dsh-completion-guard 0.6.1 → 0.6.3

package/dist/{index-C_N6DaSF.d.ts → index-CfEiC4bb.d.ts}

@@ -140,12 +140,25 @@ interface ScopeInterpretation {
   /** True only for an explicit, agent-owned, unconditional instruction. */
   immediatelyExecutable: boolean;
   authorityDisposition: AuthorityDisposition;
+  /** The 0.6.3 execution qualification this reading establishes. */
+  qualification: ExecutionQualification;
   /** Explicitly named tool/method, when the scope names one. */
   method?: string;
   /** Stable identity of this interpretation, reproducible from the same bytes. */
   fingerprint: string;
 }
 /**
+* 0.6.3 K1 regression probe: the 0.6.2 question rule, kept SOLELY so the fixed
+* defect has a test that fails against the old reading.
+*
+* 0.6.2 declared a clause information as soon as a question marker appeared
+* anywhere inside it (`QUESTION_SCOPE.test(masked)`). This function is that
+* rule, verbatim. It is not used by any production path — the current reading
+* is {@link hasQuestionScope} — and its only caller is the regression test that
+* pins the difference between the two readings on the recorded defect input.
+*/
+declare function legacyQuestionReadingIsInformational(masked: string): boolean;
+/**
 * The contract kind a scope maps to. A prohibition and an acceptance keep their
 * own lanes; everything else is a requirement. Acceptance is decided from the
 * clause's own head verb, so "确保构建通过" stays an acceptance while a
@@ -153,6 +166,182 @@ interface ScopeInterpretation {
 */
 declare function kindOfScope(directive: DirectiveClass, body?: string): GuardItemKind;
 declare function maskCodeSpans(text: string): string;
+/**
+* Whether a clause asks for information rather than ordering work (0.6.3 K1).
+*
+* 0.6.2 treated the mere presence of a question marker anywhere in a clause as
+* "the whole clause is a question", so one 是否 inside a comma-run of
+* instructions ("更新插件，检查是否存在更新，安装新主题，记录变更。") turned
+* every execution obligation beside it into closable information. The reading
+* is now grammatical — head verb, interrogative position, negation — so a
+* relative or purpose clause inside an order ("Create a file where logs are
+* stored", "更新皮肤中心，看看为什么失败") is never a question, while a real
+* request for an answer ("How do I install this?", "检查是否有更新吗？",
+* "check whether the remote has new commits") still is.
+*/
+declare function hasQuestionScope(masked: string): boolean;
+/**
+* Whether an explanation head GOVERNS its sentence.
+*
+* Everything coordinated inside the sentence the explanation heads is the OBJECT
+* of the explanation, however it is phrased and however long it is: a finite
+* complement ("how I can install …"), a `whether` complement, an infinitive, a
+* list with a long object — all of it is what the root asked to have explained.
+* The scope is therefore structural: it is the SENTENCE, bounded by the sentence
+* splitter, not a pattern with a window. A sentence break ends the governance, so
+* a following sentence can be a real instruction ("Explain the deploy. Then
+* restart service api." stays authorizable), and a question that merely stands
+* beside an order ("What changed and archive the logs?") has no explanation head
+* and keeps its order.
+*/
+declare function reportingHeadGoverns(masked: string): boolean;
+/**
+* Whether a clause is the scope of a QUESTION — any question, not only a reported
+* one: a question word ("How do I install …"), an interrogative auxiliary
+* ("Can you …"), an investigation ("Check whether …") or an explanation
+* ("Explain how …").
+*
+* A question head GOVERNS its clause: everything coordinated inside it is part of
+* what the root asked, so the clause must not be split into an executable child.
+* When such a clause ALSO carries an action of its own it is undecided — the
+* action may be exactly what the question is about — so nothing in it is
+* authority. Exported so the mutation gate and preparation consume the SAME
+* qualification the reading produced instead of re-guessing scope from the split
+* text, and so the rule is testable on its own.
+*/
+declare function isQuestionScopeNeedingReview(text: string): boolean;
+/**
+* 0.6.3 (narrowed contract): the execution qualification of one reading.
+*
+* Recognising an ACTION and holding AUTHORITY to run it are separate facts. The
+* reader decides, ONCE per clause and BEFORE any partition, whether the clause is
+* a `granted` plain instruction or a `restricted` governed scope (a question, an
+* explanation, an investigation, a reported question, or a quote). Every child the
+* partition later produces INHERITS that decision; nothing downstream — not the
+* projection, not recovery, not preparation — may upgrade a child to executable by
+* re-reading its own words (the earlier rounds' fail-open direction).
+*
+* `restricted` is not "no work": a restricted clause that names an action keeps it
+* as an undecided obligation ({@link AuthorityDisposition} `unresolved`) which no
+* answer closes and no certificate covers.
+*/
+type QualificationStatus = "granted" | "restricted";
+type QualificationReason = "plain_instruction" | "governed_scope" | "unproven_scope" | "inherited_restriction" | "legacy_missing_qualification";
+interface ExecutionQualification {
+  status: QualificationStatus;
+  reason: QualificationReason;
+  /** The governing head that restricted the clause, when one exists. */
+  governedBy?: string;
+}
+/** Blank out every quoted span of the text. */
+declare function maskQuotedSpans(text: string): string;
+/**
+* Whether the clause's OWN span asks something, even when no governed head was
+* recognised. This is the fail-closed half of the qualification: a clause whose
+* question content the reader could not classify (`I wonder whether …`, a
+* postposed 是否可行, a stray question mark) is still a scope that cannot host
+* execution authority. Code spans, quotes and subordinate spans do not count:
+* their content belongs to them, not to the clause.
+*/
+declare function clauseAsksOwnQuestion(text: string): boolean;
+/**
+* Whether the clause is a DIRECTIVE: an imperative in the root's voice. The action
+* must OPEN the clause once the request preface is consumed ("重启 api 服务。",
+* "Then restart service api.", "请更新插件"), and the clause must not be a report
+* or a third-party statement ("The technicians restart service api every night.",
+* "日志显示运维人员重启 api 服务。").
+*/
+declare function opensWithDirective(masked: string): boolean;
+/**
+* The content a restatement introduces: the Y of "把 X 明确为 Y" / "record X as Y".
+* Everything the restatement AUTHORIZES comes from this span, and nothing else.
+*/
+declare function restatedContentOf(text: string): string | undefined;
+/** The span a restatement CLARIFIES: everything before its marker. */
+declare function clarifiedSpanOf(text: string): string | undefined;
+/** Whether the clause is an explicit re-statement of what an obligation means. */
+declare function isRestatement(text: string): boolean;
+/**
+* Whether the clause is a PROTECTED scope: a question, an explanation, an
+* investigation, a reported question, a quote, or any span whose own question
+* content the head reader could not classify. A protected scope is indivisible —
+* no separator opens a child of it — and nothing inside it is execution authority.
+*/
+declare function clauseIsProtected(text: string): boolean;
+/** A clause nobody has questioned: its own reading is the authorization. */
+declare const GRANTED_QUALIFICATION: ExecutionQualification;
+/** A record captured before the qualification existed: never granted by default. */
+declare const LEGACY_QUALIFICATION: ExecutionQualification;
+/**
+* Whether a QUESTION/EXPLANATION/INVESTIGATION head governs the clause: the one
+* governance predicate every layer consumes (the partitioner, the classifier, the
+* reading, and — through the stored qualification — the gate and preparation).
+*/
+declare function questionHeadsClause(masked: string): boolean;
+/** Whether the clause's own reading is a governed scope. */
+declare function clauseIsGoverned(masked: string): boolean;
+/** The qualification the reader records for one clause. */
+declare function qualificationOfClause(text: string): ExecutionQualification;
+/**
+* Whether a GOVERNED clause carries work that its own question does not bound, so
+* that the clause must stay undecided rather than enter the answer lane.
+*
+* The test is structural and vocabulary-free in the direction that matters:
+*
+* - a coordination AFTER the clause's own question word puts the coordinated part
+*   inside the question's scope ("…是否安装 foo 并重启 api 服务"), so the whole
+*   clause is undecided whatever the verbs are;
+* - material BEFORE the question word that carries an action is the questioned
+*   span itself ("检查一下[安装 foo 并重启 api 服务]是否安全"), so it is undecided;
+* - a governed head with no question word of its own is undecided as soon as it
+*   names an action ("Check the safety of installing foo and restart service
+*   api.", "Explain the incident, rotate every credential").
+*
+* A pure question — the object list of "检查一下本地插件和皮肤是否有更新", a state
+* question like "检查是否有新版本。" — carries none of these and stays answerable.
+*/
+declare function governedClauseRestrictsExecution(text: string): boolean;
+declare function hasOrderedCoordination(masked: string): boolean;
+/** @deprecated Use {@link isQuestionScopeNeedingReview}: the rule is not limited to explanations. */
+declare const isExplanationScope: (text: string) => boolean;
+/**
+* Whether a coordinated part of the explanation's sentence opens with an action
+* of its own. Those are exactly the parts whose membership in the explanation
+* cannot be decided from the surface, so they make the sentence undecided instead
+* of answerable or executable. `masked` has code spans blanked, so an action that
+* only appears inside backticks contributes nothing.
+*/
+declare function explanationHasActionResidue(masked: string): boolean;
+declare function isInformationalFragment(masked: string): boolean;
+declare function splitTextFragments(text: string, from?: number): Array<{
+  text: string;
+  offset: number;
+}>;
+/**
+* Whether the text after a coordinating conjunction opens a DISTINCT
+* instruction: its own action head, optionally behind a connector and an
+* actor. This is the rule the sentence splitter already used to decide that a
+* conjunction joins two instructions rather than two objects, exposed so the
+* fragment splitter cannot contradict it.
+*/
+declare function introducesActionClause(text: string): boolean;
+/**
+* Every action word in `[offset, before)`, ordered by position, with the words
+* that are only a prefix of a longer action removed (the 升 of 升级, the 然 of
+* 然后). The remaining candidates are the verbs an instruction can be about.
+*/
+declare function actionVerbMatches(text: string, offset?: number, before?: number): Array<{
+  index: number;
+  length: number;
+}>;
+/**
+* True when a negator's scope covers the verb starting at `index`.
+*
+* The negator has to be phrase-initial, so the 不 of 手动 and the 无 of 无论 are
+* not read as bans; a contrast or list separator between the negator and the
+* verb ends its scope ("不仅…而且运行" keeps the run positive).
+*/
+declare function verbIsNegated(text: string, index: number): boolean;
 /** Interpret one already-segmented clause. */
 declare function interpretClause(text: string, options?: InterpretOptions): ScopeInterpretation;
 /** Interpret a whole message into independent scopes, in source order. */
@@ -172,6 +361,23 @@ declare function isExecutableItem(item: {
   authorityDisposition?: AuthorityDisposition;
   waitAuthorization?: unknown;
 }): boolean;
+/**
+* The ONE authority predicate the mutation gate and preparation both consume.
+*
+* A record holds execution authority only when the reader GRANTED it a
+* qualification: a record with no qualification at all (captured before the
+* qualification existed) is refused rather than read from its stored
+* disposition, and a restricted record — anything a question, explanation,
+* investigation, reported question or quote governs — keeps its work as an
+* undecided obligation that authorizes nothing. Within a granted reading, the
+* disposition still decides: a prohibition, a wait, a human actor, a condition or
+* an information range is never a mutation. An `unresolved` GRANTED reading keeps
+* the historical path documented for unrecognised instruction forms.
+*/
+declare function itemHoldsExecutionAuthority(item: {
+  executionQualification?: ExecutionQualification;
+  authorityDisposition?: AuthorityDisposition;
+}): boolean;
 /** Whether an item is an open obligation for certification purposes. */
 declare function isOpenObligation(item: GuardItem): boolean;
 /**
@@ -190,6 +396,147 @@ declare function statefulActionsOfScope(body: string): StatefulAction[];
 /** Actions this interpretation names, in source order (diagnostics only). */
 declare function namedActions(text: string): string[];
 //#endregion
+//#region src/domain/capability-semantics.d.ts
+/**
+* 0.6.2 D062-01/D062-02: the shared, versioned semantics for WHAT the guard
+* knows, WHY it cannot certify, and WHICH remedy is actually reachable.
+*
+* The verdict is deliberately one closed projection instead of a pile of
+* ad-hoc strings, because every consumer (prepare, checkpoint detail, recovery
+* packet, rebind query, status) must render the same answer. Two failure modes
+* are excluded by construction:
+*
+* 1. The guard never turns its own missing adapter into a user-authority gap.
+*    An unsupported capability says "complete the work honestly and do not
+*    claim a certificate"; it never asks the user to restate the request as
+*    install/modify, and it never asks for input the user already gave.
+* 2. The guard never claims a fact it did not read. `declaredExitCode:
+*    'unknown'` stays unknown however successful the host tool call looked,
+*    and an opaque compound runner stays `operationAttribution: 'unknown'`
+*    rather than inheriting the last command's exit status.
+*
+* The taxonomy is written once here and consumed by every lane, so a future
+* capability must declare its own gap kind and remedy instead of drifting into
+* a sentence list. Nothing in this module mutates contract, evidence, digest,
+* certificate, or historical record state.
+*/
+/** Fine-grained, mutually exclusive reasons a contract item is not certified. */
+type CapabilityGap = "none" | "closed" | "constraint" | "interpretation_unknown" | "missing_adapter" | "target_missing" | "input_ambiguous" | "legacy_migration_required" | "host_unavailable" | "historical_preevidence_missing" | "operation_unattributable" | "condition_pending" | "delivery_pending";
+/** The reachable remedy for one gap. `remedy` is the machine-readable form of
+* `next_action`; the two are produced together so they cannot disagree. */
+type CapabilityRemedy = "none" | "collect_evidence" | "supply_target" | "await_root_input" | "deliver_answer" | "record_interpretation" | "report_uncertified" | "report_uncertified_capability_gap" | "restore_host" | "readback_only" | "fresh_root_instruction";
+interface CapabilityFact {
+  /**
+  * Whether this obligation's OWN action belongs to the certification action
+  * set in the installed cohort. It is deliberately independent of
+  * authorization: `false` says the build has no such capability, NEVER that
+  * the user did not authorize the work, and NEVER that the work may not be
+  * done. A `generic_run` obligation has no concrete action to support.
+  */
+  actionSupported: boolean;
+  /** A durable certification path exists for this item's own contract. */
+  certifiable: boolean;
+  gap: CapabilityGap;
+  remedy: CapabilityRemedy;
+  /** Reason codes that describe the evidence chain, never new authority. */
+  blockingReasonCodes: string[];
+}
+/**
+* Whether the item's obligation has a certification path in this cohort at
+* all. A generic_run item names no concrete action: the manifest still has a
+* generic entry (the guard may run and observe ordinary commands) but no
+* user-level completion contract can be certified from it, so the item is
+* uncertifiable while ordinary execution remains entirely permitted.
+*/
+declare function actionHasCertificationPath(action: SemanticAction, legacyMigration: boolean): boolean;
+/** The capability classification of an item's own obligation contract. */
+declare function capabilityFactOf(item: GuardItem): CapabilityFact;
+/**
+* What the console itself declared about the process. `declaredExitCode` is
+* `'unknown'` unless a real marker or a structured host fact said otherwise:
+* a host tool call that was not marked as an error is NOT a read exit code.
+*/
+type ProcessExitStatus = number | "unknown";
+/**
+* Why `outcome` says what it says, so a display or a consumer never reads more
+* than the source supports.
+*/
+type ProcessOutcomeReason = "declared_exit_code" | "declared_negative_marker" | "host_error_flag" | "unmarked_renderer_success" | "marker_unclassified" | "backgrounded" | "text_scan_inconclusive";
+/**
+* How far the console let the guard attribute effects to the obligation's own
+* operation. `unknown` is the honest answer for every opaque compound runner:
+* the last command's success never covers an earlier failure.
+*/
+type OperationAttribution = "single_operation" | "declared_per_operation" | "unknown";
+/** A credible per-operation subset the host itself declared. */
+interface DeclaredOperationResult {
+  action: string;
+  outcome: "success" | "failure" | "unknown";
+}
+/** Which source declared the terminal facts this reading is based on. */
+type ProcessFactSource = "run_declaration" | "structured_meta" | "rendered_markers";
+interface DerivedProcessFacts {
+  /** What the host tool call returned, before any interpretation. */
+  hostToolReturned: "result" | "error";
+  /** The console's own exit status, or `unknown` when never read. */
+  declaredExitCode: ProcessExitStatus;
+  /** Whether an explicit terminal marker (positive or negative) was read. */
+  terminalMarkerRead: boolean;
+  /** The outcome THIS LAYER derives from its own sources. It is deliberately a
+  * separate value from the frozen evidence `outcome`: the frozen field keeps
+  * the historical rule (0.6.1 and earlier read only `meta.exitCode` and the
+  * rendered markers, never the run declaration), while this layer reads the
+  * run declaration first. The two may therefore differ, and when they do the
+  * difference is stated in `frozenOutcomeConflict` rather than hidden by
+  * rewriting the historical field. */
+  outcome: "success" | "failure" | "unknown";
+  /** Why this layer's outcome is what it is. */
+  outcomeReason: ProcessOutcomeReason;
+  /** The highest-priority source that declared the facts used here. */
+  source: ProcessFactSource;
+  /** True when this layer's outcome differs from the frozen evidence
+  * `outcome`. A consumer that needs the historical reading uses the frozen
+  * field; a consumer that needs the run's own declaration uses this layer and
+  * can see that the two disagree. */
+  frozenOutcomeConflict: boolean;
+  /** How far the guard could attribute effects to the operation. */
+  operationAttribution: OperationAttribution;
+  /** Exactly the sub-results a trusted producer declared, if any. */
+  declaredOperationResults?: DeclaredOperationResult[];
+}
+/**
+* `partial_failure` may be reported only from a credible structured
+* per-operation result, and only for the exact declared subset. `unknown`
+* stays unknown: the guard never reconstructs a per-operation verdict from
+* stderr text, and never widens a declared subset into a claim about the rest.
+*/
+declare function partialFailureOf(facts: DerivedProcessFacts): {
+  failed: DeclaredOperationResult[];
+} | undefined;
+/** The one-line consequence of a gap kind, shared so no lane re-invents it. */
+declare function capabilityConsequence(gap: CapabilityGap): string;
+/**
+* D062-03: the applicable condition every removal-like outcome must carry.
+* "Clean" or "no longer listed" never proves "no dependants", so a completed
+* subset stays reported as the subset it is. These are the execution-side
+* facts the guard can name but cannot observe; it states them instead of
+* inventing a generic remover or promising an automatic block.
+*/
+declare const DEPENDENCY_FREE_ONLY_CONDITION: readonly string[];
+/** The per-object dependency status a report must keep separate. */
+type DependencyStatus = "dependency_free" | "in_use" | "unknown";
+/** Whether one candidate object may enter the automatic removal set. */
+declare function admissibleForRemoval(status: DependencyStatus): boolean;
+interface RemovalOutcomeReport {
+  metadataRemoved: "yes" | "no" | "unknown";
+  contentRemoved: "yes" | "no" | "partial" | "unknown";
+  directoryRemoved: "yes" | "no" | "unknown";
+}
+/** Only an object proven dependency-free AND fully removed may read as done. */
+declare function removalIsComplete(report: RemovalOutcomeReport, status: DependencyStatus): boolean;
+/** A partially removed object or an unknown dependant is never "no impact". */
+declare function removalIsPartiallyKnown(report: RemovalOutcomeReport, status: DependencyStatus): boolean;
+//#endregion
 //#region src/domain/rebind.d.ts
 interface RebindArgs {
   operation: "propose" | "query" | "withdraw";
@@ -480,6 +827,21 @@ type GuardItemStatus = "pending" | "answered" | "passed" | "superseded";
 type GuardIntegrity = "valid" | "unknown" | "corrupt";
 type EvidenceOutcome = "success" | "failure" | "unknown" | "durability-unknown";
 type GuardOperation = "create" | "write" | "modify" | "read" | "run" | "verify";
+/**
+* 0.6.3 K2: where an obligation's requested target came from. A target is a
+* user SELECTION only when the root named it or a trusted host selection made
+* it; an environment default (the session working directory, a recent tool
+* path, a model-supplied selector) resolves and corroborates a target the root
+* already allowed, and never manufactures root authority. An inherited target
+* comes from another obligation of the same work unit whose own source is
+* auditable.
+*/
+type TargetSourceKind = "explicit_label" | "explicit_path" | "explicit_current_repository" | "host_selection" | "unit_inherited" | "environment_default";
+interface TargetSource {
+  kind: TargetSourceKind;
+  /** Source message id of the obligation a `unit_inherited` target came from. */
+  inheritedFrom?: string;
+}
 type TargetValue = boolean | number | string | {
   k: "b" | "i" | "s" | "e" | "x";
   v: unknown;
@@ -489,7 +851,25 @@ type EvidenceRole = "resolution" | "effect" | "state";
 type EvidenceParseStatus = "supported" | "unsupported_statement_operator" | "unsupported_command" | "malformed_quote" | "adapter_unavailable";
 type HostStatus = "supported" | "unsupported" | "unavailable";
 type TargetCaptureStatus = "resolved" | "clarification_required";
-type TargetCaptureReasonCode = "requested_target_package_id_missing" | "requested_target_artifact_id_missing" | "requested_target_repository_missing" | "requested_target_service_id_missing" | "requested_target_registry_missing_or_invalid";
+/**
+* 0.6.3 K4: why a record captured under the rules of an EARLIER release can no
+* longer be reused as a current pass. The record itself is never rewritten —
+* its historical status (including `answered`) stays the historical fact it
+* was — but the current eligibility layer refuses to inherit it and the
+* obstruction blocks new certificates and Goal completion until the root
+* resolves it. It is deliberately a hard block, not a warning: 0.6.2 published
+* a mixed request as answered, and a warning would have left exactly that
+* misreading in force.
+*/
+type NeedsReviewReason = "legacy_mixed_information_scope" | "legacy_environment_default_target" | "unknown_state_version" | "legacy_missing_execution_qualification";
+interface NeedsReviewFact {
+  reason: NeedsReviewReason;
+  /** Stable identity of the eligibility check that raised it. */
+  checkId: string;
+  /** When the check was applied: this is an upgrade fact, not a birth fact. */
+  recordedAtRevision: number;
+}
+type TargetCaptureReasonCode = "requested_target_package_id_missing" | "requested_target_artifact_id_missing" | "requested_target_repository_missing" | "requested_target_repository_ambiguous" | "requested_target_field_ambiguous" | "requested_target_service_id_missing" | "requested_target_registry_missing_or_invalid";
 interface GoalRef {
   id: string;
   revision: number;
@@ -592,6 +972,17 @@ interface GuardItem {
   requestedTarget?: TargetTuple;
   targetCaptureStatus?: TargetCaptureStatus;
   targetCaptureReasonCode?: TargetCaptureReasonCode;
+  /**
+  * 0.6.3 K2 provenance of {@link requestedTarget}. Absent on items captured by
+  * 0.6.2 and earlier, whose target reading is historical and evaluated by the
+  * upgrade eligibility check rather than re-interpreted.
+  */
+  targetSource?: TargetSource;
+  /**
+  * 0.6.3 K4: set by the upgrade eligibility check when this record cannot be
+  * inherited as a current pass. It never overwrites the historical status.
+  */
+  needsReview?: NeedsReviewFact;
   authority?: "root_instruction" | "root_adoption" | "legacy_authority_unclassified";
   legacyFlags?: Array<"legacy_generic_run" | "legacy_authority_unclassified">;
   /** v0.5 intent layer: inquiries keep the obligation but are not machine certifiable. */
@@ -606,6 +997,14 @@ interface GuardItem {
   directive?: DirectiveClass;
   executee?: Executee;
   authorityDisposition?: AuthorityDisposition;
+  /**
+  * 0.6.3 (narrowed contract): whether this reading may host execution authority.
+  * Established ONCE by the reader, before any partition, and inherited by every
+  * child the partition produces. Absent on records captured before the
+  * qualification existed: the gate and preparation refuse those rather than
+  * reading their stored disposition as permission.
+  */
+  executionQualification?: ExecutionQualification;
   /** The unresolved condition guarding a `conditional_wait` item. */
   condition?: string;
   /** The event that ends a human wait, when the source names one. */
@@ -711,6 +1110,18 @@ interface GuardEvidence {
   adapterVersion?: string;
   externalOperationRef?: ExternalOperation;
   /**
+  * 0.6.2 D062-02: the LAYERED reading of a shell result, kept beside — never
+  * instead of — the frozen `outcome`/`parseStatus` pair. It separates four
+  * different claims the historical single `outcome` conflated: what the host
+  * tool call returned, what the console actually declared about the process
+  * (an exit code and its signal, or `unknown` when none was read), how far the
+  * effect could be attributed to this obligation's own operation, and the
+  * resulting business outcome. It is derived at replay from the same bytes, is
+  * excluded from every historical digest and certificate domain, and never
+  * rewrites an old `outcome`. Only shell-tool facts carry it.
+  */
+  processFacts?: DerivedProcessFacts;
+  /**
   * 0.6.0 C04: this fact came from a delegated subagent/task round-trip. A
   * delegated result is BOUNDED evidence for the parent unit — it is recorded
   * and visible, and it can never close a parent obligation or a parent unit
@@ -1096,6 +1507,13 @@ interface CaptureScope {
   /** Session working directory; used as the scope subject when no artifact path is named. */
   cwd?: string;
 }
+/**
+* The repository an obligation resolves to when the root wrote no repository
+* at all (0.6.3 K2). The environment default is preserved so a later
+* work-unit inheritance decision can evaluate it, but it is never reported as
+* a resolved user selection.
+*/
+declare function environmentDefaultRepositoryTarget(action: SemanticAction, subject: string): TargetTuple | undefined;
 declare function extractArtifactPaths(text: string): string[];
 /**
 * Split a single human message into independently tracked clauses. Sentence
@@ -1188,18 +1606,6 @@ declare function isFrozenV042RebindResponse(recorded: unknown): boolean;
 //#endregion
 //#region src/domain/conversation.d.ts
 type UserInteractionKind = "instruction" | "conversational";
-/**
-* Classify a direct user message (or one clause of it) as an actionable
-* `instruction` or a session-layer `conversational` utterance. Only
-* conversational results drop capture, so the classifier fails closed:
-* everything it cannot confidently recognize as session-layer talk stays an
-* instruction and is captured exactly as before.
-*
-* Order matters: progression and prohibition leads first, then strong task
-* features (artifact path, explicit method, or a non-negated operation verb
-* outside progression/meta spans), then the meta-question and meta-comment
-* forms, and finally a progression lead over a featureless remainder.
-*/
 declare function classifyUserInteraction(text: string): UserInteractionKind;
 type TaskIntent = "inquiry" | "action";
 /**
@@ -1529,6 +1935,26 @@ declare const PROTOCOL_V4_NOTICE = "Context Guard protocol boundary: v4.0.0";
 */
 declare const PROTOCOL_V5_NOTICE = "Context Guard protocol boundary: v5.0.0";
 /**
+* The pure upgrade-eligibility predicate: the records in the current closure
+* scope that may NOT be inherited as a current pass, with the reason that
+* disqualifies each. Exported so the rule can be tested and read back directly,
+* never to let a caller skip it.
+*/
+declare function legacyRecordsNeedingReview(projection: GuardProjection): Array<{
+  itemId: string;
+  reason: NeedsReviewReason;
+}>;
+/**
+* Apply the 0.6.3 eligibility pass to an already-derived projection.
+*
+* This is the upgrade entry: it re-checks the records a session already holds
+* after an EVENT-SOURCED reading has been applied to them. It is idempotent —
+* a project already marked keeps its original reason and revision — and it is
+* the same function the derivation runs, so a replay and an in-place upgrade
+* cannot disagree.
+*/
+declare function applyUpgradeEligibility(projection: GuardProjection): void;
+/**
 * Pure, deterministic re-derivation of the guard projection from the DSH
 * native event log. Context Guard never writes custom session events, so every
 * piece of state is derived from `command/run`, `user/message`, `tool/call`,
@@ -1552,6 +1978,12 @@ type ReasonClass = "parameter_missing" | "source_insufficient" | "condition_unme
 //#region src/domain/diagnostics.d.ts
 type TaskKind = "inquiry" | "action" | "deliverable" | "constraint" | "unresolved";
 type CertificationSupport = "supported" | "unsupported" | "needs_target" | "needs_evidence" | "unavailable";
+/**
+* Whether anything can still be repaired, and by whom (0.5, corrected by 0.6.2
+* D062-01). `user_input_required` means a real root choice was never made
+* (a genuinely absent identity or target selection) — never a capability this
+* build simply does not have, and never a request to re-word an instruction.
+*/
 type Repairability = "agent_repairable" | "user_input_required" | "unsupported" | "historical_gap" | "none";
 interface DiagnosisNextAction {
   kind: "report_only" | "collect_evidence" | "checkpoint" | "clarify_target" | "restore_host" | "none";
@@ -1572,6 +2004,13 @@ interface UnifiedItemDiagnosis {
   /** The seven-class label this fine-grained reason code belongs to (C12). */
   reason_class: ReasonClass;
   repairability: Repairability;
+  /**
+  * 0.6.2 D062-01: WHAT the guard knows and WHICH remedy is reachable, shared
+  * by every consumer. `reason_code` stays the fine display code; the
+  * capability fact explains the remedy, so no lane infers a root cause — or
+  * invents a reachable path — from one enum.
+  */
+  capability: CapabilityFact;
   missing_fields: string[];
   missing_facets: Array<"resolution" | "effect" | "state">;
   next_action: DiagnosisNextAction;
@@ -1600,6 +2039,13 @@ declare function itemDiagnosis(p: GuardProjection, item: GuardItem): {
 declare function evidenceAvailabilityReason(evidence: GuardEvidence): string | undefined;
 /** Shared display filter; certification remains the full domain check. */
 declare function relevantEvidence(p: GuardProjection, item: GuardItem, evidence: GuardEvidence): boolean;
+/**
+* The bounded, one-phrase form of a reachable remedy (0.6.2 D062-01). The
+* capability consequence above is the full explanation; a bounded page lists
+* many items, so it uses this phrase and leaves the prose to the detail and
+* preparation surfaces. Both come from the SAME capability fact.
+*/
+declare function capabilityRemedyPhrase(remedy: CapabilityRemedy): string;
 //#endregion
 //#region src/domain/evidence.d.ts
 interface ToolCallInput {
@@ -1638,6 +2084,8 @@ interface ToolSubject {
   reasonCode?: string;
   adapterId?: string;
   adapterVersion?: string;
+  /** 0.6.2 D062-02: the layered shell reading, present only for shell tools. */
+  processFacts?: DerivedProcessFacts;
   externalOperationRef?: ExternalOperation;
 }
 declare function extractToolSubject(call: ToolCallInput, result: ToolResultInput, defaultCwd?: string, hostLock?: HostLockEvaluation): ToolSubject;
@@ -2229,6 +2677,40 @@ interface RecoveryOptions {
 declare const DEFAULT_RECOVERY_CHAR_BUDGET = 4e3;
 declare const MIN_RECOVERY_CHAR_BUDGET = 512;
 /**
+* 0.6.2 D062-03: the standing condition a removal or cleanup outcome must keep.
+* The guard cannot observe another process's cwd or handles, so it states the
+* condition instead of inferring "no dependants" from a clean tree, an empty
+* `git worktree list`, or a directory that merely looks empty. This is one
+* shared wording, not an incident phrase list, and it never claims the plugin
+* can block a dangerous removal on its own.
+*/
+declare const CLEANUP_CONDITION_RULE: string;
+/**
+* The same condition at a medium budget (0.6.2 review): shorter than the full
+* rule, and still explicit that an unknown dependant forbids the claim.
+*/
+declare const CLEANUP_CONDITION_RULE_SHORT: string;
+/**
+* The same condition at emergency budget (0.6.2 review). A packet with fewer
+* than 1000 characters cannot carry the longer sentences AND its own rules, so
+* the condition is compressed — but it is NEVER omitted: the one thing a compact
+* packet must not lose is that an unknown dependant forbids a removal claim.
+*/
+declare const CLEANUP_CONDITION_RULE_COMPACT: string;
+/**
+* Pick the longest form of the condition the packet's budget can actually
+* afford. The caller reserves this line's length before any optional row, so
+* the condition is never the text that gets clipped.
+*/
+declare function cleanupConditionFor(budget: number): string;
+/**
+* Whether this gap needs the cleanup condition spelled out. The condition
+* belongs to every uncertifiable lane that could describe removal-like work —
+* which the guard cannot identify from text — so it rides the CAPABILITY
+* limitation itself, never a vocabulary of destructive verbs.
+*/
+declare function carriesCleanupCondition(gap: CapabilityGap): boolean;
+/**
 * An actionable one-line hint for how an open item's verification contract can
 * be closed. It never weakens the contract; it only names the missing facet so
 * the agent can produce the right evidence shape instead of reverse-engineering
@@ -2419,4 +2901,4 @@ declare function latestAssistantText(events: readonly {
 //#region src/domain/supersession.d.ts
 declare function supersedeItem(items: Map<string, GuardItem>, oldId: string, replacement: GuardItem): boolean;
 //#endregion
-export { canonicalProjection as $, boundedArtifactChoiceMatches as $a, SourceSpan as $i, AuditedExecutable as $n, isFrozenV042RebindResponse as $r, GitCommandParseResult as $t, openItems as A, interpretMessage as Aa, DeriveConfig as Ai, extractToolSubject as An, HostVersionDecision as Ar, claimedBatchHasRealRootInput as At, ProofHostSurface as B, ActionManifest as Ba, GoalRef as Bi, itemDiagnosis as Bn, satisfiesSupportedHostRange as Br, injectActiveProfileHostLock as Bt, RC015_RC2_HOST_PACKAGES as C, replayRebindResult as Ca, AssetInterpretationFact as Ci, goalCompletionDenial as Cn, bindLiveGoalCapability as Cr, OperationVerbEntry as Ct, MIN_RECOVERY_CHAR_BUDGET as D, InterpretOptions as Da, BoundaryQualificationKind as Di, ToolSubject as Dn, evaluateToolSurfaceCapability as Dr, FirstStepInjection as Dt, DEFAULT_RECOVERY_CHAR_BUDGET as E, Executee as Ea, BoundaryDisposition as Ei, ToolResultInput as En, evaluateHostLock as Er, FIRST_STEP_GUIDANCE as Et, PROOF_KINDS as F, namedActions as Fa, EvidenceOutcome as Fi, Repairability as Fn, SUPPORTED_HOST_RANGE as Fr, HostProfileError as Ft, ProofManifestV2 as G, SEMANTIC_ACTIONS as Ga, GuardItem as Gi, PROTOCOL_V4_NOTICE as Gn, authorityCaptureCounts as Gr, resolveActiveProfileHostLock as Gt, ProofKindCapability as H, BOUNDED_ARTIFACT_TYPES as Ha, GuardCheckpoint as Hi, CAPTURE_V042_NOTICE as Hn, AuthorityBlock as Hr, packageRowsFromActiveGraph as Ht, PROOF_KINDS_V2 as I, semanticActionOfScope as Ia, EvidenceParseStatus as Ii, TaskKind as In, SUPPORTED_HOST_VERSIONS as Ir, TargetHostGraph as It, ProofSurface as J, STOP_PROTOCOL_VERSION_V2 as Ja, GuardOperation as Ji, ACTIVE_HOST_COHORT_ID as Jn, UserInteractionKind as Jr, GIT_COMMAND_MANIFEST_IDS as Jt, ProofObligation as K, STATEFUL_ACTIONS as Ka, GuardItemKind as Ki, PROTOCOL_V5_NOTICE as Kn, segmentAuthorityBlocks as Kr, resolveInstalledHostLock as Kt, PROOF_MANIFEST_DOMAIN_V2 as L, statefulActionsOfScope as La, EvidenceRole as Li, UnifiedItemDiagnosis as Ln, compareHostVersions as Lr, combineHostPolicy as Lt, renderRecoveryPacket as M, isOpenObligation as Ma, DeriveScope as Mi, withDurability as Mn, LATEST_SUPPORTED_HOST_VERSION as Mr, lifecyclePhase as Mt, ALPHA3_HOST_PACKAGES as N, kindOfScope as Na, DerivedEnvelope as Ni, CertificationSupport as Nn, MIN_SUPPORTED_HOST_VERSION as Nr, previewFirstStepInjection as Nt, RecoveryOptions as O, ScopeInterpretation as Oa, DeferAuthorization as Oi, evidenceFromPersistedToolResult as On, hostVersionFromPackages as Or, FirstStepPreviewInput as Ot, PROOF_CAPABILITY_MATRIX as P, maskCodeSpans as Pa, EvidenceBinding as Pi, DiagnosisNextAction as Pn, ParsedHostVersion as Pr, ActiveProfileHostLock as Pt, bindProofV2ToProjection as Q, actionCompatible as Qa, PersistenceAuthorization as Qi, ALPHA2_HOST_PACKAGES as Qn, ParsedConfirmation as Qr, GitCommandManifest as Qt, PROOF_PROTOCOL_VERSION as R, ACTION_MANIFEST as Ra, ExpectedTransition as Ri, deriveItemDiagnosis as Rn, evaluateMinimumHostVersion as Rr, hostLockContextFromComposedDump as Rt, snapshotSessionEvents as S, rebindResponse as Sa, qualifyBoundary as Si, parseShellCommand as Sn, bindExecutableIdentity as Sr, ManifestIssue as St, RC1_HOST_PACKAGES as T, DirectiveClass as Ta, BindingActionClosure as Ti, ToolCallInput as Tn, evaluateHostCapability as Tr, ClaimedMessage as Tt, ProofKindV2 as U, CERTIFICATE_VERSION as Ua, GuardEvidence as Ui, DEFAULT_DELEGATION_TOOL_NAMES as Un, AuthorityBlockKind as Ur, packageRowsFromPnpmLock as Ut, ProofKind as V, ActionSpec as Va, GuardBoundary as Vi, relevantEvidence as Vn, currentContractDigest as Vr, inspectTargetHostGraph as Vt, ProofManifest as W, CERTIFICATE_VERSION_V2 as Wa, GuardIntegrity as Wi, PROTOCOL_V3_NOTICE as Wn, AuthorityKind as Wr, readActiveHostGraph as Wt, SessionQueryV2 as X, SemanticAction as Xa, HostStatus as Xi, ACTIVE_HOST_LAUNCHER_VERSION as Xn, classifyUserInteraction as Xr, GitAdapterAction as Xt, SessionQuery as Y, SUPPORTED_EVIDENCE_ADAPTERS as Ya, GuardProjection as Yi, ACTIVE_HOST_COHORT_IDS as Yn, classifyTaskIntent as Yr, GIT_COMMAND_TEMPLATES as Yt, bindProofToProjection as Z, StatefulAction as Za, MessageCoverage as Zi, ALPHA2_DSHMARKET_139_HOST_PACKAGES as Zn, CONFIRM_LINE_PATTERN as Zr, GitCommandAccepted as Zt, progressFingerprint as _, confirmRebind as _a, GoalActivationState as _i, ParsedShell as _n, HostLockStatus as _r, evidenceCoverage as _t, NO_PROGRESS_RECORD_PREFIX as a, WaitAuthorization as aa, ClauseSegment as ai, GitTargetIdentity as an, semanticActionFromText as ao, GOAL_HOST_PACKAGES as ar, proofEvidenceConstraints as at, SessionApiError as b, proposeRebindV042 as ba, effectuateBoundary as bi, isRunExecutable as bn, HostToolSurface as br, COMMAND_SURFACE_MANIFEST as bt, classifyCompletionClaim as c, PackageRow as ca, classifyClause as ci, commitTreeSnapshotDigest as cn, canonicalizePath as co, HostAuditProvenance as cr, proofV2Rejection as ct, decisionBoundaryKey as d, ReleaseOperation as da, extractOperation as di, gitCommandMatchesTarget as dn, sanitizeClauseText as do, HostCapabilityRequest as dr, sessionQuery as dt, TargetCaptureReasonCode as ea, parseConfirmationMessage as ei, GitCommandRejected as en, isStatefulAction as eo, BASE_HOST_PACKAGES as er, createProofManifest as et, isRootPauseRequest as f, ReleaseSettlement as fa, isInformationalMessage as fi, parseGitCommandManifest as fn, sanitizeUrl as fo, HostCohort as fr, sessionQueryV2 as ft, observeAssistantOutcome as g, RebindProposal as ga, BoundaryRequest as gi, CanonicalCommandSurface as gn, HostLockEvaluation as gr, bindingSatisfies as gt, latestRootInstruction as h, RebindArgs as ha, BoundaryQualification as hi, CanonicalArgv as hn, HostLockContext as hr, EvidenceFacetCoverage as ht, CompletionDisposition as i, VerificationContract as ia, CaptureScope as ii, GitPrestateEnvelope as in, semanticActionFromCommand as io, ExecutableIdentityBinding as ir, proofDigestV2 as it, recoveryDigest as j, isExecutableItem as ja, DeriveResult as ji, isDeterministicCheck as jn, HostVersionStatus as jr, firstStepGuidance as jt, closingHint as k, interpretClause as ka, DelegationRef as ki, extractTextContent as kn, selectHostCohort as kr, LifecyclePhase as kt, decideTurnBoundary as l, ReleaseGateDecision as la, extractArtifactPaths as li, createGitPrestateEnvelope as ln, digestStrings as lo, HostCapabilityEvaluation as lr, requiredSubjectsOf as lt, latestAssistantText as m, ProposeOutcome as ma, BoundaryEffectuation as mi, verifiedLinearCommitReadback as mn, HostCohortSelectionReason as mr, validateProofManifestV2 as mt, AssistantOutcomeObservation as n, TargetTuple as na, RejectedBinding as ni, GitEffectRunner as nn, requestedTargetAuthorizesMutation as no, EXPECTED_HOST_PACKAGES as nr, proofCapabilityReport as nt, NO_PROGRESS_TURNS_BEFORE_STOP as o, WorkUnit as oa, captureClause as oi, LinearCommitReadback as on, validateActionManifest as oo, HOST_CAPABILITY_PACKAGE_GROUPS as or, proofHostSurfacesOf as ot, isWholeTaskCompletionClaim as p, BoundedSource as pa, segmentClauses as pi, revalidateGitPrestate as pn, sha256 as po, HostCohortSelection as pr, validateProofManifest as pt, ProofObligationV2 as q, STOP_PROTOCOL_VERSION as qa, GuardItemStatus as qi, deriveProjection as qn, TaskIntent as qr, verifyComposedHostLockDump as qt, CONTROL_RECORD_PREFIX as r, TargetValue as ra, certifyCheckpoint as ri, GitPrestateCheck as rn, requestedTargetMatchesResolved as ro, ExecutableIdentity as rr, proofDigest as rt, TurnStoppingDecision as s, createProjection as sa, captureItem as si, commitIndexSnapshotDigest as sn, validateActionTarget as so, HOST_COHORTS as sr, proofOperationMatches as st, supersedeItem as t, TargetCaptureStatus as ta, CheckpointResult as ti, GitEffectExecution as tn, requestedIdentityKey as to, DEFAULT_HOST_LOCK as tr, createProofManifestV2 as tt, decideTurnStopping as u, ReleaseObservedIdentity as ua, extractMethod as ui, executeRevalidatedGitEffect as un, normalizeClause as uo, HostCapabilityId as ur, scopeCoverageDigest as ut, SESSION_API_UNSUPPORTED as v, proposeRebind as va, GoalBoundaryAccess as vi, ShellParseStatus as vn, HostPlatform as vr, evidenceMatchesItem as vt, RC015_HOST_PACKAGES as w, AuthorityDisposition as wa, AssetObligation as wi, hasCurrentCertificate as wn, evaluateExternalWaitCapability as wr, validateManifest as wt, V3SessionLike as x, rebindAttemptKey as xa, isCurrentAcceptedBoundary as xi, parsePwshCommand as xn, LEGACY_HOST_COHORTS as xr, CommandSurfaceManifest as xt, SESSION_EVENT_ENVELOPE_INVALID as y, proposeRebindOutcome as ya, availableBoundaryQualifications as yi, canonicalArgvFromCommand as yn, HostProfileKind as yr, isVerifyingCapability as yt, PROOF_PROTOCOL_VERSION_V2 as z, ACTION_MANIFEST_VERSION as za, ExternalOperation as zi, evidenceAvailabilityReason as zn, parseHostVersion as zr, hostLockRowsFromComposedDump as zt };
+export { ProofSurface as $, partialFailureOf as $a, GuardIntegrity as $i, applyUpgradeEligibility as $n, STATEFUL_ACTIONS as $o, authorityCaptureCounts as $r, GIT_COMMAND_MANIFEST_IDS as $t, MIN_RECOVERY_CHAR_BUDGET as A, confirmRebind as Aa, isCurrentAcceptedBoundary as Ai, ToolCallInput as An, itemHoldsExecutionAuthority as Ao, bindExecutableIdentity as Ar, ClaimedMessage as At, PROOF_KINDS as B, DEPENDENCY_FREE_ONLY_CONDITION as Ba, DeriveResult as Bi, Repairability as Bn, restatedContentOf as Bo, LATEST_SUPPORTED_HOST_VERSION as Br, HostProfileError as Bt, RC015_RC2_HOST_PACKAGES as C, ReleaseObservedIdentity as Ca, BoundaryEffectuation as Ci, ShellParseStatus as Cn, introducesActionClause as Co, HostLockContext as Cr, evidenceMatchesItem as Ct, CLEANUP_CONDITION_RULE_COMPACT as D, ProposeOutcome as Da, GoalBoundaryAccess as Di, parseShellCommand as Dn, isOpenObligation as Do, HostProfileKind as Dr, ManifestIssue as Dt, CLEANUP_CONDITION_RULE as E, BoundedSource as Ea, GoalActivationState as Ei, parsePwshCommand as En, isInformationalFragment as Eo, HostPlatform as Er, CommandSurfaceManifest as Et, openItems as F, rebindResponse as Fa, BoundaryDisposition as Fi, extractToolSubject as Fn, namedActions as Fo, evaluateToolSurfaceCapability as Fr, claimedBatchHasRealRootInput as Ft, ProofHostSurface as G, ProcessExitStatus as Ga, EvidenceParseStatus as Gi, evidenceAvailabilityReason as Gn, ACTION_MANIFEST as Go, compareHostVersions as Gr, injectActiveProfileHostLock as Gt, PROOF_MANIFEST_DOMAIN_V2 as H, DependencyStatus as Ha, DerivedEnvelope as Hi, UnifiedItemDiagnosis as Hn, splitTextFragments as Ho, ParsedHostVersion as Hr, combineHostPolicy as Ht, recoveryDigest as I, replayRebindResult as Ia, BoundaryQualificationKind as Ii, isDeterministicCheck as In, opensWithDirective as Io, hostVersionFromPackages as Ir, firstStepGuidance as It, ProofKindV2 as J, RemovalOutcomeReport as Ja, ExternalOperation as Ji, CAPTURE_V042_NOTICE as Jn, ActionSpec as Jo, satisfiesSupportedHostRange as Jr, packageRowsFromPnpmLock as Jt, ProofKind as K, ProcessFactSource as Ka, EvidenceRole as Ki, itemDiagnosis as Kn, ACTION_MANIFEST_VERSION as Ko, evaluateMinimumHostVersion as Kr, inspectTargetHostGraph as Kt, renderRecoveryPacket as L, CapabilityFact as La, DeferAuthorization as Li, withDurability as Ln, qualificationOfClause as Lo, selectHostCohort as Lr, lifecyclePhase as Lt, carriesCleanupCondition as M, proposeRebindOutcome as Ma, AssetInterpretationFact as Mi, ToolSubject as Mn, legacyQuestionReadingIsInformational as Mo, evaluateExternalWaitCapability as Mr, FirstStepInjection as Mt, cleanupConditionFor as N, proposeRebindV042 as Na, AssetObligation as Ni, evidenceFromPersistedToolResult as Nn, maskCodeSpans as No, evaluateHostCapability as Nr, FirstStepPreviewInput as Nt, CLEANUP_CONDITION_RULE_SHORT as O, RebindArgs as Oa, availableBoundaryQualifications as Oi, goalCompletionDenial as On, isQuestionScopeNeedingReview as Oo, HostToolSurface as Or, OperationVerbEntry as Ot, closingHint as P, rebindAttemptKey as Pa, BindingActionClosure as Pi, extractTextContent as Pn, maskQuotedSpans as Po, evaluateHostLock as Pr, LifecyclePhase as Pt, ProofObligationV2 as Q, capabilityFactOf as Qa, GuardEvidence as Qi, PROTOCOL_V5_NOTICE as Qn, SEMANTIC_ACTIONS as Qo, AuthorityKind as Qr, verifyComposedHostLockDump as Qt, ALPHA3_HOST_PACKAGES as R, CapabilityGap as Ra, DelegationRef as Ri, CertificationSupport as Rn, questionHeadsClause as Ro, HostVersionDecision as Rr, previewFirstStepInjection as Rt, snapshotSessionEvents as S, ReleaseGateDecision as Sa, segmentClauses as Si, ParsedShell as Sn, interpretMessage as So, HostCohortSelectionReason as Sr, evidenceCoverage as St, RC1_HOST_PACKAGES as T, ReleaseSettlement as Ta, BoundaryRequest as Ti, isRunExecutable as Tn, isExplanationScope as To, HostLockStatus as Tr, COMMAND_SURFACE_MANIFEST as Tt, PROOF_PROTOCOL_VERSION as U, DerivedProcessFacts as Ua, EvidenceBinding as Ui, capabilityRemedyPhrase as Un, statefulActionsOfScope as Uo, SUPPORTED_HOST_RANGE as Ur, hostLockContextFromComposedDump as Ut, PROOF_KINDS_V2 as V, DeclaredOperationResult as Va, DeriveScope as Vi, TaskKind as Vn, semanticActionOfScope as Vo, MIN_SUPPORTED_HOST_VERSION as Vr, TargetHostGraph as Vt, PROOF_PROTOCOL_VERSION_V2 as W, OperationAttribution as Wa, EvidenceOutcome as Wi, deriveItemDiagnosis as Wn, verbIsNegated as Wo, SUPPORTED_HOST_VERSIONS as Wr, hostLockRowsFromComposedDump as Wt, ProofManifestV2 as X, admissibleForRemoval as Xa, GuardBoundary as Xi, PROTOCOL_V3_NOTICE as Xn, CERTIFICATE_VERSION as Xo, AuthorityBlock as Xr, resolveActiveProfileHostLock as Xt, ProofManifest as Y, actionHasCertificationPath as Ya, GoalRef as Yi, DEFAULT_DELEGATION_TOOL_NAMES as Yn, BOUNDED_ARTIFACT_TYPES as Yo, currentContractDigest as Yr, readActiveHostGraph as Yt, ProofObligation as Z, capabilityConsequence as Za, GuardCheckpoint as Zi, PROTOCOL_V4_NOTICE as Zn, CERTIFICATE_VERSION_V2 as Zo, AuthorityBlockKind as Zr, resolveInstalledHostLock as Zt, progressFingerprint as _, VerificationContract as _a, environmentDefaultRepositoryTarget as _i, parseGitCommandManifest as _n, explanationHasActionResidue as _o, HostCapabilityEvaluation as _r, normalizeClause as _s, sessionQueryV2 as _t, NO_PROGRESS_RECORD_PREFIX as a, HostStatus as aa, CONFIRM_LINE_PATTERN as ai, GitCommandRejected as an, ExecutionQualification as ao, ALPHA2_DSHMARKET_139_HOST_PACKAGES as ar, actionCompatible as as, createProofManifest as at, SessionApiError as b, createProjection as ba, extractOperation as bi, CanonicalArgv as bn, hasQuestionScope as bo, HostCohort as br, sha256 as bs, EvidenceFacetCoverage as bt, classifyCompletionClaim as c, NeedsReviewReason as ca, parseConfirmationMessage as ci, GitPrestateCheck as cn, LEGACY_QUALIFICATION as co, BASE_HOST_PACKAGES as cr, requestedIdentityKey as cs, proofDigest as ct, decisionBoundaryKey as d, TargetCaptureReasonCode as da, certifyCheckpoint as di, LinearCommitReadback as dn, ScopeInterpretation as do, ExecutableIdentity as dr, semanticActionFromCommand as ds, proofHostSurfacesOf as dt, GuardItem as ea, segmentAuthorityBlocks as ei, GIT_COMMAND_TEMPLATES as en, removalIsComplete as eo, deriveProjection as er, STOP_PROTOCOL_VERSION as es, SessionQuery as et, isRootPauseRequest as f, TargetCaptureStatus as fa, CaptureScope as fi, commitIndexSnapshotDigest as fn, actionVerbMatches as fo, ExecutableIdentityBinding as fr, semanticActionFromText as fs, proofOperationMatches as ft, observeAssistantOutcome as g, TargetValue as ga, classifyClause as gi, gitCommandMatchesTarget as gn, clauseIsProtected as go, HostAuditProvenance as gr, digestStrings as gs, sessionQuery as gt, latestRootInstruction as h, TargetTuple as ha, captureItem as hi, executeRevalidatedGitEffect as hn, clauseIsGoverned as ho, HOST_COHORTS as hr, canonicalizePath as hs, scopeCoverageDigest as ht, CompletionDisposition as i, GuardProjection as ia, classifyUserInteraction as ii, GitCommandParseResult as in, Executee as io, ACTIVE_HOST_LAUNCHER_VERSION as ir, StatefulAction as is, canonicalProjection as it, RecoveryOptions as j, proposeRebind as ja, qualifyBoundary as ji, ToolResultInput as jn, kindOfScope as jo, bindLiveGoalCapability as jr, FIRST_STEP_GUIDANCE as jt, DEFAULT_RECOVERY_CHAR_BUDGET as k, RebindProposal as ka, effectuateBoundary as ki, hasCurrentCertificate as kn, isRestatement as ko, LEGACY_HOST_COHORTS as kr, validateManifest as kt, decideTurnBoundary as l, PersistenceAuthorization as la, CheckpointResult as li, GitPrestateEnvelope as ln, QualificationReason as lo, DEFAULT_HOST_LOCK as lr, requestedTargetAuthorizesMutation as ls, proofDigestV2 as lt, latestAssistantText as m, TargetSourceKind as ma, captureClause as mi, createGitPrestateEnvelope as mn, clauseAsksOwnQuestion as mo, HOST_CAPABILITY_PACKAGE_GROUPS as mr, validateActionTarget as ms, requiredSubjectsOf as mt, AssistantOutcomeObservation as n, GuardItemStatus as na, UserInteractionKind as ni, GitCommandAccepted as nn, AuthorityDisposition as no, ACTIVE_HOST_COHORT_ID as nr, SUPPORTED_EVIDENCE_ADAPTERS as ns, bindProofToProjection as nt, NO_PROGRESS_TURNS_BEFORE_STOP as o, MessageCoverage as oa, ParsedConfirmation as oi, GitEffectExecution as on, GRANTED_QUALIFICATION as oo, ALPHA2_HOST_PACKAGES as or, boundedArtifactChoiceMatches as os, createProofManifestV2 as ot, isWholeTaskCompletionClaim as p, TargetSource as pa, ClauseSegment as pi, commitTreeSnapshotDigest as pn, clarifiedSpanOf as po, GOAL_HOST_PACKAGES as pr, validateActionManifest as ps, proofV2Rejection as pt, ProofKindCapability as q, ProcessOutcomeReason as qa, ExpectedTransition as qi, relevantEvidence as qn, ActionManifest as qo, parseHostVersion as qr, packageRowsFromActiveGraph as qt, CONTROL_RECORD_PREFIX as r, GuardOperation as ra, classifyTaskIntent as ri, GitCommandManifest as rn, DirectiveClass as ro, ACTIVE_HOST_COHORT_IDS as rr, SemanticAction as rs, bindProofV2ToProjection as rt, TurnStoppingDecision as s, NeedsReviewFact as sa, isFrozenV042RebindResponse as si, GitEffectRunner as sn, InterpretOptions as so, AuditedExecutable as sr, isStatefulAction as ss, proofCapabilityReport as st, supersedeItem as t, GuardItemKind as ta, TaskIntent as ti, GitAdapterAction as tn, removalIsPartiallyKnown as to, legacyRecordsNeedingReview as tr, STOP_PROTOCOL_VERSION_V2 as ts, SessionQueryV2 as tt, decideTurnStopping as u, SourceSpan as ua, RejectedBinding as ui, GitTargetIdentity as un, QualificationStatus as uo, EXPECTED_HOST_PACKAGES as ur, requestedTargetMatchesResolved as us, proofEvidenceConstraints as ut, SESSION_API_UNSUPPORTED as v, WaitAuthorization as va, extractArtifactPaths as vi, revalidateGitPrestate as vn, governedClauseRestrictsExecution as vo, HostCapabilityId as vr, sanitizeClauseText as vs, validateProofManifest as vt, RC015_HOST_PACKAGES as w, ReleaseOperation as wa, BoundaryQualification as wi, canonicalArgvFromCommand as wn, isExecutableItem as wo, HostLockEvaluation as wr, isVerifyingCapability as wt, V3SessionLike as x, PackageRow as xa, isInformationalMessage as xi, CanonicalCommandSurface as xn, interpretClause as xo, HostCohortSelection as xr, bindingSatisfies as xt, SESSION_EVENT_ENVELOPE_INVALID as y, WorkUnit as ya, extractMethod as yi, verifiedLinearCommitReadback as yn, hasOrderedCoordination as yo, HostCapabilityRequest as yr, sanitizeUrl as ys, validateProofManifestV2 as yt, PROOF_CAPABILITY_MATRIX as z, CapabilityRemedy as za, DeriveConfig as zi, DiagnosisNextAction as zn, reportingHeadGoverns as zo, HostVersionStatus as zr, ActiveProfileHostLock as zt };