidate.artifactSha256 === void 0 && contract.candidate.artifactSri === void 0) return {
+		status: "denied",
+		reasonCode: "release_artifact_identity_required",
+		contractId: contract.contractId
+	};
+	const candidate = contract.candidate;
+	const observedIdentity = request.observed ?? {};
+	const compared = [];
+	for (const entry of CANDIDATE_FIELD_CODES) {
+		const declared = candidate[entry.field];
+		if (typeof declared !== "string") continue;
+		compared.push([entry, declared]);
+	}
+	for (const [entry, declared] of compared) {
+		const observed = observedIdentity[entry.field];
+		if (observed === void 0) return {
+			status: "denied",
+			reasonCode: entry.unresolvedCode,
+			contractId: contract.contractId
+		};
+		if (observed !== declared) return {
+			status: "denied",
+			reasonCode: entry.mismatchCode,
+			contractId: contract.contractId
+		};
+	}
+	if (candidate.ref !== void 0 && observedIdentity.refSha !== void 0 && observedIdentity.fullSha40 !== void 0 && observedIdentity.refSha !== observedIdentity.fullSha40) return {
+		status: "denied",
+		reasonCode: "release_ref_commit_mismatch",
+		contractId: contract.contractId
+	};
+	const resolved = request.resolvedTarget;
+	if (resolved === void 0) return {
+		status: "denied",
+		reasonCode: "release_target_unresolved",
+		contractId: contract.contractId
+	};
+	if (resolved.version === void 0) return {
+		status: "denied",
+		reasonCode: "release_target_unresolved",
+		contractId: contract.contractId
+	};
+	if (candidate.packageId !== void 0 && resolved.artifact_id !== candidate.packageId) return {
+		status: "denied",
+		reasonCode: "release_target_package_mismatch",
+		contractId: contract.contractId
+	};
+	if (candidate.version !== void 0 && resolved.version !== candidate.version) return {
+		status: "denied",
+		reasonCode: "release_target_version_mismatch",
+		contractId: contract.contractId
+	};
+	if (candidate.registry !== void 0 && resolved.registry !== candidate.registry) return {
+		status: "denied",
+		reasonCode: "release_target_registry_mismatch",
+		contractId: contract.contractId
+	};
+	return {
+		status: "granted",
+		reasonCode: "release_contract_granted",
+		contractId: contract.contractId
+	};
+}
+/**
+* Whether a trusted readback settles the attempt: the readback must name the
+* SAME artifact identity the contract froze. A registry that answers with a
+* different integrity proves the wrong bytes are published, which is an
+* unknown outcome for this contract, never a settlement.
+*/
+function readbackSettlesContract(contract, readback, reservationSri) {
+	if (readback === "unavailable") return "unconfirmed";
+	if (readback.kind !== "npm_integrity") return "unconfirmed";
+	const expected = contract.candidate.artifactSri ?? reservationSri;
+	if (expected === void 0) return "unconfirmed";
+	return readback.identity === expected ? "settled" : "mismatch";
+}
+/**
+* The reservation for one call, including revoked contracts: reconciling an
+* operation that was already in flight when its contract was revoked is the
+* recovery case, not an authority question.
+*/
+function reservationFor(projection, contractId, callId) {
+	return projection.releaseReservations.find((entry) => entry.contractId === contractId && entry.callId === callId);
+}
+/** A contract by id, INCLUDING revoked ones, for recovery lookups. */
+function contractById(projection, contractId) {
+	return projection.releaseContracts.find((entry) => entry.contractId === contractId);
+}
+/** The coverage report for one contract: which adopted operations Guard can protect. */
+function releaseCoverage(contract) {
+	return [...contract.operations].sort().map((operation) => ({
+		operation,
+		...RELEASE_OPERATION_SURFACES[operation]
+	}));
+}
+
 //#endregion
 //#region src/domain/derive.ts
+/**
+* Audited delegation tool names (C04/DS06-B). A tool result from one of these
+* is a subagent's answer: bounded evidence for the unit that asked for it, and
+* never a parent completion. The real names are a host tool-bundle surface —
+* native acceptance pins the audited cohort, exactly like the question-tool
+* allowlist — so this list is the production default and can be overridden by
+* an audited cohort.
+*/
+const DEFAULT_DELEGATION_TOOL_NAMES = [
+	"task",
+	"delegate",
+	"delegate_task",
+	"subagent",
+	"subagent_fork",
+	"spawn_agent"
+];
 const CAPTURE_V042_NOTICE = "Context Guard capture boundary: v0.4.2";
 const PROTOCOL_V3_NOTICE = "Context Guard protocol boundary: v3.0.0";
 /**
@@ -8177,6 +10659,15 @@ const PROTOCOL_V3_NOTICE = "Context Guard protocol boundary: v3.0.0";
 * their historical meaning for replay.
 */
 const PROTOCOL_V4_NOTICE = "Context Guard protocol boundary: v4.0.0";
+/**
+* 0.6.0 first-step boundary: same placement discipline as v4. It cuts the
+* work-unit, delivery, and certificate-v2 semantics (P0 §1): messages before
+* it keep their historical rules, messages after it are captured into work
+* units and close through unit-closure certificates and trusted deliveries.
+* An old binary ignores this notice (plugin source, unmatched pattern), so the
+* fail direction on rollback is closed, never a misread.
+*/
+const PROTOCOL_V5_NOTICE = "Context Guard protocol boundary: v5.0.0";
 function isProtocolBoundaryNotice(event, notice = PROTOCOL_V3_NOTICE) {
 	if (event.type !== "user/message") return false;
 	const data = asRecord(event.data);
@@ -8196,6 +10687,213 @@ function parseArguments(raw) {
 function asRecord(value) {
 	return typeof value === "object" && value !== null ? value : void 0;
 }
+/** Stable JSON, used for the release adoption digest. */
+function stableJson(value) {
+	if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+/**
+* Bounded release diagnostic ledger (last 16 entries). A rejected record also
+* marks the release state damaged: an unreadable reservation, settlement or
+* contract must block release operations rather than being silently forgotten,
+* and it must not touch the projection's own integrity, which governs ordinary
+* work.
+*/
+function pushReleaseDiagnostic(projection, seq, reasonCode, damaging = false) {
+	if (damaging) projection.releaseStateDamaged = true;
+	if (projection.releaseDiagnostics.some((entry) => entry.seq === seq && entry.reasonCode === reasonCode)) return;
+	projection.releaseDiagnostics.push({
+		seq,
+		reasonCode
+	});
+	if (projection.releaseDiagnostics.length > 16) projection.releaseDiagnostics.shift();
+}
+function assetReceiptMatches(receipt, asset) {
+	const record = asRecord(receipt);
+	return record !== void 0 && record.message_seq === asset.messageSeq && record.part_index === asset.partIndex && record.media_sha256 === asset.mediaSha256;
+}
+/**
+* Atomically supersede one unresolved clause by its recorded interpretation
+* partition (0.6.1 review round 10). Every declared sub-span becomes its own
+* obligation bound to the exact sub-span: information sub-spans become
+* delivery-closable informational obligations; declared-unknown and
+* undeclared sub-spans become pending unresolved obligations that keep the
+* clause's execution and unknown demands open. Returns the ids of the
+* created information sub-items.
+*/
+function supersedeClauseByPartition(projection, item, receipt) {
+	const extent = itemExtentOf(item);
+	const information = readPartitionSpans(receipt.information_spans);
+	const unknown = readPartitionSpans(receipt.unknown_spans);
+	if (!information || !unknown) return [];
+	for (const span of [...information, ...unknown]) if (span.start < extent.start || span.end > extent.end) return [];
+	const ordered = [...information, ...unknown].sort((left, right) => left.start - right.start || left.end - right.end);
+	for (let index = 1; index < ordered.length; index += 1) if (ordered[index].start < ordered[index - 1].end) return [];
+	const complement = [];
+	let cursor = extent.start;
+	for (const span of ordered) {
+		if (span.start > cursor) complement.push({
+			start: cursor,
+			end: span.start
+		});
+		cursor = Math.max(cursor, span.end);
+	}
+	if (cursor < extent.end) complement.push({
+		start: cursor,
+		end: extent.end
+	});
+	const partIndex = (item.spans ?? [])[0]?.partIndex ?? 0;
+	const rawTextSha256 = item.rawTextSha256;
+	const revisionBase = projection.contractRevision;
+	const informationIds = [];
+	const makeSubItem = (span, informational, offset$1) => {
+		const revision = revisionBase + 1 + offset$1;
+		const kind = "requirement";
+		const id = `${informational ? "R" : "R"}${nextNumericId(projection.items, "R")}`;
+		const sub = {
+			id,
+			revision,
+			kind,
+			sourceMessageId: item.sourceMessageId,
+			normalizedText: item.normalizedText,
+			textSha256: item.textSha256,
+			status: "pending",
+			verification: {
+				enforced: false,
+				surface: "scope",
+				subject: item.verification.subject ?? "scope"
+			},
+			semanticAction: "generic_run",
+			requestedTarget: { scope: item.verification.subject ?? "scope" },
+			targetCaptureStatus: "resolved",
+			authority: item.authority,
+			taskKind: informational ? "inquiry" : "action",
+			directive: informational ? "informational" : void 0,
+			executee: "unresolved",
+			authorityDisposition: informational ? "informational" : "unresolved",
+			interpretationFingerprint: `partition:${item.id}:${span.start}:${span.end}`,
+			rawTextSha256,
+			spans: [{
+				partIndex,
+				start: span.start,
+				end: span.end,
+				class: "instruction"
+			}],
+			unitId: item.unitId,
+			clarifiesItemId: item.id,
+			interpretedFromUnresolved: item.id
+		};
+		projection.items.set(id, sub);
+		projection.contractRevision = Math.max(projection.contractRevision, revision);
+		return sub;
+	};
+	let offset = 0;
+	for (const span of information) {
+		informationIds.push(makeSubItem(span, true, offset).id);
+		offset += 1;
+	}
+	for (const span of [...unknown, ...complement]) {
+		makeSubItem(span, false, offset);
+		offset += 1;
+	}
+	if (informationIds.length > 0) {
+		item.status = "superseded";
+		item.supersededBy = informationIds[0];
+	}
+	return informationIds;
+}
+/** The next numeric id for a prefix, shared with nextId's numbering. */
+function nextNumericId(items, prefix) {
+	let max = 0;
+	for (const item of items.values()) {
+		if (!item.id.startsWith(prefix)) continue;
+		const num = Number(item.id.slice(prefix.length));
+		if (Number.isInteger(num) && num > max) max = num;
+	}
+	return max + 1;
+}
+function readPartitionSpans(raw) {
+	if (!Array.isArray(raw)) return void 0;
+	const spans = [];
+	for (const entry of raw) {
+		const record = asRecord(entry);
+		const start = record?.start;
+		const end = record?.end;
+		if (typeof start !== "number" || !Number.isSafeInteger(start) || typeof end !== "number" || !Number.isSafeInteger(end) || start >= end) return void 0;
+		spans.push({
+			start,
+			end
+		});
+	}
+	return spans;
+}
+function itemExtentOf(item) {
+	const spans = item.spans ?? [];
+	if (spans.length === 0) return {
+		start: 0,
+		end: 0
+	};
+	return {
+		start: Math.min(...spans.map((span) => span.start)),
+		end: Math.max(...spans.map((span) => span.end))
+	};
+}
+/**
+* Replay validation of a clause-kind interpretation: the CALL's partition
+* (from the persisted tool/call arguments) must be present and structurally
+* valid against the obligation's extent, the receipt's echoed spans must
+* match the contract's spans, and the receipt's partition must EQUAL the
+* call's partition. A receipt that redraws the partition — replacing a
+* submitted unknown span with an information claim — is tampering.
+*/
+function clauseCallReceiptMatches(callInformation, callUnknown, recorded, item) {
+	const spans = item.spans ?? [];
+	const echoed = recorded.spans;
+	if (!Array.isArray(echoed) || echoed.length !== spans.length) return false;
+	if (!spans.every((span, index) => {
+		const echo = asRecord(echoed[index]);
+		return echo !== void 0 && echo.part_index === span.partIndex && echo.start === span.start && echo.end === span.end;
+	})) return false;
+	if (callInformation === void 0 || callUnknown === void 0 || callInformation.length === 0) return false;
+	const extent = itemExtentOf(item);
+	const allCall = [...callInformation, ...callUnknown];
+	for (const span of allCall) if (span.start < extent.start || span.end > extent.end) return false;
+	const orderedCall = [...allCall].sort((left, right) => left.start - right.start || left.end - right.end);
+	for (let index = 1; index < orderedCall.length; index += 1) if (orderedCall[index].start < orderedCall[index - 1].end) return false;
+	const receiptInformation = readPartitionSpans(recorded.information_spans);
+	const receiptUnknown = readPartitionSpans(recorded.unknown_spans);
+	if (receiptInformation === void 0 || receiptUnknown === void 0) return false;
+	return samePartition(receiptInformation, receiptUnknown, callInformation, callUnknown);
+}
+function samePartition(leftInformation, leftUnknown, rightInformation, rightUnknown) {
+	const normalize = (information, unknown) => {
+		const ordered = [...information.map((span) => ({
+			...span,
+			information: true
+		})), ...unknown.map((span) => ({
+			...span,
+			information: false
+		}))].sort((left, right) => left.start - right.start || left.end - right.end);
+		return JSON.stringify(ordered.map((span) => [
+			span.start,
+			span.end,
+			span.information
+		]));
+	};
+	return normalize(leftInformation, leftUnknown) === normalize(rightInformation, rightUnknown);
+}
+/**
+* Whether a recorded certificate is exactly the certificate this log re-derives.
+*
+* The comparison is by FIELD SEMANTICS, not by JSON text: a tool output is a
+* JSON object whose property order is an artifact of serialization, so
+* `JSON.stringify` equality made an identical certificate replay as corrupt
+* whenever the writer emitted `unit_id` before `goal_ref` (or vice versa). The
+* field set is still exact — an extra, missing, or renamed field stays a
+* mismatch — and values are compared by canonical encoding, so tampering is as
+* detectable as before.
+*/
 function recordedCertificateMatches(recorded, checkpoint) {
 	const value = asRecord(recorded);
 	if (!value) return false;
@@ -8214,6 +10912,10 @@ function recordedCertificateMatches(recorded, checkpoint) {
 		certification_digest: checkpoint.certificationDigest,
 		goal_ref: checkpoint.goalRef ?? null
 	};
+	if (checkpoint.unitId !== void 0) {
+		exact.unit_id = checkpoint.unitId;
+		exact.unit_closure_digest = checkpoint.unitClosureDigest;
+	}
 	const normalized = {
 		...value,
 		goal_ref: goal ? {
@@ -8221,7 +10923,61 @@ function recordedCertificateMatches(recorded, checkpoint) {
 			revision: goal.revision
 		} : value.goal_ref
 	};
-	return JSON.stringify(normalized) === JSON.stringify(exact);
+	const expectedKeys = Object.keys(exact).sort();
+	const actualKeys = Object.keys(normalized).sort();
+	if (expectedKeys.length !== actualKeys.length) return false;
+	return expectedKeys.every((key, index) => key === actualKeys[index] && stableJson(normalized[key]) === stableJson(exact[key]));
+}
+/**
+* The proof binding state the log itself implies for one checkpoint call. This
+* is the same computation the signing tool performs, replayed against the
+* projection derived up to that call.
+*/
+function replayProofState(projection, proof) {
+	if (proof === void 0) return {
+		status: "absent",
+		reason_codes: []
+	};
+	const structural = validateProofManifestV2(proof);
+	if (structural.length) return {
+		status: "invalid",
+		reason_codes: [...structural].sort()
+	};
+	const binding = bindProofV2ToProjection(projection, proof);
+	return binding.length ? {
+		status: "rejected",
+		reason_codes: [...binding].sort()
+	} : {
+		status: "bound",
+		reason_codes: []
+	};
+}
+/** Bounded set equality for reason-code lists, order-insensitive. */
+function sameStringSet(recorded, expected) {
+	if (!Array.isArray(recorded)) return false;
+	const left = [...new Set(recorded.filter((entry) => typeof entry === "string"))].sort();
+	const right = [...new Set(expected)].sort();
+	return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+/**
+* Freeze the closure certificate the adopter relied on, resolved AT the
+* adoption watermark. Only the checkpoints restored so far existed then, so a
+* certificate that appears LATER in the log can never ratify an earlier
+* adoption; an unresolvable reference is recorded as unresolved rather than
+* left open for a future entry to satisfy.
+*/
+function freezeAdoptionClosure(projection, contract) {
+	const ref = contract.closureCertRef;
+	const closure = ref !== void 0 ? projection.checkpoints.find((checkpoint) => checkpoint.id === ref && checkpoint.result === "certified") : void 0;
+	return closure === void 0 ? contract : {
+		...contract,
+		frozenClosure: {
+			id: closure.id,
+			certificationDigest: closure.certificationDigest,
+			epoch: closure.epoch,
+			contractRevision: closure.contractRevision
+		}
+	};
 }
 function restoreHistoricalCheckpoint(recorded, bindings, id) {
 	const stringField = (name) => typeof recorded[name] === "string" ? recorded[name] : void 0;
@@ -8241,6 +10997,7 @@ function restoreHistoricalCheckpoint(recorded, bindings, id) {
 		"certification_digest"
 	].some((name) => !stringField(name))) return void 0;
 	if (goal && (typeof goal.id !== "string" || !Number.isSafeInteger(goal.revision))) return void 0;
+	if (recorded.unit_id !== void 0 && (typeof recorded.unit_id !== "string" || !stringField("unit_closure_digest"))) return void 0;
 	return {
 		id,
 		stopProtocolVersion: stringField("stop_protocol_version"),
@@ -8258,6 +11015,10 @@ function restoreHistoricalCheckpoint(recorded, bindings, id) {
 			id: goal.id,
 			revision: goal.revision
 		} } : {},
+		...typeof recorded.unit_id === "string" ? {
+			unitId: recorded.unit_id,
+			unitClosureDigest: stringField("unit_closure_digest")
+		} : {},
 		certificationDigest: stringField("certification_digest"),
 		result: "certified"
 	};
@@ -8295,11 +11056,39 @@ function resolveArtifact(path$1, scope) {
 * an item whose action/target could not be derived deterministically stays
 * `legacy_authority_unclassified` instead of being retroactively authorized.
 */
-function captureRootText(projection, text, seq, scope, legacy, priorRootMessages, prefix = `m${seq}`, coordinationSplit = true) {
+function captureRootText(projection, text, seq, scope, legacy, priorRootMessages, prefix = `m${seq}`, coordinationSplit = true, unitId, clarification = false) {
 	const blocks = segmentAuthorityBlocks(text, priorRootMessages);
+	const provenance = legacy ? void 0 : {
+		rawTextSha256: sha256(text),
+		rawText: text
+	};
+	let coveredSpans = 0;
+	let blockCursor = 0;
 	for (const block$1 of blocks) {
 		if (!block$1.capture) continue;
-		insertItems(projection, block$1.text, `${prefix}:${block$1.blockId}`, scope, block$1.authority === "root_adoption" ? "root_adoption" : "root_instruction", legacy, block$1.kind === "instruction" || block$1.authority === "root_adoption", coordinationSplit);
+		let blockOffset;
+		if (provenance) {
+			const at = provenance.rawText.indexOf(block$1.text, blockCursor);
+			if (at >= 0) {
+				blockCursor = at + 1;
+				blockOffset = utf8ByteOffset(provenance.rawText, at);
+			}
+		}
+		coveredSpans += insertItems(projection, block$1.text, `${prefix}:${block$1.blockId}`, scope, block$1.authority === "root_adoption" ? "root_adoption" : "root_instruction", legacy, block$1.kind === "instruction" || block$1.authority === "root_adoption", coordinationSplit, unitId, provenance ? {
+			...provenance,
+			blockOffset,
+			blockText: block$1.text,
+			blockAuthority: block$1.authority
+		} : void 0, clarification ? text : void 0);
+	}
+	if (provenance) {
+		projection.coverage.push({
+			seq,
+			rawTextSha256: provenance.rawTextSha256,
+			byteLength: utf8ByteLength(provenance.rawText),
+			coveredSpans
+		});
+		if (projection.coverage.length > 16) projection.coverage.shift();
 	}
 	priorRootMessages.push(text);
 	if (priorRootMessages.length > 16) priorRootMessages.shift();
@@ -8310,20 +11099,45 @@ function captureRootText(projection, text, seq, scope, legacy, priorRootMessages
 * item, so evidence for one file cannot close a message that also covers other
 * files or embeds prohibitions.
 */
-function insertItems(projection, text, sourceMessageId, scope, authority = "root_instruction", legacy = false, legacyAuthorityProven = false, coordinationSplit = true) {
+function insertItems(projection, text, sourceMessageId, scope, authority = "root_instruction", legacy = false, legacyAuthorityProven = false, coordinationSplit = true, unitId, provenance, clarificationText) {
 	const before = new Set(projection.items.keys());
+	let coveredSpans = 0;
+	const usedOccurrences = /* @__PURE__ */ new Set();
 	for (const segment of segmentClauses(text, { coordinationSplit })) {
 		if (classifyUserInteraction(segment.body) === "conversational") continue;
 		if (segment.kind === "requirement" && segment.paths.length === 0 && isInstructionFraming(segment.body)) continue;
+		let span;
+		if (provenance) {
+			let at = provenance.blockText.indexOf(segment.text);
+			while (at >= 0 && usedOccurrences.has(at)) at = provenance.blockText.indexOf(segment.text, at + 1);
+			if (at >= 0) {
+				usedOccurrences.add(at);
+				const start = (provenance.blockOffset ?? 0) + utf8ByteOffset(provenance.blockText, at);
+				span = {
+					partIndex: 0,
+					start,
+					end: start + utf8ByteLength(segment.text),
+					class: spanClassOf(segment.kind, segment.interpretation.directive, provenance.blockAuthority)
+				};
+			}
+		}
+		if (span) coveredSpans += 1;
 		if (segment.paths.length === 0) {
-			insert(projection, segment, sourceMessageId, scope.cwd || "scope", "scope");
+			insert(projection, segment, sourceMessageId, scope.cwd || "scope", "scope", unitId, provenance ? {
+				rawTextSha256: provenance.rawTextSha256,
+				span
+			} : void 0);
 			continue;
 		}
-		for (const path$1 of segment.paths) insert(projection, segment, sourceMessageId, resolveArtifact(path$1, scope), "artifact");
+		for (const path$1 of segment.paths) insert(projection, segment, sourceMessageId, resolveArtifact(path$1, scope), "artifact", unitId, provenance ? {
+			rawTextSha256: provenance.rawTextSha256,
+			span
+		} : void 0);
 	}
 	for (const [id, item] of projection.items) {
 		if (before.has(id)) continue;
 		if (item.kind !== "requirement" || item.waitAuthorization || item.authorityDisposition === "conditional_wait") continue;
+		if (item.authorityDisposition !== void 0 && item.authorityDisposition !== "executable_now") continue;
 		for (const [otherId, other] of projection.items) {
 			if (otherId === id || other.status !== "pending") continue;
 			if (!other.waitAuthorization || other.kind !== "requirement") continue;
@@ -8335,6 +11149,24 @@ function insertItems(projection, text, sourceMessageId, scope, authority = "root
 			break;
 		}
 	}
+	if (clarificationText) for (const [id, item] of projection.items) {
+		if (before.has(id)) continue;
+		if (item.kind === "prohibition" || item.status !== "pending") continue;
+		if (item.authorityDisposition !== "executable_now") continue;
+		if (!item.semanticAction || item.semanticAction === "generic_run") continue;
+		for (const [otherId, other] of projection.items) {
+			if (otherId === id || !before.has(otherId)) continue;
+			if (other.status !== "pending" || other.kind === "prohibition") continue;
+			if (other.waitAuthorization || other.legacyFlags?.length) continue;
+			if (!(other.semanticAction === "generic_run" && (other.authorityDisposition === "executable_now" || other.authorityDisposition === "unresolved"))) continue;
+			if (other.normalizedText.length < 4) continue;
+			if (!clarificationText.includes(other.normalizedText)) continue;
+			if (other.verification.subject !== item.verification.subject) continue;
+			supersedeItem(projection.items, otherId, item);
+			item.clarifiesItemId = otherId;
+			break;
+		}
+	}
 	for (const [id, item] of projection.items) {
 		if (before.has(id)) continue;
 		if (legacy) if (legacyAuthorityProven && item.semanticAction !== void 0 && item.semanticAction !== "generic_run" && item.targetCaptureStatus === "resolved") {
@@ -8347,17 +11179,24 @@ function insertItems(projection, text, sourceMessageId, scope, authority = "root
 		}
 		else item.authority = authority;
 	}
+	return coveredSpans;
 }
-function insert(projection, segment, sourceMessageId, subject, surface) {
+function insert(projection, segment, sourceMessageId, subject, surface, unitId, provenance) {
 	const revision = projection.contractRevision + 1;
 	const id = nextId(projection.items, segment.kind);
 	const method = extractMethod(segment.body);
 	const operation = extractOperation(segment.body);
 	const item = captureItem(segment.kind, segment.body, sourceMessageId, id, revision, subject, surface, method, operation, segment.interpretation);
+	if (unitId !== void 0) item.unitId = unitId;
+	if (provenance) {
+		item.rawTextSha256 = provenance.rawTextSha256;
+		if (provenance.span) item.spans = [provenance.span];
+	}
 	const duplicate = [...projection.items.values()].find((existing) => existing.kind === segment.kind && existing.status === "pending" && existing.textSha256 === item.textSha256 && existing.verification.subject === subject);
 	if (duplicate) supersedeItem(projection.items, duplicate.id, item);
 	else projection.items.set(id, item);
 	projection.contractRevision = item.revision;
+	return item;
 }
 /**
 * Pure, deterministic re-derivation of the guard projection from the DSH
@@ -8368,6 +11207,7 @@ function insert(projection, segment, sourceMessageId, subject, surface) {
 */
 function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLock = DEFAULT_HOST_LOCK) {
 	const projection = createProjection();
+	projection.policy = config.policy ?? "standard";
 	if (scope.sessionHeader) projection.sessionRefDigest = sessionRefDigest(scope.sessionHeader);
 	projection.hostLockDigest = hostLock.digest;
 	projection.hostStatus = hostLock.status;
@@ -8380,14 +11220,45 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 	let enablementTransitioned = false;
 	let lastCompactionSeq = -1;
 	const pendingCalls = /* @__PURE__ */ new Map();
+	const v5BoundarySeq = sourceEvents.find((event) => isProtocolBoundaryNotice(event, PROTOCOL_V5_NOTICE))?.seq;
 	const v4BoundarySeq = sourceEvents.find((event) => isProtocolBoundaryNotice(event, PROTOCOL_V4_NOTICE))?.seq;
-	const protocolBoundarySeq = sourceEvents.find((event) => isProtocolBoundaryNotice(event) || isProtocolBoundaryNotice(event, PROTOCOL_V4_NOTICE))?.seq;
-	const captureBoundarySeq = sourceEvents.find((event) => isProtocolBoundaryNotice(event, CAPTURE_V042_NOTICE) || isProtocolBoundaryNotice(event, PROTOCOL_V4_NOTICE))?.seq;
+	const protocolBoundarySeq = sourceEvents.find((event) => isProtocolBoundaryNotice(event) || isProtocolBoundaryNotice(event, PROTOCOL_V4_NOTICE) || isProtocolBoundaryNotice(event, PROTOCOL_V5_NOTICE))?.seq;
+	const captureBoundarySeq = sourceEvents.find((event) => isProtocolBoundaryNotice(event, CAPTURE_V042_NOTICE) || isProtocolBoundaryNotice(event, PROTOCOL_V4_NOTICE) || isProtocolBoundaryNotice(event, PROTOCOL_V5_NOTICE))?.seq;
 	const priorRootMessages = [];
 	let realRootInputSeen = false;
+	const trustedDeliveries = (v5BoundarySeq !== void 0 ? deriveTrustedDeliveries(sourceEvents) : []).filter((delivery) => delivery.turnEndSeq > v5BoundarySeq);
+	let deliveryCursor = 0;
+	const interpretationFacts = [];
+	const applyDeliveriesUpTo = (seq) => {
+		while (deliveryCursor < trustedDeliveries.length && trustedDeliveries[deliveryCursor].turnEndSeq <= seq) {
+			const delivery = trustedDeliveries[deliveryCursor];
+			deliveryCursor += 1;
+			const inputSeqs = turnRootInputSeqs.get(delivery.turn);
+			if (!inputSeqs) continue;
+			const owningUnitId = turnUnitIds.get(delivery.turn);
+			const eligibleUnitIds = owningUnitId === void 0 ? void 0 : new Set([owningUnitId, ...unitDescendantIds(projection, owningUnitId)]);
+			for (const itemId of informationItemIdsForDelivery(projection.items, delivery, inputSeqs, eligibleUnitIds, interpretationFacts)) {
+				const item = projection.items.get(itemId);
+				if (!item || item.status !== "pending") continue;
+				const sourceSeq = /^m(\d+)(?::|$)/.exec(item.sourceMessageId);
+				if (!sourceSeq || Number(sourceSeq[1]) <= v5BoundarySeq) continue;
+				item.status = "answered";
+				item.answeredBy = {
+					turn: delivery.turn,
+					responseSeq: delivery.responseSeq,
+					responseSha256: delivery.responseSha256
+				};
+			}
+		}
+	};
+	const turnRootInputSeqs = /* @__PURE__ */ new Map();
+	const turnUnitIds = /* @__PURE__ */ new Map();
+	let activeTurn;
+	const unitSemanticsActive = () => v5BoundarySeq !== void 0 && !scope.sessionHeader?.parentSession && !scope.sessionHeader?.delegationDepth && scope.sessionHeader?.origin !== "subagent";
 	for (const event of sourceEvents) {
 		projection.enabled = enabled;
 		projection.lastObservedSourceSeq = Math.max(projection.lastObservedSourceSeq, event.seq);
+		applyDeliveriesUpTo(event.seq);
 		switch (event.type) {
 			case "command/run": {
 				const data = asRecord(event.data);
@@ -8408,6 +11279,26 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 						item.supersededBy = `CLEAR:${revision}`;
 					}
 					projection.contractRevision = revision;
+				} else if (subcommand === "release") {
+					const rest = typeof data.args === "string" ? data.args.trim().slice(7).trim() : "";
+					const revoke = /^revoke(?:\s+(\S+))?$/.exec(rest);
+					if (revoke) {
+						const contractId = revoke[1] ?? "";
+						const contract = projection.releaseContracts.find((entry) => entry.contractId === contractId);
+						if (!contract) pushReleaseDiagnostic(projection, event.seq, "release_contract_revocation_unknown");
+						else if (contract.revokedAtSeq === void 0) contract.revokedAtSeq = event.seq;
+						break;
+					}
+					const match = /^adopt(?:\s+([\s\S]+))?$/.exec(rest);
+					if (match) {
+						const payload = parseArguments((match[1] ?? "").trim());
+						const normalized = normalizeReleaseContract(payload, {
+							seq: event.seq,
+							digest: sha256(stableJson(payload))
+						}, projection.contractRevision);
+						if (!normalized.contract) for (const code of normalized.errors) pushReleaseDiagnostic(projection, event.seq, code);
+						else if (!projection.releaseContracts.some((contract) => contract.contractId === normalized.contract.contractId)) projection.releaseContracts.push(freezeAdoptionClosure(projection, normalized.contract));
+					} else if (rest.length > 0 && !/^status$/.test(rest)) pushReleaseDiagnostic(projection, event.seq, "release_subcommand_unknown");
 				}
 				break;
 			}
@@ -8417,10 +11308,22 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 				break;
 			case "turn/start": {
 				const started = asRecord(event.data);
-				if (typeof started?.turn === "number" && Number.isSafeInteger(started.turn)) projection.hostTurn = started.turn;
+				if (typeof started?.turn === "number" && Number.isSafeInteger(started.turn)) {
+					projection.hostTurn = started.turn;
+					activeTurn = started.turn;
+				}
+				break;
+			}
+			case "turn/end": {
+				const ended = asRecord(event.data);
+				if (typeof ended?.turn === "number" && Number.isSafeInteger(ended.turn)) activeTurn = void 0;
 				break;
 			}
 			case "user/message": {
+				if (isProtocolBoundaryNotice(event, PROTOCOL_V5_NOTICE)) {
+					projection.boundaryProtocol = 5;
+					break;
+				}
 				if (isProtocolBoundaryNotice(event) || isProtocolBoundaryNotice(event, CAPTURE_V042_NOTICE) || isProtocolBoundaryNotice(event, PROTOCOL_V4_NOTICE)) break;
 				{
 					const record = asRecord(event.data);
@@ -8444,20 +11347,79 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 						if (rootSeq !== void 0) projection.handledControlSeqs.add(rootSeq);
 						break;
 					}
+					if (recordSource?.kind === "plugin" && recordSource.plugin === "context-guard") {
+						if (recordText.startsWith(RELEASE_CONTRACT_PREFIX)) {
+							const payload = parseArguments(recordText.slice(RELEASE_CONTRACT_PREFIX.length));
+							const adoptionSeq = typeof payload.adoptedBySeq === "number" && Number.isSafeInteger(payload.adoptedBySeq) ? payload.adoptedBySeq : event.seq;
+							const normalized = normalizeReleaseContract(asRecord(payload.contract) ?? payload, {
+								seq: adoptionSeq,
+								digest: sha256(stableJson(payload.contract ?? null))
+							}, projection.contractRevision);
+							if (!normalized.contract) for (const code of normalized.errors) pushReleaseDiagnostic(projection, event.seq, code, true);
+							else if (!projection.releaseContracts.some((contract) => contract.contractId === normalized.contract.contractId)) projection.releaseContracts.push(freezeAdoptionClosure(projection, normalized.contract));
+							break;
+						}
+						if (recordText.startsWith(RELEASE_RESERVATION_PREFIX)) {
+							const reservation = normalizeReservation(parseArguments(recordText.slice(RELEASE_RESERVATION_PREFIX.length)));
+							if (!reservation) pushReleaseDiagnostic(projection, event.seq, "release_reservation_malformed", true);
+							else if (!projection.releaseReservations.some((entry) => entry.callId === reservation.callId)) projection.releaseReservations.push({
+								...reservation,
+								startedAtSeq: event.seq
+							});
+							break;
+						}
+						if (recordText.startsWith(RELEASE_REVOCATION_PREFIX)) {
+							const payload = asRecord(parseArguments(recordText.slice(RELEASE_REVOCATION_PREFIX.length)));
+							const contractId = typeof payload?.contractId === "string" ? payload.contractId : "";
+							const contract = projection.releaseContracts.find((entry) => entry.contractId === contractId);
+							if (!contract) pushReleaseDiagnostic(projection, event.seq, "release_contract_revocation_unknown");
+							else if (contract.revokedAtSeq === void 0) contract.revokedAtSeq = event.seq;
+							break;
+						}
+						if (recordText.startsWith(RELEASE_SETTLEMENT_PREFIX)) {
+							const settlement = normalizeSettlement(parseArguments(recordText.slice(RELEASE_SETTLEMENT_PREFIX.length)));
+							if (!settlement) pushReleaseDiagnostic(projection, event.seq, "release_settlement_malformed", true);
+							else {
+								const pinned = {
+									...settlement,
+									settledAtSeq: event.seq
+								};
+								const key = (row) => `${row.contractId}\u0000${row.operation}\u0000${row.callId}`;
+								const index = projection.releaseSettlements.findIndex((entry) => key(entry) === key(pinned));
+								if (index < 0) projection.releaseSettlements.push(pinned);
+								else if (OUTCOME_STRENGTH[pinned.outcome] >= OUTCOME_STRENGTH[projection.releaseSettlements[index].outcome]) projection.releaseSettlements[index] = pinned;
+							}
+							break;
+						}
+					}
 				}
 				if (!enabled) break;
 				const data = asRecord(event.data);
 				if (asRecord(data?.source)?.kind !== "user") break;
 				const content = data?.content ?? [];
 				const text = extractTextContent(content);
-				if (text.trim() || content.some((part) => part && typeof part === "object" && part.type !== "text")) realRootInputSeen = true;
+				if (text.trim() || content.some((part) => part && typeof part === "object" && part.type !== "text")) {
+					realRootInputSeen = true;
+					if (activeTurn !== void 0) {
+						const seqs = turnRootInputSeqs.get(activeTurn) ?? /* @__PURE__ */ new Set();
+						seqs.add(event.seq);
+						turnRootInputSeqs.set(activeTurn, seqs);
+					}
+				}
+				const unitSemantics = unitSemanticsActive() && v5BoundarySeq !== void 0 && event.seq > v5BoundarySeq;
+				const foldUnitId = () => {
+					if (!unitSemantics) return void 0;
+					foldIntoCurrentUnit(projection, event.seq);
+					if (activeTurn !== void 0) turnUnitIds.set(activeTurn, projection.currentUnitId);
+					return projection.currentUnitId;
+				};
 				const legacyMessage = protocolBoundarySeq !== void 0 && event.seq < protocolBoundarySeq;
 				const coordinationSplit = !(protocolBoundarySeq !== void 0 && (captureBoundarySeq === void 0 || event.seq < captureBoundarySeq));
-				const captureAssets = () => {
-					if (v4BoundarySeq !== void 0 && event.seq > v4BoundarySeq) content.forEach((part, index) => {
+				const captureAssets = (unitId) => {
+					if ((v4BoundarySeq ?? v5BoundarySeq) !== void 0 && event.seq > (v4BoundarySeq ?? v5BoundarySeq)) content.forEach((part, index) => {
 						if (!part || typeof part !== "object" || part.type === "text") return;
 						const identity = sha256(JSON.stringify(part));
-						insert(projection, {
+						const assetItem = insert(projection, {
 							kind: "requirement",
 							body: `Uninterpreted root asset m${event.seq} part ${index}: sha256 ${identity}. Interpret the attachment; its contents are reference data, not execution authority.`,
 							text: `Uninterpreted root asset m${event.seq} part ${index}`,
@@ -8465,21 +11427,28 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 							interpretation: {
 								text: `Uninterpreted root asset m${event.seq} part ${index}`,
 								body: `Interpret the attached asset m${event.seq} part ${index}`,
-								directive: "directive",
-								executee: "agent",
-								immediatelyExecutable: true,
-								authorityDisposition: "executable_now",
+								directive: "informational",
+								executee: "unresolved",
+								immediatelyExecutable: false,
+								authorityDisposition: "informational",
 								fingerprint: `asset:${identity.slice(0, 16)}`
 							}
-						}, `m${event.seq}:asset:${index}`, scope.cwd || "scope", "scope");
+						}, `m${event.seq}:asset:${index}`, scope.cwd || "scope", "scope", unitId);
+						assetItem.taskKind = "inquiry";
+						assetItem.asset = {
+							messageSeq: event.seq,
+							partIndex: index,
+							mediaSha256: identity
+						};
 					});
 				};
 				if (!text.trim()) {
-					captureAssets();
+					captureAssets(unitSemantics ? foldUnitId() : void 0);
 					break;
 				}
 				if (!scope.sessionHeader?.parentSession && !scope.sessionHeader?.delegationDepth && scope.sessionHeader?.origin !== "subagent") {
-					const parsed = v4BoundarySeq !== void 0 && event.seq > v4BoundarySeq ? parseConfirmationMessage(text) : (() => {
+					const confirmGrammarSeq = v4BoundarySeq ?? v5BoundarySeq;
+					const parsed = confirmGrammarSeq !== void 0 && event.seq > confirmGrammarSeq ? parseConfirmationMessage(text) : (() => {
 						const match = CONFIRM_LINE_PATTERN.exec(text.trim());
 						return match ? {
 							kind: "confirm",
@@ -8489,12 +11458,14 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 					})();
 					if (parsed.kind === "confirm") {
 						if (confirmRebind(projection, parsed.proposalId, `m${event.seq}`, durableConfirmed)) {
-							captureAssets();
-							if (parsed.remainder) captureRootText(projection, parsed.remainder, event.seq, scope, legacyMessage, priorRootMessages, `m${event.seq}:r`, coordinationSplit);
+							const unitId = unitSemantics ? foldUnitId() : void 0;
+							captureAssets(unitId);
+							if (parsed.remainder) captureRootText(projection, parsed.remainder, event.seq, scope, legacyMessage, priorRootMessages, `m${event.seq}:r`, coordinationSplit, unitId, unitSemantics);
 							break;
 						}
 					} else if (parsed.kind !== "none") {
-						captureAssets();
+						const unitId = unitSemantics ? foldUnitId() : void 0;
+						captureAssets(unitId);
 						projection.lastConfirmationRejection = {
 							eventSeq: event.seq,
 							kind: parsed.kind,
@@ -8502,14 +11473,23 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 						};
 						const stripped = text.split(/\r?\n/).filter((line) => !CONFIRM_LINE_PATTERN.test(line.trim())).join("\n");
 						if (!stripped.trim()) break;
-						captureRootText(projection, stripped, event.seq, scope, legacyMessage, priorRootMessages, `m${event.seq}`, coordinationSplit);
+						captureRootText(projection, stripped, event.seq, scope, legacyMessage, priorRootMessages, `m${event.seq}`, coordinationSplit, unitId, unitSemantics);
 						break;
 					}
 				}
-				captureAssets();
+				const directiveBearing = text.trim().length > 0 && !isInformationalMessage(text) && classifyUserInteraction(text) !== "conversational";
+				let captureUnitId;
+				if (unitSemantics && directiveBearing) {
+					if (!explicitlyLinkedToCurrentUnit(projection, text) && opensNewUnit(projection, text, true, currentUnitHasOpenWork(projection))) {
+						const parentUnitId = opensChildUnit(projection, text) ? projection.currentUnitId : void 0;
+						captureUnitId = openUnit(projection, event.seq, text.slice(0, 200), parentUnitId).unitId;
+					} else captureUnitId = foldUnitId();
+					if (activeTurn !== void 0) turnUnitIds.set(activeTurn, projection.currentUnitId);
+				}
+				captureAssets(captureUnitId ?? (unitSemantics ? foldUnitId() : void 0));
 				if (isInformationalMessage(text)) break;
 				if (classifyUserInteraction(text) === "conversational") break;
-				captureRootText(projection, text, event.seq, scope, legacyMessage, priorRootMessages, `m${event.seq}`, coordinationSplit);
+				captureRootText(projection, text, event.seq, scope, legacyMessage, priorRootMessages, `m${event.seq}`, coordinationSplit, captureUnitId, unitSemantics);
 				break;
 			}
 			case "goal/change": {
@@ -8546,10 +11526,13 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 				const call = {
 					name: String(data?.name ?? ""),
 					arguments: String(data?.arguments ?? ""),
-					rootCallId: typeof data?.rootCallId === "string" ? data.rootCallId : void 0
+					rootCallId: typeof data?.rootCallId === "string" ? data.rootCallId : void 0,
+					...typeof data?.turn === "number" && Number.isSafeInteger(data.turn) ? { turn: data.turn } : {},
+					...projection.currentUnitId !== void 0 ? { unitIdAtCall: projection.currentUnitId } : {}
 				};
 				if (call.name === "context_guard_checkpoint") {
 					const args = parseArguments(call.arguments);
+					if (asRecord(args.proof)) call.proof = args.proof;
 					call.bindings = Array.isArray(args.bindings) ? args.bindings.map((binding) => {
 						const record = asRecord(binding);
 						const transition = asRecord(record?.expected_transition);
@@ -8639,6 +11622,18 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 						}
 						break;
 					}
+					const recordedProof = asRecord(recorded.proof_state);
+					const recomputedProof = replayProofState(projection, call.proof);
+					if ((recordedProof !== void 0 || call.proof !== void 0) && (recordedProof === void 0 || String(recordedProof.status ?? "") !== recomputedProof.status || !sameStringSet(recordedProof.reason_codes, recomputedProof.reason_codes))) {
+						projection.integrity = "corrupt";
+						projection.integrityViolations.push("proof_replay_mismatch");
+						break;
+					}
+					if (recomputedProof.status === "invalid" || recomputedProof.status === "rejected") {
+						projection.integrity = "corrupt";
+						projection.integrityViolations.push("proof_replay_mismatch");
+						break;
+					}
 					if (!asRecord(recorded.certificate)) {
 						for (const binding of call.bindings ?? []) {
 							const item = projection.items.get(binding.itemId);
@@ -8670,6 +11665,47 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 					} else certifyCheckpoint(projection, call.bindings ?? [], id, true);
 					break;
 				}
+				if (call.name === "context_guard_interpret") {
+					if (!call.rootCallId && !data?.error) {
+						const callArgs = parseArguments(call.arguments);
+						const requested = typeof callArgs.item_id === "string" ? callArgs.item_id.trim() : "";
+						const recorded = parseArguments(textContent);
+						if (recorded.status === "recorded") {
+							const item = requested ? projection.items.get(requested) : void 0;
+							const resultTurn = typeof data?.turn === "number" && Number.isSafeInteger(data.turn) ? data.turn : void 0;
+							const callInformation = readPartitionSpans(callArgs.information_spans);
+							const callUnknown = readPartitionSpans(callArgs.unknown_spans);
+							if (!(requested !== "" && item !== void 0 && item.status === "pending" && recorded.item_id === requested && recorded.item_revision === item.revision && (item.asset !== void 0 ? recorded.kind === "asset" && !Object.hasOwn(recorded, "information_spans") && !Object.hasOwn(recorded, "unknown_spans") && assetReceiptMatches(recorded.asset, item.asset) : recorded.kind === "clause" && clauseCallReceiptMatches(callInformation, callUnknown, recorded, item)))) {
+								projection.integrity = "corrupt";
+								projection.integrityViolations.push("interpretation_receipt_mismatch");
+								break;
+							}
+							if (call.turn === void 0 || resultTurn === void 0) break;
+							if (call.turn !== resultTurn) {
+								projection.integrity = "corrupt";
+								projection.integrityViolations.push("interpretation_receipt_mismatch");
+								break;
+							}
+							if (item.asset !== void 0) {
+								const existing = interpretationFacts.findIndex((fact) => fact.itemId === requested);
+								if (existing >= 0) interpretationFacts.splice(existing, 1);
+								interpretationFacts.push({
+									itemId: requested,
+									resultSeq: event.seq,
+									turn: call.turn
+								});
+							} else {
+								const informationSubItemIds = supersedeClauseByPartition(projection, item, asRecord(recorded));
+								for (const subItemId of informationSubItemIds) if (interpretationFacts.findIndex((fact) => fact.itemId === subItemId) < 0) interpretationFacts.push({
+									itemId: subItemId,
+									resultSeq: event.seq,
+									turn: call.turn
+								});
+							}
+						}
+					}
+					break;
+				}
 				if (call.name === "context_guard_boundary") {
 					const recorded = parseArguments(textContent);
 					const candidate = call.boundaryRequest ? qualifyBoundary(projection, call.boundaryRequest) : void 0;
@@ -8689,7 +11725,8 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 					break;
 				}
 				evidenceCounter += 1;
-				const evidence = withDurability(evidenceFromPersistedToolResult({
+				const delegated = DEFAULT_DELEGATION_TOOL_NAMES.includes(call.name);
+				const baseEvidence = withDurability(evidenceFromPersistedToolResult({
 					callId,
 					name: call.name,
 					arguments: call.arguments,
@@ -8703,7 +11740,17 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 					meta: data?.meta,
 					textContent
 				}, epoch, `E${String(evidenceCounter).padStart(4, "0")}`, scope.cwd || void 0, hostLock), durableConfirmed);
+				const evidence = delegated ? {
+					...baseEvidence,
+					delegatedSubtask: true
+				} : baseEvidence;
 				projection.evidence.set(evidence.id, evidence);
+				if (delegated && call.unitIdAtCall !== void 0) recordDelegation(projection, call.unitIdAtCall, {
+					callId,
+					resultSeq: event.seq,
+					toolName: call.name,
+					status: data?.error !== void 0 ? "failed" : "completed"
+				});
 				if (evidence.externalOperationRef) projection.externalOperations.set(evidence.externalOperationRef.id, evidence.externalOperationRef);
 				break;
 			}
@@ -8712,13 +11759,60 @@ function deriveProjection(sourceEvents, config, scope, durableConfirmed, hostLoc
 	}
 	projection.enabled = enabled;
 	projection.epoch = epoch;
+	if (interpretationFacts.length > 64) interpretationFacts.splice(0, interpretationFacts.length - 64);
+	projection.interpretationFacts = interpretationFacts;
+	projection.trustedSelections = deriveTrustedSelections(sourceEvents, { questionToolNames: DEFAULT_QUESTION_TOOL_NAMES });
+	if (projection.trustedSelections.length > 16) projection.trustedSelections = projection.trustedSelections.slice(-16);
+	const approvalAsked = /* @__PURE__ */ new Map();
+	for (const event of sourceEvents) {
+		const data = asRecord(event.data);
+		if (event.type === "approval/asked") {
+			const id = typeof data?.id === "string" ? data.id : "";
+			const toolName = typeof data?.toolName === "string" ? data.toolName : void 0;
+			if (id) approvalAsked.set(id, {
+				id,
+				seq: event.seq,
+				toolName
+			});
+			continue;
+		}
+		if (event.type === "approval/decided") {
+			const id = typeof data?.id === "string" ? data.id : "";
+			const asked = approvalAsked.get(id);
+			if (!asked) continue;
+			const outcome = String(data?.outcome ?? "");
+			if (![
+				"allowed-once",
+				"rejected",
+				"cancelled",
+				"unavailable"
+			].includes(outcome)) continue;
+			projection.approvals.push({
+				id: asked.id,
+				seq: asked.seq,
+				toolName: asked.toolName,
+				outcome
+			});
+			approvalAsked.delete(id);
+		}
+	}
+	if (projection.approvals.length > 16) projection.approvals = projection.approvals.slice(-16);
+	if (!projection.releaseStateDamaged) projection.releaseStateDamaged = projection.releaseSettlements.some((settlement) => {
+		if (settlement.readback === "unavailable") return false;
+		const contract = projection.releaseContracts.find((entry) => entry.contractId === settlement.contractId);
+		if (!contract || settlement.readback.kind !== "npm_integrity") return false;
+		const reservation = projection.releaseReservations.find((entry) => entry.contractId === settlement.contractId && entry.operation === settlement.operation && entry.callId === settlement.callId);
+		const expected = contract.candidate.artifactSri ?? reservation?.observedArtifactSri;
+		return expected !== void 0 && expected !== settlement.readback.identity;
+	});
 	return {
 		projection,
 		compacted,
 		enablementTransitioned,
 		lastCompactionSeq,
 		realRootInputSeen,
-		protocolV4Present: v4BoundarySeq !== void 0
+		protocolV4Present: v4BoundarySeq !== void 0,
+		boundaryV5: v5BoundarySeq !== void 0
 	};
 }
 
@@ -8770,21 +11864,34 @@ function claimedBatchHasRealRootInput(messages) {
 * persisted step batch; guidance is compact and never claims a recovery that
 * did not happen. `opt-in` reaches this path only after its explicit `on` command. Delegated sessions receive neither: their
 * scope arrives through the parent's delegation prompt (A04).
+*
+* A session without a v5 boundary receives the 0.6 boundary: it cuts the
+* work-unit/delivery/certificate-v2 semantics at exactly this message. A
+* session that already has v5 injects nothing.
 */
 function previewFirstStepInjection(input, claimedRealInput) {
-	if (!input.enabled || input.boundaryPresent || input.delegated) return void 0;
+	if (!input.enabled || input.delegated) return void 0;
 	if (!claimedRealInput) return void 0;
+	if (input.boundaryV5Present) return void 0;
 	return {
-		boundary: PROTOCOL_V4_NOTICE,
-		guidance: FIRST_STEP_GUIDANCE
+		boundary: PROTOCOL_V5_NOTICE,
+		guidance: firstStepGuidance(input.policy ?? "standard")
 	};
 }
 /**
 * Compact first-step guidance: protection has started, what it protects, and
-* the working order for stateful actions. It is not a task, asks no question,
-* and contains no recovery wording.
+* when the guarded producer path is needed. 0.6.1 (W060-05): the stateful
+* workflow is stated CONDITIONALLY — only an obligation whose own clause
+* demands a certified stateful action runs through prepare/producer/checkpoint.
+* The 0.6.0 text demanded that order for every stateful action unconditionally,
+* which ordinary business work correctly read as a Guard approval gate.
+* Ordinary answers, investigations, and ordinary tool work are never gated, and
+* missing Guard evidence is never a reason to repeat a completed action.
 */
-const FIRST_STEP_GUIDANCE = "Context Guard is now protecting this session: requirements from your messages stay open until they are certified with matching durable evidence. Before a stateful action (write, install, commit, push, publish, restart), call context_guard_prepare to see the supported command shape and required resolution/effect/state order; collect evidence with the guarded tools, then close items with context_guard_checkpoint. Ordinary answers and investigations need no certification.";
+function firstStepGuidance(policy = "standard") {
+	return "Context Guard is now protecting this session: requirements from your messages stay open until they are certified with matching durable evidence. Ordinary answers, investigations, and ordinary tool work need no Guard approval. When a requirement itself calls for a certified stateful action (install, apply, create, modify, restart, commit, push, publish, pull, fetch), call context_guard_prepare before it to see the supported command shape and the required resolution/effect/state order, run the action through the guarded path, and close items with context_guard_checkpoint; never repeat an already-completed action to mint missing evidence." + (policy === "strict" ? " Under strict policy, a verification the user explicitly requested (a visual readback or a complete-scope check) must be discharged by a real readback fact." : "") + " Ordinary answers and investigations need no certification.";
+}
+const FIRST_STEP_GUIDANCE = firstStepGuidance("standard");
 /**
 * Lifecycle phase derived from durable facts. `enabled` is the log-derived
 * enablement (`always`, or the explicit `on`/`off` command sequence), and
@@ -9079,6 +12186,22 @@ async function executeRevalidatedGitEffect(resolved, manifest, target, currentSt
 		status: "rejected",
 		...checked.reasonCode ? { reasonCode: checked.reasonCode } : {}
 	};
+	const text = (key) => {
+		const value = currentStateTuple[key];
+		return typeof value === "string" ? value : value === void 0 ? void 0 : Buffer.from(value).toString("utf8");
+	};
+	if (manifest.action === "push" && text("source_oid") !== void 0 && text("source_oid") === text("destination_oid")) return {
+		status: "rejected",
+		reasonCode: "effect_already_applied"
+	};
+	if (manifest.action === "pull" && text("pre_head_oid") !== void 0 && text("pre_head_oid") === text("upstream_oid")) return {
+		status: "rejected",
+		reasonCode: "effect_already_applied"
+	};
+	if (manifest.action === "fetch" && text("tracking_oid") !== void 0 && text("tracking_oid") === text("upstream_oid")) return {
+		status: "rejected",
+		reasonCode: "effect_already_applied"
+	};
 	await runner("git", manifest.argv.slice(1), target.repository);
 	return { status: "executed" };
 }
@@ -9693,214 +12816,4 @@ function verifyComposedHostLockDump(text, expected, roots) {
 }
 
 //#endregion
-//#region src/domain/proof.ts
-const PROOF_PROTOCOL_VERSION = "0.4.0";
-const PROOF_KINDS = [
-	"subject_readback",
-	"scope_coverage",
-	"state_verification"
-];
-function stable(value) {
-	if (Array.isArray(value)) return `[${value.map(stable).join(",")}]`;
-	if (value && typeof value === "object") return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${JSON.stringify(k)}:${stable(v)}`).join(",")}}`;
-	return JSON.stringify(value);
-}
-function digest(value) {
-	return createHash("sha256").update("ccg.proofManifest.v1\n", "utf8").update(stable(value), "utf8").digest("hex");
-}
-function validDigest(value) {
-	return /^[0-9a-f]{64}$/.test(value);
-}
-/**
-* The manifest digest root includes every integrity-bearing field, so a
-* tampered asset-set digest is exactly as detectable as a tampered obligation.
-*/
-function proofDigest(obligations, assetSetSha256) {
-	return digest({
-		proofProtocolVersion: PROOF_PROTOCOL_VERSION,
-		obligations: [...obligations],
-		...assetSetSha256 !== void 0 ? { assetSetSha256 } : {}
-	});
-}
-function validateProofManifest(manifest) {
-	const errors = [];
-	if (!manifest || typeof manifest !== "object") return ["proof_manifest_invalid"];
-	const value = manifest;
-	if (value.proofProtocolVersion !== PROOF_PROTOCOL_VERSION) errors.push("proof_protocol_version_mismatch");
-	if (!Array.isArray(value.obligations)) errors.push("proof_obligations_missing");
-	if (value.assetSetSha256 !== void 0 && (typeof value.assetSetSha256 !== "string" || !validDigest(value.assetSetSha256))) errors.push("proof_asset_set_digest_invalid");
-	if (typeof value.proofSha256 !== "string" || !validDigest(value.proofSha256)) errors.push("proof_digest_invalid");
-	const obligations = Array.isArray(value.obligations) ? value.obligations : [];
-	const ids = /* @__PURE__ */ new Set();
-	for (const raw of obligations) {
-		if (!raw || typeof raw !== "object") {
-			errors.push("proof_obligation_invalid");
-			continue;
-		}
-		const obligation = raw;
-		if (typeof obligation.obligationId !== "string" || ids.has(obligation.obligationId)) errors.push("proof_obligation_id_duplicate_or_invalid");
-		if (typeof obligation.obligationId === "string") ids.add(obligation.obligationId);
-		if (!PROOF_KINDS.includes(obligation.kind)) errors.push("proof_kind_unsupported");
-		if (![
-			"artifact",
-			"ui",
-			"visual",
-			"scope"
-		].includes(String(obligation.surface))) errors.push("proof_surface_unsupported");
-		if (!Array.isArray(obligation.subjectIds) || obligation.subjectIds.length === 0 || obligation.subjectIds.some((id) => typeof id !== "string" || id.startsWith("codex:unsupported/"))) errors.push("proof_subject_invalid");
-		if (!Array.isArray(obligation.evidenceIds) || obligation.evidenceIds.length === 0 || new Set(obligation.evidenceIds).size !== obligation.evidenceIds.length) errors.push("proof_evidence_invalid");
-		const expected = obligation.expectedScopeDigest;
-		const observed = obligation.observedScopeDigest;
-		for (const digestValue of [expected, observed]) if (digestValue !== void 0 && (typeof digestValue !== "string" || !validDigest(digestValue))) errors.push("proof_scope_digest_invalid");
-		if (expected !== void 0 && observed !== expected) errors.push("proof_scope_digest_mismatch");
-		if (expected === void 0 && observed !== void 0) errors.push("proof_scope_digest_mismatch");
-	}
-	if (errors.length === 0) {
-		const assetSet = typeof value.assetSetSha256 === "string" ? value.assetSetSha256 : void 0;
-		if (value.proofSha256 !== proofDigest(obligations, assetSet)) errors.push("proof_digest_mismatch");
-	}
-	return [...new Set(errors)];
-}
-function createProofManifest(obligations, assetSetSha256) {
-	const normalized = obligations.map((obligation) => ({
-		obligationId: obligation.obligationId,
-		kind: obligation.kind,
-		surface: obligation.surface,
-		subjectIds: [...obligation.subjectIds].sort(),
-		evidenceIds: [...obligation.evidenceIds].sort(),
-		...obligation.expectedScopeDigest ? { expectedScopeDigest: obligation.expectedScopeDigest } : {},
-		...obligation.observedScopeDigest ? { observedScopeDigest: obligation.observedScopeDigest } : {}
-	})).sort((a, b) => a.obligationId.localeCompare(b.obligationId));
-	const manifest = {
-		proofProtocolVersion: PROOF_PROTOCOL_VERSION,
-		obligations: normalized,
-		...assetSetSha256 !== void 0 ? { assetSetSha256 } : {},
-		proofSha256: proofDigest(normalized, assetSetSha256)
-	};
-	const errors = validateProofManifest(manifest);
-	if (errors.length) throw new Error(`proof manifest rejected: ${errors.join(",")}`);
-	return manifest;
-}
-/**
-* Bind a structurally valid proof to the actual replayed projection: every
-* obligation must name a pending item, every evidence id must exist in the
-* projection, and every bound evidence must satisfy the obligation's kind,
-* surface, subject, and outcome constraints. An empty projection therefore
-* rejects any proof, and cross-item or foreign evidence can never bind.
-*/
-function bindProofToProjection(projection, proof) {
-	const errors = [];
-	const items = projection.items;
-	const evidence = projection.evidence;
-	for (const obligation of proof.obligations) {
-		const item = items.get(obligation.obligationId);
-		if (!item) {
-			errors.push("proof_obligation_unbound");
-			continue;
-		}
-		if (item.status !== "pending") {
-			errors.push("proof_obligation_not_pending");
-			continue;
-		}
-		if (item.verification.surface !== void 0 && item.verification.surface !== obligation.surface) errors.push("proof_surface_unbound");
-		const seen = /* @__PURE__ */ new Set();
-		for (const evidenceId of obligation.evidenceIds) {
-			const record = evidence.get(evidenceId);
-			if (!record) {
-				errors.push("proof_evidence_unknown");
-				continue;
-			}
-			if (!seen.has(evidenceId)) seen.add(evidenceId);
-			if (record.outcome !== "success") {
-				errors.push("proof_evidence_outcome_invalid");
-				continue;
-			}
-			if (!proofEvidenceConstraints(record, obligation)) errors.push("proof_evidence_constraint_failed");
-		}
-		if (obligation.kind === "scope_coverage") {
-			const itemScope = item.requestedTarget?.scope;
-			const itemSubject = item.verification.subject;
-			if (!obligation.subjectIds.every((subject) => subject === itemScope || subject === itemSubject)) errors.push("proof_scope_subject_unbound");
-		}
-	}
-	return [...new Set(errors)];
-}
-function canonicalProjection(projection) {
-	return {
-		epoch: projection.epoch,
-		contractRevision: projection.contractRevision,
-		sessionRefDigest: projection.sessionRefDigest,
-		hostLockDigest: projection.hostLockDigest,
-		hostStatus: projection.hostStatus,
-		hostCohortId: projection.hostCohortId,
-		integrity: projection.integrity,
-		items: [...projection.items.values()].map(({ id, revision, kind, status, semanticAction, requestedTarget, verification }) => ({
-			id,
-			revision,
-			kind,
-			status,
-			semanticAction,
-			requestedTarget,
-			verification
-		})).sort((a, b) => a.id.localeCompare(b.id)),
-		evidence: [...projection.evidence.values()].map(({ id, epoch, toolName, outcome, capabilities, subjects, surfaces, operations, semanticAction, evidenceRole, resolvedTarget, observedState }) => ({
-			id,
-			epoch,
-			toolName,
-			outcome,
-			capabilities,
-			subjects,
-			surfaces,
-			operations,
-			semanticAction,
-			evidenceRole,
-			resolvedTarget,
-			observedState
-		})).sort((a, b) => a.id.localeCompare(b.id)),
-		checkpoints: projection.checkpoints.map(({ id, certificationDigest: certificationDigest$1, result }) => ({
-			id,
-			certificationDigest: certificationDigest$1,
-			result
-		}))
-	};
-}
-function sessionQuery(projection, proof) {
-	if (proof) {
-		if (validateProofManifest(proof).length) return {
-			sessionRefDigest: projection.sessionRefDigest,
-			epoch: projection.epoch,
-			contractRevision: projection.contractRevision,
-			state: "corrupt",
-			reasonCode: "proof_invalid",
-			cohortId: projection.hostCohortId
-		};
-		if (bindProofToProjection(projection, proof).length) return {
-			sessionRefDigest: projection.sessionRefDigest,
-			epoch: projection.epoch,
-			contractRevision: projection.contractRevision,
-			state: "corrupt",
-			reasonCode: "proof_unbound",
-			cohortId: projection.hostCohortId
-		};
-	}
-	const state = projection.integrity === "valid" ? projection.hostStatus === "supported" ? "valid" : "unknown" : projection.integrity;
-	return {
-		sessionRefDigest: projection.sessionRefDigest,
-		epoch: projection.epoch,
-		contractRevision: projection.contractRevision,
-		state,
-		...proof ? { proof } : {},
-		cohortId: projection.hostCohortId
-	};
-}
-function proofEvidenceConstraints(evidence, obligation) {
-	if (evidence.outcome !== "success" || evidence.surfaces.length !== 1 || evidence.surfaces[0] !== obligation.surface) return false;
-	if (!obligation.subjectIds.every((subject) => evidence.subjects.includes(subject))) return false;
-	if (obligation.kind === "subject_readback" && !(evidence.operations ?? []).some(({ op }) => op === "read" || op === "verify")) return false;
-	if (obligation.kind === "scope_coverage" && !(evidence.operations ?? []).some(({ op }) => op === "run" || op === "verify")) return false;
-	if (obligation.kind === "state_verification" && evidence.evidenceRole !== "state") return false;
-	return true;
-}
-
-//#endregion
-export { parseShellCommand as $, isStatefulAction as $n, isWholeTaskCompletionClaim as $t, createGitPrestateEnvelope as A, extractMethod as An, RC1_HOST_PACKAGES as At, CAPTURE_V042_NOTICE as B, namedActions as Bn, renderRecoveryPacket as Bt, SESSION_EVENT_ENVELOPE_INVALID as C, evidenceAvailabilityReason as Cn, SUPPORTED_HOST_VERSIONS as Ct, GIT_COMMAND_TEMPLATES as D, captureItem as Dn, satisfiesSupportedHostRange as Dt, GIT_COMMAND_MANIFEST_IDS as E, captureClause as En, parseHostVersion as Et, verifiedLinearCommitReadback as F, interpretMessage as Fn, DEFAULT_RECOVERY_CHAR_BUDGET as Ft, evidenceFromPersistedToolResult as G, ACTION_MANIFEST as Gn, CONTROL_RECORD_PREFIX as Gt, PROTOCOL_V4_NOTICE as H, statefulActionsOfScope as Hn, evidenceCoverage as Ht, FIRST_STEP_GUIDANCE as I, isExecutableItem as In, MIN_RECOVERY_CHAR_BUDGET as It, isDeterministicCheck as J, SEMANTIC_ACTIONS as Jn, classifyCompletionClaim as Jt, extractTextContent as K, ACTION_MANIFEST_VERSION as Kn, NO_PROGRESS_RECORD_PREFIX as Kt, claimedBatchHasRealRootInput as L, isOpenObligation as Ln, closingHint as Lt, gitCommandMatchesTarget as M, isInformationalMessage as Mn, authorityCaptureCounts as Mt, parseGitCommandManifest as N, segmentClauses as Nn, segmentAuthorityBlocks as Nt, commitIndexSnapshotDigest as O, classifyClause as On, RC015_RC2_HOST_PACKAGES as Ot, revalidateGitPrestate as P, interpretClause as Pn, certifyCheckpoint as Pt, parsePwshCommand as Q, actionCompatible as Qn, isRootPauseRequest as Qt, lifecyclePhase as R, kindOfScope as Rn, openItems$1 as Rt, SESSION_API_UNSUPPORTED as S, deriveItemDiagnosis as Sn, SUPPORTED_HOST_RANGE as St, snapshotSessionEvents as T, relevantEvidence as Tn, evaluateMinimumHostVersion as Tt, deriveProjection as U, canonicalRegistryBase as Un, evidenceMatchesItem as Ut, PROTOCOL_V3_NOTICE as V, semanticActionOfScope as Vn, bindingSatisfies as Vt, supersedeItem as W, npmEscapedPackageName as Wn, isVerifyingCapability as Wt, canonicalArgvFromCommand as X, STOP_PROTOCOL_VERSION as Xn, decideTurnStopping as Xt, withDurability as Y, STATEFUL_ACTIONS as Yn, decideTurnBoundary as Yt, isRunExecutable as Z, SUPPORTED_EVIDENCE_ADAPTERS as Zn, decisionBoundaryKey as Zt, packageRowsFromPnpmLock as _, rebindResponse as _n, evaluateToolSurfaceCapability as _t, createProofManifest as a, hasCurrentCertificate as an, validateActionTarget as ar, BASE_HOST_PACKAGES as at, resolveInstalledHostLock as b, isFrozenV042RebindResponse as bn, LATEST_SUPPORTED_HOST_VERSION as bt, sessionQuery as c, isCurrentAcceptedBoundary as cn, classifyTaskIntent as cr, GOAL_HOST_PACKAGES as ct, combineHostPolicy as d, createProjection as dn, digestStrings as dr, LEGACY_HOST_COHORTS as dt, latestAssistantText as en, requestedTargetAuthorizesMutation as er, ACTIVE_HOST_COHORT_ID as et, hostLockContextFromComposedDump as f, confirmRebind as fn, normalizeClause as fr, bindExecutableIdentity as ft, packageRowsFromActiveGraph as g, rebindAttemptKey as gn, evaluateHostLock as gt, inspectTargetHostGraph as h, proposeRebindV042 as hn, sha256 as hr, evaluateHostCapability as ht, canonicalProjection as i, goalCompletionDenial as in, validateActionManifest as ir, ALPHA2_HOST_PACKAGES as it, executeRevalidatedGitEffect as j, extractOperation as jn, ALPHA3_HOST_PACKAGES as jt, commitTreeSnapshotDigest as k, extractArtifactPaths as kn, RC015_HOST_PACKAGES as kt, validateProofManifest as l, qualifyBoundary as ln, classifyUserInteraction as lr, HOST_CAPABILITY_PACKAGE_GROUPS as lt, injectActiveProfileHostLock as m, proposeRebindOutcome as mn, sanitizeUrl as mr, evaluateExternalWaitCapability as mt, PROOF_PROTOCOL_VERSION as n, observeAssistantOutcome as nn, semanticActionFromCommand as nr, ACTIVE_HOST_LAUNCHER_VERSION as nt, proofDigest as o, availableBoundaryQualifications as on, COMMAND_SURFACE_MANIFEST as or, DEFAULT_HOST_LOCK as ot, hostLockRowsFromComposedDump as p, proposeRebind as pn, sanitizeClauseText as pr, bindLiveGoalCapability as pt, extractToolSubject as q, CERTIFICATE_VERSION as qn, NO_PROGRESS_TURNS_BEFORE_STOP as qt, bindProofToProjection as r, progressFingerprint as rn, semanticActionFromText as rr, ALPHA2_DSHMARKET_139_HOST_PACKAGES as rt, proofEvidenceConstraints as s, effectuateBoundary as sn, validateManifest as sr, EXPECTED_HOST_PACKAGES as st, PROOF_KINDS as t, latestRootInstruction as tn, requestedTargetMatchesResolved as tr, ACTIVE_HOST_COHORT_IDS as tt, HostProfileError as u, currentContractDigest as un, canonicalizePath as ur, HOST_COHORTS as ut, readActiveHostGraph as v, replayRebindResult as vn, hostVersionFromPackages as vt, SessionApiError as w, itemDiagnosis as wn, compareHostVersions as wt, verifyComposedHostLockDump as x, parseConfirmationMessage as xn, MIN_SUPPORTED_HOST_VERSION as xt, resolveActiveProfileHostLock as y, CONFIRM_LINE_PATTERN as yn, selectHostCohort as yt, previewFirstStepInjection as z, maskCodeSpans as zn, recoveryDigest as zt };
+export { extractToolSubject as $, isFrozenV042RebindResponse as $n, sha256 as $r, proofDigest as $t, lifecyclePhase as A, decisionBoundaryKey as An, STATEFUL_ACTIONS as Ar, compareHostVersions as At, RELEASE_RESERVATION_PREFIX as B, effectuateBoundary as Bn, semanticActionFromCommand as Br, certifyCheckpoint as Bt, gitCommandMatchesTarget as C, isVerifyingCapability as Cn, npmEscapedPackageName as Cr, evaluateToolSurfaceCapability as Ct, FIRST_STEP_GUIDANCE as D, classifyCompletionClaim as Dn, CERTIFICATE_VERSION as Dr, MIN_SUPPORTED_HOST_VERSION as Dt, verifiedLinearCommitReadback as E, NO_PROGRESS_TURNS_BEFORE_STOP as En, BOUNDED_ARTIFACT_TYPES as Er, LATEST_SUPPORTED_HOST_VERSION as Et, PROTOCOL_V4_NOTICE as F, observeAssistantOutcome as Fn, boundedArtifactChoiceMatches as Fr, RC015_HOST_PACKAGES as Ft, readbackSettlesContract as G, confirmRebind as Gn, validateManifest as Gr, PROOF_PROTOCOL_VERSION as Gt, contractById as H, qualifyBoundary as Hn, validateActionManifest as Hr, PROOF_KINDS as Ht, PROTOCOL_V5_NOTICE as I, progressFingerprint as In, isStatefulAction as Ir, RC1_HOST_PACKAGES as It, releasePreEffectDecision as J, proposeRebindV042 as Jn, canonicalizePath as Jr, bindProofV2ToProjection as Jt, releaseContractFor as K, proposeRebind as Kn, classifyTaskIntent as Kr, PROOF_PROTOCOL_VERSION_V2 as Kt, deriveProjection as L, goalCompletionDenial as Ln, requestedIdentityKey as Lr, ALPHA3_HOST_PACKAGES as Lt, CAPTURE_V042_NOTICE as M, isWholeTaskCompletionClaim as Mn, STOP_PROTOCOL_VERSION_V2 as Mr, parseHostVersion as Mt, DEFAULT_DELEGATION_TOOL_NAMES as N, latestAssistantText as Nn, SUPPORTED_EVIDENCE_ADAPTERS as Nr, satisfiesSupportedHostRange as Nt, claimedBatchHasRealRootInput as O, decideTurnBoundary as On, CERTIFICATE_VERSION_V2 as Or, SUPPORTED_HOST_RANGE as Ot, PROTOCOL_V3_NOTICE as P, latestRootInstruction as Pn, actionCompatible as Pr, RC015_RC2_HOST_PACKAGES as Pt, extractTextContent as Q, CONFIRM_LINE_PATTERN as Qn, sanitizeUrl as Qr, proofCapabilityReport as Qt, RELEASE_OPERATIONS as R, hasCurrentCertificate as Rn, requestedTargetAuthorizesMutation as Rr, authorityCaptureCounts as Rt, executeRevalidatedGitEffect as S, evidenceMatchesItem as Sn, canonicalRegistryBase as Sr, evaluateHostLock as St, revalidateGitPrestate as T, NO_PROGRESS_RECORD_PREFIX as Tn, ACTION_MANIFEST_VERSION as Tr, selectHostCohort as Tt, inFlightReservation as U, currentContractDigest as Un, validateActionTarget as Ur, PROOF_KINDS_V2 as Ut, RELEASE_SETTLEMENT_PREFIX as V, isCurrentAcceptedBoundary as Vn, semanticActionFromText as Vr, PROOF_CAPABILITY_MATRIX as Vt, normalizeReleaseContract as W, createProjection as Wn, COMMAND_SURFACE_MANIFEST as Wr, PROOF_MANIFEST_DOMAIN_V2 as Wt, supersedeItem as X, rebindResponse as Xn, normalizeClause as Xr, createProofManifest as Xt, reservationFor as Y, rebindAttemptKey as Yn, digestStrings as Yr, canonicalProjection as Yt, evidenceFromPersistedToolResult as Z, replayRebindResult as Zn, sanitizeClauseText as Zr, createProofManifestV2 as Zt, GIT_COMMAND_MANIFEST_IDS as _, openItems as _n, kindOfScope as _r, LEGACY_HOST_COHORTS as _t, injectActiveProfileHostLock as a, requiredSubjectsOf as an, captureClause as ar, parseShellCommand as at, commitTreeSnapshotDigest as b, bindingSatisfies as bn, semanticActionOfScope as br, evaluateExternalWaitCapability as bt, packageRowsFromPnpmLock as c, sessionQueryV2 as cn, extractArtifactPaths as cr, ACTIVE_HOST_LAUNCHER_VERSION as ct, resolveInstalledHostLock as d, certifiableOpenItems as dn, isInformationalMessage as dr, BASE_HOST_PACKAGES as dt, proofDigestV2 as en, parseConfirmationMessage as er, isDeterministicCheck as et, verifyComposedHostLockDump as f, certificateClosure as fn, segmentClauses as fr, DEFAULT_HOST_LOCK as ft, snapshotSessionEvents as g, closingHint as gn, isOpenObligation as gr, HOST_COHORTS as gt, SessionApiError as h, MIN_RECOVERY_CHAR_BUDGET as hn, isExecutableItem as hr, HOST_CAPABILITY_PACKAGE_GROUPS as ht, hostLockRowsFromComposedDump as i, proofV2Rejection as in, relevantEvidence as ir, parsePwshCommand as it, previewFirstStepInjection as j, isRootPauseRequest as jn, STOP_PROTOCOL_VERSION as jr, evaluateMinimumHostVersion as jt, firstStepGuidance as k, decideTurnStopping as kn, SEMANTIC_ACTIONS as kr, SUPPORTED_HOST_VERSIONS as kt, readActiveHostGraph as l, validateProofManifest as ln, extractMethod as lr, ALPHA2_DSHMARKET_139_HOST_PACKAGES as lt, SESSION_EVENT_ENVELOPE_INVALID as m, DEFAULT_RECOVERY_CHAR_BUDGET as mn, interpretMessage as mr, GOAL_HOST_PACKAGES as mt, combineHostPolicy as n, proofHostSurfacesOf as nn, evidenceAvailabilityReason as nr, canonicalArgvFromCommand as nt, inspectTargetHostGraph as o, scopeCoverageDigest as on, captureItem as or, ACTIVE_HOST_COHORT_ID as ot, SESSION_API_UNSUPPORTED as p, unitDescendantIds as pn, interpretClause as pr, EXPECTED_HOST_PACKAGES as pt, releaseCoverage as q, proposeRebindOutcome as qn, classifyUserInteraction as qr, bindProofToProjection as qt, hostLockContextFromComposedDump as r, proofOperationMatches as rn, itemDiagnosis as rr, isRunExecutable as rt, packageRowsFromActiveGraph as s, sessionQuery as sn, classifyClause as sr, ACTIVE_HOST_COHORT_IDS as st, HostProfileError as t, proofEvidenceConstraints as tn, deriveItemDiagnosis as tr, withDurability as tt, resolveActiveProfileHostLock as u, validateProofManifestV2 as un, extractOperation as ur, ALPHA2_HOST_PACKAGES as ut, GIT_COMMAND_TEMPLATES as v, recoveryDigest as vn, maskCodeSpans as vr, bindExecutableIdentity as vt, parseGitCommandManifest as w, CONTROL_RECORD_PREFIX as wn, ACTION_MANIFEST as wr, hostVersionFromPackages as wt, createGitPrestateEnvelope as x, evidenceCoverage as xn, statefulActionsOfScope as xr, evaluateHostCapability as xt, commitIndexSnapshotDigest as y, renderRecoveryPacket as yn, namedActions as yr, bindLiveGoalCapability as yt, RELEASE_OPERATION_SURFACES as z, availableBoundaryQualifications as zn, requestedTargetMatchesResolved as zr, segmentAuthorityBlocks as zt };