DL-065
A Postgres pointer row (agent_session_transcripts: stable logical session_id PK → bucket + key PREFIX + a nullable endpoint provenance column, FK-rooted in the post-0004 agent_sessions) indexes each stored log; resume reuses StartAgentSession with an additive authz-gated resume_session_id on the PUBLIC request, and the resolved pointer rides a NEW top-level ResumeContext resume = 12 on the INTERNAL SessionsResponse (outside the command oneof, tag 2 untouched — additive, non-forgeable) so a client-set pointer can never reach the Runner (the public request is relayed verbatim). The new container reconstructs one logical log from the prefix and the built replay barrier gates live input (ReplayComplete alone lifts it — no TranscriptReplay frames on the resume path)
Status: Superseded by DL-084 (Matt, 2026-07-31)