@sema-agent/server 7.137.0 → 7.139.0

package/dist/http/routes/devices.js

@@ -3,8 +3,12 @@ import { explicitOperatorOk, gatedPrincipal, sendPrincipalRefusal } from "../pri
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { DEVICE_PLATFORM_OS, DEVICE_PUBKEY_MAX_BYTES, DEVICE_TEXT_LIMITS, assertDeviceIdShape, assertDevicePubkeyShape, assertRootSessionIdShape, isDeviceAbsolutePath, sameDeviceOwner, } from "../../device-store.js";
+import { boundDeviceOf } from "../../execution-placement.js";
+import { defaultTaskRegistry } from "@sema-agent/core";
+import { probeSessionChildren, sessionChildrenScope } from "../../session-children-retire.js";
+import { liveChildrenRefusal } from "./background.js";
 import { DEFAULT_ENROLL_TOKEN_TTL_SEC } from "../../device-enrollment.js";
-import { deviceOwnerDomainOf } from "../device-placement.js";
+import { deviceOwnerDomainOf } from "../execution-context.js";
 import { echoKeyName } from "../../request-key-closure.js";
 const DEVICE_NOT_FOUND_MESSAGE = "device not found";
 const NO_DEVICE_DOMAIN_MESSAGE = "device management needs a caller domain: this credential carries no verified tenant scope claim (registry auth-bridge JWT `scope`) and is not an explicit operator — connect through the registry auth bridge, or configure OPERATOR_PRINCIPALS";
@@ -32,9 +36,6 @@ function deviceListRow(row, online) {
         ...(row.lastSeenAtMs !== null ? { lastSeenAt: new Date(row.lastSeenAtMs).toISOString() } : {}),
     };
 }
-function boundDeviceOf(row) {
-    return { deviceId: row.deviceId, rev: row.rev, boundAt: new Date(row.boundAtMs).toISOString() };
-}
 function sendDeviceRejection(res, rej) {
     if (rej.retryAfterSec !== undefined)
         res.setHeader("retry-after", String(rej.retryAfterSec));
@@ -112,7 +113,6 @@ function parseEnrollBody(res, body) {
 export async function handleDevices(req, res, match, ctx) {
     switch (match.decl.id) {
         case "devices-list":
-        case "device-session":
         case "device-session-rebind":
         case "device-enroll-tokens":
         case "device-enroll":
@@ -248,31 +248,19 @@ export async function handleDevices(req, res, match, ctx) {
         return;
     }
     const rootSessionId = decoded;
-    if (match.decl.id === "device-session") {
-        if (!operator && domain === undefined) {
-            sendError(res, 403, "auth.forbidden", NO_DEVICE_DOMAIN_MESSAGE);
-            return;
-        }
-        const binding = await store.getSessionBinding(rootSessionId);
-        if (!binding || (!operator && !sameDeviceOwner(binding.owner, domain))) {
-            sendDeviceNotFound(res);
-            return;
-        }
-        sendJson(res, 200, { rootSessionId, boundDevice: boundDeviceOf(binding) });
-        return;
-    }
     if (!operator && domain === undefined) {
         sendError(res, 403, "auth.forbidden", NO_DEVICE_DOMAIN_MESSAGE);
         return;
     }
-    const binding = await store.getSessionBinding(rootSessionId);
-    if (!binding || (!operator && !sameDeviceOwner(binding.owner, domain))) {
+    const placement = await enrollment.readPlacement(rootSessionId);
+    const binding = placement === undefined ? undefined : boundDeviceOf(placement.cell);
+    if (placement === undefined || !binding || (!operator && !sameDeviceOwner(binding.owner, domain))) {
         sendDeviceNotFound(res);
         return;
     }
     const body = (await readJson(req));
     if (typeof body !== "object" || body === null || typeof body.toDeviceId !== "string" || body.expectedRev === undefined) {
-        sendError(res, 400, "request.body_shape", "body must be { toDeviceId: string, expectedRev: number } — expectedRev is the binding rev read from GET /v1/devices/sessions/{rootSessionId} (explicit prior state; two concurrent operators must not silently stomp each other)");
+        sendError(res, 400, "request.body_shape", "body must be { toDeviceId: string, expectedRev: number } — expectedRev is the device rev read from GET /v1/sessions/{sessionId}/execution-placement (explicit prior state; two concurrent operators must not silently stomp each other)");
         return;
     }
     if (typeof body.expectedRev !== "number" || !Number.isInteger(body.expectedRev) || body.expectedRev < 0) {
@@ -295,16 +283,24 @@ export async function handleDevices(req, res, match, ctx) {
         sendError(res, 409, "device.rebind_active_run", "this session has a non-terminal run — rebinding now would leave in-flight work addressed at another workspace; cancel the run (or let it finish), then retry", { activeTaskId });
         return;
     }
-    const result = await store.rebindSession({ rootSessionId, toDeviceId, expectedRev, owner: binding.owner });
+    const tree = await probeSessionChildren({ agentStore: deps.backgroundAgentStore, checkpointStore: deps.checkpointStore, registry: defaultTaskRegistry }, rootSessionId, sessionChildrenScope(placement.occupant.owner));
+    if (tree.liveChildren.length > 0) {
+        sendError(res, 409, "device.rebind_active_run", "this session still has background agents running or waiting on an approval under it — rebinding now would leave them addressed at the old device; retire them (POST retirePath) or let them finish, then retry", liveChildrenRefusal(rootSessionId, tree.liveChildren));
+        return;
+    }
+    const result = await store.rebindDeviceExecution({ root: rootSessionId, occupant: placement.occupant, owner: binding.owner, expectedRev, targetDeviceId: toDeviceId });
     switch (result.outcome) {
         case "rebound":
         case "idempotent":
-            sendJson(res, 200, { rootSessionId, deviceId: result.row.deviceId, rev: result.row.rev, workspaceCarryover: "none" });
+            sendJson(res, 200, { rootSessionId, deviceId: result.device.id, rev: result.device.rev, workspaceCarryover: "none" });
             return;
         case "rev_conflict":
-            sendError(res, 409, "device.rebind_rev_conflict", "expectedRev does not match the binding's current rev — the session↔device binding changed since it was read; re-read it and retry with currentRev", { currentRev: result.row.rev });
+            sendError(res, 409, "device.rebind_rev_conflict", "expectedRev does not match the binding's current rev — the session↔device binding changed since it was read; re-read it and retry with currentRev", { currentRev: result.device.rev });
+            return;
+        case "active_run":
+            sendError(res, 409, "device.rebind_active_run", "this session has a non-terminal run — rebinding now would leave in-flight work addressed at another workspace; cancel the run (or let it finish), then retry", { activeTaskId: result.activeTaskId });
             return;
-        case "binding_not_found":
+        case "gone":
         case "device_not_found":
             sendDeviceNotFound(res);
             return;
@@ -321,7 +317,6 @@ export const DEVICES_ROUTES = [
     { id: "device-enroll", path: "/v1/devices/enroll", credentialGated: ["POST"], methods: ["POST"] },
     { id: "device-revoke", pattern: /^\/v1\/devices\/(?<deviceId>[^/]+)\/revoke$/, label: "/v1/devices/:deviceId/revoke", methods: ["POST"] },
     { id: "device-session-rebind", pattern: /^\/v1\/devices\/sessions\/(?<rootSessionId>[^/]+)\/rebind$/, label: "/v1/devices/sessions/:id/rebind", methods: ["POST"] },
-    { id: "device-session", pattern: /^\/v1\/devices\/sessions\/(?<rootSessionId>[^/]+)$/, label: "/v1/devices/sessions/:id", credentialGated: ["GET"], methods: ["GET"] },
     { prefix: "/v1/devices/", credentialGated: ["POST"] },
 ];
 //# sourceMappingURL=devices.js.map

package/dist/http/routes/mcp-reconnect.d.ts

@@ -25,8 +25,9 @@
  * `unsupported` 挂 409 更会把「这条 run 没有 MCP 面」谎报成一个活性问题。
  *
  * ── 下一步动作按 `status`,不解析 `reason`(core [ref] 键表逐字)────────────────────────────────
- * `status.errorCode` / `status.httpStatus` 是机器面(`http_status` 401 是一扇重新授权的门,`spawn_failed` 是
- * 缺二进制);`reason` 是**人读**的一句话(它可能嵌远端文本:引擎铸点抹过请求回显与同主体词表,本仓那一遍只读引擎没抹的段、定长截断后投出 —— `http/mcp-remote-text.ts`),
+ * `status.errorCode` / `status.httpStatus` 是机器面(`unauthorized` 是一扇要用户授权的门 —— 引擎 7.59.0 起 401 与带 `insufficient_scope` 的 403 读这个词、不再是
+ * `http_status` + 状态数;`spawn_failed` 是
+ * 缺二进制);`reason` 是**人读**的一句话(它可能嵌远端文本:引擎铸点抹过请求回显与同主体词表,出门经出口座 `mcp-remote-text` 行 —— 同一个脱敏器、界 200 —— 投出),
  * 消费端**不许**解析它。名册**按 `tools` 的在场性**投成 `toolNames`(present-iff),**不按 `outcome`**。
  *
  * ── 查找与拒绝形(与 steer / capture-optout **同一只**,不新造)───────────────────────────────────

package/dist/http/routes/mcp-reconnect.js

@@ -7,7 +7,8 @@ import {} from "../route-ctx.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { sessionOwnerCellOf } from "../../security.js";
-import { redactMcpRemoteText } from "../mcp-remote-text.js";
+import { seatText } from "../../trace/exit-seat.js";
+import { projectMcpAuthorization } from "../../mcp-authorization-face.js";
 const BodySchema = z.object({ server: z.string().min(1).max(190) }).strict();
 function outcomeOf(coreOutcome) {
     switch (coreOutcome) {
@@ -24,8 +25,9 @@ function projectStatus(s) {
         ...(s.errorCode !== undefined ? { errorCode: s.errorCode } : {}),
         ...(s.httpStatus !== undefined ? { httpStatus: s.httpStatus } : {}),
         ...(s.delivered !== undefined ? { delivered: s.delivered } : {}),
+        ...((a) => (a !== undefined ? { authorization: a } : {}))(projectMcpAuthorization(s.authorization)),
         ...(s.serverInfo !== undefined ? { serverInfo: s.serverInfo } : {}),
-        ...(s.error !== undefined ? { error: redactMcpRemoteText(String(s.error)) } : {}),
+        ...(s.error !== undefined ? { error: seatText("mcp-remote-text", String(s.error)) } : {}),
         ...(s.transportClosed !== undefined ? { transportClosed: s.transportClosed } : {}),
     };
 }
@@ -34,7 +36,7 @@ function projectListingIncomplete(l) {
         reason: l.reason,
         pages: l.pages,
         ...(l.budgetMs !== undefined ? { budgetMs: l.budgetMs } : {}),
-        ...(l.error !== undefined ? { error: redactMcpRemoteText(l.error) } : {}),
+        ...(l.error !== undefined ? { error: seatText("mcp-remote-text", l.error) } : {}),
     };
 }
 function projectResult(r) {
@@ -46,7 +48,7 @@ function projectResult(r) {
         added: r.added,
         removed: r.removed,
         ...(r.tools !== undefined ? { toolNames: r.tools.map((t) => t.name) } : {}),
-        ...(r.reason !== undefined ? { reason: redactMcpRemoteText(r.reason) } : {}),
+        ...(r.reason !== undefined ? { reason: seatText("mcp-remote-text", r.reason) } : {}),
         ...(r.status !== undefined ? { status: projectStatus(r.status) } : {}),
         ...(r.listingIncomplete !== undefined ? { listingIncomplete: projectListingIncomplete(r.listingIncomplete) } : {}),
     };
@@ -112,7 +114,7 @@ export async function handleMcpReconnect(req, res, match, ctx) {
                     const msg = e instanceof Error ? e.message : String(e);
                     switch (code) {
                         case "mcp.reconnect_unavailable":
-                            sendJson(res, 200, { taskId: activeTaskId, sessionId, server, outcome: "unsupported", reason: redactMcpRemoteText(msg) });
+                            sendJson(res, 200, { taskId: activeTaskId, sessionId, server, outcome: "unsupported", reason: seatText("mcp-remote-text", msg) });
                             return;
                         case "steering.invalid_content":
                             sendError(res, 422, "steering.invalid_content", msg);

package/dist/http/routes/memory-consolidation.d.ts

@@ -24,7 +24,7 @@
  *  · 调用方显式给 `scope` ⇒ 用它 —— 哪怕它不在 `MEMORY_CONSOLIDATION_SCOPES` 里。
  *    🔴 那张表**不是授权边界**:本仓今天没有任何授权源能对一个 operator 收窄 scope(`gateMemoryScope`
  *    的 operator 支在查目录之前就 allow;`org-memory-admission` 明写 v1 不中央收窄 operator 声明的
- *    scope —— 全文见 `src/memory-operator-faces.ts` 的 `erasureEnvelopeRefusal` 头注)。在本层拿它当
+ *    scope —— 全文见 `src/memory-operator-faces.ts` `MemoryComplianceFaces.erase` 的「授权座只有一只」段)。在本层拿它当
  *    白名单就是**发明第二套授权语义**,与 `gateMemoryScope` 对同一个身份给出相反答案;
  *  · 省略 `scope` ⇒ 只有表**恰好一条**时才有缺省(那条就是这台部署的库);零条或两条以上一律 400,
  *    并把候选列进文案 —— 让运维一眼看到「我该点哪一个」。

package/dist/http/routes/memory-origin.d.ts

@@ -114,7 +114,7 @@ export declare function buildClearanceRowWire(r: OriginClearanceRow): {
     baseRev: string;
     origin: {
         at: number;
-        cause?: "static" | "observed" | "unattributed" | "derived" | undefined;
+        cause?: "static" | "unattributed" | "observed" | "derived" | undefined;
         taint: "external";
     };
 };

package/dist/http/routes/rules.js

@@ -7,7 +7,7 @@ import { createLogger } from "../../observability/logger.js";
 import { RULE_IMPORT_RETRY_AFTER_SEC, RULE_SCOPE_REFUSAL_SENTENCE, MAX_RULE_SCOPE_CHARS, buildCcImportLayerRootRefusal, parseRuleScope, serializeRuleScope } from "../../rules-consent.js";
 import { hasControlOrBidi } from "@sema-agent/settings-schema";
 import { IMPORTED_SETTINGS_LAYERS, MAX_RULE_TEXT_CHARS, PERSISTED_RULE_MATCHES, RULE_ADD_ORIGINS, RULE_BEHAVIORS, isValidDurableScope } from "@sema-agent/core";
-import { isPersistedRuleTool, isDirectWritableRuleBehavior } from "../../permission-rule-vocab.js";
+import { isDirectWritableRuleBehavior } from "../../permission-rule-vocab.js";
 const logger = createLogger();
 export const RULES_CC_IMPORT_PREPARE_PATH = "/v1/rules/cc-import/prepare";
 export const RULES_CC_IMPORT_REDEEM_PATH = "/v1/rules/cc-import/redeem";
@@ -50,9 +50,9 @@ const LocalImportRowSchema = z
     rule: z.string().min(1).max(MAX_RULE_TEXT_CHARS),
     scope: z.string().min(1).max(MAX_RULE_SCOPE_CHARS),
     behavior: z.enum(RULE_BEHAVIORS),
-    tool: z.string().min(1).max(190).refine(isPersistedRuleTool, { message: "not a tool the persisted-rule grammar speaks for" }),
+    tool: z.string().min(1).max(190),
     match: z.enum(PERSISTED_RULE_MATCHES),
-    command: z.string().min(1).max(MAX_RULE_TEXT_CHARS),
+    command: z.string().max(MAX_RULE_TEXT_CHARS),
     adds: z.array(LocalImportAddSchema).max(64),
 })
     .strict();

package/dist/http/routes/runs.js

@@ -222,11 +222,16 @@ export async function handleRuns(req, res, match, ctx) {
         const prepared = await prepareSpec(req, res, keyedBody);
         if (!prepared)
             return;
-        const resp = await createDurableRun(req, res, ctx, prepared, idem);
-        if (!resp)
+        try {
+            const resp = await createDurableRun(req, res, ctx, prepared, idem);
+            if (!resp)
+                return;
+            sendJson(res, resp.status, resp.body);
             return;
-        sendJson(res, resp.status, resp.body);
-        return;
+        }
+        finally {
+            prepared.peerLease.release();
+        }
     }
     if (match.decl.id === "run-detail" || match.decl.id === "run-events" || match.decl.id === "runs-by-idem") {
         const runs = facts.durableRuns(deps);
@@ -433,13 +438,12 @@ export async function handleRuns(req, res, match, ctx) {
         const text = body.text;
         const priority = body.priority;
         const steerIdemRaw = headerStr(req.headers["idempotency-key"]);
-        const steerInputId = steerIdemRaw ? `idem-${idemKeyOf(steerIdemRaw, idemCallerOf(req, ctx), "run").slice(0, 32)}` : undefined;
-        const messageId = steerInputId ?? uuidv7();
+        const messageId = steerIdemRaw ? `idem-${idemKeyOf(steerIdemRaw, idemCallerOf(req, ctx), "run").slice(0, 32)}` : uuidv7();
         const trusted = explicitOperatorOk(principal, deps.config);
         const steerInput = () => ({
             text,
             trusted,
-            ...(steerInputId !== undefined ? { inputId: steerInputId } : {}),
+            inputId: messageId,
             ...(priority !== undefined ? { priority } : {}),
         });
         try {

package/dist/http/routes/session-sync.js

@@ -18,6 +18,10 @@ import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import { readSessionRulesRecords, describeSessionRulesRecordProblem } from "../../session-policy-wire.js";
 import { readSessionPinned, readSessionTitle } from "../../session-row.js";
 import { sessionFaceOfHead } from "../../session-incarnation.js";
+import { defaultTaskRegistry } from "@sema-agent/core";
+import { SessionActiveRunError, SessionForkInProgressError, SessionWriterPresentError } from "../../execution-placement.js";
+import { probeSessionChildren, sessionChildrenScope } from "../../session-children-retire.js";
+import { liveChildrenRefusal } from "./background.js";
 export function createSessionSyncLocal() {
     const pendingStagings = new Map();
     const importLeases = new Map();
@@ -90,7 +94,46 @@ export async function handleSessionSync(req, res, match, ctx) {
             const replaySessionRow = async (row, face) => {
                 if (Object.keys(row).length === 0)
                     return true;
-                return face !== undefined && (await sessionStorage.patchSessionMeta(sessionId, row, face)) !== undefined;
+                if (face === undefined)
+                    return false;
+                const replayed = await sessionStorage.writeSessionRowCells(sessionId, row, { writer: "replay", row: { row: face } });
+                switch (replayed.kind) {
+                    case "written":
+                        return true;
+                    case "absent":
+                        return false;
+                    default: {
+                        const unreachable = replayed;
+                        throw new Error(`session-sync row replay: no answer for the row write outcome ${JSON.stringify(unreachable)}`);
+                    }
+                }
+            };
+            const liveChildrenOf = async (face) => face === undefined
+                ? []
+                : (await probeSessionChildren({ agentStore: deps.backgroundAgentStore, checkpointStore: deps.checkpointStore, registry: defaultTaskRegistry }, sessionId, sessionChildrenScope(face.owner))).liveChildren;
+            const activityOf = async (face) => {
+                const activeTaskId = await deps.runStore?.getActiveTaskId(sessionId);
+                if (activeTaskId)
+                    return { kind: "run", activeTaskId };
+                const liveChildren = await liveChildrenOf(face);
+                return liveChildren.length > 0 ? { kind: "children", liveChildren } : undefined;
+            };
+            const sendActivity = (activity, moment) => {
+                switch (activity.kind) {
+                    case "run":
+                        if (moment === "open")
+                            sendError(res, 409, "session_active", "session has an active run; sync after it settles", { activeTaskId: activity.activeTaskId });
+                        else
+                            sendError(res, 409, "session_active", "session started an active run while the import streamed; sync after it settles", { activeTaskId: activity.activeTaskId });
+                        return;
+                    case "children":
+                        sendError(res, 409, "session_active", "session still has background agents running or waiting on an approval under it; retire them (POST retirePath) or let them finish, then sync", liveChildrenRefusal(sessionId, activity.liveChildren));
+                        return;
+                    default: {
+                        const unhandled = activity;
+                        throw new Error(`session sync: unknown session activity ${JSON.stringify(unhandled)}`);
+                    }
+                }
             };
             const canReplayHistory = fileHistoryImportFace(historyStore) !== undefined;
             const replayHistory = async (envelope, allowReplace) => {
@@ -339,15 +382,56 @@ export async function handleSessionSync(req, res, match, ctx) {
                     if (!payloadVerified)
                         digestSaysDiffer = true;
                 }
+                const placed = gateFace === undefined ? undefined : await sessionStorage.executionPlacement?.read(sessionId);
+                if (placed !== undefined) {
+                    switch (placed.cell.role) {
+                        case "absent":
+                        case "mirror":
+                            break;
+                        case "writer":
+                            sendSessionWriter(res);
+                            return;
+                        case "forking":
+                            sendError(res, 409, "conflict.fork_in_progress", new SessionForkInProgressError(sessionId).message);
+                            return;
+                        default: {
+                            const unknownRole = placed.cell;
+                            throw new Error(`session sync: unknown execution placement ${JSON.stringify(unknownRole)}`);
+                        }
+                    }
+                }
+                const activeNow = await activityOf(gateFace);
+                if (activeNow !== undefined) {
+                    sendActivity(activeNow, "open");
+                    return;
+                }
                 if (relA.relation === "identical" && !digestSaysDiffer) {
-                    if (fileHistory !== null && canReplayHistory) {
-                        if (resolution === "overwrite-dst") {
-                            const activeNow = await deps.runStore?.getActiveTaskId(sessionId);
-                            if (activeNow) {
-                                sendError(res, 409, "session_active", "session has an active run; sync after it settles", { activeTaskId: activeNow });
+                    const seat = sessionStorage.executionPlacement;
+                    if (seat !== undefined) {
+                        if (gateFace === undefined) {
+                            sendError(res, 409, "conflict", "sync conflict");
+                            return;
+                        }
+                        const mirrored = await seat.markMirror(sessionId, gateFace);
+                        switch (mirrored.outcome) {
+                            case "mirrored":
+                                break;
+                            case "writer":
+                                sendSessionWriter(res);
+                                return;
+                            case "gone":
+                                sendError(res, 409, "conflict", "sync conflict");
+                                return;
+                            case "active":
+                                sendActivity({ kind: "run", activeTaskId: mirrored.activeTaskId }, "open");
                                 return;
+                            default: {
+                                const unhandled = mirrored;
+                                throw new Error(`session sync: unknown mirror outcome ${JSON.stringify(unhandled)}`);
                             }
                         }
+                    }
+                    if (fileHistory !== null && canReplayHistory) {
                         const failed = await replayHistory(fileHistory, resolution === "overwrite-dst");
                         if (failed !== undefined) {
                             sendFileHistoryReplayFailure(res, failed);
@@ -380,11 +464,6 @@ export async function handleSessionSync(req, res, match, ctx) {
                     });
                     return;
                 }
-                const activeTaskId = await deps.runStore?.getActiveTaskId(sessionId);
-                if (activeTaskId) {
-                    sendError(res, 409, "session_active", "session has an active run; sync after it settles", { activeTaskId });
-                    return;
-                }
                 const heldLease = importLeases.get(sessionId);
                 if (heldLease) {
                     const staleSecRaw = deps.config.syncImportLeaseStaleSec;
@@ -511,8 +590,9 @@ export async function handleSessionSync(req, res, match, ctx) {
                 let mayPushAtCommit;
                 let activeAtCommit;
                 try {
-                    mayPushAtCommit = (await judgeSessionGate()).mayPush;
-                    activeAtCommit = mayPushAtCommit ? await deps.runStore?.getActiveTaskId(sessionId) : undefined;
+                    const gateAtCommit = await judgeSessionGate();
+                    mayPushAtCommit = gateAtCommit.mayPush;
+                    activeAtCommit = mayPushAtCommit ? await activityOf(gateAtCommit.face) : undefined;
                 }
                 catch (e) {
                     await pending.handle.abort().catch(() => undefined);
@@ -525,10 +605,10 @@ export async function handleSessionSync(req, res, match, ctx) {
                     sendSessionAbsent();
                     return;
                 }
-                if (activeAtCommit) {
+                if (activeAtCommit !== undefined) {
                     await pending.handle.abort().catch(() => undefined);
                     cleanupStaging(stagingId);
-                    sendError(res, 409, "session_active", "session started an active run while the import streamed; sync after it settles", { activeTaskId: activeAtCommit });
+                    sendActivity(activeAtCommit, "streamed");
                     return;
                 }
                 try {
@@ -567,6 +647,18 @@ export async function handleSessionSync(req, res, match, ctx) {
                         sendError(res, 409, "conflict", "sync conflict", { relation: e.relation });
                         return;
                     }
+                    if (e instanceof SessionWriterPresentError) {
+                        sendSessionWriter(res);
+                        return;
+                    }
+                    if (e instanceof SessionForkInProgressError) {
+                        sendError(res, 409, "conflict.fork_in_progress", e.message);
+                        return;
+                    }
+                    if (e instanceof SessionActiveRunError) {
+                        sendActivity({ kind: "run", activeTaskId: e.activeTaskId }, "streamed");
+                        return;
+                    }
                     if (sendSessionPolicyError(res, e))
                         return;
                     if (sendSessionError(res, e, "import")) {
@@ -635,6 +727,9 @@ function sendPullUnreadable(req, res, logger, e) {
         }
     }
 }
+function sendSessionWriter(res) {
+    sendError(res, 409, "conflict.session_writer", "this session is written on this deployment (its execution placement is a writer here) — an import cannot turn it into a read-only mirror; fork it to push your copy, or pull instead; nothing was written");
+}
 function sendMissingBlob(res) {
     sendError(res, 422, "missing_blob", "missing blob; PUT all referenced blobs before import");
 }

package/dist/http/routes/sessions.d.ts

@@ -74,6 +74,12 @@ export declare const SESSIONS_ROUTES: readonly [{
     readonly pattern: RegExp;
     readonly label: "/v1/sessions/:id/$verb";
     readonly methods: readonly ["GET"];
+}, {
+    readonly id: "session-execution-placement";
+    readonly pattern: RegExp;
+    readonly label: "/v1/sessions/:id/execution-placement";
+    readonly credentialGated: readonly ["GET"];
+    readonly methods: readonly ["GET"];
 }, {
     readonly id: "session-events";
     readonly pattern: RegExp;