dsh-completion-guard 0.8.0 → 0.8.2

package/dist/index.js

@@ -1,16 +1,17 @@
-import { $ as PROOF_KINDS, $i as BOUNDED_ARTIFACT_TYPES, $n as capabilityConsequence, $r as statefulActionsOfScope, $t as reservationFor, A as PROTOCOL_V4_NOTICE, Ai as DEFAULT_HOST_LOCK, An as isCurrentAcceptedBoundary, Ar as interpretMessage, At as carriesCleanupCondition, B as extractToolSubject, Bi as evaluateToolSurfaceCapability, Bn as replayRebindResult, Br as legacyQuestionReadingIsInformational, Bt as sourceItemForCoreRequirement, C as SESSION_EVENT_ENVELOPE_INVALID, Ci as resolveActiveProfileHostLock, Cn as hasCurrentCertificate, Cr as clauseIsProtected, Ct as CLEANUP_CONDITION_RULE_COMPACT, D as CAPTURE_V042_NOTICE, Di as ACTIVE_HOST_COHORT_IDS, Dn as BOUNDARY_RECORD_PREFIX, Dr as hasQuestionScope, Dt as V6_ORDINARY_COMPLETION_RULE, E as projectCoreV2, Ei as ACTIVE_HOST_COHORT_ID, En as unitDescendantIds, Er as hasOrderedCoordination, Et as MIN_RECOVERY_CHAR_BUDGET, F as legacyRecordsNeedingReview, Fi as bindExecutableIdentity, Fn as proposeRebind, Fr as isOpenObligation, Ft as recoveryTitle, G as isRunExecutable, Gi as SUPPORTED_HOST_RANGE, Gn as deriveItemDiagnosis, Gr as opensWithDirective, Gt as inFlightReservation, H as persistedToolResultStatus, Hi as selectHostCohort, Hn as isFrozenV042RebindResponse, Hr as maskQuotedSpans, Ht as RELEASE_OPERATIONS, I as rootLocatorFlavor, Ii as bindLiveGoalCapability, In as proposeRebindOutcome, Ir as isQuestionScopeNeedingReview, It as renderRecoveryPacket, J as authorityCaptureCounts, Ji as evaluateMinimumHostVersion, Jn as nativeFileTwoRole, Jr as questionHeadsClause, Jt as normalizeSettlement, K as parsePwshCommand, Ki as SUPPORTED_HOST_VERSIONS, Kn as evidenceAvailabilityReason, Kr as presentExplanationHead, Kt as normalizeReleaseContract, L as supersedeItem, Li as evaluateExternalWaitCapability, Ln as proposeRebindV042, Lr as isRestatement, Lt as v6CurrentRootBoundaries, M as PROTOCOL_V6_NOTICE, Mi as GOAL_HOST_PACKAGES, Mn as currentContractDigest, Mr as isExecutableItem, Mt as closingHint, N as applyUpgradeEligibility, Ni as HOST_CAPABILITY_PACKAGE_GROUPS, Nn as createProjection, Nr as isExplanationScope, Nt as openItems, O as DEFAULT_DELEGATION_TOOL_NAMES, Oi as ACTIVE_HOST_LAUNCHER_VERSION, On as availableBoundaryQualifications, Or as hasWorkPredicate, Ot as V6_ORDINARY_COMPLETION_RULE_COMPACT, P as deriveProjection, Pi as HOST_COHORTS, Pn as confirmRebind, Pr as isInformationalFragment, Pt as recoveryDigest, Q as PROOF_CAPABILITY_MATRIX, Qi as ACTION_MANIFEST_VERSION, Qn as admissibleForRemoval, Qr as splitTextFragments, Qt as releasePreEffectDecision, R as evidenceFromPersistedToolResult, Ri as evaluateHostCapability, Rn as rebindAttemptKey, Rr as itemHoldsExecutionAuthority, Rt as currentV6Feedback, S as SESSION_API_UNSUPPORTED, Si as readActiveHostGraph, Sn as goalCompletionDenial, Sr as clauseIsGoverned, St as CLEANUP_CONDITION_RULE, T as snapshotSessionEvents, Ti as verifyComposedHostLockDump, Tn as certificateClosure, Tr as governedClauseRestrictsExecution, Tt as DEFAULT_RECOVERY_CHAR_BUDGET, U as withDurability, Ui as LATEST_SUPPORTED_HOST_VERSION, Un as parseConfirmationMessage, Ur as namedActions, Ut as RELEASE_OPERATION_SURFACES, V as isDeterministicCheck, Vi as hostVersionFromPackages, Vn as CONFIRM_LINE_PATTERN, Vr as maskCodeSpans, Vt as OUTCOME_STRENGTH, W as canonicalArgvFromCommand, Wi as MIN_SUPPORTED_HOST_VERSION, Wn as capabilityRemedyPhrase, Wr as opensConditionLead, Wt as contractById, X as bindingIndividuallyAccepted, Xi as satisfiesSupportedHostRange, Xn as DEPENDENCY_FREE_ONLY_CONDITION, Xr as restatedContentOf, Xt as releaseContractFor, Y as segmentAuthorityBlocks, Yi as parseHostVersion, Yn as relevantEvidence, Yr as reportingHeadGoverns, Yt as readbackSettlesContract, Z as certifyCheckpoint, Zi as ACTION_MANIFEST, Zn as actionHasCertificationPath, Zr as semanticActionOfScope, Zt as releaseCoverage, _ as projectSessionCoreV2, _a as RC017_RC2_HOST_PACKAGES, _i as hostLockRowsFromComposedDump, _n as latestRootInstruction, _r as GRANTED_QUALIFICATION, _t as scopeCoverageDigest, a as createGitPrestateEnvelope, aa as STOP_PROTOCOL_VERSION_V2, ai as normalizeClause, an as NO_PROGRESS_RECORD_PREFIX, ar as captureItem, at as bindProofV2ToProjection, b as captureHostWorkdir, bi as packageRowsFromActiveGraph, bn as testOutcomePredicate, br as clarifiedSpanOf, bt as validateProofManifest, c as parseGitCommandManifest, ca as boundedArtifactChoiceMatches, ci as sha256, cn as assessmentOutcomePredicate, cr as extractArtifactPaths, ct as createProofManifestV2, d as FIRST_STEP_GUIDANCE, da as requestedTargetAuthorizesMutation, di as auditedDefaultWorkdirHost, dn as decideTurnBoundary, dr as isInformationalMessage, dt as proofDigestV2, ea as CERTIFICATE_VERSION, ei as verbIsNegated, en as bindingSatisfies, er as capabilityFactOf, et as PROOF_KINDS_V2, f as claimedBatchHasRealRootInput, fa as requestedTargetMatchesResolved, fi as auditedDefaultWorkdirProvider, fn as decideTurnStopping, fr as segmentClauses, ft as proofEvidenceConstraints, g as previewFirstStepInjection, ga as validateActionTarget, gi as hostLockContextFromComposedDump, gn as latestAssistantText, gr as classifyUserInteraction, gt as requiredSubjectsOf, h as lifecyclePhase, ha as validateActionManifest, hi as combineHostPolicy, hn as isWholeTaskCompletionClaim, hr as classifyTaskIntent, ht as proofV2Rejection, i as commitTreeSnapshotDigest, ia as STOP_PROTOCOL_VERSION, ii as digestStrings, in as CONTROL_RECORD_PREFIX, ir as captureClause, it as bindProofToProjection, j as PROTOCOL_V5_NOTICE, ji as EXPECTED_HOST_PACKAGES, jn as qualifyBoundary, jr as introducesActionClause, jt as cleanupConditionFor, k as PROTOCOL_V3_NOTICE, ki as BASE_HOST_PACKAGES, kn as effectuateBoundary, kr as interpretClause, kt as V6_ORDINARY_COMPLETION_RULE_SHORT, l as revalidateGitPrestate, la as isStatefulAction, li as HostProfileError, ln as classifyCompletionClaim, lr as extractMethod, lt as proofCapabilityReport, m as firstStepGuidanceV6, ma as semanticActionFromText, mi as auditedHostImplementation, mn as isRootPauseRequest, mr as npmEscapedPackageName, mt as proofOperationMatches, n as GIT_COMMAND_TEMPLATES, na as SEMANTIC_ACTIONS, ni as validateManifest, nn as evidenceMatchesItem, nr as removalIsComplete, nt as PROOF_PROTOCOL_VERSION, o as executeRevalidatedGitEffect, oa as SUPPORTED_EVIDENCE_ADAPTERS, oi as sanitizeClauseText, on as NO_PROGRESS_TURNS_BEFORE_STOP, or as classifyClause, ot as canonicalProjection, p as firstStepGuidance, pa as semanticActionFromCommand, pi as auditedForegroundRenderers, pn as decisionBoundaryKey, pr as canonicalRegistryBase, pt as proofHostSurfacesOf, q as parseShellCommand, qi as compareHostVersions, qn as itemDiagnosis, qr as qualificationOfClause, qt as normalizeReservation, r as commitIndexSnapshotDigest, ra as STATEFUL_ACTIONS, ri as canonicalizePath, rn as isVerifyingCapability, rr as removalIsPartiallyKnown, rt as PROOF_PROTOCOL_VERSION_V2, s as gitCommandMatchesTarget, sa as actionCompatible, si as sanitizeUrl, sn as assessmentAction, sr as environmentDefaultRepositoryTarget, st as createProofManifest, t as GIT_COMMAND_MANIFEST_IDS, ta as CERTIFICATE_VERSION_V2, ti as COMMAND_SURFACE_MANIFEST, tn as evidenceCoverage, tr as partialFailureOf, tt as PROOF_MANIFEST_DOMAIN_V2, u as verifiedLinearCommitReadback, ua as requestedIdentityKey, ui as activeRendererModule, un as currentActionBases, ur as extractOperation, ut as proofDigest, v as sessionCoreSnapshot, vi as injectActiveProfileHostLock, vn as observeAssistantOutcome, vr as LEGACY_QUALIFICATION, vt as sessionQuery, w as SessionApiError, wi as resolveInstalledHostLock, wn as certifiableOpenItems, wr as explanationHasActionResidue, wt as CLEANUP_CONDITION_RULE_SHORT, x as sourcedNamedTestRoot, xi as packageRowsFromPnpmLock, xn as v6TestPredicate, xr as clauseAsksOwnQuestion, xt as validateProofManifestV2, y as HOST_WORKDIR_PREFIX, yi as inspectTargetHostGraph, yn as progressFingerprint, yr as actionVerbMatches, yt as sessionQueryV2, z as extractTextContent, zi as evaluateHostLock, zn as rebindResponse, zr as kindOfScope, zt as isV6PendingRootWait } from "./domain-D0zTh3O_.js";
+import { $ as PROOF_CAPABILITY_MATRIX, $i as ACTIVE_HOST_COHORT_ID, $n as admissibleForRemoval, $r as splitTextFragments, $t as releasePreEffectDecision, A as PROTOCOL_V3_NOTICE, Aa as CERTIFICATE_VERSION_V2, Ai as resolveActiveProfileHostLock, An as effectuateBoundary, Ar as interpretClause, At as V6_ORDINARY_COMPLETION_RULE_SHORT, B as extractTextContent, Ba as requestedTargetAuthorizesMutation, Bi as readAsarFile, Bn as rebindResponse, Br as kindOfScope, Bt as isV6PendingRootWait, C as SESSION_API_UNSUPPORTED, Ca as evaluateMinimumHostVersion, Ci as inspectTargetHostGraph, Cn as goalCompletionDenial, Cr as clauseIsGoverned, Ct as CLEANUP_CONDITION_RULE, D as projectCoreV2, Da as ACTION_MANIFEST_VERSION, Di as prepareDesktopHostTrust, Dn as unitDescendantIds, Dr as hasOrderedCoordination, Dt as MIN_RECOVERY_CHAR_BUDGET, E as snapshotSessionEvents, Ea as ACTION_MANIFEST, Ei as prepareActiveHostTrust, En as certificateClosure, Er as governedClauseRestrictsExecution, Et as DEFAULT_RECOVERY_CHAR_BUDGET, F as deriveProjection, Fa as SUPPORTED_EVIDENCE_ADAPTERS, Fi as DESKTOP_IDENTITY_FACTS, Fn as confirmRebind, Fr as isInformationalFragment, Ft as recoveryDigest, G as canonicalArgvFromCommand, Ga as validateActionTarget, Gi as writeDesktopRuntimeReceipt, Gn as capabilityRemedyPhrase, Gr as opensConditionLead, Gt as contractById, H as isDeterministicCheck, Ha as semanticActionFromCommand, Hi as readDesktopAppRuntime, Hn as CONFIRM_LINE_PATTERN, Hr as maskCodeSpans, Ht as OUTCOME_STRENGTH, I as legacyRecordsNeedingReview, Ia as actionCompatible, Ii as DESKTOP_PROFILE_PACKAGE_NAME, In as proposeRebind, Ir as isOpenObligation, It as recoveryTitle, J as parseShellCommand, Ji as hostTrustDigest, Jn as itemDiagnosis, Jr as qualificationOfClause, Jt as normalizeReservation, K as isRunExecutable, Ka as RC020_RC2_HOST_PACKAGES, Ki as HostTrustError, Kn as deriveItemDiagnosis, Kr as opensWithDirective, Kt as inFlightReservation, L as rootLocatorFlavor, La as boundedArtifactChoiceMatches, Li as DESKTOP_RUNTIME_PACKAGE_NAME, Ln as proposeRebindOutcome, Lr as isQuestionScopeNeedingReview, Lt as renderRecoveryPacket, M as PROTOCOL_V5_NOTICE, Ma as STATEFUL_ACTIONS, Mi as resolveInstalledHostLock, Mn as qualifyBoundary, Mr as introducesActionClause, Mt as cleanupConditionFor, N as PROTOCOL_V6_NOTICE, Na as STOP_PROTOCOL_VERSION, Ni as revalidateDesktopCoreLock, Nn as currentContractDigest, Nr as isExecutableItem, Nt as closingHint, O as CAPTURE_V042_NOTICE, Oa as BOUNDED_ARTIFACT_TYPES, Oi as prepareTargetHostTrust, On as BOUNDARY_RECORD_PREFIX, Or as hasQuestionScope, Ot as V6_ORDINARY_COMPLETION_RULE, P as applyUpgradeEligibility, Pa as STOP_PROTOCOL_VERSION_V2, Pi as verifyComposedHostLockDump, Pn as createProjection, Pr as isExplanationScope, Pt as openItems, Q as certifyCheckpoint, Qi as registryArchiveModules, Qn as actionHasCertificationPath, Qr as semanticActionOfScope, Qt as releaseCoverage, R as supersedeItem, Ra as isStatefulAction, Ri as auditDesktopInstalledImplementation, Rn as proposeRebindV042, Rr as isRestatement, Rt as v6CurrentRootBoundaries, S as sourcedNamedTestRoot, Sa as compareHostVersions, Si as inspectDesktopTargetGraph, Sn as v6TestPredicate, Sr as clauseAsksOwnQuestion, St as validateProofManifestV2, T as SessionApiError, Ta as satisfiesSupportedHostRange, Ti as packageRowsFromPnpmLock, Tn as certifiableOpenItems, Tr as explanationHasActionResidue, Tt as CLEANUP_CONDITION_RULE_SHORT, U as persistedToolResultStatus, Ua as semanticActionFromText, Ui as readDesktopDependency, Un as isFrozenV042RebindResponse, Ur as maskQuotedSpans, Ut as RELEASE_OPERATIONS, V as extractToolSubject, Va as requestedTargetMatchesResolved, Vi as readAsarIndex, Vn as replayRebindResult, Vr as legacyQuestionReadingIsInformational, Vt as sourceItemForCoreRequirement, W as withDurability, Wa as validateActionManifest, Wi as readDesktopTargetGraph, Wn as parseConfirmationMessage, Wr as namedActions, Wt as RELEASE_OPERATION_SURFACES, X as segmentAuthorityBlocks, Xi as qualifyHostTrust, Xn as relevantEvidence, Xr as reportingHeadGoverns, Xt as readbackSettlesContract, Y as authorityCaptureCounts, Yi as parseHostTrust, Yn as nativeFileTwoRole, Yr as questionHeadsClause, Yt as normalizeSettlement, Z as bindingIndividuallyAccepted, Zi as registryArchiveFiles, Zn as DEPENDENCY_FREE_ONLY_CONDITION, Zr as restatedContentOf, Zt as releaseContractFor, _ as previewFirstStepInjection, _a as HOST_VALIDATED_VERSIONS, _i as evaluateActiveHostLock, _n as latestAssistantText, _r as classifyUserInteraction, _t as requiredSubjectsOf, a as commitTreeSnapshotDigest, aa as GOAL_HOST_PACKAGES, ai as digestStrings, an as CONTROL_RECORD_PREFIX, ar as captureClause, at as bindProofToProjection, b as HOST_WORKDIR_PREFIX, ba as SUPPORTED_HOST_RANGE, bi as hostLockRowsFromComposedDump, bn as progressFingerprint, br as actionVerbMatches, bt as sessionQueryV2, c as gitCommandMatchesTarget, ca as bindExecutableIdentity, ci as sanitizeUrl, cn as assessmentAction, cr as environmentDefaultRepositoryTarget, ct as createProofManifest, d as verifiedLinearCommitReadback, da as evaluateGraphDerivedHostLock, di as activeRendererModule, dn as currentActionBases, dr as extractOperation, dt as proofDigest, ea as ACTIVE_HOST_COHORT_IDS, ei as statefulActionsOfScope, en as reservationFor, er as capabilityConsequence, et as PROOF_KINDS, f as FIRST_STEP_GUIDANCE, fa as evaluateHostCapability, fi as auditedDefaultWorkdirHost, fn as decideTurnBoundary, fr as isInformationalMessage, ft as proofDigestV2, g as lifecyclePhase, ga as selectHostCohort, gi as combineHostPolicy, gn as isWholeTaskCompletionClaim, gr as classifyTaskIntent, gt as proofV2Rejection, h as firstStepGuidanceV6, ha as hostVersionFromPackages, hi as auditedHostImplementation, hn as isRootPauseRequest, hr as npmEscapedPackageName, ht as proofOperationMatches, i as commitIndexSnapshotDigest, ia as EXPECTED_HOST_PACKAGES, ii as canonicalizePath, in as isVerifyingCapability, ir as removalIsPartiallyKnown, it as PROOF_PROTOCOL_VERSION_V2, j as PROTOCOL_V4_NOTICE, ja as SEMANTIC_ACTIONS, ji as resolveDesktopProfileHostLock, jn as isCurrentAcceptedBoundary, jr as interpretMessage, jt as carriesCleanupCondition, k as DEFAULT_DELEGATION_TOOL_NAMES, ka as CERTIFICATE_VERSION, ki as readActiveHostGraph, kn as availableBoundaryQualifications, kr as hasWorkPredicate, kt as V6_ORDINARY_COMPLETION_RULE_COMPACT, l as parseGitCommandManifest, la as bindLiveGoalCapability, li as sha256, ln as assessmentOutcomePredicate, lr as extractArtifactPaths, lt as createProofManifestV2, m as firstStepGuidance, ma as evaluateToolSurfaceCapability, mi as auditedForegroundRenderers, mn as decisionBoundaryKey, mr as canonicalRegistryBase, mt as proofHostSurfacesOf, n as GIT_COMMAND_MANIFEST_IDS, na as BASE_HOST_PACKAGES, ni as COMMAND_SURFACE_MANIFEST, nn as evidenceCoverage, nr as partialFailureOf, nt as PROOF_MANIFEST_DOMAIN_V2, o as createGitPrestateEnvelope, oa as HOST_CAPABILITY_PACKAGE_GROUPS, oi as normalizeClause, on as NO_PROGRESS_RECORD_PREFIX, or as captureItem, ot as bindProofV2ToProjection, p as claimedBatchHasRealRootInput, pa as evaluateHostLock, pi as auditedDefaultWorkdirProvider, pn as decideTurnStopping, pr as segmentClauses, pt as proofEvidenceConstraints, q as parsePwshCommand, qa as createHostAuditSession, qi as acquireHostTrust, qn as evidenceAvailabilityReason, qr as presentExplanationHead, qt as normalizeReleaseContract, r as GIT_COMMAND_TEMPLATES, ra as DEFAULT_HOST_LOCK, ri as validateManifest, rn as evidenceMatchesItem, rr as removalIsComplete, rt as PROOF_PROTOCOL_VERSION, s as executeRevalidatedGitEffect, sa as HOST_COHORTS, si as sanitizeClauseText, sn as NO_PROGRESS_TURNS_BEFORE_STOP, sr as classifyClause, st as canonicalProjection, t as RC020_RC1_HOST_PACKAGES, ta as ACTIVE_HOST_LAUNCHER_VERSION, ti as verbIsNegated, tn as bindingSatisfies, tr as capabilityFactOf, tt as PROOF_KINDS_V2, u as revalidateGitPrestate, ua as evaluateExternalWaitCapability, ui as HostProfileError, un as classifyCompletionClaim, ur as extractMethod, ut as proofCapabilityReport, v as projectSessionCoreV2, va as LATEST_TESTED_HOST_VERSION, vi as evaluateConfiguredHostLock, vn as latestRootInstruction, vr as GRANTED_QUALIFICATION, vt as scopeCoverageDigest, w as SESSION_EVENT_ENVELOPE_INVALID, wa as parseHostVersion, wi as packageRowsFromActiveGraph, wn as hasCurrentCertificate, wr as clauseIsProtected, wt as CLEANUP_CONDITION_RULE_COMPACT, x as captureHostWorkdir, xa as SUPPORTED_HOST_VERSIONS, xi as injectActiveProfileHostLock, xn as testOutcomePredicate, xr as clarifiedSpanOf, xt as validateProofManifest, y as sessionCoreSnapshot, ya as MIN_SUPPORTED_HOST_VERSION, yi as hostLockContextFromComposedDump, yn as observeAssistantOutcome, yr as LEGACY_QUALIFICATION, yt as sessionQuery, z as evidenceFromPersistedToolResult, za as requestedIdentityKey, zi as hasDesktopImporterState, zn as rebindAttemptKey, zr as itemHoldsExecutionAuthority, zt as currentV6Feedback } from "./domain-B-2fya9P.js";
 import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm";
-import { closeSync, constants, existsSync, fchmodSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, unlinkSync, writeSync } from "node:fs";
 import { basename, delimiter, dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { createHash } from "node:crypto";
 import { fileURLToPath } from "node:url";
+import { createHash } from "node:crypto";
+import { closeSync, constants, existsSync, fchmodSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, unlinkSync, writeSync } from "node:fs";
+import { gunzip } from "node:zlib";
+import { execFile } from "node:child_process";
+import { homedir, tmpdir } from "node:os";
 import { JobId } from "@deepseek-ai/dsh-jobs";
 import { defineTool } from "@deepseek-ai/dsh-tools";
-import { homedir, tmpdir } from "node:os";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { promisify } from "node:util";
-import { execFile } from "node:child_process";
 import { access, readFile, realpath } from "node:fs/promises";
-import { gunzip } from "node:zlib";
 import { SESSION_FORMAT_VERSION, Session, SessionId } from "@deepseek-ai/dsh-session";
 
 //#region src/tools/rebind.ts
@@ -410,7 +411,7 @@ function openItemForTool(projection, item) {
 		...template ? { binding_template: template } : {}
 	};
 }
-function createCheckpointTool(getProjection, onRejected, prepare = async () => true) {
+function createCheckpointTool(getProjection, onRejected, prepare = async () => true, revalidate = () => {}) {
 	return defineTool({
 		name: "context_guard_checkpoint",
 		description: "Read current ordinary closure from confirmed observations; request a certificate only for an explicitly adopted proof, Goal, or release contract.",
@@ -836,6 +837,7 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 					order: closure.order
 				})) } : {}
 			}));
+			revalidate();
 			let proofState = {
 				status: "absent",
 				reason_codes: []
@@ -2487,6 +2489,10 @@ async function executeGuardAction(action, resolution, roots, signal, executableI
 		const tgzPath = requireString(resolution.commandManifest, "tgz_path");
 		const identity = tgzPath ? await tgzIdentity(tgzPath) : void 0;
 		if (!executableIdentity$1 || !tgzPath || !identity || identity.name !== target.package_id || identity.version !== target.version || identity.integrity !== target.integrity_digest || roots.profile?.name !== target.profile) return { status: "unavailable" };
+		if (roots.preEffectVeto?.() === false) return {
+			status: "unavailable",
+			reasonCode: "pre_effect_host_veto_refused"
+		};
 		await runCommand(roots, executableIdentity$1, [
 			"plugin",
 			"--profile",
@@ -2501,6 +2507,10 @@ async function executeGuardAction(action, resolution, roots, signal, executableI
 		const identity = tgzPath ? await tgzIdentity(tgzPath) : void 0;
 		const registry = typeof target.registry === "string" ? canonicalRegistryBase(target.registry, { allowLoopbackHttp: roots.allowLoopbackHttpRegistry }) : void 0;
 		if (!executableIdentity$1 || !tgzPath || !identity || identity.name !== target.artifact_id || identity.version !== target.version || identity.integrity !== target.integrity_digest || !registry || registry !== target.registry) return { status: "unavailable" };
+		if (roots.preEffectVeto?.() === false) return {
+			status: "unavailable",
+			reasonCode: "pre_effect_host_veto_refused"
+		};
 		await runCommand(roots, executableIdentity$1, [
 			"publish",
 			tgzPath,
@@ -3025,7 +3035,8 @@ function normalizedRoots(options) {
 		...options.readExecutableIdentity ? { readExecutableIdentity: options.readExecutableIdentity } : {},
 		...options.allowLoopbackHttpRegistry ? { allowLoopbackHttpRegistry: true } : {},
 		...options.releaseGate ? { releaseGate: options.releaseGate } : {},
-		...options.releaseSettle ? { releaseSettle: options.releaseSettle } : {}
+		...options.releaseSettle ? { releaseSettle: options.releaseSettle } : {},
+		...options.preEffectVeto ? { preEffectVeto: options.preEffectVeto } : {}
 	};
 }
 function createActionTool(options = {}) {
@@ -3139,11 +3150,6 @@ function createActionTool(options = {}) {
 				reason_code: "action_adapter_unavailable",
 				...empty
 			};
-			if (roots.hostCapability?.(action).status !== "supported" && roots.hostCapability) return {
-				status: "unavailable",
-				reason_code: "host_capability_unavailable",
-				...empty
-			};
 			let durable = false;
 			try {
 				durable = await roots.prepareMutation?.(agent) === true;
@@ -3173,6 +3179,31 @@ function createActionTool(options = {}) {
 				reason_code: "target_digest_mismatch",
 				...identity
 			};
+			const executable = executableFor(action);
+			let currentExecutable;
+			if (executable) {
+				currentExecutable = await (roots.readExecutableIdentity ?? executableIdentity)(executable, exec.signal);
+				if (bindExecutableIdentity(resolution.executableIdentity, currentExecutable).status !== "supported") return {
+					status: "unavailable",
+					reason_code: "executable_identity_drift",
+					...identity
+				};
+			}
+			const releaseOperation = action === "publish" ? "npm_publish" : void 0;
+			let observed;
+			if (releaseOperation && roots.releaseGate) {
+				observed = await observePublishCandidate(resolution, roots, exec.signal, cwdOf(agent));
+				if (!observed) return {
+					status: "unavailable",
+					reason_code: "release_candidate_unobservable",
+					...identity
+				};
+			}
+			if (roots.hostCapability?.(action).status !== "supported" && roots.hostCapability) return {
+				status: "unavailable",
+				reason_code: "host_capability_unavailable",
+				...empty
+			};
 			let authorization;
 			try {
 				authorization = roots.authorizeMutation?.({
@@ -3189,26 +3220,9 @@ function createActionTool(options = {}) {
 				reason_code: authorization?.reasonCode ?? "mutation_authority_unavailable",
 				...identity
 			};
-			const executable = executableFor(action);
-			let currentExecutable;
-			if (executable) {
-				currentExecutable = await (roots.readExecutableIdentity ?? executableIdentity)(executable, exec.signal);
-				if (bindExecutableIdentity(resolution.executableIdentity, currentExecutable).status !== "supported") return {
-					status: "unavailable",
-					reason_code: "executable_identity_drift",
-					...identity
-				};
-			}
-			const releaseOperation = action === "publish" ? "npm_publish" : void 0;
 			let releaseGranted = false;
 			let releaseContractId;
 			if (releaseOperation && roots.releaseGate) {
-				const observed = await observePublishCandidate(resolution, roots, exec.signal, cwdOf(agent));
-				if (!observed) return {
-					status: "unavailable",
-					reason_code: "release_candidate_unobservable",
-					...identity
-				};
 				let decision;
 				try {
 					decision = await roots.releaseGate({
@@ -5486,6 +5500,8 @@ const Config = Schema.object({
 	hostLockPolicy: Schema.string(),
 	hostLockRuntimeRoot: Schema.string(),
 	hostLockProfileRoot: Schema.string(),
+	hostLockTrust: Schema.string(),
+	hostLockDesktopDigest: Schema.string(),
 	hostLockPackages: Schema.array(Schema.object({
 		name: Schema.string().required(),
 		version: Schema.string(),
@@ -5514,15 +5530,19 @@ function resolveConfig(config) {
 		});
 	}
 	if (config.hostLockPlatform !== void 0 && config.hostLockPlatform !== "posix" && config.hostLockPlatform !== "windows") throw new TypeError("hostLockPlatform must be \"posix\" or \"windows\"");
-	if (config.hostLockProfile !== void 0 && config.hostLockProfile !== "headless" && config.hostLockProfile !== "web") throw new TypeError("hostLockProfile must be \"headless\" or \"web\"");
+	if (config.hostLockProfile !== void 0 && config.hostLockProfile !== "headless" && config.hostLockProfile !== "web" && config.hostLockProfile !== "desktop") throw new TypeError("hostLockProfile must be \"headless\", \"web\", or \"desktop\"");
 	const hasHostRows = hostLockPackages !== void 0;
 	if (hasHostRows !== (config.hostLockPlatform !== void 0) || hasHostRows !== (config.hostLockProfile !== void 0)) throw new TypeError("hostLockPackages, hostLockPlatform, and hostLockProfile must be injected together");
 	for (const key of [
 		"hostLockPolicy",
 		"hostLockRuntimeRoot",
-		"hostLockProfileRoot"
+		"hostLockProfileRoot",
+		"hostLockTrust"
 	]) if (config[key] !== void 0 && (typeof config[key] !== "string" || !config[key])) throw new TypeError(`${key} must be a non-empty string`);
+	if (config.hostLockDesktopDigest !== void 0 && (config.hostLockProfile !== "desktop" || typeof config.hostLockDesktopDigest !== "string" || !/^[a-f0-9]{64}$/.test(config.hostLockDesktopDigest))) throw new TypeError("hostLockDesktopDigest must be an injected Desktop SHA-256");
 	return {
+		...typeof config.hostLockDesktopDigest === "string" ? { hostLockDesktopDigest: config.hostLockDesktopDigest } : {},
+		...typeof config.hostLockTrust === "string" ? { hostLockTrust: config.hostLockTrust } : {},
 		...typeof config.hostLockPolicy === "string" ? { hostLockPolicy: config.hostLockPolicy } : {},
 		...typeof config.hostLockRuntimeRoot === "string" ? { hostLockRuntimeRoot: config.hostLockRuntimeRoot } : {},
 		...typeof config.hostLockProfileRoot === "string" ? { hostLockProfileRoot: config.hostLockProfileRoot } : {},
@@ -6107,8 +6127,9 @@ async function handleGuardTurnStopping(agent, runtime, access$1) {
 		durable = false;
 	}
 	runtime.setDurability(durable);
-	runtime.sync();
+	runtime.sync({ revalidateHostLock: true });
 	if (!durable) return "boundary_flush_failed";
+	const hostSupported = access$1.hostSupported && runtime.projection.hostStatus === "supported";
 	const rootInstruction = latestRootInstruction(agent.session?.snapshotEvents?.() ?? []);
 	if (rootInstruction !== void 0 && isRootPauseRequest(rootInstruction.text) && !runtime.projection.handledControlSeqs.has(rootInstruction.seq) && access$1.pauseAccess) {
 		agent.session.append("user/message", createUserMessage({
@@ -6177,7 +6198,7 @@ async function handleGuardTurnStopping(agent, runtime, access$1) {
 		return decision.reason ?? "protocol_correction_steer";
 	}
 	if (decision.reason === "no_progress_bounded_disarm") {
-		if (!access$1.goalAccess || !access$1.hostSupported) {
+		if (!access$1.goalAccess || !hostSupported) {
 			runtime.projection.integrity = "unknown";
 			runtime.projection.integrityViolations.push("boundary_host_lock_unsupported");
 			return "boundary_host_lock_unsupported";
@@ -6195,7 +6216,7 @@ async function handleGuardTurnStopping(agent, runtime, access$1) {
 		const current = runtime.projection.boundaries.at(-1);
 		const alreadyCurrent = current && isCurrentAcceptedBoundary(runtime.projection, current) && current.disposition === "user_wait" && current.qualificationIds.slice().sort().join(",") === waiting.join(",");
 		if (waiting.length > 0 && !alreadyCurrent) {
-			if (!access$1.hostSupported) {
+			if (!hostSupported) {
 				runtime.projection.integrity = "unknown";
 				runtime.projection.integrityViolations.push("boundary_host_lock_unsupported");
 				return "boundary_host_lock_unsupported";
@@ -6212,15 +6233,17 @@ async function handleGuardTurnStopping(agent, runtime, access$1) {
 	if (decision.reason !== "accepted_boundary_pending_effectuation") return decision.reason ?? "safe_yield_pending_preserved";
 	const boundary = runtime.projection.boundaries.at(-1);
 	if (!boundary || !isCurrentAcceptedBoundary(runtime.projection, boundary)) return "boundary_candidate_stale";
-	if (boundary.goalRef && (!access$1.goalAccess || !access$1.hostSupported)) {
+	if (boundary.goalRef && (!access$1.goalAccess || !hostSupported)) {
 		runtime.projection.integrity = "unknown";
 		runtime.projection.integrityViolations.push("boundary_host_lock_unsupported");
 		return "boundary_host_lock_unsupported";
 	}
-	const requalify = boundary.disposition === "external_wait" ? async () => access$1.externalWaitCapability?.status === "supported" && boundary.qualificationIds.every((id) => {
-		const row = access$1.readExternalOperation(id);
-		return row?.status === "running" || row?.status === "pending";
-	}) : void 0;
+	const requalify = boundary.disposition === "external_wait" ? async () => {
+		return (access$1.refreshExternalWaitCapability?.() ?? access$1.externalWaitCapability)?.status === "supported" && boundary.qualificationIds.every((id) => {
+			const row = access$1.readExternalOperation(id);
+			return row?.status === "running" || row?.status === "pending";
+		});
+	} : void 0;
 	const effect = await effectuateBoundary(boundary, {
 		...access$1.goalAccess ?? {
 			get: async () => void 0,
@@ -6285,7 +6308,6 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 	const persistenceCorrectionAttempts = projection.persistenceCorrectionAttempts;
 	const rebuild = () => {
 		const previousReleaseContracts = projection.releaseContracts.length;
-		if (refreshHostLock) hostLock = refreshHostLock();
 		const header = session.header;
 		const priorRecoveryDigest = projection.lastRecoveryDigest;
 		const sessionHeader = sessionHeaderForDigest(session);
@@ -6372,11 +6394,33 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 			observedCompactionSeq = derived.lastCompactionSeq;
 		}
 	};
-	const sync = () => {
+	const entryStorage = new AsyncLocalStorage();
+	const sync = (options) => {
+		if (options?.revalidateHostLock && refreshHostLock) {
+			const cell = entryStorage.getStore();
+			if (cell && !cell.stale) hostLock = cell.lock;
+			else {
+				hostLock = refreshHostLock();
+				if (cell) {
+					cell.lock = hostLock;
+					cell.stale = false;
+					queueMicrotask(() => {
+						cell.stale = true;
+					});
+				}
+			}
+		}
 		rebuild();
 	};
+	const runHostLockEntry = async (operation) => {
+		if (!refreshHostLock) return await operation();
+		return await entryStorage.run({
+			lock: void 0,
+			stale: true
+		}, async () => await operation());
+	};
 	const setEnabled = (_enabled) => {
-		rebuild();
+		sync({ revalidateHostLock: true });
 	};
 	const setDurability = (confirmed) => {
 		durabilityConfirmed = confirmed;
@@ -6413,6 +6457,7 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 			return [...pendingRecoveryCauses];
 		},
 		sync,
+		runHostLockEntry,
 		setEnabled,
 		setDurability,
 		markRecoveryNeeded,
@@ -6434,18 +6479,56 @@ function isDelegatedSession(session) {
 	return header?.origin === "subagent" || typeof header?.delegationDepth === "number" && header.delegationDepth > 0 || typeof header?.parentSession === "string";
 }
 /** Never reinterpret a legacy injected snapshot as freshly accepted core/v1. */
-function revalidateCoreLock(config, expected) {
+function revalidateCoreLock(config, expected, providedSession) {
 	if (config.hostLockPolicy !== "dsh-core/v1" || !config.hostLockRuntimeRoot || !config.hostLockProfileRoot) return {
 		...expected,
 		status: "unavailable",
 		goalAvailable: false,
 		reasonCode: "host_lock_migration_required"
 	};
+	if (config.hostLockProfile === "desktop") {
+		if (!config.hostLockDesktopDigest) return {
+			...expected,
+			status: "unavailable",
+			goalAvailable: false,
+			reasonCode: "host_lock_migration_required"
+		};
+		try {
+			const configured = evaluateConfiguredHostLock(config.hostLockPackages ?? [], {
+				platform: config.hostLockPlatform,
+				profileKind: "desktop"
+			}, config.hostLockTrust, config.hostLockProfileRoot);
+			if (configured.status !== "supported") return configured;
+			const actual = revalidateDesktopCoreLock(config.hostLockRuntimeRoot, config.hostLockProfileRoot, expected, config.hostLockTrust);
+			if (actual.status !== "supported") return actual;
+			const currentRows = evaluateConfiguredHostLock(actual.packages, {
+				platform: config.hostLockPlatform,
+				profileKind: "desktop"
+			}, config.hostLockTrust, config.hostLockProfileRoot);
+			if (actual.digest !== config.hostLockDesktopDigest || currentRows.digest !== configured.digest) return {
+				...actual,
+				status: "unsupported",
+				goalAvailable: false,
+				reasonCode: "host_lock_installed_graph_drift"
+			};
+			return actual;
+		} catch {
+			return {
+				...expected,
+				status: "unavailable",
+				goalAvailable: false,
+				reasonCode: "host_lock_missing"
+			};
+		}
+	}
+	const session = providedSession ?? createHostAuditSession();
 	try {
-		const actual = evaluateHostLock(readActiveHostGraph(config.hostLockRuntimeRoot, config.hostLockProfileRoot), {
+		const runtimeRoot = session.realpath(config.hostLockRuntimeRoot);
+		const profileRoot = session.realpath(config.hostLockProfileRoot);
+		const actual = evaluateActiveHostLock(runtimeRoot, profileRoot, {
 			platform: config.hostLockPlatform,
 			profileKind: config.hostLockProfile
-		});
+		}, session, config.hostLockTrust);
 		if (actual.status !== "supported") return actual;
 		if (actual.digest !== expected.digest) return {
 			...actual,
@@ -6453,13 +6536,7 @@ function revalidateCoreLock(config, expected) {
 			goalAvailable: false,
 			reasonCode: "host_lock_installed_graph_drift"
 		};
-		if (!auditedHostImplementation(config.hostLockRuntimeRoot, config.hostLockProfileRoot)) return {
-			...actual,
-			status: "unsupported",
-			goalAvailable: false,
-			reasonCode: "host_lock_installed_graph_drift"
-		};
-		const audited = auditedForegroundRenderers(config.hostLockRuntimeRoot, config.hostLockProfileRoot);
+		const audited = auditedForegroundRenderers(runtimeRoot, profileRoot, session);
 		return audited.length ? {
 			...actual,
 			auditedForegroundRenderers: audited,
@@ -6481,7 +6558,8 @@ function registerPassiveHostWorkdirObserver(agent, hostLockAtCall, attestedRoute
 	const pre = agent.ctx.on("tools/pre-execute", async (exec, next) => {
 		if (exec.agent === agent && (exec.name === "bash" || exec.name === "pwsh")) try {
 			const policy = agent.ctx.get("sandboxPolicy");
-			const receipt = captureHostWorkdir(agent.session, exec, hostLockAtCall(), policy, await attestedRouteAtCall(exec.name, agent.ctx.get("shell"), policy), sourcedRootAtCall?.(exec) ?? null, SESSION_FORMAT_VERSION);
+			const audit = createHostAuditSession();
+			const receipt = captureHostWorkdir(agent.session, exec, hostLockAtCall(audit), policy, await attestedRouteAtCall(exec.name, agent.ctx.get("shell"), policy, audit), sourcedRootAtCall?.(exec) ?? null, SESSION_FORMAT_VERSION);
 			if (receipt) pending.set(exec, receipt);
 		} catch {}
 		return next();
@@ -6515,13 +6593,18 @@ function registerPassiveHostWorkdirObserver(agent, hostLockAtCall, attestedRoute
 }
 function apply(ctx, rawConfig = {}, seams = {}) {
 	const config = resolveConfig(rawConfig);
-	const installedHostLock = seams.hostLock ?? evaluateHostLock(config.hostLockPackages ?? [], {
+	const configuredHostLock = seams.hostLock ?? evaluateConfiguredHostLock(config.hostLockPackages ?? [], {
 		platform: config.hostLockPlatform,
 		profileKind: config.hostLockProfile
-	});
+	}, config.hostLockTrust, config.hostLockProfileRoot);
+	const installedHostLock = seams.hostLock ?? (config.hostLockProfile === "desktop" && config.hostLockDesktopDigest ? {
+		...configuredHostLock,
+		digest: config.hostLockDesktopDigest
+	} : configuredHostLock);
 	const runtimes = /* @__PURE__ */ new Map();
 	const privateLedgerRoot = seams.privateLedgerRoot ?? resolvePrivateLedgerRoot(void 0, process.env.DSH_HOME, homedir());
 	const hostLocks = /* @__PURE__ */ new Map();
+	const qualifiedGoalService = (agent) => (hostLocks.get(agent) ?? installedHostLock).goalQualificationFailure ? void 0 : optionalGoalService(ctx, agent);
 	const ledgerContext = (agent, fallback = installedHostLock) => ({
 		sessionId: String(agent.session.id),
 		sessionHeader: structuredClone(agent.session.header),
@@ -6542,19 +6625,25 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 	ctx.on("agent/disposed", ({ agent }) => {
 		detach(agent);
 	});
+	/** One full host-lock validation for the named agent, recorded as the
+	* agent's current authority. Every fresh-validation entry funnels here. */
+	const fullHostLockValidation = () => {
+		const evaluated = revalidateCoreLock(config, installedHostLock);
+		seams.onHostLockValidation?.();
+		return evaluated;
+	};
+	const refreshAgentHostLock = (agent) => {
+		const current = bindLiveGoalCapability(seams.hostLock ?? fullHostLockValidation(), Boolean(qualifiedGoalService(agent)) && hasPinnedUpdateGoalTool(agent));
+		hostLocks.set(agent, current);
+		return current;
+	};
 	const ensure = (agent) => {
 		let runtime = runtimes.get(agent);
 		if (!runtime) {
-			const goals = optionalGoalService(ctx, agent);
-			const refreshHostLock = () => {
-				const current = bindLiveGoalCapability(seams.hostLock ?? revalidateCoreLock(config, installedHostLock), Boolean(goals) && hasPinnedUpdateGoalTool(agent));
-				hostLocks.set(agent, current);
-				return current;
-			};
-			const agentHostLock = refreshHostLock();
-			runtime = createRuntime(agent, config, agentHostLock, goals ? () => goals.get(agent) : void 0, refreshHostLock, privateLedgerRoot ? () => readPrivateLedger(privateLedgerRoot, ledgerContext(agent, agentHostLock)) : void 0, privateLedgerRoot ? () => initializePrivateLedger(privateLedgerRoot, ledgerContext(agent, agentHostLock)) : void 0);
+			const goals = qualifiedGoalService(agent);
+			const agentHostLock = refreshAgentHostLock(agent);
+			runtime = createRuntime(agent, config, agentHostLock, goals ? () => goals.get(agent) : void 0, () => refreshAgentHostLock(agent), privateLedgerRoot ? () => readPrivateLedger(privateLedgerRoot, ledgerContext(agent, agentHostLock)) : void 0, privateLedgerRoot ? () => initializePrivateLedger(privateLedgerRoot, ledgerContext(agent, agentHostLock)) : void 0);
 			runtimes.set(agent, runtime);
-			hostLocks.set(agent, agentHostLock);
 		}
 		return runtime;
 	};
@@ -6585,7 +6674,12 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 				runtime.projection.lastRecoveryDigest = void 0;
 				runtime.markRecoveryNeeded(source === "resume" ? "resume" : "compaction");
 			}
-			own(registerPassiveHostWorkdirObserver(agent, () => seams.hostLock ?? revalidateCoreLock(config, installedHostLock), (tool, provider, policy) => config.hostLockRuntimeRoot && config.hostLockProfileRoot ? auditedDefaultWorkdirProvider(config.hostLockRuntimeRoot, config.hostLockProfileRoot, tool, provider, policy) : false, (exec) => {
+			own(registerPassiveHostWorkdirObserver(agent, (audit) => {
+				if (seams.hostLock) return seams.hostLock;
+				const evaluated = revalidateCoreLock(config, installedHostLock, audit);
+				seams.onHostLockValidation?.();
+				return evaluated;
+			}, (tool, provider, policy, audit) => config.hostLockRuntimeRoot && config.hostLockProfileRoot ? auditedDefaultWorkdirProvider(config.hostLockRuntimeRoot, config.hostLockProfileRoot, tool, provider, policy, audit) : false, (exec) => {
 				runtime.sync();
 				return sourcedNamedTestRoot(runtime.projection, agent.session, exec.arguments);
 			}));
@@ -6600,7 +6694,7 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 				runtime.setDurability(durable);
 				runtime.sync();
 				return durable;
-			}));
+			}, () => runtime.sync({ revalidateHostLock: true })));
 			ownedTools.register(createBoundaryTool(() => runtime.projection, async () => {
 				const durable = await ctx.sessions.flush(agent.session);
 				runtime.setDurability(durable);
@@ -6615,11 +6709,17 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 				runtime.sync();
 				return durable;
 			};
+			const hostCapabilityFromCache = (action) => createHostCapabilityEvaluator(hostLocks.get(agent) ?? installedHostLock)(action);
 			const evidenceOptions = {
-				hostCapability: createHostCapabilityEvaluator(hostLocks.get(agent) ?? installedHostLock),
+				hostCapability: hostCapabilityFromCache,
 				...seams.commandRunner ? { commandRunner: seams.commandRunner } : {},
 				...seams.fetcher ? { fetcher: seams.fetcher } : {},
+				...seams.readExecutableIdentity ? { readExecutableIdentity: seams.readExecutableIdentity } : {},
 				...seams.allowLoopbackHttpRegistry ? { allowLoopbackHttpRegistry: true } : {},
+				preEffectVeto: () => {
+					runtime.sync({ revalidateHostLock: true });
+					return runtime.projection.hostStatus === "supported";
+				},
 				prepareMutation: async (toolAgent) => {
 					if (toolAgent.session !== agent.session) return false;
 					const durable = await ctx.sessions.flush(agent.session);
@@ -6628,20 +6728,14 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 					return durable;
 				},
 				authorizeMutation: (request) => {
-					runtime.sync();
+					runtime.sync({ revalidateHostLock: true });
 					return authorizeMutationFromProjection(runtime.projection, request);
 				},
 				marketOrigin: optionalMarketOrigin(ctx, agent),
 				hasRestartIntent: (resolutionCallId, serviceId, preGeneration) => hasPrivateRestartIntent(readPrivateLedger(privateLedgerRoot, ledgerContext(agent)), resolutionCallId, serviceId, preGeneration),
 				releaseGate: async (request) => {
-					runtime.sync();
-					const projection = runtime.projection;
-					if (!(projection.policy === "release" || projection.releaseContracts.length > 0)) return {
-						status: "denied",
-						reasonCode: "release_contract_not_adopted"
-					};
 					const observed = { ...request.observed };
-					const declaredRef = releaseContractFor(projection, request.operation)?.candidate.ref;
+					const declaredRef = releaseContractFor(runtime.projection, request.operation)?.candidate.ref;
 					if (declaredRef !== void 0 && observed.ref === void 0) {
 						const refSha = await resolveAuditedRef(sessionCwd(runtime.session), declaredRef, evidenceOptions, requestSignal());
 						if (refSha !== void 0) {
@@ -6649,6 +6743,16 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 							observed.refSha = refSha;
 						}
 					}
+					runtime.sync({ revalidateHostLock: true });
+					const projection = runtime.projection;
+					if (!(projection.policy === "release" || projection.releaseContracts.length > 0)) return {
+						status: "denied",
+						reasonCode: "release_contract_not_adopted"
+					};
+					if (projection.hostStatus !== "supported") return {
+						status: "denied",
+						reasonCode: projection.hostReasonCode ?? "host_lock_unavailable"
+					};
 					const decision = releasePreEffectDecision(projection, {
 						operation: request.operation,
 						observed,
@@ -6723,7 +6827,17 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 				fs: ctx.fs,
 				flush: (session) => ctx.sessions.flush(session)
 			}));
-			ownedTools.register(createActionTool(evidenceOptions));
+			const actionTool = createActionTool({
+				...evidenceOptions,
+				hostCapability: (action) => {
+					runtime.sync({ revalidateHostLock: true });
+					return createHostCapabilityEvaluator(hostLocks.get(agent) ?? installedHostLock)(action);
+				}
+			});
+			ownedTools.register({
+				...actionTool,
+				execute: (...args) => runtime.runHostLockEntry(() => actionTool.execute(...args))
+			});
 			ownedTools.register(createPrepareTool({
 				getProjection: () => runtime.projection,
 				hostCapability: (action) => {
@@ -6765,7 +6879,10 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 				})
 			}));
 			ownedTools.register(createExternalOperationTool((id, toolAgent) => readExternalOperation(ctx, toolAgent, id), () => evaluateExternalWaitCapability(hostLocks.get(agent) ?? installedHostLock)));
-			ownedTools.guard((exec) => goalCompletionDenial(runtime.projection, exec.name, exec.arguments));
+			ownedTools.guard((exec) => {
+				if (exec.name === "update_goal" && exec.arguments?.action === "complete" && runtime.projection.enabled) runtime.sync({ revalidateHostLock: true });
+				return goalCompletionDenial(runtime.projection, exec.name, exec.arguments);
+			});
 		} catch (error) {
 			detach(agent);
 			throw error;
@@ -6835,11 +6952,12 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 	});
 	ctx.on("agent/turn-stopping", async ({ agent }) => {
 		const runtime = ensure(agent);
-		const goals = optionalGoalService(ctx, agent);
+		const goals = qualifiedGoalService(agent);
 		await handleGuardTurnStopping(agent, runtime, {
 			flush: () => ctx.sessions.flush(agent.session),
 			hostSupported: runtime.projection.hostStatus === "supported",
 			externalWaitCapability: evaluateExternalWaitCapability(hostLocks.get(agent) ?? installedHostLock),
+			refreshExternalWaitCapability: () => evaluateExternalWaitCapability(hostLocks.get(agent) ?? installedHostLock),
 			...goals ? { goalAccess: {
 				get: async () => normalizeGoalState(await goals.get(agent)),
 				disarm: async () => normalizeGoalState(await goals.disarm(agent))
@@ -7065,4 +7183,4 @@ async function replayRawV2(input) {
 }
 
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, BASE_HOST_PACKAGES, BOUNDARY_RECORD_PREFIX, BOUNDED_ARTIFACT_TYPES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, CERTIFICATE_VERSION_V2, CLEANUP_CONDITION_RULE, CLEANUP_CONDITION_RULE_COMPACT, CLEANUP_CONDITION_RULE_SHORT, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_DELEGATION_TOOL_NAMES, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DEPENDENCY_FREE_ONLY_CONDITION, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GRANTED_QUALIFICATION, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HostProfileError, LATEST_SUPPORTED_HOST_VERSION, LEGACY_QUALIFICATION, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_CAPABILITY_MATRIX, PROOF_KINDS, PROOF_KINDS_V2, PROOF_MANIFEST_DOMAIN_V2, PROOF_PROTOCOL_VERSION, PROOF_PROTOCOL_VERSION_V2, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, PROTOCOL_V5_NOTICE, PROTOCOL_V6_NOTICE, RC017_RC2_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, STOP_PROTOCOL_VERSION_V2, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, SessionApiError, V6_ORDINARY_COMPLETION_RULE, V6_ORDINARY_COMPLETION_RULE_COMPACT, V6_ORDINARY_COMPLETION_RULE_SHORT, actionCompatible, actionHasCertificationPath, actionVerbMatches, activeRendererModule, admissibleForRemoval, apply, applyUpgradeEligibility, assessmentAction, assessmentOutcomePredicate, auditedDefaultWorkdirHost, auditedDefaultWorkdirProvider, auditedForegroundRenderers, auditedHostImplementation, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindProofV2ToProjection, bindingIndividuallyAccepted, bindingSatisfies, boundedArtifactChoiceMatches, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, capabilityConsequence, capabilityFactOf, capabilityRemedyPhrase, captureClause, captureItem, carriesCleanupCondition, certifyCheckpoint, claimedBatchHasRealRootInput, clarifiedSpanOf, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, clauseAsksOwnQuestion, clauseIsGoverned, clauseIsProtected, cleanupConditionFor, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, createProofManifestV2, currentActionBases, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, environmentDefaultRepositoryTarget, evaluateExternalWaitCapability, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, explanationHasActionResidue, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, firstStepGuidance, firstStepGuidanceV6, gitCommandMatchesTarget, goalCompletionDenial, governedClauseRestrictsExecution, hasCurrentCertificate, hasOrderedCoordination, hasQuestionScope, hasWorkPredicate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, introducesActionClause, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isExplanationScope, isFrozenV042RebindResponse, isInformationalFragment, isInformationalMessage, isOpenObligation, isQuestionScopeNeedingReview, isRestatement, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, itemHoldsExecutionAuthority, kindOfScope, latestAssistantText, latestRootInstruction, legacyQuestionReadingIsInformational, legacyRecordsNeedingReview, lifecyclePhase, maskCodeSpans, maskQuotedSpans, name, namedActions, nativeFileTwoRole, normalizeClause, observeAssistantOutcome, openItems, opensConditionLead, opensWithDirective, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostVersion, parsePwshCommand, parseShellCommand, partialFailureOf, persistedToolResultStatus, presentExplanationHead, previewFirstStepInjection, progressFingerprint, projectCoreV2, projectSessionCoreV2, proofCapabilityReport, proofDigest, proofDigestV2, proofEvidenceConstraints, proofHostSurfacesOf, proofOperationMatches, proofV2Rejection, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualificationOfClause, qualifyBoundary, questionHeadsClause, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, recoveryTitle, relevantEvidence, removalIsComplete, removalIsPartiallyKnown, renderRecoveryPacket, replayRawV2, replayRebindResult, reportingHeadGoverns, requestedIdentityKey, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, requiredSubjectsOf, resolveActiveProfileHostLock, resolveInstalledHostLock, restatedContentOf, revalidateGitPrestate, rootLocatorFlavor, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, scopeCoverageDigest, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sessionQueryV2, sha256, snapshotSessionEvents, splitTextFragments, statefulActionsOfScope, supersedeItem, testOutcomePredicate, v6CurrentRootBoundaries, v6TestPredicate, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, validateProofManifestV2, verbIsNegated, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, BASE_HOST_PACKAGES, BOUNDARY_RECORD_PREFIX, BOUNDED_ARTIFACT_TYPES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, CERTIFICATE_VERSION_V2, CLEANUP_CONDITION_RULE, CLEANUP_CONDITION_RULE_COMPACT, CLEANUP_CONDITION_RULE_SHORT, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_DELEGATION_TOOL_NAMES, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DEPENDENCY_FREE_ONLY_CONDITION, DESKTOP_IDENTITY_FACTS, DESKTOP_PROFILE_PACKAGE_NAME, DESKTOP_RUNTIME_PACKAGE_NAME, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GRANTED_QUALIFICATION, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HOST_VALIDATED_VERSIONS, HostProfileError, HostTrustError, LATEST_TESTED_HOST_VERSION, LEGACY_QUALIFICATION, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_CAPABILITY_MATRIX, PROOF_KINDS, PROOF_KINDS_V2, PROOF_MANIFEST_DOMAIN_V2, PROOF_PROTOCOL_VERSION, PROOF_PROTOCOL_VERSION_V2, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, PROTOCOL_V5_NOTICE, PROTOCOL_V6_NOTICE, RC020_RC1_HOST_PACKAGES, RC020_RC2_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, STOP_PROTOCOL_VERSION_V2, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, SessionApiError, V6_ORDINARY_COMPLETION_RULE, V6_ORDINARY_COMPLETION_RULE_COMPACT, V6_ORDINARY_COMPLETION_RULE_SHORT, acquireHostTrust, actionCompatible, actionHasCertificationPath, actionVerbMatches, activeRendererModule, admissibleForRemoval, apply, applyUpgradeEligibility, assessmentAction, assessmentOutcomePredicate, auditDesktopInstalledImplementation, auditedDefaultWorkdirHost, auditedDefaultWorkdirProvider, auditedForegroundRenderers, auditedHostImplementation, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindProofV2ToProjection, bindingIndividuallyAccepted, bindingSatisfies, boundedArtifactChoiceMatches, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, capabilityConsequence, capabilityFactOf, capabilityRemedyPhrase, captureClause, captureItem, carriesCleanupCondition, certifyCheckpoint, claimedBatchHasRealRootInput, clarifiedSpanOf, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, clauseAsksOwnQuestion, clauseIsGoverned, clauseIsProtected, cleanupConditionFor, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, createProofManifestV2, currentActionBases, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, environmentDefaultRepositoryTarget, evaluateActiveHostLock, evaluateConfiguredHostLock, evaluateExternalWaitCapability, evaluateGraphDerivedHostLock, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, explanationHasActionResidue, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, firstStepGuidance, firstStepGuidanceV6, gitCommandMatchesTarget, goalCompletionDenial, governedClauseRestrictsExecution, hasCurrentCertificate, hasDesktopImporterState, hasOrderedCoordination, hasQuestionScope, hasWorkPredicate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostTrustDigest, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectDesktopTargetGraph, inspectTargetHostGraph, interpretClause, interpretMessage, introducesActionClause, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isExplanationScope, isFrozenV042RebindResponse, isInformationalFragment, isInformationalMessage, isOpenObligation, isQuestionScopeNeedingReview, isRestatement, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, itemHoldsExecutionAuthority, kindOfScope, latestAssistantText, latestRootInstruction, legacyQuestionReadingIsInformational, legacyRecordsNeedingReview, lifecyclePhase, maskCodeSpans, maskQuotedSpans, name, namedActions, nativeFileTwoRole, normalizeClause, observeAssistantOutcome, openItems, opensConditionLead, opensWithDirective, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostTrust, parseHostVersion, parsePwshCommand, parseShellCommand, partialFailureOf, persistedToolResultStatus, prepareActiveHostTrust, prepareDesktopHostTrust, prepareTargetHostTrust, presentExplanationHead, previewFirstStepInjection, progressFingerprint, projectCoreV2, projectSessionCoreV2, proofCapabilityReport, proofDigest, proofDigestV2, proofEvidenceConstraints, proofHostSurfacesOf, proofOperationMatches, proofV2Rejection, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualificationOfClause, qualifyBoundary, qualifyHostTrust, questionHeadsClause, readActiveHostGraph, readAsarFile, readAsarIndex, readDesktopAppRuntime, readDesktopDependency, readDesktopTargetGraph, rebindAttemptKey, rebindResponse, recoveryDigest, recoveryTitle, registryArchiveFiles, registryArchiveModules, relevantEvidence, removalIsComplete, removalIsPartiallyKnown, renderRecoveryPacket, replayRawV2, replayRebindResult, reportingHeadGoverns, requestedIdentityKey, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, requiredSubjectsOf, resolveActiveProfileHostLock, resolveDesktopProfileHostLock, resolveInstalledHostLock, restatedContentOf, revalidateDesktopCoreLock, revalidateGitPrestate, rootLocatorFlavor, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, scopeCoverageDigest, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sessionQueryV2, sha256, snapshotSessionEvents, splitTextFragments, statefulActionsOfScope, supersedeItem, testOutcomePredicate, v6CurrentRootBoundaries, v6TestPredicate, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, validateProofManifestV2, verbIsNegated, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability, writeDesktopRuntimeReceipt };