fix(conformance): withCapture propagates inner brands + chain test + docstring fixes

packages/core-shared/src/conformance/brand-runtime.ts

@@ -17,9 +17,11 @@ type Brand = "__instrumented" | "__captured" | "__audited";
 
 /**
  * Attaches the brand as a non-enumerable property on the given function.
- * Returns the same reference (no allocation). Idempotent: calling twice with
- * the same brand throws because the property is non-configurable — wrappers
- * never double-wrap, so this is the correct safety net.
+ * Returns the same reference (no allocation). Calling twice with the same
+ * brand on the same fn is a no-op (matching descriptors) — the engine silently
+ * accepts a redundant `defineProperty` call when every descriptor attribute
+ * matches the existing one. Redefining with different attributes (e.g. flipping
+ * `configurable`) would throw, but wrappers never do that.
  */
 export function attachBrand<F extends object>(fn: F, brand: Brand): F {
   Object.defineProperty(fn, brand, {

packages/core-shared/src/conformance/brands.ts

@@ -1,9 +1,11 @@
 /**
  * Phantom-type brands attached at wrap time by `withSpan`, `withCapture`,
- * and `withAudit`. Pure type-level — no runtime cost, no proxy, no
- * `Object.assign`. The conformance system uses these as the type-level
- * seam the binding signature checks; a use-case factory that hasn't been
- * wrapped is not assignable to a `ProductionUseCase<...>` slot.
+ * and `withAudit`. The brand has a type-level form (this file) and a
+ * non-enumerable runtime counterpart (see `./brand-runtime.ts`). The runtime
+ * cost is one `Object.defineProperty` call per wrap. The conformance system
+ * uses these as the type-level seam the binding signature checks; a use-case
+ * factory that hasn't been wrapped is not assignable to a
+ * `ProductionUseCase<...>` slot.
  */
 export type Instrumented<F> = F & { readonly __instrumented: true };
 export type Captured<F> = F & { readonly __captured: true };