@intx/hub-sessions 0.3.0 → 0.4.0

package/dist/session-service.js

@@ -1,21 +1,20 @@
 import { type } from "arktype";
-import { and, eq } from "drizzle-orm";
+import { and, eq, isNull } from "drizzle-orm";
 import { getLogger } from "@intx/log";
-import { assembleMessage, assembleSignedContent, createDetachedSignatureFromProvider, } from "@intx/mime";
-import { buildCredentialDelivery, listAssetsForTenant, } from "@intx/db";
-import { grant as grantTable, sidecarAllocation as sidecarAllocationTable, workflowDefinition as workflowDefinitionTable, workflowRun as workflowRunTable, } from "@intx/db/schema";
-import { base64Encode, hexEncode } from "@intx/types";
-import { generateId } from "@intx/hub-common";
+import { buildCredentialDelivery, createSidecarAllocationStore, listAssetsForTenant, resolveInferenceMaterials, } from "@intx/db";
+import { workflowDefinition as workflowDefinitionTable, workflowRun as workflowRunTable, } from "@intx/db/schema";
+import { hexEncode } from "@intx/types";
 import { sessionAsset as sessionAssetTable } from "@intx/db/schema";
 import { AssetRegistrySource, HttpRegistrySource, ManifestInvalidError, createClosureResolver, } from "@intx/tool-packaging";
 import { ToolPackageManifest, } from "@intx/types/tool-packages";
-import { computeWireDefinitionHash } from "@intx/types/wire-definition-hash";
-import { buildInertProjectionStepSources, deriveRunAddress, enumerateInertOnTriggerBodies, pickStepInferenceSource, WorkflowDefinitionInvalidError, } from "@intx/workflow-deploy";
+import { buildInertProjectionStepSources, collectAgentBearingStepIds, deriveRunAddress, WorkflowDefinitionInvalidError, } from "@intx/workflow-deploy";
 import { DEFAULT_ASSET_REF, } from "./asset-service.js";
+import { isDeployFrameFailure } from "./ws/sidecar-handler.js";
 import { buildSourceAssetMounts, } from "./workflow-closure-resolution.js";
 import { restoreWorkflowRunToAllocation } from "./workflow-run-restore.js";
 import { committedReadsToSourceTree } from "./committed-source-tree.js";
 import { installAndApproveWorkflowDefinition, } from "./workflow-probe-gate.js";
+import { buildReferencedWorkflowSourcePins } from "./workflow-source-pins.js";
 const logger = getLogger(["interchange", "hub", "session-service"]);
 export class SessionLaunchError extends Error {
     /** Which phase failed: "write", "provision", "pack", or "start". */
@@ -102,7 +101,8 @@ export function bridgeOrchestratorDeployContent(content) {
  * closure reaches the wire surface via `sendAgentDeploy` with a `workflow`
  * field structurally matching the `AgentDeployFrame.workflow` schema.
  */
-export async function sendMultiStepDeployFrame(args) {
+export async function sendMultiStepDeployFrame(args, signal, beforeSend) {
+    signal?.throwIfAborted();
     const workflow = {
         // The deploy frame carries no inline definition: the sidecar evaluates the
         // pinned code closure from `sourceRef` and re-verifies it against
@@ -121,16 +121,7 @@ export async function sendMultiStepDeployFrame(args) {
             ? { assets: [...args.assets] }
             : {}),
     };
-    // A prepared exclusive deploy routes its frame to the dedicated allocation; a
-    // shared deploy sends it on the shared router. The frozen projection/hash/pin
-    // ride verbatim in both cases -- only the transport differs.
-    if (args.allocationTarget !== undefined) {
-        if (args.sidecarAllocationRouter === undefined) {
-            throw new Error("Exclusive deployment routing is not configured");
-        }
-        return args.sidecarAllocationRouter.sendAgentDeployToAllocation(args.allocationTarget, args.agentAddress, args.config, workflow);
-    }
-    return args.sidecarRouter.sendAgentDeploy(args.agentAddress, args.config, workflow);
+    return args.sidecarAllocationRouter.sendAgentDeployToAllocation(args.allocationTarget, args.agentAddress, args.config, workflow, signal, beforeSend);
 }
 function isAssetDeployArgs(args) {
     return args.source.kind === "asset";
@@ -145,8 +136,16 @@ function isAssetDeployArgs(args) {
  * closure, so the child re-verify over the inert projection matches the gate's
  * freeze.
  *
- * Credential MATERIAL for the definition's tenant-owned bindings is resolved
- * here (`buildCredentialDelivery`) and delivered to the child on the frame.
+ * Credential MATERIAL rides ONE `CredentialDelivery` delivered to the child on
+ * the frame, unioned from three rails and deduped by credentialId: tool bindings
+ * (grant-scoped, resolved here via `buildCredentialDelivery`); every top-level
+ * inference source; and every inline body step's inference source. Both inference
+ * rails are resolved HERE from the DB under the tenant-ownership authority
+ * (`resolveInferenceMaterials`), so the deploy is self-contained -- no caller
+ * pre-supplies material, and a spawned body child finds its secret in the cell.
+ * The merge is a post-authz union of already-cleared material (tool material is
+ * grant-scoped, inference material is tenant-ownership-scoped), never a shared
+ * authz check.
  * Credential GRANT enforcement is a SEPARATE layer: the `credential:{id}` /
  * `use` grant the runtime gate checks is minted per-run by run-grant
  * materialization into `runs/<runId>/grants.json`, not carried on this frame --
@@ -156,14 +155,17 @@ function isAssetDeployArgs(args) {
  * A gate outcome that did not approve cannot deploy: an unapproved `approval`
  * fails closed here rather than shipping an unfrozen definition.
  *
- * This emits the source-ref deploy frame ONLY -- it does NOT write the anchor
- * `workflow_run` row. `deployCodeSourcedWorkflow` wraps it with the shared-path
- * INSERT; the prepared exclusive path wraps it with an UPDATE-under-lock of the
- * anchor row that already exists from prepare time. It returns the frozen
- * definition id so each wrapper writes the same content-addressed identity the
- * gate persisted.
+ * This does the READ-ONLY preparation ONLY: it runs the guards, resolves
+ * credential material, pins the body sources, and builds the asset mounts, then
+ * returns the frozen definition id and the assembled send args. It emits NO
+ * frame and writes NO row, so it has no side effect to unwind. The ordinary path
+ * (`deployCodeSourcedWorkflow`) sequences prepare -> INSERT anchor -> emit so
+ * the anchor is visible before the frame spawns the child; `emitSourceRefDeployFrame`
+ * composes prepare -> emit for the prepared provisioned path, whose anchor row
+ * already exists from prepare time. It returns the frozen definition id so each
+ * caller writes the same content-addressed identity the gate persisted.
  */
-async function emitSourceRefDeployFrame(args) {
+async function prepareSourceRefDeploy(args) {
     const { approval, projection, closure } = args.approved;
     if (!approval.ok) {
         throw new Error(`deployCodeSourcedWorkflow: refusing to deploy an unapproved workflow (gate reason: ${approval.reason})`);
@@ -224,11 +226,12 @@ async function emitSourceRefDeployFrame(args) {
         }
         credentials = delivery.delivery;
     }
-    // Pin per-step inference sources for the projection's inline onTrigger bodies.
+    // Pin per-step inference sources for the projection's inline trigger bodies
+    // -- onTrigger sections and childWorkflow children, enumerated transitively.
     // The hub holds only the frozen inert projection, so it enumerates the inline
     // bodies from the wire form and resolves each body step's source through the
     // same resolver + operator-approval gate the top-level steps use
-    // (`pickStepInferenceSource` against `approval.approvedGrants`). Each body's
+    // (`pickStepInferenceSource` against `approval.approvedSurface`). Each body's
     // wire hash is recomputed from the inert body verbatim, so a body child's
     // re-verify over the re-evaluated closure clears the same barrier a top-level
     // re-verify does. The pinned sources ride OUTSIDE the hash; their trust comes
@@ -244,43 +247,74 @@ async function emitSourceRefDeployFrame(args) {
     // rather than reading it off disk, so no body workflow.json is staged (see the
     // staging loop in workflow-host-wiring.ts and the anti-fallback guard in
     // workflow-host run-child.ts).
-    const referencedDefinitions = await Promise.all(enumerateInertOnTriggerBodies(projection).map(async (body) => {
-        const sources = {};
-        for (const bodyStepId of body.definition.stepOrder) {
-            // Agent-bearing body steps run inference and need a source pinned
-            // through the approval gate. A non-agent body step (sleep,
-            // awaitSignal) declares no preference and runs no inference, so it
-            // advertises no `inference.source` grant the gate could approve --
-            // but the deploy frame's coverage contract still requires a source
-            // entry for EVERY body step. Pin the deploy's default source as an
-            // inert placeholder for such a step: the body child resolves a
-            // step's source only when that step invokes inference, so this entry
-            // is never read, which is why it needs no operator approval.
-            const preferred = body.preferredByStep[bodyStepId] ?? null;
-            if (preferred === null) {
-                const placeholder = args.config.sources.find((s) => s.id === args.config.defaultSource);
-                if (placeholder === undefined) {
-                    throw new WorkflowDefinitionInvalidError(body.ref, `non-agent body step ${bodyStepId} needs an inert placeholder source, but the deploy config carries no defaultSource entry to pin`);
-                }
-                sources[bodyStepId] = [placeholder];
-                continue;
+    const referencedDefinitions = await buildReferencedWorkflowSourcePins({
+        projection,
+        config: args.config,
+        operatorApprovals: approval.approvedSurface,
+    });
+    // Assemble the ONE credential delivery. Its `materials` cover three rails, each
+    // authorized upstream on its own terms, deduped by credentialId into one cell:
+    //   - tool bindings, grant-scoped through `buildCredentialDelivery` above;
+    //   - the inference source pinned to each top-level step that can actually
+    //     invoke inference, tenant-owned;
+    //   - the same for each inline body step (onTrigger/childWorkflow bodies
+    //     pinned above), tenant-owned.
+    // Which steps those are is read from the hash-covered projection, never from
+    // the pinned map: every step carries a pin because the wire shape demands one,
+    // but a step that cannot issue a request has no use for a secret. Delivering
+    // one anyway decrypts a tenant credential, seals it to the sidecar, and
+    // re-delivers it on every reconnect, on behalf of a step that never makes a
+    // call.
+    // The inference rails are resolved HERE from the DB under the tenant-ownership
+    // authority, so this deploy is self-contained: a direct deploy (a test) that
+    // seeds the credentials in the DB -- rather than pre-supplying material -- still
+    // fills the cell, and a spawned body finds its secret rather than failing closed
+    // at resolve time. Precedence on a shared credentialId is tool material first
+    // (grant-scoped), then the inference material (tenant-ownership-scoped): the
+    // first material for an id wins. Inference sources carry NO binding descriptor
+    // -- they reference their credential by id directly.
+    const materials = new Map();
+    for (const material of credentials?.materials ?? []) {
+        materials.set(material.credentialId, material);
+    }
+    const inferenceCredentialIds = new Set();
+    const addAgentBearingCredentials = (definition, pinned, context) => {
+        for (const stepId of collectAgentBearingStepIds({ definition, context })) {
+            const stepSources = pinned[stepId];
+            if (stepSources === undefined) {
+                throw new Error(`${context}step ${stepId} can invoke inference but carries no pinned source`);
+            }
+            for (const source of stepSources) {
+                inferenceCredentialIds.add(source.credentialId);
             }
-            sources[bodyStepId] = [
-                pickStepInferenceSource({
-                    preferred,
-                    stepId: bodyStepId,
-                    workflowId: body.ref,
-                    config: args.config,
-                    operatorApprovals: approval.approvedGrants,
-                }),
-            ];
         }
-        return {
-            definition: body.definition,
-            sources,
-            approvedWireHash: await computeWireDefinitionHash(body.definition),
-        };
-    }));
+    };
+    addAgentBearingCredentials(projection, args.sources, "deployCodeSourcedWorkflow: ");
+    for (const body of referencedDefinitions) {
+        addAgentBearingCredentials(body.definition, body.sources, `deployCodeSourcedWorkflow body ${body.definition.id}: `);
+    }
+    if (inferenceCredentialIds.size > 0) {
+        if (args.credentialCipher === undefined) {
+            throw new Error("deployCodeSourcedWorkflow: pinned inference sources reference credentials " +
+                "but no credentialCipher was supplied to resolve them");
+        }
+        const inferenceMaterials = await resolveInferenceMaterials(args.db, args.tenantId, inferenceCredentialIds, args.credentialCipher);
+        for (const material of inferenceMaterials) {
+            if (!materials.has(material.credentialId)) {
+                materials.set(material.credentialId, material);
+            }
+        }
+    }
+    // A delivery with tool bindings always carries their material, so an empty map
+    // means no rail contributed anything -- send no delivery. (Tool bindings never
+    // produce a descriptor without a material, so bindings-without-materials cannot
+    // occur.)
+    const credentialDelivery = materials.size > 0
+        ? {
+            bindings: credentials?.bindings ?? [],
+            materials: [...materials.values()],
+        }
+        : undefined;
     // An asset-sourced pin's `kind:"asset"` closure entries read from source
     // assets the sidecar cannot fetch itself; deliver them inline on the frame so
     // the sidecar checks them out into its durable per-deployment source store. A
@@ -288,58 +322,238 @@ async function emitSourceRefDeployFrame(args) {
     const assets = isAssetDeployArgs(args)
         ? await buildSourceAssetMounts(closure, args.resolveAttachment)
         : [];
-    const result = await sendMultiStepDeployFrame({
+    const sendArgs = {
         lineage: "source-ref",
-        sidecarRouter: args.sidecarRouter,
-        ...(args.sidecarAllocationRouter !== undefined
-            ? { sidecarAllocationRouter: args.sidecarAllocationRouter }
-            : {}),
-        ...(args.allocationTarget !== undefined
-            ? { allocationTarget: args.allocationTarget }
-            : {}),
+        sidecarAllocationRouter: args.sidecarAllocationRouter,
+        allocationTarget: args.allocationTarget,
         agentAddress: args.agentAddress,
         config: args.config,
         sources: args.sources,
         approvedWireHash: approval.approvedWireHash,
         sourceRef: { source: args.source, closure },
-        ...(credentials !== undefined ? { credentials } : {}),
+        ...(credentialDelivery !== undefined
+            ? { credentials: credentialDelivery }
+            : {}),
         ...(referencedDefinitions.length > 0 ? { referencedDefinitions } : {}),
         ...(assets.length > 0 ? { assets } : {}),
-    });
-    return { publicKey: result.publicKey, definitionId: approval.definitionId };
+    };
+    return { definitionId: approval.definitionId, sendArgs };
+}
+/**
+ * Prepare then emit the source-ref deploy frame, for the prepared provisioned
+ * path whose anchor `workflow_run` row already exists (inserted at prepare
+ * time). It emits the frame but does NOT touch the anchor row: the caller
+ * (`deployPreparedCodeSourcedWorkflow`) stamps the acked key under the
+ * allocation-ownership lock. A tagged `DeployFrameFailure` is converted to the
+ * `SessionLaunchError` disposition the allocation reconciler consumes, while
+ * untagged preparation errors remain safe same-generation retries. The ordinary
+ * path does NOT use this wrapper -- it must interleave the anchor INSERT between
+ * prepare and emit, so it drives `prepareSourceRefDeploy` and
+ * `sendMultiStepDeployFrame` directly.
+ */
+// The non-secret projection of a delivery, persisted on the anchor run so the
+// reconnect resync can re-resolve current materials. Secrets never land here.
+function credentialRefsFromDelivery(delivery) {
+    return {
+        credentialIds: delivery.materials.map((material) => material.credentialId),
+        bindings: delivery.bindings,
+    };
+}
+async function emitSourceRefDeployFrame(args, reconciliation) {
+    const { signal, leaseId } = reconciliation;
+    signal.throwIfAborted();
+    const { definitionId, sendArgs } = await prepareSourceRefDeploy(args);
+    signal.throwIfAborted();
+    const allocationStore = createSidecarAllocationStore(args.db);
+    const initialization = {
+        allocationId: sendArgs.allocationTarget.allocationId,
+        generation: sendArgs.allocationTarget.generation,
+        anchorRunId: args.anchorRunId,
+        tenantId: args.tenantId,
+        leaseId,
+        signal,
+    };
+    let previousPublicKey;
+    try {
+        const result = await sendMultiStepDeployFrame(sendArgs, signal, async () => {
+            const reserved = await allocationStore.beginInitialization(initialization);
+            if (reserved === null) {
+                throw new Error("Allocation no longer permits this initialization attempt");
+            }
+            previousPublicKey = reserved.previousPublicKey;
+        });
+        return {
+            publicKey: result.publicKey,
+            definitionId,
+            ...(sendArgs.credentials !== undefined
+                ? { credentialRefs: credentialRefsFromDelivery(sendArgs.credentials) }
+                : {}),
+        };
+    }
+    catch (cause) {
+        if (!isDeployFrameFailure(cause))
+            throw cause;
+        // Only a confirmed reservation gives us the key to restore. An ambiguous
+        // reservation response leaves its durable marker for conservative cleanup.
+        // A confirmed unsent attempt can roll back even after lease cancellation.
+        if (!cause.frameSent && previousPublicKey !== undefined) {
+            try {
+                const cleared = await allocationStore.clearUnsentInitialization({
+                    ...initialization,
+                    previousPublicKey,
+                });
+                if (cleared)
+                    args.onUnsentInitializationCleared(previousPublicKey);
+            }
+            catch (error) {
+                logger.warn `Could not clear unsent initialization for ${initialization.allocationId}: ${error instanceof Error ? error.message : String(error)}`;
+            }
+        }
+        throw new SessionLaunchError("start", cause, cause.frameSent);
+    }
 }
 /**
- * The single public composition entrypoint for a SHARED code-sourced (npm)
- * deploy: emit the source-ref frame, then INSERT the deployment's anchor
- * `workflow_run` row -- the deployment's first-class record that owns its
- * routing address and public key. Run-grant materialization keys off this row
- * (address + live status), so WITHOUT it no per-run grants (tool, capability, OR
- * credential) ever materialize for a source-ref deployment. Born "deployed"
- * (live but pre-trigger): the first trigger's materialization flips it to
- * "running" via `anchorWithPrincipal`'s guarded update, which a row born
- * "running" would skip. Its `anchorRunId` equals its own id, so the anchor
- * references itself. The deployer read grant is deferred to the production
- * route, which carries the authenticated deployer principal; this stays a
- * single insert with no grant row to pair atomically.
+ * A direct allocation-bound composition entrypoint for tests and low-level
+ * callers: prepare, INSERT the deployment's anchor `workflow_run` row, THEN emit
+ * the source-ref frame. The anchor row is the deployment's first-class record
+ * that owns its routing address and public key. Run-grant materialization keys
+ * off this row (address + live status), so WITHOUT it no per-run grants (tool,
+ * capability, OR credential) ever materialize for a source-ref deployment. Born
+ * "deployed" (live but pre-trigger) with a null public key: the first trigger's
+ * materialization flips it to "running" via `anchorWithPrincipal`'s guarded
+ * update, which a row born "running" would skip. Its `anchorRunId` equals its
+ * own id, so the anchor references itself. The deployer read grant is deferred
+ * to the production route, which carries the authenticated deployer principal.
+ *
+ * ORDERING IS LOAD-BEARING. The anchor row must be committed and visible to the
+ * pack-receipt connection BEFORE the frame reaches the wire: the frame spawns
+ * the child, whose first events pack races the ack back, and
+ * `receiveWorkflowRunPack` fails closed on a missing live anchor. Emitting first
+ * (the previous order) rejected that first pack and never bootstrapped the log.
+ * This works because `args.db` is the autocommit handle (`DB["db"]`, which the
+ * type forbids from being a transaction) and the INSERT is NOT wrapped in a
+ * transaction with the emit -- so the row is durably visible the instant the
+ * INSERT statement returns. Do NOT relax `db` to a transaction executor or wrap
+ * anchor+emit in one transaction to make them atomic: that reopens the race.
  *
- * The prepared exclusive path does NOT use this wrapper: its anchor row already
- * exists from prepare time, so it wraps `emitSourceRefDeployFrame` with an
- * UPDATE-under-allocation-lock instead of this INSERT.
+ * On emit failure the anchor row is rolled back or fenced by the `frameSent`
+ * evidence from the transport. `leakedAgent: false` (safe to fully roll back) is
+ * the STRONG claim and is made only on positive proof the frame never reached
+ * the wire (`isDeployFrameFailure && frameSent === false`); every other failure
+ * -- a sent-but-unacked frame OR any untagged error -- is treated as
+ * possibly-live: the anchor is fenced `deployed` -> `failed` and the error is
+ * `leakedAgent: true`.
+ *
+ * The prepared provisioned path does NOT use this composition: its anchor row
+ * already exists from prepare time, so it drives `emitSourceRefDeployFrame` and
+ * an UPDATE-under-allocation-lock instead.
  */
 export async function deployCodeSourcedWorkflow(args) {
-    const { publicKey, definitionId } = await emitSourceRefDeployFrame(args);
-    await args.db.insert(workflowRunTable).values({
-        id: args.anchorRunId,
-        tenantId: args.tenantId,
-        anchorRunId: args.anchorRunId,
-        definitionId,
-        address: args.agentAddress,
-        publicKey,
-        status: "deployed",
-        createdAt: new Date(),
-    });
+    const { definitionId, sendArgs } = await prepareSourceRefDeploy(args);
+    // INSERT the anchor before the frame. A collision or DB error here spawned
+    // nothing (no frame went out), so it is a clean, non-leaking failure.
+    try {
+        await args.db.insert(workflowRunTable).values({
+            id: args.anchorRunId,
+            tenantId: args.tenantId,
+            anchorRunId: args.anchorRunId,
+            definitionId,
+            address: args.agentAddress,
+            publicKey: null,
+            status: "deployed",
+            createdAt: new Date(),
+            // Persist the non-secret shape of the delivery so the reconnect resync
+            // can re-resolve current materials for these ids. Secrets never land here.
+            ...(sendArgs.credentials !== undefined
+                ? { credentialRefs: credentialRefsFromDelivery(sendArgs.credentials) }
+                : {}),
+        });
+    }
+    catch (cause) {
+        throw new SessionLaunchError("start", cause, false);
+    }
+    let publicKey;
+    try {
+        const result = await sendMultiStepDeployFrame(sendArgs);
+        publicKey = result.publicKey;
+    }
+    catch (cause) {
+        if (isDeployFrameFailure(cause) && cause.frameSent === false) {
+            // Positive proof the frame never reached the wire: nothing spawned, so
+            // fully roll the anchor back. The guard (`deployed`, null key) is a
+            // tripwire on the `frameSent: false` contract -- a 0-row delete means the
+            // row advanced or vanished, so the contract lied and a child may be live;
+            // surface that loudly and refuse to claim it is safe to roll back.
+            const deleted = await args.db
+                .delete(workflowRunTable)
+                .where(and(eq(workflowRunTable.id, args.anchorRunId), eq(workflowRunTable.anchorRunId, args.anchorRunId), eq(workflowRunTable.tenantId, args.tenantId), eq(workflowRunTable.status, "deployed"), isNull(workflowRunTable.publicKey)))
+                .returning({ id: workflowRunTable.id });
+            if (deleted.length === 0) {
+                logger.error `anchor-before-frame rollback found no deployed/null-key row for ${args.anchorRunId} after a frameSent:false failure; the never-sent contract was violated and a child may be live`;
+                throw new SessionLaunchError("start", cause, true);
+            }
+            throw new SessionLaunchError("start", cause, false);
+        }
+        // A sent-but-unacked frame, OR any untagged/unexpected error: no positive
+        // proof of a clean send, so treat the agent as possibly-live. Fence the
+        // anchor `deployed` -> `failed` (guarded so a self-flip to "running" by a
+        // trigger that already landed is left alone). Do NOT delete: a live child
+        // needs the anchor to bootstrap.
+        const flipped = await args.db
+            .update(workflowRunTable)
+            .set({ status: "failed" })
+            .where(and(eq(workflowRunTable.id, args.anchorRunId), eq(workflowRunTable.anchorRunId, args.anchorRunId), eq(workflowRunTable.tenantId, args.tenantId), eq(workflowRunTable.status, "deployed"), isNull(workflowRunTable.publicKey)))
+            .returning({ id: workflowRunTable.id });
+        if (flipped.length === 0) {
+            // The anchor already advanced past deployed -- a trigger flipped it to
+            // "running", so the deploy actually succeeded and the run is progressing
+            // despite the ack failure. Leave it; the leaked-agent disposition still
+            // holds because the frame was (or may have been) sent.
+            logger.warn `anchor-before-frame: anchor ${args.anchorRunId} already advanced past deployed on an unacked/failed emit; the agent is live and the run is progressing despite the ack failure`;
+        }
+        else {
+            logger.warn `anchor-before-frame: fenced anchor ${args.anchorRunId} deployed->failed on an unacked/failed emit; the agent may be leaked but the run is dead`;
+        }
+        throw new SessionLaunchError("start", cause, true);
+    }
+    // Emit succeeded: stamp the acked key. No status guard -- the key is a fact
+    // regardless of whether the pack-ack race already flipped the row to
+    // "running", and skipping the stamp there would strand a live run with a null
+    // key. A 0-row update is an anomaly (nothing should remove a deployed anchor
+    // on the success path), but the deploy succeeded, so log it rather than
+    // failing a live run.
+    const stamped = await args.db
+        .update(workflowRunTable)
+        .set({ publicKey })
+        .where(and(eq(workflowRunTable.id, args.anchorRunId), eq(workflowRunTable.anchorRunId, args.anchorRunId), eq(workflowRunTable.tenantId, args.tenantId)))
+        .returning({ id: workflowRunTable.id });
+    if (stamped.length === 0) {
+        logger.error `anchor-before-frame: anchor ${args.anchorRunId} vanished before its public key could be stamped on a successful deploy`;
+    }
     return { publicKey };
 }
+/** Resolve deferred sender mail after claiming the previous initializer's lease. */
+export async function recoverSenderDeploy(args) {
+    const { allocation, reconciliation } = args;
+    reconciliation.signal.throwIfAborted();
+    // A proven-unsent clear may still restore the previous key after this claim.
+    // Do not fail its mail using the claim's stale marker. Cleanup rechecks under
+    // the allocation lock; an advanced fence settles failure, while a rolled-back
+    // attempt is resolved by its caller or the next claim's completed key.
+    if (allocation.initializationLeaseId !== undefined)
+        return;
+    // Claiming the lease prevents the previous attempt from publishing. Its
+    // marker and key now distinguish a committed initialization from failure,
+    // even before the worker reconnects or the old response arrives.
+    const anchor = await args.db.query.workflowRun.findFirst({
+        where: eq(workflowRunTable.id, allocation.anchorRunId),
+        columns: { publicKey: true },
+    });
+    reconciliation.signal.throwIfAborted();
+    args.sidecarRouter.noteSenderDeploySettled({ allocationId: allocation.id, generation: allocation.generation }, anchor !== undefined && anchor.publicKey !== null
+        ? { recorded: anchor.publicKey }
+        : { failed: "Previous deployment initialization did not complete" });
+}
 export function createSessionService(deps) {
     const { sidecarRouter, sidecarAllocationRouter, agentRepoStore, assetService, db, toolPackageRegistries, } = deps;
     if (assetService !== undefined && db === undefined) {
@@ -350,7 +564,7 @@ export function createSessionService(deps) {
     }
     function requireAllocationRouter() {
         if (sidecarAllocationRouter === undefined) {
-            throw new Error("Exclusive deployment routing is not configured");
+            throw new Error("Provisioned deployment routing is not configured");
         }
         return sidecarAllocationRouter;
     }
@@ -455,12 +669,7 @@ export function createSessionService(deps) {
         // route is held only for the pack window and dropped in the `finally`.
         if (stageOnly) {
             try {
-                if (params.allocationTarget === undefined) {
-                    sidecarRouter.bindStepRoute(agentAddress);
-                }
-                else {
-                    await requireAllocationRouter().bindAllocatedStepRoute(params.allocationTarget, agentAddress);
-                }
+                await requireAllocationRouter().bindAllocatedStepRoute(params.allocationTarget, agentAddress);
             }
             catch (err) {
                 throw new SessionLaunchError("provision", err, false);
@@ -474,12 +683,7 @@ export function createSessionService(deps) {
             // exist before the pack applies.
             try {
                 if (stageOnly) {
-                    if (params.allocationTarget === undefined) {
-                        await sidecarRouter.sendProvisionStep(agentAddress, config);
-                    }
-                    else {
-                        await requireAllocationRouter().sendProvisionStepToAllocation(params.allocationTarget, agentAddress, config);
-                    }
+                    await requireAllocationRouter().sendProvisionStepToAllocation(params.allocationTarget, agentAddress, config);
                 }
                 else {
                     // Every caller supplies `stageOnly`. A deploy without it has no
@@ -500,26 +704,17 @@ export function createSessionService(deps) {
             // the orphaned repo. This is an acceptable minor leak on the exceptional
             // staging-failure path, not a live-path cost.
             try {
-                if (params.allocationTarget === undefined) {
-                    await sidecarRouter.sendPack(agentAddress, pack, ref, commitSha);
-                }
-                else {
-                    await requireAllocationRouter().sendPackToAllocation(params.allocationTarget, agentAddress, pack, ref, commitSha);
-                }
+                await requireAllocationRouter().sendPackToAllocation(params.allocationTarget, agentAddress, pack, ref, commitSha);
             }
             catch (err) {
-                if (!stageOnly && params.allocationTarget === undefined) {
-                    await attemptCleanup(agentAddress, "pack", err);
-                }
-                throw new SessionLaunchError("pack", err, !stageOnly && params.allocationTarget !== undefined);
+                throw new SessionLaunchError("pack", err, !stageOnly);
             }
             // Phase 2b: Asset-pack fan-out. For each attached asset, build a
             // pack, reserve the manifest row, then send the pack. The manifest
             // reservation MUST happen before the pack send: if the sidecar acks
             // but the row is missing, the session has materialization without
-            // a recorded manifest. An allocated replacement may reuse the exact
-            // row its predecessor recorded; ordinary launches still require a new
-            // row. If reservation fails, the pack send must not happen.
+            // a recorded manifest. An allocated replacement may reuse the exact row
+            // its predecessor recorded. If reservation fails, no pack is sent.
             //
             // The fan-out materializes the package-registry assets the
             // tool-package resolver picked. They live behind tenant
@@ -528,35 +723,19 @@ export function createSessionService(deps) {
             // `manifestAssetAttachments`.
             const fanOut = manifestAssetAttachments;
             if (assetService !== undefined && fanOut.length > 0) {
-                // Track the rows this attempt owns so a later fan-out failure can roll
-                // them back in lockstep with the sidecar undeploy. Allocated rows are
-                // durable recovery intent, not attempt-owned materialization state, so
-                // replacement failures must leave them in place for the next worker.
-                const committed = [];
                 for (const att of fanOut) {
                     try {
-                        const committedRecord = await sendAttachmentPack(runId, agentAddress, att, params.allocationTarget);
-                        if (committedRecord !== null)
-                            committed.push(committedRecord);
+                        await sendAttachmentPack(runId, agentAddress, att, params.allocationTarget);
                     }
                     catch (err) {
-                        await rollbackCommittedAttachments(committed);
-                        if (!stageOnly && params.allocationTarget === undefined) {
-                            await attemptCleanup(agentAddress, "pack", err);
-                        }
-                        throw new SessionLaunchError("pack", err, !stageOnly && params.allocationTarget !== undefined);
+                        throw new SessionLaunchError("pack", err, !stageOnly);
                     }
                 }
             }
         }
         finally {
             if (stageOnly) {
-                if (params.allocationTarget === undefined) {
-                    sidecarRouter.unbindStepRoute(agentAddress);
-                }
-                else {
-                    requireAllocationRouter().unbindAllocatedStepRoute(params.allocationTarget, agentAddress);
-                }
+                requireAllocationRouter().unbindAllocatedStepRoute(params.allocationTarget, agentAddress);
             }
         }
     }
@@ -581,9 +760,7 @@ export function createSessionService(deps) {
             ...(params.toolPackagePins !== undefined
                 ? { toolPackagePins: params.toolPackagePins }
                 : {}),
-            ...(params.allocationTarget !== undefined
-                ? { allocationTarget: params.allocationTarget }
-                : {}),
+            allocationTarget: params.allocationTarget,
         });
     }
     // Resolve the npm registry config a code-sourced install resolves external
@@ -630,11 +807,17 @@ export function createSessionService(deps) {
             throw new Error("deployWorkflowFromSource requires a db handle to freeze the approval");
         }
         const dbHandle = db;
+        const allocationTarget = params.allocationTarget;
         const common = {
             entry: params.entry,
             assetId: params.definitionAssetId,
-            approvals: { mode: "approve-probed" },
-            router: sidecarRouter,
+            approvals: { kind: "approve-probed" },
+            router: {
+                sendProbe: (args) => requireAllocationRouter().sendProbeToAllocation(allocationTarget, args),
+            },
+            ...(params.onProbeResult !== undefined
+                ? { onProbeResult: params.onProbeResult }
+                : {}),
             db: dbHandle,
         };
         const source = params.source;
@@ -703,17 +886,17 @@ export function createSessionService(deps) {
     // Install + probe + gate + freeze a code-sourced definition, returning the
     // frozen bundle and the (asset-only) attachment resolver. The gate outcome is
     // NOT asserted here: `deployWorkflowFromSource` and `installAndApproveWorkflowSource`
-    // each surface a non-approval as their own domain error. This is the shared
-    // freeze both the shared deploy and the exclusive prepare run.
+    // each surface a non-approval as their own domain error. This is the common
+    // freeze used by direct tests and provisioned prepare runs.
     async function prepareCodeSourcedApproval(params) {
         const resolveAttachment = bindSourceAttachmentResolver(params.source);
         const installArgs = await buildInstallArgs(params, resolveAttachment);
         const approved = await installAndApproveWorkflowDefinition(installArgs);
         return { approved, resolveAttachment };
     }
-    // Freeze a code-sourced approval on shared capacity WITHOUT deploying it. The
-    // exclusive prepare path persists the returned bundle and deploys it to a
-    // dedicated allocation later. A non-approval fails closed as an invalid
+    // Freeze a code-sourced approval WITHOUT deploying it. The provisioned
+    // prepare path persists the returned bundle and deploys it to an allocation
+    // later. A non-approval fails closed as an invalid
     // definition.
     async function installAndApproveWorkflowSource(params) {
         const { approved } = await prepareCodeSourcedApproval(params);
@@ -722,79 +905,12 @@ export function createSessionService(deps) {
         }
         return approved;
     }
-    async function deployWorkflowFromSource(params) {
-        if (db === undefined) {
-            throw new Error("deployWorkflowFromSource requires a db handle to record the deployment's anchor run");
-        }
-        const source = params.source;
-        const { approved, resolveAttachment } = await prepareCodeSourcedApproval(params);
-        if (!approved.approval.ok) {
-            throw new WorkflowDefinitionInvalidError(approved.projection.id, `code-sourced workflow install did not approve (reason: ${approved.approval.reason})`);
-        }
-        // Pin every top-level step's inference source under the frozen approval,
-        // then hand the frozen bundle to the source-ref deploy.
-        const sources = buildInertProjectionStepSources({
-            projection: approved.projection,
-            config: params.config,
-            operatorApprovals: approved.approval.approvedGrants,
-        });
-        const commonDeploy = {
-            approved,
-            sidecarRouter,
-            agentAddress: params.agentAddress,
-            config: params.config,
-            sources,
-            db,
-            tenantId: params.tenantId,
-            anchorRunId: params.anchorRunId,
-            deploymentDomain: params.deploymentDomain,
-        };
-        // Branch on the source discriminant so the deploy args match the
-        // asset/registry arms of `DeployCodeSourcedWorkflowArgs`: an asset arm
-        // carries the attachment resolver (asserted non-null here to satisfy the
-        // union and fail loud on a mis-wired caller), a registry arm carries none.
-        let result;
-        if (source.kind === "asset") {
-            if (resolveAttachment === null) {
-                throw new Error("deployWorkflowFromSource: asset source deploy is missing its attachment resolver");
-            }
-            result = await deployCodeSourcedWorkflow({
-                ...commonDeploy,
-                source,
-                resolveAttachment,
-            });
-        }
-        else {
-            result = await deployCodeSourcedWorkflow({ ...commonDeploy, source });
-        }
-        // Seed the deploying principal's read grant on the deployment's workflow-run
-        // resource. `deployCodeSourcedWorkflow` wrote the anchor row but deliberately
-        // leaves this grant to the route, which carries the authenticated deployer
-        // principal.
-        const now = new Date();
-        await db.insert(grantTable).values({
-            id: generateId("grant"),
-            tenantId: params.tenantId,
-            principalId: params.config.principalId,
-            resource: `workflow-run:${params.anchorRunId}`,
-            action: "read",
-            effect: "allow",
-            origin: "creator",
-            createdAt: now,
-            updatedAt: now,
-        });
-        return {
-            anchorRunId: params.anchorRunId,
-            deploymentAddress: params.agentAddress,
-            publicKey: result.publicKey,
-        };
-    }
     /**
      * Update a prepared anchor run's `publicKey` under the allocation-ownership
      * lock. The anchor row was inserted at prepare time; this stamps the
      * supervisor key returned by the deploy ack, but only while the allocation
-     * still names this exact accepted generation for this anchor. A lost lock (the
-     * allocation moved on, another worker took the generation) fails closed as a
+     * still names this exact accepted generation and unexpired reconciliation
+     * lease for this anchor. Lost ownership or cancellation fails closed as a
      * leaked-agent `SessionLaunchError` -- the deploy already reached the sidecar,
      * so the caller must treat the sidecar agent as possibly live. Used by the
      * `deployPreparedCodeSourcedWorkflow` prepared path.
@@ -805,35 +921,19 @@ export function createSessionService(deps) {
         }
         const dbHandle = db;
         try {
-            const updated = await dbHandle.transaction(async (tx) => {
-                const [allocation] = await tx
-                    .select({
-                    id: sidecarAllocationTable.id,
-                    anchorRunId: sidecarAllocationTable.anchorRunId,
-                    status: sidecarAllocationTable.status,
-                    generation: sidecarAllocationTable.generation,
-                    ensureAcceptedGeneration: sidecarAllocationTable.ensureAcceptedGeneration,
-                })
-                    .from(sidecarAllocationTable)
-                    .where(eq(sidecarAllocationTable.id, args.allocationTarget.allocationId))
-                    .limit(1)
-                    .for("update");
-                if (allocation === undefined ||
-                    allocation.anchorRunId !== args.anchorRunId ||
-                    allocation.status !== "allocated" ||
-                    allocation.generation !== args.allocationTarget.generation ||
-                    allocation.ensureAcceptedGeneration !==
-                        args.allocationTarget.generation) {
-                    return null;
-                }
-                const [anchor] = await tx
-                    .update(workflowRunTable)
-                    .set({ publicKey: args.publicKey })
-                    .where(and(eq(workflowRunTable.id, args.anchorRunId), eq(workflowRunTable.anchorRunId, args.anchorRunId), eq(workflowRunTable.tenantId, args.tenantId)))
-                    .returning({ id: workflowRunTable.id });
-                return anchor ?? null;
+            const updated = await createSidecarAllocationStore(dbHandle).completeInitialization({
+                allocationId: args.allocationTarget.allocationId,
+                generation: args.allocationTarget.generation,
+                anchorRunId: args.anchorRunId,
+                tenantId: args.tenantId,
+                leaseId: args.reconciliation.leaseId,
+                signal: args.reconciliation.signal,
+                publicKey: args.publicKey,
+                ...(args.credentialRefs !== undefined
+                    ? { credentialRefs: args.credentialRefs }
+                    : {}),
             });
-            if (updated === null) {
+            if (!updated) {
                 throw new Error(`Prepared anchor run ${args.anchorRunId} lost allocation ownership before initialization completed`);
             }
         }
@@ -852,6 +952,8 @@ export function createSessionService(deps) {
      * resolved source carries a credential secret).
      */
     async function deployPreparedCodeSourcedWorkflow(params) {
+        const { signal } = params.reconciliation;
+        signal.throwIfAborted();
         if (db === undefined) {
             throw new Error("deployPreparedCodeSourcedWorkflow requires a db handle to update the prepared anchor run");
         }
@@ -864,11 +966,11 @@ export function createSessionService(deps) {
         const source = params.source;
         const resolveAttachment = bindSourceAttachmentResolver(source);
         // Re-pin every top-level step's inference source from the re-resolved chain
-        // under the frozen approval -- the same pin the shared deploy computes.
+        // under the frozen approval -- the same pin the source-ref deploy computes.
         const sources = buildInertProjectionStepSources({
             projection: params.approved.projection,
             config: params.config,
-            operatorApprovals: approval.approvedGrants,
+            operatorApprovals: approval.approvedSurface,
         });
         // Restore the Hub-authoritative run ref onto the exact allocation generation
         // before its address is routed.
@@ -877,10 +979,15 @@ export function createSessionService(deps) {
             allocationRouter,
             allocationTarget: params.allocationTarget,
             agentAddress: params.agentAddress,
+            signal,
         });
+        signal.throwIfAborted();
+        let restoredPublicKey;
         const commonEmit = {
+            onUnsentInitializationCleared(publicKey) {
+                restoredPublicKey = publicKey;
+            },
             approved: params.approved,
-            sidecarRouter,
             sidecarAllocationRouter: allocationRouter,
             allocationTarget: params.allocationTarget,
             agentAddress: params.agentAddress,
@@ -898,48 +1005,68 @@ export function createSessionService(deps) {
         // arms: an asset arm carries the rebuilt attachment resolver (asserted
         // non-null to satisfy the union), a registry arm carries none.
         let result;
-        if (source.kind === "asset") {
-            if (resolveAttachment === null) {
-                throw new Error("deployPreparedCodeSourcedWorkflow: asset source deploy is missing its attachment resolver");
+        const senderAttempt = {
+            ...params.allocationTarget,
+            leaseId: params.reconciliation.leaseId,
+        };
+        signal.throwIfAborted();
+        sidecarRouter.noteSenderDeployStarted(params.agentAddress, senderAttempt);
+        try {
+            // Bracket the allocated pre-ack window: mark the sender's key-record as
+            // mid-flight before the deploy emit so a run that sends mail before its
+            // anchor key is committed parks rather than delivering keyless. The settle
+            // follows durable completion; cancellation leaves the outcome to recovery.
+            if (source.kind === "asset") {
+                if (resolveAttachment === null) {
+                    throw new Error("deployPreparedCodeSourcedWorkflow: asset source deploy is missing its attachment resolver");
+                }
+                result = await emitSourceRefDeployFrame({ ...commonEmit, source, resolveAttachment }, params.reconciliation);
             }
-            result = await emitSourceRefDeployFrame({
-                ...commonEmit,
-                source,
-                resolveAttachment,
+            else {
+                result = await emitSourceRefDeployFrame({ ...commonEmit, source }, params.reconciliation);
+            }
+            await updateAnchorPublicKeyUnderAllocationLock({
+                tenantId: params.tenantId,
+                anchorRunId: params.anchorRunId,
+                allocationTarget: params.allocationTarget,
+                reconciliation: params.reconciliation,
+                publicKey: result.publicKey,
+                ...(result.credentialRefs !== undefined
+                    ? { credentialRefs: result.credentialRefs }
+                    : {}),
             });
+            // The anchor's public key is now durable. Wake any mail the run parked
+            // while pre-ack so it delivers with the sender key co-delivered, closing
+            // the window where a run sends before its key is recorded. The write above
+            // happens-before this settle, so a re-drive resolves the recorded key.
+            // `params.agentAddress` is the run's deploy address, byte-identical to the
+            // sender address its mail was sent under (asserted against the anchor at
+            // deploy time), so a settle matches the parked entries.
+            sidecarRouter.noteSenderDeploySettled(senderAttempt, {
+                recorded: result.publicKey,
+            });
+            return {
+                anchorRunId: params.anchorRunId,
+                deploymentAddress: params.agentAddress,
+                publicKey: result.publicKey,
+            };
         }
-        else {
-            result = await emitSourceRefDeployFrame({ ...commonEmit, source });
-        }
-        await updateAnchorPublicKeyUnderAllocationLock({
-            tenantId: params.tenantId,
-            anchorRunId: params.anchorRunId,
-            allocationTarget: params.allocationTarget,
-            publicKey: result.publicKey,
-        });
-        return {
-            anchorRunId: params.anchorRunId,
-            deploymentAddress: params.agentAddress,
-            publicKey: result.publicKey,
-        };
-    }
-    async function rollbackCommittedAttachments(committed) {
-        if (db === undefined)
-            return;
-        if (committed.length === 0)
-            return;
-        // Per-row try/catch so a single rollback failure does not stop the
-        // sweep — every committed row needs to come off the books before
-        // the caller emits the original sendPack error.
-        for (const record of committed) {
-            try {
-                await db
-                    .delete(sessionAssetTable)
-                    .where(and(eq(sessionAssetTable.runId, record.runId), eq(sessionAssetTable.mountPath, record.mountPath), eq(sessionAssetTable.assetPackSha, record.assetPackSha), eq(sessionAssetTable.sourceCommitSha, record.sourceCommitSha)));
+        catch (error) {
+            if (restoredPublicKey !== undefined) {
+                sidecarRouter.noteSenderDeploySettled(senderAttempt, restoredPublicKey === null
+                    ? { failed: error instanceof Error ? error.message : String(error) }
+                    : { recorded: restoredPublicKey });
             }
-            catch (err) {
-                logger.warn `session_asset rollback failed for earlier-committed instance=${record.runId} mountPath=${record.mountPath}: ${err instanceof Error ? err.message : String(err)}`;
+            // A sent deploy or cancelled publication may have committed despite its
+            // lost response, as may an unsent rollback. Without a confirmed rollback,
+            // recovery owns transport failures too. Only an uncancelled preparation
+            // failure can settle definitively here.
+            else if (!signal.aborted && !(error instanceof SessionLaunchError)) {
+                sidecarRouter.noteSenderDeploySettled(senderAttempt, {
+                    failed: error instanceof Error ? error.message : String(error),
+                });
             }
+            throw error;
         }
     }
     async function sendAttachmentPack(runId, agentAddress, attachment, allocationTarget) {
@@ -957,77 +1084,32 @@ export function createSessionService(deps) {
             assetPackSha,
             sourceCommitSha,
         };
-        // Reserve the manifest row before the pack send so we never end up in the
-        // materialized-without-manifest state. Only an allocated launch may reuse
-        // an identical row: replacement workers keep the stable instance id and
-        // mount path, while the shared path retains its duplicate-launch guard.
-        const rollbackRecord = allocationTarget === undefined ? record : null;
-        if (allocationTarget === undefined) {
-            await db
-                .insert(sessionAssetTable)
-                .values({ ...record, materializedAt: new Date() });
-        }
-        else {
-            const inserted = await db
-                .insert(sessionAssetTable)
-                .values({ ...record, materializedAt: new Date() })
-                .onConflictDoNothing({
-                target: [sessionAssetTable.runId, sessionAssetTable.mountPath],
-            })
-                .returning({ runId: sessionAssetTable.runId });
-            if (inserted.length === 0) {
-                const existing = await db.query.sessionAsset.findFirst({
-                    where: and(eq(sessionAssetTable.runId, runId), eq(sessionAssetTable.mountPath, mountPath)),
-                    columns: {
-                        assetPackSha: true,
-                        sourceCommitSha: true,
-                    },
-                });
-                if (existing === undefined) {
-                    throw new Error(`session_asset ${runId}/${mountPath} disappeared after its insert conflicted`);
-                }
-                if (existing.assetPackSha !== assetPackSha ||
-                    existing.sourceCommitSha !== sourceCommitSha) {
-                    throw new Error(`session_asset ${runId}/${mountPath} conflicts with the allocated workflow's restored asset`);
-                }
-            }
-        }
-        try {
-            const options = { mountPath, repoId };
-            if (allocationTarget === undefined) {
-                await sidecarRouter.sendPack(agentAddress, pack, ref, sourceCommitSha, options);
-            }
-            else {
-                await requireAllocationRouter().sendPackToAllocation(allocationTarget, agentAddress, pack, ref, sourceCommitSha, options);
+        // Reserve durable recovery intent before the pack send. A replacement
+        // generation may reuse the exact row its predecessor recorded.
+        const inserted = await db
+            .insert(sessionAssetTable)
+            .values({ ...record, materializedAt: new Date() })
+            .onConflictDoNothing({
+            target: [sessionAssetTable.runId, sessionAssetTable.mountPath],
+        })
+            .returning({ runId: sessionAssetTable.runId });
+        if (inserted.length === 0) {
+            const existing = await db.query.sessionAsset.findFirst({
+                where: and(eq(sessionAssetTable.runId, runId), eq(sessionAssetTable.mountPath, mountPath)),
+                columns: {
+                    assetPackSha: true,
+                    sourceCommitSha: true,
+                },
+            });
+            if (existing === undefined) {
+                throw new Error(`session_asset ${runId}/${mountPath} disappeared after its insert conflicted`);
             }
-        }
-        catch (err) {
-            // Shared launches own the row they just created and roll it back when
-            // the send fails. Allocated rows are durable recovery intent: even a row
-            // first inserted by this attempt can already be reused by another
-            // reconciler, so no replacement attempt may delete it.
-            // The forensic value of a manifest-without-materialization row is
-            // negligible because no agent will read against it. Wrap the
-            // rollback in its own try/catch so a rollback failure (DB gone,
-            // connection killed mid-launch) is logged rather than masking the
-            // primary sendPack error — the caller needs to see the original
-            // failure, not the secondary one.
-            if (rollbackRecord !== null) {
-                try {
-                    await db
-                        .delete(sessionAssetTable)
-                        .where(and(eq(sessionAssetTable.runId, rollbackRecord.runId), eq(sessionAssetTable.mountPath, rollbackRecord.mountPath), eq(sessionAssetTable.assetPackSha, rollbackRecord.assetPackSha), eq(sessionAssetTable.sourceCommitSha, rollbackRecord.sourceCommitSha)));
-                }
-                catch (rollbackErr) {
-                    const msg = rollbackErr instanceof Error
-                        ? rollbackErr.message
-                        : String(rollbackErr);
-                    logger.warn `session_asset rollback failed for instance=${runId} mountPath=${mountPath}: ${msg}`;
-                }
+            if (existing.assetPackSha !== assetPackSha ||
+                existing.sourceCommitSha !== sourceCommitSha) {
+                throw new Error(`session_asset ${runId}/${mountPath} conflicts with the allocated workflow's restored asset`);
             }
-            throw err;
         }
-        return rollbackRecord;
+        await requireAllocationRouter().sendPackToAllocation(allocationTarget, agentAddress, pack, ref, sourceCommitSha, { mountPath, repoId });
     }
     /**
      * Build a per-agent `ClosureResolver` from the tenant's visible
@@ -1130,62 +1212,13 @@ export function createSessionService(deps) {
             ref: returnedRef,
         };
     }
-    async function attemptCleanup(agentAddress, failedPhase, originalErr) {
-        try {
-            await sidecarRouter.sendAgentUndeploy(agentAddress, failedPhase);
-        }
-        catch (cleanupErr) {
-            logger.error `Failed to clean up agent ${agentAddress} after ${failedPhase} failure: ${String(cleanupErr)}`;
-            // Preserve the original error as cause so the root cause is not
-            // lost when the cleanup also fails.
-            throw new SessionLaunchError(failedPhase, originalErr, true);
-        }
-    }
-    async function sendUserMessage(params) {
-        const { agentAddress, from, messageId, date, content, attachments, inReplyTo, references, sessionId, tenantId, cryptoProvider, } = params;
-        const headers = {
-            from,
-            to: [agentAddress],
-            cc: undefined,
-            date,
-            messageId,
-            subject: undefined,
-            inReplyTo,
-            references,
-            mimeVersion: "1.0",
-            interchangeType: "conversation.message",
-            interchangeCorrelationId: undefined,
-            interchangeTenantId: tenantId,
-            interchangeAgentId: undefined,
-            interchangeSessionId: sessionId,
-            interchangeOfferingId: undefined,
-            interchangeSchemaVersion: undefined,
-            traceparent: undefined,
-            tracestate: undefined,
-        };
-        const signedContent = assembleSignedContent({
-            kind: "conversation",
-            text: content,
-            ...(attachments !== undefined ? { attachments } : {}),
-        });
-        const signature = await createDetachedSignatureFromProvider(signedContent, cryptoProvider);
-        const rawMessage = assembleMessage(headers, signedContent, signature);
-        const base64 = base64Encode(rawMessage);
-        const delivered = sidecarRouter.routeMail(agentAddress, base64, messageId);
-        if (!delivered) {
-            throw new Error(`Failed to deliver message to ${agentAddress}: agent is unreachable`);
-        }
-        return rawMessage;
-    }
     async function endSession(agentAddress, reason) {
         await sidecarRouter.sendAgentUndeploy(agentAddress, reason);
     }
     return {
         stageWorkflowStep,
-        deployWorkflowFromSource,
         installAndApproveWorkflowSource,
         deployPreparedCodeSourcedWorkflow,
-        sendUserMessage,
         endSession,
     };
 }