Persist Patrol proposal evidence in action origins

docs/release-control/v6/internal/subsystems/agent-lifecycle.md

@@ -938,6 +938,13 @@ must not be projected into the provider child process. Any future design that
 distributes subscription CLI state or authentication through an agent requires
 a separate agent-lifecycle contract change and verification.
 
+Patrol investigation evidence copied by
+`internal/api/patrol_action_broker.go` into an action's broker-owned origin is
+API/AI audit provenance only. Tool-use evidence IDs do not identify an agent,
+grant an agent scope, authorize a command channel, or replace live agent
+readiness and dispatch admission. Any agent-mediated action still crosses the
+existing lifecycle identity, authorization, and receipt boundaries.
+
 First-run security discovery under shared `internal/api/` is likewise an
 adjacent API/security boundary, not an agent-lifecycle discovery surface.
 Unauthenticated `/api/security/status` responses must stay on the public tier

docs/release-control/v6/internal/subsystems/api-contracts.md

@@ -1955,7 +1955,8 @@ a new API state machine, queue contract, or verification-accounting field.
    `aicontracts.OrchestratorActionBroker` contract as a tenant-bound proposal
    adapter. It stamps the fixed `pulse_patrol` requestedBy actor
    and a broker-owned `ActionOrigin` (surface/finding/investigation/proposal
-   IDs) through the service's internal `PlanWithOptions`; the public plan
+   IDs plus the orchestrator-observed investigation evidence IDs) through the
+   service's internal `PlanWithOptions`; the public plan
    endpoint keeps calling plain `Plan`, so an HTTP request body can never
    claim a first-party origin. Enterprise still has no decision or execution
    method. After planning, core may auto-authorize only when the capability's
@@ -1990,7 +1991,12 @@ a new API state machine, queue contract, or verification-accounting field.
    can reconcile decisions and outcomes onto the correct tenant. A
    Patrol proposal must carry both its finding and investigation IDs
    before anything persists; identity-less proposals are refused so a
-   governed action can never lose deterministic correlation.
+   governed action can never lose deterministic correlation. Enterprise binds
+   proposal evidence from the bounded, non-terminal tool-use events it
+   observed for that run; the broker copies those IDs into `ActionOrigin`, and
+   the lifecycle normalizes and de-duplicates them before persistence. Model
+   output cannot mint this audit provenance, and the IDs grant no planning,
+   approval, or execution authority.
    Authority proof: `TestContract_PatrolActionBrokerKeepsPolicyExecutionCoreOwned` in
    `internal/api/contract_test.go`.
    The proposal enters that broker from the investigation-only

docs/release-control/v6/internal/subsystems/storage-recovery.md

@@ -147,6 +147,13 @@ governed tool and verification boundaries. CLI authentication state must not be
 included in recovery exports, snapshots, or support bundles, and must not be
 interpreted as recovery readiness.
 
+Patrol investigation evidence copied by
+`internal/api/patrol_action_broker.go` into broker-owned action origin is
+correlation provenance, not storage or recovery proof. A tool-use evidence ID
+must not be reinterpreted as backup freshness, protection coverage, restore
+readiness, or verification truth; those claims continue to require their
+domain-owned typed evidence and deterministic verification paths.
+
 Unified Agent durable-operation-receipt metadata is likewise an internal
 monitoring and agent-lifecycle boundary. The exact current protocol may be a
 fail-closed prerequisite when unified resources derive the bounded