borgmcp 2.0.3 → 2.0.4

package/docs/EXTRACTION_PROVENANCE.md

@@ -19,9 +19,9 @@ The extraction copied the monorepo's `client/src/` production boundary and top-l
   repository-idempotent cube creation required for local dogfood.
 - Initially set the standalone package identity to `2.0.0`. Its immutable
   lightweight release tag failed before packaging. The reviewed `2.0.1`
-  recovery and `2.0.2` successor were published and registry-verified; the next
-  candidate identity is `2.0.3`. Extraction and versioning do not authorize
-  publication.
+  recovery, `2.0.2`, and `2.0.3` successors were published and registry-verified;
+  the next candidate identity is `2.0.4`. Extraction and versioning do not
+  authorize publication.
 
 ## Review Holds
 
@@ -38,6 +38,6 @@ contract, with a pre-request `PENDING` record in the local 0600-permission seat
 store, exact-tuple ambiguous retry, and verified activation. The contract now
 resolves to the audited registry `borgmcp-shared@0.4.3`. The matching
 `borgmcp-server@0.1.8` release is published and registry-verified. Client
-`borgmcp@2.0.2` is published and registry-verified. Publication of the next
-candidate remains gated by reviewed `v2.0.3` source, a fresh annotated tag, and
+`borgmcp@2.0.3` is published and registry-verified. Publication of the next
+candidate remains gated by reviewed `v2.0.4` source, a fresh annotated tag, and
 exact registry integrity and signature verification.

package/docs/LOCAL_SERVER.md

@@ -28,6 +28,7 @@ Usage: borg server <command> [arguments]
 Commands:
   setup    Prepare local server identity and data; does not start the server.
   start    Start the verified server in the foreground.
+  stop     Stop the managed local server.
   status   Report verified runtime evidence.
   update   Verify and activate a local server artifact.
   invite   Create a single-use invitation in an interactive terminal.
@@ -119,9 +120,12 @@ The default discovery endpoint is `https://127.0.0.1:7091`. Explicit `--host` va
 - Rejected or expired invitation: keep the server running and mint a replacement
   invitation with `borg server invite`, then rerun `borg assimilate --host
   <server> --enroll` with the replacement invitation.
-- Rejected or unloadable local seat: run `borg reset-local-seat --host <server>`
-  to clear ONLY this worktree's saved local seat, then rerun `borg assimilate
-  --host <server>` with the server still running.
+- Revoked or superseded local session: run `borg reset-local-seat`, ask the
+  operator for a new invitation from `borg server invite`, then run `borg
+  assimilate --host <server> --enroll` with the server still running.
+- Unloadable local seat: run `borg reset-local-seat --host <server>` to clear
+  ONLY this worktree's saved local seat, then rerun `borg assimilate --host
+  <server>` with the server still running.
 - Unreachable server: start or restart it with `borg server start`, then
   rerun `borg assimilate --host <server>`.
 - Trust mismatch after an intentional server re-initialization: verify the

package/docs/RELEASING.md

@@ -29,7 +29,16 @@ successfully published that exact source as `borgmcp@2.0.2`; the registry record
 integrity
 `sha512-w0O0t/2wzeJpXEqb4jQGuqZeavEkfFKdz6poRT8q1TxDKHTlOlwo3auctE+X1kWU2s5JkSDcUiUdQdyLwu84IA==`.
 Never move, replace, reuse, or rerun that tag or workflow. The next candidate
-uses the unused `v2.0.3` identity from a fresh reviewed protected-main commit
+must use a fresh unused identity and requires the complete release gate again.
+
+The annotated `v2.0.3` tag object
+`47701127cbdba6499595ef0529de264b00a61840` peels to protected-main commit
+`3e44e9c439c036850c6a9226d02876f4883501d9`. Workflow run `29851751102`
+successfully published that exact source as `borgmcp@2.0.3`; the registry records
+integrity
+`sha512-3Iy4BSB+yq8F75w/gWiEU7D+mKCYYa5mIsn/iC/byy5CK/QsAWg10KgsBI3GlDBZul1CD3Qq+zpmVeK2qpIE1A==`.
+Never move, replace, reuse, or rerun that tag or workflow. The next candidate
+uses the unused `v2.0.4` identity from a fresh reviewed protected-main commit
 and requires the complete release gate again.
 
 ## Release Prerequisites

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "borgmcp",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "description": "Coordinate AI coding agents in shared cubes. Works with Claude Code, Codex, and OpenCode.",
   "type": "module",
   "main": "./dist/index.js",

package/src/assimilate-cmd.ts

@@ -42,7 +42,7 @@ import { installBorgPlugin } from './opencode-plugin.js';
 import { computeOpenCodePort, connectOpenCodeDrone, createOpenCodeLaunchKickoff, injectInitialKickoff } from './opencode-drone.js';
 import { ensureCliMcpConfigured } from './ensure-mcp-config.js';
 import { normalizeServerEndpoint } from './server-endpoint.js';
-import { BorgServerError } from './server-errors.js';
+import { BorgServerError, LegacySessionCredentialCollisionError } from './server-errors.js';
 import type { SeatStatus } from './seat-probe.js';
 import type { ServerSessionOperation } from './config.js';
 import type { ExpectedBinding, FinalizeServerSeatOutcome, PersistedLocalSeat } from './cubes.js';
@@ -92,7 +92,6 @@ export interface AssimilateResult {
   role_id: string;
   local_session?: {
     credential_ref: string;
-    expires_at: string | null;
   };
   // Idempotent-reattach discriminant: 'reused' when the server resolved the
   // client bearer to an existing seat, 'created' on a first/fresh attach.
@@ -126,7 +125,6 @@ export interface ActiveCube {
   /** Verified local-server CA identity; absent until a local server is selected. */
   serverTrustIdentity?: string;
   localSessionCredentialRef?: string;
-  localSessionExpiresAt?: string | null;
   // gh#899: assimilated role, persisted for connect-time tool-surface scoping
   // (mirrors cubes.ts ActiveCube; optional → backward-compatible).
   roleName?: string;
@@ -388,25 +386,25 @@ function reportServerFailure(
     );
     return 1;
   }
+  if (error instanceof LegacySessionCredentialCollisionError) {
+    deps.stderr(
+      `Local session credential collision detected.\n` +
+        `No local credentials were changed.\n` +
+        `Next: run borg assimilate --host ${error.origin} --enroll.\n`,
+    );
+    return 1;
+  }
   // A pin-matched typed 401: the server verified its own identity but rejected
-  // THIS worktree's session bearer (revoked, or taken over by another session).
+  // THIS worktree's session bearer with an explicit terminal outcome.
   // Distinct from a protocol/version mismatch and from a rejected enrollment:
   // only this worktree's saved local seat is affected, and recovery is scoped to
   // this worktree — no server/trust-anchor/cube/other-worktree reset, no restart
   // or version-alignment advice (#1082).
+  if (error instanceof BorgServerError && error.code === 'SESSION_REVOKED') {
+    return diagnoseSessionTermination(deps, apiUrl, 'revoked');
+  }
   if (error instanceof BorgServerError && error.code === 'SESSION_REJECTED') {
-    // Attach is PURE DIAGNOSIS on a rejection — it mutates nothing. This copy
-    // claims NO mutation of its own; it points at the dedicated OFFLINE
-    // `borg reset-local-seat` command (the only writer that clears a seat).
-    deps.stderr(
-      `This worktree's saved local seat on ${apiUrl} is no longer accepted — it was ` +
-        'revoked or taken over by another session. No Borg state changed. Run ' +
-        `${resetLocalSeatCommand(apiUrl)} to clear ONLY this worktree's saved seat ` +
-        '(offline; add `--yes` when non-interactive), then ask the server operator for a new ' +
-        'invitation — the server can stay running — and re-enroll with ' +
-        `${localAssimilateCommand(apiUrl, true)}.\n`,
-    );
-    return 1;
+    return diagnoseSessionTermination(deps, apiUrl, 'superseded');
   }
   if (error instanceof BorgServerError && error.code === 'INVITATION_REJECTED') {
     deps.stderr(
@@ -482,34 +480,19 @@ function resetLocalSeatCommand(apiUrl: string): string {
   return `\`borg reset-local-seat --host ${apiUrl}\``;
 }
 
-/**
- * Pin-matched SESSION_REJECTED diagnosis (#1082). PURE DIAGNOSIS — attach makes
- * ZERO local mutation on a rejected seat (ratified client-seat-reset-state-model
- * clause 1). The local server verified its OWN pinned identity (this is reached
- * only after a successful pinned-TLS attach — a pin MISMATCH throws a distinct
- * trust error and never lands here), then rejected THIS worktree's saved session
- * bearer (revoked, or taken over by another session). We stop and recommend the
- * dedicated OFFLINE `borg reset-local-seat` command, which is the ONLY writer
- * that clears a worktree's saved seat. Nothing here contacts the server further,
- * emits unselected egress, or touches local state. The recovery is
- * live-safe: the operator is never told to stop/restart the server.
- */
-function diagnoseSessionRejected(
+// Pin-matched terminal session diagnosis. This is intentionally output-only:
+// only the explicit offline reset command may clear the saved local seat.
+function diagnoseSessionTermination(
   deps: AssimilateDeps,
   apiUrl: string,
+  outcome: 'revoked' | 'superseded',
 ): number {
-  const worktree = deps.findProjectRoot(deps.cwd());
-  deps.stderr(
-    `This worktree's saved local seat on ${apiUrl} is no longer accepted — it was ` +
-      'revoked or taken over by another session. No Borg state was changed: your pinned ' +
-      'server trust, this and every other worktree, and their cubes are all untouched.\n',
-  );
+  const message = outcome === 'revoked'
+    ? 'Local session was revoked.'
+    : 'Local session was superseded by a newer enrollment.';
   deps.stderr(
-    `To clear ONLY this worktree's saved local seat (worktree ${worktree}), run ` +
-      `${resetLocalSeatCommand(apiUrl)} (add \`--yes\` when non-interactive). That command is ` +
-      'offline — it revokes nothing server-side. Then ask the server operator for a new ' +
-      'invitation (the server can stay running) and re-enroll with ' +
-      `${localAssimilateCommand(apiUrl, true)}.\n`,
+    `${message}\n` +
+      `Next: run borg reset-local-seat, then borg assimilate --host ${apiUrl} --enroll.\n`,
   );
   return 1;
 }
@@ -534,9 +517,28 @@ export async function runAssimilate(
     }
   }
 
+  // Read local seat state before authority discovery, which may probe the local
+  // server. A retired replacement collision must not send either saved bearer or
+  // perform any other network request.
+  let existing: ActiveCube | null = null;
+  let hasPersistedIdentity = false;
+  let localSeatReadError: unknown;
+  try {
+    existing = await deps.getActiveCube();
+    hasPersistedIdentity = existing !== null || await deps.hasPersistedActiveCube();
+  } catch (error) {
+    if (error instanceof LegacySessionCredentialCollisionError) {
+      return reportServerFailure(deps, error.origin, error);
+    }
+    localSeatReadError = error;
+  }
+
   // ----- Step 1: Select and authenticate the local server -----
   const authority = await selectAssimilationAuthority(args.flags, deps);
   if (!authority) return 1;
+  if (localSeatReadError !== undefined) {
+    return reportServerFailure(deps, authority.apiUrl, localSeatReadError);
+  }
 
   // ----- Repository + cube-name preflight -----
   // Resolve and, where necessary, confirm local presentation data before an
@@ -766,8 +768,6 @@ export async function runAssimilate(
   // retain its original role so the attach request reuses the exact durable
   // retry binding instead of selecting another unoccupied role and minting a
   // duplicate seat.
-  const existing = await deps.getActiveCube();
-  const hasPersistedIdentity = existing !== null || await deps.hasPersistedActiveCube();
   const wantSibling =
     args.flags.worktree !== undefined || (existing !== null && !args.flags.here);
   // `let`: the bound-pending resume path (CR#2) OVERRIDES this from the stored
@@ -943,8 +943,11 @@ export async function runAssimilate(
       // rejection; it points at the offline `borg reset-local-seat` command.
       // Distinct from unreachable/404/5xx/trust-mismatch, which stay
       // indeterminate below.
+      if (status === 'revoked') {
+        return diagnoseSessionTermination(deps, auth.apiUrl, 'revoked');
+      }
       if (status === 'rejected') {
-        return diagnoseSessionRejected(deps, auth.apiUrl);
+        return diagnoseSessionTermination(deps, auth.apiUrl, 'superseded');
       }
       // CR #6: distinct causes get cause-accurate, non-destructive recovery —
       // never the generic "restart the server" advice.
@@ -1192,17 +1195,18 @@ export async function runAssimilate(
       );
       return 1;
     }
-    // Pin-matched SESSION_REJECTED (revoked / taken-over seat): PURE DIAGNOSIS.
+    // Pin-matched terminal session outcomes are pure diagnosis.
     // Reached only after a successful pinned-TLS attach, so it is pin-matched by
     // construction — a pin mismatch throws a distinct trust error and never
     // enters this branch. Attach mutates NOTHING; it recommends the offline
     // `borg reset-local-seat` command.
-    if (
-      err instanceof BorgServerError &&
-      err.code === 'SESSION_REJECTED' &&
-      reattachPriorId != null
-    ) {
-      return diagnoseSessionRejected(deps, authority.apiUrl);
+    if (err instanceof BorgServerError && reattachPriorId != null) {
+      if (err.code === 'SESSION_REVOKED') {
+        return diagnoseSessionTermination(deps, authority.apiUrl, 'revoked');
+      }
+      if (err.code === 'SESSION_REJECTED') {
+        return diagnoseSessionTermination(deps, authority.apiUrl, 'superseded');
+      }
     }
     if (authority.kind === 'server') {
       return reportServerFailure(deps, authority.apiUrl, err);
@@ -1389,7 +1393,6 @@ export async function runAssimilate(
     apiUrl: auth.apiUrl,
     serverTrustIdentity: auth.serverTrustIdentity,
     localSessionCredentialRef: result.local_session!.credential_ref,
-    localSessionExpiresAt: result.local_session!.expires_at,
     // gh#899: persist the assimilated role so the connect-time ListTools
     // handler can role-scope the native tool surface.
     roleName: assignedRole.name,

package/src/assimilate-deps.ts

@@ -352,7 +352,6 @@ export function buildDefaultAssimilateDeps(): AssimilateDeps {
           result: prepared.result,
           local_session: {
             credential_ref: prepared.credentialRef,
-            expires_at: prepared.session.expiresAt,
           },
           // Handles for the cube-lock-held FINALIZE (assimilate-cmd Step 8).
           finalize: {

package/src/cleanup-cmd.ts

@@ -69,7 +69,8 @@ export type CleanupReason =
   | 'SURVIVES-clobber'
   | 'SURVIVES-unmerged'
   | 'SURVIVES-detached'
-  | 'SURVIVES-rejected'
+  | 'SURVIVES-revoked'
+  | 'SURVIVES-superseded'
   | 'SURVIVES-live'
   | 'SURVIVES-self'
   | 'UNKNOWN-indeterminate'
@@ -345,7 +346,9 @@ async function classifyWorktree(
     case 'evicted':
       return { reason: 'PRUNABLE', detail: '410 DRONE_EVICTED (clean + merged)' };
     case 'rejected':
-      return { reason: 'SURVIVES-rejected', detail: 'pin-matched 401 (revoked/taken over) — recoverable via re-enroll, never delete' };
+      return { reason: 'SURVIVES-superseded', detail: 'session superseded by a newer enrollment — recoverable via re-enroll, never delete' };
+    case 'revoked':
+      return { reason: 'SURVIVES-revoked', detail: 'session revoked — recoverable via re-enroll, never delete' };
     case 'live':
       return { reason: 'SURVIVES-live', detail: 'seat resolves (drone alive)' };
     case 'indeterminate':

package/src/cli-help.ts

@@ -50,6 +50,7 @@ export function serverHelpText(): string {
     `Commands:\n` +
     `  setup    Prepare local server identity and data; does not start the server.\n` +
     `  start    Start the verified server in the foreground.\n` +
+    `  stop     Stop the managed local server.\n` +
     `  status   Report verified runtime evidence.\n` +
     `  update   Verify and activate a local server artifact.\n` +
     `  invite   Create a single-use invitation in an interactive terminal.\n\n` +
@@ -102,7 +103,7 @@ export function resetLocalSeatHelpText(version: string): string {
     `just this worktree's saved local seat — its credential and cube binding together — from the\n` +
     `local seat store on this machine. Server, trust anchor, cube, and every sibling worktree are\n` +
     `left untouched.\n\n` +
-    `Use it after \`borg assimilate\` reports this worktree's seat was revoked or taken over\n` +
+    `Use it after \`borg assimilate\` reports this worktree's session was revoked or superseded\n` +
     `(a pin-matched rejection), then ask the operator for a new invitation and re-enroll.\n\n` +
     `Usage:\n` +
     `  borg reset-local-seat                 Reset this worktree's saved seat (TTY confirms [y/N])\n` +

package/src/cubes.ts

@@ -62,7 +62,6 @@ export interface ActiveCube {
   serverTrustIdentity?: string;
   /** Opaque local-session keychain reference; never a bearer. */
   localSessionCredentialRef?: string;
-  localSessionExpiresAt?: string | null;
   // gh#899: the assimilated role, persisted so the connect-time ListTools
   // handler can role-scope the NATIVE tool surface (UX/context only — never an
   // auth boundary). Absent on pre-gh#899 cubes.json entries → the filter
@@ -280,7 +279,6 @@ async function hydrateActiveCube(record: SeatRecord): Promise<ActiveCube | null>
     apiUrl: record.origin,
     serverTrustIdentity: record.trustIdentity,
     localSessionCredentialRef: ref,
-    ...(record.expiresAt !== undefined ? { localSessionExpiresAt: record.expiresAt } : {}),
     ...(record.roleName !== undefined ? { roleName: record.roleName } : {}),
     ...(record.roleClass !== undefined ? { roleClass: record.roleClass } : {}),
     ...(record.isHumanSeat !== undefined ? { isHumanSeat: record.isHumanSeat } : {}),
@@ -392,7 +390,6 @@ export interface PersistedLocalSeat {
   apiUrl: string;
   serverTrustIdentity: string;
   localSessionCredentialRef: string;
-  localSessionExpiresAt?: string | null;
   roleName?: string;
   roleClass?: 'queen' | 'worker';
   isHumanSeat?: boolean;
@@ -432,7 +429,6 @@ export async function readPersistedLocalSeat(): Promise<PersistedLocalSeat | nul
     localSessionCredentialRef: seatRef(record),
     operation: record.operation,
     state: record.state,
-    ...(record.expiresAt !== undefined ? { localSessionExpiresAt: record.expiresAt } : {}),
     ...(record.roleName !== undefined ? { roleName: record.roleName } : {}),
     ...(record.roleClass !== undefined ? { roleClass: record.roleClass } : {}),
     ...(record.isHumanSeat !== undefined ? { isHumanSeat: record.isHumanSeat } : {}),

package/src/launch-all-cmd.ts

@@ -276,6 +276,7 @@ export async function runLaunchAll(
   //     LOCK-live (seemingly-running) session.
   const launchable: DroneCandidate[] = [];
   let evictedCount = 0;
+  let revokedCount = 0;
   let rejectedCount = 0;
   let trustMismatchCount = 0;
   let credentialRejectedCount = 0;
@@ -294,15 +295,19 @@ export async function runLaunchAll(
       );
       continue;
     }
+    if (status === 'revoked') {
+      revokedCount += 1;
+      deps.stderr(
+        `Local session was revoked.\n` +
+          `Next: run borg reset-local-seat, then borg assimilate --host ${c.apiUrl} --enroll.\n`
+      );
+      continue;
+    }
     if (status === 'rejected') {
       rejectedCount += 1;
       deps.stderr(
-        `skipping ${c.droneLabel} (${c.worktreeDir}): saved seat no longer accepted (revoked or ` +
-          `taken over). Recover from that worktree: ` +
-          `1) \`borg reset-local-seat --host ${c.apiUrl}\` (add --yes non-interactively) to clear ` +
-          `ONLY that worktree's saved seat; ` +
-          `2) ask the server operator to mint a fresh scoped invitation (the server stays running); ` +
-          `3) \`borg assimilate --host ${c.apiUrl} --enroll\`.\n`
+        `Local session was superseded by a newer enrollment.\n` +
+          `Next: run borg reset-local-seat, then borg assimilate --host ${c.apiUrl} --enroll.\n`
       );
       continue;
     }
@@ -355,8 +360,11 @@ export async function runLaunchAll(
     if (evictedCount > 0) {
       causes.push(`${evictedCount} evicted`);
     }
+    if (revokedCount > 0) {
+      causes.push(`${revokedCount} revoked`);
+    }
     if (rejectedCount > 0) {
-      causes.push(`${rejectedCount} with a saved seat no longer accepted (revoked/taken over)`);
+      causes.push(`${rejectedCount} superseded`);
     }
     if (trustMismatchCount > 0) {
       causes.push(`${trustMismatchCount} with a changed (terminal) server identity`);

package/src/log-stream.ts

@@ -54,8 +54,7 @@ import {
   wakeCodexViaAppServer,
 } from './codex-app-wake.js';
 import { readBoundedResponseBody } from './server-response.js';
-import { BorgServerError, BorgServerUnreachableError } from './server-errors.js';
-import { recoverExpiredLocalSession } from './session-continuity.js';
+import { BorgServerError } from './server-errors.js';
 import {
   acquireStreamLease,
   readOwnershipSnapshot,
@@ -428,7 +427,6 @@ export interface RunLoopTestDeps {
   getActiveCube?: typeof getActiveCube;
   acquireStreamLease?: typeof acquireStreamLease;
   streamOnce?: typeof streamOnce;
-  recoverExpiredSession?: typeof recoverExpiredLocalSession;
   sleep?: (ms: number) => Promise<void>;
   maxIterations?: number;
 }
@@ -437,7 +435,6 @@ async function runLoop(testDeps: RunLoopTestDeps = {}): Promise<void> {
   const _getActiveCube = testDeps.getActiveCube ?? getActiveCube;
   const _acquireStreamLease = testDeps.acquireStreamLease ?? acquireStreamLease;
   const _streamOnce = testDeps.streamOnce ?? streamOnce;
-  const _recoverExpiredSession = testDeps.recoverExpiredSession ?? recoverExpiredLocalSession;
   const _sleep = testDeps.sleep ?? sleep;
   const _maxIterations = testDeps.maxIterations ?? Infinity;
   let _iterations = 0;
@@ -447,7 +444,6 @@ async function runLoop(testDeps: RunLoopTestDeps = {}): Promise<void> {
   let currentCubeId: string | null = null;
   let lease: StreamLease | null = null;
   let leaseKey: string | null = null;
-  let lastRecoveredToken: string | null = null;
 
   try {
     while (_iterations < _maxIterations) {
@@ -548,7 +544,6 @@ async function runLoop(testDeps: RunLoopTestDeps = {}): Promise<void> {
       }
       // Clean disconnect (e.g. server-side rollout). Reset backoff.
       attempt = 0;
-      lastRecoveredToken = null;
       streamState.reconnectAttempts = 0;
     } catch (err: any) {
       if (ownerLost) {
@@ -576,27 +571,7 @@ async function runLoop(testDeps: RunLoopTestDeps = {}): Promise<void> {
         );
         throw new TerminalStreamError();
       }
-      if (err instanceof BorgServerError) {
-        if (err.code !== 'AUTH_EXPIRED' || lastRecoveredToken === active.sessionToken) {
-          throw new TerminalStreamError();
-        }
-        try {
-          const renewed = await _recoverExpiredSession(active);
-          lastRecoveredToken = renewed.sessionToken;
-          attempt = 0;
-          streamState.reconnectAttempts = 0;
-          continue;
-        } catch (recoveryError) {
-          if (!(recoveryError instanceof BorgServerUnreachableError)) {
-            throw new TerminalStreamError();
-          }
-          // The replacement bearer is durable and intentionally survives an
-          // ambiguous transport failure. Fall through to the ordinary bounded
-          // reconnect backoff; the next AUTH_EXPIRED response resumes that exact
-          // replacement instead of permanently silencing the stream.
-          err = recoveryError;
-        }
-      }
+      if (err instanceof BorgServerError) throw new TerminalStreamError();
       streamState.connected = false;
       const delay =
         Math.min(RECONNECT_MIN_MS * 2 ** attempt, RECONNECT_MAX_MS) +
@@ -907,9 +882,6 @@ export async function streamOnce(
       } catch {
         code = undefined;
       }
-      if (code === ErrorCode.AUTH_EXPIRED) {
-        throw new BorgServerError('AUTH_EXPIRED', 'Borg server session expired');
-      }
       if (code === ErrorCode.SESSION_REJECTED) {
         throw new BorgServerError('SESSION_REJECTED', 'Borg server session was rejected');
       }

package/src/remote-client.ts

@@ -47,7 +47,6 @@ import {
 } from './local-server-cursor.js';
 import { readBoundedResponseBody } from './server-response.js';
 import { resolveLocalLogRecipients } from './local-log-routing.js';
-import { ensureLocalSessionFresh, recoverExpiredLocalSession } from './session-continuity.js';
 
 export interface RemoteConnection {
   apiUrl: string;
@@ -229,15 +228,12 @@ async function localServerRequest<T>(
   method: 'GET' | 'POST' | 'PUT' | 'PATCH',
   payload?: Record<string, unknown>,
 ): Promise<T | null> {
-  let current = active.localSessionCredentialRef && active.localSessionExpiresAt
-    ? await ensureLocalSessionFresh(active)
-    : active;
-  const request = (candidate: ActiveCube) => decodeLocalProtocolResponse<T>((signal) => authedFetch(path, {
+  return decodeLocalProtocolResponse<T>((signal) => authedFetch(path, {
       method,
       signal,
-      droneSession: candidate.sessionToken,
-      apiUrl: candidate.apiUrl,
-      serverTrustIdentity: candidate.serverTrustIdentity,
+      droneSession: active.sessionToken,
+      apiUrl: active.apiUrl,
+      serverTrustIdentity: active.serverTrustIdentity,
       redirect: 'error',
       ...(payload === undefined
         ? { headers: { Accept: 'application/json' } }
@@ -246,14 +242,6 @@ async function localServerRequest<T>(
           body: JSON.stringify(createProtocolEnvelope(randomUUID(), payload)),
         }),
     }), true);
-  try {
-    return await request(current);
-  } catch (error) {
-    if (!(error instanceof BorgServerError) || error.code !== 'AUTH_EXPIRED') throw error;
-    if (current.sessionToken !== active.sessionToken) throw error;
-    current = await recoverExpiredLocalSession(current);
-    return request(current);
-  }
 }
 
 export interface LocalManageOperation {
@@ -621,16 +609,16 @@ async function authedFetch(
     } catch {
       rejectedCode = undefined;
     }
-    if (droneSession !== undefined && rejectedCode === ErrorCode.AUTH_EXPIRED) {
+    if (droneSession !== undefined && rejectedCode === ErrorCode.SESSION_REJECTED) {
       throw new BorgServerError(
-        'AUTH_EXPIRED',
-        'the selected Borg server session expired',
+        'SESSION_REJECTED',
+        'the selected Borg server superseded this worktree session with a newer enrollment',
       );
     }
-    if (droneSession !== undefined && rejectedCode === ErrorCode.SESSION_REJECTED) {
+    if (droneSession !== undefined && rejectedCode === ErrorCode.SESSION_REVOKED) {
       throw new BorgServerError(
-        'SESSION_REJECTED',
-        'the selected Borg server rejected this worktree session (revoked or taken over)',
+        'SESSION_REVOKED',
+        'the selected Borg server revoked this worktree session',
       );
     }
     throw new BorgServerError(

package/src/seat-probe.ts

@@ -19,9 +19,9 @@ import {
  * preserved (CR #6 / CR5 — the probe must NOT collapse them). Each verdict is
  * derived from the actual error TYPE/CODE, never from a mutable error-text regex:
  *   evicted            ← 410 DRONE_EVICTED (terminal; the SOLE delete authority — gh#882 S1)
- *   rejected           ← pin-matched drone-SESSION 401 carrying the EXACT typed
- *                        SESSION_REJECTED code (revoked / taken over; recover via
- *                        the offline `borg reset-local-seat` — never here)
+ *   revoked            ← pin-matched drone-SESSION 401 carrying SESSION_REVOKED
+ *   rejected           ← pin-matched drone-SESSION 401 carrying SESSION_REJECTED
+ *                        (superseded by a newer enrollment)
  *   credential-rejected← any OTHER 401 on the drone session (bare/untyped or a
  *                        non-SESSION typed code): the saved credential is no longer
  *                        accepted, but this is NON-DESTRUCTIVE — re-enroll, NEVER a
@@ -40,6 +40,7 @@ import {
  */
 export type SeatStatus =
   | 'evicted'
+  | 'revoked'
   | 'rejected'
   | 'live'
   | 'credential-rejected'
@@ -99,6 +100,7 @@ export async function defaultProbeSeat(
     // the error TYPE, never from message text (the security boundary).
     if (err instanceof BorgServerTrustError) return 'trust-mismatch';
     if (err instanceof BorgServerError) {
+      if (err.code === 'SESSION_REVOKED') return 'revoked';
       if (err.code === 'SESSION_REJECTED') return 'rejected';
       // Every non-SESSION 401 (bare/untyped or a different typed code) is a
       // credential rejection — non-destructive, distinct from a takeover.