The runtime refuses to move a Local session.

The trust boundary

The runtime checks the boundary before every request.

A session carries its own privacy authority — local, byok, or managed — written down beside its transcript, and the runtime re-reads it before each request it builds. When the selected model routes somewhere that authority does not cover, the send stops there and the error names the one command that would carry the work across properly.

That command forks a second session which starts with no history at all. It runs a secret scan over the messages you picked, shows you the exact payload with counts of what was included, excluded and truncated, and completes only when you send that reviewed draft back word for word. Attached files are never added for you. The Local session it forked from keeps its own authority and its own transcript, unchanged.