dsh-completion-guard 0.8.1 → 0.8.3

package/dist/index.js

@@ -1,12 +1,12 @@
-import { $ as PROOF_KINDS, $i as hostVersionFromPackages, $n as capabilityConsequence, $r as statefulActionsOfScope, $t as reservationFor, A as PROTOCOL_V4_NOTICE, Aa as RC020_RC1_HOST_PACKAGES, Ai as HostTrustError, An as isCurrentAcceptedBoundary, Ar as interpretMessage, At as carriesCleanupCondition, B as extractToolSubject, Bi as BASE_HOST_PACKAGES, Bn as replayRebindResult, Br as legacyQuestionReadingIsInformational, Bt as sourceItemForCoreRequirement, C as SESSION_EVENT_ENVELOPE_INVALID, Ca as requestedIdentityKey, Ci as packageRowsFromPnpmLock, Cn as hasCurrentCertificate, Cr as clauseIsProtected, Ct as CLEANUP_CONDITION_RULE_COMPACT, D as CAPTURE_V042_NOTICE, Da as semanticActionFromText, Di as resolveActiveProfileHostLock, Dn as BOUNDARY_RECORD_PREFIX, Dr as hasQuestionScope, Dt as V6_ORDINARY_COMPLETION_RULE, E as projectCoreV2, Ea as semanticActionFromCommand, Ei as readActiveHostGraph, En as unitDescendantIds, Er as hasOrderedCoordination, Et as MIN_RECOVERY_CHAR_BUDGET, F as legacyRecordsNeedingReview, Fi as registryArchiveFiles, Fn as proposeRebind, Fr as isOpenObligation, Ft as recoveryTitle, G as isRunExecutable, Gi as HOST_COHORTS, Gn as deriveItemDiagnosis, Gr as opensWithDirective, Gt as inFlightReservation, H as persistedToolResultStatus, Hi as EXPECTED_HOST_PACKAGES, Hn as isFrozenV042RebindResponse, Hr as maskQuotedSpans, Ht as RELEASE_OPERATIONS, I as rootLocatorFlavor, Ii as registryArchiveModules, In as proposeRebindOutcome, Ir as isQuestionScopeNeedingReview, It as renderRecoveryPacket, J as authorityCaptureCounts, Ji as evaluateExternalWaitCapability, Jn as nativeFileTwoRole, Jr as questionHeadsClause, Jt as normalizeSettlement, K as parsePwshCommand, Ki as bindExecutableIdentity, Kn as evidenceAvailabilityReason, Kr as presentExplanationHead, Kt as normalizeReleaseContract, L as supersedeItem, Li as ACTIVE_HOST_COHORT_ID, Ln as proposeRebindV042, Lr as isRestatement, Lt as v6CurrentRootBoundaries, M as PROTOCOL_V6_NOTICE, Mi as hostTrustDigest, Mn as currentContractDigest, Mr as isExecutableItem, Mt as closingHint, N as applyUpgradeEligibility, Ni as parseHostTrust, Nn as createProjection, Nr as isExplanationScope, Nt as openItems, O as DEFAULT_DELEGATION_TOOL_NAMES, Oa as validateActionManifest, Oi as resolveInstalledHostLock, On as availableBoundaryQualifications, Or as hasWorkPredicate, Ot as V6_ORDINARY_COMPLETION_RULE_COMPACT, P as deriveProjection, Pi as qualifyHostTrust, Pn as confirmRebind, Pr as isInformationalFragment, Pt as recoveryDigest, Q as PROOF_CAPABILITY_MATRIX, Qi as evaluateToolSurfaceCapability, Qn as admissibleForRemoval, Qr as splitTextFragments, Qt as releasePreEffectDecision, R as evidenceFromPersistedToolResult, Ri as ACTIVE_HOST_COHORT_IDS, Rn as rebindAttemptKey, Rr as itemHoldsExecutionAuthority, Rt as currentV6Feedback, S as SESSION_API_UNSUPPORTED, Sa as isStatefulAction, Si as packageRowsFromActiveGraph, Sn as goalCompletionDenial, Sr as clauseIsGoverned, St as CLEANUP_CONDITION_RULE, T as snapshotSessionEvents, Ta as requestedTargetMatchesResolved, Ti as prepareTargetHostTrust, Tn as certificateClosure, Tr as governedClauseRestrictsExecution, Tt as DEFAULT_RECOVERY_CHAR_BUDGET, U as withDurability, Ui as GOAL_HOST_PACKAGES, Un as parseConfirmationMessage, Ur as namedActions, Ut as RELEASE_OPERATION_SURFACES, V as isDeterministicCheck, Vi as DEFAULT_HOST_LOCK, Vn as CONFIRM_LINE_PATTERN, Vr as maskCodeSpans, Vt as OUTCOME_STRENGTH, W as canonicalArgvFromCommand, Wi as HOST_CAPABILITY_PACKAGE_GROUPS, Wn as capabilityRemedyPhrase, Wr as opensConditionLead, Wt as contractById, X as bindingIndividuallyAccepted, Xi as evaluateHostCapability, Xn as DEPENDENCY_FREE_ONLY_CONDITION, Xr as restatedContentOf, Xt as releaseContractFor, Y as segmentAuthorityBlocks, Yi as evaluateGraphDerivedHostLock, Yn as relevantEvidence, Yr as reportingHeadGoverns, Yt as readbackSettlesContract, Z as certifyCheckpoint, Zi as evaluateHostLock, Zn as actionHasCertificationPath, Zr as semanticActionOfScope, Zt as releaseCoverage, _ as projectSessionCoreV2, _a as STOP_PROTOCOL_VERSION, _i as evaluateConfiguredHostLock, _n as latestRootInstruction, _r as GRANTED_QUALIFICATION, _t as scopeCoverageDigest, a as createGitPrestateEnvelope, aa as SUPPORTED_HOST_VERSIONS, ai as normalizeClause, an as NO_PROGRESS_RECORD_PREFIX, ar as captureItem, at as bindProofV2ToProjection, b as captureHostWorkdir, ba as actionCompatible, bi as injectActiveProfileHostLock, bn as testOutcomePredicate, br as clarifiedSpanOf, bt as validateProofManifest, c as parseGitCommandManifest, ca as parseHostVersion, ci as sha256, cn as assessmentOutcomePredicate, cr as extractArtifactPaths, ct as createProofManifestV2, d as FIRST_STEP_GUIDANCE, da as ACTION_MANIFEST_VERSION, di as auditedDefaultWorkdirHost, dn as decideTurnBoundary, dr as isInformationalMessage, dt as proofDigestV2, ea as selectHostCohort, ei as verbIsNegated, en as bindingSatisfies, er as capabilityFactOf, et as PROOF_KINDS_V2, f as claimedBatchHasRealRootInput, fa as BOUNDED_ARTIFACT_TYPES, fi as auditedDefaultWorkdirProvider, fn as decideTurnStopping, fr as segmentClauses, ft as proofEvidenceConstraints, g as previewFirstStepInjection, ga as STATEFUL_ACTIONS, gi as evaluateActiveHostLock, gn as latestAssistantText, gr as classifyUserInteraction, gt as requiredSubjectsOf, h as lifecyclePhase, ha as SEMANTIC_ACTIONS, hi as combineHostPolicy, hn as isWholeTaskCompletionClaim, hr as classifyTaskIntent, ht as proofV2Rejection, i as commitTreeSnapshotDigest, ia as SUPPORTED_HOST_RANGE, ii as digestStrings, in as CONTROL_RECORD_PREFIX, ir as captureClause, it as bindProofToProjection, j as PROTOCOL_V5_NOTICE, ja as createHostAuditSession, ji as acquireHostTrust, jn as qualifyBoundary, jr as introducesActionClause, jt as cleanupConditionFor, k as PROTOCOL_V3_NOTICE, ka as validateActionTarget, ki as verifyComposedHostLockDump, kn as effectuateBoundary, kr as interpretClause, kt as V6_ORDINARY_COMPLETION_RULE_SHORT, l as revalidateGitPrestate, la as satisfiesSupportedHostRange, li as HostProfileError, ln as classifyCompletionClaim, lr as extractMethod, lt as proofCapabilityReport, m as firstStepGuidanceV6, ma as CERTIFICATE_VERSION_V2, mi as auditedHostImplementation, mn as isRootPauseRequest, mr as npmEscapedPackageName, mt as proofOperationMatches, n as GIT_COMMAND_TEMPLATES, na as LATEST_TESTED_HOST_VERSION, ni as validateManifest, nn as evidenceMatchesItem, nr as removalIsComplete, nt as PROOF_PROTOCOL_VERSION, o as executeRevalidatedGitEffect, oa as compareHostVersions, oi as sanitizeClauseText, on as NO_PROGRESS_TURNS_BEFORE_STOP, or as classifyClause, ot as canonicalProjection, p as firstStepGuidance, pa as CERTIFICATE_VERSION, pi as auditedForegroundRenderers, pn as decisionBoundaryKey, pr as canonicalRegistryBase, pt as proofHostSurfacesOf, q as parseShellCommand, qi as bindLiveGoalCapability, qn as itemDiagnosis, qr as qualificationOfClause, qt as normalizeReservation, r as commitIndexSnapshotDigest, ra as MIN_SUPPORTED_HOST_VERSION, ri as canonicalizePath, rn as isVerifyingCapability, rr as removalIsPartiallyKnown, rt as PROOF_PROTOCOL_VERSION_V2, s as gitCommandMatchesTarget, sa as evaluateMinimumHostVersion, si as sanitizeUrl, sn as assessmentAction, sr as environmentDefaultRepositoryTarget, st as createProofManifest, t as GIT_COMMAND_MANIFEST_IDS, ta as HOST_VALIDATED_VERSIONS, ti as COMMAND_SURFACE_MANIFEST, tn as evidenceCoverage, tr as partialFailureOf, tt as PROOF_MANIFEST_DOMAIN_V2, u as verifiedLinearCommitReadback, ua as ACTION_MANIFEST, ui as activeRendererModule, un as currentActionBases, ur as extractOperation, ut as proofDigest, v as sessionCoreSnapshot, va as STOP_PROTOCOL_VERSION_V2, vi as hostLockContextFromComposedDump, vn as observeAssistantOutcome, vr as LEGACY_QUALIFICATION, vt as sessionQuery, w as SessionApiError, wa as requestedTargetAuthorizesMutation, wi as prepareActiveHostTrust, wn as certifiableOpenItems, wr as explanationHasActionResidue, wt as CLEANUP_CONDITION_RULE_SHORT, x as sourcedNamedTestRoot, xa as boundedArtifactChoiceMatches, xi as inspectTargetHostGraph, xn as v6TestPredicate, xr as clauseAsksOwnQuestion, xt as validateProofManifestV2, y as HOST_WORKDIR_PREFIX, ya as SUPPORTED_EVIDENCE_ADAPTERS, yi as hostLockRowsFromComposedDump, yn as progressFingerprint, yr as actionVerbMatches, yt as sessionQueryV2, z as extractTextContent, zi as ACTIVE_HOST_LAUNCHER_VERSION, zn as rebindResponse, zr as kindOfScope, zt as isV6PendingRootWait } from "./domain-Jo13xgPJ.js";
+import { $ as segmentAuthorityBlocks, $a as createHostAuditSession, $i as acquireHostTrust, $n as evidenceAvailabilityReason, $r as presentExplanationHead, $t as normalizeSettlement, A as PROTOCOL_V3_NOTICE, Aa as parseHostVersion, Ai as packageRowsFromActiveGraph, An as certifiableOpenItems, Ar as clauseIsProtected, At as MIN_RECOVERY_CHAR_BUDGET, B as evidenceFromPersistedToolResult, Ba as STOP_PROTOCOL_VERSION_V2, Bi as verifyComposedHostLockDump, Bn as createProjection, Br as isExplanationScope, Bt as renderRecoveryPacket, C as SESSION_API_UNSUPPORTED, Ca as HOST_VALIDATED_VERSIONS, Ci as evaluateActiveHostLock, Cn as observeAssistantOutcome, Cr as classifyUserInteraction, Ct as sessionQueryV2, D as projectCoreV2, Da as SUPPORTED_HOST_VERSIONS, Di as injectActiveProfileHostLock, Dn as goalCompletionDenial, Dr as clarifiedSpanOf, Dt as CLEANUP_CONDITION_RULE_COMPACT, E as snapshotSessionEvents, Ea as SUPPORTED_HOST_RANGE, Ei as hostLockRowsFromComposedDump, En as v6TestPredicate, Er as actionVerbMatches, Et as CLEANUP_CONDITION_RULE, F as deriveProjection, Fa as CERTIFICATE_VERSION, Fi as readActiveHostGraph, Fn as availableBoundaryQualifications, Fr as hasWorkPredicate, Ft as cleanupConditionFor, G as persistedToolResultStatus, Ga as requestedIdentityKey, Gi as hasDesktopImporterState, Gn as rebindAttemptKey, Gr as itemHoldsExecutionAuthority, Gt as sourceItemForCoreRequirement, H as extractToolSubject, Ha as actionCompatible, Hi as DESKTOP_PROFILE_PACKAGE_NAME, Hn as proposeRebind, Hr as isOpenObligation, Ht as confirmedV6CoreDiagnostic, I as legacyRecordsNeedingReview, Ia as CERTIFICATE_VERSION_V2, Ii as resolveActiveProfileHostLock, In as effectuateBoundary, Ir as interpretClause, It as closingHint, J as canonicalArgvFromCommand, Ja as semanticActionFromCommand, Ji as readDesktopAppRuntime, Jn as CONFIRM_LINE_PATTERN, Jr as maskCodeSpans, Jt as RELEASE_OPERATION_SURFACES, K as shellReadbackOutcome, Ka as requestedTargetAuthorizesMutation, Ki as readAsarFile, Kn as rebindResponse, Kr as kindOfScope, Kt as OUTCOME_STRENGTH, L as rootLocatorFlavor, La as SEMANTIC_ACTIONS, Li as resolveDesktopProfileHostLock, Ln as isCurrentAcceptedBoundary, Lr as interpretMessage, Lt as openItems, M as PROTOCOL_V5_NOTICE, Ma as ACTION_MANIFEST, Mi as prepareActiveHostTrust, Mn as needsReviewObligations, Mr as governedClauseRestrictsExecution, Mt as V6_ORDINARY_COMPLETION_RULE_COMPACT, N as PROTOCOL_V6_NOTICE, Na as ACTION_MANIFEST_VERSION, Ni as prepareDesktopHostTrust, Nn as unitDescendantIds, Nr as hasOrderedCoordination, Nt as V6_ORDINARY_COMPLETION_RULE_SHORT, O as CAPTURE_V042_NOTICE, Oa as compareHostVersions, Oi as inspectDesktopTargetGraph, On as hasCurrentCertificate, Or as clauseAsksOwnQuestion, Ot as CLEANUP_CONDITION_RULE_SHORT, P as applyUpgradeEligibility, Pa as BOUNDED_ARTIFACT_TYPES, Pi as prepareTargetHostTrust, Pn as BOUNDARY_RECORD_PREFIX, Pr as hasQuestionScope, Pt as carriesCleanupCondition, Q as authorityCaptureCounts, Qa as RC020_RC2_HOST_PACKAGES, Qi as HostTrustError, Qn as deriveItemDiagnosis, Qr as opensWithDirective, Qt as normalizeReservation, R as supersedeItem, Ra as STATEFUL_ACTIONS, Ri as resolveInstalledHostLock, Rn as qualifyBoundary, Rr as introducesActionClause, Rt as recoveryDigest, S as sourcedNamedTestRoot, Sa as selectHostCohort, Si as combineHostPolicy, Sn as latestRootInstruction, Sr as classifyTaskIntent, St as sessionQuery, T as SessionApiError, Ta as MIN_SUPPORTED_HOST_VERSION, Ti as hostLockContextFromComposedDump, Tn as testOutcomePredicate, Tr as LEGACY_QUALIFICATION, Tt as validateProofManifestV2, U as isDeterministicCheck, Ua as boundedArtifactChoiceMatches, Ui as DESKTOP_RUNTIME_PACKAGE_NAME, Un as proposeRebindOutcome, Ur as isQuestionScopeNeedingReview, Ut as currentV6Feedback, V as extractTextContent, Va as SUPPORTED_EVIDENCE_ADAPTERS, Vi as DESKTOP_IDENTITY_FACTS, Vn as confirmRebind, Vr as isInformationalFragment, Vt as v6CurrentRootBoundaries, W as nativeGitParentOidVerified, Wa as isStatefulAction, Wi as auditDesktopInstalledImplementation, Wn as proposeRebindV042, Wr as isRestatement, Wt as isV6PendingRootWait, X as parsePwshCommand, Xa as validateActionManifest, Xi as readDesktopTargetGraph, Xn as parseConfirmationMessage, Xr as namedActions, Xt as inFlightReservation, Y as isRunExecutable, Ya as semanticActionFromText, Yi as readDesktopDependency, Yn as isFrozenV042RebindResponse, Yr as maskQuotedSpans, Yt as contractById, Z as parseShellCommand, Za as validateActionTarget, Zi as writeDesktopRuntimeReceipt, Zn as capabilityRemedyPhrase, Zr as opensConditionLead, Zt as normalizeReleaseContract, _ as previewFirstStepInjection, _a as evaluateGraphDerivedHostLock, _i as activeRendererModule, _n as decideTurnStopping, _r as extractOperation, _t as proofHostSurfacesOf, a as commitTreeSnapshotDigest, aa as ACTIVE_HOST_COHORT_ID, ai as splitTextFragments, an as bindingSatisfies, ar as admissibleForRemoval, at as PROOF_MANIFEST_DOMAIN_V2, b as HOST_WORKDIR_PREFIX, ba as evaluateToolSurfaceCapability, bi as auditedForegroundRenderers, bn as isWholeTaskCompletionClaim, br as canonicalRegistryBase, bt as requiredSubjectsOf, c as gitCommandMatchesTarget, ca as BASE_HOST_PACKAGES, ci as COMMAND_SURFACE_MANIFEST, cn as isVerifyingCapability, cr as partialFailureOf, ct as bindProofToProjection, d as verifiedLinearCommitReadback, da as GOAL_HOST_PACKAGES, di as digestStrings, dn as NO_PROGRESS_TURNS_BEFORE_STOP, dr as captureClause, dt as createProofManifest, ea as hostTrustDigest, ei as qualificationOfClause, en as readbackSettlesContract, er as itemDiagnosis, et as bindingIndividuallyAccepted, f as FIRST_STEP_GUIDANCE, fa as HOST_CAPABILITY_PACKAGE_GROUPS, fi as normalizeClause, fn as assessmentAction, fr as captureItem, ft as createProofManifestV2, g as lifecyclePhase, ga as evaluateExternalWaitCapability, gi as HostProfileError, gn as decideTurnBoundary, gr as extractMethod, gt as proofEvidenceConstraints, h as firstStepGuidanceV6, ha as bindLiveGoalCapability, hi as sha256, hn as currentActionBases, hr as extractArtifactPaths, ht as proofDigestV2, i as commitIndexSnapshotDigest, ia as registryArchiveModules, ii as semanticActionOfScope, in as reservationFor, ir as actionHasCertificationPath, it as PROOF_KINDS_V2, j as PROTOCOL_V4_NOTICE, ja as satisfiesSupportedHostRange, ji as packageRowsFromPnpmLock, jn as certificateClosure, jr as explanationHasActionResidue, jt as V6_ORDINARY_COMPLETION_RULE, k as DEFAULT_DELEGATION_TOOL_NAMES, ka as evaluateMinimumHostVersion, ki as inspectTargetHostGraph, kn as ancestorConstraintForBinding, kr as clauseIsGoverned, kt as DEFAULT_RECOVERY_CHAR_BUDGET, l as parseGitCommandManifest, la as DEFAULT_HOST_LOCK, li as validateManifest, ln as CONTROL_RECORD_PREFIX, lr as removalIsComplete, lt as bindProofV2ToProjection, m as firstStepGuidance, ma as bindExecutableIdentity, mi as sanitizeUrl, mn as classifyCompletionClaim, mr as environmentDefaultRepositoryTarget, mt as proofDigest, n as GIT_COMMAND_MANIFEST_IDS, na as qualifyHostTrust, ni as reportingHeadGoverns, nn as releaseCoverage, nr as relevantEvidence, nt as PROOF_CAPABILITY_MATRIX, o as createGitPrestateEnvelope, oa as ACTIVE_HOST_COHORT_IDS, oi as statefulActionsOfScope, on as evidenceCoverage, or as capabilityConsequence, ot as PROOF_PROTOCOL_VERSION, p as claimedBatchHasRealRootInput, pa as HOST_COHORTS, pi as sanitizeClauseText, pn as assessmentOutcomePredicate, pr as classifyClause, pt as proofCapabilityReport, q as withDurability, qa as requestedTargetMatchesResolved, qi as readAsarIndex, qn as replayRebindResult, qr as legacyQuestionReadingIsInformational, qt as RELEASE_OPERATIONS, r as GIT_COMMAND_TEMPLATES, ra as registryArchiveFiles, ri as restatedContentOf, rn as releasePreEffectDecision, rr as DEPENDENCY_FREE_ONLY_CONDITION, rt as PROOF_KINDS, s as executeRevalidatedGitEffect, sa as ACTIVE_HOST_LAUNCHER_VERSION, si as verbIsNegated, sn as evidenceMatchesItem, sr as capabilityFactOf, st as PROOF_PROTOCOL_VERSION_V2, t as RC020_RC1_HOST_PACKAGES, ta as parseHostTrust, ti as questionHeadsClause, tn as releaseContractFor, tr as nativeFileTwoRole, tt as certifyCheckpoint, u as revalidateGitPrestate, ua as EXPECTED_HOST_PACKAGES, ui as canonicalizePath, un as NO_PROGRESS_RECORD_PREFIX, ur as removalIsPartiallyKnown, ut as canonicalProjection, v as projectSessionCoreV2, va as evaluateHostCapability, vi as auditedDefaultWorkdirHost, vn as decisionBoundaryKey, vr as isInformationalMessage, vt as proofOperationMatches, w as SESSION_EVENT_ENVELOPE_INVALID, wa as LATEST_TESTED_HOST_VERSION, wi as evaluateConfiguredHostLock, wn as progressFingerprint, wr as GRANTED_QUALIFICATION, wt as validateProofManifest, x as captureHostWorkdir, xa as hostVersionFromPackages, xi as auditedHostImplementation, xn as latestAssistantText, xr as npmEscapedPackageName, xt as scopeCoverageDigest, y as sessionCoreSnapshot, ya as evaluateHostLock, yi as auditedDefaultWorkdirProvider, yn as isRootPauseRequest, yr as segmentClauses, yt as proofV2Rejection, z as NATIVE_GIT_ROOT_PARENT_OID, za as STOP_PROTOCOL_VERSION, zi as revalidateDesktopCoreLock, zn as currentContractDigest, zr as isExecutableItem, zt as recoveryTitle } from "./domain-DKqyOtgY.js";
 import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { basename, delimiter, dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { createHash } from "node:crypto";
-import { closeSync, constants, existsSync, fchmodSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, unlinkSync, writeSync } from "node:fs";
+import { createHash, randomBytes } from "node:crypto";
+import { closeSync, constants, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, unlinkSync, writeSync } from "node:fs";
 import { gunzip } from "node:zlib";
 import { execFile } from "node:child_process";
-import { homedir, tmpdir } from "node:os";
+import { homedir, hostname, tmpdir } from "node:os";
 import { JobId } from "@deepseek-ai/dsh-jobs";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -18,7 +18,7 @@ import { SESSION_FORMAT_VERSION, Session, SessionId } from "@deepseek-ai/dsh-ses
 function createRebindTool(getProjection, prepare) {
 	return defineTool({
 		name: "context_guard_rebind",
-		description: "Propose an exact source-clause partition, query, or withdraw it. Only a durable root-user confirmation can replace the contract; no execution authority is added.",
+		description: "Propose, query or withdraw an exact source-clause partition. Replacement requires durable root-user confirmation; adds no execution authority.",
 		parameters: {
 			operation: {
 				type: "string",
@@ -64,6 +64,64 @@ function createRebindTool(getProjection, prepare) {
 	});
 }
 
+//#endregion
+//#region src/tools/checkpoint-feedback.ts
+/** Request-local display evidence. Never marks items passed or mints a certificate. */
+function signingFeedback(p, bindings, result, selected) {
+	if (result.checkpoint || result.status !== "incomplete" || p.integrity !== "valid" || p.hostStatus !== "supported") return void 0;
+	const scope = new Set([...certificateClosure(p).itemIds, ...needsReviewObligations(p).map((item) => item.id)]);
+	const groups = /* @__PURE__ */ new Map();
+	for (const binding of bindings) {
+		const bucket = groups.get(binding.itemId);
+		if (bucket) bucket.push(binding);
+		else groups.set(binding.itemId, [binding]);
+	}
+	const core = confirmedV6CoreDiagnostic(p);
+	const matched = /* @__PURE__ */ new Set();
+	for (const [id, group] of groups) {
+		const item = p.items.get(id), binding = group[0];
+		if (core?.openIds.includes(id) || !item || !scope.has(id) || group.length !== 1 || item.legacyFlags?.length || item.needsReview || item.waitAuthorization || item.authorityDisposition === "conditional_wait" || item.actionPlan?.length || ancestorConstraintForBinding(p, item, binding.resolvedTarget) || result.rejectedBindings.some((row) => row.itemId === id) || !bindingIndividuallyAccepted(p, item, binding)) continue;
+		matched.add(id);
+	}
+	const remaining = new Set([...scope].filter((id) => !matched.has(id)));
+	if (core) for (const id of core.openIds) remaining.add(id);
+	for (const row of result.rejectedBindings) if (row.itemId !== "*") remaining.add(row.itemId);
+	const reasons = /* @__PURE__ */ new Map();
+	const sample = [];
+	const firstByReason = /* @__PURE__ */ new Set();
+	for (const id of remaining) {
+		const reason = core?.predicates[id] ?? "binding_not_matched";
+		reasons.set(reason, (reasons.get(reason) ?? 0) + 1);
+		if (sample.length < 4 && !firstByReason.has(reason)) {
+			sample.push({
+				id: id.length <= 128 ? id : `sha256:${sha256(id)}`,
+				reason_code: reason.slice(0, 160)
+			});
+			firstByReason.add(reason);
+		}
+	}
+	const unresolvedGlobal = result.rejectedBindings.some((row) => row.itemId === "*" && (row.reasonCode !== "current_closure_unmet" || core === void 0 || core.openIds.length === 0));
+	return {
+		matched,
+		remaining,
+		summary: {
+			scope: "whole_contract",
+			scope_total: scope.size,
+			matched_binding_total: matched.size,
+			remaining_total: remaining.size,
+			remaining_sample: sample,
+			remaining_reason_counts: [...reasons].slice(0, 8).map(([reason_code, count]) => ({
+				reason_code,
+				count
+			})),
+			folded_reason_count: Math.max(0, reasons.size - 8),
+			filtered_out_total: selected?.length ? [...remaining].filter((id) => !selected.includes(id)).length : 0,
+			unresolved_global: unresolvedGlobal,
+			next_step: matched.size ? "Retain matched bindings; do not repeat their effects or resubmit the same partial checkpoint. Resolve remaining closure/proof blockers. Omit item_ids and cursor to inspect the whole scope; keep bindings and filters unchanged when continuing a cursor." : "Resolve the remaining closure/proof blockers. Omit item_ids and cursor to inspect the whole scope; keep bindings and filters unchanged when continuing a cursor."
+		}
+	};
+}
+
 //#endregion
 //#region src/tools/cursor-identity.ts
 /** The Session observation watermark advances when a read-only Guard tool
@@ -134,7 +192,7 @@ function checkpointPage(p, query, full) {
 	if (item_ids?.length) {
 		rows.open_items = rows.open_items.filter((row) => item_ids.includes(String(row.id)));
 		rows.active_constraints = rows.active_constraints.filter((row) => item_ids.includes(String(row.id)));
-		rows.rejected_bindings = rows.rejected_bindings.filter((row) => item_ids.includes(String(row.item_id)));
+		rows.rejected_bindings = rows.rejected_bindings.filter((row) => row.item_id === "*" || item_ids.includes(String(row.item_id)));
 	}
 	if (evidence_ids?.length) rows.available_evidence = rows.available_evidence.filter((row) => evidence_ids.includes(String(row.id)));
 	if (lane && offset > rows[lane].length) return invalid("invalid_cursor_offset");
@@ -156,7 +214,11 @@ function checkpointPage(p, query, full) {
 			detail_offset,
 			detail_chunk: chunk,
 			next_detail_offset: detail_offset + chunk.length < data.length ? detail_offset + chunk.length : null,
-			snapshot: identity
+			snapshot: identity,
+			...full.signing_feedback ? {
+				blockers: full.signing_feedback,
+				certificate_status: "not_issued"
+			} : {}
 		};
 	}
 	const reasons = /* @__PURE__ */ new Map();
@@ -189,6 +251,10 @@ function checkpointPage(p, query, full) {
 		output.current_action_total = (full.current_actions ?? []).length;
 		output.certificate_status = "not_requested";
 	}
+	if (full.signing_feedback) {
+		Object.assign(output.blockers, full.signing_feedback);
+		output.certificate_status = "not_issued";
+	}
 	if (full.certificate) output.certificate = full.certificate;
 	if (full.proof_state) output.proof_state = full.proof_state;
 	const pagination = {
@@ -215,9 +281,16 @@ function checkpointPage(p, query, full) {
 			revision: row.revision,
 			kind: row.kind,
 			semantic_action: row.semantic_action,
+			status: row.status,
+			binding_status: row.binding_status,
 			next_step: typeof row.next_step === "string" ? row.next_step.slice(0, 240) : void 0,
 			adapter_disposition: row.adapter_disposition,
 			...row.binding_template !== void 0 ? { binding_template: row.binding_template } : {},
+			...row.expected_transition_template !== void 0 ? {
+				expected_transition_template: row.expected_transition_template,
+				binding_template_unavailable: row.binding_template_unavailable,
+				binding_guidance: row.binding_guidance
+			} : {},
 			omitted: true,
 			detail_id: lookup(String(row.id ?? row.item_id))
 		};
@@ -371,12 +444,22 @@ function bindingTemplate(projection, item) {
 		}
 	}
 }
-function openItemForTool(projection, item) {
+function openItemForTool(projection, item, requestMatched = false, rejection) {
 	const action = item.semanticAction ?? "generic_run";
 	const spec = ACTION_MANIFEST.actions[action];
-	const template = bindingTemplate(projection, item);
 	const diagnosis = deriveItemDiagnosis(projection, item);
+	const evidenceGap = diagnosis.reason_code === "missing_evidence";
+	const matched = requestMatched && evidenceGap;
+	const bindingRejection = evidenceGap ? rejection : void 0;
+	const template = matched || !evidenceGap ? void 0 : bindingTemplate(projection, item);
+	const candidateHints = !matched && evidenceGap && !template && diagnosis.capability.actionSupported && spec.evidenceProducer === "supported" && !isStatefulAction(action) && !["generic_run", "inspect_remote_updates"].includes(action);
 	const compact = itemDiagnosis(projection, item);
+	const effectCandidates = !candidateHints ? [] : [...projection.evidence.values()].filter((e) => e.epoch === projection.epoch && e.outcome === "success" && e.semanticAction === action && (e.evidenceRole ?? "effect") === "effect").sort((a, b) => b.toolResultSeq - a.toolResultSeq).slice(0, 3).map((e) => ({
+		evidence_id: e.id,
+		resolved_target: targetForTool(e.resolvedTarget),
+		matches_captured_target: sameTuple(item.requestedTarget, pick$1(e.resolvedTarget ?? {}, Object.keys(item.requestedTarget ?? {})))
+	}));
+	const targetDiscrepancy = effectCandidates.length > 0 && effectCandidates.every((e) => !e.matches_captured_target);
 	return {
 		id: item.id,
 		revision: item.revision,
@@ -389,14 +472,15 @@ function openItemForTool(projection, item) {
 		semantic_action: action,
 		requested_target: targetForTool(item.requestedTarget),
 		certifiable: compact.certifiable,
-		reason_code: diagnosis.reason_code,
-		next_step: diagnosis.capability.remedy === "await_root_input" ? (diagnosis.next_action.resume_condition ?? capabilityRemedyPhrase(diagnosis.capability.remedy)).slice(0, 240) : capabilityRemedyPhrase(diagnosis.capability.remedy),
+		reason_code: matched ? "binding_matched_not_certified" : bindingRejection?.reasonCode ?? (targetDiscrepancy ? "successful_effect_target_mismatch" : diagnosis.reason_code),
+		...matched ? { binding_status: "matched_not_certified" } : {},
+		next_step: matched ? "This request binding matches individually; the item is still pending and no certificate was issued. Retain it while resolving the whole-contract blockers; do not repeat the effect or collect the same evidence again." : bindingRejection && template ? "Correct the rejected binding using binding_template unchanged; retain the successful effect and do not rerun it merely to repair binding syntax." : bindingRejection ? `${bindingRejection.reason.slice(0, 150)}. Inspect captured target and successful evidence before another action.` : targetDiscrepancy ? "Successful effect candidates target a different scope. Retain them and resolve the captured/effect target discrepancy against the root instruction before another action." : diagnosis.capability.remedy === "await_root_input" ? (diagnosis.next_action.resume_condition ?? capabilityRemedyPhrase(diagnosis.capability.remedy)).slice(0, 240) : capabilityRemedyPhrase(diagnosis.capability.remedy),
 		...item.targetCaptureStatus ? { target_capture_status: item.targetCaptureStatus } : {},
 		capability: {
 			action_supported: diagnosis.capability.actionSupported,
 			certifiable: diagnosis.capability.certifiable,
 			gap: diagnosis.capability.gap,
-			remedy: diagnosis.capability.remedy
+			remedy: matched ? "none" : diagnosis.capability.remedy
 		},
 		producer_disposition: ACTION_MANIFEST.actions[action].evidenceProducer,
 		...item.targetCaptureReasonCode ? { target_capture_reason_code: item.targetCaptureReasonCode } : {},
@@ -408,7 +492,18 @@ function openItemForTool(projection, item) {
 			observed_state_keys: spec.observedStateKeys,
 			pred_params_kind: "inline"
 		},
-		...template ? { binding_template: template } : {}
+		...template ? { binding_template: template } : {},
+		...candidateHints ? {
+			expected_transition_template: expectedTransitionForTool({
+				predicateId: spec.predicateId,
+				version: 1,
+				predParamsKind: "inline",
+				parameters: expectedParameters(action, {}, {})
+			}),
+			binding_template_unavailable: "no_matching_successful_effect",
+			successful_effect_candidates: effectCandidates,
+			binding_guidance: "Retain successful effects. Resolve any captured/effect target discrepancy against the root instruction before further execution; do not guess predicate parameters or rerun a successful test to repair binding syntax."
+		} : {}
 	};
 }
 function createCheckpointTool(getProjection, onRejected, prepare = async () => true, revalidate = () => {}) {
@@ -589,7 +684,7 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 					current_action_total: { type: "integer" },
 					certificate_status: {
 						type: "string",
-						enum: ["not_requested"]
+						enum: ["not_requested", "not_issued"]
 					},
 					contract_revision: { type: "integer" },
 					active_constraints: {
@@ -907,12 +1002,17 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 					})) } : {}
 				} } : {}
 			}));
+			const feedback = signingFeedback(projection, bindings, result, args.item_ids);
 			return checkpointPage(projection, args, {
+				...feedback ? {
+					signing_feedback: feedback.summary,
+					certificate_status: "not_issued"
+				} : {},
 				status: result.status,
 				proof_state: proofState,
 				contract_revision: result.contractRevision,
-				blocking_total: result.openItems.length,
-				open_items: (args.item_ids?.length ? args.item_ids : result.openItems).map((id) => projection.items.get(id)).filter((item) => Boolean(item)).sort((a, b) => b.revision - a.revision || a.id.localeCompare(b.id)).map((item) => openItemForTool(projection, item)),
+				blocking_total: feedback ? Math.max(feedback.remaining.size, feedback.summary.unresolved_global ? 1 : 0) : result.openItems.length,
+				open_items: (args.item_ids?.length ? args.item_ids : result.openItems).map((id) => projection.items.get(id)).filter((item) => Boolean(item)).sort((a, b) => b.revision - a.revision || a.id.localeCompare(b.id)).map((item) => openItemForTool(projection, item, feedback?.matched.has(item.id), result.rejectedBindings.find((row) => row.itemId === item.id))),
 				active_constraints: [...projection.items.values()].filter((item) => item.kind === "prohibition" && item.status === "pending").map((item) => openItemForTool(projection, item)),
 				available_evidence,
 				available_qualifications: availableBoundaryQualifications(projection).map((row) => ({
@@ -1402,7 +1502,7 @@ function discoveryItemIds(p) {
 function createPrepareTool(options) {
 	return defineTool({
 		name: "context_guard_prepare",
-		description: "Read-only diagnosis of open contract items. Ordinary changes use native host tools and observed facts; this tool never grants execution permission. Omit item_id for a paginated item list.",
+		description: "Read-only contract diagnosis; grants no permission. Use host tools for ordinary work. Omit item_id to list items; page_cursor continues.",
 		parameters: {
 			item_id: { type: "string" },
 			item_revision: { type: "number" },
@@ -1796,7 +1896,7 @@ function itemExtent(spans) {
 function createInterpretTool(options) {
 	return defineTool({
 		name: "context_guard_interpret",
-		description: "Record the interpretation of one unresolved obligation: pass the item ID from context_guard_prepare plus the partition of its input spans you read as information (information_spans) and the sub-spans you could not resolve (unknown_spans); for an attached asset, the partition is unnecessary. Contract bookkeeping only — performs no action, grants no authority. Information sub-spans close when this turn's host-confirmed final answer is delivered; unknown sub-spans remain pending obligations. Correctness is never certified.",
+		description: "Record unresolved input: use an item ID from context_guard_prepare and partition information_spans/unknown_spans (unneeded for attached assets). Bookkeeping only; no action or authority. Information closes on this turn's host-confirmed final answer; unknown stays pending. Correctness stays uncertified.",
 		parameters: {
 			item_id: {
 				type: "string",
@@ -3043,7 +3143,7 @@ function createActionTool(options = {}) {
 	const roots = normalizedRoots(options);
 	return defineTool({
 		name: ACTION_TOOL,
-		description: "Compatibility entry for older sessions. Ordinary mutations return a migration diagnosis without side effects; only an explicitly adopted registry publication can use the controlled release path.",
+		description: "Legacy compatibility: ordinary mutations return migration diagnostics without effects. Only explicitly adopted registry publication uses the controlled path.",
 		parameters: {
 			semantic_action: {
 				type: "string",
@@ -3607,7 +3707,7 @@ const RELEASE_TOOL = "context_guard_release";
 function createReleaseTool(options) {
 	return defineTool({
 		name: RELEASE_TOOL,
-		description: "Read the explicit release state, or reconcile a release attempt whose effect was unknown by reading back the external identity. This tool never re-sends a release.",
+		description: "Read release state or reconcile an unknown effect through external identity readback. Never re-sends a release.",
 		parameters: {
 			operation: {
 				type: "string",
@@ -3744,7 +3844,7 @@ const record = (value) => value !== null && typeof value === "object" && !Array.
 function createNativeFileObserver(host) {
 	return defineTool({
 		name: "context_guard_observe_file",
-		description: "Read back the exact UTF-8 file after an already persisted native write or edit. This tool does not modify files or authorize the edit.",
+		description: "Read back exact UTF-8 bytes after a persisted native write/edit. Does not modify files or authorize edits.",
 		parameters: { effect_call_id: {
 			type: "string",
 			required: true
@@ -4013,14 +4113,19 @@ function createNativeGitObserver(host) {
 			const message = record(result.message);
 			const source = record(message?.source);
 			if (source?.kind !== "tool" || source.callId !== args.effect_call_id) return missing("native_effect_missing");
-			const resultStatus = persistedToolResultStatus(result, args.effect_call_id);
-			if (resultStatus !== "clean") return missing(resultStatus === "failure" ? "native_effect_failed" : "native_effect_untrusted");
 			let effectArgs;
 			try {
 				effectArgs = record(JSON.parse(String(call.arguments)));
 			} catch {
 				return missing("native_effect_arguments_invalid");
 			}
+			const resultStatus = persistedToolResultStatus(result, args.effect_call_id);
+			if (resultStatus !== "clean") return missing(resultStatus === "failure" ? "native_effect_failed" : "native_effect_untrusted");
+			const readbackOutcome = shellReadbackOutcome(call.name, effectArgs ?? {}, {
+				meta: result.meta,
+				textContent: Array.isArray(message?.content) ? extractTextContent(message.content) : ""
+			});
+			if (readbackOutcome !== "success") return missing(readbackOutcome === "failure" ? "native_effect_failed" : "native_effect_untrusted");
 			const command = effectArgs?.command;
 			const repository = effectArgs?.workdir;
 			if (typeof command !== "string" || typeof repository !== "string" || !repository) return missing("native_git_target_missing");
@@ -4031,6 +4136,7 @@ function createNativeGitObserver(host) {
 			if (action !== "commit" && action !== "push") return missing("native_git_command_unsupported");
 			const gitAction = action;
 			const output = Array.isArray(message?.content) ? extractTextContent(message.content) : "";
+			const combinedSignal = typeof AbortSignal.any === "function" ? AbortSignal.any([exec.signal, AbortSignal.timeout(2e4)]) : exec.signal ?? AbortSignal.timeout(2e4);
 			const git$1 = async (...query) => (await execFileAsync("git", [
 				"-C",
 				repository,
@@ -4038,7 +4144,8 @@ function createNativeGitObserver(host) {
 			], {
 				encoding: "utf8",
 				timeout: 5e3,
-				maxBuffer: 1024 * 1024
+				maxBuffer: 1024 * 1024,
+				signal: combinedSignal
 			})).stdout.trim();
 			try {
 				const top = await git$1("rev-parse", "--show-toplevel");
@@ -4049,8 +4156,17 @@ function createNativeGitObserver(host) {
 				if (!/^[0-9a-f]{40,64}$/.test(postOid)) return missing("native_git_readback_unavailable");
 				if (action === "commit") {
 					if (argv.length !== 4 || argv[2] !== "-m" || !argv[3] || !(/* @__PURE__ */ new RegExp(`\\b${postOid.slice(0, 7)}[0-9a-f]*\\b`)).test(output)) return missing("native_git_effect_output_unbound");
-					const parentOid = await git$1("rev-parse", "HEAD^");
-					const treeOid = await git$1("rev-parse", "HEAD^{tree}");
+					const headerLines = (await git$1("--no-replace-objects", "cat-file", "commit", postOid)).split("\n");
+					const headerEnd = headerLines.indexOf("");
+					const header = (headerEnd >= 0 ? headerLines.slice(0, headerEnd) : headerLines).filter(Boolean);
+					const treeLine = header.find((line) => line.startsWith("tree "));
+					const parentLines = header.filter((line) => line.startsWith("parent "));
+					const objectOid = /^[0-9a-f]{40,64}$/.test(treeLine?.slice(5).trim() ?? "") ? treeLine.slice(5).trim() : void 0;
+					if (!treeLine || objectOid === void 0) return missing("native_git_readback_unavailable");
+					const treeOid = objectOid;
+					const parents = parentLines.map((line) => line.slice(7).trim());
+					if (parents.some((oid$1) => !/^[0-9a-f]{40,64}$/.test(oid$1))) return missing("native_git_readback_unavailable");
+					const parentOid = parents.length === 0 ? NATIVE_GIT_ROOT_PARENT_OID : parents[0];
 					return {
 						status: "observed",
 						reason_code: "git_commit_observed",
@@ -5501,6 +5617,7 @@ const Config = Schema.object({
 	hostLockRuntimeRoot: Schema.string(),
 	hostLockProfileRoot: Schema.string(),
 	hostLockTrust: Schema.string(),
+	hostLockDesktopDigest: Schema.string(),
 	hostLockPackages: Schema.array(Schema.object({
 		name: Schema.string().required(),
 		version: Schema.string(),
@@ -5529,7 +5646,7 @@ function resolveConfig(config) {
 		});
 	}
 	if (config.hostLockPlatform !== void 0 && config.hostLockPlatform !== "posix" && config.hostLockPlatform !== "windows") throw new TypeError("hostLockPlatform must be \"posix\" or \"windows\"");
-	if (config.hostLockProfile !== void 0 && config.hostLockProfile !== "headless" && config.hostLockProfile !== "web") throw new TypeError("hostLockProfile must be \"headless\" or \"web\"");
+	if (config.hostLockProfile !== void 0 && config.hostLockProfile !== "headless" && config.hostLockProfile !== "web" && config.hostLockProfile !== "desktop") throw new TypeError("hostLockProfile must be \"headless\", \"web\", or \"desktop\"");
 	const hasHostRows = hostLockPackages !== void 0;
 	if (hasHostRows !== (config.hostLockPlatform !== void 0) || hasHostRows !== (config.hostLockProfile !== void 0)) throw new TypeError("hostLockPackages, hostLockPlatform, and hostLockProfile must be injected together");
 	for (const key of [
@@ -5538,7 +5655,9 @@ function resolveConfig(config) {
 		"hostLockProfileRoot",
 		"hostLockTrust"
 	]) if (config[key] !== void 0 && (typeof config[key] !== "string" || !config[key])) throw new TypeError(`${key} must be a non-empty string`);
+	if (config.hostLockDesktopDigest !== void 0 && (config.hostLockProfile !== "desktop" || typeof config.hostLockDesktopDigest !== "string" || !/^[a-f0-9]{64}$/.test(config.hostLockDesktopDigest))) throw new TypeError("hostLockDesktopDigest must be an injected Desktop SHA-256");
 	return {
+		...typeof config.hostLockDesktopDigest === "string" ? { hostLockDesktopDigest: config.hostLockDesktopDigest } : {},
 		...typeof config.hostLockTrust === "string" ? { hostLockTrust: config.hostLockTrust } : {},
 		...typeof config.hostLockPolicy === "string" ? { hostLockPolicy: config.hostLockPolicy } : {},
 		...typeof config.hostLockRuntimeRoot === "string" ? { hostLockRuntimeRoot: config.hostLockRuntimeRoot } : {},
@@ -5580,7 +5699,6 @@ const contextDigest = (context, root) => sha256(canonical({
 }));
 const ledgerPath = (root, context) => join(root, `${sessionDigest(context.sessionId)}.jsonl`);
 const anchorPath = (root) => join(root, "session-anchors.v1.jsonl");
-const rootLockPath = (root) => join(root, ".writer.lock");
 const privateLedgerContractDigest = (contract) => {
 	if (!contract || typeof contract !== "object" || Array.isArray(contract)) return sha256(canonical(contract));
 	const { revokedAtSeq: _mutableRevocation,...immutable } = contract;
@@ -5603,14 +5721,23 @@ function ensureRoot(root) {
 	if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("private_ledger_root_unsafe");
 }
 function openRegular(path, flags, mode = 384) {
+	try {
+		const entry = lstatSync(path);
+		if (!entry.isFile() || entry.isSymbolicLink()) throw new Error("private_ledger_file_unsafe");
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
 	const fd = openSync(path, flags | (process.platform === "win32" ? 0 : constants.O_NOFOLLOW), mode);
-	const stat = fstatSync(fd);
-	if (!stat.isFile()) {
+	try {
+		const stat = fstatSync(fd);
+		const entry = lstatSync(path);
+		if (!stat.isFile() || !entry.isFile() || entry.isSymbolicLink() || stat.dev !== entry.dev || stat.ino !== entry.ino) throw new Error("private_ledger_file_unsafe");
+		if (process.platform !== "win32" && (stat.mode & 63) !== 0) fchmodSync(fd, 384);
+		return fd;
+	} catch (error) {
 		closeSync(fd);
-		throw new Error("private_ledger_file_unsafe");
+		throw error;
 	}
-	if (process.platform !== "win32" && (stat.mode & 63) !== 0) fchmodSync(fd, 384);
-	return fd;
 }
 function writeAll(fd, text) {
 	const bytes = Buffer.from(text);
@@ -5656,6 +5783,369 @@ function readAnchors(root) {
 	}
 	return anchors;
 }
+/**
+* The one full ledger read+chain-verify, shared by the read and append paths
+* (CG-083-PERF05: an append used to re-read the anchors AND the whole ledger
+* after already reading the anchors under the lock). Callers must already
+* hold the writer lock or accept the unlocked-read race the public API had.
+* Returns `undefined` for "ledger file missing" so callers can distinguish
+* the anchored-but-missing (damaged) case from an empty ledger.
+*/
+function readVerifiedLedgerRecords(root, context, session, expectedContext) {
+	const path = ledgerPath(root, context);
+	if (!existsSync(path)) return void 0;
+	const fd = openRegular(path, constants.O_RDONLY);
+	let raw;
+	try {
+		raw = readFileSync(fd, "utf8");
+	} finally {
+		closeSync(fd);
+	}
+	if (raw && !raw.endsWith("\n")) return void 0;
+	const records = [];
+	let prior = null;
+	for (const [index, line] of raw.split("\n").filter(Boolean).entries()) {
+		const value = JSON.parse(line);
+		const { record_sha256,...unsigned } = value;
+		if (value.version !== 1 || value.session_sha256 !== session || value.context_sha256 !== expectedContext || value.position !== index + 1 || value.prior_sha256 !== prior || ![
+			"release_reservation",
+			"release_settlement",
+			"restart_intent"
+		].includes(value.kind) || !value.payload || typeof value.payload !== "object" || Array.isArray(value.payload) || record_sha256 !== digestRecord(unsigned)) return void 0;
+		records.push(value);
+		prior = record_sha256;
+	}
+	return records;
+}
+/**
+* CG-083-F1 (revision 3): arbitration-log writer lock with optimistic
+* concurrency control. See docs/WRITER_LOCK_PROTOCOL.md "Revision 3".
+*
+* All authority decisions are records appended to `arbitration.log` (atomicity
+* assumptions A1/A2 in the doc). A claim carries `prev` — the holder nonce the
+* claimant observed — and the deterministic replay grants it only if the
+* current holder at its log position equals `prev`. Recovery appends
+* `evict {prev: deadNonce}` after an ESRCH probe; a delayed recoverer's record
+* is adjudicated against the CURRENT holder and simply has no effect when the
+* holder changed (L1/L2 structurally impossible: nothing is ever deleted from
+* or done to a pathname on the basis of an older observation).
+*
+* Bidirectional v2 upgrade barrier (L3): the v3 critical section also holds
+* the v2-shaped root `.writer.lock` (O_EXCL, version-2-shaped owner record).
+* A live v2 writer refuses (file exists); v3 refuses while a live/unknown v2
+* record exists; a v2 record whose pid answers ESRCH is removed by name (v2
+* has no self-recovery) and the migration proceeds.
+*/
+const ARBITRATION_NAME = "arbitration.log";
+const LEGACY_V2_LOCK_NAME = ".writer.lock";
+const PENDING_PREFIX = "pending.";
+const LOG_COMPACTION_RECORDS = 8192;
+function arbitrationPath(root) {
+	return join(root, ARBITRATION_NAME);
+}
+function legacyV2Path(root) {
+	return join(root, LEGACY_V2_LOCK_NAME);
+}
+/**
+* Parse the log (docs/WRITER_LOCK_PROTOCOL.md Revision 3.1, correction 3).
+* Unparseable lines — torn tails from a crash mid-append — are SKIPPED: they
+* never took effect, so skipping revokes nothing, and later complete records
+* stay visible (there is no truncation anywhere in the protocol, so a
+* truncate-and-revive race cannot exist). A final line without a trailing
+* newline is still replayed when it parses: it was fully written.
+*/
+function parseArbitration(root) {
+	let raw;
+	try {
+		raw = readFileSync(arbitrationPath(root), "utf8");
+	} catch {
+		return [];
+	}
+	const records = [];
+	for (const line of raw.split("\n")) {
+		if (line === "") continue;
+		try {
+			const value = JSON.parse(line);
+			if (value && value.v === 3 && (value.op === "claim" || value.op === "release" || value.op === "evict") && typeof value.nonce === "string" && value.nonce.length === 32 && typeof value.pid === "number" && Number.isSafeInteger(value.pid) && value.pid > 0 && typeof value.hostname === "string" && typeof value.created_at_epoch_ms === "number" && (value.prev === null || typeof value.prev === "string")) records.push(value);
+		} catch {}
+	}
+	return records;
+}
+/**
+* Deterministic replay (docs/WRITER_LOCK_PROTOCOL.md Revision 3.1). A claim
+* is effective ONLY when the slot is empty: a claim recorded while another
+* holder is current (e.g. one whose barrier was stolen on a stale legacy
+* observation) is stored but INEFFECTIVE, and the claimant exits on its
+* read-back. Release/evict take effect only for the current holder nonce.
+*/
+function replayHolder(records) {
+	let holder = null;
+	for (const record$2 of records) {
+		const isHolder = holder !== null && holder.nonce === record$2.prev;
+		if (record$2.op === "claim") {
+			if (holder === null) holder = {
+				nonce: record$2.nonce,
+				pid: record$2.pid,
+				hostname: record$2.hostname,
+				created_at_epoch_ms: record$2.created_at_epoch_ms
+			};
+		} else if (record$2.op === "release" || record$2.op === "evict") {
+			if (isHolder) holder = null;
+		}
+	}
+	return holder;
+}
+function readHolder(root) {
+	return replayHolder(parseArbitration(root));
+}
+/** Only ESRCH proves a recorded owner is gone; any other answer refuses. */
+function processExists(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code !== "ESRCH";
+	}
+}
+function unlinkIfExists(path) {
+	try {
+		unlinkSync(path);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+}
+function appendArbitration(root, record$2) {
+	let needsNewline = false;
+	try {
+		const raw = readFileSync(arbitrationPath(root), "utf8");
+		needsNewline = raw.length > 0 && !raw.endsWith("\n");
+	} catch {
+		needsNewline = false;
+	}
+	const fd = openRegular(arbitrationPath(root), constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND, 384);
+	try {
+		writeAll(fd, `${needsNewline ? "\n" : ""}${canonical(record$2)}\n`);
+		fsyncSync(fd);
+	} finally {
+		closeSync(fd);
+	}
+}
+function readLegacyV2(root) {
+	let raw;
+	try {
+		raw = readFileSync(legacyV2Path(root), "utf8");
+	} catch {
+		return;
+	}
+	if (!raw.trim()) return "legacy";
+	try {
+		const value = JSON.parse(raw);
+		if (value && (value.version === 2 || value.version === 3) && typeof value.nonce === "string" && (value.nonce.length === 32 || value.version === 2) && typeof value.pid === "number" && Number.isSafeInteger(value.pid) && value.pid > 0 && typeof value.hostname === "string" && typeof value.created_at_epoch_ms === "number") return value;
+	} catch {}
+	return "legacy";
+}
+function pendingPath(root, nonce) {
+	return join(root, `${PENDING_PREFIX}${nonce}.json`);
+}
+function removeOwnPending(root, nonce) {
+	unlinkIfExists(pendingPath(root, nonce));
+}
+function readRecord(path) {
+	let raw;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch {
+		return;
+	}
+	if (!raw.trim()) return "legacy";
+	try {
+		const value = JSON.parse(raw);
+		if (value && (value.version === 2 || value.version === 3) && typeof value.nonce === "string" && (value.nonce.length === 32 || value.version === 2) && typeof value.pid === "number" && Number.isSafeInteger(value.pid) && value.pid > 0 && typeof value.hostname === "string" && typeof value.created_at_epoch_ms === "number") return value;
+	} catch {}
+	return "legacy";
+}
+function recordIsProvablyDead(record$2) {
+	return record$2.hostname === hostname() && !processExists(record$2.pid);
+}
+/** Append one arbitration record (the ONLY mutation of the log). */
+function appendLog(root, op, nonce, prev) {
+	appendArbitration(root, {
+		v: 3,
+		op,
+		nonce,
+		prev,
+		pid: process.pid,
+		hostname: hostname(),
+		created_at_epoch_ms: Date.now()
+	});
+}
+/**
+* Acquire the writer lock. Returns the held nonce, or undefined when refused
+* (live/unknown holder, v2 barrier, or a lost optimistic claim).
+*/
+/**
+* Admission (Revision 3.1 + 3.2). The v2-compat barrier is PUBLISHED
+* atomically: the writer prepares `pending.<nonce>` with its complete owner
+* record (write + fsync) and hard-links it to `.writer.lock` — the barrier
+* therefore never exists with empty or partial content from this protocol
+* (S2 closed: a crash before the link leaves only an inert pending file, and
+* a crash after it leaves a complete record naming a provably dead owner,
+* both recoverable). A barrier left by a crashed V2 WRITER (empty, partial,
+* or complete-with-dead-pid) is classified separately: unknown owners refuse
+* with the documented manual migration; a complete same-host record whose
+* pid answers ESRCH is ADOPTED untouched. The log claim is effective only on
+* an empty slot and is verified by read-back.
+*/
+function acquireWriterLock(root) {
+	for (let attempt = 0; attempt < 16; attempt += 1) {
+		gcPendingFiles(root);
+		let barrierState = "absent";
+		const legacy = readLegacyV2(root);
+		if (legacy !== void 0) if (legacy === "legacy") barrierState = "unknown";
+		else if (legacy.hostname !== hostname()) barrierState = "unknown";
+		else if (processExists(legacy.pid)) barrierState = "live";
+		else barrierState = "adopted";
+		if (barrierState === "unknown" || barrierState === "live") return void 0;
+		const observed = readHolder(root);
+		if (observed !== null) {
+			if (observed.hostname !== hostname()) return void 0;
+			if (!processExists(observed.pid)) {
+				appendLog(root, "evict", randomBytes(16).toString("hex"), observed.nonce);
+				continue;
+			}
+			return;
+		}
+		const nonce = randomBytes(16).toString("hex");
+		let ownedBarrier = false;
+		if (barrierState === "absent") {
+			if (!publishBarrier(root, nonce)) continue;
+			ownedBarrier = true;
+		}
+		appendLog(root, "claim", nonce, null);
+		const holder = readHolder(root);
+		if (holder !== null && holder.nonce === nonce) {
+			compactLogInTenure(root, {
+				nonce,
+				ownedBarrier
+			});
+			return {
+				nonce,
+				ownedBarrier
+			};
+		}
+		if (ownedBarrier) {
+			const barrier = readLegacyV2(root);
+			if (barrier !== void 0 && barrier !== "legacy" && barrier.nonce === nonce) unlinkIfExists(legacyV2Path(root));
+		}
+		unlinkIfExists(pendingPath(root, nonce));
+		return;
+	}
+}
+/**
+* Publish the v2-compat barrier atomically (Revision 3.2): write the complete
+* owner record to a unique pending file (O_EXCL + fsync), then hard-link it
+* onto the barrier pathname. link() succeeds only when the barrier is absent,
+* and the linked content is the fully written record — the barrier can never
+* be observed empty or partial from this protocol. Returns false when the
+* barrier exists (caller re-classifies).
+*/
+function publishBarrier(root, nonce) {
+	const pending = pendingPath(root, nonce);
+	let fd;
+	try {
+		fd = openRegular(pending, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
+	} catch (error) {
+		if (error.code === "EEXIST") return false;
+		throw error;
+	}
+	try {
+		const record$2 = {
+			version: 2,
+			nonce,
+			pid: process.pid,
+			hostname: hostname(),
+			created_at_epoch_ms: Date.now()
+		};
+		writeAll(fd, `${canonical(record$2)}\n`);
+		fsyncSync(fd);
+	} finally {
+		try {
+			closeSync(fd);
+		} catch {}
+	}
+	try {
+		linkSync(pending, legacyV2Path(root));
+		return true;
+	} catch (error) {
+		unlinkIfExists(pending);
+		if (error.code === "EEXIST") return false;
+		throw error;
+	}
+}
+/** GC pending files whose embedded creator is provably dead (by name). */
+function gcPendingFiles(root) {
+	let entries;
+	try {
+		entries = readdirSync(root);
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		if (!entry.startsWith(PENDING_PREFIX)) continue;
+		const record$2 = readRecord(join(root, entry));
+		if (record$2 !== void 0 && record$2 !== "legacy" && recordIsProvablyDead(record$2)) unlinkIfExists(join(root, entry));
+	}
+}
+/**
+* Release (Revision 3.1): append the release record, then remove ONLY a
+* barrier this writer created in its own critical section (nonce-conditional).
+* An ADOPTED legacy barrier is left untouched — it keeps blocking v2 writers
+* until the documented manual migration removes it, and every later v3
+* admission re-adopts it.
+*/
+function releaseWriterLock(root, held) {
+	if (held === void 0) return;
+	appendLog(root, "release", held.nonce, held.nonce);
+	if (held.ownedBarrier) {
+		const barrier = readLegacyV2(root);
+		if (barrier !== void 0 && barrier !== "legacy" && barrier.nonce === held.nonce) unlinkIfExists(legacyV2Path(root));
+	}
+	removeOwnPending(root, held.nonce);
+}
+/** Compaction threshold; test-overridable via the internals hook. */
+let compactionRecordThreshold = LOG_COMPACTION_RECORDS;
+/**
+* Compaction (Revision 3.1, correction 4): performed ONLY by the current
+* holder inside its verified critical section. During a live holder's tenure
+* no concurrent record can be effective (claims need an empty slot; evicts
+* need a dead holder), so the rename window cannot drop an effective record:
+* the baseline re-installs the holder, and readers see the old or the new
+* file, both replaying to the same holder. State-equivalence is asserted by
+* the lock tests.
+*/
+function compactLogInTenure(root, held) {
+	if (parseArbitration(root).length <= compactionRecordThreshold) return;
+	const baseline = {
+		v: 3,
+		op: "claim",
+		nonce: held.nonce,
+		pid: process.pid,
+		hostname: hostname(),
+		created_at_epoch_ms: Date.now(),
+		prev: null
+	};
+	const tmp = join(root, `${ARBITRATION_NAME}.compact`);
+	const fd = openSync(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC, 384);
+	try {
+		writeAll(fd, `${canonical(baseline)}\n`);
+		fsyncSync(fd);
+	} finally {
+		closeSync(fd);
+	}
+	try {
+		renameSync(tmp, arbitrationPath(root));
+	} catch {}
+}
 function readPrivateLedger(root, input) {
 	if (!root) return {
 		records: [],
@@ -5683,46 +6173,24 @@ function readPrivateLedger(root, input) {
 			damaged: true,
 			anchored: true
 		};
-		const path = ledgerPath(root, context);
-		if (!existsSync(path)) return {
-			records: [],
-			damaged: anchored !== void 0,
-			anchored: anchored !== void 0
-		};
-		if (anchored === void 0) return {
-			records: [],
-			damaged: true,
-			anchored: false
-		};
-		const fd = openRegular(path, constants.O_RDONLY);
-		let raw;
-		try {
-			raw = readFileSync(fd, "utf8");
-		} finally {
-			closeSync(fd);
+		if (anchored === void 0) {
+			if (existsSync(ledgerPath(root, context))) return {
+				records: [],
+				damaged: true,
+				anchored: false
+			};
+			return {
+				records: [],
+				damaged: false,
+				anchored: false
+			};
 		}
-		if (raw && !raw.endsWith("\n")) return {
+		const records = readVerifiedLedgerRecords(root, context, session, expectedContext);
+		if (records === void 0) return {
 			records: [],
 			damaged: true,
 			anchored: true
 		};
-		const records = [];
-		let prior = null;
-		for (const [index, line] of raw.split("\n").filter(Boolean).entries()) {
-			const value = JSON.parse(line);
-			const { record_sha256,...unsigned } = value;
-			if (value.version !== 1 || value.session_sha256 !== session || value.context_sha256 !== expectedContext || value.position !== index + 1 || value.prior_sha256 !== prior || ![
-				"release_reservation",
-				"release_settlement",
-				"restart_intent"
-			].includes(value.kind) || !value.payload || typeof value.payload !== "object" || Array.isArray(value.payload) || record_sha256 !== digestRecord(unsigned)) return {
-				records: [],
-				damaged: true,
-				anchored: true
-			};
-			records.push(value);
-			prior = record_sha256;
-		}
 		return {
 			records,
 			damaged: false,
@@ -5743,7 +6211,8 @@ function initializePrivateLedger(root, input) {
 	try {
 		const context = normalizeContext(input);
 		ensureRoot(root);
-		lockFd = openRegular(rootLockPath(root), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL);
+		lockFd = acquireWriterLock(root);
+		if (lockFd === void 0) return false;
 		const session = sessionDigest(context.sessionId);
 		const expectedContext = contextDigest(context, root);
 		const anchored = readAnchors(root).get(session);
@@ -5774,14 +6243,7 @@ function initializePrivateLedger(root, input) {
 	} catch {
 		return false;
 	} finally {
-		if (lockFd !== void 0) {
-			try {
-				closeSync(lockFd);
-			} catch {}
-			try {
-				unlinkSync(rootLockPath(root));
-			} catch {}
-		}
+		releaseWriterLock(root, lockFd);
 	}
 }
 function appendPrivateLedger(root, input, kind, payload) {
@@ -5790,17 +6252,18 @@ function appendPrivateLedger(root, input, kind, payload) {
 	try {
 		const context = normalizeContext(input);
 		ensureRoot(root);
-		lockFd = openRegular(rootLockPath(root), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL);
+		lockFd = acquireWriterLock(root);
+		if (lockFd === void 0) return false;
 		const session = sessionDigest(context.sessionId);
 		const expectedContext = contextDigest(context, root);
 		const anchored = readAnchors(root).get(session);
 		if (anchored !== void 0 && anchored !== expectedContext) return false;
-		const snapshot$1 = anchored === void 0 ? {
-			records: [],
-			damaged: false
-		} : readPrivateLedger(root, context);
-		if (snapshot$1.damaged) return false;
-		if (anchored === void 0) {
+		let records = [];
+		if (anchored !== void 0) {
+			const verified = readVerifiedLedgerRecords(root, context, session, expectedContext);
+			if (verified === void 0) return false;
+			records = verified;
+		} else {
 			const unsignedAnchor = {
 				version: 1,
 				session_sha256: session,
@@ -5820,7 +6283,7 @@ function appendPrivateLedger(root, input, kind, payload) {
 		}
 		if (kind === "release_settlement") {
 			const settlement = normalizeSettlement(payload);
-			const reservation = settlement && [...snapshot$1.records].reverse().find((record$3) => record$3.kind === "release_reservation" && record$3.payload.contractId === settlement.contractId && record$3.payload.operation === settlement.operation && record$3.payload.callId === settlement.callId);
+			const reservation = settlement && [...records].reverse().find((record$3) => record$3.kind === "release_reservation" && record$3.payload.contractId === settlement.contractId && record$3.payload.operation === settlement.operation && record$3.payload.callId === settlement.callId);
 			if (!reservation) return false;
 			payload = {
 				...payload,
@@ -5833,8 +6296,8 @@ function appendPrivateLedger(root, input, kind, payload) {
 			version: 1,
 			session_sha256: session,
 			context_sha256: expectedContext,
-			position: snapshot$1.records.length + 1,
-			prior_sha256: snapshot$1.records.at(-1)?.record_sha256 ?? null,
+			position: records.length + 1,
+			prior_sha256: records.at(-1)?.record_sha256 ?? null,
 			kind,
 			payload
 		};
@@ -5854,14 +6317,7 @@ function appendPrivateLedger(root, input, kind, payload) {
 	} catch {
 		return false;
 	} finally {
-		if (lockFd !== void 0) {
-			try {
-				closeSync(lockFd);
-			} catch {}
-			try {
-				unlinkSync(rootLockPath(root));
-			} catch {}
-		}
+		releaseWriterLock(root, lockFd);
 	}
 }
 function applyPrivateLedger(projection, snapshot$1) {
@@ -6303,20 +6759,80 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 	let synchronizedOnce = false;
 	const continuationAttempts = projection.continuationAttempts;
 	const persistenceCorrectionAttempts = projection.persistenceCorrectionAttempts;
-	const rebuild = () => {
+	let refreshEpoch = 0;
+	let lastFullSync;
+	const sameSnapshotIdentity = (candidate, consumed) => {
+		if (candidate.length !== consumed.length) return false;
+		for (let index = 0; index < candidate.length; index += 1) if (candidate[index] !== consumed[index]) return false;
+		return true;
+	};
+	/**
+	* F2/R1: element-wise identity alone cannot protect the fast path when the
+	* session view hands out the SAME MUTABLE array (or mutably nested event
+	* objects): the saved reference compares equal to itself while its content
+	* drifts. The adapter only validates envelopes, not immutability, so the
+	* fast path is served ONLY for snapshots whose immutability is PROVABLE:
+	* every container in the snapshot is Object.isFrozen, checked recursively
+	* under a node budget. A snapshot that fails (or exhausts) the check is
+	* "not provable" and always takes the full rebuild — fail-closed, never
+	* cached. Passing results are remembered per array object: freezing is
+	* irreversible, so a previously proven snapshot cannot become mutable.
+	*/
+	const provenImmutableSnapshots = /* @__PURE__ */ new WeakSet();
+	const IMMUTABILITY_PROOF_NODE_BUDGET = 4e5;
+	/**
+	* F2 (round 3): freezing a container does NOT freeze its content when a
+	* property is an accessor — a frozen getter's return value follows its
+	* closure. Eligibility therefore requires every property to be an ordinary
+	* DATA descriptor whose value is itself provably immutable. Accessor
+	* descriptors (get/set) make the whole snapshot unprovable: full rebuild,
+	* never cached. The value of a data descriptor is read for the recursion
+	* only — a single read is not treated as a permanent immutability proof of
+	* anything mutable; only the descriptor SHAPE plus frozen containers are.
+	*/
+	const snapshotIsProvablyImmutable = (events) => {
+		if (provenImmutableSnapshots.has(events)) return true;
+		let visited = 0;
+		const walk = (value) => {
+			if (value === null || typeof value !== "object") return true;
+			if (++visited > IMMUTABILITY_PROOF_NODE_BUDGET) return false;
+			if (!Object.isFrozen(value)) return false;
+			for (const key of Object.getOwnPropertyNames(value)) {
+				const descriptor = Object.getOwnPropertyDescriptor(value, key);
+				if (!descriptor) return false;
+				if (descriptor.get !== void 0 || descriptor.set !== void 0) return false;
+				if (descriptor.value !== void 0 && !walk(descriptor.value)) return false;
+			}
+			return true;
+		};
+		if (!walk(events)) return false;
+		provenImmutableSnapshots.add(events);
+		return true;
+	};
+	const readGoalOnce = () => {
+		if (!readGoalState) return {
+			state: void 0,
+			failed: false
+		};
+		try {
+			return {
+				state: normalizeGoalState(readGoalState()),
+				failed: false
+			};
+		} catch {
+			return {
+				state: void 0,
+				failed: true
+			};
+		}
+	};
+	const goalKeyOf = (goal) => goal.failed ? "error" : goal.state ? `${goal.state.id}\0${goal.state.revision}\0${goal.state.phase}\0${goal.state.activation}` : "none";
+	const ledgerSnapshotKey = (snapshot$1) => `${snapshot$1.records.length}\0${snapshot$1.records.at(-1)?.record_sha256 ?? ""}\0${snapshot$1.damaged ? "d" : "-"}\0${snapshot$1.anchored ? "a" : "-"}`;
+	const rebuild = (events, goal, ledger) => {
 		const previousReleaseContracts = projection.releaseContracts.length;
 		const header = session.header;
 		const priorRecoveryDigest = projection.lastRecoveryDigest;
 		const sessionHeader = sessionHeaderForDigest(session);
-		let events;
-		try {
-			events = snapshotSessionEvents(session);
-		} catch (error) {
-			const code = error instanceof SessionApiError ? error.code : "session_snapshot_failed";
-			projection.integrity = "unknown";
-			if (!projection.integrityViolations.includes(code)) projection.integrityViolations.push(code);
-			return;
-		}
 		const derived = deriveProjection(events, {
 			activation: config.activation,
 			policy: config.policy
@@ -6325,8 +6841,8 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 			sessionHeader
 		}, durabilityConfirmed, hostLock);
 		Object.assign(projection, derived.projection);
-		if (readPrivateRecords) {
-			let privateSnapshot = readPrivateRecords();
+		if (readPrivateRecords && ledger) {
+			let privateSnapshot = ledger;
 			if (!synchronizedOnce && events.length === 0 && !privateSnapshot.damaged && !privateSnapshot.anchored && initializePrivateRecords?.()) privateSnapshot = readPrivateRecords();
 			if (projection.releaseContracts.length > 0 && !privateSnapshot.damaged && !privateSnapshot.anchored) if (synchronizedOnce && previousReleaseContracts === 0 && initializePrivateRecords?.()) privateSnapshot = readPrivateRecords();
 			else privateSnapshot = {
@@ -6335,21 +6851,27 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 				anchored: false
 			};
 			applyPrivateLedger(projection, privateSnapshot);
+			ledger = privateSnapshot;
 		}
 		synchronizedOnce = true;
+		lastFullSync = {
+			events,
+			headerRef: session.header,
+			durability: durabilityConfirmed,
+			goalKey: goalKeyOf(goal),
+			ledgerKey: ledger ? ledgerSnapshotKey(ledger) : "",
+			refreshEpoch
+		};
 		if (!sessionHeader) {
 			projection.integrity = "unknown";
 			if (!projection.integrityViolations.includes("session_ref_unavailable")) projection.integrityViolations.push("session_ref_unavailable");
 		}
-		if (readGoalState) try {
-			const state = normalizeGoalState(readGoalState());
-			if (state && projection.currentGoalRef?.id === state.id && projection.currentGoalRef.revision === state.revision) {
-				projection.currentGoalPhase = state.phase;
-				projection.currentGoalActivation = state.activation;
-			}
-		} catch {
+		if (goal.failed) {
 			projection.integrity = "unknown";
 			projection.integrityViolations.push("goal_readback_unavailable");
+		} else if (goal.state && projection.currentGoalRef?.id === goal.state.id && projection.currentGoalRef.revision === goal.state.revision) {
+			projection.currentGoalPhase = goal.state.phase;
+			projection.currentGoalActivation = goal.state.activation;
 		}
 		projection.continuationAttempts = continuationAttempts;
 		projection.persistenceCorrectionAttempts = persistenceCorrectionAttempts;
@@ -6357,7 +6879,7 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 		projection.durabilityWatermark = durabilityWatermark;
 		if (projection.boundaryProtocol === 6 && durabilityWatermark === "confirmed") try {
 			const displayOrigins = /* @__PURE__ */ new Map();
-			projection.coreV2 = projectSessionCoreV2(session.snapshotEvents(), projection, displayOrigins);
+			projection.coreV2 = projectSessionCoreV2(events, projection, displayOrigins);
 			projection.coreV2RequirementOrigins = projection.coreV2 ? displayOrigins : void 0;
 			projection.coreV2Reason = projection.coreV2 ? void 0 : "source_not_projectable";
 		} catch {
@@ -6406,8 +6928,22 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 					});
 				}
 			}
+			refreshEpoch += 1;
+		}
+		let events;
+		try {
+			events = snapshotSessionEvents(session);
+		} catch (error) {
+			const code = error instanceof SessionApiError ? error.code : "session_snapshot_failed";
+			projection.integrity = "unknown";
+			if (!projection.integrityViolations.includes(code)) projection.integrityViolations.push(code);
+			lastFullSync = void 0;
+			return;
 		}
-		rebuild();
+		const goal = readGoalOnce();
+		const ledger = readPrivateRecords ? readPrivateRecords() : void 0;
+		if (lastFullSync && snapshotIsProvablyImmutable(events) && lastFullSync.refreshEpoch === refreshEpoch && sameSnapshotIdentity(events, lastFullSync.events) && Object.is(lastFullSync.headerRef, session.header) && lastFullSync.durability === durabilityConfirmed && lastFullSync.goalKey === goalKeyOf(goal) && (!readPrivateRecords || lastFullSync.ledgerKey === ledgerSnapshotKey(ledger))) return;
+		rebuild(events, goal, ledger);
 	};
 	const runHostLockEntry = async (operation) => {
 		if (!refreshHostLock) return await operation();
@@ -6434,7 +6970,7 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 		pendingRecoveryCauses = /* @__PURE__ */ new Set();
 		return was;
 	};
-	rebuild();
+	sync();
 	return {
 		projection,
 		session,
@@ -6483,6 +7019,41 @@ function revalidateCoreLock(config, expected, providedSession) {
 		goalAvailable: false,
 		reasonCode: "host_lock_migration_required"
 	};
+	if (config.hostLockProfile === "desktop") {
+		if (!config.hostLockDesktopDigest) return {
+			...expected,
+			status: "unavailable",
+			goalAvailable: false,
+			reasonCode: "host_lock_migration_required"
+		};
+		try {
+			const configured = evaluateConfiguredHostLock(config.hostLockPackages ?? [], {
+				platform: config.hostLockPlatform,
+				profileKind: "desktop"
+			}, config.hostLockTrust, config.hostLockProfileRoot);
+			if (configured.status !== "supported") return configured;
+			const actual = revalidateDesktopCoreLock(config.hostLockRuntimeRoot, config.hostLockProfileRoot, expected, config.hostLockTrust);
+			if (actual.status !== "supported") return actual;
+			const currentRows = evaluateConfiguredHostLock(actual.packages, {
+				platform: config.hostLockPlatform,
+				profileKind: "desktop"
+			}, config.hostLockTrust, config.hostLockProfileRoot);
+			if (actual.digest !== config.hostLockDesktopDigest || currentRows.digest !== configured.digest) return {
+				...actual,
+				status: "unsupported",
+				goalAvailable: false,
+				reasonCode: "host_lock_installed_graph_drift"
+			};
+			return actual;
+		} catch {
+			return {
+				...expected,
+				status: "unavailable",
+				goalAvailable: false,
+				reasonCode: "host_lock_missing"
+			};
+		}
+	}
 	const session = providedSession ?? createHostAuditSession();
 	try {
 		const runtimeRoot = session.realpath(config.hostLockRuntimeRoot);
@@ -6518,12 +7089,16 @@ function registerPassiveHostWorkdirObserver(agent, hostLockAtCall, attestedRoute
 	if (typeof agent.ctx.on !== "function") return () => {};
 	const pending = /* @__PURE__ */ new WeakMap();
 	const pre = agent.ctx.on("tools/pre-execute", async (exec, next) => {
-		if (exec.agent === agent && (exec.name === "bash" || exec.name === "pwsh")) try {
-			const policy = agent.ctx.get("sandboxPolicy");
-			const audit = createHostAuditSession();
-			const receipt = captureHostWorkdir(agent.session, exec, hostLockAtCall(audit), policy, await attestedRouteAtCall(exec.name, agent.ctx.get("shell"), policy, audit), sourcedRootAtCall?.(exec) ?? null, SESSION_FORMAT_VERSION);
-			if (receipt) pending.set(exec, receipt);
-		} catch {}
+		if (exec.agent === agent && (exec.name === "bash" || exec.name === "pwsh")) {
+			const args = typeof exec.arguments === "object" && exec.arguments !== null ? exec.arguments : {};
+			const command = String(args.command ?? "").trim();
+			if (exec.parent === void 0 && exec.rootCallId === exec.callId && !Object.hasOwn(args, "workdir") && args.run_in_background !== true && /^(?:npm|pnpm)\s+test$/u.test(command)) try {
+				const policy = agent.ctx.get("sandboxPolicy");
+				const audit = createHostAuditSession();
+				const receipt = captureHostWorkdir(agent.session, exec, hostLockAtCall(audit), policy, await attestedRouteAtCall(exec.name, agent.ctx.get("shell"), policy, audit), sourcedRootAtCall?.(exec) ?? null, SESSION_FORMAT_VERSION);
+				if (receipt) pending.set(exec, receipt);
+			} catch {}
+		}
 		return next();
 	});
 	const post = agent.ctx.on("tools/post-execute", async (exec, _result, next) => {
@@ -6555,10 +7130,14 @@ function registerPassiveHostWorkdirObserver(agent, hostLockAtCall, attestedRoute
 }
 function apply(ctx, rawConfig = {}, seams = {}) {
 	const config = resolveConfig(rawConfig);
-	const installedHostLock = seams.hostLock ?? evaluateConfiguredHostLock(config.hostLockPackages ?? [], {
+	const configuredHostLock = seams.hostLock ?? evaluateConfiguredHostLock(config.hostLockPackages ?? [], {
 		platform: config.hostLockPlatform,
 		profileKind: config.hostLockProfile
 	}, config.hostLockTrust, config.hostLockProfileRoot);
+	const installedHostLock = seams.hostLock ?? (config.hostLockProfile === "desktop" && config.hostLockDesktopDigest ? {
+		...configuredHostLock,
+		digest: config.hostLockDesktopDigest
+	} : configuredHostLock);
 	const runtimes = /* @__PURE__ */ new Map();
 	const privateLedgerRoot = seams.privateLedgerRoot ?? resolvePrivateLedgerRoot(void 0, process.env.DSH_HOME, homedir());
 	const hostLocks = /* @__PURE__ */ new Map();
@@ -6597,19 +7176,24 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 	};
 	const ensure = (agent) => {
 		let runtime = runtimes.get(agent);
+		let created = false;
 		if (!runtime) {
 			const goals = qualifiedGoalService(agent);
 			const agentHostLock = refreshAgentHostLock(agent);
 			runtime = createRuntime(agent, config, agentHostLock, goals ? () => goals.get(agent) : void 0, () => refreshAgentHostLock(agent), privateLedgerRoot ? () => readPrivateLedger(privateLedgerRoot, ledgerContext(agent, agentHostLock)) : void 0, privateLedgerRoot ? () => initializePrivateLedger(privateLedgerRoot, ledgerContext(agent, agentHostLock)) : void 0);
 			runtimes.set(agent, runtime);
+			created = true;
 		}
-		return runtime;
+		return {
+			runtime,
+			created
+		};
 	};
-	ctx.commands.register(createContextGuardCommand((agent) => ensure(agent).projection, (agent, enabled) => ensure(agent).setEnabled(enabled), (agent) => ensure(agent).sync(), (agent) => ensure(agent).lifecycle));
+	ctx.commands.register(createContextGuardCommand((agent) => ensure(agent).runtime.projection, (agent, enabled) => ensure(agent).runtime.setEnabled(enabled), (agent) => ensure(agent).runtime.sync(), (agent) => ensure(agent).runtime.lifecycle));
 	const attach = (agent, source) => {
 		if (registrations.has(agent)) {
 			if (source === "resume" || source === "compact") {
-				const runtime = ensure(agent);
+				const { runtime } = ensure(agent);
 				runtime.sync();
 				runtime.projection.lastRecoveryDigest = void 0;
 				runtime.markRecoveryNeeded(source === "resume" ? "resume" : "compaction");
@@ -6626,8 +7210,8 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 			guard: (...args) => own(agent.ctx.tools.guard(...args))
 		};
 		try {
-			const runtime = ensure(agent);
-			runtime.sync();
+			const { runtime, created } = ensure(agent);
+			if (!created) runtime.sync();
 			if (source === "resume" || source === "compact") {
 				runtime.projection.lastRecoveryDigest = void 0;
 				runtime.markRecoveryNeeded(source === "resume" ? "resume" : "compaction");
@@ -6853,7 +7437,7 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 	for (const agent of ctx.get?.("agents")?.list() ?? []) attach(agent);
 	ctx.on("agent/pre-step", async ({ agent }, next) => {
 		const durability = await ctx.sessions.flush(agent.session);
-		const runtime = ensure(agent);
+		const { runtime } = ensure(agent);
 		runtime.setDurability(durability);
 		runtime.sync();
 		const decision = await next();
@@ -6909,7 +7493,7 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 		return decision;
 	});
 	ctx.on("agent/turn-stopping", async ({ agent }) => {
-		const runtime = ensure(agent);
+		const { runtime } = ensure(agent);
 		const goals = qualifiedGoalService(agent);
 		await handleGuardTurnStopping(agent, runtime, {
 			flush: () => ctx.sessions.flush(agent.session),
@@ -7141,4 +7725,4 @@ async function replayRawV2(input) {
 }
 
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, BASE_HOST_PACKAGES, BOUNDARY_RECORD_PREFIX, BOUNDED_ARTIFACT_TYPES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, CERTIFICATE_VERSION_V2, CLEANUP_CONDITION_RULE, CLEANUP_CONDITION_RULE_COMPACT, CLEANUP_CONDITION_RULE_SHORT, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_DELEGATION_TOOL_NAMES, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DEPENDENCY_FREE_ONLY_CONDITION, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GRANTED_QUALIFICATION, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HOST_VALIDATED_VERSIONS, HostProfileError, HostTrustError, LATEST_TESTED_HOST_VERSION, LEGACY_QUALIFICATION, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_CAPABILITY_MATRIX, PROOF_KINDS, PROOF_KINDS_V2, PROOF_MANIFEST_DOMAIN_V2, PROOF_PROTOCOL_VERSION, PROOF_PROTOCOL_VERSION_V2, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, PROTOCOL_V5_NOTICE, PROTOCOL_V6_NOTICE, RC020_RC1_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, STOP_PROTOCOL_VERSION_V2, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, SessionApiError, V6_ORDINARY_COMPLETION_RULE, V6_ORDINARY_COMPLETION_RULE_COMPACT, V6_ORDINARY_COMPLETION_RULE_SHORT, acquireHostTrust, actionCompatible, actionHasCertificationPath, actionVerbMatches, activeRendererModule, admissibleForRemoval, apply, applyUpgradeEligibility, assessmentAction, assessmentOutcomePredicate, auditedDefaultWorkdirHost, auditedDefaultWorkdirProvider, auditedForegroundRenderers, auditedHostImplementation, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindProofV2ToProjection, bindingIndividuallyAccepted, bindingSatisfies, boundedArtifactChoiceMatches, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, capabilityConsequence, capabilityFactOf, capabilityRemedyPhrase, captureClause, captureItem, carriesCleanupCondition, certifyCheckpoint, claimedBatchHasRealRootInput, clarifiedSpanOf, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, clauseAsksOwnQuestion, clauseIsGoverned, clauseIsProtected, cleanupConditionFor, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, createProofManifestV2, currentActionBases, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, environmentDefaultRepositoryTarget, evaluateActiveHostLock, evaluateConfiguredHostLock, evaluateExternalWaitCapability, evaluateGraphDerivedHostLock, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, explanationHasActionResidue, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, firstStepGuidance, firstStepGuidanceV6, gitCommandMatchesTarget, goalCompletionDenial, governedClauseRestrictsExecution, hasCurrentCertificate, hasOrderedCoordination, hasQuestionScope, hasWorkPredicate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostTrustDigest, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectTargetHostGraph, interpretClause, interpretMessage, introducesActionClause, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isExplanationScope, isFrozenV042RebindResponse, isInformationalFragment, isInformationalMessage, isOpenObligation, isQuestionScopeNeedingReview, isRestatement, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, itemHoldsExecutionAuthority, kindOfScope, latestAssistantText, latestRootInstruction, legacyQuestionReadingIsInformational, legacyRecordsNeedingReview, lifecyclePhase, maskCodeSpans, maskQuotedSpans, name, namedActions, nativeFileTwoRole, normalizeClause, observeAssistantOutcome, openItems, opensConditionLead, opensWithDirective, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostTrust, parseHostVersion, parsePwshCommand, parseShellCommand, partialFailureOf, persistedToolResultStatus, prepareActiveHostTrust, prepareTargetHostTrust, presentExplanationHead, previewFirstStepInjection, progressFingerprint, projectCoreV2, projectSessionCoreV2, proofCapabilityReport, proofDigest, proofDigestV2, proofEvidenceConstraints, proofHostSurfacesOf, proofOperationMatches, proofV2Rejection, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualificationOfClause, qualifyBoundary, qualifyHostTrust, questionHeadsClause, readActiveHostGraph, rebindAttemptKey, rebindResponse, recoveryDigest, recoveryTitle, registryArchiveFiles, registryArchiveModules, relevantEvidence, removalIsComplete, removalIsPartiallyKnown, renderRecoveryPacket, replayRawV2, replayRebindResult, reportingHeadGoverns, requestedIdentityKey, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, requiredSubjectsOf, resolveActiveProfileHostLock, resolveInstalledHostLock, restatedContentOf, revalidateGitPrestate, rootLocatorFlavor, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, scopeCoverageDigest, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sessionQueryV2, sha256, snapshotSessionEvents, splitTextFragments, statefulActionsOfScope, supersedeItem, testOutcomePredicate, v6CurrentRootBoundaries, v6TestPredicate, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, validateProofManifestV2, verbIsNegated, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, BASE_HOST_PACKAGES, BOUNDARY_RECORD_PREFIX, BOUNDED_ARTIFACT_TYPES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, CERTIFICATE_VERSION_V2, CLEANUP_CONDITION_RULE, CLEANUP_CONDITION_RULE_COMPACT, CLEANUP_CONDITION_RULE_SHORT, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_DELEGATION_TOOL_NAMES, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DEPENDENCY_FREE_ONLY_CONDITION, DESKTOP_IDENTITY_FACTS, DESKTOP_PROFILE_PACKAGE_NAME, DESKTOP_RUNTIME_PACKAGE_NAME, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GRANTED_QUALIFICATION, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HOST_VALIDATED_VERSIONS, HostProfileError, HostTrustError, LATEST_TESTED_HOST_VERSION, LEGACY_QUALIFICATION, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NATIVE_GIT_ROOT_PARENT_OID, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_CAPABILITY_MATRIX, PROOF_KINDS, PROOF_KINDS_V2, PROOF_MANIFEST_DOMAIN_V2, PROOF_PROTOCOL_VERSION, PROOF_PROTOCOL_VERSION_V2, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, PROTOCOL_V5_NOTICE, PROTOCOL_V6_NOTICE, RC020_RC1_HOST_PACKAGES, RC020_RC2_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, STOP_PROTOCOL_VERSION_V2, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, SessionApiError, V6_ORDINARY_COMPLETION_RULE, V6_ORDINARY_COMPLETION_RULE_COMPACT, V6_ORDINARY_COMPLETION_RULE_SHORT, acquireHostTrust, actionCompatible, actionHasCertificationPath, actionVerbMatches, activeRendererModule, admissibleForRemoval, apply, applyUpgradeEligibility, assessmentAction, assessmentOutcomePredicate, auditDesktopInstalledImplementation, auditedDefaultWorkdirHost, auditedDefaultWorkdirProvider, auditedForegroundRenderers, auditedHostImplementation, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindProofV2ToProjection, bindingIndividuallyAccepted, bindingSatisfies, boundedArtifactChoiceMatches, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, capabilityConsequence, capabilityFactOf, capabilityRemedyPhrase, captureClause, captureItem, carriesCleanupCondition, certifyCheckpoint, claimedBatchHasRealRootInput, clarifiedSpanOf, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, clauseAsksOwnQuestion, clauseIsGoverned, clauseIsProtected, cleanupConditionFor, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, createProofManifestV2, currentActionBases, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, environmentDefaultRepositoryTarget, evaluateActiveHostLock, evaluateConfiguredHostLock, evaluateExternalWaitCapability, evaluateGraphDerivedHostLock, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, explanationHasActionResidue, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, firstStepGuidance, firstStepGuidanceV6, gitCommandMatchesTarget, goalCompletionDenial, governedClauseRestrictsExecution, hasCurrentCertificate, hasDesktopImporterState, hasOrderedCoordination, hasQuestionScope, hasWorkPredicate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostTrustDigest, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectDesktopTargetGraph, inspectTargetHostGraph, interpretClause, interpretMessage, introducesActionClause, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isExplanationScope, isFrozenV042RebindResponse, isInformationalFragment, isInformationalMessage, isOpenObligation, isQuestionScopeNeedingReview, isRestatement, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, itemHoldsExecutionAuthority, kindOfScope, latestAssistantText, latestRootInstruction, legacyQuestionReadingIsInformational, legacyRecordsNeedingReview, lifecyclePhase, maskCodeSpans, maskQuotedSpans, name, namedActions, nativeFileTwoRole, nativeGitParentOidVerified, normalizeClause, observeAssistantOutcome, openItems, opensConditionLead, opensWithDirective, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostTrust, parseHostVersion, parsePwshCommand, parseShellCommand, partialFailureOf, persistedToolResultStatus, prepareActiveHostTrust, prepareDesktopHostTrust, prepareTargetHostTrust, presentExplanationHead, previewFirstStepInjection, progressFingerprint, projectCoreV2, projectSessionCoreV2, proofCapabilityReport, proofDigest, proofDigestV2, proofEvidenceConstraints, proofHostSurfacesOf, proofOperationMatches, proofV2Rejection, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualificationOfClause, qualifyBoundary, qualifyHostTrust, questionHeadsClause, readActiveHostGraph, readAsarFile, readAsarIndex, readDesktopAppRuntime, readDesktopDependency, readDesktopTargetGraph, rebindAttemptKey, rebindResponse, recoveryDigest, recoveryTitle, registryArchiveFiles, registryArchiveModules, relevantEvidence, removalIsComplete, removalIsPartiallyKnown, renderRecoveryPacket, replayRawV2, replayRebindResult, reportingHeadGoverns, requestedIdentityKey, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, requiredSubjectsOf, resolveActiveProfileHostLock, resolveDesktopProfileHostLock, resolveInstalledHostLock, restatedContentOf, revalidateDesktopCoreLock, revalidateGitPrestate, rootLocatorFlavor, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, scopeCoverageDigest, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sessionQueryV2, sha256, shellReadbackOutcome, snapshotSessionEvents, splitTextFragments, statefulActionsOfScope, supersedeItem, testOutcomePredicate, v6CurrentRootBoundaries, v6TestPredicate, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, validateProofManifestV2, verbIsNegated, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability, writeDesktopRuntimeReceipt };