Choose what you need to preserve before moving or sharing a session. This guide is for a person reviewing local work or coordinating a transfer with an operator. Its baseline is Sonny 0.12.7 on Linux. It distinguishes executed TUI controls from source-tested service contracts and client paths that remain unavailable or unauthorized in the fixture.
Choose the right operation
| Operation | What it means | Qualification boundary |
|---|---|---|
TUI /export | A readable Markdown transcript at a file path | Executed; inspected for system prompt and conversation text |
TUI /branch | A distinct local conversation copy | Executed after registering the selected Recipe in the daemon catalog |
| Portable package | Versioned transcript, goal and provenance references with an integrity digest/report | Service round-trip/refusal tests passed; the tested editor connection was refused command authority |
| Live split | A related peer with independent lifetime and, for repository work, its own worktree | Service lifecycle/recovery tests passed; TUI reviewed submission reports unavailable and creates nothing |
| Mesh attachment/transfer | Work owned by a configured remote runtime | Separate mesh workflow ; not a local file copy |
An advertised capability or a successful initialization is not permission to run it. Do not turn a source contract into a promise that every client exposes the operation or your current connection may use it.
Export a readable transcript
First follow local session setup and review the active title, identifier and workspace. Choose a new absolute file path that you own. Paste the actual path into this TUI command; the example below is syntax with a placeholder:
/export /absolute/path/to/review-session.md
This writes immediately. The qualified implementation can overwrite an existing path and does not apply the portable package’s redaction/omission contract. Do not select an existing document, a shared directory or a secret-bearing location. Relative export paths can be ambiguous when a session changed its working directory; an inspected absolute destination is clearer.
Open the file in a text/Markdown viewer. The executed fixture contained a session
identifier, Recipe metadata, the system prompt and conversation text, including
an interrupted response. A newly created fixture file had mode 0600; that is
not a promise about an existing file’s mode or a shared filesystem’s access policy.
Review every section for private instructions, account information, file paths,
quoted secrets and tool output before sharing. Treat the file as sensitive until
reviewed. Deleting a session does not remove this separately written file.
A Markdown transcript is useful for human review, not an importable execution snapshot. It does not establish remote ownership, restore files/tools, or provide credentials on another machine.
Understand the portable-package contract
The versioned package is a different service operation, not a TUI /import
command. Its service contract uses sonny.app.portable-session/v1 and returns an
integrity digest plus an explicit omission report. Source tests exercised export,
redaction, import, reference resolution and hostile-package refusal.
| Travels as data or a reference | Does not travel as usable authority/content |
|---|---|
| Redacted canonical transcript and carried goal | Credential stores and explicit secret fields |
| Session/configuration identifiers | Machine-local grants and approvals |
| Split lineage as provenance | Re-established live peer relationships |
| Attachment manifest and evidence references | Attachment bytes and evidence records themselves |
| Checkpoint references and summaries | Checkpoint patch bytes |
| Working directory as a reference | An admitted workspace binding on the destination |
Review the actual omission report and message bodies; do not infer that a token detector removes every possible sensitive statement. The importer checks digest/schema/bounds before durable import (up to 5,000 messages and 1 MiB per message in the tested contract). Those service bounds do not remove the editor transport’s smaller frame limits. It creates local identity and authority, records provenance, and does not start a turn. Workspace paths and Recipe/model/account references must be resolved under destination policy. A source-tested retried import replays its committed portion rather than appending duplicate transcript entries.
The real editor-protocol probe initialized against a fixture-owned supervisor,
but portable export was refused with runtime: command authority denied.
Import was therefore not attempted through that connection. This guide does not
provide a successful end-user portable export/import command for that configuration.
Use an authorized client/integration that exposes the complete reviewed operation;
inspect its availability and authority before relying on it. Do not bypass the
refusal, copy the sessions database as authentication, or treat a plain Markdown
file as a portable package.
If an authorized import is interrupted, keep the original package, digest and operation identity. Inspect its recorded outcome before retrying, using the same operation identity where the supported client requires it. Do not manufacture a second copy merely because a response was lost. Configure credentials at the destination using the credential guide , independently of transcript recovery.
Distinguish a branch from a live split
/branch makes a conversation copy. A split is intended to create a durable peer
with a goal, ownership and reconciliation relationship. It is not synonymous with
opening another tab or spawning a delegated worker.
The TUI accepts reviewed split syntax such as this non-coding example:
/split Review the approved support notes --name notes-review
In the tested release, this opens the split review dialog. Submitting it reports
that live split submission is not available yet and nothing was created. The
fixture checked that no extra session appeared. Do not keep submitting in the
expectation that a hidden worker is running. /split-detach and
/split-reconcile are also not a qualified live TUI workflow for this baseline.
For an operator’s compatible service/client, the source-tested split contract records stable operation identity across snapshot, worktree preparation, child identity, seed/compaction, guard and activation. The child does not run before activation. The contract includes interrupted-phase recovery and compensating cancellation; inspect the operation instead of discarding a half-prepared directory. A client needs to expose these actual controls before this becomes a user walkthrough.
Reviewed inputs distinguish the child goal, name, normalized repository-relative file scopes and selected queued-prompt IDs. Stale queue IDs or invalid paths must be resolved rather than silently substituted. The reviewed dirty-state choice, child Recipe/model and ownership matter. A copied conversation is not proof that files, tools, authority or the running model moved with it.
Preserve partial reconciliation and worktrees
A supported reconciliation previews the code/context changes and requires current identities/revisions and quiescence. A changed preview, ownership conflict or code-applied/context-pending result needs its named recovery path. Treat code integration and context synthesis as separate effects; do not repeat a successful code apply merely because later synthesis failed.
Detaching a relationship, closing a tab, terminating execution, archiving metadata and deleting a session do different things. Preserve child branches, worktrees, operation records and pending inputs until the owning workflow confirms integration and cleanup eligibility. Goals and delegated work explains inspection and the non-removing prune preview. Never delete a dirty or uncertain worktree as generic cache.
For a multi-machine task, continue with mesh sessions and ownership and the daemon prerequisites . Check your client’s current capabilities and recovery controls before planning a transfer; an unavailable operation cannot be supplied by copying session files.