fix(protocol): bind relaunch termination authority

tools/validate.py

@@ -322,18 +322,27 @@ def main() -> int:
     reconnect_endpoint = openapi.split("      operationId: reconnectBrokerSession\n", 1)[1].split("\n  /api/", 1)[0]
     assert "        '202':\n" in reconnect_endpoint
     relaunch_response = reconnect_endpoint.split("        '202':\n", 1)[1].split("        '400':", 1)[0]
-    assert "$defs/StopOperation" in relaunch_response
-    assert "durable `session.display_relaunch` termination operation" in relaunch_response
-    assert "MUST create at most one display-relaunch operation per session" in relaunch_response
-    assert "same-owner/device lost-response retry MUST return that same operation" in relaunch_response
-    assert "existing user Stop in any state MUST win and yield a stable non-202 result" in relaunch_response
-    assert "MUST NOT be reinterpreted as display-relaunch authority" in relaunch_response
-    assert "not a manifest" in relaunch_response
-    assert "does not assert termination completion" in relaunch_response
-    assert "does not authorize a replacement session before `applied`" in relaunch_response
-    assert "fresh `SessionRequest` with a new idempotency key" in relaunch_response
-    assert "Failed or `termination_unconfirmed` outcomes never auto-relaunch" in relaunch_response
-    assert "Local Stop or teardown MUST suppress the fresh launch" in relaunch_response
+    relaunch_schema = relaunch_response.split("          content:\n", 1)[1]
+    assert relaunch_schema == (
+        "            application/json:\n"
+        "              schema:\n"
+        "                $ref: ../schemas/control-v1.schema.json#/$defs/StopOperation\n"
+    ), "reconnect 202 must contain only the exact StopOperation schema reference"
+    assert "ConnectionManifest" not in relaunch_response
+    assert "anyOf:" not in relaunch_response and "oneOf:" not in relaunch_response
+    relaunch_text = " ".join(relaunch_response.split())
+    assert "durable `session.display_relaunch` termination operation" in relaunch_text
+    assert "Before initial operation creation and on every replay, the authenticated principal and active client device/key MUST match the broker session" in relaunch_text
+    assert "MUST create at most one termination operation total per broker session" in relaunch_text
+    assert "A same-owner/device lost-response retry MUST return that same operation" in relaunch_text
+    assert "If a user Stop wins first, reconnect MUST return a stable non-202 result" in relaunch_text
+    assert "a later user Stop MUST converge on that same existing `StopOperation` without creating a second operation or issuing a second Terminate" in relaunch_text
+    assert "not a manifest" in relaunch_text
+    assert "does not assert termination completion" in relaunch_text
+    assert "does not authorize a replacement session before `applied`" in relaunch_text
+    assert "fresh `SessionRequest` with a new idempotency key" in relaunch_text
+    assert "Failed or `termination_unconfirmed` outcomes never auto-relaunch" in relaunch_text
+    assert "Client local Stop or teardown MUST invalidate relaunch generation so a later `applied` state cannot cause a fresh launch" in relaunch_text
     for operation_id in ("loginBrowserSession", "rotateNativeCredential", "issueNativeTunnelCredential"):
         operation = openapi.split(f"      operationId: {operation_id}\n", 1)[1].split("      responses:\n", 1)[0]
         assert "browserCsrf" not in operation, f"{operation_id}: excluded operation gained browser CSRF"