Returns the session with a new grant and revokes the previous one, so a leaked grant stops working at the next poll rather than at its expiry.

This is also the keepalive, for both clocks that matter: the grant's expiry and the machine's idle timer. Call it well before dataPlane.expiresAt — the SDKs do this for you.

agent.status is how you follow a run started with sendAgentMessage. It is reported here rather than on a route of its own precisely so that one poll keeps the session alive and tells you where the run is. completed, failed, and paused are terminal; paused is what a stopAgent produces. unknown means the machine could not be reached for this field alone — the grant in the same response is still good, so retry rather than recreating the session.