fix: acknowledge pi maintenance barrier

backend/src/routes/sessions.ts

@@ -9,6 +9,7 @@ import type { ReadinessManager } from "../runtime/readiness-manager.js";
 import type { ListModelsFn } from "./meta.js";
 import type { WorkspaceRegistry } from "../workspaces/registry.js";
 import type { WorkspaceDescriptor } from "../workspaces/schema.js";
+import type { MaintenanceBarrier } from "../runtime/maintenance-gate.js";
 
 const BOOTSTRAP_FAILURE_MESSAGE =
   "Session startup failed. Check configuration and connectivity, then Resume the session.";
@@ -37,8 +38,7 @@ export function sessionRoutes(
     legacyWorkspaceMode?: boolean;
     /** Fail-closed installation/runtime transport capability check. */
     workspaceRuntimeSupport: (workspace: WorkspaceDescriptor) => boolean;
-    /** Host-controlled admission guard. Existing runtimes deliberately continue. */
-    maintenanceGate: () => boolean;
+    maintenanceBarrier: MaintenanceBarrier;
   },
 ) {
   const lifecycleTails = new Map<string, Promise<void>>();
@@ -81,6 +81,14 @@ export function sessionRoutes(
     code: "maintenance",
     error: "Session admission is temporarily paused for maintenance. Try again shortly.",
   });
+  const admissionLeases = new WeakMap<object, () => void>();
+  app.addHook("preHandler", async (req, reply) => {
+    if (req.method !== "POST" || !(req.url === "/sessions" || /^\/sessions\/[^/]+\/resume(?:\?|$)/.test(req.url))) return;
+    const release = d.maintenanceBarrier.acquire();
+    if (!release) return maintenanceReply(reply);
+    admissionLeases.set(req, release);
+  });
+  app.addHook("onResponse", async (req) => { admissionLeases.get(req)?.(); });
 
   /** Include retained historical descriptors so removed workspaces remain resumable. */
   const sessionRevisions = async () => {
@@ -279,7 +287,6 @@ export function sessionRoutes(
   });
 
   app.post("/sessions", async (req, reply) => {
-    if (d.maintenanceGate()) return maintenanceReply(reply);
     const b = req.body as {
       question: string; name?: string; workspace?: string; workspaceId?: string;
       provider?: string; model?: string; thinking?: string;
@@ -510,7 +517,6 @@ export function sessionRoutes(
     return reply.code(204).send();
   });
   app.post("/sessions/:id/resume", async (req, reply) => {
-    if (d.maintenanceGate()) return maintenanceReply(reply);
     const id = (req.params as any).id;
     const principal = getPrincipal(req);
     return withSessionLifecycle(id, async () => {