@opengeni/core 2.5.3 → 2.6.4-canary.0

package/src/domain/sessions.ts

@@ -2,14 +2,16 @@ import { CODEX_MODEL_ID_PREFIX, isCodexBilledModel } from "@opengeni/codex";
 import {
   canonicalizeConfiguredModelId,
   configuredAllowedModels,
+  WORKSPACE_GATEWAY_MODEL_ID_PREFIX,
+  WORKSPACE_OPENROUTER_MODEL_ID_PREFIX,
   resolveFirstPartyMcpToolPolicy,
   policyProviderIdForModel,
   resolveTurnExecutionPolicyV1,
-  WORKSPACE_GATEWAY_MODEL_ID_PREFIX,
   XAI_SUBSCRIPTION_MODEL_ID_PREFIX,
   type Settings,
 } from "@opengeni/config";
 import {
+  AUTOMATIC_SESSION_TITLE_FALLBACK,
   CreateSessionRequest,
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
   DEFAULT_FIRST_PARTY_MCP_TOOLS,
@@ -20,7 +22,10 @@ import {
   ServiceTurnInitiator,
   ServiceTurnInitiatorContext,
   evaluateWorkspaceModelPolicy,
+  normalizeAutomaticSessionTitle,
   resolveWorkspaceSessionToolDefaults,
+  metadataWithTurnExecutionPolicyV1,
+  readTurnExecutionPolicyV1,
   stableJson,
   type AccessGrant,
   type ComposerDraft,
@@ -60,6 +65,7 @@ import {
 import {
   createSession,
   createSessionWithIdempotencyKeyResult,
+  canonicalSessionCommandHash,
   encryptVariableSetValue,
   getAnySessionInGroup,
   getEnrollment,
@@ -70,10 +76,10 @@ import {
   listDistinctRigVersionIdsInGroup,
   getSandbox,
   getSession,
+  getInitializedSessionCreateReplay,
   getSessionAuthorityProjection,
   SessionIdConflictError,
   NewSessionDraftConflictError,
-  getSessionSpawnDenialByIdempotencyKey,
   getWorkspaceControlEvent,
   getSessionLineage,
   getSessionTurn,
@@ -85,7 +91,10 @@ import {
   initializeSessionStartAtomically,
   listSessionTurns,
   listSessionMcpServersForChildInheritance,
+  lockActiveWorkspaceGatewayCustomModelForAdmission,
+  lockActiveWorkspaceOpenRouterCustomModelForAdmission,
   requireSession,
+  replaySubmittedHumanPromptFromBoundaryReceipt,
   submitHumanPromptInTransaction,
   appendSessionEventsWithLockedSessionUpdate,
   updateSessionTitleWithEvent,
@@ -126,6 +135,12 @@ import {
   SessionAuthorizationDeniedError,
 } from "../session-authorization";
 import { swapActiveSandbox, type FleetContext } from "../sandbox/fleet";
+import { managedSessionGroupBackend } from "../sandbox/runtime-settings";
+import {
+  isWorkspaceCustomModelId,
+  resolveWorkspaceCatalogSettings,
+  workspaceCustomModelReference,
+} from "../model-catalog";
 import { settingsWithEnabledCapabilityMcpServers } from "./capabilities";
 import { validateSubmittedTimelineAnnotations } from "./timeline-annotations";
 import { requireVariableSetEncryption, validateVariableSetAttachment } from "./environments";
@@ -607,6 +622,44 @@ export type CreateSessionRequestOutcome = CreateSessionOutcome & {
   usageRecording: "recorded" | "failed";
 };
 
+type AgentChildSessionCreatePresentation = {
+  /** Model-authored title candidate from the first-party `session_create` tool.
+   * This is deliberately separate from the public REST request contract. */
+  automaticTitleCandidate?: string | null;
+};
+
+const AGENT_CHILD_AUTOMATIC_TITLE_CONTEXT_KEY = "agentChildAutomaticTitle" as const;
+
+/** @internal Exported for the keyed-create repair regression. */
+export function freezeAgentChildAutomaticTitleInCreatorContext(
+  context: TurnInitiatorContext | undefined,
+  title: string | null | undefined,
+): TurnInitiatorContext | undefined {
+  return title ? { ...(context ?? {}), [AGENT_CHILD_AUTOMATIC_TITLE_CONTEXT_KEY]: title } : context;
+}
+
+/** @internal Keyed repair must use the committed winner, not the retry payload. */
+export function initialAutomaticTitleForSessionStart(
+  session: Pick<Session, "createdByContext">,
+  requestedTitle: string | null | undefined,
+): string | null {
+  const frozenTitle = session.createdByContext[AGENT_CHILD_AUTOMATIC_TITLE_CONTEXT_KEY];
+  return typeof frozenTitle === "string" ? frozenTitle : (requestedTitle ?? null);
+}
+
+function automaticTitleForAgentChildCreate(
+  presentation: AgentChildSessionCreatePresentation,
+  goal: GoalSpec | null | undefined,
+  initialMessage: string | null | undefined,
+): string | null {
+  for (const candidate of [presentation.automaticTitleCandidate, goal?.text, initialMessage]) {
+    if (typeof candidate !== "string") continue;
+    const normalized = normalizeAutomaticSessionTitle(candidate);
+    if (normalized && normalized !== AUTOMATIC_SESSION_TITLE_FALLBACK) return normalized;
+  }
+  return null;
+}
+
 export async function createAndStartSessionWithOutcome(input: {
   requestedSessionId?: string;
   db: Database;
@@ -615,6 +668,16 @@ export async function createAndStartSessionWithOutcome(input: {
   /** Internal database-only composition seam. The exact session shell and this
    * linkage commit together before its first event/turn can be initialized. */
   beforeCreateCommit?: (tx: Database, sessionId: string) => Promise<void>;
+  /** The custom workspace model was frozen by an earlier accepted boundary or
+   * inherited from an existing session, so retirement must not invalidate it. */
+  retainWorkspaceGatewayModel?: boolean;
+  /** Provider-neutral successor to retainWorkspaceGatewayModel. */
+  retainWorkspaceCustomModel?: boolean;
+  /** The selected workspace Gateway product is backed by a mutable custom row,
+   * rather than deployment-curated Gateway membership. */
+  workspaceGatewayCustomModel?: boolean;
+  /** Provider-neutral successor to workspaceGatewayCustomModel. */
+  workspaceCustomModel?: boolean;
   accountId: string;
   workspaceId: string;
   visibility?: "user_private" | "workspace_shared";
@@ -652,6 +715,9 @@ export async function createAndStartSessionWithOutcome(input: {
   // resolved workspace-scoped by the caller). Null/omitted ⇒ unfiled (inbox).
   channelId?: string | null;
   goal?: GoalSpec | null;
+  /** Trusted sensitive-safe automatic title for an agent-created child. The
+   * atomic initializer commits the row mutation and `session.title_set`. */
+  initialAutomaticTitle?: string | null;
   // Per-session agent persona/system instructions (org-visible metadata, not a
   // secret). Persisted on the session row and composed system-level AFTER the
   // workspace agentInstructions at turn time; never emitted as a timeline event.
@@ -731,12 +797,56 @@ export async function createAndStartSessionWithOutcome(input: {
   allowNestedAgentDepthIncrease?: boolean;
   subjectId?: string | null;
 }): Promise<CreateSessionOutcome> {
-  const sessionMetadata = {
-    ...input.metadata,
-    model: input.model,
-    reasoningEffort: input.reasoningEffort,
-    ...(input.latencyMode !== undefined ? { latencyMode: input.latencyMode } : {}),
-  };
+  const sessionMetadata = metadataWithTurnExecutionPolicyV1(
+    {
+      ...input.metadata,
+      model: input.model,
+      reasoningEffort: input.reasoningEffort,
+      ...(input.latencyMode !== undefined ? { latencyMode: input.latencyMode } : {}),
+    },
+    input.turnExecutionPolicy,
+  );
+  const frozenCreatedByContext = freezeAgentChildAutomaticTitleInCreatorContext(
+    input.createdByContext,
+    input.initialAutomaticTitle,
+  );
+  const requiresActiveWorkspaceCustomModel =
+    (input.workspaceCustomModel === true || input.workspaceGatewayCustomModel === true) &&
+    input.retainWorkspaceCustomModel !== true &&
+    input.retainWorkspaceGatewayModel !== true;
+  const beforeCreateCommit =
+    requiresActiveWorkspaceCustomModel || input.beforeCreateCommit
+      ? async (tx: Database, sessionId: string, context?: { created: boolean }): Promise<void> => {
+          // A committed keyed replay already crossed this fence when its shell
+          // was first accepted. Revalidate only the transaction inserting a new
+          // session, while still running caller linkage on every replay.
+          if (requiresActiveWorkspaceCustomModel && context?.created !== false) {
+            const openRouter = input.model.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX);
+            const upstreamModelId = input.model.slice(
+              openRouter
+                ? WORKSPACE_OPENROUTER_MODEL_ID_PREFIX.length
+                : WORKSPACE_GATEWAY_MODEL_ID_PREFIX.length,
+            );
+            const active = openRouter
+              ? await lockActiveWorkspaceOpenRouterCustomModelForAdmission(tx, {
+                  accountId: input.accountId,
+                  workspaceId: input.workspaceId,
+                  upstreamModelId,
+                })
+              : await lockActiveWorkspaceGatewayCustomModelForAdmission(tx, {
+                  accountId: input.accountId,
+                  workspaceId: input.workspaceId,
+                  upstreamModelId,
+                });
+            if (!active) {
+              throw new HTTPException(422, {
+                message: `model is not available: ${input.model}`,
+              });
+            }
+          }
+          await input.beforeCreateCommit?.(tx, sessionId);
+        }
+      : undefined;
   // Keyed creation is intentionally handled only by the database admission
   // transaction below. Its workspace/key lock replays either the successful
   // session or the committed denial atomically; an application-side lookup
@@ -755,7 +865,7 @@ export async function createAndStartSessionWithOutcome(input: {
       toolPolicy: input.toolPolicy,
       metadata: sessionMetadata,
       ...(input.createdBy ? { createdBy: input.createdBy } : {}),
-      ...(input.createdByContext ? { createdByContext: input.createdByContext } : {}),
+      ...(frozenCreatedByContext ? { createdByContext: frozenCreatedByContext } : {}),
       createdByActor: input.createdByActor ?? null,
       model: input.model,
       reasoningEffort: input.reasoningEffort,
@@ -786,15 +896,29 @@ export async function createAndStartSessionWithOutcome(input: {
       maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,
       allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,
       subjectId: input.subjectId ?? null,
-      ...(input.beforeCreateCommit ? { beforeCreateCommit: input.beforeCreateCommit } : {}),
+      ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
     });
     if (keyedResult.denied) {
       throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(keyedResult.denial));
     }
     const { session: keyed, created } = keyedResult;
     if (!created) {
+      const persistedPolicy = readTurnExecutionPolicyV1(keyed.metadata);
       const finished = await finishStartSession(
-        keyed.temporalWorkflowId ? { ...input, seedTargetSandbox: null } : input,
+        keyed.temporalWorkflowId
+          ? {
+              ...input,
+              seedTargetSandbox: null,
+              ...(persistedPolicy.kind === "valid"
+                ? { turnExecutionPolicy: persistedPolicy.policy }
+                : {}),
+            }
+          : {
+              ...input,
+              ...(persistedPolicy.kind === "valid"
+                ? { turnExecutionPolicy: persistedPolicy.policy }
+                : {}),
+            },
         keyed,
       );
       return {
@@ -827,7 +951,7 @@ export async function createAndStartSessionWithOutcome(input: {
       toolPolicy: input.toolPolicy,
       metadata: sessionMetadata,
       ...(input.createdBy ? { createdBy: input.createdBy } : {}),
-      ...(input.createdByContext ? { createdByContext: input.createdByContext } : {}),
+      ...(frozenCreatedByContext ? { createdByContext: frozenCreatedByContext } : {}),
       createdByActor: input.createdByActor ?? null,
       model: input.model,
       reasoningEffort: input.reasoningEffort,
@@ -857,7 +981,7 @@ export async function createAndStartSessionWithOutcome(input: {
       maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,
       allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,
       subjectId: input.subjectId ?? null,
-      ...(input.beforeCreateCommit ? { beforeCreateCommit: input.beforeCreateCommit } : {}),
+      ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
     });
   } catch (error) {
     if (error instanceof SessionSpawnDeniedDbError) {
@@ -905,6 +1029,7 @@ async function finishStartSession(
     sandboxBackend: Settings["sandboxBackend"];
     variableSets?: Array<{ id: string; name: string; scope: VariableSet["scope"] }>;
     goal?: GoalSpec | null;
+    initialAutomaticTitle?: string | null;
     sessionMcpServers?: SessionMcpServerMetadata[];
     seedTargetSandbox?: {
       sandboxId: string;
@@ -1009,6 +1134,10 @@ async function finishStartSession(
             : {}),
         }
       : null,
+    initialAutomaticTitle: initialAutomaticTitleForSessionStart(
+      session,
+      input.initialAutomaticTitle,
+    ),
     consumeNewSessionDraft: input.consumeNewSessionDraft ?? null,
     rememberNewSessionSelection: input.rememberNewSessionSelection ?? null,
     deferInitialTurn: input.deferInitialTurn === true,
@@ -1084,9 +1213,6 @@ export function canonicalConfiguredModel(
   ) {
     return canonicalModel;
   }
-  if (canonicalModel.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX)) {
-    return canonicalModel;
-  }
   throw new HTTPException(422, { message: `model is not available: ${model}` });
 }
 
@@ -1192,7 +1318,17 @@ export async function requireQueuedTurnForApi(
  * `session_send_message` tool so the two surfaces cannot drift. Callers own
  * resource/tool validation and the per-message usage limit before calling.
  */
-export async function postUserMessageTurn(input: {
+type PostUserMessageTurnResult = {
+  accepted: SessionEvent;
+  turn: SessionTurn;
+  draft: ComposerDraft | null;
+  receipt: SessionCommandReceipt;
+  routing: SessionPromptRouting;
+  interruptionCount: number;
+  replay: boolean;
+};
+
+type PostUserMessageTurnInput = {
   db: Database;
   bus: EventBus;
   workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
@@ -1220,28 +1356,143 @@ export async function postUserMessageTurn(input: {
   commandActor?: SessionCommandActor;
   controlEtag?: string | null;
   expectedDraftRevision?: number | null;
+  boundaryRequestHash?: string;
   reasoningEffortFallback?: Settings["openaiReasoningEffort"];
   turnExecutionPolicy: TurnExecutionPolicyV1;
   recordAgentRunUsage?: boolean;
   schedulePostCommit?: (task: () => Promise<void>) => void;
-}): Promise<{
-  accepted: SessionEvent;
-  turn: SessionTurn;
-  draft: ComposerDraft | null;
-  receipt: SessionCommandReceipt;
-  routing: SessionPromptRouting;
-  interruptionCount: number;
-  replay: boolean;
-}> {
-  const { db, bus, workflowClient, settings, accountId, workspaceId, sessionId } = input;
+};
+
+function finalizePostUserMessageTurn(
+  input: Pick<
+    PostUserMessageTurnInput,
+    | "db"
+    | "bus"
+    | "workflowClient"
+    | "accountId"
+    | "workspaceId"
+    | "sessionId"
+    | "delivery"
+    | "schedulePostCommit"
+  >,
+  result: Awaited<ReturnType<typeof submitHumanPromptInTransaction>>,
+): PostUserMessageTurnResult {
+  const { db, bus, workflowClient, accountId, workspaceId, sessionId } = input;
+  const postCommitTask = async () => {
+    await Promise.all([
+      (async () => {
+        try {
+          await publishDurableSessionEvents(bus, workspaceId, sessionId, result.events);
+          if (result.workspaceControlEventId) {
+            const controlEvent = await getWorkspaceControlEvent(
+              db,
+              workspaceId,
+              result.workspaceControlEventId,
+            );
+            if (!controlEvent) {
+              throw new Error(
+                `Committed workspace control event disappeared: ${result.workspaceControlEventId}`,
+              );
+            }
+            await publishDurableWorkspaceControlEvent(bus, workspaceId, controlEvent);
+          }
+        } catch {
+          console.warn("[sessions] prompt event fanout failed; durable rows remain replayable", {
+            errorClass: "PromptEventFanoutOperationError",
+            errorCode: "session_prompt_event_fanout_failed",
+            origin: "core",
+          });
+        }
+      })(),
+      (async () => {
+        try {
+          await workflowClient.wakeSessionWorkflow({
+            accountId,
+            workspaceId,
+            sessionId,
+            workflowId: result.turn.temporalWorkflowId,
+            wakeRevision: result.wakeRevision,
+            ...((input.delivery ?? "send") === "steer" || result.interruptionCount > 0
+              ? { interruptionRequested: true }
+              : {}),
+          });
+        } catch {
+          console.warn("[sessions] workflow wake failed; durable outbox will retry", {
+            errorClass: "WorkflowWakeOperationError",
+            errorCode: "session_workflow_wake_failed",
+            origin: "core",
+          });
+        }
+      })(),
+    ]);
+  };
+  const schedulePostCommit =
+    input.schedulePostCommit ??
+    ((task: () => Promise<void>) => {
+      void task();
+    });
+  try {
+    schedulePostCommit(postCommitTask);
+  } catch {
+    console.warn("[sessions] prompt post-commit scheduling failed; durable recovery remains", {
+      errorClass: "PromptPostCommitScheduleError",
+      errorCode: "session_prompt_post_commit_schedule_failed",
+      origin: "core",
+    });
+  }
+  return {
+    accepted: result.accepted,
+    turn: result.turn,
+    receipt: {
+      id: result.receipt.id,
+      action: result.receipt.action,
+      operationKey: result.receipt.operationKey,
+      targetSessionId: result.receipt.targetSessionId,
+      targetTurnId: result.receipt.targetTurnId,
+      appliedControlRevision: result.receipt.appliedControlRevision,
+      appliedQueueVersion: result.receipt.appliedQueueVersion,
+      appliedTurnVersion: result.receipt.appliedTurnVersion,
+      appliedDraftRevision: result.receipt.appliedDraftRevision,
+      createdAt: result.receipt.createdAt.toISOString(),
+    },
+    routing: result.routing,
+    draft: result.draft
+      ? {
+          revision: result.draft.revision,
+          text: result.draft.text,
+          annotations: DraftTimelineAnnotations.parse(result.draft.annotations),
+          resources: result.draft.resources as ResourceRef[],
+          model: result.draft.model,
+          reasoningEffort: result.draft.reasoningEffort as ReasoningEffort,
+          latencyMode: result.draft.latencyMode as ComposerDraft["latencyMode"],
+          sourceTurnId: result.draft.sourceTurnId,
+          sourceTurnVersion: result.draft.sourceTurnVersion,
+          updatedAt: result.draft.updatedAt.toISOString(),
+        }
+      : null,
+    interruptionCount: result.interruptionCount,
+    replay: result.replay,
+  };
+}
+
+export async function postUserMessageTurn(
+  input: PostUserMessageTurnInput,
+): Promise<PostUserMessageTurnResult> {
+  const { db, settings, accountId, workspaceId, sessionId } = input;
   const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
   const requestedReasoningEffort = input.reasoningEffort ?? null;
   // Reject an explicit per-message model the host does not expose; an omitted
   // model inherits the session's model downstream (always a configured id).
   assertConfiguredModel(settings, requestedModel);
-  await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, requestedModel);
   const sessionForModelGate = await requireSession(db, workspaceId, sessionId);
   const effectiveModelForGate = requestedModel ?? sessionForModelGate.model;
+  const freshWorkspaceCustomModel =
+    requestedModel !== null &&
+    isWorkspaceCustomModelId(settings, requestedModel) &&
+    requestedModel !== sessionForModelGate.model
+      ? requestedModel
+      : null;
+  await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, effectiveModelForGate);
   try {
     assertSessionAllowsProductModel(sessionForModelGate, effectiveModelForGate);
   } catch (error) {
@@ -1276,6 +1527,9 @@ export async function postUserMessageTurn(input: {
                 subjectId: input.actor ?? accountId,
               },
               operationKey,
+              ...(input.boundaryRequestHash
+                ? { boundaryRequestHash: input.boundaryRequestHash }
+                : {}),
               delivery: input.delivery ?? "send",
               controlEtag: input.controlEtag ?? null,
               expectedDraftRevision: input.expectedDraftRevision ?? null,
@@ -1303,6 +1557,36 @@ export async function postUserMessageTurn(input: {
                   }
                 : {}),
               mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],
+              ...(freshWorkspaceCustomModel
+                ? {
+                    beforeFreshPromptCommit: async (tx: Database): Promise<void> => {
+                      const reference = workspaceCustomModelReference(
+                        settings,
+                        freshWorkspaceCustomModel,
+                      );
+                      if (!reference) {
+                        throw new Error("workspace custom model reference disappeared");
+                      }
+                      const active =
+                        reference.providerKind === "openrouter"
+                          ? await lockActiveWorkspaceOpenRouterCustomModelForAdmission(tx, {
+                              accountId,
+                              workspaceId,
+                              upstreamModelId: reference.upstreamModelId,
+                            })
+                          : await lockActiveWorkspaceGatewayCustomModelForAdmission(tx, {
+                              accountId,
+                              workspaceId,
+                              upstreamModelId: reference.upstreamModelId,
+                            });
+                      if (!active) {
+                        throw new HTTPException(422, {
+                          message: `model is not available: ${freshWorkspaceCustomModel}`,
+                        });
+                      }
+                    },
+                  }
+                : {}),
               controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs(),
             }),
         ),
@@ -1333,101 +1617,7 @@ export async function postUserMessageTurn(input: {
     }
     throw error;
   }
-  const postCommitTask = async () => {
-    await Promise.all([
-      (async () => {
-        try {
-          await publishDurableSessionEvents(bus, workspaceId, sessionId, result.events);
-          if (result.workspaceControlEventId) {
-            const controlEvent = await getWorkspaceControlEvent(
-              db,
-              workspaceId,
-              result.workspaceControlEventId,
-            );
-            if (!controlEvent) {
-              throw new Error(
-                `Committed workspace control event disappeared: ${result.workspaceControlEventId}`,
-              );
-            }
-            await publishDurableWorkspaceControlEvent(bus, workspaceId, controlEvent);
-          }
-        } catch {
-          console.warn("[sessions] prompt event fanout failed; durable rows remain replayable", {
-            errorClass: "PromptEventFanoutOperationError",
-            errorCode: "session_prompt_event_fanout_failed",
-            origin: "core",
-          });
-        }
-      })(),
-      (async () => {
-        try {
-          await workflowClient.wakeSessionWorkflow({
-            accountId,
-            workspaceId,
-            sessionId,
-            workflowId: result.turn.temporalWorkflowId,
-            wakeRevision: result.wakeRevision,
-            ...((input.delivery ?? "send") === "steer" || result.interruptionCount > 0
-              ? { interruptionRequested: true }
-              : {}),
-          });
-        } catch {
-          console.warn("[sessions] workflow wake failed; durable outbox will retry", {
-            errorClass: "WorkflowWakeOperationError",
-            errorCode: "session_workflow_wake_failed",
-            origin: "core",
-          });
-        }
-      })(),
-    ]);
-  };
-  const schedulePostCommit =
-    input.schedulePostCommit ??
-    ((task: () => Promise<void>) => {
-      void task();
-    });
-  try {
-    schedulePostCommit(postCommitTask);
-  } catch {
-    console.warn("[sessions] prompt post-commit scheduling failed; durable recovery remains", {
-      errorClass: "PromptPostCommitScheduleError",
-      errorCode: "session_prompt_post_commit_schedule_failed",
-      origin: "core",
-    });
-  }
-  return {
-    accepted: result.accepted,
-    turn: result.turn,
-    receipt: {
-      id: result.receipt.id,
-      action: result.receipt.action,
-      operationKey: result.receipt.operationKey,
-      targetSessionId: result.receipt.targetSessionId,
-      targetTurnId: result.receipt.targetTurnId,
-      appliedControlRevision: result.receipt.appliedControlRevision,
-      appliedQueueVersion: result.receipt.appliedQueueVersion,
-      appliedTurnVersion: result.receipt.appliedTurnVersion,
-      appliedDraftRevision: result.receipt.appliedDraftRevision,
-      createdAt: result.receipt.createdAt.toISOString(),
-    },
-    routing: result.routing,
-    draft: result.draft
-      ? {
-          revision: result.draft.revision,
-          text: result.draft.text,
-          annotations: DraftTimelineAnnotations.parse(result.draft.annotations),
-          resources: result.draft.resources as ResourceRef[],
-          model: result.draft.model,
-          reasoningEffort: result.draft.reasoningEffort as ReasoningEffort,
-          latencyMode: result.draft.latencyMode as ComposerDraft["latencyMode"],
-          sourceTurnId: result.draft.sourceTurnId,
-          sourceTurnVersion: result.draft.sourceTurnVersion,
-          updatedAt: result.draft.updatedAt.toISOString(),
-        }
-      : null,
-    interruptionCount: result.interruptionCount,
-    replay: result.replay,
-  };
+  return finalizePostUserMessageTurn(input, result);
 }
 
 /**
@@ -1479,15 +1669,92 @@ export function resolveSessionCreateVisibility(input: {
   return input.requestedVisibility === "private" ? "user_private" : "workspace_shared";
 }
 
-export async function createSessionForRequestWithOutcome(
-  deps: ApiRouteDeps,
+async function resolveWorkspaceModelBoundarySettings(
+  deps: Pick<ApiRouteDeps, "db" | "settings" | "catalogSourceSettings">,
   grant: AccessGrant,
   workspaceId: string,
-  rawPayload: unknown,
-  authorization?: AccessGrantAuthorization,
-): Promise<CreateSessionRequestOutcome> {
-  const { settings, db, bus, workflowClient, objectStorage } = deps;
-  const payload = CreateSessionRequest.parse(rawPayload);
+  modelIds: readonly (string | null | undefined)[],
+  retainedProductModelId?: string | null,
+): Promise<Settings> {
+  const retainedWorkspaceModel =
+    retainedProductModelId?.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX) === true ||
+    retainedProductModelId?.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX) === true;
+  if (deps.catalogSourceSettings) {
+    // The adapter already resolved one exact workspace catalog snapshot for
+    // this request. Preserve it for fresh selections, but an existing session
+    // may name a retired custom model that the active-only adapter snapshot
+    // intentionally omitted. Re-open only the unoverlaid source for that
+    // retention lookup; never feed the synthetic workspace provider back
+    // through deployment validation.
+    if (!retainedWorkspaceModel) return deps.settings;
+  }
+  const workspaceModelIds = modelIds.filter(
+    (modelId): modelId is string =>
+      typeof modelId === "string" &&
+      (modelId.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX) ||
+        modelId.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX)),
+  );
+  const needsWorkspaceResolution =
+    deps.settings.modelCatalogSource === "database" || workspaceModelIds.length > 0;
+  if (!needsWorkspaceResolution) return deps.settings;
+  return (
+    await resolveWorkspaceCatalogSettings(deps.db, deps.catalogSourceSettings ?? deps.settings, {
+      accountId: grant.accountId,
+      workspaceId,
+      ...(retainedProductModelId !== undefined ? { retainedProductModelId } : {}),
+    })
+  ).settings;
+}
+
+async function withSessionCreateUsageRecording(input: {
+  deps: ApiRouteDeps;
+  grant: AccessGrant;
+  workspaceId: string;
+  startMode: "realtime" | undefined;
+  origin: "system" | "user";
+  createOutcome: CreateSessionOutcome;
+}): Promise<CreateSessionRequestOutcome> {
+  let usageRecording: CreateSessionRequestOutcome["usageRecording"] = "recorded";
+  if (input.startMode !== "realtime") {
+    try {
+      await recordWorkspaceUsage(input.deps, {
+        accountId: input.grant.accountId,
+        workspaceId: input.workspaceId,
+        subjectId: input.grant.subjectId,
+        eventType: "agent_run.created",
+        quantity: 1,
+        unit: "run",
+        sourceResourceType: "session",
+        sourceResourceId: input.createOutcome.session.id,
+        sessionId: input.createOutcome.session.id,
+        initiator: input.createOutcome.session.createdBy,
+        initiatorContext: input.createOutcome.session.createdByContext,
+        origin: input.origin,
+        idempotencyKey: `agent_run.created:${input.workspaceId}:${input.createOutcome.session.id}`,
+      });
+    } catch (error) {
+      usageRecording = "failed";
+      reportSessionUsageRecordingFailure(error);
+    }
+  }
+  return { ...input.createOutcome, usageRecording };
+}
+
+export async function createSessionForRequestWithOutcome(
+  unresolvedDeps: ApiRouteDeps,
+  grant: AccessGrant,
+  workspaceId: string,
+  rawPayload: unknown,
+  authorization?: AccessGrantAuthorization,
+  agentChildPresentation?: AgentChildSessionCreatePresentation,
+): Promise<CreateSessionRequestOutcome> {
+  const payload = CreateSessionRequest.parse(rawPayload);
+  if (hasReservedOpenGeniSlackBotSessionMetadata(payload.metadata)) {
+    throw new HTTPException(422, {
+      message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY} is reserved for scheduler routing`,
+    });
+  }
+  const db = unresolvedDeps.db;
   const visibilityProvided = hasOwnProperty(rawPayload, "visibility");
   if (payload.visibility === "private" && !grant.metadata?.["sessionId"]) {
     if (!authorization) {
@@ -1495,39 +1762,13 @@ export async function createSessionForRequestWithOutcome(
         message: "managed human session required",
       });
     }
-    await requireManagedHumanPrivateSessionCreate(deps, authorization, workspaceId);
+    await requireManagedHumanPrivateSessionCreate(unresolvedDeps, authorization, workspaceId);
     if (payload.sandbox === "shared" || typeof payload.sandbox === "object") {
       throw new HTTPException(422, {
         message: "Only-me sessions require their own sandbox",
       });
     }
   }
-  if (hasReservedOpenGeniSlackBotSessionMetadata(payload.metadata)) {
-    throw new HTTPException(422, {
-      message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY} is reserved for scheduler routing`,
-    });
-  }
-  // A committed keyed denial is the idempotent outcome even if mutable
-  // resources, policy, authorization, or budget have changed since the first
-  // attempt. Replay it before any of those checks, just as a keyed successful
-  // session is returned rather than recreated later in createAndStartSession.
-  if (payload.idempotencyKey) {
-    const denial = await getSessionSpawnDenialByIdempotencyKey(
-      db,
-      workspaceId,
-      payload.idempotencyKey,
-    );
-    if (denial) {
-      throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(denial));
-    }
-  }
-  await requireAtomicPersonalResourceAttachment(
-    deps,
-    authorization,
-    workspaceId,
-    payload.personalResourceAttachment,
-    false,
-  );
   // Parent linkage and execution-context inheritance come ONLY from the
   // worker-signed sessionId claim. A caller cannot nominate a parent in the
   // payload, so inheriting an existing repository/tool/credential snapshot does
@@ -1538,7 +1779,7 @@ export async function createSessionForRequestWithOutcome(
       : null;
   if (parentSessionId) {
     try {
-      await requireSessionAuthorization(deps, grant, {
+      await requireSessionAuthorization(unresolvedDeps, grant, {
         sessionId: parentSessionId,
         operation: "session.child.create",
         surface: "core",
@@ -1596,6 +1837,117 @@ export async function createSessionForRequestWithOutcome(
       message: "caller attempt does not belong to the parent session",
     });
   }
+  const replayManagedHumanSubjectId = creationInitiator.actor
+    ? (parentCallingTurn?.initiatingHumanSubjectId ??
+      (parentCallingTurn?.initiator.kind === "subject"
+        ? parentCallingTurn.initiator.subjectId
+        : null))
+    : authorization?.canonicalManagedHumanSession || grant.principalKind === "human_session"
+      ? grant.subjectId
+      : null;
+  let retainedKeyedShellModel: string | null = null;
+  if (
+    payload.idempotencyKey &&
+    (effectiveVisibility !== "user_private" || replayManagedHumanSubjectId !== null)
+  ) {
+    try {
+      const initializedReplay = await getInitializedSessionCreateReplay(db, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: replayManagedHumanSubjectId ?? grant.subjectId,
+        ...(replayManagedHumanSubjectId
+          ? { activeManagedHumanSubjectId: replayManagedHumanSubjectId }
+          : {}),
+        createIdempotencyKey: payload.idempotencyKey,
+        ...(payload.requestedSessionId ? { requestedSessionId: payload.requestedSessionId } : {}),
+        visibility: effectiveVisibility,
+        variableSetIds: payload.variableSetIds ?? [],
+        initialPersonalResourceAttachmentIntent: payload.personalResourceAttachment ?? null,
+        deferInitialTurn: payload.startMode === "realtime",
+      });
+      if (initializedReplay) {
+        if (initializedReplay.outcome === "denied") {
+          throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(initializedReplay.denial));
+        }
+        if (initializedReplay.outcome === "pending") {
+          retainedKeyedShellModel = initializedReplay.session.model;
+        } else {
+          if (initializedReplay.workflowWakeRevision !== null) {
+            await unresolvedDeps.workflowClient.wakeSessionWorkflow({
+              accountId: grant.accountId,
+              workspaceId,
+              sessionId: initializedReplay.session.id,
+              workflowId: initializedReplay.temporalWorkflowId,
+              wakeRevision: initializedReplay.workflowWakeRevision,
+            });
+          }
+          return await withSessionCreateUsageRecording({
+            deps: unresolvedDeps,
+            grant,
+            workspaceId,
+            startMode: payload.startMode,
+            origin: creationInitiator.actor ? "system" : "user",
+            createOutcome: {
+              session: initializedReplay.session,
+              outcome: initializedReplay.changed ? "repaired" : "replayed",
+              replay: !initializedReplay.changed,
+              changed: initializedReplay.changed,
+            },
+          });
+        }
+      }
+    } catch (error) {
+      if (error instanceof SessionIdConflictError) {
+        throw new HTTPException(409, {
+          message: "requested session id is already in use",
+        });
+      }
+      if (error instanceof SessionCreateIdempotencyConflictError) {
+        throw new HTTPException(409, { message: error.message, cause: error });
+      }
+      throw error;
+    }
+  }
+  let settings = await resolveWorkspaceModelBoundarySettings(
+    unresolvedDeps,
+    grant,
+    workspaceId,
+    [payload.model],
+    retainedKeyedShellModel,
+  );
+  let deps =
+    settings === unresolvedDeps.settings
+      ? unresolvedDeps
+      : {
+          ...unresolvedDeps,
+          catalogSourceSettings: unresolvedDeps.catalogSourceSettings ?? unresolvedDeps.settings,
+          settings,
+        };
+  const { bus, workflowClient, objectStorage } = deps;
+  await requireAtomicPersonalResourceAttachment(
+    deps,
+    authorization,
+    workspaceId,
+    payload.personalResourceAttachment,
+    false,
+  );
+  const inheritedModel = parentCallingTurn?.model ?? parentSession?.model ?? settings.openaiModel;
+  const effectiveModelId = payload.model ?? inheritedModel;
+  const effectiveCatalogSettings = await resolveWorkspaceModelBoundarySettings(
+    deps,
+    grant,
+    workspaceId,
+    [effectiveModelId],
+    parentSession ? inheritedModel : null,
+  );
+  if (effectiveCatalogSettings !== settings) {
+    deps = {
+      ...deps,
+      catalogSourceSettings: deps.catalogSourceSettings ?? settings,
+      settings: effectiveCatalogSettings,
+    };
+    settings = effectiveCatalogSettings;
+  }
   let effectiveGoal = payload.goal;
   if (parentSession && payload.goal) {
     try {
@@ -1612,6 +1964,14 @@ export async function createSessionForRequestWithOutcome(
       });
     }
   }
+  const initialAutomaticTitle =
+    parentSession && agentChildPresentation
+      ? automaticTitleForAgentChildCreate(
+          agentChildPresentation,
+          effectiveGoal,
+          payload.initialMessage,
+        )
+      : null;
   const personalResourceSubjectId = creationInitiator.actor
     ? (await requireLiveAgentAttemptAuthorization(db, grant, creationInitiator.actor.sessionId))
         .initiatingHumanSubjectId
@@ -1798,8 +2158,7 @@ export async function createSessionForRequestWithOutcome(
   // managers: falling back to the deployment model would silently move a child
   // onto the OpenGeni-credits billing path. Legacy session-bound grants without
   // exact attempt claims fall back to the parent session's persisted defaults.
-  const inheritedModel = parentCallingTurn?.model ?? parentSession?.model ?? settings.openaiModel;
-  const model = canonicalConfiguredModel(settings, payload.model ?? inheritedModel);
+  const model = canonicalConfiguredModel(settings, effectiveModelId);
   if (model === null || model === undefined) {
     throw new Error("effective session model unexpectedly resolved to null");
   }
@@ -2038,6 +2397,8 @@ export async function createSessionForRequestWithOutcome(
     payload.sandbox ?? (payload.targetSandboxId ? "new" : parentSessionId ? "shared" : "new");
   let sandboxGroupId: string | null = null;
   let inheritedBackend: Session["sandboxBackend"] | undefined;
+  let inheritedSandboxOs: Session["sandboxOs"] | undefined;
+  let inheritedActiveTarget: { sandboxId: string; workingDir: string | null } | null = null;
   // ENV-AWARE GROUPING: under the CURRENT mechanics the workspace VariableSet is
   // creation-time box state — the box's manifest env is fixed when it is cold-
   // created, and the SDK's provided-session guard rejects any manifest-env delta
@@ -2112,6 +2473,17 @@ export async function createSessionForRequestWithOutcome(
     } else {
       sandboxGroupId = parent.sandboxGroupId;
       inheritedBackend = parent.sandboxBackend;
+      inheritedSandboxOs = parent.sandboxOs;
+      // A Connected Machine route is session-local even when two sessions share
+      // one logical sandbox group. Copy the trusted parent's exact active route
+      // so an omitted child sandbox really does share the creator's current box
+      // instead of creating a selfhosted row with no bound agent.
+      inheritedActiveTarget = parent.activeSandboxId
+        ? {
+            sandboxId: parent.activeSandboxId,
+            workingDir: parent.workingDir,
+          }
+        : null;
     }
   } else if (typeof sandboxChoice === "object") {
     const member = await getAnySessionInGroup(db, workspaceId, sandboxChoice.groupId);
@@ -2160,6 +2532,7 @@ export async function createSessionForRequestWithOutcome(
     }
     sandboxGroupId = sandboxChoice.groupId;
     inheritedBackend = member.sandboxBackend;
+    inheritedSandboxOs = member.sandboxOs;
   }
   // else "new": leave sandboxGroupId null → own singleton group (group ≡ id).
   // A working dir is only meaningful for a TARGETED machine (it is the chosen
@@ -2172,6 +2545,19 @@ export async function createSessionForRequestWithOutcome(
         "workingDir requires targetSandboxId (it is the targeted machine's working directory)",
     });
   }
+  // A registry-built selfhosted client is deliberately inert: it has no live
+  // agent identity until a concrete Connected Machine is named. Reject an own
+  // targetless home before persisting a session whose first turn can only fail.
+  // Shared children retain their already-bound group through inheritedBackend.
+  if (
+    inheritedBackend === undefined &&
+    !payload.targetSandboxId &&
+    (payload.sandboxBackend ?? settings.sandboxBackend) === "selfhosted"
+  ) {
+    throw new HTTPException(422, {
+      message: "selfhosted sessions require targetSandboxId; select an online Connected Machine",
+    });
+  }
   // Honest-label (Stage-D closure): a session TARGETED at a Connected
   // Machine (a selfhosted sandbox) runs machine-primary every turn, so its HOME
   // sandbox_backend must read "selfhosted" — not the deployment cloud default —
@@ -2230,6 +2616,25 @@ export async function createSessionForRequestWithOutcome(
       }
     }
   }
+  const effectiveSandboxBackend =
+    inheritedBackend ?? machineHomeBackend ?? payload.sandboxBackend ?? settings.sandboxBackend;
+  const effectiveSandboxOs = inheritedSandboxOs ?? machineHomeOs;
+  const effectiveSeedTarget = payload.targetSandboxId
+    ? {
+        sandboxId: payload.targetSandboxId,
+        workingDir: payload.workingDir ?? null,
+      }
+    : inheritedActiveTarget;
+  if (
+    effectiveSandboxBackend === "selfhosted" &&
+    effectiveSeedTarget === null &&
+    managedSessionGroupBackend(settings.sandboxBackend, effectiveSandboxBackend) === null
+  ) {
+    throw new HTTPException(422, {
+      message:
+        "self-hosted execution runs on a Connected Machine, but no machine was selected or inherited; connect the parent session to a machine or provide machineTarget",
+    });
+  }
   if (payload.startMode !== "realtime") {
     await requireLimit(deps, {
       accountId: grant.accountId,
@@ -2266,11 +2671,10 @@ export async function createSessionForRequestWithOutcome(
       // machine-targeted create (top-level or own-box child) labels the home
       // "selfhosted" (machineHomeBackend), overriding the caller/deployment
       // default so the row matches where the session actually runs.
-      sandboxBackend:
-        inheritedBackend ?? machineHomeBackend ?? payload.sandboxBackend ?? settings.sandboxBackend,
+      sandboxBackend: effectiveSandboxBackend,
       // Mirror the backend relabel on the OS axis: a machine-targeted own-box
-      // create carries a derived OS; shared spawns keep the parent-box behavior.
-      ...(machineHomeOs ? { sandboxOs: machineHomeOs } : {}),
+      // create carries a derived OS; shared spawns inherit the exact parent box.
+      ...(effectiveSandboxOs ? { sandboxOs: effectiveSandboxOs } : {}),
       sandboxGroupId,
       metadata: payload.metadata,
       ...(creationInitiator.initiator ? { createdBy: creationInitiator.initiator } : {}),
@@ -2286,6 +2690,7 @@ export async function createSessionForRequestWithOutcome(
       rigVersionId: frozenRigVersionId,
       channelId,
       goal: effectiveGoal ?? null,
+      initialAutomaticTitle,
       // Per-session persona instructions (already trimmed/validated by the
       // contracts schema). Persisted on the row; composed system-level at turn
       // time. Not surfaced as an event.
@@ -2297,6 +2702,8 @@ export async function createSessionForRequestWithOutcome(
       sessionMcpServers: sessionMcpServers.metadata,
       personalConnectionDelegations,
       initialPersonalResourceAttachmentIntent: payload.personalResourceAttachment ?? null,
+      workspaceCustomModel: isWorkspaceCustomModelId(settings, model),
+      retainWorkspaceCustomModel: parentSession !== null && model === inheritedModel,
       ...(xaiProviderAccountAuthoritySnapshot ? { xaiProviderAccountAuthoritySnapshot } : {}),
       parentSessionId,
       createIdempotencyKey: payload.idempotencyKey ?? null,
@@ -2307,11 +2714,11 @@ export async function createSessionForRequestWithOutcome(
       // active-sandbox pointer is seeded race-free inside createAndStartSession
       // (after the row exists, before the first turn dispatches). Validation
       // (ownership/liveness) lives in swapActiveSandbox; an invalid target 422s.
-      seedTargetSandbox: payload.targetSandboxId
+      seedTargetSandbox: effectiveSeedTarget
         ? {
-            sandboxId: payload.targetSandboxId,
+            sandboxId: effectiveSeedTarget.sandboxId,
             settings,
-            workingDir: payload.workingDir ?? null,
+            workingDir: effectiveSeedTarget.workingDir,
             resourceSubjectId: personalResourceSubjectId,
           }
         : null,
@@ -2366,30 +2773,14 @@ export async function createSessionForRequestWithOutcome(
     }
     throw error;
   }
-  let usageRecording: CreateSessionRequestOutcome["usageRecording"] = "recorded";
-  if (payload.startMode !== "realtime") {
-    try {
-      await recordWorkspaceUsage(deps, {
-        accountId: grant.accountId,
-        workspaceId,
-        subjectId: grant.subjectId,
-        eventType: "agent_run.created",
-        quantity: 1,
-        unit: "run",
-        sourceResourceType: "session",
-        sourceResourceId: createOutcome.session.id,
-        sessionId: createOutcome.session.id,
-        initiator: createOutcome.session.createdBy,
-        initiatorContext: createOutcome.session.createdByContext,
-        origin: creationInitiator.actor ? "system" : "user",
-        idempotencyKey: `agent_run.created:${workspaceId}:${createOutcome.session.id}`,
-      });
-    } catch (error) {
-      usageRecording = "failed";
-      reportSessionUsageRecordingFailure(error);
-    }
-  }
-  return { ...createOutcome, usageRecording };
+  return await withSessionCreateUsageRecording({
+    deps,
+    grant,
+    workspaceId,
+    startMode: payload.startMode,
+    origin: creationInitiator.actor ? "system" : "user",
+    createOutcome,
+  });
 }
 
 /** @internal Fixed public projection; the committed session outcome remains authoritative. */
@@ -2417,6 +2808,53 @@ export async function createSessionForRequest(
   ).session;
 }
 
+function sessionPromptBoundaryRequestHash(input: {
+  delivery: "send" | "steer";
+  controlEtag: string | null;
+  expectedDraftRevision: number | null;
+  text: string;
+  annotations: SubmittedTimelineAnnotation[];
+  modelContext: string | null;
+  resources: ResourceRef[];
+  composerDraftResources?: ResourceRef[];
+  model: string | null;
+  reasoningEffort: ReasoningEffort | null;
+  latencyMode: "standard" | "priority" | "fast" | null;
+  source: "user" | "api";
+  mcpCredentialUpdates: SessionMcpCredentialUpdateInput[];
+  connectionAuthorities?: McpConnectionAuthoritySelection[];
+  personalResourceAttachment?: PersonalResourceAttachmentIntent;
+  commandActor: SessionCommandActor;
+}): string {
+  return `prompt-boundary-v1:${canonicalSessionCommandHash({
+    delivery: input.delivery,
+    controlEtag: input.controlEtag,
+    expectedDraftRevision: input.expectedDraftRevision,
+    text: input.text,
+    annotations: input.annotations,
+    modelContext: input.modelContext,
+    resources: input.resources,
+    composerDraftResourcesProvided: input.composerDraftResources !== undefined,
+    composerDraftResources: input.composerDraftResources ?? [],
+    model: input.model,
+    reasoningEffort: input.reasoningEffort,
+    latencyMode: input.latencyMode,
+    source: input.source,
+    mcpCredentialUpdates: input.mcpCredentialUpdates,
+    connectionAuthorities: input.connectionAuthorities ?? [],
+    personalResourceAttachment: input.personalResourceAttachment ?? null,
+    ...(input.commandActor.type === "service"
+      ? {
+          serviceInitiator: {
+            subjectId: input.commandActor.subjectId,
+            subjectLabel: input.commandActor.subjectLabel ?? null,
+            context: input.commandActor.context ?? {},
+          },
+        }
+      : {}),
+  })}`;
+}
+
 /**
  * Full accept-user-message flow shared by the `user.message` branch of
  * `POST /sessions/:id/events` and the first-party MCP `session_send_message`
@@ -2458,192 +2896,308 @@ export async function acceptSessionUserMessageWithOutcome(
   interruptionCount: number;
   replay: boolean;
 }> {
-  const { settings, db, bus, workflowClient, objectStorage } = deps;
+  const { db, bus, workflowClient, objectStorage } = deps;
   const delegatedServiceInitiator = serviceInitiatorForGrant(grant);
+  const delivery = input.delivery ?? "send";
+  const source = delegatedServiceInitiator || input.origin === "operator" ? "api" : "user";
+  const commandActor: SessionCommandActor = delegatedServiceInitiator
+    ? {
+        type: "service",
+        subjectId: delegatedServiceInitiator.initiator.subjectId,
+        ...(delegatedServiceInitiator.initiator.label
+          ? { subjectLabel: delegatedServiceInitiator.initiator.label }
+          : {}),
+        context: delegatedServiceInitiator.context,
+      }
+    : { type: "human", subjectId: grant.subjectId };
   await requireSessionAuthorization(deps, grant, {
     sessionId,
-    operation: input.delivery === "steer" ? "session.steer" : "session.append",
+    operation: delivery === "steer" ? "session.steer" : "session.append",
     surface: "core",
   });
-  await requireAtomicPersonalResourceAttachment(
-    deps,
-    input.authorization,
-    workspaceId,
-    input.personalResourceAttachment,
-    true,
-  );
-  // Hoisted above requireLimit so the codex-billed predicate can resolve the
-  // turn's effective model (a follow-up turn inherits the session's model). A
-  // pure read with no side effects.
-  const existingSession = await requireSession(db, workspaceId, sessionId);
-  const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
-  const effectiveModel =
-    canonicalConfiguredModel(settings, requestedModel ?? existingSession.model) ?? null;
-  if (effectiveModel === null) {
-    throw new Error("effective follow-up model unexpectedly resolved to null");
-  }
-  try {
-    assertSessionAllowsProductModel(existingSession, effectiveModel);
-  } catch (error) {
-    if (error instanceof CodexCompactionV2ProviderLockedError) {
-      throw new HTTPException(422, { message: error.message, cause: error });
-    }
-    throw error;
-  }
-  const sessionReasoningEffort = existingSession.reasoningEffort;
-  const effectiveReasoningEffort = input.reasoningEffort ?? sessionReasoningEffort;
-  const sessionLatencyMode = existingSession.latencyMode;
-  const effectiveLatencyMode = input.latencyMode ?? sessionLatencyMode;
-  const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {
-    modelId: effectiveModel,
-    requestedModelId: input.model ?? null,
-    modelSource: input.model == null ? "session" : "explicit",
-    reasoningEffort: effectiveReasoningEffort,
-    reasoningSource: input.reasoningEffort == null ? "session" : "explicit",
-    latencyMode: effectiveLatencyMode,
-    latencyModeSource: input.latencyMode == null ? "session" : "explicit",
-  });
   const requestedResources = normalizeResources(input.resources ?? []);
   const composerDraftResources = input.composerDraftResources
     ? normalizeResources(input.composerDraftResources)
     : undefined;
-  if (composerDraftResources) {
-    const acceptedResources = new Set(requestedResources.map((resource) => stableJson(resource)));
-    const unacceptedDraftResource = composerDraftResources.find(
-      (resource) => !acceptedResources.has(stableJson(resource)),
+  const boundaryRequestHash = input.clientEventId
+    ? sessionPromptBoundaryRequestHash({
+        delivery,
+        controlEtag: input.controlEtag ?? null,
+        expectedDraftRevision: input.expectedDraftRevision ?? null,
+        text: input.text,
+        annotations: input.annotations ?? [],
+        modelContext: input.modelContext ?? null,
+        resources: requestedResources,
+        ...(composerDraftResources ? { composerDraftResources } : {}),
+        model: input.model ?? null,
+        reasoningEffort: input.reasoningEffort ?? null,
+        latencyMode: input.latencyMode ?? null,
+        source,
+        mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],
+        ...(input.connectionAuthorities
+          ? { connectionAuthorities: input.connectionAuthorities }
+          : {}),
+        ...(input.personalResourceAttachment
+          ? { personalResourceAttachment: input.personalResourceAttachment }
+          : {}),
+        commandActor,
+      })
+    : null;
+  if (input.clientEventId && boundaryRequestHash) {
+    const replay = await withWorkspaceSubjectSessionActivityRls(
+      db,
+      workspaceId,
+      grant.subjectId,
+      async (scopedDb) =>
+        await replaySubmittedHumanPromptFromBoundaryReceipt(scopedDb, {
+          workspaceId,
+          sessionId,
+          subjectId: grant.subjectId,
+          actor: commandActor,
+          operationKey: input.clientEventId!,
+          delivery,
+          boundaryRequestHash,
+          expectedDraftRevision: input.expectedDraftRevision ?? null,
+        }),
     );
-    if (unacceptedDraftResource) {
-      throw new HTTPException(422, {
-        message: "composer draft resources must be included in the accepted resource set",
-      });
+    if (replay) {
+      return finalizePostUserMessageTurn(
+        {
+          db,
+          bus,
+          workflowClient,
+          accountId: grant.accountId,
+          workspaceId,
+          sessionId,
+          delivery,
+          ...(deps.schedulePromptPostCommit
+            ? { schedulePostCommit: deps.schedulePromptPostCommit }
+            : {}),
+        },
+        replay,
+      );
     }
   }
-  const annotations = await validateSubmittedTimelineAnnotations(
-    db,
-    workspaceId,
-    sessionId,
-    input.annotations ?? [],
-  );
-  await requireLimit(deps, {
-    accountId: grant.accountId,
-    workspaceId,
-    action: "agent_run:create",
-    quantity: 1,
-    model: effectiveModel,
-  });
-  if (requestedResources.some((resource) => resource.kind === "file") && !objectStorage) {
-    throw new HTTPException(503, {
-      message: "object storage is not configured",
+  try {
+    await requireAtomicPersonalResourceAttachment(
+      deps,
+      input.authorization,
+      workspaceId,
+      input.personalResourceAttachment,
+      true,
+    );
+    // Hoisted above requireLimit so the codex-billed predicate can resolve the
+    // turn's effective model (a follow-up turn inherits the session's model). A
+    // pure read with no side effects.
+    const existingSession = await requireSession(db, workspaceId, sessionId);
+    const settings = await resolveWorkspaceModelBoundarySettings(
+      deps,
+      grant,
+      workspaceId,
+      [input.model ?? existingSession.model],
+      existingSession.model,
+    );
+    if (settings !== deps.settings) {
+      deps = {
+        ...deps,
+        catalogSourceSettings: deps.catalogSourceSettings ?? deps.settings,
+        settings,
+      };
+    }
+    const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
+    const effectiveModel =
+      canonicalConfiguredModel(settings, requestedModel ?? existingSession.model) ?? null;
+    if (effectiveModel === null) {
+      throw new Error("effective follow-up model unexpectedly resolved to null");
+    }
+    await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, requestedModel);
+    try {
+      assertSessionAllowsProductModel(existingSession, effectiveModel);
+    } catch (error) {
+      if (error instanceof CodexCompactionV2ProviderLockedError) {
+        throw new HTTPException(422, { message: error.message, cause: error });
+      }
+      throw error;
+    }
+    const sessionReasoningEffort = existingSession.reasoningEffort;
+    const effectiveReasoningEffort = input.reasoningEffort ?? sessionReasoningEffort;
+    const sessionLatencyMode = existingSession.latencyMode;
+    const effectiveLatencyMode = input.latencyMode ?? sessionLatencyMode;
+    const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {
+      modelId: effectiveModel,
+      requestedModelId: input.model ?? null,
+      modelSource: input.model == null ? "session" : "explicit",
+      reasoningEffort: effectiveReasoningEffort,
+      reasoningSource: input.reasoningEffort == null ? "session" : "explicit",
+      latencyMode: effectiveLatencyMode,
+      latencyModeSource: input.latencyMode == null ? "session" : "explicit",
     });
-  }
-  await validateFileResources(
-    db,
-    grant.accountId,
-    workspaceId,
-    grant.subjectId,
-    requestedResources,
-  );
-  await validateGitHubRepositorySelection(db, workspaceId, [
-    ...existingSession.resources,
-    ...requestedResources,
-  ]);
-  const mcpCredentialUpdates = validateSessionMcpCredentialUpdates({
-    settings,
-    grant,
-    session: existingSession,
-    updates: input.mcpCredentialUpdates ?? [],
-  });
-  const connectionDelegationSource = personalConnectionDelegationSourceForGrant(grant);
-  const inheritedPersonalConnectionDelegations =
-    connectionDelegationSource.kind === "turn"
-      ? await getSessionTurnPersonalConnectionDelegations(
-          db,
-          workspaceId,
-          connectionDelegationSource.sessionId,
-          connectionDelegationSource.turnId,
-        )
-      : null;
-  const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
-    db,
-    workspaceId,
-    settings,
-    inheritedPersonalConnectionDelegations
-      ? {
-          personalConnectionDelegations: inheritedPersonalConnectionDelegations,
-        }
-      : { subjectId: grant.subjectId },
-  );
-  const personalConnectionDelegations = await freezePersonalConnectionDelegations({
-    db,
-    workspaceId,
-    settings: runtimeSettings,
-    tools: existingSession.tools,
-    resources: [...existingSession.resources, ...requestedResources],
-    source: connectionDelegationSource,
-    targetSessionId: sessionId,
-    googleDrivePublicationEnabled:
-      existingSession.firstPartyMcpTools.includes("editable_artifact_export") &&
-      existingSession.firstPartyMcpTools.includes("editable_artifact_export_status") &&
-      (!existingSession.firstPartyMcpPermissions?.length ||
-        (existingSession.firstPartyMcpPermissions.includes("artifacts:read") &&
-          existingSession.firstPartyMcpPermissions.includes("artifacts:publish"))),
-    atlassianEnabled:
-      existingSession.firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) &&
-      (!existingSession.firstPartyMcpPermissions?.length ||
-        existingSession.firstPartyMcpPermissions.includes("connections:read")),
-    ...(input.connectionAuthorities ? { authoritySelections: input.connectionAuthorities } : {}),
-  });
-  const { accepted, turn, draft, receipt, routing, interruptionCount, replay } =
-    await postUserMessageTurn({
+    if (composerDraftResources) {
+      const acceptedResources = new Set(requestedResources.map((resource) => stableJson(resource)));
+      const unacceptedDraftResource = composerDraftResources.find(
+        (resource) => !acceptedResources.has(stableJson(resource)),
+      );
+      if (unacceptedDraftResource) {
+        throw new HTTPException(422, {
+          message: "composer draft resources must be included in the accepted resource set",
+        });
+      }
+    }
+    const annotations = await validateSubmittedTimelineAnnotations(
       db,
-      bus,
-      workflowClient,
-      settings,
-      accountId: grant.accountId,
       workspaceId,
       sessionId,
-      text: input.text,
-      annotations,
-      modelContext: input.modelContext ?? null,
-      resources: requestedResources,
-      ...(composerDraftResources ? { composerDraftResources } : {}),
-      model: input.model ?? null,
-      reasoningEffort: input.reasoningEffort ?? null,
-      latencyMode: input.latencyMode ?? null,
-      reasoningEffortFallback: sessionReasoningEffort,
-      turnExecutionPolicy,
-      mcpCredentialUpdates,
-      personalConnectionDelegations,
-      ...(input.personalResourceAttachment
-        ? { personalResourceAttachment: input.personalResourceAttachment }
-        : {}),
-      delivery: input.delivery ?? "send",
-      origin: delegatedServiceInitiator ? "operator" : (input.origin ?? "human"),
-      actor: grant.subjectId,
-      ...(grant.subjectLabel ? { actorLabel: grant.subjectLabel } : {}),
-      ...(delegatedServiceInitiator
+      input.annotations ?? [],
+    );
+    await requireLimit(deps, {
+      accountId: grant.accountId,
+      workspaceId,
+      action: "agent_run:create",
+      quantity: 1,
+      model: effectiveModel,
+    });
+    if (requestedResources.some((resource) => resource.kind === "file") && !objectStorage) {
+      throw new HTTPException(503, {
+        message: "object storage is not configured",
+      });
+    }
+    await validateFileResources(
+      db,
+      grant.accountId,
+      workspaceId,
+      grant.subjectId,
+      requestedResources,
+    );
+    await validateGitHubRepositorySelection(db, workspaceId, [
+      ...existingSession.resources,
+      ...requestedResources,
+    ]);
+    const mcpCredentialUpdates = validateSessionMcpCredentialUpdates({
+      settings,
+      grant,
+      session: existingSession,
+      updates: input.mcpCredentialUpdates ?? [],
+    });
+    const connectionDelegationSource = personalConnectionDelegationSourceForGrant(grant);
+    const inheritedPersonalConnectionDelegations =
+      connectionDelegationSource.kind === "turn"
+        ? await getSessionTurnPersonalConnectionDelegations(
+            db,
+            workspaceId,
+            connectionDelegationSource.sessionId,
+            connectionDelegationSource.turnId,
+          )
+        : null;
+    const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
+      db,
+      workspaceId,
+      settings,
+      inheritedPersonalConnectionDelegations
         ? {
-            commandActor: {
-              type: "service" as const,
-              subjectId: delegatedServiceInitiator.initiator.subjectId,
-              ...(delegatedServiceInitiator.initiator.label
-                ? { subjectLabel: delegatedServiceInitiator.initiator.label }
-                : {}),
-              context: delegatedServiceInitiator.context,
-            },
+            personalConnectionDelegations: inheritedPersonalConnectionDelegations,
           }
-        : {}),
-      ...(input.controlEtag !== undefined ? { controlEtag: input.controlEtag } : {}),
-      ...(input.expectedDraftRevision !== undefined
-        ? { expectedDraftRevision: input.expectedDraftRevision }
-        : {}),
-      ...(input.clientEventId ? { clientEventId: input.clientEventId } : {}),
-      recordAgentRunUsage: true,
-      ...(deps.schedulePromptPostCommit
-        ? { schedulePostCommit: deps.schedulePromptPostCommit }
-        : {}),
+        : { subjectId: grant.subjectId },
+    );
+    const personalConnectionDelegations = await freezePersonalConnectionDelegations({
+      db,
+      workspaceId,
+      settings: runtimeSettings,
+      tools: existingSession.tools,
+      resources: [...existingSession.resources, ...requestedResources],
+      source: connectionDelegationSource,
+      targetSessionId: sessionId,
+      googleDrivePublicationEnabled:
+        existingSession.firstPartyMcpTools.includes("editable_artifact_export") &&
+        existingSession.firstPartyMcpTools.includes("editable_artifact_export_status") &&
+        (!existingSession.firstPartyMcpPermissions?.length ||
+          (existingSession.firstPartyMcpPermissions.includes("artifacts:read") &&
+            existingSession.firstPartyMcpPermissions.includes("artifacts:publish"))),
+      atlassianEnabled:
+        existingSession.firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) &&
+        (!existingSession.firstPartyMcpPermissions?.length ||
+          existingSession.firstPartyMcpPermissions.includes("connections:read")),
+      ...(input.connectionAuthorities ? { authoritySelections: input.connectionAuthorities } : {}),
     });
-  return { accepted, turn, draft, receipt, routing, interruptionCount, replay };
+    const { accepted, turn, draft, receipt, routing, interruptionCount, replay } =
+      await postUserMessageTurn({
+        db,
+        bus,
+        workflowClient,
+        settings,
+        accountId: grant.accountId,
+        workspaceId,
+        sessionId,
+        text: input.text,
+        annotations,
+        modelContext: input.modelContext ?? null,
+        resources: requestedResources,
+        ...(composerDraftResources ? { composerDraftResources } : {}),
+        model: input.model ?? null,
+        reasoningEffort: input.reasoningEffort ?? null,
+        latencyMode: input.latencyMode ?? null,
+        reasoningEffortFallback: sessionReasoningEffort,
+        turnExecutionPolicy,
+        mcpCredentialUpdates,
+        personalConnectionDelegations,
+        ...(input.personalResourceAttachment
+          ? { personalResourceAttachment: input.personalResourceAttachment }
+          : {}),
+        delivery,
+        origin: source === "api" ? "operator" : "human",
+        actor: grant.subjectId,
+        ...(grant.subjectLabel ? { actorLabel: grant.subjectLabel } : {}),
+        commandActor,
+        ...(boundaryRequestHash ? { boundaryRequestHash } : {}),
+        ...(input.controlEtag !== undefined ? { controlEtag: input.controlEtag } : {}),
+        ...(input.expectedDraftRevision !== undefined
+          ? { expectedDraftRevision: input.expectedDraftRevision }
+          : {}),
+        ...(input.clientEventId ? { clientEventId: input.clientEventId } : {}),
+        recordAgentRunUsage: true,
+        ...(deps.schedulePromptPostCommit
+          ? { schedulePostCommit: deps.schedulePromptPostCommit }
+          : {}),
+      });
+    return { accepted, turn, draft, receipt, routing, interruptionCount, replay };
+  } catch (error) {
+    if (input.clientEventId && boundaryRequestHash) {
+      const replay = await withWorkspaceSubjectSessionActivityRls(
+        db,
+        workspaceId,
+        grant.subjectId,
+        async (scopedDb) =>
+          await replaySubmittedHumanPromptFromBoundaryReceipt(scopedDb, {
+            workspaceId,
+            sessionId,
+            subjectId: grant.subjectId,
+            actor: commandActor,
+            operationKey: input.clientEventId!,
+            delivery,
+            boundaryRequestHash,
+            expectedDraftRevision: input.expectedDraftRevision ?? null,
+            serializeOperation: true,
+          }),
+      );
+      if (replay) {
+        return finalizePostUserMessageTurn(
+          {
+            db,
+            bus,
+            workflowClient,
+            accountId: grant.accountId,
+            workspaceId,
+            sessionId,
+            delivery,
+            ...(deps.schedulePromptPostCommit
+              ? { schedulePostCommit: deps.schedulePromptPostCommit }
+              : {}),
+          },
+          replay,
+        );
+      }
+    }
+    throw error;
+  }
 }
 
 /** Backward-compatible entity-returning path used by existing REST callers. */