fix(acp): Preserve submitted prompt provenance for auto recall (#11455)

* fix(acp): Preserve submitted prompt provenance for auto recall

Co-authored-by: Qwen-Coder <[email protected]>

* fix(acp): Omit submitted_prompt on channel-classified turns (#11455)

Channel turns are machine-relayed deliveries (loop jobs, webhook tasks,
adapter-synthesized events), so nothing on them crossed a submission
boundary. Since submitted_prompt presence alone gates Auto Recall's
outbound provider search, emitting it there ran retrieval on unattended
turns and could publish composed wrapper text as user provenance. Gate
emission on a positive user-submission condition instead.

Also reconcile the producer-set contract this PR changed: hooks.md, the
Auto Recall READMEs, the in-product hook description with its locale
mirrors, and the recording payload comment now state the actual rule,
and the new design doc records the channel exclusion plus the
strict-decoder rollout warning.

* fix(acp): Require explicit submission provenance for auto recall

Carry original Web Shell composer text separately through admission and queues; keep background dispatches and undeclared requests ineligible. Reconcile hook and integration contracts and add regression coverage.

Co-authored-by: Qwen-Coder <[email protected]>

---------

Co-authored-by: Qwen-Coder <[email protected]>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

integrations/external-context-mem0/README.md

@@ -260,12 +260,9 @@ could send two searches for one turn. Use the v2 Extension profile for
 on-demand `context_search`, or the v3 Hook-only profile for Auto Recall, never
 both in one Qwen process.
 
-The Hook requires a non-empty `submitted_prompt` captured before prompt
-expansion. This includes supported interactive TUI submissions and headless
-CLI user turns (`qwen -p` and stream-json input, including SDK clients using
-that path). The field establishes prompt provenance, not a TUI-only origin.
-The Hook never falls back to the expanded `prompt`; events without
-`submitted_prompt` do not trigger retrieval.
+The Hook requires a non-empty `submitted_prompt` captured before prompt expansion. This includes supported interactive TUI submissions, first-turn headless CLI `UserQuery` sends (`qwen -p` and stream-json input, including SDK clients using that path), and explicitly declared fresh non-channel turns on the ACP session path used by ACP clients, `serve`, and daemon hosts. ACP/daemon clients must provide `_meta: { "qwen.submittedPrompt": "original submitted text" }` per eligible request; Web Shell does so at its submission boundary. Realtime voice handoffs omit declarations because their text comes from model-generated tool arguments. Existing ACP clients without a declaration continue to omit the field. Internal background dispatches and all channel messages, including human messages, are excluded. See [UserPromptSubmit](../../docs/users/features/hooks.md#userpromptsubmit).
+
+The field establishes prompt provenance, not a TUI-only origin or proof of human authorship. The Hook never falls back to `prompt`; events without `submitted_prompt` do not trigger retrieval.
 
 Register this profile only in launchers where automatic retrieval is intended
 for all eligible inputs. To disable every Hook for an automation run, use

integrations/external-context/README.md

@@ -237,13 +237,11 @@ write. Cancellation therefore does not prove that no memory was created.
 
 ### Auto-recall profile
 
-Auto-recall sends a sanitized best-effort query to the external provider for
-each eligible ordinary interactive prompt. It requires a non-empty
-`submitted_prompt` captured by the supported interactive TUI before reminders,
-file and resource expansion, extension output, and vision expansion. It never
-falls back to the legacy model-bound `prompt`. Missing or invalid provenance
-fails closed before configuration or credentials are read. Common credential
-shapes are removed from the submitted text, but this is not DLP.
+This managed Auto Profile supports a fresh interactive TTY launcher, as constrained below. It sends a sanitized best-effort query to the external provider for eligible submissions. The Hook requires a non-empty `submitted_prompt` and never falls back to legacy `prompt`.
+
+The field itself has a broader producer contract than this managed launcher: supported TUI and first-turn headless submissions, and explicitly declared fresh non-channel turns on the ACP path used by ACP clients, `serve`, and daemon hosts. ACP declarations are opt-in per request; ordinary clients without them, internal background dispatches, and all channel messages (including human messages) do not trigger recall. See [UserPromptSubmit](../../docs/users/features/hooks.md#userpromptsubmit) for the current field contract. This does not expand this Direct Profile's supported launchers. The original [Direct Auto Recall design](../../docs/design/direct-external-context-auto-recall.md) describes its TTY deployment constraints; its producer enumeration predates subsequent headless and ACP support.
+
+Missing or invalid provenance fails closed before configuration or credentials are read. Common credential shapes are removed from the submitted text, but this is not DLP.
 
 1. Copy `examples/auto-recall-mem0.json` or
    `examples/auto-recall-generic-http.json` to an