DL-384

Fresh session IDs are server-minted by a domain-separated length-prefixed SHA-256 derivation from the server-generated relay request ID; the ID rides internal SessionsResponse.fresh_session_id; Runner never mints and preserves resume IDs; deployment requires Server and Runner together because there is no version handshake; mismatch is stopped and fails closed

Status: Active (Matt, 2026-09-18)