fix(protocol): bind relaunch termination authority

2026-08-13 13:43:07 +07:00
parent 878588d364
commit a19023995e
2 changed files with 30 additions and 17 deletions
@@ -311,12 +311,16 @@ paths:
        '202':
          description: >-
            Confirmed over-cap reconnect creates or returns a durable `session.display_relaunch` termination operation.
-            Under the session and unique Stop lock, the Server MUST create at most one display-relaunch operation per session;
-            a same-owner/device lost-response retry MUST return that same operation. It reuses the existing one-way non-reissued
-            Stop work/ack path. An existing user Stop in any state MUST win and yield a stable non-202 result; it MUST NOT be reinterpreted as display-relaunch authority. This response is not a manifest,
-            does not assert termination completion, and does not authorize a replacement session before `applied`.
+            Before initial operation creation and on every replay, the authenticated principal and active client device/key MUST
+            match the broker session. Under the session and unique Stop lock, the Server MUST create at most one termination
+            operation total per broker session. A same-owner/device lost-response retry MUST return that same operation.
+            If a user Stop wins first, reconnect MUST return a stable non-202 result. If display relaunch wins first, a later user
+            Stop MUST converge on that same existing `StopOperation` without creating a second operation or issuing a second Terminate.
+            The operation reuses the existing one-way non-reissued Stop work/ack path. This response is not a manifest, does not
+            assert termination completion, and does not authorize a replacement session before `applied`.
            After `applied`, the client submits a fresh `SessionRequest` with a new idempotency key.
-            Failed or `termination_unconfirmed` outcomes never auto-relaunch. Local Stop or teardown MUST suppress the fresh launch.
+            Failed or `termination_unconfirmed` outcomes never auto-relaunch. Client local Stop or teardown MUST invalidate
+            relaunch generation so a later `applied` state cannot cause a fresh launch.
            Maximum JSON body: 16384 bytes.
          content:
            application/json: