Files Changed: harden external assessment isolation and egress privacy

Acceptance Criteria

• When sessions commit different bytes to one external reference, an owner whose expected digest no longer matches current bytes receives unavailable with no patch.
• A later session whose expected digest matches current bytes may receive its own changed assessment.
• Restoring a baseline reports unchanged rather than fabricated contention.
• A fork has no owned external references or baseline artifacts, even if copied transcript data mentions historic opaque references.
• A same-host restart rehydrates committed ownership and preserves truthful assessment.
• Removing a session deletes records and artifacts; orphan cleanup is idempotent and never removes live artifacts.
• A sentinel in a baseline or generated patch is absent from result and permission metadata, events, summaries, exports, share payloads, and the legacy diff response.
• The sentinel appears only in the authenticated no-store assessed detail response when a changed patch is requested.
• Legacy session diffs remain a wire-compatible array of in-worktree changed rows.

Testing Decisions

• Extend the session-scoped diff harness for the two-session expected-digest matrix and legacy exclusion.
• Extend session lifecycle tests for fork isolation and recursive removal.
• Extend the reload harness for same-host baseline rehydration.
• Extend sharing payload interception and tool metadata tests with a generated-artifact sentinel.
• Extend HTTP and SDK contract tests for no-store detail responses and unchanged legacy array behavior.

Key Decisions

• Current bytes are attributed only when they match the session's expected digest or are provably unchanged from its baseline.
• Identical-byte restoration is not detectable history and is reported by final byte state.
• Generated external patches are transient; ordinary tool arguments retain their existing session policy.
• Cleanup failures are repaired by an orphan sweep, never by serializing host-local artifacts into session data.

Constraints & Invariants

• Do not copy external ownership into a session fork.
• Do not widen or version-break the legacy diff array.
• Do not infer authorship for undeclared writers.
• Do not add UI behavior or new mutation sources in this slice.

Prior Art

• Parent Files Changed: full session-lineage mutation ledger #972
• fix(app): trust server session diff for Files Changed panel #720, Slice 1: Contamination fix — derive agent-file filter from tool filediff only #742, Slice 2: External-change reactivity — watcher ungating + client event handler #743, and Files Changed: per-session file watcher for reliable external-change refresh #845
• Existing session lifecycle, sharing, and scoped-diff coverage

Source

Part of #972. Blocked by #974.

Notes

This child starts as hitl because the parent review is degraded. Its own deliberate review must pass before implementation begins.