[ITSGJY]

Summary

• add a bounded ack_ref for compact request-scoped evidence of the exact retained ACK-required Workflow Session message set
• bind each ref to the exact Session owner/incarnation and the full current open ACK-required membership, so changed or stale sets acknowledge nothing
• keep ack_session_message_ids available for exact-ID compatibility and Window Peer ACKs
• preserve existing Session authorization, message resolution, completion, and non-sticky model-context semantics

Behavior

session_attention can return an ack_ref representing the ACK-required Session messages explicitly retained across the current exchange. Echoing the ref on a later Stateless MCP 2026 call expands it only after the exact authorized attention Session has been established.

The ref is non-authoritative and Session-only. Adding, resolving, withdrawing, replacing, or otherwise removing an ACK-required message changes the full-set fence, so an older ref cannot absorb new membership. ACK observation alone does not change membership, which keeps exact replay safe. Malformed, foreign-Session, foreign-principal, stale, and non-canonical refs acknowledge nothing.

No ambient Window/Session ACK state is introduced. Message resolution and todo completion remain separate durable transitions.

Validation

• cargo fmt --all -- --check
• git diff --check
• cargo check --locked -p webcodex
• full webcodex-workflow-session library tests passed
• full webcodex-tool-contracts library tests passed (234 tests)
• focused Runtime/MCP coverage passed for ACK replay, retained-set accumulation, foreign-principal denial, HTTP Stateless MCP flow, wrapper validation, and compact tools/list size budgets

Implements yyjeqhc#573.

[ITSGJY]

Full CI passed; closing this fork-only validation PR before upstream submission.