Read a connect session (by token, or by id with a credential)

ONE path with TWO arms, discriminated by the SHAPE of the path segment — never by which credential you send.

Token arm — pass the dd_sess_... token and send no Authorization header. Public: the token is the capability. Returns PublicSession: the records exactly as you requested them, plus status, detected provider and expiry. Once the session's 24 hours are up this arm answers 410 expired forever, which is correct for a capability URL and useless for observability — hence the other arm.

Id arm — pass the session id and authenticate with a dd_sk_ secret key or an OAuth token carrying sessions:read. Returns IntegratorSession, and it can do two things the token arm cannot: it is addressable by the sessionId that every webhook payload carries (the token never appears in one), and it reads an EXPIRED session rather than refusing it — reporting expired: true instead of 410. That flag is DERIVED at read (expiresAt <= now), so it is already true in the window before the reaper persists status: "expired"; do not infer expiry from status alone. Its records are the COMPOSED names (type/host/fqdn) actually looked up on DNS, not the raw request echo the token arm returns.

tier and detectedProvider are null on both arms until detection runs — that pair is the 'detection has not run yet' signal, never a detection failure.