@opengeni/db 0.17.1 → 0.19.0

package/dist/index.js

@@ -90,7 +90,7 @@ import {
   workspaceVariableSetVariables,
   workspaceVariableSets,
   workspaces
-} from "./chunk-TLAC622R.js";
+} from "./chunk-SZP6KRLC.js";
 import {
   migrate,
   runMigrations
@@ -110,7 +110,7 @@ import {
   inspectRuntimeDatabasePosture,
   provisionRoles,
   runtimeDatabaseReadyCheck
-} from "./chunk-T6RSJT6C.js";
+} from "./chunk-XOXEQ7HG.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/index.ts
@@ -122,7 +122,7 @@ import {
   canonicalModalCheckpointProviderBinding,
   decodeNativeSnapshotRef,
   parseWorkspaceArchiveDescriptor,
-  stableJson as stableJson2
+  stableJson as stableJson3
 } from "@opengeni/contracts";
 import {
   approvalIdentifier,
@@ -164,6 +164,7 @@ import {
   asc as asc5,
   desc as desc5,
   eq as eq10,
+  getTableColumns,
   gt as gt2,
   gte as gte2,
   inArray as inArray5,
@@ -175,7 +176,7 @@ import {
   ne,
   notInArray,
   or as or3,
-  sql as sql7
+  sql as sql8
 } from "drizzle-orm";
 
 // src/turn-initiator.ts
@@ -2655,6 +2656,7 @@ async function insertWorkspaceControlEventInTransaction(db, input) {
 
 // src/memory-domain.ts
 import { createHash as createHash2 } from "crypto";
+import { stableJson } from "@opengeni/contracts";
 var MEMORY_TEXT_MAX_CHARS = 4e3;
 var MEMORY_VISIBLE_RECORD_CAP = 2e3;
 var MEMORY_ACTIVE_RECORD_CAP = MEMORY_VISIBLE_RECORD_CAP;
@@ -2665,6 +2667,226 @@ var MEMORY_BLOCK_RECORD_LIMIT = 50;
 var MEMORY_SEARCH_DEFAULT_LIMIT = 8;
 var MEMORY_SEARCH_MAX_LIMIT = 20;
 var AGENT_VISIBLE_MEMORY_STATUSES = ["active", "approved"];
+var MEMORY_LABEL_MAX_CHARS = 64;
+var MEMORY_LABEL_MAX_COUNT = 16;
+var MEMORY_NAMESPACE_MAX_CHARS = 128;
+var MEMORY_ROLE_KEY_MAX_CHARS = 64;
+var MEMORY_SUBJECT_ID_MAX_CHARS = 1024;
+var MEMORY_SELECTOR_SEGMENT_PATTERN = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/;
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var MEMORY_RELATIONSHIP_TYPES = [
+  "derived_from",
+  "supersedes",
+  "corrects",
+  "conflicts_with",
+  "related_to",
+  "depends_on",
+  "applies_to"
+];
+var SYMMETRIC_MEMORY_RELATIONSHIPS = /* @__PURE__ */ new Set([
+  "conflicts_with",
+  "related_to"
+]);
+function normalizeSelectorSegment(value, label) {
+  const normalized = value.trim().toLowerCase().replace(/\s+/g, "-");
+  if (!MEMORY_SELECTOR_SEGMENT_PATTERN.test(normalized)) {
+    throw new Error(
+      `${label} must be a lowercase slug using letters, numbers, dot, underscore, or dash`
+    );
+  }
+  return normalized;
+}
+function normalizeUuid(value, label) {
+  const normalized = value.trim().toLowerCase();
+  if (!UUID_PATTERN.test(normalized)) {
+    throw new Error(`${label} must be a UUID`);
+  }
+  return normalized;
+}
+function normalizePositiveVersion(value, label) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(`${label} must be a positive safe integer`);
+  }
+  return value;
+}
+function normalizeMemoryLabel(label) {
+  const normalized = normalizeSelectorSegment(label, "memory label");
+  if (normalized.length > MEMORY_LABEL_MAX_CHARS) {
+    throw new Error(`memory label exceeds ${MEMORY_LABEL_MAX_CHARS} characters`);
+  }
+  return normalized;
+}
+function normalizeMemoryLabels(labels) {
+  const normalized = new Set((labels ?? []).map(normalizeMemoryLabel));
+  if (normalized.size > MEMORY_LABEL_MAX_COUNT) {
+    throw new Error(`memory labels exceed the ${MEMORY_LABEL_MAX_COUNT}-label limit`);
+  }
+  return [...normalized].sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
+}
+function normalizeMemoryNamespace(namespace) {
+  const raw = namespace?.trim() || "general";
+  const normalized = raw.split("/").map((segment) => normalizeSelectorSegment(segment, "memory namespace segment")).join("/");
+  if (normalized.length > MEMORY_NAMESPACE_MAX_CHARS) {
+    throw new Error(`memory namespace exceeds ${MEMORY_NAMESPACE_MAX_CHARS} characters`);
+  }
+  return normalized;
+}
+function normalizeMemoryRoleKey(roleKey) {
+  const normalized = normalizeSelectorSegment(roleKey, "memory role key");
+  if (normalized.length > MEMORY_ROLE_KEY_MAX_CHARS) {
+    throw new Error(`memory role key exceeds ${MEMORY_ROLE_KEY_MAX_CHARS} characters`);
+  }
+  return normalized;
+}
+function normalizeMemoryScope(scope) {
+  switch (scope.type) {
+    case "workspace":
+      return { type: "workspace" };
+    case "user": {
+      const subjectId = scope.subjectId.trim();
+      if (!subjectId || subjectId.length > MEMORY_SUBJECT_ID_MAX_CHARS) {
+        throw new Error(
+          `memory user scope requires a subject id of at most ${MEMORY_SUBJECT_ID_MAX_CHARS} characters`
+        );
+      }
+      return { type: "user", subjectId };
+    }
+    case "role":
+      return { type: "role", roleKey: normalizeMemoryRoleKey(scope.roleKey) };
+    case "session":
+      return { type: "session", sessionId: normalizeUuid(scope.sessionId, "memory session id") };
+    case "ephemeral": {
+      const validUntil = new Date(scope.validUntil);
+      if (!Number.isFinite(validUntil.getTime())) {
+        throw new Error("ephemeral memory scope requires a valid expiry timestamp");
+      }
+      return {
+        type: "ephemeral",
+        sessionId: normalizeUuid(scope.sessionId, "ephemeral memory session id"),
+        validUntil: validUntil.toISOString()
+      };
+    }
+    case "legacy": {
+      const legacyScope = scope.legacyScope.trim();
+      if (!legacyScope || legacyScope.length > MEMORY_NAMESPACE_MAX_CHARS) {
+        throw new Error("legacy memory scope must be a non-empty bounded string");
+      }
+      return { type: "legacy", legacyScope };
+    }
+  }
+}
+function isMemoryScopeApplicable(scope, context) {
+  const normalized = normalizeMemoryScope(scope);
+  switch (normalized.type) {
+    case "workspace":
+      return true;
+    case "user":
+      return Boolean(context.subjectId) && normalized.subjectId === context.subjectId;
+    case "role":
+      return Boolean(context.roleKey) && normalized.roleKey === normalizeMemoryRoleKey(context.roleKey);
+    case "session":
+      return Boolean(context.sessionId) && normalized.sessionId === context.sessionId;
+    case "ephemeral": {
+      if (!context.sessionId || normalized.sessionId !== context.sessionId) return false;
+      const now = context.now instanceof Date ? context.now : new Date(context.now ?? Date.now());
+      return Number.isFinite(now.getTime()) && now.getTime() < Date.parse(normalized.validUntil);
+    }
+    case "legacy":
+      return false;
+  }
+}
+function canonicalMemoryRelationship(input) {
+  const sourceMemoryId = normalizeUuid(input.sourceMemoryId, "source memory id");
+  const targetMemoryId = normalizeUuid(input.targetMemoryId, "target memory id");
+  if (sourceMemoryId === targetMemoryId) {
+    throw new Error("a memory relationship must connect two distinct memories");
+  }
+  if (!MEMORY_RELATIONSHIP_TYPES.includes(input.relationshipType)) {
+    throw new Error(`unsupported memory relationship type: ${input.relationshipType}`);
+  }
+  if (SYMMETRIC_MEMORY_RELATIONSHIPS.has(input.relationshipType) && targetMemoryId < sourceMemoryId) {
+    return {
+      sourceMemoryId: targetMemoryId,
+      targetMemoryId: sourceMemoryId,
+      relationshipType: input.relationshipType
+    };
+  }
+  return { sourceMemoryId, targetMemoryId, relationshipType: input.relationshipType };
+}
+function normalizeMemoryOperationPlan(input) {
+  const base = {
+    operationId: normalizeUuid(input.operationId, "memory operation id"),
+    operationType: input.operationType,
+    targetMemoryId: normalizeUuid(input.targetMemoryId, "target memory id"),
+    expectedTargetVersion: normalizePositiveVersion(
+      input.expectedTargetVersion,
+      "expected target memory version"
+    )
+  };
+  switch (input.operationType) {
+    case "reclassify":
+      return {
+        ...base,
+        operationType: "reclassify",
+        scope: normalizeMemoryScope(input.scope),
+        namespace: normalizeMemoryNamespace(input.namespace),
+        labels: normalizeMemoryLabels(input.labels)
+      };
+    case "archive":
+      return { ...base, operationType: "archive" };
+    case "relationship_add":
+    case "relationship_remove": {
+      const relatedMemoryId = normalizeUuid(input.relatedMemoryId, "related memory id");
+      const expectedRelatedVersion = normalizePositiveVersion(
+        input.expectedRelatedVersion,
+        "expected related memory version"
+      );
+      const relationship = canonicalMemoryRelationship({
+        sourceMemoryId: base.targetMemoryId,
+        targetMemoryId: relatedMemoryId,
+        relationshipType: input.relationshipType
+      });
+      const endpointsWereSwapped = relationship.sourceMemoryId !== base.targetMemoryId;
+      return {
+        ...base,
+        operationType: input.operationType,
+        targetMemoryId: relationship.sourceMemoryId,
+        relatedMemoryId: relationship.targetMemoryId,
+        expectedTargetVersion: endpointsWereSwapped ? expectedRelatedVersion : base.expectedTargetVersion,
+        expectedRelatedVersion: endpointsWereSwapped ? base.expectedTargetVersion : expectedRelatedVersion,
+        relationshipType: relationship.relationshipType
+      };
+    }
+    case "supersede":
+    case "correct": {
+      const relatedMemoryId = normalizeUuid(input.relatedMemoryId, "replacement memory id");
+      if (relatedMemoryId === base.targetMemoryId) {
+        throw new Error("a memory cannot supersede or correct itself");
+      }
+      return {
+        ...base,
+        operationType: input.operationType,
+        relatedMemoryId,
+        expectedRelatedVersion: normalizePositiveVersion(
+          input.expectedRelatedVersion,
+          "expected replacement memory version"
+        )
+      };
+    }
+  }
+}
+function hashMemoryOperationPlan(plan) {
+  return createHash2("sha256").update(stableJson(plan), "utf8").digest("hex");
+}
+function normalizeMemoryRevertPlan(input) {
+  return {
+    operationId: normalizeUuid(input.operationId, "memory revert operation id"),
+    appliedOperationId: normalizeUuid(input.appliedOperationId, "applied memory operation id")
+  };
+}
+function hashMemoryRevertPlan(plan) {
+  return createHash2("sha256").update(stableJson(plan), "utf8").digest("hex");
+}
 var MEMORY_BLOCK_KIND_ORDER = [
   "preference",
   "semantic",
@@ -2782,7 +3004,7 @@ function renderMemoryEntry(record) {
 }
 
 // src/index.ts
-import { sql as sql8 } from "drizzle-orm";
+import { sql as sql9 } from "drizzle-orm";
 
 // src/session-queue-commands.ts
 import {
@@ -2790,7 +3012,7 @@ import {
   mergeResourceRefs,
   ResourceRef,
   resourceMountPath,
-  stableJson,
+  stableJson as stableJson2,
   turnExecutionPolicyAuditMetadata
 } from "@opengeni/contracts";
 import { and as and5, asc as asc2, eq as eq5, inArray as inArray2, sql as sql3 } from "drizzle-orm";
@@ -3003,7 +3225,7 @@ function withCanonicalResourceMountPaths(resources) {
       ...value,
       mountPath: resourceMountPath(parsed.data)
     };
-    const key = stableJson(normalized);
+    const key = stableJson2(normalized);
     if (seen.has(key)) continue;
     seen.add(key);
     canonical.push(normalized);
@@ -5637,8 +5859,225 @@ async function getPreferenceRegistryFullContent(db, claims, handle) {
   });
 }
 
+// src/memory-governance.ts
+import { sql as sql5 } from "drizzle-orm";
+var MemoryGovernanceAuthorityError = class extends Error {
+  name = "MemoryGovernanceAuthorityError";
+};
+function requireBoundedActorId(value, label) {
+  const normalized = value.trim();
+  if (!normalized || normalized.length > 1024) {
+    throw new MemoryGovernanceAuthorityError(`${label} must be a non-empty bounded identifier`);
+  }
+  return normalized;
+}
+async function setAndVerifyMemoryGovernanceContext(db, authority) {
+  if (authority.actorKind === "subject") {
+    await setSubjectRlsContext(db, authority.actorSubjectId);
+  } else {
+    await db.execute(sql5`select set_config('opengeni.subject_id', '', true)`);
+  }
+  await db.execute(sql5`
+    select
+      set_config('opengeni.memory_actor_kind', ${authority.actorKind}, true),
+      set_config('opengeni.memory_actor_id', ${authority.actorSubjectId}, true),
+      set_config('opengeni.memory_session_id', ${authority.sessionId ?? ""}, true),
+      set_config('opengeni.memory_role_key', ${authority.roleKey ?? ""}, true)
+  `);
+  const rows = await db.execute(sql5`
+    select
+      nullif(current_setting('opengeni.account_id', true), '') as account_id,
+      nullif(current_setting('opengeni.workspace_id', true), '') as workspace_id,
+      nullif(current_setting('opengeni.subject_id', true), '') as subject_id,
+      nullif(current_setting('opengeni.memory_actor_kind', true), '') as actor_kind,
+      nullif(current_setting('opengeni.memory_actor_id', true), '') as actor_id,
+      nullif(current_setting('opengeni.memory_session_id', true), '') as session_id,
+      nullif(current_setting('opengeni.memory_role_key', true), '') as role_key
+  `);
+  const applied = rows[0];
+  if (!applied || applied.account_id !== authority.accountId || applied.workspace_id !== authority.workspaceId || applied.subject_id !== (authority.actorKind === "subject" ? authority.actorSubjectId : null) || applied.actor_kind !== authority.actorKind || applied.actor_id !== authority.actorSubjectId || applied.session_id !== authority.sessionId || applied.role_key !== authority.roleKey) {
+    throw new MemoryGovernanceAuthorityError(
+      "Memory governance authority was not applied on the active database backend"
+    );
+  }
+}
+async function resolveAttemptAuthority(db, input) {
+  if (!Number.isSafeInteger(input.executionGeneration) || input.executionGeneration <= 0) {
+    throw new MemoryGovernanceAuthorityError(
+      "Memory governance attempt requires a positive execution generation"
+    );
+  }
+  const rows = await db.execute(sql5`
+    with locked_workspace as materialized (
+      select workspace.id, workspace.account_id
+      from workspaces workspace
+      where workspace.id = ${input.workspaceId}::uuid
+        and workspace.account_id = ${input.accountId}::uuid
+      for key share of workspace
+    ), locked_session as materialized (
+      select session.id, session.account_id, session.workspace_id,
+        session.active_turn_id, session.metadata ->> 'memoryRoleKey' as memory_role_key
+      from sessions session
+      join locked_workspace workspace
+        on workspace.id = session.workspace_id
+       and workspace.account_id = session.account_id
+      where session.id = ${input.sessionId}::uuid
+        and session.active_turn_id = ${input.turnId}::uuid
+      for share of session
+    ), locked_turn as materialized (
+      select turn.id, turn.account_id, turn.workspace_id, turn.session_id,
+        turn.active_attempt_id, turn.execution_generation,
+        turn.initiator_kind, turn.initiator_subject_id
+      from session_turns turn
+      join locked_session session
+        on session.id = turn.session_id
+       and session.workspace_id = turn.workspace_id
+       and session.account_id = turn.account_id
+      where turn.id = ${input.turnId}::uuid
+        and turn.active_attempt_id = ${input.attemptId}::uuid
+        and turn.execution_generation = ${input.executionGeneration}
+        and turn.status in ('running', 'requires_action', 'recovering', 'waiting_capacity')
+        and turn.initiator_kind in ('subject', 'service')
+        and length(btrim(turn.initiator_subject_id)) between 1 and 1024
+      for share of turn
+    ), locked_attempt as materialized (
+      select attempt.id, attempt.account_id, attempt.workspace_id,
+        attempt.session_id, attempt.turn_id, attempt.execution_generation
+      from session_turn_attempts attempt
+      join locked_turn turn
+        on turn.id = attempt.turn_id
+       and turn.session_id = attempt.session_id
+       and turn.workspace_id = attempt.workspace_id
+       and turn.account_id = attempt.account_id
+      where attempt.id = ${input.attemptId}::uuid
+        and attempt.execution_generation = ${input.executionGeneration}
+        and attempt.state in ('claimed', 'running')
+        and not exists (
+          select 1
+          from session_attempt_interruptions interruption
+          where interruption.workspace_id = attempt.workspace_id
+            and interruption.attempt_id = attempt.id
+            and interruption.state in ('pending', 'delivered', 'acknowledged')
+        )
+      for share of attempt
+    )
+    select turn.initiator_kind, turn.initiator_subject_id, session.memory_role_key
+    from locked_workspace workspace
+    join locked_session session on true
+    join locked_turn turn on true
+    join locked_attempt attempt on true
+    where workspace.account_id = attempt.account_id
+      and workspace.id = attempt.workspace_id
+      and session.id = attempt.session_id
+      and turn.id = attempt.turn_id
+  `);
+  const row = rows[0];
+  if (!row) {
+    throw new MemoryGovernanceAuthorityError(
+      "Memory governance requires the exact current attempt, generation, and immutable initiator"
+    );
+  }
+  let roleKey = null;
+  if (row.memory_role_key !== null) {
+    try {
+      roleKey = normalizeMemoryRoleKey(row.memory_role_key);
+    } catch {
+      throw new MemoryGovernanceAuthorityError(
+        "Persisted session memoryRoleKey is invalid; role-scoped authority fails closed"
+      );
+    }
+    if (roleKey !== row.memory_role_key) {
+      throw new MemoryGovernanceAuthorityError(
+        "Persisted session memoryRoleKey is not canonical; role-scoped authority fails closed"
+      );
+    }
+  }
+  return {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    actorKind: row.initiator_kind,
+    actorSubjectId: row.initiator_subject_id,
+    sessionId: input.sessionId,
+    turnId: input.turnId,
+    attemptId: input.attemptId,
+    executionGeneration: input.executionGeneration,
+    roleKey
+  };
+}
+async function withMemoryGovernanceAuthority(db, authority, fn) {
+  return await withWorkspaceRls(db, authority.workspaceId, async (scopedDb) => {
+    let resolved;
+    if (authority.kind === "attempt") {
+      resolved = await resolveAttemptAuthority(scopedDb, authority);
+    } else {
+      const actorSubjectId = requireBoundedActorId(
+        authority.kind === "subject" ? authority.subjectId : authority.serviceId,
+        authority.kind === "subject" ? "subject id" : "service id"
+      );
+      resolved = {
+        accountId: authority.accountId,
+        workspaceId: authority.workspaceId,
+        actorKind: authority.kind,
+        actorSubjectId,
+        sessionId: null,
+        turnId: null,
+        attemptId: null,
+        executionGeneration: null,
+        roleKey: null
+      };
+    }
+    await setAndVerifyMemoryGovernanceContext(scopedDb, resolved);
+    return await fn(scopedDb, resolved);
+  });
+}
+async function applyKnowledgeMemoryOperation(db, input) {
+  const plan = normalizeMemoryOperationPlan(input.plan);
+  const planHash = hashMemoryOperationPlan(plan);
+  return await withMemoryGovernanceAuthority(db, input.authority, async (scopedDb, authority) => {
+    const rows = await scopedDb.execute(sql5`
+      select event_id
+      from knowledge_memory_apply_operation(
+        ${JSON.stringify(plan)}::jsonb,
+        ${planHash},
+        ${authority.actorKind},
+        ${authority.actorSubjectId},
+        ${authority.sessionId}::uuid,
+        ${authority.turnId}::uuid,
+        ${authority.attemptId}::uuid,
+        ${authority.executionGeneration}::integer
+      )
+    `);
+    const eventId = rows[0]?.event_id;
+    if (!eventId) throw new Error("Memory governance apply operation returned no event");
+    return { eventId, planHash };
+  });
+}
+async function revertKnowledgeMemoryOperation(db, input) {
+  const plan = normalizeMemoryRevertPlan(input.plan);
+  const planHash = hashMemoryRevertPlan(plan);
+  return await withMemoryGovernanceAuthority(db, input.authority, async (scopedDb, authority) => {
+    const rows = await scopedDb.execute(sql5`
+      select event_id
+      from knowledge_memory_revert_operation(
+        ${plan.operationId}::uuid,
+        ${plan.appliedOperationId}::uuid,
+        ${planHash},
+        ${authority.actorKind},
+        ${authority.actorSubjectId},
+        ${authority.sessionId}::uuid,
+        ${authority.turnId}::uuid,
+        ${authority.attemptId}::uuid,
+        ${authority.executionGeneration}::integer
+      )
+    `);
+    const eventId = rows[0]?.event_id;
+    if (!eventId) throw new Error("Memory governance revert operation returned no event");
+    return { eventId, planHash };
+  });
+}
+
 // src/insights.ts
-import { and as and8, desc as desc3, eq as eq8, gte, inArray as inArray4, lt as lt2, sql as sql5 } from "drizzle-orm";
+import { and as and8, desc as desc3, eq as eq8, gte, inArray as inArray4, lt as lt2, sql as sql6 } from "drizzle-orm";
 import { alias } from "drizzle-orm/pg-core";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function dayKeyUtc(value) {
@@ -5648,7 +6087,7 @@ async function sumUsageQuantityInRange(db, input) {
   const context = await rlsContextForWorkspace(db, input.workspaceId);
   return await withRlsContext(db, context, async (scopedDb) => {
     const [{ total } = { total: 0 }] = await scopedDb.select({
-      total: sql5`coalesce(sum(${usageEvents.quantity}), 0)`
+      total: sql6`coalesce(sum(${usageEvents.quantity}), 0)`
     }).from(usageEvents).where(
       and8(
         eq8(usageEvents.workspaceId, input.workspaceId),
@@ -5664,8 +6103,8 @@ async function sumUsageQuantityByDay(db, input) {
   const context = await rlsContextForWorkspace(db, input.workspaceId);
   return await withRlsContext(db, context, async (scopedDb) => {
     const rows = await scopedDb.select({
-      day: sql5`to_char(date_trunc('day', ${usageEvents.occurredAt} at time zone 'UTC'), 'YYYY-MM-DD')`,
-      total: sql5`coalesce(sum(${usageEvents.quantity}), 0)`
+      day: sql6`to_char(date_trunc('day', ${usageEvents.occurredAt} at time zone 'UTC'), 'YYYY-MM-DD')`,
+      total: sql6`coalesce(sum(${usageEvents.quantity}), 0)`
     }).from(usageEvents).where(
       and8(
         eq8(usageEvents.workspaceId, input.workspaceId),
@@ -5673,7 +6112,7 @@ async function sumUsageQuantityByDay(db, input) {
         gte(usageEvents.occurredAt, input.since),
         lt2(usageEvents.occurredAt, input.until)
       )
-    ).groupBy(sql5`date_trunc('day', ${usageEvents.occurredAt} at time zone 'UTC')`);
+    ).groupBy(sql6`date_trunc('day', ${usageEvents.occurredAt} at time zone 'UTC')`);
     return new Map(rows.map((row) => [row.day, Number(row.total)]));
   });
 }
@@ -5691,14 +6130,14 @@ async function aggregateModelCallFacts(db, input) {
       provider: modelCallFacts.provider,
       model: modelCallFacts.model,
       billingPath: modelCallFacts.billingPath,
-      calls: sql5`count(*)::int`,
-      inputTokens: sql5`coalesce(sum(${modelCallFacts.inputTokens}), 0)`,
-      outputTokens: sql5`coalesce(sum(${modelCallFacts.outputTokens}), 0)`,
-      cachedTokens: sql5`coalesce(sum(${modelCallFacts.cachedTokens}), 0)`,
-      cacheWriteTokens: sql5`coalesce(sum(${modelCallFacts.cacheWriteTokens}), 0)`,
-      reasoningTokens: sql5`coalesce(sum(${modelCallFacts.reasoningTokens}), 0)`,
-      totalTokens: sql5`coalesce(sum(${modelCallFacts.totalTokens}), 0)`,
-      pricedCostMicros: sql5`coalesce(sum(${modelCallFacts.pricedCostMicros}), 0)`
+      calls: sql6`count(*)::int`,
+      inputTokens: sql6`coalesce(sum(${modelCallFacts.inputTokens}), 0)`,
+      outputTokens: sql6`coalesce(sum(${modelCallFacts.outputTokens}), 0)`,
+      cachedTokens: sql6`coalesce(sum(${modelCallFacts.cachedTokens}), 0)`,
+      cacheWriteTokens: sql6`coalesce(sum(${modelCallFacts.cacheWriteTokens}), 0)`,
+      reasoningTokens: sql6`coalesce(sum(${modelCallFacts.reasoningTokens}), 0)`,
+      totalTokens: sql6`coalesce(sum(${modelCallFacts.totalTokens}), 0)`,
+      pricedCostMicros: sql6`coalesce(sum(${modelCallFacts.pricedCostMicros}), 0)`
     }).from(modelCallFacts).where(and8(...clauses)).groupBy(
       modelCallFacts.provider,
       modelCallFacts.model,
@@ -5730,12 +6169,12 @@ async function aggregateModelCallFactsByDay(db, input) {
       ...input.model ? [eq8(modelCallFacts.model, input.model)] : []
     ];
     const rows = await scopedDb.select({
-      day: sql5`to_char(date_trunc('day', ${modelCallFacts.occurredAt} at time zone 'UTC'), 'YYYY-MM-DD')`,
-      costMicros: sql5`coalesce(sum(${modelCallFacts.pricedCostMicros}), 0)`,
-      inputTokens: sql5`coalesce(sum(${modelCallFacts.inputTokens}), 0)`,
-      cachedTokens: sql5`coalesce(sum(${modelCallFacts.cachedTokens}), 0)`,
-      calls: sql5`count(*)::int`
-    }).from(modelCallFacts).where(and8(...clauses)).groupBy(sql5`date_trunc('day', ${modelCallFacts.occurredAt} at time zone 'UTC')`);
+      day: sql6`to_char(date_trunc('day', ${modelCallFacts.occurredAt} at time zone 'UTC'), 'YYYY-MM-DD')`,
+      costMicros: sql6`coalesce(sum(${modelCallFacts.pricedCostMicros}), 0)`,
+      inputTokens: sql6`coalesce(sum(${modelCallFacts.inputTokens}), 0)`,
+      cachedTokens: sql6`coalesce(sum(${modelCallFacts.cachedTokens}), 0)`,
+      calls: sql6`count(*)::int`
+    }).from(modelCallFacts).where(and8(...clauses)).groupBy(sql6`date_trunc('day', ${modelCallFacts.occurredAt} at time zone 'UTC')`);
     return new Map(
       rows.map((row) => [
         row.day,
@@ -5754,17 +6193,17 @@ async function aggregateWarmSecondsByGroup(db, input) {
   const limit = input.limit ?? 24;
   return await withRlsContext(db, context, async (scopedDb) => {
     const rows = await scopedDb.select({
-      groupId: sql5`split_part(${usageEvents.sourceResourceId}, ':', 1)`,
-      warmSeconds: sql5`coalesce(sum(${usageEvents.quantity}), 0)`
+      groupId: sql6`split_part(${usageEvents.sourceResourceId}, ':', 1)`,
+      warmSeconds: sql6`coalesce(sum(${usageEvents.quantity}), 0)`
     }).from(usageEvents).where(
       and8(
         eq8(usageEvents.workspaceId, input.workspaceId),
         eq8(usageEvents.eventType, "sandbox.warm_seconds"),
         gte(usageEvents.occurredAt, input.since),
         lt2(usageEvents.occurredAt, input.until),
-        sql5`${usageEvents.sourceResourceId} is not null`
+        sql6`${usageEvents.sourceResourceId} is not null`
       )
-    ).groupBy(sql5`split_part(${usageEvents.sourceResourceId}, ':', 1)`).orderBy(sql5`coalesce(sum(${usageEvents.quantity}), 0) desc`).limit(Math.max(limit * 4, limit));
+    ).groupBy(sql6`split_part(${usageEvents.sourceResourceId}, ':', 1)`).orderBy(sql6`coalesce(sum(${usageEvents.quantity}), 0) desc`).limit(Math.max(limit * 4, limit));
     return rows.filter((row) => UUID_RE.test(row.groupId)).slice(0, limit).map((row) => ({
       groupId: row.groupId,
       warmSeconds: Number(row.warmSeconds)
@@ -5804,7 +6243,7 @@ async function countSessionsAttachedToGroups(db, workspaceId, groupIds) {
   return await withRlsContext(db, context, async (scopedDb) => {
     const rows = await scopedDb.select({
       groupId: sessions.sandboxGroupId,
-      n: sql5`count(*)::int`
+      n: sql6`count(*)::int`
     }).from(sessions).where(
       and8(
         eq8(sessions.workspaceId, workspaceId),
@@ -5833,9 +6272,9 @@ async function aggregateRootSessionDrivers(db, input) {
     const query = scopedDb.select({
       rootSessionId: childSessions.rootSessionId,
       title: rootSessions.title,
-      pricedCostMicros: sql5`coalesce(sum(${modelCallFacts.pricedCostMicros}), 0)`,
-      inputTokens: sql5`coalesce(sum(${modelCallFacts.inputTokens}), 0)`,
-      cachedTokens: sql5`coalesce(sum(${modelCallFacts.cachedTokens}), 0)`
+      pricedCostMicros: sql6`coalesce(sum(${modelCallFacts.pricedCostMicros}), 0)`,
+      inputTokens: sql6`coalesce(sum(${modelCallFacts.inputTokens}), 0)`,
+      cachedTokens: sql6`coalesce(sum(${modelCallFacts.cachedTokens}), 0)`
     }).from(modelCallFacts).innerJoin(
       childSessions,
       and8(
@@ -5848,7 +6287,7 @@ async function aggregateRootSessionDrivers(db, input) {
         eq8(rootSessions.workspaceId, childSessions.workspaceId),
         eq8(rootSessions.id, childSessions.rootSessionId)
       )
-    ).where(and8(...clauses)).groupBy(childSessions.rootSessionId, rootSessions.title).orderBy(sql5`coalesce(sum(${modelCallFacts.pricedCostMicros}), 0) desc`);
+    ).where(and8(...clauses)).groupBy(childSessions.rootSessionId, rootSessions.title).orderBy(sql6`coalesce(sum(${modelCallFacts.pricedCostMicros}), 0) desc`);
     const rows = input.rootSessionIds ? await query : await query.limit(input.limit ?? 8);
     return rows.map((row) => ({
       rootSessionId: row.rootSessionId,
@@ -5882,17 +6321,17 @@ async function aggregateScheduleFacts(db, input) {
       eq8(modelCallFacts.workspaceId, input.workspaceId),
       gte(modelCallFacts.occurredAt, input.since),
       lt2(modelCallFacts.occurredAt, input.until),
-      sql5`${modelCallFacts.scheduledTaskId} is not null`,
+      sql6`${modelCallFacts.scheduledTaskId} is not null`,
       ...input.provider ? [eq8(modelCallFacts.provider, input.provider)] : [],
       ...input.model ? [eq8(modelCallFacts.model, input.model)] : []
     ];
     const rows = await scopedDb.select({
       scheduledTaskId: modelCallFacts.scheduledTaskId,
-      pricedCostMicros: sql5`coalesce(sum(${modelCallFacts.pricedCostMicros}), 0)`,
-      inputTokens: sql5`coalesce(sum(${modelCallFacts.inputTokens}), 0)`,
-      cachedTokens: sql5`coalesce(sum(${modelCallFacts.cachedTokens}), 0)`,
-      calls: sql5`count(*)::int`,
-      billingPath: sql5`case
+      pricedCostMicros: sql6`coalesce(sum(${modelCallFacts.pricedCostMicros}), 0)`,
+      inputTokens: sql6`coalesce(sum(${modelCallFacts.inputTokens}), 0)`,
+      cachedTokens: sql6`coalesce(sum(${modelCallFacts.cachedTokens}), 0)`,
+      calls: sql6`count(*)::int`,
+      billingPath: sql6`case
           when bool_or(${modelCallFacts.billingPath} = 'opengeni_credits')
           then 'opengeni_credits'
           else 'external'
@@ -5914,7 +6353,7 @@ async function countScheduledTaskFires(db, input) {
   return await withRlsContext(db, context, async (scopedDb) => {
     const rows = await scopedDb.select({
       taskId: scheduledTaskRuns.taskId,
-      n: sql5`count(*)::int`
+      n: sql6`count(*)::int`
     }).from(scheduledTaskRuns).where(
       and8(
         eq8(scheduledTaskRuns.workspaceId, input.workspaceId),
@@ -5931,21 +6370,21 @@ async function aggregateSessionDepth(db, workspaceId) {
   return await withRlsContext(db, context, async (scopedDb) => {
     const buckets = await scopedDb.select({
       depth: sessions.nestedAgentDepth,
-      sessions: sql5`count(*)::int`
+      sessions: sql6`count(*)::int`
     }).from(sessions).where(eq8(sessions.workspaceId, workspaceId)).groupBy(sessions.nestedAgentDepth).orderBy(sessions.nestedAgentDepth);
     const [stats] = await scopedDb.select({
-      sessionsTouched: sql5`count(*)::int`,
-      rootSessions: sql5`count(*) filter (where ${sessions.nestedAgentDepth} = 0)::int`,
-      deepestDepth: sql5`coalesce(max(${sessions.nestedAgentDepth}), 0)`,
-      avgDepth: sql5`coalesce(avg(${sessions.nestedAgentDepth}), 0)`
+      sessionsTouched: sql6`count(*)::int`,
+      rootSessions: sql6`count(*) filter (where ${sessions.nestedAgentDepth} = 0)::int`,
+      deepestDepth: sql6`coalesce(max(${sessions.nestedAgentDepth}), 0)`,
+      avgDepth: sql6`coalesce(avg(${sessions.nestedAgentDepth}), 0)`
     }).from(sessions).where(eq8(sessions.workspaceId, workspaceId));
     const [deepest] = await scopedDb.select({
       title: sessions.title,
       depth: sessions.nestedAgentDepth
     }).from(sessions).where(eq8(sessions.workspaceId, workspaceId)).orderBy(desc3(sessions.nestedAgentDepth), desc3(sessions.updatedAt)).limit(1);
     const [goals] = await scopedDb.select({
-      active: sql5`count(*) filter (where ${sessionGoals.status} = 'active')::int`,
-      completed: sql5`count(*) filter (where ${sessionGoals.status} = 'completed')::int`
+      active: sql6`count(*) filter (where ${sessionGoals.status} = 'active')::int`,
+      completed: sql6`count(*) filter (where ${sessionGoals.status} = 'completed')::int`
     }).from(sessionGoals).where(eq8(sessionGoals.workspaceId, workspaceId));
     return {
       buckets: buckets.map((row) => ({
@@ -5983,7 +6422,7 @@ async function countOnlineMachines(db, workspaceId, heartbeatFreshMs) {
   const context = await rlsContextForWorkspace(db, workspaceId);
   return await withRlsContext(db, context, async (scopedDb) => {
     const cutoff = new Date(Date.now() - heartbeatFreshMs);
-    const [{ n } = { n: 0 }] = await scopedDb.select({ n: sql5`count(*)::int` }).from(enrollments).where(
+    const [{ n } = { n: 0 }] = await scopedDb.select({ n: sql6`count(*)::int` }).from(enrollments).where(
       and8(
         eq8(enrollments.workspaceId, workspaceId),
         eq8(enrollments.status, "active"),
@@ -6032,9 +6471,9 @@ async function backfillModelCallFactsFromSessionEvents(db, input) {
           eq8(sessionEvents.type, "agent.model.usage"),
           eq8(sessionEvents.turnAssociation, "current"),
           lt2(sessionEvents.occurredAt, until),
-          sql5`${sessionEvents.turnId} is not null`,
+          sql6`${sessionEvents.turnId} is not null`,
           // Keyset on (occurred_at, id) so same-millisecond bursts cannot be skipped.
-          sql5`(${sessionEvents.occurredAt}, ${sessionEvents.id}) > (${cursorOccurredAt}, ${cursorId}::uuid)`
+          sql6`(${sessionEvents.occurredAt}, ${sessionEvents.id}) > (${cursorOccurredAt}, ${cursorId}::uuid)`
         )
       ).orderBy(sessionEvents.occurredAt, sessionEvents.id).limit(Math.min(batchSize, remaining));
     });
@@ -6995,7 +7434,7 @@ async function cancelResponseBody(response) {
 }
 
 // src/workspace-artifacts.ts
-import { and as and9, desc as desc4, eq as eq9, lt as lt3, or as or2, sql as sql6 } from "drizzle-orm";
+import { and as and9, desc as desc4, eq as eq9, lt as lt3, or as or2, sql as sql7 } from "drizzle-orm";
 var WorkspaceArtifactNotFoundError = class extends Error {
   name = "WorkspaceArtifactNotFoundError";
 };
@@ -7185,7 +7624,7 @@ async function assertAttemptAuthority(scopedDb, input) {
   if (provenance.some((value) => value === null) || input.sourceToolName === null) {
     throw new WorkspaceArtifactOperationError("Artifact attempt provenance is incomplete");
   }
-  const rows = await scopedDb.execute(sql6`
+  const rows = await scopedDb.execute(sql7`
     WITH locked_workspace AS MATERIALIZED (
       SELECT workspace.id, workspace.account_id
       FROM workspaces workspace
@@ -7269,7 +7708,7 @@ async function replayForOperation(scopedDb, workspaceId, operationKey) {
 }
 async function lockOperation(scopedDb, workspaceId, operationKey) {
   await scopedDb.execute(
-    sql6`SELECT pg_advisory_xact_lock(hashtextextended(${`${workspaceId}:${operationKey}`}, 0))`
+    sql7`SELECT pg_advisory_xact_lock(hashtextextended(${`${workspaceId}:${operationKey}`}, 0))`
   );
 }
 function assertCreateReplay(replay) {
@@ -7619,7 +8058,7 @@ function validateHostExportIdentity(kind, consumerId) {
 }
 async function registerHostExportConsumer(db, input) {
   validateHostExportIdentity(input.kind, input.consumerId);
-  await db.execute(sql7`
+  await db.execute(sql8`
     select opengeni_host_export.register_host_export_consumer(
       ${input.kind}, ${input.consumerId}
     )
@@ -7627,7 +8066,7 @@ async function registerHostExportConsumer(db, input) {
 }
 async function disableHostExportConsumer(db, input) {
   validateHostExportIdentity(input.kind, input.consumerId);
-  await db.execute(sql7`
+  await db.execute(sql8`
     select opengeni_host_export.disable_host_export_consumer(
       ${input.kind}, ${input.consumerId}
     )
@@ -7635,7 +8074,7 @@ async function disableHostExportConsumer(db, input) {
 }
 async function retireHostExportConsumer(db, input) {
   validateHostExportIdentity(input.kind, input.consumerId);
-  await db.execute(sql7`
+  await db.execute(sql8`
     select opengeni_host_export.retire_host_export_consumer(
       ${input.kind}, ${input.consumerId}
     )
@@ -7645,7 +8084,7 @@ async function claimHostExportBatch(db, input) {
   validateHostExportIdentity(input.kind, input.consumerId);
   const claimedRows = await rawRows(
     db,
-    sql7`
+    sql8`
       select * from opengeni_host_export.claim_host_export_batch(
         ${input.kind}, ${input.consumerId}, ${input.leaseToken}::uuid,
         ${input.leaseHolderId}, ${input.leaseSeconds ?? 60},
@@ -7662,7 +8101,7 @@ async function claimHostExportBatch(db, input) {
   }
   const roots = await rawRows(
     db,
-    sql7`
+    sql8`
       select * from opengeni_host_export.host_export_cursor_roots(
         ${input.kind}, ${input.consumerId}, ${input.leaseToken}::uuid
       )
@@ -7768,7 +8207,7 @@ async function acknowledgeHostExportBatch(db, input) {
   validateHostExportIdentity(input.kind, input.consumerId);
   const [row] = await rawRows(
     db,
-    sql7`
+    sql8`
       select opengeni_host_export.ack_host_export_batch(
         ${input.kind}, ${input.consumerId}, ${input.leaseToken}::uuid
       ) as checkpoint
@@ -7781,7 +8220,7 @@ async function failHostExportBatch(db, input) {
   validateHostExportIdentity(input.kind, input.consumerId);
   const [row] = await rawRows(
     db,
-    sql7`
+    sql8`
       select opengeni_host_export.fail_host_export_batch(
         ${input.kind}, ${input.consumerId}, ${input.leaseToken}::uuid,
         ${input.error}, ${input.maxFailures ?? 20}
@@ -7796,7 +8235,7 @@ async function deadLetterHostExportHead(db, input) {
   const cursor = hostExportCursor(input.cursor);
   const [row] = await rawRows(
     db,
-    sql7`
+    sql8`
       select opengeni_host_export.dead_letter_host_export_head(
         ${input.kind}, ${input.consumerId}, ${input.leaseToken}::uuid,
         ${cursor}::bigint, ${input.reason}
@@ -7808,7 +8247,7 @@ async function deadLetterHostExportHead(db, input) {
 }
 async function resumeHostExportConsumer(db, input) {
   validateHostExportIdentity(input.kind, input.consumerId);
-  await db.execute(sql7`
+  await db.execute(sql8`
     select opengeni_host_export.resume_host_export_consumer(
       ${input.kind}, ${input.consumerId}
     )
@@ -7817,7 +8256,7 @@ async function resumeHostExportConsumer(db, input) {
 async function rewindHostExportConsumer(db, input) {
   validateHostExportIdentity(input.kind, input.consumerId);
   const checkpoint = hostExportCursor(input.checkpoint);
-  await db.execute(sql7`
+  await db.execute(sql8`
     select opengeni_host_export.rewind_host_export_consumer(
       ${input.kind}, ${input.consumerId}, ${checkpoint}::bigint
     )
@@ -7827,7 +8266,7 @@ async function pruneHostExportOutbox(db, input) {
   validateHostExportKind(input.kind);
   const [row] = await rawRows(
     db,
-    sql7`
+    sql8`
       select opengeni_host_export.prune_host_export_outbox(
         ${input.kind}, ${input.graceSeconds ?? 3600}, ${input.limit ?? 1e3}
       ) as deleted
@@ -7839,7 +8278,7 @@ async function getHostExportConsumerStatus(db, input) {
   validateHostExportIdentity(input.kind, input.consumerId);
   const [row] = await rawRows(
     db,
-    sql7`
+    sql8`
       select * from opengeni_host_export.host_export_consumer_status(
         ${input.kind}, ${input.consumerId}
       )
@@ -7868,18 +8307,18 @@ async function setRlsContext(db, context) {
   if (typeof context.accountId !== "string" || context.accountId.trim() === "") {
     throw new Error("setRlsContext: a non-empty accountId is required to establish an RLS context");
   }
-  await db.execute(sql7`select set_config('opengeni.account_id', ${context.accountId}, true)`);
+  await db.execute(sql8`select set_config('opengeni.account_id', ${context.accountId}, true)`);
   await db.execute(
-    sql7`select set_config('opengeni.workspace_id', ${context.workspaceId ?? ""}, true)`
+    sql8`select set_config('opengeni.workspace_id', ${context.workspaceId ?? ""}, true)`
   );
-  await db.execute(sql7`select set_config('opengeni.sandbox_recovery_protocol_v2', '1', true)`);
+  await db.execute(sql8`select set_config('opengeni.sandbox_recovery_protocol_v2', '1', true)`);
 }
 async function withRlsContext(db, context, fn, transactionConfig) {
   return await db.transaction(async (tx) => {
     const scoped = tx;
     await setRlsContext(scoped, context);
     const applied = await tx.execute(
-      sql7`select
+      sql8`select
         current_setting('opengeni.account_id', true) as account_id,
         current_setting('opengeni.workspace_id', true) as workspace_id`
     );
@@ -7938,9 +8377,9 @@ async function setSubjectRlsContext(db, subjectId) {
   if (!subjectId.trim()) {
     throw new Error("setSubjectRlsContext: a non-empty subjectId is required");
   }
-  await db.execute(sql7`select set_config('opengeni.subject_id', ${subjectId}, true)`);
+  await db.execute(sql8`select set_config('opengeni.subject_id', ${subjectId}, true)`);
   const applied = await db.execute(
-    sql7`select current_setting('opengeni.subject_id', true) as subject_id`
+    sql8`select current_setting('opengeni.subject_id', true) as subject_id`
   );
   if ((applied[0]?.subject_id ?? "") !== subjectId) {
     throw new Error("Authenticated subject RLS context was not applied on the active backend");
@@ -7949,7 +8388,7 @@ async function setSubjectRlsContext(db, subjectId) {
 async function withWorkspaceUsageLock(db, workspaceId, fn) {
   const context = await rlsContextForWorkspace(db, workspaceId);
   return await withRlsContext(db, context, async (scopedDb) => {
-    await scopedDb.execute(sql7`select pg_advisory_xact_lock(hashtext(${`usage:${workspaceId}`}))`);
+    await scopedDb.execute(sql8`select pg_advisory_xact_lock(hashtext(${`usage:${workspaceId}`}))`);
     return await fn(scopedDb);
   });
 }
@@ -8278,7 +8717,7 @@ async function listWorkspacesForSubject(db, subjectId, limit = 100) {
 }
 async function countWorkspacesForAccount(db, accountId) {
   const [{ count } = { count: 0 }] = await db.select({
-    count: sql7`count(*)::int`
+    count: sql8`count(*)::int`
   }).from(workspaces).where(eq10(workspaces.accountId, accountId));
   return Number(count);
 }
@@ -8356,7 +8795,7 @@ async function updateWorkspaceSettings(db, workspaceId, patch) {
       async (scopedDb) => await scopedDb.transaction(async (tx) => {
         await lockWorkspaceInferenceControl(tx, workspaceId, "update");
         const [row2] = await tx.update(workspaces).set({
-          settings: requested === null ? sql7`(${workspaces.settings} - 'maxNestedAgentDepth') || ${JSON.stringify(nextPatch)}::jsonb` : sql7`${workspaces.settings} || ${JSON.stringify(nextPatch)}::jsonb`,
+          settings: requested === null ? sql8`(${workspaces.settings} - 'maxNestedAgentDepth') || ${JSON.stringify(nextPatch)}::jsonb` : sql8`${workspaces.settings} || ${JSON.stringify(nextPatch)}::jsonb`,
           updatedAt: /* @__PURE__ */ new Date()
         }).where(eq10(workspaces.id, workspaceId)).returning();
         if (!row2) throw new Error(`Workspace not found: ${workspaceId}`);
@@ -8368,7 +8807,7 @@ async function updateWorkspaceSettings(db, workspaceId, patch) {
     );
   }
   const [row] = await db.update(workspaces).set({
-    settings: sql7`${workspaces.settings} || ${JSON.stringify(patch)}::jsonb`,
+    settings: sql8`${workspaces.settings} || ${JSON.stringify(patch)}::jsonb`,
     updatedAt: /* @__PURE__ */ new Date()
   }).where(eq10(workspaces.id, workspaceId)).returning();
   if (!row) {
@@ -8455,7 +8894,7 @@ async function getManagedUserByEmail(db, email) {
   if (binding?.userLookup) {
     return await binding.userLookup(db, email);
   }
-  const rows = await db.execute(sql7`
+  const rows = await db.execute(sql8`
     select id from auth_users where lower(email) = lower(${email}) limit 1
   `);
   return rows[0]?.id ?? null;
@@ -8493,12 +8932,12 @@ async function listApiKeys(db, workspaceId) {
 async function countActiveApiKeysForWorkspace(db, workspaceId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [{ count } = { count: 0 }] = await scopedDb.select({
-      count: sql7`count(*)::int`
+      count: sql8`count(*)::int`
     }).from(apiKeys).where(
       and10(
         eq10(apiKeys.workspaceId, workspaceId),
-        sql7`${apiKeys.revokedAt} is null`,
-        sql7`(${apiKeys.expiresAt} is null or ${apiKeys.expiresAt} > now())`
+        sql8`${apiKeys.revokedAt} is null`,
+        sql8`(${apiKeys.expiresAt} is null or ${apiKeys.expiresAt} > now())`
       )
     );
     return Number(count);
@@ -8518,12 +8957,12 @@ async function revokeApiKey(db, workspaceId, apiKeyId) {
 }
 async function findActiveApiKeyByHash(db, keyHash) {
   return await db.transaction(async (tx) => {
-    await tx.execute(sql7`select set_config('opengeni.api_key_hash', ${keyHash}, true)`);
+    await tx.execute(sql8`select set_config('opengeni.api_key_hash', ${keyHash}, true)`);
     const [row] = await tx.select().from(apiKeys).where(
       and10(
         eq10(apiKeys.keyHash, keyHash),
-        sql7`${apiKeys.revokedAt} is null`,
-        sql7`(${apiKeys.expiresAt} is null or ${apiKeys.expiresAt} > now())`
+        sql8`${apiKeys.revokedAt} is null`,
+        sql8`(${apiKeys.expiresAt} is null or ${apiKeys.expiresAt} > now())`
       )
     ).limit(1);
     if (!row) {
@@ -8759,7 +9198,7 @@ async function bindAuthorizedGitHubInstallationRepositories(db, input) {
 async function assertGitHubAuthorityWindowOpen(tx, checkedAt, expiresAt) {
   const checkedAtIso = checkedAt.toISOString();
   const expiresAtIso = expiresAt.toISOString();
-  const result = await tx.execute(sql7`
+  const result = await tx.execute(sql8`
     select (
       ${checkedAtIso}::timestamptz <= clock_timestamp()
       and clock_timestamp() < ${expiresAtIso}::timestamptz
@@ -8892,16 +9331,16 @@ async function recordUsageEvent(db, input) {
       }).onConflictDoUpdate({
         target: usageEvents.idempotencyKey,
         set: {
-          sessionId: sql7`coalesce(${usageEvents.sessionId}, excluded.session_id)`,
-          turnId: sql7`coalesce(${usageEvents.turnId}, excluded.turn_id)`,
-          turnAttemptId: sql7`coalesce(${usageEvents.turnAttemptId}, excluded.turn_attempt_id)`,
-          initiatorKind: sql7`coalesce(${usageEvents.initiatorKind}, excluded.initiator_kind)`,
-          initiatorSubjectId: sql7`coalesce(${usageEvents.initiatorSubjectId}, excluded.initiator_subject_id)`,
-          initiatorContext: sql7`case
+          sessionId: sql8`coalesce(${usageEvents.sessionId}, excluded.session_id)`,
+          turnId: sql8`coalesce(${usageEvents.turnId}, excluded.turn_id)`,
+          turnAttemptId: sql8`coalesce(${usageEvents.turnAttemptId}, excluded.turn_attempt_id)`,
+          initiatorKind: sql8`coalesce(${usageEvents.initiatorKind}, excluded.initiator_kind)`,
+          initiatorSubjectId: sql8`coalesce(${usageEvents.initiatorSubjectId}, excluded.initiator_subject_id)`,
+          initiatorContext: sql8`case
               when ${usageEvents.initiatorKind} is null then excluded.initiator_context
               else ${usageEvents.initiatorContext}
             end`,
-          origin: sql7`coalesce(${usageEvents.origin}, excluded.origin)`
+          origin: sql8`coalesce(${usageEvents.origin}, excluded.origin)`
         }
       }).returning();
       if (row) {
@@ -9032,11 +9471,11 @@ async function recordModelCallFact(db, input) {
           modelCallFacts.sourceKey
         ],
         set: {
-          turnAttemptId: sql7`coalesce(${modelCallFacts.turnAttemptId}, excluded.turn_attempt_id)`,
-          scheduledTaskId: sql7`coalesce(${modelCallFacts.scheduledTaskId}, excluded.scheduled_task_id)`,
-          initiatorKind: sql7`coalesce(${modelCallFacts.initiatorKind}, excluded.initiator_kind)`,
-          initiatorSubjectId: sql7`coalesce(${modelCallFacts.initiatorSubjectId}, excluded.initiator_subject_id)`,
-          turnSource: sql7`coalesce(${modelCallFacts.turnSource}, excluded.turn_source)`
+          turnAttemptId: sql8`coalesce(${modelCallFacts.turnAttemptId}, excluded.turn_attempt_id)`,
+          scheduledTaskId: sql8`coalesce(${modelCallFacts.scheduledTaskId}, excluded.scheduled_task_id)`,
+          initiatorKind: sql8`coalesce(${modelCallFacts.initiatorKind}, excluded.initiator_kind)`,
+          initiatorSubjectId: sql8`coalesce(${modelCallFacts.initiatorSubjectId}, excluded.initiator_subject_id)`,
+          turnSource: sql8`coalesce(${modelCallFacts.turnSource}, excluded.turn_source)`
         }
       }).returning();
       if (!row) {
@@ -9074,7 +9513,7 @@ async function sumUsageQuantity(db, input) {
       ...input.since ? [gt2(usageEvents.occurredAt, input.since)] : []
     ];
     const [{ total } = { total: 0 }] = await scopedDb.select({
-      total: sql7`coalesce(sum(${usageEvents.quantity}), 0)`
+      total: sql8`coalesce(sum(${usageEvents.quantity}), 0)`
     }).from(usageEvents).where(and10(...clauses));
     return Number(total);
   });
@@ -9112,7 +9551,7 @@ async function applyCreditDebitUpToBalance(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId ?? null },
     async (scopedDb) => {
-      await scopedDb.execute(sql7`select pg_advisory_xact_lock(hashtext(${input.accountId}))`);
+      await scopedDb.execute(sql8`select pg_advisory_xact_lock(hashtext(${input.accountId}))`);
       const before = await getBillingBalance(scopedDb, input.accountId);
       const candidateDebitMicros = Math.min(
         input.requestedAmountMicros,
@@ -9209,7 +9648,7 @@ async function markStripeWebhookProcessed(db, id) {
 async function getBillingBalance(db, accountId) {
   return await withAccountRls(db, accountId, async (scopedDb) => {
     const [{ balance } = { balance: 0 }] = await scopedDb.select({
-      balance: sql7`coalesce(sum(${creditLedgerEntries.amountMicros}), 0)`
+      balance: sql8`coalesce(sum(${creditLedgerEntries.amountMicros}), 0)`
     }).from(creditLedgerEntries).where(eq10(creditLedgerEntries.accountId, accountId));
     return {
       accountId,
@@ -9222,7 +9661,7 @@ async function getBillingBalance(db, accountId) {
 async function countScheduledTasksForWorkspace(db, workspaceId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [{ count } = { count: 0 }] = await scopedDb.select({
-      count: sql7`count(*)::int`
+      count: sql8`count(*)::int`
     }).from(scheduledTasks).where(eq10(scheduledTasks.workspaceId, workspaceId));
     return Number(count);
   });
@@ -9438,7 +9877,7 @@ async function claimFileUploadCleanup(db, input) {
 async function claimExpiredFileUploadCleanup(db, input) {
   const rows = await rawRows(
     db,
-    sql7`
+    sql8`
       select upload_id, account_id, workspace_id, file_id, object_key
       from opengeni_private.claim_expired_file_upload_cleanup(
         ${input.graceMs},
@@ -9728,7 +10167,7 @@ async function upsertRegistryCapabilityCatalogItem(db, input) {
     credentialFacts: values.credentialFacts,
     tier: values.tier,
     provenance: values.provenance,
-    logoAssetPath: sql7`coalesce(excluded.logo_asset_path, ${capabilityCatalogItems.logoAssetPath})`,
+    logoAssetPath: sql8`coalesce(excluded.logo_asset_path, ${capabilityCatalogItems.logoAssetPath})`,
     importBatchId: values.importBatchId,
     stale: false,
     staleAt: null,
@@ -9890,7 +10329,7 @@ async function getCapabilityCatalogItem(db, workspaceId, capabilityId) {
           isNull3(capabilityCatalogItems.workspaceId)
         )
       )
-    ).orderBy(asc5(sql7`(${capabilityCatalogItems.workspaceId} is null)`)).limit(1);
+    ).orderBy(asc5(sql8`(${capabilityCatalogItems.workspaceId} is null)`)).limit(1);
     if (!row) {
       return null;
     }
@@ -10114,6 +10553,20 @@ function connectionSubjectVisibility(subjectId) {
 function connectionExactSubject(subjectId) {
   return subjectId ? eq10(connections.subjectId, subjectId) : isNull3(connections.subjectId);
 }
+function personalSlackCanonicalConnectionOrder() {
+  return [
+    sql8`case ${connections.status}
+      when 'active' then 0
+      when 'needs_reauth' then 1
+      when 'error' then 2
+      when 'revoked' then 3
+      else 4
+    end`,
+    desc5(connections.updatedAt),
+    desc5(connections.createdAt),
+    desc5(connections.id)
+  ];
+}
 async function withConnectionSubjectRls(db, workspaceId, subjectId, fn) {
   return subjectId ? await withWorkspaceSubjectRls(db, workspaceId, subjectId, fn) : await withWorkspaceRls(db, workspaceId, fn);
 }
@@ -10183,7 +10636,7 @@ async function updateConnectionInScope(db, input) {
     ...input.status !== void 0 ? { status: input.status } : {},
     ...input.credentialEncrypted !== void 0 ? {
       credentialEncrypted: input.credentialEncrypted,
-      version: sql7`${connections.version} + 1`,
+      version: sql8`${connections.version} + 1`,
       lastError: null
     } : {},
     ...input.grantedScopes !== void 0 ? { grantedScopes: input.grantedScopes } : {},
@@ -10216,11 +10669,11 @@ async function revokeConnectionInScope(db, workspaceId, connectionId, updatedByS
     status: "revoked",
     // The version bump invalidates any in-flight refresh's (id, version) CAS,
     // so a racing refresh cannot commit and flip the row back to active.
-    version: sql7`${connections.version} + 1`,
+    version: sql8`${connections.version} + 1`,
     // Status-only revocation does not replace the verified credential or bot
     // identity. Carry the marker to the same new CAS version so the dedicated
     // reinstall path can still recognize (but not use) the inactive row.
-    verifiedInstallVersion: sql7`case
+    verifiedInstallVersion: sql8`case
         when ${connections.verifiedInstallAt} is null then null
         else ${connections.version} + 1
       end`,
@@ -10248,7 +10701,7 @@ async function revokeConnection(db, workspaceId, connectionId, updatedBySubjectI
   );
 }
 async function resolveSlackInstallationRoute(db, slackTeamId) {
-  const rows = await db.execute(sql7`select * from opengeni_private.resolve_slack_installation(${slackTeamId})`);
+  const rows = await db.execute(sql8`select * from opengeni_private.resolve_slack_installation(${slackTeamId})`);
   const row = rows[0];
   return row ? {
     accountId: row.account_id,
@@ -10268,7 +10721,7 @@ async function saveSlackBotUserLink(db, input) {
         slackTeamId: input.slackTeamId,
         subjectId: input.subjectId,
         linkedBySubjectId: input.linkedBySubjectId,
-        updatedAt: sql7`now()`
+        updatedAt: sql8`now()`
       }
     }).returning();
     if (!row) throw new Error("Slack identity link write returned no row");
@@ -10322,7 +10775,7 @@ async function enqueueSlackInteractionInbox(db, input) {
 }
 async function claimSlackInteractionInbox(db, claimHolderId, claimLeaseMs) {
   const rows = await db.execute(
-    sql7`select * from opengeni_private.claim_slack_interaction_inbox(${claimHolderId}::uuid, ${claimLeaseMs})`
+    sql8`select * from opengeni_private.claim_slack_interaction_inbox(${claimHolderId}::uuid, ${claimLeaseMs})`
   );
   return rows[0] ? mapSlackInteractionInbox(rows[0]) : null;
 }
@@ -10332,9 +10785,10 @@ async function settleSlackInteractionInbox(db, input) {
       status: input.outcome,
       claimHolderId: null,
       claimExpiresAt: null,
-      processedAt: sql7`now()`,
+      retryAt: null,
+      processedAt: sql8`now()`,
       lastErrorCode: input.errorCode ?? null,
-      updatedAt: sql7`now()`
+      updatedAt: sql8`now()`
     }).where(
       and10(
         eq10(slackInteractionInbox.id, input.entry.id),
@@ -10351,8 +10805,9 @@ async function releaseSlackInteractionInbox(db, input) {
       status: "pending",
       claimHolderId: null,
       claimExpiresAt: null,
+      retryAt: input.retryAt,
       lastErrorCode: input.errorCode,
-      updatedAt: sql7`now()`
+      updatedAt: sql8`now()`
     }).where(
       and10(
         eq10(slackInteractionInbox.id, input.entry.id),
@@ -10405,7 +10860,7 @@ async function getSlackInteractionSessionAccess(db, workspaceId, rootSessionId)
 }
 async function getSlackInteractionSessionAccessForSession(db, input) {
   return await withRlsContext(db, input, async (scopedDb) => {
-    const rows = await scopedDb.execute(sql7`
+    const rows = await scopedDb.execute(sql8`
       with recursive lineage(id, parent_session_id, depth, path, cycle) as (
         select
           ${sessions.id},
@@ -10464,7 +10919,7 @@ async function getSlackInteractionSessionAccessForSession(db, input) {
 }
 async function bindSlackInteractionSession(db, input) {
   return await withRlsContext(db, input, async (scopedDb) => {
-    const [row] = await scopedDb.update(slackInteractions).set({ sessionId: input.sessionId, updatedAt: sql7`now()` }).where(
+    const [row] = await scopedDb.update(slackInteractions).set({ sessionId: input.sessionId, updatedAt: sql8`now()` }).where(
       and10(
         eq10(slackInteractions.id, input.id),
         eq10(slackInteractions.owningSubjectId, input.owningSubjectId),
@@ -10526,7 +10981,7 @@ async function claimSlackInteractionProgressDelivery(db, input) {
       operationId: crypto.randomUUID()
     }).returning();
     if (!delivery) throw new Error("Slack progress delivery claim returned no row");
-    const [updated] = await scopedDb.update(slackInteractions).set({ progressCount: slot, updatedAt: sql7`now()` }).where(
+    const [updated] = await scopedDb.update(slackInteractions).set({ progressCount: slot, updatedAt: sql8`now()` }).where(
       and10(
         eq10(slackInteractions.id, input.interactionId),
         eq10(slackInteractions.deliveryClaimHolderId, input.claimHolderId),
@@ -10548,20 +11003,26 @@ async function rekeySlackInteractionRoute(db, input) {
       routeKey: input.routeKey,
       slackThreadTs: input.slackThreadTs,
       ackSlackMessageTs: input.ackSlackMessageTs,
-      updatedAt: sql7`now()`
+      updatedAt: sql8`now()`
     }).where(eq10(slackInteractions.id, input.id)).returning();
     return row ? mapSlackInteraction(row) : null;
   });
 }
 async function claimSlackInteractionDelivery(db, claimHolderId, claimLeaseMs) {
   const rows = await db.execute(
-    sql7`select * from opengeni_private.claim_slack_interaction_delivery(${claimHolderId}::uuid, ${claimLeaseMs})`
+    sql8`select * from opengeni_private.claim_slack_interaction_delivery(${claimHolderId}::uuid, ${claimLeaseMs})`
   );
   return rows[0] ? mapSlackInteraction(rows[0]) : null;
 }
 async function reopenSlackInteractionDelivery(db, input) {
   return await withRlsContext(db, input, async (scopedDb) => {
-    const rows = await scopedDb.update(slackInteractions).set({ terminalDeliveryState: "open", updatedAt: sql7`now()` }).where(eq10(slackInteractions.id, input.id)).returning({ id: slackInteractions.id });
+    const rows = await scopedDb.update(slackInteractions).set({
+      terminalDeliveryState: "open",
+      deliveryAttemptCount: 0,
+      deliveryRetryAt: null,
+      deliveryLastErrorCode: null,
+      updatedAt: sql8`now()`
+    }).where(eq10(slackInteractions.id, input.id)).returning({ id: slackInteractions.id });
     return rows.length === 1;
   });
 }
@@ -10570,7 +11031,10 @@ async function advanceSlackInteractionDelivery(db, input) {
     const rows = await scopedDb.update(slackInteractions).set({
       lastDeliveredSessionEventSequence: input.sequence,
       ...input.ackSlackMessageTs !== void 0 ? { ackSlackMessageTs: input.ackSlackMessageTs } : {},
-      updatedAt: sql7`now()`
+      deliveryAttemptCount: 0,
+      deliveryRetryAt: null,
+      deliveryLastErrorCode: null,
+      updatedAt: sql8`now()`
     }).where(
       and10(
         eq10(slackInteractions.id, input.id),
@@ -10586,7 +11050,24 @@ async function releaseSlackInteractionDelivery(db, input) {
     const rows = await scopedDb.update(slackInteractions).set({
       deliveryClaimHolderId: null,
       deliveryClaimExpiresAt: null,
-      updatedAt: sql7`now()`
+      updatedAt: sql8`now()`
+    }).where(
+      and10(
+        eq10(slackInteractions.id, input.id),
+        eq10(slackInteractions.deliveryClaimHolderId, input.claimHolderId)
+      )
+    ).returning({ id: slackInteractions.id });
+    return rows.length === 1;
+  });
+}
+async function deferSlackInteractionDelivery(db, input) {
+  return await withRlsContext(db, input, async (scopedDb) => {
+    const rows = await scopedDb.update(slackInteractions).set({
+      deliveryClaimHolderId: null,
+      deliveryClaimExpiresAt: null,
+      deliveryRetryAt: input.retryAt,
+      deliveryLastErrorCode: input.errorCode.slice(0, 128),
+      updatedAt: sql8`now()`
     }).where(
       and10(
         eq10(slackInteractions.id, input.id),
@@ -10603,7 +11084,9 @@ async function closeSlackInteractionDelivery(db, input) {
       terminalDeliveryState: input.state,
       deliveryClaimHolderId: null,
       deliveryClaimExpiresAt: null,
-      updatedAt: sql7`now()`
+      deliveryRetryAt: null,
+      deliveryLastErrorCode: input.errorCode?.slice(0, 128) ?? null,
+      updatedAt: sql8`now()`
     }).where(
       and10(
         eq10(slackInteractions.id, input.id),
@@ -10635,6 +11118,7 @@ function mapSlackInteractionInbox(row) {
     claimHolderId: slackRowNullableString(row, "claimHolderId", "claim_holder_id"),
     claimExpiresAt: slackRowNullableDate(row, "claimExpiresAt", "claim_expires_at"),
     attemptCount: slackRowNumber(row, "attemptCount", "attempt_count"),
+    retryAt: slackRowNullableDate(row, "retryAt", "retry_at"),
     lastErrorCode: slackRowNullableString(row, "lastErrorCode", "last_error_code"),
     processedAt: slackRowNullableDate(row, "processedAt", "processed_at"),
     createdAt: slackRowDate(row, "createdAt", "created_at"),
@@ -10675,6 +11159,13 @@ function mapSlackInteraction(row) {
       "deliveryClaimExpiresAt",
       "delivery_claim_expires_at"
     ),
+    deliveryAttemptCount: slackRowNumber(row, "deliveryAttemptCount", "delivery_attempt_count"),
+    deliveryRetryAt: slackRowNullableDate(row, "deliveryRetryAt", "delivery_retry_at"),
+    deliveryLastErrorCode: slackRowNullableString(
+      row,
+      "deliveryLastErrorCode",
+      "delivery_last_error_code"
+    ),
     ackSlackMessageTs: slackRowNullableString(row, "ackSlackMessageTs", "ack_slack_message_ts"),
     progressCount: slackRowNumber(row, "progressCount", "progress_count"),
     terminalDeliveryState: slackRowString(
@@ -10837,7 +11328,7 @@ async function recordSlackBotInstallCallbackFailure(db, input) {
       await setSubjectRlsContext(scopedDb, input.subjectId);
       await assertWorkspaceAccountPairInScope(scopedDb, input.accountId, input.workspaceId);
       await scopedDb.execute(
-        sql7`select pg_advisory_xact_lock(hashtextextended(${`slack-callback-failure:${input.workspaceId}:${input.callbackDigest}`}, 0))`
+        sql8`select pg_advisory_xact_lock(hashtextextended(${`slack-callback-failure:${input.workspaceId}:${input.callbackDigest}`}, 0))`
       );
       const [existing] = await scopedDb.select({ id: auditEvents.id }).from(auditEvents).where(
         and10(
@@ -10893,7 +11384,7 @@ async function claimSlackBotPostOperation(db, input) {
         requestDigest: input.requestDigest,
         status: "provider_started",
         claimHolderId: input.claimHolderId,
-        claimExpiresAt: sql7`now() + (${claimLeaseMs} * interval '1 millisecond')`,
+        claimExpiresAt: sql8`now() + (${claimLeaseMs} * interval '1 millisecond')`,
         attemptCount: 1
       }).onConflictDoNothing({
         target: [
@@ -10927,16 +11418,16 @@ async function claimSlackBotPostOperation(db, input) {
       }
       const [reclaimed] = await tx.update(slackBotPostOperations).set({
         claimHolderId: input.claimHolderId,
-        claimExpiresAt: sql7`now() + (${claimLeaseMs} * interval '1 millisecond')`,
-        attemptCount: sql7`${slackBotPostOperations.attemptCount} + 1`,
+        claimExpiresAt: sql8`now() + (${claimLeaseMs} * interval '1 millisecond')`,
+        attemptCount: sql8`${slackBotPostOperations.attemptCount} + 1`,
         lastFailureCode: null,
-        updatedAt: sql7`now()`
+        updatedAt: sql8`now()`
       }).where(
         and10(
           eq10(slackBotPostOperations.id, existing.id),
           or3(
             isNull3(slackBotPostOperations.claimHolderId),
-            lte2(slackBotPostOperations.claimExpiresAt, sql7`now()`)
+            lte2(slackBotPostOperations.claimExpiresAt, sql8`now()`)
           )
         )
       ).returning();
@@ -10959,7 +11450,7 @@ async function releaseSlackBotPostOperationClaim(db, input) {
         claimHolderId: null,
         claimExpiresAt: null,
         lastFailureCode: input.failureCode.slice(0, 128),
-        updatedAt: sql7`now()`
+        updatedAt: sql8`now()`
       }).where(
         and10(
           eq10(slackBotPostOperations.workspaceId, input.workspaceId),
@@ -11004,8 +11495,8 @@ async function completeSlackBotPostOperation(db, input) {
         lastFailureCode: null,
         slackChannelId: input.slackChannelId,
         slackMessageTimestamp: input.slackMessageTimestamp,
-        completedAt: sql7`now()`,
-        updatedAt: sql7`now()`
+        completedAt: sql8`now()`,
+        updatedAt: sql8`now()`
       }).where(eq10(slackBotPostOperations.id, current.id)).returning();
       if (!completed) throw new Error("Slack post completion returned no row");
       await tx.insert(auditEvents).values({
@@ -11068,7 +11559,7 @@ async function claimSlackBotDeleteOperation(db, input) {
         requestDigest: input.requestDigest,
         status: "pending",
         claimHolderId: input.claimHolderId,
-        claimExpiresAt: sql7`now() + (${claimLeaseMs} * interval '1 millisecond')`,
+        claimExpiresAt: sql8`now() + (${claimLeaseMs} * interval '1 millisecond')`,
         attemptCount: 1
       }).onConflictDoNothing({
         target: [
@@ -11108,9 +11599,9 @@ async function claimSlackBotDeleteOperation(db, input) {
       const [reclaimed] = await tx.update(slackBotDeleteOperations).set({
         status: nextStatus,
         claimHolderId: input.claimHolderId,
-        claimExpiresAt: sql7`now() + (${claimLeaseMs} * interval '1 millisecond')`,
-        attemptCount: sql7`${slackBotDeleteOperations.attemptCount} + 1`,
-        updatedAt: sql7`now()`
+        claimExpiresAt: sql8`now() + (${claimLeaseMs} * interval '1 millisecond')`,
+        attemptCount: sql8`${slackBotDeleteOperations.attemptCount} + 1`,
+        updatedAt: sql8`now()`
       }).where(eq10(slackBotDeleteOperations.id, existing.id)).returning();
       if (!reclaimed) throw new Error("Slack delete operation reclaim returned no row");
       return {
@@ -11125,7 +11616,7 @@ async function markSlackBotDeleteOperationProviderStarted(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const rows = await scopedDb.update(slackBotDeleteOperations).set({ status: "provider_started", updatedAt: sql7`now()` }).where(
+      const rows = await scopedDb.update(slackBotDeleteOperations).set({ status: "provider_started", updatedAt: sql8`now()` }).where(
         and10(
           eq10(slackBotDeleteOperations.workspaceId, input.workspaceId),
           eq10(slackBotDeleteOperations.connectionId, input.connectionId),
@@ -11151,7 +11642,7 @@ async function releaseSlackBotDeleteOperationClaim(db, input) {
         claimHolderId: null,
         claimExpiresAt: null,
         lastFailureCode: input.failureCode.slice(0, 128),
-        updatedAt: sql7`now()`
+        updatedAt: sql8`now()`
       }).where(
         and10(
           eq10(slackBotDeleteOperations.workspaceId, input.workspaceId),
@@ -11196,8 +11687,8 @@ async function completeSlackBotDeleteOperation(db, input) {
         lastFailureCode: null,
         slackChannelId: input.slackChannelId,
         slackMessageTimestamp: input.slackMessageTimestamp,
-        completedAt: sql7`now()`,
-        updatedAt: sql7`now()`
+        completedAt: sql8`now()`,
+        updatedAt: sql8`now()`
       }).where(eq10(slackBotDeleteOperations.id, current.id)).returning();
       if (!completed) throw new Error("Slack delete completion returned no row");
       await tx.insert(auditEvents).values({
@@ -11257,9 +11748,12 @@ async function loadConnectionCredentialForBroker(db, settings, input) {
     input.workspaceId,
     input.allowSubjectOwned ? input.subjectId : null,
     async (scopedDb) => {
+      const personalSlackSubjectLookup = !input.connectionId && input.allowSubjectOwned === true && input.providerDomain === "slack.com" && input.kind === "oauth2";
       const [row] = await scopedDb.select().from(connections).where(and10(...conditions)).orderBy(
-        desc5(sql7`(${connections.status} = 'active')`),
-        desc5(connections.updatedAt)
+        ...personalSlackSubjectLookup ? personalSlackCanonicalConnectionOrder() : [
+          desc5(sql8`(${connections.status} = 'active')`),
+          desc5(connections.updatedAt)
+        ]
       ).limit(1);
       if (!row) {
         return null;
@@ -11306,7 +11800,7 @@ async function recordConnectionTokenRefresh(db, input) {
         lastRefreshAt: input.lastRefreshAt,
         status: "active",
         lastError: null,
-        version: sql7`${connections.version} + 1`,
+        version: sql8`${connections.version} + 1`,
         updatedAt: /* @__PURE__ */ new Date(),
         ...input.grantedScopes !== void 0 ? { grantedScopes: input.grantedScopes } : {}
       };
@@ -11330,8 +11824,8 @@ async function setConnectionStatus(db, workspaceId, status, lastError, guard) {
     const updated = await scopedDb.update(connections).set({
       status,
       lastError,
-      version: sql7`${connections.version} + 1`,
-      verifiedInstallVersion: sql7`case
+      version: sql8`${connections.version} + 1`,
+      verifiedInstallVersion: sql8`case
           when ${connections.verifiedInstallAt} is null then null
           else ${connections.version} + 1
         end`,
@@ -11567,7 +12061,7 @@ async function updateKnowledgeMemory(db, workspaceId, memoryId, input, embedder)
     );
     if (willBeVisible) {
       const [{ visibleCount } = { visibleCount: 0 }] = await scopedDb.select({
-        visibleCount: sql7`count(*)::int`
+        visibleCount: sql8`count(*)::int`
       }).from(knowledgeMemories).where(
         and10(
           eq10(knowledgeMemories.workspaceId, workspaceId),
@@ -11696,7 +12190,7 @@ async function listKnowledgeMemories(db, workspaceId, options = {}) {
     const query = cleanDbString(options.query);
     if (query) {
       conditions.push(
-        sql7`to_tsvector('simple', ${knowledgeMemories.text}) @@ plainto_tsquery('simple', ${query})`
+        sql8`to_tsvector('simple', ${knowledgeMemories.text}) @@ plainto_tsquery('simple', ${query})`
       );
     }
     const limit = Math.min(Math.max(options.limit ?? 20, 1), 100);
@@ -11724,17 +12218,21 @@ function memoryVectorLiteral(values) {
   return `[${values.join(",")}]`;
 }
 var agentVisibleMemoryStatuses = [...AGENT_VISIBLE_MEMORY_STATUSES];
-var visibleTextHashUniqueIndexName = "knowledge_memories_workspace_visible_text_hash_uq";
+var visibleTextHashUniqueIndexNames = /* @__PURE__ */ new Set([
+  "knowledge_memories_workspace_visible_text_hash_uq",
+  "knowledge_memories_scope_visible_text_hash_uq"
+]);
 function isVisibleTextHashUniqueViolation(error) {
   const candidate = error;
   if (!candidate || typeof candidate !== "object") {
     return false;
   }
   const constraint = candidate.constraint ?? candidate.constraint_name;
-  if (candidate.code === "23505" && constraint === visibleTextHashUniqueIndexName) {
+  if (candidate.code === "23505" && visibleTextHashUniqueIndexNames.has(String(constraint))) {
     return true;
   }
-  if (typeof candidate.message === "string" && candidate.message.includes(visibleTextHashUniqueIndexName) && (candidate.code === "23505" || candidate.message.includes("duplicate key value violates unique constraint"))) {
+  const message = typeof candidate.message === "string" ? candidate.message : null;
+  if (message !== null && [...visibleTextHashUniqueIndexNames].some((name) => message.includes(name)) && (candidate.code === "23505" || message.includes("duplicate key value violates unique constraint"))) {
     return true;
   }
   return isVisibleTextHashUniqueViolation(candidate.cause);
@@ -11796,7 +12294,7 @@ async function resolveWorkspaceMemoryId(scopedDb, workspaceId, rawId) {
   const matches = await scopedDb.select({ id: knowledgeMemories.id }).from(knowledgeMemories).where(
     and10(
       eq10(knowledgeMemories.workspaceId, workspaceId),
-      sql7`${knowledgeMemories.id}::text like ${`${candidate}%`}`,
+      sql8`${knowledgeMemories.id}::text like ${`${candidate}%`}`,
       ne(knowledgeMemories.status, "archived"),
       ne(knowledgeMemories.status, "superseded"),
       ne(knowledgeMemories.status, "rejected")
@@ -11952,14 +12450,14 @@ async function saveWorkspaceMemory(db, input, embedder) {
         inArray5(knowledgeMemories.status, agentVisibleMemoryStatuses)
       )
     ).orderBy(
-      replacesFullId ? sql7`case when ${knowledgeMemories.id} = ${replacesFullId} then 1 else 0 end` : knowledgeMemories.updatedAt
+      replacesFullId ? sql8`case when ${knowledgeMemories.id} = ${replacesFullId} then 1 else 0 end` : knowledgeMemories.updatedAt
     ).limit(replacesFullId ? 2 : 1);
     const exact = exactMatches.find((row) => row.id !== replacesFullId) ?? exactMatches[0];
     if (exact) {
       return await dedupeToExisting(exact, "exact");
     }
     if (embedding && embeddingModel) {
-      const distance = sql7`${knowledgeMemories.embedding} <=> ${memoryVectorLiteral(embedding)}::vector`;
+      const distance = sql8`${knowledgeMemories.embedding} <=> ${memoryVectorLiteral(embedding)}::vector`;
       const neighbours = await scopedDb.select({
         id: knowledgeMemories.id,
         distance
@@ -11968,7 +12466,7 @@ async function saveWorkspaceMemory(db, input, embedder) {
           eq10(knowledgeMemories.workspaceId, input.workspaceId),
           inArray5(knowledgeMemories.status, agentVisibleMemoryStatuses),
           eq10(knowledgeMemories.embeddingModel, embeddingModel),
-          sql7`${knowledgeMemories.embedding} is not null`
+          sql8`${knowledgeMemories.embedding} is not null`
         )
       ).orderBy(distance).limit(MEMORY_NEAR_DUP_NEIGHBORS);
       const duplicateNeighbours = neighbours.filter(
@@ -11988,7 +12486,7 @@ async function saveWorkspaceMemory(db, input, embedder) {
       }
     }
     const [{ visibleCount } = { visibleCount: 0 }] = await scopedDb.select({
-      visibleCount: sql7`count(*)::int`
+      visibleCount: sql8`count(*)::int`
     }).from(knowledgeMemories).where(
       and10(
         eq10(knowledgeMemories.workspaceId, input.workspaceId),
@@ -12173,12 +12671,12 @@ async function searchWorkspaceMemories(db, workspaceId, input, embedder) {
         if (!vector || vector.length === 0) {
           throw new Error("embedder returned no query vector");
         }
-        const distance = sql7`${knowledgeMemories.embedding} <=> ${memoryVectorLiteral(vector)}::vector`;
+        const distance = sql8`${knowledgeMemories.embedding} <=> ${memoryVectorLiteral(vector)}::vector`;
         const rows = await scopedDb.select({ id: knowledgeMemories.id, distance }).from(knowledgeMemories).where(
           and10(
             ...baseConditions,
             eq10(knowledgeMemories.embeddingModel, embedder.model),
-            sql7`${knowledgeMemories.embedding} is not null`
+            sql8`${knowledgeMemories.embedding} is not null`
           )
         ).orderBy(distance).limit(candidateLimit);
         for (const row of rows) {
@@ -12202,11 +12700,11 @@ async function searchWorkspaceMemories(db, workspaceId, input, embedder) {
       }
     }
     if (mode === "keyword" || mode === "hybrid") {
-      const rank = sql7`ts_rank_cd(to_tsvector('simple', ${knowledgeMemories.text}), plainto_tsquery('simple', ${query}))`;
+      const rank = sql8`ts_rank_cd(to_tsvector('simple', ${knowledgeMemories.text}), plainto_tsquery('simple', ${query}))`;
       const rows = await scopedDb.select({ id: knowledgeMemories.id, rank }).from(knowledgeMemories).where(
         and10(
           ...baseConditions,
-          sql7`to_tsvector('simple', ${knowledgeMemories.text}) @@ plainto_tsquery('simple', ${query})`
+          sql8`to_tsvector('simple', ${knowledgeMemories.text}) @@ plainto_tsquery('simple', ${query})`
         )
       ).orderBy(desc5(rank)).limit(candidateLimit);
       for (const row of rows) {
@@ -12239,7 +12737,7 @@ async function searchWorkspaceMemories(db, workspaceId, input, embedder) {
     }
     const ids = ranked.map((entry) => entry.id);
     const bumped = await scopedDb.update(knowledgeMemories).set({
-      usageCount: sql7`${knowledgeMemories.usageCount} + 1`,
+      usageCount: sql8`${knowledgeMemories.usageCount} + 1`,
       lastUsedAt: /* @__PURE__ */ new Date()
     }).where(
       and10(
@@ -12312,6 +12810,7 @@ async function createSocialConnection(db, input) {
         status: input.status,
         scopes: input.scopes ?? [],
         credentialRef: input.credentialRef ?? null,
+        credentialEncrypted: input.credentialEncrypted ?? null,
         tokenMetadata: input.tokenMetadata ?? {},
         metadata: input.metadata ?? {}
       }).returning();
@@ -12322,15 +12821,85 @@ async function createSocialConnection(db, input) {
     }
   );
 }
+async function upsertSocialOAuthConnection(db, input) {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const [row] = await scopedDb.insert(socialConnections).values({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        provider: input.provider,
+        accountHandle: input.accountHandle,
+        accountName: input.accountName ?? null,
+        externalAccountId: input.externalAccountId ?? null,
+        status: "connected",
+        scopes: input.scopes,
+        credentialEncrypted: input.credentialEncrypted,
+        tokenMetadata: input.tokenMetadata ?? {}
+      }).onConflictDoUpdate({
+        target: [
+          socialConnections.workspaceId,
+          socialConnections.provider,
+          socialConnections.accountHandle
+        ],
+        set: {
+          accountName: input.accountName ?? null,
+          externalAccountId: input.externalAccountId ?? null,
+          status: "connected",
+          scopes: input.scopes,
+          credentialEncrypted: input.credentialEncrypted,
+          tokenMetadata: input.tokenMetadata ?? {},
+          updatedAt: /* @__PURE__ */ new Date()
+        }
+      }).returning();
+      if (!row) {
+        throw new Error("Failed to upsert social connection");
+      }
+      return mapSocialConnection(row);
+    }
+  );
+}
+async function loadSocialConnectionCredential(db, workspaceId, connectionId) {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb.select().from(socialConnections).where(
+      and10(
+        eq10(socialConnections.workspaceId, workspaceId),
+        eq10(socialConnections.id, connectionId)
+      )
+    ).limit(1);
+    if (!row) {
+      return null;
+    }
+    return { connection: mapSocialConnection(row), credentialEncrypted: row.credentialEncrypted };
+  });
+}
+async function updateSocialConnectionCredential(db, input) {
+  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb.update(socialConnections).set({
+      ...input.credentialEncrypted !== void 0 ? { credentialEncrypted: input.credentialEncrypted } : {},
+      ...input.status !== void 0 ? { status: input.status } : {},
+      ...input.tokenMetadata !== void 0 ? { tokenMetadata: input.tokenMetadata } : {},
+      updatedAt: /* @__PURE__ */ new Date()
+    }).where(
+      and10(
+        eq10(socialConnections.workspaceId, input.workspaceId),
+        eq10(socialConnections.id, input.connectionId)
+      )
+    ).returning();
+    return row ? mapSocialConnection(row) : null;
+  });
+}
+var { credentialEncrypted: _socialCredentialColumn, ...socialConnectionPublicColumns } = getTableColumns(socialConnections);
 async function listSocialConnections(db, workspaceId, limit = 100) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const rows = await scopedDb.select().from(socialConnections).where(eq10(socialConnections.workspaceId, workspaceId)).orderBy(desc5(socialConnections.createdAt)).limit(limit);
+    const rows = await scopedDb.select(socialConnectionPublicColumns).from(socialConnections).where(eq10(socialConnections.workspaceId, workspaceId)).orderBy(desc5(socialConnections.createdAt)).limit(limit);
     return rows.map(mapSocialConnection);
   });
 }
 async function getSocialConnection(db, workspaceId, connectionId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const [row] = await scopedDb.select().from(socialConnections).where(
+    const [row] = await scopedDb.select(socialConnectionPublicColumns).from(socialConnections).where(
       and10(
         eq10(socialConnections.workspaceId, workspaceId),
         eq10(socialConnections.id, connectionId)
@@ -12376,6 +12945,44 @@ async function createSocialPost(db, input) {
     }
   );
 }
+async function recordSyncedSocialPosts(db, input) {
+  if (input.posts.length === 0) {
+    return { inserted: 0, skipped: 0 };
+  }
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const connection = await requireSocialConnection(
+        scopedDb,
+        input.workspaceId,
+        input.connectionId
+      );
+      const rows = await scopedDb.insert(socialPosts).values(
+        input.posts.map((post) => ({
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          connectionId: input.connectionId,
+          provider: connection.provider,
+          externalPostId: post.externalPostId,
+          url: post.url ?? null,
+          authorHandle: post.authorHandle ?? connection.accountHandle,
+          text: post.text,
+          publishedAt: post.publishedAt,
+          metrics: post.metrics ?? {},
+          raw: post.raw ?? {}
+        }))
+      ).onConflictDoNothing({
+        target: [
+          socialPosts.workspaceId,
+          socialPosts.connectionId,
+          socialPosts.externalPostId
+        ]
+      }).returning({ id: socialPosts.id });
+      return { inserted: rows.length, skipped: input.posts.length - rows.length };
+    }
+  );
+}
 async function listSocialPosts(db, options) {
   const conditions = [eq10(socialPosts.workspaceId, options.workspaceId)];
   if (options.connectionIds?.length) {
@@ -12486,7 +13093,7 @@ async function createScheduledTaskRun(db, input) {
     };
     const [inserted] = input.producerKey ? await scopedDb.insert(scheduledTaskRuns).values(values).onConflictDoNothing({
       target: [scheduledTaskRuns.workspaceId, scheduledTaskRuns.producerKey],
-      where: sql7`${scheduledTaskRuns.producerKey} is not null`
+      where: sql8`${scheduledTaskRuns.producerKey} is not null`
     }).returning() : await scopedDb.insert(scheduledTaskRuns).values(values).returning();
     const [row] = inserted ? [inserted] : await scopedDb.select().from(scheduledTaskRuns).where(
       and10(
@@ -12685,7 +13292,7 @@ async function deleteVariableSet(db, workspaceId, variableSetId) {
 async function countVariableSets(db, workspaceId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [{ count } = { count: 0 }] = await scopedDb.select({
-      count: sql7`count(*)::int`
+      count: sql8`count(*)::int`
     }).from(workspaceVariableSets).where(eq10(workspaceVariableSets.workspaceId, workspaceId));
     return Number(count);
   });
@@ -12693,7 +13300,7 @@ async function countVariableSets(db, workspaceId) {
 async function countScheduledTasksUsingVariableSet(db, workspaceId, variableSetId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [{ count } = { count: 0 }] = await scopedDb.select({
-      count: sql7`count(*)::int`
+      count: sql8`count(*)::int`
     }).from(scheduledTasks).where(
       and10(
         eq10(scheduledTasks.workspaceId, workspaceId),
@@ -12706,7 +13313,7 @@ async function countScheduledTasksUsingVariableSet(db, workspaceId, variableSetI
 async function countActiveSessionsUsingVariableSet(db, workspaceId, variableSetId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [{ count } = { count: 0 }] = await scopedDb.select({
-      count: sql7`count(*)::int`
+      count: sql8`count(*)::int`
     }).from(sessions).where(
       and10(
         eq10(sessions.workspaceId, workspaceId),
@@ -12737,7 +13344,7 @@ async function setVariableSetVariable(db, input) {
         ],
         set: {
           valueEncrypted: input.valueEncrypted,
-          version: sql7`${workspaceVariableSetVariables.version} + 1`,
+          version: sql8`${workspaceVariableSetVariables.version} + 1`,
           updatedAt: now
         }
       }).returning({
@@ -12863,7 +13470,7 @@ async function loadRigActiveAndCount(scopedDb, workspaceId, rigId) {
       eq10(rigVersions.active, true)
     )
   ).limit(1);
-  const [{ count } = { count: 0 }] = await scopedDb.select({ count: sql7`count(*)::int` }).from(rigVersions).where(
+  const [{ count } = { count: 0 }] = await scopedDb.select({ count: sql8`count(*)::int` }).from(rigVersions).where(
     and10(eq10(rigVersions.workspaceId, workspaceId), eq10(rigVersions.rigId, rigId))
   );
   return {
@@ -12936,7 +13543,7 @@ async function loadRigHealthByActiveVersion(scopedDb, workspaceId, activeVersion
       eq10(auditEvents.workspaceId, workspaceId),
       eq10(auditEvents.targetType, "rig"),
       inArray5(auditEvents.action, ["rig.verification.passed", "rig.verification.failed"]),
-      inArray5(sql7`${auditEvents.metadata}->>'versionId'`, versionIds)
+      inArray5(sql8`${auditEvents.metadata}->>'versionId'`, versionIds)
     )
   );
   for (const row of auditRows) {
@@ -13009,7 +13616,7 @@ async function listRigs(db, workspaceId) {
     ]);
     const countRows = await scopedDb.select({
       rigId: rigVersions.rigId,
-      count: sql7`count(*)::int`
+      count: sql8`count(*)::int`
     }).from(rigVersions).where(eq10(rigVersions.workspaceId, workspaceId)).groupBy(rigVersions.rigId);
     const countByRig = new Map(countRows.map((row) => [row.rigId, Number(row.count)]));
     return rows.map((row) => {
@@ -13111,11 +13718,11 @@ async function deleteRigIfNoActiveSessions(db, workspaceId, rigId) {
     if (!rig) {
       return { deleted: false, activeSessionCount: 0 };
     }
-    const [{ count } = { count: 0 }] = await scopedDb.select({ count: sql7`count(*)::int` }).from(sessions).where(
+    const [{ count } = { count: 0 }] = await scopedDb.select({ count: sql8`count(*)::int` }).from(sessions).where(
       and10(
         eq10(sessions.workspaceId, workspaceId),
         eq10(sessions.rigId, rigId),
-        sql7`${sessions.status} not in ('failed', 'cancelled')`
+        sql8`${sessions.status} not in ('failed', 'cancelled')`
       )
     );
     const activeSessionCount = Number(count);
@@ -13128,13 +13735,13 @@ async function deleteRigIfNoActiveSessions(db, workspaceId, rigId) {
 }
 async function countRigs(db, workspaceId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const [{ count } = { count: 0 }] = await scopedDb.select({ count: sql7`count(*)::int` }).from(rigs).where(eq10(rigs.workspaceId, workspaceId));
+    const [{ count } = { count: 0 }] = await scopedDb.select({ count: sql8`count(*)::int` }).from(rigs).where(eq10(rigs.workspaceId, workspaceId));
     return Number(count);
   });
 }
 async function countSessionsUsingRig(db, workspaceId, rigId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const [{ count } = { count: 0 }] = await scopedDb.select({ count: sql7`count(*)::int` }).from(sessions).where(and10(eq10(sessions.workspaceId, workspaceId), eq10(sessions.rigId, rigId)));
+    const [{ count } = { count: 0 }] = await scopedDb.select({ count: sql8`count(*)::int` }).from(sessions).where(and10(eq10(sessions.workspaceId, workspaceId), eq10(sessions.rigId, rigId)));
     return Number(count);
   });
 }
@@ -13145,7 +13752,7 @@ async function createRigVersion(db, workspaceId, rigId, input, options = {}) {
       throw new Error(`Rig not found: ${rigId}`);
     }
     const [{ max } = { max: 0 }] = await scopedDb.select({
-      max: sql7`coalesce(max(${rigVersions.version}), 0)::int`
+      max: sql8`coalesce(max(${rigVersions.version}), 0)::int`
     }).from(rigVersions).where(
       and10(eq10(rigVersions.workspaceId, workspaceId), eq10(rigVersions.rigId, rigId))
     );
@@ -13221,7 +13828,7 @@ async function createRigVersionForChangePromotion(db, workspaceId, rigId, change
       );
     }
     const [{ max } = { max: 0 }] = await scopedDb.select({
-      max: sql7`coalesce(max(${rigVersions.version}), 0)::int`
+      max: sql8`coalesce(max(${rigVersions.version}), 0)::int`
     }).from(rigVersions).where(
       and10(eq10(rigVersions.workspaceId, workspaceId), eq10(rigVersions.rigId, rigId))
     );
@@ -13283,20 +13890,20 @@ async function listRigVersionMonitoringSummaries(db, workspaceId, rigId, limit =
       rigId: rigVersions.rigId,
       version: rigVersions.version,
       active: rigVersions.active,
-      image: sql7`left(${rigVersions.image}, 512)`,
-      imageOriginalChars: sql7`char_length(${rigVersions.image})::int`,
-      setupScriptBytes: sql7`octet_length(coalesce(${rigVersions.setupScript}, ''))::int`,
-      checkCount: sql7`jsonb_array_length(${rigVersions.checks})::int`,
-      credentialHookCount: sql7`jsonb_array_length(${rigVersions.credentialHooks})::int`,
-      defaultVariableSetCount: sql7`jsonb_array_length(${rigVersions.defaultVariableSetIds})::int`,
-      changelog: sql7`left(${rigVersions.changelog}, 600)`,
-      changelogOriginalChars: sql7`char_length(${rigVersions.changelog})::int`,
-      createdBy: sql7`left(${rigVersions.createdBy}, 200)`,
+      image: sql8`left(${rigVersions.image}, 512)`,
+      imageOriginalChars: sql8`char_length(${rigVersions.image})::int`,
+      setupScriptBytes: sql8`octet_length(coalesce(${rigVersions.setupScript}, ''))::int`,
+      checkCount: sql8`jsonb_array_length(${rigVersions.checks})::int`,
+      credentialHookCount: sql8`jsonb_array_length(${rigVersions.credentialHooks})::int`,
+      defaultVariableSetCount: sql8`jsonb_array_length(${rigVersions.defaultVariableSetIds})::int`,
+      changelog: sql8`left(${rigVersions.changelog}, 600)`,
+      changelogOriginalChars: sql8`char_length(${rigVersions.changelog})::int`,
+      createdBy: sql8`left(${rigVersions.createdBy}, 200)`,
       createdAt: rigVersions.createdAt
     }).from(rigVersions).where(
       and10(eq10(rigVersions.workspaceId, workspaceId), eq10(rigVersions.rigId, rigId))
     ).orderBy(desc5(rigVersions.version), desc5(rigVersions.id)).limit(boundedLimit + 1);
-    const [{ total } = { total: 0 }] = await scopedDb.select({ total: sql7`count(*)::int` }).from(rigVersions).where(
+    const [{ total } = { total: 0 }] = await scopedDb.select({ total: sql8`count(*)::int` }).from(rigVersions).where(
       and10(eq10(rigVersions.workspaceId, workspaceId), eq10(rigVersions.rigId, rigId))
     );
     return {
@@ -13417,16 +14024,16 @@ async function listRigChangeMonitoringSummaries(db, workspaceId, rigId, limit =
       baseVersionId: rigChanges.baseVersionId,
       kind: rigChanges.kind,
       status: rigChanges.status,
-      proposedBy: sql7`left(${rigChanges.proposedBy}, 200)`,
+      proposedBy: sql8`left(${rigChanges.proposedBy}, 200)`,
       resultVersionId: rigChanges.resultVersionId,
-      commandPreview: sql7`left(${rigChanges.payload}->>'command', 600)`,
-      commandOriginalChars: sql7`char_length(${rigChanges.payload}->>'command')::int`,
-      payloadBytes: sql7`octet_length(${rigChanges.payload}::text)::int`,
-      verificationBytes: sql7`octet_length(coalesce(${rigChanges.verification}::text, 'null'))::int`,
-      verificationLogBytes: sql7`octet_length(coalesce(${rigChanges.verification}->>'log', ''))::int`,
-      verificationStartedAt: sql7`left(${rigChanges.verification}->>'startedAt', 64)`,
-      verificationFinishedAt: sql7`left(${rigChanges.verification}->>'finishedAt', 64)`,
-      verificationPassed: sql7`case
+      commandPreview: sql8`left(${rigChanges.payload}->>'command', 600)`,
+      commandOriginalChars: sql8`char_length(${rigChanges.payload}->>'command')::int`,
+      payloadBytes: sql8`octet_length(${rigChanges.payload}::text)::int`,
+      verificationBytes: sql8`octet_length(coalesce(${rigChanges.verification}::text, 'null'))::int`,
+      verificationLogBytes: sql8`octet_length(coalesce(${rigChanges.verification}->>'log', ''))::int`,
+      verificationStartedAt: sql8`left(${rigChanges.verification}->>'startedAt', 64)`,
+      verificationFinishedAt: sql8`left(${rigChanges.verification}->>'finishedAt', 64)`,
+      verificationPassed: sql8`case
           when ${rigChanges.verification}->>'passed' = 'true' then true
           when ${rigChanges.verification}->>'passed' = 'false' then false
           else null
@@ -13436,7 +14043,7 @@ async function listRigChangeMonitoringSummaries(db, workspaceId, rigId, limit =
     }).from(rigChanges).where(
       and10(eq10(rigChanges.workspaceId, workspaceId), eq10(rigChanges.rigId, rigId))
     ).orderBy(desc5(rigChanges.createdAt), desc5(rigChanges.id)).limit(boundedLimit + 1);
-    const [{ total } = { total: 0 }] = await scopedDb.select({ total: sql7`count(*)::int` }).from(rigChanges).where(
+    const [{ total } = { total: 0 }] = await scopedDb.select({ total: sql8`count(*)::int` }).from(rigChanges).where(
       and10(eq10(rigChanges.workspaceId, workspaceId), eq10(rigChanges.rigId, rigId))
     );
     return {
@@ -13619,7 +14226,7 @@ async function upsertCodexSubscriptionCredential(db, input) {
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
       await scopedDb.execute(
-        sql7`select pg_advisory_xact_lock(hashtextextended(${`codex-credential-upsert:${input.workspaceId}:${input.chatgptAccountId ?? "null"}`}, 0))`
+        sql8`select pg_advisory_xact_lock(hashtextextended(${`codex-credential-upsert:${input.workspaceId}:${input.chatgptAccountId ?? "null"}`}, 0))`
       );
       const [existing] = input.chatgptAccountId ? await scopedDb.select({
         id: codexSubscriptionCredentials.id,
@@ -13670,7 +14277,7 @@ async function upsertCodexSubscriptionCredential(db, input) {
           codexSubscriptionCredentials.workspaceId,
           codexSubscriptionCredentials.chatgptAccountId
         ],
-        targetWhere: sql7`chatgpt_account_id is not null`,
+        targetWhere: sql8`chatgpt_account_id is not null`,
         set: {
           // account_id MUST be re-asserted on conflict. Omitting it leaves a stale
           // account_id on a row whose owning account changed (e.g. a reconnect
@@ -13686,7 +14293,7 @@ async function upsertCodexSubscriptionCredential(db, input) {
           // Refresh the derived email; keep an existing user-chosen label (only seed
           // it when still null) so a re-connect never clobbers a rename.
           accountEmail: input.accountEmail ?? null,
-          label: sql7`coalesce(${codexSubscriptionCredentials.label}, ${input.label ?? null})`,
+          label: sql8`coalesce(${codexSubscriptionCredentials.label}, ${input.label ?? null})`,
           // Ownership follows the most recent connection exactly. A
           // configured/delegated/API-key reconnect is intentionally
           // nonhuman and clears the prior human owner, making the row
@@ -13694,7 +14301,7 @@ async function upsertCodexSubscriptionCredential(db, input) {
           connectedBySubjectId: input.connectedBySubjectId ?? null,
           status: "active",
           lastError: null,
-          version: sql7`${codexSubscriptionCredentials.version} + 1`,
+          version: sql8`${codexSubscriptionCredentials.version} + 1`,
           updatedAt: now
         }
       }).returning({
@@ -13766,7 +14373,7 @@ async function recordCodexTokenRefresh(db, input) {
       lastRefreshAt: input.lastRefreshAt,
       status: "active",
       lastError: null,
-      version: sql7`${codexSubscriptionCredentials.version} + 1`,
+      version: sql8`${codexSubscriptionCredentials.version} + 1`,
       updatedAt: /* @__PURE__ */ new Date()
     }).where(
       and10(
@@ -13780,9 +14387,9 @@ async function recordCodexTokenRefresh(db, input) {
 }
 async function withCodexCredentialRefreshLock(db, workspaceId, credentialId, fn) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    await scopedDb.execute(sql7`set local lock_timeout = '30s'`);
+    await scopedDb.execute(sql8`set local lock_timeout = '30s'`);
     await scopedDb.execute(
-      sql7`select pg_advisory_xact_lock(hashtextextended(${`codex-refresh:${credentialId}`}, 0))`
+      sql8`select pg_advisory_xact_lock(hashtextextended(${`codex-refresh:${credentialId}`}, 0))`
     );
     return await fn(scopedDb);
   });
@@ -13821,7 +14428,7 @@ async function setCodexCredentialStatusById(db, workspaceId, credentialId, statu
   });
 }
 async function getCodexCredentialStatusScoped(scopedDb, workspaceId) {
-  await scopedDb.execute(sql7`
+  await scopedDb.execute(sql8`
     select id from codex_rotation_settings
     where workspace_id = ${workspaceId}
     for update
@@ -13968,7 +14575,7 @@ function filterCodexLeaseCandidatesForPolicy(accounts, policyScope, filter) {
   return { accounts: [...filteredAccounts], unavailableDiagnostics };
 }
 async function listCodexLeaseCandidatesInTransaction(tx, input) {
-  const rows = await tx.execute(sql7`
+  const rows = await tx.execute(sql8`
     select
       c.id,
       c.chatgpt_account_id,
@@ -14017,13 +14624,13 @@ async function acquireCodexCredentialLease(db, input, select) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (tx) => {
-      await tx.execute(sql7`
+      await tx.execute(sql8`
         insert into codex_rotation_settings
           (account_id, workspace_id, lease_rotation_enabled)
         values (${input.accountId}, ${input.workspaceId}, false)
         on conflict (workspace_id) do nothing
       `);
-      const settingsRows = await tx.execute(sql7`
+      const settingsRows = await tx.execute(sql8`
         select active_credential_id, rotation_enabled,
                lease_rotation_enabled, rotation_strategy
         from codex_rotation_settings
@@ -14034,7 +14641,7 @@ async function acquireCodexCredentialLease(db, input, select) {
       if (!settingsRow) {
         throw new Error(`Codex rotation settings not visible for workspace ${input.workspaceId}`);
       }
-      const turns = await tx.execute(sql7`
+      const turns = await tx.execute(sql8`
         select id, metadata from session_turns
         where account_id = ${input.accountId}
           and workspace_id = ${input.workspaceId}
@@ -14046,7 +14653,7 @@ async function acquireCodexCredentialLease(db, input, select) {
       }
       const policyScope = input.resolvePolicyScope?.(turns[0].metadata ?? {}) ?? null;
       const continuationRows = input.continuationCredentialId ? await tx.execute(
-        sql7`
+        sql8`
               select frozen_codex_credential_id
               from agent_run_states
               where account_id = ${input.accountId}
@@ -14062,13 +14669,13 @@ async function acquireCodexCredentialLease(db, input, select) {
       const leaseRotationEnabled = settingsRow.rotation_enabled && settingsRow.lease_rotation_enabled;
       const rotationStrategy = settingsRow.rotation_strategy;
       if (leaseRotationEnabled) {
-        await tx.execute(sql7`
+        await tx.execute(sql8`
           delete from codex_credential_leases
           where workspace_id = ${input.workspaceId} and leased_until <= now()
         `);
       }
       const existingRows = leaseRotationEnabled ? await tx.execute(
-        sql7`
+        sql8`
               select credential_id, holder_id, generation from codex_credential_leases
               where workspace_id = ${input.workspaceId}
                 and turn_id = ${input.turnId}
@@ -14115,7 +14722,7 @@ async function acquireCodexCredentialLease(db, input, select) {
       }
       if (selected.credentialId === null) {
         if (leaseRotationEnabled && existingCredentialId !== null) {
-          await tx.execute(sql7`
+          await tx.execute(sql8`
             delete from codex_credential_leases
             where workspace_id = ${input.workspaceId} and turn_id = ${input.turnId}
           `);
@@ -14145,7 +14752,7 @@ async function acquireCodexCredentialLease(db, input, select) {
       const advanceActivePointer = input.advanceActivePointer && selected.advanceActivePointer !== false;
       if (!leaseRotationEnabled) {
         if (advanceActivePointer && activeCredentialId !== selected.credentialId) {
-          await tx.execute(sql7`
+          await tx.execute(sql8`
             update codex_rotation_settings
             set active_credential_id = ${selected.credentialId}, updated_at = now()
             where account_id = ${input.accountId} and workspace_id = ${input.workspaceId}
@@ -14168,7 +14775,7 @@ async function acquireCodexCredentialLease(db, input, select) {
       }
       const reused = existingCredentialId === selected.credentialId;
       const leaseRows = await tx.execute(
-        sql7`
+        sql8`
         insert into codex_credential_leases
           (account_id, workspace_id, credential_id, turn_id, holder_id, generation, leased_until)
         values
@@ -14191,7 +14798,7 @@ async function acquireCodexCredentialLease(db, input, select) {
         throw new Error("Codex credential lease insert returned no expiry");
       }
       if (!reused) {
-        await tx.execute(sql7`
+        await tx.execute(sql8`
           update codex_subscription_credentials
           set selection_count = selection_count + 1,
               last_selected_at = now()
@@ -14201,7 +14808,7 @@ async function acquireCodexCredentialLease(db, input, select) {
         `);
       }
       if (advanceActivePointer && activeCredentialId !== selected.credentialId) {
-        await tx.execute(sql7`
+        await tx.execute(sql8`
           update codex_rotation_settings
           set active_credential_id = ${selected.credentialId}, updated_at = now()
           where account_id = ${input.accountId} and workspace_id = ${input.workspaceId}
@@ -14261,7 +14868,7 @@ function codexCapacityPolicyHashFromTurnMetadata(metadata) {
   return typeof value === "string" && value.length > 0 ? value : null;
 }
 async function lockExistingCodexRotationSettingsForCapacity(tx, workspaceId) {
-  const rows = await tx.execute(sql7`
+  const rows = await tx.execute(sql8`
     select account_id, active_credential_id, rotation_enabled,
            lease_rotation_enabled, rotation_strategy
     from codex_rotation_settings
@@ -14319,7 +14926,7 @@ async function armCodexCapacityWait(db, input) {
           eq10(sessionGoals.sessionId, input.sessionId)
         )
       ).for("update").limit(1) : [];
-      const leaseRows = input.leaseFence ? await tx.execute(sql7`
+      const leaseRows = input.leaseFence ? await tx.execute(sql8`
               select holder_id, generation
               from codex_credential_leases
               where account_id = ${input.accountId}
@@ -14495,7 +15102,7 @@ async function armCodexCapacityWait(db, input) {
         throw new Error("Codex capacity session changed during atomic arm");
       }
       if (input.leaseFence) {
-        await tx.execute(sql7`
+        await tx.execute(sql8`
             delete from codex_credential_leases
             where account_id = ${input.accountId}
               and workspace_id = ${input.workspaceId}
@@ -14536,7 +15143,7 @@ async function withCodexCapacityMutation(db, input, mutate) {
         return { result: mutation.result, wakeTargets: [] };
       }
       const rows = await tx.update(codexCapacityWaiters).set({
-        wakeRevision: sql7`${codexCapacityWaiters.wakeRevision} + 1`,
+        wakeRevision: sql8`${codexCapacityWaiters.wakeRevision} + 1`,
         lastWakeReason: input.reason,
         updatedAt: /* @__PURE__ */ new Date()
       }).where(
@@ -14590,7 +15197,7 @@ async function listPendingCodexCapacityWakeTargets(db, workspaceId) {
       and10(
         eq10(codexCapacityWaiters.workspaceId, workspaceId),
         eq10(codexCapacityWaiters.status, "waiting"),
-        sql7`${codexCapacityWaiters.wakeRevision} > ${codexCapacityWaiters.observedWakeRevision}`
+        sql8`${codexCapacityWaiters.wakeRevision} > ${codexCapacityWaiters.observedWakeRevision}`
       )
     );
     return rows.map(({ waiter: row, workflowWakeRevision }) => ({
@@ -14948,7 +15555,7 @@ async function reconcileCodexCapacityWait(db, input, decide, policy) {
 }
 async function heartbeatCodexCredentialLeaseUntil(db, accountId, workspaceId, turnId, holderId, generation, leaseTtlMs = CODEX_CREDENTIAL_LEASE_TTL_MS) {
   return await withRlsContext(db, { accountId, workspaceId }, async (scopedDb) => {
-    const rows = await scopedDb.execute(sql7`
+    const rows = await scopedDb.execute(sql8`
       update codex_credential_leases
       set leased_until = now() + (${leaseTtlMs} * interval '1 millisecond'),
           updated_at = now()
@@ -14992,7 +15599,7 @@ async function quarantineCodexCredentialForLease(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => await scopedDb.transaction(async (tx) => {
-      const leaseRows = await tx.execute(sql7`
+      const leaseRows = await tx.execute(sql8`
           select id from codex_credential_leases
           where account_id = ${input.accountId}
             and workspace_id = ${input.workspaceId}
@@ -15117,7 +15724,7 @@ async function updateCodexAllocatorEligibility(db, input) {
       const changedAt = /* @__PURE__ */ new Date();
       const [updated] = await tx.update(codexSubscriptionCredentials).set({
         allocatorEnabled: input.enabled,
-        allocatorVersion: sql7`${codexSubscriptionCredentials.allocatorVersion} + 1`,
+        allocatorVersion: sql8`${codexSubscriptionCredentials.allocatorVersion} + 1`,
         allocatorUpdatedBySubjectId: input.subjectId,
         allocatorUpdatedAt: changedAt
         // Deliberately no credential version/updatedAt write.
@@ -15287,7 +15894,7 @@ async function adoptCodexResetRedemptionAttempt(db, input) {
       if (attempt.status !== "provider_started" && attempt.status !== "completed") {
         return { kind: "conflict" };
       }
-      const claim = await tx.execute(sql7`
+      const claim = await tx.execute(sql8`
           select claim_expires_at > now() as claim_live
           from codex_reset_redemption_attempts
           where workspace_id = ${input.workspaceId} and id = ${input.attemptId}
@@ -15297,7 +15904,7 @@ async function adoptCodexResetRedemptionAttempt(db, input) {
         browserSessionHash: input.browserSessionHash,
         claimHolderId: null,
         claimExpiresAt: null,
-        updatedAt: sql7`now()`
+        updatedAt: sql8`now()`
       }).where(eq10(codexResetRedemptionAttempts.id, input.attemptId)).returning();
       if (!adopted) throw new Error("Codex redemption adoption returned no row");
       return {
@@ -15320,10 +15927,10 @@ async function claimCodexResetRedemption(db, input) {
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => await scopedDb.transaction(async (tx) => {
       await tx.execute(
-        sql7`select pg_advisory_xact_lock(hashtextextended(${`codex-reset-attempt:${input.id}`}, 0))`
+        sql8`select pg_advisory_xact_lock(hashtextextended(${`codex-reset-attempt:${input.id}`}, 0))`
       );
       await tx.execute(
-        sql7`select pg_advisory_xact_lock(hashtextextended(${`codex-reset-credit:${input.workspaceId}:${input.credentialId}:${input.creditId}`}, 0))`
+        sql8`select pg_advisory_xact_lock(hashtextextended(${`codex-reset-credit:${input.workspaceId}:${input.credentialId}:${input.creditId}`}, 0))`
       );
       const [credential] = await tx.select({
         connectedBySubjectId: codexSubscriptionCredentials.connectedBySubjectId,
@@ -15355,7 +15962,7 @@ async function claimCodexResetRedemption(db, input) {
         if (credential.status !== "active") {
           return { kind: "forbidden" };
         }
-        const claimState = await tx.execute(sql7`
+        const claimState = await tx.execute(sql8`
             select claim_expires_at > now() as claim_live
             from codex_reset_redemption_attempts
             where workspace_id = ${input.workspaceId} and id = ${input.id}
@@ -15365,10 +15972,10 @@ async function claimCodexResetRedemption(db, input) {
         }
         const [reclaimed] = await tx.update(codexResetRedemptionAttempts).set({
           claimHolderId: input.claimHolderId,
-          claimExpiresAt: sql7`now() + (${claimTtlMs} * interval '1 millisecond')`,
+          claimExpiresAt: sql8`now() + (${claimTtlMs} * interval '1 millisecond')`,
           confirmationExpiresAt: input.confirmationExpiresAt,
           lastFailureKind: null,
-          retryCount: sql7`${codexResetRedemptionAttempts.retryCount} + 1`,
+          retryCount: sql8`${codexResetRedemptionAttempts.retryCount} + 1`,
           updatedAt: now
         }).where(eq10(codexResetRedemptionAttempts.id, input.id)).returning();
         if (!reclaimed) throw new Error("Codex redemption reclaim returned no row");
@@ -15380,7 +15987,7 @@ async function claimCodexResetRedemption(db, input) {
       if (credential.status !== "active" || credential.connectedBySubjectId !== input.subjectId) {
         return { kind: "forbidden" };
       }
-      const [creditAttempt] = await tx.execute(sql7`
+      const [creditAttempt] = await tx.execute(sql8`
           select id, status, claim_expires_at > now() as claim_live
           from codex_reset_redemption_attempts
           where workspace_id = ${input.workspaceId}
@@ -15399,7 +16006,7 @@ async function claimCodexResetRedemption(db, input) {
             eq10(codexResetRedemptionAttempts.workspaceId, input.workspaceId),
             eq10(codexResetRedemptionAttempts.id, creditAttempt.id),
             eq10(codexResetRedemptionAttempts.status, "processing"),
-            sql7`(${codexResetRedemptionAttempts.claimExpiresAt} is null or ${codexResetRedemptionAttempts.claimExpiresAt} <= now())`
+            sql8`(${codexResetRedemptionAttempts.claimExpiresAt} is null or ${codexResetRedemptionAttempts.claimExpiresAt} <= now())`
           )
         ).returning({ id: codexResetRedemptionAttempts.id });
         if (removed.length !== 1) return { kind: "conflict" };
@@ -15414,7 +16021,7 @@ async function claimCodexResetRedemption(db, input) {
         creditId: input.creditId,
         status: "processing",
         claimHolderId: input.claimHolderId,
-        claimExpiresAt: sql7`now() + (${claimTtlMs} * interval '1 millisecond')`,
+        claimExpiresAt: sql8`now() + (${claimTtlMs} * interval '1 millisecond')`,
         confirmationExpiresAt: input.confirmationExpiresAt
       }).returning();
       if (!created) throw new Error("Codex redemption claim returned no row");
@@ -15458,7 +16065,7 @@ async function fenceCodexResetRedemptionSend(db, input) {
       if (attempt.status === "completed") {
         return { kind: "not_ready", reason: "already_completed" };
       }
-      const [liveness] = await tx.execute(sql7`
+      const [liveness] = await tx.execute(sql8`
           select claim_expires_at > now() as claim_live,
                  confirmation_expires_at > now() as confirmation_live
           from codex_reset_redemption_attempts
@@ -15472,10 +16079,10 @@ async function fenceCodexResetRedemptionSend(db, input) {
       } else {
         const [ready] = await tx.update(codexResetRedemptionAttempts).set({
           status: "provider_started",
-          providerStartedAt: sql7`coalesce(${codexResetRedemptionAttempts.providerStartedAt}, now())`,
-          claimExpiresAt: sql7`now() + (${sendLeaseMs} * interval '1 millisecond')`,
+          providerStartedAt: sql8`coalesce(${codexResetRedemptionAttempts.providerStartedAt}, now())`,
+          claimExpiresAt: sql8`now() + (${sendLeaseMs} * interval '1 millisecond')`,
           lastFailureKind: null,
-          updatedAt: sql7`now()`
+          updatedAt: sql8`now()`
         }).where(eq10(codexResetRedemptionAttempts.id, input.attemptId)).returning();
         if (!ready) throw new Error("Codex redemption send fence returned no row");
         return {
@@ -15490,7 +16097,7 @@ async function fenceCodexResetRedemptionSend(db, input) {
           claimHolderId: null,
           claimExpiresAt: null,
           lastFailureKind: `send_fence_${reason}`,
-          updatedAt: sql7`now()`
+          updatedAt: sql8`now()`
         }).where(eq10(codexResetRedemptionAttempts.id, input.attemptId));
       }
       return { kind: "not_ready", reason };
@@ -15529,7 +16136,7 @@ async function releaseCodexResetRedemptionClaim(db, input) {
           eq10(codexResetRedemptionAttempts.workspaceId, input.workspaceId),
           eq10(codexResetRedemptionAttempts.id, input.attemptId),
           eq10(codexResetRedemptionAttempts.claimHolderId, input.claimHolderId),
-          sql7`${codexResetRedemptionAttempts.status} <> 'completed'`
+          sql8`${codexResetRedemptionAttempts.status} <> 'completed'`
         )
       ).returning({ id: codexResetRedemptionAttempts.id });
       return rows.length === 1;
@@ -15545,7 +16152,7 @@ async function completeCodexResetRedemption(db, input) {
     { workspaceId: input.workspaceId, reason: "codex_reset_credit_redeemed" },
     async (tx) => {
       await tx.execute(
-        sql7`select pg_advisory_xact_lock(hashtextextended(${`codex-reset-attempt:${input.attemptId}`}, 0))`
+        sql8`select pg_advisory_xact_lock(hashtextextended(${`codex-reset-attempt:${input.attemptId}`}, 0))`
       );
       const [current] = await tx.select().from(codexResetRedemptionAttempts).where(
         and10(
@@ -15701,7 +16308,7 @@ async function ensureCodexRotationSettings(db, accountId, workspaceId) {
 }
 async function setActiveCodexCredential(db, workspaceId, credentialId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    await scopedDb.execute(sql7`
+    await scopedDb.execute(sql8`
       select id from codex_rotation_settings
       where workspace_id = ${workspaceId}
       for update
@@ -15721,7 +16328,7 @@ async function setActiveCodexCredential(db, workspaceId, credentialId) {
 }
 async function setInitialActiveCodexCredential(db, workspaceId, credentialId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    await scopedDb.execute(sql7`
+    await scopedDb.execute(sql8`
       select id from codex_rotation_settings
       where workspace_id = ${workspaceId}
       for update
@@ -15777,13 +16384,13 @@ async function countConsecutiveReactiveRotations(db, workspaceId, sessionId) {
       eq10(sessionEvents.workspaceId, workspaceId),
       eq10(sessionEvents.sessionId, sessionId),
       eq10(sessionEvents.type, "turn.failed"),
-      sql7`${sessionEvents.payload} ->> 'rotated' = 'true'`
+      sql8`${sessionEvents.payload} ->> 'rotated' = 'true'`
     ];
     if (lastOk) {
-      conditions.push(sql7`${sessionEvents.sequence} > ${lastOk.sequence}`);
+      conditions.push(sql8`${sessionEvents.sequence} > ${lastOk.sequence}`);
     }
     const [{ rotated } = { rotated: 0 }] = await scopedDb.select({
-      rotated: sql7`count(*)::int`
+      rotated: sql8`count(*)::int`
     }).from(sessionEvents).where(and10(...conditions));
     return Number(rotated);
   });
@@ -15905,7 +16512,7 @@ async function recordSessionActiveCodexCredential(db, workspaceId, sessionId, cr
 }
 async function disconnectCodexAccount(db, workspaceId, credentialId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    await scopedDb.execute(sql7`
+    await scopedDb.execute(sql8`
       select id from codex_rotation_settings
       where workspace_id = ${workspaceId}
       for update
@@ -16144,7 +16751,7 @@ async function updateSessionMcpServerCredentialsInTransaction(tx, input) {
   for (const update of input.updates) {
     const [row] = await tx.update(sessionMcpServers).set({
       headersEncrypted: update.headersEncrypted,
-      credentialVersion: sql7`${sessionMcpServers.credentialVersion} + 1`,
+      credentialVersion: sql8`${sessionMcpServers.credentialVersion} + 1`,
       updatedAt: /* @__PURE__ */ new Date()
     }).where(
       and10(
@@ -16320,7 +16927,7 @@ async function lockWorkspaceForSessionCreate(tx, workspaceId, accountId) {
   if (workspace.accountId !== accountId) {
     throw new Error(`Workspace ${workspaceId} does not belong to account ${accountId}`);
   }
-  const [deploymentPolicy] = await tx.execute(sql7`
+  const [deploymentPolicy] = await tx.execute(sql8`
     select
       max_nested_agent_depth as "maxNestedAgentDepth",
       policy_source as "policySource"
@@ -16433,7 +17040,7 @@ async function existingSessionForCreateKey(tx, workspaceId, createIdempotencyKey
 }
 async function lockSessionCreateIdempotencyKey(tx, workspaceId, createIdempotencyKey) {
   await tx.execute(
-    sql7`select pg_advisory_xact_lock(hashtext(${`session-create:${workspaceId}:${createIdempotencyKey}`}))`
+    sql8`select pg_advisory_xact_lock(hashtext(${`session-create:${workspaceId}:${createIdempotencyKey}`}))`
   );
 }
 async function existingSpawnDenialForKey(tx, workspaceId, createIdempotencyKey) {
@@ -16463,7 +17070,7 @@ async function recordSessionSpawnDenial(tx, input, decision) {
     idempotencyKey: input.createIdempotencyKey ?? null
   }).onConflictDoNothing({
     target: [sessionSpawnDenials.workspaceId, sessionSpawnDenials.idempotencyKey],
-    where: sql7`${sessionSpawnDenials.idempotencyKey} is not null`
+    where: sql8`${sessionSpawnDenials.idempotencyKey} is not null`
   }).returning();
   if (inserted) return mapSessionSpawnDenial(inserted);
   const key = input.createIdempotencyKey;
@@ -16780,12 +17387,12 @@ function sessionPersonalStateLockKey(workspaceId, subjectId) {
 }
 async function lockSessionPersonalStateShared(db, workspaceId, subjectId) {
   await db.execute(
-    sql7`select pg_advisory_xact_lock_shared(hashtextextended(${sessionPersonalStateLockKey(workspaceId, subjectId)}, 0))`
+    sql8`select pg_advisory_xact_lock_shared(hashtextextended(${sessionPersonalStateLockKey(workspaceId, subjectId)}, 0))`
   );
 }
 async function lockSessionPersonalStateExclusive(db, workspaceId, subjectId) {
   await db.execute(
-    sql7`select pg_advisory_xact_lock(hashtextextended(${sessionPersonalStateLockKey(workspaceId, subjectId)}, 0))`
+    sql8`select pg_advisory_xact_lock(hashtextextended(${sessionPersonalStateLockKey(workspaceId, subjectId)}, 0))`
   );
 }
 function mapSessionPin(row) {
@@ -16871,7 +17478,7 @@ async function sessionTreeStatsForSessions(db, workspaceId, rootIds) {
   }
   const rows = await rawRows(
     db,
-    sql7`
+    sql8`
       select
         root.id as "rootId",
         stats."directChildren",
@@ -16965,7 +17572,7 @@ async function sessionTreeStatsForSessions(db, workspaceId, rootIds) {
         from numbered
       ) stats
       where root.workspace_id = ${workspaceId}
-        and ${inArray5(sql7`root.id`, uniqueRootIds)}
+        and ${inArray5(sql8`root.id`, uniqueRootIds)}
     `
   );
   return new Map(
@@ -16986,7 +17593,7 @@ async function sessionTreeStatsForSessions(db, workspaceId, rootIds) {
 }
 function sessionFilters(options) {
   const filters = [
-    sql7`not exists (
+    sql8`not exists (
       select 1
       from ${slackInteractions} private_slack_interaction
       where private_slack_interaction.workspace_id = ${sessions.workspaceId}
@@ -17016,7 +17623,7 @@ function sessionFilters(options) {
   return filters;
 }
 function sessionAuthorizationScopeFilter(scope) {
-  if (scope.kind === "all") return sql7`true`;
+  if (scope.kind === "all") return sql8`true`;
   if (scope.rootSessionIds.length > SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS || scope.sessionIds.length > SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS) {
     throw new RangeError(
       `Session authorization scope exceeds ${SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS} ids per field`
@@ -17024,14 +17631,14 @@ function sessionAuthorizationScopeFilter(scope) {
   }
   const rootIds = [...new Set(scope.rootSessionIds)];
   const sessionIds = [...new Set(scope.sessionIds)];
-  if (rootIds.length === 0 && sessionIds.length === 0) return sql7`false`;
-  const exact = sessionIds.length > 0 ? inArray5(sessions.id, sessionIds) : sql7`false`;
-  const descendants = rootIds.length > 0 ? sql7`${sessions.id} in (
+  if (rootIds.length === 0 && sessionIds.length === 0) return sql8`false`;
+  const exact = sessionIds.length > 0 ? inArray5(sessions.id, sessionIds) : sql8`false`;
+  const descendants = rootIds.length > 0 ? sql8`${sessions.id} in (
           with recursive authorized_sessions(id) as (
             select root.id
             from ${sessions} root
             where root.workspace_id = ${sessions.workspaceId}
-              and ${inArray5(sql7`root.id`, rootIds)}
+              and ${inArray5(sql8`root.id`, rootIds)}
 
             union
 
@@ -17042,7 +17649,7 @@ function sessionAuthorizationScopeFilter(scope) {
              and child.parent_session_id = parent.id
           )
           select id from authorized_sessions
-        )` : sql7`false`;
+        )` : sql8`false`;
   return or3(exact, descendants);
 }
 async function sessionIdsCoveredByAuthorizationRoots(db, workspaceId, sessionIds, scope) {
@@ -17067,7 +17674,7 @@ var SESSION_LIST_SNAPSHOT_REUSE_MS = 5e3;
 var SESSION_LIST_SNAPSHOT_MAX_IDS = 5e3;
 var SESSION_LIST_SNAPSHOT_MAX_ACTIVE_PER_SUBJECT = 32;
 var SESSION_LIST_SERIALIZATION_MAX_ATTEMPTS = 3;
-var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function sessionParentFilter(parentSessionId) {
   return parentSessionId === void 0 ? "all" : parentSessionId === null ? "null" : parentSessionId;
 }
@@ -17080,7 +17687,7 @@ function sessionListSnapshotLockKey(workspaceId, subjectId) {
 }
 async function lockSessionListSnapshotCreation(db, workspaceId, subjectId) {
   await db.execute(
-    sql7`select pg_advisory_xact_lock(hashtextextended(${sessionListSnapshotLockKey(workspaceId, subjectId)}, 0))`
+    sql8`select pg_advisory_xact_lock(hashtextextended(${sessionListSnapshotLockKey(workspaceId, subjectId)}, 0))`
   );
 }
 function encodeSessionListCursor(cursor) {
@@ -17099,7 +17706,7 @@ function decodeSessionListCursor(value) {
     const parentSessionFilter = parsed.parentSessionFilter;
     const search = parsed.search;
     const offset = parsed.offset;
-    if (typeof parsed.snapshotId !== "string" || !UUID_PATTERN.test(parsed.snapshotId) || typeof offset !== "number" || !Number.isSafeInteger(offset) || offset < 0 || parentSessionFilter !== "all" && parentSessionFilter !== "null" && (typeof parentSessionFilter !== "string" || !UUID_PATTERN.test(parentSessionFilter)) || search !== null && (typeof search !== "string" || search.length > 200)) {
+    if (typeof parsed.snapshotId !== "string" || !UUID_PATTERN2.test(parsed.snapshotId) || typeof offset !== "number" || !Number.isSafeInteger(offset) || offset < 0 || parentSessionFilter !== "all" && parentSessionFilter !== "null" && (typeof parentSessionFilter !== "string" || !UUID_PATTERN2.test(parentSessionFilter)) || search !== null && (typeof search !== "string" || search.length > 200)) {
       return null;
     }
     return {
@@ -17115,7 +17722,7 @@ function decodeSessionListCursor(value) {
 async function reapExpiredSessionListSnapshots(db, limit = 500) {
   const rows = await rawRows(
     db,
-    sql7`select opengeni_private.reap_expired_session_list_snapshots(${limit}) as deleted_count`
+    sql8`select opengeni_private.reap_expired_session_list_snapshots(${limit}) as deleted_count`
   );
   return Number(rows[0]?.deleted_count ?? 0);
 }
@@ -17280,7 +17887,7 @@ async function listSessionsForSubject(db, workspaceId, options) {
           if (ordinaryIds.length > limit) {
             let snapshot = reusableSnapshot;
             if (!snapshot) {
-              await tx.execute(sql7`
+              await tx.execute(sql8`
                 delete from ${sessionListSnapshots} snapshot
                 where snapshot.workspace_id = ${workspaceId}
                   and snapshot.subject_id = ${options.subjectId}
@@ -17412,7 +18019,7 @@ async function getSessionForSubject(db, workspaceId, sessionId, subjectId, relat
       and10(
         eq10(sessions.workspaceId, workspaceId),
         eq10(sessions.id, sessionId),
-        sql7`not exists (
+        sql8`not exists (
             select 1
             from ${slackInteractions} private_slack_interaction
             where private_slack_interaction.workspace_id = ${sessions.workspaceId}
@@ -17500,7 +18107,7 @@ async function setSessionPin(db, input) {
         const [updated] = await tx.update(sessionPins).set({
           pinned: input.pinned,
           pinnedAt: input.pinned ? /* @__PURE__ */ new Date() : null,
-          version: sql7`${sessionPins.version} + 1`
+          version: sql8`${sessionPins.version} + 1`
         }).where(
           and10(
             eq10(sessionPins.workspaceId, input.workspaceId),
@@ -17582,7 +18189,7 @@ function normalizeSessionActivityRevision(value, label) {
   return revision.toString();
 }
 async function lockWorkspaceSessionActivityRevision(db, workspaceId) {
-  await db.execute(sql7`
+  await db.execute(sql8`
     insert into ${workspaceSessionActivityRevisions} (
       workspace_id, account_id, revision
     )
@@ -17591,7 +18198,7 @@ async function lockWorkspaceSessionActivityRevision(db, workspaceId) {
     where ${workspaces.id} = ${workspaceId}
     on conflict (workspace_id) do nothing
   `);
-  const rows = await db.execute(sql7`
+  const rows = await db.execute(sql8`
     select revision::text as revision
     from ${workspaceSessionActivityRevisions}
     where workspace_id = ${workspaceId}
@@ -17620,7 +18227,7 @@ async function listSessionDiscoverySummaries(db, workspaceId, options) {
     }
     const snapshotAt = options.cursor?.snapshotAt ?? (await rawRows(
       scopedDb,
-      sql7`select to_char(statement_timestamp() at time zone 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"') as value`
+      sql8`select to_char(statement_timestamp() at time zone 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"') as value`
     ))[0].value;
     const needsUpdatedSnapshot = orderBy === "updatedAt" && options.cursor?.snapshotRevision === void 0;
     if (needsUpdatedSnapshot) {
@@ -17635,13 +18242,13 @@ async function listSessionDiscoverySummaries(db, workspaceId, options) {
       throw new Error("sessions_list created-order cursor cannot carry activity revisions");
     }
     const cursorPredicate = options.cursor ? orderBy === "updatedAt" ? or3(
-      sql7`${sessions.activityRevision} < ${cursorSortRevision}::text::bigint`,
+      sql8`${sessions.activityRevision} < ${cursorSortRevision}::text::bigint`,
       and10(
-        sql7`${sessions.activityRevision} = ${cursorSortRevision}::text::bigint`,
+        sql8`${sessions.activityRevision} = ${cursorSortRevision}::text::bigint`,
         or3(
-          sql7`${sessions.updatedAt} < ${options.cursor.sortAt}::text::timestamptz`,
+          sql8`${sessions.updatedAt} < ${options.cursor.sortAt}::text::timestamptz`,
           and10(
-            sql7`${sessions.updatedAt} = ${options.cursor.sortAt}::text::timestamptz`,
+            sql8`${sessions.updatedAt} = ${options.cursor.sortAt}::text::timestamptz`,
             lt4(sessions.id, options.cursor.id)
           )
         )
@@ -17650,9 +18257,9 @@ async function listSessionDiscoverySummaries(db, workspaceId, options) {
       // Cast through text deliberately. postgres.js otherwise infers a
       // timestamptz parameter and serializes this exact cursor string via
       // JS Date, which discards PostgreSQL's sub-millisecond precision.
-      sql7`${sessions.createdAt} < ${options.cursor.sortAt}::text::timestamptz`,
+      sql8`${sessions.createdAt} < ${options.cursor.sortAt}::text::timestamptz`,
       and10(
-        sql7`${sessions.createdAt} = ${options.cursor.sortAt}::text::timestamptz`,
+        sql8`${sessions.createdAt} = ${options.cursor.sortAt}::text::timestamptz`,
         lt4(sessions.id, options.cursor.id)
       )
     ) : void 0;
@@ -17661,23 +18268,23 @@ async function listSessionDiscoverySummaries(db, workspaceId, options) {
       snapshotFilters.push(sessionAuthorizationScopeFilter(options.authorizationScope));
     }
     snapshotFilters.push(
-      orderBy === "updatedAt" ? sql7`${sessions.activityRevision} <= ${snapshotRevision}::text::bigint` : sql7`${sessions.createdAt} <= ${snapshotAt}::text::timestamptz`
+      orderBy === "updatedAt" ? sql8`${sessions.activityRevision} <= ${snapshotRevision}::text::bigint` : sql8`${sessions.createdAt} <= ${snapshotAt}::text::timestamptz`
     );
     if (updatedAfter !== null) {
       snapshotFilters.push(
-        sql7`${sessions.activityRevision} > ${updatedAfter}::text::bigint`
+        sql8`${sessions.activityRevision} > ${updatedAfter}::text::bigint`
       );
     }
     const rows = await scopedDb.select({
       id: sessions.id,
-      title: sql7`left(${sessions.title}, ${SESSION_DISCOVERY_CONTROL_TITLE_MAX_CHARS})`,
-      titleOriginalChars: sql7`char_length(${sessions.title})::integer`,
+      title: sql8`left(${sessions.title}, ${SESSION_DISCOVERY_CONTROL_TITLE_MAX_CHARS})`,
+      titleOriginalChars: sql8`char_length(${sessions.title})::integer`,
       parentSessionId: sessions.parentSessionId,
       status: sessions.status,
       createdAt: sessions.createdAt,
       updatedAt: sessions.updatedAt,
-      sortRevision: orderBy === "updatedAt" ? sql7`${sessions.activityRevision}::text` : sql7`'0'`,
-      sortAt: orderBy === "updatedAt" ? sql7`to_char(${sessions.updatedAt} at time zone 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"')` : sql7`to_char(${sessions.createdAt} at time zone 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"')`
+      sortRevision: orderBy === "updatedAt" ? sql8`${sessions.activityRevision}::text` : sql8`'0'`,
+      sortAt: orderBy === "updatedAt" ? sql8`to_char(${sessions.updatedAt} at time zone 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"')` : sql8`to_char(${sessions.createdAt} at time zone 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"')`
     }).from(sessions).where(and10(...snapshotFilters, cursorPredicate)).orderBy(
       ...orderBy === "updatedAt" ? [
         desc5(sessions.activityRevision),
@@ -17688,7 +18295,7 @@ async function listSessionDiscoverySummaries(db, workspaceId, options) {
     const hasMore = rows.length > limit;
     const page = rows.slice(0, limit);
     const ids = page.map((row) => row.id);
-    const [{ total } = { total: 0 }] = await scopedDb.select({ total: sql7`count(*)::int` }).from(sessions).where(and10(...snapshotFilters));
+    const [{ total } = { total: 0 }] = await scopedDb.select({ total: sql8`count(*)::int` }).from(sessions).where(and10(...snapshotFilters));
     if (ids.length === 0) {
       return {
         sessions: [],
@@ -17713,8 +18320,8 @@ async function listSessionDiscoverySummaries(db, workspaceId, options) {
     const goals = await scopedDb.select({
       sessionId: sessionGoals.sessionId,
       status: sessionGoals.status,
-      text: sql7`left(${sessionGoals.text}, ${SESSION_DISCOVERY_GOAL_MAX_CHARS})`,
-      textOriginalChars: sql7`char_length(${sessionGoals.text})::integer`
+      text: sql8`left(${sessionGoals.text}, ${SESSION_DISCOVERY_GOAL_MAX_CHARS})`,
+      textOriginalChars: sql8`char_length(${sessionGoals.text})::integer`
     }).from(sessionGoals).where(
       and10(
         eq10(sessionGoals.workspaceId, workspaceId),
@@ -17724,7 +18331,7 @@ async function listSessionDiscoverySummaries(db, workspaceId, options) {
     const goalsBySession = new Map(goals.map((goal) => [goal.sessionId, goal]));
     const queueCounts = await scopedDb.select({
       sessionId: sessionTurns.sessionId,
-      count: sql7`count(*)::int`
+      count: sql8`count(*)::int`
     }).from(sessionTurns).where(
       and10(
         eq10(sessionTurns.workspaceId, workspaceId),
@@ -17742,12 +18349,12 @@ async function listSessionDiscoverySummaries(db, workspaceId, options) {
       // Extract only the bounded textual preview in PostgreSQL. Selecting
       // the JSON payload here would re-materialize the exact multi-MB
       // event bodies this compact discovery path exists to avoid.
-      preview: sql7`left(coalesce(
+      preview: sql8`left(coalesce(
               ${sessionEvents.payload}->>'text',
               ${sessionEvents.payload}->>'message',
               ${sessionEvents.payload}->>'content'
             ), ${SESSION_DISCOVERY_MESSAGE_MAX_CHARS})`,
-      previewOriginalChars: sql7`char_length(coalesce(
+      previewOriginalChars: sql8`char_length(coalesce(
               ${sessionEvents.payload}->>'text',
               ${sessionEvents.payload}->>'message',
               ${sessionEvents.payload}->>'content'
@@ -17819,7 +18426,7 @@ async function listSessionDiscoverySummaries(db, workspaceId, options) {
 }
 async function getSessionRootId(db, workspaceId, sessionId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const rows = await scopedDb.execute(sql7`
+    const rows = await scopedDb.execute(sql8`
       with recursive lineage(id, parent_session_id, depth, path, cycle) as (
         select
           ${sessions.id},
@@ -17863,7 +18470,7 @@ async function getSessionRootId(db, workspaceId, sessionId) {
 async function getSessionLineage(db, workspaceId, sessionId) {
   const descendantLimit = 200;
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const rootRows = await scopedDb.execute(sql7`
+    const rootRows = await scopedDb.execute(sql8`
       select id from ${sessions}
       where ${sessions.workspaceId} = ${workspaceId} and ${sessions.id} = ${sessionId}
       limit 1
@@ -17871,7 +18478,7 @@ async function getSessionLineage(db, workspaceId, sessionId) {
     if (rootRows.length === 0) {
       return null;
     }
-    const ancestorLineageRows = await scopedDb.execute(sql7`
+    const ancestorLineageRows = await scopedDb.execute(sql8`
       with recursive ancestors(id, parent_session_id, depth, path, cycle) as (
         select ${sessions.id}, ${sessions.parentSessionId}, 0, array[${sessions.id}], false
         from ${sessions}
@@ -17899,7 +18506,7 @@ async function getSessionLineage(db, workspaceId, sessionId) {
       throw new Error(`session lineage for ${sessionId} has no valid workspace root`);
     }
     const ancestorRows = ancestorLineageRows.filter((row) => row.depth > 0);
-    const childRows = await scopedDb.execute(sql7`
+    const childRows = await scopedDb.execute(sql8`
       with recursive descendants(id, parent_session_id, depth, path) as (
         select child.id, child.parent_session_id, 1, array[${sessionId}, child.id]
         from ${sessions} child
@@ -17963,7 +18570,7 @@ async function getSessionLineage(db, workspaceId, sessionId) {
 async function countActiveSessionsForWorkspace(db, workspaceId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [{ count } = { count: 0 }] = await scopedDb.select({
-      count: sql7`count(*)::int`
+      count: sql8`count(*)::int`
     }).from(sessions).where(
       and10(
         eq10(sessions.workspaceId, workspaceId),
@@ -18092,48 +18699,48 @@ async function listSessionEventPage(db, workspaceId, sessionId, options = {}) {
   });
 }
 function sessionEventProjectionSelect(payloadMode = "full") {
-  const typeInvalid = sql7`(
+  const typeInvalid = sql8`(
     octet_length(${sessionEvents.type}) > ${SESSION_EVENT_TYPE_MAX_BYTES}
     or position(E'\\n' in ${sessionEvents.type}) > 0
     or position(E'\\r' in ${sessionEvents.type}) > 0
   )`;
-  const clientEventIdInvalid = sql7`(
+  const clientEventIdInvalid = sql8`(
     ${sessionEvents.clientEventId} is not null
     and octet_length(${sessionEvents.clientEventId})
       > ${SESSION_EVENT_CLIENT_EVENT_ID_MAX_BYTES}
   )`;
-  const turnAssociationInvalid = sql7`(
+  const turnAssociationInvalid = sql8`(
     ${sessionEvents.turnAssociation} is not null
     and ${sessionEvents.turnAssociation} not in (
       'current', 'late_rejected', 'duplicate'
     )
   )`;
-  const duplicateReasonInvalid = sql7`(
+  const duplicateReasonInvalid = sql8`(
     ${sessionEvents.duplicateReason} is not null
     and octet_length(${sessionEvents.duplicateReason})
       > ${SESSION_EVENT_DUPLICATE_REASON_MAX_BYTES}
   )`;
-  const envelopeInvalid = sql7`(
+  const envelopeInvalid = sql8`(
     ${typeInvalid} or ${clientEventIdInvalid}
     or ${turnAssociationInvalid} or ${duplicateReasonInvalid}
   )`;
-  const projectedType = sql7`case
+  const projectedType = sql8`case
     when ${typeInvalid} then 'session.event.envelope_omitted'
     else ${sessionEvents.type}
   end`;
-  const projectedClientEventId = sql7`case
+  const projectedClientEventId = sql8`case
     when ${clientEventIdInvalid} then left(${sessionEvents.clientEventId}, 256)
     else ${sessionEvents.clientEventId}
   end`;
-  const projectedTurnAssociation = sql7`case
+  const projectedTurnAssociation = sql8`case
     when ${turnAssociationInvalid} then null
     else ${sessionEvents.turnAssociation}
   end`;
-  const projectedDuplicateReason = sql7`case
+  const projectedDuplicateReason = sql8`case
     when ${duplicateReasonInvalid} then left(${sessionEvents.duplicateReason}, 1024)
     else ${sessionEvents.duplicateReason}
   end`;
-  const projectedEnvelopeFields = sql7`(
+  const projectedEnvelopeFields = sql8`(
     '[]'::jsonb
     || case when ${typeInvalid} then jsonb_build_array(jsonb_build_object(
       'field', 'type',
@@ -18156,7 +18763,7 @@ function sessionEventProjectionSelect(payloadMode = "full") {
       'deliveredBytes', octet_length(${projectedDuplicateReason})
     )) else '[]'::jsonb end
   )`;
-  const projectedPayload = sql7`case
+  const projectedPayload = sql8`case
     when ${envelopeInvalid} then jsonb_build_object(
       'preview', '[legacy event envelope normalized at bounded database read boundary]',
       'originalEventBytes', octet_length(row_to_json(${sessionEvents})::text),
@@ -18170,14 +18777,14 @@ function sessionEventProjectionSelect(payloadMode = "full") {
     )
     else opengeni_private.project_session_event_payload(${sessionEvents.payload})
   end`;
-  const projectedPayloadBytes = sql7`octet_length((${projectedPayload})::text)`;
-  const selectedPayload = payloadMode === "none" ? sql7`jsonb_build_object(
+  const projectedPayloadBytes = sql8`octet_length((${projectedPayload})::text)`;
+  const selectedPayload = payloadMode === "none" ? sql8`jsonb_build_object(
           '_monitoring', jsonb_build_object(
             'payloadMode', 'none',
             'payloadOmitted', true,
             'projectedPayloadBytes', ${projectedPayloadBytes}
           )
-        )` : payloadMode === "summary" ? sql7`case
+        )` : payloadMode === "summary" ? sql8`case
             when ${projectedPayloadBytes} <= 4096 then ${projectedPayload}
             else jsonb_build_object(
               '_monitoring', jsonb_build_object(
@@ -18277,7 +18884,7 @@ async function reserveToolspaceCallForAttempt(db, input) {
         return { reserved: false, reason: "budget_exhausted" };
       }
       const [row] = await tx.update(sessionTurns).set({
-        toolspaceCallCount: sql7`${sessionTurns.toolspaceCallCount} + 1`
+        toolspaceCallCount: sql8`${sessionTurns.toolspaceCallCount} + 1`
       }).where(
         and10(
           eq10(sessionTurns.workspaceId, input.workspaceId),
@@ -18285,7 +18892,7 @@ async function reserveToolspaceCallForAttempt(db, input) {
           eq10(sessionTurns.id, input.turnId),
           eq10(sessionTurns.executionGeneration, input.executionGeneration),
           eq10(sessionTurns.activeAttemptId, input.attemptId),
-          sql7`${sessionTurns.toolspaceCallCount} < ${input.limit}`
+          sql8`${sessionTurns.toolspaceCallCount} < ${input.limit}`
         )
       ).returning({ count: sessionTurns.toolspaceCallCount });
       if (!row) {
@@ -19058,7 +19665,7 @@ async function recordPendingSessionToolCallResult(db, input) {
       }).where(
         and10(
           eq10(sessionPendingToolCalls.id, pending.id),
-          sql7`${sessionPendingToolCalls.resultItem} is null`
+          sql8`${sessionPendingToolCalls.resultItem} is null`
         )
       ).returning({ id: sessionPendingToolCalls.id });
       return {
@@ -19088,7 +19695,7 @@ async function clearDurablePendingSessionToolCalls(db, input) {
           eq10(sessionPendingToolCalls.sessionId, input.sessionId),
           eq10(sessionPendingToolCalls.turnId, input.turnId),
           inArray5(sessionPendingToolCalls.callId, input.callIds),
-          sql7`${sessionPendingToolCalls.resultItem} is not null`
+          sql8`${sessionPendingToolCalls.resultItem} is not null`
         )
       ).for("update");
       if (pending.length === 0) return { accepted: true, cleared: 0 };
@@ -19155,7 +19762,7 @@ async function getActiveSessionHistoryItems(db, workspaceId, sessionId) {
 async function countActiveSessionHistoryItems(db, workspaceId, sessionId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [row] = await scopedDb.select({
-      count: sql7`count(*)`
+      count: sql8`count(*)`
     }).from(sessionHistoryItems).where(
       and10(
         eq10(sessionHistoryItems.workspaceId, workspaceId),
@@ -19238,7 +19845,7 @@ async function applyContextCompaction(db, input) {
           return { applied: false, reason: fence.reason };
         }
         const [{ maxPosition } = { maxPosition: -1 }] = await tx.select({
-          maxPosition: sql7`coalesce(max(${sessionHistoryItems.position}), -1)`
+          maxPosition: sql8`coalesce(max(${sessionHistoryItems.position}), -1)`
         }).from(sessionHistoryItems).where(
           and10(
             eq10(sessionHistoryItems.workspaceId, input.workspaceId),
@@ -19412,7 +20019,7 @@ async function recordSkippedContextCompaction(db, input) {
 async function nextSessionHistoryPosition(db, workspaceId, sessionId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [row] = await scopedDb.select({
-      maxPosition: sql7`max(${sessionHistoryItems.position})`
+      maxPosition: sql8`max(${sessionHistoryItems.position})`
     }).from(sessionHistoryItems).where(
       and10(
         eq10(sessionHistoryItems.workspaceId, workspaceId),
@@ -19483,7 +20090,7 @@ async function clearSessionContext(db, input) {
           )
         ).returning({ id: sessionHistoryItems.id });
         const [{ maxPosition } = { maxPosition: -1 }] = await tx.select({
-          maxPosition: sql7`coalesce(max(${sessionHistoryItems.position}), -1)`
+          maxPosition: sql8`coalesce(max(${sessionHistoryItems.position}), -1)`
         }).from(sessionHistoryItems).where(
           and10(
             eq10(sessionHistoryItems.workspaceId, input.workspaceId),
@@ -19520,7 +20127,7 @@ async function clearSessionContext(db, input) {
 async function countSessionHistoryItems(db, workspaceId, sessionId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [row] = await scopedDb.select({
-      count: sql7`count(*)`
+      count: sql8`count(*)`
     }).from(sessionHistoryItems).where(
       and10(
         eq10(sessionHistoryItems.workspaceId, workspaceId),
@@ -19692,7 +20299,7 @@ async function abandonRecordingForTurnAttempt(db, input) {
           eq10(sessionEvents.turnAttemptId, input.attemptId),
           eq10(sessionEvents.turnAssociation, "current"),
           eq10(sessionEvents.type, "recording.started"),
-          eq10(sql7`${sessionEvents.payload} ->> 'recordingId'`, input.recordingId)
+          eq10(sql8`${sessionEvents.payload} ->> 'recordingId'`, input.recordingId)
         )
       ).limit(1);
       if (!started) return false;
@@ -20079,20 +20686,20 @@ function archiveProjectionFromResumeState(resumeState) {
   };
 }
 async function recomputeAndStampLease(tx, leaseId, leaseTtlMs, setLiveness) {
-  const counts = await tx.execute(sql7`
+  const counts = await tx.execute(sql8`
     select count(*)::int as total,
            count(*) filter (where kind = 'turn')::int   as turns,
            count(*) filter (where kind = 'viewer')::int as viewers
     from sandbox_lease_holders where lease_id = ${leaseId}
   `);
   const c = counts[0];
-  const updated = await tx.execute(sql7`
+  const updated = await tx.execute(sql8`
     update sandbox_leases set
       refcount       = ${c.total},
       turn_holders   = ${c.turns},
       viewer_holders = ${c.viewers},
       expires_at     = now() + (${String(leaseTtlMs)} || ' milliseconds')::interval,
-      ${setLiveness ? sql7`liveness = ${setLiveness},` : sql7``}
+      ${setLiveness ? sql8`liveness = ${setLiveness},` : sql8``}
       updated_at     = now()
     where id = ${leaseId}
     returning *
@@ -20100,7 +20707,7 @@ async function recomputeAndStampLease(tx, leaseId, leaseTtlMs, setLiveness) {
   return updated[0];
 }
 async function upsertLeaseHolder(tx, leaseId, accountId, workspaceId, kind, holderId, subjectId) {
-  await tx.execute(sql7`
+  await tx.execute(sql8`
     insert into sandbox_lease_holders
       (account_id, workspace_id, lease_id, kind, holder_id, subject_id, last_heartbeat_at)
     values (${accountId}, ${workspaceId}, ${leaseId}, ${kind}, ${holderId}, ${subjectId}, now())
@@ -20123,7 +20730,7 @@ async function acquireLeaseOnce(db, input) {
       const tx = txRaw;
       const image = input.image ?? null;
       const rigVersionId = input.rigVersionId ?? null;
-      await tx.execute(sql7`
+      await tx.execute(sql8`
         insert into sandbox_leases
           (account_id, workspace_id, sandbox_group_id, liveness, backend, os, image, rig_version_id, expires_at)
         values
@@ -20131,7 +20738,7 @@ async function acquireLeaseOnce(db, input) {
            now() + (${String(input.leaseTtlMs)} || ' milliseconds')::interval)
         on conflict (workspace_id, sandbox_group_id) do nothing
       `);
-      const rows = await tx.execute(sql7`
+      const rows = await tx.execute(sql8`
         select *, (liveness = 'draining' and expires_at <= now()) as draining_expired
         from sandbox_leases
         where workspace_id = ${workspaceId} and sandbox_group_id = ${sandboxGroupId}
@@ -20141,7 +20748,7 @@ async function acquireLeaseOnce(db, input) {
       if (!row) throw new Error(`Lease row vanished post-insert: ${sandboxGroupId}`);
       const liveness = row.liveness;
       if (kind === "viewer" && Number(row.turn_holders) === 0) {
-        const workspaceRows = await tx.execute(sql7`
+        const workspaceRows = await tx.execute(sql8`
             select sandbox_viewer_force_drain_reason
             from workspaces
             where id = ${workspaceId}
@@ -20163,7 +20770,7 @@ async function acquireLeaseOnce(db, input) {
       const imageConflict = image !== null && row.image !== null && row.image !== image;
       const rigConflict = rigVersionId !== null && row.rig_version_id !== null && row.rig_version_id !== rigVersionId;
       if (liveness !== "cold" && (imageConflict || rigConflict)) {
-        const others = await tx.execute(sql7`
+        const others = await tx.execute(sql8`
           select count(*)::int as n from sandbox_lease_holders
           where lease_id = ${row.id} and not (kind = ${kind} and holder_id = ${holderId})
         `);
@@ -20182,7 +20789,7 @@ async function acquireLeaseOnce(db, input) {
             rigVersionId
           );
         }
-        const rotating = await tx.execute(sql7`
+        const rotating = await tx.execute(sql8`
           update sandbox_leases set
             rotation_requested_at = coalesce(rotation_requested_at, now()),
             rotation_reason = coalesce(rotation_reason, 'operator'),
@@ -20210,11 +20817,11 @@ async function acquireLeaseOnce(db, input) {
             lease: mapLeaseRow(row)
           };
         }
-        const casRows = await tx.execute(sql7`
+        const casRows = await tx.execute(sql8`
           update sandbox_leases set
             liveness = 'warming',
-            ${image !== null ? sql7`image = ${image},` : sql7``}
-            ${rigVersionId !== null ? sql7`rig_version_id = ${rigVersionId},` : sql7``}
+            ${image !== null ? sql8`image = ${image},` : sql8``}
+            ${rigVersionId !== null ? sql8`rig_version_id = ${rigVersionId},` : sql8``}
             updated_at = now()
           where id = ${row.id} and liveness = 'cold'
           returning id
@@ -20278,7 +20885,7 @@ async function beginSandboxRematerialization(db, input) {
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
       const tx = txRaw;
-      const rows = await tx.execute(sql7`
+      const rows = await tx.execute(sql8`
           select * from sandbox_leases
           where workspace_id = ${input.workspaceId}
             and sandbox_group_id = ${input.sandboxGroupId}
@@ -20366,7 +20973,7 @@ async function beginSandboxRematerialization(db, input) {
             }
           };
           const degradedResumeState = resumeStateWithRecovery(workingResumeState, degraded);
-          const degradedRows = await tx.execute(sql7`
+          const degradedRows = await tx.execute(sql8`
               update sandbox_leases set
                 resume_state = ${JSON.stringify(degradedResumeState)}::jsonb,
                 resume_backend_id = coalesce(resume_backend_id, backend),
@@ -20386,7 +20993,7 @@ async function beginSandboxRematerialization(db, input) {
       }
       let checkpointArtifact = null;
       if (workingRow.current_checkpoint_artifact_id !== null) {
-        const artifactRows = await tx.execute(sql7`
+        const artifactRows = await tx.execute(sql8`
             select id, account_id, workspace_id, sandbox_group_id,
               source_lease_id, source_workspace_generation, provenance, provider_backend,
               provider_binding_key, provider_binding, object_kind, object_id,
@@ -20428,7 +21035,7 @@ async function beginSandboxRematerialization(db, input) {
               verifiedAt: null
             }
           };
-          const degradedRows = await tx.execute(sql7`
+          const degradedRows = await tx.execute(sql8`
               update sandbox_leases set
                 resume_state = ${JSON.stringify(
             resumeStateWithRecovery(workingResumeState, degraded)
@@ -20494,10 +21101,10 @@ async function beginSandboxRematerialization(db, input) {
       const resumeStateJson = JSON.stringify(
         resumeStateWithRecovery(workingResumeState, recovery)
       );
-      const updated = await tx.execute(sql7`
+      const updated = await tx.execute(sql8`
           update sandbox_leases set
             resume_state = ${resumeStateJson}::jsonb,
-            ${importedArchiveGeneration ? sql7`archive_generation = workspace_generation,` : sql7``}
+            ${importedArchiveGeneration ? sql8`archive_generation = workspace_generation,` : sql8``}
             updated_at = now()
           where id = ${row.id}
             and liveness = 'warming'
@@ -20521,7 +21128,7 @@ async function markSandboxRestoreVerifying(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const rows = await scopedDb.execute(sql7`
+      const rows = await scopedDb.execute(sql8`
         update sandbox_leases set
           resume_state = jsonb_set(resume_state, '{opengeniRecovery,restore,status}', '"verifying"'::jsonb),
           updated_at = now()
@@ -20543,7 +21150,7 @@ async function failSandboxRematerialization(db, input) {
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
       const tx = txRaw;
-      const rows = await tx.execute(sql7`
+      const rows = await tx.execute(sql8`
           select * from sandbox_leases
           where workspace_id = ${input.workspaceId}
             and sandbox_group_id = ${input.sandboxGroupId}
@@ -20576,7 +21183,7 @@ async function failSandboxRematerialization(db, input) {
         }
       };
       const resumeStateJson = JSON.stringify(archiveOnlyResumeState(row, recovery));
-      const updated = await tx.execute(sql7`
+      const updated = await tx.execute(sql8`
           update sandbox_leases set
             liveness = 'cold',
             instance_id = null,
@@ -20608,7 +21215,7 @@ async function markSandboxProviderReady(db, input) {
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
       const tx = txRaw;
-      const rows = await tx.execute(sql7`
+      const rows = await tx.execute(sql8`
           select * from sandbox_leases
           where workspace_id = ${input.workspaceId}
             and sandbox_group_id = ${input.sandboxGroupId}
@@ -20641,7 +21248,7 @@ async function markSandboxProviderReady(db, input) {
         }
       };
       const resumeStateJson = JSON.stringify(resumeStateWithRecovery(row.resume_state, recovery));
-      const updated = await tx.execute(sql7`
+      const updated = await tx.execute(sql8`
           update sandbox_leases set resume_state = ${resumeStateJson}::jsonb, updated_at = now()
           where id = ${row.id}
             and liveness = 'warm'
@@ -20659,7 +21266,7 @@ async function commitWarmingToWarm(db, input) {
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
       const tx = txRaw;
-      const rows = await tx.execute(sql7`
+      const rows = await tx.execute(sql8`
           select * from sandbox_leases
           where workspace_id = ${input.workspaceId}
             and sandbox_group_id = ${input.sandboxGroupId}
@@ -20748,7 +21355,7 @@ async function commitWarmingToWarm(db, input) {
         row.resume_state
       );
       const resumeStateJson = JSON.stringify(resumeStateWithRecovery(withArchives, recovery));
-      const updated = await tx.execute(sql7`
+      const updated = await tx.execute(sql8`
           update sandbox_leases set
             liveness          = 'warm',
             instance_id       = ${input.instanceId},
@@ -20781,7 +21388,7 @@ async function recordWarmingSandboxCreated(db, input) {
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
       const tx = txRaw;
-      const rows = await tx.execute(sql7`
+      const rows = await tx.execute(sql8`
           select * from sandbox_leases
           where workspace_id = ${input.workspaceId}
             and sandbox_group_id = ${input.sandboxGroupId}
@@ -20824,7 +21431,7 @@ async function recordWarmingSandboxCreated(db, input) {
       if (providerCreatedAt && providerDeadlineAt && providerDeadlineAt.getTime() <= providerCreatedAt.getTime()) {
         throw new Error("Provider deadline must be later than provider creation");
       }
-      const updated = await tx.execute(sql7`
+      const updated = await tx.execute(sql8`
           update sandbox_leases set
             instance_id       = ${input.instanceId},
             resume_backend_id = ${input.resumeBackendId ?? null},
@@ -20899,18 +21506,18 @@ function archiveSessionState(row) {
   return sessionState && typeof sessionState === "object" ? sessionState : null;
 }
 async function readColdLostSnapshotRowsTx(tx, input) {
-  const timestampRows = await tx.execute(sql7`
+  const timestampRows = await tx.execute(sql8`
     select transaction_timestamp() as snapshot_at
   `);
   const [sessionRows, leaseRows] = await Promise.all([
-    tx.execute(sql7`
+    tx.execute(sql8`
       select id, status, sandbox_group_id, active_sandbox_id, active_epoch
       from sessions
       where account_id = ${input.accountId}
         and workspace_id = ${input.workspaceId}
         and id = ${input.sessionId}
     `),
-    tx.execute(sql7`
+    tx.execute(sql8`
       select * from sandbox_leases
       where account_id = ${input.accountId}
         and workspace_id = ${input.workspaceId}
@@ -20934,7 +21541,7 @@ async function readColdLostSnapshotRowsTx(tx, input) {
     };
   }
   const [processes, admissions, ptys, holders, interruptions] = await Promise.all([
-    tx.execute(sql7`
+    tx.execute(sql8`
       select id,
         session_id as "sessionId",
         parent_admission_id as "parentAdmissionId",
@@ -20967,7 +21574,7 @@ async function readColdLostSnapshotRowsTx(tx, input) {
         ))
       order by id
     `),
-    tx.execute(sql7`
+    tx.execute(sql8`
       select id,
         session_id as "sessionId",
         actor_kind as "actorKind",
@@ -21002,7 +21609,7 @@ async function readColdLostSnapshotRowsTx(tx, input) {
         ))
       order by id
     `),
-    tx.execute(sql7`
+    tx.execute(sql8`
       select id,
         session_id as "sessionId",
         retained_process_id as "retainedProcessId",
@@ -21030,7 +21637,7 @@ async function readColdLostSnapshotRowsTx(tx, input) {
         ))
       order by id
     `),
-    tx.execute(sql7`
+    tx.execute(sql8`
       select holder.id,
         holder.kind,
         holder.holder_id,
@@ -21052,7 +21659,7 @@ async function readColdLostSnapshotRowsTx(tx, input) {
         and holder.lease_id = ${lease.id}
       order by holder.kind, holder.holder_id
     `),
-    tx.execute(sql7`
+    tx.execute(sql8`
       select interruption.id,
         interruption.session_id as "sessionId",
         interruption.operation_id as "operationId",
@@ -21686,7 +22293,7 @@ function evaluateColdLostSnapshot(input, rows, database, options = { requireRead
   };
 }
 async function readColdLostDatabasePostureTx(tx) {
-  const postureRows = await tx.execute(sql7`
+  const postureRows = await tx.execute(sql8`
     select current_user as role,
       coalesce((select rolsuper from pg_roles where rolname = current_user), true) as role_superuser,
       coalesce((select rolbypassrls from pg_roles where rolname = current_user), true) as role_bypass_rls,
@@ -21737,7 +22344,7 @@ async function previewColdLostLeaseInstanceBlockers(db, input) {
 }
 var LOST_PROVIDER_PROCESS_REASON = "provider_instance_lost";
 async function lockExactLostProviderWorkspaceBlockersTx(tx, input) {
-  await tx.execute(sql7`
+  await tx.execute(sql8`
     select id from sandbox_retained_processes
     where account_id = ${input.accountId}
       and workspace_id = ${input.workspaceId}
@@ -21749,7 +22356,7 @@ async function lockExactLostProviderWorkspaceBlockersTx(tx, input) {
     order by id
     for update
   `);
-  await tx.execute(sql7`
+  await tx.execute(sql8`
     select id from sandbox_workspace_mutation_admissions
     where account_id = ${input.accountId}
       and workspace_id = ${input.workspaceId}
@@ -21761,7 +22368,7 @@ async function lockExactLostProviderWorkspaceBlockersTx(tx, input) {
     order by id
     for update
   `);
-  await tx.execute(sql7`
+  await tx.execute(sql8`
     select id from sandbox_pty_sessions
     where account_id = ${input.accountId}
       and workspace_id = ${input.workspaceId}
@@ -21828,7 +22435,7 @@ async function settleExactLostProviderWorkspaceBlockersTx(tx, input) {
       )
     )
   ).returning({ holderId: sandboxLeaseHolders.holderId });
-  await tx.execute(sql7`
+  await tx.execute(sql8`
     update sandbox_leases as lease set
       refcount = counts.total,
       turn_holders = counts.turns,
@@ -21856,7 +22463,7 @@ async function markWarmLeaseInstanceLost(db, input) {
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
       const tx = txRaw;
-      const observedRows = await tx.execute(sql7`
+      const observedRows = await tx.execute(sql8`
           select * from sandbox_leases
           where workspace_id = ${input.workspaceId}
             and sandbox_group_id = ${input.sandboxGroupId}
@@ -21877,7 +22484,7 @@ async function markWarmLeaseInstanceLost(db, input) {
         lostInstanceId: input.expectedInstanceId
       };
       await lockExactLostProviderWorkspaceBlockersTx(tx, blockerScope);
-      const currentRows = await tx.execute(sql7`
+      const currentRows = await tx.execute(sql8`
           select * from sandbox_leases
           where workspace_id = ${input.workspaceId}
             and sandbox_group_id = ${input.sandboxGroupId}
@@ -21924,7 +22531,7 @@ async function markWarmLeaseInstanceLost(db, input) {
       };
       const coldResumeState = archiveOnlyResumeState(current, recovery);
       const coldResumeStateJson = JSON.stringify(coldResumeState);
-      const updatedRows = await tx.execute(sql7`
+      const updatedRows = await tx.execute(sql8`
           update sandbox_leases set
             liveness = 'cold',
             instance_id = null,
@@ -22030,7 +22637,7 @@ async function reconcileColdLostLeaseInstanceBlockers(db, input) {
         lostInstanceId: input.expectedLostInstanceId
       };
       await lockExactLostProviderWorkspaceBlockersTx(tx, blockerScope);
-      const currentRows = await tx.execute(sql7`
+      const currentRows = await tx.execute(sql8`
           select * from sandbox_leases
           where workspace_id = ${input.workspaceId}
             and sandbox_group_id = ${input.sandboxGroupId}
@@ -22060,7 +22667,7 @@ async function reconcileColdLostLeaseInstanceBlockers(db, input) {
         return { status: "blocked", preview: currentPreview };
       }
       const settlement = await settleExactLostProviderWorkspaceBlockersTx(tx, blockerScope);
-      const refreshedRows = await tx.execute(sql7`
+      const refreshedRows = await tx.execute(sql8`
           select * from sandbox_leases where id = ${current.id}
         `);
       const refreshed = refreshedRows[0];
@@ -22079,7 +22686,7 @@ async function failWarmingToCold(db, input) {
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
       const tx = txRaw;
-      const rows = await tx.execute(sql7`
+      const rows = await tx.execute(sql8`
           select * from sandbox_leases
           where workspace_id = ${input.workspaceId}
             and sandbox_group_id = ${input.sandboxGroupId}
@@ -22119,7 +22726,7 @@ async function failWarmingToCold(db, input) {
         }
       };
       const resumeStateJson = hasArchive ? JSON.stringify(archiveOnlyResumeState(row, recovery)) : null;
-      await tx.execute(sql7`
+      await tx.execute(sql8`
           update sandbox_leases set
             liveness = 'cold',
             instance_id = null,
@@ -22153,18 +22760,18 @@ async function releaseLeaseHolder(db, input) {
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
       const tx = txRaw;
-      const rows = await tx.execute(sql7`
+      const rows = await tx.execute(sql8`
         select * from sandbox_leases
         where workspace_id = ${input.workspaceId} and sandbox_group_id = ${input.sandboxGroupId}
         for update
       `);
       const row = rows[0];
       if (!row) return null;
-      await tx.execute(sql7`
+      await tx.execute(sql8`
         delete from sandbox_lease_holders
         where lease_id = ${row.id} and kind = ${input.kind} and holder_id = ${input.holderId}
       `);
-      const counts = await tx.execute(sql7`
+      const counts = await tx.execute(sql8`
         select count(*)::int as total,
                count(*) filter (where kind = 'turn')::int   as turns,
                count(*) filter (where kind = 'viewer')::int as viewers
@@ -22173,10 +22780,10 @@ async function releaseLeaseHolder(db, input) {
       const c = counts[0];
       const enterDraining = row.liveness === "warm" && c.total === 0 && c.turns === 0;
       const drainGraceMs = row.rotation_requested_at ? 0 : input.idleGraceMs;
-      const updated = await tx.execute(sql7`
+      const updated = await tx.execute(sql8`
         update sandbox_leases set
           refcount = ${c.total}, turn_holders = ${c.turns}, viewer_holders = ${c.viewers},
-          ${enterDraining ? sql7`liveness = 'draining', expires_at = now() + (${String(drainGraceMs)} || ' milliseconds')::interval,` : sql7``}
+          ${enterDraining ? sql8`liveness = 'draining', expires_at = now() + (${String(drainGraceMs)} || ' milliseconds')::interval,` : sql8``}
           updated_at = now()
         where id = ${row.id}
         returning *
@@ -22185,7 +22792,7 @@ async function releaseLeaseHolder(db, input) {
     })
   );
 }
-var LIVE_CANONICAL_TURN_HOLDER_PREDICATE = sql7`
+var LIVE_CANONICAL_TURN_HOLDER_PREDICATE = sql8`
   (
     holder.kind <> 'turn'
     or holder.holder_id !~* '^turn-attempt:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'
@@ -22208,7 +22815,7 @@ var LIVE_CANONICAL_TURN_HOLDER_PREDICATE = sql7`
   )
 `;
 async function touchLiveLeaseHolder(tx, input) {
-  const updated = await tx.execute(sql7`
+  const updated = await tx.execute(sql8`
     update sandbox_lease_holders as holder set last_heartbeat_at = now()
     where holder.lease_id = (
       select id from sandbox_leases
@@ -22229,7 +22836,7 @@ async function heartbeatLeaseHolder(db, input) {
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
       const tx = txRaw;
-      const leases = await tx.execute(sql7`
+      const leases = await tx.execute(sql8`
           select id from sandbox_leases
           where workspace_id = ${input.workspaceId}
             and sandbox_group_id = ${input.sandboxGroupId}
@@ -22244,7 +22851,7 @@ async function heartbeatLeaseHolder(db, input) {
         holderId: input.holderId
       });
       if (!holderAlive) return false;
-      const leaseRows = await tx.execute(sql7`
+      const leaseRows = await tx.execute(sql8`
         update sandbox_leases set
           expires_at = now() + (${String(input.leaseTtlMs)} || ' milliseconds')::interval,
           updated_at = now()
@@ -22280,13 +22887,13 @@ async function reapStaleLeaseHolders(db, input) {
     input.workspaceId,
     async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
       const tx = txRaw;
-      await tx.execute(sql7`
+      await tx.execute(sql8`
           select id from sandbox_leases
           where workspace_id = ${input.workspaceId}
           order by id
           for update
         `);
-      const reaped = await tx.execute(sql7`
+      const reaped = await tx.execute(sql8`
         delete from sandbox_lease_holders
         where id in (
           select id from sandbox_lease_holders
@@ -22302,7 +22909,7 @@ async function reapStaleLeaseHolders(db, input) {
       const reapedDirect = reaped.filter(
         (row) => row.kind === "direct"
       ).length;
-      const reapedTurnRows = input.turnHolderTtlMs && input.turnHolderTtlMs > 0 ? await tx.execute(sql7`
+      const reapedTurnRows = input.turnHolderTtlMs && input.turnHolderTtlMs > 0 ? await tx.execute(sql8`
           delete from sandbox_lease_holders
           where id in (
             select id from sandbox_lease_holders
@@ -22312,7 +22919,7 @@ async function reapStaleLeaseHolders(db, input) {
           )
           returning lease_id
         `) : [];
-      await tx.execute(sql7`
+      await tx.execute(sql8`
         update sandbox_leases L set
           refcount       = c.total,
           turn_holders   = c.turns,
@@ -22335,7 +22942,7 @@ async function reapStaleLeaseHolders(db, input) {
         ) c
         where L.id = c.id and L.workspace_id = ${input.workspaceId}
       `);
-      const expiredWarming = await tx.execute(sql7`
+      const expiredWarming = await tx.execute(sql8`
         select * from sandbox_leases
         where workspace_id = ${input.workspaceId}
           and liveness = 'warming' and expires_at < now() and instance_id is null
@@ -22368,7 +22975,7 @@ async function reapStaleLeaseHolders(db, input) {
             verifiedAt: null
           }
         }) : null;
-        const reset = await tx.execute(sql7`
+        const reset = await tx.execute(sql8`
           update sandbox_leases set
             liveness = 'cold', instance_id = null,
             lease_epoch = lease_epoch + 1,
@@ -22388,7 +22995,7 @@ async function reapStaleLeaseHolders(db, input) {
         `);
         warmingReset += reset.length;
       }
-      const warmingDrain = await tx.execute(sql7`
+      const warmingDrain = await tx.execute(sql8`
         update sandbox_leases set
           liveness = 'draining',
           refcount = 0,
@@ -22405,7 +23012,7 @@ async function reapStaleLeaseHolders(db, input) {
       `);
       const drainable = await rawRows(
         tx,
-        sql7`
+        sql8`
         select sandbox_group_id, instance_id, lease_epoch from sandbox_leases
         where workspace_id = ${input.workspaceId}
           and liveness = 'draining' and expires_at < now() and refcount = 0
@@ -22430,10 +23037,10 @@ async function reapStaleLeaseHoldersGlobal(db, input) {
   let rows;
   const runCurrentReaper = async () => await db.transaction(async (txRaw) => {
     const tx = txRaw;
-    await tx.execute(sql7`select set_config('opengeni.sandbox_recovery_protocol_v2', '1', true)`);
+    await tx.execute(sql8`select set_config('opengeni.sandbox_recovery_protocol_v2', '1', true)`);
     return await rawRows(
       tx,
-      sql7`
+      sql8`
         select workspace_id, sandbox_group_id, instance_id, lease_epoch
         from opengeni_private.reap_sandbox_leases(${input.viewerHolderTtlMs}, ${input.turnHolderTtlMs ?? 0}, ${input.idleGraceMs})
       `
@@ -22441,10 +23048,10 @@ async function reapStaleLeaseHoldersGlobal(db, input) {
   });
   const runLegacyReaper = async () => await db.transaction(async (txRaw) => {
     const tx = txRaw;
-    await tx.execute(sql7`select set_config('opengeni.sandbox_recovery_protocol_v2', '1', true)`);
+    await tx.execute(sql8`select set_config('opengeni.sandbox_recovery_protocol_v2', '1', true)`);
     return await rawRows(
       tx,
-      sql7`
+      sql8`
         select workspace_id, sandbox_group_id, instance_id, lease_epoch
         from opengeni_private.reap_sandbox_leases(${input.viewerHolderTtlMs}, ${input.idleGraceMs})
       `
@@ -22474,7 +23081,7 @@ async function reapStaleLeaseHoldersGlobal(db, input) {
 async function listMeterableWarmLeases(db) {
   const rows = await rawRows(
     db,
-    sql7`
+    sql8`
     select account_id, workspace_id, sandbox_group_id, lease_epoch, backend
     from opengeni_private.list_meterable_warm_leases()
   `
@@ -22490,7 +23097,7 @@ async function listMeterableWarmLeases(db) {
 async function listSandboxViewerForceDrainWorkspaceIds(db) {
   const rows = await rawRows(
     db,
-    sql7`select workspace_id
+    sql8`select workspace_id
         from opengeni_private.list_sandbox_viewer_force_drain_workspaces()`
   );
   return rows.map((row) => row.workspace_id);
@@ -22498,7 +23105,7 @@ async function listSandboxViewerForceDrainWorkspaceIds(db) {
 async function countQueuedTurns(db) {
   const rows = await rawRows(
     db,
-    sql7`
+    sql8`
     select opengeni_private.count_queued_turns() as count
   `
   );
@@ -22513,7 +23120,7 @@ async function countSandboxLeasesByLiveness(db) {
   };
   const rows = await rawRows(
     db,
-    sql7`
+    sql8`
     select liveness, count
     from opengeni_private.count_sandbox_leases_by_liveness()
   `
@@ -22528,7 +23135,7 @@ async function countSandboxLeasesByLiveness(db) {
 async function listCreditBalancesByAccount(db) {
   const rows = await rawRows(
     db,
-    sql7`
+    sql8`
     select account_id, balance_micros
     from opengeni_private.credit_balance_by_account()
   `
@@ -22541,7 +23148,7 @@ async function listCreditBalancesByAccount(db) {
 async function listLiveModalSandboxLeaseAttributions(db) {
   const rows = await rawRows(
     db,
-    sql7`
+    sql8`
     select lease_id, workspace_id, sandbox_group_id, instance_id, liveness
     from opengeni_private.list_live_modal_sandbox_leases()
   `
@@ -22559,7 +23166,7 @@ async function reArmDrainingLease(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const rows = await scopedDb.execute(sql7`
+      const rows = await scopedDb.execute(sql8`
         update sandbox_leases set
           liveness = 'warm',
           expires_at = now() + (${String(input.leaseTtlMs)} || ' milliseconds')::interval,
@@ -22580,7 +23187,7 @@ async function confirmDrainCold(db, input) {
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
       const tx = txRaw;
-      const observedRows = await tx.execute(sql7`
+      const observedRows = await tx.execute(sql8`
           select * from sandbox_leases
           where workspace_id = ${input.workspaceId}
             and sandbox_group_id = ${input.sandboxGroupId}
@@ -22600,7 +23207,7 @@ async function confirmDrainCold(db, input) {
       if (blockerScope) {
         await lockExactLostProviderWorkspaceBlockersTx(tx, blockerScope);
       }
-      const locked = await tx.execute(sql7`
+      const locked = await tx.execute(sql8`
           select * from sandbox_leases
           where workspace_id = ${input.workspaceId}
             and sandbox_group_id = ${input.sandboxGroupId}
@@ -22645,7 +23252,7 @@ async function confirmDrainCold(db, input) {
       };
       const preserveRecovery = hasArchive || restoreStatus === "unrecoverable";
       const resumeStateJson = preserveRecovery ? JSON.stringify(archiveOnlyResumeState(row, recovery)) : null;
-      const rows = await tx.execute(sql7`
+      const rows = await tx.execute(sql8`
         update sandbox_leases set
           liveness = 'cold',
           instance_id = null,
@@ -22985,7 +23592,7 @@ async function advanceWorkspaceGenerationForAuthorityOnce(db, authority, operati
     async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
       const tx = txRaw;
       const locked = await lockWorkspaceMutationAuthorityTx(tx, authority);
-      const rows = await tx.execute(sql7`
+      const rows = await tx.execute(sql8`
           with advanced as (
             update sandbox_leases as lease set
               workspace_generation = lease.workspace_generation + 1,
@@ -23033,7 +23640,7 @@ async function advanceWorkspaceGenerationForAuthorityOnce(db, authority, operati
         `);
       const row = rows[0];
       if (!row) {
-        const current = await tx.execute(sql7`
+        const current = await tx.execute(sql8`
             select lease.workspace_generation,
               (
                 lease.account_id = ${locked.accountId}
@@ -23151,7 +23758,7 @@ async function advanceWorkspaceGenerationForRetainedProcess(db, input) {
   );
 }
 async function selectExactAdmissionForUpdate(tx, input) {
-  const rows = await tx.execute(sql7`
+  const rows = await tx.execute(sql8`
     select * from sandbox_workspace_mutation_admissions
     where id = ${input.admissionId}
       and account_id = ${input.accountId}
@@ -23214,7 +23821,7 @@ async function verifyResolvedAdmissionAuthority(tx, authority, admission) {
       detail: "Workspace mutation output rejected because its active route moved"
     };
   }
-  const [identity] = await tx.execute(sql7`
+  const [identity] = await tx.execute(sql8`
     select
       (
         lease.account_id = ${authority.accountId}
@@ -23282,7 +23889,7 @@ async function verifyWorkspaceMutationSettlementForAuthority(db, authorityInput,
         };
       }
       if (!admission.settled_at) {
-        await tx.execute(sql7`
+        await tx.execute(sql8`
             update sandbox_workspace_mutation_admissions set
               provider_outcome = ${input.outcome}, settled_at = now()
             where id = ${input.admission.id} and settled_at is null
@@ -23453,7 +24060,7 @@ async function retainWorkspaceMutationProcess(db, input) {
             "Settled workspace mutation cannot be promoted to a retained process"
           );
         }
-        const processLeases = await tx.execute(sql7`
+        const processLeases = await tx.execute(sql8`
             select id from sandbox_leases
             where id = ${admission.lease_id}
             for update
@@ -23465,7 +24072,7 @@ async function retainWorkspaceMutationProcess(db, input) {
           );
         }
         const processHolderId = `process:${input.processId}`;
-        await tx.execute(sql7`
+        await tx.execute(sql8`
             insert into sandbox_lease_holders
               (account_id, workspace_id, lease_id, kind, holder_id, subject_id,
                last_heartbeat_at)
@@ -23498,11 +24105,11 @@ async function retainWorkspaceMutationProcess(db, input) {
           providerSessionId: input.providerSessionId,
           state: "active"
         }).returning();
-        await tx.execute(sql7`
+        await tx.execute(sql8`
             update sandbox_workspace_mutation_admissions set provider_outcome = 'retained'
             where id = ${admission.id} and provider_outcome is null and settled_at is null
           `);
-        await tx.execute(sql7`
+        await tx.execute(sql8`
             update sandbox_leases as lease set
               refcount = counts.total,
               turn_holders = counts.turns,
@@ -23561,7 +24168,7 @@ async function claimTerminalRetainedProcesses(db, input) {
   }
   const rows = await rawRows(
     db,
-    sql7`
+    sql8`
       select account_id, workspace_id, session_id, process_id, claim_id,
         owner_state, owner_attempt_outcome
       from opengeni_private.claim_terminal_retained_processes(
@@ -23773,7 +24380,7 @@ async function deferRetainedProcessReconciliation(db, input) {
 async function countActiveRetainedProcessesByOwnerState(db) {
   const rows = await rawRows(
     db,
-    sql7`
+    sql8`
       select owner_state, active_count, terminal_owner_count
       from opengeni_private.count_active_retained_processes_by_owner_state()
     `
@@ -23787,7 +24394,7 @@ async function countActiveRetainedProcessesByOwnerState(db) {
 async function countExpiredDrainingSandboxLeases(db) {
   const rows = await rawRows(
     db,
-    sql7`
+    sql8`
       select backend, age_bucket, count
       from opengeni_private.count_expired_draining_sandbox_leases()
     `
@@ -23861,7 +24468,7 @@ async function settleRetainedProcess(db, input) {
           "Retained process settlement conflicts with checkpointed provider proof"
         );
       }
-      const admissions = await tx.execute(sql7`
+      const admissions = await tx.execute(sql8`
           select * from sandbox_workspace_mutation_admissions
           where id = ${process.parentAdmissionId}
             and account_id = ${input.accountId}
@@ -23885,7 +24492,7 @@ async function settleRetainedProcess(db, input) {
           "Retained process parent admission is not open"
         );
       }
-      const leases = await tx.execute(sql7`
+      const leases = await tx.execute(sql8`
           select * from sandbox_leases
           where id = ${process.leaseId}
             and account_id = ${input.accountId}
@@ -23933,39 +24540,39 @@ async function settleRetainedProcess(db, input) {
           "Retained process changed while its row was locked"
         );
       }
-      await tx.execute(sql7`
+      await tx.execute(sql8`
           update sandbox_workspace_mutation_admissions set
             provider_outcome = ${input.outcome === "exited" ? "resolved" : "rejected"},
             settled_at = now()
           where id = ${process.parentAdmissionId}
             and provider_outcome = 'retained' and settled_at is null
         `);
-      await tx.execute(sql7`
+      await tx.execute(sql8`
           delete from sandbox_lease_holders
           where lease_id = ${process.leaseId}
             and account_id = ${input.accountId}
             and workspace_id = ${input.workspaceId}
             and kind = 'process' and holder_id = ${process.holderId}
         `);
-      const [counts] = await tx.execute(sql7`
+      const [counts] = await tx.execute(sql8`
           select count(*)::int as total,
             count(*) filter (where kind = 'turn')::int as turns,
             count(*) filter (where kind = 'viewer')::int as viewers
           from sandbox_lease_holders where lease_id = ${process.leaseId}
         `);
       const enterDraining = processOwnsCurrentLease && (counts?.total ?? 0) === 0;
-      await tx.execute(sql7`
+      await tx.execute(sql8`
           update sandbox_leases set
             refcount = ${counts?.total ?? 0},
             turn_holders = ${counts?.turns ?? 0},
             viewer_holders = ${counts?.viewers ?? 0},
-            ${enterDraining ? sql7`liveness = case when liveness = 'warm' then 'draining' else liveness end,
+            ${enterDraining ? sql8`liveness = case when liveness = 'warm' then 'draining' else liveness end,
                       expires_at = case when liveness = 'warm'
                         then case when rotation_requested_at is not null
                           then now()
                           else now() + (${String(input.idleGraceMs)} || ' milliseconds')::interval
                         end
-                        else expires_at end,` : sql7``}
+                        else expires_at end,` : sql8``}
             updated_at = now()
           where id = ${process.leaseId}
             and sandbox_group_id = ${process.sandboxGroupId}
@@ -23979,14 +24586,14 @@ async function readWorkspaceArchiveCapturePreflight(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const rows = await scopedDb.execute(sql7`
+      const rows = await scopedDb.execute(sql8`
         select lease.* from sandbox_leases as lease
         where lease.workspace_id = ${input.workspaceId}
           and lease.sandbox_group_id = ${input.sandboxGroupId}
           and lease.liveness = ${input.liveness}
           and lease.lease_epoch = ${input.expectedEpoch}
           and lease.instance_id = ${input.expectedInstanceId}
-          ${input.liveness === "draining" ? sql7`and lease.refcount = 0` : sql7``}
+          ${input.liveness === "draining" ? sql8`and lease.refcount = 0` : sql8``}
           and not exists (
             select 1
             from sandbox_workspace_mutation_admissions as admission
@@ -24076,7 +24683,7 @@ async function claimWorkspaceArchiveCapture(db, input) {
         const attemptMayCapture = attempt !== void 0 && attempt.accountId === input.accountId && attempt.sandboxGroupId === input.sandboxGroupId && attempt.activeAttemptId === input.warmAttempt.attemptId && !interruption && (attempt.state === "claimed" || attempt.state === "running" ? attempt.outcome === null : attempt.state === "closed" && (attempt.outcome === "completed" || attempt.outcome === "failed" || attempt.outcome === "requires_action"));
         if (!attemptMayCapture) return { status: "attempt_fenced" };
       }
-      const rows = await scopedDb.execute(sql7`
+      const rows = await scopedDb.execute(sql8`
         select lease.*
         from sandbox_leases lease
         where lease.account_id = ${input.accountId}
@@ -24091,7 +24698,7 @@ async function claimWorkspaceArchiveCapture(db, input) {
       if (row.archive_capture_id !== null) {
         return { status: "capture_in_progress" };
       }
-      const holderCounts = input.warmAttempt ? await scopedDb.execute(sql7`
+      const holderCounts = input.warmAttempt ? await scopedDb.execute(sql8`
             select
               count(*)::integer as total,
               count(*) filter (
@@ -24100,7 +24707,7 @@ async function claimWorkspaceArchiveCapture(db, input) {
               )::integer as exact
             from sandbox_lease_holders
             where lease_id = ${row.id}
-          `) : await scopedDb.execute(sql7`
+          `) : await scopedDb.execute(sql8`
             select count(*)::integer as total, 0::integer as exact
             from sandbox_lease_holders
             where lease_id = ${row.id}
@@ -24112,7 +24719,7 @@ async function claimWorkspaceArchiveCapture(db, input) {
       if ((holderCounts[0]?.total ?? 0) !== expectedHolderCount) {
         return { status: "holder_in_progress" };
       }
-      const unsettled = await scopedDb.execute(sql7`
+      const unsettled = await scopedDb.execute(sql8`
         select exists (
           select 1
           from sandbox_workspace_mutation_admissions admission
@@ -24146,7 +24753,7 @@ async function claimWorkspaceArchiveCapture(db, input) {
       }
       const startedAt = /* @__PURE__ */ new Date();
       const deadlineAt = new Date(startedAt.getTime() + input.captureTimeoutMs);
-      const claimed = await scopedDb.execute(sql7`
+      const claimed = await scopedDb.execute(sql8`
         update sandbox_leases set
           archive_capture_id = ${input.captureId}::uuid,
           archive_capture_generation = workspace_generation,
@@ -24187,7 +24794,7 @@ async function releaseWorkspaceArchiveCapture(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const rows = await scopedDb.execute(sql7`
+      const rows = await scopedDb.execute(sql8`
         update sandbox_leases set
           archive_capture_id = null,
           archive_capture_generation = null,
@@ -24215,7 +24822,7 @@ async function replaceExpiredWorkspaceArchiveCapture(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const rows = await scopedDb.execute(sql7`
+      const rows = await scopedDb.execute(sql8`
         update sandbox_leases as lease set
           archive_capture_id = ${input.captureId}::uuid,
           archive_capture_generation = lease.workspace_generation,
@@ -24317,7 +24924,7 @@ async function registerSandboxCheckpointArtifact(db, input) {
         db,
         { accountId: input.accountId, workspaceId: input.workspaceId },
         async (scopedDb) => {
-          const inserted = await scopedDb.execute(sql7`
+          const inserted = await scopedDb.execute(sql8`
         insert into sandbox_checkpoint_artifacts (
           account_id, workspace_id, sandbox_group_id, source_lease_id,
           source_lease_epoch, source_instance_id, source_workspace_generation,
@@ -24337,7 +24944,7 @@ async function registerSandboxCheckpointArtifact(db, input) {
           do nothing
         returning id, state, object_id
       `);
-          const row = inserted[0] ?? (await scopedDb.execute(sql7`
+          const row = inserted[0] ?? (await scopedDb.execute(sql8`
             select id, state, object_id, account_id, workspace_id,
               sandbox_group_id, source_lease_id, source_lease_epoch,
               source_instance_id, source_workspace_generation, provenance,
@@ -24350,7 +24957,7 @@ async function registerSandboxCheckpointArtifact(db, input) {
             limit 1
             for update
           `))[0];
-          if (!row || "account_id" in row && (row.account_id !== input.accountId || row.workspace_id !== input.workspaceId || row.sandbox_group_id !== input.sandboxGroupId || row.source_lease_id !== input.sourceLeaseId || Number(row.source_lease_epoch) !== input.sourceLeaseEpoch || row.source_instance_id !== input.sourceInstanceId || row.source_workspace_generation === null || Number(row.source_workspace_generation) !== input.sourceWorkspaceGeneration || row.provenance !== "native_capture" || row.archive_base64 !== input.workspaceArchive || row.archive_sha256 !== verified.descriptor.archiveSha256 || stableJson2(row.descriptor) !== stableJson2(verified.descriptor) || row.descriptor_revision !== verified.descriptor.revision || row.object_kind !== verified.objectKind || canonicalModalCheckpointProviderBinding(row.provider_binding)?.key !== providerIdentity.key)) {
+          if (!row || "account_id" in row && (row.account_id !== input.accountId || row.workspace_id !== input.workspaceId || row.sandbox_group_id !== input.sandboxGroupId || row.source_lease_id !== input.sourceLeaseId || Number(row.source_lease_epoch) !== input.sourceLeaseEpoch || row.source_instance_id !== input.sourceInstanceId || row.source_workspace_generation === null || Number(row.source_workspace_generation) !== input.sourceWorkspaceGeneration || row.provenance !== "native_capture" || row.archive_base64 !== input.workspaceArchive || row.archive_sha256 !== verified.descriptor.archiveSha256 || stableJson3(row.descriptor) !== stableJson3(verified.descriptor) || row.descriptor_revision !== verified.descriptor.revision || row.object_kind !== verified.objectKind || canonicalModalCheckpointProviderBinding(row.provider_binding)?.key !== providerIdentity.key)) {
             throw new SandboxCheckpointArtifactRegistrationConflictError(
               "Modal checkpoint object identity collision"
             );
@@ -24377,7 +24984,7 @@ async function markSandboxCheckpointArtifactDeletePending(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const rows = await scopedDb.execute(sql7`
+      const rows = await scopedDb.execute(sql8`
         update sandbox_checkpoint_artifacts artifact set
           state = 'delete_pending',
           delete_after = now(),
@@ -24399,7 +25006,7 @@ async function markSandboxCheckpointArtifactDeletePending(db, input) {
 async function claimSandboxCheckpointArtifactsForGc(db, input) {
   const rows = await rawRows(
     db,
-    sql7`select * from opengeni_private.claim_sandbox_checkpoint_artifacts(
+    sql8`select * from opengeni_private.claim_sandbox_checkpoint_artifacts(
       ${input.claimId}::uuid, ${input.limit}, ${input.claimTtlMs}
     )`
   );
@@ -24416,7 +25023,7 @@ async function claimSandboxCheckpointArtifactsForGc(db, input) {
 async function settleSandboxCheckpointArtifactGc(db, input) {
   const rows = await rawRows(
     db,
-    sql7`select opengeni_private.settle_sandbox_checkpoint_artifact(
+    sql8`select opengeni_private.settle_sandbox_checkpoint_artifact(
       ${input.artifactId}::uuid, ${input.claimId}::uuid, ${input.deleted},
       ${input.error?.slice(0, 4e3) ?? null}, ${input.retryAfterMs}
     ) as settled`
@@ -24426,7 +25033,7 @@ async function settleSandboxCheckpointArtifactGc(db, input) {
 async function pruneDeletedSandboxCheckpointArtifacts(db, retentionMs, limit) {
   const rows = await rawRows(
     db,
-    sql7`select opengeni_private.prune_deleted_sandbox_checkpoint_artifacts(
+    sql8`select opengeni_private.prune_deleted_sandbox_checkpoint_artifacts(
       ${retentionMs}, ${limit}
     ) as pruned`
   );
@@ -24435,7 +25042,7 @@ async function pruneDeletedSandboxCheckpointArtifacts(db, retentionMs, limit) {
 async function requestDueSandboxRotationsGlobal(db, leadMs, limit) {
   const rows = await rawRows(
     db,
-    sql7`select opengeni_private.request_due_sandbox_rotations(
+    sql8`select opengeni_private.request_due_sandbox_rotations(
       ${leadMs}, ${limit}
     ) as requested`
   );
@@ -24456,7 +25063,7 @@ async function countSandboxCheckpointArtifactsByState(db) {
   );
   const rows = await rawRows(
     db,
-    sql7`select state, count
+    sql8`select state, count
         from opengeni_private.sandbox_checkpoint_artifact_inventory()`
   );
   for (const row of rows) {
@@ -24467,7 +25074,7 @@ async function countSandboxCheckpointArtifactsByState(db) {
   return counts;
 }
 async function readSandboxRotationBacklog(db) {
-  const rows = await rawRows(db, sql7`select * from opengeni_private.sandbox_rotation_backlog()`);
+  const rows = await rawRows(db, sql8`select * from opengeni_private.sandbox_rotation_backlog()`);
   const row = rows[0];
   return {
     requested: Number(row?.requested ?? 0),
@@ -24478,7 +25085,7 @@ async function readSandboxRotationBacklog(db) {
   };
 }
 async function listLegacyModalCheckpointSlots(db, limit = 100) {
-  const rows = await rawRows(db, sql7`select * from opengeni_private.list_legacy_modal_checkpoint_slots(${limit})`);
+  const rows = await rawRows(db, sql8`select * from opengeni_private.list_legacy_modal_checkpoint_slots(${limit})`);
   return rows.flatMap((row) => {
     const descriptor = parseArchiveRevision(row.descriptor);
     return descriptor?.version === 2 ? [
@@ -24510,7 +25117,7 @@ async function adoptLegacyModalCheckpointArtifact(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const leaseRows = await scopedDb.execute(sql7`
+      const leaseRows = await scopedDb.execute(sql8`
         select lease.id, lease.current_checkpoint_artifact_id,
           lease.previous_checkpoint_artifact_id
         from sandbox_leases lease
@@ -24522,16 +25129,16 @@ async function adoptLegacyModalCheckpointArtifact(db, input) {
           and lease.workspace_generation = ${input.workspaceGeneration}
           and lease.backend = 'modal'
           and lease.liveness in ('warming', 'warm', 'draining')
-          ${input.rematerializationId ? sql7`and lease.liveness = 'warming'
+          ${input.rematerializationId ? sql8`and lease.liveness = 'warming'
                     and lease.resume_state #>> '{opengeniRecovery,restore,rematerializationId}' =
                       ${input.rematerializationId}
                     and lease.resume_state #>> '{opengeniRecovery,restore,status}' in
-                      ('restoring', 'verifying')` : sql7``}
-          and ${input.slot === "current" ? sql7`lease.archive_generation = lease.workspace_generation
+                      ('restoring', 'verifying')` : sql8``}
+          and ${input.slot === "current" ? sql8`lease.archive_generation = lease.workspace_generation
                     and lease.resume_state #>> '{sessionState,workspaceArchive}' =
                       ${input.archiveBase64}
                     and lease.resume_state #> '{sessionState,workspaceArchiveMeta}' =
-                      ${JSON.stringify(input.descriptor)}::jsonb` : sql7`lease.resume_state #>> '{sessionState,workspaceArchivePrev}' =
+                      ${JSON.stringify(input.descriptor)}::jsonb` : sql8`lease.resume_state #>> '{sessionState,workspaceArchivePrev}' =
                       ${input.archiveBase64}
                     and lease.resume_state #> '{sessionState,workspaceArchivePrevMeta}' =
                       ${JSON.stringify(input.descriptor)}::jsonb`}
@@ -24541,7 +25148,7 @@ async function adoptLegacyModalCheckpointArtifact(db, input) {
       if (!lease) return false;
       const existingReference = input.slot === "current" ? lease.current_checkpoint_artifact_id : lease.previous_checkpoint_artifact_id;
       if (existingReference !== null) {
-        const exact = await scopedDb.execute(sql7`
+        const exact = await scopedDb.execute(sql8`
           select artifact.id
           from sandbox_checkpoint_artifacts artifact
           where artifact.id = ${existingReference}::uuid
@@ -24565,7 +25172,7 @@ async function adoptLegacyModalCheckpointArtifact(db, input) {
         `);
         return exact.length === 1;
       }
-      const inserted = await scopedDb.execute(sql7`
+      const inserted = await scopedDb.execute(sql8`
         insert into sandbox_checkpoint_artifacts (
           account_id, workspace_id, sandbox_group_id, source_lease_id,
           source_lease_epoch, source_instance_id, source_workspace_generation,
@@ -24585,7 +25192,7 @@ async function adoptLegacyModalCheckpointArtifact(db, input) {
           do nothing
         returning id, state
       `);
-      const artifact = inserted[0] ?? (await scopedDb.execute(sql7`
+      const artifact = inserted[0] ?? (await scopedDb.execute(sql8`
             select id, state, account_id, workspace_id, sandbox_group_id,
               source_lease_id, source_lease_epoch, source_instance_id,
               source_workspace_generation, provenance, archive_base64,
@@ -24597,7 +25204,7 @@ async function adoptLegacyModalCheckpointArtifact(db, input) {
             limit 1
             for update
           `))[0];
-      const exactExisting = artifact !== void 0 && (!("account_id" in artifact) || artifact.account_id === input.accountId && artifact.workspace_id === input.workspaceId && artifact.sandbox_group_id === input.sandboxGroupId && artifact.source_lease_id === input.leaseId && Number(artifact.source_lease_epoch) === input.leaseEpoch && artifact.source_instance_id === null && artifact.source_workspace_generation === null && artifact.provenance === "legacy_provider_adopted" && artifact.archive_base64 === input.archiveBase64 && artifact.archive_sha256 === verified.descriptor.archiveSha256 && stableJson2(artifact.descriptor) === stableJson2(verified.descriptor) && artifact.descriptor_revision === verified.descriptor.revision && artifact.object_kind === verified.objectKind);
+      const exactExisting = artifact !== void 0 && (!("account_id" in artifact) || artifact.account_id === input.accountId && artifact.workspace_id === input.workspaceId && artifact.sandbox_group_id === input.sandboxGroupId && artifact.source_lease_id === input.leaseId && Number(artifact.source_lease_epoch) === input.leaseEpoch && artifact.source_instance_id === null && artifact.source_workspace_generation === null && artifact.provenance === "legacy_provider_adopted" && artifact.archive_base64 === input.archiveBase64 && artifact.archive_sha256 === verified.descriptor.archiveSha256 && stableJson3(artifact.descriptor) === stableJson3(verified.descriptor) && artifact.descriptor_revision === verified.descriptor.revision && artifact.object_kind === verified.objectKind);
       if (!artifact || !exactExisting || artifact.state === "deleted") {
         throw new SandboxCheckpointArtifactRegistrationConflictError(
           "Modal checkpoint object identity collision"
@@ -24608,7 +25215,7 @@ async function adoptLegacyModalCheckpointArtifact(db, input) {
           "Legacy Modal checkpoint is already owned by another archive slot"
         );
       }
-      const published = await scopedDb.execute(sql7`
+      const published = await scopedDb.execute(sql8`
         update sandbox_checkpoint_artifacts set
           state = ${input.slot}, published_at = coalesce(published_at, now()),
           delete_after = null, last_delete_error = null, updated_at = now()
@@ -24618,12 +25225,12 @@ async function adoptLegacyModalCheckpointArtifact(db, input) {
       if (published.length !== 1) {
         throw new Error("Legacy Modal checkpoint adoption lost its locked provider object");
       }
-      const attached = await scopedDb.execute(sql7`
+      const attached = await scopedDb.execute(sql8`
         update sandbox_leases lease set
-          ${input.slot === "current" ? sql7`current_checkpoint_artifact_id = ${artifact.id}::uuid` : sql7`previous_checkpoint_artifact_id = ${artifact.id}::uuid`},
+          ${input.slot === "current" ? sql8`current_checkpoint_artifact_id = ${artifact.id}::uuid` : sql8`previous_checkpoint_artifact_id = ${artifact.id}::uuid`},
           updated_at = now()
         where lease.id = ${input.leaseId}::uuid
-          and ${input.slot === "current" ? sql7`lease.current_checkpoint_artifact_id is null` : sql7`lease.previous_checkpoint_artifact_id is null`}
+          and ${input.slot === "current" ? sql8`lease.current_checkpoint_artifact_id is null` : sql8`lease.previous_checkpoint_artifact_id is null`}
         returning lease.id
       `);
       if (attached.length !== 1) {
@@ -24645,7 +25252,7 @@ async function persistDrainSnapshot(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const guard = await scopedDb.execute(sql7`
+      const guard = await scopedDb.execute(sql8`
         select
           resume_state #>> '{sessionState,workspaceArchive}' as prior_archive,
           resume_state #>> '{sessionState,workspaceArchivePrev}' as prior_archive_prev,
@@ -24693,7 +25300,7 @@ async function persistDrainSnapshot(db, input) {
       const priorArchive = guard[0].prior_archive ?? null;
       const priorArchivePrev = guard[0].prior_archive_prev ?? null;
       if (input.workspaceArchive === null) {
-        await scopedDb.execute(sql7`
+        await scopedDb.execute(sql8`
           update sandbox_leases set
             archive_capture_id = null,
             archive_capture_generation = null,
@@ -24764,7 +25371,7 @@ function rotateWorkspaceArchives(input) {
   };
 }
 async function foldWorkspaceArchiveOntoLease(scopedDb, input) {
-  const livenessGuard = input.livenessGuard === "draining" ? sql7`lease.liveness = 'draining' and lease.refcount = 0` : sql7`lease.liveness = 'warm'`;
+  const livenessGuard = input.livenessGuard === "draining" ? sql8`lease.liveness = 'draining' and lease.refcount = 0` : sql8`lease.liveness = 'warm'`;
   const archiveAtIso = input.workspaceArchiveMeta?.capturedAt ?? input.archiveAtIso ?? (/* @__PURE__ */ new Date()).toISOString();
   const base = input.resumeState && typeof input.resumeState === "object" ? input.resumeState : {};
   const currentSession = base.sessionState && typeof base.sessionState === "object" ? base.sessionState : {};
@@ -24795,7 +25402,7 @@ async function foldWorkspaceArchiveOntoLease(scopedDb, input) {
     archive: archiveProjectionFromResumeState(folded)
   };
   const foldedJson = JSON.stringify(folded);
-  const rows = await scopedDb.execute(sql7`
+  const rows = await scopedDb.execute(sql8`
     update sandbox_leases as lease set
       resume_state = ${foldedJson}::jsonb,
       archive_generation = ${input.expectedWorkspaceGeneration},
@@ -24857,7 +25464,7 @@ async function foldWorkspaceArchiveOntoLease(scopedDb, input) {
   `);
   if (rows.length === 0) return false;
   if (input.checkpointArtifactId) {
-    await scopedDb.execute(sql7`
+    await scopedDb.execute(sql8`
       update sandbox_checkpoint_artifacts set
         state = 'current', published_at = coalesce(published_at, now()),
         delete_after = null, last_delete_error = null, updated_at = now()
@@ -24865,7 +25472,7 @@ async function foldWorkspaceArchiveOntoLease(scopedDb, input) {
     `);
   }
   if (input.previousCheckpointArtifactId && input.previousCheckpointArtifactId !== input.checkpointArtifactId) {
-    await scopedDb.execute(sql7`
+    await scopedDb.execute(sql8`
       update sandbox_checkpoint_artifacts set
         state = 'previous', delete_after = null, last_delete_error = null,
         updated_at = now()
@@ -24880,12 +25487,12 @@ async function foldWorkspaceArchiveOntoLease(scopedDb, input) {
     (id) => id !== null && id !== input.checkpointArtifactId && id !== input.previousCheckpointArtifactId
   );
   if (evictedArtifactIds.length > 0) {
-    await scopedDb.execute(sql7`
+    await scopedDb.execute(sql8`
       update sandbox_checkpoint_artifacts set
         state = 'delete_pending', delete_after = now(), updated_at = now()
-      where id in (${sql7.join(
-      evictedArtifactIds.map((id) => sql7`${id}::uuid`),
-      sql7`, `
+      where id in (${sql8.join(
+      evictedArtifactIds.map((id) => sql8`${id}::uuid`),
+      sql8`, `
     )})
         and state in ('current', 'previous', 'candidate', 'delete_failed')
     `);
@@ -24941,7 +25548,7 @@ async function persistWarmSnapshot(db, input) {
           archiveRevision: null
         };
       }
-      const guard = await scopedDb.execute(sql7`
+      const guard = await scopedDb.execute(sql8`
         select
           resume_state #>> '{sessionState,workspaceArchive}' as prior_archive,
           resume_state #>> '{sessionState,workspaceArchivePrev}' as prior_archive_prev,
@@ -25056,7 +25663,7 @@ async function getMaterializedSandboxFileResources(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const rows = await scopedDb.execute(sql7`
+      const rows = await scopedDb.execute(sql8`
         select coalesce(
           jsonb_path_query_array(
             resume_state,
@@ -25086,7 +25693,7 @@ async function markSandboxFileResourcesMaterialized(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const rows = await scopedDb.execute(sql7`
+      const rows = await scopedDb.execute(sql8`
         update sandbox_leases set
           resume_state = jsonb_set(
             case when jsonb_typeof(resume_state) = 'object' then resume_state else '{}'::jsonb end,
@@ -25130,7 +25737,7 @@ async function markSandboxFileResourcesMaterialized(db, input) {
     }
   );
 }
-var WORKSPACE_CAPTURE_COLUMNS = sql7`
+var WORKSPACE_CAPTURE_COLUMNS = sql8`
   id, session_id, turn_id, revision, lease_epoch, state,
   manifest_key, tree_index_key, blob_keys, size_bytes, stats, captured_at
 `;
@@ -25180,7 +25787,7 @@ async function commitWorkspaceCaptureRevision(db, input) {
         return null;
       }
       const capturedAt = input.capturedAt ?? /* @__PURE__ */ new Date();
-      const rows = await tx.execute(sql7`
+      const rows = await tx.execute(sql8`
           insert into workspace_captures
             (account_id, workspace_id, session_id, turn_id, revision, lease_epoch, state,
              manifest_key, tree_index_key, blob_keys, size_bytes, stats, captured_at)
@@ -25262,7 +25869,7 @@ async function insertFailedWorkspaceCapture(db, input) {
 }
 async function latestWorkspaceCapture(db, workspaceId, sessionId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const rows = await scopedDb.execute(sql7`
+    const rows = await scopedDb.execute(sql8`
       select ${WORKSPACE_CAPTURE_COLUMNS} from workspace_captures
       where session_id = ${sessionId}
       order by revision desc
@@ -25273,7 +25880,7 @@ async function latestWorkspaceCapture(db, workspaceId, sessionId) {
 }
 async function sessionLatestWorkspaceCapture(db, workspaceId, sessionId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const rows = await scopedDb.execute(sql7`
+    const rows = await scopedDb.execute(sql8`
       select
         sessions.id as found_session_id,
         capture.id as capture_id,
@@ -25323,7 +25930,7 @@ async function sessionLatestWorkspaceCapture(db, workspaceId, sessionId) {
 }
 async function workspaceCaptureAtRevision(db, workspaceId, sessionId, revision) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const rows = await scopedDb.execute(sql7`
+    const rows = await scopedDb.execute(sql8`
       select ${WORKSPACE_CAPTURE_COLUMNS} from workspace_captures
       where session_id = ${sessionId} and revision = ${revision}
       limit 1
@@ -25353,7 +25960,7 @@ function computeWorkspaceCaptureGcPlan(rows, keepN) {
 }
 async function planWorkspaceCaptureGc(db, input) {
   return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
-    const rows = await scopedDb.execute(sql7`
+    const rows = await scopedDb.execute(sql8`
       select id, revision, manifest_key, tree_index_key, blob_keys
       from workspace_captures
       where session_id = ${input.sessionId}
@@ -25375,11 +25982,11 @@ async function planWorkspaceCaptureGc(db, input) {
 async function deleteWorkspaceCaptureRows(db, input) {
   if (input.rowIds.length === 0) return 0;
   return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
-    const result = await scopedDb.execute(sql7`
+    const result = await scopedDb.execute(sql8`
       delete from workspace_captures
-      where id in (${sql7.join(
-      input.rowIds.map((id) => sql7`${id}`),
-      sql7`, `
+      where id in (${sql8.join(
+      input.rowIds.map((id) => sql8`${id}`),
+      sql8`, `
     )})
       returning id
     `);
@@ -25388,7 +25995,7 @@ async function deleteWorkspaceCaptureRows(db, input) {
 }
 async function readLease(db, workspaceId, sandboxGroupId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const rows = await scopedDb.execute(sql7`
+    const rows = await scopedDb.execute(sql8`
       select * from sandbox_leases
       where workspace_id = ${workspaceId} and sandbox_group_id = ${sandboxGroupId}
       limit 1
@@ -25401,7 +26008,7 @@ async function recordLeaseDataPlaneUrl(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const rows = await scopedDb.execute(sql7`
+      const rows = await scopedDb.execute(sql8`
         update sandbox_leases set
           data_plane_url = ${input.dataPlaneUrl ?? null},
           updated_at     = now()
@@ -25419,7 +26026,7 @@ async function recordLeaseTerminalDataPlaneUrl(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const rows = await scopedDb.execute(sql7`
+      const rows = await scopedDb.execute(sql8`
         update sandbox_leases set
           terminal_data_plane_url = ${input.terminalDataPlaneUrl ?? null},
           updated_at              = now()
@@ -25618,7 +26225,7 @@ async function setEnrollmentDisplayState(db, input) {
           // null-safe inequality (a plain `ne` skips NULL rows).
           or3(
             ne(enrollments.hasDisplay, input.hasDisplay),
-            sql7`${enrollments.desktopUnavailableReason} IS DISTINCT FROM ${input.desktopUnavailableReason}`
+            sql8`${enrollments.desktopUnavailableReason} IS DISTINCT FROM ${input.desktopUnavailableReason}`
           )
         )
       ).returning({ id: enrollments.id });
@@ -25699,7 +26306,7 @@ async function createDeviceEnrollmentRequest(db, input) {
   );
 }
 async function getDeviceEnrollmentRequestByDeviceCode(db, deviceCode) {
-  const resolved = await db.execute(sql7`
+  const resolved = await db.execute(sql8`
     select account_id, workspace_id from opengeni_private.resolve_device_enrollment_request(${deviceCode})
   `);
   const ctx = resolved[0];
@@ -25728,7 +26335,7 @@ async function getPendingDeviceEnrollmentRequestByUserCode(db, workspaceId, user
   });
 }
 async function getPendingDeviceEnrollmentRequestByUserCodeGlobal(db, userCode) {
-  const resolved = await db.execute(sql7`
+  const resolved = await db.execute(sql8`
     select account_id, workspace_id from opengeni_private.resolve_pending_device_enrollment_by_user_code(${userCode})
   `);
   const ctx = resolved[0];
@@ -25978,11 +26585,11 @@ async function setActiveSandbox(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const rows = await scopedDb.execute(sql7`
+      const rows = await scopedDb.execute(sql8`
       update sessions set
         active_sandbox_id = ${input.targetSandboxId},
         active_epoch      = active_epoch + 1,
-        working_dir       = ${input.workingDir === void 0 ? sql7`working_dir` : input.workingDir},
+        working_dir       = ${input.workingDir === void 0 ? sql8`working_dir` : input.workingDir},
         updated_at        = now()
       where workspace_id = ${input.workspaceId} and id = ${input.sessionId}
         and active_epoch = ${input.expectedEpoch}
@@ -26146,7 +26753,7 @@ async function recordStreamAcknowledgment(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const rows = await scopedDb.execute(sql7`
+      const rows = await scopedDb.execute(sql8`
         insert into session_stream_acknowledgments
           (account_id, workspace_id, sandbox_group_id, subject_id,
            acknowledged_unredacted, acknowledged_shared, acknowledged_at, updated_at)
@@ -26172,7 +26779,7 @@ async function recordStreamAcknowledgment(db, input) {
 }
 async function getStreamAcknowledgment(db, input) {
   return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
-    const rows = await scopedDb.execute(sql7`
+    const rows = await scopedDb.execute(sql8`
       select acknowledged_unredacted, acknowledged_shared
       from session_stream_acknowledgments
       where workspace_id = ${input.workspaceId}
@@ -26191,7 +26798,7 @@ async function listSessionIdsInGroup(db, workspaceId, sandboxGroupId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const rows = await rawRows(
       scopedDb,
-      sql7`
+      sql8`
       select id from sessions
       where workspace_id = ${workspaceId} and sandbox_group_id = ${sandboxGroupId}
       order by created_at asc
@@ -26222,7 +26829,7 @@ async function accrueWarmSeconds(db, input) {
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
       const tx = txRaw;
-      const rows = await tx.execute(sql7`
+      const rows = await tx.execute(sql8`
         select *,
           case when last_meter_at is null then null
                else floor(extract(epoch from (now() - last_meter_at)))::int end as meter_elapsed_s
@@ -26236,7 +26843,7 @@ async function accrueWarmSeconds(db, input) {
         return none;
       }
       if (row.last_meter_at == null) {
-        await tx.execute(sql7`
+        await tx.execute(sql8`
           update sandbox_leases set last_meter_at = now(), updated_at = now()
           where id = ${row.id}
         `);
@@ -26248,7 +26855,7 @@ async function accrueWarmSeconds(db, input) {
       }
       const tick = Number(row.last_meter_tick) + 1;
       const costMicros = Math.round(elapsedS * Math.max(0, input.warmRateMicrosPerSecond));
-      await tx.execute(sql7`
+      await tx.execute(sql8`
         insert into usage_events
           (account_id, workspace_id, subject_id, event_type, quantity, unit,
            source_resource_type, source_resource_id, idempotency_key, occurred_at)
@@ -26261,7 +26868,7 @@ async function accrueWarmSeconds(db, input) {
         on conflict (idempotency_key) do nothing
       `);
       if (costMicros > 0) {
-        await tx.execute(sql7`
+        await tx.execute(sql8`
           insert into usage_events
             (account_id, workspace_id, subject_id, event_type, quantity, unit,
              source_resource_type, source_resource_id, idempotency_key, occurred_at)
@@ -26274,7 +26881,7 @@ async function accrueWarmSeconds(db, input) {
           on conflict (idempotency_key) do nothing
         `);
       }
-      await tx.execute(sql7`
+      await tx.execute(sql8`
         update sandbox_leases set
           last_meter_at = now(), last_meter_tick = ${tick}, updated_at = now()
         where id = ${row.id}
@@ -26306,7 +26913,7 @@ async function forceDrainOverLimitViewerOnlyBoxes(db, input) {
     } else if (input.maxWarmSecondsPerWorkspace > 0) {
       const since = input.capWindowStart ?? startOfUtcMonthDefault();
       const [{ total } = { total: 0 }] = await scopedDb.select({
-        total: sql7`coalesce(sum(${usageEvents.quantity}), 0)`
+        total: sql8`coalesce(sum(${usageEvents.quantity}), 0)`
       }).from(usageEvents).where(
         and10(
           eq10(usageEvents.workspaceId, input.workspaceId),
@@ -26319,7 +26926,7 @@ async function forceDrainOverLimitViewerOnlyBoxes(db, input) {
       }
     }
     if (!reason) {
-      await scopedDb.execute(sql7`
+      await scopedDb.execute(sql8`
         update workspaces set
           sandbox_viewer_force_drain_reason = null,
           sandbox_viewer_force_drain_requested_at = null,
@@ -26329,7 +26936,7 @@ async function forceDrainOverLimitViewerOnlyBoxes(db, input) {
       `);
       return { overLimit: false, reason: null, drained: [] };
     }
-    await scopedDb.execute(sql7`
+    await scopedDb.execute(sql8`
       update workspaces set
         sandbox_viewer_force_drain_reason = ${reason},
         sandbox_viewer_force_drain_requested_at =
@@ -26345,14 +26952,14 @@ async function forceDrainOverLimitViewerOnlyBoxes(db, input) {
           or sandbox_viewer_force_drain_requested_at is null
         )
     `);
-    await scopedDb.execute(sql7`
+    await scopedDb.execute(sql8`
       select id from sandbox_leases
       where workspace_id = ${input.workspaceId}
         and liveness = 'warm' and turn_holders = 0
       order by id
       for update
     `);
-    await scopedDb.execute(sql7`
+    await scopedDb.execute(sql8`
       delete from sandbox_lease_holders h
       where h.kind = 'viewer'
         and h.lease_id in (
@@ -26363,7 +26970,7 @@ async function forceDrainOverLimitViewerOnlyBoxes(db, input) {
     `);
     const drained = await rawRows(
       scopedDb,
-      sql7`
+      sql8`
       update sandbox_leases set
         liveness = 'draining',
         refcount = 0, turn_holders = 0, viewer_holders = 0,
@@ -26399,7 +27006,7 @@ async function saveRunState(db, input) {
         });
         if (!allowed.allowed) return false;
         const [{ maxVersion } = { maxVersion: 0 }] = await tx.select({
-          maxVersion: sql7`coalesce(max(${agentRunStates.stateVersion}), 0)`
+          maxVersion: sql8`coalesce(max(${agentRunStates.stateVersion}), 0)`
         }).from(agentRunStates).where(
           and10(
             eq10(agentRunStates.workspaceId, input.workspaceId),
@@ -26491,7 +27098,7 @@ async function getSessionGoalWithContinuation(db, workspaceId, sessionId) {
         // accepted while a goal turn is running can have a lower normalized
         // queue position; that future human turn must not hide the live goal
         // attempt in this projection.
-        sql7`case when ${sessionTurns.id} = ${session.activeTurnId} then 0 else 1 end`,
+        sql8`case when ${sessionTurns.id} = ${session.activeTurnId} then 0 else 1 end`,
         asc5(sessionTurns.position),
         asc5(sessionTurns.createdAt)
       ).limit(1);
@@ -26501,8 +27108,8 @@ async function getSessionGoalWithContinuation(db, workspaceId, sessionId) {
           eq10(sessionSystemUpdates.sessionId, sessionId),
           eq10(sessionSystemUpdates.kind, "goal_continuation"),
           eq10(sessionSystemUpdates.state, "pending"),
-          sql7`${sessionSystemUpdates.payload} ->> 'goalId' = ${goal.id}`,
-          sql7`(
+          sql8`${sessionSystemUpdates.payload} ->> 'goalId' = ${goal.id}`,
+          sql8`(
               jsonb_typeof(${sessionSystemUpdates.payload} -> 'goalVersion') = 'number'
               and ${sessionSystemUpdates.payload} ->> 'goalVersion' ~ '^[1-9][0-9]*$'
               and ${sessionSystemUpdates.payload} ->> 'goalVersion' = ${goal.version.toString()}
@@ -26748,7 +27355,7 @@ async function updateSessionGoal(db, workspaceId, sessionId, input) {
     const [row] = await scopedDb.update(sessionGoals).set({
       ...input.text !== void 0 ? { text: input.text } : {},
       ...input.successCriteria !== void 0 ? { successCriteria: input.successCriteria } : {},
-      version: sql7`${sessionGoals.version} + 1`,
+      version: sql8`${sessionGoals.version} + 1`,
       noProgressStreak: 0,
       updatedAt: /* @__PURE__ */ new Date()
     }).where(
@@ -26885,8 +27492,8 @@ async function updateSessionTitle(db, input) {
       and10(
         eq10(sessions.workspaceId, input.workspaceId),
         eq10(sessions.id, input.sessionId),
-        sql7`${sessions.title} is distinct from ${input.title}`,
-        ...input.source === "agent" ? [sql7`${sessions.titleSource} is distinct from 'user'`] : []
+        sql8`${sessions.title} is distinct from ${input.title}`,
+        ...input.source === "agent" ? [sql8`${sessions.titleSource} is distinct from 'user'`] : []
       )
     ).returning({ title: sessions.title });
     if (row) {
@@ -27045,7 +27652,7 @@ async function turnHasFailureCodeTx(tx, workspaceId, sessionId, turnId, code) {
       eq10(sessionEvents.sessionId, sessionId),
       eq10(sessionEvents.turnId, turnId),
       eq10(sessionEvents.type, "turn.failed"),
-      sql7`${sessionEvents.payload} ->> 'code' = ${code}`
+      sql8`${sessionEvents.payload} ->> 'code' = ${code}`
     )
   ).limit(1);
   return Boolean(failure);
@@ -27055,7 +27662,7 @@ async function latestFinishedTurnHasFailureCodeTx(tx, workspaceId, sessionId, co
     and10(
       eq10(sessionTurns.workspaceId, workspaceId),
       eq10(sessionTurns.sessionId, sessionId),
-      sql7`${sessionTurns.finishedAt} is not null`
+      sql8`${sessionTurns.finishedAt} is not null`
     )
   ).orderBy(desc5(sessionTurns.position), desc5(sessionTurns.createdAt)).limit(1);
   return latestFinished ? await turnHasFailureCodeTx(tx, workspaceId, sessionId, latestFinished.id, code) : false;
@@ -27108,7 +27715,7 @@ async function evaluateGoalContinuation(db, input) {
         and10(
           eq10(sessionTurns.workspaceId, input.workspaceId),
           eq10(sessionTurns.sessionId, input.sessionId),
-          sql7`${sessionTurns.finishedAt} is not null`
+          sql8`${sessionTurns.finishedAt} is not null`
         )
       ).orderBy(desc5(sessionTurns.position), desc5(sessionTurns.createdAt)).limit(1);
       const contextCompactionFailure = latestFinished ? await turnHasFailureCodeTx(
@@ -27131,18 +27738,18 @@ async function evaluateGoalContinuation(db, input) {
           noProgressStreak = 0;
         } else if (lastFinished) {
           const [{ rotatedFailures } = { rotatedFailures: 0 }] = await tx.select({
-            rotatedFailures: sql7`count(*)::int`
+            rotatedFailures: sql8`count(*)::int`
           }).from(sessionEvents).where(
             and10(
               eq10(sessionEvents.workspaceId, input.workspaceId),
               eq10(sessionEvents.turnId, row.lastContinuationTurnId),
               eq10(sessionEvents.type, "turn.failed"),
-              sql7`${sessionEvents.payload} ->> 'rotated' = 'true'`
+              sql8`${sessionEvents.payload} ->> 'rotated' = 'true'`
             )
           );
           rotatedFailover = Number(rotatedFailures) > 0;
           const [{ toolCalls } = { toolCalls: 0 }] = await tx.select({
-            toolCalls: sql7`count(*)::int`
+            toolCalls: sql8`count(*)::int`
           }).from(sessionEvents).where(
             and10(
               eq10(sessionEvents.workspaceId, input.workspaceId),
@@ -27155,13 +27762,13 @@ async function evaluateGoalContinuation(db, input) {
             noProgressStreak = 0;
           } else {
             const [{ backpressureFailures } = { backpressureFailures: 0 }] = await tx.select({
-              backpressureFailures: sql7`count(*)::int`
+              backpressureFailures: sql8`count(*)::int`
             }).from(sessionEvents).where(
               and10(
                 eq10(sessionEvents.workspaceId, input.workspaceId),
                 eq10(sessionEvents.turnId, row.lastContinuationTurnId),
                 eq10(sessionEvents.type, "turn.failed"),
-                sql7`${sessionEvents.payload} ->> 'recovery' = 'goal_continuation'`
+                sql8`${sessionEvents.payload} ->> 'recovery' = 'goal_continuation'`
               )
             );
             if (Number(backpressureFailures) === 0) {
@@ -27266,7 +27873,7 @@ async function materializeGoalContinuation(db, input) {
       if (!goalRead || goalRead.status !== "active" || session.status === "cancelled" || effectiveControl.state !== "active") {
         return { action: "none", events: [] };
       }
-      const malformedGoalVersionEvidence = sql7`
+      const malformedGoalVersionEvidence = sql8`
           jsonb_build_object(
             'reason', 'malformed_goal_version',
             'rawGoalVersion', ${sessionSystemUpdates.payload} ->> 'goalVersion',
@@ -27279,7 +27886,7 @@ async function materializeGoalContinuation(db, input) {
         deliveredTurnId: null,
         deliveredAt: null,
         summary: "Malformed goal continuation quarantined: malformed_goal_version",
-        payload: sql7`
+        payload: sql8`
               (
                 case
                   when jsonb_typeof(${sessionSystemUpdates.payload}) = 'object'
@@ -27298,7 +27905,7 @@ async function materializeGoalContinuation(db, input) {
                 )
               )
             `,
-        lineage: sql7`
+        lineage: sql8`
               (
                 case
                   when jsonb_typeof(${sessionSystemUpdates.lineage}) = 'object'
@@ -27314,8 +27921,8 @@ async function materializeGoalContinuation(db, input) {
           eq10(sessionSystemUpdates.sessionId, input.sessionId),
           eq10(sessionSystemUpdates.kind, "goal_continuation"),
           eq10(sessionSystemUpdates.state, "pending"),
-          sql7`${sessionSystemUpdates.payload} ->> 'goalId' = ${goalRead.id}`,
-          sql7`(
+          sql8`${sessionSystemUpdates.payload} ->> 'goalId' = ${goalRead.id}`,
+          sql8`(
                 jsonb_typeof(${sessionSystemUpdates.payload} -> 'goalVersion') = 'number'
                 and ${sessionSystemUpdates.payload} ->> 'goalVersion' ~ '^[1-9][0-9]*$'
                 and ${sessionSystemUpdates.payload} ->> 'goalVersion' = ${goalRead.version.toString()}
@@ -27359,8 +27966,8 @@ async function materializeGoalContinuation(db, input) {
           eq10(sessionSystemUpdates.sessionId, input.sessionId),
           eq10(sessionSystemUpdates.kind, "goal_continuation"),
           eq10(sessionSystemUpdates.state, "pending"),
-          sql7`${sessionSystemUpdates.payload} ->> 'goalId' = ${goalRead.id}`,
-          sql7`(
+          sql8`${sessionSystemUpdates.payload} ->> 'goalId' = ${goalRead.id}`,
+          sql8`(
                 jsonb_typeof(${sessionSystemUpdates.payload} -> 'goalVersion') = 'number'
                 and ${sessionSystemUpdates.payload} ->> 'goalVersion' ~ '^[1-9][0-9]*$'
                 and ${sessionSystemUpdates.payload} ->> 'goalVersion' = ${goalRead.version.toString()}
@@ -27389,7 +27996,7 @@ async function materializeGoalContinuation(db, input) {
       let goalWakeRevision = goalRead.continuationWakeRevision;
       if (goalWakeRevision <= goalRead.continuationObservedRevision) {
         const [repaired] = await tx.update(sessionGoals).set({
-          continuationWakeRevision: sql7`${sessionGoals.continuationWakeRevision} + 1`,
+          continuationWakeRevision: sql8`${sessionGoals.continuationWakeRevision} + 1`,
           updatedAt: /* @__PURE__ */ new Date()
         }).where(eq10(sessionGoals.id, goalRead.id)).returning({
           revision: sessionGoals.continuationWakeRevision
@@ -28116,7 +28723,7 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
           return;
         }
         const [{ position } = { position: 0 }] = await tx.select({
-          position: sql7`coalesce(max(${sessionHistoryItems.position}), -1) + 1`
+          position: sql8`coalesce(max(${sessionHistoryItems.position}), -1) + 1`
         }).from(sessionHistoryItems).where(
           and10(
             eq10(sessionHistoryItems.workspaceId, workspaceId),
@@ -28275,19 +28882,19 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
           }
           const now2 = /* @__PURE__ */ new Date();
           const dispatchGeneration2 = parsedDispatch.generation + 1;
-          await tx.execute(sql7`set local opengeni.session_inference_claim = '1'`);
+          await tx.execute(sql8`set local opengeni.session_inference_claim = '1'`);
           const [resumed] = await tx.update(sessionTurns).set({
             status: "running",
             triggerEventId: input.trigger.triggerEventId,
             temporalWorkflowId: workflowId,
-            executionGeneration: sql7`${sessionTurns.executionGeneration} + 1`,
+            executionGeneration: sql8`${sessionTurns.executionGeneration} + 1`,
             activeAttemptId: input.attemptId,
             metadata: metadataWithTurnDispatchAttempt(activeTurn.metadata, {
               id: input.dispatchId,
               generation: dispatchGeneration2,
               triggerEventId: input.trigger.triggerEventId
             }),
-            version: sql7`${sessionTurns.version} + 1`,
+            version: sql8`${sessionTurns.version} + 1`,
             startedAt: now2,
             finishedAt: null,
             updatedAt: now2
@@ -28319,18 +28926,18 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
           }
           const now2 = /* @__PURE__ */ new Date();
           const dispatchGeneration2 = parsedDispatch.generation + 1;
-          await tx.execute(sql7`set local opengeni.session_inference_claim = '1'`);
+          await tx.execute(sql8`set local opengeni.session_inference_claim = '1'`);
           const [resumed] = await tx.update(sessionTurns).set({
             status: "running",
             temporalWorkflowId: workflowId,
-            executionGeneration: sql7`${sessionTurns.executionGeneration} + 1`,
+            executionGeneration: sql8`${sessionTurns.executionGeneration} + 1`,
             activeAttemptId: input.attemptId,
             metadata: metadataWithTurnDispatchAttempt(activeTurn.metadata, {
               id: input.dispatchId,
               generation: dispatchGeneration2,
               triggerEventId: activeTurn.triggerEventId
             }),
-            version: sql7`${sessionTurns.version} + 1`,
+            version: sql8`${sessionTurns.version} + 1`,
             startedAt: now2,
             finishedAt: null,
             updatedAt: now2
@@ -28396,7 +29003,7 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
       ).limit(1).for("update");
       const rows = await rawRows(
         tx,
-        sql7`select id, trigger_event_id, metadata from session_turns
+        sql8`select id, trigger_event_id, metadata from session_turns
               where workspace_id = ${workspaceId} and session_id = ${sessionId}
                 and status = 'queued' and source in ('user', 'api')
                 and (
@@ -28440,7 +29047,7 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
             context: {}
           };
           const [{ position: position2 } = { position: 1 }] = await tx.select({
-            position: sql7`coalesce(max(${sessionTurns.position}), 0) + 1`
+            position: sql8`coalesce(max(${sessionTurns.position}), 0) + 1`
           }).from(sessionTurns).where(
             and10(
               eq10(sessionTurns.workspaceId, workspaceId),
@@ -28457,10 +29064,10 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
             and10(
               eq10(sessionTurns.workspaceId, workspaceId),
               eq10(sessionTurns.sessionId, sessionId),
-              sql7`${sessionTurns.startedAt} is not null`
+              sql8`${sessionTurns.startedAt} is not null`
             )
           ).orderBy(desc5(sessionTurns.startedAt), desc5(sessionTurns.createdAt)).limit(1);
-          await tx.execute(sql7`set local opengeni.session_inference_claim = '1'`);
+          await tx.execute(sql8`set local opengeni.session_inference_claim = '1'`);
           const [compactionTurn] = await tx.insert(sessionTurns).values({
             id: turnId2,
             accountId: session.accountId,
@@ -28558,7 +29165,7 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
         const turnId = crypto.randomUUID();
         const triggerEventId = crypto.randomUUID();
         const [{ position } = { position: 1 }] = await tx.select({
-          position: sql7`coalesce(max(${sessionTurns.position}), 0) + 1`
+          position: sql8`coalesce(max(${sessionTurns.position}), 0) + 1`
         }).from(sessionTurns).where(
           and10(
             eq10(sessionTurns.workspaceId, workspaceId),
@@ -28683,7 +29290,7 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
           and10(
             eq10(sessionTurns.workspaceId, workspaceId),
             eq10(sessionTurns.sessionId, sessionId),
-            sql7`${sessionTurns.startedAt} is not null`
+            sql8`${sessionTurns.startedAt} is not null`
           )
         ).orderBy(desc5(sessionTurns.startedAt), desc5(sessionTurns.createdAt)).limit(1);
         const model = typeof goalPolicy?.model === "string" ? goalPolicy.model : latestStarted?.model ?? session.model;
@@ -28701,7 +29308,7 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
         );
         const tools = Array.isArray(goalPolicy?.tools) ? goalPolicy.tools : latestStarted?.tools ?? session.tools;
         const sandboxBackend = typeof goalPolicy?.sandboxBackend === "string" ? goalPolicy.sandboxBackend : latestStarted?.sandboxBackend ?? session.sandboxBackend;
-        await tx.execute(sql7`set local opengeni.session_inference_claim = '1'`);
+        await tx.execute(sql8`set local opengeni.session_inference_claim = '1'`);
         const [internalTurn] = await tx.insert(sessionTurns).values({
           id: turnId,
           accountId: session.accountId,
@@ -28787,18 +29394,18 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
         throw new Error("Turn dispatch generation exhausted; refusing to wrap or reuse it");
       }
       const dispatchGeneration = queuedDispatch.generation + 1;
-      await tx.execute(sql7`set local opengeni.session_inference_claim = '1'`);
+      await tx.execute(sql8`set local opengeni.session_inference_claim = '1'`);
       const [row] = await tx.update(sessionTurns).set({
         status: "running",
         temporalWorkflowId: workflowId,
-        executionGeneration: sql7`${sessionTurns.executionGeneration} + 1`,
+        executionGeneration: sql8`${sessionTurns.executionGeneration} + 1`,
         activeAttemptId: input.attemptId,
         metadata: metadataWithTurnDispatchAttempt(queuedTurn?.metadata, {
           id: input.dispatchId,
           generation: dispatchGeneration,
           triggerEventId: queuedTurn.trigger_event_id
         }),
-        version: sql7`${sessionTurns.version} + 1`,
+        version: sql8`${sessionTurns.version} + 1`,
         startedAt: now,
         updatedAt: now
       }).where(
@@ -28809,7 +29416,7 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
       }
       await registerAttempt(row);
       const [{ historyPosition } = { historyPosition: 0 }] = await tx.select({
-        historyPosition: sql7`coalesce(max(${sessionHistoryItems.position}), -1) + 1`
+        historyPosition: sql8`coalesce(max(${sessionHistoryItems.position}), -1) + 1`
       }).from(sessionHistoryItems).where(
         and10(
           eq10(sessionHistoryItems.workspaceId, workspaceId),
@@ -29015,7 +29622,7 @@ async function reconcileSessionAttemptQuiescence(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const rows = await scopedDb.execute(sql7`
+      const rows = await scopedDb.execute(sql8`
         select
           attempt.account_id,
           attempt.state,
@@ -29469,7 +30076,7 @@ async function peekSessionWork(db, workspaceId, sessionId) {
             isNotNull(sessionHumanInputRequests.expiresAt)
           )
         ).orderBy(
-          sql7`${sessionHumanInputRequests.expiresAt} asc nulls last`,
+          sql8`${sessionHumanInputRequests.expiresAt} asc nulls last`,
           asc5(sessionHumanInputRequests.id)
         ).limit(1);
         return expiringHumanInput?.expiresAt ? {
@@ -29612,7 +30219,7 @@ async function settleSessionIdleWithParentOutbox(db, workspaceId, sessionId) {
         return { action: "stale", episodeKey: null, events: [] };
       }
       const [{ episodeSequence } = { episodeSequence: 0 }] = await tx.select({
-        episodeSequence: sql7`coalesce(max(${sessionEvents.sequence}), 0)::int`
+        episodeSequence: sql8`coalesce(max(${sessionEvents.sequence}), 0)::int`
       }).from(sessionEvents).where(
         and10(
           eq10(sessionEvents.workspaceId, workspaceId),
@@ -29903,7 +30510,7 @@ async function applySessionTurnSettlement(db, workspaceId, input) {
           }
         }
         const [{ maxVersion } = { maxVersion: 0 }] = await tx.select({
-          maxVersion: sql7`coalesce(max(${agentRunStates.stateVersion}), 0)`
+          maxVersion: sql8`coalesce(max(${agentRunStates.stateVersion}), 0)`
         }).from(agentRunStates).where(
           and10(
             eq10(agentRunStates.workspaceId, workspaceId),
@@ -29949,7 +30556,7 @@ async function applySessionTurnSettlement(db, workspaceId, input) {
                 turnGeneration: turn.executionGeneration,
                 updatedAt: /* @__PURE__ */ new Date()
               },
-              setWhere: sql7`
+              setWhere: sql8`
                   ${sessionHumanInputRequests.status} = 'pending'
                   and ${sessionHumanInputRequests.allowSkip} = ${request.allowSkip}
                   and ${sessionHumanInputRequests.questions} = ${JSON.stringify(request.questions)}::jsonb
@@ -30157,7 +30764,7 @@ async function applySessionTurnSettlement(db, workspaceId, input) {
       const inserted = values.length > 0 ? await tx.insert(sessionEvents).values(values).returning() : [];
       const terminal = input.turnStatus === "completed" || input.turnStatus === "cancelled" || input.turnStatus === "failed" || input.turnStatus === "superseded";
       if (input.turnStatus === "running") {
-        await tx.execute(sql7`set local opengeni.session_inference_claim = '1'`);
+        await tx.execute(sql8`set local opengeni.session_inference_claim = '1'`);
       }
       await tx.update(sessionTurns).set({
         status: input.turnStatus,
@@ -30200,7 +30807,7 @@ async function applySessionTurnSettlement(db, workspaceId, input) {
       );
       if (terminal && input.activeTurnId === null) {
         const [armedGoal] = await tx.update(sessionGoals).set({
-          continuationWakeRevision: sql7`${sessionGoals.continuationWakeRevision} + 1`,
+          continuationWakeRevision: sql8`${sessionGoals.continuationWakeRevision} + 1`,
           updatedAt: now
         }).where(
           and10(
@@ -30256,7 +30863,7 @@ async function settleCodexCredentialLeaseLoss(db, input) {
         return { action: "stale", events: [] };
       }
       const leaseRows = await tx.execute(
-        sql7`
+        sql8`
             select holder_id, generation from codex_credential_leases
             where account_id = ${input.accountId}
               and workspace_id = ${input.workspaceId}
@@ -30382,7 +30989,7 @@ async function settleCodexCredentialLeaseLoss(db, input) {
           eq10(sessions.activeTurnId, input.turnId)
         )
       );
-      await tx.execute(sql7`
+      await tx.execute(sql8`
           delete from codex_credential_leases
           where account_id = ${input.accountId}
             and workspace_id = ${input.workspaceId}
@@ -30434,7 +31041,7 @@ async function settleCodexCredentialFailover(db, input) {
         };
       }
       const leaseRows = await tx.execute(
-        sql7`
+        sql8`
           select holder_id, generation from codex_credential_leases
           where account_id = ${input.accountId}
             and workspace_id = ${input.workspaceId}
@@ -30544,7 +31151,7 @@ async function settleCodexCredentialFailover(db, input) {
           eq10(sessions.activeTurnId, input.turnId)
         )
       );
-      await tx.execute(sql7`
+      await tx.execute(sql8`
           delete from codex_credential_leases
           where account_id = ${input.accountId}
             and workspace_id = ${input.workspaceId}
@@ -30610,7 +31217,7 @@ async function requestSessionTurnRecovery(db, workspaceId, input) {
               input.providerArtifactInvalidation.codexCredentialId
             ),
             isNull3(sessionHistoryItems.providerArtifactInvalidatedAt),
-            sql7`${sessionHistoryItems.item} ->> 'type' in ('reasoning', 'compaction')`
+            sql8`${sessionHistoryItems.item} ->> 'type' in ('reasoning', 'compaction')`
           )
         ).returning({ id: sessionHistoryItems.id });
         const [latestRunState] = await tx.select({ id: agentRunStates.id }).from(agentRunStates).where(
@@ -31010,7 +31617,7 @@ async function getActiveSessionTurnForExecution(db, workspaceId, sessionId) {
         eq10(sessionTurnAttempts.turnId, sessionTurns.id),
         inArray5(sessionTurnAttempts.state, ["claimed", "running"]),
         inArray5(sessionTurns.status, ["running", "recovering", "waiting_capacity"]),
-        sql7`not exists (
+        sql8`not exists (
             select 1
             from ${sessionAttemptInterruptions} interruption
             where interruption.workspace_id = ${workspaceId}
@@ -31050,7 +31657,7 @@ async function getSessionTurnForAttempt(db, workspaceId, sessionId, attemptId) {
           "recovering",
           "waiting_capacity"
         ]),
-        sql7`not exists (
+        sql8`not exists (
             select 1
             from ${sessionAttemptInterruptions} interruption
             where interruption.workspace_id = ${workspaceId}
@@ -31113,7 +31720,7 @@ async function getSessionQueueSnapshot(db, workspaceId, sessionId) {
         eq10(sessionSystemUpdates.state, "pending")
       )
     ).orderBy(
-      sql7`case when ${sessionSystemUpdates.kind} = 'agent_steer_instruction' then 0 else 1 end`,
+      sql8`case when ${sessionSystemUpdates.kind} = 'agent_steer_instruction' then 0 else 1 end`,
       asc5(sessionSystemUpdates.createdAt),
       asc5(sessionSystemUpdates.id)
     );
@@ -31254,7 +31861,7 @@ async function getSessionSystemUpdateOutboxByDedupeKey(db, input) {
   );
 }
 async function claimPendingSessionSystemUpdateOutbox(db, limit = 100) {
-  const rows = await rawRows(db, sql7`select * from opengeni_private.claim_session_system_update_outbox(${limit})`);
+  const rows = await rawRows(db, sql8`select * from opengeni_private.claim_session_system_update_outbox(${limit})`);
   return rows.map(mapSystemUpdateOutboxRow);
 }
 async function enqueueSessionWorkflowWakeInTransaction(tx, input) {
@@ -31271,13 +31878,13 @@ async function enqueueSessionWorkflowWakeInTransaction(tx, input) {
     target: sessionWorkflowWakeOutbox.sessionId,
     set: {
       temporalWorkflowId: input.temporalWorkflowId,
-      wakeRevision: sql7`${sessionWorkflowWakeOutbox.wakeRevision} + 1`,
+      wakeRevision: sql8`${sessionWorkflowWakeOutbox.wakeRevision} + 1`,
       reason: input.reason,
       attempts: 0,
       // Coalescing a delayed retry must never postpone an already-due wake
       // owned by another producer. A later revision makes the batch richer;
       // it does not revoke the earlier delivery obligation.
-      nextAttemptAt: sql7`least(${sessionWorkflowWakeOutbox.nextAttemptAt}, ${nextAttemptAt.toISOString()}::timestamptz)`,
+      nextAttemptAt: sql8`least(${sessionWorkflowWakeOutbox.nextAttemptAt}, ${nextAttemptAt.toISOString()}::timestamptz)`,
       lastError: null,
       updatedAt: now
     }
@@ -31317,7 +31924,7 @@ async function enqueueSessionWorkflowWakeIfRunnable(db, input) {
   );
 }
 async function claimPendingSessionWorkflowWakes(db, limit = 100) {
-  const rows = await rawRows(db, sql7`select * from opengeni_private.claim_session_workflow_wakes(${limit})`);
+  const rows = await rawRows(db, sql8`select * from opengeni_private.claim_session_workflow_wakes(${limit})`);
   return rows.map((row) => ({
     accountId: row.account_id,
     workspaceId: row.workspace_id,
@@ -31389,9 +31996,9 @@ async function markSessionWorkflowWakeDelivered(db, input) {
         }
       }
       const [row] = await tx.update(sessionWorkflowWakeOutbox).set({
-        deliveredRevision: sql7`greatest(${sessionWorkflowWakeOutbox.deliveredRevision}, ${input.wakeRevision})`,
-        attempts: sql7`case when ${sessionWorkflowWakeOutbox.wakeRevision} = ${input.wakeRevision} then 0 else ${sessionWorkflowWakeOutbox.attempts} end`,
-        lastError: sql7`case when ${sessionWorkflowWakeOutbox.wakeRevision} = ${input.wakeRevision} then null else ${sessionWorkflowWakeOutbox.lastError} end`,
+        deliveredRevision: sql8`greatest(${sessionWorkflowWakeOutbox.deliveredRevision}, ${input.wakeRevision})`,
+        attempts: sql8`case when ${sessionWorkflowWakeOutbox.wakeRevision} = ${input.wakeRevision} then 0 else ${sessionWorkflowWakeOutbox.attempts} end`,
+        lastError: sql8`case when ${sessionWorkflowWakeOutbox.wakeRevision} = ${input.wakeRevision} then null else ${sessionWorkflowWakeOutbox.lastError} end`,
         updatedAt: /* @__PURE__ */ new Date()
       }).where(
         and10(
@@ -31603,7 +32210,7 @@ async function addSessionSystemUpdateWithSourceMutation(db, input, mutateSource)
             eq10(sessionEvents.workspaceId, input.workspaceId),
             eq10(sessionEvents.sessionId, input.sessionId),
             eq10(sessionEvents.type, "system.update.pending"),
-            sql7`${sessionEvents.payload} ->> 'updateId' = ${existing.id}`
+            sql8`${sessionEvents.payload} ->> 'updateId' = ${existing.id}`
           )
         ).limit(1);
         if (!pendingEvent) throw new Error("System-update pending event disappeared");
@@ -31692,7 +32299,7 @@ async function listSessionSystemUpdatesForTurn(db, workspaceId, sessionId, turnI
       // materialized goal continuation. Keep all coalesced work in one
       // metered inference, but render the winning Steer last so transaction
       // timestamps cannot let an older goal prompt override it.
-      sql7`case when ${sessionSystemUpdates.kind} = 'agent_steer_instruction' then 1 else 0 end`,
+      sql8`case when ${sessionSystemUpdates.kind} = 'agent_steer_instruction' then 1 else 0 end`,
       asc5(sessionSystemUpdates.createdAt),
       asc5(sessionSystemUpdates.id)
     );
@@ -31954,7 +32561,7 @@ async function appendSessionEventsForTurnAttempt(db, workspaceId, sessionId, tur
           eq10(sessionEvents.type, "agent.model.usage"),
           eq10(sessionEvents.turnAssociation, "current"),
           inArray5(
-            sql7`${sessionEvents.payload} ->> 'sourceKey'`,
+            sql8`${sessionEvents.payload} ->> 'sourceKey'`,
             incomingUsageKeys
           )
         )
@@ -32084,7 +32691,7 @@ async function appendSessionEventToSandboxGroup(db, workspaceId, sandboxGroupId,
       const inserted = await tx.insert(sessionEvents).values(values).returning();
       const lockedSessionIds = rows.map((row) => row.id);
       const updated = await tx.update(sessions).set({
-        lastSequence: sql7`${sessions.lastSequence} + 1`,
+        lastSequence: sql8`${sessions.lastSequence} + 1`,
         ...sessionEventTypesAdvanceActivity([input]) ? { updatedAt: /* @__PURE__ */ new Date() } : {}
       }).where(
         and10(
@@ -33032,14 +33639,21 @@ export {
   MEMORY_BLOCK_RECORD_LIMIT,
   MEMORY_CORRECT_TOOL_DESCRIPTION,
   MEMORY_KIND_SECTION_TITLES,
+  MEMORY_LABEL_MAX_CHARS,
+  MEMORY_LABEL_MAX_COUNT,
+  MEMORY_NAMESPACE_MAX_CHARS,
   MEMORY_NEAR_DUP_COSINE_THRESHOLD,
   MEMORY_NEAR_DUP_NEIGHBORS,
+  MEMORY_RELATIONSHIP_TYPES,
+  MEMORY_ROLE_KEY_MAX_CHARS,
   MEMORY_SAVE_TOOL_DESCRIPTION,
   MEMORY_SEARCH_DEFAULT_LIMIT,
   MEMORY_SEARCH_MAX_LIMIT,
   MEMORY_SEARCH_TOOL_DESCRIPTION,
+  MEMORY_SUBJECT_ID_MAX_CHARS,
   MEMORY_TEXT_MAX_CHARS,
   MEMORY_VISIBLE_RECORD_CAP,
+  MemoryGovernanceAuthorityError,
   NON_RLS_RUNTIME_TABLES,
   NewSessionDraftAccessError,
   NewSessionDraftConflictError,
@@ -33139,6 +33753,7 @@ export {
   applyContextCompaction,
   applyCreditDebitUpToBalance,
   applyCreditLedgerEntry,
+  applyKnowledgeMemoryOperation,
   applySessionTurnSettlement,
   approveDeviceEnrollmentRequest,
   areGitHubRepositoriesAllowedForWorkspace,
@@ -33159,6 +33774,7 @@ export {
   buildCodexTokenResolver,
   buildConnectionTokenResolver,
   buildHostConnectionTokenResolver,
+  canonicalMemoryRelationship,
   canonicalSessionCommandHash,
   changePreferenceRegistryScope,
   claimCodexResetRedemption,
@@ -33253,7 +33869,7 @@ export {
   createWorkspaceEnvironment,
   createWorkspaceInstructionPolicyDraft,
   databaseFailureCode,
-  sql8 as dbSql,
+  sql9 as dbSql,
   deactivatePreferenceRegistry,
   deadLetterHostExportHead,
   decodeSessionListCursor,
@@ -33261,6 +33877,7 @@ export {
   decryptEnvironmentValue as decryptVariableSetValue,
   decryptedCapabilityHeaders,
   deferRetainedProcessReconciliation,
+  deferSlackInteractionDelivery,
   deleteGitHubInstallationBinding,
   deleteRecording,
   deleteRig,
@@ -33409,6 +34026,8 @@ export {
   grantWorkspaceAccess,
   hasAuditableGitHubInstallationAuthority,
   hasCreditLedgerEntry,
+  hashMemoryOperationPlan,
+  hashMemoryRevertPlan,
   hashMemoryText,
   heartbeatCodexCredentialLease,
   heartbeatCodexCredentialLeaseUntil,
@@ -33427,6 +34046,7 @@ export {
   isCodexBilledModel2 as isCodexBilledModel,
   isCodexBilledTurn,
   isDatabasePersistenceFailure,
+  isMemoryScopeApplicable,
   isMemoryTextTooLong,
   isPrivateAddress,
   isRetryablePersistenceSqlState,
@@ -33501,6 +34121,7 @@ export {
   loadCodexCredentialForRun,
   loadConnectionCredentialForBroker,
   loadIntegrationOAuthClient,
+  loadSocialConnectionCredential,
   loadVariableSetForRun,
   loadWorkspaceEnvironmentForRun,
   lockSessionEventWriteRows,
@@ -33530,6 +34151,13 @@ export {
   newSessionDraftToolsProvided,
   nextSessionHistoryPosition,
   normalizeBearerScheme,
+  normalizeMemoryLabel,
+  normalizeMemoryLabels,
+  normalizeMemoryNamespace,
+  normalizeMemoryOperationPlan,
+  normalizeMemoryRevertPlan,
+  normalizeMemoryRoleKey,
+  normalizeMemoryScope,
   normalizeMemoryText,
   orphanedResultRowIndicesForRepair,
   peekSessionWork,
@@ -33577,6 +34205,7 @@ export {
   recordStartedContextCompaction,
   recordStreamAcknowledgment,
   recordStripeWebhookEvent,
+  recordSyncedSocialPosts,
   recordUsageEvent,
   recordWarmingSandboxCreated,
   recoverSessionDispatch,
@@ -33622,6 +34251,7 @@ export {
   retainedProcessReconciliationProof,
   retainedProcessSettlementIdentity,
   retireHostExportConsumer,
+  revertKnowledgeMemoryOperation,
   revokeApiKey,
   revokeConnection,
   revokeConnectionWithSlackBotSuccessAudit,
@@ -33718,6 +34348,7 @@ export {
   updateSessionMcpApprovalPolicy,
   updateSessionMcpServerCredentials,
   updateSessionTitle,
+  updateSocialConnectionCredential,
   updateVariableSet,
   updateWorkspace,
   updateWorkspaceEnvironment,
@@ -33731,6 +34362,7 @@ export {
   upsertSandboxSessionEnvelope,
   upsertSessionGoal,
   upsertSessionGoalWithEvent,
+  upsertSocialOAuthConnection,
   upsertWorkspaceModelPolicy,
   validateHumanInputResponse,
   verifyDirectWorkspaceMutationSettlement,