…unner-owned shape

ClawSweeper review on openclaw#84046 flagged the prior count-only check as too
broad: concurrent transcript rewrites, file replacements, branch
changes, and same-user-count mutations could all keep the user-message
count unchanged while changing session state. Tighten the fence
disambiguation so a stat-fingerprint mismatch is only tolerated when
ALL of these hold:

- dev/ino match (no atomic replacement onto a new inode)
- birthtimeNs matches (no unlink+recreate-same-inode case; common on
  tmpfs/ext4 with rapid recreation, where dev and ino are reused)
- size grew (file is append-only between fence-set and assert)
- bytes [0, fenceSize) hash identical to the fenced prefix hash (no
  in-place rewrite of earlier transcript content)
- bytes [fenceSize, currentSize) contain only message entries with role
  assistant or tool (no new user-role turn, no malformed tail)

Anything else — replacement, shrink, in-place rewrite, new user turn,
or compaction-style mutation — remains a real takeover. Snapshot now
captures the prefix hash alongside the fingerprint at releaseForPrompt
and refreshSessionFileFence so the slow path can verify rigorously.

Adds tests covering in-place rewrite and unlink+recreate replacement
(both with prefix bytes coincidentally matching and roles that would
otherwise look runner-owned); existing append-only and new-user-turn
tests preserved.

Refs: openclaw#83436, openclaw#83615
Addresses ClawSweeper P1 finding on prior revision of openclaw#84046.

…t non-message tail entries

ClawSweeper re-review on openclaw#84046 flagged two P1 issues on the prior
revision of the append-only fence:

- The role allowlist used 'tool', but OpenClaw persists tool outputs
  as message.role === 'toolResult' (see
  src/agents/pi-embedded-runner/transcript-file-state.ts:182). Real
  tool-using turns would still false-trip the takeover. Update the
  allowlist to match isAgentMessage's runner-owned roles: assistant,
  toolResult, bashExecution.

- The slow path silently 'continue'd through non-message tail entries
  (custom, branch_summary, compaction, session). That let a different
  owner mutate session state during the released-lock window without
  a new user turn. Fail closed: any non-message entry in the tail
  rejects the fence.

Test updates: existing acceptance test now appends assistant +
toolResult + bashExecution (the three valid persisted runner-owned
roles); new test asserts a 'type: custom' tail entry trips takeover
even though it grew append-only.

Refs: openclaw#83436, openclaw#83615
Addresses ClawSweeper P1 findings on second revision of openclaw#84046.

…l entries

ClawSweeper P2 finding on the prior revision: the slow path accepted
any 'type: message' entry with role in {assistant, toolResult,
bashExecution} without checking the full persisted message contract.
Malformed or externally-synthesized entries carrying an accepted role
would advance the fence over state they do not actually represent.

Add a local isPersistedRunnerOwnedMessage validator that mirrors
isAgentMessage in transcript-file-state.ts for the three accepted
roles: assistant needs content present; toolResult needs string
toolCallId/toolName, boolean isError, array content; bashExecution
needs string command/output, boolean cancelled/truncated, and
number-or-undefined exitCode. Reject everything else.

Tests: existing acceptance test updated to use array content for
toolResult (matching the persisted schema); new test asserts a
toolResult message missing toolName/isError/content trips takeover
even though role is accepted.

Refs: openclaw#83436, openclaw#83615
Addresses ClawSweeper P2 finding on third revision of openclaw#84046.

ClawSweeper P2 finding on prior revision: the local validator was a
hand-rolled subset of isAgentMessage in transcript-file-state.ts, and
each round of review surfaced a new schema gap (assistant content
just had to exist; toolResult content just had to be an array;
bashExecution missed nothing here yet). Reproducing the contract
locally is the wrong layer — transcript-file-state.ts already owns
the canonical persisted message contract.

Export isAgentMessage from transcript-file-state.ts and call it from
the fence slow path, then gate on the runner-owned role subset
(assistant, toolResult, bashExecution). user-role and custom-role
messages remain real takeover signals even when their contract is
valid.

The local helper drops to ten lines: full contract check via the
canonical validator, then role-subset gate. No new tests needed —
the existing malformed-toolResult regression already covers the
schema mismatch the canonical validator now catches more strictly
(missing toolName/isError + non-array content).

Refs: openclaw#83436, openclaw#83615
Addresses ClawSweeper P2 finding on fourth revision of openclaw#84046.