@@ -798,6 +798,25 @@ promotion retain their own acceptance. No new paid cohort or soak is authorized.
   owners are not qualified. `execution_authority: false` and the M3 activation
   hold remain unchanged.
 
+### 2026-09-29: M3 handoff inbox/outbox candidate
+
+- **Baseline:** `738115bde87eef3fd153abe456d53da5e2b249f8`.
+- **Proposed:** Bind each new shadow-management lineage to the exact source
+  GoalRef. Existing outbox entries, commit markers, and cursors remain
+  byte-compatible; their entry identity already includes the immutable lineage.
+  Exact bootstrap, management, and outbox-manifest records use new schema
+  versions. An exact caller cannot infer ownership from a legacy binding.
+- **Evidence:** A real source-session A-to-B recreation leaves Goal A's pending
+  files and candidate head unchanged when B drains. B cannot capture against
+  A's active lineage. A capture started by A is revalidated under the Goal
+  lifetime guard and rejected before its primary write if B has replaced A.
+  Explicit rollback archives A with its GoalRef, and a fresh B bootstrap
+  accepts and replays only B work. A legacy drain request cannot enter an exact
+  lineage.
+- **Remaining hold:** This qualifies only the `handoff_inbox_outbox` inventory
+  row. Todo/lease mutation admission, quota, automation, Goal Channel, and the
+  overall M3 activation hold remain separate.
+
 ## Appendix B: Decision log
 
 | Date | Decision | Owner / approval | Alternatives | Normative sections changed |
 
@@ -723,6 +723,23 @@ service adoption、D1–D3 provider promotion 保留各自验收。不授权付
   downstream drain、不支持的旧/常驻二进制和其余 inventory owner 尚未
   qualified；`execution_authority: false` 与 M3 activation hold 保持不变。
 
+### 2026-09-29：M3 handoff inbox/outbox 候选
+
+- **基线：** `738115bde87eef3fd153abe456d53da5e2b249f8`。
+- **候选实现：** 将每个新 shadow management lineage 绑定到 source registry
+  的精确 GoalRef。既有 outbox entry、commit marker 和 cursor 字节保持兼容；
+  entry identity 已包含不可变 lineage。Exact bootstrap、management 和
+  outbox manifest 使用新 schema。Exact caller 不能从 legacy binding 推断身份。
+- **证据：** 真实 source-session A-to-B recreation 后，B drain 不会修改 Goal A
+  的 pending 文件或 candidate head，B 也不能向 A 的 active lineage 写 capture。
+  如果 A 已开始 capture 而 B 在 primary write 前替换 A，writer 会在 Goal
+  lifetime guard 内重新校验，并在写入前拒绝该 capture。显式 rollback 会连同
+  GoalRef 归档 A；重新 bootstrap 后，B 只提交并 replay 自己的工作。Legacy
+  drain request 不能进入 exact lineage。
+- **剩余 hold：** 本切片只资格化 `handoff_inbox_outbox` inventory 行。
+  Todo/lease mutation admission、quota、automation、Goal Channel 与 M3 总
+  activation hold 仍分别验收。
+
 ## 附录 B：决策日志
 
 | 日期 | 决策 | Owner／批准 | 替代方案 | 变更的规范章节 |
 
@@ -526,6 +526,26 @@ settings editor already owns these configurations and their readback. Live
 memory/usage/correction controls and Lark evidence returns remain delivery work,
 not acceptance supplied by CLI tests.
 
+The explicit Agent preference slice now implements a narrow part of the
+correction journey: the existing `semantic-preference` capability owns a
+TS lifecycle backed by the shared transactional storage implementation in an
+isolated private context namespace. Current explicit preferences have stable
+subjects, source references, revisions and retirement/expiry; CLI quota and
+native Turn entry points disclose an exact current read. This is not a universal
+memory database, an authorization grant or proof of learned-experience utility.
+See [operation and boundaries](../../../loopx/capabilities/semantic_preference/README.md#explicit-agent-preferences).
+Remaining acceptance includes authenticated external-message ingestion,
+Dashboard/Lark inspection, cross-host migration, memory-service provider
+qualification (including OpenViking, beyond interchangeable storage drivers),
+and measured decision utility
+for episodic recall. Reuse the existing semantic-preference extension lifecycle:
+project-scoped recall is already available, while explicit Goal/Agent correction,
+retirement and provider cutover need their own real-service readback. A top-k
+recall response does not qualify as a complete current preference view; service
+outages or delayed indexing must not resurrect revoked advice. The
+[memory-service acceptance boundary](../../../loopx/capabilities/semantic_preference/README.md#memory-service-providers-and-the-next-integration-boundary)
+defines the next independent slice. Do not count this slice as completion of all M0–M5.
+
 Next, qualify one **correction → fresh-session decision** journey before adding
 a composition planner: persist an authorized correction, show the affected
 source and superseded assertion, resume a different session, retrieve the
 
@@ -56,7 +56,14 @@ not amend normative sections.
    wire values or move value authority to the registry. M2 now generates the
    Turn vocabularies, route projection and ordered controller rules from
    `turn_loop_controller_contract_v0.json` via `generate_turn_contract.py`;
-   this does not migrate every cross-runtime vocabulary.
+   this does not migrate every cross-runtime vocabulary. The semantic binding
+   generator also derives the existing Python digest-pattern module from its TS
+   owner. This narrow literal grammar rejects flags, dynamic expressions and
+   unsupported regex syntax. The twin ratchet excludes a source-derived binding
+   only after recomputing and matching its entire artifact; a filename/header
+   alone never qualifies. Digest callers keep their imports and matching behavior,
+   and no runtime bridge is added. This restores 43 independently maintained
+   pairs without raising the 43-pair ceiling.
 3. **Default and opt-in boundary.** The check is always on for the repository.
    It has no runtime flag because it never runs inside the product.
 4. **Principal constraint.** Fail closed, deterministic, and not weakenable by
 
@@ -780,6 +780,11 @@ TypeScript effective-action/frontier 绑定与[术语表](../../reference/glossa
 检查生成物新鲜度，不新增 required CI job。运行 TypeScript 生产者扫描之前，
 先用 `npm ci --ignore-scripts` 安装锁定的 Node 依赖。
 
+同一语义绑定生成器还从 TS owner 生成现有 Python 摘要格式模块：仅接受两条无 flags
+的受限字面量正则，动态表达式与不支持的语法明确拒绝。孪生预算只在重新生成并逐字
+核对产物后，排除独立维护计数；文件名或 generated 注释不能豁免。调用方导入、匹配
+行为保持不变，也不增加运行时桥接。独立维护对数因此恢复为 43，上限仍为 43。
+
 Turn 契约使用独立的生成器和来源。只读验证入口：
 
 ```bash
 
@@ -1058,8 +1058,11 @@ def check_dual_runtime_twins(registry: dict[str, Any]) -> str:
     paths = {file.path for file in load_sources(REPO_ROOT, entry["root"])}
     twins = sorted(path for path in paths if path.endswith(".py") and not path.endswith("/__init__.py") and path[:-3] + ".ts" in paths)
     from scripts.generate_turn_contract import verified_generated_paths
-    generated = verified_generated_paths()
-    generated_twins = [path for path in twins if path in generated and path[:-3] + '.ts' in generated]
+    from scripts.generate_semantic_bindings import verified_generated_paths as semantic_generated_paths
+    generated = verified_generated_paths() | semantic_generated_paths()
+    # A verified source-derived binding has no independently maintained rule;
+    # its owner may be authored TS/Python or a shared generated contract.
+    generated_twins = [path for path in twins if path in generated or path[:-3] + '.ts' in generated]
     maintained = len(twins) - len(generated_twins)
     require(maintained <= entry['module_budget'], f"{maintained} independently maintained py/ts twins; budget is {entry['module_budget']}")
     return f"twins_raw={len(twins)} generated_verified={len(generated_twins)} independently_maintained={maintained}/{entry['module_budget']}"
 
@@ -133,7 +133,7 @@ def command(self) -> list[str]:
          'tests/control_plane_ts/coordination_runtime_shadow.test.ts', 'observation transaction mixed'),
     Case('management_request_digest', ((COORDINATION + "shadow_management.ts", replacement('if (state.operation.request_digest !== digest) throw new ShadowManagementError("management_operation_identity_mismatch");', 'if (false) throw new ShadowManagementError("management_operation_identity_mismatch");')),),
          "tests/control_plane_ts/shadow_management.test.ts", 'management request digest'),
-    Case('management_manifest_hash', ((COORDINATION + "shadow_management.ts", replacement('managementDigest(manifest) !== state.operation.manifest_digest\n      || manifest.schema_version !== SHADOW_MANAGEMENT_MANIFEST_SCHEMA\n', 'false\n      || manifest.schema_version !== SHADOW_MANAGEMENT_MANIFEST_SCHEMA\n')),),
+    Case('management_manifest_hash', ((COORDINATION + "shadow_management.ts", replacement('managementDigest(manifest) !== state.operation.manifest_digest\n      || !supportedSchema\n', 'false\n      || !supportedSchema\n')),),
          "tests/control_plane_ts/shadow_management.test.ts", 'management manifest hash'),
     Case('management_phase', ((COORDINATION + "shadow_management.ts", replacement('operation.kind !== kind || !phases.includes(String(operation.phase))', 'operation.kind !== kind')),),
          "tests/control_plane_ts/shadow_management.test.ts", 'management phase validation'),
 
@@ -13,6 +13,7 @@
 from ...control_plane.runtime.public_safety import (
     REMOTE_LOCATION_SURFACE_PATTERN,
     SECRET_LIKE_SURFACE_PATTERN,
+    find_public_safe_local_path,
 )
 
 DECISION_EVIDENCE_PACKET_SCHEMA_VERSION = "decision_evidence_packet_v0"
@@ -40,7 +41,10 @@
 }
 
 _TOKEN_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$")
-_LOCAL_PATH_RE = re.compile(r"(^|[\s:=])(?:/Users/|/private/|/tmp/|~/)")
+# Refs #5136, direction 3: "does this text carry a local path?" is decided once
+# by find_public_safe_local_path; this site keeps its own rejection message and
+# length limit for whatever the owner recognizes.
+#
 # Local threshold policy only: the credential *shapes* are decided once by
 # SECRET_LIKE_SURFACE_PATTERN, which this site consults in addition to this list.
 _CREDENTIAL_RE = re.compile(
@@ -77,7 +81,7 @@ def _compact_text(value: Any, *, field: str, max_len: int = 320) -> str:
         raise ValueError(f"{field} must be non-empty")
     if len(text) > max_len:
         raise ValueError(f"{field} must be at most {max_len} characters")
-    if _LOCAL_PATH_RE.search(text):
+    if find_public_safe_local_path(text) is not None:
         raise ValueError(f"{field} must not contain a local path")
     if REMOTE_LOCATION_SURFACE_PATTERN.search(text):
         raise ValueError(f"{field} must use an opaque source reference, not a raw URL")
 
@@ -12,10 +12,14 @@
 from ...control_plane.runtime.public_safety import (
     REMOTE_LOCATION_SURFACE_PATTERN,
     SECRET_LIKE_SURFACE_PATTERN,
+    find_public_safe_local_path,
 )
 
 _TOKEN_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$")
-_LOCAL_PATH_RE = re.compile(r"(^|[\s:=])(?:/Users/|/private/|/tmp/|~/)")
+# Refs #5136, direction 3: "does this text carry a local path?" is decided once
+# by find_public_safe_local_path; this site keeps its own rejection message and
+# length limit for whatever the owner recognizes.
+#
 # Local threshold policy only: the credential *shapes* are decided once by
 # SECRET_LIKE_SURFACE_PATTERN, which this site consults in addition to this list.
 _CREDENTIAL_RE = re.compile(
@@ -53,7 +57,7 @@ def compact_text(value: Any, *, field: str, max_len: int = 320) -> str:
         raise ValueError(f"{field} must be non-empty")
     if len(text) > max_len:
         raise ValueError(f"{field} must be at most {max_len} characters")
-    if _LOCAL_PATH_RE.search(text):
+    if find_public_safe_local_path(text) is not None:
         raise ValueError(f"{field} must not contain a local path")
     if REMOTE_LOCATION_SURFACE_PATTERN.search(text):
         raise ValueError(f"{field} must use an opaque reference, not a raw URL")