dsh-completion-guard 0.6.3 → 0.7.0

package/dist/index.js

@@ -1,16 +1,16 @@
-import { $ as evidenceFromPersistedToolResult, $n as proposeRebind, $r as isRestatement, $t as createProofManifestV2, A as lifecyclePhase, Ai as requestedTargetMatchesResolved, An as NO_PROGRESS_TURNS_BEFORE_STOP, Ar as canonicalRegistryBase, At as SUPPORTED_HOST_RANGE, B as RELEASE_OPERATIONS, Bi as sanitizeClauseText, Bn as progressFingerprint, Br as clauseIsProtected, Bt as authorityCaptureCounts, C as gitCommandMatchesTarget, Ci as STOP_PROTOCOL_VERSION_V2, Cn as renderRecoveryPacket, Cr as classifyClause, Ct as evaluateHostCapability, D as FIRST_STEP_GUIDANCE, Di as isStatefulAction, Dn as isVerifyingCapability, Dr as extractOperation, Dt as selectHostCohort, E as verifiedLinearCommitReadback, Ei as boundedArtifactChoiceMatches, En as evidenceMatchesItem, Er as extractMethod, Et as hostVersionFromPackages, F as PROTOCOL_V4_NOTICE, Fi as COMMAND_SURFACE_MANIFEST, Fn as isRootPauseRequest, Fr as LEGACY_QUALIFICATION, Ft as satisfiesSupportedHostRange, G as inFlightReservation, Gn as unitDescendantIds, Gr as interpretClause, Gt as PROOF_KINDS_V2, H as RELEASE_RESERVATION_PREFIX, Hi as sha256, Hn as hasCurrentCertificate, Hr as governedClauseRestrictsExecution, Ht as certifyCheckpoint, I as PROTOCOL_V5_NOTICE, Ii as validateManifest, In as isWholeTaskCompletionClaim, Ir as actionVerbMatches, It as RC015_RC2_HOST_PACKAGES, J as releaseContractFor, Jn as isCurrentAcceptedBoundary, Jr as isExecutableItem, Jt as PROOF_PROTOCOL_VERSION_V2, K as normalizeReleaseContract, Kn as availableBoundaryQualifications, Kr as interpretMessage, Kt as PROOF_MANIFEST_DOMAIN_V2, L as applyUpgradeEligibility, Li as canonicalizePath, Ln as latestAssistantText, Lr as clarifiedSpanOf, Lt as RC015_HOST_PACKAGES, M as CAPTURE_V042_NOTICE, Mi as semanticActionFromText, Mn as decideTurnBoundary, Mr as classifyTaskIntent, Mt as compareHostVersions, N as DEFAULT_DELEGATION_TOOL_NAMES, Ni as validateActionManifest, Nn as decideTurnStopping, Nr as classifyUserInteraction, Nt as evaluateMinimumHostVersion, O as claimedBatchHasRealRootInput, Oi as requestedIdentityKey, On as CONTROL_RECORD_PREFIX, Or as isInformationalMessage, Ot as LATEST_SUPPORTED_HOST_VERSION, P as PROTOCOL_V3_NOTICE, Pi as validateActionTarget, Pn as decisionBoundaryKey, Pr as GRANTED_QUALIFICATION, Pt as parseHostVersion, Q as supersedeItem, Qn as confirmRebind, Qr as isQuestionScopeNeedingReview, Qt as createProofManifest, R as deriveProjection, Ri as digestStrings, Rn as latestRootInstruction, Rr as clauseAsksOwnQuestion, Rt as RC1_HOST_PACKAGES, S as executeRevalidatedGitEffect, Si as STOP_PROTOCOL_VERSION, Sn as recoveryDigest, Sr as captureItem, St as evaluateExternalWaitCapability, T as revalidateGitPrestate, Ti as actionCompatible, Tn as evidenceCoverage, Tr as extractArtifactPaths, Tt as evaluateToolSurfaceCapability, U as RELEASE_SETTLEMENT_PREFIX, Un as certifiableOpenItems, Ur as hasOrderedCoordination, Ut as PROOF_CAPABILITY_MATRIX, V as RELEASE_OPERATION_SURFACES, Vi as sanitizeUrl, Vn as goalCompletionDenial, Vr as explanationHasActionResidue, Vt as segmentAuthorityBlocks, W as contractById, Wn as certificateClosure, Wr as hasQuestionScope, Wt as PROOF_KINDS, X as releasePreEffectDecision, Xn as currentContractDigest, Xr as isInformationalFragment, Xt as bindProofV2ToProjection, Y as releaseCoverage, Yn as qualifyBoundary, Yr as isExplanationScope, Yt as bindProofToProjection, Z as reservationFor, Zn as createProjection, Zr as isOpenObligation, Zt as canonicalProjection, _ as GIT_COMMAND_MANIFEST_IDS, _i as BOUNDED_ARTIFACT_TYPES, _n as MIN_RECOVERY_CHAR_BUDGET, _r as capabilityFactOf, _t as HOST_CAPABILITY_PACKAGE_GROUPS, a as injectActiveProfileHostLock, ai as namedActions, an as proofOperationMatches, ar as CONFIRM_LINE_PATTERN, at as isRunExecutable, b as commitTreeSnapshotDigest, bi as SEMANTIC_ACTIONS, bn as closingHint, br as removalIsPartiallyKnown, bt as bindExecutableIdentity, c as packageRowsFromPnpmLock, ci as questionHeadsClause, cn as scopeCoverageDigest, cr as capabilityRemedyPhrase, ct as ACTIVE_HOST_COHORT_ID, d as resolveInstalledHostLock, di as semanticActionOfScope, dn as validateProofManifest, dr as itemDiagnosis, dt as ALPHA2_DSHMARKET_139_HOST_PACKAGES, ei as itemHoldsExecutionAuthority, en as proofCapabilityReport, er as proposeRebindOutcome, et as extractTextContent, f as verifyComposedHostLockDump, fi as splitTextFragments, fn as validateProofManifestV2, fr as relevantEvidence, ft as ALPHA2_HOST_PACKAGES, g as snapshotSessionEvents, gi as ACTION_MANIFEST_VERSION, gn as DEFAULT_RECOVERY_CHAR_BUDGET, gr as capabilityConsequence, gt as GOAL_HOST_PACKAGES, h as SessionApiError, hi as ACTION_MANIFEST, hn as CLEANUP_CONDITION_RULE_SHORT, hr as admissibleForRemoval, ht as EXPECTED_HOST_PACKAGES, i as hostLockRowsFromComposedDump, ii as maskQuotedSpans, in as proofHostSurfacesOf, ir as replayRebindResult, it as canonicalArgvFromCommand, j as previewFirstStepInjection, ji as semanticActionFromCommand, jn as classifyCompletionClaim, jr as npmEscapedPackageName, jt as SUPPORTED_HOST_VERSIONS, k as firstStepGuidance, ki as requestedTargetAuthorizesMutation, kn as NO_PROGRESS_RECORD_PREFIX, kr as segmentClauses, kt as MIN_SUPPORTED_HOST_VERSION, l as readActiveHostGraph, li as reportingHeadGoverns, ln as sessionQuery, lr as deriveItemDiagnosis, lt as ACTIVE_HOST_COHORT_IDS, m as SESSION_EVENT_ENVELOPE_INVALID, mi as verbIsNegated, mn as CLEANUP_CONDITION_RULE_COMPACT, mr as actionHasCertificationPath, mt as DEFAULT_HOST_LOCK, n as combineHostPolicy, ni as legacyQuestionReadingIsInformational, nn as proofDigestV2, nr as rebindAttemptKey, nt as isDeterministicCheck, o as inspectTargetHostGraph, oi as opensWithDirective, on as proofV2Rejection, or as isFrozenV042RebindResponse, ot as parsePwshCommand, p as SESSION_API_UNSUPPORTED, pi as statefulActionsOfScope, pn as CLEANUP_CONDITION_RULE, pr as DEPENDENCY_FREE_ONLY_CONDITION, pt as BASE_HOST_PACKAGES, q as readbackSettlesContract, qn as effectuateBoundary, qr as introducesActionClause, qt as PROOF_PROTOCOL_VERSION, r as hostLockContextFromComposedDump, ri as maskCodeSpans, rn as proofEvidenceConstraints, rr as rebindResponse, rt as withDurability, s as packageRowsFromActiveGraph, si as qualificationOfClause, sn as requiredSubjectsOf, sr as parseConfirmationMessage, st as parseShellCommand, t as HostProfileError, ti as kindOfScope, tn as proofDigest, tr as proposeRebindV042, tt as extractToolSubject, u as resolveActiveProfileHostLock, ui as restatedContentOf, un as sessionQueryV2, ur as evidenceAvailabilityReason, ut as ACTIVE_HOST_LAUNCHER_VERSION, v as GIT_COMMAND_TEMPLATES, vi as CERTIFICATE_VERSION, vn as carriesCleanupCondition, vr as partialFailureOf, vt as HOST_COHORTS, w as parseGitCommandManifest, wi as SUPPORTED_EVIDENCE_ADAPTERS, wn as bindingSatisfies, wr as environmentDefaultRepositoryTarget, wt as evaluateHostLock, x as createGitPrestateEnvelope, xi as STATEFUL_ACTIONS, xn as openItems, xr as captureClause, xt as bindLiveGoalCapability, y as commitIndexSnapshotDigest, yi as CERTIFICATE_VERSION_V2, yn as cleanupConditionFor, yr as removalIsComplete, yt as LEGACY_HOST_COHORTS, z as legacyRecordsNeedingReview, zi as normalizeClause, zn as observeAssistantOutcome, zr as clauseIsGoverned, zt as ALPHA3_HOST_PACKAGES } from "./domain-BUA1lLjs.js";
+import { $ as currentV6Feedback, $i as requestedIdentityKey, $n as decideTurnStopping, $r as npmEscapedPackageName, $t as RC015_RC2_HOST_PACKAGES, A as firstStepGuidanceV6, Ai as opensWithDirective, An as CLEANUP_CONDITION_RULE, Ar as capabilityRemedyPhrase, At as BASE_HOST_PACKAGES, B as SessionApiError, Bi as ACTION_MANIFEST, Bn as renderRecoveryPacket, Br as partialFailureOf, Bt as evaluateHostCapability, C as gitCommandMatchesTarget, Ci as itemHoldsExecutionAuthority, Cn as proofV2Rejection, Cr as proposeRebindV042, Ct as parsePwshCommand, D as FIRST_STEP_GUIDANCE, Di as maskQuotedSpans, Dn as sessionQueryV2, Dr as CONFIRM_LINE_PATTERN, Dt as ACTIVE_HOST_LAUNCHER_VERSION, E as verifiedLinearCommitReadback, Ei as maskCodeSpans, En as sessionQuery, Er as replayRebindResult, Et as ACTIVE_HOST_COHORT_IDS, F as HOST_WORKDIR_PREFIX, Fi as restatedContentOf, Fn as carriesCleanupCondition, Fr as DEPENDENCY_FREE_ONLY_CONDITION, Ft as HOST_COHORTS, G as PROTOCOL_V3_NOTICE, Gi as SEMANTIC_ACTIONS, Gn as CONTROL_RECORD_PREFIX, Gr as classifyClause, Gt as LATEST_SUPPORTED_HOST_VERSION, H as projectCoreV2, Hi as BOUNDED_ARTIFACT_TYPES, Hn as evidenceCoverage, Hr as removalIsPartiallyKnown, Ht as evaluateToolSurfaceCapability, I as captureHostWorkdir, Ii as semanticActionOfScope, In as cleanupConditionFor, Ir as actionHasCertificationPath, It as LEGACY_HOST_COHORTS, J as PROTOCOL_V6_NOTICE, Ji as STOP_PROTOCOL_VERSION_V2, Jn as assessmentAction, Jr as extractMethod, Jt as SUPPORTED_HOST_VERSIONS, K as PROTOCOL_V4_NOTICE, Ki as STATEFUL_ACTIONS, Kn as NO_PROGRESS_RECORD_PREFIX, Kr as environmentDefaultRepositoryTarget, Kt as MIN_SUPPORTED_HOST_VERSION, L as sourcedNamedTestRoot, Li as splitTextFragments, Ln as closingHint, Lr as admissibleForRemoval, Lt as bindExecutableIdentity, M as previewFirstStepInjection, Mi as qualificationOfClause, Mn as CLEANUP_CONDITION_RULE_SHORT, Mr as evidenceAvailabilityReason, Mt as EXPECTED_HOST_PACKAGES, N as projectSessionCoreV2, Ni as questionHeadsClause, Nn as DEFAULT_RECOVERY_CHAR_BUDGET, Nr as itemDiagnosis, Nt as GOAL_HOST_PACKAGES, O as claimedBatchHasRealRootInput, Oi as namedActions, On as validateProofManifest, Or as isFrozenV042RebindResponse, Ot as ALPHA2_DSHMARKET_139_HOST_PACKAGES, P as sessionCoreSnapshot, Pi as reportingHeadGoverns, Pn as MIN_RECOVERY_CHAR_BUDGET, Pr as relevantEvidence, Pt as HOST_CAPABILITY_PACKAGE_GROUPS, Q as rootLocatorFlavor, Qi as isStatefulAction, Qn as decideTurnBoundary, Qr as canonicalRegistryBase, Qt as satisfiesSupportedHostRange, R as SESSION_API_UNSUPPORTED, Ri as statefulActionsOfScope, Rn as openItems, Rr as capabilityConsequence, Rt as bindLiveGoalCapability, S as executeRevalidatedGitEffect, Si as isRestatement, Sn as proofOperationMatches, Sr as proposeRebindOutcome, St as isRunExecutable, T as revalidateGitPrestate, Ti as legacyQuestionReadingIsInformational, Tn as scopeCoverageDigest, Tr as rebindResponse, Tt as ACTIVE_HOST_COHORT_ID, U as CAPTURE_V042_NOTICE, Ui as CERTIFICATE_VERSION, Un as evidenceMatchesItem, Ur as captureClause, Ut as hostVersionFromPackages, V as snapshotSessionEvents, Vi as ACTION_MANIFEST_VERSION, Vn as bindingSatisfies, Vr as removalIsComplete, Vt as evaluateHostLock, W as DEFAULT_DELEGATION_TOOL_NAMES, Wi as CERTIFICATE_VERSION_V2, Wn as isVerifyingCapability, Wr as captureItem, Wt as selectHostCohort, X as deriveProjection, Xi as actionCompatible, Xn as classifyCompletionClaim, Xr as isInformationalMessage, Xt as evaluateMinimumHostVersion, Y as applyUpgradeEligibility, Yi as SUPPORTED_EVIDENCE_ADAPTERS, Yn as assessmentOutcomePredicate, Yr as extractOperation, Yt as compareHostVersions, Z as legacyRecordsNeedingReview, Zi as boundedArtifactChoiceMatches, Zn as currentActionBases, Zr as segmentClauses, Zt as parseHostVersion, _ as GIT_COMMAND_MANIFEST_IDS, _i as isExecutableItem, _n as proofCapabilityReport, _r as qualifyBoundary, _t as extractToolSubject, a as auditedForegroundRenderers, aa as validateActionTarget, ai as clarifiedSpanOf, an as certifyCheckpoint, ar as observeAssistantOutcome, at as inFlightReservation, b as commitTreeSnapshotDigest, bi as isOpenObligation, bn as proofEvidenceConstraints, br as confirmRebind, bt as withDurability, c as hostLockRowsFromComposedDump, ca as canonicalizePath, ci as clauseIsProtected, cn as PROOF_KINDS_V2, cr as v6TestPredicate, ct as normalizeSettlement, d as packageRowsFromActiveGraph, da as sanitizeClauseText, di as hasOrderedCoordination, dn as PROOF_PROTOCOL_VERSION_V2, dr as certifiableOpenItems, dt as releaseCoverage, ea as requestedTargetAuthorizesMutation, ei as classifyTaskIntent, en as RC015_HOST_PACKAGES, er as decisionBoundaryKey, et as sourceItemForCoreRequirement, f as packageRowsFromPnpmLock, fa as sanitizeUrl, fi as hasQuestionScope, fn as bindProofToProjection, fr as certificateClosure, ft as releasePreEffectDecision, g as verifyComposedHostLockDump, gi as introducesActionClause, gn as createProofManifestV2, gr as isCurrentAcceptedBoundary, gt as extractTextContent, h as resolveInstalledHostLock, hi as interpretMessage, hn as createProofManifest, hr as effectuateBoundary, ht as evidenceFromPersistedToolResult, i as auditedDefaultWorkdirProvider, ia as validateActionManifest, ii as actionVerbMatches, in as segmentAuthorityBlocks, ir as latestRootInstruction, it as contractById, j as lifecyclePhase, ji as presentExplanationHead, jn as CLEANUP_CONDITION_RULE_COMPACT, jr as deriveItemDiagnosis, jt as DEFAULT_HOST_LOCK, k as firstStepGuidance, ki as opensConditionLead, kn as validateProofManifestV2, kr as parseConfirmationMessage, kt as ALPHA2_HOST_PACKAGES, l as injectActiveProfileHostLock, la as digestStrings, li as explanationHasActionResidue, ln as PROOF_MANIFEST_DOMAIN_V2, lr as goalCompletionDenial, lt as readbackSettlesContract, m as resolveActiveProfileHostLock, mi as interpretClause, mn as canonicalProjection, mr as availableBoundaryQualifications, mt as supersedeItem, n as activeRendererModule, na as semanticActionFromCommand, ni as GRANTED_QUALIFICATION, nn as ALPHA3_HOST_PACKAGES, nr as isWholeTaskCompletionClaim, nt as RELEASE_OPERATIONS, o as combineHostPolicy, oa as COMMAND_SURFACE_MANIFEST, oi as clauseAsksOwnQuestion, on as PROOF_CAPABILITY_MATRIX, or as progressFingerprint, ot as normalizeReleaseContract, p as readActiveHostGraph, pa as sha256, pi as hasWorkPredicate, pn as bindProofV2ToProjection, pr as unitDescendantIds, pt as reservationFor, q as PROTOCOL_V5_NOTICE, qi as STOP_PROTOCOL_VERSION, qn as NO_PROGRESS_TURNS_BEFORE_STOP, qr as extractArtifactPaths, qt as SUPPORTED_HOST_RANGE, r as auditedDefaultWorkdirHost, ra as semanticActionFromText, ri as LEGACY_QUALIFICATION, rn as authorityCaptureCounts, rr as latestAssistantText, rt as RELEASE_OPERATION_SURFACES, s as hostLockContextFromComposedDump, sa as validateManifest, si as clauseIsGoverned, sn as PROOF_KINDS, sr as testOutcomePredicate, st as normalizeReservation, t as HostProfileError, ta as requestedTargetMatchesResolved, ti as classifyUserInteraction, tn as RC1_HOST_PACKAGES, tr as isRootPauseRequest, tt as OUTCOME_STRENGTH, u as inspectTargetHostGraph, ua as normalizeClause, ui as governedClauseRestrictsExecution, un as PROOF_PROTOCOL_VERSION, ur as hasCurrentCertificate, ut as releaseContractFor, v as GIT_COMMAND_TEMPLATES, vi as isExplanationScope, vn as proofDigest, vr as currentContractDigest, vt as isDeterministicCheck, w as parseGitCommandManifest, wi as kindOfScope, wn as requiredSubjectsOf, wr as rebindAttemptKey, wt as parseShellCommand, x as createGitPrestateEnvelope, xi as isQuestionScopeNeedingReview, xn as proofHostSurfacesOf, xr as proposeRebind, xt as canonicalArgvFromCommand, y as commitIndexSnapshotDigest, yi as isInformationalFragment, yn as proofDigestV2, yr as createProjection, yt as persistedToolResultStatus, z as SESSION_EVENT_ENVELOPE_INVALID, zi as verbIsNegated, zn as recoveryDigest, zr as capabilityFactOf, zt as evaluateExternalWaitCapability } from "./domain-B3EuAllT.js";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { createHash } from "node:crypto";
-import { basename, delimiter, dirname, isAbsolute, join, resolve } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
+import { homedir, tmpdir } from "node:os";
 import { boundContextSummary, createToolResultMessage, createUserMessage } from "@deepseek-ai/dsh-llm";
+import { closeSync, constants, existsSync, fchmodSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, unlinkSync, writeSync } from "node:fs";
+import { promisify } from "node:util";
 import { execFile } from "node:child_process";
-import { constants, existsSync, readFileSync } from "node:fs";
 import { access, readFile, realpath } from "node:fs/promises";
-import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
-import { promisify } from "node:util";
 import { gunzip } from "node:zlib";
-import { SESSION_FORMAT_VERSION } from "@deepseek-ai/dsh-session";
+import { SESSION_FORMAT_VERSION, Session, SessionId } from "@deepseek-ai/dsh-session";
 
 //#region src/tools/rebind.ts
 function createRebindTool(getProjection, prepare) {
@@ -86,6 +86,7 @@ function checkpointPage(p, query, full) {
 		revision: p.contractRevision,
 		evidence: [...p.evidence.values()],
 		items: [...p.items.values()],
+		...full.current_feedback === true ? { current_core: p.coreV2 } : {},
 		item_ids,
 		evidence_ids,
 		evidence_scope,
@@ -167,12 +168,23 @@ function checkpointPage(p, query, full) {
 		available_evidence: [],
 		available_qualifications: []
 	};
+	if (full.current_feedback === true) {
+		output.reason_code = full.reason_code;
+		output.feedback_source = "confirmed_core_v2";
+		output.current_actions = (full.current_actions ?? []).slice(0, 8);
+		output.current_action_total = (full.current_actions ?? []).length;
+		output.certificate_status = "not_requested";
+	}
 	if (full.certificate) output.certificate = full.certificate;
 	if (full.proof_state) output.proof_state = full.proof_state;
 	const pagination = {
 		snapshot: identity,
 		scope: evidence_scope,
-		counts: {
+		counts: full.current_feedback === true ? {
+			pending: full.open_items.length,
+			passed: Object.values(p.coreV2?.predicates ?? {}).filter((value) => value === "satisfied").length,
+			superseded: 0
+		} : {
 			pending: [...p.items.values()].filter((i) => i.status === "pending").length,
 			passed: [...p.items.values()].filter((i) => i.status === "passed").length,
 			superseded: [...p.items.values()].filter((i) => i.status === "superseded").length
@@ -185,6 +197,10 @@ function checkpointPage(p, query, full) {
 			id: String(row.id ?? row.item_id).slice(0, 128),
 			reason_code: row.reason_code,
 			certifiable: row.certifiable,
+			source_item_id: row.source_item_id,
+			revision: row.revision,
+			kind: row.kind,
+			semantic_action: row.semantic_action,
 			next_step: typeof row.next_step === "string" ? row.next_step.slice(0, 240) : void 0,
 			adapter_disposition: row.adapter_disposition,
 			...row.binding_template !== void 0 ? { binding_template: row.binding_template } : {},
@@ -352,7 +368,7 @@ function openItemForTool(projection, item) {
 function createCheckpointTool(getProjection, onRejected, prepare = async () => true) {
 	return defineTool({
 		name: "context_guard_checkpoint",
-		description: "Request a completion certificate from existing durable evidence.",
+		description: "Read current ordinary closure from confirmed observations; request a certificate only for an explicitly adopted proof, Goal, or release contract.",
 		parameters: {
 			item_ids: {
 				type: "array",
@@ -508,10 +524,27 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 						type: "string",
 						enum: [
 							"certified",
+							"observed",
 							"incomplete",
 							"unknown"
 						]
 					},
+					feedback_source: {
+						type: "string",
+						enum: ["confirmed_core_v2"]
+					},
+					current_actions: {
+						type: "array",
+						items: {
+							type: "object",
+							additionalProperties: true
+						}
+					},
+					current_action_total: { type: "integer" },
+					certificate_status: {
+						type: "string",
+						enum: ["not_requested"]
+					},
 					contract_revision: { type: "integer" },
 					active_constraints: {
 						type: "array",
@@ -638,6 +671,22 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 							certification_digest: { type: "string" },
 							unit_id: { type: "string" },
 							unit_closure_digest: { type: "string" },
+							root_locator_identity: { type: "string" },
+							native_observations: {
+								type: "object",
+								additionalProperties: false,
+								properties: {
+									schema: {
+										type: "string",
+										required: true
+									},
+									digests: {
+										type: "array",
+										required: true,
+										items: { type: "string" }
+									}
+								}
+							},
 							goal_ref: { oneOf: [{
 								type: "object",
 								additionalProperties: false,
@@ -670,6 +719,46 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 					rejected_bindings: []
 				};
 			}
+			const currentFeedback = args.proof === void 0 ? currentV6Feedback(projection) : void 0;
+			if (currentFeedback) {
+				const openRows = currentFeedback.openIds.map((id) => {
+					const sourced = sourceItemForCoreRequirement(projection, id);
+					return {
+						id,
+						reason_code: currentFeedback.predicates[id],
+						...sourced ? {
+							source_item_id: sourced.item.id,
+							revision: sourced.item.revision,
+							kind: sourced.item.kind,
+							text: sourced.item.normalizedText
+						} : {},
+						...sourced?.origin ? {
+							source_start: sourced.origin.sourceStart,
+							source_end: sourced.origin.sourceEnd,
+							semantic_action: sourced.origin.action,
+							target: sourced.origin.target
+						} : sourced?.item.semanticAction ? { semantic_action: sourced.item.semanticAction } : {},
+						next_step: "Answer this sourced requirement using the current Host observation or final delivery; ordinary Guard bindings are not required."
+					};
+				});
+				const constraints = Object.entries(currentFeedback.predicates).filter(([, state]) => state === "constraint_active" || state === "constraint_unresolved" || state === "constraint_violated").map(([id, state]) => ({
+					id,
+					reason_code: state
+				}));
+				return checkpointPage(projection, args, {
+					status: currentFeedback.status,
+					reason_code: currentFeedback.reasonCode,
+					current_feedback: true,
+					contract_revision: projection.contractRevision,
+					blocking_total: openRows.length,
+					open_items: openRows,
+					active_constraints: constraints,
+					available_evidence: [],
+					available_qualifications: [],
+					rejected_bindings: [],
+					current_actions: currentFeedback.currentActions
+				});
+			}
 			const bindings = args.bindings.map((binding) => ({
 				itemId: binding.item_id,
 				evidenceIds: binding.evidence_ids,
@@ -796,6 +885,8 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 					open_digest: result.checkpoint.openDigest,
 					evidence_sha256: result.checkpoint.evidenceSha256,
 					binding_digest: result.checkpoint.bindingDigest,
+					...result.checkpoint.nativeObservations ? { native_observations: result.checkpoint.nativeObservations } : {},
+					...result.checkpoint.rootLocatorIdentity ? { root_locator_identity: result.checkpoint.rootLocatorIdentity } : {},
 					certification_digest: result.checkpoint.certificationDigest,
 					...result.checkpoint.unitId !== void 0 ? {
 						unit_id: result.checkpoint.unitId,
@@ -1234,8 +1325,10 @@ const encodeCursor = (cursor) => Buffer.from(JSON.stringify(cursor), "utf8").toS
 * are reached by item ID, not re-listed here (0.6.1, W060-03).
 */
 function discoveryItemIds(p) {
+	const current = currentV6Feedback(p);
+	if (current && current.status !== "unknown") return current.openIds;
 	const pending = [...p.items.values()].filter((item) => item.status === "pending").sort((a, b) => a.revision - b.revision || a.id.localeCompare(b.id));
-	if (p.boundaryProtocol !== 5) return pending.map((item) => item.id);
+	if (p.boundaryProtocol === void 0 || p.boundaryProtocol < 5) return pending.map((item) => item.id);
 	const closureUnits = new Set([...p.currentUnitId !== void 0 ? [p.currentUnitId, ...unitDescendantIds(p, p.currentUnitId)] : []]);
 	return pending.filter((item) => item.unitId === void 0 || item.unitId !== void 0 && closureUnits.has(item.unitId)).map((item) => item.id);
 }
@@ -1251,7 +1344,7 @@ function discoveryItemIds(p) {
 function createPrepareTool(options) {
 	return defineTool({
 		name: "context_guard_prepare",
-		description: "Read-only pre-action preparation: report the supported command shape, required evidence order, existing references, and exact missing target fields for one contract item. Omit item_id to list current open items with their IDs; a stateful change needs resolution/effect/state, a read-only verification needs one matching fact. Pagination follows page_cursor (bound to the contract revision) and semantic_action filters the listing. Performs no action and grants no authority.",
+		description: "Read-only diagnosis of open contract items. Ordinary changes use native host tools and observed facts; this tool never grants execution permission. Omit item_id for a paginated item list.",
 		parameters: {
 			item_id: { type: "string" },
 			item_revision: { type: "number" },
@@ -1292,8 +1385,66 @@ function createPrepareTool(options) {
 				status: "unknown",
 				reason_code: "guard_unavailable"
 			};
+			const currentFeedback = currentV6Feedback(p);
+			if (currentFeedback?.status === "unknown") return {
+				status: "unknown",
+				reason_code: currentFeedback.reasonCode
+			};
+			if (p.boundaryProtocol === 6 && args.item_id !== void 0) {
+				const sourced = currentFeedback ? sourceItemForCoreRequirement(p, args.item_id) : void 0;
+				const current = sourced?.item ?? p.items.get(args.item_id);
+				if (!current) return {
+					status: "rejected",
+					reason_code: "item_not_found"
+				};
+				if (args.item_revision !== void 0 && args.item_revision !== current.revision) return {
+					status: "rejected",
+					reason_code: "item_revision_mismatch"
+				};
+				if (current.kind === "prohibition" && currentFeedback) {
+					const state = currentFeedback.predicates[args.item_id];
+					if (state === "constraint_active" || state === "constraint_unresolved" || state === "constraint_violated") return {
+						status: state === "constraint_active" ? "active" : state === "constraint_unresolved" ? "unknown" : "incomplete",
+						reason_code: state,
+						item: {
+							id: current.id,
+							revision: current.revision,
+							status: state
+						},
+						next_step: state === "constraint_active" ? "This sourced prohibition remains active." : state === "constraint_unresolved" ? "The current Host facts cannot establish whether this prohibition was respected." : "A sourced Host mutation violated this prohibition."
+					};
+				}
+				if (current.semanticAction !== "publish" && currentFeedback) {
+					const exactDerived = sourced?.origin !== void 0;
+					const related = Object.entries(currentFeedback.predicates).filter(([id]) => exactDerived ? id === args.item_id : id === args.item_id || sourceItemForCoreRequirement(p, id)?.item.id === current.id);
+					const state = related.length === 0 ? void 0 : related.every(([, value]) => value === "satisfied") ? "satisfied" : "insufficient";
+					return {
+						status: state === void 0 || state === "satisfied" ? "observed" : "incomplete",
+						reason_code: state === void 0 ? "historical_item_not_current" : state === "satisfied" ? "ordinary_current_predicate_observed" : "current_predicate_insufficient",
+						item: {
+							id: args.item_id,
+							source_item_id: current.id,
+							revision: current.revision,
+							status: state ?? "historical",
+							related_requirement_ids: related.map(([id]) => id)
+						},
+						next_step: state === void 0 ? "This item is historical and is not current ordinary work." : state === "satisfied" ? "This ordinary predicate is already observed. Continue with the remaining sourced requirements; no Guard execution qualification is needed." : "Use the current sourced action and host facts; no Guard execution qualification is needed."
+					};
+				}
+				if (current.semanticAction !== "publish") return {
+					status: "observed",
+					reason_code: "ordinary_execution_host_owned",
+					item: {
+						id: current.id,
+						revision: current.revision,
+						status: current.status
+					},
+					next_step: "Use the host tool for ordinary work. Guard can observe its persisted result and independent readback; no Guard preparation or qualification is required."
+				};
+			}
 			if (args.item_id === void 0) {
 				const filter = args.semantic_action ?? null;
+				const coreIdentity = currentFeedback ? sha256(JSON.stringify(p.coreV2 ?? null)) : void 0;
 				const invalidCursor = (reason_code, note) => ({
 					status: "rejected",
 					reason_code,
@@ -1307,18 +1458,23 @@ function createPrepareTool(options) {
 					try {
 						if (args.page_cursor.length <= 1024) {
 							const value = JSON.parse(Buffer.from(args.page_cursor, "base64url").toString("utf8"));
-							if (value?.v === 1 && Number.isSafeInteger(value.r) && (value.f === null || typeof value.f === "string") && Array.isArray(value.k) && Number.isSafeInteger(value.k[0]) && typeof value.k[1] === "string") parsed = value;
+							if (value?.v === 1 && Number.isSafeInteger(value.r) && (value.f === null || typeof value.f === "string") && Array.isArray(value.k) && Number.isSafeInteger(value.k[0]) && typeof value.k[1] === "string" && (value.c === void 0 || typeof value.c === "string")) parsed = value;
 						}
 					} catch {
 						parsed = void 0;
 					}
 					if (!parsed) return invalidCursor("discovery_cursor_malformed");
 					if (parsed.r !== p.contractRevision) return invalidCursor("discovery_cursor_stale", `The contract changed (cursor revision ${parsed.r}, current ${p.contractRevision}). Re-run discovery without page_cursor; items are never skipped by a stale page.`);
+					if (parsed.c !== coreIdentity) return invalidCursor("discovery_cursor_stale", "The current observation changed. Re-run discovery without page_cursor.");
 					if ((parsed.f ?? null) !== (filter ?? null)) return invalidCursor("discovery_cursor_filter_mismatch");
 					startAfter = parsed.k;
 				}
-				const eligible = discoveryItemIds(p).map((id) => p.items.get(id)).filter((item$1) => filter === null || (item$1.semanticAction ?? "generic_run") === filter);
-				const startIndex = startAfter === void 0 ? 0 : eligible.findIndex((item$1) => item$1.revision === startAfter[0] && item$1.id === startAfter[1]) + 1;
+				const eligible = discoveryItemIds(p).map((id) => ({
+					id,
+					sourced: currentFeedback ? sourceItemForCoreRequirement(p, id) : void 0,
+					item: currentFeedback ? sourceItemForCoreRequirement(p, id)?.item : p.items.get(id)
+				})).filter((entry) => entry.item !== void 0).filter(({ item: item$1, sourced }) => filter === null || (sourced?.origin?.action ?? item$1.semanticAction ?? "generic_run") === filter);
+				const startIndex = startAfter === void 0 ? 0 : eligible.findIndex(({ id, item: item$1 }) => item$1.revision === startAfter[0] && id === startAfter[1]) + 1;
 				if (startAfter !== void 0 && startIndex <= 0) return invalidCursor("discovery_cursor_stale", "The cursor names an item no longer in the current listing. Re-run discovery without page_cursor.");
 				const page = eligible.slice(startIndex, startIndex + DISCOVERY_ITEM_LIMIT);
 				const hasMore = startIndex + page.length < eligible.length;
@@ -1330,15 +1486,21 @@ function createPrepareTool(options) {
 					total_open: eligible.length,
 					listed: page.length,
 					has_more: hasMore,
-					items: page.map((item$1) => {
+					items: page.map(({ id, item: item$1, sourced }) => {
 						const diagnosis$1 = deriveItemDiagnosis(p, item$1);
 						return {
-							id: item$1.id,
+							id,
+							...sourced?.origin ? {
+								source_item_id: item$1.id,
+								source_start: sourced.origin.sourceStart,
+								source_end: sourced.origin.sourceEnd,
+								target: sourced.origin.target
+							} : {},
 							revision: item$1.revision,
 							kind: item$1.kind,
 							...item$1.taskKind !== void 0 ? { task_kind: item$1.taskKind } : {},
-							semantic_action: item$1.semanticAction ?? "generic_run",
-							reason_code: diagnosis$1.reason_code,
+							semantic_action: sourced?.origin?.action ?? item$1.semanticAction ?? "generic_run",
+							reason_code: currentFeedback ? currentFeedback.predicates[id] ?? "current_predicate_insufficient" : diagnosis$1.reason_code,
 							text: item$1.normalizedText
 						};
 					}),
@@ -1346,10 +1508,11 @@ function createPrepareTool(options) {
 						v: 1,
 						r: p.contractRevision,
 						f: filter,
-						k: [page[page.length - 1].revision, page[page.length - 1].id]
+						k: [page[page.length - 1].item.revision, page[page.length - 1].id],
+						...coreIdentity ? { c: coreIdentity } : {}
 					}) } : {},
 					...filter !== null ? { filtered_by: { semantic_action: filter } } : {},
-					note: "Re-run with one item_id to prepare that item, or pass page_cursor for the next page. Preparation performs no action."
+					note: "Re-run with one item_id for a read-only diagnosis, or pass page_cursor for the next page."
 				};
 			}
 			const item = p.items.get(args.item_id ?? "");
@@ -1498,9 +1661,9 @@ function parsePartition(args, extent) {
 		if (!Array.isArray(raw)) return void 0;
 		const spans = [];
 		for (const entry of raw) {
-			const record$1 = entry;
-			const start = record$1?.start;
-			const end = record$1?.end;
+			const record$2 = entry;
+			const start = record$2?.start;
+			const end = record$2?.end;
 			if (typeof start !== "number" || !Number.isSafeInteger(start) || typeof end !== "number" || !Number.isSafeInteger(end) || start >= end) return void 0;
 			spans.push({
 				start,
@@ -1630,7 +1793,7 @@ function createInterpretTool(options) {
 
 //#endregion
 //#region src/tools/evidence.ts
-const execFileAsync = promisify(execFile);
+const execFileAsync$1 = promisify(execFile);
 const PRODUCER_VERSION = "1.0.0";
 const PRODUCER_TOOL = "context_guard_evidence";
 const ACTION_TOOL = "context_guard_action";
@@ -1649,17 +1812,17 @@ const SUPPORTED = [
 const RESTART_INTENT_PREFIX = "Context Guard restart intent v1: ";
 function restartIntent(events, resolutionCallId, target) {
 	for (const raw of events) {
-		const event = record(raw);
+		const event = record$1(raw);
 		if (!event || event.type !== "user/message") continue;
-		const data = record(event.data);
-		const source = record(data?.source);
+		const data = record$1(event.data);
+		const source = record$1(data?.source);
 		if (source?.kind !== "plugin" || source.plugin !== "context-guard" || source.form !== "notice") continue;
 		const content = Array.isArray(data?.content) ? data.content : [];
-		const block = content.length === 1 ? record(content[0]) : void 0;
+		const block = content.length === 1 ? record$1(content[0]) : void 0;
 		const text = typeof block?.text === "string" ? block.text : "";
 		if (!text.startsWith(RESTART_INTENT_PREFIX)) continue;
 		try {
-			const value = record(JSON.parse(text.slice(33)));
+			const value = record$1(JSON.parse(text.slice(33)));
 			if (value?.resolution_call_id === resolutionCallId && value.service_id === target.service_id && value.pre_generation === target.pre_generation) return true;
 		} catch {}
 	}
@@ -1687,7 +1850,7 @@ function installedProfile(moduleUrl = import.meta.url) {
 		directory = parent;
 	}
 }
-function record(value) {
+function record$1(value) {
 	return value && typeof value === "object" ? value : void 0;
 }
 function stable(value) {
@@ -1711,7 +1874,7 @@ function jsonExpectedTransition(transition) {
 	};
 }
 function tuple(value) {
-	return record(value);
+	return record$1(value);
 }
 function adapterId(action) {
 	if (["create", "modify"].includes(action)) return "context-guard.artifact.v1";
@@ -1760,29 +1923,29 @@ function supported(action, role, resolved, observed = {}, commandManifest = {},
 	};
 }
 function messageMeta(event) {
-	return record(record(event.data)?.meta);
+	return record$1(record$1(event.data)?.meta);
 }
 function producerMeta(event) {
-	return record(messageMeta(event)?.contextGuard);
+	return record$1(messageMeta(event)?.contextGuard);
 }
 function eventCallId(event) {
-	const data = record(event.data);
+	const data = record$1(event.data);
 	if (event.type === "tool/call") return typeof data?.callId === "string" ? data.callId : void 0;
-	const source = record(record(data?.message)?.source);
+	const source = record$1(record$1(data?.message)?.source);
 	return typeof source?.callId === "string" ? source.callId : void 0;
 }
 function findResolution(events, callId, action) {
 	let selector;
 	let commandManifest;
 	for (const raw of events) {
-		const event = record(raw);
+		const event = record$1(raw);
 		if (!event || eventCallId(event) !== callId) continue;
 		if (event.type === "tool/call") {
-			const data = record(event.data);
+			const data = record$1(event.data);
 			try {
-				const args = record(JSON.parse(String(data?.arguments ?? "{}")));
-				selector = record(args?.selector);
-				commandManifest = record(args?.command_manifest);
+				const args = record$1(JSON.parse(String(data?.arguments ?? "{}")));
+				selector = record$1(args?.selector);
+				commandManifest = record$1(args?.command_manifest);
 			} catch {
 				return;
 			}
@@ -1792,13 +1955,13 @@ function findResolution(events, callId, action) {
 		const meta = producerMeta(event);
 		if (meta?.semanticAction !== action || meta.evidenceRole !== "resolution" || meta.adapterVersion !== (action === "restart" ? "2.0.0" : PRODUCER_VERSION) || !selector || !commandManifest) return void 0;
 		const target = tuple(meta.resolvedTarget);
-		const rawBinding = record(meta.gitBinding);
-		const rawManifest = record(rawBinding?.manifest);
-		const rawPrestate = record(rawBinding?.prestate);
-		const rawEnvelope = record(rawBinding?.envelope);
-		const rawExecutable = record(meta.executableIdentity);
-		const rawExpected = record(meta.expectedTransition);
-		const expectedParameters$1 = record(rawExpected?.parameters);
+		const rawBinding = record$1(meta.gitBinding);
+		const rawManifest = record$1(rawBinding?.manifest);
+		const rawPrestate = record$1(rawBinding?.prestate);
+		const rawEnvelope = record$1(rawBinding?.envelope);
+		const rawExecutable = record$1(meta.executableIdentity);
+		const rawExpected = record$1(meta.expectedTransition);
+		const expectedParameters$1 = record$1(rawExpected?.parameters);
 		const expectedTransition = rawExpected && typeof rawExpected.predicateId === "string" && rawExpected.version === 1 && rawExpected.predParamsKind === "inline" && expectedParameters$1 ? rawExpected : void 0;
 		const expectedTransitionDigest = typeof meta.expectedTransitionDigest === "string" ? meta.expectedTransitionDigest : void 0;
 		const interpreterIdentityValid = rawExecutable && (rawExecutable.interpreterRealpath === void 0 && rawExecutable.interpreterVersion === void 0 || typeof rawExecutable.interpreterRealpath === "string" && typeof rawExecutable.interpreterVersion === "string");
@@ -1822,14 +1985,14 @@ function findResolution(events, callId, action) {
 function findEffect(events, callId) {
 	let call;
 	for (const raw of events) {
-		const event = record(raw);
+		const event = record$1(raw);
 		if (!event) continue;
 		const seq = typeof event.seq === "number" ? event.seq : -1;
 		if (event.type === "tool/call" && eventCallId(event) === callId) {
-			const data = record(event.data);
+			const data = record$1(event.data);
 			let args = {};
 			try {
-				args = record(JSON.parse(String(data?.arguments ?? "{}"))) ?? {};
+				args = record$1(JSON.parse(String(data?.arguments ?? "{}"))) ?? {};
 			} catch {
 				args = {};
 			}
@@ -1842,23 +2005,26 @@ function findEffect(events, callId) {
 			};
 		}
 		if (event.type === "tool/result" && eventCallId(event) === callId && call) {
-			const data = record(event.data);
+			const data = record$1(event.data);
 			call.resultSeq = seq;
-			call.error = data?.error;
+			call.error = persistedToolResultStatus(data, callId) !== "clean" ? {
+				name: "HostResultError",
+				code: "HOST_RESULT_UNTRUSTED"
+			} : void 0;
 			call.meta = data?.meta;
-			call.textContent = extractTextContent(record(data?.message)?.content ?? []);
+			call.textContent = extractTextContent(record$1(data?.message)?.content ?? []);
 			return call;
 		}
 	}
 }
 function actionCallMatches(events, callId, action, resolutionCallId, target) {
 	for (const raw of events) {
-		const event = record(raw);
+		const event = record$1(raw);
 		if (!event || event.type !== "tool/call" || eventCallId(event) !== callId) continue;
-		const data = record(event.data);
+		const data = record$1(event.data);
 		if (data?.name !== ACTION_TOOL) return false;
 		try {
-			const args = record(JSON.parse(String(data.arguments ?? "{}")));
+			const args = record$1(JSON.parse(String(data.arguments ?? "{}")));
 			return args?.semantic_action === action && args.resolution_call_id === resolutionCallId && args.target_digest === digest(target) && typeof args.contract_item_id === "string" && Number.isSafeInteger(args.contract_item_revision);
 		} catch {
 			return false;
@@ -1868,15 +2034,15 @@ function actionCallMatches(events, callId, action, resolutionCallId, target) {
 }
 function actionResultCompleted(events, callId) {
 	for (const raw of events) {
-		const event = record(raw);
+		const event = record$1(raw);
 		if (!event || event.type !== "tool/result" || eventCallId(event) !== callId) continue;
-		return record(messageMeta(event)?.contextGuardAction)?.status === "completed";
+		return record$1(messageMeta(event)?.contextGuardAction)?.status === "completed" && persistedToolResultStatus(event.data, callId) === "clean";
 	}
 	return false;
 }
 function plannedEffectDigest(manifest) {
 	const name$1 = typeof manifest.planned_tool === "string" ? manifest.planned_tool : void 0;
-	const args = record(manifest.planned_arguments);
+	const args = record$1(manifest.planned_arguments);
 	return name$1 && args ? digest({
 		name: name$1,
 		arguments: args
@@ -1884,7 +2050,7 @@ function plannedEffectDigest(manifest) {
 }
 function plannedEffect(manifest) {
 	const name$1 = typeof manifest.planned_tool === "string" ? manifest.planned_tool : void 0;
-	const args = record(manifest.planned_arguments);
+	const args = record$1(manifest.planned_arguments);
 	return name$1 && args ? {
 		name: name$1,
 		arguments: args,
@@ -1917,7 +2083,7 @@ function effectDigest(effect) {
 	});
 }
 function cwdOf(agent) {
-	const header = record(agent.session.header);
+	const header = record$1(agent.session.header);
 	return typeof header?.cwd === "string" ? header.cwd : void 0;
 }
 function pathOf(selector, cwd) {
@@ -1935,7 +2101,7 @@ async function fileDigest(path) {
 }
 async function readJson(path) {
 	try {
-		return record(JSON.parse(await readFile(path, "utf8")));
+		return record$1(JSON.parse(await readFile(path, "utf8")));
 	} catch {
 		return;
 	}
@@ -1959,7 +2125,7 @@ async function tgzIdentity(path) {
 		if (name$1 === "package/package.json") {
 			if (manifest || size$1 > 1024 * 1024) return void 0;
 			try {
-				manifest = record(JSON.parse(tar.subarray(bodyStart, bodyEnd).toString("utf8")));
+				manifest = record$1(JSON.parse(tar.subarray(bodyStart, bodyEnd).toString("utf8")));
 			} catch {
 				return;
 			}
@@ -1969,7 +2135,7 @@ async function tgzIdentity(path) {
 	if (typeof manifest?.name !== "string" || typeof manifest.version !== "string") return void 0;
 	const gitHead = typeof manifest.gitHead === "string" && /^[0-9a-f]{40}$/.test(manifest.gitHead) ? manifest.gitHead : void 0;
 	const repositoryField = manifest.repository;
-	const repository = typeof repositoryField === "string" ? repositoryField : record(repositoryField) && typeof record(repositoryField)?.url === "string" ? String(record(repositoryField).url) : void 0;
+	const repository = typeof repositoryField === "string" ? repositoryField : record$1(repositoryField) && typeof record$1(repositoryField)?.url === "string" ? String(record$1(repositoryField).url) : void 0;
 	return {
 		name: manifest.name,
 		version: manifest.version,
@@ -2037,10 +2203,10 @@ async function marketCapabilities(roots, signal) {
 		redirect: "error"
 	});
 	if (!response.ok) return void 0;
-	const value = record(await response.json());
+	const value = record$1(await response.json());
 	if (value?.schema !== MARKET_SCHEMA || value.apiVersion !== 1 || value.marketVersion !== binding.version || value.profile !== binding.profile || value.bootId !== binding.bootId) return void 0;
-	const features = record(value.features);
-	const restart = record(value.restart);
+	const features = record$1(value.features);
+	const restart = record$1(value.restart);
 	if (features?.restart !== true || restart?.supported !== true || restart.managedBy !== "market") return void 0;
 	const provider = createHash("sha256").update(JSON.stringify([
 		MARKET_SCHEMA,
@@ -2104,17 +2270,17 @@ async function profilePackage(profilePath, packageId) {
 	}
 }
 async function registryIntegrity(registry, packageId, version, roots, signal) {
-	const canonical = canonicalRegistryBase(registry, { allowLoopbackHttp: roots.allowLoopbackHttpRegistry });
-	if (!canonical || canonical !== registry) return void 0;
-	const response = await (roots.fetcher ?? fetch)(new URL(npmEscapedPackageName(packageId), canonical), {
+	const canonical$1 = canonicalRegistryBase(registry, { allowLoopbackHttp: roots.allowLoopbackHttpRegistry });
+	if (!canonical$1 || canonical$1 !== registry) return void 0;
+	const response = await (roots.fetcher ?? fetch)(new URL(npmEscapedPackageName(packageId), canonical$1), {
 		signal,
 		headers: { accept: "application/json" },
 		redirect: "error"
 	});
 	if (!response.ok) return void 0;
-	const value = record(await response.json());
-	const release = record(record(value?.versions)?.[version]);
-	const dist = record(release?.dist);
+	const value = record$1(await response.json());
+	const release = record$1(record$1(value?.versions)?.[version]);
+	const dist = record$1(release?.dist);
 	return value?.name === packageId && release?.name === packageId && release.version === version && typeof dist?.integrity === "string" ? dist.integrity : void 0;
 }
 function windowsBatchCommand(file, args) {
@@ -2130,7 +2296,7 @@ async function windowsCommandInterpreter(signal) {
 		const interpreterRealpath = await realpath(configured);
 		const systemInterpreter = await realpath(resolve(systemRoot, "System32", "cmd.exe"));
 		if (basename(interpreterRealpath).toLowerCase() !== "cmd.exe" || interpreterRealpath.toLowerCase() !== systemInterpreter.toLowerCase()) return void 0;
-		const { stdout, stderr } = await execFileAsync(interpreterRealpath, [
+		const { stdout, stderr } = await execFileAsync$1(interpreterRealpath, [
 			"/d",
 			"/v:off",
 			"/c",
@@ -2153,7 +2319,7 @@ async function execAuditedFile(file, args, options, interpreter) {
 	if (process.platform === "win32" && /\.(?:cmd|bat)$/i.test(file)) {
 		const command = windowsBatchCommand(file, args);
 		if (!command || !interpreter) throw new Error("unsafe Windows batch invocation");
-		return execFileAsync(interpreter.interpreterRealpath, [
+		return execFileAsync$1(interpreter.interpreterRealpath, [
 			"/d",
 			"/v:off",
 			"/s",
@@ -2166,7 +2332,7 @@ async function execAuditedFile(file, args, options, interpreter) {
 			windowsVerbatimArguments: true
 		});
 	}
-	return execFileAsync(file, args, {
+	return execFileAsync$1(file, args, {
 		...options,
 		encoding: "utf8"
 	});
@@ -2202,14 +2368,14 @@ async function executableIdentity(executable, signal) {
 		const candidate = resolve(directory, `${executable}${suffix}`);
 		try {
 			await access(candidate, constants.X_OK);
-			const canonical = await realpath(candidate);
-			const interpreter = process.platform === "win32" && /\.(?:cmd|bat)$/i.test(canonical) ? await windowsCommandInterpreter(signal) : void 0;
-			if (process.platform === "win32" && /\.(?:cmd|bat)$/i.test(canonical) && !interpreter) continue;
-			const { stdout, stderr } = await execAuditedFile(canonical, ["--version"], { signal }, interpreter);
+			const canonical$1 = await realpath(candidate);
+			const interpreter = process.platform === "win32" && /\.(?:cmd|bat)$/i.test(canonical$1) ? await windowsCommandInterpreter(signal) : void 0;
+			if (process.platform === "win32" && /\.(?:cmd|bat)$/i.test(canonical$1) && !interpreter) continue;
+			const { stdout, stderr } = await execAuditedFile(canonical$1, ["--version"], { signal }, interpreter);
 			const version = `${stdout}${stderr}`.trim();
 			if (version && !version.includes("\n") && !version.includes("\r")) return {
 				executable,
-				realpath: canonical,
+				realpath: canonical$1,
 				version,
 				...interpreter
 			};
@@ -2249,8 +2415,8 @@ async function executeGuardAction(action, resolution, roots, signal, executableI
 		const capabilities = await marketCapabilities(roots, signal);
 		if (!capabilities || !roots.marketOrigin || !resolutionCallId || !agent) return { status: "unavailable" };
 		if (!sameMarketProvider(target.pre_generation, capabilities.generation)) return { status: "unavailable" };
-		if (capabilities.generation !== target.pre_generation) return restartIntent(snapshotSessionEvents(agent.session), resolutionCallId, target) ? { status: "completed" } : { status: "unavailable" };
-		if (restartIntent(snapshotSessionEvents(agent.session), resolutionCallId, target)) return { status: "handoff_pending" };
+		if (capabilities.generation !== target.pre_generation) return roots.hasRestartIntent?.(resolutionCallId, String(target.service_id), String(target.pre_generation)) || restartIntent(snapshotSessionEvents(agent.session), resolutionCallId, target) ? { status: "completed" } : { status: "unavailable" };
+		if (roots.hasRestartIntent?.(resolutionCallId, String(target.service_id), String(target.pre_generation)) || restartIntent(snapshotSessionEvents(agent.session), resolutionCallId, target)) return { status: "handoff_pending" };
 		if (!roots.persistRestartIntent || !await roots.persistRestartIntent(agent, {
 			resolutionCallId,
 			serviceId: String(target.service_id),
@@ -2268,7 +2434,7 @@ async function executeGuardAction(action, resolution, roots, signal, executableI
 			body: "{}"
 		});
 		if (!response.ok) return { status: "unavailable" };
-		return record(await response.json())?.schema === MARKET_SCHEMA ? { status: "handoff_pending" } : { status: "unavailable" };
+		return record$1(await response.json())?.schema === MARKET_SCHEMA ? { status: "handoff_pending" } : { status: "unavailable" };
 	}
 	if (action === "commit" || action === "push" || action === "pull" || action === "fetch") {
 		const binding = resolution.gitBinding;
@@ -2321,7 +2487,7 @@ async function executeGuardAction(action, resolution, roots, signal, executableI
 	return { status: "unavailable" };
 }
 async function gitBytes(repository, args, signal, file = "git") {
-	const { stdout } = await execFileAsync(file, args, {
+	const { stdout } = await execFileAsync$1(file, args, {
 		cwd: repository,
 		encoding: "buffer",
 		signal,
@@ -2441,12 +2607,12 @@ function pickTarget(target, keys) {
 async function expectedTransitionForResolution(action, target, commandManifest) {
 	let parameters;
 	if (action === "create") {
-		const plannedArguments = record(commandManifest.planned_arguments);
+		const plannedArguments = record$1(commandManifest.planned_arguments);
 		const content = typeof plannedArguments?.content === "string" ? plannedArguments.content : void 0;
 		if (content === void 0) return void 0;
 		parameters = { post_digest: createHash("sha256").update(Buffer.from(content, "utf8")).digest("hex") };
 	} else if (action === "modify") {
-		const plannedArguments = record(commandManifest.planned_arguments);
+		const plannedArguments = record$1(commandManifest.planned_arguments);
 		const oldString = requireString(plannedArguments ?? {}, "old_string");
 		const newString = typeof plannedArguments?.new_string === "string" ? plannedArguments.new_string : void 0;
 		const artifact = typeof target.artifact_id === "string" ? target.artifact_id : void 0;
@@ -2523,8 +2689,8 @@ async function resolveTarget(action, selector, commandManifest, cwd, roots, sign
 		const service = requireString(selector, "service_id");
 		if (service !== "dsh-web" || commandManifest.manifest_id !== "dshmarket.restart.v1" || !ACTION_MANIFEST.actions.restart.commandManifestIds.includes("dshmarket.restart.v1") || Object.keys(commandManifest).length !== 1) return void 0;
 		const capabilities = await marketCapabilities(roots, signal);
-		const features = record(capabilities?.features);
-		const restart = record(capabilities?.restart);
+		const features = record$1(capabilities?.features);
+		const restart = record$1(capabilities?.restart);
 		if (features?.restart !== true || restart?.supported !== true || restart.managedBy !== "market") return void 0;
 		return { target: {
 			service_id: service,
@@ -2753,6 +2919,7 @@ function normalizedRoots(options) {
 		...options.fetcher ? { fetcher: options.fetcher } : {},
 		...options.commandRunner ? { commandRunner: options.commandRunner } : {},
 		...options.persistRestartIntent ? { persistRestartIntent: options.persistRestartIntent } : {},
+		...options.hasRestartIntent ? { hasRestartIntent: options.hasRestartIntent } : {},
 		...options.hostCapability ? { hostCapability: options.hostCapability } : {},
 		...options.authorizeMutation ? { authorizeMutation: options.authorizeMutation } : {},
 		...options.prepareMutation ? { prepareMutation: options.prepareMutation } : {},
@@ -2766,7 +2933,7 @@ function createActionTool(options = {}) {
 	const roots = normalizedRoots(options);
 	return defineTool({
 		name: ACTION_TOOL,
-		description: "Execute one explicit Guard-owned mutation after re-reading a persisted resolution and exact target digest. This tool changes package, Git, registry, or Web service state; its result echoes the bounded target and command-manifest digest.",
+		description: "Compatibility entry for older sessions. Ordinary mutations return a migration diagnosis without side effects; only an explicitly adopted registry publication can use the controlled release path.",
 		parameters: {
 			semantic_action: {
 				type: "string",
@@ -2854,6 +3021,11 @@ function createActionTool(options = {}) {
 				target_digest: "",
 				command_manifest_digest: ""
 			};
+			if (action !== "publish") return {
+				status: "unavailable",
+				reason_code: "ordinary_action_migrated_to_host_tools",
+				...empty
+			};
 			if (!agent || ![
 				"install",
 				"apply",
@@ -3022,7 +3194,7 @@ function createEvidenceTool(options = {}) {
 	const roots = normalizedRoots(options);
 	return defineTool({
 		name: PRODUCER_TOOL,
-		description: "Create one trusted stateful resolution/effect/state fact from the live resource and persisted DSH tool events. Unsupported adapters fail closed.",
+		description: "Observe a controlled registry publish. Ordinary work uses native host tools and read-only observers; older producer calls return migration diagnostics.",
 		parameters: {
 			semantic_action: {
 				type: "string",
@@ -3228,6 +3400,17 @@ function createEvidenceTool(options = {}) {
 		async execute(args, exec) {
 			const action = args.semantic_action;
 			const role = args.evidence_role;
+			if ([
+				"install",
+				"apply",
+				"create",
+				"modify",
+				"restart",
+				"commit",
+				"push",
+				"pull",
+				"fetch"
+			].includes(action)) return unavailable(action, role, "ordinary_evidence_migrated_to_host_facts", void 0, "Use the native host tool and its persisted result; request only a read-only Guard observer when an independent state fact is needed. Do not repeat an earlier effect.");
 			if (!SUPPORTED.includes(action)) return unavailable(action, role, "adapter_unavailable_for_pinned_host");
 			if (roots.hostCapability?.(action).status !== "supported" && roots.hostCapability) return unavailable(action, role, "host_capability_unavailable");
 			const agent = exec.agent;
@@ -3236,9 +3419,9 @@ function createEvidenceTool(options = {}) {
 				if (role === "resolution") {
 					const recipe = actionPreparation(action);
 					{
-						const manifest = record(args.command_manifest);
-						const plannedArgs = record(manifest?.planned_arguments);
-						const selector = record(args.selector);
+						const manifest = record$1(args.command_manifest);
+						const plannedArgs = record$1(manifest?.planned_arguments);
+						const selector = record$1(args.selector);
 						const needsManifestId = [
 							"install",
 							"apply",
@@ -3258,10 +3441,10 @@ function createEvidenceTool(options = {}) {
 					const executable$1 = executableFor(action);
 					const executableBinding = executable$1 ? await (roots.readExecutableIdentity ?? executableIdentity)(executable$1, exec.signal) : void 0;
 					if (executable$1 && !executableBinding) return unavailable(action, role, "executable_identity_unavailable");
-					const resolved = await resolveTarget(action, record(args.selector) ?? {}, record(args.command_manifest) ?? {}, cwdOf(agent), roots, exec.signal, executableBinding);
+					const resolved = await resolveTarget(action, record$1(args.selector) ?? {}, record$1(args.command_manifest) ?? {}, cwdOf(agent), roots, exec.signal, executableBinding);
 					if (!resolved) return unavailable(action, role, action === "restart" && !roots.verifyMarketInstance ? "market_instance_binding_unavailable" : "resolution_unavailable");
 					const gitBinding = resolved.gitBinding ? JSON.parse(JSON.stringify(resolved.gitBinding)) : void 0;
-					const commandManifest = record(args.command_manifest) ?? {};
+					const commandManifest = record$1(args.command_manifest) ?? {};
 					const expectedTransition = await expectedTransitionForResolution(action, resolved.target, commandManifest);
 					if (!expectedTransition) return unavailable(action, role, "expected_transition_unavailable");
 					return supported(action, role, resolved.target, {}, commandManifest, gitBinding, executableBinding, expectedTransition);
@@ -3353,21 +3536,27 @@ function createReleaseTool(options) {
 					operations: releaseCoverage(contract$1),
 					candidate: contract$1.candidate
 				})),
-				reservations: projection.releaseReservations.map(({ contractId: contractId$1, operation: operation$1, callId: callId$1, startedAtSeq, observedArtifactSri }) => ({
+				reservations: projection.releaseReservations.map(({ contractId: contractId$1, operation: operation$1, callId: callId$1, startedAtSeq, ledgerPosition, observedArtifactSri }) => ({
 					contract_id: contractId$1,
 					operation: operation$1,
 					resolution_call_id: callId$1,
-					started_at_seq: startedAtSeq,
+					...ledgerPosition === void 0 ? { started_at_seq: startedAtSeq } : { record_position: {
+						channel: "private_ledger",
+						position: ledgerPosition
+					} },
 					observed_artifact_sri: observedArtifactSri ?? null,
 					in_flight: inFlightReservation(projection, contractId$1, operation$1)?.callId === callId$1
 				})),
-				settlements: projection.releaseSettlements.map(({ contractId: contractId$1, operation: operation$1, callId: callId$1, outcome: outcome$1, readback: readback$2, settledAtSeq }) => ({
+				settlements: projection.releaseSettlements.map(({ contractId: contractId$1, operation: operation$1, callId: callId$1, outcome: outcome$1, readback: readback$2, settledAtSeq, ledgerPosition }) => ({
 					contract_id: contractId$1,
 					operation: operation$1,
 					resolution_call_id: callId$1,
 					outcome: outcome$1,
 					readback: readback$2,
-					settled_at_seq: settledAtSeq
+					...ledgerPosition === void 0 ? { settled_at_seq: settledAtSeq } : { record_position: {
+						channel: "private_ledger",
+						position: ledgerPosition
+					} }
 				})),
 				diagnostics: projection.releaseDiagnostics
 			};
@@ -3434,6 +3623,518 @@ function createReleaseTool(options) {
 	});
 }
 
+//#endregion
+//#region src/tools/observe.ts
+const execFileAsync = promisify(execFile);
+const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+/** Read-only, post-effect file observer. The path comes from a persisted native edit call. */
+function createNativeFileObserver(host) {
+	return defineTool({
+		name: "context_guard_observe_file",
+		description: "Read back the exact UTF-8 file after an already persisted native write or edit. This tool does not modify files or authorize the edit.",
+		parameters: { effect_call_id: {
+			type: "string",
+			required: true
+		} },
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					status: {
+						type: "string",
+						required: true,
+						enum: ["observed", "unavailable"]
+					},
+					reason_code: {
+						type: "string",
+						required: true
+					},
+					effect_call_id: {
+						type: "string",
+						required: true
+					},
+					path: {
+						type: "string",
+						required: true
+					},
+					sha256: {
+						type: "string",
+						required: true
+					},
+					action: {
+						type: "string",
+						required: true,
+						enum: [
+							"create",
+							"modify",
+							"unknown"
+						]
+					},
+					canonical_path: { type: "string" },
+					canonical_base: { type: "string" }
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: JSON.stringify(value)
+			}],
+			presentationMeta: (_args, value) => value.status === "observed" ? { contextGuardNativeFile: {
+				effectCallId: value.effect_call_id,
+				path: value.path,
+				sha256: value.sha256,
+				action: value.action,
+				...value.canonical_path ? { canonicalPath: value.canonical_path } : {},
+				...value.canonical_base ? { canonicalBase: value.canonical_base } : {}
+			} } : { contextGuardNativeFileUnavailable: { reasonCode: value.reason_code } }
+		},
+		async execute(args, exec) {
+			const missing = (reason) => ({
+				status: "unavailable",
+				reason_code: reason,
+				effect_call_id: args.effect_call_id,
+				path: "",
+				sha256: "",
+				action: "unknown"
+			});
+			const agent = exec.agent;
+			if (!agent || !host.fs || !host.flush) return missing("host_fs_unavailable");
+			if (!await host.flush(agent.session)) return missing("native_effect_not_durable");
+			let call;
+			let result;
+			let callSeq = -1;
+			let resultSeq = -1;
+			let duplicate = false;
+			for (const raw of snapshotSessionEvents(agent.session)) {
+				const event = record(raw);
+				const data = record(event?.data);
+				if (event?.type === "tool/call" && data?.callId === args.effect_call_id) {
+					if (call) duplicate = true;
+					call = data;
+					callSeq = Number(event.seq);
+				}
+				if (event?.type === "tool/result" && record(record(data?.message)?.source)?.callId === args.effect_call_id) {
+					if (result) duplicate = true;
+					result = data;
+					resultSeq = Number(event.seq);
+				}
+			}
+			if (!call || !result || duplicate || callSeq >= resultSeq || call.turn !== result.turn || call.step !== result.step || ![
+				"write",
+				"write_file",
+				"edit",
+				"edit_file"
+			].includes(String(call.name))) return missing("native_effect_missing");
+			const source = record(record(result.message)?.source);
+			if (source?.kind !== "tool" || source.callId !== args.effect_call_id) return missing("native_effect_missing");
+			const resultStatus = persistedToolResultStatus(result, args.effect_call_id);
+			if (resultStatus !== "clean") return missing(resultStatus === "failure" ? "native_effect_failed" : "native_effect_untrusted");
+			let effectArgs;
+			try {
+				effectArgs = record(JSON.parse(String(call.arguments)));
+			} catch {
+				return missing("native_effect_arguments_invalid");
+			}
+			const filePath = effectArgs?.file_path;
+			if (typeof filePath !== "string" || !filePath) return missing("native_effect_target_missing");
+			const action = String(call.name).startsWith("write") ? "create" : "modify";
+			const cwd = record(agent.session.header)?.cwd;
+			try {
+				const target = await host.fs.resolve(filePath, {
+					...typeof cwd === "string" ? { cwd } : {},
+					signal: exec.signal
+				});
+				const before = await host.fs.stat(target, exec.signal);
+				if (!before || before.type !== "file" || before.size !== void 0 && before.size > 2e7) return missing("native_file_readback_unavailable");
+				const content = await host.fs.readText(target, exec.signal);
+				const after = await host.fs.stat(target, exec.signal);
+				if (!after || after.type !== "file" || before.version !== after.version) return missing("native_file_readback_raced");
+				let canonicalPath;
+				let canonicalBase;
+				if (typeof cwd === "string" && host.fs.processPath && host.fs.contains) {
+					const base = await host.fs.resolve(cwd, { signal: exec.signal });
+					const path = host.fs.processPath(target);
+					const root = host.fs.processPath(base);
+					const absoluteFlavor = (value) => value.startsWith("/") && !value.startsWith("//") && !value.includes("\\") && posix.normalize(value) === value ? "posix" : /^[A-Za-z]:\\/.test(value) && !value.includes("/") && !value.slice(3).includes("\\\\") && !value.slice(3).includes(":") && !value.split("\\").some((part) => part === "." || part === "..") ? "windows" : void 0;
+					if (host.fs.contains(base, target) && absoluteFlavor(path) && absoluteFlavor(path) === absoluteFlavor(root)) {
+						canonicalPath = path;
+						canonicalBase = root;
+					}
+				}
+				return {
+					status: "observed",
+					reason_code: "file_state_observed",
+					effect_call_id: args.effect_call_id,
+					path: target.displayPath,
+					sha256: createHash("sha256").update(content, "utf8").digest("hex"),
+					action,
+					...canonicalPath && canonicalBase ? {
+						canonical_path: canonicalPath,
+						canonical_base: canonicalBase
+					} : {}
+				};
+			} catch {
+				return missing("native_file_readback_unavailable");
+			}
+		}
+	});
+}
+/** Fixed-argv Git readback for a persisted native shell commit/push result. */
+function createNativeGitObserver(host) {
+	return defineTool({
+		name: "context_guard_observe_git",
+		description: "Read back a repository after a persisted native Git command; performs only fixed Git queries.",
+		parameters: { effect_call_id: {
+			type: "string",
+			required: true
+		} },
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					status: {
+						type: "string",
+						required: true,
+						enum: ["observed", "unavailable"]
+					},
+					reason_code: {
+						type: "string",
+						required: true
+					},
+					effect_call_id: {
+						type: "string",
+						required: true
+					},
+					action: {
+						type: "string",
+						required: true,
+						enum: [
+							"commit",
+							"push",
+							"unknown"
+						]
+					},
+					repository: {
+						type: "string",
+						required: true
+					},
+					branch: {
+						type: "string",
+						required: true
+					},
+					remote: {
+						type: "string",
+						required: true
+					},
+					refspec: {
+						type: "string",
+						required: true
+					},
+					post_oid: {
+						type: "string",
+						required: true
+					},
+					parent_oid: {
+						type: "string",
+						required: true
+					},
+					tree_oid: {
+						type: "string",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: JSON.stringify(value)
+			}],
+			presentationMeta: (_args, value) => value.status === "observed" ? { contextGuardNativeGit: {
+				effectCallId: value.effect_call_id,
+				action: value.action,
+				repository: value.repository,
+				branch: value.branch,
+				remote: value.remote,
+				refspec: value.refspec,
+				postOid: value.post_oid,
+				parentOid: value.parent_oid,
+				treeOid: value.tree_oid
+			} } : { contextGuardNativeGitUnavailable: { reasonCode: value.reason_code } }
+		},
+		async execute(args, exec) {
+			const missing = (reason) => ({
+				status: "unavailable",
+				reason_code: reason,
+				effect_call_id: args.effect_call_id,
+				action: "unknown",
+				repository: "",
+				branch: "",
+				remote: "",
+				refspec: "",
+				post_oid: "",
+				parent_oid: "",
+				tree_oid: ""
+			});
+			const session = exec.agent?.session;
+			if (!session || !host.flush || !await host.flush(session)) return missing("native_effect_not_durable");
+			let call;
+			let result;
+			let callSeq = -1;
+			let resultSeq = -1;
+			let duplicate = false;
+			for (const raw of snapshotSessionEvents(session)) {
+				const event = record(raw);
+				const data = record(event?.data);
+				if (event?.type === "tool/call" && data?.callId === args.effect_call_id) {
+					if (call) duplicate = true;
+					call = data;
+					callSeq = Number(event.seq);
+				}
+				if (event?.type === "tool/result" && record(record(data?.message)?.source)?.callId === args.effect_call_id) {
+					if (result) duplicate = true;
+					result = data;
+					resultSeq = Number(event.seq);
+				}
+			}
+			if (!call || !result || duplicate || callSeq >= resultSeq || call.turn !== result.turn || call.step !== result.step || call.name !== "bash" && call.name !== "pwsh") return missing("native_effect_missing");
+			const message = record(result.message);
+			const source = record(message?.source);
+			if (source?.kind !== "tool" || source.callId !== args.effect_call_id) return missing("native_effect_missing");
+			const resultStatus = persistedToolResultStatus(result, args.effect_call_id);
+			if (resultStatus !== "clean") return missing(resultStatus === "failure" ? "native_effect_failed" : "native_effect_untrusted");
+			let effectArgs;
+			try {
+				effectArgs = record(JSON.parse(String(call.arguments)));
+			} catch {
+				return missing("native_effect_arguments_invalid");
+			}
+			const command = effectArgs?.command;
+			const repository = effectArgs?.workdir;
+			if (typeof command !== "string" || typeof repository !== "string" || !repository) return missing("native_git_target_missing");
+			const parsed = canonicalArgvFromCommand(command, call.name);
+			const argv = parsed.argv;
+			if (parsed.status !== "supported" || argv[0] !== "git") return missing("native_git_command_unsupported");
+			const action = argv[1];
+			if (action !== "commit" && action !== "push") return missing("native_git_command_unsupported");
+			const gitAction = action;
+			const output = Array.isArray(message?.content) ? extractTextContent(message.content) : "";
+			const git$1 = async (...query) => (await execFileAsync("git", [
+				"-C",
+				repository,
+				...query
+			], {
+				encoding: "utf8",
+				timeout: 5e3,
+				maxBuffer: 1024 * 1024
+			})).stdout.trim();
+			try {
+				const top = await git$1("rev-parse", "--show-toplevel");
+				if (!top || await realpath(top) !== await realpath(repository)) return missing("native_git_repository_mismatch");
+				const observedRepository = repository;
+				const branch = await git$1("symbolic-ref", "--short", "HEAD");
+				const postOid = await git$1("rev-parse", "HEAD");
+				if (!/^[0-9a-f]{40,64}$/.test(postOid)) return missing("native_git_readback_unavailable");
+				if (action === "commit") {
+					if (argv.length !== 4 || argv[2] !== "-m" || !argv[3] || !(/* @__PURE__ */ new RegExp(`\\b${postOid.slice(0, 7)}[0-9a-f]*\\b`)).test(output)) return missing("native_git_effect_output_unbound");
+					const parentOid = await git$1("rev-parse", "HEAD^");
+					const treeOid = await git$1("rev-parse", "HEAD^{tree}");
+					return {
+						status: "observed",
+						reason_code: "git_commit_observed",
+						effect_call_id: args.effect_call_id,
+						action: gitAction,
+						repository: observedRepository,
+						branch,
+						remote: "",
+						refspec: "",
+						post_oid: postOid,
+						parent_oid: parentOid,
+						tree_oid: treeOid
+					};
+				}
+				const remote = argv[2];
+				const refspec = argv[3];
+				if (argv.length !== 4 || !remote || !/^refs\/heads\/[^:]+:refs\/heads\/[^:]+$/.test(refspec)) return missing("native_git_refspec_unsupported");
+				const [src, dst] = refspec.split(":");
+				const localOid = await git$1("rev-parse", src);
+				const remoteOid = (await git$1("ls-remote", "--exit-code", remote, dst)).split(/\s+/)[0];
+				const destinationName = dst.slice(11);
+				const reportedUpdate = output.includes(localOid.slice(0, 7)) || output.includes("[new branch]") && output.includes(`-> ${destinationName}`);
+				if (remoteOid !== localOid || !reportedUpdate) return missing("native_git_push_readback_mismatch");
+				return {
+					status: "observed",
+					reason_code: "git_push_observed",
+					effect_call_id: args.effect_call_id,
+					action: gitAction,
+					repository: observedRepository,
+					branch,
+					remote,
+					refspec,
+					post_oid: remoteOid,
+					parent_oid: "",
+					tree_oid: ""
+				};
+			} catch {
+				return missing("native_git_readback_unavailable");
+			}
+		}
+	});
+}
+/** Specific package-script readiness, with a stable changed input for an
+* assessment. The observer never executes the script or infers success. */
+function createTestReadinessObserver(host) {
+	return defineTool({
+		name: "context_guard_observe_test_readiness",
+		description: "Read a pending test or assessment script and its concrete inputs; never runs the script.",
+		parameters: { item_id: {
+			type: "string",
+			required: true
+		} },
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					status: {
+						type: "string",
+						required: true,
+						enum: ["ready", "unavailable"]
+					},
+					reason_code: {
+						type: "string",
+						required: true
+					},
+					item_id: {
+						type: "string",
+						required: true
+					},
+					scope: {
+						type: "string",
+						required: true
+					},
+					manifest_sha256: {
+						type: "string",
+						required: true
+					},
+					predicate: {
+						type: "string",
+						required: true
+					},
+					script_name: {
+						type: "string",
+						required: true
+					},
+					selected_path: {
+						type: "string",
+						required: true
+					},
+					effect_call_id: {
+						type: "string",
+						required: true
+					},
+					input_sha256: {
+						type: "string",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: JSON.stringify(value)
+			}],
+			presentationMeta: (_args, value) => value.status === "ready" ? { contextGuardTestReadiness: {
+				itemId: value.item_id,
+				scope: value.scope,
+				manifestSha256: value.manifest_sha256,
+				predicate: value.predicate,
+				scriptName: value.script_name,
+				selectedPath: value.selected_path,
+				effectCallId: value.effect_call_id,
+				inputSha256: value.input_sha256
+			} } : { contextGuardTestReadinessUnavailable: { reasonCode: value.reason_code } }
+		},
+		async execute(args, exec) {
+			const missing = (reason) => ({
+				status: "unavailable",
+				reason_code: reason,
+				item_id: args.item_id,
+				scope: "",
+				manifest_sha256: "",
+				predicate: "",
+				script_name: "",
+				selected_path: "",
+				effect_call_id: "",
+				input_sha256: ""
+			});
+			if (!exec.agent?.session || !host.flush || !host.fs || !await host.flush(exec.agent.session)) return missing("readiness_host_unavailable");
+			const projection = host.getProjection();
+			const item = projection?.items.get(args.item_id);
+			if (!item || item.status !== "pending" || !["test", "verify"].includes(item.semanticAction ?? "") || item.authority !== "root_instruction" || item.authorityDisposition !== "executable_now" || item.legacyFlags?.length || item.waitAuthorization || item.condition || typeof item.requestedTarget?.scope !== "string") return missing("readiness_item_unsupported");
+			const scope = item.requestedTarget.scope;
+			const assessment = item.semanticAction === "verify";
+			if (typeof item.requestedTarget.script_name === "string") return missing("readiness_script_capability_unavailable");
+			const scriptName = assessment && /(?:吞吐|性能|时延|延迟|throughput|performance|latency)/iu.test(item.normalizedText) ? "benchmark" : "test";
+			let selectedPath = "", effectCallId = "", inputSha256 = "";
+			if (assessment) {
+				const unitStart = item.unitId ? projection?.units.get(item.unitId)?.openedAtSeq : void 0;
+				if (unitStart === void 0) return missing("assessment_unit_unavailable");
+				const changes = [...projection?.evidence.values() ?? []].filter((fact) => fact.epoch === projection?.epoch && fact.toolResultSeq >= unitStart && fact.outcome === "success" && fact.parseStatus === "supported" && fact.semanticAction === "modify" && fact.evidenceRole === "effect").flatMap((fact) => (fact.operations ?? []).filter((op) => op.op === "modify" && typeof op.path === "string").map((op) => ({
+					path: op.path,
+					callId: fact.callId
+				})));
+				const paths = [...new Set(changes.map((change) => change.path))];
+				if (paths.length > 1) return missing("assessment_input_ambiguous");
+				if (paths.length === 1) {
+					const change = changes.find((entry) => entry.path === paths[0]);
+					selectedPath = change.path;
+					effectCallId = change.callId;
+					try {
+						const changed = await host.fs.resolve(selectedPath, { signal: exec.signal });
+						const before = await host.fs.stat(changed, exec.signal);
+						if (!before || before.type !== "file" || before.size !== void 0 && before.size > 2e7) return missing("assessment_input_unavailable");
+						const raw = await host.fs.readText(changed, exec.signal);
+						const after = await host.fs.stat(changed, exec.signal);
+						if (!after || after.type !== "file" || before.version !== after.version) return missing("assessment_input_raced");
+						inputSha256 = createHash("sha256").update(raw, "utf8").digest("hex");
+					} catch {
+						return missing("assessment_input_unavailable");
+					}
+				}
+			}
+			try {
+				if (/^[A-Za-z]:/.test(scope) && (!/^[A-Za-z]:\\/.test(scope) || scope.includes("/"))) return missing("readiness_scope_unavailable");
+				const manifestPath = /^[A-Za-z]:\\/.test(scope) ? win32.join(scope, "package.json") : posix.join(scope, "package.json");
+				const target = await host.fs.resolve(manifestPath, { signal: exec.signal });
+				const before = await host.fs.stat(target, exec.signal);
+				if (!before || before.type !== "file" || before.size !== void 0 && before.size > 2e6) return missing("readiness_manifest_unavailable");
+				const raw = await host.fs.readText(target, exec.signal);
+				const after = await host.fs.stat(target, exec.signal);
+				if (!after || after.type !== "file" || before.version !== after.version) return missing("readiness_manifest_raced");
+				const manifest = record(JSON.parse(raw));
+				if (typeof record(manifest?.scripts)?.[scriptName] !== "string" || !String(record(manifest?.scripts)?.[scriptName]).trim()) return missing("readiness_script_missing");
+				if (assessment && !selectedPath) {
+					selectedPath = target.displayPath;
+					inputSha256 = createHash("sha256").update(raw, "utf8").digest("hex");
+				}
+				return {
+					status: "ready",
+					reason_code: assessment ? "assessment_inputs_ready" : "package_test_script_ready",
+					item_id: args.item_id,
+					scope,
+					manifest_sha256: createHash("sha256").update(raw, "utf8").digest("hex"),
+					predicate: assessment ? "verification_passed" : "test_passed",
+					script_name: scriptName,
+					selected_path: selectedPath,
+					effect_call_id: effectCallId,
+					input_sha256: inputSha256
+				};
+			} catch {
+				return missing("readiness_manifest_unavailable");
+			}
+		}
+	});
+}
+
 //#endregion
 //#region src/tools/external-operation.ts
 function createExternalOperationTool(read, capability) {
@@ -3525,14 +4226,17 @@ const PRESERVED_DIGEST_DOMAINS = [
 	"ccg.proofManifest.v1"
 ];
 function migrationReport(projection) {
-	const v5 = projection.boundaryProtocol === 5;
+	const v6 = projection.boundaryProtocol === 6;
+	const v5 = projection.boundaryProtocol !== void 0 && projection.boundaryProtocol >= 5;
 	const legacyItemIds = certifiableOpenItems(projection).filter((item) => item.unitId === void 0).map((item) => item.id);
 	const closure = v5 ? certificateClosure(projection) : { itemIds: [] };
 	const reasonCodes = [];
 	if (!v5) reasonCodes.push("legacy_session_keeps_v4_contract");
 	if (v5 && legacyItemIds.length > 0) reasonCodes.push("pre_v5_obligations_retained_in_closure");
+	if (v6) reasonCodes.push("v6_ordinary_host_facts_and_legacy_review");
+	if (v6 && projection.coreV2Reason) reasonCodes.push(`core_v2_${projection.coreV2Reason}`);
 	return {
-		ruleMode: v5 ? "v5" : "legacy-v4",
+		ruleMode: v6 ? "v6" : v5 ? "v5" : "legacy-v4",
 		certificateVersion: v5 ? CERTIFICATE_VERSION_V2 : CERTIFICATE_VERSION,
 		stopProtocolVersion: v5 ? STOP_PROTOCOL_VERSION_V2 : STOP_PROTOCOL_VERSION,
 		unitClosure: v5,
@@ -3542,7 +4246,7 @@ function migrationReport(projection) {
 		preservedDigestDomains: [...PRESERVED_DIGEST_DOMAINS],
 		historyOnlyCertificateVersions: v5 ? [CERTIFICATE_VERSION] : [],
 		rollbackRequiresStateSnapshot: v5,
-		rollbackInstruction: v5 ? "Restore the 0.5.x state snapshot before starting the older binary. Replaying a v5 log with 0.5.x fails closed with certificate_replay_mismatch; never migrate new-schema data down by hand." : "No rollback action is required for this session: it has not written a v5 boundary.",
+		rollbackInstruction: v6 ? "Restore a pre-v6 state snapshot before running 0.6.x. The v6 boundary, native-observation digest and migration review must not be read as v5 current authority or downgraded by hand." : v5 ? "Restore the 0.5.x state snapshot before starting the older binary. Replaying a v5 log with 0.5.x fails closed with certificate_replay_mismatch; never migrate new-schema data down by hand." : "No rollback action is required for this session: it has not written a v5 boundary.",
 		reasonCodes
 	};
 }
@@ -3636,17 +4340,23 @@ function releaseResponse(projection, rawInput) {
 		operations: releaseCoverage(contract),
 		expires_at_epoch_ms: contract.expiresAtEpochMs ?? null,
 		consumed_operations: projection.releaseSettlements.filter((settlement) => settlement.contractId === contract.contractId && settlement.outcome === "settled").map((settlement) => settlement.operation),
-		in_flight: projection.releaseReservations.filter((reservation) => reservation.contractId === contract.contractId && !projection.releaseSettlements.some((settlement) => settlement.callId === reservation.callId && (settlement.outcome === "settled" || settlement.outcome === "not_effected"))).map(({ operation, callId, startedAtSeq }) => ({
+		in_flight: projection.releaseReservations.filter((reservation) => reservation.contractId === contract.contractId && !projection.releaseSettlements.some((settlement) => settlement.callId === reservation.callId && (settlement.outcome === "settled" || settlement.outcome === "not_effected"))).map(({ operation, callId, startedAtSeq, ledgerPosition }) => ({
 			operation,
 			call_id: callId,
-			started_at_seq: startedAtSeq
+			...ledgerPosition === void 0 ? { started_at_seq: startedAtSeq } : { record_position: {
+				channel: "private_ledger",
+				position: ledgerPosition
+			} }
 		})),
-		settlements: projection.releaseSettlements.filter((settlement) => settlement.contractId === contract.contractId).map(({ operation, callId, outcome, readback: readback$1, settledAtSeq }) => ({
+		settlements: projection.releaseSettlements.filter((settlement) => settlement.contractId === contract.contractId).map(({ operation, callId, outcome, readback: readback$1, settledAtSeq, ledgerPosition }) => ({
 			operation,
 			call_id: callId,
 			outcome,
 			readback: readback$1,
-			settled_at_seq: settledAtSeq
+			...ledgerPosition === void 0 ? { settled_at_seq: settledAtSeq } : { record_position: {
+				channel: "private_ledger",
+				position: ledgerPosition
+			} }
 		}))
 	}));
 	return {
@@ -4628,10 +5338,385 @@ function resolveConfig(config) {
 	};
 }
 
+//#endregion
+//#region src/domain/private-ledger.ts
+const normalizeContext = (value) => typeof value === "string" ? {
+	sessionId: value,
+	sessionHeader: { id: value },
+	cwd: "/",
+	hostLockDigest: "test-seam"
+} : value;
+const canonical = (value) => {
+	if (value === null || typeof value === "boolean" || typeof value === "string") return JSON.stringify(value);
+	if (typeof value === "number") {
+		if (!Number.isFinite(value) || Object.is(value, -0)) throw new TypeError("private_ledger_non_json_number");
+		return JSON.stringify(value);
+	}
+	if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
+	throw new TypeError("private_ledger_non_json_value");
+};
+const digestRecord = (record$2) => sha256(canonical(record$2));
+const sessionDigest = (sessionId) => sha256(`dsh-completion-guard/private-ledger/v1\0${sessionId}`);
+const contextDigest = (context, root) => sha256(canonical({
+	session_sha256: sessionDigest(context.sessionId),
+	session_header: context.sessionHeader,
+	cwd_sha256: sha256(context.cwd),
+	host_lock_sha256: context.hostLockDigest,
+	ledger_root_sha256: sha256(realpathSync(root))
+}));
+const ledgerPath = (root, context) => join(root, `${sessionDigest(context.sessionId)}.jsonl`);
+const anchorPath = (root) => join(root, "session-anchors.v1.jsonl");
+const rootLockPath = (root) => join(root, ".writer.lock");
+const privateLedgerContractDigest = (contract) => {
+	if (!contract || typeof contract !== "object" || Array.isArray(contract)) return sha256(canonical(contract));
+	const { revokedAtSeq: _mutableRevocation,...immutable } = contract;
+	return sha256(canonical(immutable));
+};
+const privateLedgerTargetDigest = (target) => sha256(canonical(target));
+/** Mirrors the audited dsh-home-paths precedence without importing another host package. */
+function resolvePrivateLedgerRoot(configured, envHome, osHome) {
+	const selected = configured ?? (envHome?.trim() ? envHome : join(osHome, ".dsh"));
+	if (!selected || !osHome) return void 0;
+	return join(resolve(selected === "~" ? osHome : selected.startsWith("~/") || selected.startsWith("~\\") ? join(osHome, selected.slice(2)) : selected), "completion-guard", "private-ledger-v1");
+}
+function ensureRoot(root) {
+	if (resolve(root) !== root) throw new Error("private_ledger_root_not_normalized");
+	mkdirSync(root, {
+		recursive: true,
+		mode: 448
+	});
+	const stat = lstatSync(root);
+	if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("private_ledger_root_unsafe");
+}
+function openRegular(path, flags, mode = 384) {
+	const fd = openSync(path, flags | (process.platform === "win32" ? 0 : constants.O_NOFOLLOW), mode);
+	const stat = fstatSync(fd);
+	if (!stat.isFile()) {
+		closeSync(fd);
+		throw new Error("private_ledger_file_unsafe");
+	}
+	if (process.platform !== "win32" && (stat.mode & 63) !== 0) fchmodSync(fd, 384);
+	return fd;
+}
+function writeAll(fd, text) {
+	const bytes = Buffer.from(text);
+	let offset = 0;
+	while (offset < bytes.length) {
+		const written = writeSync(fd, bytes, offset, bytes.length - offset);
+		if (written <= 0) throw new Error("private_ledger_partial_write");
+		offset += written;
+	}
+}
+function syncDirectory(root) {
+	if (process.platform === "win32") return;
+	const fd = openSync(root, constants.O_RDONLY);
+	try {
+		fsyncSync(fd);
+	} finally {
+		closeSync(fd);
+	}
+}
+function readAnchors(root) {
+	const path = anchorPath(root);
+	if (!existsSync(path)) return /* @__PURE__ */ new Map();
+	const fd = openRegular(path, constants.O_RDONLY);
+	let raw;
+	try {
+		raw = readFileSync(fd, "utf8");
+	} finally {
+		closeSync(fd);
+	}
+	if (raw && !raw.endsWith("\n")) throw new Error("private_ledger_anchor_truncated");
+	const anchors = /* @__PURE__ */ new Map();
+	for (const line of raw.split("\n").filter(Boolean)) {
+		const value = JSON.parse(line);
+		const unsigned = {
+			version: 1,
+			session_sha256: value.session_sha256,
+			context_sha256: value.context_sha256
+		};
+		if (value.version !== 1 || typeof value.session_sha256 !== "string" || typeof value.context_sha256 !== "string" || value.anchor_sha256 !== sha256(canonical(unsigned))) throw new Error("private_ledger_anchor_invalid");
+		const existing = anchors.get(value.session_sha256);
+		if (existing && existing !== value.context_sha256) throw new Error("private_ledger_anchor_conflict");
+		anchors.set(value.session_sha256, value.context_sha256);
+	}
+	return anchors;
+}
+function readPrivateLedger(root, input) {
+	if (!root) return {
+		records: [],
+		damaged: true,
+		anchored: false
+	};
+	try {
+		const context = normalizeContext(input);
+		if (!existsSync(root)) return {
+			records: [],
+			damaged: false,
+			anchored: false
+		};
+		const rootStat = lstatSync(root);
+		if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) return {
+			records: [],
+			damaged: true,
+			anchored: false
+		};
+		const session = sessionDigest(context.sessionId);
+		const expectedContext = contextDigest(context, root);
+		const anchored = readAnchors(root).get(session);
+		if (anchored !== void 0 && anchored !== expectedContext) return {
+			records: [],
+			damaged: true,
+			anchored: true
+		};
+		const path = ledgerPath(root, context);
+		if (!existsSync(path)) return {
+			records: [],
+			damaged: anchored !== void 0,
+			anchored: anchored !== void 0
+		};
+		if (anchored === void 0) return {
+			records: [],
+			damaged: true,
+			anchored: false
+		};
+		const fd = openRegular(path, constants.O_RDONLY);
+		let raw;
+		try {
+			raw = readFileSync(fd, "utf8");
+		} finally {
+			closeSync(fd);
+		}
+		if (raw && !raw.endsWith("\n")) return {
+			records: [],
+			damaged: true,
+			anchored: true
+		};
+		const records = [];
+		let prior = null;
+		for (const [index, line] of raw.split("\n").filter(Boolean).entries()) {
+			const value = JSON.parse(line);
+			const { record_sha256,...unsigned } = value;
+			if (value.version !== 1 || value.session_sha256 !== session || value.context_sha256 !== expectedContext || value.position !== index + 1 || value.prior_sha256 !== prior || ![
+				"release_reservation",
+				"release_settlement",
+				"restart_intent"
+			].includes(value.kind) || !value.payload || typeof value.payload !== "object" || Array.isArray(value.payload) || record_sha256 !== digestRecord(unsigned)) return {
+				records: [],
+				damaged: true,
+				anchored: true
+			};
+			records.push(value);
+			prior = record_sha256;
+		}
+		return {
+			records,
+			damaged: false,
+			anchored: true
+		};
+	} catch {
+		return {
+			records: [],
+			damaged: true,
+			anchored: false
+		};
+	}
+}
+/** Establish the provider-invisible anchor when a live runtime observes a new adoption. */
+function initializePrivateLedger(root, input) {
+	if (!root) return false;
+	let lockFd;
+	try {
+		const context = normalizeContext(input);
+		ensureRoot(root);
+		lockFd = openRegular(rootLockPath(root), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL);
+		const session = sessionDigest(context.sessionId);
+		const expectedContext = contextDigest(context, root);
+		const anchored = readAnchors(root).get(session);
+		if (anchored !== void 0) return anchored === expectedContext;
+		const unsignedAnchor = {
+			version: 1,
+			session_sha256: session,
+			context_sha256: expectedContext
+		};
+		const fd = openRegular(anchorPath(root), constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND);
+		try {
+			writeAll(fd, `${canonical({
+				...unsignedAnchor,
+				anchor_sha256: sha256(canonical(unsignedAnchor))
+			})}\n`);
+			fsyncSync(fd);
+		} finally {
+			closeSync(fd);
+		}
+		const ledgerFd = openRegular(ledgerPath(root, context), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL);
+		try {
+			fsyncSync(ledgerFd);
+		} finally {
+			closeSync(ledgerFd);
+		}
+		syncDirectory(root);
+		return true;
+	} catch {
+		return false;
+	} finally {
+		if (lockFd !== void 0) {
+			try {
+				closeSync(lockFd);
+			} catch {}
+			try {
+				unlinkSync(rootLockPath(root));
+			} catch {}
+		}
+	}
+}
+function appendPrivateLedger(root, input, kind, payload) {
+	if (!root) return false;
+	let lockFd;
+	try {
+		const context = normalizeContext(input);
+		ensureRoot(root);
+		lockFd = openRegular(rootLockPath(root), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL);
+		const session = sessionDigest(context.sessionId);
+		const expectedContext = contextDigest(context, root);
+		const anchored = readAnchors(root).get(session);
+		if (anchored !== void 0 && anchored !== expectedContext) return false;
+		const snapshot = anchored === void 0 ? {
+			records: [],
+			damaged: false
+		} : readPrivateLedger(root, context);
+		if (snapshot.damaged) return false;
+		if (anchored === void 0) {
+			const unsignedAnchor = {
+				version: 1,
+				session_sha256: session,
+				context_sha256: expectedContext
+			};
+			const fd$1 = openRegular(anchorPath(root), constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND);
+			try {
+				writeAll(fd$1, `${canonical({
+					...unsignedAnchor,
+					anchor_sha256: sha256(canonical(unsignedAnchor))
+				})}\n`);
+				fsyncSync(fd$1);
+			} finally {
+				closeSync(fd$1);
+			}
+			syncDirectory(root);
+		}
+		if (kind === "release_settlement") {
+			const settlement = normalizeSettlement(payload);
+			const reservation = settlement && [...snapshot.records].reverse().find((record$3) => record$3.kind === "release_reservation" && record$3.payload.contractId === settlement.contractId && record$3.payload.operation === settlement.operation && record$3.payload.callId === settlement.callId);
+			if (!reservation) return false;
+			payload = {
+				...payload,
+				reservation_sha256: reservation.record_sha256,
+				contract_sha256: reservation.payload.contract_sha256,
+				target_sha256: reservation.payload.target_sha256
+			};
+		}
+		const unsigned = {
+			version: 1,
+			session_sha256: session,
+			context_sha256: expectedContext,
+			position: snapshot.records.length + 1,
+			prior_sha256: snapshot.records.at(-1)?.record_sha256 ?? null,
+			kind,
+			payload
+		};
+		const record$2 = {
+			...unsigned,
+			record_sha256: digestRecord(unsigned)
+		};
+		const fd = openRegular(ledgerPath(root, context), constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND);
+		try {
+			writeAll(fd, `${canonical(record$2)}\n`);
+			fsyncSync(fd);
+		} finally {
+			closeSync(fd);
+		}
+		syncDirectory(root);
+		return true;
+	} catch {
+		return false;
+	} finally {
+		if (lockFd !== void 0) {
+			try {
+				closeSync(lockFd);
+			} catch {}
+			try {
+				unlinkSync(rootLockPath(root));
+			} catch {}
+		}
+	}
+}
+function applyPrivateLedger(projection, snapshot) {
+	if (snapshot.damaged || projection.releaseContracts.length > 0 && snapshot.anchored === false) {
+		projection.releaseStateDamaged = true;
+		if (!projection.releaseDiagnostics.some((row) => row.reasonCode === "private_ledger_damaged")) projection.releaseDiagnostics.push({
+			seq: 0,
+			reasonCode: "private_ledger_damaged"
+		});
+		return;
+	}
+	const reservations = /* @__PURE__ */ new Map();
+	for (const record$2 of snapshot.records) if (record$2.kind === "release_reservation") {
+		const normalized = normalizeReservation(record$2.payload);
+		const contract = normalized && projection.releaseContracts.find((entry) => entry.contractId === normalized.contractId);
+		if (!normalized || !contract || record$2.payload.contract_sha256 !== privateLedgerContractDigest(contract) || typeof record$2.payload.target_sha256 !== "string") {
+			projection.releaseStateDamaged = true;
+			continue;
+		}
+		const key = `${normalized.contractId}\0${normalized.operation}\0${normalized.callId}`;
+		if (reservations.has(key)) {
+			projection.releaseStateDamaged = true;
+			continue;
+		}
+		reservations.set(key, record$2);
+		const existing = projection.releaseReservations.find((entry) => entry.callId === normalized.callId);
+		if (existing && (existing.contractId !== normalized.contractId || existing.operation !== normalized.operation)) {
+			projection.releaseStateDamaged = true;
+			continue;
+		}
+		if (!existing) projection.releaseReservations.push({
+			...normalized,
+			startedAtSeq: 0,
+			ledgerPosition: record$2.position
+		});
+	} else if (record$2.kind === "release_settlement") {
+		const normalized = normalizeSettlement(record$2.payload);
+		const key = normalized && `${normalized.contractId}\0${normalized.operation}\0${normalized.callId}`;
+		const reservationRecord = key ? reservations.get(key) : void 0;
+		const contract = normalized && projection.releaseContracts.find((entry) => entry.contractId === normalized.contractId);
+		const source = record$2.payload.settlement_source;
+		const readbackVerdict = normalized && contract ? readbackSettlesContract(contract, normalized.readback, reservationRecord ? normalizeReservation(reservationRecord.payload)?.observedArtifactSri : void 0) : void 0;
+		if (!normalized || !reservationRecord || !contract || source !== "effect" && source !== "reconcile" || normalized.outcome === "not_effected" && source !== "effect" || source === "reconcile" && normalized.readback === "unavailable" || record$2.payload.reservation_sha256 !== reservationRecord.record_sha256 || record$2.payload.contract_sha256 !== reservationRecord.payload.contract_sha256 || record$2.payload.target_sha256 !== reservationRecord.payload.target_sha256 || normalized.outcome === "settled" && readbackVerdict !== "settled" || source === "reconcile" && readbackVerdict === "mismatch") {
+			projection.releaseStateDamaged = true;
+			continue;
+		}
+		const pinned = {
+			...normalized,
+			settledAtSeq: 0,
+			ledgerPosition: record$2.position
+		};
+		const index = projection.releaseSettlements.findIndex((entry) => entry.contractId === pinned.contractId && entry.operation === pinned.operation && entry.callId === pinned.callId);
+		if (index < 0) projection.releaseSettlements.push(pinned);
+		else if (OUTCOME_STRENGTH[pinned.outcome] >= OUTCOME_STRENGTH[projection.releaseSettlements[index].outcome]) projection.releaseSettlements[index] = pinned;
+	}
+}
+function hasPrivateRestartIntent(snapshot, resolutionCallId, serviceId, preGeneration) {
+	return !snapshot.damaged && snapshot.records.some((record$2) => record$2.kind === "restart_intent" && record$2.payload.resolution_call_id === resolutionCallId && record$2.payload.service_id === serviceId && record$2.payload.pre_generation === preGeneration);
+}
+
 //#endregion
 //#region src/runtime.ts
 const name = "context-guard";
-const inject = ["sessions", "commands"];
+const inject = [
+	"sessions",
+	"commands",
+	"fs"
+];
 /**
 * Bind an explicit mutation to one live root-owned contract item. Resolution
 * evidence is intentionally not authority: every effect rechecks the current
@@ -4884,13 +5969,13 @@ async function handleGuardTurnStopping(agent, runtime, access$1) {
 		}
 		return "root_pause_routed";
 	}
-	const decision = decideTurnBoundary(runtime.projection);
+	const decision = decideTurnBoundary(runtime.projection, rootInstruction?.text);
 	if (decision.noProgressClaim) {
-		const record$1 = `${NO_PROGRESS_RECORD_PREFIX}${JSON.stringify(decision.noProgressClaim)}`;
+		const record$2 = `${NO_PROGRESS_RECORD_PREFIX}${JSON.stringify(decision.noProgressClaim)}`;
 		agent.session.append("user/message", createUserMessage({
 			content: [{
 				type: "text",
-				text: record$1
+				text: record$2
 			}],
 			source: {
 				kind: "plugin",
@@ -5013,7 +6098,7 @@ function sessionHeaderForDigest(session) {
 		delegationDepth: typeof raw.delegationDepth === "number" ? raw.delegationDepth : 0
 	};
 }
-function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalState, refreshHostLock) {
+function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalState, refreshHostLock, readPrivateRecords, initializePrivateRecords) {
 	const projection = createProjection();
 	const session = agent.session;
 	let pendingRecovery = false;
@@ -5024,11 +6109,14 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 	let observedContractRevision = -1;
 	let protocolV4Present = false;
 	let protocolV5Present = false;
+	let protocolV6Present = false;
 	let realRootInputSeen = false;
 	let lifecycle = "armed";
+	let synchronizedOnce = false;
 	const continuationAttempts = projection.continuationAttempts;
 	const persistenceCorrectionAttempts = projection.persistenceCorrectionAttempts;
 	const rebuild = () => {
+		const previousReleaseContracts = projection.releaseContracts.length;
 		if (refreshHostLock) hostLock = refreshHostLock();
 		const header = session.header;
 		const priorRecoveryDigest = projection.lastRecoveryDigest;
@@ -5050,6 +6138,18 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 			sessionHeader
 		}, durabilityConfirmed, hostLock);
 		Object.assign(projection, derived.projection);
+		if (readPrivateRecords) {
+			let privateSnapshot = readPrivateRecords();
+			if (!synchronizedOnce && events.length === 0 && !privateSnapshot.damaged && !privateSnapshot.anchored && initializePrivateRecords?.()) privateSnapshot = readPrivateRecords();
+			if (projection.releaseContracts.length > 0 && !privateSnapshot.damaged && !privateSnapshot.anchored) if (synchronizedOnce && previousReleaseContracts === 0 && initializePrivateRecords?.()) privateSnapshot = readPrivateRecords();
+			else privateSnapshot = {
+				records: [],
+				damaged: true,
+				anchored: false
+			};
+			applyPrivateLedger(projection, privateSnapshot);
+		}
+		synchronizedOnce = true;
 		if (!sessionHeader) {
 			projection.integrity = "unknown";
 			if (!projection.integrityViolations.includes("session_ref_unavailable")) projection.integrityViolations.push("session_ref_unavailable");
@@ -5068,8 +6168,19 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 		projection.persistenceCorrectionAttempts = persistenceCorrectionAttempts;
 		projection.lastRecoveryDigest = priorRecoveryDigest;
 		projection.durabilityWatermark = durabilityWatermark;
+		if (projection.boundaryProtocol === 6 && durabilityWatermark === "confirmed") try {
+			const displayOrigins = /* @__PURE__ */ new Map();
+			projection.coreV2 = projectSessionCoreV2(session.snapshotEvents(), projection, displayOrigins);
+			projection.coreV2RequirementOrigins = projection.coreV2 ? displayOrigins : void 0;
+			projection.coreV2Reason = projection.coreV2 ? void 0 : "source_not_projectable";
+		} catch {
+			projection.coreV2 = void 0;
+			projection.coreV2RequirementOrigins = void 0;
+			projection.coreV2Reason = "projection_failed";
+		}
 		protocolV4Present = derived.protocolV4Present;
 		protocolV5Present = derived.boundaryV5;
+		protocolV6Present = derived.boundaryV6;
 		realRootInputSeen = derived.realRootInputSeen;
 		lifecycle = lifecyclePhase({
 			enabled: projection.enabled,
@@ -5120,6 +6231,9 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 		get protocolV5Present() {
 			return protocolV5Present;
 		},
+		get protocolV6Present() {
+			return protocolV6Present;
+		},
 		sync,
 		setEnabled,
 		setDurability,
@@ -5161,7 +6275,12 @@ function revalidateCoreLock(config, expected) {
 			goalAvailable: false,
 			reasonCode: "host_lock_installed_graph_drift"
 		};
-		return actual;
+		const audited = auditedForegroundRenderers(config.hostLockRuntimeRoot, config.hostLockProfileRoot);
+		return audited.length ? {
+			...actual,
+			auditedForegroundRenderers: audited,
+			digest: createHash("sha256").update(`dsh.core-host-renderer/v1\0${actual.digest}\0${audited.join(",")}`).digest("hex")
+		} : actual;
 	} catch {
 		return {
 			...expected,
@@ -5171,6 +6290,41 @@ function revalidateCoreLock(config, expected) {
 		};
 	}
 }
+/** Observe one actual Host dispatch through Cordis without joining its gate. */
+function registerPassiveHostWorkdirObserver(agent, hostLockAtCall, attestedRouteAtCall, sourcedRootAtCall) {
+	if (typeof agent.ctx.on !== "function") return;
+	const pending = /* @__PURE__ */ new WeakMap();
+	agent.ctx.on("tools/pre-execute", async (exec, next) => {
+		if (exec.agent === agent && (exec.name === "bash" || exec.name === "pwsh")) try {
+			const policy = agent.ctx.get("sandboxPolicy");
+			const receipt = captureHostWorkdir(agent.session, exec, hostLockAtCall(), policy, await attestedRouteAtCall(exec.name, agent.ctx.get("shell"), policy), sourcedRootAtCall?.(exec) ?? null);
+			if (receipt) pending.set(exec, receipt);
+		} catch {}
+		return next();
+	});
+	agent.ctx.on("tools/post-execute", async (exec, _result, next) => {
+		const decision = await next();
+		const receipt = pending.get(exec);
+		pending.delete(exec);
+		if (!receipt || exec.agent !== agent) return decision;
+		const context = createUserMessage({
+			content: [{
+				type: "text",
+				text: `${HOST_WORKDIR_PREFIX}${JSON.stringify(receipt)}`
+			}],
+			source: {
+				kind: "plugin",
+				plugin: "context-guard",
+				form: "notice",
+				summary: "read-only Host workdir observation"
+			}
+		});
+		return {
+			...decision,
+			additionalContexts: [...decision.additionalContexts ?? [], context]
+		};
+	});
+}
 function apply(ctx, rawConfig = {}, seams = {}) {
 	const config = resolveConfig(rawConfig);
 	const installedHostLock = seams.hostLock ?? evaluateHostLock(config.hostLockPackages ?? [], {
@@ -5178,7 +6332,14 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 		profileKind: config.hostLockProfile
 	});
 	const runtimes = /* @__PURE__ */ new Map();
+	const privateLedgerRoot = seams.privateLedgerRoot ?? resolvePrivateLedgerRoot(void 0, process.env.DSH_HOME, homedir());
 	const hostLocks = /* @__PURE__ */ new Map();
+	const ledgerContext = (agent, fallback = installedHostLock) => ({
+		sessionId: String(agent.session.id),
+		sessionHeader: structuredClone(agent.session.header),
+		cwd: sessionCwd(agent.session) ?? "",
+		hostLockDigest: (hostLocks.get(agent) ?? fallback).digest
+	});
 	const registeredAgents = /* @__PURE__ */ new WeakSet();
 	const ensure = (agent) => {
 		let runtime = runtimes.get(agent);
@@ -5190,7 +6351,7 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 				return current;
 			};
 			const agentHostLock = refreshHostLock();
-			runtime = createRuntime(agent, config, agentHostLock, goals ? () => goals.get(agent) : void 0, refreshHostLock);
+			runtime = createRuntime(agent, config, agentHostLock, goals ? () => goals.get(agent) : void 0, refreshHostLock, privateLedgerRoot ? () => readPrivateLedger(privateLedgerRoot, ledgerContext(agent, agentHostLock)) : void 0, privateLedgerRoot ? () => initializePrivateLedger(privateLedgerRoot, ledgerContext(agent, agentHostLock)) : void 0);
 			runtimes.set(agent, runtime);
 			hostLocks.set(agent, agentHostLock);
 		}
@@ -5206,6 +6367,10 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 		}
 		if (registeredAgents.has(agent)) return;
 		registeredAgents.add(agent);
+		registerPassiveHostWorkdirObserver(agent, () => seams.hostLock ?? revalidateCoreLock(config, installedHostLock), (tool, provider, policy) => config.hostLockRuntimeRoot && config.hostLockProfileRoot ? auditedDefaultWorkdirProvider(config.hostLockRuntimeRoot, config.hostLockProfileRoot, tool, provider, policy) : false, (exec) => {
+			runtime.sync();
+			return sourcedNamedTestRoot(runtime.projection, agent.session, exec.arguments);
+		});
 		agent.ctx.tools.register(createRebindTool(() => runtime.projection, async () => {
 			const durable = await ctx.sessions.flush(agent.session);
 			runtime.setDurability(durable);
@@ -5224,33 +6389,11 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 			runtime.sync();
 			return durable;
 		}, () => runtime.markRecoveryNeeded()));
-		/**
-		* Persist one C10 release record through the plugin-notice channel and make
-		* it durable before returning. A record that cannot be flushed is reported
-		* as a failure: an unflushed reservation is not an in-flight operation, and
-		* an unflushed settlement would let a consumed ticket look unused.
-		*/
-		const persistReleaseRecord = async (toolAgent, prefix, payload) => {
-			const target = toolAgent.session;
-			target.append.bind(target)("user/message", createUserMessage({
-				content: [{
-					type: "text",
-					text: `${prefix}${JSON.stringify(payload)}`
-				}],
-				source: {
-					kind: "plugin",
-					plugin: "context-guard",
-					form: "notice",
-					summary: boundContextSummary("recording an explicit release record")
-				}
-			}), { surfaceOp: "append" });
-			let durable = false;
-			try {
-				durable = await ctx.sessions.flush(target);
-			} catch {
-				durable = false;
-			}
-			runtime.setDurability(durable);
+		/** Persist release state outside provider-visible Session history. */
+		const persistReleaseRecord = async (toolAgent, kind, payload) => {
+			if (toolAgent.session !== agent.session) return false;
+			if (!sessionCwd(agent.session)) return false;
+			const durable = appendPrivateLedger(privateLedgerRoot, ledgerContext(agent), kind, payload);
 			runtime.sync();
 			return durable;
 		};
@@ -5271,12 +6414,13 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 				return authorizeMutationFromProjection(runtime.projection, request);
 			},
 			marketOrigin: optionalMarketOrigin(ctx, agent),
+			hasRestartIntent: (resolutionCallId, serviceId, preGeneration) => hasPrivateRestartIntent(readPrivateLedger(privateLedgerRoot, ledgerContext(agent)), resolutionCallId, serviceId, preGeneration),
 			releaseGate: async (request) => {
 				runtime.sync();
 				const projection = runtime.projection;
 				if (!(projection.policy === "release" || projection.releaseContracts.length > 0)) return {
-					status: "granted",
-					reasonCode: "release_profile_not_adopted"
+					status: "denied",
+					reasonCode: "release_contract_not_adopted"
 				};
 				const observed = { ...request.observed };
 				const declaredRef = releaseContractFor(projection, request.operation)?.candidate.ref;
@@ -5297,12 +6441,19 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 					status: "denied",
 					reasonCode: decision.reasonCode
 				};
-				return await persistReleaseRecord(agent, RELEASE_RESERVATION_PREFIX, {
+				const grantedContract = projection.releaseContracts.find((entry) => entry.contractId === decision.contractId);
+				if (!grantedContract) return {
+					status: "denied",
+					reasonCode: "release_state_damaged"
+				};
+				return await persistReleaseRecord(agent, "release_reservation", {
 					contractId: decision.contractId,
 					operation: request.operation,
 					callId: request.callId,
 					startedAtSeq: 0,
 					status: "in_flight",
+					contract_sha256: privateLedgerContractDigest(grantedContract),
+					target_sha256: privateLedgerTargetDigest(request.resolvedTarget),
 					...observed.artifactSri !== void 0 ? { observedArtifactSri: observed.artifactSri } : {}
 				}) ? {
 					status: "granted",
@@ -5319,40 +6470,41 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 				const reservation = reservationFor(runtime.projection, contractId, request.callId);
 				let outcome = request.effect === "not_effected" ? "not_effected" : "unknown";
 				if (request.effect === "completed" && contract) outcome = readbackSettlesContract(contract, request.readback, reservation?.observedArtifactSri) === "settled" ? "settled" : "unknown";
-				await persistReleaseRecord(agent, RELEASE_SETTLEMENT_PREFIX, {
+				await persistReleaseRecord(agent, "release_settlement", {
 					contractId,
 					operation: request.operation,
 					callId: request.callId,
 					settledAtSeq: 0,
 					readback: request.readback,
-					outcome
+					outcome,
+					settlement_source: "effect"
 				});
 			},
 			persistRestartIntent: async (toolAgent, intent) => {
-				const session = toolAgent.session;
-				session.append.bind(session)("user/message", createUserMessage({
-					content: [{
-						type: "text",
-						text: `${RESTART_INTENT_PREFIX}${JSON.stringify({
-							resolution_call_id: intent.resolutionCallId,
-							service_id: intent.serviceId,
-							pre_generation: intent.preGeneration
-						})}`
-					}],
-					source: {
-						kind: "plugin",
-						plugin: "context-guard",
-						form: "notice",
-						summary: boundContextSummary("persisting a restart handoff intent")
-					}
-				}), { surfaceOp: "append" });
-				const durable = await ctx.sessions.flush(session);
-				runtime.setDurability(durable);
+				if (toolAgent.session !== agent.session) return false;
+				if (!sessionCwd(agent.session)) return false;
+				const snapshot = readPrivateLedger(privateLedgerRoot, ledgerContext(agent));
+				if (snapshot.damaged || !snapshot.anchored) return false;
+				const durable = appendPrivateLedger(privateLedgerRoot, ledgerContext(agent), "restart_intent", {
+					resolution_call_id: intent.resolutionCallId,
+					service_id: intent.serviceId,
+					pre_generation: intent.preGeneration
+				});
 				runtime.sync();
 				return durable;
 			}
 		};
 		agent.ctx.tools.register(createEvidenceTool(evidenceOptions));
+		agent.ctx.tools.register(createNativeFileObserver({
+			fs: ctx.fs,
+			flush: (session) => ctx.sessions.flush(session)
+		}));
+		agent.ctx.tools.register(createNativeGitObserver({ flush: (session) => ctx.sessions.flush(session) }));
+		agent.ctx.tools.register(createTestReadinessObserver({
+			getProjection: () => runtime.projection,
+			fs: ctx.fs,
+			flush: (session) => ctx.sessions.flush(session)
+		}));
 		agent.ctx.tools.register(createActionTool(evidenceOptions));
 		agent.ctx.tools.register(createPrepareTool({
 			getProjection: () => runtime.projection,
@@ -5384,13 +6536,14 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 			getProjection: () => runtime.projection,
 			fetcher: evidenceOptions.fetcher,
 			...evidenceOptions.allowLoopbackHttpRegistry ? { allowLoopbackHttpRegistry: true } : {},
-			persistSettlement: async (request) => persistReleaseRecord(request.agent, RELEASE_SETTLEMENT_PREFIX, {
+			persistSettlement: async (request) => persistReleaseRecord(request.agent, "release_settlement", {
 				contractId: request.contractId,
 				operation: request.operation,
 				callId: request.callId,
 				settledAtSeq: 0,
 				readback: request.readback,
-				outcome: request.outcome
+				outcome: request.outcome,
+				settlement_source: "reconcile"
 			})
 		}));
 		agent.ctx.tools.register(createExternalOperationTool((id, toolAgent) => readExternalOperation(ctx, toolAgent, id), () => evaluateExternalWaitCapability(hostLocks.get(agent) ?? installedHostLock)));
@@ -5405,11 +6558,13 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 		if (decision.kind !== "enter") return decision;
 		const injected = [];
 		const delegated = isDelegatedSession(agent.session);
-		let boundaryPending = !runtime.protocolV5Present;
+		let boundaryPending = !runtime.protocolV6Present;
 		const firstStep = previewFirstStepInjection({
 			activation: config.activation,
 			enabled: runtime.projection.enabled,
 			boundaryV5Present: runtime.protocolV5Present,
+			boundaryV6Present: runtime.protocolV6Present,
+			targetProtocol: 6,
 			boundaryPresent: runtime.protocolV4Present,
 			delegated,
 			policy: runtime.projection.policy
@@ -5427,7 +6582,7 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 			if (recovery && digest$2 !== runtime.projection.lastRecoveryDigest) {
 				runtime.projection.lastRecoveryDigest = digest$2;
 				if (boundaryPending && !delegated) {
-					injected.push(pluginNoticeMessage(PROTOCOL_V5_NOTICE, "Context Guard recorded a replay version boundary"));
+					injected.push(pluginNoticeMessage(PROTOCOL_V6_NOTICE, "Context Guard recorded a replay version boundary"));
 					boundaryPending = false;
 				}
 				injected.push(createUserMessage({
@@ -5548,12 +6703,12 @@ function optionalGoalService(ctx, agent) {
 }
 function normalizeGoalState(value) {
 	if (!value || typeof value !== "object") return void 0;
-	const record$1 = value;
-	const goal = record$1.goal && typeof record$1.goal === "object" ? record$1.goal : record$1;
+	const record$2 = value;
+	const goal = record$2.goal && typeof record$2.goal === "object" ? record$2.goal : record$2;
 	const id = goal.id;
 	const revision = goal.revision;
 	const phase = goal.phase;
-	const activation = record$1.activation ?? goal.activation;
+	const activation = record$2.activation ?? goal.activation;
 	if (typeof id !== "string" || typeof revision !== "number") return void 0;
 	if (![
 		"active",
@@ -5571,4 +6726,112 @@ function normalizeGoalState(value) {
 }
 
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, BOUNDED_ARTIFACT_TYPES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, CERTIFICATE_VERSION_V2, CLEANUP_CONDITION_RULE, CLEANUP_CONDITION_RULE_COMPACT, CLEANUP_CONDITION_RULE_SHORT, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_DELEGATION_TOOL_NAMES, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DEPENDENCY_FREE_ONLY_CONDITION, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GRANTED_QUALIFICATION, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, LATEST_SUPPORTED_HOST_VERSION, LEGACY_HOST_COHORTS, LEGACY_QUALIFICATION, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_CAPABILITY_MATRIX, PROOF_KINDS, PROOF_KINDS_V2, PROOF_MANIFEST_DOMAIN_V2, PROOF_PROTOCOL_VERSION, PROOF_PROTOCOL_VERSION_V2, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, PROTOCOL_V5_NOTICE, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, STOP_PROTOCOL_VERSION_V2, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, SessionApiError, actionCompatible, actionHasCertificationPath, actionVerbMatches, admissibleForRemoval, apply, applyUpgradeEligibility, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindProofV2ToProjection, bindingSatisfies, boundedArtifactChoiceMatches, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, capabilityConsequence, capabilityFactOf, capabilityRemedyPhrase, captureClause, captureItem, carriesCleanupCondition, certifyCheckpoint, claimedBatchHasRealRootInput, clarifiedSpanOf, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, clauseAsksOwnQuestion, clauseIsGoverned, clauseIsProtected, cleanupConditionFor, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, createProofManifestV2, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, environmentDefaultRepositoryTarget, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, explanationHasActionResidue, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, firstStepGuidance, gitCommandMatchesTarget, goalCompletionDenial, governedClauseRestrictsExecution, hasCurrentCertificate, hasOrderedCoordination, hasQuestionScope, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, introducesActionClause, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isExplanationScope, isFrozenV042RebindResponse, isInformationalFragment, isInformationalMessage, isOpenObligation, isQuestionScopeNeedingReview, isRestatement, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, itemHoldsExecutionAuthority, kindOfScope, latestAssistantText, latestRootInstruction, legacyQuestionReadingIsInformational, legacyRecordsNeedingReview, lifecyclePhase, maskCodeSpans, maskQuotedSpans, name, namedActions, normalizeClause, observeAssistantOutcome, openItems, opensWithDirective, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, partialFailureOf, previewFirstStepInjection, progressFingerprint, proofCapabilityReport, proofDigest, proofDigestV2, proofEvidenceConstraints, proofHostSurfacesOf, proofOperationMatches, proofV2Rejection, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualificationOfClause, qualifyBoundary, questionHeadsClause, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, removalIsComplete, removalIsPartiallyKnown, renderRecoveryPacket, replayRebindResult, reportingHeadGoverns, requestedIdentityKey, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, requiredSubjectsOf, resolveActiveProfileHostLock, resolveInstalledHostLock, restatedContentOf, revalidateGitPrestate, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, scopeCoverageDigest, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sessionQueryV2, sha256, snapshotSessionEvents, splitTextFragments, statefulActionsOfScope, supersedeItem, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, validateProofManifestV2, verbIsNegated, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+//#region src/raw-replay.ts
+/** Local synthetic replay using the actual Session, derivation and registered
+* Stop handler. It neither executes tools nor asserts a real model outcome. */
+async function replayRawV2(input) {
+	const cwd = input.cwd ?? "/work";
+	const id = SessionId("raw-v2-replay");
+	const session = Session.create(id, void 0, {
+		version: SESSION_FORMAT_VERSION,
+		isSeeded: false,
+		id,
+		createdAt: 1,
+		cwd
+	});
+	session.append("user/message", createUserMessage({
+		content: [{
+			type: "text",
+			text: PROTOCOL_V6_NOTICE
+		}],
+		source: {
+			kind: "plugin",
+			plugin: "context-guard",
+			form: "notice",
+			summary: "v6 replay boundary"
+		}
+	}), { surfaceOp: "append" });
+	session.append("turn/start", { turn: 1 });
+	session.append("user/message", createUserMessage({
+		content: [{
+			type: "text",
+			text: input.root
+		}],
+		source: { kind: "user" }
+	}), { surfaceOp: "append" });
+	const appendEvent = session.append.bind(session);
+	for (const event of input.events ?? []) {
+		if (event.type === "turn/end") throw new Error("turn/end is emitted only after the Stop callback in this replay");
+		appendEvent(event.type, event.data, event.type === "tool/call" ? void 0 : { surfaceOp: "append" });
+	}
+	session.append("assistant/message", {
+		turn: 1,
+		step: 1,
+		message: {
+			role: "assistant",
+			content: [{
+				type: "text",
+				text: input.final
+			}]
+		}
+	}, { surfaceOp: "append" });
+	const lock = evaluateHostLock(EXPECTED_HOST_PACKAGES, {
+		platform: "posix",
+		profileKind: "web"
+	});
+	const steers = [];
+	const agent = {
+		session,
+		steer: (message) => {
+			steers.push(message);
+		}
+	};
+	const runtime = createRuntime(agent, { activation: "always" }, lock, () => void 0);
+	runtime.setDurability(true);
+	runtime.sync();
+	const snapshot = sessionCoreSnapshot(session.snapshotEvents(), runtime.projection);
+	const stopCore = runtime.projection.coreV2 ?? null;
+	const stop = await handleGuardTurnStopping(agent, runtime, {
+		flush: async () => true,
+		hostSupported: true,
+		readExternalOperation: () => void 0
+	});
+	session.append("turn/end", {
+		turn: 1,
+		reason: { kind: "completed" }
+	});
+	runtime.sync();
+	const projection = runtime.projection;
+	const postSnapshot = sessionCoreSnapshot(session.snapshotEvents(), projection);
+	return {
+		stop_core_snapshot: snapshot ?? null,
+		stop_core_projection: stopCore,
+		stop,
+		post_turn_core_snapshot: postSnapshot ?? null,
+		post_turn_core_projection: projection.coreV2 ?? null,
+		goal_complete_denial: goalCompletionDenial(projection, "update_goal", {
+			action: "complete",
+			goal_id: projection.currentGoalRef?.id,
+			revision: projection.currentGoalRef?.revision
+		}) ?? null,
+		assistant_observation: observeAssistantOutcome(input.final),
+		steers: steers.length,
+		items: [...projection.items.values()].map((item) => ({
+			id: item.id,
+			status: item.status,
+			action: item.semanticAction,
+			authority: item.authority,
+			disposition: item.authorityDisposition,
+			review: item.needsReview?.reason ?? null
+		})),
+		durable_seq: session.seq,
+		event_types: session.snapshotEvents().map((event) => ({
+			seq: event.seq,
+			type: event.type
+		})),
+		boundary_protocol: projection.boundaryProtocol
+	};
+}
+
+//#endregion
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, ALPHA2_DSHMARKET_139_HOST_PACKAGES, ALPHA2_HOST_PACKAGES, ALPHA3_HOST_PACKAGES, BASE_HOST_PACKAGES, BOUNDED_ARTIFACT_TYPES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, CERTIFICATE_VERSION_V2, CLEANUP_CONDITION_RULE, CLEANUP_CONDITION_RULE_COMPACT, CLEANUP_CONDITION_RULE_SHORT, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_DELEGATION_TOOL_NAMES, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DEPENDENCY_FREE_ONLY_CONDITION, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GRANTED_QUALIFICATION, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, LATEST_SUPPORTED_HOST_VERSION, LEGACY_HOST_COHORTS, LEGACY_QUALIFICATION, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_CAPABILITY_MATRIX, PROOF_KINDS, PROOF_KINDS_V2, PROOF_MANIFEST_DOMAIN_V2, PROOF_PROTOCOL_VERSION, PROOF_PROTOCOL_VERSION_V2, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, PROTOCOL_V5_NOTICE, PROTOCOL_V6_NOTICE, RC015_HOST_PACKAGES, RC015_RC2_HOST_PACKAGES, RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, STOP_PROTOCOL_VERSION_V2, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, SessionApiError, actionCompatible, actionHasCertificationPath, actionVerbMatches, activeRendererModule, admissibleForRemoval, apply, applyUpgradeEligibility, assessmentAction, assessmentOutcomePredicate, auditedDefaultWorkdirHost, auditedDefaultWorkdirProvider, auditedForegroundRenderers, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindProofV2ToProjection, bindingSatisfies, boundedArtifactChoiceMatches, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, capabilityConsequence, capabilityFactOf, capabilityRemedyPhrase, captureClause, captureItem, carriesCleanupCondition, certifyCheckpoint, claimedBatchHasRealRootInput, clarifiedSpanOf, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, clauseAsksOwnQuestion, clauseIsGoverned, clauseIsProtected, cleanupConditionFor, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, createProofManifestV2, currentActionBases, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, environmentDefaultRepositoryTarget, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, explanationHasActionResidue, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, firstStepGuidance, firstStepGuidanceV6, gitCommandMatchesTarget, goalCompletionDenial, governedClauseRestrictsExecution, hasCurrentCertificate, hasOrderedCoordination, hasQuestionScope, hasWorkPredicate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, introducesActionClause, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isExplanationScope, isFrozenV042RebindResponse, isInformationalFragment, isInformationalMessage, isOpenObligation, isQuestionScopeNeedingReview, isRestatement, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, itemHoldsExecutionAuthority, kindOfScope, latestAssistantText, latestRootInstruction, legacyQuestionReadingIsInformational, legacyRecordsNeedingReview, lifecyclePhase, maskCodeSpans, maskQuotedSpans, name, namedActions, normalizeClause, observeAssistantOutcome, openItems, opensConditionLead, opensWithDirective, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, partialFailureOf, persistedToolResultStatus, presentExplanationHead, previewFirstStepInjection, progressFingerprint, projectCoreV2, projectSessionCoreV2, proofCapabilityReport, proofDigest, proofDigestV2, proofEvidenceConstraints, proofHostSurfacesOf, proofOperationMatches, proofV2Rejection, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualificationOfClause, qualifyBoundary, questionHeadsClause, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, relevantEvidence, removalIsComplete, removalIsPartiallyKnown, renderRecoveryPacket, replayRawV2, replayRebindResult, reportingHeadGoverns, requestedIdentityKey, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, requiredSubjectsOf, resolveActiveProfileHostLock, resolveInstalledHostLock, restatedContentOf, revalidateGitPrestate, rootLocatorFlavor, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, scopeCoverageDigest, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sessionQueryV2, sha256, snapshotSessionEvents, splitTextFragments, statefulActionsOfScope, supersedeItem, testOutcomePredicate, v6TestPredicate, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, validateProofManifestV2, verbIsNegated, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };