[5/5] fix(session): validate published rollout weights

[ashtonchew]

Summary

• Applies the published-weight invariant when session response records are converted into rollout samples.
• Validates the recorded request model and resolves omitted or literal default routes before checking the response's weight version.
• Keeps reference and other unpublished routes valid while rejecting stale actor-route records before they can enter training data.

Context

Session rollouts reconstruct samples from OpenAI-compatible response records instead of passing through the direct generation response helper changed in PR #1806. Without validation at this ingress, a checkpoint-backed actor response carrying weight_version=default after publication could bypass the direct rollout guard.

This final layer reuses the same route-aware validator during session sample conversion. It closes the alternate ingestion path without adding another publication state machine or changing recovery behavior.

Closes #1724.

Stack goal: This five-PR sequence addresses issue #1724: recovered updatable engines remain unroutable until actor-weight synchronization succeeds, and both rollout ingestion paths reject evidence that this invariant was violated.

Layer	Upstream PR	Status	Contract
1/5	#1801	Ready for review	Typed asynchronous Router lifecycle
2/5	#1804	Ready for review	Confirmed SGLang worker activation and removal
3/5	#1805	Ready for review	Recovered-engine publication after weight synchronization
4/5	#1806	Ready for review	Direct rollout published-weight guard
5/5	#1807	Ready for review	Session-ingress published-weight guard

All public drafts target main because external-fork branches cannot be selected as base refs in this repository. This matches the existing Miles external-stack convention: descendants appear cumulative until their parents merge, then GitHub removes shared commits from later diffs. Merge in order. If a parent is squash- or rebase-merged and commit identities change, rebase the descendants onto the updated main before continuing.

Description

• Validates each session response against the model recorded in its request before constructing a Sample.
• Rejects non-string request model values because route ownership cannot otherwise be determined safely.
• Resolves an omitted model or literal default route to the configured default model.
• Allows initial versions from reference and other unpublished routes while rejecting them from a published actor route.
• Reuses the direct rollout validator so direct responses and session records enforce one publication contract.

Validation

Layer checks

• The session sample suite passed 25 tests.
• Route-specific tests cover explicit reference, explicit actor, literal default, omitted model, and malformed model values.
• The complete five-layer stack passed 112 focused tests.
• Exact branch-head CPU CI passed all four Stage A shards and Stage B on 5fdef0252e. Stage B reported 152 passed and 34 skipped.

Stack-head confirmation

The final stack head was tested against baseline 52403d0e3b with the same controlled asynchronous held-transfer witness:

• the baseline sent one of four pre-synchronization requests to the replacement and returned default;
• the fixed head sent none of those requests to the replacement and returned four current numeric versions;
• after synchronization, the replacement joined normally and served 8 of 32 requests in both runs;
• each job completed four production rollouts with 128 numeric responses.

Both GPU jobs completed successfully. Four separate failure-path checks confirmed that transfer and registration failures quarantine the affected replacement. PR #1805 contains the full setup, result table, interpretation, and proof boundary.

Proof boundary

The paired GPU run proves the recovery publication invariant on the exact baseline and fixed commits. It is a focused recovery test, not a long-running or fully asynchronous trainer test.

Risks and Follow-ups

Malformed session records with a non-string model now fail during sample conversion. This is intentional: accepting them would make route-specific publication validation ambiguous.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.