@opengeni/core 3.0.1 → 3.1.2

package/src/domain/sessions.ts

@@ -1,34 +1,80 @@
+import { isDirectModelId, ModelUnavailableError } from "@opengeni/contracts";
+import { requireExplicitPermissionDelegation } from "../access";
+import { acceptSessionFileAttachments } from "@opengeni/db";
 import { knowledgeContextForAccess } from "./knowledge";
+import {
+  getSessionEvent,
+  getSessionRetryReceiptInTransaction,
+  setSessionModelInTransaction,
+  withWorkspaceSessionActivityRls,
+  retryFailedSessionInTransaction,
+  SessionRetryConflictError,
+} from "@opengeni/db";
+import type {
+  SessionRetryRequest,
+  SessionRetryResponse,
+  SessionTurnSurface,
+} from "@opengeni/contracts";
+import { resolveTurnSurface } from "../turn-surface";
+import {
+  recordSessionCreated,
+  recordUserMessageAccepted,
+  type ProductUsageMetricsSink,
+} from "../product-usage-metrics";
 import { saveAgentLearningSettings } from "@opengeni/db";
 import { withSessionRlsActorContext } from "@opengeni/db";
 import { fileOwnerContextForAccess, fileOwnerContextForAgent } from "./file-owner";
+import { assertSessionIsNotImported } from "@opengeni/db";
 import { CODEX_MODEL_ID_PREFIX, isCodexBilledModel } from "@opengeni/codex";
-import { sessionCreationMetadata } from "../site-session-origin";
 import {
-  hostMcpBindingMatchesSelection,
-  HostMcpCreateSelections,
-  type HostMcpCreateSelection,
-} from "@opengeni/contracts/host-mcp-bindings";
+  currentSiteSessionOrigin,
+  sessionCreationMetadata,
+  SITE_ORIGIN_METADATA_KEY,
+} from "../site-session-origin";
+import { assertSiteAgentMayChooseCompute } from "../site-agent-clamp";
+import { currentHostSessionUsageLimit } from "../host-session-usage-limit";
+import { measureSessionStartPhase, type SessionStartObservability } from "./session-start-timing";
 import {
-  captureDirectHostMcpAuthority,
-  HostMcpDelegationAuthorityError,
-  HostMcpBindingConflictError,
-  getHostMcpBinding,
-  getHostMcpDelegation,
-} from "@opengeni/db";
+  requireDeveloperSetupDelegatedPermissions,
+  withDeveloperSetupCredentialRestriction,
+} from "../developer-setup-credential-ceiling";
+
 import {
+  CLAUDE_CONNECTION_KINDS,
+  claudeProviderId,
   canonicalizeConfiguredModelId,
   configuredAllowedModels,
+  withCodexCatalogProvider,
   ORGANIZATION_GATEWAY_MODEL_ID_PREFIX,
   ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX,
+  ORGANIZATION_OPPER_MODEL_ID_PREFIX,
+  WORKSPACE_OPPER_MODEL_ID_PREFIX,
+  allowedFirstPartyMcpToolsForSession,
+  resolveSessionFirstPartyMcpTools,
+  deploymentUnavailableFirstPartyMcpTools,
   resolveFirstPartyMcpToolPolicy,
+  policyChargesCreditsForModel,
   policyProviderIdForModel,
   resolveTurnExecutionPolicyV1,
   WORKSPACE_GATEWAY_MODEL_ID_PREFIX,
   WORKSPACE_OPENROUTER_MODEL_ID_PREFIX,
   XAI_SUBSCRIPTION_MODEL_ID_PREFIX,
+  codeSearchDeploymentPolicy,
+  agentConfigDeploymentPolicy,
   type Settings,
 } from "@opengeni/config";
+import type { CodeSearchDeploymentPolicy } from "@opengeni/contracts/code-search";
+import {
+  agentConfigAddedFirstPartyMcpTools,
+  intersectVaultPolicies,
+  resolveAgentConfigUpdate,
+  VAULT_POLICY_ALL,
+  type AgentConfigCreator,
+  type ResolvedAgentCapabilities,
+  type ResolvedAgentConfig,
+  type UpdateSessionAgentRequest,
+  type VaultPolicy,
+} from "@opengeni/contracts";
 import {
   AUTOMATIC_SESSION_TITLE_FALLBACK,
   CreateSessionRequest,
@@ -40,6 +86,7 @@ import {
   OPENGENI_SLACK_BOT_SESSION_METADATA_KEY,
   SessionSkills,
   resolveBundledSkillSelection,
+  bundledSkillSelectionForAgentConfig,
   SessionSpawnDenial,
   ServiceTurnInitiator,
   ServiceTurnInitiatorContext,
@@ -55,7 +102,9 @@ import {
   type GoalSpec,
   type FirstPartyMcpToolName,
   type McpPersonalConnectionDelegation,
-  type McpConnectionAuthoritySelection,
+  type McpConnectionAccountBinding,
+  type ConnectionAccountIntent,
+  type McpConnectionAccountSelection,
   type Permission,
   type PersonalResourceAttachmentIntent,
   type ReasoningEffort,
@@ -68,14 +117,18 @@ import {
   type SessionSkill,
   type SessionEvent,
   SessionMcpApprovalPolicy,
+  SetSessionModelRequest,
   type SessionMcpCredentialUpdateInput,
   type SessionMcpServerInput,
   type SessionMcpServerMetadata,
+  type SessionMcpApprovalPolicyTarget,
   type SubmittedTimelineAnnotation,
   type TimelineAnnotation,
   type UpdateSessionMcpApprovalPolicyResponse,
   type UpdateSessionToolPolicyRequest,
+  type UpdateSessionSkillsRequest,
   type SessionAuthorizationPort,
+  type SessionAuthorizationSurface,
   type SessionToolPolicy,
   type SessionTurn,
   type SessionPromptRouting,
@@ -86,36 +139,44 @@ import {
   type TurnExecutionPolicyV1,
   type VariableSet,
   type XaiProviderAccountAuthoritySnapshotV1,
+  type ClaudeProviderAccountAuthoritySnapshotV1,
 } from "@opengeni/contracts";
 import {
   assertExactNewSessionDraftInTransaction,
   createSession,
   createSessionWithIdempotencyKeyResult,
   canonicalSessionCommandHash,
+  frozenInitiatorForCommandActor,
+  getComposerDraftInTransaction,
   encryptVariableSetValue,
   getAnySessionInGroup,
   getEnrollment,
   getChannel,
   getRig,
   getWorkspaceDefaultRigId,
-  listDistinctVariableSetSelectionsInGroup,
   listDistinctRigVersionIdsInGroup,
   listInstalledPortableSkills,
+  listEnabledMcpCapabilityServers,
+  resolveMcpApprovalRecommendation,
   getSandbox,
   getSession,
   getInitializedSessionCreateReplay,
+  getSessionGoal,
   getSessionAuthorityProjection,
   SessionIdConflictError,
   NewSessionDraftConflictError,
   getWorkspaceControlEvent,
   getSessionLineage,
   getSessionTurn,
+  getSessionTurnInitiatingHumanSubjectId,
   getSessionTurnForAttempt,
   getSessionTurnPersonalConnectionDelegations,
   getSessionTurnXaiProviderAccountAuthoritySnapshot,
+  getSessionTurnClaudeProviderAccountAuthoritySnapshot,
   getWorkspaceModelPolicy,
   requireWorkspace,
   initializeSessionStartAtomically,
+  discardUninitializedSessionShell,
   listSessionTurns,
   listSessionMcpServersForChildInheritance,
   requireSession,
@@ -125,9 +186,12 @@ import {
   submitHumanPromptInTransaction,
   appendSessionEventsWithLockedSessionUpdate,
   updateSessionTitleWithEvent,
+  setSessionKeepLive,
+  type SetSessionKeepLiveResult,
   withWorkspaceSubjectSessionActivityRls,
   type CreateSessionMcpServerInput,
   type Database,
+  type FrozenTurnInitiator,
   type UpdateSessionMcpServerCredentialsInput,
   QueueCommandConflictError,
   AgentCommandAuthorityError,
@@ -137,7 +201,6 @@ import {
   SessionToolPolicyVersionConflictError,
   SessionCreateIdempotencyConflictError,
   PersonalResourceAttachmentAcceptanceError,
-  sessionTenancyProductActivated,
   workspaceControlRequestLockTimeoutMs,
   WorkspaceControlBusyError,
   type SessionCommandActor,
@@ -153,8 +216,16 @@ import { hasPermission, requirePermission, type AccessGrantAuthorization } from
 import { externalCreationMetadata } from "./external-creation-attribution";
 import { prepareExternalLinkTurnAdmission } from "../application/external-link-work-admission";
 import { externalContinuationCommitAuthorizer } from "../application/external-continuation";
-import { prepareHostMcpOwnerAuthorization } from "../application/host-mcp-owner";
+
 import { recordWorkspaceUsage, requireLimit } from "../billing/limits";
+import {
+  applyInitialSessionUsageLimit,
+  requireSessionUsageLimitAllows,
+  SessionUsageLimitHttpError,
+  sessionUsageLimitsProducerEnabled,
+  sessionUsageLimitWriteActorForAccess,
+} from "../session-usage-limits";
+import { recordSessionUsageLimitEvent } from "../session-usage-limit-metrics";
 import type {
   AcceptSessionUserMessageDependencies,
   ApiRouteDeps,
@@ -166,7 +237,7 @@ import {
   requireSessionAuthorization,
   SessionAuthorizationDeniedError,
 } from "../session-authorization";
-import { assertHostMcpAuthoritySourceAdmissionEnabled } from "./host-mcp-authority-source-admission";
+import { assertNativeMcpConnectionRef } from "./native-mcp-connection-admission";
 import {
   preflightCreateTimeSandboxTarget,
   swapActiveSandbox,
@@ -179,11 +250,26 @@ import {
   resolveWorkspaceCatalogSettings,
   workspaceCustomModelReference,
 } from "../model-catalog";
+import {
+  resolveDefaultSessionModel,
+  resolveCallerWorkspaceModelSelections,
+  admissibleWorkspaceModel,
+} from "../default-session-model";
 import { settingsWithEnabledCapabilityMcpServers } from "./capabilities";
+import {
+  applySessionAgentConfigWriteThrough,
+  legacySessionAgentCapabilities,
+  resolveSessionAgentConfigForCreate,
+  withAgentConfigHttpErrors,
+} from "./agent-config-resolution";
+import {
+  resolveSessionToolPolicy,
+  workspaceSessionToolPolicyDefaultServerIdsFor,
+} from "./session-tool-policy";
 import { validateSubmittedTimelineAnnotations } from "./timeline-annotations";
-import { requireVariableSetEncryption, validateVariableSetAttachment } from "./environments";
+import { requireEnvironmentEncryption, variableSetsRemovedError } from "./encryption-key";
 import {
-  freezePersonalConnectionDelegations,
+  freezeConnectionAccounts,
   personalConnectionDelegationSourceForGrant,
 } from "./personal-connection-delegations";
 import { hasReservedOpenGeniSlackBotSessionMetadata } from "./slack-bot";
@@ -209,12 +295,40 @@ const maxSessionMcpCredentialHeaderValueLength = 4096;
 // the generic lossy projection cannot silently rewrite this audit fact.
 const maxToolPolicyAuditRefs = 40;
 
+function withoutExcludedMcpServers(
+  tools: ToolRef[],
+  excludedIds: readonly string[] = [],
+): ToolRef[] {
+  const excluded = new Set(excludedIds);
+  return tools.filter((tool) => tool.id === "opengeni" || !excluded.has(tool.id));
+}
+
+function defaultPolicyExclusions(
+  ids: readonly string[] = [],
+): Pick<SessionToolPolicy, "excludedMcpServerIds"> {
+  const sorted = [...new Set(ids)].filter((id) => id !== "opengeni").sort();
+  if (sorted.length > 64 || sorted.some((id) => id.length > 200 || !/^[A-Za-z0-9_-]+$/.test(id))) {
+    throw new HTTPException(422, {
+      message: "connector exclusions must contain at most 64 valid MCP server IDs",
+    });
+  }
+  return sorted.length ? { excludedMcpServerIds: sorted } : {};
+}
+
 function isCatalogOverlayModel(modelId: string | null | undefined): boolean {
   return (
+    (modelId != null && isDirectModelId(modelId)) ||
     modelId?.startsWith(WORKSPACE_GATEWAY_MODEL_ID_PREFIX) === true ||
     modelId?.startsWith(WORKSPACE_OPENROUTER_MODEL_ID_PREFIX) === true ||
     modelId?.startsWith(ORGANIZATION_GATEWAY_MODEL_ID_PREFIX) === true ||
-    modelId?.startsWith(ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX) === true
+    modelId?.startsWith(ORGANIZATION_OPENROUTER_MODEL_ID_PREFIX) === true ||
+    modelId?.startsWith(WORKSPACE_OPPER_MODEL_ID_PREFIX) === true ||
+    modelId?.startsWith(ORGANIZATION_OPPER_MODEL_ID_PREFIX) === true ||
+    CLAUDE_CONNECTION_KINDS.some((kind) =>
+      ["workspace", "organization"].some((scope) =>
+        modelId?.startsWith(claudeProviderId(kind, scope as "workspace" | "organization") + "/"),
+      ),
+    )
   );
 }
 // RFC 9110 field-name token characters.
@@ -241,11 +355,6 @@ async function requireAtomicPersonalResourceAttachment(
       cause: error,
     });
   }
-  if (!(await sessionTenancyProductActivated(deps.db, workspaceId))) {
-    throw new HTTPException(409, {
-      message: "Session tenancy is not activated for this organization.",
-    });
-  }
   if (existingSession && intent.expectedAuthorityEpoch === undefined) {
     throw new HTTPException(422, {
       message: "Personal-resource attachment requires expectedAuthorityEpoch.",
@@ -307,6 +416,13 @@ export function resolveFirstPartyMcpToolsForCreate(
   },
 ): FirstPartyMcpToolName[] {
   if (requested !== undefined) {
+    // Check the caller's own names, before legacy aliases expand them.
+    requireDeploymentFirstPartyMcpTools(
+      requested,
+      policy.allowed,
+      [],
+      "Omit firstPartyMcpTools to inherit the effective selection.",
+    );
     requested = currentAgentLearningToolSelection(requested);
     if (parentStored !== undefined) {
       const parentCeiling = effectiveFirstPartyMcpToolCeiling(parentStored, policy);
@@ -324,6 +440,29 @@ export function resolveFirstPartyMcpToolsForCreate(
   return currentAgentLearningToolSelection(inherited).filter((tool) => allowed.has(tool));
 }
 
+/**
+ * An explicit first-party tool selection is a promise, not a best-effort
+ * default: a tool the deployment disables fails the request, naming every such
+ * tool and the allowed set, instead of silently shrinking the selection.
+ * `retained` names tools the caller may echo from its stored selection; those
+ * stay deployment-filtered like any default, so a later policy change never
+ * blocks an unrelated edit.
+ */
+export function requireDeploymentFirstPartyMcpTools(
+  requested: readonly FirstPartyMcpToolName[],
+  allowed: readonly FirstPartyMcpToolName[],
+  retained: Iterable<FirstPartyMcpToolName> = [],
+  hint = "",
+): void {
+  const permitted = new Set([...allowed, ...retained]);
+  const disallowed = [...new Set(requested.filter((tool) => !permitted.has(tool)))];
+  if (disallowed.length > 0) {
+    throw new HTTPException(422, {
+      message: `first-party MCP tools are disabled by deployment policy: ${disallowed.join(", ")}. Allowed tools: ${allowed.join(", ") || "(none)"}.${hint ? ` ${hint}` : ""}`,
+    });
+  }
+}
+
 function sessionSpawnDeniedMessage(denial: SessionSpawnDenial): string {
   if (denial.code === "nested_agent_depth_override_forbidden") {
     return `requested nested-agent depth limit ${denial.requestedMaxNestedAgentDepthOverride ?? "unknown"} exceeds inherited limit ${denial.effectiveMaxNestedAgentDepth}; workspace:admin is required to increase it`;
@@ -353,6 +492,21 @@ export type FrozenCreationInitiator = {
   actor?: Extract<SessionCommandActor, { type: "agent_attempt" }>;
 };
 
+/** Attribution is immutable accepted-work data, never the current request principal. */
+export function initiatingHumanForAllowance(
+  frozen: Pick<FrozenTurnInitiator, "initiator" | "initiatingHumanSubjectId">,
+): string | null {
+  const subjectId =
+    frozen.initiatingHumanSubjectId === undefined
+      ? frozen.initiator.kind === "subject"
+        ? frozen.initiator.subjectId
+        : null
+      : frozen.initiatingHumanSubjectId;
+  // Older accepted API-key turns used the subject initiator kind. They are
+  // still service-funded work, not a human member's allowance.
+  return subjectId?.startsWith("api_key:") ? null : subjectId;
+}
+
 function serviceInitiatorForGrant(grant: AccessGrant): {
   initiator: ServiceTurnInitiator;
   context: ServiceTurnInitiatorContext;
@@ -432,6 +586,20 @@ export function creationInitiatorForGrant(grant: AccessGrant): FrozenCreationIni
   if (serviceInitiator) {
     return serviceInitiator;
   }
+  if (
+    grant.principalKind === "service" ||
+    grant.principalKind === "api_key" ||
+    grant.principalKind === "configured_key"
+  ) {
+    return {
+      initiator: {
+        kind: "service",
+        subjectId: grant.subjectId,
+        ...(grant.subjectLabel ? { label: grant.subjectLabel } : {}),
+      },
+      context: {},
+    };
+  }
   return {
     initiator: {
       kind: "subject",
@@ -558,7 +726,7 @@ function validateSessionMcpServersForCreate(
   }
   requirePermission(grant, "mcp_servers:attach");
   const encryptionKey = servers.some((server) => Object.keys(server.headers ?? {}).length > 0)
-    ? requireVariableSetEncryption(settings)
+    ? requireEnvironmentEncryption(settings)
     : null;
   const existingIds = new Set(settings.mcpServers.map((server) => server.id));
   const seenIds = new Set<string>();
@@ -566,7 +734,7 @@ function validateSessionMcpServersForCreate(
   const dbServers: CreateSessionMcpServerInput[] = [];
   const metadata: SessionMcpServerMetadata[] = [];
   for (const server of servers) {
-    assertHostMcpAuthoritySourceAdmissionEnabled(settings, server.connectionRef);
+    assertNativeMcpConnectionRef(server.connectionRef);
     if (seenIds.has(server.id)) {
       throw new HTTPException(422, {
         message: `duplicate session MCP server id: ${server.id}`,
@@ -653,7 +821,7 @@ function validateInheritedSessionMcpServersForCreate(
   };
 }
 
-function validateSessionMcpCredentialUpdates(input: {
+export function validateSessionMcpCredentialUpdates(input: {
   settings: Settings;
   grant: AccessGrant;
   session: Session;
@@ -663,7 +831,7 @@ function validateSessionMcpCredentialUpdates(input: {
     return [];
   }
   requirePermission(input.grant, "mcp_servers:attach");
-  const encryptionKey = requireVariableSetEncryption(input.settings);
+  const encryptionKey = requireEnvironmentEncryption(input.settings);
   const knownIds = new Set(input.session.mcpServers.map((server) => server.id));
   const seenIds = new Set<string>();
   const encryptedUpdates = input.updates.map((update) => {
@@ -713,6 +881,27 @@ type AgentChildSessionCreatePresentation = {
   automaticTitleCandidate?: string | null;
 };
 
+/** Trusted entry-point options for creating a session outside the REST body. */
+export type SessionCreateRequestOptions = {
+  /**
+   * Product surface when the entry point knows it (for example Slack or an
+   * in-process embedding host). Omitted derives it from the grant.
+   */
+  surface?: SessionTurnSurface;
+  /**
+   * Agent-configuration creator kind (renderer default and default-config
+   * policy). Omitted derives `slack` from a Slack surface, else the public API.
+   */
+  agentConfigCreator?: AgentConfigCreator;
+  /**
+   * Built-in tools to guarantee on top of the defaults a new session follows,
+   * for an entry point whose sessions need their own tools (a chat surface's
+   * read tools). Ignored when the request names an explicit built-in list.
+   * Trusted entry points only; not part of the public create request.
+   */
+  firstPartyMcpToolAdditions?: readonly FirstPartyMcpToolName[];
+};
+
 const AGENT_CHILD_AUTOMATIC_TITLE_CONTEXT_KEY = "agentChildAutomaticTitle" as const;
 
 /** @internal Exported for the keyed-create repair regression. */
@@ -745,6 +934,13 @@ function automaticTitleForAgentChildCreate(
   return null;
 }
 
+/** Vault IDs are compared as lowercase text in SQL. */
+function lowercaseVaultPolicy(policy: VaultPolicy): VaultPolicy {
+  return policy.mode === "all"
+    ? { mode: "all" }
+    : { mode: "selected", vaultIds: [...new Set(policy.vaultIds.map((id) => id.toLowerCase()))] };
+}
+
 export async function createAndStartSessionWithOutcome(input: {
   initialAgentLearning?: import("@opengeni/contracts").AgentLearningOverrides | undefined;
   requestedSessionId?: string;
@@ -760,7 +956,7 @@ export async function createAndStartSessionWithOutcome(input: {
   captureInitialTurnAuthority?: (tx: Database, sessionId: string, turnId: string) => Promise<void>;
   /** Internal replay identity; the verified caller must also capture authority.
    * Supplying selection metadata alone never grants runtime use. */
-  selectedHostMcpDelegations?: HostMcpCreateSelection[];
+
   /** The custom workspace model was frozen by an earlier accepted boundary or
    * inherited from an existing session, so retirement must not invalidate it. */
   retainWorkspaceGatewayModel?: boolean;
@@ -775,6 +971,15 @@ export async function createAndStartSessionWithOutcome(input: {
   workspaceId: string;
   visibility?: "user_private" | "workspace_shared";
   initialMessage: string;
+  /** Content-free product surface the create request entered through. */
+  surface?: SessionTurnSurface | null;
+  /**
+   * Live product usage counters: a newly created session (never a replay)
+   * counts once, and its initial user message once unless deferred.
+   */
+  metrics?: ProductUsageMetricsSink | null;
+  /** Optional content-free child spans; never a lifecycle dependency. */
+  startupObservability?: SessionStartObservability | null;
   /** Create the session shell without an initial user event/agent turn. */
   deferInitialTurn?: boolean;
   modelContext?: string | null;
@@ -829,6 +1034,12 @@ export async function createAndStartSessionWithOutcome(input: {
   // Model-visible first-party tool names. Authorization remains controlled by
   // firstPartyMcpPermissions and the target resource checks.
   firstPartyMcpTools: FirstPartyMcpToolName[];
+  // Frozen agent configuration (migration 0559), already resolved and written
+  // through to tools/firstPartyMcpTools by the caller. Omitted/null = legacy.
+  agentConfig?: ResolvedAgentConfig | null;
+  // Vault narrowing for this session (0739), already intersected with the
+  // agent configuration's policy. Omitted = no narrowing.
+  vaultPolicy?: VaultPolicy;
   // Agent-access scope, opaque end-user label, and typed Memory selector
   // (migration 0427), already resolved against the parent by the caller.
   // Omitted keeps the workspace defaults for internal lifecycle callers.
@@ -838,14 +1049,22 @@ export async function createAndStartSessionWithOutcome(input: {
   // Encrypted DB rows plus matching safe metadata for create-time per-session
   // MCP servers. Metadata is the only shape emitted in events/responses.
   mcpServers?: CreateSessionMcpServerInput[];
+  mcpApprovalPolicies?: Record<string, SessionMcpApprovalPolicy>;
   sessionMcpServers?: SessionMcpServerMetadata[];
   personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+  mcpAccountBindings?: McpConnectionAccountBinding[] | null;
+  /** The creator's account intent, carried by work that continues the first turn. */
+  connectionAccountIntent?: ConnectionAccountIntent | null;
   initialPersonalResourceAttachmentIntent?: PersonalResourceAttachmentIntent | null;
   xaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;
+  claudeProviderAccountAuthoritySnapshot?: ClaudeProviderAccountAuthoritySnapshotV1;
   // The manager session spawning this worker (a worker-signed sessionId claim
   // on the creating grant); null for direct API creates and scheduled runs.
   // When set, the worker's terminal-for-now transitions wake this parent.
   parentSessionId?: string | null;
+  // Deployment code_search policy for freezing a new root session's decision.
+  // Omitted falls back to the policy the process installed at boot.
+  codeSearchDeploymentPolicy?: CodeSearchDeploymentPolicy;
   // Workspace-scoped CREATE idempotency key. When present, a double-fire with
   // the same key (sequential retry OR concurrent race) collapses to a single
   // session. Every caller repairs or re-delivers the winner's one atomic start;
@@ -904,6 +1123,13 @@ export async function createAndStartSessionWithOutcome(input: {
   allowNestedAgentDepthIncrease?: boolean;
   subjectId?: string | null;
 }): Promise<CreateSessionOutcome> {
+  const frozenBundledSkillIds = bundledSkillSelectionForAgentConfig(
+    input.bundledSkillIds,
+    input.agentConfig,
+  );
+  if (frozenBundledSkillIds !== input.bundledSkillIds) {
+    input = { ...input, bundledSkillIds: frozenBundledSkillIds };
+  }
   const sessionMetadata = metadataWithTurnExecutionPolicyV1(
     {
       ...input.metadata,
@@ -965,20 +1191,27 @@ export async function createAndStartSessionWithOutcome(input: {
               scope: input.turnExecutionPolicy.providerId.startsWith("organization-")
                 ? ("organization" as const)
                 : ("workspace" as const),
-              providerKind: input.turnExecutionPolicy.providerId.includes("openrouter")
-                ? ("openrouter" as const)
-                : ("vercel_gateway" as const),
+              providerKind:
+                CLAUDE_CONNECTION_KINDS.find(
+                  (kind) =>
+                    claudeProviderId(kind) === input.turnExecutionPolicy.providerId ||
+                    claudeProviderId(kind, "workspace") === input.turnExecutionPolicy.providerId,
+                ) ??
+                (input.turnExecutionPolicy.providerId.includes("openrouter")
+                  ? ("openrouter" as const)
+                  : input.turnExecutionPolicy.providerId.endsWith("-opper")
+                    ? ("opper" as const)
+                    : ("vercel_gateway" as const)),
               upstreamModelId: input.turnExecutionPolicy.upstreamModelId,
             };
             const active = await lockActiveCustomModelForAdmission(tx, {
               accountId: input.accountId,
               workspaceId: input.workspaceId,
               reference,
+              claudeAuthority: { sessionId },
             });
             if (!active) {
-              throw new HTTPException(422, {
-                message: `model is not available: ${input.model}`,
-              });
+              throw modelUnavailableHttpException(input.model);
             }
           }
           // Reject an already-stale browser draft before the newly inserted
@@ -1020,59 +1253,76 @@ export async function createAndStartSessionWithOutcome(input: {
   // session or the committed denial atomically; an application-side lookup
   // cannot serialize those two source tables against an older writer.
   if (input.createIdempotencyKey) {
-    const keyedResult = await createSessionWithIdempotencyKeyResult(input.db, {
-      ...(input.requestedSessionId ? { requestedSessionId: input.requestedSessionId } : {}),
-      accountId: input.accountId,
-      workspaceId: input.workspaceId,
-      visibility: input.visibility ?? "workspace_shared",
-      initialMessage: input.initialMessage,
-      initialModelContext: input.modelContext ?? null,
-      resources: input.resources,
-      skills: input.skills ?? [],
-      bundledSkillIds: input.bundledSkillIds,
-      tools: input.tools,
-      toolPolicy: input.toolPolicy,
-      metadata: sessionMetadata,
-      initialAgentLearning: input.initialAgentLearning,
-      selectedHostMcpDelegations: input.selectedHostMcpDelegations ?? [],
-      ...(input.createdBy ? { createdBy: input.createdBy } : {}),
-      ...(frozenCreatedByContext ? { createdByContext: frozenCreatedByContext } : {}),
-      createdByActor: input.createdByActor ?? null,
-      model: input.model,
-      reasoningEffort: input.reasoningEffort,
-      latencyMode: input.latencyMode ?? "standard",
-      sandboxBackend: input.sandboxBackend,
-      variableSetIds: input.variableSets?.map((variableSet) => variableSet.id) ?? [],
-      variableSetId: input.variableSets?.at(-1)?.id ?? null,
-      rigId: input.rigId ?? null,
-      rigVersionId: input.rigVersionId ?? null,
-      channelId: input.channelId ?? null,
-      firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
-      firstPartyMcpTools: input.firstPartyMcpTools,
-      instructions: input.instructions ?? null,
-      policyRole: input.policyRole ?? null,
-      ...(input.agentAccess ? { agentAccess: input.agentAccess } : {}),
-      ...(input.scopeSubjectId !== undefined ? { scopeSubjectId: input.scopeSubjectId } : {}),
-      ...(input.memoryScope ? { memoryScope: input.memoryScope } : {}),
-      parentSessionId: input.parentSessionId ?? null,
-      createIdempotencyKey: input.createIdempotencyKey,
-      selectedInstalledSkillIds: input.selectedInstalledSkillIds ?? [],
-      sandboxGroupId: input.sandboxGroupId ?? null,
-      ...(input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}),
-      mcpServers: input.mcpServers ?? [],
-      personalConnectionDelegations: input.personalConnectionDelegations ?? [],
-      initialPersonalResourceAttachmentIntent:
-        input.initialPersonalResourceAttachmentIntent ?? null,
-      ...(input.xaiProviderAccountAuthoritySnapshot
-        ? {
-            initialXaiProviderAccountAuthoritySnapshot: input.xaiProviderAccountAuthoritySnapshot,
-          }
-        : {}),
-      maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,
-      allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,
-      subjectId: input.subjectId ?? null,
-      ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
-    });
+    const keyedResult = await measureSessionStartPhase(
+      input.startupObservability,
+      "shell_insert",
+      () =>
+        createSessionWithIdempotencyKeyResult(input.db, {
+          ...(input.requestedSessionId ? { requestedSessionId: input.requestedSessionId } : {}),
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          visibility: input.visibility ?? "workspace_shared",
+          initialMessage: input.initialMessage,
+          initialModelContext: input.modelContext ?? null,
+          resources: input.resources,
+          skills: input.skills ?? [],
+          bundledSkillIds: input.bundledSkillIds,
+          tools: input.tools,
+          toolPolicy: input.toolPolicy,
+          metadata: sessionMetadata,
+          initialAgentLearning: input.initialAgentLearning,
+
+          ...(input.createdBy ? { createdBy: input.createdBy } : {}),
+          ...(frozenCreatedByContext ? { createdByContext: frozenCreatedByContext } : {}),
+          createdByActor: input.createdByActor ?? null,
+          model: input.model,
+          reasoningEffort: input.reasoningEffort,
+          latencyMode: input.latencyMode ?? "standard",
+          sandboxBackend: input.sandboxBackend,
+          variableSetIds: input.variableSets?.map((variableSet) => variableSet.id) ?? [],
+          variableSetId: input.variableSets?.at(-1)?.id ?? null,
+          rigId: input.rigId ?? null,
+          rigVersionId: input.rigVersionId ?? null,
+          channelId: input.channelId ?? null,
+          firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
+          firstPartyMcpTools: input.firstPartyMcpTools,
+          ...(input.agentConfig !== undefined ? { agentConfig: input.agentConfig } : {}),
+          instructions: input.instructions ?? null,
+          ...(input.vaultPolicy ? { vaultPolicy: input.vaultPolicy } : {}),
+          policyRole: input.policyRole ?? null,
+          ...(input.agentAccess ? { agentAccess: input.agentAccess } : {}),
+          ...(input.scopeSubjectId !== undefined ? { scopeSubjectId: input.scopeSubjectId } : {}),
+          ...(input.memoryScope ? { memoryScope: input.memoryScope } : {}),
+          parentSessionId: input.parentSessionId ?? null,
+          createIdempotencyKey: input.createIdempotencyKey!,
+          selectedInstalledSkillIds: input.selectedInstalledSkillIds ?? [],
+          sandboxGroupId: input.sandboxGroupId ?? null,
+          ...(input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}),
+          mcpServers: input.mcpServers ?? [],
+          mcpApprovalPolicies: input.mcpApprovalPolicies ?? {},
+          personalConnectionDelegations: input.personalConnectionDelegations ?? [],
+          mcpAccountBindings: input.mcpAccountBindings ?? null,
+          connectionAccountIntent: input.connectionAccountIntent ?? null,
+          initialPersonalResourceAttachmentIntent:
+            input.initialPersonalResourceAttachmentIntent ?? null,
+          ...(input.xaiProviderAccountAuthoritySnapshot
+            ? {
+                initialXaiProviderAccountAuthoritySnapshot:
+                  input.xaiProviderAccountAuthoritySnapshot,
+              }
+            : {}),
+          ...(input.claudeProviderAccountAuthoritySnapshot
+            ? {
+                initialClaudeProviderAccountAuthoritySnapshot:
+                  input.claudeProviderAccountAuthoritySnapshot,
+              }
+            : {}),
+          maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,
+          allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,
+          subjectId: input.subjectId ?? null,
+          ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
+        }),
+    );
     if (keyedResult.denied) {
       throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(keyedResult.denial));
     }
@@ -1103,10 +1353,13 @@ export async function createAndStartSessionWithOutcome(input: {
         changed: finished.changed,
       };
     }
+    // A keyed shell whose start fails stays durable: a retry with the same key
+    // repairs it with the parameters it was first accepted with.
     const finished = await finishStartSession(
       targetSeededBeforeCreateCommit ? { ...input, seedTargetSandbox: null } : input,
       keyed,
     );
+    recordCreatedSessionUsage(input);
     return {
       session: finished.session,
       outcome: "created",
@@ -1116,67 +1369,84 @@ export async function createAndStartSessionWithOutcome(input: {
   }
   let session: Session;
   try {
-    session = await createSession(input.db, {
-      ...(input.requestedSessionId ? { requestedSessionId: input.requestedSessionId } : {}),
-      accountId: input.accountId,
-      workspaceId: input.workspaceId,
-      visibility: input.visibility ?? "workspace_shared",
-      initialMessage: input.initialMessage,
-      initialModelContext: input.modelContext ?? null,
-      resources: input.resources,
-      skills: input.skills ?? [],
-      bundledSkillIds: input.bundledSkillIds,
-      tools: input.tools,
-      toolPolicy: input.toolPolicy,
-      metadata: sessionMetadata,
-      initialAgentLearning: input.initialAgentLearning,
-      ...(input.createdBy ? { createdBy: input.createdBy } : {}),
-      selectedHostMcpDelegations: input.selectedHostMcpDelegations ?? [],
-      ...(frozenCreatedByContext ? { createdByContext: frozenCreatedByContext } : {}),
-      createdByActor: input.createdByActor ?? null,
-      model: input.model,
-      reasoningEffort: input.reasoningEffort,
-      latencyMode: input.latencyMode ?? "standard",
-      sandboxBackend: input.sandboxBackend,
-      variableSetIds: input.variableSets?.map((variableSet) => variableSet.id) ?? [],
-      variableSetId: input.variableSets?.at(-1)?.id ?? null,
-      rigId: input.rigId ?? null,
-      rigVersionId: input.rigVersionId ?? null,
-      channelId: input.channelId ?? null,
-      firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
-      firstPartyMcpTools: input.firstPartyMcpTools,
-      instructions: input.instructions ?? null,
-      policyRole: input.policyRole ?? null,
-      ...(input.agentAccess ? { agentAccess: input.agentAccess } : {}),
-      ...(input.scopeSubjectId !== undefined ? { scopeSubjectId: input.scopeSubjectId } : {}),
-      ...(input.memoryScope ? { memoryScope: input.memoryScope } : {}),
-      parentSessionId: input.parentSessionId ?? null,
-      sandboxGroupId: input.sandboxGroupId ?? null,
-      ...(input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}),
-      mcpServers: input.mcpServers ?? [],
-      personalConnectionDelegations: input.personalConnectionDelegations ?? [],
-      initialPersonalResourceAttachmentIntent:
-        input.initialPersonalResourceAttachmentIntent ?? null,
-      ...(input.xaiProviderAccountAuthoritySnapshot
-        ? {
-            initialXaiProviderAccountAuthoritySnapshot: input.xaiProviderAccountAuthoritySnapshot,
-          }
-        : {}),
-      maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,
-      allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,
-      subjectId: input.subjectId ?? null,
-      ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
-    });
+    session = await measureSessionStartPhase(input.startupObservability, "shell_insert", () =>
+      createSession(input.db, {
+        ...(input.requestedSessionId ? { requestedSessionId: input.requestedSessionId } : {}),
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        visibility: input.visibility ?? "workspace_shared",
+        initialMessage: input.initialMessage,
+        initialModelContext: input.modelContext ?? null,
+        resources: input.resources,
+        skills: input.skills ?? [],
+        bundledSkillIds: input.bundledSkillIds,
+        tools: input.tools,
+        toolPolicy: input.toolPolicy,
+        metadata: sessionMetadata,
+        initialAgentLearning: input.initialAgentLearning,
+        ...(input.createdBy ? { createdBy: input.createdBy } : {}),
+
+        ...(frozenCreatedByContext ? { createdByContext: frozenCreatedByContext } : {}),
+        createdByActor: input.createdByActor ?? null,
+        model: input.model,
+        reasoningEffort: input.reasoningEffort,
+        latencyMode: input.latencyMode ?? "standard",
+        sandboxBackend: input.sandboxBackend,
+        variableSetIds: input.variableSets?.map((variableSet) => variableSet.id) ?? [],
+        variableSetId: input.variableSets?.at(-1)?.id ?? null,
+        rigId: input.rigId ?? null,
+        rigVersionId: input.rigVersionId ?? null,
+        channelId: input.channelId ?? null,
+        firstPartyMcpPermissions: input.firstPartyMcpPermissions ?? null,
+        firstPartyMcpTools: input.firstPartyMcpTools,
+        ...(input.agentConfig !== undefined ? { agentConfig: input.agentConfig } : {}),
+        instructions: input.instructions ?? null,
+        ...(input.vaultPolicy ? { vaultPolicy: input.vaultPolicy } : {}),
+        policyRole: input.policyRole ?? null,
+        ...(input.agentAccess ? { agentAccess: input.agentAccess } : {}),
+        ...(input.scopeSubjectId !== undefined ? { scopeSubjectId: input.scopeSubjectId } : {}),
+        ...(input.memoryScope ? { memoryScope: input.memoryScope } : {}),
+        parentSessionId: input.parentSessionId ?? null,
+        ...(input.codeSearchDeploymentPolicy
+          ? { codeSearchDeploymentPolicy: input.codeSearchDeploymentPolicy }
+          : {}),
+        sandboxGroupId: input.sandboxGroupId ?? null,
+        ...(input.sandboxOs ? { sandboxOs: input.sandboxOs } : {}),
+        mcpServers: input.mcpServers ?? [],
+        mcpApprovalPolicies: input.mcpApprovalPolicies ?? {},
+        personalConnectionDelegations: input.personalConnectionDelegations ?? [],
+        mcpAccountBindings: input.mcpAccountBindings ?? null,
+        connectionAccountIntent: input.connectionAccountIntent ?? null,
+        initialPersonalResourceAttachmentIntent:
+          input.initialPersonalResourceAttachmentIntent ?? null,
+        ...(input.xaiProviderAccountAuthoritySnapshot
+          ? {
+              initialXaiProviderAccountAuthoritySnapshot: input.xaiProviderAccountAuthoritySnapshot,
+            }
+          : {}),
+        ...(input.claudeProviderAccountAuthoritySnapshot
+          ? {
+              initialClaudeProviderAccountAuthoritySnapshot:
+                input.claudeProviderAccountAuthoritySnapshot,
+            }
+          : {}),
+        maxNestedAgentDepthOverride: input.maxNestedAgentDepthOverride ?? null,
+        allowNestedAgentDepthIncrease: input.allowNestedAgentDepthIncrease ?? false,
+        subjectId: input.subjectId ?? null,
+        ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
+      }),
+    );
   } catch (error) {
     if (error instanceof SessionSpawnDeniedDbError) {
       throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(error.denial));
     }
     throw error;
   }
-  const finished = await finishStartSession(
+  const finished = await finishNewlyCreatedSession(
     targetSeededBeforeCreateCommit ? { ...input, seedTargetSandbox: null } : input,
     session,
   );
+  recordCreatedSessionUsage(input);
   return {
     session: finished.session,
     outcome: "created",
@@ -1185,6 +1455,51 @@ export async function createAndStartSessionWithOutcome(input: {
   };
 }
 
+/**
+ * Start an unkeyed shell this call just inserted. If the start fails before
+ * the first event or turn commits, the caller gets the error and has no way to
+ * resume that session, so the bare shell is discarded instead of lingering as
+ * a queued session nothing runs. A shell that did initialize (including an
+ * outcome-unknown commit) is kept.
+ */
+async function finishNewlyCreatedSession(
+  input: Parameters<typeof finishStartSession>[0],
+  session: Session,
+): Promise<Awaited<ReturnType<typeof finishStartSession>>> {
+  try {
+    return await finishStartSession(input, session);
+  } catch (error) {
+    try {
+      await discardUninitializedSessionShell(input.db, {
+        accountId: session.accountId,
+        workspaceId: session.workspaceId,
+        sessionId: session.id,
+      });
+    } catch {
+      // The original start failure is the actionable error; a shell that
+      // cannot be discarded now is no worse than before this cleanup ran.
+    }
+    throw error;
+  }
+}
+
+function recordCreatedSessionUsage(input: {
+  metrics?: ProductUsageMetricsSink | null;
+  surface?: SessionTurnSurface | null;
+  createdBy?: TurnInitiator;
+  parentSessionId?: string | null;
+  deferInitialTurn?: boolean;
+}): void {
+  recordSessionCreated(input.metrics, {
+    surface: input.surface,
+    createdByKind: input.createdBy?.kind ?? "service",
+    parentSessionId: input.parentSessionId,
+  });
+  if (!input.deferInitialTurn) {
+    recordUserMessageAccepted(input.metrics, { surface: input.surface });
+  }
+}
+
 /** Backward-compatible entity-returning create path used by existing callers. */
 export async function createAndStartSession(
   input: Parameters<typeof createAndStartSessionWithOutcome>[0],
@@ -1203,6 +1518,7 @@ async function finishStartSession(
     db: Database;
     bus: EventBus;
     workflowClient: Pick<SessionWorkflowClient, "wakeSessionWorkflow">;
+    startupObservability?: SessionStartObservability | null;
     initialMessage: string;
     captureInitialTurnAuthority?: (
       tx: Database,
@@ -1210,6 +1526,7 @@ async function finishStartSession(
       turnId: string,
     ) => Promise<void>;
     deferInitialTurn?: boolean;
+    surface?: SessionTurnSurface | null;
     modelContext?: string | null;
     resources: ResourceRef[];
     tools: ToolRef[];
@@ -1290,68 +1607,92 @@ async function finishStartSession(
       });
     }
   }
-  const started = await initializeSessionStartAtomically(input.db, {
-    accountId: session.accountId,
-    workspaceId: session.workspaceId,
-    sessionId: session.id,
-    ...(input.captureInitialTurnAuthority
-      ? {
-          captureInitialTurnAuthority: (tx: Database, turnId: string) =>
-            input.captureInitialTurnAuthority!(tx, session.id, turnId),
-        }
-      : {}),
-    ...(input.clientEventId ? { clientEventId: input.clientEventId } : {}),
-    reasoningEffortFallback: input.reasoningEffort,
-    turnExecutionPolicy: input.turnExecutionPolicy,
-    createdEventPayload: {
-      toolPolicy: input.toolPolicy,
-      ...(input.variableSets?.length
+  const started = await measureSessionStartPhase(input.startupObservability, "initialize", () =>
+    initializeSessionStartAtomically(input.db, {
+      accountId: session.accountId,
+      workspaceId: session.workspaceId,
+      sessionId: session.id,
+      ...(input.captureInitialTurnAuthority
         ? {
-            variableSetIds: input.variableSets.map((variableSet) => variableSet.id),
-            variableSets: input.variableSets,
-            // Legacy highest-precedence aliases.
-            variableSetId: input.variableSets.at(-1)!.id,
-            variableSetName: input.variableSets.at(-1)!.name,
+            captureInitialTurnAuthority: (tx: Database, turnId: string) =>
+              input.captureInitialTurnAuthority!(tx, session.id, turnId),
           }
         : {}),
-      ...(input.sessionMcpServers?.length ? { mcpServers: input.sessionMcpServers } : {}),
-    },
-    goal: input.goal
-      ? {
-          text: input.goal.text,
-          ...(input.goal.successCriteria !== undefined
-            ? { successCriteria: input.goal.successCriteria }
-            : {}),
-          ...(input.goal.rootConstraints !== undefined
-            ? { rootConstraints: input.goal.rootConstraints }
-            : {}),
-          ...(input.goal.maxAutoContinuations !== undefined
-            ? { maxAutoContinuations: input.goal.maxAutoContinuations }
-            : {}),
-          ...(input.goal.mutationPolicy !== undefined
-            ? { mutationPolicy: input.goal.mutationPolicy }
-            : {}),
-        }
-      : null,
-    initialAutomaticTitle: initialAutomaticTitleForSessionStart(
-      session,
-      input.initialAutomaticTitle,
+      ...(input.clientEventId ? { clientEventId: input.clientEventId } : {}),
+      reasoningEffortFallback: input.reasoningEffort,
+      turnExecutionPolicy: input.turnExecutionPolicy,
+      surface: input.surface ?? null,
+      createdEventPayload: {
+        toolPolicy: input.toolPolicy,
+        ...(input.variableSets?.length
+          ? {
+              variableSetIds: input.variableSets.map((variableSet) => variableSet.id),
+              variableSets: input.variableSets,
+              // Legacy highest-precedence aliases.
+              variableSetId: input.variableSets.at(-1)!.id,
+              variableSetName: input.variableSets.at(-1)!.name,
+            }
+          : {}),
+        ...(input.sessionMcpServers?.length ? { mcpServers: input.sessionMcpServers } : {}),
+      },
+      goal: input.goal
+        ? {
+            text: input.goal.text,
+            ...(input.goal.successCriteria !== undefined
+              ? { successCriteria: input.goal.successCriteria }
+              : {}),
+            ...(input.goal.rootConstraints !== undefined
+              ? { rootConstraints: input.goal.rootConstraints }
+              : {}),
+            ...(input.goal.reportRequirements !== undefined
+              ? { reportRequirements: input.goal.reportRequirements }
+              : {}),
+            ...(input.goal.maxAutoContinuations !== undefined
+              ? { maxAutoContinuations: input.goal.maxAutoContinuations }
+              : {}),
+            ...(input.goal.mutationPolicy !== undefined
+              ? { mutationPolicy: input.goal.mutationPolicy }
+              : {}),
+          }
+        : null,
+      initialAutomaticTitle: initialAutomaticTitleForSessionStart(
+        session,
+        input.initialAutomaticTitle,
+      ),
+      consumeNewSessionDraft: input.consumeNewSessionDraft ?? null,
+      rememberNewSessionSelection: input.rememberNewSessionSelection ?? null,
+      deferInitialTurn: input.deferInitialTurn === true,
+    }),
+  );
+  // Initialization committed the initial turn, events and wake outbox together.
+  // Live fanout is not workflow authority: signal from the durable revision
+  // without waiting for NATS, but retain and fully join both notifications.
+  const wakeRevision = started.workflowWakeRevision;
+  const [fanout, wake] = await Promise.allSettled([
+    measureSessionStartPhase(input.startupObservability, "event_fanout", () =>
+      publishDurableSessionEvents(input.bus, session.workspaceId, session.id, started.events),
     ),
-    consumeNewSessionDraft: input.consumeNewSessionDraft ?? null,
-    rememberNewSessionSelection: input.rememberNewSessionSelection ?? null,
-    deferInitialTurn: input.deferInitialTurn === true,
-  });
-  await publishDurableSessionEvents(input.bus, session.workspaceId, session.id, started.events);
-  if (started.workflowWakeRevision !== null) {
-    await input.workflowClient.wakeSessionWorkflow({
-      accountId: session.accountId,
-      workspaceId: session.workspaceId,
-      sessionId: session.id,
-      workflowId: started.temporalWorkflowId,
-      wakeRevision: started.workflowWakeRevision,
-    });
-  }
-  const persisted = await requireSession(input.db, session.workspaceId, session.id);
+    wakeRevision === null
+      ? Promise.resolve()
+      : measureSessionStartPhase(input.startupObservability, "workflow_wake", () =>
+          input.workflowClient.wakeSessionWorkflow({
+            accountId: session.accountId,
+            workspaceId: session.workspaceId,
+            sessionId: session.id,
+            workflowId: started.temporalWorkflowId,
+            wakeRevision,
+          }),
+        ),
+  ]);
+  // Keep the prior serial error priority without detaching attempt work. Normal
+  // transport failure remains best-effort inside publishDurableSessionEvents.
+  if (fanout.status === "rejected") throw fanout.reason;
+  if (wake.status === "rejected") throw wake.reason;
+  const persisted = await measureSessionStartPhase(
+    input.startupObservability,
+    "session_reload",
+    () => requireSession(input.db, session.workspaceId, session.id),
+  );
   const initialTurnId =
     started.turn?.id ??
     (await listSessionTurns(input.db, session.workspaceId, session.id, 1))[0]?.id ??
@@ -1366,6 +1707,17 @@ export function workflowIdForSession(sessionId: string): string {
   return `session-${sessionId}`;
 }
 
+/**
+ * The one 422 for a model that is not selectable in the live catalog (retired,
+ * removed, or never offered). The message keeps its historical text; the typed
+ * cause lets the API envelope add `details.code: "model_unavailable"` so
+ * clients can ask for another model instead of offering a futile retry.
+ */
+export function modelUnavailableHttpException(model: string): HTTPException {
+  const cause = new ModelUnavailableError(model);
+  return new HTTPException(422, { message: cause.message, cause });
+}
+
 /**
  * Reject an explicit model that the host does not expose. The set of usable
  * models is the union surfaced by `configuredAllowedModels` (the built-in
@@ -1374,8 +1726,9 @@ export function workflowIdForSession(sessionId: string): string {
  * the API edge with 422 rather than enqueuing a turn the worker can't honor.
  *
  * `model` is the effective value selected by the caller's boundary. Top-level
- * omission defaults to `settings.openaiModel`; child-session omission inherits
- * the worker-signed calling turn before reaching this helper. Centralized here
+ * omission resolves the new-chat default (`resolveDefaultSessionModel`);
+ * child-session omission inherits the worker-signed calling turn before
+ * reaching this helper. Centralized here
  * so every model-carrying choke point
  * (create-session, user-message/turn-accept, queued-turn update, and
  * scheduled-task agentConfig — a scheduled task is a session the worker runs
@@ -1390,6 +1743,18 @@ export function canonicalConfiguredModel(
     return model;
   }
   const canonicalModel = canonicalizeConfiguredModelId(settings, model);
+  if (
+    canonicalModel.startsWith(CODEX_MODEL_ID_PREFIX) &&
+    settings.resolvedCodexModelsJson !== undefined
+  ) {
+    if (
+      settings.codexSubscriptionEnabled &&
+      configuredAllowedModels(withCodexCatalogProvider(settings)).includes(canonicalModel)
+    ) {
+      return canonicalModel;
+    }
+    throw modelUnavailableHttpException(model);
+  }
   if (configuredAllowedModels(settings).includes(canonicalModel)) {
     return canonicalModel;
   }
@@ -1412,7 +1777,7 @@ export function canonicalConfiguredModel(
   ) {
     return canonicalModel;
   }
-  throw new HTTPException(422, { message: `model is not available: ${model}` });
+  throw modelUnavailableHttpException(model);
 }
 
 export function assertConfiguredModel(settings: Settings, model: string | null | undefined): void {
@@ -1455,10 +1820,10 @@ export function assertSessionAllowsProductModel(
  * worker's authoritative post-resolution gate would fail. `model` is the
  * EFFECTIVE value the caller is about to persist: pass the explicit value at
  * message/turn-update/scheduled-task edges (omitted inherits an
- * already-validated stored default), but at session CREATION pass
- * `payload.model ?? settings.openaiModel` — an omitted model stamps the
- * deployment default onto the session, and under a restricted policy that
- * default may be exactly the provider the policy exists to block.
+ * already-validated stored default), but at session CREATION pass the
+ * effective model: an omitted model stamps the resolved default onto the
+ * session, and under a restricted policy that default may be exactly the
+ * provider the policy exists to block.
  */
 export async function assertWorkspaceModelPolicyAllows(
   db: Database,
@@ -1481,13 +1846,16 @@ export async function assertWorkspaceModelPolicyAllows(
   const verdict = evaluateWorkspaceModelPolicy(policy, {
     providerId,
     modelId: canonicalModel,
+    chargesCredits: policyChargesCreditsForModel(settings, canonicalModel),
   });
   if (!verdict.allowed) {
     throw new HTTPException(422, {
       message:
-        verdict.reason === "provider"
-          ? `model "${canonicalModel}" is not allowed by this workspace's model policy: provider "${providerId}" is not in the allowed providers`
-          : `model "${canonicalModel}" is not allowed by this workspace's model policy`,
+        verdict.reason === "credits"
+          ? `model "${canonicalModel}" uses Opengeni credits, which are turned off in this workspace. Choose a model paid by a subscription or API key, or ask a workspace admin to turn Opengeni credits back on`
+          : verdict.reason === "provider"
+            ? `model "${canonicalModel}" is not allowed by this workspace's model policy: provider "${providerId}" is not in the allowed providers`
+            : `model "${canonicalModel}" is not allowed by this workspace's model policy`,
     });
   }
 }
@@ -1547,11 +1915,16 @@ type PostUserMessageTurnInput = {
   clientEventId?: string;
   mcpCredentialUpdates?: UpdateSessionMcpServerCredentialsInput[];
   personalConnectionDelegations?: McpPersonalConnectionDelegation[];
-  selectedHostMcpDelegations?: HostMcpCreateSelection[];
+  mcpAccountBindings?: McpConnectionAccountBinding[] | null;
+  /** The sender's account intent, carried by work that continues this turn. */
+  connectionAccountIntent?: ConnectionAccountIntent | null;
+
   captureTurnAuthority?: (tx: Database, turnId: string) => Promise<void>;
   personalResourceAttachment?: PersonalResourceAttachmentIntent;
   delivery?: "send" | "steer";
   origin?: "human" | "operator";
+  /** Content-free product surface the request entered through. */
+  surface?: SessionTurnSurface | null;
   actor?: string;
   actorLabel?: string;
   commandActor?: SessionCommandActor;
@@ -1682,6 +2055,8 @@ export async function postUserMessageTurn(
   const { db, settings, accountId, workspaceId, sessionId } = input;
   const requestedModel = canonicalConfiguredModel(settings, input.model ?? null) ?? null;
   const requestedReasoningEffort = input.reasoningEffort ?? null;
+  // A message sent from a Site page records which Site (and version) on its turn.
+  const siteOrigin = currentSiteSessionOrigin();
   // Reject an explicit per-message model the host does not expose; an omitted
   // model inherits the session's model downstream (always a configured id).
   assertConfiguredModel(settings, requestedModel);
@@ -1751,13 +2126,15 @@ export async function postUserMessageTurn(
                 input.reasoningEffortFallback ?? settings.openaiReasoningEffort,
               turnExecutionPolicy: input.turnExecutionPolicy,
               source: input.origin === "operator" ? "api" : "user",
+              surface: input.surface ?? null,
               ...(input.recordAgentRunUsage !== undefined
                 ? { recordAgentRunUsage: input.recordAgentRunUsage }
                 : {}),
               personalConnectionDelegations: input.personalConnectionDelegations ?? [],
-              ...(input.selectedHostMcpDelegations?.length
-                ? { selectedHostMcpDelegations: input.selectedHostMcpDelegations }
-                : {}),
+              mcpAccountBindings: input.mcpAccountBindings ?? null,
+              connectionAccountIntent: input.connectionAccountIntent ?? null,
+              ...(siteOrigin ? { turnMetadata: { [SITE_ORIGIN_METADATA_KEY]: siteOrigin } } : {}),
+
               ...(input.captureTurnAuthority
                 ? { captureTurnAuthority: input.captureTurnAuthority }
                 : {}),
@@ -1769,7 +2146,10 @@ export async function postUserMessageTurn(
               mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],
               ...(freshWorkspaceCustomModel
                 ? {
-                    beforeFreshPromptCommit: async (tx: Database): Promise<void> => {
+                    beforeFreshPromptCommit: async (
+                      tx: Database,
+                      { claudeProviderAccountAuthoritySnapshot, claudeAcceptedSource },
+                    ): Promise<void> => {
                       const reference = workspaceCustomModelReference(
                         settings,
                         freshWorkspaceCustomModel,
@@ -1781,17 +2161,24 @@ export async function postUserMessageTurn(
                         accountId,
                         workspaceId,
                         reference,
+                        claudeAuthority: {
+                          authoritySnapshot: claudeProviderAccountAuthoritySnapshot,
+                          ...(claudeAcceptedSource ? { acceptedSource: claudeAcceptedSource } : {}),
+                        },
                       });
                       if (!active) {
-                        throw new HTTPException(422, {
-                          message: `model is not available: ${freshWorkspaceCustomModel}`,
-                        });
+                        throw modelUnavailableHttpException(freshWorkspaceCustomModel);
                       }
                     },
                   }
                 : {}),
               controlLockTimeoutMs: workspaceControlRequestLockTimeoutMs(),
             }),
+          undefined,
+          "shared",
+          // Linked-actor capture reauthorizes under the organization-membership
+          // lock; take it before the tenancy fence and the canonical prefix.
+          Boolean(input.captureTurnAuthority),
         ),
     );
   } catch (error) {
@@ -1981,11 +2368,144 @@ async function resolveWorkspaceModelBoundarySettings(
   ).settings;
 }
 
+/** Explicit recovery, never a new prompt or a Pause/Resume command. */
+export async function retryFailedSession(
+  deps: ApiRouteDeps,
+  grant: AccessGrant,
+  workspaceId: string,
+  sessionId: string,
+  request: SessionRetryRequest,
+): Promise<SessionRetryResponse> {
+  requirePermission(grant, "sessions:control");
+  await requireSessionAuthorization(deps, grant, {
+    sessionId,
+    operation: "session.control",
+    surface: "core",
+  });
+  const replay = await withWorkspaceSubjectSessionActivityRls(
+    deps.db,
+    workspaceId,
+    grant.subjectId,
+    async (db) =>
+      await getSessionRetryReceiptInTransaction(db, {
+        workspaceId,
+        sessionId,
+        subjectId: grant.subjectId,
+        request,
+      }),
+  );
+  if (replay) return replay;
+  const session = await requireSession(deps.db, workspaceId, sessionId);
+  // A retry is a new model request: a reached task usage limit refuses it.
+  await requireSessionUsageLimitAllows(
+    deps.db,
+    { accountId: grant.accountId, workspaceId, sessionId, runtime: true },
+    { sink: deps.observability, boundary: "send" },
+  );
+  const failure = await getSessionEvent(deps.db, workspaceId, request.failureEventId);
+  if (!failure || failure.sessionId !== sessionId)
+    throw new SessionRetryConflictError("RETRY_STALE_FAILURE", "The failure event is unavailable");
+  const turn = failure?.turnId ? await getSessionTurn(deps.db, workspaceId, failure.turnId) : null;
+  const retainedModel = turn?.model ?? session.model;
+  const settings = await resolveWorkspaceModelBoundarySettings(
+    deps,
+    grant,
+    workspaceId,
+    [request.model ?? retainedModel],
+    retainedModel,
+  );
+  const model = canonicalConfiguredModel(settings, request.model ?? retainedModel)!;
+  try {
+    assertSessionAllowsProductModel(session, model);
+  } catch (error) {
+    if (error instanceof CodexCompactionV2ProviderLockedError)
+      throw new HTTPException(422, { message: error.message, cause: error });
+    throw error;
+  }
+  await assertWorkspaceModelPolicyAllows(deps.db, settings, workspaceId, model);
+  const executionPolicy = withDeveloperSetupCredentialRestriction(
+    resolveTurnExecutionPolicyV1(settings, {
+      modelId: model,
+      requestedModelId: request.model ?? null,
+      modelSource: request.model === undefined ? "session" : "explicit",
+      reasoningEffort: request.reasoningEffort ?? turn?.reasoningEffort ?? session.reasoningEffort,
+      reasoningSource: request.reasoningEffort === undefined ? "session" : "explicit",
+      latencyMode: request.latencyMode ?? turn?.latencyMode ?? session.latencyMode,
+      latencyModeSource: request.latencyMode === undefined ? "session" : "explicit",
+    }),
+    { grant, trustedMetadata: [session.metadata, turn?.metadata] },
+  );
+  await requireLimit(
+    { ...deps, settings },
+    {
+      accountId: grant.accountId,
+      workspaceId,
+      initiatingHumanSubjectId: turn
+        ? initiatingHumanForAllowance({
+            initiator: turn.initiator,
+            initiatingHumanSubjectId: await getSessionTurnInitiatingHumanSubjectId(
+              deps.db,
+              workspaceId,
+              turn.id,
+            ),
+          })
+        : null,
+      action: "agent_run:create",
+      quantity: 1,
+      model,
+      ...(turn ? { acceptedTurn: { sessionId: session.id, turnId: turn.id } } : {}),
+    },
+  );
+  const result = await runIdempotentPersistenceTransaction(
+    {
+      stage: "session.retry",
+      eventTypes: ["turn.recovery.requested", "session.status.changed"],
+      maxAttempts: 3,
+    },
+    async () =>
+      await withWorkspaceSubjectSessionActivityRls(
+        deps.db,
+        workspaceId,
+        grant.subjectId,
+        async (db) =>
+          await retryFailedSessionInTransaction(db, {
+            accountId: grant.accountId,
+            workspaceId,
+            sessionId,
+            subjectId: grant.subjectId,
+            request,
+            executionPolicy,
+          }),
+      ),
+  );
+  // Fanout and workflow dispatch are reconstructible after the durable commit.
+  // Never report an admitted retry as failed because one notification is down.
+  void Promise.all([
+    deps.workflowClient.requestSessionWorkflowWakeDispatch(),
+    (async () => {
+      const events = await Promise.all(
+        result.eventIds.map((id) => getSessionEvent(deps.db, workspaceId, id)),
+      );
+      await publishDurableSessionEvents(
+        deps.bus,
+        workspaceId,
+        sessionId,
+        events.filter((event): event is SessionEvent => event !== null),
+      );
+    })(),
+  ]).catch(() => {
+    console.warn("[sessions] retry notification failed; durable recovery remains", {
+      errorCode: "session_retry_notification_failed",
+    });
+  });
+  return { outcome: result.outcome, turnId: result.turnId, failureEventId: result.failureEventId };
+}
+
 async function withSessionCreateUsageRecording(input: {
   deps: ApiRouteDeps;
   grant: AccessGrant;
   workspaceId: string;
-  startMode: "realtime" | undefined;
+  startMode: "realtime" | "standard" | undefined;
   origin: "system" | "user";
   createOutcome: CreateSessionOutcome;
 }): Promise<CreateSessionRequestOutcome> {
@@ -2022,29 +2542,30 @@ async function createSessionForRequestInFileScope(
   rawPayload: unknown,
   authorization?: AccessGrantAuthorization,
   agentChildPresentation?: AgentChildSessionCreatePresentation,
+  requestOptions: SessionCreateRequestOptions = {},
 ): Promise<CreateSessionRequestOutcome> {
   const payload = CreateSessionRequest.parse(rawPayload);
+  // An agent started from a Site page keeps its workers off chosen machines
+  // and other sessions' sandboxes.
+  await assertSiteAgentMayChooseCompute(unresolvedDeps.db, grant, payload);
+  // A tool whose backing workload this deployment does not run is dropped, not
+  // rejected: a client echoing a full catalog must not fail on a deployment fact.
+  if (payload.firstPartyMcpTools) {
+    const unavailable = deploymentUnavailableFirstPartyMcpTools(unresolvedDeps.settings);
+    payload.firstPartyMcpTools = payload.firstPartyMcpTools.filter(
+      (tool) => !unavailable.has(tool),
+    );
+  }
+  // Read before any await: the Site scope is request-local provenance.
+  const surface = resolveTurnSurface({
+    grant,
+    authorization,
+    requested: requestOptions.surface,
+  });
   payload.metadata = sessionCreationMetadata(payload.metadata);
   const creationMetadata = externalCreationMetadata(payload.metadata, authorization, grant);
   const externalBeforeCreateCommit = externalContinuationCommitAuthorizer(authorization);
-  const hostSelections = payload.selectedHostMcpDelegations ?? [];
-  if (
-    hostSelections.length &&
-    (!authorization ||
-      authorization.grant.accountId !== grant.accountId ||
-      authorization.grant.subjectId !== grant.subjectId ||
-      authorization?.grant.workspaceId !== workspaceId ||
-      !hasPermission(authorization?.grant.permissions ?? [], "connections:read") ||
-      !hasPermission(grant.permissions, "connections:read") ||
-      grant.metadata?.["sessionId"] ||
-      payload.startMode === "realtime")
-  ) {
-    throw new HTTPException(403, {
-      message: "Host selection requires a verified direct owner and non-realtime start",
-    });
-  }
-  if (hostSelections.length)
-    prepareHostMcpOwnerAuthorization(authorization!, workspaceId, "connections:read");
+
   if (hasReservedOpenGeniSlackBotSessionMetadata(payload.metadata)) {
     throw new HTTPException(422, {
       message: `${OPENGENI_SLACK_BOT_SESSION_METADATA_KEY} is reserved for scheduler routing`,
@@ -2059,11 +2580,10 @@ async function createSessionForRequestInFileScope(
       });
     }
     await requireManagedHumanPrivateSessionCreate(unresolvedDeps, authorization, workspaceId);
-    if (payload.sandbox === "shared" || typeof payload.sandbox === "object") {
-      throw new HTTPException(422, {
-        message: "Only-me sessions require their own sandbox",
-      });
-    }
+    // Who can read a session and who can use a sandbox are separate: an
+    // Only-me session may join a sandbox group the creator can already see.
+    // Its own records stay scoped to its audience; files on the box are as
+    // shared as the box.
   }
   // Parent linkage and execution-context inheritance come ONLY from the
   // worker-signed sessionId claim. A caller cannot nominate a parent in the
@@ -2087,13 +2607,76 @@ async function createSessionForRequestInFileScope(
       throw error;
     }
   }
+  // a create-time usage limit belongs to a new ROOT task and only a
+  // person or the trusted host may set it. Agents (including children, which
+  // always share their root's limit) are rejected even when the value is null.
+  let initialUsageLimitActor: ReturnType<typeof sessionUsageLimitWriteActorForAccess> | null = null;
+  if (payload.usageLimitMicros !== undefined) {
+    try {
+      if (parentSessionId || !authorization) {
+        throw new SessionUsageLimitHttpError(
+          403,
+          "session_usage_limit_forbidden",
+          "Only a person or the application's server can set a task usage limit.",
+        );
+      }
+      initialUsageLimitActor = sessionUsageLimitWriteActorForAccess(authorization);
+    } catch (error) {
+      recordSessionUsageLimitEvent(unresolvedDeps.observability, "create", "forbidden");
+      throw error;
+    }
+  }
+  if (
+    payload.usageLimitMicros !== undefined &&
+    payload.usageLimitMicros !== null &&
+    !sessionUsageLimitsProducerEnabled(unresolvedDeps.settings)
+  ) {
+    recordSessionUsageLimitEvent(unresolvedDeps.observability, "create", "disabled");
+    throw new SessionUsageLimitHttpError(
+      422,
+      "session_usage_limit_disabled",
+      "Usage limits are not enabled on this server.",
+    );
+  }
+  // The trusted server in this process (published Site runtime) may attach a
+  // limit to a root session it creates as its own service principal, so the
+  // limit is in place before the first model call. Requests cannot set it.
+  const hostUsageLimit = currentHostSessionUsageLimit();
+  const hostInitialUsageLimit =
+    payload.usageLimitMicros === undefined &&
+    !parentSessionId &&
+    hostUsageLimit !== undefined &&
+    hostUsageLimit.subjectId === grant.subjectId
+      ? hostUsageLimit
+      : null;
+  if (hostInitialUsageLimit && !sessionUsageLimitsProducerEnabled(unresolvedDeps.settings)) {
+    recordSessionUsageLimitEvent(unresolvedDeps.observability, "create", "disabled");
+    throw new SessionUsageLimitHttpError(
+      422,
+      "session_usage_limit_disabled",
+      "Usage limits are not enabled on this server.",
+    );
+  }
+  // A task whose usage limit is reached cannot start more inference by
+  // spawning another agent.
+  if (parentSessionId) {
+    await requireSessionUsageLimitAllows(
+      db,
+      { accountId: grant.accountId, workspaceId, sessionId: parentSessionId },
+      { sink: unresolvedDeps.observability, boundary: "child_create" },
+    );
+  }
   const parentSession = parentSessionId ? await getSession(db, workspaceId, parentSessionId) : null;
   if (parentSessionId && !parentSession) {
     throw new HTTPException(404, {
       message: `parent session not found in workspace: ${parentSessionId}`,
     });
   }
-  const workspace = await requireWorkspace(db, workspaceId);
+  const workspace = await measureSessionStartPhase(
+    unresolvedDeps.observability,
+    "workspace_read",
+    () => requireWorkspace(db, workspaceId),
+  );
   const workspaceSessionToolDefaults = resolveWorkspaceSessionToolDefaults(workspace.settings);
   const parentAuthority = parentSession
     ? await getSessionAuthorityProjection(db, workspaceId, parentSession.id)
@@ -2150,6 +2733,27 @@ async function createSessionForRequestInFileScope(
         }
       : null,
   });
+  // One frozen agent configuration for this session (null = exact legacy).
+  // Resolved before keyed replay so a retry that resolves differently is a
+  // conflict rather than a silent replay.
+  const agentConfigCreator: AgentConfigCreator =
+    requestOptions.agentConfigCreator ?? (requestOptions.surface === "slack" ? "slack" : "api");
+  const agentResolution = resolveSessionAgentConfigForCreate({
+    settings: unresolvedDeps.settings,
+    creator: agentConfigCreator,
+    request: payload.agent,
+    instructions: payload.instructions,
+    workspaceSettings: workspace.settings,
+    parent: parentSession,
+    goal: payload.goal !== undefined,
+  });
+  const agentConfig = agentResolution.config;
+  if (agentResolution.instructions !== undefined) {
+    payload.instructions = agentResolution.instructions;
+  }
+  // Freeze what the agent configuration implies before keyed replay compares
+  // it: a `"none"` agent omits the bundled guides unless the request lists them.
+  bundledSkillIds = bundledSkillSelectionForAgentConfig(bundledSkillIds, agentConfig);
   const parentCallingTurn =
     parentSession && creationInitiator.actor
       ? await getSessionTurnForAttempt(
@@ -2176,36 +2780,47 @@ async function createSessionForRequestInFileScope(
       ? grant.subjectId
       : null;
   let retainedKeyedShellModel: string | null = null;
+  let retainedKeyedShellReasoningEffort: Session["reasoningEffort"] | null = null;
   if (
     payload.idempotencyKey &&
     (effectiveVisibility !== "user_private" || replayManagedHumanSubjectId !== null)
   ) {
+    const createIdempotencyKey = payload.idempotencyKey;
     try {
-      const initializedReplay = await getInitializedSessionCreateReplay(db, {
-        bundledSkillIds,
-        accountId: grant.accountId,
-        workspaceId,
-        subjectId: replayManagedHumanSubjectId ?? grant.subjectId,
-        ...(replayManagedHumanSubjectId
-          ? { activeManagedHumanSubjectId: replayManagedHumanSubjectId }
-          : {}),
-        createIdempotencyKey: payload.idempotencyKey,
-        selectedInstalledSkillIds: payload.installedSkillIds ?? [],
-        initialAgentLearning: payload.agentLearning,
-        ...sessionScope,
-        selectedHostMcpDelegations: hostSelections,
-        ...(payload.requestedSessionId ? { requestedSessionId: payload.requestedSessionId } : {}),
-        visibility: effectiveVisibility,
-        variableSetIds: payload.variableSetIds ?? [],
-        initialPersonalResourceAttachmentIntent: payload.personalResourceAttachment ?? null,
-        deferInitialTurn: payload.startMode === "realtime",
-      });
-      if (initializedReplay) {
-        if (initializedReplay.outcome === "denied") {
-          throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(initializedReplay.denial));
-        }
+      const initializedReplay = await measureSessionStartPhase(
+        unresolvedDeps.observability,
+        "idempotent_replay",
+        () =>
+          getInitializedSessionCreateReplay(db, {
+            bundledSkillIds,
+            accountId: grant.accountId,
+            workspaceId,
+            subjectId: replayManagedHumanSubjectId ?? grant.subjectId,
+            ...(replayManagedHumanSubjectId
+              ? { activeManagedHumanSubjectId: replayManagedHumanSubjectId }
+              : {}),
+            createIdempotencyKey,
+            selectedInstalledSkillIds: payload.installedSkillIds ?? [],
+            initialAgentLearning: payload.agentLearning,
+            ...sessionScope,
+
+            ...(payload.requestedSessionId
+              ? { requestedSessionId: payload.requestedSessionId }
+              : {}),
+            visibility: effectiveVisibility,
+            variableSetIds: payload.variableSetIds ?? [],
+            initialPersonalResourceAttachmentIntent: payload.personalResourceAttachment ?? null,
+            deferInitialTurn: payload.startMode === "realtime",
+            agentConfig,
+          }),
+      );
+      if (initializedReplay) {
+        if (initializedReplay.outcome === "denied") {
+          throw new SessionSpawnDeniedError(SessionSpawnDenial.parse(initializedReplay.denial));
+        }
         if (initializedReplay.outcome === "pending") {
           retainedKeyedShellModel = initializedReplay.session.model;
+          retainedKeyedShellReasoningEffort = initializedReplay.session.reasoningEffort;
         } else {
           if (initializedReplay.workflowWakeRevision !== null) {
             await unresolvedDeps.workflowClient.wakeSessionWorkflow({
@@ -2243,12 +2858,17 @@ async function createSessionForRequestInFileScope(
       throw error;
     }
   }
-  let settings = await resolveWorkspaceModelBoundarySettings(
-    unresolvedDeps,
-    grant,
-    workspaceId,
-    [payload.model],
-    retainedKeyedShellModel,
+  let settings = await measureSessionStartPhase(
+    unresolvedDeps.observability,
+    "model_catalog_initial",
+    () =>
+      resolveWorkspaceModelBoundarySettings(
+        unresolvedDeps,
+        grant,
+        workspaceId,
+        [payload.model],
+        retainedKeyedShellModel,
+      ),
   );
   let deps =
     settings === unresolvedDeps.settings
@@ -2266,14 +2886,42 @@ async function createSessionForRequestInFileScope(
     payload.personalResourceAttachment,
     false,
   );
-  const inheritedModel = parentCallingTurn?.model ?? parentSession?.model ?? settings.openaiModel;
+  // A top-level create that names no model gets the resolved new-chat default
+  // (saved workspace default, then a usable connected subscription, then the
+  // credits default while the organization holds credits, then the deployment
+  // default). Children still inherit their calling turn, never this default.
+  // A keyed retry of a still-uninitialized shell keeps the default that shell
+  // already persisted instead of resolving again.
+  const resolvedDefault =
+    parentSession || payload.model !== undefined
+      ? null
+      : retainedKeyedShellModel !== null && retainedKeyedShellReasoningEffort !== null
+        ? { model: retainedKeyedShellModel, reasoningEffort: retainedKeyedShellReasoningEffort }
+        : await measureSessionStartPhase(unresolvedDeps.observability, "default_model", () =>
+            resolveDefaultSessionModel(db, settings, {
+              accountId: grant.accountId,
+              workspaceId,
+              subjectId: grant.subjectId,
+              workspaceSettings: workspace.settings,
+            }),
+          );
+  const inheritedModel =
+    parentCallingTurn?.model ??
+    parentSession?.model ??
+    resolvedDefault?.model ??
+    settings.openaiModel;
   const effectiveModelId = payload.model ?? inheritedModel;
-  const effectiveCatalogSettings = await resolveWorkspaceModelBoundarySettings(
-    deps,
-    grant,
-    workspaceId,
-    [effectiveModelId],
-    parentSession ? inheritedModel : null,
+  const effectiveCatalogSettings = await measureSessionStartPhase(
+    unresolvedDeps.observability,
+    "model_catalog_effective",
+    () =>
+      resolveWorkspaceModelBoundarySettings(
+        deps,
+        grant,
+        workspaceId,
+        [effectiveModelId],
+        parentSession ? inheritedModel : null,
+      ),
   );
   if (effectiveCatalogSettings !== settings) {
     deps = {
@@ -2320,6 +2968,15 @@ async function createSessionForRequestInFileScope(
           creationInitiator.actor.turnId,
         )
       : undefined;
+  const claudeProviderAccountAuthoritySnapshot =
+    parentSession && creationInitiator.actor
+      ? await getSessionTurnClaudeProviderAccountAuthoritySnapshot(
+          db,
+          workspaceId,
+          parentSession.id,
+          creationInitiator.actor.turnId,
+        )
+      : undefined;
   const connectionDelegationSource = personalConnectionDelegationSourceForGrant(grant);
   const inheritedPersonalConnectionDelegations =
     connectionDelegationSource.kind === "turn"
@@ -2330,15 +2987,20 @@ async function createSessionForRequestInFileScope(
           connectionDelegationSource.turnId,
         )
       : null;
-  const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(
-    db,
-    workspaceId,
-    settings,
-    inheritedPersonalConnectionDelegations
-      ? {
-          personalConnectionDelegations: inheritedPersonalConnectionDelegations,
-        }
-      : { subjectId: grant.subjectId },
+  const capabilityRuntimeSettings = await measureSessionStartPhase(
+    unresolvedDeps.observability,
+    "capability_settings",
+    () =>
+      settingsWithEnabledCapabilityMcpServers(
+        db,
+        workspaceId,
+        settings,
+        inheritedPersonalConnectionDelegations
+          ? {
+              personalConnectionDelegations: inheritedPersonalConnectionDelegations,
+            }
+          : { subjectId: grant.subjectId },
+      ),
   );
   const sessionMcpServers = hasOwnProperty(rawPayload, "mcpServers")
     ? validateSessionMcpServersForCreate(capabilityRuntimeSettings, grant, payload.mcpServers)
@@ -2351,6 +3013,27 @@ async function createSessionForRequestInFileScope(
     capabilityRuntimeSettings,
     sessionMcpServers.runtimeServers,
   );
+  const requestedMcpPolicies =
+    payload.mcpApprovalPolicies ?? parentSession?.mcpApprovalPolicies ?? {};
+  const mcpApprovalPolicies: Record<string, SessionMcpApprovalPolicy> = {};
+  if (Object.keys(requestedMcpPolicies).length > 0) {
+    requirePermission(grant, "sessions:control");
+    const inheritedServers = await listEnabledMcpCapabilityServers(db, workspaceId);
+    for (const [id, policy] of Object.entries(requestedMcpPolicies)) {
+      const inherited = inheritedServers.find((server) => server.id === id);
+      if (!inherited || sessionMcpServers.runtimeServers.some((server) => server.id === id)) {
+        throw new HTTPException(422, {
+          message: `MCP approval policy must name an enabled inherited capability: ${id}${
+            /^api_(openapi|graphql)_/.test(id)
+              ? "; API Integration tool approval is set at install with autoApprovedTools"
+              : ""
+          }`,
+        });
+      }
+      mcpApprovalPolicies[id] =
+        resolveMcpApprovalRecommendation(policy, inherited.approvalFloor) ?? false;
+    }
+  }
   const resources = normalizeResources(
     hasOwnProperty(rawPayload, "resources")
       ? payload.resources
@@ -2395,6 +3078,11 @@ async function createSessionForRequestInFileScope(
     });
   }
   const toolsProvided = hasOwnProperty(rawPayload, "tools");
+  if (toolsProvided && payload.excludedMcpServerIds !== undefined) {
+    throw new HTTPException(422, {
+      message: "connector exclusions require workspace-default tools",
+    });
+  }
   // Visibility became durable draft state after older clients had already
   // written rows without it. Compare it only when the create request supplied
   // the field explicitly; the parsed schema default must not manufacture a
@@ -2417,6 +3105,9 @@ async function createSessionForRequestInFileScope(
           )
         : parentSession.tools,
       runtimeSettings,
+    ).filter(
+      (tool) =>
+        tool.id === "opengeni" || !parentSession.toolPolicy.excludedMcpServerIds?.includes(tool.id),
     );
     if (toolsProvided) {
       assertToolRefsSubset(
@@ -2434,6 +3125,7 @@ async function createSessionForRequestInFileScope(
       toolPolicy = {
         mode: parentTracksWorkspaceDefaults ? "workspace_default" : "inherited",
         inheritedFromSessionId: parentSession.id,
+        ...defaultPolicyExclusions(parentSession.toolPolicy.excludedMcpServerIds),
       };
     }
   } else if (toolsProvided) {
@@ -2448,50 +3140,87 @@ async function createSessionForRequestInFileScope(
     );
     toolPolicy = { mode: "workspace_default", inheritedFromSessionId: null };
   }
+  if (!parentSession) {
+    selectedTools = withSameRequestSessionMcpServerTools(
+      selectedTools,
+      sessionMcpServers.runtimeServers,
+    );
+  }
+  if (payload.excludedMcpServerIds !== undefined) {
+    if (toolPolicy.mode !== "workspace_default") {
+      throw new HTTPException(403, {
+        message: "connector exclusions require workspace-default tools",
+      });
+    }
+    toolPolicy = {
+      ...toolPolicy,
+      ...defaultPolicyExclusions([
+        ...(toolPolicy.excludedMcpServerIds ?? []),
+        ...payload.excludedMcpServerIds,
+      ]),
+    };
+  }
+  selectedTools = withoutExcludedMcpServers(selectedTools, toolPolicy.excludedMcpServerIds);
+  if (agentConfig) {
+    // Product refs survive a connectors-off configuration: servers attached to
+    // this session, refs the request named, and a parent's explicit refs.
+    const productServerIds = new Set<string>([
+      ...sessionMcpServers.runtimeServers.map((server) => server.id),
+      ...(toolsProvided ? payload.tools.map((tool) => tool.id) : []),
+      ...(parentSession && parentSession.toolPolicy.mode !== "workspace_default"
+        ? parentSession.tools.map((tool) => tool.id)
+        : []),
+    ]);
+    const writeThrough = applySessionAgentConfigWriteThrough({
+      config: agentConfig,
+      firstPartyMcpTools: [],
+      tools: selectedTools,
+      toolPolicy,
+      productServerIds,
+      ...(toolsProvided && agentConfigCreator !== "slack"
+        ? { explicitServerIds: payload.tools.map((tool) => tool.id) }
+        : {}),
+    });
+    selectedTools = writeThrough.tools;
+    toolPolicy = writeThrough.toolPolicy;
+  }
   // The first-party MCP server is attached to EVERY session. Registration is
   // independently intersected with the exact model-visible selection and the
   // tool's permission/target authorization predicate, so attachment alone
   // exposes nothing.
   const tools = withFirstPartyTools(selectedTools, runtimeSettings);
-  const captureSelectedHostAuthority = prepareSelectedHostTurnAuthority(
-    runtimeSettings,
-    tools,
-    grant,
-    workspaceId,
-    hostSelections,
-    authorization,
-  );
+
   const captureLinkedAuthority = prepareExternalLinkTurnAdmission(authorization);
-  await validateGitHubRepositorySelection(db, workspaceId, resources);
-  if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
-    throw new HTTPException(503, {
-      message: "object storage is not configured",
-    });
-  }
-  await validateFileResources(
-    db,
-    grant.accountId,
-    workspaceId,
-    personalResourceSubjectId ?? grant.subjectId,
-    resources,
-    (authorization || grant.principalKind === "agent_attempt") &&
-      (effectiveVisibility === "user_private" ||
-        sessionScope.memoryScope === "user" ||
-        workspace.kind === "personal")
-      ? authorization
+  const { attachmentOwnerContext, variableSets } = await measureSessionStartPhase(
+    unresolvedDeps.observability,
+    "resource_validation",
+    async () => {
+      await validateGitHubRepositorySelection(db, workspaceId, resources);
+      if (resources.some((resource) => resource.kind === "file") && !objectStorage) {
+        throw new HTTPException(503, {
+          message: "object storage is not configured",
+        });
+      }
+      const ownerContext = authorization
         ? await fileOwnerContextForAccess({ db }, authorization, "sessions:create")
-        : await fileOwnerContextForAgent({ db }, grant, "sessions:create")
-      : undefined,
+        : grant.principalKind === "agent_attempt"
+          ? await fileOwnerContextForAgent({ db }, grant, "sessions:create")
+          : undefined;
+      await validateFileResources(
+        db,
+        grant.accountId,
+        workspaceId,
+        personalResourceSubjectId ?? grant.subjectId,
+        resources,
+        ownerContext,
+      );
+      // Variable Sets were replaced by vaults (RM-1); a session never selects one.
+      if (payload.variableSetIds?.length) throw variableSetsRemovedError("variableSetIds");
+      return { attachmentOwnerContext: ownerContext, variableSets: [] as VariableSet[] };
+    },
   );
-  // Every selected Variable Set is independently authorized. Scope does not
-  // affect precedence: explicit order is low-to-high and later sets win name
-  // collisions.
-  const variableSets: VariableSet[] = [];
-  for (const variableSetId of payload.variableSetIds ?? []) {
-    variableSets.push(
-      await validateVariableSetAttachment({ settings, db }, grant, workspaceId, variableSetId),
-    );
-  }
+  const attachmentOwner =
+    attachmentOwnerContext?.privateFileOwnerSubjectId === grant.subjectId ? grant.subjectId : null;
   // RIG BINDING (M3). Resolve the rig this session rides — a UUID binds that
   // rig, null explicitly opts out, and omission inherits the workspace default
   // (workspaces.default_rig_id) — then FREEZE both the rig id and its currently-
@@ -2503,34 +3232,33 @@ async function createSessionForRequestInFileScope(
   //   - A stale workspace-default rig (deleted → FK-nulled, or somehow with no
   //     active version) degrades SILENTLY to rig-less: an operator-side default
   //     must never brick every create in the workspace.
-  const requestedRigId =
-    payload.rigId === undefined ? await getWorkspaceDefaultRigId(db, workspaceId) : payload.rigId;
-  let frozenRigId: string | null = null;
-  let frozenRigVersionId: string | null = null;
-  if (requestedRigId) {
-    const rig = await getRig(db, grant, requestedRigId);
-    if (!rig || !rig.activeVersion) {
-      if (payload.rigId) {
-        throw new HTTPException(422, {
-          message: rig
-            ? `rig ${payload.rigId} has no active version to bind`
-            : `unknown rigId: ${payload.rigId}`,
-        });
-      }
-      // else: workspace-default fallback that no longer resolves → rig-less.
-    } else {
-      for (const defaultVariableSetId of new Set(rig.activeVersion.defaultVariableSetIds)) {
-        await validateVariableSetAttachment(
-          { settings, db },
-          grant,
-          workspaceId,
-          defaultVariableSetId,
-        );
+  const { frozenRigId, frozenRigVersionId } = await measureSessionStartPhase(
+    unresolvedDeps.observability,
+    "rig_binding",
+    async () => {
+      const requestedRigId =
+        payload.rigId === undefined
+          ? await getWorkspaceDefaultRigId(db, workspaceId)
+          : payload.rigId;
+      if (!requestedRigId) return { frozenRigId: null, frozenRigVersionId: null };
+      const rig = await getRig(db, grant, requestedRigId);
+      if (!rig || !rig.activeVersion) {
+        if (payload.rigId) {
+          throw new HTTPException(422, {
+            message: rig
+              ? `sandbox environment ${payload.rigId} has no active version to bind`
+              : `unknown rigId: ${payload.rigId}`,
+          });
+        }
+        // else: workspace-default fallback that no longer resolves → rig-less.
+        return { frozenRigId: null, frozenRigVersionId: null };
       }
-      frozenRigId = rig.id;
-      frozenRigVersionId = rig.activeVersion.id;
-    }
-  }
+      return {
+        frozenRigId: rig.id as string | null,
+        frozenRigVersionId: rig.activeVersion.id as string | null,
+      };
+    },
+  );
   // CHANNEL FILING. Pure rail organization: a UUID files the session into that
   // workspace channel, omission/null leaves it unfiled (inbox). Resolved
   // workspace-scoped so a foreign channel id can never attach; an explicit
@@ -2546,10 +3274,10 @@ async function createSessionForRequestInFileScope(
     channelId = channel.id;
   }
   // A spawned worker is causally part of the exact turn that created it. Omitted
-  // execution policy fields therefore inherit that calling turn rather than the
+  // model and reasoning fields therefore inherit that calling turn rather than the
   // deployment defaults. This is especially important for Codex subscription
   // managers: falling back to the deployment model would silently move a child
-  // onto the OpenGeni-credits billing path. Legacy session-bound grants without
+  // onto the Opengeni-credits billing path. Legacy session-bound grants without
   // exact attempt claims fall back to the parent session's persisted defaults.
   const model = canonicalConfiguredModel(settings, effectiveModelId);
   if (model === null || model === undefined) {
@@ -2559,15 +3287,34 @@ async function createSessionForRequestInFileScope(
   // inherited calling-turn model, or deployment default — so the policy must
   // vet that effective value, not just explicit ones (a restricted workspace's
   // inherited/default-model session would otherwise be born blocked).
-  await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model);
+  await measureSessionStartPhase(unresolvedDeps.observability, "model_admission", async () => {
+    await assertWorkspaceModelPolicyAllows(db, settings, workspaceId, model);
+    // Direct creation is a fresh model selection. Child inheritance and keyed
+    // repair preserve the existing accepted-model/authority rules.
+    if (retainedKeyedShellModel === null && !parentSession) {
+      const selections = await resolveCallerWorkspaceModelSelections(db, settings, {
+        accountId: grant.accountId,
+        workspaceId,
+        subjectId: personalResourceSubjectId ?? grant.subjectId,
+        ...(claudeProviderAccountAuthoritySnapshot
+          ? { claudeAuthoritySnapshot: claudeProviderAccountAuthoritySnapshot }
+          : {}),
+      });
+      if (!admissibleWorkspaceModel(selections, model)) {
+        throw new HTTPException(422, { message: `model is not selectable: ${model}` });
+      }
+    }
+  });
   const inheritedReasoningEffort =
     parentCallingTurn?.reasoningEffort ??
     parentSession?.reasoningEffort ??
+    resolvedDefault?.reasoningEffort ??
     settings.openaiReasoningEffort;
-  const inheritedLatencyMode =
-    parentCallingTurn?.latencyMode ?? parentSession?.latencyMode ?? "standard";
   const reasoningEffort = payload.reasoningEffort ?? inheritedReasoningEffort;
-  const latencyMode = payload.latencyMode ?? inheritedLatencyMode;
+  // A fresh session never implicitly opts into a faster, higher-cost tier.
+  // This is a fresh-creation default only: replay/repair preserves persisted
+  // policy, and follow-ups use the recipient session's own frozen settings.
+  const latencyMode = payload.latencyMode ?? "standard";
   if (payload.expectedNewSessionDraftRevision !== undefined && payload.rigId === null) {
     throw new HTTPException(409, {
       message: "The submitted session options are not represented by the new-session draft",
@@ -2584,6 +3331,9 @@ async function createSessionForRequestInFileScope(
           reasoningEffort,
           latencyMode,
           options: {
+            ...(payload.excludedMcpServerIds !== undefined
+              ? { excludedMcpServerIds: payload.excludedMcpServerIds }
+              : {}),
             ...(visibilityProvided ? { visibility: payload.visibility } : {}),
             ...(payload.sandboxBackend ? { sandboxBackend: payload.sandboxBackend } : {}),
             ...(payload.targetSandboxId ? { targetSandboxId: payload.targetSandboxId } : {}),
@@ -2602,34 +3352,33 @@ async function createSessionForRequestInFileScope(
             ...(payload.firstPartyMcpTools
               ? { firstPartyMcpTools: payload.firstPartyMcpTools }
               : {}),
+            ...(payload.agent ? { agent: payload.agent } : {}),
           },
         }
       : null;
   const inheritedFromParent = parentSession !== null;
-  const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {
-    modelId: model,
-    requestedModelId: payload.model ?? null,
-    modelSource:
-      payload.model === undefined
-        ? inheritedFromParent
-          ? "continuation"
-          : "deployment"
-        : "explicit",
-    reasoningEffort,
-    reasoningSource:
-      payload.reasoningEffort === undefined
-        ? inheritedFromParent
-          ? "continuation"
-          : "deployment"
-        : "explicit",
-    latencyMode,
-    latencyModeSource:
-      payload.latencyMode === undefined
-        ? inheritedFromParent
-          ? "continuation"
-          : "deployment"
-        : "explicit",
-  });
+  const turnExecutionPolicy = withDeveloperSetupCredentialRestriction(
+    resolveTurnExecutionPolicyV1(settings, {
+      modelId: model,
+      requestedModelId: payload.model ?? null,
+      modelSource:
+        payload.model === undefined
+          ? inheritedFromParent
+            ? "continuation"
+            : "deployment"
+          : "explicit",
+      reasoningEffort,
+      reasoningSource:
+        payload.reasoningEffort === undefined
+          ? inheritedFromParent
+            ? "continuation"
+            : "deployment"
+          : "explicit",
+      latencyMode,
+      latencyModeSource: payload.latencyMode === undefined ? "deployment" : "explicit",
+    }),
+    { grant, authorization, trustedMetadata: [parentSession?.metadata] },
+  );
   // Parent linkage was resolved above, before context validation. A child with
   // no explicit permission override inherits the creating session's effective
   // grant instead of silently expanding to standalone worker defaults.
@@ -2643,6 +3392,7 @@ async function createSessionForRequestInFileScope(
   const parentFirstPartyMcpPermissions = parentSession
     ? [...(parentSession.firstPartyMcpPermissions ?? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS)]
     : null;
+  requireDeveloperSetupDelegatedPermissions(turnExecutionPolicy, payload.firstPartyMcpPermissions);
   if (
     parentFirstPartyMcpPermissions &&
     payload.firstPartyMcpPermissions?.some(
@@ -2663,7 +3413,11 @@ async function createSessionForRequestInFileScope(
       ? parentFirstPartyMcpPermissions.filter((permission) =>
           hasPermission(grant.permissions, permission),
         )
-      : null);
+      : grant.permissionMode === "explicit"
+        ? DEFAULT_FIRST_PARTY_MCP_PERMISSIONS.filter((permission) =>
+            hasPermission(grant.permissions, permission),
+          )
+        : null);
   if (firstPartyMcpPermissions && firstPartyMcpPermissions.length === 0) {
     // An empty set would sign an unusable zero-permission token; the default
     // worker set is expressed by omitting the field.
@@ -2672,6 +3426,7 @@ async function createSessionForRequestInFileScope(
         "firstPartyMcpPermissions must not be empty; omit it for the default worker permission set",
     });
   }
+  requireExplicitPermissionDelegation(grant, firstPartyMcpPermissions ?? []);
   for (const permission of firstPartyMcpPermissions ?? []) {
     if (!hasPermission(grant.permissions, permission)) {
       throw new HTTPException(403, {
@@ -2700,20 +3455,14 @@ async function createSessionForRequestInFileScope(
   // top-level omission selects the workspace's exact default catalog (or the
   // deployment default when the workspace has not configured one).
   const deploymentFirstPartyMcpToolPolicy = resolveFirstPartyMcpToolPolicy(settings);
-  const disallowedFirstPartyMcpTool = payload.firstPartyMcpTools?.find(
-    (tool) => !deploymentFirstPartyMcpToolPolicy.allowed.includes(tool),
-  );
-  if (disallowedFirstPartyMcpTool) {
-    throw new HTTPException(422, {
-      message: `first-party MCP tool is disabled by deployment policy: ${disallowedFirstPartyMcpTool}`,
-    });
-  }
   const workspaceFirstPartyDefaults = workspaceSessionToolDefaults?.firstPartyMcpTools?.filter(
     (tool) => deploymentFirstPartyMcpToolPolicy.allowed.includes(tool),
   );
-  const firstPartyMcpTools = resolveFirstPartyMcpToolsForCreate(
+  const resolvedCreatorFirstPartyMcpTools = resolveFirstPartyMcpToolsForCreate(
     payload.firstPartyMcpTools,
-    parentSession ? parentSession.firstPartyMcpTools : undefined,
+    parentSession
+      ? resolveSessionFirstPartyMcpTools(settings, parentSession, workspace.settings)
+      : undefined,
     workspaceFirstPartyDefaults && !parentSession
       ? {
           ...deploymentFirstPartyMcpToolPolicy,
@@ -2721,6 +3470,41 @@ async function createSessionForRequestInFileScope(
         }
       : deploymentFirstPartyMcpToolPolicy,
   );
+  // Capabilities only narrow the creator's exact legacy selection; "all" keeps it.
+  const followsFirstPartyDefaults =
+    payload.firstPartyMcpTools === undefined &&
+    (!parentSession || parentSession.toolPolicy.firstPartyMode === "workspace_default");
+  // A child following defaults keeps its parent's guaranteed additions; a
+  // top-level session takes them from its trusted entry point.
+  const firstPartyAdditions = followsFirstPartyDefaults
+    ? (parentSession
+        ? (parentSession.toolPolicy.firstPartyAdditions ?? [])
+        : (requestOptions.firstPartyMcpToolAdditions ?? [])
+      ).filter((tool) => deploymentFirstPartyMcpToolPolicy.allowed.includes(tool))
+    : [];
+  if (followsFirstPartyDefaults) {
+    toolPolicy = {
+      ...toolPolicy,
+      firstPartyMode: "workspace_default",
+      ...(firstPartyAdditions.length
+        ? { firstPartyAdditions: [...new Set(firstPartyAdditions)] }
+        : {}),
+    };
+  }
+  const creatorFirstPartyMcpTools = firstPartyAdditions.length
+    ? [...new Set([...resolvedCreatorFirstPartyMcpTools, ...firstPartyAdditions])]
+    : resolvedCreatorFirstPartyMcpTools;
+  const firstPartyMcpTools = applySessionAgentConfigWriteThrough({
+    config: agentConfig,
+    firstPartyMcpTools: creatorFirstPartyMcpTools,
+    // Slack computes its own baseline selection; only a caller's own explicit
+    // list is checked strictly against the capabilities.
+    explicitFirstPartyMcpTools:
+      agentConfigCreator === "slack" ? undefined : payload.firstPartyMcpTools,
+    tools: [],
+    toolPolicy,
+    productServerIds: [],
+  }).firstPartyMcpTools;
   const googleDrivePublicationEnabled =
     firstPartyMcpTools.includes("editable_artifact_export") &&
     firstPartyMcpTools.includes("editable_artifact_export_status") &&
@@ -2730,17 +3514,32 @@ async function createSessionForRequestInFileScope(
   const atlassianEnabled =
     firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) &&
     (!firstPartyMcpPermissions?.length || firstPartyMcpPermissions.includes("connections:read"));
-  const personalConnectionDelegations = await freezePersonalConnectionDelegations({
-    db,
-    workspaceId,
-    settings: runtimeSettings,
-    tools,
-    resources,
-    source: connectionDelegationSource,
-    authoritySelections: payload.connectionAuthorities,
-    googleDrivePublicationEnabled,
-    atlassianEnabled,
+  // Creation's stored tool snapshot can omit configured workspace defaults.
+  // Freeze initial-turn accounts against the same executable policy as later
+  // messages; explicit selections and exclusions remain exact.
+  const connectionAccountTools = sessionToolsForConnectionAccounts({
+    session: { tools, toolPolicy },
+    runtimeMcpServers: runtimeSettings.mcpServers,
+    defaultMcpServerIds: workspaceSessionToolPolicyDefaultServerIdsFor(
+      capabilityRuntimeSettings.mcpServers,
+      workspace.settings,
+    ),
   });
+  const { personalConnectionDelegations, mcpAccountBindings, connectionAccountIntent } =
+    await measureSessionStartPhase(unresolvedDeps.observability, "connection_freeze", () =>
+      freezeConnectionAccounts({
+        db,
+        accountId: grant.accountId,
+        workspaceId,
+        settings: runtimeSettings,
+        tools: connectionAccountTools,
+        resources,
+        source: connectionDelegationSource,
+        authoritySelections: payload.connectionAccounts,
+        googleDrivePublicationEnabled,
+        atlassianEnabled,
+      }),
+    );
   if (effectiveGoal) {
     const missingGoalTools = ["goal_update", "goal_progress", "goal_complete", "goal_pause"].filter(
       (name) => !firstPartyMcpTools.includes(name as FirstPartyMcpToolName),
@@ -2798,27 +3597,10 @@ async function createSessionForRequestInFileScope(
     sandboxId: string;
     workingDir: string | null;
   } | null = null;
-  // ENV-AWARE GROUPING: under the CURRENT mechanics the workspace VariableSet is
-  // creation-time box state — the box's manifest env is fixed when it is cold-
-  // created, and the SDK's provided-session guard rejects any manifest-env delta
-  // at attach. A session carrying a DIFFERENT VariableSet than the box it joins
-  // is therefore a genuine shared-state conflict TODAY: its first turn on a warm
-  // box dies with "Live sandbox sessions cannot change manifest variableSet
-  // variables" (proven live, sessions 5aee77e9 + 63d18823). Until the VariableSet
-  // is evicted from the manifest (per-exec, like the git token), grouping must be
-  // env-aware: the INHERITED default falls back to an own box on mismatch (a
-  // credentialed worker spawned from a credential-less manager just works), and
-  // an EXPLICIT shared/{groupId} request with a mismatched VariableSet fails
-  // fast at create (422) instead of poisoning the session's first turn.
-  // The env conflict is a BOX property, so a boxless group is exempt: a
-  // backend:"none" session runs in-process with no sandbox, no manifest, and no
-  // provided-session attach — no shared box state exists to conflict, and
-  // env-differing spawns from such parents shared safely before the env-aware
-  // check. They keep sharing (and keep inheriting "none").
-  const requestedVariableSetIds = variableSets.map((variableSet) => variableSet.id);
-  const variableSetsMatchGroup = (memberVariableSetIds: readonly string[]): boolean =>
-    stableJson(memberVariableSetIds) === stableJson(requestedVariableSetIds);
-  // RIG-AWARE GROUPING (M3), the exact sibling of the env-aware gate above: the
+  // Variable Sets no longer split boxes (W1 secrets delivery): user secrets are
+  // resolved per command from `{{secret:…}}` references and never ride the box
+  // manifest, so sessions with different selections share a box safely.
+  // RIG-AWARE GROUPING (M3): the
   // box's rig-baked setup/tooling is fixed at cold-create, so a session joining a
   // shared box must ride the SAME frozen rig_version_id. A mismatch is a genuine
   // shared-state conflict (the box was set up for a different rig) — the INHERITED
@@ -2841,7 +3623,6 @@ async function createSessionForRequestInFileScope(
     }
     const parent = parentSession;
     const parentBoxed = parent.sandboxBackend !== "none";
-    const variableSetMismatch = parentBoxed && !variableSetsMatchGroup(parent.variableSetIds);
     let rigMismatch = parentBoxed && !rigVersionMatchesGroup(parent.rigVersionId ?? null);
     if (parentBoxed && !rigMismatch) {
       const memberRigVersionIds = await listDistinctRigVersionIdsInGroup(
@@ -2853,16 +3634,13 @@ async function createSessionForRequestInFileScope(
         rigVersionMatchesGroup(memberRigVersionId),
       );
     }
-    if (variableSetMismatch || rigMismatch) {
+    if (rigMismatch) {
       if (payload.sandbox === "shared") {
-        // The caller explicitly asked to share while carrying a different
-        // VariableSet / rig — surface the conflict at create time, not turn time.
-        // VariableSet is checked first so its (pre-rig) message is unchanged for
-        // the env-only mismatch the existing gate already covered.
+        // The caller explicitly asked to share while carrying a different rig —
+        // surface the conflict at create time, not turn time.
         throw new HTTPException(422, {
-          message: variableSetMismatch
-            ? "sandbox:'shared' requires the same variableSet / same environment as the creator's box (the box variable set/environment is fixed at creation); omit sandbox or pass 'new' when attaching a different variableSet/environment."
-            : "sandbox:'shared' requires the same rig as the creator's box (the box's rig setup is fixed at creation); omit sandbox or pass 'new' when binding a different rig.",
+          message:
+            "sandbox:'shared' requires the same sandbox environment as the creator's box (setup is fixed at creation); omit sandbox or pass 'new' when selecting a different sandbox environment.",
         });
       }
       // Inherited default: deterministic separation on the genuine shared-state
@@ -2892,26 +3670,7 @@ async function createSessionForRequestInFileScope(
       });
     }
     if (member.sandboxBackend !== "none") {
-      // Compare against EVERY member, not one arbitrary row: a legacy env-blind
-      // group can carry mixed variableSetIds, and an any-member read would make
-      // the join verdict nondeterministic. Post-env-aware groups are homogeneous
-      // (both join paths enforce equality), so this reads one distinct value in
-      // the common case; a mixed legacy group deterministically rejects.
-      const memberVariableSetSelections = await listDistinctVariableSetSelectionsInGroup(
-        db,
-        workspaceId,
-        sandboxChoice.groupId,
-      );
-      if (
-        !memberVariableSetSelections.every((memberVariableSetIds) =>
-          variableSetsMatchGroup(memberVariableSetIds),
-        )
-      ) {
-        throw new HTTPException(422, {
-          message: `sandbox group ${sandboxChoice.groupId} runs a different variableSet / different environment (the box variable set/environment is fixed at creation); create with the group's variableSet/environment or omit sandbox for an own box.`,
-        });
-      }
-      // Same deterministic all-members check for the frozen rig version (M3): the
+      // Deterministic all-members check for the frozen rig version (M3): the
       // box's rig setup is fixed at creation, so every member must ride the rig
       // this create resolved (or the group is rig-less and so is this create).
       const memberRigVersionIds = await listDistinctRigVersionIdsInGroup(
@@ -2925,13 +3684,25 @@ async function createSessionForRequestInFileScope(
         )
       ) {
         throw new HTTPException(422, {
-          message: `sandbox group ${sandboxChoice.groupId} runs a different rig (the box's rig setup is fixed at creation); create with the group's rig or omit sandbox for an own box.`,
+          message: `sandbox group ${sandboxChoice.groupId} uses a different sandbox environment (setup is fixed at creation); select the group's sandbox environment or omit sandbox for a separate box.`,
         });
       }
     }
     sandboxGroupId = sandboxChoice.groupId;
     inheritedBackend = member.sandboxBackend;
     inheritedSandboxOs = member.sandboxOs;
+    // Naming the creator's own group is the explicit spelling of "shared".
+    // The machine route is session-local, so copy the trusted parent's exact
+    // route as the omitted default does; otherwise the child lands on the
+    // group's managed box, a different filesystem from the creator's machine.
+    if (parentSession && parentSession.sandboxGroupId === sandboxChoice.groupId) {
+      inheritedActiveTarget = parentSession.activeSandboxId
+        ? {
+            sandboxId: parentSession.activeSandboxId,
+            workingDir: parentSession.workingDir,
+          }
+        : null;
+    }
   }
   // else "new": leave sandboxGroupId null → own singleton group (group ≡ id).
   // A working dir is only meaningful for a TARGETED machine (it is the chosen
@@ -3034,14 +3805,37 @@ async function createSessionForRequestInFileScope(
         "self-hosted execution runs on a Connected Machine, but no machine was selected or inherited; connect the parent session to a machine or provide machineTarget",
     });
   }
-  if (payload.startMode !== "realtime") {
-    await requireLimit(deps, {
-      accountId: grant.accountId,
-      workspaceId,
-      action: "agent_run:create",
-      quantity: 1,
-      model,
-    });
+  if (payload.startMode !== "realtime" && !model.startsWith("codex/")) {
+    const frozenCreationInitiator = await measureSessionStartPhase(
+      unresolvedDeps.observability,
+      "initiator_freeze",
+      () =>
+        withWorkspaceSessionActivityRls(db, workspaceId, (scopedDb) =>
+          frozenInitiatorForCommandActor(
+            scopedDb,
+            workspaceId,
+            creationInitiator.actor ??
+              (creationInitiator.initiator?.kind === "service"
+                ? {
+                    type: "service",
+                    subjectId: creationInitiator.initiator.subjectId,
+                    ...(creationInitiator.context ? { context: creationInitiator.context } : {}),
+                  }
+                : { type: "human", subjectId: creationInitiator.initiator!.subjectId }),
+            grant.subjectLabel,
+          ),
+        ),
+    );
+    await measureSessionStartPhase(unresolvedDeps.observability, "allowance", () =>
+      requireLimit(deps, {
+        accountId: grant.accountId,
+        workspaceId,
+        initiatingHumanSubjectId: initiatingHumanForAllowance(frozenCreationInitiator),
+        action: "agent_run:create",
+        quantity: 1,
+        model,
+      }),
+    );
   }
   const initialLearning =
     payload.agentLearning && Object.keys(payload.agentLearning).length
@@ -3063,10 +3857,31 @@ async function createSessionForRequestInFileScope(
       ? ("personal" as const)
       : ("workspace" as const);
   const initialLearningActor = initialLearningContext?.actor;
+  const initialUsageLimit =
+    initialUsageLimitActor && payload.usageLimitMicros != null
+      ? { actor: initialUsageLimitActor, limitMicros: payload.usageLimitMicros }
+      : hostInitialUsageLimit
+        ? {
+            actor: { type: "host" as const, subjectId: hostInitialUsageLimit.subjectId },
+            limitMicros: hostInitialUsageLimit.limitMicros,
+          }
+        : null;
+  const applyInitialUsageLimit = initialUsageLimit
+    ? async (tx: Database, sessionId: string) =>
+        await applyInitialSessionUsageLimit(tx, {
+          accountId: grant.accountId,
+          workspaceId,
+          sessionId,
+          limitMicros: initialUsageLimit.limitMicros,
+          actor: initialUsageLimit.actor,
+          producerEnabled: sessionUsageLimitsProducerEnabled(unresolvedDeps.settings),
+        })
+    : null;
   const beforeCreateCommit =
     initialLearning && initialLearningContext && initialLearningActor?.kind === "human"
       ? async (tx: Database, sessionId: string) => {
           await externalBeforeCreateCommit?.(tx);
+          await applyInitialUsageLimit?.(tx, sessionId);
           await saveAgentLearningSettings(
             tx,
             {
@@ -3082,7 +3897,12 @@ async function createSessionForRequestInFileScope(
             },
           );
         }
-      : externalBeforeCreateCommit;
+      : applyInitialUsageLimit
+        ? async (tx: Database, sessionId: string) => {
+            await externalBeforeCreateCommit?.(tx);
+            await applyInitialUsageLimit(tx, sessionId);
+          }
+        : externalBeforeCreateCommit;
   let createOutcome: CreateSessionOutcome;
   try {
     createOutcome = await createAndStartSessionWithOutcome({
@@ -3090,10 +3910,16 @@ async function createSessionForRequestInFileScope(
       db,
       bus,
       workflowClient,
+      codeSearchDeploymentPolicy: codeSearchDeploymentPolicy(deps.settings),
       accountId: grant.accountId,
       workspaceId,
       visibility: effectiveVisibility,
       initialMessage: payload.initialMessage ?? "",
+      surface,
+      metrics: unresolvedDeps.observability ?? null,
+      ...(unresolvedDeps.observability
+        ? { startupObservability: unresolvedDeps.observability }
+        : {}),
       deferInitialTurn: payload.startMode === "realtime",
       modelContext: payload.modelContext ?? null,
       resources,
@@ -3118,8 +3944,8 @@ async function createSessionForRequestInFileScope(
       sandboxGroupId,
       metadata: creationMetadata ?? {},
       ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
-      selectedHostMcpDelegations: hostSelections,
-      ...(captureSelectedHostAuthority || captureLinkedAuthority
+
+      ...(payload.startMode !== "realtime"
         ? {
             captureInitialTurnAuthority: async (
               tx: Database,
@@ -3127,7 +3953,33 @@ async function createSessionForRequestInFileScope(
               turnId: string,
             ) => {
               await captureLinkedAuthority?.(tx, sessionId, turnId);
-              await captureSelectedHostAuthority?.(tx, sessionId, turnId);
+              if (model.startsWith("codex/")) {
+                await requireLimit(
+                  { ...deps, db: tx },
+                  {
+                    accountId: grant.accountId,
+                    workspaceId,
+                    initiatingHumanSubjectId: await getSessionTurnInitiatingHumanSubjectId(
+                      tx,
+                      workspaceId,
+                      turnId,
+                    ),
+                    action: "agent_run:create",
+                    quantity: 1,
+                    model,
+                    acceptedTurn: { sessionId, turnId },
+                  },
+                );
+              }
+              if (attachmentOwner)
+                await acceptSessionFileAttachments(tx, {
+                  accountId: grant.accountId,
+                  workspaceId,
+                  sessionId,
+                  turnId,
+                  subjectId: attachmentOwner,
+                  resources,
+                });
             },
           }
         : {}),
@@ -3149,19 +4001,30 @@ async function createSessionForRequestInFileScope(
       // contracts schema). Persisted on the row; composed system-level at turn
       // time. Not surfaced as an event.
       instructions: payload.instructions ?? null,
+      // Session and agent-config vault narrowing, intersected (AX-2). Ancestor
+      // policies apply again whenever this session resolves a reference.
+      vaultPolicy: intersectVaultPolicies(
+        lowercaseVaultPolicy(payload.vaultPolicy ?? VAULT_POLICY_ALL),
+        lowercaseVaultPolicy(payload.agent?.vaultPolicy ?? VAULT_POLICY_ALL),
+      ),
       policyRole: payload.policyRole ?? null,
       agentAccess: sessionScope.agentAccess,
       scopeSubjectId: sessionScope.scopeSubjectId,
       memoryScope: sessionScope.memoryScope,
       firstPartyMcpPermissions,
       firstPartyMcpTools,
+      agentConfig,
       mcpServers: sessionMcpServers.dbServers,
+      mcpApprovalPolicies,
       sessionMcpServers: sessionMcpServers.metadata,
       personalConnectionDelegations,
+      mcpAccountBindings,
+      connectionAccountIntent,
       initialPersonalResourceAttachmentIntent: payload.personalResourceAttachment ?? null,
       workspaceCustomModel: isWorkspaceCustomModelId(settings, model),
       retainWorkspaceCustomModel: parentSession !== null && model === inheritedModel,
       ...(xaiProviderAccountAuthoritySnapshot ? { xaiProviderAccountAuthoritySnapshot } : {}),
+      ...(claudeProviderAccountAuthoritySnapshot ? { claudeProviderAccountAuthoritySnapshot } : {}),
       parentSessionId,
       createIdempotencyKey: payload.idempotencyKey ?? null,
       selectedInstalledSkillIds,
@@ -3213,18 +4076,7 @@ async function createSessionForRequestInFileScope(
         { message: error.message, cause: error },
       );
     }
-    if (error instanceof HostMcpDelegationAuthorityError) {
-      throw new HTTPException(403, {
-        message: "Host delegation authority unavailable",
-        cause: error,
-      });
-    }
-    if (error instanceof HostMcpBindingConflictError) {
-      throw new HTTPException(409, {
-        message: "Host delegation selection conflicts",
-        cause: error,
-      });
-    }
+
     if (error instanceof AgentCommandAuthorityError) {
       throw new HTTPException(403, { message: error.message });
     }
@@ -3273,95 +4125,21 @@ export async function createSessionForRequest(
   workspaceId: string,
   rawPayload: unknown,
   authorization?: AccessGrantAuthorization,
+  requestOptions?: SessionCreateRequestOptions,
 ): Promise<CreateSessionResponse> {
   return (
-    await createSessionForRequestWithOutcome(deps, grant, workspaceId, rawPayload, authorization)
+    await createSessionForRequestWithOutcome(
+      deps,
+      grant,
+      workspaceId,
+      rawPayload,
+      authorization,
+      undefined,
+      requestOptions,
+    )
   ).session;
 }
 
-/** Snapshot the selected destination, then recheck live actor, binding and grant
- * inside the transaction which accepts the turn. Neither selection nor a
- * registered binding alone is execution authority. Shared by create/send/steer. */
-function prepareSelectedHostTurnAuthority(
-  settings: Settings,
-  tools: ToolRef[],
-  grant: AccessGrant,
-  workspaceId: string,
-  selections: HostMcpCreateSelection[],
-  authorization?: AccessGrantAuthorization,
-): ((tx: Database, sessionId: string, turnId: string) => Promise<void>) | undefined {
-  if (!selections.length) return undefined;
-  if (
-    !authorization ||
-    authorization.grant.accountId !== grant.accountId ||
-    authorization.grant.subjectId !== grant.subjectId ||
-    authorization?.grant.workspaceId !== workspaceId ||
-    !hasPermission(authorization?.grant.permissions ?? [], "connections:read") ||
-    !hasPermission(grant.permissions, "connections:read") ||
-    grant.metadata?.["sessionId"]
-  )
-    throw new HTTPException(403, {
-      message: "Host selection requires a verified direct owner",
-    });
-  const beforeCommit = prepareHostMcpOwnerAuthorization(
-    authorization,
-    workspaceId,
-    "connections:read",
-  );
-  const configs = new Map(
-    selections.map((selection) => {
-      const configured = settings.mcpServers.find((server) => server.id === selection.serverId);
-      if (
-        !configured ||
-        !tools.some((tool) => tool.kind === "mcp" && tool.id === selection.serverId) ||
-        configured.connectionRef?.authoritySource !== "host" ||
-        !configured.connectionRef.hostBinding ||
-        !configured.url
-      )
-        throw new HTTPException(422, {
-          message: "Host delegation must match a selected configured host server",
-        });
-      assertHostMcpAuthoritySourceAdmissionEnabled(settings, configured.connectionRef);
-      return [selection.serverId, structuredClone(configured)] as const;
-    }),
-  );
-  return async (tx, sessionId, turnId) => {
-    const owner = await beforeCommit(tx);
-    for (const selection of selections) {
-      const delegation = await getHostMcpDelegation(tx, owner, selection.delegationId);
-      const binding = delegation ? await getHostMcpBinding(tx, owner, delegation.bindingId) : null;
-      const configured = configs.get(selection.serverId)!;
-      if (
-        !delegation ||
-        !binding ||
-        delegation.status !== "active" ||
-        binding.status !== "active" ||
-        delegation.generation !== selection.generation ||
-        !hostMcpBindingMatchesSelection(binding, {
-          serverId: selection.serverId,
-          destinationUrl: configured.url!,
-          connectionRef: configured.connectionRef!,
-        })
-      )
-        throw new HTTPException(403, { message: "Host delegation selection changed" });
-      try {
-        await captureDirectHostMcpAuthority(tx, owner, {
-          sessionId,
-          turnId,
-          delegationId: delegation.id,
-          expectedDelegationGeneration: selection.generation,
-        });
-      } catch (error) {
-        if (error instanceof HostMcpDelegationAuthorityError)
-          throw new HTTPException(403, { message: "Host delegation authority unavailable" });
-        if (error instanceof HostMcpBindingConflictError)
-          throw new HTTPException(409, { message: "Host delegation selection conflicts" });
-        throw error;
-      }
-    }
-  };
-}
-
 function sessionPromptBoundaryRequestHash(input: {
   delivery: "send" | "steer";
   controlEtag: string | null;
@@ -3376,8 +4154,7 @@ function sessionPromptBoundaryRequestHash(input: {
   latencyMode: "standard" | "priority" | "fast" | null;
   source: "user" | "api";
   mcpCredentialUpdates: SessionMcpCredentialUpdateInput[];
-  connectionAuthorities?: McpConnectionAuthoritySelection[];
-  selectedHostMcpDelegations?: HostMcpCreateSelection[];
+  connectionAccounts?: McpConnectionAccountSelection[];
   personalResourceAttachment?: PersonalResourceAttachmentIntent;
   commandActor: SessionCommandActor;
 }): string {
@@ -3396,10 +4173,7 @@ function sessionPromptBoundaryRequestHash(input: {
     latencyMode: input.latencyMode,
     source: input.source,
     mcpCredentialUpdates: input.mcpCredentialUpdates,
-    connectionAuthorities: input.connectionAuthorities ?? [],
-    ...(input.selectedHostMcpDelegations?.length
-      ? { selectedHostMcpDelegations: input.selectedHostMcpDelegations }
-      : {}),
+    connectionAccounts: input.connectionAccounts ?? [],
     personalResourceAttachment: input.personalResourceAttachment ?? null,
     ...(input.commandActor.type === "service"
       ? {
@@ -3437,10 +4211,14 @@ async function acceptSessionUserMessageInFileScope(
     latencyMode?: "standard" | "priority" | "fast" | null;
     clientEventId?: string;
     mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[];
-    connectionAuthorities?: McpConnectionAuthoritySelection[];
-    selectedHostMcpDelegations?: HostMcpCreateSelection[];
+    connectionAccounts?: McpConnectionAccountSelection[];
     delivery?: "send" | "steer";
     origin?: "human" | "operator";
+    /**
+     * Product surface when the entry point knows it (for example Slack or an
+     * in-process embedding host). Omitted derives it from the grant.
+     */
+    surface?: SessionTurnSurface;
     controlEtag?: string | null;
     expectedDraftRevision?: number | null;
     personalResourceAttachment?: PersonalResourceAttachmentIntent;
@@ -3456,25 +4234,12 @@ async function acceptSessionUserMessageInFileScope(
   replay: boolean;
 }> {
   const { db, bus, workflowClient, objectStorage } = deps;
-  const hostSelections = HostMcpCreateSelections.parse(input.selectedHostMcpDelegations ?? []).sort(
-    (a, b) => (a.serverId < b.serverId ? -1 : a.serverId > b.serverId ? 1 : 0),
-  );
-  if (
-    hostSelections.length &&
-    (!input.authorization ||
-      input.authorization.grant.accountId !== grant.accountId ||
-      input.authorization.grant.subjectId !== grant.subjectId ||
-      input.authorization?.grant.workspaceId !== workspaceId ||
-      !hasPermission(input.authorization?.grant.permissions ?? [], "connections:read") ||
-      !hasPermission(grant.permissions, "connections:read") ||
-      grant.metadata?.["sessionId"])
-  )
-    throw new HTTPException(403, {
-      message: "Host selection requires a verified direct owner",
-    });
-  if (hostSelections.length)
-    prepareHostMcpOwnerAuthorization(input.authorization!, workspaceId, "connections:read");
-  const delegatedServiceInitiator = serviceInitiatorForGrant(grant);
+
+  const promptInitiator = creationInitiatorForGrant(grant);
+  const delegatedServiceInitiator =
+    promptInitiator.initiator?.kind === "service"
+      ? { initiator: promptInitiator.initiator, context: promptInitiator.context ?? {} }
+      : null;
   const delivery = input.delivery ?? "send";
   const source = delegatedServiceInitiator || input.origin === "operator" ? "api" : "user";
   const commandActor: SessionCommandActor = delegatedServiceInitiator
@@ -3486,7 +4251,7 @@ async function acceptSessionUserMessageInFileScope(
           : {}),
         context: delegatedServiceInitiator.context,
       }
-    : { type: "human", subjectId: grant.subjectId };
+    : (promptInitiator.actor ?? { type: "human", subjectId: grant.subjectId });
   await requireSessionAuthorization(deps, grant, {
     sessionId,
     operation: delivery === "steer" ? "session.steer" : "session.append",
@@ -3511,10 +4276,7 @@ async function acceptSessionUserMessageInFileScope(
         latencyMode: input.latencyMode ?? null,
         source,
         mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],
-        selectedHostMcpDelegations: hostSelections,
-        ...(input.connectionAuthorities
-          ? { connectionAuthorities: input.connectionAuthorities }
-          : {}),
+        ...(input.connectionAccounts ? { connectionAccounts: input.connectionAccounts } : {}),
         ...(input.personalResourceAttachment
           ? { personalResourceAttachment: input.personalResourceAttachment }
           : {}),
@@ -3568,6 +4330,14 @@ async function acceptSessionUserMessageInFileScope(
     // turn's effective model (a follow-up turn inherits the session's model). A
     // pure read with no side effects.
     const existingSession = await requireSession(db, workspaceId, sessionId);
+    assertSessionIsNotImported(existingSession);
+    // a reached task usage limit refuses a fresh Send/Steer here,
+    // after exact replays returned above and before any queue/interrupt write.
+    await requireSessionUsageLimitAllows(
+      db,
+      { accountId: grant.accountId, workspaceId, sessionId, runtime: true },
+      { sink: deps.observability, boundary: delivery === "steer" ? "steer" : "send" },
+    );
     const settings = await resolveWorkspaceModelBoundarySettings(
       deps,
       grant,
@@ -3601,15 +4371,18 @@ async function acceptSessionUserMessageInFileScope(
     const effectiveReasoningEffort = input.reasoningEffort ?? sessionReasoningEffort;
     const sessionLatencyMode = existingSession.latencyMode;
     const effectiveLatencyMode = input.latencyMode ?? sessionLatencyMode;
-    const turnExecutionPolicy = resolveTurnExecutionPolicyV1(settings, {
-      modelId: effectiveModel,
-      requestedModelId: input.model ?? null,
-      modelSource: input.model == null ? "session" : "explicit",
-      reasoningEffort: effectiveReasoningEffort,
-      reasoningSource: input.reasoningEffort == null ? "session" : "explicit",
-      latencyMode: effectiveLatencyMode,
-      latencyModeSource: input.latencyMode == null ? "session" : "explicit",
-    });
+    const turnExecutionPolicy = withDeveloperSetupCredentialRestriction(
+      resolveTurnExecutionPolicyV1(settings, {
+        modelId: effectiveModel,
+        requestedModelId: input.model ?? null,
+        modelSource: input.model == null ? "session" : "explicit",
+        reasoningEffort: effectiveReasoningEffort,
+        reasoningSource: input.reasoningEffort == null ? "session" : "explicit",
+        latencyMode: effectiveLatencyMode,
+        latencyModeSource: input.latencyMode == null ? "session" : "explicit",
+      }),
+      { grant, authorization: input.authorization, trustedMetadata: [existingSession.metadata] },
+    );
     if (composerDraftResources) {
       const acceptedResources = new Set(requestedResources.map((resource) => stableJson(resource)));
       const unacceptedDraftResource = composerDraftResources.find(
@@ -3627,33 +4400,69 @@ async function acceptSessionUserMessageInFileScope(
       sessionId,
       input.annotations ?? [],
     );
-    await requireLimit(deps, {
-      accountId: grant.accountId,
+    const admissionActor = commandActor;
+    let frozenAdmissionInitiator = await withWorkspaceSessionActivityRls(
+      db,
       workspaceId,
-      action: "agent_run:create",
-      quantity: 1,
-      model: effectiveModel,
-    });
+      (scopedDb) =>
+        frozenInitiatorForCommandActor(scopedDb, workspaceId, admissionActor, grant.subjectLabel),
+    );
+    // Re-submitting a checked-out queue edit retains the original turn's
+    // causal human, just as the locked prompt transaction does.
+    if (delivery === "send" && input.expectedDraftRevision != null) {
+      const draft = await withWorkspaceSubjectSessionActivityRls(
+        db,
+        workspaceId,
+        grant.subjectId,
+        async (scopedDb) =>
+          await getComposerDraftInTransaction(scopedDb, {
+            workspaceId,
+            sessionId,
+            subjectId: grant.subjectId,
+          }),
+      );
+      if (draft?.revision === input.expectedDraftRevision && draft.sourceTurnId) {
+        const sourceTurn = await getSessionTurn(db, workspaceId, draft.sourceTurnId);
+        if (sourceTurn?.sessionId === sessionId) {
+          frozenAdmissionInitiator = {
+            initiator: sourceTurn.initiator,
+            context: sourceTurn.initiatorContext,
+            initiatingHumanSubjectId: await getSessionTurnInitiatingHumanSubjectId(
+              db,
+              workspaceId,
+              sourceTurn.id,
+            ),
+          };
+        }
+      }
+    }
+    if (!effectiveModel.startsWith("codex/")) {
+      await requireLimit(deps, {
+        accountId: grant.accountId,
+        workspaceId,
+        initiatingHumanSubjectId: initiatingHumanForAllowance(frozenAdmissionInitiator),
+        action: "agent_run:create",
+        quantity: 1,
+        model: effectiveModel,
+      });
+    }
     if (requestedResources.some((resource) => resource.kind === "file") && !objectStorage) {
       throw new HTTPException(503, {
         message: "object storage is not configured",
       });
     }
+    const attachmentOwnerContext = input.authorization
+      ? await fileOwnerContextForAccess({ db }, input.authorization, "sessions:control")
+      : grant.principalKind === "agent_attempt"
+        ? await fileOwnerContextForAgent({ db }, grant, "sessions:control")
+        : undefined;
     await validateFileResources(
       db,
       grant.accountId,
       workspaceId,
       grant.subjectId,
       requestedResources,
-      (input.authorization || grant.principalKind === "agent_attempt") &&
-        ((await getSessionAuthorityProjection(db, workspaceId, sessionId))?.visibility ===
-          "user_private" ||
-          existingSession.memoryScope === "user" ||
-          (await requireWorkspace(db, workspaceId)).kind === "personal")
-        ? input.authorization
-          ? await fileOwnerContextForAccess({ db }, input.authorization, "sessions:control")
-          : await fileOwnerContextForAgent({ db }, grant, "sessions:control")
-        : undefined,
+      attachmentOwnerContext,
     );
     await validateGitHubRepositorySelection(db, workspaceId, [
       ...existingSession.resources,
@@ -3675,7 +4484,7 @@ async function acceptSessionUserMessageInFileScope(
             connectionDelegationSource.turnId,
           )
         : null;
-    const runtimeSettings = await settingsWithEnabledCapabilityMcpServers(
+    const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(
       db,
       workspaceId,
       settings,
@@ -3685,37 +4494,60 @@ async function acceptSessionUserMessageInFileScope(
           }
         : { subjectId: grant.subjectId },
     );
-    const personalConnectionDelegations = await freezePersonalConnectionDelegations({
-      db,
-      workspaceId,
-      settings: runtimeSettings,
-      tools: existingSession.tools,
-      resources: [...existingSession.resources, ...requestedResources],
-      source: connectionDelegationSource,
-      targetSessionId: sessionId,
-      googleDrivePublicationEnabled:
-        existingSession.firstPartyMcpTools.includes("editable_artifact_export") &&
-        existingSession.firstPartyMcpTools.includes("editable_artifact_export_status") &&
-        (!existingSession.firstPartyMcpPermissions?.length ||
-          (existingSession.firstPartyMcpPermissions.includes("artifacts:read") &&
-            existingSession.firstPartyMcpPermissions.includes("artifacts:publish"))),
-      atlassianEnabled:
-        existingSession.firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) &&
-        (!existingSession.firstPartyMcpPermissions?.length ||
-          existingSession.firstPartyMcpPermissions.includes("connections:read")),
-      ...(input.connectionAuthorities ? { authoritySelections: input.connectionAuthorities } : {}),
+    const runtimeSettings = settingsWithSessionMcpServerMetadata(
+      capabilityRuntimeSettings,
+      existingSession.mcpServers,
+    );
+    // A `workspace_default` session stores only its creation-time tool
+    // snapshot and resolves the current workspace defaults at run time, so the
+    // raw column is not the connector allow-list this follow-up executes with.
+    // Freeze accounts against the same resolved list the composer and the
+    // worker see.
+    const connectionWorkspace = await requireWorkspace(db, workspaceId);
+    const connectionAccountTools = sessionToolsForConnectionAccounts({
+      session: existingSession,
+      runtimeMcpServers: runtimeSettings.mcpServers,
+      defaultMcpServerIds: workspaceSessionToolPolicyDefaultServerIdsFor(
+        capabilityRuntimeSettings.mcpServers,
+        connectionWorkspace.settings,
+      ),
     });
-    const captureSelectedHostAuthority = prepareSelectedHostTurnAuthority(
-      settingsWithSessionMcpServerMetadata(runtimeSettings, existingSession.mcpServers),
-      existingSession.tools,
-      grant,
-      workspaceId,
-      hostSelections,
-      input.authorization,
+    const existingEffectiveFirstPartyTools = resolveSessionFirstPartyMcpTools(
+      settings,
+      existingSession,
+      connectionWorkspace.settings,
     );
-    const captureLinkedAuthority = prepareExternalLinkTurnAdmission(input.authorization);
-    const { accepted, turn, draft, receipt, routing, interruptionCount, replay } =
-      await postUserMessageTurn({
+    const { personalConnectionDelegations, mcpAccountBindings, connectionAccountIntent } =
+      await freezeConnectionAccounts({
+        db,
+        accountId: grant.accountId,
+        workspaceId,
+        settings: runtimeSettings,
+        tools: connectionAccountTools,
+        resources: [...existingSession.resources, ...requestedResources],
+        source: connectionDelegationSource,
+        targetSessionId: sessionId,
+        googleDrivePublicationEnabled:
+          existingEffectiveFirstPartyTools.includes("editable_artifact_export") &&
+          existingEffectiveFirstPartyTools.includes("editable_artifact_export_status") &&
+          (!existingSession.firstPartyMcpPermissions?.length ||
+            (existingSession.firstPartyMcpPermissions.includes("artifacts:read") &&
+              existingSession.firstPartyMcpPermissions.includes("artifacts:publish"))),
+        atlassianEnabled:
+          existingSession.firstPartyMcpTools.some((tool) => tool.startsWith("atlassian_")) &&
+          (!existingSession.firstPartyMcpPermissions?.length ||
+            existingSession.firstPartyMcpPermissions.includes("connections:read")),
+        ...(input.connectionAccounts ? { authoritySelections: input.connectionAccounts } : {}),
+      });
+
+    const captureLinkedAuthority = prepareExternalLinkTurnAdmission(input.authorization);
+    const surface = resolveTurnSurface({
+      grant,
+      authorization: input.authorization,
+      requested: input.surface,
+    });
+    const { accepted, turn, draft, receipt, routing, interruptionCount, replay } =
+      await postUserMessageTurn({
         db,
         bus,
         workflowClient,
@@ -3735,20 +4567,33 @@ async function acceptSessionUserMessageInFileScope(
         turnExecutionPolicy,
         mcpCredentialUpdates,
         personalConnectionDelegations,
-        selectedHostMcpDelegations: hostSelections,
-        ...(captureSelectedHostAuthority || captureLinkedAuthority
-          ? {
-              captureTurnAuthority: async (tx: Database, turnId: string) => {
-                await captureLinkedAuthority?.(tx, sessionId, turnId);
-                await captureSelectedHostAuthority?.(tx, sessionId, turnId);
+        mcpAccountBindings,
+        connectionAccountIntent,
+
+        captureTurnAuthority: async (tx: Database, turnId: string) => {
+          await captureLinkedAuthority?.(tx, sessionId, turnId);
+          // The prompt transaction has frozen the exact authority at this
+          // point. A refusal rolls back both prompt and receipt atomically.
+          if (effectiveModel.startsWith("codex/"))
+            await requireLimit(
+              { ...deps, db: tx },
+              {
+                accountId: grant.accountId,
+                workspaceId,
+                initiatingHumanSubjectId: initiatingHumanForAllowance(frozenAdmissionInitiator),
+                action: "agent_run:create",
+                quantity: 1,
+                model: effectiveModel,
+                acceptedTurn: { sessionId, turnId },
               },
-            }
-          : {}),
+            );
+        },
         ...(input.personalResourceAttachment
           ? { personalResourceAttachment: input.personalResourceAttachment }
           : {}),
         delivery,
         origin: source === "api" ? "operator" : "human",
+        surface,
         actor: grant.subjectId,
         ...(grant.subjectLabel ? { actorLabel: grant.subjectLabel } : {}),
         commandActor,
@@ -3763,6 +4608,7 @@ async function acceptSessionUserMessageInFileScope(
           ? { schedulePostCommit: deps.schedulePromptPostCommit }
           : {}),
       });
+    if (!replay) recordUserMessageAccepted(deps.observability, { surface });
     return {
       accepted,
       turn,
@@ -3880,6 +4726,131 @@ export async function updateSessionTitle(
   };
 }
 
+/**
+ * Set or clear the session's keep-live exemption from the idle-session archive.
+ * Archived sessions are read-only and reject the change.
+ */
+export async function setSessionRetention(
+  deps: {
+    db: Database;
+    sessionAuthorization?: SessionAuthorizationPort | null;
+  },
+  grant: AccessGrant,
+  sessionId: string,
+  keepLive: boolean,
+): Promise<{
+  result: SetSessionKeepLiveResult;
+  relatedSessionAccess: "target" | "root";
+}> {
+  const authorization = await requireSessionAuthorization(deps, grant, {
+    sessionId,
+    operation: "session.retention.write",
+    surface: "core",
+  });
+  const result = await setSessionKeepLive(deps.db, {
+    workspaceId: grant.workspaceId,
+    sessionId,
+    keepLive,
+  });
+  return { result, relatedSessionAccess: authorization?.relatedSessionAccess ?? "root" };
+}
+
+/** Change future defaults without accepting a prompt or touching accepted work. */
+export async function setSessionModel(
+  deps: Pick<
+    ApiRouteDeps,
+    "db" | "bus" | "settings" | "catalogSourceSettings" | "sessionAuthorization"
+  >,
+  grant: AccessGrant,
+  sessionId: string,
+  request: SetSessionModelRequest,
+  surface: SessionAuthorizationSurface = "core",
+) {
+  requirePermission(grant, "sessions:control");
+  const input = SetSessionModelRequest.parse(request);
+  const authorization = await requireSessionAuthorization(deps, grant, {
+    sessionId,
+    operation: "session.model.write",
+    surface,
+  });
+  const settings = await resolveWorkspaceModelBoundarySettings(deps, grant, grant.workspaceId, [
+    input.model,
+  ]);
+  const model = canonicalConfiguredModel(settings, input.model)!;
+  await assertWorkspaceModelPolicyAllows(deps.db, settings, grant.workspaceId, model);
+  const caller = authorization?.actor;
+  const service = serviceInitiatorForGrant(grant);
+  const actor: SessionCommandActor =
+    caller?.kind === "agent_attempt"
+      ? {
+          type: "agent_attempt",
+          sessionId: caller.callerSessionId,
+          turnId: caller.turnId,
+          attemptId: caller.attemptId,
+          executionGeneration: caller.executionGeneration,
+        }
+      : service
+        ? { type: "service", subjectId: service.initiator.subjectId, context: service.context }
+        : { type: "human", subjectId: grant.subjectId };
+  const result = await runIdempotentPersistenceTransaction(
+    {
+      stage: "session.model_settings",
+      eventTypes: ["session.model_settings.updated"],
+      maxAttempts: 3,
+    },
+    async () => {
+      const write = async (tx: Parameters<typeof setSessionModelInTransaction>[0]) =>
+        await setSessionModelInTransaction(tx, {
+          accountId: grant.accountId,
+          workspaceId: grant.workspaceId,
+          sessionId,
+          actor,
+          operationKey: input.idempotencyKey,
+          model,
+          reasoningEffort: input.reasoningEffort,
+          validate: (session) => {
+            try {
+              assertSessionAllowsProductModel(
+                {
+                  codexCompactionMode:
+                    session.codexCompactionMode as Session["codexCompactionMode"],
+                },
+                model,
+              );
+              // Validate fresh selection/provider and preserved latency exactly as
+              // prompt admission does; never silently clamp requested settings.
+              resolveTurnExecutionPolicyV1(settings, {
+                modelId: model,
+                requestedModelId: input.model,
+                modelSource: "explicit",
+                reasoningEffort: input.reasoningEffort,
+                reasoningSource: "explicit",
+                latencyMode: session.latencyMode as Session["latencyMode"],
+                latencyModeSource: "session",
+              });
+            } catch (error) {
+              throw new HTTPException(422, {
+                message: error instanceof Error ? error.message : "Invalid model settings",
+                cause: error,
+              });
+            }
+          },
+        });
+      return actor.type === "agent_attempt"
+        ? await withWorkspaceSessionActivityRls(deps.db, grant.workspaceId, write)
+        : await withWorkspaceSubjectSessionActivityRls(
+            deps.db,
+            grant.workspaceId,
+            grant.subjectId,
+            write,
+          );
+    },
+  );
+  const event = await getSessionEvent(deps.db, grant.workspaceId, result.eventId);
+  if (event) await publishDurableSessionEvents(deps.bus, grant.workspaceId, sessionId, [event]);
+  return { sessionId, ...result, effectiveFrom: "future_turns" as const };
+}
+
 /**
  * Update one existing session MCP server's approval policy. The database
  * serializes this write with attempt claim under the session lock: an already
@@ -3905,7 +4876,7 @@ export async function updateSessionMcpApprovalPolicy(
   });
   requirePermission(grant, "sessions:control");
 
-  const outcome: { server?: SessionMcpServerMetadata } = {};
+  const outcome: { server?: SessionMcpApprovalPolicyTarget } = {};
   const events = await appendSessionEventsWithLockedSessionUpdate(
     deps.db,
     grant.workspaceId,
@@ -3975,7 +4946,17 @@ function toolPolicyAuditSnapshot(
   const toolRefs = allToolRefs.slice(0, maxToolPolicyAuditRefs);
   return {
     mode: policy.mode,
+    ...(policy.firstPartyMode ? { firstPartyMode: policy.firstPartyMode } : {}),
+    ...(policy.firstPartyAdditions?.length
+      ? { firstPartyAdditions: [...policy.firstPartyAdditions] }
+      : {}),
     inheritedFromSessionId: policy.inheritedFromSessionId,
+    ...(policy.excludedMcpServerIds?.length
+      ? {
+          excludedMcpServerIds: policy.excludedMcpServerIds.slice(0, maxToolPolicyAuditRefs),
+          excludedMcpServerCount: policy.excludedMcpServerIds.length,
+        }
+      : {}),
     // IDs only: no MCP URLs, names, headers, credentials, schemas, or args.
     toolIds: [...toolRefs]
       .sort((left, right) => `${left.kind}:${left.id}`.localeCompare(`${right.kind}:${right.id}`))
@@ -3984,7 +4965,37 @@ function toolPolicyAuditSnapshot(
     toolCount: allToolRefs.length,
     firstPartyMcpTools: [...firstPartyMcpTools].sort(),
     firstPartyMcpToolCount: firstPartyMcpTools.length,
-    truncated: allToolRefs.length > toolRefs.length,
+    truncated:
+      allToolRefs.length > toolRefs.length ||
+      (policy.excludedMcpServerIds?.length ?? 0) > maxToolPolicyAuditRefs,
+  };
+}
+
+/** Exact parent authority shared by tool-policy and agent-configuration writes. */
+function sessionToolPolicyCeiling(
+  session: Session,
+  settings: Settings,
+  runtimeSettings: Settings,
+  workspaceDefaults: ReturnType<typeof resolveWorkspaceSessionToolDefaults>,
+): { tools: ToolRef[]; firstPartyMcpTools: FirstPartyMcpToolName[] } {
+  return {
+    tools: withFirstPartyTools(
+      session.toolPolicy.mode === "workspace_default"
+        ? withWorkspaceDefaultMcpTools(
+            availableToolRefs(session.tools, runtimeSettings),
+            settings,
+            runtimeSettings,
+            workspaceDefaults,
+          )
+        : session.tools,
+      runtimeSettings,
+    ).filter(
+      (tool) =>
+        tool.id === "opengeni" || !session.toolPolicy.excludedMcpServerIds?.includes(tool.id),
+    ),
+    firstPartyMcpTools: resolveSessionFirstPartyMcpTools(settings, session, {
+      sessionToolDefaults: workspaceDefaults,
+    }),
   };
 }
 
@@ -4028,9 +5039,31 @@ export async function updateSessionToolPolicy(
   );
   const explicitRequest = request.mode === "workspace_default" ? null : request;
   const requestedMode = explicitRequest ? "explicit" : "workspace_default";
+  const connectorOnlyEdit =
+    request.mode === "workspace_default" && request.excludedMcpServerIds !== undefined;
+  const requestedExclusions =
+    request.mode === "workspace_default" ? (request.excludedMcpServerIds ?? []) : [];
   const explicitRequestedTools = explicitRequest
     ? (() => {
-        const validatedTools = validateToolRefs(explicitRequest.tools, runtimeSettings);
+        // A disconnected stored selection remains policy truth, not executable
+        // authority. Preserve exact existing refs while validating every new or
+        // changed ref against the current runtime registry.
+        const availableIds = new Set(runtimeSettings.mcpServers.map((server) => server.id));
+        const retainedUnavailableRefs = explicitRequest.tools.filter(
+          (tool) =>
+            !availableIds.has(tool.id) &&
+            existingSession.tools.some((existing) => stableJson(existing) === stableJson(tool)),
+        );
+        const retainedIds = new Set(retainedUnavailableRefs.map((tool) => tool.id));
+        const validatedCurrentRefs = validateToolRefs(
+          explicitRequest.tools.filter((tool) => !retainedIds.has(tool.id)),
+          runtimeSettings,
+        );
+        const validatedTools = explicitRequest.tools.filter(
+          (tool) =>
+            retainedUnavailableRefs.includes(tool) ||
+            validatedCurrentRefs.some((validated) => validated.id === tool.id),
+        );
         const validatedIds = new Set(validatedTools.map((tool) => `${tool.kind}:${tool.id}`));
         const unknown = explicitRequest.tools.find(
           (tool) => !validatedIds.has(`${tool.kind}:${tool.id}`),
@@ -4043,18 +5076,28 @@ export async function updateSessionToolPolicy(
         return withFirstPartyTools(validatedTools, runtimeSettings);
       })()
     : null;
-  const explicitRequestedFirstPartyTools = explicitRequest
-    ? [...explicitRequest.firstPartyMcpTools]
-    : null;
   const deploymentFirstPartyMcpToolPolicy = resolveFirstPartyMcpToolPolicy(deps.settings);
-  const disallowedFirstPartyMcpTool = explicitRequestedFirstPartyTools?.find(
-    (tool) => !deploymentFirstPartyMcpToolPolicy.allowed.includes(tool),
-  );
-  if (disallowedFirstPartyMcpTool) {
-    throw new HTTPException(422, {
-      message: `first-party MCP tool is disabled by deployment policy: ${disallowedFirstPartyMcpTool}`,
-    });
+  // Echoing the session's stored catalog (or create defaults) can include a
+  // tool the deployment later removed. Runtime already strips those; failing
+  // the whole connector save would block unrelated MCP toggles. A newly added
+  // disabled tool, however, is explicit intent and fails rather than vanishing.
+  if (explicitRequest) {
+    requireDeploymentFirstPartyMcpTools(
+      explicitRequest.firstPartyMcpTools,
+      deploymentFirstPartyMcpToolPolicy.allowed,
+      [
+        // A session without a stored selection was shown the unfiltered defaults.
+        ...(existingSession.firstPartyMcpTools ??
+          deps.settings.defaultFirstPartyMcpTools ??
+          DEFAULT_FIRST_PARTY_MCP_TOOLS),
+        ...(workspaceSessionToolDefaults?.firstPartyMcpTools ?? []),
+        ...(existingSession.toolPolicy.firstPartyAdditions ?? []),
+      ],
+    );
   }
+  const explicitRequestedFirstPartyTools = explicitRequest
+    ? allowedFirstPartyMcpToolsForSession(deps.settings, explicitRequest.firstPartyMcpTools)
+    : null;
   const workspaceDefaultTools = withFirstPartyTools(
     withWorkspaceDefaultMcpTools(
       [],
@@ -4082,6 +5125,11 @@ export async function updateSessionToolPolicy(
       let nextTools: ToolRef[];
       let nextFirstPartyMcpTools: FirstPartyMcpToolName[];
       let nextPolicy: SessionToolPolicy;
+      // Guaranteed additions belong to the session, not to one tool choice: an
+      // explicit edit stops applying them and a reset to defaults restores them.
+      const sessionFirstPartyAdditions = session.toolPolicy.firstPartyAdditions?.length
+        ? { firstPartyAdditions: [...session.toolPolicy.firstPartyAdditions] }
+        : {};
       if (session.parentSessionId) {
         const parent = await context.getLockedSession(session.parentSessionId);
         if (!parent) {
@@ -4090,23 +5138,13 @@ export async function updateSessionToolPolicy(
           });
         }
         const parentTracksWorkspaceDefaults = parent.toolPolicy?.mode === "workspace_default";
-        const parentEffective = withFirstPartyTools(
-          parentTracksWorkspaceDefaults
-            ? withWorkspaceDefaultMcpTools(
-                availableToolRefs(parent.tools, runtimeSettings),
-                deps.settings,
-                runtimeSettings,
-                workspaceSessionToolDefaults,
-              )
-            : parent.tools,
-          runtimeSettings,
-        );
-        const deploymentAllowedFirstPartyMcpTools = new Set(
-          deploymentFirstPartyMcpToolPolicy.allowed,
-        );
-        const parentFirstPartyMcpTools = [
-          ...(parent.firstPartyMcpTools ?? deploymentFirstPartyMcpToolPolicy.default),
-        ].filter((tool) => deploymentAllowedFirstPartyMcpTools.has(tool));
+        const { tools: parentEffective, firstPartyMcpTools: parentFirstPartyMcpTools } =
+          sessionToolPolicyCeiling(
+            parent,
+            deps.settings,
+            runtimeSettings,
+            workspaceSessionToolDefaults,
+          );
         if (requestedMode === "workspace_default") {
           if (!parentTracksWorkspaceDefaults) {
             throw new HTTPException(403, {
@@ -4119,6 +5157,18 @@ export async function updateSessionToolPolicy(
           nextPolicy = {
             mode: "workspace_default",
             inheritedFromSessionId: parent.id,
+            ...(parent.toolPolicy.firstPartyMode === "workspace_default"
+              ? {
+                  firstPartyMode: "workspace_default" as const,
+                  ...(parent.toolPolicy.firstPartyAdditions?.length
+                    ? { firstPartyAdditions: [...parent.toolPolicy.firstPartyAdditions] }
+                    : {}),
+                }
+              : {}),
+            ...defaultPolicyExclusions([
+              ...(parent.toolPolicy.excludedMcpServerIds ?? []),
+              ...requestedExclusions,
+            ]),
           };
         } else {
           nextTools = explicitRequestedTools!;
@@ -4133,7 +5183,7 @@ export async function updateSessionToolPolicy(
           );
           if (widenedFirstPartyTool) {
             throw new HTTPException(403, {
-              message: `session OpenGeni tools may only narrow the parent policy: ${widenedFirstPartyTool}`,
+              message: `session Opengeni tools may only narrow the parent policy: ${widenedFirstPartyTool}`,
             });
           }
           nextFirstPartyMcpTools = explicitRequestedFirstPartyTools!;
@@ -4147,43 +5197,131 @@ export async function updateSessionToolPolicy(
           requestedMode === "workspace_default" ? workspaceDefaultTools : explicitRequestedTools!;
         nextFirstPartyMcpTools =
           requestedMode === "workspace_default"
-            ? workspaceDefaultFirstPartyTools
+            ? [
+                ...new Set([
+                  ...workspaceDefaultFirstPartyTools,
+                  ...(session.toolPolicy.firstPartyAdditions ?? []).filter((tool) =>
+                    deploymentFirstPartyMcpToolPolicy.allowed.includes(tool),
+                  ),
+                ]),
+              ]
             : explicitRequestedFirstPartyTools!;
-        nextPolicy = { mode: requestedMode, inheritedFromSessionId: null };
-        if (agentAttemptCaller) {
-          // A human or API key may widen a top-level session; a live agent
-          // attempt may only narrow relative to the session's CURRENT
-          // effective policy, in either mode. Adopting workspace defaults is a
-          // widen whenever it adds a server or tool the session does not hold.
-          const sessionTracksWorkspaceDefaults = session.toolPolicy?.mode === "workspace_default";
-          const currentEffectiveTools = withFirstPartyTools(
-            sessionTracksWorkspaceDefaults
-              ? withWorkspaceDefaultMcpTools(
-                  availableToolRefs(session.tools, runtimeSettings),
+        nextPolicy = {
+          mode: requestedMode,
+          inheritedFromSessionId: null,
+          ...sessionFirstPartyAdditions,
+          ...(requestedMode === "workspace_default"
+            ? {
+                firstPartyMode: "workspace_default" as const,
+                ...defaultPolicyExclusions(requestedExclusions),
+              }
+            : {}),
+        };
+      }
+      if (connectorOnlyEdit) {
+        if (session.toolPolicy.mode !== "workspace_default") {
+          throw new HTTPException(409, {
+            message: "adopt workspace defaults before editing connector exclusions",
+          });
+        }
+        // A connector switch never rewrites built-in tool choices or selected refs.
+        nextTools = session.tools;
+        nextFirstPartyMcpTools = [
+          ...(session.firstPartyMcpTools ?? deploymentFirstPartyMcpToolPolicy.default),
+        ];
+        delete nextPolicy.firstPartyMode;
+        if (session.toolPolicy.firstPartyMode) {
+          nextPolicy.firstPartyMode = session.toolPolicy.firstPartyMode;
+        }
+      }
+      if (!connectorOnlyEdit) {
+        nextTools = withoutExcludedMcpServers(nextTools, nextPolicy.excludedMcpServerIds);
+      }
+      if (session.agent) {
+        // The agent configuration is the ceiling of a configured session's
+        // legacy tool columns: a tool-policy edit can narrow within it but
+        // never re-add a tool of a capability the configuration turns off.
+        const clamped = applySessionAgentConfigWriteThrough({
+          config: session.agent,
+          firstPartyMcpTools: nextFirstPartyMcpTools,
+          tools: nextTools,
+          toolPolicy: nextPolicy,
+          productServerIds: [
+            ...session.mcpServers.map((server) => server.id),
+            ...(explicitRequest ? explicitRequest.tools.map((tool) => tool.id) : []),
+          ],
+        });
+        nextFirstPartyMcpTools = clamped.firstPartyMcpTools;
+        nextTools = clamped.tools;
+        nextPolicy = clamped.toolPolicy;
+      }
+      if (agentAttemptCaller && !session.parentSessionId) {
+        if (
+          nextPolicy.firstPartyMode === "workspace_default" &&
+          session.toolPolicy.firstPartyMode !== "workspace_default"
+        ) {
+          throw new HTTPException(403, {
+            message: "an agent may not replace a pinned built-in selection with future defaults",
+          });
+        }
+        // A human or API key may widen a top-level session; a live agent
+        // attempt may only narrow relative to the session's CURRENT
+        // effective policy, in either mode. Adopting workspace defaults is a
+        // widen whenever it adds a server or tool the session does not hold.
+        const sessionTracksWorkspaceDefaults = session.toolPolicy?.mode === "workspace_default";
+        const currentEffectiveTools = withFirstPartyTools(
+          sessionTracksWorkspaceDefaults
+            ? withWorkspaceDefaultMcpTools(
+                availableToolRefs(session.tools, runtimeSettings),
+                deps.settings,
+                runtimeSettings,
+                workspaceSessionToolDefaults,
+              )
+            : session.tools,
+          runtimeSettings,
+        );
+        const currentAllowedTools = withoutExcludedMcpServers(
+          currentEffectiveTools,
+          session.toolPolicy.excludedMcpServerIds,
+        );
+        const nextEffectiveTools =
+          nextPolicy.mode === "workspace_default"
+            ? withFirstPartyTools(
+                withWorkspaceDefaultMcpTools(
+                  availableToolRefs(nextTools, runtimeSettings),
                   deps.settings,
                   runtimeSettings,
                   workspaceSessionToolDefaults,
-                )
-              : session.tools,
-            runtimeSettings,
-          );
-          assertToolRefsSubset(
-            nextTools,
-            currentEffectiveTools,
-            "an agent may only narrow its session tool policy",
-          );
-          const currentFirstPartyCeiling = effectiveFirstPartyMcpToolCeiling(
-            session.firstPartyMcpTools,
-            deploymentFirstPartyMcpToolPolicy,
-          );
-          const widenedFirstPartyTool = nextFirstPartyMcpTools.find(
-            (tool) => !currentFirstPartyCeiling.has(tool),
-          );
-          if (widenedFirstPartyTool) {
-            throw new HTTPException(403, {
-              message: `an agent may only narrow its session OpenGeni tools: ${widenedFirstPartyTool}`,
-            });
-          }
+                ),
+                runtimeSettings,
+              )
+            : nextTools;
+        if (
+          nextPolicy.mode === "workspace_default" &&
+          (session.toolPolicy.excludedMcpServerIds ?? []).some(
+            (id) => !nextPolicy.excludedMcpServerIds?.includes(id),
+          )
+        ) {
+          throw new HTTPException(403, {
+            message: "an agent may not remove session connector exclusions",
+          });
+        }
+        assertToolRefsSubset(
+          withoutExcludedMcpServers(nextEffectiveTools, nextPolicy.excludedMcpServerIds),
+          currentAllowedTools,
+          "an agent may only narrow its session tool policy",
+        );
+        const currentFirstPartyCeiling = effectiveFirstPartyMcpToolCeiling(
+          resolveSessionFirstPartyMcpTools(deps.settings, session, workspace.settings),
+          deploymentFirstPartyMcpToolPolicy,
+        );
+        const widenedFirstPartyTool = nextFirstPartyMcpTools.find(
+          (tool) => !currentFirstPartyCeiling.has(tool),
+        );
+        if (widenedFirstPartyTool) {
+          throw new HTTPException(403, {
+            message: `an agent may only narrow its session Opengeni tools: ${widenedFirstPartyTool}`,
+          });
         }
       }
 
@@ -4248,6 +5386,353 @@ export async function updateSessionToolPolicy(
   return await requireSession(deps.db, grant.workspaceId, sessionId);
 }
 
+/**
+ * Replace a running session's agent configuration (`PUT .../agent`). Omitted
+ * request fields keep their current values; a legacy (null) session converts
+ * from its current effective state without widening. The configuration and
+ * its write-through to the legacy tool columns (and the instructions alias)
+ * commit under the same tool-policy version CAS, so tool-policy and agent
+ * updates cannot race. Effective from the next attempt. Agent callers may only
+ * narrow; a child never widens past its parent.
+ */
+export async function updateSessionAgent(
+  deps: {
+    db: Database;
+    bus: EventBus;
+    settings: Settings;
+    sessionAuthorization?: SessionAuthorizationPort | null;
+  },
+  grant: AccessGrant,
+  sessionId: string,
+  request: UpdateSessionAgentRequest,
+): Promise<Session> {
+  await requireSessionAuthorization(deps, grant, {
+    sessionId,
+    operation: "session.tool_policy.write",
+    surface: "core",
+  });
+  requirePermission(grant, "sessions:control");
+  const agentAttemptCaller = grantHasAgentAttemptAuthority(grant);
+  const workspace = await requireWorkspace(deps.db, grant.workspaceId);
+  const goal = await getSessionGoal(deps.db, grant.workspaceId, sessionId);
+  const goalOpen = goal !== null && goal.status !== "completed";
+  const deploymentPolicy = agentConfigDeploymentPolicy(deps.settings);
+  const deploymentFirstPartyMcpToolPolicy = resolveFirstPartyMcpToolPolicy(deps.settings);
+  const workspaceSessionToolDefaults = resolveWorkspaceSessionToolDefaults(workspace.settings);
+  const defaultFirstPartyTools = [
+    ...(workspaceSessionToolDefaults?.firstPartyMcpTools?.filter((tool) =>
+      deploymentFirstPartyMcpToolPolicy.allowed.includes(tool),
+    ) ?? deploymentFirstPartyMcpToolPolicy.default),
+  ];
+  const capabilityRuntimeSettings = await settingsWithEnabledCapabilityMcpServers(
+    deps.db,
+    grant.workspaceId,
+    deps.settings,
+    {
+      subjectId: grant.subjectId,
+    },
+  );
+  const runtimeMcpServers = capabilityRuntimeSettings.mcpServers;
+  const runtimeServerIds = new Set(runtimeMcpServers.map((server) => server.id));
+  const workspaceDefaultServerIds = workspaceSessionToolPolicyDefaultServerIdsFor(
+    runtimeMcpServers,
+    workspace.settings,
+  );
+  const events = await appendSessionEventsWithLockedSessionUpdate(
+    deps.db,
+    grant.workspaceId,
+    sessionId,
+    async (session, context) => {
+      const currentVersion = session.toolPolicyVersion ?? 1;
+      if (request.expectedVersion !== currentVersion) {
+        throw new SessionToolPolicyVersionConflictError(currentVersion);
+      }
+      let parentCeiling: ResolvedAgentCapabilities | undefined;
+      let parent: Session | null = null;
+      if (session.parentSessionId) {
+        parent = await context.getLockedSession(session.parentSessionId);
+        if (!parent) {
+          throw new HTTPException(409, { message: "parent session is no longer available" });
+        }
+        parentCeiling =
+          parent.agent?.capabilities ??
+          legacySessionAgentCapabilities(deps.settings, parent, workspace.settings);
+      }
+      const parentTools = parent
+        ? sessionToolPolicyCeiling(
+            parent,
+            deps.settings,
+            settingsWithSessionMcpServerMetadata(capabilityRuntimeSettings, session.mcpServers),
+            workspaceSessionToolDefaults,
+          )
+        : null;
+      const legacyCeiling = legacySessionAgentCapabilities(
+        deps.settings,
+        session,
+        workspace.settings,
+        workspaceDefaultServerIds,
+      );
+      const previousCapabilities = session.agent?.capabilities ?? legacyCeiling;
+      const next = withAgentConfigHttpErrors(() =>
+        resolveAgentConfigUpdate({
+          current: session.agent,
+          legacyCeiling,
+          request: request.agent,
+          deployment: deploymentPolicy,
+          onlyNarrow: agentAttemptCaller,
+          ...(parentCeiling ? { parentCeiling } : {}),
+          goal: goalOpen,
+        }),
+      );
+      const currentFirstPartyMcpTools = resolveSessionFirstPartyMcpTools(
+        deps.settings,
+        session,
+        workspace.settings,
+      );
+      const added = agentAttemptCaller
+        ? []
+        : agentConfigAddedFirstPartyMcpTools(
+            previousCapabilities,
+            next,
+            parentTools?.firstPartyMcpTools ?? defaultFirstPartyTools,
+          );
+      let tools = [...session.tools];
+      let toolPolicy: SessionToolPolicy = { ...session.toolPolicy };
+      if (!agentAttemptCaller) {
+        // Re-enabled built-ins come back; re-enabled connectors track the
+        // workspace defaults again for a top-level session.
+        const reEnabled = (id: "workspaceFiles" | "knowledge" | "workspaceConnectors") =>
+          !previousCapabilities[id] && next.capabilities[id];
+        for (const [capability, serverId] of [
+          ["workspaceFiles", "files"],
+          ["knowledge", "docs"],
+        ] as const) {
+          if (!reEnabled(capability)) continue;
+          if (toolPolicy.excludedMcpServerIds?.includes(serverId)) {
+            const excluded = toolPolicy.excludedMcpServerIds.filter((id) => id !== serverId);
+            const { excludedMcpServerIds: _removed, ...rest } = toolPolicy;
+            toolPolicy = excluded.length ? { ...rest, excludedMcpServerIds: excluded } : rest;
+          } else if (
+            toolPolicy.mode !== "workspace_default" &&
+            runtimeServerIds.has(serverId) &&
+            !tools.some((tool) => tool.id === serverId)
+          ) {
+            tools.push({ kind: "mcp", id: serverId, optional: true });
+          }
+          const parentTool = parentTools?.tools.find((tool) => tool.id === serverId);
+          if (parentTool && !tools.some((tool) => tool.id === serverId)) tools.push(parentTool);
+        }
+        if (
+          reEnabled("workspaceConnectors") &&
+          !session.parentSessionId &&
+          toolPolicy.mode === "explicit"
+        ) {
+          toolPolicy = { ...toolPolicy, mode: "workspace_default", inheritedFromSessionId: null };
+        }
+      }
+      let firstPartyMcpTools = [...new Set([...currentFirstPartyMcpTools, ...added])];
+      if (parent && parentTools) {
+        // Family booleans are not exact tool authority: re-enabling a family
+        // restores only selections the locked parent actually permits.
+        const runtimeSettings = settingsWithSessionMcpServerMetadata(
+          capabilityRuntimeSettings,
+          session.mcpServers,
+        );
+        const parentFirstPartyTools = new Set(parentTools.firstPartyMcpTools);
+        firstPartyMcpTools = firstPartyMcpTools.filter((tool) => parentFirstPartyTools.has(tool));
+        if (toolPolicy.mode === "workspace_default") {
+          tools = withoutExcludedMcpServers(
+            withFirstPartyTools(
+              withWorkspaceDefaultMcpTools(
+                availableToolRefs(tools, runtimeSettings),
+                deps.settings,
+                runtimeSettings,
+                workspaceSessionToolDefaults,
+              ),
+              runtimeSettings,
+            ),
+            toolPolicy.excludedMcpServerIds,
+          );
+          if (parent.toolPolicy.mode !== "workspace_default") {
+            // An explicit parent cannot authorize future workspace additions.
+            toolPolicy = { mode: "inherited", inheritedFromSessionId: parent.id };
+          } else {
+            toolPolicy = {
+              ...toolPolicy,
+              ...defaultPolicyExclusions([
+                ...(parent.toolPolicy.excludedMcpServerIds ?? []),
+                ...(toolPolicy.excludedMcpServerIds ?? []),
+              ]),
+            };
+          }
+        }
+        const parentToolIds = new Set(parentTools.tools.map((tool) => `${tool.kind}:${tool.id}`));
+        tools = tools.filter((tool) => parentToolIds.has(`${tool.kind}:${tool.id}`));
+      }
+      const writeThrough = applySessionAgentConfigWriteThrough({
+        config: next,
+        firstPartyMcpTools,
+        tools,
+        toolPolicy,
+        productServerIds: [
+          ...session.mcpServers.map((server) => server.id),
+          ...(session.toolPolicy.mode !== "workspace_default"
+            ? session.tools.map((tool) => tool.id)
+            : []),
+        ],
+      });
+      tools = writeThrough.tools;
+      toolPolicy = writeThrough.toolPolicy;
+      const nextInstructions =
+        request.agent.instructions !== undefined
+          ? request.agent.instructions
+          : (session.instructions ?? null);
+      if (goalOpen && !writeThrough.firstPartyMcpTools.includes("goal_complete")) {
+        throw new HTTPException(422, {
+          message: "a session with an open goal must keep its goal tools",
+        });
+      }
+      const unchanged =
+        stableJson({
+          agent: session.agent,
+          instructions: session.instructions ?? null,
+          firstPartyMcpTools: currentFirstPartyMcpTools,
+          tools: session.tools,
+          policy: session.toolPolicy,
+        }) ===
+        stableJson({
+          agent: next,
+          instructions: nextInstructions,
+          firstPartyMcpTools: writeThrough.firstPartyMcpTools,
+          tools,
+          policy: toolPolicy,
+        });
+      if (unchanged) return { events: [] };
+      const nextVersion = currentVersion + 1;
+      return {
+        events: [
+          {
+            type: "session.agent.updated" as const,
+            payload: {
+              before: session.agent,
+              after: next,
+              instructionsChanged: nextInstructions !== (session.instructions ?? null),
+              toolPolicy: {
+                before: toolPolicyAuditSnapshot(
+                  session,
+                  session.tools,
+                  currentFirstPartyMcpTools,
+                  session.toolPolicy,
+                ),
+                after: toolPolicyAuditSnapshot(
+                  session,
+                  tools,
+                  writeThrough.firstPartyMcpTools,
+                  toolPolicy,
+                ),
+              },
+              version: nextVersion,
+              effectiveFrom: "next_attempt",
+            },
+          },
+        ],
+        update: {
+          agentConfig: next,
+          ...(nextInstructions !== (session.instructions ?? null)
+            ? { instructions: nextInstructions }
+            : {}),
+          tools,
+          firstPartyMcpTools: writeThrough.firstPartyMcpTools,
+          toolPolicy,
+          toolPolicyVersion: nextVersion,
+          expectedToolPolicyVersion: request.expectedVersion,
+        },
+      };
+    },
+    { activity: "semantic", lockParentSession: true },
+  );
+  if (events.length > 0) {
+    await publishDurableSessionEvents(deps.bus, grant.workspaceId, sessionId, events);
+  }
+  return await requireSession(deps.db, grant.workspaceId, sessionId);
+}
+
+/**
+ * Replace the Skills a session carries itself. The worker reads them at the
+ * start of every attempt, so the change applies from the next attempt; work
+ * already running keeps the Skill index it started with. Shares the
+ * tool-policy version (409 when stale) with the other agent-configuration
+ * writes. An agent may only remove Skills, never add or change one.
+ */
+export async function updateSessionSkills(
+  deps: {
+    db: Database;
+    bus: EventBus;
+    sessionAuthorization?: SessionAuthorizationPort | null;
+  },
+  grant: AccessGrant,
+  sessionId: string,
+  request: UpdateSessionSkillsRequest,
+): Promise<Session> {
+  await requireSessionAuthorization(deps, grant, {
+    sessionId,
+    operation: "session.tool_policy.write",
+    surface: "core",
+  });
+  requirePermission(grant, "sessions:control");
+  let skills: SessionSkill[];
+  try {
+    skills = SessionSkills.parse(request.skills);
+  } catch (error) {
+    throw new HTTPException(422, {
+      message: error instanceof Error ? error.message : "invalid session Skill selection",
+    });
+  }
+  const agentAttemptCaller = grantHasAgentAttemptAuthority(grant);
+  const events = await appendSessionEventsWithLockedSessionUpdate(
+    deps.db,
+    grant.workspaceId,
+    sessionId,
+    (session) => {
+      const currentVersion = session.toolPolicyVersion ?? 1;
+      if (request.expectedVersion !== currentVersion) {
+        throw new SessionToolPolicyVersionConflictError(currentVersion);
+      }
+      const current = new Set(session.skills.map((skill) => stableJson(skill)));
+      if (agentAttemptCaller && skills.some((skill) => !current.has(stableJson(skill)))) {
+        throw new HTTPException(403, {
+          message: "An agent can only remove Skills from a session.",
+        });
+      }
+      if (stableJson(session.skills) === stableJson(skills)) return { events: [] };
+      const nextVersion = currentVersion + 1;
+      return {
+        events: [
+          {
+            type: "session.skills.updated" as const,
+            payload: {
+              before: session.skills.map((skill) => skill.name),
+              after: skills.map((skill) => skill.name),
+              version: nextVersion,
+              effectiveFrom: "next_attempt",
+            },
+          },
+        ],
+        update: {
+          skills,
+          toolPolicyVersion: nextVersion,
+          expectedToolPolicyVersion: request.expectedVersion,
+        },
+      };
+    },
+    { activity: "semantic" },
+  );
+  if (events.length > 0) {
+    await publishDurableSessionEvents(deps.bus, grant.workspaceId, sessionId, events);
+  }
+  return await requireSession(deps.db, grant.workspaceId, sessionId);
+}
+
 export async function readSessionLineage(
   deps: Pick<ApiRouteDeps, "db" | "sessionAuthorization">,
   grant: AccessGrant,
@@ -4272,6 +5757,30 @@ export async function readSessionLineage(
   return lineage;
 }
 
+/**
+ * A server attached in the same root create request is selected by that
+ * attachment. Neither `tools` (an allow-list over the workspace/deployment
+ * registry) nor the workspace-default expansion can name it, so without this
+ * the attached endpoint was stored but never contacted and the model saw no
+ * tools. This grants nothing beyond the attach itself: the caller already
+ * passed `mcp_servers:attach` for exactly this endpoint, and the server's own
+ * approval policy still governs every call. An explicit ref for the same id
+ * wins unchanged so a caller can still mark it `eager` or `optional`; the
+ * added ref is strict, exactly like listing `{ kind: "mcp", id }` explicitly.
+ * Child creates never reach here: an inherited snapshot keeps the parent's
+ * selection and a child may only narrow it.
+ */
+export function withSameRequestSessionMcpServerTools(
+  tools: ToolRef[],
+  attachedServers: ReadonlyArray<{ id: string }>,
+): ToolRef[] {
+  const selectedIds = new Set(tools.map((tool) => tool.id));
+  const missing = attachedServers
+    .filter((server) => !selectedIds.has(server.id))
+    .map((server) => ({ kind: "mcp" as const, id: server.id }));
+  return missing.length === 0 ? tools : mergeToolRefs(tools, missing);
+}
+
 function withFirstPartyTools(
   tools: ToolRef[],
   runtimeSettings: { mcpServers: Array<{ id: string }> },
@@ -4282,6 +5791,34 @@ function withFirstPartyTools(
   return mergeToolRefs(tools, [{ kind: "mcp", id: "opengeni" }]);
 }
 
+/**
+ * The executable MCP tool list a follow-up on an existing session freezes
+ * connector accounts against.
+ *
+ * A `workspace_default` session stores only the tool snapshot taken when it
+ * was created and expands the current workspace defaults at run time, so a
+ * connector enabled after creation never enters the stored column. The
+ * composer projects that same expansion and submits account selections for
+ * it, so freezing against the stored column rejected every such selection as
+ * unmatched and never froze its personal delegation. Resolve through the one
+ * ID-only policy resolver the API projection and the worker use, with the
+ * same omitted-tools default, so all three agree on the executable set.
+ */
+export function sessionToolsForConnectionAccounts(input: {
+  session: Pick<Session, "tools" | "toolPolicy">;
+  /** The resolved runtime registry, including session-local servers. */
+  runtimeMcpServers: Iterable<{ id: string }>;
+  /** The current omitted-tools default for this workspace. */
+  defaultMcpServerIds: Iterable<string>;
+}): ToolRef[] {
+  return resolveSessionToolPolicy({
+    toolPolicy: input.session.toolPolicy,
+    sessionTools: input.session.tools,
+    availableMcpServerIds: [...input.runtimeMcpServers].map((server) => server.id),
+    defaultMcpServerIds: input.defaultMcpServerIds,
+  }).toolRefs;
+}
+
 function hasOwnProperty(value: unknown, key: string): boolean {
   return Boolean(
     value && typeof value === "object" && Object.prototype.hasOwnProperty.call(value, key),