@opengeni/db 0.28.9 → 0.31.1

package/drizzle/0206_browser_sessions.sql

@@ -0,0 +1,646 @@
+-- deployment-mode: maintenance
+-- Canonical BrowserSession resource and interaction-holder authority. Every
+-- application/worker writer is upgraded together; no legacy holder protocol remains.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '30s';
+
+CREATE TABLE "workspace_interaction_revisions" (
+  "workspace_id" uuid PRIMARY KEY,
+  "account_id" uuid NOT NULL,
+  "revision" bigint NOT NULL DEFAULT 0,
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "workspace_interaction_revisions_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id") ON DELETE CASCADE,
+  CONSTRAINT "workspace_interaction_revisions_revision_check"
+    CHECK ("revision" >= 0)
+);
+
+CREATE TABLE "browser_sessions" (
+  "id" uuid PRIMARY KEY,
+  "account_id" uuid NOT NULL,
+  "workspace_id" uuid NOT NULL,
+  "name" text NOT NULL,
+  "lifecycle" text NOT NULL DEFAULT 'starting',
+  "placement_kind" text NOT NULL,
+  "sandbox_group_id" uuid,
+  "connected_sandbox_id" uuid,
+  "device_id" uuid,
+  "external_provider_id" text,
+  "external_placement_id" text,
+  "controller_id" text,
+  "controller_generation" text,
+  "placement_instance_id" text,
+  "token_generation" integer NOT NULL DEFAULT 1,
+  "driver_id" text NOT NULL,
+  "engine" text NOT NULL,
+  "engine_version" text,
+  "headless" boolean NOT NULL,
+  "identity_id" uuid,
+  "base_revision_id" uuid,
+  "linked_computer_session_id" uuid,
+  "network_route_id" uuid,
+  "private_checkpoint_artifact_id" uuid,
+  "capabilities" jsonb NOT NULL,
+  "create_operation_id" uuid NOT NULL,
+  "created_by_subject_id" text NOT NULL,
+  "failure_code" text,
+  "controller_heartbeat_at" timestamptz,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "last_used_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "browser_sessions_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id") ON DELETE CASCADE,
+  CONSTRAINT "browser_sessions_lifecycle_check" CHECK (
+    "lifecycle" IN (
+      'starting', 'active', 'suspending', 'suspended', 'restoring',
+      'repair_required', 'lost', 'ending', 'ended', 'failed'
+    )
+  ),
+  CONSTRAINT "browser_sessions_engine_check" CHECK (
+    "engine" IN ('chromium', 'chrome', 'firefox', 'webkit', 'lightpanda', 'external')
+  ),
+  CONSTRAINT "browser_sessions_values_check" CHECK (
+    octet_length("name") BETWEEN 1 AND 200
+    AND octet_length("driver_id") BETWEEN 1 AND 512
+    AND octet_length("created_by_subject_id") BETWEEN 1 AND 1024
+    AND "token_generation" > 0
+    AND jsonb_typeof("capabilities") = 'object'
+    AND octet_length("capabilities"::text) BETWEEN 2 AND 65536
+    AND ("engine_version" IS NULL OR octet_length("engine_version") BETWEEN 1 AND 256)
+    AND ("failure_code" IS NULL OR octet_length("failure_code") BETWEEN 1 AND 512)
+  ),
+  CONSTRAINT "browser_sessions_placement_check" CHECK (
+    (
+      "placement_kind" = 'sandbox_group'
+      AND "sandbox_group_id" IS NOT NULL
+      AND "connected_sandbox_id" IS NULL
+      AND "device_id" IS NULL
+      AND "external_provider_id" IS NULL
+      AND "external_placement_id" IS NULL
+    ) OR (
+      "placement_kind" = 'connected_machine'
+      AND "sandbox_group_id" IS NULL
+      AND "connected_sandbox_id" IS NOT NULL
+      AND "device_id" IS NULL
+      AND "external_provider_id" IS NULL
+      AND "external_placement_id" IS NULL
+    ) OR (
+      "placement_kind" = 'attached_device'
+      AND "sandbox_group_id" IS NULL
+      AND "connected_sandbox_id" IS NULL
+      AND "device_id" IS NOT NULL
+      AND "external_provider_id" IS NULL
+      AND "external_placement_id" IS NULL
+    ) OR (
+      "placement_kind" = 'external_provider'
+      AND "sandbox_group_id" IS NULL
+      AND "connected_sandbox_id" IS NULL
+      AND "device_id" IS NULL
+      AND "external_provider_id" IS NOT NULL
+      AND "external_placement_id" IS NOT NULL
+      AND octet_length("external_provider_id") BETWEEN 1 AND 512
+      AND octet_length("external_placement_id") BETWEEN 1 AND 512
+    )
+  ),
+  CONSTRAINT "browser_sessions_controller_check" CHECK (
+    (
+      "controller_id" IS NULL
+      AND "controller_generation" IS NULL
+      AND "placement_instance_id" IS NULL
+      AND "controller_heartbeat_at" IS NULL
+    ) OR (
+      "controller_id" IS NOT NULL
+      AND octet_length("controller_id") BETWEEN 1 AND 512
+      AND "controller_generation" IS NOT NULL
+      AND octet_length("controller_generation") BETWEEN 1 AND 256
+      AND "placement_instance_id" IS NOT NULL
+      AND octet_length("placement_instance_id") BETWEEN 1 AND 512
+      AND "controller_heartbeat_at" IS NOT NULL
+    )
+  ),
+  CONSTRAINT "browser_sessions_identity_revision_check"
+    CHECK ("base_revision_id" IS NULL OR "identity_id" IS NOT NULL),
+  CONSTRAINT "browser_sessions_failure_check" CHECK (
+    (
+      "lifecycle" IN ('repair_required', 'lost', 'failed')
+      AND "failure_code" IS NOT NULL
+    ) OR (
+      "lifecycle" NOT IN ('repair_required', 'lost', 'failed')
+      AND "failure_code" IS NULL
+    )
+  ),
+  CONSTRAINT "browser_sessions_workspace_id_uq" UNIQUE ("workspace_id", "id"),
+  CONSTRAINT "browser_sessions_workspace_create_operation_uq"
+    UNIQUE ("workspace_id", "create_operation_id")
+);
+
+CREATE INDEX "browser_sessions_workspace_lifecycle_idx"
+  ON "browser_sessions" ("workspace_id", "lifecycle", "last_used_at", "id");
+CREATE INDEX "browser_sessions_sandbox_group_idx"
+  ON "browser_sessions" ("workspace_id", "sandbox_group_id", "lifecycle");
+
+CREATE TABLE "browser_session_associations" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "account_id" uuid NOT NULL,
+  "workspace_id" uuid NOT NULL,
+  "browser_session_id" uuid NOT NULL,
+  "session_id" uuid NOT NULL,
+  "turn_id" uuid,
+  "attempt_id" uuid,
+  "relationship" text NOT NULL,
+  "actor_subject_id" text NOT NULL,
+  "last_used_at" timestamptz NOT NULL DEFAULT now(),
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "browser_session_associations_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id") ON DELETE CASCADE,
+  CONSTRAINT "browser_session_associations_resource_fk"
+    FOREIGN KEY ("workspace_id", "browser_session_id")
+    REFERENCES "browser_sessions"("workspace_id", "id") ON DELETE CASCADE,
+  CONSTRAINT "browser_session_associations_session_fk"
+    FOREIGN KEY ("workspace_id", "session_id")
+    REFERENCES "sessions"("workspace_id", "id") ON DELETE CASCADE,
+  CONSTRAINT "browser_session_associations_turn_fk"
+    FOREIGN KEY ("workspace_id", "turn_id")
+    REFERENCES "session_turns"("workspace_id", "id") ON DELETE SET NULL ("turn_id"),
+  CONSTRAINT "browser_session_associations_attempt_fk"
+    FOREIGN KEY ("workspace_id", "attempt_id")
+    REFERENCES "session_turn_attempts"("workspace_id", "id") ON DELETE SET NULL ("attempt_id"),
+  CONSTRAINT "browser_session_associations_relationship_check"
+    CHECK ("relationship" IN ('created', 'using', 'observing', 'related')),
+  CONSTRAINT "browser_session_associations_values_check" CHECK (
+    octet_length("actor_subject_id") BETWEEN 1 AND 1024
+    AND ("attempt_id" IS NULL OR "turn_id" IS NOT NULL)
+  ),
+  CONSTRAINT "browser_session_associations_resource_session_relationship_uq"
+    UNIQUE ("browser_session_id", "session_id", "relationship")
+);
+
+CREATE INDEX "browser_session_associations_workspace_session_idx"
+  ON "browser_session_associations" ("workspace_id", "session_id", "last_used_at");
+CREATE INDEX "browser_session_associations_resource_idx"
+  ON "browser_session_associations" ("workspace_id", "browser_session_id", "last_used_at");
+
+CREATE TABLE "interaction_operations" (
+  "operation_id" uuid PRIMARY KEY,
+  "account_id" uuid NOT NULL,
+  "workspace_id" uuid NOT NULL,
+  "resource_kind" text NOT NULL,
+  "resource_id" uuid NOT NULL,
+  "kind" text NOT NULL,
+  "request_digest" text NOT NULL,
+  "state" text NOT NULL DEFAULT 'prepared',
+  "controller_generation" text,
+  "error_code" text,
+  "error_message" text,
+  "error_retryable" boolean,
+  "error_details" jsonb,
+  "actor_subject_id" text NOT NULL,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "dispatched_at" timestamptz,
+  "settled_at" timestamptz,
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "interaction_operations_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id") ON DELETE CASCADE,
+  CONSTRAINT "interaction_operations_resource_kind_check"
+    CHECK ("resource_kind" IN ('browser_session', 'computer_session')),
+  CONSTRAINT "interaction_operations_kind_check"
+    CHECK ("kind" IN ('create', 'resume', 'suspend', 'end')),
+  CONSTRAINT "interaction_operations_state_check"
+    CHECK ("state" IN ('prepared', 'dispatched', 'completed', 'failed', 'outcome_unknown')),
+  CONSTRAINT "interaction_operations_values_check" CHECK (
+    "request_digest" ~ '^[0-9a-f]{64}$'
+    AND octet_length("actor_subject_id") BETWEEN 1 AND 1024
+    AND ("controller_generation" IS NULL OR octet_length("controller_generation") BETWEEN 1 AND 256)
+    AND ("error_code" IS NULL OR octet_length("error_code") BETWEEN 1 AND 512)
+    AND ("error_message" IS NULL OR octet_length("error_message") BETWEEN 1 AND 8192)
+    AND ("error_details" IS NULL OR (
+      jsonb_typeof("error_details") = 'object'
+      AND octet_length("error_details"::text) BETWEEN 2 AND 65536
+    ))
+  ),
+  CONSTRAINT "interaction_operations_lifecycle_check" CHECK (
+    (
+      "state" = 'prepared'
+      AND "dispatched_at" IS NULL
+      AND "settled_at" IS NULL
+      AND "error_code" IS NULL
+      AND "error_message" IS NULL
+      AND "error_retryable" IS NULL
+      AND "error_details" IS NULL
+    ) OR (
+      "state" = 'dispatched'
+      AND "dispatched_at" IS NOT NULL
+      AND "settled_at" IS NULL
+      AND "error_code" IS NULL
+      AND "error_message" IS NULL
+      AND "error_retryable" IS NULL
+      AND "error_details" IS NULL
+    ) OR (
+      "state" = 'completed'
+      AND "dispatched_at" IS NOT NULL
+      AND "settled_at" IS NOT NULL
+      AND "error_code" IS NULL
+      AND "error_message" IS NULL
+      AND "error_retryable" IS NULL
+      AND "error_details" IS NULL
+    ) OR (
+      "state" IN ('failed', 'outcome_unknown')
+      AND "settled_at" IS NOT NULL
+      AND "error_code" IS NOT NULL
+      AND "error_message" IS NOT NULL
+      AND "error_retryable" IS NOT NULL
+    )
+  ),
+  CONSTRAINT "interaction_operations_workspace_operation_uq"
+    UNIQUE ("workspace_id", "operation_id")
+);
+
+CREATE INDEX "interaction_operations_resource_history_idx"
+  ON "interaction_operations" (
+    "workspace_id", "resource_kind", "resource_id", "created_at"
+  );
+CREATE UNIQUE INDEX "interaction_operations_active_resource_uq"
+  ON "interaction_operations" ("workspace_id", "resource_kind", "resource_id")
+  WHERE "state" IN ('prepared', 'dispatched');
+
+ALTER TABLE "browser_sessions"
+  ADD CONSTRAINT "browser_sessions_create_operation_fk"
+  FOREIGN KEY ("workspace_id", "create_operation_id")
+  REFERENCES "interaction_operations"("workspace_id", "operation_id") ON DELETE RESTRICT;
+
+ALTER TABLE "sandbox_lease_holders"
+  DROP CONSTRAINT "sandbox_lease_holders_kind_check";
+ALTER TABLE "sandbox_lease_holders"
+  ADD CONSTRAINT "sandbox_lease_holders_kind_check"
+    CHECK ("kind" IN ('turn', 'viewer', 'direct', 'process', 'interaction'));
+
+ALTER TABLE "workspace_interaction_revisions" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "workspace_interaction_revisions" FORCE ROW LEVEL SECURITY;
+CREATE POLICY workspace_isolation ON "workspace_interaction_revisions"
+  USING (opengeni_private.workspace_rls_visible("account_id", "workspace_id"))
+  WITH CHECK (opengeni_private.workspace_rls_visible("account_id", "workspace_id"));
+
+ALTER TABLE "browser_sessions" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "browser_sessions" FORCE ROW LEVEL SECURITY;
+CREATE POLICY workspace_isolation ON "browser_sessions"
+  USING (opengeni_private.workspace_rls_visible("account_id", "workspace_id"))
+  WITH CHECK (opengeni_private.workspace_rls_visible("account_id", "workspace_id"));
+
+ALTER TABLE "browser_session_associations" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "browser_session_associations" FORCE ROW LEVEL SECURITY;
+CREATE POLICY workspace_isolation ON "browser_session_associations"
+  USING (opengeni_private.workspace_rls_visible("account_id", "workspace_id"))
+  WITH CHECK (opengeni_private.workspace_rls_visible("account_id", "workspace_id"));
+
+ALTER TABLE "interaction_operations" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "interaction_operations" FORCE ROW LEVEL SECURITY;
+CREATE POLICY workspace_isolation ON "interaction_operations"
+  USING (opengeni_private.workspace_rls_visible("account_id", "workspace_id"))
+  WITH CHECK (opengeni_private.workspace_rls_visible("account_id", "workspace_id"));
+
+DO $grants$
+DECLARE target_schema text := current_schema();
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'REVOKE ALL ON TABLE %I.workspace_interaction_revisions, %I.browser_sessions, %I.browser_session_associations, %I.interaction_operations FROM opengeni_app',
+      target_schema,
+      target_schema,
+      target_schema,
+      target_schema
+    );
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE ON TABLE %I.workspace_interaction_revisions TO opengeni_app',
+      target_schema
+    );
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE ON TABLE %I.browser_sessions TO opengeni_app',
+      target_schema
+    );
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE %I.browser_session_associations TO opengeni_app',
+      target_schema
+    );
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE ON TABLE %I.interaction_operations TO opengeni_app',
+      target_schema
+    );
+  END IF;
+END
+$grants$;
+
+-- The mega-PR is a maintenance cutover, so the global reaper has one exact
+-- four-argument contract. Interaction holders are controller-heartbeat-bound;
+-- a dead controller makes its BrowserSession visibly lost before the box drains.
+DROP FUNCTION opengeni_private.reap_sandbox_leases(bigint, bigint, bigint);
+
+DO $interaction_aware_reaper$
+DECLARE data_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE FUNCTION opengeni_private.reap_sandbox_leases(
+      p_viewer_holder_ttl_ms bigint,
+      p_turn_holder_ttl_ms bigint,
+      p_interaction_holder_ttl_ms bigint,
+      p_idle_grace_ms bigint
+    )
+    RETURNS TABLE (
+      workspace_id uuid,
+      sandbox_group_id uuid,
+      instance_id text,
+      lease_epoch integer
+    )
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE
+      locked_ids uuid[];
+      stale_interaction_ids uuid[];
+      changed_interaction_workspaces uuid[];
+    BEGIN
+      PERFORM pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2', '1', true);
+
+      SELECT coalesce(pg_catalog.array_agg(candidate.id), ARRAY[]::uuid[])
+      INTO locked_ids
+      FROM (
+        SELECT lease.id
+        FROM %1$I.sandbox_leases lease
+        WHERE lease.liveness <> 'cold'
+          OR EXISTS (
+            SELECT 1
+            FROM %1$I.sandbox_lease_holders holder
+            WHERE holder.lease_id = lease.id
+          )
+        ORDER BY lease.updated_at, lease.id
+        LIMIT 500
+        FOR UPDATE OF lease SKIP LOCKED
+      ) candidate;
+
+      IF pg_catalog.cardinality(locked_ids) = 0 THEN
+        RETURN;
+      END IF;
+
+      DELETE FROM %1$I.sandbox_lease_holders holder
+      USING (
+        SELECT stale.id
+        FROM %1$I.sandbox_lease_holders stale
+        WHERE stale.lease_id = ANY(locked_ids)
+          AND stale.kind IN ('viewer', 'direct')
+          AND stale.last_heartbeat_at
+            < pg_catalog.now()
+              - pg_catalog.make_interval(secs => p_viewer_holder_ttl_ms / 1000.0)
+        FOR UPDATE OF stale SKIP LOCKED
+      ) victim
+      WHERE holder.id = victim.id;
+
+      IF p_turn_holder_ttl_ms > 0 THEN
+        DELETE FROM %1$I.sandbox_lease_holders holder
+        USING (
+          SELECT stale.id
+          FROM %1$I.sandbox_lease_holders stale
+          WHERE stale.lease_id = ANY(locked_ids)
+            AND stale.kind = 'turn'
+            AND (
+              stale.last_heartbeat_at
+                < pg_catalog.now()
+                  - pg_catalog.make_interval(secs => p_turn_holder_ttl_ms / 1000.0)
+              OR (
+                stale.holder_id ~* '^turn-attempt:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'
+                AND NOT EXISTS (
+                  SELECT 1
+                  FROM %1$I.session_turn_attempts attempt
+                  JOIN %1$I.session_turns turn
+                    ON turn.account_id = attempt.account_id
+                   AND turn.workspace_id = attempt.workspace_id
+                   AND turn.session_id = attempt.session_id
+                   AND turn.id = attempt.turn_id
+                   AND turn.execution_generation = attempt.execution_generation
+                   AND turn.active_attempt_id = attempt.id
+                  WHERE stale.holder_id = ('turn-attempt:' || attempt.id::text)
+                    AND attempt.account_id = stale.account_id
+                    AND attempt.workspace_id = stale.workspace_id
+                    AND attempt.session_id = stale.subject_id
+                    AND attempt.state IN ('claimed', 'running')
+                )
+              )
+            )
+          FOR UPDATE OF stale SKIP LOCKED
+        ) victim
+        WHERE holder.id = victim.id;
+      END IF;
+
+      IF p_interaction_holder_ttl_ms > 0 THEN
+        SELECT coalesce(pg_catalog.array_agg(candidate.id), ARRAY[]::uuid[])
+        INTO stale_interaction_ids
+        FROM (
+          SELECT stale.id
+          FROM %1$I.sandbox_lease_holders stale
+          WHERE stale.lease_id = ANY(locked_ids)
+            AND stale.kind = 'interaction'
+            AND (
+              stale.last_heartbeat_at
+                < pg_catalog.now()
+                  - pg_catalog.make_interval(
+                      secs => p_interaction_holder_ttl_ms / 1000.0
+                    )
+              OR NOT EXISTS (
+                SELECT 1
+                FROM %1$I.browser_sessions browser
+                WHERE stale.holder_id = ('browser-session:' || browser.id::text)
+                  AND browser.account_id = stale.account_id
+                  AND browser.workspace_id = stale.workspace_id
+                  AND browser.sandbox_group_id = (
+                    SELECT lease.sandbox_group_id
+                    FROM %1$I.sandbox_leases lease
+                    WHERE lease.id = stale.lease_id
+                  )
+                  AND browser.lifecycle IN (
+                    'starting', 'active', 'suspending', 'restoring', 'ending'
+                  )
+              )
+            )
+          FOR UPDATE OF stale SKIP LOCKED
+        ) candidate;
+
+        IF pg_catalog.cardinality(stale_interaction_ids) > 0 THEN
+          WITH updated AS (
+            UPDATE %1$I.browser_sessions browser
+            SET lifecycle = 'lost',
+                controller_id = null,
+                controller_generation = null,
+                placement_instance_id = null,
+                controller_heartbeat_at = null,
+                failure_code = 'controller_heartbeat_expired',
+                updated_at = pg_catalog.now()
+            FROM %1$I.sandbox_lease_holders holder
+            WHERE holder.id = ANY(stale_interaction_ids)
+              AND holder.holder_id = ('browser-session:' || browser.id::text)
+              AND holder.account_id = browser.account_id
+              AND holder.workspace_id = browser.workspace_id
+              AND browser.lifecycle IN (
+                'starting', 'active', 'suspending', 'restoring', 'ending'
+              )
+            RETURNING browser.workspace_id
+          )
+          SELECT coalesce(
+            pg_catalog.array_agg(DISTINCT updated.workspace_id),
+            ARRAY[]::uuid[]
+          )
+          INTO changed_interaction_workspaces
+          FROM updated;
+
+          DELETE FROM %1$I.sandbox_lease_holders holder
+          WHERE holder.id = ANY(stale_interaction_ids);
+
+          UPDATE %1$I.workspace_interaction_revisions revision
+          SET revision = revision.revision + 1,
+              updated_at = pg_catalog.now()
+          WHERE revision.workspace_id = ANY(changed_interaction_workspaces);
+        END IF;
+      END IF;
+
+      UPDATE %1$I.sandbox_leases lease SET
+        refcount = counts.total,
+        turn_holders = counts.turns,
+        viewer_holders = counts.viewers,
+        liveness = CASE
+          WHEN lease.liveness = 'warm'
+            AND counts.total = 0
+            AND counts.turns = 0
+            AND (
+              lease.reaper_hold_id IS NULL
+              OR lease.reaper_hold_until <= pg_catalog.now()
+            )
+          THEN 'draining' ELSE lease.liveness END,
+        expires_at = CASE
+          WHEN lease.liveness = 'warm'
+            AND counts.total = 0
+            AND counts.turns = 0
+            AND (
+              lease.reaper_hold_id IS NULL
+              OR lease.reaper_hold_until <= pg_catalog.now()
+            )
+          THEN CASE
+            WHEN lease.rotation_requested_at IS NOT NULL
+              OR lease.archive_capture_id IS NOT NULL
+            THEN pg_catalog.now() - interval '1 millisecond'
+            ELSE pg_catalog.now()
+              + pg_catalog.make_interval(secs => p_idle_grace_ms / 1000.0)
+          END
+          ELSE lease.expires_at END,
+        updated_at = pg_catalog.now()
+      FROM (
+        SELECT candidate.id,
+          pg_catalog.count(holder.id)::int AS total,
+          pg_catalog.count(holder.id)
+            FILTER (WHERE holder.kind = 'turn')::int AS turns,
+          pg_catalog.count(holder.id)
+            FILTER (WHERE holder.kind = 'viewer')::int AS viewers
+        FROM pg_catalog.unnest(locked_ids) candidate(id)
+        LEFT JOIN %1$I.sandbox_lease_holders holder
+          ON holder.lease_id = candidate.id
+        GROUP BY candidate.id
+      ) counts
+      WHERE lease.id = counts.id;
+
+      UPDATE %1$I.sandbox_leases lease SET
+        liveness = 'cold',
+        instance_id = null,
+        lease_epoch = lease.lease_epoch + 1,
+        reaper_hold_id = null,
+        reaper_hold_until = null,
+        reaper_hold_reason = null,
+        resume_state = opengeni_private.warming_reset_resume_state_v2(
+          lease.backend,
+          lease.resume_backend_id,
+          lease.resume_state,
+          lease.workspace_generation,
+          lease.archive_generation,
+          pg_catalog.clock_timestamp()
+        ),
+        resume_backend_id = CASE
+          WHEN coalesce(
+            lease.resume_state #>> '{sessionState,workspaceArchive}', ''
+          ) <> ''
+            OR coalesce(
+              lease.resume_state #>> '{sessionState,workspaceArchivePrev}', ''
+            ) <> ''
+          THEN coalesce(lease.resume_backend_id, lease.backend)
+          ELSE null END,
+        data_plane_url = null,
+        terminal_data_plane_url = null,
+        provider_created_at = null,
+        provider_deadline_at = null,
+        rotation_requested_at = null,
+        rotation_reason = null,
+        updated_at = pg_catalog.now()
+      WHERE lease.id = ANY(locked_ids)
+        AND lease.liveness = 'warming'
+        AND lease.expires_at < pg_catalog.now()
+        AND lease.instance_id IS NULL
+        AND (
+          lease.reaper_hold_id IS NULL
+          OR lease.reaper_hold_until <= pg_catalog.now()
+        );
+
+      UPDATE %1$I.sandbox_leases lease SET
+        liveness = 'draining',
+        refcount = 0,
+        turn_holders = 0,
+        viewer_holders = 0,
+        data_plane_url = null,
+        terminal_data_plane_url = null,
+        lease_epoch = lease.lease_epoch + 1,
+        reaper_hold_id = null,
+        reaper_hold_until = null,
+        reaper_hold_reason = null,
+        expires_at = pg_catalog.now() - interval '1 millisecond',
+        updated_at = pg_catalog.now()
+      WHERE lease.id = ANY(locked_ids)
+        AND lease.liveness = 'warming'
+        AND lease.expires_at < pg_catalog.now()
+        AND lease.instance_id IS NOT NULL
+        AND (
+          lease.reaper_hold_id IS NULL
+          OR lease.reaper_hold_until <= pg_catalog.now()
+        );
+
+      RETURN QUERY
+        SELECT lease.workspace_id, lease.sandbox_group_id,
+          lease.instance_id, lease.lease_epoch
+        FROM %1$I.sandbox_leases lease
+        WHERE lease.id = ANY(locked_ids)
+          AND lease.liveness = 'draining'
+          AND lease.expires_at < pg_catalog.now()
+          AND lease.refcount = 0
+          AND (
+            lease.reaper_hold_id IS NULL
+            OR lease.reaper_hold_until <= pg_catalog.now()
+          );
+    END;
+    $function$;
+  $create$, data_schema);
+END
+$interaction_aware_reaper$;
+
+REVOKE ALL ON FUNCTION opengeni_private.reap_sandbox_leases(
+  bigint, bigint, bigint, bigint
+) FROM PUBLIC;
+
+DO $reaper_grant$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.reap_sandbox_leases(
+      bigint, bigint, bigint, bigint
+    ) TO opengeni_app;
+  END IF;
+END
+$reaper_grant$;
+
+RESET statement_timeout;
+RESET lock_timeout;