feat(perception): publish immutable lab session instances

tests/test_session_api.py

@@ -265,6 +265,39 @@ def test_session_router_lists_details_and_dispatches_opaque_replay(tmp_path: Pat
         assert_no_local_paths(value, repository)
 
 
+def test_session_router_exposes_immutable_lab_provenance(tmp_path: Path) -> None:
+    repository = tmp_path / "repo"
+    sessions = repository / "sessions"
+    source = make_legacy_session(sessions, "20260716T205632Z_viewer_live")
+    store = SessionStore(repository, data_dir=tmp_path / "data")
+    store.reconcile_archive(xgrids_k1_archive_source(sessions))
+    binding = store.publish_lab_instance(
+        session_id="lab-e21-d0201712",
+        source_session_id=source.name,
+        display_name="LAB E21 · Real-time 1× · d0201712",
+        lab_id="LAB E21",
+        result_kind="e21-realtime-envelope",
+        result_id="e10-integrated-perception-" + "a" * 64,
+        source_result_id="e21-realtime-envelope-" + "b" * 64,
+        config_sha256="c" * 64,
+        run_created_at_utc="2026-07-23T15:55:15.548Z",
+        provenance={"source_payloads_mutated": False},
+    )
+    router = build_session_router(store)
+    list_route = endpoint(router, "/api/v1/observation-sessions", "GET")
+    detail_route = endpoint(router, "/api/v1/observation-sessions/{session_id}", "GET")
+
+    listing = list_route(limit=20, cursor=None)
+    item = next(value for value in listing["items"] if value["id"] == binding.session_id)
+    detail = detail_route(session_id=binding.session_id)
+
+    assert item["lab"] == binding.as_dict()
+    assert detail["lab"] == binding.as_dict()
+    assert item["lab"]["source_session_id"] == source.name
+    assert item["lab"]["provenance"]["source_payloads_mutated"] is False
+    assert_no_local_paths((item, detail), repository)
+
+
 def test_delete_session_removes_evidence_and_cache_but_refuses_an_open_recording(
     tmp_path: Path,
 ) -> None: