diff --git a/.agents/notes/implemented/feature/2026-07-06-sandbox.i18n.yaml b/.agents/notes/implemented/feature/2026-07-06-sandbox.i18n.yaml
index f2395fc8b4..6f0610036e 100644
--- a/.agents/notes/implemented/feature/2026-07-06-sandbox.i18n.yaml
+++ b/.agents/notes/implemented/feature/2026-07-06-sandbox.i18n.yaml
@@ -1,6 +1,6 @@
 # Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write
-2026-07-06-sandbox.md: 4409b6a32809c8ff7a02c0684f449143c0891caa
-2026-07-06-sandbox.zh.md: 7e5564f17ab791662f5a40ed625b937725293333
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-06-sandbox.md
+2026-07-06-sandbox.md: cd36ae62b60fd61d55d63469ad50234363dbcf86
+2026-07-06-sandbox.zh.md: 3930c654d0970c294e135d2e5ec9d530249a902d
diff --git a/.agents/notes/implemented/feature/2026-07-06-sandbox.md b/.agents/notes/implemented/feature/2026-07-06-sandbox.md
index 4409b6a328..cd36ae62b6 100644
--- a/.agents/notes/implemented/feature/2026-07-06-sandbox.md
+++ b/.agents/notes/implemented/feature/2026-07-06-sandbox.md
@@ -89,10 +89,12 @@ Left open: what a durable grant's scope identity is beyond the sandbox mode —
 #### Per-session modes: the session log as the store
 
 ```
-effective(session) = findLast(the session's own knob events)?.value ?? the composition-config default
+effective(session) = findLast(the session's OWN post-seed knob events)?.value
+                  ?? the inherited SessionHeader baseline
+                  ?? the composition-config default
 ```
 
-The default is composition config (`cordis.yml`) — operator-owned, process-wide. A runtime switch is a session-scoped override recorded as one log-only event in that session's own log. Restart immunity (resuming a session replays its log, so overrides come back with zero catch-up machinery) and multi-session isolation both fall out by construction, and no external config store exists anywhere. Isolation does not make delegation an escape hatch: the in-process subagent driver stamps a delegating parent's effective override onto each child session inside the child's first turn, so a tightened parent binds spawn children, fork children, and grandchildren ([the subagent policy-inheritance Agent Note](2026-07-25-subagent-policy-inheritance.md)).
+The default is composition config (`cordis.yml`) — operator-owned, process-wide. A runtime switch is a session-scoped override recorded as one log-only event in that session's own log; the middle rung is the delegation baseline a subagent child's header carries. Restart immunity (resuming a session replays its log and restores its header, so overrides come back with zero catch-up machinery) and multi-session isolation both fall out by construction, and no external config store exists anywhere. Isolation does not make delegation an escape hatch: the in-process subagent driver captures a delegating parent's effective override synchronously at delegation and carries it into each child's creation-time `SessionHeader` (`sandboxMode`/`approvalPolicy`), so a tightened parent binds spawn children, fork children, and grandchildren with no first-turn timing window ([the subagent policy-inheritance Agent Note](2026-07-25-subagent-policy-inheritance.md)).
 
 **One event per knob, owned by its domain** — the merge-extensible `SessionEventMap` idiom every existing event family already follows (`approval/*` in `dsh-user-approval`, `hook/*` in the hooks packages):
 
diff --git a/.agents/notes/implemented/feature/2026-07-06-sandbox.zh.md b/.agents/notes/implemented/feature/2026-07-06-sandbox.zh.md
index 7e5564f17a..3930c654d0 100644
--- a/.agents/notes/implemented/feature/2026-07-06-sandbox.zh.md
+++ b/.agents/notes/implemented/feature/2026-07-06-sandbox.zh.md
@@ -89,10 +89,12 @@ Landlock launcher 源码和包工作区位于 `native/landlock-run`，与 harnes
 #### 按会话模式：会话日志即存储
 
 ```
-effective(session) = findLast(the session's own knob events)?.value ?? the composition-config default
+effective(session) = findLast(the session's OWN post-seed knob events)?.value
+                  ?? the inherited SessionHeader baseline
+                  ?? the composition-config default
 ```
 
-默认值是组合配置（`cordis.yml`）——运维人员拥有，进程范围。运行时切换是会话范围的覆盖，记录为该会话自身日志中的一条仅日志事件。重启免疫（恢复会话时回放其日志，覆盖自然恢复，无需追赶机制）和多会话隔离都是构造性的自然结果，且不存在任何外部配置存储。隔离并不使委派成为逃生通道：进程内 subagent 驱动器会在子 agent 的首个轮次内，把发起委派的父级的有效覆盖盖章写入每个子会话，因此收紧后的父级会约束 spawn 子 agent、fork 子 agent 与孙代 agent（[subagent 策略继承 Agent Note](2026-07-25-subagent-policy-inheritance.md)）。
+默认值是组合配置（`cordis.yml`）——运维人员拥有，进程范围。运行时切换是会话范围的覆盖，记录为该会话自身日志中的一条仅日志事件；中间层是 subagent 子 agent 的会话头所携带的委派基线。重启免疫（恢复会话时回放其日志并还原其会话头，覆盖自然恢复，无需追赶机制）和多会话隔离都是构造性的自然结果，且不存在任何外部配置存储。隔离并不使委派成为逃生通道：进程内 subagent 驱动器在委派时同步捕获发起委派的父级的有效覆盖，并将其带入每个子 agent 创建时的 `SessionHeader`（`sandboxMode`/`approvalPolicy`），因此收紧后的父级会约束 spawn 子 agent、fork 子 agent 与孙代 agent，且不存在任何第一轮次的时序窗口（[subagent 策略继承 Agent Note](2026-07-25-subagent-policy-inheritance.md)）。
 
 **每个旋钮一种事件，由其领域拥有**——这是每个既有事件族已遵循的可合并扩展 `SessionEventMap` 惯用法（`dsh-user-approval` 中的 `approval/*`、hooks 包中的 `hook/*`）：