feat(core,storage,cli): evidence pointers and staleness flags for foreign session handoff

Follow-up to #1057 (parts 1+2 merged as #1208/#1221), implementing the
compatible half of ofekron's post-merge design feedback: the handoff
should carry claims with evidence pointers and confidence flags, not
just a summary.

- ForeignSessionDigest gains `transcriptPath` (the evidence pointer for
  the whole digest) and `filesTouched` entries carry `lastEventAtMs` —
  the source event's own timestamp. Timestamps were chosen over
  transcript line offsets deliberately: large transcripts are read as a
  bounded TAIL window, where line numbers would be window-relative and
  silently wrong.
- New handoff-time staleness check: @maka/storage probes the CURRENT
  repo state (cwd existence, branch via .git/HEAD — worktree gitdir
  files followed one level, no git spawn — and per-touched-file
  mtimes), and pure core assessment turns mismatches into typed flags
  (cwd_missing / branch_changed / files_changed / files_missing).
  Per-file mtimes compare against each touch's own event timestamp,
  falling back to the session clock.
- The report renders as a Maka-authored <repo-state-check> block
  between the instruction and the untrusted envelope. An empty flag
  list renders an explicit all-clear (a receiving agent must be able to
  tell "checked and clean" from "never checked"), and stripEnvelopeTags
  now covers the new tag so a hostile path cannot forge maka-verified
  content. Probe failure degrades to the unchecked handoff shape.
- Deliberately NOT implemented from the feedback: carrying "checks run
  and observed results" forward — tool outputs stay excluded per the
  #1057 safety contract; the staleness flags provide the confidence
  signal without trusting the transcript's account of the world.

Tests: core 1183/1183 (evidence semantics, every flag kind, all-clear
rendering, envelope-forgery defense, handoff composition), storage
530/530 (probe on real dirs: branch, worktree gitdir, detached HEAD,
missing cwd), cli 652/652 (handoff carries the flagged report
end-to-end through the picker import).

Author: UncertaintyDeterminesYou4ndMe

packages/cli/src/__tests__/pi-tui-runner.test.ts

@@ -5819,6 +5819,10 @@ describe('Maka Pi TUI runner', () => {
       updatedAtMs: Date.now(),
       transcriptPath: '/home/u/.claude/projects/-repo/fabc.jsonl',
     };
+    // A REAL directory as the digest cwd so the handoff-time repo probe runs
+    // deterministically: the cwd exists, and the single touched file does
+    // not — the staleness report must flag it.
+    const digestCwd = await mkdtemp(join(tmpdir(), 'maka-foreign-handoff-'));
     let readDigestCalls = 0;
     const foreignSessions = {
       availableSources: async () => ['claude-code' as const],
@@ -5829,11 +5833,12 @@ describe('Maka Pi TUI runner', () => {
           source: 'claude-code' as const,
           id: 'fabc',
           title: 'Prior parser work',
-          cwd: '/repo',
+          cwd: digestCwd,
           updatedAtMs: summary.updatedAtMs,
+          transcriptPath: summary.transcriptPath,
           userMessages: ['重构解析器'],
           assistantTexts: ['已修复并补测试'],
-          filesTouched: ['/repo/parser.ts'],
+          filesTouched: [{ path: 'parser.ts' }],
           warnings: [],
         };
       },
@@ -5867,6 +5872,11 @@ describe('Maka Pi TUI runner', () => {
     assert.match(driver.prompts[0]!, /<foreign-session-digest>/);
     assert.match(driver.prompts[0]!, /untrusted reference DATA/);
     assert.match(driver.prompts[0]!, /重构解析器/);
+    // The Maka-verified repo state check ran: cwd exists, the touched file
+    // does not — the handoff carries the mismatch as an explicit flag.
+    assert.match(driver.prompts[0]!, /<repo-state-check maka-verified="true">/);
+    assert.match(driver.prompts[0]!, /\[files_missing\].*parser\.ts/);
+    assert.match(driver.prompts[0]!, /source_transcript="[^\n]*fabc\.jsonl"/);
 
     exitMaka(terminal);
     await Promise.race([

packages/cli/src/pi-tui-runner.ts

@@ -27,12 +27,13 @@ import {
   type ShellRunUpdate,
 } from '@maka/core';
 import {
+  assessForeignSessionStaleness,
   buildForeignSessionHandoffMessage,
   foreignSessionHandoffDisplayText,
   foreignSourceLabel,
   type ForeignSessionSummary,
 } from '@maka/core/foreign-session';
-import type { ForeignSessionStore } from '@maka/storage';
+import { probeForeignSessionRepoState, type ForeignSessionStore } from '@maka/storage';
 import type { GoalTurnOutcome, SessionActivityLease } from '@maka/runtime';
 import type { ModelChoice } from './connection-target.js';
 import {
@@ -1784,13 +1785,22 @@ export async function runMakaPiTui(input: MakaPiTuiInput): Promise<void> {
     let handedOff = false;
     try {
       const digest = await input.foreignSessions.readDigest(summary);
+      // #1057 follow-up: probe the CURRENT repo state (cwd / branch / touched-
+      // file mtimes) and hand the model Maka-verified staleness flags instead
+      // of leaving it to trust the transcript's account of the world. The
+      // probe is best-effort — a probe failure downgrades the handoff to the
+      // unchecked shape rather than blocking the import.
+      const staleness = await probeForeignSessionRepoState(digest).then(
+        (probe) => assessForeignSessionStaleness(digest, probe),
+        () => undefined,
+      );
       if (closed) return;
       newSession();
       void runAgentTurn({
         kind: 'external',
         prompt: foreignSessionHandoffDisplayText(digest),
         sessionId: input.driver.getSessionId(),
-        sendText: buildForeignSessionHandoffMessage(digest),
+        sendText: buildForeignSessionHandoffMessage(digest, staleness),
       });
       handedOff = true;
     } catch (error) {