@opengeni/db 0.27.7 → 0.27.8

package/dist/schema.d.ts

@@ -15342,6 +15342,23 @@ export declare const sessionWorkflowWakeOutbox: import("drizzle-orm/pg-core").Pg
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        controlRevision: import("drizzle-orm/pg-core").PgColumn<{
+            name: "control_revision";
+            tableName: "session_workflow_wake_outbox";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         reason: import("drizzle-orm/pg-core").PgColumn<{
             name: "reason";
             tableName: "session_workflow_wake_outbox";

package/dist/schema.js

@@ -139,7 +139,7 @@ import {
   workspaceVariableSetVariables,
   workspaceVariableSets,
   workspaces
-} from "./chunk-EX7CDSGH.js";
+} from "./chunk-M6EOXYHK.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,

package/dist/session-control.d.ts

@@ -259,6 +259,7 @@ export declare function registerSessionWorkflowWakeInTransaction(db: Database, i
     sessionId: string;
     temporalWorkflowId: string;
     reason: string;
+    controlRequested?: boolean;
 }): Promise<number>;
 /**
  * Internal producers share one outstanding session-level receipt. While a wake

package/drizzle/0170_session_control_wake_revision.sql

@@ -0,0 +1,133 @@
+-- deployment-mode: rolling
+-- Preserve control-priority Temporal signals across coalesced session wakes.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+ALTER TABLE "session_workflow_wake_outbox"
+  ADD COLUMN "control_revision" bigint NOT NULL DEFAULT 0;
+
+ALTER TABLE "session_workflow_wake_outbox"
+  ADD CONSTRAINT "session_workflow_wake_outbox_control_revision_check"
+  CHECK (
+    "control_revision" >= 0
+    AND "control_revision" <= "wake_revision"
+    AND "control_revision" <= 9007199254740991
+  ) NOT VALID;
+
+-- Mixed-version writers do not know the new column. Stamp recognized control
+-- reasons in the database so an old Steer followed by an old Send still leaves
+-- the earlier control revision outstanding until delivery.
+CREATE OR REPLACE FUNCTION opengeni_private.stamp_session_workflow_control_revision()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $function$
+BEGIN
+  IF NEW.reason IN (
+    'prompt_steer',
+    'queue_steer',
+    'agent_steer',
+    'session_cancelled',
+    'session_pause_interruption',
+    'workspace_pause_interruption',
+    'attempt_interruption_settled',
+    'attempt_interruption_rejected_stale'
+  ) AND NEW.wake_revision > NEW.delivered_revision THEN
+    NEW.control_revision := greatest(NEW.control_revision, NEW.wake_revision);
+  END IF;
+  RETURN NEW;
+END
+$function$;
+
+DROP TRIGGER IF EXISTS session_workflow_wake_control_revision
+  ON "session_workflow_wake_outbox";
+CREATE TRIGGER session_workflow_wake_control_revision
+BEFORE INSERT OR UPDATE OF reason, wake_revision, control_revision
+ON "session_workflow_wake_outbox"
+FOR EACH ROW
+EXECUTE FUNCTION opengeni_private.stamp_session_workflow_control_revision();
+
+-- Preserve already-committed ownerless Steer/cancellation wakes during rolling
+-- activation. Active-attempt controls remain independently discoverable from
+-- the interruption ledger below.
+UPDATE "session_workflow_wake_outbox"
+SET "control_revision" = "wake_revision"
+WHERE "delivered_revision" < "wake_revision"
+  AND "reason" IN (
+    'prompt_steer',
+    'queue_steer',
+    'agent_steer',
+    'session_cancelled',
+    'session_pause_interruption',
+    'workspace_pause_interruption'
+  );
+
+ALTER TABLE "session_workflow_wake_outbox"
+  VALIDATE CONSTRAINT "session_workflow_wake_outbox_control_revision_check";
+
+DROP FUNCTION opengeni_private.claim_session_workflow_wakes(integer);
+DO $migration$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE FUNCTION opengeni_private.claim_session_workflow_wakes(p_limit integer)
+    RETURNS TABLE (
+      account_id uuid,
+      workspace_id uuid,
+      session_id uuid,
+      temporal_workflow_id text,
+      wake_revision bigint,
+      interruption_requested boolean
+    )
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    BEGIN
+      RETURN QUERY
+        WITH due AS (
+          SELECT o.session_id
+          FROM %1$I.session_workflow_wake_outbox o
+          WHERE o.wake_revision > o.delivered_revision
+            AND o.next_attempt_at <= now()
+          ORDER BY o.next_attempt_at, o.updated_at, o.session_id
+          FOR UPDATE SKIP LOCKED
+          LIMIT greatest(1, least(coalesce(p_limit, 100), 1000))
+        )
+        UPDATE %1$I.session_workflow_wake_outbox o
+        SET attempts = o.attempts + 1,
+            next_attempt_at = now() + make_interval(
+              secs => least(300, greatest(1, power(2, least(o.attempts, 8))::integer))
+            ),
+            updated_at = now()
+        FROM due
+        WHERE o.session_id = due.session_id
+        RETURNING o.account_id, o.workspace_id, o.session_id,
+          o.temporal_workflow_id, o.wake_revision,
+          o.control_revision > o.delivered_revision
+          OR EXISTS (
+            SELECT 1
+            FROM %1$I.session_attempt_interruptions interruption
+            WHERE interruption.workspace_id = o.workspace_id
+              AND interruption.session_id = o.session_id
+              AND interruption.state IN (
+                'pending', 'delivered', 'acknowledged', 'settled', 'rejected_stale'
+              )
+          ) AS interruption_requested;
+    END $function$;
+  $create$, target_schema);
+END $migration$;
+
+REVOKE ALL ON FUNCTION opengeni_private.claim_session_workflow_wakes(integer) FROM PUBLIC;
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.claim_session_workflow_wakes(integer)
+      TO opengeni_app;
+  END IF;
+END $$;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "0.27.7",
+  "version": "0.27.8",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {

package/src/index.ts

@@ -37554,6 +37554,7 @@ export async function claimSessionWorkForAttempt(
                 "delivered",
                 "acknowledged",
                 "settled",
+                "rejected_stale",
               ]),
               isNull(schema.sessionTurnAttempts.quiescedAt),
             ),
@@ -38481,28 +38482,6 @@ export async function claimSessionWorkForAttempt(
             turn: mapSessionTurnForExecution(internalTurn),
           };
         }
-        const predecessorAttemptId = queuedSteerReplacementAttemptId(queuedTurn.metadata);
-        if (predecessorAttemptId) {
-          const [predecessor] = await tx
-            .select({ quiescedAt: schema.sessionTurnAttempts.quiescedAt })
-            .from(schema.sessionTurnAttempts)
-            .where(
-              and(
-                eq(schema.sessionTurnAttempts.workspaceId, workspaceId),
-                eq(schema.sessionTurnAttempts.sessionId, sessionId),
-                eq(schema.sessionTurnAttempts.id, predecessorAttemptId),
-              ),
-            )
-            .limit(1);
-          if (!predecessor) {
-            throw new SessionControlInvariantError(
-              `Queued Steer ${id} points to missing predecessor attempt ${predecessorAttemptId}`,
-            );
-          }
-          if (!predecessor.quiescedAt) {
-            return { action: "unclaimed", reason: "control-pending" };
-          }
-        }
         // The database guard makes this function the only supported
         // queued-to-running transition. Raw or stale claimers cannot bypass the
         // generation/active-pointer transaction.
@@ -39136,6 +39115,14 @@ export async function settleSessionAttemptInterruptions(
               interruptions.map((interruption) => interruption.id),
             ),
           );
+        await enqueueSessionWorkflowWakeInTransaction(tx as unknown as Database, {
+          accountId: session.accountId,
+          workspaceId,
+          sessionId,
+          temporalWorkflowId: session.temporalWorkflowId ?? `session-${sessionId}`,
+          reason: "attempt_interruption_rejected_stale",
+          controlRequested: true,
+        });
         return {
           action: effectiveControl.state === "paused" ? "paused" : "continue",
           events: [],
@@ -39327,6 +39314,14 @@ export async function settleSessionAttemptInterruptions(
             interruptions.map((interruption) => interruption.id),
           ),
         );
+      await enqueueSessionWorkflowWakeInTransaction(tx as unknown as Database, {
+        accountId: session.accountId,
+        workspaceId,
+        sessionId,
+        temporalWorkflowId: session.temporalWorkflowId ?? `session-${sessionId}`,
+        reason: "attempt_interruption_settled",
+        controlRequested: true,
+      });
       return {
         action: effectiveControl.state === "paused" ? "paused" : "continue",
         events: [...closedTools.events, ...eventRows.map(mapEvent)],
@@ -39355,6 +39350,50 @@ export type SessionWorkPeek =
   | { kind: "cancellation-wait"; attemptId: string }
   | { kind: "idle" };
 
+/**
+ * Return the oldest exact attempt whose logical interruption settled but whose
+ * physical quiescence receipt is still missing. This deliberately searches all
+ * attempts: a provider-recovery race can create a newer generation before the
+ * predecessor receipt is reconciled, and looking only at the newest attempt
+ * would strand the replacement forever.
+ */
+async function nextSessionAttemptAwaitingQuiescence(
+  db: Database,
+  workspaceId: string,
+  sessionId: string,
+): Promise<{
+  attemptId: string;
+} | null> {
+  const [row] = await db
+    .select({
+      attemptId: schema.sessionTurnAttempts.id,
+    })
+    .from(schema.sessionTurnAttempts)
+    .innerJoin(
+      schema.sessionAttemptInterruptions,
+      and(
+        eq(schema.sessionAttemptInterruptions.workspaceId, schema.sessionTurnAttempts.workspaceId),
+        eq(schema.sessionAttemptInterruptions.sessionId, schema.sessionTurnAttempts.sessionId),
+        eq(schema.sessionAttemptInterruptions.attemptId, schema.sessionTurnAttempts.id),
+      ),
+    )
+    .where(
+      and(
+        eq(schema.sessionTurnAttempts.workspaceId, workspaceId),
+        eq(schema.sessionTurnAttempts.sessionId, sessionId),
+        eq(schema.sessionTurnAttempts.state, "closed"),
+        isNull(schema.sessionTurnAttempts.quiescedAt),
+        inArray(schema.sessionAttemptInterruptions.state, ["settled", "rejected_stale"]),
+      ),
+    )
+    .orderBy(
+      asc(schema.sessionAttemptInterruptions.requestedAt),
+      asc(schema.sessionAttemptInterruptions.id),
+    )
+    .limit(1);
+  return row ?? null;
+}
+
 async function latestSessionAttemptInterruption(
   db: Database,
   workspaceId: string,
@@ -39402,6 +39441,43 @@ async function latestSessionAttemptInterruption(
     : null;
 }
 
+async function queuedSteerHasUnquiescedPredecessor(
+  db: Database,
+  workspaceId: string,
+  sessionId: string,
+  predecessorAttemptIds: string[],
+): Promise<boolean> {
+  if (predecessorAttemptIds.length === 0) return false;
+  const [row] = await db
+    .select({ attemptId: schema.sessionTurnAttempts.id })
+    .from(schema.sessionTurnAttempts)
+    .innerJoin(
+      schema.sessionAttemptInterruptions,
+      and(
+        eq(schema.sessionAttemptInterruptions.workspaceId, schema.sessionTurnAttempts.workspaceId),
+        eq(schema.sessionAttemptInterruptions.sessionId, schema.sessionTurnAttempts.sessionId),
+        eq(schema.sessionAttemptInterruptions.attemptId, schema.sessionTurnAttempts.id),
+      ),
+    )
+    .where(
+      and(
+        eq(schema.sessionTurnAttempts.workspaceId, workspaceId),
+        eq(schema.sessionTurnAttempts.sessionId, sessionId),
+        inArray(schema.sessionTurnAttempts.id, predecessorAttemptIds),
+        isNull(schema.sessionTurnAttempts.quiescedAt),
+        inArray(schema.sessionAttemptInterruptions.state, [
+          "pending",
+          "delivered",
+          "acknowledged",
+          "settled",
+          "rejected_stale",
+        ]),
+      ),
+    )
+    .limit(1);
+  return row !== undefined;
+}
+
 /** Read durable session state without reserving a turn-worker slot or mutating it. */
 export async function peekSessionWork(
   db: Database,
@@ -39445,19 +39521,15 @@ export async function peekSessionWork(
     }
     if (effectiveControl.state !== "active") return { kind: "idle" };
 
-    const latestInterruption = await latestSessionAttemptInterruption(
+    const awaitingQuiescence = await nextSessionAttemptAwaitingQuiescence(
       scopedDb,
       workspaceId,
       sessionId,
     );
-    if (
-      latestInterruption &&
-      latestInterruption.quiescedAt === null &&
-      latestInterruption.interruptionState === "settled"
-    ) {
+    if (awaitingQuiescence) {
       return {
         kind: "cancellation-wait",
-        attemptId: latestInterruption.attemptId,
+        attemptId: awaitingQuiescence.attemptId,
       };
     }
 
@@ -41315,6 +41387,7 @@ export type RequestSessionTurnRecoveryInput = {
   attemptId: string;
   reason: string;
   detail?: Record<string, unknown>;
+  providerRecoveryCount?: number;
   fromStatuses?: SessionTurnStatus[];
   providerArtifactInvalidation?: {
     codexCredentialId: string;
@@ -41368,6 +41441,25 @@ export async function requestSessionTurnRecovery(
         { workspaceControl: locks.control ?? undefined },
       );
       const turnStatus = (turn?.status as SessionTurnStatus | undefined) ?? null;
+      const [pendingInterruption] = attempt
+        ? await tx
+            .select({ id: schema.sessionAttemptInterruptions.id })
+            .from(schema.sessionAttemptInterruptions)
+            .where(
+              and(
+                eq(schema.sessionAttemptInterruptions.workspaceId, workspaceId),
+                eq(schema.sessionAttemptInterruptions.sessionId, input.sessionId),
+                eq(schema.sessionAttemptInterruptions.attemptId, input.attemptId),
+                inArray(schema.sessionAttemptInterruptions.state, [
+                  "pending",
+                  "delivered",
+                  "acknowledged",
+                ]),
+              ),
+            )
+            .limit(1)
+            .for("update")
+        : [];
       if (
         !locks.workspace ||
         !turn ||
@@ -41381,7 +41473,8 @@ export async function requestSessionTurnRecovery(
         effectiveControl.state !== "active" ||
         session.activeTurnId !== input.turnId ||
         !fromStatuses.includes(turnStatus as SessionTurnStatus) ||
-        turn.activeAttemptId !== input.attemptId
+        turn.activeAttemptId !== input.attemptId ||
+        pendingInterruption !== undefined
       ) {
         return {
           action: "stale" as const,
@@ -41392,6 +41485,12 @@ export async function requestSessionTurnRecovery(
       }
 
       const now = new Date();
+      if (
+        input.providerRecoveryCount !== undefined &&
+        (!Number.isSafeInteger(input.providerRecoveryCount) || input.providerRecoveryCount <= 0)
+      ) {
+        throw new Error("providerRecoveryCount must be a positive safe integer");
+      }
       let providerArtifactsInvalidated = 0;
       if (input.providerArtifactInvalidation) {
         const invalidatedHistory = await tx
@@ -41533,7 +41632,12 @@ export async function requestSessionTurnRecovery(
           cancelledBy: null,
           cancelReason: null,
           version: turn.version + 1,
-          metadata: metadataWithoutTurnDispatchAttempt(turn.metadata),
+          metadata: {
+            ...metadataWithoutTurnDispatchAttempt(turn.metadata),
+            ...(input.providerRecoveryCount !== undefined
+              ? { providerRecoveryCount: input.providerRecoveryCount }
+              : {}),
+          },
           updatedAt: now,
         })
         .where(
@@ -42142,12 +42246,25 @@ export async function getSessionQueueSnapshot(
         asc(schema.sessionSystemUpdates.createdAt),
         asc(schema.sessionSystemUpdates.id),
       );
+    const items = rows.map(mapSessionTurn);
     const latestInterruption = await latestSessionAttemptInterruption(
       scopedDb,
       workspaceId,
       sessionId,
     );
-    const items = rows.map(mapSessionTurn);
+    const queuedSteerPredecessorIds = items
+      .map((turn) => queuedSteerReplacementAttemptId(turn.metadata))
+      .filter((attemptId): attemptId is string => attemptId !== null);
+    const stoppingPreviousAttempt =
+      (latestInterruption !== null &&
+        latestInterruption.interruptionState !== "rejected_stale" &&
+        latestInterruption.quiescedAt === null) ||
+      (await queuedSteerHasUnquiescedPredecessor(
+        scopedDb,
+        workspaceId,
+        sessionId,
+        queuedSteerPredecessorIds,
+      ));
     const nextInputBatch = selectBoundedSystemUpdateBatch(pendingInputs);
     const hasPendingAgentSteer = pendingInputs.some(
       (update) => update.kind === "agent_steer_instruction",
@@ -42159,10 +42276,7 @@ export async function getSessionQueueSnapshot(
       version: session.queueVersion,
       effectiveControl: serializeEffectiveSessionControl(effectiveControl),
       activePersonalConnections,
-      stoppingPreviousAttempt:
-        latestInterruption !== null &&
-        latestInterruption.interruptionState !== "rejected_stale" &&
-        latestInterruption.quiescedAt === null,
+      stoppingPreviousAttempt,
       items,
       pendingInputs: pendingInputs.map((update) => {
         const canonical = mapSessionSystemUpdate(update);
@@ -42201,7 +42315,9 @@ function queuedSteerReplacementAttemptId(metadata: Record<string, unknown>): str
   ) {
     return attemptId;
   }
-  throw new SessionControlInvariantError("Queued Steer has malformed predecessor metadata");
+  // The interruption ledger is authoritative. Historical or malformed display
+  // metadata must not make the read-only queue projection fail.
+  return null;
 }
 
 async function enqueueFailedChildOutboxForTurnTx(
@@ -42418,6 +42534,7 @@ export async function enqueueSessionWorkflowWakeInTransaction(
     temporalWorkflowId: string;
     reason: string;
     notBefore?: Date;
+    controlRequested?: boolean;
   },
 ): Promise<number> {
   const now = new Date();
@@ -42429,6 +42546,7 @@ export async function enqueueSessionWorkflowWakeInTransaction(
       workspaceId: input.workspaceId,
       sessionId: input.sessionId,
       temporalWorkflowId: input.temporalWorkflowId,
+      controlRevision: input.controlRequested ? 1 : 0,
       reason: input.reason,
       nextAttemptAt,
     })
@@ -42437,6 +42555,9 @@ export async function enqueueSessionWorkflowWakeInTransaction(
       set: {
         temporalWorkflowId: input.temporalWorkflowId,
         wakeRevision: sql`${schema.sessionWorkflowWakeOutbox.wakeRevision} + 1`,
+        controlRevision: input.controlRequested
+          ? sql`${schema.sessionWorkflowWakeOutbox.wakeRevision} + 1`
+          : sql`${schema.sessionWorkflowWakeOutbox.controlRevision}`,
         reason: input.reason,
         attempts: 0,
         // Coalescing a delayed retry must never postpone an already-due wake
@@ -42462,6 +42583,7 @@ export async function enqueueSessionWorkflowWake(
     temporalWorkflowId: string;
     reason: string;
     notBefore?: Date;
+    controlRequested?: boolean;
   },
 ): Promise<number> {
   return await withRlsContext(
@@ -42485,6 +42607,7 @@ export async function enqueueSessionWorkflowWakeIfRunnable(
     temporalWorkflowId: string;
     reason: string;
     notBefore?: Date;
+    controlRequested?: boolean;
   },
 ): Promise<number | null> {
   return await withRlsContext(

package/src/schema.ts

@@ -3246,6 +3246,7 @@ export const sessionWorkflowWakeOutbox = pgTable(
     temporalWorkflowId: text("temporal_workflow_id").notNull(),
     wakeRevision: bigint("wake_revision", { mode: "number" }).notNull().default(1),
     deliveredRevision: bigint("delivered_revision", { mode: "number" }).notNull().default(0),
+    controlRevision: bigint("control_revision", { mode: "number" }).notNull().default(0),
     reason: text("reason").notNull(),
     attempts: integer("attempts").notNull().default(0),
     nextAttemptAt: timestamp("next_attempt_at", { withTimezone: true }).notNull().defaultNow(),
@@ -3262,6 +3263,10 @@ export const sessionWorkflowWakeOutbox = pgTable(
       "session_workflow_wake_outbox_revision_safe_check",
       sql`${table.wakeRevision} <= 9007199254740991 and ${table.deliveredRevision} <= 9007199254740991`,
     ),
+    controlRevisionValid: check(
+      "session_workflow_wake_outbox_control_revision_check",
+      sql`${table.controlRevision} >= 0 and ${table.controlRevision} <= ${table.wakeRevision} and ${table.controlRevision} <= 9007199254740991`,
+    ),
     workspaceAccount: foreignKey({
       name: "session_workflow_wake_outbox_workspace_account_fk",
       columns: [table.workspaceId, table.accountId],

package/src/session-control.ts

@@ -1494,12 +1494,13 @@ async function registerContinuableWakes(
       )
     ), upserted as (
       insert into ${schema.sessionWorkflowWakeOutbox} (
-        session_id, account_id, workspace_id, temporal_workflow_id, reason
+        session_id, account_id, workspace_id, temporal_workflow_id, reason, control_revision
       )
-      select session_id, account_id, workspace_id, temporal_workflow_id, ${input.reason}
+      select session_id, account_id, workspace_id, temporal_workflow_id, ${input.reason}, 1
       from eligible
       on conflict (session_id) do update set
         wake_revision = ${schema.sessionWorkflowWakeOutbox}.wake_revision + 1,
+        control_revision = ${schema.sessionWorkflowWakeOutbox}.wake_revision + 1,
         temporal_workflow_id = excluded.temporal_workflow_id,
         reason = excluded.reason,
         attempts = 0,
@@ -1611,12 +1612,13 @@ async function registerCancellationWakes(
         and session.id in (${sessionIds})
     ), upserted as (
       insert into ${schema.sessionWorkflowWakeOutbox} (
-        session_id, account_id, workspace_id, temporal_workflow_id, reason
+        session_id, account_id, workspace_id, temporal_workflow_id, reason, control_revision
       )
-      select session_id, account_id, workspace_id, temporal_workflow_id, 'session_cancelled'
+      select session_id, account_id, workspace_id, temporal_workflow_id, 'session_cancelled', 1
       from eligible
       on conflict (session_id) do update set
         wake_revision = ${schema.sessionWorkflowWakeOutbox}.wake_revision + 1,
+        control_revision = ${schema.sessionWorkflowWakeOutbox}.wake_revision + 1,
         temporal_workflow_id = excluded.temporal_workflow_id,
         reason = excluded.reason,
         attempts = 0,
@@ -1641,6 +1643,7 @@ export async function registerSessionWorkflowWakeInTransaction(
     sessionId: string;
     temporalWorkflowId: string;
     reason: string;
+    controlRequested?: boolean;
   },
 ): Promise<number> {
   const [row] = await db
@@ -1650,6 +1653,7 @@ export async function registerSessionWorkflowWakeInTransaction(
       workspaceId: input.workspaceId,
       sessionId: input.sessionId,
       temporalWorkflowId: input.temporalWorkflowId,
+      controlRevision: input.controlRequested ? 1 : 0,
       reason: input.reason,
     })
     .onConflictDoUpdate({
@@ -1657,6 +1661,9 @@ export async function registerSessionWorkflowWakeInTransaction(
       set: {
         temporalWorkflowId: input.temporalWorkflowId,
         wakeRevision: sql`${schema.sessionWorkflowWakeOutbox.wakeRevision} + 1`,
+        controlRevision: input.controlRequested
+          ? sql`${schema.sessionWorkflowWakeOutbox.wakeRevision} + 1`
+          : sql`${schema.sessionWorkflowWakeOutbox.controlRevision}`,
         reason: input.reason,
         attempts: 0,
         nextAttemptAt: new Date(),

package/src/session-queue-commands.ts

@@ -1180,6 +1180,7 @@ export async function steerQueuedTurnInTransaction(
     sessionId: input.sessionId,
     temporalWorkflowId: session.temporalWorkflowId ?? `session-${input.sessionId}`,
     reason: "queue_steer",
+    controlRequested: true,
   });
   const receipt = await updateSessionCommandReceiptResult(db, reserved.receipt.id, {
     controlRevision: resumed.revision,
@@ -1739,6 +1740,7 @@ export async function submitHumanPromptInTransaction(
     sessionId: input.sessionId,
     temporalWorkflowId: workflowId,
     reason: input.delivery === "steer" ? "prompt_steer" : "prompt_send",
+    controlRequested: input.delivery === "steer",
   });
   await db.insert(schema.auditEvents).values({
     accountId: input.accountId,
@@ -2183,6 +2185,7 @@ export async function steerAgentSessionInTransaction(
     sessionId: input.targetSessionId,
     temporalWorkflowId: workflowId,
     reason: "agent_steer",
+    controlRequested: true,
   });
   await db
     .update(schema.sessions)