subagent: carry inherited policy overrides in the child session header

Review fix (ds-review-bot critical #2 on #623): the first-turn event stamp
had a durability hole no turn anchoring can close — an idle SessionStart-
style injection persists a complete one-shot turn before any prompt turn
opens, so a crash in that window left a resumable-looking child with no
inherited policy, falling back to a possibly wider deployment default.

The captured overrides now ride the child's creation meta into its
immutable SessionHeader (sandboxMode/approvalPolicy, neutral strings at the
session boundary — the delegationDepth precedent), durable from the moment
the session exists: no listener ordering can starve the baseline and no
crash window can lose it. overrideOf(session) on both policy services
resolves fold(events past header.seedLength) ?? header baseline, validating
against the closed vocabulary on read; stampOverride and the prompt-submit
listener machinery are deleted. The header field rides both persistence
backends (JSONL header line; SQLite sessions columns, SCHEMA_VERSION 11 —
pre-release, no migration). pty-local reads through overrideOf so PTY
spawns see the baseline too.

Red-first: header-durability-before-any-turn test (the injection crash
window shape), baseline/seed-boundary/closed-vocabulary contract tests in
both service suites; the real-wall suite (race, veto, fork stale-seed,
grandchild) re-anchored on header assertions and green. The Agent Note's
Alternatives now records the superseded event-stamping iteration with the
review evidence; bilingual docs updated.

packages/core/session/src/index.ts

@@ -151,6 +151,14 @@ function snapshotSessionHeader(id: SessionId, source?: SessionHeader): SessionHe
     && (typeof record.delegationDepth !== 'number' || !Number.isSafeInteger(record.delegationDepth) || record.delegationDepth < 0)) {
     throw new Error('session header delegationDepth must be a non-negative safe integer')
   }
+  // Neutral strings only: the owning policy packages validate the values
+  // against their closed vocabularies on read (durable boundary).
+  if (record.sandboxMode !== undefined && typeof record.sandboxMode !== 'string') {
+    throw new Error('session header sandboxMode must be a string')
+  }
+  if (record.approvalPolicy !== undefined && typeof record.approvalPolicy !== 'string') {
+    throw new Error('session header approvalPolicy must be a string')
+  }
   return deepFreeze(record as unknown as SessionHeader)
 }
 
@@ -680,6 +688,8 @@ export class SessionStore extends Service {
       ...meta?.parentSession === undefined ? {} : { parentSession: meta.parentSession },
       ...meta?.seedLength === undefined ? {} : { seedLength: meta.seedLength },
       ...meta?.delegationDepth === undefined ? {} : { delegationDepth: meta.delegationDepth },
+      ...meta?.sandboxMode === undefined ? {} : { sandboxMode: meta.sandboxMode },
+      ...meta?.approvalPolicy === undefined ? {} : { approvalPolicy: meta.approvalPolicy },
     }
     return new Session(sessionId, seed, header)
   }

packages/core/session/src/types.ts

@@ -53,6 +53,24 @@ export interface SessionHeader {
    * resume — a runtime-only depth would reset a resumed child to top-level.
    */
   readonly delegationDepth?: number
+  /**
+   * The sandbox-mode override inherited from the delegating parent at
+   * creation (the delegation-inheritance baseline). A neutral string here:
+   * the policy owner (`dsh-sandbox-policy`) validates it against its closed
+   * vocabulary on every read, this being a durable boundary. Absent for
+   * top-level sessions and for children of unswitched parents, which keep
+   * following the LIVE deployment default. Header-carried (the
+   * `delegationDepth` precedent) so the baseline is durable from the creation
+   * moment — no first-turn event survives every crash window, because an
+   * idle injection can persist a complete turn before any prompt turn opens.
+   */
+  readonly sandboxMode?: string
+  /**
+   * The approval-policy override inherited from the delegating parent at
+   * creation. Same contract as {@link SessionHeader.sandboxMode}; validated
+   * by `dsh-user-approval` on read.
+   */
+  readonly approvalPolicy?: string
 }
 
 /**
@@ -73,6 +91,8 @@ export interface CreateSessionOptions {
     readonly createdAt?: number
     readonly seedLength?: number
     readonly delegationDepth?: number
+    readonly sandboxMode?: string
+    readonly approvalPolicy?: string
   }
 }