dsh-completion-guard 0.8.2 → 0.8.4

package/dist/index.js

@@ -1,12 +1,12 @@
-import { $ as PROOF_CAPABILITY_MATRIX, $i as ACTIVE_HOST_COHORT_ID, $n as admissibleForRemoval, $r as splitTextFragments, $t as releasePreEffectDecision, A as PROTOCOL_V3_NOTICE, Aa as CERTIFICATE_VERSION_V2, Ai as resolveActiveProfileHostLock, An as effectuateBoundary, Ar as interpretClause, At as V6_ORDINARY_COMPLETION_RULE_SHORT, B as extractTextContent, Ba as requestedTargetAuthorizesMutation, Bi as readAsarFile, Bn as rebindResponse, Br as kindOfScope, Bt as isV6PendingRootWait, C as SESSION_API_UNSUPPORTED, Ca as evaluateMinimumHostVersion, Ci as inspectTargetHostGraph, Cn as goalCompletionDenial, Cr as clauseIsGoverned, Ct as CLEANUP_CONDITION_RULE, D as projectCoreV2, Da as ACTION_MANIFEST_VERSION, Di as prepareDesktopHostTrust, Dn as unitDescendantIds, Dr as hasOrderedCoordination, Dt as MIN_RECOVERY_CHAR_BUDGET, E as snapshotSessionEvents, Ea as ACTION_MANIFEST, Ei as prepareActiveHostTrust, En as certificateClosure, Er as governedClauseRestrictsExecution, Et as DEFAULT_RECOVERY_CHAR_BUDGET, F as deriveProjection, Fa as SUPPORTED_EVIDENCE_ADAPTERS, Fi as DESKTOP_IDENTITY_FACTS, Fn as confirmRebind, Fr as isInformationalFragment, Ft as recoveryDigest, G as canonicalArgvFromCommand, Ga as validateActionTarget, Gi as writeDesktopRuntimeReceipt, Gn as capabilityRemedyPhrase, Gr as opensConditionLead, Gt as contractById, H as isDeterministicCheck, Ha as semanticActionFromCommand, Hi as readDesktopAppRuntime, Hn as CONFIRM_LINE_PATTERN, Hr as maskCodeSpans, Ht as OUTCOME_STRENGTH, I as legacyRecordsNeedingReview, Ia as actionCompatible, Ii as DESKTOP_PROFILE_PACKAGE_NAME, In as proposeRebind, Ir as isOpenObligation, It as recoveryTitle, J as parseShellCommand, Ji as hostTrustDigest, Jn as itemDiagnosis, Jr as qualificationOfClause, Jt as normalizeReservation, K as isRunExecutable, Ka as RC020_RC2_HOST_PACKAGES, Ki as HostTrustError, Kn as deriveItemDiagnosis, Kr as opensWithDirective, Kt as inFlightReservation, L as rootLocatorFlavor, La as boundedArtifactChoiceMatches, Li as DESKTOP_RUNTIME_PACKAGE_NAME, Ln as proposeRebindOutcome, Lr as isQuestionScopeNeedingReview, Lt as renderRecoveryPacket, M as PROTOCOL_V5_NOTICE, Ma as STATEFUL_ACTIONS, Mi as resolveInstalledHostLock, Mn as qualifyBoundary, Mr as introducesActionClause, Mt as cleanupConditionFor, N as PROTOCOL_V6_NOTICE, Na as STOP_PROTOCOL_VERSION, Ni as revalidateDesktopCoreLock, Nn as currentContractDigest, Nr as isExecutableItem, Nt as closingHint, O as CAPTURE_V042_NOTICE, Oa as BOUNDED_ARTIFACT_TYPES, Oi as prepareTargetHostTrust, On as BOUNDARY_RECORD_PREFIX, Or as hasQuestionScope, Ot as V6_ORDINARY_COMPLETION_RULE, P as applyUpgradeEligibility, Pa as STOP_PROTOCOL_VERSION_V2, Pi as verifyComposedHostLockDump, Pn as createProjection, Pr as isExplanationScope, Pt as openItems, Q as certifyCheckpoint, Qi as registryArchiveModules, Qn as actionHasCertificationPath, Qr as semanticActionOfScope, Qt as releaseCoverage, R as supersedeItem, Ra as isStatefulAction, Ri as auditDesktopInstalledImplementation, Rn as proposeRebindV042, Rr as isRestatement, Rt as v6CurrentRootBoundaries, S as sourcedNamedTestRoot, Sa as compareHostVersions, Si as inspectDesktopTargetGraph, Sn as v6TestPredicate, Sr as clauseAsksOwnQuestion, St as validateProofManifestV2, T as SessionApiError, Ta as satisfiesSupportedHostRange, Ti as packageRowsFromPnpmLock, Tn as certifiableOpenItems, Tr as explanationHasActionResidue, Tt as CLEANUP_CONDITION_RULE_SHORT, U as persistedToolResultStatus, Ua as semanticActionFromText, Ui as readDesktopDependency, Un as isFrozenV042RebindResponse, Ur as maskQuotedSpans, Ut as RELEASE_OPERATIONS, V as extractToolSubject, Va as requestedTargetMatchesResolved, Vi as readAsarIndex, Vn as replayRebindResult, Vr as legacyQuestionReadingIsInformational, Vt as sourceItemForCoreRequirement, W as withDurability, Wa as validateActionManifest, Wi as readDesktopTargetGraph, Wn as parseConfirmationMessage, Wr as namedActions, Wt as RELEASE_OPERATION_SURFACES, X as segmentAuthorityBlocks, Xi as qualifyHostTrust, Xn as relevantEvidence, Xr as reportingHeadGoverns, Xt as readbackSettlesContract, Y as authorityCaptureCounts, Yi as parseHostTrust, Yn as nativeFileTwoRole, Yr as questionHeadsClause, Yt as normalizeSettlement, Z as bindingIndividuallyAccepted, Zi as registryArchiveFiles, Zn as DEPENDENCY_FREE_ONLY_CONDITION, Zr as restatedContentOf, Zt as releaseContractFor, _ as previewFirstStepInjection, _a as HOST_VALIDATED_VERSIONS, _i as evaluateActiveHostLock, _n as latestAssistantText, _r as classifyUserInteraction, _t as requiredSubjectsOf, a as commitTreeSnapshotDigest, aa as GOAL_HOST_PACKAGES, ai as digestStrings, an as CONTROL_RECORD_PREFIX, ar as captureClause, at as bindProofToProjection, b as HOST_WORKDIR_PREFIX, ba as SUPPORTED_HOST_RANGE, bi as hostLockRowsFromComposedDump, bn as progressFingerprint, br as actionVerbMatches, bt as sessionQueryV2, c as gitCommandMatchesTarget, ca as bindExecutableIdentity, ci as sanitizeUrl, cn as assessmentAction, cr as environmentDefaultRepositoryTarget, ct as createProofManifest, d as verifiedLinearCommitReadback, da as evaluateGraphDerivedHostLock, di as activeRendererModule, dn as currentActionBases, dr as extractOperation, dt as proofDigest, ea as ACTIVE_HOST_COHORT_IDS, ei as statefulActionsOfScope, en as reservationFor, er as capabilityConsequence, et as PROOF_KINDS, f as FIRST_STEP_GUIDANCE, fa as evaluateHostCapability, fi as auditedDefaultWorkdirHost, fn as decideTurnBoundary, fr as isInformationalMessage, ft as proofDigestV2, g as lifecyclePhase, ga as selectHostCohort, gi as combineHostPolicy, gn as isWholeTaskCompletionClaim, gr as classifyTaskIntent, gt as proofV2Rejection, h as firstStepGuidanceV6, ha as hostVersionFromPackages, hi as auditedHostImplementation, hn as isRootPauseRequest, hr as npmEscapedPackageName, ht as proofOperationMatches, i as commitIndexSnapshotDigest, ia as EXPECTED_HOST_PACKAGES, ii as canonicalizePath, in as isVerifyingCapability, ir as removalIsPartiallyKnown, it as PROOF_PROTOCOL_VERSION_V2, j as PROTOCOL_V4_NOTICE, ja as SEMANTIC_ACTIONS, ji as resolveDesktopProfileHostLock, jn as isCurrentAcceptedBoundary, jr as interpretMessage, jt as carriesCleanupCondition, k as DEFAULT_DELEGATION_TOOL_NAMES, ka as CERTIFICATE_VERSION, ki as readActiveHostGraph, kn as availableBoundaryQualifications, kr as hasWorkPredicate, kt as V6_ORDINARY_COMPLETION_RULE_COMPACT, l as parseGitCommandManifest, la as bindLiveGoalCapability, li as sha256, ln as assessmentOutcomePredicate, lr as extractArtifactPaths, lt as createProofManifestV2, m as firstStepGuidance, ma as evaluateToolSurfaceCapability, mi as auditedForegroundRenderers, mn as decisionBoundaryKey, mr as canonicalRegistryBase, mt as proofHostSurfacesOf, n as GIT_COMMAND_MANIFEST_IDS, na as BASE_HOST_PACKAGES, ni as COMMAND_SURFACE_MANIFEST, nn as evidenceCoverage, nr as partialFailureOf, nt as PROOF_MANIFEST_DOMAIN_V2, o as createGitPrestateEnvelope, oa as HOST_CAPABILITY_PACKAGE_GROUPS, oi as normalizeClause, on as NO_PROGRESS_RECORD_PREFIX, or as captureItem, ot as bindProofV2ToProjection, p as claimedBatchHasRealRootInput, pa as evaluateHostLock, pi as auditedDefaultWorkdirProvider, pn as decideTurnStopping, pr as segmentClauses, pt as proofEvidenceConstraints, q as parsePwshCommand, qa as createHostAuditSession, qi as acquireHostTrust, qn as evidenceAvailabilityReason, qr as presentExplanationHead, qt as normalizeReleaseContract, r as GIT_COMMAND_TEMPLATES, ra as DEFAULT_HOST_LOCK, ri as validateManifest, rn as evidenceMatchesItem, rr as removalIsComplete, rt as PROOF_PROTOCOL_VERSION, s as executeRevalidatedGitEffect, sa as HOST_COHORTS, si as sanitizeClauseText, sn as NO_PROGRESS_TURNS_BEFORE_STOP, sr as classifyClause, st as canonicalProjection, t as RC020_RC1_HOST_PACKAGES, ta as ACTIVE_HOST_LAUNCHER_VERSION, ti as verbIsNegated, tn as bindingSatisfies, tr as capabilityFactOf, tt as PROOF_KINDS_V2, u as revalidateGitPrestate, ua as evaluateExternalWaitCapability, ui as HostProfileError, un as classifyCompletionClaim, ur as extractMethod, ut as proofCapabilityReport, v as projectSessionCoreV2, va as LATEST_TESTED_HOST_VERSION, vi as evaluateConfiguredHostLock, vn as latestRootInstruction, vr as GRANTED_QUALIFICATION, vt as scopeCoverageDigest, w as SESSION_EVENT_ENVELOPE_INVALID, wa as parseHostVersion, wi as packageRowsFromActiveGraph, wn as hasCurrentCertificate, wr as clauseIsProtected, wt as CLEANUP_CONDITION_RULE_COMPACT, x as captureHostWorkdir, xa as SUPPORTED_HOST_VERSIONS, xi as injectActiveProfileHostLock, xn as testOutcomePredicate, xr as clarifiedSpanOf, xt as validateProofManifest, y as sessionCoreSnapshot, ya as MIN_SUPPORTED_HOST_VERSION, yi as hostLockContextFromComposedDump, yn as observeAssistantOutcome, yr as LEGACY_QUALIFICATION, yt as sessionQuery, z as evidenceFromPersistedToolResult, za as requestedIdentityKey, zi as hasDesktopImporterState, zn as rebindAttemptKey, zr as itemHoldsExecutionAuthority, zt as currentV6Feedback } from "./domain-B-2fya9P.js";
+import { $ as segmentAuthorityBlocks, $a as createHostAuditSession, $i as acquireHostTrust, $n as evidenceAvailabilityReason, $r as presentExplanationHead, $t as normalizeSettlement, A as PROTOCOL_V3_NOTICE, Aa as parseHostVersion, Ai as packageRowsFromActiveGraph, An as certifiableOpenItems, Ar as clauseIsProtected, At as MIN_RECOVERY_CHAR_BUDGET, B as evidenceFromPersistedToolResult, Ba as STOP_PROTOCOL_VERSION_V2, Bi as verifyComposedHostLockDump, Bn as createProjection, Br as isExplanationScope, Bt as renderRecoveryPacket, C as SESSION_API_UNSUPPORTED, Ca as HOST_VALIDATED_VERSIONS, Ci as evaluateActiveHostLock, Cn as observeAssistantOutcome, Cr as classifyUserInteraction, Ct as sessionQueryV2, D as projectCoreV2, Da as SUPPORTED_HOST_VERSIONS, Di as injectActiveProfileHostLock, Dn as goalCompletionDenial, Dr as clarifiedSpanOf, Dt as CLEANUP_CONDITION_RULE_COMPACT, E as snapshotSessionEvents, Ea as SUPPORTED_HOST_RANGE, Ei as hostLockRowsFromComposedDump, En as v6TestPredicate, Er as actionVerbMatches, Et as CLEANUP_CONDITION_RULE, F as deriveProjection, Fa as CERTIFICATE_VERSION, Fi as readActiveHostGraph, Fn as availableBoundaryQualifications, Fr as hasWorkPredicate, Ft as cleanupConditionFor, G as persistedToolResultStatus, Ga as requestedIdentityKey, Gi as hasDesktopImporterState, Gn as rebindAttemptKey, Gr as itemHoldsExecutionAuthority, Gt as sourceItemForCoreRequirement, H as extractToolSubject, Ha as actionCompatible, Hi as DESKTOP_PROFILE_PACKAGE_NAME, Hn as proposeRebind, Hr as isOpenObligation, Ht as confirmedV6CoreDiagnostic, I as legacyRecordsNeedingReview, Ia as CERTIFICATE_VERSION_V2, Ii as resolveActiveProfileHostLock, In as effectuateBoundary, Ir as interpretClause, It as closingHint, J as canonicalArgvFromCommand, Ja as semanticActionFromCommand, Ji as readDesktopAppRuntime, Jn as CONFIRM_LINE_PATTERN, Jr as maskCodeSpans, Jt as RELEASE_OPERATION_SURFACES, K as shellReadbackOutcome, Ka as requestedTargetAuthorizesMutation, Ki as readAsarFile, Kn as rebindResponse, Kr as kindOfScope, Kt as OUTCOME_STRENGTH, L as rootLocatorFlavor, La as SEMANTIC_ACTIONS, Li as resolveDesktopProfileHostLock, Ln as isCurrentAcceptedBoundary, Lr as interpretMessage, Lt as openItems, M as PROTOCOL_V5_NOTICE, Ma as ACTION_MANIFEST, Mi as prepareActiveHostTrust, Mn as needsReviewObligations, Mr as governedClauseRestrictsExecution, Mt as V6_ORDINARY_COMPLETION_RULE_COMPACT, N as PROTOCOL_V6_NOTICE, Na as ACTION_MANIFEST_VERSION, Ni as prepareDesktopHostTrust, Nn as unitDescendantIds, Nr as hasOrderedCoordination, Nt as V6_ORDINARY_COMPLETION_RULE_SHORT, O as CAPTURE_V042_NOTICE, Oa as compareHostVersions, Oi as inspectDesktopTargetGraph, On as hasCurrentCertificate, Or as clauseAsksOwnQuestion, Ot as CLEANUP_CONDITION_RULE_SHORT, P as applyUpgradeEligibility, Pa as BOUNDED_ARTIFACT_TYPES, Pi as prepareTargetHostTrust, Pn as BOUNDARY_RECORD_PREFIX, Pr as hasQuestionScope, Pt as carriesCleanupCondition, Q as authorityCaptureCounts, Qa as RC020_RC2_HOST_PACKAGES, Qi as HostTrustError, Qn as deriveItemDiagnosis, Qr as opensWithDirective, Qt as normalizeReservation, R as supersedeItem, Ra as STATEFUL_ACTIONS, Ri as resolveInstalledHostLock, Rn as qualifyBoundary, Rr as introducesActionClause, Rt as recoveryDigest, S as sourcedNamedTestRoot, Sa as selectHostCohort, Si as combineHostPolicy, Sn as latestRootInstruction, Sr as classifyTaskIntent, St as sessionQuery, T as SessionApiError, Ta as MIN_SUPPORTED_HOST_VERSION, Ti as hostLockContextFromComposedDump, Tn as testOutcomePredicate, Tr as LEGACY_QUALIFICATION, Tt as validateProofManifestV2, U as isDeterministicCheck, Ua as boundedArtifactChoiceMatches, Ui as DESKTOP_RUNTIME_PACKAGE_NAME, Un as proposeRebindOutcome, Ur as isQuestionScopeNeedingReview, Ut as currentV6Feedback, V as extractTextContent, Va as SUPPORTED_EVIDENCE_ADAPTERS, Vi as DESKTOP_IDENTITY_FACTS, Vn as confirmRebind, Vr as isInformationalFragment, Vt as v6CurrentRootBoundaries, W as nativeGitParentOidVerified, Wa as isStatefulAction, Wi as auditDesktopInstalledImplementation, Wn as proposeRebindV042, Wr as isRestatement, Wt as isV6PendingRootWait, X as parsePwshCommand, Xa as validateActionManifest, Xi as readDesktopTargetGraph, Xn as parseConfirmationMessage, Xr as namedActions, Xt as inFlightReservation, Y as isRunExecutable, Ya as semanticActionFromText, Yi as readDesktopDependency, Yn as isFrozenV042RebindResponse, Yr as maskQuotedSpans, Yt as contractById, Z as parseShellCommand, Za as validateActionTarget, Zi as writeDesktopRuntimeReceipt, Zn as capabilityRemedyPhrase, Zr as opensConditionLead, Zt as normalizeReleaseContract, _ as previewFirstStepInjection, _a as evaluateGraphDerivedHostLock, _i as activeRendererModule, _n as decideTurnStopping, _r as extractOperation, _t as proofHostSurfacesOf, a as commitTreeSnapshotDigest, aa as ACTIVE_HOST_COHORT_ID, ai as splitTextFragments, an as bindingSatisfies, ar as admissibleForRemoval, at as PROOF_MANIFEST_DOMAIN_V2, b as HOST_WORKDIR_PREFIX, ba as evaluateToolSurfaceCapability, bi as auditedForegroundRenderers, bn as isWholeTaskCompletionClaim, br as canonicalRegistryBase, bt as requiredSubjectsOf, c as gitCommandMatchesTarget, ca as BASE_HOST_PACKAGES, ci as COMMAND_SURFACE_MANIFEST, cn as isVerifyingCapability, cr as partialFailureOf, ct as bindProofToProjection, d as verifiedLinearCommitReadback, da as GOAL_HOST_PACKAGES, di as digestStrings, dn as NO_PROGRESS_TURNS_BEFORE_STOP, dr as captureClause, dt as createProofManifest, ea as hostTrustDigest, ei as qualificationOfClause, en as readbackSettlesContract, er as itemDiagnosis, et as bindingIndividuallyAccepted, f as FIRST_STEP_GUIDANCE, fa as HOST_CAPABILITY_PACKAGE_GROUPS, fi as normalizeClause, fn as assessmentAction, fr as captureItem, ft as createProofManifestV2, g as lifecyclePhase, ga as evaluateExternalWaitCapability, gi as HostProfileError, gn as decideTurnBoundary, gr as extractMethod, gt as proofEvidenceConstraints, h as firstStepGuidanceV6, ha as bindLiveGoalCapability, hi as sha256, hn as currentActionBases, hr as extractArtifactPaths, ht as proofDigestV2, i as commitIndexSnapshotDigest, ia as registryArchiveModules, ii as semanticActionOfScope, in as reservationFor, ir as actionHasCertificationPath, it as PROOF_KINDS_V2, j as PROTOCOL_V4_NOTICE, ja as satisfiesSupportedHostRange, ji as packageRowsFromPnpmLock, jn as certificateClosure, jr as explanationHasActionResidue, jt as V6_ORDINARY_COMPLETION_RULE, k as DEFAULT_DELEGATION_TOOL_NAMES, ka as evaluateMinimumHostVersion, ki as inspectTargetHostGraph, kn as ancestorConstraintForBinding, kr as clauseIsGoverned, kt as DEFAULT_RECOVERY_CHAR_BUDGET, l as parseGitCommandManifest, la as DEFAULT_HOST_LOCK, li as validateManifest, ln as CONTROL_RECORD_PREFIX, lr as removalIsComplete, lt as bindProofV2ToProjection, m as firstStepGuidance, ma as bindExecutableIdentity, mi as sanitizeUrl, mn as classifyCompletionClaim, mr as environmentDefaultRepositoryTarget, mt as proofDigest, n as GIT_COMMAND_MANIFEST_IDS, na as qualifyHostTrust, ni as reportingHeadGoverns, nn as releaseCoverage, nr as relevantEvidence, nt as PROOF_CAPABILITY_MATRIX, o as createGitPrestateEnvelope, oa as ACTIVE_HOST_COHORT_IDS, oi as statefulActionsOfScope, on as evidenceCoverage, or as capabilityConsequence, ot as PROOF_PROTOCOL_VERSION, p as claimedBatchHasRealRootInput, pa as HOST_COHORTS, pi as sanitizeClauseText, pn as assessmentOutcomePredicate, pr as classifyClause, pt as proofCapabilityReport, q as withDurability, qa as requestedTargetMatchesResolved, qi as readAsarIndex, qn as replayRebindResult, qr as legacyQuestionReadingIsInformational, qt as RELEASE_OPERATIONS, r as GIT_COMMAND_TEMPLATES, ra as registryArchiveFiles, ri as restatedContentOf, rn as releasePreEffectDecision, rr as DEPENDENCY_FREE_ONLY_CONDITION, rt as PROOF_KINDS, s as executeRevalidatedGitEffect, sa as ACTIVE_HOST_LAUNCHER_VERSION, si as verbIsNegated, sn as evidenceMatchesItem, sr as capabilityFactOf, st as PROOF_PROTOCOL_VERSION_V2, t as RC020_RC1_HOST_PACKAGES, ta as parseHostTrust, ti as questionHeadsClause, tn as releaseContractFor, tr as nativeFileTwoRole, tt as certifyCheckpoint, u as revalidateGitPrestate, ua as EXPECTED_HOST_PACKAGES, ui as canonicalizePath, un as NO_PROGRESS_RECORD_PREFIX, ur as removalIsPartiallyKnown, ut as canonicalProjection, v as projectSessionCoreV2, va as evaluateHostCapability, vi as auditedDefaultWorkdirHost, vn as decisionBoundaryKey, vr as isInformationalMessage, vt as proofOperationMatches, w as SESSION_EVENT_ENVELOPE_INVALID, wa as LATEST_TESTED_HOST_VERSION, wi as evaluateConfiguredHostLock, wn as progressFingerprint, wr as GRANTED_QUALIFICATION, wt as validateProofManifest, x as captureHostWorkdir, xa as hostVersionFromPackages, xi as auditedHostImplementation, xn as latestAssistantText, xr as npmEscapedPackageName, xt as scopeCoverageDigest, y as sessionCoreSnapshot, ya as evaluateHostLock, yi as auditedDefaultWorkdirProvider, yn as isRootPauseRequest, yr as segmentClauses, yt as proofV2Rejection, z as NATIVE_GIT_ROOT_PARENT_OID, za as STOP_PROTOCOL_VERSION, zi as revalidateDesktopCoreLock, zn as currentContractDigest, zr as isExecutableItem, zt as recoveryTitle } from "./domain-DZTbCIYn.js";
 import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { basename, delimiter, dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { createHash } from "node:crypto";
-import { closeSync, constants, existsSync, fchmodSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, unlinkSync, writeSync } from "node:fs";
+import { createHash, randomBytes } from "node:crypto";
+import { closeSync, constants, existsSync, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, unlinkSync, writeSync } from "node:fs";
 import { gunzip } from "node:zlib";
 import { execFile } from "node:child_process";
-import { homedir, tmpdir } from "node:os";
+import { homedir, hostname, tmpdir } from "node:os";
 import { JobId } from "@deepseek-ai/dsh-jobs";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -18,7 +18,7 @@ import { SESSION_FORMAT_VERSION, Session, SessionId } from "@deepseek-ai/dsh-ses
 function createRebindTool(getProjection, prepare) {
 	return defineTool({
 		name: "context_guard_rebind",
-		description: "Propose an exact source-clause partition, query, or withdraw it. Only a durable root-user confirmation can replace the contract; no execution authority is added.",
+		description: "Propose, query or withdraw an exact source-clause partition. Replacement requires durable root-user confirmation; adds no execution authority.",
 		parameters: {
 			operation: {
 				type: "string",
@@ -64,6 +64,64 @@ function createRebindTool(getProjection, prepare) {
 	});
 }
 
+//#endregion
+//#region src/tools/checkpoint-feedback.ts
+/** Request-local display evidence. Never marks items passed or mints a certificate. */
+function signingFeedback(p, bindings, result, selected) {
+	if (result.checkpoint || result.status !== "incomplete" || p.integrity !== "valid" || p.hostStatus !== "supported") return void 0;
+	const scope = new Set([...certificateClosure(p).itemIds, ...needsReviewObligations(p).map((item) => item.id)]);
+	const groups = /* @__PURE__ */ new Map();
+	for (const binding of bindings) {
+		const bucket = groups.get(binding.itemId);
+		if (bucket) bucket.push(binding);
+		else groups.set(binding.itemId, [binding]);
+	}
+	const core = confirmedV6CoreDiagnostic(p);
+	const matched = /* @__PURE__ */ new Set();
+	for (const [id, group] of groups) {
+		const item = p.items.get(id), binding = group[0];
+		if (core?.openIds.includes(id) || !item || !scope.has(id) || group.length !== 1 || item.legacyFlags?.length || item.needsReview || item.waitAuthorization || item.authorityDisposition === "conditional_wait" || item.actionPlan?.length || ancestorConstraintForBinding(p, item, binding.resolvedTarget) || result.rejectedBindings.some((row) => row.itemId === id) || !bindingIndividuallyAccepted(p, item, binding)) continue;
+		matched.add(id);
+	}
+	const remaining = new Set([...scope].filter((id) => !matched.has(id)));
+	if (core) for (const id of core.openIds) remaining.add(id);
+	for (const row of result.rejectedBindings) if (row.itemId !== "*") remaining.add(row.itemId);
+	const reasons = /* @__PURE__ */ new Map();
+	const sample = [];
+	const firstByReason = /* @__PURE__ */ new Set();
+	for (const id of remaining) {
+		const reason = core?.predicates[id] ?? "binding_not_matched";
+		reasons.set(reason, (reasons.get(reason) ?? 0) + 1);
+		if (sample.length < 4 && !firstByReason.has(reason)) {
+			sample.push({
+				id: id.length <= 128 ? id : `sha256:${sha256(id)}`,
+				reason_code: reason.slice(0, 160)
+			});
+			firstByReason.add(reason);
+		}
+	}
+	const unresolvedGlobal = result.rejectedBindings.some((row) => row.itemId === "*" && (row.reasonCode !== "current_closure_unmet" || core === void 0 || core.openIds.length === 0));
+	return {
+		matched,
+		remaining,
+		summary: {
+			scope: "whole_contract",
+			scope_total: scope.size,
+			matched_binding_total: matched.size,
+			remaining_total: remaining.size,
+			remaining_sample: sample,
+			remaining_reason_counts: [...reasons].slice(0, 8).map(([reason_code, count]) => ({
+				reason_code,
+				count
+			})),
+			folded_reason_count: Math.max(0, reasons.size - 8),
+			filtered_out_total: selected?.length ? [...remaining].filter((id) => !selected.includes(id)).length : 0,
+			unresolved_global: unresolvedGlobal,
+			next_step: matched.size ? "Retain matched bindings; do not repeat their effects or resubmit the same partial checkpoint. Resolve remaining closure/proof blockers. Omit item_ids and cursor to inspect the whole scope; keep bindings and filters unchanged when continuing a cursor." : "Resolve the remaining closure/proof blockers. Omit item_ids and cursor to inspect the whole scope; keep bindings and filters unchanged when continuing a cursor."
+		}
+	};
+}
+
 //#endregion
 //#region src/tools/cursor-identity.ts
 /** The Session observation watermark advances when a read-only Guard tool
@@ -134,7 +192,7 @@ function checkpointPage(p, query, full) {
 	if (item_ids?.length) {
 		rows.open_items = rows.open_items.filter((row) => item_ids.includes(String(row.id)));
 		rows.active_constraints = rows.active_constraints.filter((row) => item_ids.includes(String(row.id)));
-		rows.rejected_bindings = rows.rejected_bindings.filter((row) => item_ids.includes(String(row.item_id)));
+		rows.rejected_bindings = rows.rejected_bindings.filter((row) => row.item_id === "*" || item_ids.includes(String(row.item_id)));
 	}
 	if (evidence_ids?.length) rows.available_evidence = rows.available_evidence.filter((row) => evidence_ids.includes(String(row.id)));
 	if (lane && offset > rows[lane].length) return invalid("invalid_cursor_offset");
@@ -156,7 +214,11 @@ function checkpointPage(p, query, full) {
 			detail_offset,
 			detail_chunk: chunk,
 			next_detail_offset: detail_offset + chunk.length < data.length ? detail_offset + chunk.length : null,
-			snapshot: identity
+			snapshot: identity,
+			...full.signing_feedback ? {
+				blockers: full.signing_feedback,
+				certificate_status: "not_issued"
+			} : {}
 		};
 	}
 	const reasons = /* @__PURE__ */ new Map();
@@ -189,6 +251,10 @@ function checkpointPage(p, query, full) {
 		output.current_action_total = (full.current_actions ?? []).length;
 		output.certificate_status = "not_requested";
 	}
+	if (full.signing_feedback) {
+		Object.assign(output.blockers, full.signing_feedback);
+		output.certificate_status = "not_issued";
+	}
 	if (full.certificate) output.certificate = full.certificate;
 	if (full.proof_state) output.proof_state = full.proof_state;
 	const pagination = {
@@ -215,9 +281,16 @@ function checkpointPage(p, query, full) {
 			revision: row.revision,
 			kind: row.kind,
 			semantic_action: row.semantic_action,
+			status: row.status,
+			binding_status: row.binding_status,
 			next_step: typeof row.next_step === "string" ? row.next_step.slice(0, 240) : void 0,
 			adapter_disposition: row.adapter_disposition,
 			...row.binding_template !== void 0 ? { binding_template: row.binding_template } : {},
+			...row.expected_transition_template !== void 0 ? {
+				expected_transition_template: row.expected_transition_template,
+				binding_template_unavailable: row.binding_template_unavailable,
+				binding_guidance: row.binding_guidance
+			} : {},
 			omitted: true,
 			detail_id: lookup(String(row.id ?? row.item_id))
 		};
@@ -371,12 +444,22 @@ function bindingTemplate(projection, item) {
 		}
 	}
 }
-function openItemForTool(projection, item) {
+function openItemForTool(projection, item, requestMatched = false, rejection) {
 	const action = item.semanticAction ?? "generic_run";
 	const spec = ACTION_MANIFEST.actions[action];
-	const template = bindingTemplate(projection, item);
 	const diagnosis = deriveItemDiagnosis(projection, item);
+	const evidenceGap = diagnosis.reason_code === "missing_evidence";
+	const matched = requestMatched && evidenceGap;
+	const bindingRejection = evidenceGap ? rejection : void 0;
+	const template = matched || !evidenceGap ? void 0 : bindingTemplate(projection, item);
+	const candidateHints = !matched && evidenceGap && !template && diagnosis.capability.actionSupported && spec.evidenceProducer === "supported" && !isStatefulAction(action) && !["generic_run", "inspect_remote_updates"].includes(action);
 	const compact = itemDiagnosis(projection, item);
+	const effectCandidates = !candidateHints ? [] : [...projection.evidence.values()].filter((e) => e.epoch === projection.epoch && e.outcome === "success" && e.semanticAction === action && (e.evidenceRole ?? "effect") === "effect").sort((a, b) => b.toolResultSeq - a.toolResultSeq).slice(0, 3).map((e) => ({
+		evidence_id: e.id,
+		resolved_target: targetForTool(e.resolvedTarget),
+		matches_captured_target: sameTuple(item.requestedTarget, pick$1(e.resolvedTarget ?? {}, Object.keys(item.requestedTarget ?? {})))
+	}));
+	const targetDiscrepancy = effectCandidates.length > 0 && effectCandidates.every((e) => !e.matches_captured_target);
 	return {
 		id: item.id,
 		revision: item.revision,
@@ -389,14 +472,15 @@ function openItemForTool(projection, item) {
 		semantic_action: action,
 		requested_target: targetForTool(item.requestedTarget),
 		certifiable: compact.certifiable,
-		reason_code: diagnosis.reason_code,
-		next_step: diagnosis.capability.remedy === "await_root_input" ? (diagnosis.next_action.resume_condition ?? capabilityRemedyPhrase(diagnosis.capability.remedy)).slice(0, 240) : capabilityRemedyPhrase(diagnosis.capability.remedy),
+		reason_code: matched ? "binding_matched_not_certified" : bindingRejection?.reasonCode ?? (targetDiscrepancy ? "successful_effect_target_mismatch" : diagnosis.reason_code),
+		...matched ? { binding_status: "matched_not_certified" } : {},
+		next_step: matched ? "This request binding matches individually; the item is still pending and no certificate was issued. Retain it while resolving the whole-contract blockers; do not repeat the effect or collect the same evidence again." : bindingRejection && template ? "Correct the rejected binding using binding_template unchanged; retain the successful effect and do not rerun it merely to repair binding syntax." : bindingRejection ? `${bindingRejection.reason.slice(0, 150)}. Inspect captured target and successful evidence before another action.` : targetDiscrepancy ? "Successful effect candidates target a different scope. Retain them and resolve the captured/effect target discrepancy against the root instruction before another action." : diagnosis.capability.remedy === "await_root_input" ? (diagnosis.next_action.resume_condition ?? capabilityRemedyPhrase(diagnosis.capability.remedy)).slice(0, 240) : capabilityRemedyPhrase(diagnosis.capability.remedy),
 		...item.targetCaptureStatus ? { target_capture_status: item.targetCaptureStatus } : {},
 		capability: {
 			action_supported: diagnosis.capability.actionSupported,
 			certifiable: diagnosis.capability.certifiable,
 			gap: diagnosis.capability.gap,
-			remedy: diagnosis.capability.remedy
+			remedy: matched ? "none" : diagnosis.capability.remedy
 		},
 		producer_disposition: ACTION_MANIFEST.actions[action].evidenceProducer,
 		...item.targetCaptureReasonCode ? { target_capture_reason_code: item.targetCaptureReasonCode } : {},
@@ -408,7 +492,18 @@ function openItemForTool(projection, item) {
 			observed_state_keys: spec.observedStateKeys,
 			pred_params_kind: "inline"
 		},
-		...template ? { binding_template: template } : {}
+		...template ? { binding_template: template } : {},
+		...candidateHints ? {
+			expected_transition_template: expectedTransitionForTool({
+				predicateId: spec.predicateId,
+				version: 1,
+				predParamsKind: "inline",
+				parameters: expectedParameters(action, {}, {})
+			}),
+			binding_template_unavailable: "no_matching_successful_effect",
+			successful_effect_candidates: effectCandidates,
+			binding_guidance: "Retain successful effects. Resolve any captured/effect target discrepancy against the root instruction before further execution; do not guess predicate parameters or rerun a successful test to repair binding syntax."
+		} : {}
 	};
 }
 function createCheckpointTool(getProjection, onRejected, prepare = async () => true, revalidate = () => {}) {
@@ -589,7 +684,7 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 					current_action_total: { type: "integer" },
 					certificate_status: {
 						type: "string",
-						enum: ["not_requested"]
+						enum: ["not_requested", "not_issued"]
 					},
 					contract_revision: { type: "integer" },
 					active_constraints: {
@@ -907,12 +1002,17 @@ function createCheckpointTool(getProjection, onRejected, prepare = async () => t
 					})) } : {}
 				} } : {}
 			}));
+			const feedback = signingFeedback(projection, bindings, result, args.item_ids);
 			return checkpointPage(projection, args, {
+				...feedback ? {
+					signing_feedback: feedback.summary,
+					certificate_status: "not_issued"
+				} : {},
 				status: result.status,
 				proof_state: proofState,
 				contract_revision: result.contractRevision,
-				blocking_total: result.openItems.length,
-				open_items: (args.item_ids?.length ? args.item_ids : result.openItems).map((id) => projection.items.get(id)).filter((item) => Boolean(item)).sort((a, b) => b.revision - a.revision || a.id.localeCompare(b.id)).map((item) => openItemForTool(projection, item)),
+				blocking_total: feedback ? Math.max(feedback.remaining.size, feedback.summary.unresolved_global ? 1 : 0) : result.openItems.length,
+				open_items: (args.item_ids?.length ? args.item_ids : result.openItems).map((id) => projection.items.get(id)).filter((item) => Boolean(item)).sort((a, b) => b.revision - a.revision || a.id.localeCompare(b.id)).map((item) => openItemForTool(projection, item, feedback?.matched.has(item.id), result.rejectedBindings.find((row) => row.itemId === item.id))),
 				active_constraints: [...projection.items.values()].filter((item) => item.kind === "prohibition" && item.status === "pending").map((item) => openItemForTool(projection, item)),
 				available_evidence,
 				available_qualifications: availableBoundaryQualifications(projection).map((row) => ({
@@ -1402,7 +1502,7 @@ function discoveryItemIds(p) {
 function createPrepareTool(options) {
 	return defineTool({
 		name: "context_guard_prepare",
-		description: "Read-only diagnosis of open contract items. Ordinary changes use native host tools and observed facts; this tool never grants execution permission. Omit item_id for a paginated item list.",
+		description: "Read-only contract diagnosis; grants no permission. Use host tools for ordinary work. Omit item_id to list items; page_cursor continues.",
 		parameters: {
 			item_id: { type: "string" },
 			item_revision: { type: "number" },
@@ -1796,7 +1896,7 @@ function itemExtent(spans) {
 function createInterpretTool(options) {
 	return defineTool({
 		name: "context_guard_interpret",
-		description: "Record the interpretation of one unresolved obligation: pass the item ID from context_guard_prepare plus the partition of its input spans you read as information (information_spans) and the sub-spans you could not resolve (unknown_spans); for an attached asset, the partition is unnecessary. Contract bookkeeping only — performs no action, grants no authority. Information sub-spans close when this turn's host-confirmed final answer is delivered; unknown sub-spans remain pending obligations. Correctness is never certified.",
+		description: "Record unresolved input: use an item ID from context_guard_prepare and partition information_spans/unknown_spans (unneeded for attached assets). Bookkeeping only; no action or authority. Information closes on this turn's host-confirmed final answer; unknown stays pending. Correctness stays uncertified.",
 		parameters: {
 			item_id: {
 				type: "string",
@@ -3043,7 +3143,7 @@ function createActionTool(options = {}) {
 	const roots = normalizedRoots(options);
 	return defineTool({
 		name: ACTION_TOOL,
-		description: "Compatibility entry for older sessions. Ordinary mutations return a migration diagnosis without side effects; only an explicitly adopted registry publication can use the controlled release path.",
+		description: "Legacy compatibility: ordinary mutations return migration diagnostics without effects. Only explicitly adopted registry publication uses the controlled path.",
 		parameters: {
 			semantic_action: {
 				type: "string",
@@ -3607,7 +3707,7 @@ const RELEASE_TOOL = "context_guard_release";
 function createReleaseTool(options) {
 	return defineTool({
 		name: RELEASE_TOOL,
-		description: "Read the explicit release state, or reconcile a release attempt whose effect was unknown by reading back the external identity. This tool never re-sends a release.",
+		description: "Read release state or reconcile an unknown effect through external identity readback. Never re-sends a release.",
 		parameters: {
 			operation: {
 				type: "string",
@@ -3744,7 +3844,7 @@ const record = (value) => value !== null && typeof value === "object" && !Array.
 function createNativeFileObserver(host) {
 	return defineTool({
 		name: "context_guard_observe_file",
-		description: "Read back the exact UTF-8 file after an already persisted native write or edit. This tool does not modify files or authorize the edit.",
+		description: "Read back exact UTF-8 bytes after a persisted native write/edit. Does not modify files or authorize edits.",
 		parameters: { effect_call_id: {
 			type: "string",
 			required: true
@@ -4013,14 +4113,19 @@ function createNativeGitObserver(host) {
 			const message = record(result.message);
 			const source = record(message?.source);
 			if (source?.kind !== "tool" || source.callId !== args.effect_call_id) return missing("native_effect_missing");
-			const resultStatus = persistedToolResultStatus(result, args.effect_call_id);
-			if (resultStatus !== "clean") return missing(resultStatus === "failure" ? "native_effect_failed" : "native_effect_untrusted");
 			let effectArgs;
 			try {
 				effectArgs = record(JSON.parse(String(call.arguments)));
 			} catch {
 				return missing("native_effect_arguments_invalid");
 			}
+			const resultStatus = persistedToolResultStatus(result, args.effect_call_id);
+			if (resultStatus !== "clean") return missing(resultStatus === "failure" ? "native_effect_failed" : "native_effect_untrusted");
+			const readbackOutcome = shellReadbackOutcome(call.name, effectArgs ?? {}, {
+				meta: result.meta,
+				textContent: Array.isArray(message?.content) ? extractTextContent(message.content) : ""
+			});
+			if (readbackOutcome !== "success") return missing(readbackOutcome === "failure" ? "native_effect_failed" : "native_effect_untrusted");
 			const command = effectArgs?.command;
 			const repository = effectArgs?.workdir;
 			if (typeof command !== "string" || typeof repository !== "string" || !repository) return missing("native_git_target_missing");
@@ -4031,6 +4136,7 @@ function createNativeGitObserver(host) {
 			if (action !== "commit" && action !== "push") return missing("native_git_command_unsupported");
 			const gitAction = action;
 			const output = Array.isArray(message?.content) ? extractTextContent(message.content) : "";
+			const combinedSignal = typeof AbortSignal.any === "function" ? AbortSignal.any([exec.signal, AbortSignal.timeout(2e4)]) : exec.signal ?? AbortSignal.timeout(2e4);
 			const git$1 = async (...query) => (await execFileAsync("git", [
 				"-C",
 				repository,
@@ -4038,7 +4144,8 @@ function createNativeGitObserver(host) {
 			], {
 				encoding: "utf8",
 				timeout: 5e3,
-				maxBuffer: 1024 * 1024
+				maxBuffer: 1024 * 1024,
+				signal: combinedSignal
 			})).stdout.trim();
 			try {
 				const top = await git$1("rev-parse", "--show-toplevel");
@@ -4049,8 +4156,17 @@ function createNativeGitObserver(host) {
 				if (!/^[0-9a-f]{40,64}$/.test(postOid)) return missing("native_git_readback_unavailable");
 				if (action === "commit") {
 					if (argv.length !== 4 || argv[2] !== "-m" || !argv[3] || !(/* @__PURE__ */ new RegExp(`\\b${postOid.slice(0, 7)}[0-9a-f]*\\b`)).test(output)) return missing("native_git_effect_output_unbound");
-					const parentOid = await git$1("rev-parse", "HEAD^");
-					const treeOid = await git$1("rev-parse", "HEAD^{tree}");
+					const headerLines = (await git$1("--no-replace-objects", "cat-file", "commit", postOid)).split("\n");
+					const headerEnd = headerLines.indexOf("");
+					const header = (headerEnd >= 0 ? headerLines.slice(0, headerEnd) : headerLines).filter(Boolean);
+					const treeLine = header.find((line) => line.startsWith("tree "));
+					const parentLines = header.filter((line) => line.startsWith("parent "));
+					const objectOid = /^[0-9a-f]{40,64}$/.test(treeLine?.slice(5).trim() ?? "") ? treeLine.slice(5).trim() : void 0;
+					if (!treeLine || objectOid === void 0) return missing("native_git_readback_unavailable");
+					const treeOid = objectOid;
+					const parents = parentLines.map((line) => line.slice(7).trim());
+					if (parents.some((oid$1) => !/^[0-9a-f]{40,64}$/.test(oid$1))) return missing("native_git_readback_unavailable");
+					const parentOid = parents.length === 0 ? NATIVE_GIT_ROOT_PARENT_OID : parents[0];
 					return {
 						status: "observed",
 						reason_code: "git_commit_observed",
@@ -5583,7 +5699,6 @@ const contextDigest = (context, root) => sha256(canonical({
 }));
 const ledgerPath = (root, context) => join(root, `${sessionDigest(context.sessionId)}.jsonl`);
 const anchorPath = (root) => join(root, "session-anchors.v1.jsonl");
-const rootLockPath = (root) => join(root, ".writer.lock");
 const privateLedgerContractDigest = (contract) => {
 	if (!contract || typeof contract !== "object" || Array.isArray(contract)) return sha256(canonical(contract));
 	const { revokedAtSeq: _mutableRevocation,...immutable } = contract;
@@ -5606,14 +5721,23 @@ function ensureRoot(root) {
 	if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("private_ledger_root_unsafe");
 }
 function openRegular(path, flags, mode = 384) {
+	try {
+		const entry = lstatSync(path);
+		if (!entry.isFile() || entry.isSymbolicLink()) throw new Error("private_ledger_file_unsafe");
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
 	const fd = openSync(path, flags | (process.platform === "win32" ? 0 : constants.O_NOFOLLOW), mode);
-	const stat = fstatSync(fd);
-	if (!stat.isFile()) {
+	try {
+		const stat = fstatSync(fd);
+		const entry = lstatSync(path);
+		if (!stat.isFile() || !entry.isFile() || entry.isSymbolicLink() || stat.dev !== entry.dev || stat.ino !== entry.ino) throw new Error("private_ledger_file_unsafe");
+		if (process.platform !== "win32" && (stat.mode & 63) !== 0) fchmodSync(fd, 384);
+		return fd;
+	} catch (error) {
 		closeSync(fd);
-		throw new Error("private_ledger_file_unsafe");
+		throw error;
 	}
-	if (process.platform !== "win32" && (stat.mode & 63) !== 0) fchmodSync(fd, 384);
-	return fd;
 }
 function writeAll(fd, text) {
 	const bytes = Buffer.from(text);
@@ -5659,6 +5783,369 @@ function readAnchors(root) {
 	}
 	return anchors;
 }
+/**
+* The one full ledger read+chain-verify, shared by the read and append paths
+* (CG-083-PERF05: an append used to re-read the anchors AND the whole ledger
+* after already reading the anchors under the lock). Callers must already
+* hold the writer lock or accept the unlocked-read race the public API had.
+* Returns `undefined` for "ledger file missing" so callers can distinguish
+* the anchored-but-missing (damaged) case from an empty ledger.
+*/
+function readVerifiedLedgerRecords(root, context, session, expectedContext) {
+	const path = ledgerPath(root, context);
+	if (!existsSync(path)) return void 0;
+	const fd = openRegular(path, constants.O_RDONLY);
+	let raw;
+	try {
+		raw = readFileSync(fd, "utf8");
+	} finally {
+		closeSync(fd);
+	}
+	if (raw && !raw.endsWith("\n")) return void 0;
+	const records = [];
+	let prior = null;
+	for (const [index, line] of raw.split("\n").filter(Boolean).entries()) {
+		const value = JSON.parse(line);
+		const { record_sha256,...unsigned } = value;
+		if (value.version !== 1 || value.session_sha256 !== session || value.context_sha256 !== expectedContext || value.position !== index + 1 || value.prior_sha256 !== prior || ![
+			"release_reservation",
+			"release_settlement",
+			"restart_intent"
+		].includes(value.kind) || !value.payload || typeof value.payload !== "object" || Array.isArray(value.payload) || record_sha256 !== digestRecord(unsigned)) return void 0;
+		records.push(value);
+		prior = record_sha256;
+	}
+	return records;
+}
+/**
+* CG-083-F1 (revision 3): arbitration-log writer lock with optimistic
+* concurrency control. See docs/WRITER_LOCK_PROTOCOL.md "Revision 3".
+*
+* All authority decisions are records appended to `arbitration.log` (atomicity
+* assumptions A1/A2 in the doc). A claim carries `prev` — the holder nonce the
+* claimant observed — and the deterministic replay grants it only if the
+* current holder at its log position equals `prev`. Recovery appends
+* `evict {prev: deadNonce}` after an ESRCH probe; a delayed recoverer's record
+* is adjudicated against the CURRENT holder and simply has no effect when the
+* holder changed (L1/L2 structurally impossible: nothing is ever deleted from
+* or done to a pathname on the basis of an older observation).
+*
+* Bidirectional v2 upgrade barrier (L3): the v3 critical section also holds
+* the v2-shaped root `.writer.lock` (O_EXCL, version-2-shaped owner record).
+* A live v2 writer refuses (file exists); v3 refuses while a live/unknown v2
+* record exists; a v2 record whose pid answers ESRCH is removed by name (v2
+* has no self-recovery) and the migration proceeds.
+*/
+const ARBITRATION_NAME = "arbitration.log";
+const LEGACY_V2_LOCK_NAME = ".writer.lock";
+const PENDING_PREFIX = "pending.";
+const LOG_COMPACTION_RECORDS = 8192;
+function arbitrationPath(root) {
+	return join(root, ARBITRATION_NAME);
+}
+function legacyV2Path(root) {
+	return join(root, LEGACY_V2_LOCK_NAME);
+}
+/**
+* Parse the log (docs/WRITER_LOCK_PROTOCOL.md Revision 3.1, correction 3).
+* Unparseable lines — torn tails from a crash mid-append — are SKIPPED: they
+* never took effect, so skipping revokes nothing, and later complete records
+* stay visible (there is no truncation anywhere in the protocol, so a
+* truncate-and-revive race cannot exist). A final line without a trailing
+* newline is still replayed when it parses: it was fully written.
+*/
+function parseArbitration(root) {
+	let raw;
+	try {
+		raw = readFileSync(arbitrationPath(root), "utf8");
+	} catch {
+		return [];
+	}
+	const records = [];
+	for (const line of raw.split("\n")) {
+		if (line === "") continue;
+		try {
+			const value = JSON.parse(line);
+			if (value && value.v === 3 && (value.op === "claim" || value.op === "release" || value.op === "evict") && typeof value.nonce === "string" && value.nonce.length === 32 && typeof value.pid === "number" && Number.isSafeInteger(value.pid) && value.pid > 0 && typeof value.hostname === "string" && typeof value.created_at_epoch_ms === "number" && (value.prev === null || typeof value.prev === "string")) records.push(value);
+		} catch {}
+	}
+	return records;
+}
+/**
+* Deterministic replay (docs/WRITER_LOCK_PROTOCOL.md Revision 3.1). A claim
+* is effective ONLY when the slot is empty: a claim recorded while another
+* holder is current (e.g. one whose barrier was stolen on a stale legacy
+* observation) is stored but INEFFECTIVE, and the claimant exits on its
+* read-back. Release/evict take effect only for the current holder nonce.
+*/
+function replayHolder(records) {
+	let holder = null;
+	for (const record$2 of records) {
+		const isHolder = holder !== null && holder.nonce === record$2.prev;
+		if (record$2.op === "claim") {
+			if (holder === null) holder = {
+				nonce: record$2.nonce,
+				pid: record$2.pid,
+				hostname: record$2.hostname,
+				created_at_epoch_ms: record$2.created_at_epoch_ms
+			};
+		} else if (record$2.op === "release" || record$2.op === "evict") {
+			if (isHolder) holder = null;
+		}
+	}
+	return holder;
+}
+function readHolder(root) {
+	return replayHolder(parseArbitration(root));
+}
+/** Only ESRCH proves a recorded owner is gone; any other answer refuses. */
+function processExists(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code !== "ESRCH";
+	}
+}
+function unlinkIfExists(path) {
+	try {
+		unlinkSync(path);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+}
+function appendArbitration(root, record$2) {
+	let needsNewline = false;
+	try {
+		const raw = readFileSync(arbitrationPath(root), "utf8");
+		needsNewline = raw.length > 0 && !raw.endsWith("\n");
+	} catch {
+		needsNewline = false;
+	}
+	const fd = openRegular(arbitrationPath(root), constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND, 384);
+	try {
+		writeAll(fd, `${needsNewline ? "\n" : ""}${canonical(record$2)}\n`);
+		fsyncSync(fd);
+	} finally {
+		closeSync(fd);
+	}
+}
+function readLegacyV2(root) {
+	let raw;
+	try {
+		raw = readFileSync(legacyV2Path(root), "utf8");
+	} catch {
+		return;
+	}
+	if (!raw.trim()) return "legacy";
+	try {
+		const value = JSON.parse(raw);
+		if (value && (value.version === 2 || value.version === 3) && typeof value.nonce === "string" && (value.nonce.length === 32 || value.version === 2) && typeof value.pid === "number" && Number.isSafeInteger(value.pid) && value.pid > 0 && typeof value.hostname === "string" && typeof value.created_at_epoch_ms === "number") return value;
+	} catch {}
+	return "legacy";
+}
+function pendingPath(root, nonce) {
+	return join(root, `${PENDING_PREFIX}${nonce}.json`);
+}
+function removeOwnPending(root, nonce) {
+	unlinkIfExists(pendingPath(root, nonce));
+}
+function readRecord(path) {
+	let raw;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch {
+		return;
+	}
+	if (!raw.trim()) return "legacy";
+	try {
+		const value = JSON.parse(raw);
+		if (value && (value.version === 2 || value.version === 3) && typeof value.nonce === "string" && (value.nonce.length === 32 || value.version === 2) && typeof value.pid === "number" && Number.isSafeInteger(value.pid) && value.pid > 0 && typeof value.hostname === "string" && typeof value.created_at_epoch_ms === "number") return value;
+	} catch {}
+	return "legacy";
+}
+function recordIsProvablyDead(record$2) {
+	return record$2.hostname === hostname() && !processExists(record$2.pid);
+}
+/** Append one arbitration record (the ONLY mutation of the log). */
+function appendLog(root, op, nonce, prev) {
+	appendArbitration(root, {
+		v: 3,
+		op,
+		nonce,
+		prev,
+		pid: process.pid,
+		hostname: hostname(),
+		created_at_epoch_ms: Date.now()
+	});
+}
+/**
+* Acquire the writer lock. Returns the held nonce, or undefined when refused
+* (live/unknown holder, v2 barrier, or a lost optimistic claim).
+*/
+/**
+* Admission (Revision 3.1 + 3.2). The v2-compat barrier is PUBLISHED
+* atomically: the writer prepares `pending.<nonce>` with its complete owner
+* record (write + fsync) and hard-links it to `.writer.lock` — the barrier
+* therefore never exists with empty or partial content from this protocol
+* (S2 closed: a crash before the link leaves only an inert pending file, and
+* a crash after it leaves a complete record naming a provably dead owner,
+* both recoverable). A barrier left by a crashed V2 WRITER (empty, partial,
+* or complete-with-dead-pid) is classified separately: unknown owners refuse
+* with the documented manual migration; a complete same-host record whose
+* pid answers ESRCH is ADOPTED untouched. The log claim is effective only on
+* an empty slot and is verified by read-back.
+*/
+function acquireWriterLock(root) {
+	for (let attempt = 0; attempt < 16; attempt += 1) {
+		gcPendingFiles(root);
+		let barrierState = "absent";
+		const legacy = readLegacyV2(root);
+		if (legacy !== void 0) if (legacy === "legacy") barrierState = "unknown";
+		else if (legacy.hostname !== hostname()) barrierState = "unknown";
+		else if (processExists(legacy.pid)) barrierState = "live";
+		else barrierState = "adopted";
+		if (barrierState === "unknown" || barrierState === "live") return void 0;
+		const observed = readHolder(root);
+		if (observed !== null) {
+			if (observed.hostname !== hostname()) return void 0;
+			if (!processExists(observed.pid)) {
+				appendLog(root, "evict", randomBytes(16).toString("hex"), observed.nonce);
+				continue;
+			}
+			return;
+		}
+		const nonce = randomBytes(16).toString("hex");
+		let ownedBarrier = false;
+		if (barrierState === "absent") {
+			if (!publishBarrier(root, nonce)) continue;
+			ownedBarrier = true;
+		}
+		appendLog(root, "claim", nonce, null);
+		const holder = readHolder(root);
+		if (holder !== null && holder.nonce === nonce) {
+			compactLogInTenure(root, {
+				nonce,
+				ownedBarrier
+			});
+			return {
+				nonce,
+				ownedBarrier
+			};
+		}
+		if (ownedBarrier) {
+			const barrier = readLegacyV2(root);
+			if (barrier !== void 0 && barrier !== "legacy" && barrier.nonce === nonce) unlinkIfExists(legacyV2Path(root));
+		}
+		unlinkIfExists(pendingPath(root, nonce));
+		return;
+	}
+}
+/**
+* Publish the v2-compat barrier atomically (Revision 3.2): write the complete
+* owner record to a unique pending file (O_EXCL + fsync), then hard-link it
+* onto the barrier pathname. link() succeeds only when the barrier is absent,
+* and the linked content is the fully written record — the barrier can never
+* be observed empty or partial from this protocol. Returns false when the
+* barrier exists (caller re-classifies).
+*/
+function publishBarrier(root, nonce) {
+	const pending = pendingPath(root, nonce);
+	let fd;
+	try {
+		fd = openRegular(pending, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
+	} catch (error) {
+		if (error.code === "EEXIST") return false;
+		throw error;
+	}
+	try {
+		const record$2 = {
+			version: 2,
+			nonce,
+			pid: process.pid,
+			hostname: hostname(),
+			created_at_epoch_ms: Date.now()
+		};
+		writeAll(fd, `${canonical(record$2)}\n`);
+		fsyncSync(fd);
+	} finally {
+		try {
+			closeSync(fd);
+		} catch {}
+	}
+	try {
+		linkSync(pending, legacyV2Path(root));
+		return true;
+	} catch (error) {
+		unlinkIfExists(pending);
+		if (error.code === "EEXIST") return false;
+		throw error;
+	}
+}
+/** GC pending files whose embedded creator is provably dead (by name). */
+function gcPendingFiles(root) {
+	let entries;
+	try {
+		entries = readdirSync(root);
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		if (!entry.startsWith(PENDING_PREFIX)) continue;
+		const record$2 = readRecord(join(root, entry));
+		if (record$2 !== void 0 && record$2 !== "legacy" && recordIsProvablyDead(record$2)) unlinkIfExists(join(root, entry));
+	}
+}
+/**
+* Release (Revision 3.1): append the release record, then remove ONLY a
+* barrier this writer created in its own critical section (nonce-conditional).
+* An ADOPTED legacy barrier is left untouched — it keeps blocking v2 writers
+* until the documented manual migration removes it, and every later v3
+* admission re-adopts it.
+*/
+function releaseWriterLock(root, held) {
+	if (held === void 0) return;
+	appendLog(root, "release", held.nonce, held.nonce);
+	if (held.ownedBarrier) {
+		const barrier = readLegacyV2(root);
+		if (barrier !== void 0 && barrier !== "legacy" && barrier.nonce === held.nonce) unlinkIfExists(legacyV2Path(root));
+	}
+	removeOwnPending(root, held.nonce);
+}
+/** Compaction threshold; test-overridable via the internals hook. */
+let compactionRecordThreshold = LOG_COMPACTION_RECORDS;
+/**
+* Compaction (Revision 3.1, correction 4): performed ONLY by the current
+* holder inside its verified critical section. During a live holder's tenure
+* no concurrent record can be effective (claims need an empty slot; evicts
+* need a dead holder), so the rename window cannot drop an effective record:
+* the baseline re-installs the holder, and readers see the old or the new
+* file, both replaying to the same holder. State-equivalence is asserted by
+* the lock tests.
+*/
+function compactLogInTenure(root, held) {
+	if (parseArbitration(root).length <= compactionRecordThreshold) return;
+	const baseline = {
+		v: 3,
+		op: "claim",
+		nonce: held.nonce,
+		pid: process.pid,
+		hostname: hostname(),
+		created_at_epoch_ms: Date.now(),
+		prev: null
+	};
+	const tmp = join(root, `${ARBITRATION_NAME}.compact`);
+	const fd = openSync(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC, 384);
+	try {
+		writeAll(fd, `${canonical(baseline)}\n`);
+		fsyncSync(fd);
+	} finally {
+		closeSync(fd);
+	}
+	try {
+		renameSync(tmp, arbitrationPath(root));
+	} catch {}
+}
 function readPrivateLedger(root, input) {
 	if (!root) return {
 		records: [],
@@ -5686,46 +6173,24 @@ function readPrivateLedger(root, input) {
 			damaged: true,
 			anchored: true
 		};
-		const path = ledgerPath(root, context);
-		if (!existsSync(path)) return {
-			records: [],
-			damaged: anchored !== void 0,
-			anchored: anchored !== void 0
-		};
-		if (anchored === void 0) return {
-			records: [],
-			damaged: true,
-			anchored: false
-		};
-		const fd = openRegular(path, constants.O_RDONLY);
-		let raw;
-		try {
-			raw = readFileSync(fd, "utf8");
-		} finally {
-			closeSync(fd);
+		if (anchored === void 0) {
+			if (existsSync(ledgerPath(root, context))) return {
+				records: [],
+				damaged: true,
+				anchored: false
+			};
+			return {
+				records: [],
+				damaged: false,
+				anchored: false
+			};
 		}
-		if (raw && !raw.endsWith("\n")) return {
+		const records = readVerifiedLedgerRecords(root, context, session, expectedContext);
+		if (records === void 0) return {
 			records: [],
 			damaged: true,
 			anchored: true
 		};
-		const records = [];
-		let prior = null;
-		for (const [index, line] of raw.split("\n").filter(Boolean).entries()) {
-			const value = JSON.parse(line);
-			const { record_sha256,...unsigned } = value;
-			if (value.version !== 1 || value.session_sha256 !== session || value.context_sha256 !== expectedContext || value.position !== index + 1 || value.prior_sha256 !== prior || ![
-				"release_reservation",
-				"release_settlement",
-				"restart_intent"
-			].includes(value.kind) || !value.payload || typeof value.payload !== "object" || Array.isArray(value.payload) || record_sha256 !== digestRecord(unsigned)) return {
-				records: [],
-				damaged: true,
-				anchored: true
-			};
-			records.push(value);
-			prior = record_sha256;
-		}
 		return {
 			records,
 			damaged: false,
@@ -5746,7 +6211,8 @@ function initializePrivateLedger(root, input) {
 	try {
 		const context = normalizeContext(input);
 		ensureRoot(root);
-		lockFd = openRegular(rootLockPath(root), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL);
+		lockFd = acquireWriterLock(root);
+		if (lockFd === void 0) return false;
 		const session = sessionDigest(context.sessionId);
 		const expectedContext = contextDigest(context, root);
 		const anchored = readAnchors(root).get(session);
@@ -5777,14 +6243,7 @@ function initializePrivateLedger(root, input) {
 	} catch {
 		return false;
 	} finally {
-		if (lockFd !== void 0) {
-			try {
-				closeSync(lockFd);
-			} catch {}
-			try {
-				unlinkSync(rootLockPath(root));
-			} catch {}
-		}
+		releaseWriterLock(root, lockFd);
 	}
 }
 function appendPrivateLedger(root, input, kind, payload) {
@@ -5793,17 +6252,18 @@ function appendPrivateLedger(root, input, kind, payload) {
 	try {
 		const context = normalizeContext(input);
 		ensureRoot(root);
-		lockFd = openRegular(rootLockPath(root), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL);
+		lockFd = acquireWriterLock(root);
+		if (lockFd === void 0) return false;
 		const session = sessionDigest(context.sessionId);
 		const expectedContext = contextDigest(context, root);
 		const anchored = readAnchors(root).get(session);
 		if (anchored !== void 0 && anchored !== expectedContext) return false;
-		const snapshot$1 = anchored === void 0 ? {
-			records: [],
-			damaged: false
-		} : readPrivateLedger(root, context);
-		if (snapshot$1.damaged) return false;
-		if (anchored === void 0) {
+		let records = [];
+		if (anchored !== void 0) {
+			const verified = readVerifiedLedgerRecords(root, context, session, expectedContext);
+			if (verified === void 0) return false;
+			records = verified;
+		} else {
 			const unsignedAnchor = {
 				version: 1,
 				session_sha256: session,
@@ -5823,7 +6283,7 @@ function appendPrivateLedger(root, input, kind, payload) {
 		}
 		if (kind === "release_settlement") {
 			const settlement = normalizeSettlement(payload);
-			const reservation = settlement && [...snapshot$1.records].reverse().find((record$3) => record$3.kind === "release_reservation" && record$3.payload.contractId === settlement.contractId && record$3.payload.operation === settlement.operation && record$3.payload.callId === settlement.callId);
+			const reservation = settlement && [...records].reverse().find((record$3) => record$3.kind === "release_reservation" && record$3.payload.contractId === settlement.contractId && record$3.payload.operation === settlement.operation && record$3.payload.callId === settlement.callId);
 			if (!reservation) return false;
 			payload = {
 				...payload,
@@ -5836,8 +6296,8 @@ function appendPrivateLedger(root, input, kind, payload) {
 			version: 1,
 			session_sha256: session,
 			context_sha256: expectedContext,
-			position: snapshot$1.records.length + 1,
-			prior_sha256: snapshot$1.records.at(-1)?.record_sha256 ?? null,
+			position: records.length + 1,
+			prior_sha256: records.at(-1)?.record_sha256 ?? null,
 			kind,
 			payload
 		};
@@ -5857,14 +6317,7 @@ function appendPrivateLedger(root, input, kind, payload) {
 	} catch {
 		return false;
 	} finally {
-		if (lockFd !== void 0) {
-			try {
-				closeSync(lockFd);
-			} catch {}
-			try {
-				unlinkSync(rootLockPath(root));
-			} catch {}
-		}
+		releaseWriterLock(root, lockFd);
 	}
 }
 function applyPrivateLedger(projection, snapshot$1) {
@@ -6306,20 +6759,80 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 	let synchronizedOnce = false;
 	const continuationAttempts = projection.continuationAttempts;
 	const persistenceCorrectionAttempts = projection.persistenceCorrectionAttempts;
-	const rebuild = () => {
+	let refreshEpoch = 0;
+	let lastFullSync;
+	const sameSnapshotIdentity = (candidate, consumed) => {
+		if (candidate.length !== consumed.length) return false;
+		for (let index = 0; index < candidate.length; index += 1) if (candidate[index] !== consumed[index]) return false;
+		return true;
+	};
+	/**
+	* F2/R1: element-wise identity alone cannot protect the fast path when the
+	* session view hands out the SAME MUTABLE array (or mutably nested event
+	* objects): the saved reference compares equal to itself while its content
+	* drifts. The adapter only validates envelopes, not immutability, so the
+	* fast path is served ONLY for snapshots whose immutability is PROVABLE:
+	* every container in the snapshot is Object.isFrozen, checked recursively
+	* under a node budget. A snapshot that fails (or exhausts) the check is
+	* "not provable" and always takes the full rebuild — fail-closed, never
+	* cached. Passing results are remembered per array object: freezing is
+	* irreversible, so a previously proven snapshot cannot become mutable.
+	*/
+	const provenImmutableSnapshots = /* @__PURE__ */ new WeakSet();
+	const IMMUTABILITY_PROOF_NODE_BUDGET = 4e5;
+	/**
+	* F2 (round 3): freezing a container does NOT freeze its content when a
+	* property is an accessor — a frozen getter's return value follows its
+	* closure. Eligibility therefore requires every property to be an ordinary
+	* DATA descriptor whose value is itself provably immutable. Accessor
+	* descriptors (get/set) make the whole snapshot unprovable: full rebuild,
+	* never cached. The value of a data descriptor is read for the recursion
+	* only — a single read is not treated as a permanent immutability proof of
+	* anything mutable; only the descriptor SHAPE plus frozen containers are.
+	*/
+	const snapshotIsProvablyImmutable = (events) => {
+		if (provenImmutableSnapshots.has(events)) return true;
+		let visited = 0;
+		const walk = (value) => {
+			if (value === null || typeof value !== "object") return true;
+			if (++visited > IMMUTABILITY_PROOF_NODE_BUDGET) return false;
+			if (!Object.isFrozen(value)) return false;
+			for (const key of Object.getOwnPropertyNames(value)) {
+				const descriptor = Object.getOwnPropertyDescriptor(value, key);
+				if (!descriptor) return false;
+				if (descriptor.get !== void 0 || descriptor.set !== void 0) return false;
+				if (descriptor.value !== void 0 && !walk(descriptor.value)) return false;
+			}
+			return true;
+		};
+		if (!walk(events)) return false;
+		provenImmutableSnapshots.add(events);
+		return true;
+	};
+	const readGoalOnce = () => {
+		if (!readGoalState) return {
+			state: void 0,
+			failed: false
+		};
+		try {
+			return {
+				state: normalizeGoalState(readGoalState()),
+				failed: false
+			};
+		} catch {
+			return {
+				state: void 0,
+				failed: true
+			};
+		}
+	};
+	const goalKeyOf = (goal) => goal.failed ? "error" : goal.state ? `${goal.state.id}\0${goal.state.revision}\0${goal.state.phase}\0${goal.state.activation}` : "none";
+	const ledgerSnapshotKey = (snapshot$1) => `${snapshot$1.records.length}\0${snapshot$1.records.at(-1)?.record_sha256 ?? ""}\0${snapshot$1.damaged ? "d" : "-"}\0${snapshot$1.anchored ? "a" : "-"}`;
+	const rebuild = (events, goal, ledger) => {
 		const previousReleaseContracts = projection.releaseContracts.length;
 		const header = session.header;
 		const priorRecoveryDigest = projection.lastRecoveryDigest;
 		const sessionHeader = sessionHeaderForDigest(session);
-		let events;
-		try {
-			events = snapshotSessionEvents(session);
-		} catch (error) {
-			const code = error instanceof SessionApiError ? error.code : "session_snapshot_failed";
-			projection.integrity = "unknown";
-			if (!projection.integrityViolations.includes(code)) projection.integrityViolations.push(code);
-			return;
-		}
 		const derived = deriveProjection(events, {
 			activation: config.activation,
 			policy: config.policy
@@ -6328,8 +6841,8 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 			sessionHeader
 		}, durabilityConfirmed, hostLock);
 		Object.assign(projection, derived.projection);
-		if (readPrivateRecords) {
-			let privateSnapshot = readPrivateRecords();
+		if (readPrivateRecords && ledger) {
+			let privateSnapshot = ledger;
 			if (!synchronizedOnce && events.length === 0 && !privateSnapshot.damaged && !privateSnapshot.anchored && initializePrivateRecords?.()) privateSnapshot = readPrivateRecords();
 			if (projection.releaseContracts.length > 0 && !privateSnapshot.damaged && !privateSnapshot.anchored) if (synchronizedOnce && previousReleaseContracts === 0 && initializePrivateRecords?.()) privateSnapshot = readPrivateRecords();
 			else privateSnapshot = {
@@ -6338,21 +6851,27 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 				anchored: false
 			};
 			applyPrivateLedger(projection, privateSnapshot);
+			ledger = privateSnapshot;
 		}
 		synchronizedOnce = true;
+		lastFullSync = {
+			events,
+			headerRef: session.header,
+			durability: durabilityConfirmed,
+			goalKey: goalKeyOf(goal),
+			ledgerKey: ledger ? ledgerSnapshotKey(ledger) : "",
+			refreshEpoch
+		};
 		if (!sessionHeader) {
 			projection.integrity = "unknown";
 			if (!projection.integrityViolations.includes("session_ref_unavailable")) projection.integrityViolations.push("session_ref_unavailable");
 		}
-		if (readGoalState) try {
-			const state = normalizeGoalState(readGoalState());
-			if (state && projection.currentGoalRef?.id === state.id && projection.currentGoalRef.revision === state.revision) {
-				projection.currentGoalPhase = state.phase;
-				projection.currentGoalActivation = state.activation;
-			}
-		} catch {
+		if (goal.failed) {
 			projection.integrity = "unknown";
 			projection.integrityViolations.push("goal_readback_unavailable");
+		} else if (goal.state && projection.currentGoalRef?.id === goal.state.id && projection.currentGoalRef.revision === goal.state.revision) {
+			projection.currentGoalPhase = goal.state.phase;
+			projection.currentGoalActivation = goal.state.activation;
 		}
 		projection.continuationAttempts = continuationAttempts;
 		projection.persistenceCorrectionAttempts = persistenceCorrectionAttempts;
@@ -6360,7 +6879,7 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 		projection.durabilityWatermark = durabilityWatermark;
 		if (projection.boundaryProtocol === 6 && durabilityWatermark === "confirmed") try {
 			const displayOrigins = /* @__PURE__ */ new Map();
-			projection.coreV2 = projectSessionCoreV2(session.snapshotEvents(), projection, displayOrigins);
+			projection.coreV2 = projectSessionCoreV2(events, projection, displayOrigins);
 			projection.coreV2RequirementOrigins = projection.coreV2 ? displayOrigins : void 0;
 			projection.coreV2Reason = projection.coreV2 ? void 0 : "source_not_projectable";
 		} catch {
@@ -6409,8 +6928,22 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 					});
 				}
 			}
+			refreshEpoch += 1;
 		}
-		rebuild();
+		let events;
+		try {
+			events = snapshotSessionEvents(session);
+		} catch (error) {
+			const code = error instanceof SessionApiError ? error.code : "session_snapshot_failed";
+			projection.integrity = "unknown";
+			if (!projection.integrityViolations.includes(code)) projection.integrityViolations.push(code);
+			lastFullSync = void 0;
+			return;
+		}
+		const goal = readGoalOnce();
+		const ledger = readPrivateRecords ? readPrivateRecords() : void 0;
+		if (lastFullSync && snapshotIsProvablyImmutable(events) && lastFullSync.refreshEpoch === refreshEpoch && sameSnapshotIdentity(events, lastFullSync.events) && Object.is(lastFullSync.headerRef, session.header) && lastFullSync.durability === durabilityConfirmed && lastFullSync.goalKey === goalKeyOf(goal) && (!readPrivateRecords || lastFullSync.ledgerKey === ledgerSnapshotKey(ledger))) return;
+		rebuild(events, goal, ledger);
 	};
 	const runHostLockEntry = async (operation) => {
 		if (!refreshHostLock) return await operation();
@@ -6437,7 +6970,7 @@ function createRuntime(agent, config, hostLock = DEFAULT_HOST_LOCK, readGoalStat
 		pendingRecoveryCauses = /* @__PURE__ */ new Set();
 		return was;
 	};
-	rebuild();
+	sync();
 	return {
 		projection,
 		session,
@@ -6556,12 +7089,16 @@ function registerPassiveHostWorkdirObserver(agent, hostLockAtCall, attestedRoute
 	if (typeof agent.ctx.on !== "function") return () => {};
 	const pending = /* @__PURE__ */ new WeakMap();
 	const pre = agent.ctx.on("tools/pre-execute", async (exec, next) => {
-		if (exec.agent === agent && (exec.name === "bash" || exec.name === "pwsh")) try {
-			const policy = agent.ctx.get("sandboxPolicy");
-			const audit = createHostAuditSession();
-			const receipt = captureHostWorkdir(agent.session, exec, hostLockAtCall(audit), policy, await attestedRouteAtCall(exec.name, agent.ctx.get("shell"), policy, audit), sourcedRootAtCall?.(exec) ?? null, SESSION_FORMAT_VERSION);
-			if (receipt) pending.set(exec, receipt);
-		} catch {}
+		if (exec.agent === agent && (exec.name === "bash" || exec.name === "pwsh")) {
+			const args = typeof exec.arguments === "object" && exec.arguments !== null ? exec.arguments : {};
+			const command = String(args.command ?? "").trim();
+			if (exec.parent === void 0 && exec.rootCallId === exec.callId && !Object.hasOwn(args, "workdir") && args.run_in_background !== true && /^(?:npm|pnpm)\s+test$/u.test(command)) try {
+				const policy = agent.ctx.get("sandboxPolicy");
+				const audit = createHostAuditSession();
+				const receipt = captureHostWorkdir(agent.session, exec, hostLockAtCall(audit), policy, await attestedRouteAtCall(exec.name, agent.ctx.get("shell"), policy, audit), sourcedRootAtCall?.(exec) ?? null, SESSION_FORMAT_VERSION);
+				if (receipt) pending.set(exec, receipt);
+			} catch {}
+		}
 		return next();
 	});
 	const post = agent.ctx.on("tools/post-execute", async (exec, _result, next) => {
@@ -6639,19 +7176,24 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 	};
 	const ensure = (agent) => {
 		let runtime = runtimes.get(agent);
+		let created = false;
 		if (!runtime) {
 			const goals = qualifiedGoalService(agent);
 			const agentHostLock = refreshAgentHostLock(agent);
 			runtime = createRuntime(agent, config, agentHostLock, goals ? () => goals.get(agent) : void 0, () => refreshAgentHostLock(agent), privateLedgerRoot ? () => readPrivateLedger(privateLedgerRoot, ledgerContext(agent, agentHostLock)) : void 0, privateLedgerRoot ? () => initializePrivateLedger(privateLedgerRoot, ledgerContext(agent, agentHostLock)) : void 0);
 			runtimes.set(agent, runtime);
+			created = true;
 		}
-		return runtime;
+		return {
+			runtime,
+			created
+		};
 	};
-	ctx.commands.register(createContextGuardCommand((agent) => ensure(agent).projection, (agent, enabled) => ensure(agent).setEnabled(enabled), (agent) => ensure(agent).sync(), (agent) => ensure(agent).lifecycle));
+	ctx.commands.register(createContextGuardCommand((agent) => ensure(agent).runtime.projection, (agent, enabled) => ensure(agent).runtime.setEnabled(enabled), (agent) => ensure(agent).runtime.sync(), (agent) => ensure(agent).runtime.lifecycle));
 	const attach = (agent, source) => {
 		if (registrations.has(agent)) {
 			if (source === "resume" || source === "compact") {
-				const runtime = ensure(agent);
+				const { runtime } = ensure(agent);
 				runtime.sync();
 				runtime.projection.lastRecoveryDigest = void 0;
 				runtime.markRecoveryNeeded(source === "resume" ? "resume" : "compaction");
@@ -6668,8 +7210,8 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 			guard: (...args) => own(agent.ctx.tools.guard(...args))
 		};
 		try {
-			const runtime = ensure(agent);
-			runtime.sync();
+			const { runtime, created } = ensure(agent);
+			if (!created) runtime.sync();
 			if (source === "resume" || source === "compact") {
 				runtime.projection.lastRecoveryDigest = void 0;
 				runtime.markRecoveryNeeded(source === "resume" ? "resume" : "compaction");
@@ -6895,7 +7437,7 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 	for (const agent of ctx.get?.("agents")?.list() ?? []) attach(agent);
 	ctx.on("agent/pre-step", async ({ agent }, next) => {
 		const durability = await ctx.sessions.flush(agent.session);
-		const runtime = ensure(agent);
+		const { runtime } = ensure(agent);
 		runtime.setDurability(durability);
 		runtime.sync();
 		const decision = await next();
@@ -6951,7 +7493,7 @@ function apply(ctx, rawConfig = {}, seams = {}) {
 		return decision;
 	});
 	ctx.on("agent/turn-stopping", async ({ agent }) => {
-		const runtime = ensure(agent);
+		const { runtime } = ensure(agent);
 		const goals = qualifiedGoalService(agent);
 		await handleGuardTurnStopping(agent, runtime, {
 			flush: () => ctx.sessions.flush(agent.session),
@@ -7183,4 +7725,4 @@ async function replayRawV2(input) {
 }
 
 //#endregion
-export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, BASE_HOST_PACKAGES, BOUNDARY_RECORD_PREFIX, BOUNDED_ARTIFACT_TYPES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, CERTIFICATE_VERSION_V2, CLEANUP_CONDITION_RULE, CLEANUP_CONDITION_RULE_COMPACT, CLEANUP_CONDITION_RULE_SHORT, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_DELEGATION_TOOL_NAMES, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DEPENDENCY_FREE_ONLY_CONDITION, DESKTOP_IDENTITY_FACTS, DESKTOP_PROFILE_PACKAGE_NAME, DESKTOP_RUNTIME_PACKAGE_NAME, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GRANTED_QUALIFICATION, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HOST_VALIDATED_VERSIONS, HostProfileError, HostTrustError, LATEST_TESTED_HOST_VERSION, LEGACY_QUALIFICATION, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_CAPABILITY_MATRIX, PROOF_KINDS, PROOF_KINDS_V2, PROOF_MANIFEST_DOMAIN_V2, PROOF_PROTOCOL_VERSION, PROOF_PROTOCOL_VERSION_V2, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, PROTOCOL_V5_NOTICE, PROTOCOL_V6_NOTICE, RC020_RC1_HOST_PACKAGES, RC020_RC2_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, STOP_PROTOCOL_VERSION_V2, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, SessionApiError, V6_ORDINARY_COMPLETION_RULE, V6_ORDINARY_COMPLETION_RULE_COMPACT, V6_ORDINARY_COMPLETION_RULE_SHORT, acquireHostTrust, actionCompatible, actionHasCertificationPath, actionVerbMatches, activeRendererModule, admissibleForRemoval, apply, applyUpgradeEligibility, assessmentAction, assessmentOutcomePredicate, auditDesktopInstalledImplementation, auditedDefaultWorkdirHost, auditedDefaultWorkdirProvider, auditedForegroundRenderers, auditedHostImplementation, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindProofV2ToProjection, bindingIndividuallyAccepted, bindingSatisfies, boundedArtifactChoiceMatches, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, capabilityConsequence, capabilityFactOf, capabilityRemedyPhrase, captureClause, captureItem, carriesCleanupCondition, certifyCheckpoint, claimedBatchHasRealRootInput, clarifiedSpanOf, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, clauseAsksOwnQuestion, clauseIsGoverned, clauseIsProtected, cleanupConditionFor, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, createProofManifestV2, currentActionBases, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, environmentDefaultRepositoryTarget, evaluateActiveHostLock, evaluateConfiguredHostLock, evaluateExternalWaitCapability, evaluateGraphDerivedHostLock, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, explanationHasActionResidue, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, firstStepGuidance, firstStepGuidanceV6, gitCommandMatchesTarget, goalCompletionDenial, governedClauseRestrictsExecution, hasCurrentCertificate, hasDesktopImporterState, hasOrderedCoordination, hasQuestionScope, hasWorkPredicate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostTrustDigest, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectDesktopTargetGraph, inspectTargetHostGraph, interpretClause, interpretMessage, introducesActionClause, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isExplanationScope, isFrozenV042RebindResponse, isInformationalFragment, isInformationalMessage, isOpenObligation, isQuestionScopeNeedingReview, isRestatement, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, itemHoldsExecutionAuthority, kindOfScope, latestAssistantText, latestRootInstruction, legacyQuestionReadingIsInformational, legacyRecordsNeedingReview, lifecyclePhase, maskCodeSpans, maskQuotedSpans, name, namedActions, nativeFileTwoRole, normalizeClause, observeAssistantOutcome, openItems, opensConditionLead, opensWithDirective, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostTrust, parseHostVersion, parsePwshCommand, parseShellCommand, partialFailureOf, persistedToolResultStatus, prepareActiveHostTrust, prepareDesktopHostTrust, prepareTargetHostTrust, presentExplanationHead, previewFirstStepInjection, progressFingerprint, projectCoreV2, projectSessionCoreV2, proofCapabilityReport, proofDigest, proofDigestV2, proofEvidenceConstraints, proofHostSurfacesOf, proofOperationMatches, proofV2Rejection, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualificationOfClause, qualifyBoundary, qualifyHostTrust, questionHeadsClause, readActiveHostGraph, readAsarFile, readAsarIndex, readDesktopAppRuntime, readDesktopDependency, readDesktopTargetGraph, rebindAttemptKey, rebindResponse, recoveryDigest, recoveryTitle, registryArchiveFiles, registryArchiveModules, relevantEvidence, removalIsComplete, removalIsPartiallyKnown, renderRecoveryPacket, replayRawV2, replayRebindResult, reportingHeadGoverns, requestedIdentityKey, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, requiredSubjectsOf, resolveActiveProfileHostLock, resolveDesktopProfileHostLock, resolveInstalledHostLock, restatedContentOf, revalidateDesktopCoreLock, revalidateGitPrestate, rootLocatorFlavor, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, scopeCoverageDigest, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sessionQueryV2, sha256, snapshotSessionEvents, splitTextFragments, statefulActionsOfScope, supersedeItem, testOutcomePredicate, v6CurrentRootBoundaries, v6TestPredicate, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, validateProofManifestV2, verbIsNegated, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability, writeDesktopRuntimeReceipt };
+export { ACTION_MANIFEST, ACTION_MANIFEST_VERSION, ACTIVE_HOST_COHORT_ID, ACTIVE_HOST_COHORT_IDS, ACTIVE_HOST_LAUNCHER_VERSION, BASE_HOST_PACKAGES, BOUNDARY_RECORD_PREFIX, BOUNDED_ARTIFACT_TYPES, CAPTURE_V042_NOTICE, CERTIFICATE_VERSION, CERTIFICATE_VERSION_V2, CLEANUP_CONDITION_RULE, CLEANUP_CONDITION_RULE_COMPACT, CLEANUP_CONDITION_RULE_SHORT, COMMAND_SURFACE_MANIFEST, CONFIRM_LINE_PATTERN, CONTROL_RECORD_PREFIX, Config, DEFAULT_DELEGATION_TOOL_NAMES, DEFAULT_HOST_LOCK, DEFAULT_RECOVERY_CHAR_BUDGET, DEPENDENCY_FREE_ONLY_CONDITION, DESKTOP_IDENTITY_FACTS, DESKTOP_PROFILE_PACKAGE_NAME, DESKTOP_RUNTIME_PACKAGE_NAME, EXPECTED_HOST_PACKAGES, FIRST_STEP_GUIDANCE, GIT_COMMAND_MANIFEST_IDS, GIT_COMMAND_TEMPLATES, GOAL_HOST_PACKAGES, GRANTED_QUALIFICATION, HOST_CAPABILITY_PACKAGE_GROUPS, HOST_COHORTS, HOST_VALIDATED_VERSIONS, HostProfileError, HostTrustError, LATEST_TESTED_HOST_VERSION, LEGACY_QUALIFICATION, MIN_RECOVERY_CHAR_BUDGET, MIN_SUPPORTED_HOST_VERSION, NATIVE_GIT_ROOT_PARENT_OID, NO_PROGRESS_RECORD_PREFIX, NO_PROGRESS_TURNS_BEFORE_STOP, PROOF_CAPABILITY_MATRIX, PROOF_KINDS, PROOF_KINDS_V2, PROOF_MANIFEST_DOMAIN_V2, PROOF_PROTOCOL_VERSION, PROOF_PROTOCOL_VERSION_V2, PROTOCOL_V3_NOTICE, PROTOCOL_V4_NOTICE, PROTOCOL_V5_NOTICE, PROTOCOL_V6_NOTICE, RC020_RC1_HOST_PACKAGES, RC020_RC2_HOST_PACKAGES, SEMANTIC_ACTIONS, SESSION_API_UNSUPPORTED, SESSION_EVENT_ENVELOPE_INVALID, STATEFUL_ACTIONS, STOP_PROTOCOL_VERSION, STOP_PROTOCOL_VERSION_V2, SUPPORTED_EVIDENCE_ADAPTERS, SUPPORTED_HOST_RANGE, SUPPORTED_HOST_VERSIONS, SessionApiError, V6_ORDINARY_COMPLETION_RULE, V6_ORDINARY_COMPLETION_RULE_COMPACT, V6_ORDINARY_COMPLETION_RULE_SHORT, acquireHostTrust, actionCompatible, actionHasCertificationPath, actionVerbMatches, activeRendererModule, admissibleForRemoval, apply, applyUpgradeEligibility, assessmentAction, assessmentOutcomePredicate, auditDesktopInstalledImplementation, auditedDefaultWorkdirHost, auditedDefaultWorkdirProvider, auditedForegroundRenderers, auditedHostImplementation, authorityCaptureCounts, availableBoundaryQualifications, bindExecutableIdentity, bindLiveGoalCapability, bindProofToProjection, bindProofV2ToProjection, bindingIndividuallyAccepted, bindingSatisfies, boundedArtifactChoiceMatches, canonicalArgvFromCommand, canonicalProjection, canonicalizePath, capabilityConsequence, capabilityFactOf, capabilityRemedyPhrase, captureClause, captureItem, carriesCleanupCondition, certifyCheckpoint, claimedBatchHasRealRootInput, clarifiedSpanOf, classifyClause, classifyCompletionClaim, classifyTaskIntent, classifyUserInteraction, clauseAsksOwnQuestion, clauseIsGoverned, clauseIsProtected, cleanupConditionFor, closingHint, combineHostPolicy, commitIndexSnapshotDigest, commitTreeSnapshotDigest, compareHostVersions, confirmRebind, createGitPrestateEnvelope, createProjection, createProofManifest, createProofManifestV2, currentActionBases, currentContractDigest, decideTurnBoundary, decideTurnStopping, decisionBoundaryKey, deriveItemDiagnosis, deriveProjection, digestStrings, effectuateBoundary, environmentDefaultRepositoryTarget, evaluateActiveHostLock, evaluateConfiguredHostLock, evaluateExternalWaitCapability, evaluateGraphDerivedHostLock, evaluateHostCapability, evaluateHostLock, evaluateMinimumHostVersion, evaluateToolSurfaceCapability, evidenceAvailabilityReason, evidenceCoverage, evidenceFromPersistedToolResult, evidenceMatchesItem, executeRevalidatedGitEffect, explanationHasActionResidue, extractArtifactPaths, extractMethod, extractOperation, extractTextContent, extractToolSubject, firstStepGuidance, firstStepGuidanceV6, gitCommandMatchesTarget, goalCompletionDenial, governedClauseRestrictsExecution, hasCurrentCertificate, hasDesktopImporterState, hasOrderedCoordination, hasQuestionScope, hasWorkPredicate, hostLockContextFromComposedDump, hostLockRowsFromComposedDump, hostTrustDigest, hostVersionFromPackages, inject, injectActiveProfileHostLock, inspectDesktopTargetGraph, inspectTargetHostGraph, interpretClause, interpretMessage, introducesActionClause, isCurrentAcceptedBoundary, isDeterministicCheck, isExecutableItem, isExplanationScope, isFrozenV042RebindResponse, isInformationalFragment, isInformationalMessage, isOpenObligation, isQuestionScopeNeedingReview, isRestatement, isRootPauseRequest, isRunExecutable, isStatefulAction, isVerifyingCapability, isWholeTaskCompletionClaim, itemDiagnosis, itemHoldsExecutionAuthority, kindOfScope, latestAssistantText, latestRootInstruction, legacyQuestionReadingIsInformational, legacyRecordsNeedingReview, lifecyclePhase, maskCodeSpans, maskQuotedSpans, name, namedActions, nativeFileTwoRole, nativeGitParentOidVerified, normalizeClause, observeAssistantOutcome, openItems, opensConditionLead, opensWithDirective, packageRowsFromActiveGraph, packageRowsFromPnpmLock, parseConfirmationMessage, parseGitCommandManifest, parseHostTrust, parseHostVersion, parsePwshCommand, parseShellCommand, partialFailureOf, persistedToolResultStatus, prepareActiveHostTrust, prepareDesktopHostTrust, prepareTargetHostTrust, presentExplanationHead, previewFirstStepInjection, progressFingerprint, projectCoreV2, projectSessionCoreV2, proofCapabilityReport, proofDigest, proofDigestV2, proofEvidenceConstraints, proofHostSurfacesOf, proofOperationMatches, proofV2Rejection, proposeRebind, proposeRebindOutcome, proposeRebindV042, qualificationOfClause, qualifyBoundary, qualifyHostTrust, questionHeadsClause, readActiveHostGraph, readAsarFile, readAsarIndex, readDesktopAppRuntime, readDesktopDependency, readDesktopTargetGraph, rebindAttemptKey, rebindResponse, recoveryDigest, recoveryTitle, registryArchiveFiles, registryArchiveModules, relevantEvidence, removalIsComplete, removalIsPartiallyKnown, renderRecoveryPacket, replayRawV2, replayRebindResult, reportingHeadGoverns, requestedIdentityKey, requestedTargetAuthorizesMutation, requestedTargetMatchesResolved, requiredSubjectsOf, resolveActiveProfileHostLock, resolveDesktopProfileHostLock, resolveInstalledHostLock, restatedContentOf, revalidateDesktopCoreLock, revalidateGitPrestate, rootLocatorFlavor, sanitizeClauseText, sanitizeUrl, satisfiesSupportedHostRange, scopeCoverageDigest, segmentAuthorityBlocks, segmentClauses, selectHostCohort, semanticActionFromCommand, semanticActionFromText, semanticActionOfScope, sessionQuery, sessionQueryV2, sha256, shellReadbackOutcome, snapshotSessionEvents, splitTextFragments, statefulActionsOfScope, supersedeItem, testOutcomePredicate, v6CurrentRootBoundaries, v6TestPredicate, validateActionManifest, validateActionTarget, validateManifest, validateProofManifest, validateProofManifestV2, verbIsNegated, verifiedLinearCommitReadback, verifyComposedHostLockDump, withDurability, writeDesktopRuntimeReceipt };