fix: Emit recall context using native hook contracts

[buildingjoshbetter]

Refs #763 (C07). Emit recall context using the contract selected by trusted installed host/event argv.

Changes

Trusted host/event	Context response
Claude SessionStart / UserPromptSubmit	Top-level additionalContext
Cursor sessionStart	Top-level additional_context
Gemini SessionStart / BeforeAgent	Nested hookSpecificOutput.hookEventName and additionalContext
Codex SessionStart / UserPromptSubmit	Nested hookSpecificOutput.hookEventName and additionalContext

Installed argv supplies the trusted host and exact native event; stdin fields cannot select another serializer. Legacy Claude defaults and behavior are retained. C05's --host continues to select transcript admission/identity/background routing; Stop/Compact parse --event but use host for transcript admission.

Emission succeeds only after stdout reports the full response write and flush completes. The SessionStart recall-injected marker follows that success and a nonempty recall portion. Partial/None/oversized writes, closed streams, write/flush errors and welcome/update-only output do not mark recall. That marker records emitted context, not native host acceptance or model-visible delivery.

Cursor beforeSubmitPrompt retains capture/per-exchange storage and skips recall lookup/emission because its documented response lacks the required context transport. Capture support does not imply per-prompt injection. Trusted Cursor conversation identity uses C05's shared normalization. Cursor registrations carry --host cursor and exact sessionStart, stop, beforeSubmitPrompt or preCompact events with existing 10/5-second timeouts. Verified owned commands migrate; foreign hooks and mere truememory mentions remain preserved.

Stack and scope

Proposed normal fast-forward refresh of existing draft #832 to C07 head 26afddf7332f1586768d1d787cfe1aad2c1278e1, destination fix/native-hook-contracts-publish-v3. Previous published head: d60536f068d58c45bef19a05d8833a3a5d7b5299.

Parent is draft #831 through fix/transcript-allowlists-publish-v3, with expected refreshed dependency head 003705e9e3f4cd38f7a3abf5c79607af2ba45e7e. The plan keeps the same existing PRs, titles and base branch chain.

The delta against corrected C05 contains seven paths: four production files, two hook/adapter test files and the fixture-only #630 lifecycle correction. Compared with the previous published C07 head, only the inherited C05 ownership fixture and #630 fixture changed; all production and documentation bytes are identical. C10/#766 follows C07. Shared retrieval, budget and storage functions, formula constants, model/reranker identities, dimensions and limits remain unchanged. Product egress defaults remain held.

Controls and preserved failures

The reviewed independent source retained three original Cursor negatives: collapsed conversation state, missing SessionStart conversation marker and foreign command rewriting. Corrected source passed all 17 frozen independent controls. Those controls cover trusted argv despite forged stdin, exact JSON/event fields, six write/flush failure modes, marker ordering, Cursor capture without recall, transcript admission before reads and owned command recognition.

Twenty-one new synthetic test definitions contain 75 unittest assertion/fail call AST nodes and one Python Assert statement. Cursor fixtures retain 29 test definitions and all 69 Python Assert statements, with faithful Python/package-script command inputs. These are source inventories, not runtime assertion execution totals. The frozen protection inventory retains the executable ASTs of 23 named retrieval/budget/store functions: 10 SessionStart + 13 Prompt = 23. Formula constants are checked separately and unchanged. A separate source review passes 23 scope checks protecting unrelated source and prerequisite boundaries; 15 actual-serializer checks cover supported schemas, unsupported host/events and write/short-write/flush refusal.

Original old-head Windows failures remain preserved. Draft #831 at 72b66c20d5e00c6935f9ae2264b27d019b335925 failed four ownership-fixture subtests because unconditional POSIX single-quoted commands were supplied to the native Windows parser; production correctly rejected them. Log SHA256 ac86315cb74ffde5db2086772a793f031b90d52d55cb2e05104facdd3477f8fb is preserved in .work/reports/transcript-hosted-failure-windows-114405870142-v1.log. The first fixture child b53c35d6b8bcdd705c5893d672976a65eb35cd0b passed its simulated methods but omitted literal-semicolon Windows coverage; that gap and its receipt remain preserved. Child 003705e9e3f4cd38f7a3abf5c79607af2ba45e7e explicitly tests POSIX single-quoted and native Windows double-quoted literal semicolons on both simulated platform paths, retaining all 32 methods, 102 assertion/fail call AST nodes and foreign/shell negatives. Production ownership is unchanged.

Draft #833's old Windows job separately failed seven manual-parity methods through unescaped native paths, JSON/TOML parsing and Hermes POSIX tokenization, plus the same four inherited C05 subtests. Its preserved log SHA256 is 6b6697440d6dc5e6360df7a0aaf31bcc384c3fe9f749d8b16e93f4f57a305c72, in .work/reports/manual-docs-hosted-failure-windows-114407979608-v1.log. C10's fixture-only encoding/tokenization/canonicalization correction retains eight method bodies and 58 assertion/fail call AST nodes. Narrow JSON-compatible double-quoted STRING decoding rejects duplicate keys, aliases, tabs, malformed/trailing input and non-string collections. Actual-source synthetic controls exercise POSIX and Windows path strings; they do not establish actual new Windows CI or native host acceptance.

The preserved old #832 Ubuntu experimental failure used ordinary CPython 3.14.8; actual GIL state was not measured. Its #631 zero-vector rebuild hit the unchanged nonblocking model-publication busy fence with identity (0, "model2vec", 256). The exact lock owner and historical cause remain unproven. Log SHA256 b81ee74dfc997bc0e0824bb1ee09e8537c5bba02a2dc63a95888a1d26f83d3f3 remains in .work/reports/native-hook-ft-hosted-failure-114406830194-v1.log; the historical filename is not evidence of a free-threaded runtime.

Actual-source inspection identified a separate #630 fixture that opened its unique engine without teardown. C07's fixture-only correction captures that fixture's coordinator, checks its canonical database path against the unique fixture database, cancels and waits at most 10 seconds, surfaces failed completion, and always closes the fixture engine in a nested finally. It covers open/test failures without changing the model fence, shared lock, registry, model identity, caller transaction semantics, GC or production code. Initial child 67e73f3c7fe427b8b63fcfaa933fdcb339fcb2a2 failed a foreign-database negative by cancelling/waiting on that coordinator; its commit/report remain preserved. Child 26afddf7332f1586768d1d787cfe1aad2c1278e1 refuses before foreign cancel/wait and still closes the fixture engine. Root confirmed 16 frozen lifecycle controls and 32 production guards passed. All three #630 method bodies/nine Python Assert nodes and the entire #631 file (nine tests/28 Python Assert nodes) remain unchanged; these are source inventories, not runtime assertion totals. Synthetic actual-function ownership witnesses demonstrate safe teardown and possible interference, without proving the historical hosted owner.

The inherited #684 correction requires exact Engine/failed-handle proof, strict automatic-owner receipts, identity rechecks and one shared 10,000 ms budget. Current-owned writers refuse before opening; manual/receiptless, serving/already-admitted and replacement-handle cases retain refusal. Historical macOS and old #829 Windows owner identities remain unproven; duplicate hosted jobs passed. Separate synthetic verified-owner reproduction supports the narrow correction. Reconnect controls pass 26 methods and 42 independent probes. All 101 boundary methods and 550 unittest assertion/fail call AST nodes remain unchanged through fixture repairs; the memory-only run passes 101/101.

Original combined full 5cd23db000fd2a7c98e93395be33cf8638641db1 failed ten MCP fixture tests: nine missing-time NameError traces and one parallel-wait assertion cascade. Original source, container and full log remain preserved, log SHA256 2a706b32240afa808f582e1751beeea1a24302f1a6f86f3eb3eddec5fa85befd. The inherited MCP-only fixture repair retains all 11 test methods and 52 unittest/Mock assertion/fail call AST nodes, binds actual source-derived collaborators and strict unexpected-wait/import guards, and passes 11 safe methods plus 35 independent controls. Production, GC, model and retrieval behavior are unchanged by that fixture repair.

Source-only controls rejected queue v4's marker-insertion argv and publisher v5's incomplete exact-PR identity checks; the originals and failed controls remain preserved. Root uses reviewed queue v5, SHA256 cb9136cbe4cd3c2ca75c9c52e225c0ed2d71f5f08b711ae8ea6e885fe9d17824, and publisher v6, SHA256 573d39c50d4258461fe6160f65ab5a66f9ffc5871425946e6970fdbad2277f8b. Root confirmed the publisher's 22 URL and 63 metadata negative controls passed. Those source controls are distinct from actual publication/readback. Plan v4 SHA256 45dd32d3f099b6445c97054089b66382bec9866e90ae6b1c268516e94b39eb56 and manifest v9 SHA256 8419a390c620d0f9fc6159f48631d123448a80745b1f2baad9f36cead85d1a8b pin the refresh source chain.

Exact-source validation

Gate	Exact source	Passing tests / subtests	Runner elapsed	Full-log SHA256
Expanded focused	acc9e00a55cadb91f392ec2a172a2f1fa580c749	845 / 658	40.071 s	7eadab0e30751d913a7ec9b092d2af719aee4039007eb8ace87896291dc85200
Combined full	acc9e00a55cadb91f392ec2a172a2f1fa580c749	3,735 / 3,248	417.054 s	f5e0f116edaddb79ed96fe3dc3b28b56198af256aa92e1d1c2c91bcb2b03bbc5
Exact C07 full	26afddf7332f1586768d1d787cfe1aad2c1278e1	3,595 / 2,603	414.397 s	91bcb493697a732de9c58ed30ae2b87249464d2839ad32ca04ca777396cc8c22

Both full gates exited 0 with 17 skips, three network deselections and 39 warnings, no timeout/OOM and matching actual source/build/log hashes. The focused selection contains 39 files, including #630 and #631. The exact C07 pytest elapsed time was 407.19 seconds; the table reports runner elapsed time.

The gates ran sequentially on synthetic data in offline installed-wheel images with eight CPUs, 16 GiB, read-only source/models/fixtures, enabled native SQLite flags and no GPU exposed. Installed-wheel images were built and identified; all-test installed import origin was not measured. No GC-disabling override was used; three selected regression assertions observed GC enabled at their checkpoints. Full-run runtime GC state was not recorded.

Exact publication source/build/run: source-native-hook-contracts-publish-v7, build-native-hook-contracts-publish-v7, native-hook-contracts-publication-v3. Receipts: .work/reports/native-hook-contracts-publication-validation-v3.json, .work/reports/native-hook-contracts-publication-container-config-v3.json and .work/reports/build-native-hook-contracts-publish-v7-evidence-v1.json. Build-log SHA256 6f4cfc86115d1037a0eebd437708ede770f1a7197722d4f62ffcc1b0ff1a2490. Combined/focused receipts are .work/reports/native-integrations-combined-full-validation-v4.json and .work/reports/native-integrations-focused-validation-v8.json, with container configs v4/v5 and combined-v8 build evidence.

The complete five-gate set was independently accepted before body-file preparation. Those receipts validate exact sources; actual publication and remote readback remain separate root actions.

Remaining validation

Actual corrected-head Windows CI and fresh CPython 3.14 hosted CI remain unproven. The current root GPU images record Python 3.12.15; the old Python 3.14.8 experimental job's actual GIL and busy-fence owner were not measured. No matched-3.14 runtime success is claimed.

Configuration presence, registration, status output, serializer emission and written instructions do not establish native event execution, payload translation, transcript capture, host acceptance or model-visible recall. No native Codex, Cursor, Gemini, Kimi, Hermes or OpenClaw version was exercised by the manual parity controls. Kimi's newer home, Hermes translation under #765, and OpenClaw discovery/activation/runtime payloads/user/database propagation under #764 remain unverified. The adapter's OpenClaw staging divergence remains separate.

Historical macOS closed-handle and old #829 Windows I/O owner identities remain unproven; duplicate jobs passed and synthetic verified-owner controls support only the scoped inherited admission correction. The original 26.24 GB Mac memory fix and native host/model acceptance remain unproven. Complete-archive DeepSearch and durable source citations remain future work; #758/#759 product egress policy is held.

Validated private integration remains 3a9360b1ba6bf210a1b54e05287117923fbbaae5; adoption of the refreshed passing combination is separate. Draft only. No merge, release, refreshed private adoption or accepted issue closure is claimed.