@opengeni/db 0.12.1 → 0.13.0

package/src/index.ts

@@ -23,6 +23,7 @@ import type {
   KnowledgeMemoryKind,
   KnowledgeMemoryStatus,
   KnowledgeSourceRef,
+  GitHubInstallationAuthorityKind,
   GitHubRepositoryScope,
   HostEventExport,
   HostEventExportBatch,
@@ -159,7 +160,7 @@ import { drizzle } from "drizzle-orm/postgres-js";
 import postgres from "postgres";
 import { decryptEnvironmentValue } from "./environment-crypto";
 import { sanitizeEventPayload, sanitizeModelPayload } from "./event-payload-sanitizer";
-import { consumeNewSessionDraftInTransaction } from "./new-session-drafts";
+import { seedNewSessionDraftInTransaction } from "./new-session-drafts";
 import {
   runIdempotentPersistenceTransaction,
   type IdempotentPersistenceTransactionOptions,
@@ -213,6 +214,7 @@ export { sql as dbSql } from "drizzle-orm";
 export * from "./session-control";
 export * from "./session-queue-commands";
 export * from "./new-session-drafts";
+export * from "./workspace-instruction-policies";
 export { interruptedToolCallResult } from "./session-tool-call-settlement";
 export { decryptEnvironmentValue, encryptEnvironmentValue } from "./environment-crypto";
 export {
@@ -225,6 +227,7 @@ export {
   sanitizeModelPayload,
 } from "./event-payload-sanitizer";
 export * from "./persistence-errors";
+export * from "./runtime-posture";
 export { sanitizeMemoryText } from "./memory-domain";
 // Re-exported so external consumers can `import { migrate } from "@opengeni/db"`.
 // The `@opengeni/db/migrate` subpath stays available too (internal callers + the
@@ -260,6 +263,16 @@ export * from "./memory-domain";
 // unaffected.
 export type Database = PgDatabase<any, typeof schema>;
 
+/** Raised when a durable session tool-policy write lost its version fence. */
+export class SessionToolPolicyVersionConflictError extends Error {
+  readonly code = "SESSION_TOOL_POLICY_CONFLICT";
+
+  constructor(readonly currentVersion: number) {
+    super("The session tool policy changed in another client");
+    this.name = "SessionToolPolicyVersionConflictError";
+  }
+}
+
 export type DbClient = {
   db: Database;
   close: () => Promise<void>;
@@ -999,15 +1012,27 @@ export async function withRlsContext<T>(
     // manufacturing a phantom "no active subscription" from a credential that is
     // in fact active. Convert that silent false into a loud, root-cause-bearing
     // error so the caller can retry rather than permanently mis-decide.
-    const applied = await tx.execute<{ account_id: string | null }>(
-      sql`select current_setting('opengeni.account_id', true) as account_id`,
+    const applied = await tx.execute<{
+      account_id: string | null;
+      workspace_id: string | null;
+    }>(
+      sql`select
+        current_setting('opengeni.account_id', true) as account_id,
+        current_setting('opengeni.workspace_id', true) as workspace_id`,
     );
     const appliedAccountId = applied[0]?.account_id ?? "";
+    const expectedWorkspaceId = context.workspaceId ?? "";
+    const appliedWorkspaceId = applied[0]?.workspace_id ?? "";
     if (appliedAccountId !== context.accountId) {
       throw new Error(
         `RLS context not applied on the active backend: expected account ${context.accountId}, got "${appliedAccountId}"`,
       );
     }
+    if (appliedWorkspaceId !== expectedWorkspaceId) {
+      throw new Error(
+        `RLS context not applied on the active backend: expected workspace "${expectedWorkspaceId}", got "${appliedWorkspaceId}"`,
+      );
+    }
     return await fn(scoped);
   }, transactionConfig);
 }
@@ -2044,10 +2069,17 @@ export type GitHubInstallation = {
   accountId: string;
   workspaceId: string;
   installationId: number;
+  githubAccountId: number | null;
   accountLogin: string | null;
   accountType: string | null;
   repositoryScope: GitHubRepositoryScope;
   linkedBySubjectId: string | null;
+  githubActorId: number | null;
+  githubActorLogin: string | null;
+  authorityKind: GitHubInstallationAuthorityKind | null;
+  authorityCheckedAt: string | null;
+  authorityExpiresAt: string | null;
+  authorityNonce: string | null;
   createdAt: string;
   updatedAt: string;
 };
@@ -2056,6 +2088,59 @@ export type GitHubInstallationAccess = GitHubInstallation & {
   repositoryIds: number[];
 };
 
+export class GitHubInstallationAuthorityCommitError extends Error {
+  constructor() {
+    super("GitHub installation authority expired before the binding transaction completed");
+  }
+}
+
+const githubInstallationAuthorityMaxAgeMs = 10 * 60_000;
+
+/**
+ * True only for a binding created by the owner-authority transaction. Legacy
+ * installation rows remain visible for audit/unlink, but can never make a
+ * workspace healthy, enumerate repositories, or authorize a token mint.
+ *
+ * `authorityExpiresAt` is the expiry of the consumed proof, not of the durable
+ * delegation. A binding remains delegated after that instant; GitHub's live
+ * installation/repository checks govern its ongoing usability.
+ */
+export function hasAuditableGitHubInstallationAuthority(
+  installation: GitHubInstallationAccess,
+): boolean {
+  const checkedAt = installation.authorityCheckedAt
+    ? Date.parse(installation.authorityCheckedAt)
+    : Number.NaN;
+  const expiresAt = installation.authorityExpiresAt
+    ? Date.parse(installation.authorityExpiresAt)
+    : Number.NaN;
+  const common =
+    installation.repositoryScope === "selected" &&
+    installation.repositoryIds.length > 0 &&
+    installation.repositoryIds.every((id) => Number.isSafeInteger(id) && id > 0) &&
+    installation.githubAccountId !== null &&
+    Number.isSafeInteger(installation.githubAccountId) &&
+    installation.githubAccountId > 0 &&
+    Boolean(installation.accountLogin) &&
+    installation.githubActorId !== null &&
+    Number.isSafeInteger(installation.githubActorId) &&
+    installation.githubActorId > 0 &&
+    Boolean(installation.githubActorLogin) &&
+    Boolean(installation.linkedBySubjectId) &&
+    Boolean(installation.authorityNonce) &&
+    Number.isFinite(checkedAt) &&
+    Number.isFinite(expiresAt) &&
+    checkedAt < expiresAt;
+  if (!common) {
+    return false;
+  }
+  return installation.authorityKind === "personal_owner"
+    ? installation.accountType === "User" &&
+        installation.githubActorId === installation.githubAccountId
+    : installation.authorityKind === "organization_owner" &&
+        installation.accountType === "Organization";
+}
+
 export async function upsertGitHubInstallation(
   db: Database,
   input: {
@@ -2095,6 +2180,9 @@ export async function upsertGitHubInstallation(
               : {}),
             updatedAt: new Date(),
           },
+          // This legacy metadata helper cannot mutate an owner-authorized row.
+          // New bindings use bindAuthorizedGitHubInstallationRepositories.
+          setWhere: isNull(schema.githubInstallations.authorityNonce),
         })
         .returning();
       if (!row) {
@@ -2156,6 +2244,164 @@ export async function bindGitHubInstallationRepositories(
               linkedBySubjectId: input.linkedBySubjectId,
               updatedAt: new Date(),
             },
+            // Preserve the immutable authority + allowlist audit boundary.
+            setWhere: isNull(schema.githubInstallations.authorityNonce),
+          })
+          .returning();
+        if (!row) {
+          throw new Error("Failed to bind GitHub installation");
+        }
+        await tx
+          .delete(schema.githubInstallationRepositories)
+          .where(
+            and(
+              eq(schema.githubInstallationRepositories.workspaceId, input.workspaceId),
+              eq(schema.githubInstallationRepositories.installationId, input.installationId),
+            ),
+          );
+        for (let offset = 0; offset < repositoryIds.length; offset += 1_000) {
+          await tx.insert(schema.githubInstallationRepositories).values(
+            repositoryIds.slice(offset, offset + 1_000).map((repositoryId) => ({
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              installationId: input.installationId,
+              repositoryId,
+            })),
+          );
+        }
+        return { ...mapGitHubInstallation(row), repositoryIds };
+      }),
+  );
+}
+
+export async function bindAuthorizedGitHubInstallationRepositories(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    installationId: number;
+    githubAccountId: number;
+    accountLogin: string | null;
+    accountType: string | null;
+    linkedBySubjectId: string;
+    githubActorId: number;
+    githubActorLogin: string;
+    authorityKind: GitHubInstallationAuthorityKind;
+    authorityCheckedAt: Date;
+    authorityExpiresAt: Date;
+    authorityNonce: string;
+    repositoryIds: number[];
+  },
+): Promise<GitHubInstallationAccess | null> {
+  if (!Number.isSafeInteger(input.installationId) || input.installationId <= 0) {
+    throw new Error("GitHub installation id must be a positive safe integer");
+  }
+  if (!Number.isSafeInteger(input.githubAccountId) || input.githubAccountId <= 0) {
+    throw new Error("GitHub account id must be a positive safe integer");
+  }
+  if (!Number.isSafeInteger(input.githubActorId) || input.githubActorId <= 0) {
+    throw new Error("GitHub actor id must be a positive safe integer");
+  }
+  const authorityCheckedAtMs = input.authorityCheckedAt.getTime();
+  const authorityExpiresAtMs = input.authorityExpiresAt.getTime();
+  if (
+    !Number.isFinite(authorityCheckedAtMs) ||
+    !Number.isFinite(authorityExpiresAtMs) ||
+    authorityCheckedAtMs >= authorityExpiresAtMs ||
+    authorityExpiresAtMs - authorityCheckedAtMs > githubInstallationAuthorityMaxAgeMs ||
+    !input.authorityNonce ||
+    !input.githubActorLogin.trim() ||
+    !input.accountLogin?.trim() ||
+    !input.linkedBySubjectId.trim() ||
+    (input.authorityKind !== "personal_owner" && input.authorityKind !== "organization_owner") ||
+    (input.authorityKind === "personal_owner" &&
+      (input.accountType !== "User" || input.githubActorId !== input.githubAccountId)) ||
+    (input.authorityKind === "organization_owner" && input.accountType !== "Organization")
+  ) {
+    throw new Error("GitHub installation authority proof is invalid or expired");
+  }
+  const repositoryIds = [...new Set(input.repositoryIds)];
+  if (
+    repositoryIds.length === 0 ||
+    repositoryIds.length !== input.repositoryIds.length ||
+    repositoryIds.some((id) => !Number.isSafeInteger(id) || id <= 0)
+  ) {
+    throw new Error(
+      "GitHub repository ids must be a nonempty, unique list of positive safe integers",
+    );
+  }
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (tx) => {
+        await assertGitHubAuthorityWindowOpen(
+          tx,
+          input.authorityCheckedAt,
+          input.authorityExpiresAt,
+        );
+        await tx
+          .delete(schema.integrationOauthStateNonces)
+          .where(
+            and(
+              eq(schema.integrationOauthStateNonces.workspaceId, input.workspaceId),
+              lt(schema.integrationOauthStateNonces.expiresAt, input.authorityCheckedAt),
+            ),
+          );
+        const consumed = await tx
+          .insert(schema.integrationOauthStateNonces)
+          .values({
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            subjectId: input.linkedBySubjectId,
+            nonce: input.authorityNonce,
+            expiresAt: input.authorityExpiresAt,
+            usedAt: input.authorityCheckedAt,
+          })
+          .onConflictDoNothing({ target: schema.integrationOauthStateNonces.nonce })
+          .returning({ nonce: schema.integrationOauthStateNonces.nonce });
+        if (consumed.length === 0) {
+          return null;
+        }
+
+        const [row] = await tx
+          .insert(schema.githubInstallations)
+          .values({
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            installationId: input.installationId,
+            githubAccountId: input.githubAccountId,
+            accountLogin: input.accountLogin,
+            accountType: input.accountType,
+            repositoryScope: "selected",
+            linkedBySubjectId: input.linkedBySubjectId,
+            githubActorId: input.githubActorId,
+            githubActorLogin: input.githubActorLogin,
+            authorityKind: input.authorityKind,
+            authorityCheckedAt: input.authorityCheckedAt,
+            authorityExpiresAt: input.authorityExpiresAt,
+            authorityNonce: input.authorityNonce,
+          })
+          .onConflictDoUpdate({
+            target: [
+              schema.githubInstallations.workspaceId,
+              schema.githubInstallations.installationId,
+            ],
+            set: {
+              accountId: input.accountId,
+              githubAccountId: input.githubAccountId,
+              accountLogin: input.accountLogin,
+              accountType: input.accountType,
+              repositoryScope: "selected",
+              linkedBySubjectId: input.linkedBySubjectId,
+              githubActorId: input.githubActorId,
+              githubActorLogin: input.githubActorLogin,
+              authorityKind: input.authorityKind,
+              authorityCheckedAt: input.authorityCheckedAt,
+              authorityExpiresAt: input.authorityExpiresAt,
+              authorityNonce: input.authorityNonce,
+              updatedAt: input.authorityCheckedAt,
+            },
           })
           .returning();
         if (!row) {
@@ -2179,11 +2425,41 @@ export async function bindGitHubInstallationRepositories(
             })),
           );
         }
+        // Recheck against the database clock after all writes. Throwing here
+        // rolls the transaction back if the proof expired while it was being
+        // committed, so no partial nonce or binding can survive.
+        await assertGitHubAuthorityWindowOpen(
+          tx,
+          input.authorityCheckedAt,
+          input.authorityExpiresAt,
+        );
         return { ...mapGitHubInstallation(row), repositoryIds };
       }),
   );
 }
 
+async function assertGitHubAuthorityWindowOpen(
+  tx: Database,
+  checkedAt: Date,
+  expiresAt: Date,
+): Promise<void> {
+  // postgres.js does not serialize JavaScript Date instances passed through
+  // raw Drizzle SQL. Bind the already-validated ISO timestamp representation
+  // and retain PostgreSQL's timestamptz/database-clock authority checks.
+  const checkedAtIso = checkedAt.toISOString();
+  const expiresAtIso = expiresAt.toISOString();
+  const result = await tx.execute<{ valid: boolean }>(sql`
+    select (
+      ${checkedAtIso}::timestamptz <= clock_timestamp()
+      and clock_timestamp() < ${expiresAtIso}::timestamptz
+      and ${expiresAtIso}::timestamptz <= ${checkedAtIso}::timestamptz + interval '10 minutes'
+    ) as valid
+  `);
+  if (result[0]?.valid !== true) {
+    throw new GitHubInstallationAuthorityCommitError();
+  }
+}
+
 export async function listGitHubInstallationsForWorkspace(
   db: Database,
   workspaceId: string,
@@ -2256,7 +2532,7 @@ export async function areGitHubRepositoriesAllowedForWorkspace(
   }
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [installation] = await scopedDb
-      .select({ repositoryScope: schema.githubInstallations.repositoryScope })
+      .select()
       .from(schema.githubInstallations)
       .where(
         and(
@@ -2268,9 +2544,6 @@ export async function areGitHubRepositoriesAllowedForWorkspace(
     if (!installation) {
       return false;
     }
-    if (installation.repositoryScope === "all") {
-      return true;
-    }
     const allowed = await scopedDb
       .select({
         repositoryId: schema.githubInstallationRepositories.repositoryId,
@@ -2283,7 +2556,13 @@ export async function areGitHubRepositoriesAllowedForWorkspace(
           inArray(schema.githubInstallationRepositories.repositoryId, requestedIds),
         ),
       );
-    return allowed.length === requestedIds.length;
+    if (allowed.length !== requestedIds.length) {
+      return false;
+    }
+    return hasAuditableGitHubInstallationAuthority({
+      ...mapGitHubInstallation(installation),
+      repositoryIds: allowed.map((row) => row.repositoryId),
+    });
   });
 }
 
@@ -2866,6 +3145,8 @@ export type CreateConnectionInput = {
   credentialEncrypted: string;
   grantedScopes?: string[];
   expiresAt?: Date | null;
+  verifiedInstallAt?: Date | null;
+  verifiedInstallVersion?: number | null;
   metadata?: Record<string, unknown>;
   createdBySubjectId?: string | null;
   updatedBySubjectId?: string | null;
@@ -2883,10 +3164,40 @@ export type UpdateConnectionInput = {
   credentialEncrypted?: string;
   grantedScopes?: string[];
   expiresAt?: Date | null;
+  verifiedInstallAt?: Date | null;
+  verifiedInstallVersion?: number | null;
   metadata?: Record<string, unknown>;
   updatedBySubjectId?: string | null;
 };
 
+/** Server-owned verification facts; public schemas expose them read-only and nullable. */
+export type ConnectionMetadataWithVerification = ConnectionMetadata & {
+  verifiedInstallAt: string | null;
+  verifiedInstallVersion: number | null;
+};
+
+export type SlackBotPostOperation = {
+  id: string;
+  accountId: string;
+  workspaceId: string;
+  connectionId: string;
+  operationId: string;
+  clientMessageId: string;
+  targetKind: "channel" | "user";
+  targetId: string;
+  requestDigest: string;
+  status: "provider_started" | "completed";
+  claimHolderId: string | null;
+  claimExpiresAt: Date | null;
+  attemptCount: number;
+  lastFailureCode: string | null;
+  slackChannelId: string | null;
+  slackMessageTimestamp: string | null;
+  completedAt: Date | null;
+  createdAt: Date;
+  updatedAt: Date;
+};
+
 export type ConnectionCredentialForBroker = {
   id: string;
   accountId: string;
@@ -4445,6 +4756,8 @@ const connectionMetadataColumns = {
   lastUsedAt: schema.connections.lastUsedAt,
   lastError: schema.connections.lastError,
   version: schema.connections.version,
+  verifiedInstallAt: schema.connections.verifiedInstallAt,
+  verifiedInstallVersion: schema.connections.verifiedInstallVersion,
   metadata: schema.connections.metadata,
   createdBySubjectId: schema.connections.createdBySubjectId,
   updatedBySubjectId: schema.connections.updatedBySubjectId,
@@ -4461,7 +4774,7 @@ function connectionSubjectVisibility(subjectId?: string | null): SQL {
 export async function createConnection(
   db: Database,
   input: CreateConnectionInput,
-): Promise<ConnectionMetadata> {
+): Promise<ConnectionMetadataWithVerification> {
   return await withRlsContext(
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
@@ -4478,6 +4791,8 @@ export async function createConnection(
           credentialEncrypted: input.credentialEncrypted,
           grantedScopes: input.grantedScopes ?? [],
           expiresAt: input.expiresAt ?? null,
+          verifiedInstallAt: input.verifiedInstallAt ?? null,
+          verifiedInstallVersion: input.verifiedInstallVersion ?? null,
           metadata: input.metadata ?? {},
           createdBySubjectId: input.createdBySubjectId ?? null,
           updatedBySubjectId: input.updatedBySubjectId ?? input.createdBySubjectId ?? null,
@@ -4495,7 +4810,7 @@ export async function listConnectionsMetadata(
   db: Database,
   workspaceId: string,
   subjectId?: string | null,
-): Promise<ConnectionMetadata[]> {
+): Promise<ConnectionMetadataWithVerification[]> {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const rows = await scopedDb
       .select(connectionMetadataColumns)
@@ -4516,7 +4831,7 @@ export async function getConnectionMetadata(
   workspaceId: string,
   connectionId: string,
   subjectId?: string | null,
-): Promise<ConnectionMetadata | null> {
+): Promise<ConnectionMetadataWithVerification | null> {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [row] = await scopedDb
       .select(connectionMetadataColumns)
@@ -4536,7 +4851,7 @@ export async function getConnectionMetadata(
 export async function updateConnection(
   db: Database,
   input: UpdateConnectionInput,
-): Promise<ConnectionMetadata | null> {
+): Promise<ConnectionMetadataWithVerification | null> {
   return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
     const set = {
       updatedAt: new Date(),
@@ -4553,6 +4868,12 @@ export async function updateConnection(
         : {}),
       ...(input.grantedScopes !== undefined ? { grantedScopes: input.grantedScopes } : {}),
       ...(input.expiresAt !== undefined ? { expiresAt: input.expiresAt } : {}),
+      ...(input.verifiedInstallAt !== undefined
+        ? { verifiedInstallAt: input.verifiedInstallAt }
+        : {}),
+      ...(input.verifiedInstallVersion !== undefined
+        ? { verifiedInstallVersion: input.verifiedInstallVersion }
+        : {}),
       ...(input.metadata !== undefined ? { metadata: input.metadata } : {}),
       ...(input.updatedBySubjectId !== undefined
         ? { updatedBySubjectId: input.updatedBySubjectId }
@@ -4581,7 +4902,7 @@ export async function revokeConnection(
   workspaceId: string,
   connectionId: string,
   updatedBySubjectId?: string | null,
-): Promise<ConnectionMetadata | null> {
+): Promise<ConnectionMetadataWithVerification | null> {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [row] = await scopedDb
       .update(schema.connections)
@@ -4590,6 +4911,13 @@ export async function revokeConnection(
         // The version bump invalidates any in-flight refresh's (id, version) CAS,
         // so a racing refresh cannot commit and flip the row back to active.
         version: sql`${schema.connections.version} + 1`,
+        // Status-only revocation does not replace the verified credential or bot
+        // identity. Carry the marker to the same new CAS version so the dedicated
+        // reinstall path can still recognize (but not use) the inactive row.
+        verifiedInstallVersion: sql`case
+          when ${schema.connections.verifiedInstallAt} is null then null
+          else ${schema.connections.version} + 1
+        end`,
         updatedBySubjectId: updatedBySubjectId ?? null,
         updatedAt: new Date(),
       })
@@ -4608,6 +4936,272 @@ export async function revokeConnection(
   });
 }
 
+export type ClaimSlackBotPostOperationResult =
+  | { kind: "claimed" | "in_progress" | "completed"; operation: SlackBotPostOperation }
+  | { kind: "conflict" | "connection_not_found" };
+
+/**
+ * Claims one durable Slack post identity. The insert occurs before any provider
+ * call; retries retain the original client_msg_id and immutable request digest.
+ * A live claim suppresses concurrent sends, while a released/expired claim can
+ * be reclaimed after response loss or process death.
+ */
+export async function claimSlackBotPostOperation(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    operationId: string;
+    targetKind: "channel" | "user";
+    targetId: string;
+    requestDigest: string;
+    claimHolderId: string;
+    claimLeaseMs: number;
+  },
+): Promise<ClaimSlackBotPostOperationResult> {
+  const claimLeaseMs = Math.max(1, Math.min(Math.trunc(input.claimLeaseMs), 120_000));
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (txRaw) => {
+        const tx = txRaw as unknown as Database;
+        const [connection] = await tx
+          .select({ id: schema.connections.id })
+          .from(schema.connections)
+          .where(
+            and(
+              eq(schema.connections.accountId, input.accountId),
+              eq(schema.connections.workspaceId, input.workspaceId),
+              eq(schema.connections.id, input.connectionId),
+            ),
+          )
+          .for("share")
+          .limit(1);
+        if (!connection) return { kind: "connection_not_found" } as const;
+
+        const [created] = await tx
+          .insert(schema.slackBotPostOperations)
+          .values({
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            connectionId: input.connectionId,
+            operationId: input.operationId,
+            clientMessageId: input.operationId,
+            targetKind: input.targetKind,
+            targetId: input.targetId,
+            requestDigest: input.requestDigest,
+            status: "provider_started",
+            claimHolderId: input.claimHolderId,
+            claimExpiresAt: sql`now() + (${claimLeaseMs} * interval '1 millisecond')`,
+            attemptCount: 1,
+          })
+          .onConflictDoNothing({
+            target: [
+              schema.slackBotPostOperations.workspaceId,
+              schema.slackBotPostOperations.connectionId,
+              schema.slackBotPostOperations.operationId,
+            ],
+          })
+          .returning();
+        if (created) {
+          return { kind: "claimed", operation: mapSlackBotPostOperation(created) } as const;
+        }
+
+        const [existing] = await tx
+          .select()
+          .from(schema.slackBotPostOperations)
+          .where(
+            and(
+              eq(schema.slackBotPostOperations.workspaceId, input.workspaceId),
+              eq(schema.slackBotPostOperations.connectionId, input.connectionId),
+              eq(schema.slackBotPostOperations.operationId, input.operationId),
+            ),
+          )
+          .for("update")
+          .limit(1);
+        if (!existing) throw new Error("Slack post operation disappeared after conflict");
+        if (
+          existing.accountId !== input.accountId ||
+          existing.targetKind !== input.targetKind ||
+          existing.targetId !== input.targetId ||
+          existing.requestDigest !== input.requestDigest ||
+          existing.clientMessageId !== input.operationId
+        ) {
+          return { kind: "conflict" } as const;
+        }
+        if (existing.status === "completed") {
+          return { kind: "completed", operation: mapSlackBotPostOperation(existing) } as const;
+        }
+
+        const [reclaimed] = await tx
+          .update(schema.slackBotPostOperations)
+          .set({
+            claimHolderId: input.claimHolderId,
+            claimExpiresAt: sql`now() + (${claimLeaseMs} * interval '1 millisecond')`,
+            attemptCount: sql`${schema.slackBotPostOperations.attemptCount} + 1`,
+            lastFailureCode: null,
+            updatedAt: sql`now()`,
+          })
+          .where(
+            and(
+              eq(schema.slackBotPostOperations.id, existing.id),
+              or(
+                isNull(schema.slackBotPostOperations.claimHolderId),
+                lte(schema.slackBotPostOperations.claimExpiresAt, sql`now()`),
+              ),
+            ),
+          )
+          .returning();
+        return reclaimed
+          ? ({ kind: "claimed", operation: mapSlackBotPostOperation(reclaimed) } as const)
+          : ({ kind: "in_progress", operation: mapSlackBotPostOperation(existing) } as const);
+      }),
+  );
+}
+
+export async function releaseSlackBotPostOperationClaim(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    operationId: string;
+    claimHolderId: string;
+    failureCode: string;
+  },
+): Promise<boolean> {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const rows = await scopedDb
+        .update(schema.slackBotPostOperations)
+        .set({
+          claimHolderId: null,
+          claimExpiresAt: null,
+          lastFailureCode: input.failureCode.slice(0, 128),
+          updatedAt: sql`now()`,
+        })
+        .where(
+          and(
+            eq(schema.slackBotPostOperations.workspaceId, input.workspaceId),
+            eq(schema.slackBotPostOperations.connectionId, input.connectionId),
+            eq(schema.slackBotPostOperations.operationId, input.operationId),
+            eq(schema.slackBotPostOperations.status, "provider_started"),
+            eq(schema.slackBotPostOperations.claimHolderId, input.claimHolderId),
+          ),
+        )
+        .returning({ id: schema.slackBotPostOperations.id });
+      return rows.length === 1;
+    },
+  );
+}
+
+export type CompleteSlackBotPostOperationResult =
+  | { kind: "completed"; operation: SlackBotPostOperation; newlyCompleted: boolean }
+  | { kind: "not_found" | "not_owned" };
+
+/** Completion and the single success audit receipt commit atomically. */
+export async function completeSlackBotPostOperation(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    operationId: string;
+    claimHolderId: string;
+    slackChannelId: string;
+    slackMessageTimestamp: string;
+    subjectId?: string | null;
+    auditMetadata: Record<string, unknown>;
+  },
+): Promise<CompleteSlackBotPostOperationResult> {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (txRaw) => {
+        const tx = txRaw as unknown as Database;
+        const [current] = await tx
+          .select()
+          .from(schema.slackBotPostOperations)
+          .where(
+            and(
+              eq(schema.slackBotPostOperations.workspaceId, input.workspaceId),
+              eq(schema.slackBotPostOperations.connectionId, input.connectionId),
+              eq(schema.slackBotPostOperations.operationId, input.operationId),
+            ),
+          )
+          .for("update")
+          .limit(1);
+        if (!current) return { kind: "not_found" } as const;
+        if (current.status === "completed") {
+          return {
+            kind: "completed",
+            operation: mapSlackBotPostOperation(current),
+            newlyCompleted: false,
+          } as const;
+        }
+        if (current.claimHolderId !== input.claimHolderId) {
+          return { kind: "not_owned" } as const;
+        }
+        const [completed] = await tx
+          .update(schema.slackBotPostOperations)
+          .set({
+            status: "completed",
+            claimHolderId: null,
+            claimExpiresAt: null,
+            lastFailureCode: null,
+            slackChannelId: input.slackChannelId,
+            slackMessageTimestamp: input.slackMessageTimestamp,
+            completedAt: sql`now()`,
+            updatedAt: sql`now()`,
+          })
+          .where(eq(schema.slackBotPostOperations.id, current.id))
+          .returning();
+        if (!completed) throw new Error("Slack post completion returned no row");
+        await tx.insert(schema.auditEvents).values({
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          subjectId: input.subjectId ?? null,
+          action: "slack_bot.message.post",
+          targetType: "connection",
+          targetId: input.connectionId,
+          metadata: input.auditMetadata,
+        });
+        return {
+          kind: "completed",
+          operation: mapSlackBotPostOperation(completed),
+          newlyCompleted: true,
+        } as const;
+      }),
+  );
+}
+
+export async function getSlackBotPostOperation(
+  db: Database,
+  workspaceId: string,
+  connectionId: string,
+  operationId: string,
+): Promise<SlackBotPostOperation | null> {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb
+      .select()
+      .from(schema.slackBotPostOperations)
+      .where(
+        and(
+          eq(schema.slackBotPostOperations.workspaceId, workspaceId),
+          eq(schema.slackBotPostOperations.connectionId, connectionId),
+          eq(schema.slackBotPostOperations.operationId, operationId),
+        ),
+      )
+      .limit(1);
+    return row ? mapSlackBotPostOperation(row) : null;
+  });
+}
+
 export async function loadConnectionCredentialForBroker(
   db: Database,
   settings: Settings,
@@ -4741,6 +5335,10 @@ export async function setConnectionStatus(
         status,
         lastError,
         version: sql`${schema.connections.version} + 1`,
+        verifiedInstallVersion: sql`case
+          when ${schema.connections.verifiedInstallAt} is null then null
+          else ${schema.connections.version} + 1
+        end`,
         updatedAt: new Date(),
       })
       .where(
@@ -9516,12 +10114,13 @@ export type CodexCapacityWait = {
   accountId: string;
   workspaceId: string;
   sessionId: string;
-  goalId: string;
+  goalId: string | null;
   blockedTurnId: string;
+  blockedTurnGeneration: number;
   workflowId: string;
   generation: number;
   status: CodexCapacityWaitStatus;
-  goalVersion: number;
+  goalVersion: number | null;
   policyHash: string | null;
   earliestResetAt: Date | null;
   nextCheckAt: Date;
@@ -9588,9 +10187,9 @@ export type ReconcileCodexCapacityWaitResult =
   | {
       action: "resumed";
       waiter: CodexCapacityWait;
-      update: SessionSystemUpdate;
       events: SessionEvent[];
     }
+  | { action: "paused"; waiter: CodexCapacityWait; events: SessionEvent[] }
   | { action: "superseded"; waiter: CodexCapacityWait; events: SessionEvent[] }
   | {
       action: "stale";
@@ -9621,6 +10220,7 @@ function mapCodexCapacityWaiter(
     sessionId: row.sessionId,
     goalId: row.goalId,
     blockedTurnId: row.blockedTurnId,
+    blockedTurnGeneration: row.blockedTurnGeneration,
     workflowId: row.workflowId,
     generation: row.generation,
     status: row.status as CodexCapacityWaitStatus,
@@ -9698,14 +10298,13 @@ function nextCodexCapacityCheckAt(
 }
 
 /**
- * Atomically settle one all-unavailable turn and arm exactly one durable wait.
- * Lock order is allocator rotation row -> workspace control -> actual workspace
- * -> session -> exact turn -> exact attempt -> goal -> live lease (when a
- * reactive failure owns one) -> waiter. The control share lock and effective
- * control recheck prevent a capacity boundary from closing an attempt after a
- * committed Pause. The failed turn, idle/capacity-paused session, durable
- * events, lease release, and waiter generation commit together; a crash cannot
- * leave only half of the boundary visible.
+ * Atomically close one all-unavailable attempt and arm exactly one durable wait
+ * for the same logical turn. Lock order is allocator rotation row -> workspace
+ * control -> actual workspace -> session -> exact turn -> exact attempt ->
+ * optional goal -> live lease (when a reactive failure owns one) -> waiter.
+ * The waiting turn/session pointer, durable events, exact lease release, and
+ * waiter generation commit together; a crash cannot leave only half of the
+ * boundary visible.
  */
 export async function armCodexCapacityWait(
   db: Database,
@@ -9716,8 +10315,8 @@ export async function armCodexCapacityWait(
     turnId: string;
     attemptId: string;
     workflowId: string;
-    goalId: string;
-    goalVersion: number;
+    goalId?: string | null;
+    goalVersion?: number | null;
     policyHash?: string | null;
     earliestResetAt: Date | null;
     resetKind: CodexCapacityResetKind;
@@ -9730,6 +10329,14 @@ export async function armCodexCapacityWait(
   },
 ): Promise<ArmCodexCapacityWaitResult> {
   const now = input.now ?? new Date();
+  const goalId = input.goalId ?? null;
+  const goalVersion = input.goalVersion ?? null;
+  if (
+    (goalId === null) !== (goalVersion === null) ||
+    (goalVersion !== null && (!Number.isSafeInteger(goalVersion) || goalVersion < 1))
+  ) {
+    throw new Error("Codex capacity goal fence must be absent or contain a positive version");
+  }
   return await withRlsContext(
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
@@ -9755,18 +10362,20 @@ export async function armCodexCapacityWait(
               workspaceControl: locks.control ?? undefined,
             })
           : null;
-        const [goal] = await tx
-          .select()
-          .from(schema.sessionGoals)
-          .where(
-            and(
-              eq(schema.sessionGoals.workspaceId, input.workspaceId),
-              eq(schema.sessionGoals.id, input.goalId),
-              eq(schema.sessionGoals.sessionId, input.sessionId),
-            ),
-          )
-          .for("update")
-          .limit(1);
+        const [goal] = goalId
+          ? await tx
+              .select()
+              .from(schema.sessionGoals)
+              .where(
+                and(
+                  eq(schema.sessionGoals.workspaceId, input.workspaceId),
+                  eq(schema.sessionGoals.id, goalId),
+                  eq(schema.sessionGoals.sessionId, input.sessionId),
+                ),
+              )
+              .for("update")
+              .limit(1)
+          : [];
         const leaseRows = input.leaseFence
           ? await tx.execute(sql<{ holder_id: string; generation: number }>`
               select holder_id, generation
@@ -9807,7 +10416,10 @@ export async function armCodexCapacityWait(
         if (
           existing?.status === "waiting" &&
           existing.blockedTurnId === input.turnId &&
-          turn?.status === "failed"
+          existing.blockedTurnGeneration === turn?.executionGeneration &&
+          turn?.status === "waiting_capacity" &&
+          session?.status === "waiting_capacity" &&
+          session.activeTurnId === input.turnId
         ) {
           return {
             action: "waiting",
@@ -9825,13 +10437,14 @@ export async function armCodexCapacityWait(
             Number(lease.generation) === input.leaseFence.generation &&
             currentRedispatches === (input.expectedRedispatches ?? currentRedispatches));
         if (
-          !goal ||
+          !session ||
+          !turn ||
           effectiveControl?.state !== "active" ||
           effectiveControl.settlement !== null ||
           session.activeTurnId !== input.turnId ||
           session.status !== "running" ||
-          goal.status !== "active" ||
-          goal.version !== input.goalVersion ||
+          (goalId !== null &&
+            (!goal || goal.status !== "active" || goal.version !== goalVersion)) ||
           turn.status !== "running" ||
           turn.activeAttemptId !== input.attemptId ||
           !leaseFenceValid ||
@@ -9851,7 +10464,7 @@ export async function armCodexCapacityWait(
           sessionId: input.sessionId,
           turnId: input.turnId,
           executionGeneration: turn.executionGeneration,
-          outcome: "failed",
+          outcome: "waiting_capacity",
           closedAt: now,
         });
 
@@ -9867,12 +10480,13 @@ export async function armCodexCapacityWait(
           accountId: input.accountId,
           workspaceId: input.workspaceId,
           sessionId: input.sessionId,
-          goalId: input.goalId,
+          goalId,
           blockedTurnId: input.turnId,
+          blockedTurnGeneration: turn.executionGeneration,
           workflowId: input.workflowId,
           generation,
           status: "waiting",
-          goalVersion: input.goalVersion,
+          goalVersion,
           policyHash,
           earliestResetAt: input.earliestResetAt,
           nextCheckAt,
@@ -9917,32 +10531,17 @@ export async function armCodexCapacityWait(
               workspaceId: input.workspaceId,
               sessionId: input.sessionId,
               sequence: ++sequence,
-              type: "turn.failed",
+              type: "codex.capacity.waiting",
               payload: sanitizeEventPayload({
                 ...input.failurePayload,
                 recovery: "codex_capacity",
-                retryable: false,
+                retryable: true,
                 rotated: true,
-                capacityWaiterId: waiterRow.id,
-                capacityWaitGeneration: waiterRow.generation,
-              }),
-              turnId: input.turnId,
-              turnGeneration: turn.executionGeneration,
-              turnAttemptId: input.attemptId,
-              turnAssociation: "current",
-              occurredAt: now,
-            },
-            {
-              accountId: input.accountId,
-              workspaceId: input.workspaceId,
-              sessionId: input.sessionId,
-              sequence: ++sequence,
-              type: "codex.capacity.waiting",
-              payload: sanitizeEventPayload({
                 waiterId: waiterRow.id,
                 generation: waiterRow.generation,
-                goalId: input.goalId,
-                goalVersion: input.goalVersion,
+                goalId,
+                goalVersion,
+                blockedTurnGeneration: turn.executionGeneration,
                 policyHash,
                 resetKind: input.resetKind,
                 earliestResetAt: input.earliestResetAt?.toISOString() ?? null,
@@ -9960,7 +10559,7 @@ export async function armCodexCapacityWait(
               sessionId: input.sessionId,
               sequence: ++sequence,
               type: "session.status.changed",
-              payload: { status: "idle", reason: "codex_capacity" },
+              payload: { status: "waiting_capacity", reason: "codex_capacity" },
               turnId: input.turnId,
               turnGeneration: turn.executionGeneration,
               turnAttemptId: input.attemptId,
@@ -9969,13 +10568,14 @@ export async function armCodexCapacityWait(
             },
           ])
           .returning();
-        await tx
+        const [waitingTurn] = await tx
           .update(schema.sessionTurns)
           .set({
-            status: "failed",
+            status: "waiting_capacity",
             activeAttemptId: null,
+            metadata: metadataWithoutTurnDispatchAttempt(turn.metadata),
             version: turn.version + 1,
-            finishedAt: now,
+            finishedAt: null,
             updatedAt: now,
           })
           .where(
@@ -9983,13 +10583,18 @@ export async function armCodexCapacityWait(
               eq(schema.sessionTurns.workspaceId, input.workspaceId),
               eq(schema.sessionTurns.id, input.turnId),
               eq(schema.sessionTurns.status, "running"),
+              eq(schema.sessionTurns.activeAttemptId, input.attemptId),
             ),
-          );
-        await tx
+          )
+          .returning({ id: schema.sessionTurns.id });
+        if (!waitingTurn) {
+          throw new Error("Codex capacity blocked turn changed during atomic arm");
+        }
+        const [waitingSession] = await tx
           .update(schema.sessions)
           .set({
-            status: "idle",
-            activeTurnId: null,
+            status: "waiting_capacity",
+            activeTurnId: input.turnId,
             lastSequence: sequence,
             updatedAt: now,
           })
@@ -9997,15 +10602,24 @@ export async function armCodexCapacityWait(
             and(
               eq(schema.sessions.workspaceId, input.workspaceId),
               eq(schema.sessions.id, input.sessionId),
+              eq(schema.sessions.status, "running"),
               eq(schema.sessions.activeTurnId, input.turnId),
             ),
-          );
-        await tx.execute(sql`
-          delete from codex_credential_leases
-          where account_id = ${input.accountId}
-            and workspace_id = ${input.workspaceId}
-            and turn_id = ${input.turnId}
-        `);
+          )
+          .returning({ id: schema.sessions.id });
+        if (!waitingSession) {
+          throw new Error("Codex capacity session changed during atomic arm");
+        }
+        if (input.leaseFence) {
+          await tx.execute(sql`
+            delete from codex_credential_leases
+            where account_id = ${input.accountId}
+              and workspace_id = ${input.workspaceId}
+              and turn_id = ${input.turnId}
+              and holder_id = ${input.leaseFence.holderId}
+              and generation = ${input.leaseFence.generation}
+          `);
+        }
         return {
           action: "waiting",
           waiter: mapCodexCapacityWaiter(waiterRow),
@@ -10037,8 +10651,8 @@ export async function getCodexCapacityWaitForSession(
 }
 
 /**
- * Same-transaction capacity-mutation/outbox seam for account eligibility and
- * policy-scope membership/default changes. The allocator rotation row is always the
+ * Same-transaction capacity-mutation/outbox seam for eligibility and
+ * membership/default changes. The allocator rotation row is always the
  * first lock. Mutations report whether capacity truth changed; only then are
  * matching waiter wake revisions advanced and returned for best-effort signal.
  */
@@ -10153,6 +10767,7 @@ async function supersedeCodexCapacityWaitInTransaction(
   tx: Database,
   input: {
     session: typeof schema.sessions.$inferSelect;
+    blockedTurn: typeof schema.sessionTurns.$inferSelect;
     waiter: typeof schema.codexCapacityWaiters.$inferSelect;
     reason: string;
     now: Date;
@@ -10176,9 +10791,52 @@ async function supersedeCodexCapacityWaitInTransaction(
   if (!updated) {
     return { waiter: mapCodexCapacityWaiter(input.waiter), events: [] };
   }
-  const inserted = await tx
-    .insert(schema.sessionEvents)
-    .values({
+  const turnWasCurrent = input.session.activeTurnId === input.blockedTurn.id;
+  const turnStillWaiting = input.blockedTurn.status === "waiting_capacity";
+  const terminalTurnStatus = input.session.status === "cancelled" ? "cancelled" : "superseded";
+  if (turnStillWaiting) {
+    const [supersededTurn] = await tx
+      .update(schema.sessionTurns)
+      .set({
+        status: terminalTurnStatus,
+        activeAttemptId: null,
+        cancelledBy: "codex_capacity_reconcile",
+        cancelReason: input.reason,
+        version: input.blockedTurn.version + 1,
+        finishedAt: input.now,
+        updatedAt: input.now,
+      })
+      .where(
+        and(
+          eq(schema.sessionTurns.workspaceId, input.session.workspaceId),
+          eq(schema.sessionTurns.id, input.blockedTurn.id),
+          eq(schema.sessionTurns.status, "waiting_capacity"),
+          isNull(schema.sessionTurns.activeAttemptId),
+          eq(schema.sessionTurns.executionGeneration, input.waiter.blockedTurnGeneration),
+        ),
+      )
+      .returning({ id: schema.sessionTurns.id });
+    if (!supersededTurn) {
+      throw new Error("Codex capacity blocked turn changed during atomic supersession");
+    }
+  }
+  const [queued] = turnWasCurrent
+    ? await tx
+        .select({ id: schema.sessionTurns.id })
+        .from(schema.sessionTurns)
+        .where(
+          and(
+            eq(schema.sessionTurns.workspaceId, input.session.workspaceId),
+            eq(schema.sessionTurns.sessionId, input.session.id),
+            eq(schema.sessionTurns.status, "queued"),
+          ),
+        )
+        .limit(1)
+    : [];
+  const nextSessionStatus =
+    input.session.status === "cancelled" ? "cancelled" : queued ? "queued" : "idle";
+  const eventValues: Array<typeof schema.sessionEvents.$inferInsert> = [
+    {
       accountId: input.session.accountId,
       workspaceId: input.session.workspaceId,
       sessionId: input.session.id,
@@ -10190,18 +10848,45 @@ async function supersedeCodexCapacityWaitInTransaction(
         reason: input.reason,
       }),
       turnId: updated.blockedTurnId,
+      turnGeneration: input.blockedTurn.executionGeneration,
+      ...(turnWasCurrent ? { turnAssociation: "current" } : {}),
       occurredAt: input.now,
-    })
-    .returning();
-  await tx
+    },
+  ];
+  if (turnWasCurrent && input.session.status !== nextSessionStatus) {
+    eventValues.push({
+      accountId: input.session.accountId,
+      workspaceId: input.session.workspaceId,
+      sessionId: input.session.id,
+      sequence: input.session.lastSequence + 2,
+      type: "session.status.changed",
+      payload: { status: nextSessionStatus, reason: input.reason },
+      turnId: updated.blockedTurnId,
+      turnGeneration: input.blockedTurn.executionGeneration,
+      turnAssociation: "current",
+      occurredAt: input.now,
+    });
+  }
+  const inserted = await tx.insert(schema.sessionEvents).values(eventValues).returning();
+  const lastSequence = input.session.lastSequence + inserted.length;
+  const [updatedSession] = await tx
     .update(schema.sessions)
-    .set({ lastSequence: input.session.lastSequence + 1, updatedAt: input.now })
+    .set({
+      ...(turnWasCurrent ? { status: nextSessionStatus, activeTurnId: null } : {}),
+      lastSequence,
+      updatedAt: input.now,
+    })
     .where(
       and(
         eq(schema.sessions.workspaceId, input.session.workspaceId),
         eq(schema.sessions.id, input.session.id),
+        ...(turnWasCurrent ? [eq(schema.sessions.activeTurnId, input.blockedTurn.id)] : []),
       ),
-    );
+    )
+    .returning({ id: schema.sessions.id });
+  if (!updatedSession) {
+    throw new Error("Codex capacity session changed during atomic supersession");
+  }
   return {
     waiter: mapCodexCapacityWaiter(updated),
     events: inserted.map(mapEvent),
@@ -10211,10 +10896,11 @@ async function supersedeCodexCapacityWaitInTransaction(
 /**
  * Row-lock and re-evaluate one waiter. Availability is decided by a pure
  * caller supplied policy over the same rotation-row transaction as normal
- * acquisition. If available, one system goal-continuation event and one turn
- * are committed; duplicate timers/signals observe status=resumed and do no
- * work. If any goal/control/policy/turn/queue fence changed, the waiter is
- * superseded without inference.
+ * acquisition. If available, the exact blocked turn becomes `recovering`;
+ * duplicate timers/signals observe status=resumed and do no work. Effective
+ * Pause leaves the waiter untouched, ordinary queued prompts remain behind the
+ * current inference, and only an explicit semantic fence change supersedes the
+ * waiter/blocked turn without inference.
  */
 export async function reconcileCodexCapacityWait<
   TPolicyScope = never,
@@ -10287,18 +10973,20 @@ export async function reconcileCodexCapacityWait<
               workspaceControl: prefix.control ?? undefined,
             })
           : null;
-        const [goal] = await tx
-          .select()
-          .from(schema.sessionGoals)
-          .where(
-            and(
-              eq(schema.sessionGoals.workspaceId, input.workspaceId),
-              eq(schema.sessionGoals.id, waiterRead.goalId),
-              eq(schema.sessionGoals.sessionId, input.sessionId),
-            ),
-          )
-          .for("update")
-          .limit(1);
+        const [goal] = waiterRead.goalId
+          ? await tx
+              .select()
+              .from(schema.sessionGoals)
+              .where(
+                and(
+                  eq(schema.sessionGoals.workspaceId, input.workspaceId),
+                  eq(schema.sessionGoals.id, waiterRead.goalId),
+                  eq(schema.sessionGoals.sessionId, input.sessionId),
+                ),
+              )
+              .for("update")
+              .limit(1)
+          : [];
         const [waiter] = await tx
           .select()
           .from(schema.codexCapacityWaiters)
@@ -10307,7 +10995,6 @@ export async function reconcileCodexCapacityWait<
           .limit(1);
         if (
           !session ||
-          !goal ||
           !blockedTurn ||
           !waiter ||
           session.accountId !== input.accountId ||
@@ -10326,55 +11013,40 @@ export async function reconcileCodexCapacityWait<
             events: [],
           } as const;
         }
+        if (effectiveControl?.state !== "active" || effectiveControl.settlement !== null) {
+          return {
+            action: "paused",
+            waiter: mapCodexCapacityWaiter(waiter),
+            events: [],
+          } as const;
+        }
 
-        const [pending] = await tx
-          .select({ id: schema.sessionTurns.id })
-          .from(schema.sessionTurns)
-          .where(
-            and(
-              eq(schema.sessionTurns.workspaceId, input.workspaceId),
-              eq(schema.sessionTurns.sessionId, input.sessionId),
-              inArray(schema.sessionTurns.status, [
-                "queued",
-                "running",
-                "requires_action",
-                "recovering",
-                "waiting_capacity",
-              ]),
-            ),
-          )
-          .limit(1);
-        const [laterTurn] = await tx
-          .select({ id: schema.sessionTurns.id })
-          .from(schema.sessionTurns)
-          .where(
-            and(
-              eq(schema.sessionTurns.workspaceId, input.workspaceId),
-              eq(schema.sessionTurns.sessionId, input.sessionId),
-              gt(schema.sessionTurns.position, blockedTurn.position),
-            ),
-          )
-          .limit(1);
         const currentPolicyHash = codexCapacityPolicyHashFromTurnMetadata(blockedTurn.metadata);
         let supersedeReason: string | null = null;
-        if (effectiveControl?.state !== "active" || effectiveControl.settlement !== null) {
-          supersedeReason = "control_changed";
-        } else if (goal.status !== "active" || goal.version !== waiter.goalVersion) {
+        if (session.status === "cancelled") {
+          supersedeReason = "session_cancelled";
+        } else if (
+          waiter.goalId !== null &&
+          (!goal || goal.status !== "active" || goal.version !== waiter.goalVersion)
+        ) {
           supersedeReason = "goal_changed";
         } else if (currentPolicyHash !== waiter.policyHash) {
           supersedeReason = "credential_policy_changed";
-        } else if (session.status !== "idle" || session.activeTurnId !== null) {
-          supersedeReason = "session_not_capacity_idle";
-        } else if (blockedTurn.status !== "failed") {
+        } else if (session.activeTurnId !== blockedTurn.id) {
+          supersedeReason = "active_turn_changed";
+        } else if (session.status !== "waiting_capacity") {
+          supersedeReason = "session_not_waiting_capacity";
+        } else if (
+          blockedTurn.status !== "waiting_capacity" ||
+          blockedTurn.activeAttemptId !== null ||
+          blockedTurn.executionGeneration !== waiter.blockedTurnGeneration
+        ) {
           supersedeReason = "blocked_turn_changed";
-        } else if (pending) {
-          supersedeReason = "pending_work_exists";
-        } else if (laterTurn) {
-          supersedeReason = "newer_turn_exists";
         }
         if (supersedeReason) {
           const superseded = await supersedeCodexCapacityWaitInTransaction(tx, {
             session,
+            blockedTurn,
             waiter,
             reason: supersedeReason,
             now,
@@ -10446,69 +11118,6 @@ export async function reconcileCodexCapacityWait<
           } as const;
         }
 
-        const prompt = [
-          "[CODEX CAPACITY RESUME] Codex subscription capacity is available again.",
-          `Continue the existing active goal from durable conversation history: ${goal.text}`,
-          `Success criteria: ${goal.successCriteria ?? "none specified"}.`,
-          "Do not replay completed tool side effects; verify any ambiguous in-flight effect before repeating it.",
-          "If the goal is complete, call opengeni__goal_complete. If blocked for another reason, call opengeni__goal_pause.",
-        ].join("\n");
-        const [update] = await tx
-          .insert(schema.sessionSystemUpdates)
-          .values({
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            sessionId: input.sessionId,
-            kind: "goal_continuation",
-            classification: "info",
-            sourceId: goal.id,
-            dedupeKey: `codex-capacity-resume:${waiter.id}:${waiter.generation}`,
-            summary: prompt,
-            payload: {
-              type: "goal_continuation",
-              goalId: goal.id,
-              goalVersion: goal.version,
-              prompt,
-              reason: "codex_capacity",
-              capacityWaiterId: waiter.id,
-              capacityWaitGeneration: waiter.generation,
-              policy: {
-                model: blockedTurn.model,
-                reasoningEffort: blockedTurn.reasoningEffort,
-                tools: blockedTurn.tools,
-                sandboxBackend: blockedTurn.sandboxBackend,
-              },
-            },
-            lineage: {
-              goalId: goal.id,
-              blockedTurnId: blockedTurn.id,
-              capacityWaiterId: waiter.id,
-            },
-            state: "pending",
-          })
-          .returning();
-        if (!update) {
-          throw new Error("Codex capacity resume did not create an internal update");
-        }
-        await tx
-          .insert(schema.usageEvents)
-          .values({
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            eventType: "agent_run.created",
-            quantity: 1,
-            unit: "run",
-            sourceResourceType: "session_system_update",
-            sourceResourceId: update.id,
-            sessionId: input.sessionId,
-            initiatorKind: "service",
-            initiatorSubjectId: "goal-continuation",
-            initiatorContext: { goalId: goal.id, reason: "codex_capacity" },
-            origin: "goal",
-            idempotencyKey: `agent_run.created:codex-capacity:${input.workspaceId}:${update.id}`,
-            occurredAt: now,
-          })
-          .onConflictDoNothing({ target: schema.usageEvents.idempotencyKey });
         const events = await tx
           .insert(schema.sessionEvents)
           .values([
@@ -10517,14 +11126,20 @@ export async function reconcileCodexCapacityWait<
               workspaceId: input.workspaceId,
               sessionId: input.sessionId,
               sequence: session.lastSequence + 1,
-              type: "system.update.pending",
+              type: "codex.capacity.resumed",
               payload: sanitizeEventPayload({
-                updateId: update.id,
-                kind: update.kind,
-                classification: update.classification,
-                sourceId: update.sourceId,
-                summary: update.summary,
+                waiterId: waiter.id,
+                generation: waiter.generation,
+                wakeRevision: waiter.wakeRevision,
+                goalId: waiter.goalId,
+                goalVersion: waiter.goalVersion,
+                blockedTurnGeneration: waiter.blockedTurnGeneration,
+                policyHash: waiter.policyHash,
+                diagnostic: decision.diagnostic ?? null,
               }),
+              turnId: blockedTurn.id,
+              turnGeneration: blockedTurn.executionGeneration,
+              turnAssociation: "current",
               occurredAt: now,
             },
             {
@@ -10532,18 +11147,11 @@ export async function reconcileCodexCapacityWait<
               workspaceId: input.workspaceId,
               sessionId: input.sessionId,
               sequence: session.lastSequence + 2,
-              type: "codex.capacity.resumed",
-              payload: sanitizeEventPayload({
-                waiterId: waiter.id,
-                generation: waiter.generation,
-                wakeRevision: waiter.wakeRevision,
-                goalId: goal.id,
-                goalVersion: goal.version,
-                policyHash: waiter.policyHash,
-                diagnostic: decision.diagnostic ?? null,
-                updateId: update.id,
-              }),
+              type: "session.status.changed",
+              payload: { status: "recovering", reason: "codex_capacity" },
               turnId: blockedTurn.id,
+              turnGeneration: blockedTurn.executionGeneration,
+              turnAssociation: "current",
               occurredAt: now,
             },
           ])
@@ -10552,7 +11160,7 @@ export async function reconcileCodexCapacityWait<
           .update(schema.codexCapacityWaiters)
           .set({
             status: "resumed",
-            resumedUpdateId: update.id,
+            resumedUpdateId: null,
             observedWakeRevision: waiter.wakeRevision,
             lastWakeReason: "capacity_available",
             updatedAt: now,
@@ -10568,11 +11176,34 @@ export async function reconcileCodexCapacityWait<
         if (!updatedWaiter) {
           throw new Error("Codex capacity waiter changed during atomic resume");
         }
-        await tx
+        const [recoveringTurn] = await tx
+          .update(schema.sessionTurns)
+          .set({
+            status: "recovering",
+            activeAttemptId: null,
+            metadata: metadataWithoutTurnDispatchAttempt(blockedTurn.metadata),
+            version: blockedTurn.version + 1,
+            finishedAt: null,
+            updatedAt: now,
+          })
+          .where(
+            and(
+              eq(schema.sessionTurns.workspaceId, input.workspaceId),
+              eq(schema.sessionTurns.id, blockedTurn.id),
+              eq(schema.sessionTurns.status, "waiting_capacity"),
+              isNull(schema.sessionTurns.activeAttemptId),
+              eq(schema.sessionTurns.executionGeneration, waiter.blockedTurnGeneration),
+            ),
+          )
+          .returning({ id: schema.sessionTurns.id });
+        if (!recoveringTurn) {
+          throw new Error("Codex capacity blocked turn changed during atomic resume");
+        }
+        const [recoveringSession] = await tx
           .update(schema.sessions)
           .set({
-            status: "queued",
-            activeTurnId: null,
+            status: "recovering",
+            activeTurnId: blockedTurn.id,
             lastSequence: session.lastSequence + 2,
             updatedAt: now,
           })
@@ -10580,13 +11211,17 @@ export async function reconcileCodexCapacityWait<
             and(
               eq(schema.sessions.workspaceId, input.workspaceId),
               eq(schema.sessions.id, input.sessionId),
-              isNull(schema.sessions.activeTurnId),
+              eq(schema.sessions.status, "waiting_capacity"),
+              eq(schema.sessions.activeTurnId, blockedTurn.id),
             ),
-          );
+          )
+          .returning({ id: schema.sessions.id });
+        if (!recoveringSession) {
+          throw new Error("Codex capacity session changed during atomic resume");
+        }
         return {
           action: "resumed",
           waiter: mapCodexCapacityWaiter(updatedWaiter),
-          update: mapSessionSystemUpdate(update),
           events: events.map(mapEvent),
         } as const;
       }),
@@ -14463,21 +15098,24 @@ export async function listSessionsForSubject(
           if (ordinaryIds.length > limit) {
             let snapshot = reusableSnapshot;
             if (!snapshot) {
-              const activeSnapshots = await tx
-                .select({ id: schema.sessionListSnapshots.id })
-                .from(schema.sessionListSnapshots)
-                .where(
-                  and(
-                    eq(schema.sessionListSnapshots.workspaceId, workspaceId),
-                    eq(schema.sessionListSnapshots.subjectId, options.subjectId),
-                  ),
-                )
-                .limit(SESSION_LIST_SNAPSHOT_MAX_ACTIVE_PER_SUBJECT);
-              if (activeSnapshots.length >= SESSION_LIST_SNAPSHOT_MAX_ACTIVE_PER_SUBJECT) {
-                throw new SessionListSnapshotLimitError(
-                  "too many active session list snapshots; retry after an existing cursor expires",
-                );
-              }
+              // Creation is serialized by the subject advisory lock above.
+              // Retain only the newest N-1 before inserting so polling and
+              // search identity churn cannot turn this bounded cache into a
+              // user-visible 429. A continuation for an evicted row retains
+              // the existing typed expiry/410 + client rebase contract.
+              await tx.execute(sql`
+                delete from ${schema.sessionListSnapshots} snapshot
+                where snapshot.workspace_id = ${workspaceId}
+                  and snapshot.subject_id = ${options.subjectId}
+                  and snapshot.id in (
+                    select evicted.id
+                    from ${schema.sessionListSnapshots} evicted
+                    where evicted.workspace_id = ${workspaceId}
+                      and evicted.subject_id = ${options.subjectId}
+                    order by evicted.created_at desc, evicted.id desc
+                    offset ${SESSION_LIST_SNAPSHOT_MAX_ACTIVE_PER_SUBJECT - 1}
+                  )
+              `);
               const [workspace] = await tx
                 .select({ accountId: schema.workspaces.accountId })
                 .from(schema.workspaces)
@@ -19374,7 +20012,7 @@ export async function acquireLease(
         if (liveness === "cold") {
           const recovery = recoveryStateFromLeaseRow(row);
           if (
-            recovery.restore.status === "degraded" ||
+            (recovery.restore.status === "degraded" && recovery.restore.retryable !== true) ||
             recovery.restore.status === "unrecoverable"
           ) {
             return {
@@ -20075,10 +20713,186 @@ export async function recordWarmingSandboxCreated(
   );
 }
 
+export type LostProviderWorkspaceSettlement = {
+  processesLost: number;
+  admissionsRejected: number;
+  ptysClosed: number;
+  processHoldersDeleted: number;
+};
+
 export type MarkWarmLeaseInstanceLostResult =
-  | { status: "marked"; lease: LeaseSnapshot }
+  | {
+      status: "marked";
+      lease: LeaseSnapshot;
+      settlement: LostProviderWorkspaceSettlement;
+    }
   | { status: "stale"; lease: LeaseSnapshot | null };
 
+const LOST_PROVIDER_PROCESS_REASON = "provider_instance_lost";
+
+/** Lock the exact provider-owned blocker set before taking the lease row. Normal
+ * retained-process settlement locks process -> admission -> lease, so provider
+ * loss must not hold the lease while waiting for one of those rows. The lease
+ * tuple is revalidated under FOR UPDATE after these locks are acquired. */
+async function lockExactLostProviderWorkspaceBlockersTx(
+  tx: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    leaseId: string;
+    sandboxGroupId: string;
+    lostEpoch: number;
+    lostInstanceId: string;
+  },
+): Promise<void> {
+  await tx.execute(sql`
+    select id from sandbox_retained_processes
+    where account_id = ${input.accountId}
+      and workspace_id = ${input.workspaceId}
+      and lease_id = ${input.leaseId}
+      and sandbox_group_id = ${input.sandboxGroupId}
+      and lease_epoch = ${input.lostEpoch}
+      and provider_instance_id = ${input.lostInstanceId}
+      and state = 'active'
+    order by id
+    for update
+  `);
+  await tx.execute(sql`
+    select id from sandbox_workspace_mutation_admissions
+    where account_id = ${input.accountId}
+      and workspace_id = ${input.workspaceId}
+      and lease_id = ${input.leaseId}
+      and sandbox_group_id = ${input.sandboxGroupId}
+      and lease_epoch = ${input.lostEpoch}
+      and provider_instance_id = ${input.lostInstanceId}
+      and settled_at is null
+    order by id
+    for update
+  `);
+  await tx.execute(sql`
+    select id from sandbox_pty_sessions
+    where account_id = ${input.accountId}
+      and workspace_id = ${input.workspaceId}
+      and lease_id = ${input.leaseId}
+      and sandbox_group_id = ${input.sandboxGroupId}
+      and lease_epoch = ${input.lostEpoch}
+      and provider_instance_id = ${input.lostInstanceId}
+      and status = 'open'
+    order by id
+    for update
+  `);
+}
+
+async function settleExactLostProviderWorkspaceBlockersTx(
+  tx: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    leaseId: string;
+    sandboxGroupId: string;
+    lostEpoch: number;
+    lostInstanceId: string;
+  },
+): Promise<LostProviderWorkspaceSettlement> {
+  const lostProcesses = await tx
+    .update(schema.sandboxRetainedProcesses)
+    .set({
+      state: "lost",
+      exitCode: null,
+      settlementReason: LOST_PROVIDER_PROCESS_REASON,
+      settledAt: new Date(),
+    })
+    .where(
+      and(
+        eq(schema.sandboxRetainedProcesses.accountId, input.accountId),
+        eq(schema.sandboxRetainedProcesses.workspaceId, input.workspaceId),
+        eq(schema.sandboxRetainedProcesses.leaseId, input.leaseId),
+        eq(schema.sandboxRetainedProcesses.sandboxGroupId, input.sandboxGroupId),
+        eq(schema.sandboxRetainedProcesses.leaseEpoch, input.lostEpoch),
+        eq(schema.sandboxRetainedProcesses.providerInstanceId, input.lostInstanceId),
+        eq(schema.sandboxRetainedProcesses.state, "active"),
+      ),
+    )
+    .returning({
+      id: schema.sandboxRetainedProcesses.id,
+      holderId: schema.sandboxRetainedProcesses.holderId,
+    });
+
+  const rejectedAdmissions = await tx
+    .update(schema.sandboxWorkspaceMutationAdmissions)
+    .set({ providerOutcome: "rejected", settledAt: new Date() })
+    .where(
+      and(
+        eq(schema.sandboxWorkspaceMutationAdmissions.accountId, input.accountId),
+        eq(schema.sandboxWorkspaceMutationAdmissions.workspaceId, input.workspaceId),
+        eq(schema.sandboxWorkspaceMutationAdmissions.leaseId, input.leaseId),
+        eq(schema.sandboxWorkspaceMutationAdmissions.sandboxGroupId, input.sandboxGroupId),
+        eq(schema.sandboxWorkspaceMutationAdmissions.leaseEpoch, input.lostEpoch),
+        eq(schema.sandboxWorkspaceMutationAdmissions.providerInstanceId, input.lostInstanceId),
+        isNull(schema.sandboxWorkspaceMutationAdmissions.settledAt),
+      ),
+    )
+    .returning({ id: schema.sandboxWorkspaceMutationAdmissions.id });
+
+  const closedPtys = await tx
+    .update(schema.sandboxPtySessions)
+    .set({ status: "closed", closedAt: new Date() })
+    .where(
+      and(
+        eq(schema.sandboxPtySessions.accountId, input.accountId),
+        eq(schema.sandboxPtySessions.workspaceId, input.workspaceId),
+        eq(schema.sandboxPtySessions.leaseId, input.leaseId),
+        eq(schema.sandboxPtySessions.sandboxGroupId, input.sandboxGroupId),
+        eq(schema.sandboxPtySessions.leaseEpoch, input.lostEpoch),
+        eq(schema.sandboxPtySessions.providerInstanceId, input.lostInstanceId),
+        eq(schema.sandboxPtySessions.status, "open"),
+      ),
+    )
+    .returning({ id: schema.sandboxPtySessions.id });
+
+  const deletedHolders =
+    lostProcesses.length === 0
+      ? []
+      : await tx
+          .delete(schema.sandboxLeaseHolders)
+          .where(
+            and(
+              eq(schema.sandboxLeaseHolders.accountId, input.accountId),
+              eq(schema.sandboxLeaseHolders.workspaceId, input.workspaceId),
+              eq(schema.sandboxLeaseHolders.leaseId, input.leaseId),
+              eq(schema.sandboxLeaseHolders.kind, "process"),
+              inArray(
+                schema.sandboxLeaseHolders.holderId,
+                lostProcesses.map((process) => process.holderId),
+              ),
+            ),
+          )
+          .returning({ holderId: schema.sandboxLeaseHolders.holderId });
+
+  await tx.execute(sql`
+    update sandbox_leases as lease set
+      refcount = counts.total,
+      turn_holders = counts.turns,
+      viewer_holders = counts.viewers,
+      updated_at = now()
+    from (
+      select count(*)::int as total,
+        count(*) filter (where kind = 'turn')::int as turns,
+        count(*) filter (where kind = 'viewer')::int as viewers
+      from sandbox_lease_holders
+      where lease_id = ${input.leaseId}
+    ) as counts
+    where lease.id = ${input.leaseId}
+  `);
+
+  return {
+    processesLost: lostProcesses.length,
+    admissionsRejected: rejectedAdmissions.length,
+    ptysClosed: closedPtys.length,
+    processHoldersDeleted: deletedHolders.length,
+  };
+}
+
 /**
  * Atomically retire one exact warm provider instance after a resume-only caller
  * receives a provider NotFound. The epoch + instance predicates are the
@@ -20086,10 +20900,11 @@ export type MarkWarmLeaseInstanceLostResult =
  * box, but only the first one transitions the lease to cold and advances its
  * epoch. The next ordinary acquire elects one cold->warming spawner.
  *
- * Holders remain intact because their logical work/viewer interest still exists.
- * Only live provider identity is cleared. A persisted workspace archive is
- * reduced to the same minimal cold envelope used by the drain/failure paths, so
- * the elected replacement can hydrate it without carrying the dead box id.
+ * Logical turn/viewer interest remains intact, while holders for active
+ * processes that physically belonged to the lost provider are removed with
+ * their terminal loss proof. A persisted workspace archive is reduced to the
+ * same minimal cold envelope used by the drain/failure paths, so the elected
+ * replacement can hydrate it without carrying the dead box id.
  */
 export async function markWarmLeaseInstanceLost(
   db: Database,
@@ -20109,6 +20924,33 @@ export async function markWarmLeaseInstanceLost(
     async (scopedDb) =>
       await scopedDb.transaction(async (txRaw) => {
         const tx = txRaw as unknown as Database;
+        const observedRows = await tx.execute<LeaseRow>(sql`
+          select * from sandbox_leases
+          where workspace_id = ${input.workspaceId}
+            and sandbox_group_id = ${input.sandboxGroupId}
+        `);
+        const observed = observedRows[0];
+        if (
+          !observed ||
+          observed.liveness !== "warm" ||
+          Number(observed.lease_epoch) !== input.expectedEpoch ||
+          observed.instance_id !== input.expectedInstanceId
+        ) {
+          return {
+            status: "stale" as const,
+            lease: observed ? mapLeaseRow(observed) : null,
+          };
+        }
+
+        const blockerScope = {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          leaseId: observed.id,
+          sandboxGroupId: input.sandboxGroupId,
+          lostEpoch: input.expectedEpoch,
+          lostInstanceId: input.expectedInstanceId,
+        };
+        await lockExactLostProviderWorkspaceBlockersTx(tx, blockerScope);
         const currentRows = await tx.execute<LeaseRow>(sql`
           select * from sandbox_leases
           where workspace_id = ${input.workspaceId}
@@ -20118,6 +20960,7 @@ export async function markWarmLeaseInstanceLost(
         const current = currentRows[0];
         if (
           !current ||
+          current.id !== observed.id ||
           current.liveness !== "warm" ||
           Number(current.lease_epoch) !== input.expectedEpoch ||
           current.instance_id !== input.expectedInstanceId
@@ -20128,6 +20971,8 @@ export async function markWarmLeaseInstanceLost(
           };
         }
 
+        const settlement = await settleExactLostProviderWorkspaceBlockersTx(tx, blockerScope);
+
         const observedAt = new Date().toISOString();
         const before = recoveryStateFromLeaseRow(current);
         const archiveStatus = before.archive.status;
@@ -20198,7 +21043,126 @@ export async function markWarmLeaseInstanceLost(
         if (!updated) {
           throw new Error(`Warm sandbox lease vanished while retiring instance ${current.id}`);
         }
-        return { status: "marked" as const, lease: mapLeaseRow(updated) };
+        return { status: "marked" as const, lease: mapLeaseRow(updated), settlement };
+      }),
+  );
+}
+
+export type ReconcileColdLostLeaseInstanceBlockersResult =
+  | {
+      status: "reconciled";
+      lease: LeaseSnapshot;
+      settlement: LostProviderWorkspaceSettlement;
+    }
+  | { status: "stale"; lease: LeaseSnapshot | null };
+
+/**
+ * Settle blockers left by a provider-loss transition that predates exact loss
+ * cleanup. This is deliberately narrower than markWarmLeaseInstanceLost: it
+ * requires the already-cold lease to match the full operator-observed
+ * generation/archive tuple, the current epoch to be exactly lostEpoch + 1, and
+ * recovery truth to name the same missing provider. It never advances an epoch,
+ * rematerializes a provider, or changes archive/recovery completeness.
+ */
+export async function reconcileColdLostLeaseInstanceBlockers(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedCurrentEpoch: number;
+    expectedLostEpoch: number;
+    expectedLostInstanceId: string;
+    expectedWorkspaceGeneration: number;
+    expectedArchiveGeneration: number | null;
+    expectedArchiveComplete: boolean;
+  },
+): Promise<ReconcileColdLostLeaseInstanceBlockersResult> {
+  if (
+    !Number.isSafeInteger(input.expectedCurrentEpoch) ||
+    !Number.isSafeInteger(input.expectedLostEpoch) ||
+    input.expectedCurrentEpoch !== input.expectedLostEpoch + 1
+  ) {
+    throw new Error("Cold lost-provider reconciliation requires currentEpoch = lostEpoch + 1");
+  }
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (txRaw) => {
+        const tx = txRaw as unknown as Database;
+        const observedRows = await tx.execute<LeaseRow>(sql`
+          select * from sandbox_leases
+          where workspace_id = ${input.workspaceId}
+            and sandbox_group_id = ${input.sandboxGroupId}
+        `);
+        const observed = observedRows[0];
+        const observedRecovery = observed ? recoveryStateFromLeaseRow(observed) : null;
+        if (
+          !observed ||
+          observed.liveness !== "cold" ||
+          observed.instance_id !== null ||
+          Number(observed.lease_epoch) !== input.expectedCurrentEpoch ||
+          Number(observed.workspace_generation) !== input.expectedWorkspaceGeneration ||
+          (observed.archive_generation === null ? null : Number(observed.archive_generation)) !==
+            input.expectedArchiveGeneration ||
+          hasCompleteWorkspaceArchive(observed) !== input.expectedArchiveComplete ||
+          observedRecovery?.provider.status !== "missing" ||
+          observedRecovery.provider.instanceId !== input.expectedLostInstanceId
+        ) {
+          return {
+            status: "stale" as const,
+            lease: observed ? mapLeaseRow(observed) : null,
+          };
+        }
+
+        const blockerScope = {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          leaseId: observed.id,
+          sandboxGroupId: input.sandboxGroupId,
+          lostEpoch: input.expectedLostEpoch,
+          lostInstanceId: input.expectedLostInstanceId,
+        };
+        await lockExactLostProviderWorkspaceBlockersTx(tx, blockerScope);
+        const currentRows = await tx.execute<LeaseRow>(sql`
+          select * from sandbox_leases
+          where workspace_id = ${input.workspaceId}
+            and sandbox_group_id = ${input.sandboxGroupId}
+          for update
+        `);
+        const current = currentRows[0];
+        const recovery = current ? recoveryStateFromLeaseRow(current) : null;
+        if (
+          !current ||
+          current.id !== observed.id ||
+          current.liveness !== "cold" ||
+          current.instance_id !== null ||
+          Number(current.lease_epoch) !== input.expectedCurrentEpoch ||
+          Number(current.workspace_generation) !== input.expectedWorkspaceGeneration ||
+          (current.archive_generation === null ? null : Number(current.archive_generation)) !==
+            input.expectedArchiveGeneration ||
+          hasCompleteWorkspaceArchive(current) !== input.expectedArchiveComplete ||
+          recovery?.provider.status !== "missing" ||
+          recovery.provider.instanceId !== input.expectedLostInstanceId
+        ) {
+          return {
+            status: "stale" as const,
+            lease: current ? mapLeaseRow(current) : null,
+          };
+        }
+
+        const settlement = await settleExactLostProviderWorkspaceBlockersTx(tx, blockerScope);
+        const refreshedRows = await tx.execute<LeaseRow>(sql`
+          select * from sandbox_leases where id = ${current.id}
+        `);
+        const refreshed = refreshedRows[0];
+        if (!refreshed) throw new Error("Cold sandbox lease vanished during reconciliation");
+        return {
+          status: "reconciled" as const,
+          lease: mapLeaseRow(refreshed),
+          settlement,
+        };
       }),
   );
 }
@@ -21066,7 +22030,7 @@ export async function confirmDrainCold(
 // The fence is the split-brain guard: a stale-epoch reaper writes ZERO rows and
 // is told not to terminate.
 export class SandboxWorkspaceMutationFencedError extends Error {
-  readonly name = "SandboxWorkspaceMutationFencedError";
+  readonly name: string = "SandboxWorkspaceMutationFencedError";
 
   constructor(
     public readonly code:
@@ -21132,8 +22096,131 @@ export type SandboxRetainedProcess = {
   settlementReason: string | null;
   startedAt: string;
   settledAt: string | null;
+  reconcileAfter: string;
+  reconcileClaimId: string | null;
+  reconcileClaimedAt: string | null;
+  reconcileAttempts: number;
+  lastReconcileOutcome: string | null;
+  reconcileProofOutcome: "exited" | "lost" | null;
+  reconcileProofExitCode: number | null;
+  reconcileProofReason:
+    | "provider_exit_banner"
+    | "provider_session_lost_banner"
+    | "provider_instance_not_found"
+    | null;
+  reconcileProofObservedAt: string | null;
 };
 
+export type RetainedProcessProviderProof =
+  | { outcome: "exited"; exitCode: number; reason: "provider_exit_banner" }
+  | {
+      outcome: "lost";
+      exitCode: null;
+      reason: "provider_session_lost_banner" | "provider_instance_not_found";
+    };
+
+export type SandboxRetainedProcessIdentity = Pick<
+  SandboxRetainedProcess,
+  | "leaseId"
+  | "sandboxGroupId"
+  | "parentAdmissionId"
+  | "holderId"
+  | "leaseEpoch"
+  | "providerBackend"
+  | "providerInstanceId"
+  | "routeKind"
+  | "routeTargetId"
+  | "routeEpoch"
+  | "providerSessionId"
+>;
+
+export type SandboxRetainedProcessReconciliationClaim = {
+  process: SandboxRetainedProcess;
+  claimId: string;
+  ownerState: string;
+  ownerAttemptOutcome: string | null;
+};
+
+export type ActiveRetainedProcessOwnerCount = {
+  ownerState: string;
+  activeCount: number;
+  terminalOwnerCount: number;
+};
+
+export type ExpiredDrainingSandboxLeaseCount = {
+  backend: string;
+  ageBucket: "lt_5m" | "5m_1h" | "1h_1d" | "gte_1d";
+  count: number;
+};
+
+export function retainedProcessSettlementIdentity(
+  process: SandboxRetainedProcess,
+): SandboxRetainedProcessIdentity {
+  return {
+    leaseId: process.leaseId,
+    sandboxGroupId: process.sandboxGroupId,
+    parentAdmissionId: process.parentAdmissionId,
+    holderId: process.holderId,
+    leaseEpoch: process.leaseEpoch,
+    providerBackend: process.providerBackend,
+    providerInstanceId: process.providerInstanceId,
+    routeKind: process.routeKind,
+    routeTargetId: process.routeTargetId,
+    routeEpoch: process.routeEpoch,
+    providerSessionId: process.providerSessionId,
+  };
+}
+
+export function retainedProcessReconciliationProof(
+  process: SandboxRetainedProcess,
+): RetainedProcessProviderProof | null {
+  if (
+    process.reconcileProofOutcome === "exited" &&
+    process.reconcileProofReason === "provider_exit_banner" &&
+    process.reconcileProofExitCode !== null
+  ) {
+    return {
+      outcome: "exited",
+      exitCode: process.reconcileProofExitCode,
+      reason: "provider_exit_banner",
+    };
+  }
+  if (
+    process.reconcileProofOutcome === "lost" &&
+    (process.reconcileProofReason === "provider_session_lost_banner" ||
+      process.reconcileProofReason === "provider_instance_not_found")
+  ) {
+    return {
+      outcome: "lost",
+      exitCode: null,
+      reason: process.reconcileProofReason,
+    };
+  }
+  return null;
+}
+
+/** Durable promotion committed before a mutable route/turn authority check
+ * rejected the provider output. The process identity is safe to hand to the
+ * exact-backend cancellation path; callers must still reject the output and
+ * must never replay the provider mutation. */
+export class SandboxRetainedProcessPromotionFencedError extends SandboxWorkspaceMutationFencedError {
+  readonly name = "SandboxRetainedProcessPromotionFencedError";
+
+  constructor(
+    code:
+      | "attempt_fenced"
+      | "holder_fenced"
+      | "lease_fenced"
+      | "route_fenced"
+      | "process_fenced"
+      | "admission_fenced",
+    message: string,
+    public readonly process: SandboxRetainedProcess,
+  ) {
+    super(code, message);
+  }
+}
+
 type SandboxWorkspaceMutationSettlementResult =
   | { failure: null }
   | {
@@ -21246,6 +22333,18 @@ function normalizeRetainedProcessSettlementReason(reason: string): string {
   return bounded;
 }
 
+function normalizeRetainedProcessReconciliationOutcome(outcome: string): string {
+  const normalized = outcome.trim();
+  const byteLength = Buffer.byteLength(normalized, "utf8");
+  if (byteLength < 1 || byteLength > 64) {
+    throw new SandboxWorkspaceMutationFencedError(
+      "process_fenced",
+      "Retained process reconciliation outcome must contain between 1 and 64 UTF-8 bytes",
+    );
+  }
+  return normalized;
+}
+
 function mapWorkspaceMutationAdmission(row: {
   id: string;
   lease_id: string;
@@ -21311,9 +22410,38 @@ function mapRetainedProcess(
     settlementReason: row.settlementReason ?? null,
     startedAt: row.startedAt.toISOString(),
     settledAt: row.settledAt?.toISOString() ?? null,
+    reconcileAfter: row.reconcileAfter.toISOString(),
+    reconcileClaimId: row.reconcileClaimId ?? null,
+    reconcileClaimedAt: row.reconcileClaimedAt?.toISOString() ?? null,
+    reconcileAttempts: row.reconcileAttempts,
+    lastReconcileOutcome: row.lastReconcileOutcome ?? null,
+    reconcileProofOutcome: row.reconcileProofOutcome ?? null,
+    reconcileProofExitCode: row.reconcileProofExitCode ?? null,
+    reconcileProofReason:
+      (row.reconcileProofReason as SandboxRetainedProcess["reconcileProofReason"]) ?? null,
+    reconcileProofObservedAt: row.reconcileProofObservedAt?.toISOString() ?? null,
   };
 }
 
+function retainedProcessMatchesSettlementIdentity(
+  process: typeof schema.sandboxRetainedProcesses.$inferSelect,
+  expected: SandboxRetainedProcessIdentity,
+): boolean {
+  return (
+    process.leaseId === expected.leaseId &&
+    process.sandboxGroupId === expected.sandboxGroupId &&
+    process.parentAdmissionId === expected.parentAdmissionId &&
+    process.holderId === expected.holderId &&
+    process.leaseEpoch === expected.leaseEpoch &&
+    process.providerBackend === expected.providerBackend &&
+    process.providerInstanceId === expected.providerInstanceId &&
+    process.routeKind === expected.routeKind &&
+    (process.routeTargetId ?? null) === expected.routeTargetId &&
+    process.routeEpoch === expected.routeEpoch &&
+    process.providerSessionId === expected.providerSessionId
+  );
+}
+
 async function lockWorkspaceMutationSessionTx(
   tx: Database,
   workspaceId: string,
@@ -22333,7 +23461,11 @@ export async function retainWorkspaceMutationProcess(
       }),
   );
   if (result.failure.failure !== null) {
-    throw new SandboxWorkspaceMutationFencedError(result.failure.failure, result.failure.detail);
+    throw new SandboxRetainedProcessPromotionFencedError(
+      result.failure.failure,
+      result.failure.detail,
+      result.process,
+    );
   }
   return result.process;
 }
@@ -22360,6 +23492,293 @@ export async function getRetainedProcess(
   });
 }
 
+/** Claim a bounded, oldest-due batch of active retained processes whose exact
+ * owner attempt is closed (or whose direct request already returned). Claim
+ * expiry only recovers coordination after worker death; it is never provider
+ * exit proof. Rows that settle between the global claim and scoped read are
+ * deliberately omitted. */
+export async function claimTerminalRetainedProcesses(
+  db: Database,
+  input: { claimId: string; limit: number; claimTtlMs: number },
+): Promise<SandboxRetainedProcessReconciliationClaim[]> {
+  if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 100) {
+    throw new Error("Retained process reconciliation limit must be between 1 and 100");
+  }
+  if (
+    !Number.isSafeInteger(input.claimTtlMs) ||
+    input.claimTtlMs < 0 ||
+    input.claimTtlMs > 3_600_000
+  ) {
+    throw new Error("Retained process reconciliation claim TTL is invalid");
+  }
+  const rows = await rawRows<{
+    account_id: string;
+    workspace_id: string;
+    session_id: string;
+    process_id: string;
+    claim_id: string;
+    owner_state: string;
+    owner_attempt_outcome: string | null;
+  }>(
+    db,
+    sql`
+      select account_id, workspace_id, session_id, process_id, claim_id,
+        owner_state, owner_attempt_outcome
+      from opengeni_private.claim_terminal_retained_processes(
+        ${input.claimId}::uuid, ${input.limit}::integer, ${input.claimTtlMs}::bigint
+      )
+    `,
+  );
+  const claims: SandboxRetainedProcessReconciliationClaim[] = [];
+  for (const row of rows) {
+    const process = await getRetainedProcess(db, {
+      workspaceId: row.workspace_id,
+      sessionId: row.session_id,
+      processId: row.process_id,
+    });
+    if (
+      !process ||
+      process.accountId !== row.account_id ||
+      process.state !== "active" ||
+      process.reconcileClaimId !== row.claim_id
+    ) {
+      continue;
+    }
+    claims.push({
+      process,
+      claimId: row.claim_id,
+      ownerState: row.owner_state,
+      ownerAttemptOutcome: row.owner_attempt_outcome,
+    });
+  }
+  return claims;
+}
+
+/** Durably checkpoint exact provider exit/loss proof before canonical
+ * settlement. This closes the worker-death window between provider observation
+ * and settlement without converting owner state, age, timeout, or claim expiry
+ * into physical proof. */
+export async function recordRetainedProcessReconciliationProof(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    processId: string;
+    expected: SandboxRetainedProcessIdentity;
+    claimId: string;
+    proof: RetainedProcessProviderProof;
+  },
+): Promise<SandboxRetainedProcess> {
+  if (
+    input.proof.outcome === "exited" &&
+    (!Number.isSafeInteger(input.proof.exitCode) || input.proof.exitCode === null)
+  ) {
+    throw new SandboxWorkspaceMutationFencedError(
+      "process_fenced",
+      "Retained process reconciliation exit proof requires a safe integer exit code",
+    );
+  }
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (txRaw) => {
+        const tx = txRaw as unknown as Database;
+        const [process] = await tx
+          .select()
+          .from(schema.sandboxRetainedProcesses)
+          .where(
+            and(
+              eq(schema.sandboxRetainedProcesses.accountId, input.accountId),
+              eq(schema.sandboxRetainedProcesses.workspaceId, input.workspaceId),
+              eq(schema.sandboxRetainedProcesses.sessionId, input.sessionId),
+              eq(schema.sandboxRetainedProcesses.id, input.processId),
+            ),
+          )
+          .for("update")
+          .limit(1);
+        if (
+          !process ||
+          process.state !== "active" ||
+          !retainedProcessMatchesSettlementIdentity(process, input.expected)
+        ) {
+          throw new SandboxWorkspaceMutationFencedError(
+            "process_fenced",
+            "Retained process proof did not match an active copied durable identity",
+          );
+        }
+        if (process.reconcileClaimId !== input.claimId) {
+          throw new SandboxWorkspaceMutationFencedError(
+            "process_fenced",
+            "Retained process proof claim was lost or superseded",
+          );
+        }
+        const existing = mapRetainedProcess(process);
+        const existingProof = retainedProcessReconciliationProof(existing);
+        if (existingProof) {
+          if (
+            existingProof.outcome !== input.proof.outcome ||
+            existingProof.exitCode !== input.proof.exitCode ||
+            existingProof.reason !== input.proof.reason
+          ) {
+            throw new SandboxWorkspaceMutationFencedError(
+              "process_fenced",
+              "Retained process already carries different provider proof",
+            );
+          }
+          return existing;
+        }
+        const [updated] = await tx
+          .update(schema.sandboxRetainedProcesses)
+          .set({
+            reconcileProofOutcome: input.proof.outcome,
+            reconcileProofExitCode: input.proof.exitCode,
+            reconcileProofReason: input.proof.reason,
+            reconcileProofObservedAt: new Date(),
+            lastReconcileOutcome: `proof_${input.proof.outcome}`,
+          })
+          .where(
+            and(
+              eq(schema.sandboxRetainedProcesses.id, process.id),
+              eq(schema.sandboxRetainedProcesses.state, "active"),
+              eq(schema.sandboxRetainedProcesses.reconcileClaimId, input.claimId),
+            ),
+          )
+          .returning();
+        if (!updated) {
+          throw new SandboxWorkspaceMutationFencedError(
+            "process_fenced",
+            "Retained process changed while checkpointing provider proof",
+          );
+        }
+        return mapRetainedProcess(updated);
+      }),
+  );
+}
+
+/** Release one exact reconciliation claim after an ambiguous/running provider
+ * observation. This schedules a bounded retry but never changes process,
+ * admission, holder, lease, archive, snapshot, or workspace state. */
+export async function deferRetainedProcessReconciliation(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    processId: string;
+    expected: SandboxRetainedProcessIdentity;
+    claimId: string;
+    outcome: string;
+    retryAfterMs: number;
+  },
+): Promise<boolean> {
+  const outcome = normalizeRetainedProcessReconciliationOutcome(input.outcome);
+  if (
+    !Number.isSafeInteger(input.retryAfterMs) ||
+    input.retryAfterMs < 0 ||
+    input.retryAfterMs > 86_400_000
+  ) {
+    throw new SandboxWorkspaceMutationFencedError(
+      "process_fenced",
+      "Retained process reconciliation retry delay is invalid",
+    );
+  }
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (txRaw) => {
+        const tx = txRaw as unknown as Database;
+        const [process] = await tx
+          .select()
+          .from(schema.sandboxRetainedProcesses)
+          .where(
+            and(
+              eq(schema.sandboxRetainedProcesses.accountId, input.accountId),
+              eq(schema.sandboxRetainedProcesses.workspaceId, input.workspaceId),
+              eq(schema.sandboxRetainedProcesses.sessionId, input.sessionId),
+              eq(schema.sandboxRetainedProcesses.id, input.processId),
+            ),
+          )
+          .for("update")
+          .limit(1);
+        if (!process || !retainedProcessMatchesSettlementIdentity(process, input.expected)) {
+          throw new SandboxWorkspaceMutationFencedError(
+            "process_fenced",
+            "Retained process reconciliation did not match the copied durable identity",
+          );
+        }
+        if (process.state !== "active") return false;
+        if (process.reconcileClaimId !== input.claimId) {
+          throw new SandboxWorkspaceMutationFencedError(
+            "process_fenced",
+            "Retained process reconciliation claim was lost or superseded",
+          );
+        }
+        const [updated] = await tx
+          .update(schema.sandboxRetainedProcesses)
+          .set({
+            reconcileAfter: new Date(Date.now() + input.retryAfterMs),
+            reconcileClaimId: null,
+            reconcileClaimedAt: null,
+            lastReconcileOutcome: outcome,
+          })
+          .where(
+            and(
+              eq(schema.sandboxRetainedProcesses.id, process.id),
+              eq(schema.sandboxRetainedProcesses.state, "active"),
+              eq(schema.sandboxRetainedProcesses.reconcileClaimId, input.claimId),
+            ),
+          )
+          .returning({ id: schema.sandboxRetainedProcesses.id });
+        return Boolean(updated);
+      }),
+  );
+}
+
+export async function countActiveRetainedProcessesByOwnerState(
+  db: Database,
+): Promise<ActiveRetainedProcessOwnerCount[]> {
+  const rows = await rawRows<{
+    owner_state: string;
+    active_count: number | string;
+    terminal_owner_count: number | string;
+  }>(
+    db,
+    sql`
+      select owner_state, active_count, terminal_owner_count
+      from opengeni_private.count_active_retained_processes_by_owner_state()
+    `,
+  );
+  return rows.map((row) => ({
+    ownerState: row.owner_state,
+    activeCount: Number(row.active_count),
+    terminalOwnerCount: Number(row.terminal_owner_count),
+  }));
+}
+
+export async function countExpiredDrainingSandboxLeases(
+  db: Database,
+): Promise<ExpiredDrainingSandboxLeaseCount[]> {
+  const rows = await rawRows<{
+    backend: string;
+    age_bucket: ExpiredDrainingSandboxLeaseCount["ageBucket"];
+    count: number | string;
+  }>(
+    db,
+    sql`
+      select backend, age_bucket, count
+      from opengeni_private.count_expired_draining_sandbox_leases()
+    `,
+  );
+  return rows.map((row) => ({
+    backend: row.backend,
+    ageBucket: row.age_bucket,
+    count: Number(row.count),
+  }));
+}
+
 /** Settle an exact retained process only after exit or definitive loss proof.
  * The process row, parent admission, non-TTL holder, and lease count transition
  * commit atomically. Duplicate identical proof is idempotent; conflicting proof
@@ -22371,6 +23790,8 @@ export async function settleRetainedProcess(
     workspaceId: string;
     sessionId: string;
     processId: string;
+    expected: SandboxRetainedProcessIdentity;
+    reconciliationClaimId?: string;
     outcome: "exited" | "lost";
     exitCode?: number | null;
     reason: string;
@@ -22411,6 +23832,12 @@ export async function settleRetainedProcess(
             "Retained process settlement did not match a durable process",
           );
         }
+        if (!retainedProcessMatchesSettlementIdentity(process, input.expected)) {
+          throw new SandboxWorkspaceMutationFencedError(
+            "process_fenced",
+            "Retained process settlement did not match the copied durable identity",
+          );
+        }
         if (process.state !== "active") {
           if (
             process.state !== input.outcome ||
@@ -22433,6 +23860,27 @@ export async function settleRetainedProcess(
             );
           return { settled: false, process: mapRetainedProcess(process) };
         }
+        if (
+          input.reconciliationClaimId !== undefined &&
+          process.reconcileClaimId !== input.reconciliationClaimId
+        ) {
+          throw new SandboxWorkspaceMutationFencedError(
+            "process_fenced",
+            "Retained process settlement reconciliation claim was lost or superseded",
+          );
+        }
+        const durableProof = retainedProcessReconciliationProof(mapRetainedProcess(process));
+        if (
+          durableProof &&
+          (durableProof.outcome !== input.outcome ||
+            durableProof.exitCode !== exitCode ||
+            durableProof.reason !== reason)
+        ) {
+          throw new SandboxWorkspaceMutationFencedError(
+            "process_fenced",
+            "Retained process settlement conflicts with checkpointed provider proof",
+          );
+        }
         const admissions = await tx.execute<AdmissionIdentityRow>(sql`
           select * from sandbox_workspace_mutation_admissions
           where id = ${process.parentAdmissionId}
@@ -22440,6 +23888,13 @@ export async function settleRetainedProcess(
             and workspace_id = ${input.workspaceId}
             and session_id = ${input.sessionId}
             and lease_id = ${process.leaseId}
+            and sandbox_group_id = ${process.sandboxGroupId}
+            and lease_epoch = ${process.leaseEpoch}
+            and provider_backend = ${process.providerBackend}
+            and provider_instance_id = ${process.providerInstanceId}
+            and route_kind = ${process.routeKind}
+            and route_target_id is not distinct from ${process.routeTargetId}
+            and route_epoch = ${process.routeEpoch}
             and provider_outcome = 'retained'
             and settled_at is null
           for update
@@ -22450,6 +23905,23 @@ export async function settleRetainedProcess(
             "Retained process parent admission is not open",
           );
         }
+        const leases = await tx.execute<LeaseRow>(sql`
+          select * from sandbox_leases
+          where id = ${process.leaseId}
+            and account_id = ${input.accountId}
+            and workspace_id = ${input.workspaceId}
+            and sandbox_group_id = ${process.sandboxGroupId}
+            and lease_epoch = ${process.leaseEpoch}
+            and backend = ${process.providerBackend}
+            and instance_id = ${process.providerInstanceId}
+          for update
+        `);
+        if (!leases[0]) {
+          throw new SandboxWorkspaceMutationFencedError(
+            "lease_fenced",
+            "Retained process settlement cannot mutate a successor lease identity",
+          );
+        }
         await tx
           .update(schema.sandboxPtySessions)
           .set({ status: "closed", closedAt: new Date() })
@@ -22466,6 +23938,12 @@ export async function settleRetainedProcess(
             exitCode,
             settlementReason: reason,
             settledAt: new Date(),
+            reconcileClaimId: null,
+            reconcileClaimedAt: null,
+            lastReconcileOutcome:
+              input.reconciliationClaimId === undefined
+                ? `owner_settled_${input.outcome}`
+                : `reconciled_${input.outcome}`,
           })
           .where(
             and(
@@ -22490,6 +23968,8 @@ export async function settleRetainedProcess(
         await tx.execute(sql`
           delete from sandbox_lease_holders
           where lease_id = ${process.leaseId}
+            and account_id = ${input.accountId}
+            and workspace_id = ${input.workspaceId}
             and kind = 'process' and holder_id = ${process.holderId}
         `);
         const [counts] = await tx.execute<{
@@ -22518,6 +23998,10 @@ export async function settleRetainedProcess(
             }
             updated_at = now()
           where id = ${process.leaseId}
+            and sandbox_group_id = ${process.sandboxGroupId}
+            and lease_epoch = ${process.leaseEpoch}
+            and backend = ${process.providerBackend}
+            and instance_id = ${process.providerInstanceId}
         `);
         return { settled: true, process: mapRetainedProcess(updated) };
       }),
@@ -27521,7 +29005,7 @@ export async function initializeSessionStartAtomically(
           if (!goal) throw new Error("Failed to create initial session goal");
         }
 
-        let [userEvent] = await tx
+        const existingUserEvents = await tx
           .select()
           .from(schema.sessionEvents)
           .where(
@@ -27533,6 +29017,7 @@ export async function initializeSessionStartAtomically(
           )
           .orderBy(asc(schema.sessionEvents.sequence))
           .limit(1);
+        let userEvent: typeof schema.sessionEvents.$inferSelect | undefined = existingUserEvents[0];
         let sequence = session.lastSequence;
         const insertedEvents: Array<typeof schema.sessionEvents.$inferSelect> = [];
         const runnable = effectiveControl.state === "active";
@@ -27732,7 +29217,7 @@ export async function initializeSessionStartAtomically(
             tx as unknown as Database,
             input.consumeNewSessionDraft.subjectId,
           );
-          await consumeNewSessionDraftInTransaction(tx as unknown as Database, {
+          await seedNewSessionDraftInTransaction(tx as unknown as Database, {
             workspaceId: input.workspaceId,
             subjectId: input.consumeNewSessionDraft.subjectId,
             expectedRevision: input.consumeNewSessionDraft.expectedRevision,
@@ -29568,7 +31053,7 @@ export async function peekSessionWork(
     if (
       latestInterruption &&
       latestInterruption.quiescedAt === null &&
-      ["settled", "rejected_stale"].includes(latestInterruption.interruptionState)
+      latestInterruption.interruptionState === "settled"
     ) {
       return {
         kind: "cancellation-wait",
@@ -32894,6 +34379,9 @@ function sessionEventTypesAdvanceActivity(inputs: ReadonlyArray<{ type: string }
 function sessionMutationAdvancesActivity(update: {
   resources?: ResourceRef[];
   tools?: ToolRef[];
+  toolPolicy?: SessionToolPolicy;
+  toolPolicyVersion?: number;
+  expectedToolPolicyVersion?: number;
   model?: string;
   metadata?: Record<string, unknown>;
   status?: SessionStatus;
@@ -33482,6 +34970,7 @@ type LockedSessionUpdateContext = {
     requireApproval: SessionMcpApprovalPolicy,
   ) => Promise<UpdateSessionMcpApprovalPolicyResult>;
   listPendingSessionTurns: () => Promise<SessionTurn[]>;
+  getLockedSession: (sessionId: string) => Promise<Session | null>;
 };
 
 type LockedSessionUpdateResult = {
@@ -33489,6 +34978,9 @@ type LockedSessionUpdateResult = {
   update?: {
     resources?: ResourceRef[];
     tools?: ToolRef[];
+    toolPolicy?: SessionToolPolicy;
+    toolPolicyVersion?: number;
+    expectedToolPolicyVersion?: number;
     model?: string;
     metadata?: Record<string, unknown>;
     status?: SessionStatus;
@@ -33504,18 +34996,39 @@ export async function appendSessionEventsWithLockedSessionUpdate(
     session: Session,
     context: LockedSessionUpdateContext,
   ) => LockedSessionUpdateResult | Promise<LockedSessionUpdateResult>,
+  options: { lockParentSession?: boolean } = {},
 ): Promise<SessionEvent[]> {
   return await withWorkspaceRls(
     db,
     workspaceId,
     async (scopedDb) =>
       await scopedDb.transaction(async (tx) => {
-        const locks = await lockSessionEventWriteRows(tx as unknown as Database, {
+        const firstLocks = await lockSessionEventWriteRows(tx as unknown as Database, {
           workspaceId,
           controlLock: "share",
           sessionIds: [sessionId],
         });
-        const sessionRow = locks.sessions[0];
+        const firstSessionRow = firstLocks.sessions.find((row) => row.id === sessionId);
+        if (!firstSessionRow) {
+          throw new Error(`Session not found: ${sessionId}`);
+        }
+        // Child-policy updates must serialize with a concurrent parent-policy
+        // update. The target lock establishes the parent id, then the second
+        // call acquires the complete UUID-ordered set under the already-held
+        // workspace/control prefix.
+        const lockSessionIds = options.lockParentSession
+          ? [sessionId, firstSessionRow.parentSessionId].filter((id): id is string => Boolean(id))
+          : [sessionId];
+        const locks =
+          lockSessionIds.length === 1
+            ? firstLocks
+            : await lockSessionEventWriteRows(tx as unknown as Database, {
+                workspaceId,
+                controlLock: "already_locked",
+                workspaceLock: "already_locked",
+                sessionIds: lockSessionIds,
+              });
+        const sessionRow = locks.sessions.find((row) => row.id === sessionId);
         if (!sessionRow) {
           throw new Error(`Session not found: ${sessionId}`);
         }
@@ -33554,6 +35067,18 @@ export async function appendSessionEventsWithLockedSessionUpdate(
               .orderBy(asc(schema.sessionTurns.position), asc(schema.sessionTurns.createdAt));
             return rows.map(mapSessionTurn);
           },
+          getLockedSession: async (lockedSessionId) => {
+            const row = locks.sessions.find((candidate) => candidate.id === lockedSessionId);
+            return row
+              ? await mapSessionWithControl(
+                  tx as unknown as Database,
+                  row,
+                  [],
+                  undefined,
+                  locks.control ?? undefined,
+                )
+              : null;
+          },
         });
         if (built.events.length === 0) {
           return [];
@@ -33591,12 +35116,16 @@ export async function appendSessionEventsWithLockedSessionUpdate(
         const update = built.update ?? {};
         const advancesActivity =
           sessionMutationAdvancesActivity(update) || sessionEventTypesAdvanceActivity(values);
-        await tx
+        const updated = await tx
           .update(schema.sessions)
           .set({
             lastSequence: sequence,
             ...(update.resources !== undefined ? { resources: update.resources } : {}),
             ...(update.tools !== undefined ? { tools: update.tools } : {}),
+            ...(update.toolPolicy !== undefined ? { toolPolicy: update.toolPolicy } : {}),
+            ...(update.toolPolicyVersion !== undefined
+              ? { toolPolicyVersion: update.toolPolicyVersion }
+              : {}),
             ...(update.model !== undefined ? { model: update.model } : {}),
             ...(update.metadata !== undefined ? { metadata: update.metadata } : {}),
             ...(update.status !== undefined ? { status: update.status } : {}),
@@ -33604,8 +35133,27 @@ export async function appendSessionEventsWithLockedSessionUpdate(
             ...(advancesActivity ? { updatedAt: now } : {}),
           })
           .where(
-            and(eq(schema.sessions.workspaceId, workspaceId), eq(schema.sessions.id, sessionId)),
+            and(
+              eq(schema.sessions.workspaceId, workspaceId),
+              eq(schema.sessions.id, sessionId),
+              ...(update.expectedToolPolicyVersion !== undefined
+                ? [eq(schema.sessions.toolPolicyVersion, update.expectedToolPolicyVersion)]
+                : []),
+            ),
+          )
+          .returning({ id: schema.sessions.id });
+        if (updated.length === 0) {
+          const [current] = await tx
+            .select({ toolPolicyVersion: schema.sessions.toolPolicyVersion })
+            .from(schema.sessions)
+            .where(
+              and(eq(schema.sessions.workspaceId, workspaceId), eq(schema.sessions.id, sessionId)),
+            )
+            .limit(1);
+          throw new SessionToolPolicyVersionConflictError(
+            Number(current?.toolPolicyVersion ?? update.expectedToolPolicyVersion ?? 1),
           );
+        }
         return inserted.map(mapEvent);
       }),
   );
@@ -33666,6 +35214,7 @@ function mapSession(
       mode: "legacy",
       inheritedFromSessionId: null,
     },
+    toolPolicyVersion: Number(row.toolPolicyVersion ?? 1),
     metadata: row.metadata,
     createdBy: initiatorFromStorage(
       row.createdByKind,
@@ -34173,12 +35722,14 @@ function mapConnectionMetadata(row: {
   lastUsedAt: Date | null;
   lastError: string | null;
   version: number;
+  verifiedInstallAt: Date | null;
+  verifiedInstallVersion: number | null;
   metadata: Record<string, unknown>;
   createdBySubjectId: string | null;
   updatedBySubjectId: string | null;
   createdAt: Date;
   updatedAt: Date;
-}): ConnectionMetadata {
+}): ConnectionMetadataWithVerification {
   return {
     id: row.id,
     accountId: row.accountId,
@@ -34193,6 +35744,8 @@ function mapConnectionMetadata(row: {
     lastUsedAt: row.lastUsedAt?.toISOString() ?? null,
     lastError: row.lastError,
     version: row.version,
+    verifiedInstallAt: row.verifiedInstallAt?.toISOString() ?? null,
+    verifiedInstallVersion: row.verifiedInstallVersion,
     metadata: row.metadata,
     createdBySubjectId: row.createdBySubjectId,
     updatedBySubjectId: row.updatedBySubjectId,
@@ -34201,6 +35754,32 @@ function mapConnectionMetadata(row: {
   };
 }
 
+function mapSlackBotPostOperation(
+  row: typeof schema.slackBotPostOperations.$inferSelect,
+): SlackBotPostOperation {
+  return {
+    id: row.id,
+    accountId: row.accountId,
+    workspaceId: row.workspaceId,
+    connectionId: row.connectionId,
+    operationId: row.operationId,
+    clientMessageId: row.clientMessageId,
+    targetKind: row.targetKind,
+    targetId: row.targetId,
+    requestDigest: row.requestDigest,
+    status: row.status,
+    claimHolderId: row.claimHolderId,
+    claimExpiresAt: row.claimExpiresAt,
+    attemptCount: row.attemptCount,
+    lastFailureCode: row.lastFailureCode,
+    slackChannelId: row.slackChannelId,
+    slackMessageTimestamp: row.slackMessageTimestamp,
+    completedAt: row.completedAt,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}
+
 function mapKnowledgeMemory(row: typeof schema.knowledgeMemories.$inferSelect): KnowledgeMemory {
   return {
     id: row.id,
@@ -34270,10 +35849,17 @@ function mapGitHubInstallation(
     accountId: row.accountId,
     workspaceId: row.workspaceId,
     installationId: row.installationId,
+    githubAccountId: row.githubAccountId,
     accountLogin: row.accountLogin,
     accountType: row.accountType,
     repositoryScope: row.repositoryScope as GitHubRepositoryScope,
     linkedBySubjectId: row.linkedBySubjectId,
+    githubActorId: row.githubActorId,
+    githubActorLogin: row.githubActorLogin,
+    authorityKind: row.authorityKind as GitHubInstallationAuthorityKind | null,
+    authorityCheckedAt: row.authorityCheckedAt?.toISOString() ?? null,
+    authorityExpiresAt: row.authorityExpiresAt?.toISOString() ?? null,
+    authorityNonce: row.authorityNonce,
     createdAt: row.createdAt.toISOString(),
     updatedAt: row.updatedAt.toISOString(),
   };