fix(shell): reconcile task updates by origin

docs/fork-modifications.en.md

@@ -1,6 +1,6 @@
 # CodeWhale Fork Modification Register
 
-> Updated: 2026-09-01. Public maintenance baseline: upstream `v0.9.5` r13, published through CodeWhale PR #32; the parent gitlink lands via parent PR #370. Canonical Chinese register: [`docs/fork-modifications.md`](fork-modifications.md). This English page is a condensed summary; the Chinese version is the complete, authoritative register.
+> Updated: 2026-09-04. Public maintenance baseline: upstream `v0.9.5` r13, published through CodeWhale PR #32; an exact, unpublished r14 candidate adds Shell task-origin reconciliation. Canonical Chinese register: [`docs/fork-modifications.md`](fork-modifications.md). This English page is a condensed summary; the Chinese version is the complete, authoritative register.
 >
 > 2026-08-22 corrections: (1) the parent gitlink bump from r6 (`3bbf8421`) to r7 happened in parent PR #285 (`95502ac8`), not in PR #302 — PR #302 started from a pre-#285 main and merged without touching the gitlink; PR #305 later advanced the published baseline to r8. (2) PR #302 (capability-bundle unification, parent commit `c75f2fb2`) updated the parent-side scope model — the single `disabled_bundles.json` (package id × mode, plus `hidden_scopes`) replaced the separate `disabled_connectors.json` / `disabled_skills.json` files.
 
@@ -10,19 +10,25 @@
 |---|---|
 | Upstream | `v0.9.5` at `853cb707bbcf4f7dc4268fba6d811e0d04083f9c` |
 | Public maintenance branch | `Pinvou/CodeWhale:pinvou3-clean` at `f853f8f1` (r13: r12 plus PR #32 GAIA benchmark isolation) |
+| Unpublished candidate | r14 candidate `5a5bf363` (stable Shell tool-call/turn origin) |
 | Merged fixes | Existing `#9`, `#11`, `#12`, `#13`, `#15`, `#16`, `#17`, and `#19`, plus r11 PRs `#18`, `#21`, `#22`, `#25`, `#26`, `#27`, `#29`, `#30`, r12 PRs `#33`, `#35`, and r13 PR `#32`, are merged |
-| Published status | `pinvou3-clean` and immutable tag `pinvou-v0.9.5-r13` resolve to `f853f8f1566c57e6be40d5439a222a932aa79ef5`; `r1` through `r13` remain immutable; the parent gitlink is aligned by PR #370 |
+| Published status | `pinvou3-clean` and immutable tag `pinvou-v0.9.5-r13` resolve to `f853f8f1566c57e6be40d5439a222a932aa79ef5`; `r1` through `r13` remain immutable; the development parent gitlink temporarily points to the exact r14 candidate under review |
 | Previous baseline backup | Tag `pinvou-v0.9.0-r4` and branch `backup/pinvou3-clean-v0.9.0-r4`, both at `03e9e1027c03ce1e4b35ab9e3ccce751b65b9624` |
-| Drift | r13 baseline totals 110 files, `+10895/-1195` (net 9,700 added lines); r12→r13 is 6 files, `+1088/-1` |
+| Drift | r13 baseline totals 110 files, `+10895/-1195` (net 9,700 added lines); r12→r13 is 6 files, `+1088/-1`; the r14 candidate is 7 files, `+133/-7` over r13 |
 | Organization | Four current long-lived topics; PR #13 removes the product-specific orchestration topic |
-| Guard inventory | r13 has 63 CodeWhale `forkguard_*` tests, including six GAIA benchmark-isolation tests, plus generic tool/route compatibility regressions and parent fingerprints/behavior tests |
+| Guard inventory | r13 has 63 CodeWhale `forkguard_*` tests, including six GAIA benchmark-isolation tests; the r14 candidate adds two Shell-origin behavior tests (65 total) plus parent timeline-projection coverage |
 
 ### r12 provider-native search and keyless Bing tail (engine side merged)
 
 - CodeWhale PR #33 (six commits merged at `4f612e548`): adds provider-native search adapters for DeepSeek Responses, Model Studio Token Plan (Qwen), Moonshot/Kimi (K2.6 builtin `$web_search`, K3 official Formula protocol, Kimi Code `/search`), Z.AI/Zhipu (global `search-prime` / China `search_std`), and Xiaomi MiMo. Capability gating is exact to provider+model+official endpoint+product surface and fails closed; K3 Formula gets a dedicated 180-second budget and an 8-call limit. The reviewer-found loose endpoint matching (whole-URL lowercasing, unlimited trailing slashes) was tightened in the closing commit `4f612e548` via `is_exact_url_route`. Fingerprint anchors: `documented_server_side_web_search_for_route`, `WEB_SEARCH_FORMULA_URI`.
 - CodeWhale PR #35 (merged at `9c5f4f19`): the keyless chain tail after API-backed providers switches from DuckDuckGo to Bing (live measurements show DDG is DNS-poisoned and SNI-reset in mainland China while Bing serves both global and China endpoints keyless); the all-backends-down error now suggests API-backed `[search]` providers; adds `forkguard_api_provider_chain_tail_is_bing` (forkguard total 56→57).
 - r12 parent-side integration (PR #375): gitlink → `9c5f4f19`, settings-page search-source guidance copy (i18n zh/en/ja), and comment corrections in `prefs/search.rs` plus the matching `bridge.rs` injection-site comment and test docstring (the engine default is still DuckDuckGo; the app-side default Bing comes from the bridge's explicit `EngineConfig` injection).
 
+### r14 candidate Shell task-origin reconciliation (unpublished)
+
+- The engine stamps Shell work with its originating tool call and turn. Job snapshots and completion events expose those stable identities, allowing hosts to reconcile updates at the original transcript position instead of guessing from command text. The Pinvou bridge preserves a safe legacy fallback, keeps unmatched running jobs visible after compaction or reload, and prevents identified completed root jobs from being appended at the current timeline tail when their origin card is no longer loaded.
+- Candidate guards: `forkguard_background_shell_job_preserves_origin_identity` covers identity on snapshots and completion events, while `forkguard_tool_context_for_call_preserves_turn_and_sets_call_origin` covers the engine dispatch stamp. Parent coverage includes `forkguard_shell_monitor_assigns_identical_commands_by_stable_origin` and `shell_task_projection.test.mjs`.
+
 ### r11 provider, MCP, steer, and platform boundaries (published)
 
 - CodeWhale PRs #18, #21, #22, #25, #26, #27, #29, and #30 are published at `0d89a31be016457c180501417dd2c0f34ce844a6`. Strict-direct providers accept a wire-model casing difference only when exactly one owned model row proves the match; the parent adds a GLM bridge regression from a lowercase saved value to canonical `GLM-5.2`.
@@ -87,7 +93,7 @@ CodeWhale PR #15 combined candidate `1eca6103a` with security follow-ups `169c24
 PR #13 was squash-merged as `a36e6cd533024cfe5724bae21875aea42b2ed87a` and published as immutable tag `pinvou-v0.9.5-r7`. It removes product-specific orchestration while preserving canonical registry prompt text and alias-aware Custom SubAgent allowlist resolution.
 
 1. **Host embedding and routing boundary** — the established T1 commits through `feb8761aeda31749f3d54c6e1f8ef460540567a1` (`#19`), plus `485884913308cdf7564bc60da2e416be637083b5` (`#21`), `04e109af4b4786a0d49fbbeefdd77af15a9f495e` (`#22`), `69ed3bfbdb314f901d4cf4120f1caaaf0b6aa529` (`#30`), and `0d89a31be016457c180501417dd2c0f34ce844a6` (`#18`). Exposes narrow host seams for routing, runtime snapshots/recovery, reliable steer ownership and withdrawal, edit-target classification, provider compatibility, and post-compaction usage estimation. Explicit route ceilings constrain request budgets; strict-direct casing recovery requires one unambiguous owned model row. Edit rejection cannot call the provider or mutate history, and gateways plus ambiguous models remain untouched.
-2. **Tool compatibility and command-execution safety** — the established T2 commits through the Shell-cancellation boundary in `8aa5f77d35ac1d00d1f444193543307a7e9b391c` (`#16`), plus `44730dfe596b70f86ae2f928959877a3e3f494e4` (`#27`), `665b46cd9e67326459223aa662931bd36d726004` (`#29`), `04e109af4b4786a0d49fbbeefdd77af15a9f495e` (`#22`), `4831c3797b76485a912b056c76a4cff22f0a2863` (`#25`), `e68a185c2ba07f327bd8b63bbfea6a70a96f33ea` (`#26`), the six `#33` commits `ecfd68acc056b95b06d98312753a712e4c0755db`, `603eeadcdab65d71d62a5ac32b6700207433fe5c`, `eb25a255a92f7385a3fde74f1f44626cdd068125`, `8c243e7ea7094fff189ab12582aea0460b655d06`, `8111f8150bc6b103da685f6abc3f26143b3bb207`, and `4f612e548090616f8206154e37c9895404a8998b`, `9c5f4f19b0acbc960889778a5873c7fb038b1378` (`#35`), and `f853f8f1566c57e6be40d5439a222a932aa79ef5` (`#32`). Adds exact catalog/final-dispatch policy, read-only projections, per-tool Moonshot schema degradation with a visible diagnostic, process-local MCP secret resolution, pool-side denied-server sealing, incremental Windows Shell decoding, provider-native search adapters with exact fail-closed endpoint gating (`#33`), the keyless Bing chain tail after API-backed providers (`#35`), and default-off GAIA benchmark controls (`#32`). These generic seams remain prioritized for upstreaming; Pinvou's GAIA profiles stay app-owned.
+2. **Tool compatibility and command-execution safety** — the established T2 commits through the Shell-cancellation boundary in `8aa5f77d35ac1d00d1f444193543307a7e9b391c` (`#16`), plus `44730dfe596b70f86ae2f928959877a3e3f494e4` (`#27`), `665b46cd9e67326459223aa662931bd36d726004` (`#29`), `04e109af4b4786a0d49fbbeefdd77af15a9f495e` (`#22`), `4831c3797b76485a912b056c76a4cff22f0a2863` (`#25`), `e68a185c2ba07f327bd8b63bbfea6a70a96f33ea` (`#26`), the six `#33` commits `ecfd68acc056b95b06d98312753a712e4c0755db`, `603eeadcdab65d71d62a5ac32b6700207433fe5c`, `eb25a255a92f7385a3fde74f1f44626cdd068125`, `8c243e7ea7094fff189ab12582aea0460b655d06`, `8111f8150bc6b103da685f6abc3f26143b3bb207`, and `4f612e548090616f8206154e37c9895404a8998b`, `9c5f4f19b0acbc960889778a5873c7fb038b1378` (`#35`), and `f853f8f1566c57e6be40d5439a222a932aa79ef5` (`#32`), plus the unpublished r14 candidate `5a5bf363ebeb720410f30e400c3de44abab71de6` (Shell task origin identity). Adds exact catalog/final-dispatch policy, read-only projections, per-tool Moonshot schema degradation with a visible diagnostic, process-local MCP secret resolution, pool-side denied-server sealing, incremental Windows Shell decoding, provider-native search adapters with exact fail-closed endpoint gating (`#33`), the keyless Bing chain tail after API-backed providers (`#35`), and default-off GAIA benchmark controls (`#32`). These generic seams remain prioritized for upstreaming; Pinvou's GAIA profiles stay app-owned.
 3. **Embedded context and Skill sources** — `5a9f52941b83452c1e8b76c2d679bac315edcf70`. Seals ambient project authority, scans only the explicit Skill root, filters disabled Skills, preserves up to 100 KiB only for the Permissions fragment, and excludes internal reminders from Working Set extraction.
 4. **Automation and runtime lifecycle** — `fc84f7d3e5dca0e3db404d43e218597764129f9b`. Preserves stable conversation/thread identity, v4 task compatibility, anchored schedules, no-backfill/no-overlap behavior, and terminal-only cleanup.