borgmcp 2.3.0 → 2.4.0

package/src/display-identity.ts

@@ -0,0 +1,130 @@
+import type { ActiveCube } from './cubes.js';
+
+const LAST_CONFIRMED = ' (last confirmed)';
+
+type DisplayField = {
+  value: string | null;
+  uncertain: boolean;
+};
+
+type DisplayState = {
+  seatKey: string;
+  cubeName: DisplayField;
+  droneLabel: DisplayField;
+  roleName: DisplayField;
+};
+
+export type DisplayIdentity = {
+  cubeName: string;
+  droneLabel: string;
+  roleName: string | null;
+};
+
+export type ServerDisplayIdentity = Partial<DisplayIdentity>;
+
+let state: DisplayState | null = null;
+
+function seatKey(active: Pick<ActiveCube, 'cubeId' | 'droneId'>): string {
+  return `${active.cubeId}\0${active.droneId}`;
+}
+
+function initialState(active: ActiveCube): DisplayState {
+  return {
+    seatKey: seatKey(active),
+    cubeName: { value: active.name, uncertain: false },
+    droneLabel: { value: active.droneLabel, uncertain: false },
+    roleName: { value: active.roleName ?? null, uncertain: false },
+  };
+}
+
+function ensureState(active: ActiveCube): DisplayState {
+  const key = seatKey(active);
+  if (state === null || state.seatKey !== key) {
+    state = initialState(active);
+  }
+  return state;
+}
+
+function confirmField(field: DisplayField, value: string | null | undefined): void {
+  if (value === undefined || value === null) return;
+  field.value = value;
+  field.uncertain = false;
+}
+
+function renderField(field: DisplayField): string | null {
+  if (field.value === null) return null;
+  return field.uncertain ? `${field.value}${LAST_CONFIRMED}` : field.value;
+}
+
+/** Seed the invocation-local display source from the exact seat selected by #63. */
+export function seedDisplayIdentity(active: ActiveCube): void {
+  ensureState(active);
+}
+
+/** Apply server-authoritative fields and clear uncertainty only for those fields. */
+export function confirmDisplayIdentity(
+  active: ActiveCube,
+  identity: ServerDisplayIdentity,
+): DisplayIdentity {
+  const current = ensureState(active);
+  confirmField(current.cubeName, identity.cubeName);
+  confirmField(current.droneLabel, identity.droneLabel);
+  confirmField(current.roleName, identity.roleName);
+  return renderDisplayIdentity(active);
+}
+
+/** Mark the current seat identity as last-confirmed after an identity read fails. */
+export function markDisplayIdentityReadFailed(active: ActiveCube): void {
+  const current = ensureState(active);
+  current.cubeName.uncertain = true;
+  current.droneLabel.uncertain = true;
+  if (current.roleName.value !== null) current.roleName.uncertain = true;
+}
+
+export function renderDisplayIdentity(active: ActiveCube): DisplayIdentity {
+  const current = ensureState(active);
+  return {
+    cubeName: renderField(current.cubeName)!,
+    droneLabel: renderField(current.droneLabel)!,
+    roleName: renderField(current.roleName),
+  };
+}
+
+/** Synchronous view for console-prefix after initConsolePrefix seeds the seat. */
+export function currentDisplayIdentity(): DisplayIdentity | null {
+  if (state === null) return null;
+  return {
+    cubeName: renderField(state.cubeName)!,
+    droneLabel: renderField(state.droneLabel)!,
+    roleName: renderField(state.roleName),
+  };
+}
+
+export function identityFromRegen(result: {
+  cube?: { name?: string | null };
+  drone?: { label?: string | null };
+  role?: { name?: string | null };
+}): ServerDisplayIdentity {
+  return {
+    cubeName: result.cube?.name ?? undefined,
+    droneLabel: result.drone?.label ?? undefined,
+    roleName: result.role?.name ?? undefined,
+  };
+}
+
+export function withRenderedRegenIdentity<T extends {
+  cube?: Record<string, unknown>;
+  drone?: Record<string, unknown>;
+  role?: Record<string, unknown>;
+}>(result: T, identity: DisplayIdentity): T {
+  return {
+    ...result,
+    cube: { ...result.cube, name: identity.cubeName },
+    drone: { ...result.drone, label: identity.droneLabel },
+    role: { ...result.role, name: identity.roleName },
+  };
+}
+
+export function _resetDisplayIdentityForTests(): void {
+  state = null;
+}

package/src/docs-sections.ts

@@ -16,6 +16,7 @@ export const DOCS_BASE_URL = "https://github.com/Byte-Ventures/borg-mcp-client";
 
 const README_URL = `${DOCS_BASE_URL}#readme`;
 const LOCAL_SERVER_URL = `${DOCS_BASE_URL}/blob/main/docs/LOCAL_SERVER.md`;
+const SEAT_LIFECYCLE_URL = `${DOCS_BASE_URL}/blob/main/docs/SEAT_LIFECYCLE.md`;
 
 export interface DocsSection {
   /** logical topic key */
@@ -71,6 +72,14 @@ export const DOCS_SECTIONS: DocsSection[] = [
     summary: "Connect a client to a self-hosted server: invitations, assimilate --host --enroll, credentials.",
     keywords: ["enroll", "enrollment", "invitation", "invite", "assimilate", "--host", "credential", "credentials", "owner", "join server"],
   },
+  {
+    slug: "seat-lifecycle",
+    title: "Seat lifecycle and recovery",
+    url: SEAT_LIFECYCLE_URL,
+    page: "docs/SEAT_LIFECYCLE.md",
+    summary: "Saved-seat states, re-attach and reset recovery, duplicate-session guards, and deterministic multi-seat selection.",
+    keywords: ["seat", "lifecycle", "reattach", "re-attach", "reset-local-seat", "evicted", "revoked", "superseded", "inbox monitor", "multiple seats", "silent deafness"],
+  },
   {
     slug: "self-hosting",
     title: "Self-hosting operations",

package/src/drone-management.ts

@@ -17,6 +17,7 @@ import {
   reassignDrone,
   type LocalManageOperation,
 } from './remote-client.js';
+import { confirmDisplayIdentity } from './display-identity.js';
 
 interface ManagedCube {
   id: string;
@@ -95,6 +96,11 @@ export async function runReassignDroneTool(
 
   let warning = '';
   if (drone.id === active.droneId) {
+    confirmDisplayIdentity(active, {
+      cubeName: cube.name,
+      droneLabel: drone.label,
+      roleName: role.name,
+    });
     try {
       const refreshed = await deps.refreshActiveCubeMetadata(activeCubeWithFreshRegenIdentity(active, {
         cube,

package/src/inbox-monitor.ts

@@ -753,6 +753,23 @@ export function parseMonitorInvocation(argv: string[]): MonitorInvocation | null
   return null;
 }
 
+function liveMonitorYieldLine(
+  inboxPath: string,
+  holderPidfilePath: string,
+  deps: Pick<InboxLockDeps, 'read' | 'isAlive'>
+): string {
+  const raw = deps.read(holderPidfilePath);
+  const parsed = raw === null ? null : parsePidfileContent(raw.trim());
+  const livePid = parsed && Number.isSafeInteger(parsed.pid) && parsed.pid > 0 && deps.isAlive(parsed.pid)
+    ? parsed.pid
+    : null;
+  const holder = livePid === null ? 'another monitor instance' : `a live instance (pid ${livePid})`;
+  return (
+    `borg-inbox-monitor: seat inbox ${JSON.stringify(inboxPath)} is already monitored by ${holder}; ` +
+    'yielding — another session likely holds this seat.'
+  );
+}
+
 function main(): void {
   const invocation = parseMonitorInvocation(process.argv.slice(2));
   if (!invocation) {
@@ -812,6 +829,7 @@ function main(): void {
   if (claimResult === 'legacy-live') {
     // An already-running old monitor still owns the wake path; yield without
     // touching its inbox-adjacent state.
+    console.log(liveMonitorYieldLine(inboxPath, legacyPidfilePathFor(inboxPath), lockDeps));
     process.exit(0);
   }
   if (claimResult === 'legacy-blocked') {
@@ -822,6 +840,7 @@ function main(): void {
     process.exit(1);
   }
   if (claimResult === 'modern-live') {
+    console.log(liveMonitorYieldLine(inboxPath, pidfilePath, lockDeps));
     process.exit(0);
   }
 

package/src/index.ts

@@ -112,6 +112,14 @@ import {
 import { gateAllowsActivation, borgSessionToolNotice } from './launch-gate.js';
 import { renderSyncRolesResult } from './sync-roles-render.js';
 import { initConsolePrefix, consolePrefix } from './console-prefix.js';
+import {
+  confirmDisplayIdentity,
+  identityFromRegen,
+  markDisplayIdentityReadFailed,
+  renderDisplayIdentity,
+  seedDisplayIdentity,
+  withRenderedRegenIdentity,
+} from './display-identity.js';
 import {
   resolveSessionAgentKind,
 } from './codex-app-wake.js';
@@ -369,16 +377,25 @@ export async function main() {
               ],
             };
           }
+          seedDisplayIdentity(active);
           const since = typeof args?.since === 'string' ? args.since : undefined;
           const mode = args?.mode === 'lite' ? 'lite' : 'full';
           const reportedModel = typeof args?.model === 'string' ? args.model : undefined;
-          const result = await regen(active.sessionToken, active.apiUrl, {
-            since,
-            reportedModel,
-            agentKind: resolveReportableSessionAgentKind(),
-            workingRepo: resolveWorkingRepo(),
-            serverTrustIdentity: active.serverTrustIdentity,
-          });
+          let result: Awaited<ReturnType<typeof regen>>;
+          try {
+            result = await regen(active.sessionToken, active.apiUrl, {
+              since,
+              reportedModel,
+              agentKind: resolveReportableSessionAgentKind(),
+              workingRepo: resolveWorkingRepo(),
+              serverTrustIdentity: active.serverTrustIdentity,
+            });
+          } catch (error) {
+            markDisplayIdentityReadFailed(active);
+            throw error;
+          }
+          const displayIdentity = confirmDisplayIdentity(active, identityFromRegen(result));
+          const displayedResult = withRenderedRegenIdentity(result, displayIdentity);
           const freshActive = activeCubeWithFreshRegenIdentity(active, result);
           if (freshActive !== active) {
             await refreshActiveCubeMetadata(freshActive);
@@ -407,8 +424,8 @@ export async function main() {
             ? formatWakePathPrefix({
                 inboxPath,
                 monitorStateRoot,
-                droneLabel: regenWakePathDroneLabel(result, freshActive.droneLabel),
-                cubeName: freshActive.name,
+                droneLabel: regenWakePathDroneLabel(displayedResult, displayIdentity.droneLabel),
+                cubeName: displayIdentity.cubeName,
               })
             : '';
 
@@ -427,7 +444,7 @@ export async function main() {
             }
           } catch { /* never break regen */ }
 
-          return { content: [{ type: 'text', text: versionHeader + prefix + formatRegenMarkdown(result, { mode }) }] };
+          return { content: [{ type: 'text', text: versionHeader + prefix + formatRegenMarkdown(displayedResult, { mode }) }] };
         }
 
         case 'borg_assimilate': {
@@ -451,27 +468,31 @@ export async function main() {
           // server-validated regen path (SR cond-4: no fabricated success
           // — an evicted/revoked seat FAILS server-side and is surfaced).
           try {
+            seedDisplayIdentity(active!);
             const result = await regen(active!.sessionToken, active!.apiUrl, {
               agentKind: resolveReportableSessionAgentKind(),
               workingRepo: resolveWorkingRepo(),
               serverTrustIdentity: active!.serverTrustIdentity,
             });
+            const displayIdentity = confirmDisplayIdentity(active!, identityFromRegen(result));
+            const displayedResult = withRenderedRegenIdentity(result, displayIdentity);
             const freshActive = activeCubeWithFreshRegenIdentity(active!, result);
             if (freshActive !== active) {
               await refreshActiveCubeMetadata(freshActive);
             }
             const header = [
-              `# Re-attached to cube: ${freshActive.name}`,
+              `# Re-attached to cube: ${displayIdentity.cubeName}`,
               ``,
-              `**Drone label:** ${freshActive.droneLabel}`,
+              `**Drone label:** ${displayIdentity.droneLabel}`,
               `**Seat:** existing identity reused — no new drone minted (gh#780)`,
               ``,
               ``,
             ].join('\n');
             return {
-              content: [{ type: 'text', text: header + formatRegenMarkdown(result, { mode: 'full' }) }],
+              content: [{ type: 'text', text: header + formatRegenMarkdown(displayedResult, { mode: 'full' }) }],
             };
           } catch (err: any) {
+            markDisplayIdentityReadFailed(active!);
             const failure = reattachFailureMessage(err ?? {});
             return { content: [{ type: 'text', text: failure }], isError: true };
           }
@@ -506,11 +527,34 @@ export async function main() {
 
         case 'borg_whoami': {
           const active = await requireActiveCube();
-          const result = await whoami(
-            active.sessionToken,
-            active.apiUrl,
-            active.serverTrustIdentity,
-          );
+          seedDisplayIdentity(active);
+          let result: Awaited<ReturnType<typeof whoami>>;
+          try {
+            result = await whoami(
+              active.sessionToken,
+              active.apiUrl,
+              active.serverTrustIdentity,
+            );
+          } catch (error) {
+            markDisplayIdentityReadFailed(active);
+            throw error;
+          }
+          confirmDisplayIdentity(active, {
+            cubeName: result.cube_name,
+            droneLabel: result.drone_label,
+            roleName: result.role_name,
+          });
+          try {
+            await refreshActiveCubeMetadata({
+              ...active,
+              name: result.cube_name,
+              droneLabel: result.drone_label,
+              roleName: result.role_name,
+            });
+          } catch {
+            // The invocation-local server truth remains authoritative even if
+            // the display-only persistence refresh cannot be written.
+          }
           return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
         }
 
@@ -729,6 +773,8 @@ export async function main() {
           if (!message || typeof message !== 'string') throw new Error('message is required');
           const active = await getActiveCube();
           if (!active) throw new Error('Not assimilated to a cube. Use borg_assimilate <cube-name> first.');
+          seedDisplayIdentity(active);
+          const displayIdentity = renderDisplayIdentity(active);
           const lifecycleSignal = lifecycleSignalForMessage(message);
           if (lifecycleSignal) {
             const decision = await shouldSuppressLifecycleLog(active, message);
@@ -739,7 +785,7 @@ export async function main() {
                 content: [
                   {
                     type: 'text',
-                    text: `Suppressed duplicate ${decision.signal?.toUpperCase()} lifecycle log for ${active.droneLabel}; recent cube log already contains this signal.`,
+                    text: `Suppressed duplicate ${decision.signal?.toUpperCase()} lifecycle log for ${displayIdentity.droneLabel}; recent cube log already contains this signal.`,
                   },
                 ],
               };
@@ -773,7 +819,7 @@ export async function main() {
                 .map((r) => r.label)
                 .join(', ')}. Message delivered — they'll read it when they return.`
             : '';
-          const text = `Logged to cube "${active.name}" as ${active.droneLabel}. (entry id: ${result.entry.id})${echo}${unreachable}`;
+          const text = `Logged to cube "${displayIdentity.cubeName}" as ${displayIdentity.droneLabel}. (entry id: ${result.entry.id})${echo}${unreachable}`;
           return { content: [{ type: 'text', text }] };
         }
 

package/src/log-stream.ts

@@ -55,6 +55,7 @@ import {
 } from './codex-app-wake.js';
 import { readBoundedResponseBody } from './server-response.js';
 import { BorgServerError } from './server-errors.js';
+import { markSeatRejected } from './seats.js';
 import {
   acquireStreamLease,
   readOwnershipSnapshot,
@@ -441,7 +442,7 @@ async function runLoop(testDeps: RunLoopTestDeps = {}): Promise<void> {
 
   let attempt = 0;
   let lastEventId: string | null = null;
-  let currentCubeId: string | null = null;
+  let currentStreamKey: string | null = null;
   let lease: StreamLease | null = null;
   let leaseKey: string | null = null;
 
@@ -469,10 +470,11 @@ async function runLoop(testDeps: RunLoopTestDeps = {}): Promise<void> {
     // teardown (cube-cleared / dead app-server socket).
     ensureCodexHeartbeatStarted();
 
-    // Reset resume cursor on cube switch — entries from a prior cube
-    // mean nothing for the new cube's stream.
-    if (active.cubeId !== currentCubeId) {
-      currentCubeId = active.cubeId;
+    // Reset resume cursor on cube/drone switch — entries from a prior seat
+    // mean nothing for the newly selected stream.
+    const activeStreamKey = `${active.cubeId}:${active.droneId}`;
+    if (activeStreamKey !== currentStreamKey) {
+      currentStreamKey = activeStreamKey;
       lastEventId = null;
     }
 
@@ -560,18 +562,36 @@ async function runLoop(testDeps: RunLoopTestDeps = {}): Promise<void> {
       // loop quiesces cleanly. The agent's graceful shutdown (TaskStop Monitor,
       // no /loop reschedule) is driven separately by the EVICTED tool-result it
       // already received on the authed call that produced this verdict.
-      if (err instanceof DroneEvictedError) {
-        if (lease) await lease.release().catch(() => {});
-        lease = null;
-        leaseKey = null;
-        streamState.connected = false;
-        streamState.ownership = await readOwnershipSnapshot(active.cubeId, active.droneId);
-        process.stderr.write(
-          `[borg-mcp log stream] drone evicted — stream terminated (no reconnect).\n`
+      if (err instanceof DroneEvictedError || err instanceof BorgServerError) {
+        if (active.localSessionCredentialRef) {
+          markSeatRejected(active.localSessionCredentialRef);
+        }
+        const replacement = await _getActiveCube().catch(() => null);
+        const replacementChanged = replacement !== null && (
+          replacement.localSessionCredentialRef !== active.localSessionCredentialRef ||
+          replacement.cubeId !== active.cubeId ||
+          replacement.droneId !== active.droneId
         );
+        if (replacementChanged) {
+          if (lease) await lease.release().catch(() => {});
+          lease = null;
+          leaseKey = null;
+          streamState.connected = false;
+          streamState.ownership = await readOwnershipSnapshot(active.cubeId, active.droneId);
+          continue;
+        }
+        if (err instanceof DroneEvictedError) {
+          if (lease) await lease.release().catch(() => {});
+          lease = null;
+          leaseKey = null;
+          streamState.connected = false;
+          streamState.ownership = await readOwnershipSnapshot(active.cubeId, active.droneId);
+          process.stderr.write(
+            `[borg-mcp log stream] drone evicted — stream terminated (no reconnect).\n`
+          );
+        }
         throw new TerminalStreamError();
       }
-      if (err instanceof BorgServerError) throw new TerminalStreamError();
       streamState.connected = false;
       const delay =
         Math.min(RECONNECT_MIN_MS * 2 ** attempt, RECONNECT_MAX_MS) +
@@ -883,11 +903,14 @@ export async function streamOnce(
         code = undefined;
       }
       if (code === ErrorCode.SESSION_REJECTED) {
+        if (active.localSessionCredentialRef) markSeatRejected(active.localSessionCredentialRef);
         throw new BorgServerError('SESSION_REJECTED', 'Borg server session was rejected');
       }
       if (code === ErrorCode.SESSION_REVOKED) {
+        if (active.localSessionCredentialRef) markSeatRejected(active.localSessionCredentialRef);
         throw new BorgServerError('SESSION_REVOKED', 'Borg server session was revoked');
       }
+      if (active.localSessionCredentialRef) markSeatRejected(active.localSessionCredentialRef);
       throw new BorgServerError('CREDENTIAL_REJECTED', 'Borg server rejected the stream credential');
     }
     if (response.status === 410) {
@@ -899,6 +922,7 @@ export async function streamOnce(
       ).catch(() => '');
       const code = errorCodeFromBody(body);
       if (code === DRONE_EVICTED_CODE) {
+        if (active.localSessionCredentialRef) markSeatRejected(active.localSessionCredentialRef);
         throw new DroneEvictedError();
       }
       // client#42: an expired resume cursor is RECOVERABLE, not terminal. The

package/src/parse-assimilate-args.ts

@@ -12,7 +12,7 @@ export type ParseResult =
 
 /**
  * Parse argv for `borg assimilate [role] [--worktree <n>] [--template <n>]
- * [--no-template] [--cube-name <n>] [--host <host>] [--enroll] [--here] [--yes]`. The `assimilate`
+ * [--no-template] [--cube-name <n>] [--host <host>] [--enroll] [--here] [--force] [--yes]`. The `assimilate`
  * subcommand token must already be stripped by the caller.
  */
 export function parseAssimilateArgs(rawArgs: string[]): ParseResult {
@@ -46,6 +46,8 @@ export function parseAssimilateArgs(rawArgs: string[]): ParseResult {
       i += 1;
     } else if (arg === '--here') {
       flags.here = true;
+    } else if (arg === '--force') {
+      flags.force = true;
     } else if (arg === '--host') {
       const next = rawArgs[i + 1];
       if (typeof next !== 'string' || next.length === 0 || next.startsWith('-')) {
@@ -99,7 +101,7 @@ export function parseAssimilateArgs(rawArgs: string[]): ParseResult {
     } else if (arg.startsWith('--')) {
       return {
         ok: false,
-        error: `unknown flag: ${arg}. Supported: --worktree, --template, --no-template, --cube-name, --host, --enroll, --here, --yes, --cli, --model`,
+        error: `unknown flag: ${arg}. Supported: --worktree, --template, --no-template, --cube-name, --host, --enroll, --here, --force, --yes, --cli, --model`,
       };
     } else {
       if (role !== undefined) {

package/src/regen-format.ts

@@ -112,17 +112,18 @@ export function wakePathArming(
  * network `regen()` result and falling back per-field to the local
  * `getActiveCube` state. When `result` is null — the net-free fallback path
  * taken on a `regen()` network failure — identity comes entirely from local
- * state, so a weak drone that hits a SessionStart network blip still gets
- * oriented (with its wake-path arming) instead of left dormant.
+ * state, explicitly qualified as last-confirmed so a weak drone still gets
+ * oriented without presenting a failed identity read as current server truth.
  */
 export function resolveLeanIdentity(
   active: { name: string; droneLabel: string; roleName?: string | null },
   result: { cube?: any; drone?: any; role?: any } | null
 ): { cubeName: string; droneLabel: string; roleName: string | null } {
+  const qualifier = result === null ? ' (last confirmed)' : '';
   return {
-    cubeName: result?.cube?.name ?? active.name,
-    droneLabel: result?.drone?.label ?? active.droneLabel,
-    roleName: result?.role?.name ?? active.roleName ?? null,
+    cubeName: result?.cube?.name ?? `${active.name}${qualifier}`,
+    droneLabel: result?.drone?.label ?? `${active.droneLabel}${qualifier}`,
+    roleName: result?.role?.name ?? (active.roleName ? `${active.roleName}${qualifier}` : null),
   };
 }
 

package/src/regen.ts

@@ -22,7 +22,6 @@ import { monitorStateRootForWorktree } from './inbox-monitor.js';
 import {
   parseHookSource,
   formatLeanOrientation,
-  resolveLeanIdentity,
   type AgentKind,
 } from './regen-format.js';
 import { resolveSessionAgentKind } from './codex-app-wake.js';
@@ -30,6 +29,13 @@ import { resolveReportableSessionAgentKind } from './agent-runtime.js';
 import { handleVersionFlag } from './version.js';
 import { gateAllowsActivation } from './launch-gate.js';
 import { resolveWorkingRepo } from './working-repo.js';
+import {
+  confirmDisplayIdentity,
+  identityFromRegen,
+  markDisplayIdentityReadFailed,
+  renderDisplayIdentity,
+  seedDisplayIdentity,
+} from './display-identity.js';
 
 /**
  * Drain the SessionStart hook's stdin payload (best-effort). Mirrors
@@ -68,6 +74,7 @@ async function main(): Promise<void> {
     await emitUnassimilatedNotice();
     return;
   }
+  seedDisplayIdentity(active);
 
   const inboxPath = inboxPathForDrone(active.cubeId, active.droneId);
   const monitorStateRoot = monitorStateRootForWorktree(findProjectRoot());
@@ -90,10 +97,12 @@ async function main(): Promise<void> {
       workingRepo: resolveWorkingRepo(),
       serverTrustIdentity: active.serverTrustIdentity,
     });
+    confirmDisplayIdentity(active, identityFromRegen(result));
   } catch {
+    markDisplayIdentityReadFailed(active);
     result = null;
   }
-  const identity = resolveLeanIdentity(active, result);
+  const identity = renderDisplayIdentity(active);
   process.stdout.write(
     formatLeanOrientation({ ...identity, inboxPath, monitorStateRoot, agentKind, source }) + '\n'
   );

package/src/remote-client.ts

@@ -47,6 +47,7 @@ import {
   LocalManageRequiredError,
 } from './server-errors.js';
 import { getActiveCube, type ActiveCube } from './cubes.js';
+import { markSeatRejected } from './seats.js';
 import {
   advanceLocalServerCursor,
   getLocalServerCursor,
@@ -241,6 +242,7 @@ async function localServerRequest<T>(
       method,
       signal,
       droneSession: active.sessionToken,
+      localSessionCredentialRef: active.localSessionCredentialRef,
       apiUrl: active.apiUrl,
       serverTrustIdentity: active.serverTrustIdentity,
       redirect: 'error',
@@ -587,6 +589,7 @@ async function authedFetch(
     apiUrl?: string;
     authToken?: string;
     serverTrustIdentity?: string;
+    localSessionCredentialRef?: string;
   } = {}
 ): Promise<Response> {
   const {
@@ -594,6 +597,7 @@ async function authedFetch(
     apiUrl,
     authToken,
     serverTrustIdentity: suppliedTrustIdentity,
+    localSessionCredentialRef,
     headers,
     ...rest
   } = init;
@@ -673,6 +677,9 @@ async function authedFetch(
     } catch {
       rejectedCode = undefined;
     }
+    if (droneSession !== undefined && localSessionCredentialRef !== undefined) {
+      markSeatRejected(localSessionCredentialRef);
+    }
     if (droneSession !== undefined && rejectedCode === ErrorCode.SESSION_REJECTED) {
       throw new BorgServerError(
         'SESSION_REJECTED',
@@ -732,6 +739,7 @@ async function authedFetch(
     }
     debugLog(`✗ ${response.status} ${method} ${path}`);
     if (droneSession !== undefined && response.status === 410 && code === DRONE_EVICTED_CODE) {
+      if (localSessionCredentialRef !== undefined) markSeatRejected(localSessionCredentialRef);
       throw new DroneEvictedError();
     }
     throw new BorgServerHttpError(