Module session_server 

Phase 3 session server (soldr#2365, slice 3b): run a contained child as a broker-proxied session over a byte transport.

This ties together three already-merged pieces:

• the byte-transparent proxy pump (crate::broker::session_pump),
• the SESSION-lane codec (crate::broker::session_codec),
• the sanitized contained-spawn layer (ContainedProcessGroup → SpawnedChild, a child confined to its own Job Object on Windows / process group on Unix, killed when dropped).

serve_session reads inbound SessionFrames off a reader R, applies them to the child’s stdin, streams the child’s stdout/stderr/exit back out as SessionFrames on a writer W, and reaps the child. It is generic over the two transport halves (R: Read inbound, W: Write outbound), matching crate::broker::backend_sdk::FrameClient::from_stream’s generic-over-stream grain, so the real broker local_socket — whose raw-duplex takeover (into_backend_io) is Windows-deferred (#720) — is wired in a later slice without changing this code.

Nothing dials this yet; it is additive and dormant.

Client contract: the client closes its inbound-writing half once it has sent stdin + StdinEof. serve_session returns only after the child exits, the inbound stream reaches EOF, and all outbound frames are flushed — so a client that holds the inbound half open forever keeps the session’s stdin pump thread alive. This mirrors the pump’s existing stdin_rx-closed contract and is exactly what a dumb-terminal client (slice 4) does.

Functions

serve_session

Drive child as a proxied session over a byte transport.

spawn_contained_session

Spawn command as a contained child — its own Job Object (Windows) / process group (Unix), killed when the returned SpawnedChild drops — with all three stdio streams piped, ready to hand to serve_session or run_child_session.

spawn_contained_session_with_environment

spawn_contained_session with an explicit environment base policy.