[scode]

Second find from the live E2E battery, and the worse one: the headless distill child is itself an agent session, so
its transcript — containing the full distill prompt, i.e. every transcript emitted that cycle — lands in the session
store and gets emitted by the next scan. Each cycle's payload embeds the previous cycle's payload; growth is
unbounded. On the test box the fourth cycle hit "Prompt is too long: ~3.7M tokens" and distillation was permanently
wedged. A cron setup on an active box would reach the same wall within days.

The fix marks headless prompts with a fixed first-line sentinel, and the scan records sentinel-classified sessions as
processed without emission — their content is synthetic (leiter's own prompt plus the agent's summary), so nothing is
lost. Two review rounds shaped the details into something considerably more careful than the first cut:

• Detection is positional, not substring-anywhere: a session is a child only when its FIRST user message begins with
  the sentinel — a position injected tool output, quoted docs, or soul-synced block content can never occupy.
  Content-anywhere matching would have handed prompt injection a silent suppress-from-learning primitive, and via the
  soul-sync channel (sentinel in soul → managed block → every future transcript) a global learning shutdown.
• The classification runs in every channel the child can land in: the Claude scan, the Codex rollout scan (an
  agent_command of codex exec writes the child there — the growth loop would have survived that documented
  configuration untouched), and legacy-log rendering (a still-hooked migrating box's SessionEnd tombstone copies the
  child transcript into logs, where an unaccounted copy could re-wedge the exact failure being fixed).
• --dry-run elides every sentinel occurrence from its output, so inspecting the prompt cannot mark the inspecting
  session; the interactive leiter soul distill payload carries no sentinel at all, keeping the invoking session
  learnable. Excluded session ids are logged, not silently absorbed.

A run whose only changes are child sessions commits their watermarks through the existing empty-only self-commit path
without spawning an agent.

changelog: include