@opengeni/db 0.36.1 → 3.1.0-canary.0

package/src/schema.ts

@@ -1,10 +1,15 @@
 import type {
+  AutomationAcceptedExecution,
+  AutomationSessionTemplate,
   AttemptToolCatalog,
   AttemptToolResult,
   DraftTimelineAnnotation,
   FirstPartyMcpToolName,
   McpPersonalConnectionDelegation,
+  PersonalResourceAttachmentIntent,
+  PersonalResourceAttachmentSummary,
   McpServerConnectionRef,
+  ModelContextContributionSummary,
   RigProviderImages,
   SessionMcpApprovalPolicy,
   SessionGoalChangeKind,
@@ -12,6 +17,7 @@ import type {
   SessionGoalSnapshot,
   SlackUserLinkAccessRequest,
   TimelineAnnotation,
+  UserResourceDelegation,
   XaiProviderAccountAuthoritySnapshotV1,
 } from "@opengeni/contracts";
 import { WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 } from "@opengeni/contracts";
@@ -49,6 +55,12 @@ const vector = customType<{ data: number[]; driverData: string }>({
   },
 });
 
+const bytea = customType<{ data: Uint8Array; driverData: Uint8Array }>({
+  dataType() {
+    return "bytea";
+  },
+});
+
 export type ConnectorActionPolicyDecision = "allow" | "ask" | "block";
 
 export type ConnectorActionPolicySnapshotEntry = {
@@ -436,6 +448,7 @@ export const organizationMemberships = pgTable(
       .notNull()
       .references(() => managedAccounts.id, { onDelete: "cascade" }),
     subjectId: text("subject_id").notNull(),
+    role: text("role").notNull().default("member"),
     status: text("status").notNull().default("provisioning"),
     personalWorkspaceId: uuid("personal_workspace_id"),
     authorizationRevision: bigint("authorization_revision", { mode: "number" })
@@ -460,6 +473,9 @@ export const organizationMemberships = pgTable(
     personalWorkspace: uniqueIndex("organization_memberships_personal_workspace_idx")
       .on(table.accountId, table.personalWorkspaceId)
       .where(sql`${table.personalWorkspaceId} is not null`),
+    retentionDue: index("organization_memberships_retention_due_idx")
+      .on(table.accountId, table.personalRetentionUntil, table.id)
+      .where(sql`${table.status} = 'revoked' and ${table.personalRetentionUntil} is not null`),
     personalWorkspaceAccount: foreignKey({
       name: "organization_memberships_personal_workspace_account_fk",
       columns: [table.personalWorkspaceId, table.accountId],
@@ -469,6 +485,10 @@ export const organizationMemberships = pgTable(
       "organization_memberships_status_check",
       sql`${table.status} in ('provisioning', 'active', 'suspended', 'revoked')`,
     ),
+    roleValid: check(
+      "organization_memberships_role_check",
+      sql`${table.role} in ('owner', 'admin', 'member')`,
+    ),
     activePersonalWorkspace: check(
       "organization_memberships_active_personal_workspace_check",
       sql`${table.status} <> 'active' or ${table.personalWorkspaceId} is not null`,
@@ -489,6 +509,122 @@ export const organizationMemberships = pgTable(
   }),
 );
 
+export const organizationProfileEvents = pgTable(
+  "organization_profile_events",
+  {
+    id: uuid("id").primaryKey(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    actorMembershipId: uuid("actor_membership_id").notNull(),
+    previousName: text("previous_name").notNull(),
+    requestedName: text("requested_name").notNull(),
+    expectedUpdatedAt: timestamp("expected_updated_at", { withTimezone: true }).notNull(),
+    resultUpdatedAt: timestamp("result_updated_at", { withTimezone: true }).notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    actorMembership: foreignKey({
+      name: "organization_profile_events_actor_fk",
+      columns: [table.actorMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+  }),
+);
+
+// Forward-only organization-scoped activation receipt for the product session-
+// tenancy surface. Runtime may observe this marker, but only the drained
+// migration-owner activation seam may insert it.
+export const sessionTenancyActivations = pgTable(
+  "session_tenancy_activations",
+  {
+    accountId: uuid("account_id")
+      .primaryKey()
+      .references(() => managedAccounts.id, { onDelete: "restrict" }),
+    activationVersion: integer("activation_version").notNull(),
+    inventoryDigest: text("inventory_digest").notNull(),
+    parityDigest: text("parity_digest").notNull(),
+    activatedBy: text("activated_by").notNull(),
+    backfillReceiptIds: uuid("backfill_receipt_ids")
+      .array()
+      .notNull()
+      .default(sql`'{}'::uuid[]`),
+    activatedAt: timestamp("activated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    versionValid: check(
+      "session_tenancy_activations_version_check",
+      sql`${table.activationVersion} = 1`,
+    ),
+    digestsValid: check(
+      "session_tenancy_activations_digests_check",
+      sql`${table.inventoryDigest} ~ '^[0-9a-f]{64}$'
+        and ${table.parityDigest} ~ '^[0-9a-f]{64}$'`,
+    ),
+    actorValid: check(
+      "session_tenancy_activations_actor_check",
+      sql`octet_length(${table.activatedBy}) between 1 and 256`,
+    ),
+    backfillReceiptsValid: check(
+      "session_tenancy_activation_backfill_receipts_check",
+      sql`cardinality(${table.backfillReceiptIds}) in (0, 5, 6)`,
+    ),
+  }),
+);
+
+export const organizationPrivateSessionSettings = pgTable(
+  "organization_private_session_settings",
+  {
+    accountId: uuid("account_id")
+      .primaryKey()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    enabled: boolean("enabled").notNull().default(false),
+    version: bigint("version", { mode: "number" }).notNull().default(1),
+    updatedByMembershipId: uuid("updated_by_membership_id"),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    updater: foreignKey({
+      name: "organization_private_session_settings_updater_fk",
+      columns: [table.updatedByMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    versionValid: check(
+      "organization_private_session_settings_version_check",
+      sql`${table.version} > 0`,
+    ),
+  }),
+);
+
+export const organizationPrivateSessionSettingEvents = pgTable(
+  "organization_private_session_setting_events",
+  {
+    id: uuid("id").primaryKey(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    actorMembershipId: uuid("actor_membership_id").notNull(),
+    requestedEnabled: boolean("requested_enabled").notNull(),
+    expectedVersion: bigint("expected_version", { mode: "number" }).notNull(),
+    resultEnabled: boolean("result_enabled").notNull(),
+    resultVersion: bigint("result_version", { mode: "number" }).notNull(),
+    resultUpdatedAt: timestamp("result_updated_at", { withTimezone: true }).notNull(),
+    changed: boolean("changed").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    actor: foreignKey({
+      name: "organization_private_session_setting_events_actor_fk",
+      columns: [table.actorMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    versionsValid: check(
+      "organization_private_session_setting_events_versions_check",
+      sql`${table.expectedVersion} >= 0 and ${table.resultVersion} > 0`,
+    ),
+  }),
+);
+
 export const organizationUserRetentionPolicies = pgTable(
   "organization_user_retention_policies",
   {
@@ -517,7 +653,7 @@ export const organizationUserRetentionPolicies = pgTable(
         or (
           ${table.mode} = 'delete_after'
           and ${table.retentionDays} is not null
-          and ${table.retentionDays} between 1 and 3650
+          and ${table.retentionDays} between 30 and 90
         )`,
     ),
     versionValid: check(
@@ -527,280 +663,1193 @@ export const organizationUserRetentionPolicies = pgTable(
   }),
 );
 
-export const organizationUserResourceAuthorities = pgTable(
-  "organization_user_resource_authorities",
+export const organizationMembershipInvitations = pgTable(
+  "organization_membership_invitations",
   {
     id: uuid("id").primaryKey().defaultRandom(),
     accountId: uuid("account_id")
       .notNull()
       .references(() => managedAccounts.id, { onDelete: "cascade" }),
-    organizationMembershipId: uuid("organization_membership_id").notNull(),
-    resourceKind: text("resource_kind").notNull(),
-    resourceId: uuid("resource_id").notNull(),
-    // Provenance only. The migration owns a composite same-organization FK
-    // whose delete action clears only this column, never account_id.
-    originWorkspaceId: uuid("origin_workspace_id"),
-    generation: bigint("generation", { mode: "number" }).notNull().default(1),
-    status: text("status").notNull().default("active"),
-    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+    targetSubjectId: text("target_subject_id"),
+    targetEmail: text("target_email").notNull(),
+    targetName: text("target_name"),
+    initialWorkspaceIds: uuid("initial_workspace_ids")
+      .array()
+      .notNull()
+      .default(sql`'{}'::uuid[]`),
+    role: text("role").notNull().default("member"),
+    status: text("status").notNull().default("pending"),
+    revision: bigint("revision", { mode: "number" }).notNull().default(1),
+    createdByMembershipId: uuid("created_by_membership_id").notNull(),
+    acceptedMembershipId: uuid("accepted_membership_id"),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
-    accountIdentity: uniqueIndex("organization_user_resource_authorities_id_account_idx").on(
+    accountIdentity: uniqueIndex("organization_membership_invitations_id_account_idx").on(
       table.id,
       table.accountId,
     ),
-    accountMembershipIdentity: uniqueIndex(
-      "organization_user_resource_authorities_id_account_membership_idx",
-    ).on(table.id, table.accountId, table.organizationMembershipId),
-    resourceIdentity: uniqueIndex(
-      "organization_user_resource_authorities_resource_identity_idx",
-    ).on(table.accountId, table.organizationMembershipId, table.resourceKind, table.resourceId),
-    membership: foreignKey({
-      name: "organization_user_resource_authorities_membership_fk",
-      columns: [table.organizationMembershipId, table.accountId],
+    pendingTarget: uniqueIndex("organization_membership_invitations_pending_target_uq")
+      .on(table.accountId, table.targetSubjectId)
+      .where(sql`${table.status} = 'pending' AND ${table.targetSubjectId} IS NOT NULL`),
+    pendingEmail: uniqueIndex("organization_membership_invitations_pending_email_uq")
+      .on(table.accountId, table.targetEmail)
+      .where(sql`${table.status} = 'pending'`),
+    accountCreated: index("organization_membership_invitations_account_created_idx").on(
+      table.accountId,
+      table.createdAt.desc(),
+      table.id.desc(),
+    ),
+    subjectCreated: index("organization_membership_invitations_subject_created_idx").on(
+      table.targetSubjectId,
+      table.createdAt.desc(),
+      table.id.desc(),
+    ),
+    creator: foreignKey({
+      name: "organization_membership_invitations_creator_fk",
+      columns: [table.createdByMembershipId, table.accountId],
       foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
     }).onDelete("restrict"),
-    resourceKindValid: check(
-      "organization_user_resource_authorities_kind_check",
-      sql`${table.resourceKind} = lower(btrim(${table.resourceKind}))
-        and length(${table.resourceKind}) between 1 and 64
-        and ${table.resourceKind} ~ '^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$'`,
-    ),
-    generationValid: check(
-      "organization_user_resource_authorities_generation_check",
-      sql`${table.generation} > 0`,
+    acceptedMembership: foreignKey({
+      name: "organization_membership_invitations_accepted_membership_fk",
+      columns: [table.acceptedMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    roleValid: check(
+      "organization_membership_invitations_role_check",
+      sql`${table.role} in ('owner', 'admin', 'member')`,
     ),
     statusValid: check(
-      "organization_user_resource_authorities_status_check",
-      sql`${table.status} in ('active', 'retained', 'revoked')`,
+      "organization_membership_invitations_status_check",
+      sql`${table.status} in ('pending', 'accepted', 'revoked', 'expired')`,
     ),
-    revocationValid: check(
-      "organization_user_resource_authorities_revocation_check",
-      sql`(${table.status} = 'revoked' and ${table.revokedAt} is not null)
-        or (${table.status} <> 'revoked' and ${table.revokedAt} is null)`,
+    revisionValid: check(
+      "organization_membership_invitations_revision_check",
+      sql`${table.revision} > 0`,
+    ),
+    acceptanceValid: check(
+      "organization_membership_invitations_acceptance_check",
+      sql`(${table.status} = 'accepted' and ${table.acceptedMembershipId} is not null)
+        or (${table.status} <> 'accepted' and ${table.acceptedMembershipId} is null)`,
     ),
   }),
 );
 
-export const apiKeys = pgTable(
-  "api_keys",
+export const organizationInvitationBindingEvents = pgTable(
+  "organization_invitation_binding_events",
   {
     id: uuid("id").primaryKey().defaultRandom(),
     accountId: uuid("account_id")
       .notNull()
       .references(() => managedAccounts.id, { onDelete: "cascade" }),
-    workspaceId: uuid("workspace_id").references(() => workspaces.id, {
-      onDelete: "cascade",
-    }),
-    name: text("name").notNull(),
-    prefix: text("prefix").notNull(),
-    keyHash: text("key_hash").notNull(),
-    permissions: jsonb("permissions").$type<string[]>().notNull().default([]),
-    expiresAt: timestamp("expires_at", { withTimezone: true }),
-    revokedAt: timestamp("revoked_at", { withTimezone: true }),
-    lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+    invitationId: uuid("invitation_id").notNull(),
+    targetSubjectId: text("target_subject_id").notNull(),
+    resultingRevision: bigint("resulting_revision", { mode: "number" }).notNull(),
+    boundAt: timestamp("bound_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
-    prefix: index("api_keys_prefix_idx").on(table.prefix),
-    hash: uniqueIndex("api_keys_key_hash_idx").on(table.keyHash),
-    account: index("api_keys_account_idx").on(table.accountId),
-    workspace: index("api_keys_workspace_idx").on(table.workspaceId),
+    invitation: foreignKey({
+      name: "organization_invitation_binding_events_invitation_fk",
+      columns: [table.invitationId, table.accountId],
+      foreignColumns: [
+        organizationMembershipInvitations.id,
+        organizationMembershipInvitations.accountId,
+      ],
+    }).onDelete("restrict"),
+    invitationIdentity: uniqueIndex("organization_invitation_binding_events_invitation_uq").on(
+      table.accountId,
+      table.invitationId,
+    ),
+    subjectValid: check(
+      "organization_invitation_binding_events_subject_check",
+      sql`${table.targetSubjectId} = btrim(${table.targetSubjectId})
+        and ${table.targetSubjectId} like 'user:%'
+        and octet_length(convert_to(${table.targetSubjectId}, 'UTF8')) between 6 and 1024`,
+    ),
+    revisionValid: check(
+      "organization_invitation_binding_events_revision_check",
+      sql`${table.resultingRevision} > 1`,
+    ),
   }),
 );
 
-export const workspaceVariableSets = pgTable(
-  "workspace_variable_sets",
+export const organizationMembershipOperationReceipts = pgTable(
+  "organization_membership_operation_receipts",
   {
-    id: uuid("id").primaryKey().defaultRandom(),
     accountId: uuid("account_id")
       .notNull()
       .references(() => managedAccounts.id, { onDelete: "cascade" }),
-    workspaceId: uuid("workspace_id")
-      .notNull()
-      .references(() => workspaces.id, { onDelete: "cascade" }),
-    name: text("name").notNull(),
-    description: text("description"),
-    // Migration 0230 is schema-only: all shipped CRUD continues to omit these
-    // fields and therefore remains workspace-scoped. A later activation slice
-    // must provide the complete owner authority and runtime protocol.
-    authorityScope: text("authority_scope").notNull().default("workspace"),
-    authorityId: uuid("authority_id"),
-    ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
-    originWorkspaceId: uuid("origin_workspace_id"),
+    operationId: uuid("operation_id").notNull(),
+    action: text("action").notNull(),
+    inputHash: text("input_hash").notNull(),
+    result: jsonb("result").$type<Record<string, unknown>>().notNull(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
-    workspaceName: uniqueIndex("workspace_variable_sets_workspace_name_idx").on(
-      table.workspaceId,
-      table.name,
-    ),
-    workspaceCreated: index("workspace_variable_sets_workspace_created_idx").on(
-      table.workspaceId,
-      table.createdAt,
-    ),
-    authorityShape: check(
-      "workspace_variable_sets_authority_shape_check",
-      sql`(
-          ${table.authorityScope} = 'workspace'
-          and ${table.authorityId} is null
-          and ${table.ownerOrganizationMembershipId} is null
-        ) or (
-          ${table.authorityScope} = 'user'
-          and ${table.authorityId} is not null
-          and ${table.ownerOrganizationMembershipId} is not null
-        )`,
+    identity: primaryKey({ columns: [table.accountId, table.operationId] }),
+    actionValid: check(
+      "organization_membership_operation_receipts_action_check",
+      sql`${table.action} in ('invite', 'accept', 'revoke_invitation', 'change_role', 'suspend', 'reactivate', 'offboard', 'retention', 'create_workspace')`,
     ),
-    authorityScopeValid: check(
-      "workspace_variable_sets_authority_scope_check",
-      sql`${table.authorityScope} in ('workspace', 'user')`,
+    inputHashValid: check(
+      "organization_membership_operation_receipts_input_hash_check",
+      sql`${table.inputHash} ~ '^[0-9a-f]{64}$'`,
     ),
-    authority: foreignKey({
-      name: "workspace_variable_sets_authority_fk",
-      columns: [table.authorityId, table.accountId, table.ownerOrganizationMembershipId],
-      foreignColumns: [
-        organizationUserResourceAuthorities.id,
-        organizationUserResourceAuthorities.accountId,
-        organizationUserResourceAuthorities.organizationMembershipId,
-      ],
-    }).onDelete("restrict"),
-    // PostgreSQL's column-subset SET NULL action preserves account_id; Drizzle
-    // cannot represent that action, so migration 0230 owns the origin FK.
   }),
 );
 
-export const workspaceVariableSetVariables = pgTable(
-  "workspace_variable_set_variables",
+export const organizationMembershipLifecycleEvents = pgTable(
+  "organization_membership_lifecycle_events",
   {
     id: uuid("id").primaryKey().defaultRandom(),
     accountId: uuid("account_id")
       .notNull()
       .references(() => managedAccounts.id, { onDelete: "cascade" }),
-    workspaceId: uuid("workspace_id")
-      .notNull()
-      .references(() => workspaces.id, { onDelete: "cascade" }),
-    variableSetId: uuid("variable_set_id")
-      .notNull()
-      .references(() => workspaceVariableSets.id, { onDelete: "cascade" }),
-    name: text("name").notNull(),
-    // Format: v1:<base64 iv>:<base64 ciphertext||gcm-tag>. Never returned by any API.
-    valueEncrypted: text("value_encrypted").notNull(),
-    version: integer("version").notNull().default(1),
+    operationId: uuid("operation_id").notNull(),
+    actorMembershipId: uuid("actor_membership_id").notNull(),
+    targetMembershipId: uuid("target_membership_id"),
+    kind: text("kind").notNull(),
+    priorAuthorizationRevision: bigint("prior_authorization_revision", {
+      mode: "number",
+    }),
+    resultingAuthorizationRevision: bigint("resulting_authorization_revision", {
+      mode: "number",
+    }),
+    reason: text("reason"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
-    variableSetName: uniqueIndex("workspace_variable_set_variables_env_name_idx").on(
-      table.workspaceId,
-      table.variableSetId,
-      table.name,
+    operation: uniqueIndex("organization_membership_lifecycle_events_operation_uq").on(
+      table.accountId,
+      table.operationId,
     ),
-    variableSet: index("workspace_variable_set_variables_workspace_env_idx").on(
-      table.workspaceId,
-      table.variableSetId,
+    actor: foreignKey({
+      name: "organization_membership_lifecycle_events_actor_fk",
+      columns: [table.actorMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    target: foreignKey({
+      name: "organization_membership_lifecycle_events_target_fk",
+      columns: [table.targetMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    kindValid: check(
+      "organization_membership_lifecycle_events_kind_check",
+      sql`${table.kind} in ('invite', 'accept', 'revoke_invitation', 'change_role', 'suspend', 'reactivate', 'offboard', 'retention')`,
     ),
   }),
 );
 
-// Per-workspace ChatGPT/Codex subscription credential. One row per connected
-// ChatGPT account within a workspace.
-// access/refresh/id tokens live INSIDE credential_encrypted (v1 AES-256-GCM,
-// same envelope as workspace_variable_set_variables); the other columns are
-// plaintext metadata (header value + UI). RLS-isolated per workspace.
-export const codexSubscriptionCredentials = pgTable(
-  "codex_subscription_credentials",
+export const organizationUserRetentionDeletions = pgTable(
+  "organization_user_retention_deletions",
   {
-    id: uuid("id").primaryKey().defaultRandom(),
     accountId: uuid("account_id")
       .notNull()
       .references(() => managedAccounts.id, { onDelete: "cascade" }),
-    workspaceId: uuid("workspace_id")
-      .notNull()
-      .references(() => workspaces.id, { onDelete: "cascade" }),
-    // Format: v1:<base64 iv>:<base64 ciphertext||gcm-tag>. JSON {access_token, refresh_token, id_token}. Never returned by any API.
-    credentialEncrypted: text("credential_encrypted").notNull(),
-    chatgptAccountId: text("chatgpt_account_id"), // plaintext ChatGPT-Account-ID header value (non-secret)
-    scopes: text("scopes"), // space-delimited, as granted
-    planType: text("plan_type"),
-    isFedramp: boolean("is_fedramp").notNull().default(false),
-    expiresAt: timestamp("expires_at", { withTimezone: true }), // derived from access-token JWT exp
-    lastRefreshAt: timestamp("last_refresh_at", { withTimezone: true }),
-    status: text("status").notNull().default("active"), // active | needs_relogin | error
-    lastError: text("last_error"),
-    version: integer("version").notNull().default(1),
-    label: text("label"), // user-chosen nickname; null ⇒ derive from email/plan/account
-    accountEmail: text("account_email"), // email from the id_token (user's own email; non-secret)
-    // P2 usage cache (plaintext metadata; NEVER a token). Snapshotted from
-    // GET /wham/usage; drives the quota bars + the cache TTL. primary = 5h window
-    // (limit_window_seconds 18000), secondary = weekly (604800).
-    primaryUsedPercent: integer("primary_used_percent"),
-    primaryResetAt: timestamp("primary_reset_at", { withTimezone: true }),
-    secondaryUsedPercent: integer("secondary_used_percent"),
-    secondaryResetAt: timestamp("secondary_reset_at", { withTimezone: true }),
-    usageCheckedAt: timestamp("usage_checked_at", { withTimezone: true }), // snapshot freshness → cache TTL clock
-    // P3 rotation cooldown (plaintext metadata; NEVER a token). Set when this account hit its
-    // usage cap on a rotation turn; the rotation engine treats `exhausted_until > now()` as
-    // capped/skip so it isn't immediately re-picked. Self-clears via the now() comparison.
-    exhaustedUntil: timestamp("exhausted_until", { withTimezone: true }),
-    // Workspace-local, server-held fairness cursor. Provider usage headers are
-    // capacity hints, never the sole allocator: live lease count is ranked first
-    // and this cursor deterministically breaks equal-load/equal-capacity ties.
-    // This flag controls NEW automatic allocations only. Credential health,
-    // refresh, encrypted material, and an already-leased in-flight turn are
-    // intentionally independent. account eligibility policy owns toggle OCC/audit and product UI.
-    allocatorEnabled: boolean("allocator_enabled").notNull().default(true),
-    // Independent OCC/audit sequence for the allocator toggle. Token refresh
-    // continues to own `version`; quota/cache writes own neither counter.
-    allocatorVersion: integer("allocator_version").notNull().default(1),
-    allocatorUpdatedBySubjectId: text("allocator_updated_by_subject_id"),
-    allocatorUpdatedAt: timestamp("allocator_updated_at", {
-      withTimezone: true,
+    membershipId: uuid("membership_id").notNull(),
+    retentionUntil: timestamp("retention_until", { withTimezone: true }).notNull(),
+    state: text("state").notNull().default("claimed"),
+    claimOperationId: uuid("claim_operation_id").notNull(),
+    claimExpiresAt: timestamp("claim_expires_at", { withTimezone: true }).notNull(),
+    attemptCount: integer("attempt_count").notNull().default(1),
+    databaseResult: jsonb("database_result").$type<Record<string, unknown>>(),
+    databaseFinalizedAt: timestamp("database_finalized_at", { withTimezone: true }),
+    result: jsonb("result").$type<Record<string, unknown>>(),
+    completedAt: timestamp("completed_at", { withTimezone: true }),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    identity: primaryKey({ columns: [table.accountId, table.membershipId] }),
+    operation: uniqueIndex("organization_user_retention_deletions_operation_uq").on(
+      table.claimOperationId,
+    ),
+    claim: index("organization_user_retention_deletions_claim_idx").on(
+      table.accountId,
+      table.state,
+      table.claimExpiresAt,
+    ),
+    membership: foreignKey({
+      name: "organization_user_retention_deletions_membership_fk",
+      columns: [table.membershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    stateValid: check(
+      "organization_user_retention_deletions_state_check",
+      sql`${table.state} in ('claimed', 'failed', 'completed')`,
+    ),
+    attemptValid: check(
+      "organization_user_retention_deletions_attempt_check",
+      sql`${table.attemptCount} > 0`,
+    ),
+    completionValid: check(
+      "organization_user_retention_deletions_completion_check",
+      sql`(${table.state} = 'completed' and ${table.completedAt} is not null and ${table.result} is not null)
+        or (${table.state} <> 'completed' and ${table.completedAt} is null and ${table.result} is null)`,
+    ),
+    databaseFinalizationValid: check(
+      "organization_retention_deletions_db_finalized_chk",
+      sql`(${table.databaseFinalizedAt} is null and ${table.databaseResult} is null)
+        or (${table.databaseFinalizedAt} is not null and ${table.databaseResult} is not null)`,
+    ),
+  }),
+);
+
+export const organizationUserRetentionObjectObligations = pgTable(
+  "organization_user_retention_object_obligations",
+  {
+    accountId: uuid("account_id").notNull(),
+    membershipId: uuid("membership_id").notNull(),
+    objectKind: text("object_kind").notNull(),
+    sourceId: text("source_id").notNull(),
+    objectBucket: text("object_bucket").notNull(),
+    objectKey: text("object_key").notNull(),
+    preparedOperationId: uuid("prepared_operation_id").notNull(),
+    objectKeyHash: text("object_key_hash").notNull(),
+    preparedAt: timestamp("prepared_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    identity: primaryKey({
+      columns: [
+        table.accountId,
+        table.membershipId,
+        table.objectKind,
+        table.sourceId,
+        table.objectBucket,
+      ],
     }),
-    // Authoritative count-only summary cached from /wham/usage. Detailed rows
-    // are never persisted as redemption authority; every first POST preflights
-    // the provider's fresh detail endpoint.
-    resetCreditAvailableCount: integer("reset_credit_available_count"),
-    resetCreditsCheckedAt: timestamp("reset_credits_checked_at", {
-      withTimezone: true,
+    deletion: foreignKey({
+      name: "organization_retention_object_obligations_deletion_fk",
+      columns: [table.accountId, table.membershipId],
+      foreignColumns: [
+        organizationUserRetentionDeletions.accountId,
+        organizationUserRetentionDeletions.membershipId,
+      ],
+    }).onDelete("restrict"),
+    hashValid: check(
+      "organization_user_retention_object_obligations_hash_check",
+      sql`${table.objectKeyHash} ~ '^[0-9a-f]{64}$'`,
+    ),
+    shapeValid: check(
+      "organization_user_retention_object_obligations_shape_check",
+      sql`${table.objectKind} in (
+          'file', 'session_recording', 'browser_state_artifact', 'browser_state_upload',
+          'transcription_recording_object', 'video_staging_reference',
+          'workspace_artifact_version', 'editable_artifact_blob',
+          'workspace_capture_manifest', 'workspace_capture_tree_index',
+          'workspace_capture_blob'
+        )
+        and octet_length(${table.sourceId}) between 1 and 2048
+        and octet_length(${table.objectBucket}) between 1 and 1024
+        and octet_length(${table.objectKey}) between 1 and 4096`,
+    ),
+  }),
+);
+
+export const organizationUserRetentionObjectDeletionReceipts = pgTable(
+  "organization_user_retention_object_deletion_receipts",
+  {
+    accountId: uuid("account_id").notNull(),
+    membershipId: uuid("membership_id").notNull(),
+    objectKind: text("object_kind").notNull(),
+    sourceId: text("source_id").notNull(),
+    objectBucket: text("object_bucket").notNull(),
+    operationId: uuid("operation_id").notNull(),
+    deletedAt: timestamp("deleted_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    identity: primaryKey({
+      columns: [
+        table.accountId,
+        table.membershipId,
+        table.objectKind,
+        table.sourceId,
+        table.objectBucket,
+      ],
     }),
-    // Set only by a direct Better Auth cookie connection/reconnection. Legacy,
-    // configured, delegated, API-key, and agent-created rows remain view-only.
-    connectedBySubjectId: text("connected_by_subject_id"),
-    selectionCount: integer("selection_count").notNull().default(0),
-    lastSelectedAt: timestamp("last_selected_at", { withTimezone: true }),
+    obligation: foreignKey({
+      name: "organization_retention_object_deletions_obligation_fk",
+      columns: [
+        table.accountId,
+        table.membershipId,
+        table.objectKind,
+        table.sourceId,
+        table.objectBucket,
+      ],
+      foreignColumns: [
+        organizationUserRetentionObjectObligations.accountId,
+        organizationUserRetentionObjectObligations.membershipId,
+        organizationUserRetentionObjectObligations.objectKind,
+        organizationUserRetentionObjectObligations.sourceId,
+        organizationUserRetentionObjectObligations.objectBucket,
+      ],
+    }).onDelete("restrict"),
+  }),
+);
+
+export const organizationUserRetentionDeletionEvents = pgTable(
+  "organization_user_retention_deletion_events",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id").notNull(),
+    membershipId: uuid("membership_id").notNull(),
+    operationId: uuid("operation_id").notNull(),
+    kind: text("kind").notNull(),
+    reasonCode: text("reason_code"),
+    result: jsonb("result").$type<Record<string, unknown>>().notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    operationKind: uniqueIndex("organization_user_retention_deletion_events_operation_kind_uq").on(
+      table.accountId,
+      table.operationId,
+      table.kind,
+    ),
+    membershipCreated: index("organization_retention_events_member_created_idx").on(
+      table.accountId,
+      table.membershipId,
+      table.createdAt,
+      table.id,
+    ),
+    membership: foreignKey({
+      name: "organization_user_retention_deletion_events_membership_fk",
+      columns: [table.membershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    kindValid: check(
+      "organization_user_retention_deletion_events_kind_check",
+      sql`${table.kind} in ('claimed', 'failed', 'completed')`,
+    ),
+    reasonValid: check(
+      "organization_user_retention_deletion_events_reason_check",
+      sql`${table.reasonCode} is null or ${table.reasonCode} ~ '^[a-z0-9_]{1,64}$'`,
+    ),
+  }),
+);
+
+export const organizationUserResourceAuthorities = pgTable(
+  "organization_user_resource_authorities",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    organizationMembershipId: uuid("organization_membership_id").notNull(),
+    resourceKind: text("resource_kind").notNull(),
+    resourceId: uuid("resource_id").notNull(),
+    // Provenance only. The migration owns a composite same-organization FK
+    // whose delete action clears only this column, never account_id.
+    originWorkspaceId: uuid("origin_workspace_id"),
+    generation: bigint("generation", { mode: "number" }).notNull().default(1),
+    status: text("status").notNull().default("active"),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
-    // REPLACES codex_subscription_credentials_workspace_idx (the one-per-workspace cap).
-    // One row per (workspace, ChatGPT account). Partial WHERE chatgpt_account_id IS NOT NULL
-    // so degenerate null-account rows can't collide; the device-grant connect path always
-    // populates chatgpt_account_id.
-    wsAccount: uniqueIndex("codex_subscription_credentials_ws_account_idx")
-      .on(table.workspaceId, table.chatgptAccountId)
-      .where(sql`${table.chatgptAccountId} is not null`),
-    workspace: index("codex_subscription_credentials_workspace_lookup_idx").on(table.workspaceId),
-    // Composite identity is the defense-in-depth FK target for workspace-local
-    // lease references in migration 0053.
-    workspaceIdentity: uniqueIndex("codex_subscription_credentials_workspace_id_idx").on(
-      table.workspaceId,
+    accountIdentity: uniqueIndex("organization_user_resource_authorities_id_account_idx").on(
       table.id,
+      table.accountId,
+    ),
+    accountMembershipIdentity: uniqueIndex(
+      "organization_user_resource_authorities_id_account_membership_idx",
+    ).on(table.id, table.accountId, table.organizationMembershipId),
+    resourceIdentity: uniqueIndex(
+      "organization_user_resource_authorities_resource_identity_idx",
+    ).on(table.accountId, table.organizationMembershipId, table.resourceKind, table.resourceId),
+    membership: foreignKey({
+      name: "organization_user_resource_authorities_membership_fk",
+      columns: [table.organizationMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    resourceKindValid: check(
+      "organization_user_resource_authorities_kind_check",
+      sql`${table.resourceKind} = lower(btrim(${table.resourceKind}))
+        and length(${table.resourceKind}) between 1 and 64
+        and ${table.resourceKind} ~ '^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$'`,
+    ),
+    generationValid: check(
+      "organization_user_resource_authorities_generation_check",
+      sql`${table.generation} > 0`,
+    ),
+    statusValid: check(
+      "organization_user_resource_authorities_status_check",
+      sql`${table.status} in ('active', 'retained', 'revoked')`,
+    ),
+    revocationValid: check(
+      "organization_user_resource_authorities_revocation_check",
+      sql`(${table.status} = 'revoked' and ${table.revokedAt} is not null)
+        or (${table.status} <> 'revoked' and ${table.revokedAt} is null)`,
+    ),
+  }),
+);
+
+export const apiKeys = pgTable(
+  "api_keys",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id").references(() => workspaces.id, {
+      onDelete: "cascade",
+    }),
+    name: text("name").notNull(),
+    description: text("description"),
+    prefix: text("prefix").notNull(),
+    keyHash: text("key_hash").notNull(),
+    permissions: jsonb("permissions").$type<string[]>().notNull().default([]),
+    expiresAt: timestamp("expires_at", { withTimezone: true }),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+    lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    prefix: index("api_keys_prefix_idx").on(table.prefix),
+    hash: uniqueIndex("api_keys_key_hash_idx").on(table.keyHash),
+    account: index("api_keys_account_idx").on(table.accountId),
+    workspace: index("api_keys_workspace_idx").on(table.workspaceId),
+    descriptionValid: check(
+      "api_keys_description_check",
+      sql`${table.description} is null or length(${table.description}) between 1 and 500`,
+    ),
+  }),
+);
+
+export const workspaceVariableSets = pgTable(
+  "workspace_variable_sets",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    description: text("description"),
+    // Omitted creation remains workspace-owned. User ownership is anchored to
+    // the common organization-user resource authority; organization ownership
+    // has no member owner and is administered through account authority.
+    authorityScope: text("authority_scope").notNull().default("workspace"),
+    authorityId: uuid("authority_id"),
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
+    originWorkspaceId: uuid("origin_workspace_id"),
+    generation: bigint("generation", { mode: "number" }).notNull().default(1),
+    status: text("status").notNull().default("active"),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceName: uniqueIndex("workspace_variable_sets_workspace_name_active_idx")
+      .on(table.workspaceId, table.name)
+      .where(sql`${table.authorityScope} = 'workspace' and ${table.status} = 'active'`),
+    workspaceCreated: index("workspace_variable_sets_workspace_created_idx").on(
+      table.workspaceId,
+      table.createdAt,
+    ),
+    authorityShape: check(
+      "workspace_variable_sets_authority_shape_check",
+      sql`(
+          ${table.authorityScope} in ('organization', 'workspace')
+          and ${table.authorityId} is null
+          and ${table.ownerOrganizationMembershipId} is null
+        ) or (
+          ${table.authorityScope} = 'user'
+          and ${table.authorityId} is not null
+          and ${table.ownerOrganizationMembershipId} is not null
+        )`,
+    ),
+    authorityScopeValid: check(
+      "workspace_variable_sets_authority_scope_check",
+      sql`${table.authorityScope} in ('organization', 'workspace', 'user')`,
+    ),
+    generationValid: check(
+      "workspace_variable_sets_generation_check",
+      sql`${table.generation} > 0`,
+    ),
+    statusValid: check(
+      "workspace_variable_sets_status_check",
+      sql`${table.status} in ('active', 'revoked')`,
+    ),
+    revocationValid: check(
+      "workspace_variable_sets_revocation_check",
+      sql`(${table.status} = 'revoked' and ${table.revokedAt} is not null)
+        or (${table.status} = 'active' and ${table.revokedAt} is null)`,
+    ),
+    authority: foreignKey({
+      name: "workspace_variable_sets_authority_fk",
+      columns: [table.authorityId, table.accountId, table.ownerOrganizationMembershipId],
+      foreignColumns: [
+        organizationUserResourceAuthorities.id,
+        organizationUserResourceAuthorities.accountId,
+        organizationUserResourceAuthorities.organizationMembershipId,
+      ],
+    }).onDelete("restrict"),
+    // PostgreSQL's column-subset SET NULL action preserves account_id; Drizzle
+    // cannot represent that action, so migration 0230 owns the origin FK.
+  }),
+);
+
+export const workspaceVariableSetVariables = pgTable(
+  "workspace_variable_set_variables",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    variableSetId: uuid("variable_set_id")
+      .notNull()
+      .references(() => workspaceVariableSets.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    // Format: v1:<base64 iv>:<base64 ciphertext||gcm-tag>. Never returned by any API.
+    valueEncrypted: text("value_encrypted").notNull(),
+    version: integer("version").notNull().default(1),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    variableSetName: uniqueIndex("workspace_variable_set_variables_env_name_idx").on(
+      table.workspaceId,
+      table.variableSetId,
+      table.name,
+    ),
+    variableSet: index("workspace_variable_set_variables_workspace_env_idx").on(
+      table.workspaceId,
+      table.variableSetId,
+    ),
+  }),
+);
+
+// Per-workspace ChatGPT/Codex subscription credential. One row per connected
+// ChatGPT account within a workspace.
+// access/refresh/id tokens live INSIDE credential_encrypted (v1 AES-256-GCM,
+// same envelope as workspace_variable_set_variables); the other columns are
+// plaintext metadata (header value + UI). RLS-isolated per workspace.
+export const codexSubscriptionCredentials = pgTable(
+  "codex_subscription_credentials",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    // Format: v1:<base64 iv>:<base64 ciphertext||gcm-tag>. JSON {access_token, refresh_token, id_token}. Never returned by any API.
+    credentialEncrypted: text("credential_encrypted").notNull(),
+    chatgptAccountId: text("chatgpt_account_id"), // plaintext ChatGPT-Account-ID header value (non-secret)
+    scopes: text("scopes"), // space-delimited, as granted
+    planType: text("plan_type"),
+    isFedramp: boolean("is_fedramp").notNull().default(false),
+    expiresAt: timestamp("expires_at", { withTimezone: true }), // derived from access-token JWT exp
+    lastRefreshAt: timestamp("last_refresh_at", { withTimezone: true }),
+    status: text("status").notNull().default("active"), // active | needs_relogin | error
+    lastError: text("last_error"),
+    version: integer("version").notNull().default(1),
+    label: text("label"), // user-chosen nickname; null ⇒ derive from email/plan/account
+    accountEmail: text("account_email"), // email from the id_token (user's own email; non-secret)
+    // P2 usage cache (plaintext metadata; NEVER a token). Snapshotted from
+    // GET /wham/usage; drives the quota bars + the cache TTL. primary = 5h window
+    // (limit_window_seconds 18000), secondary = weekly (604800).
+    primaryUsedPercent: integer("primary_used_percent"),
+    primaryResetAt: timestamp("primary_reset_at", { withTimezone: true }),
+    secondaryUsedPercent: integer("secondary_used_percent"),
+    secondaryResetAt: timestamp("secondary_reset_at", { withTimezone: true }),
+    usageCheckedAt: timestamp("usage_checked_at", { withTimezone: true }), // snapshot freshness → cache TTL clock
+    // P3 rotation cooldown (plaintext metadata; NEVER a token). Set when this account hit its
+    // usage cap on a rotation turn; the rotation engine treats `exhausted_until > now()` as
+    // capped/skip so it isn't immediately re-picked. Self-clears via the now() comparison.
+    exhaustedUntil: timestamp("exhausted_until", { withTimezone: true }),
+    // Workspace-local, server-held fairness cursor. Provider usage headers are
+    // capacity hints, never the sole allocator: live lease count is ranked first
+    // and this cursor deterministically breaks equal-load/equal-capacity ties.
+    // This flag controls NEW automatic allocations only. Credential health,
+    // refresh, encrypted material, and an already-leased in-flight turn are
+    // intentionally independent. account eligibility policy owns toggle OCC/audit and product UI.
+    allocatorEnabled: boolean("allocator_enabled").notNull().default(true),
+    // Independent OCC/audit sequence for the allocator toggle. Token refresh
+    // continues to own `version`; quota/cache writes own neither counter.
+    allocatorVersion: integer("allocator_version").notNull().default(1),
+    allocatorUpdatedBySubjectId: text("allocator_updated_by_subject_id"),
+    allocatorUpdatedAt: timestamp("allocator_updated_at", {
+      withTimezone: true,
+    }),
+    // Authoritative count-only summary cached from /wham/usage. Detailed rows
+    // are never persisted as redemption authority; every first POST preflights
+    // the provider's fresh detail endpoint.
+    resetCreditAvailableCount: integer("reset_credit_available_count"),
+    resetCreditsCheckedAt: timestamp("reset_credits_checked_at", {
+      withTimezone: true,
+    }),
+    // Set only by a direct Better Auth cookie connection/reconnection. Legacy,
+    // configured, delegated, API-key, and agent-created rows remain view-only.
+    connectedBySubjectId: text("connected_by_subject_id"),
+    selectionCount: integer("selection_count").notNull().default(0),
+    lastSelectedAt: timestamp("last_selected_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    // REPLACES codex_subscription_credentials_workspace_idx (the one-per-workspace cap).
+    // One row per (workspace, ChatGPT account). Partial WHERE chatgpt_account_id IS NOT NULL
+    // so degenerate null-account rows can't collide; the device-grant connect path always
+    // populates chatgpt_account_id.
+    wsAccount: uniqueIndex("codex_subscription_credentials_ws_account_idx")
+      .on(table.workspaceId, table.chatgptAccountId)
+      .where(sql`${table.chatgptAccountId} is not null`),
+    workspace: index("codex_subscription_credentials_workspace_lookup_idx").on(table.workspaceId),
+    // Composite identity is the defense-in-depth FK target for workspace-local
+    // lease references in migration 0053.
+    workspaceIdentity: uniqueIndex("codex_subscription_credentials_workspace_id_idx").on(
+      table.workspaceId,
+      table.id,
+    ),
+    workspaceAccountIdentity: uniqueIndex(
+      "codex_subscription_credentials_workspace_account_id_idx",
+    ).on(table.workspaceId, table.accountId, table.id),
+  }),
+);
+
+// Optional workspace-level credential used only for ChatGPT connected Apps.
+// Inference selection, usage, cooldown, allocator, pins, and leases never read
+// this row. A durable null row retains the OCC sequence after designation clear.
+export const codexAppsSettings = pgTable(
+  "codex_apps_settings",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    credentialId: uuid("credential_id"),
+    version: integer("version").notNull().default(1),
+    designatedAt: timestamp("designated_at", { withTimezone: true }),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceAccount: foreignKey({
+      name: "codex_apps_settings_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    credentialScope: foreignKey({
+      name: "codex_apps_settings_credential_scope_fk",
+      columns: [table.workspaceId, table.accountId, table.credentialId],
+      foreignColumns: [
+        codexSubscriptionCredentials.workspaceId,
+        codexSubscriptionCredentials.accountId,
+        codexSubscriptionCredentials.id,
+      ],
+    }).onDelete("cascade"),
+    workspace: uniqueIndex("codex_apps_settings_workspace_idx").on(table.workspaceId),
+    designationShape: check(
+      "codex_apps_settings_designation_shape_chk",
+      sql`${table.version} > 0 and (
+        (${table.credentialId} is null and ${table.designatedAt} is null)
+        or
+        (${table.credentialId} is not null and ${table.designatedAt} is not null)
+      )`,
+    ),
+  }),
+);
+
+// One durable logical human redemption. `processing` means the fresh provider
+// detail preflight is still owed; `provider_started` means the POST may have
+// reached upstream and every retry must reuse upstreamIdempotencyKey without
+// requiring the credit to remain visible as available.
+export const codexResetRedemptionAttempts = pgTable(
+  "codex_reset_redemption_attempts",
+  {
+    id: uuid("id").primaryKey(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    credentialId: uuid("credential_id").notNull(),
+    subjectId: text("subject_id").notNull(),
+    browserSessionHash: text("browser_session_hash").notNull(),
+    creditId: text("credit_id").notNull(),
+    upstreamIdempotencyKey: uuid("upstream_idempotency_key").notNull().defaultRandom(),
+    status: text("status").notNull().default("processing"),
+    outcome: text("outcome"),
+    claimHolderId: uuid("claim_holder_id"),
+    claimExpiresAt: timestamp("claim_expires_at", { withTimezone: true }),
+    confirmationExpiresAt: timestamp("confirmation_expires_at", {
+      withTimezone: true,
+    }).notNull(),
+    providerStartedAt: timestamp("provider_started_at", { withTimezone: true }),
+    completedAt: timestamp("completed_at", { withTimezone: true }),
+    lastFailureKind: text("last_failure_kind"),
+    retryCount: integer("retry_count").notNull().default(0),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceAccount: foreignKey({
+      name: "codex_reset_redemption_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    upstreamKey: uniqueIndex("codex_reset_redemption_upstream_key_idx").on(
+      table.upstreamIdempotencyKey,
+    ),
+    credentialCredit: uniqueIndex("codex_reset_redemption_credential_credit_idx")
+      .on(table.workspaceId, table.credentialId, table.creditId)
+      .where(
+        sql`${table.status} <> 'completed' or ${table.outcome} in ('reset', 'alreadyRedeemed')`,
+      ),
+    workspaceCredential: index("codex_reset_redemption_workspace_credential_idx").on(
+      table.workspaceId,
+      table.credentialId,
+      table.createdAt,
+    ),
+    claimExpiry: index("codex_reset_redemption_claim_expiry_idx")
+      .on(table.claimExpiresAt)
+      .where(sql`${table.status} <> 'completed'`),
+    statusValid: check(
+      "codex_reset_redemption_status_check",
+      sql`${table.status} in ('processing', 'provider_started', 'completed')`,
+    ),
+    outcomeValid: check(
+      "codex_reset_redemption_outcome_check",
+      sql`${table.outcome} is null or ${table.outcome} in ('reset', 'nothingToReset', 'noCredit', 'alreadyRedeemed')`,
+    ),
+    completionConsistent: check(
+      "codex_reset_redemption_completed_check",
+      sql`(${table.status} = 'completed') = (${table.outcome} is not null and ${table.completedAt} is not null)`,
+    ),
+    retryCountValid: check(
+      "codex_reset_redemption_retry_count_check",
+      sql`${table.retryCount} >= 0`,
+    ),
+    humanSubjectValid: check(
+      "codex_reset_redemption_human_subject_check",
+      sql`${table.subjectId} like 'user:_%'`,
+    ),
+  }),
+);
+
+// Generic external-service credential spine. credential_encrypted is the ONLY
+// secret-bearing column; normal API reads use metadata-only helpers below the DB
+// layer. Runtime token material is decrypted only by the broker accessor.
+export const connections = pgTable(
+  "connections",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    subjectId: text("subject_id"),
+    providerDomain: text("provider_domain").notNull(),
+    kind: text("kind").notNull(),
+    status: text("status").notNull().default("active"),
+    credentialEncrypted: text("credential_encrypted").notNull(),
+    grantedScopes: jsonb("granted_scopes").$type<string[]>().notNull().default([]),
+    expiresAt: timestamp("expires_at", { withTimezone: true }),
+    lastRefreshAt: timestamp("last_refresh_at", { withTimezone: true }),
+    lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+    lastError: text("last_error"),
+    version: integer("version").notNull().default(1),
+    // Server-owned proof that the dedicated install route verified the exact
+    // credential at this connection version. Generic/legacy writers cannot set
+    // these columns, and migration 0131 clears them when protected fields change
+    // without a fresh verification in the same statement.
+    verifiedInstallAt: timestamp("verified_install_at", { withTimezone: true }),
+    verifiedInstallVersion: integer("verified_install_version"),
+    metadata: jsonb("metadata").$type<Record<string, unknown>>().notNull().default({}),
+    createdBySubjectId: text("created_by_subject_id"),
+    updatedBySubjectId: text("updated_by_subject_id"),
+    // Explicit execution authority. Workspace rows have no member authority;
+    // user rows bind one immutable organization membership and common resource
+    // authority. `legacy_user` preserves pre-tenancy personal rows without
+    // inventing an owner membership; it is ineligible for delegated use until
+    // the migration cutover binds it. Public metadata projects only the opaque
+    // authority id to the exact subject owner; membership, scope, origin, and
+    // generation remain internal.
+    authorityScope: text("authority_scope").notNull().default("workspace"),
+    authorityId: uuid("authority_id"),
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
+    originWorkspaceId: uuid("origin_workspace_id"),
+    // Separate from credential version: refresh may rotate token material
+    // without invalidating already accepted work, while reconnect/disconnect
+    // and identity/status transitions advance this generation.
+    authorityGeneration: bigint("authority_generation", { mode: "number" }).notNull().default(1),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceProviderStatus: index("connections_workspace_provider_status_idx").on(
+      table.workspaceId,
+      table.providerDomain,
+      table.status,
+    ),
+    workspaceSubjectProvider: index("connections_workspace_subject_provider_idx").on(
+      table.workspaceId,
+      table.subjectId,
+      table.providerDomain,
+    ),
+    workspaceKind: index("connections_workspace_kind_idx").on(table.workspaceId, table.kind),
+    workspaceExpires: index("connections_workspace_expires_idx").on(
+      table.workspaceId,
+      table.expiresAt,
+    ),
+    authorityIdentity: uniqueIndex("connections_authority_identity_uq")
+      .on(table.accountId, table.authorityId)
+      .where(sql`${table.authorityId} is not null`),
+    ownerAuthority: index("connections_owner_authority_idx")
+      .on(
+        table.accountId,
+        table.ownerOrganizationMembershipId,
+        table.status,
+        table.updatedAt,
+        table.id,
+      )
+      .where(sql`${table.authorityScope} = 'user'`),
+    authorityScopeValid: check(
+      "connections_authority_scope_check",
+      sql`${table.authorityScope} in ('workspace', 'user', 'legacy_user')`,
+    ),
+    authorityShapeValid: check(
+      "connections_authority_shape_check",
+      sql`(
+          ${table.authorityScope} = 'workspace'
+          and ${table.subjectId} is null
+          and ${table.authorityId} is null
+          and ${table.ownerOrganizationMembershipId} is null
+          and ${table.originWorkspaceId} = ${table.workspaceId}
+        ) or (
+          ${table.authorityScope} = 'user'
+          and ${table.subjectId} is not null
+          and ${table.authorityId} is not null
+          and ${table.ownerOrganizationMembershipId} is not null
+          and ${table.originWorkspaceId} is not null
+        ) or (
+          ${table.authorityScope} = 'legacy_user'
+          and ${table.subjectId} is not null
+          and ${table.authorityId} is null
+          and ${table.ownerOrganizationMembershipId} is null
+          and ${table.originWorkspaceId} is not null
+        )`,
+    ),
+    authorityGenerationValid: check(
+      "connections_authority_generation_check",
+      sql`${table.authorityGeneration} > 0`,
+    ),
+    authority: foreignKey({
+      name: "connections_authority_fk",
+      columns: [table.authorityId, table.accountId, table.ownerOrganizationMembershipId],
+      foreignColumns: [
+        organizationUserResourceAuthorities.id,
+        organizationUserResourceAuthorities.accountId,
+        organizationUserResourceAuthorities.organizationMembershipId,
+      ],
+    }).onDelete("restrict"),
+    // Migration 0255 owns the same-organization origin FK because Drizzle
+    // cannot express PostgreSQL's column-subset SET NULL action.
+  }),
+);
+
+/**
+ * Monotonic authority head for one personal GitHub connection's selected
+ * repository set. The head is separate from the selected rows so replacing
+ * the set with an empty array still advances durable authority.
+ */
+export const personalGitHubRepositorySelectionHeads = pgTable(
+  "personal_github_repository_selection_heads",
+  {
+    connectionId: uuid("connection_id")
+      .primaryKey()
+      .references(() => connections.id, { onDelete: "cascade" }),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    originWorkspaceId: uuid("origin_workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    ownerSubjectId: text("owner_subject_id").notNull(),
+    providerPrincipalId: text("provider_principal_id").notNull(),
+    credentialBindingId: uuid("credential_binding_id").notNull(),
+    connectionAuthorityGeneration: bigint("connection_authority_generation", {
+      mode: "number",
+    }).notNull(),
+    generation: bigint("generation", { mode: "number" }).notNull().default(1),
+    updatedBySubjectId: text("updated_by_subject_id").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    tenantConnection: uniqueIndex("personal_github_repository_selection_heads_tenant_uq").on(
+      table.accountId,
+      table.originWorkspaceId,
+      table.ownerSubjectId,
+      table.connectionId,
+    ),
+    owner: index("personal_github_repository_selection_heads_owner_idx").on(
+      table.accountId,
+      table.ownerSubjectId,
+      table.connectionId,
+    ),
+    generationValid: check(
+      "personal_github_repository_selection_heads_generation_chk",
+      sql`${table.connectionAuthorityGeneration} > 0 and ${table.generation} > 0`,
+    ),
+  }),
+);
+
+/** Only explicitly selected repositories are persisted; discovery stays live. */
+export const personalGitHubRepositorySelections = pgTable(
+  "personal_github_repository_selections",
+  {
+    connectionId: uuid("connection_id").notNull(),
+    repositoryId: bigint("repository_id", { mode: "bigint" }).notNull(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    originWorkspaceId: uuid("origin_workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    ownerSubjectId: text("owner_subject_id").notNull(),
+    canonicalFullName: text("canonical_full_name").notNull(),
+    canonicalHttpsUri: text("canonical_https_uri").notNull(),
+    defaultBranch: text("default_branch").notNull(),
+    visibility: text("visibility").notNull(),
+    private: boolean("private").notNull(),
+    archived: boolean("archived").notNull(),
+    disabled: boolean("disabled").notNull(),
+    permissions: jsonb("permissions").$type<Record<string, boolean>>().notNull(),
+    selectedAccess: text("selected_access").notNull(),
+    selectionGeneration: bigint("selection_generation", {
+      mode: "number",
+    }).notNull(),
+    selectedBySubjectId: text("selected_by_subject_id").notNull(),
+    selectedAt: timestamp("selected_at", { withTimezone: true }).notNull().defaultNow(),
+    verifiedAt: timestamp("verified_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    identity: primaryKey({ columns: [table.connectionId, table.repositoryId] }),
+    head: foreignKey({
+      name: "personal_github_repository_selections_head_fk",
+      columns: [table.accountId, table.originWorkspaceId, table.ownerSubjectId, table.connectionId],
+      foreignColumns: [
+        personalGitHubRepositorySelectionHeads.accountId,
+        personalGitHubRepositorySelectionHeads.originWorkspaceId,
+        personalGitHubRepositorySelectionHeads.ownerSubjectId,
+        personalGitHubRepositorySelectionHeads.connectionId,
+      ],
+    }).onDelete("cascade"),
+    tenant: index("personal_github_repository_selections_tenant_idx").on(
+      table.accountId,
+      table.originWorkspaceId,
+      table.connectionId,
+    ),
+    shapeValid: check(
+      "personal_github_repository_selections_shape_chk",
+      sql`${table.repositoryId} > 0
+        and ${table.selectionGeneration} > 0
+        and ${table.selectedAccess} in ('read', 'write')
+        and ${table.visibility} in ('public', 'private', 'internal')
+        and ${table.private} = (${table.visibility} = 'private')
+        and jsonb_typeof(${table.permissions}) = 'object'
+        and ${table.permissions} ?& array['pull','push','admin','maintain','triage']
+        and ${table.permissions} - array['pull','push','admin','maintain','triage']::text[] = '{}'::jsonb
+        and jsonb_typeof(${table.permissions}->'pull') = 'boolean'
+        and jsonb_typeof(${table.permissions}->'push') = 'boolean'
+        and jsonb_typeof(${table.permissions}->'admin') = 'boolean'
+        and jsonb_typeof(${table.permissions}->'maintain') = 'boolean'
+        and jsonb_typeof(${table.permissions}->'triage') = 'boolean'
+        and (${table.permissions}->'pull' = 'true'::jsonb
+          or ${table.permissions}->'push' = 'true'::jsonb
+          or ${table.permissions}->'admin' = 'true'::jsonb
+          or ${table.permissions}->'maintain' = 'true'::jsonb
+          or ${table.permissions}->'triage' = 'true'::jsonb)
+        and (${table.selectedAccess} <> 'write' or (
+          not ${table.archived} and not ${table.disabled}
+          and (${table.permissions}->'push' = 'true'::jsonb
+            or ${table.permissions}->'admin' = 'true'::jsonb
+            or ${table.permissions}->'maintain' = 'true'::jsonb)
+        ))
+        and octet_length(${table.ownerSubjectId}) between 1 and 512
+        and ${table.canonicalFullName} ~ '^[A-Za-z0-9][A-Za-z0-9-]{0,38}/[A-Za-z0-9_.-]{1,100}$'
+        and octet_length(${table.canonicalFullName}) between 3 and 140
+        and octet_length(${table.defaultBranch}) between 1 and 255`,
+    ),
+  }),
+);
+
+/** Bounded idempotency receipt for an owner-issued full selection replacement. */
+export const personalGitHubRepositorySelectionOperations = pgTable(
+  "personal_github_repository_selection_operations",
+  {
+    connectionId: uuid("connection_id").notNull(),
+    idempotencyKey: text("idempotency_key").notNull(),
+    accountId: uuid("account_id").notNull(),
+    originWorkspaceId: uuid("origin_workspace_id").notNull(),
+    ownerSubjectId: text("owner_subject_id").notNull(),
+    requestDigest: bytea("request_digest").notNull(),
+    resultingGeneration: bigint("resulting_generation", {
+      mode: "number",
+    }).notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    identity: primaryKey({
+      columns: [table.connectionId, table.idempotencyKey],
+    }),
+    head: foreignKey({
+      name: "personal_github_repository_selection_operations_head_fk",
+      columns: [table.accountId, table.originWorkspaceId, table.ownerSubjectId, table.connectionId],
+      foreignColumns: [
+        personalGitHubRepositorySelectionHeads.accountId,
+        personalGitHubRepositorySelectionHeads.originWorkspaceId,
+        personalGitHubRepositorySelectionHeads.ownerSubjectId,
+        personalGitHubRepositorySelectionHeads.connectionId,
+      ],
+    }).onDelete("cascade"),
+    shapeValid: check(
+      "personal_github_repository_selection_operations_shape_chk",
+      sql`${table.resultingGeneration} > 0
+        and octet_length(${table.idempotencyKey}) between 1 and 200
+        and octet_length(${table.ownerSubjectId}) between 1 and 512
+        and octet_length(${table.requestDigest}) = 32`,
+    ),
+  }),
+);
+
+export const connectionUseOnceConsumptionReceipts = pgTable(
+  "connection_use_once_consumption_receipts",
+  {
+    grantId: uuid("grant_id").primaryKey(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    authorityId: uuid("authority_id").notNull(),
+    authorityGeneration: bigint("authority_generation", { mode: "number" }).notNull(),
+    grantGeneration: bigint("grant_generation", { mode: "number" }).notNull(),
+    acceptedWorkKind: text("accepted_work_kind").notNull(),
+    acceptedWorkId: uuid("accepted_work_id").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    authority: foreignKey({
+      name: "connection_once_receipts_authority_fk",
+      columns: [table.authorityId, table.accountId],
+      foreignColumns: [
+        organizationUserResourceAuthorities.id,
+        organizationUserResourceAuthorities.accountId,
+      ],
+    }).onDelete("cascade"),
+    grant: foreignKey({
+      name: "connection_once_receipts_grant_fk",
+      columns: [table.grantId, table.accountId],
+      foreignColumns: [organizationUserResourceGrants.id, organizationUserResourceGrants.accountId],
+    }).onDelete("cascade"),
+    generationValid: check(
+      "connection_once_receipts_generation_check",
+      sql`${table.authorityGeneration} > 0 and ${table.grantGeneration} > 0`,
+    ),
+    acceptedWorkKindValid: check(
+      "connection_once_receipts_work_kind_check",
+      sql`${table.acceptedWorkKind} in ('turn', 'scheduled_task')`,
+    ),
+  }),
+);
+
+// One durable routing authority per installed Slack team. The active partial
+// unique index is the database fence that prevents a team from being routed to
+// two OpenGeni workspaces. Legacy ambiguous rows are retained as quarantined
+// evidence instead of deleting credentials or guessing a winner.
+export const slackInstallationBindings = pgTable(
+  "slack_installation_bindings",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    connectionId: uuid("connection_id")
+      .notNull()
+      .references(() => connections.id, { onDelete: "cascade" }),
+    slackTeamId: text("slack_team_id").notNull(),
+    slackTeamName: text("slack_team_name").notNull(),
+    botId: text("bot_id").notNull(),
+    botUserId: text("bot_user_id").notNull(),
+    botDisplayName: text("bot_display_name").notNull(),
+    state: text("state").$type<"active" | "quarantined">().notNull(),
+    quarantineReason: text("quarantine_reason"),
+    version: integer("version").notNull().default(1),
+    createdBySubjectId: text("created_by_subject_id"),
+    updatedBySubjectId: text("updated_by_subject_id"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    connection: uniqueIndex("slack_installation_bindings_connection_uq").on(table.connectionId),
+    activeTeam: uniqueIndex("slack_installation_bindings_active_team_uq")
+      .on(table.slackTeamId)
+      .where(sql`${table.state} = 'active'`),
+    workspaceState: index("slack_installation_bindings_workspace_state_idx").on(
+      table.workspaceId,
+      table.state,
+      table.updatedAt,
+    ),
+    workspaceAccount: foreignKey({
+      name: "slack_installation_bindings_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    stateValid: check(
+      "slack_installation_bindings_state_check",
+      sql`${table.state} in ('active', 'quarantined')`,
+    ),
+    quarantineConsistent: check(
+      "slack_installation_bindings_quarantine_check",
+      sql`(${table.state} = 'active' and ${table.quarantineReason} is null)
+        or (${table.state} = 'quarantined' and length(btrim(${table.quarantineReason})) > 0)`,
+    ),
+    identityBounded: check(
+      "slack_installation_bindings_identity_check",
+      sql`octet_length(${table.slackTeamId}) between 1 and 64
+        and octet_length(${table.slackTeamName}) between 1 and 256
+        and octet_length(${table.botId}) between 1 and 64
+        and octet_length(${table.botUserId}) between 1 and 64
+        and ${table.botDisplayName} in ('OpenGeni', 'OpenGeni Staging')`,
     ),
-    workspaceAccountIdentity: uniqueIndex(
-      "codex_subscription_credentials_workspace_account_id_idx",
-    ).on(table.workspaceId, table.accountId, table.id),
+    versionPositive: check("slack_installation_bindings_version_check", sql`${table.version} > 0`),
   }),
 );
 
-// Optional workspace-level credential used only for ChatGPT connected Apps.
-// Inference selection, usage, cooldown, allocator, pins, and leases never read
-// this row. A durable null row retains the OCC sequence after designation clear.
-export const codexAppsSettings = pgTable(
-  "codex_apps_settings",
+/**
+ * Per-channel Slack workspace routing within one organization.
+ *
+ * HOME tenancy (`accountId`/`workspaceId`) is the installation binding's own
+ * workspace: it owns the bot credential every provider call is fenced on. The
+ * TARGET (`targetAccountId`/`targetWorkspaceId`) is where the session, its
+ * grant, and its events live. `slack_channel_routes_same_account_check` keeps
+ * both sides in one organization; cross-organization routing is out of scope.
+ *
+ * The row is the durable ask-once memory: once a human picks in the Slack
+ * picker, or an admin sets it in the web sheet, later messages in that channel
+ * never ask again.
+ */
+export const slackChannelRoutes = pgTable(
+  "slack_channel_routes",
   {
     id: uuid("id").primaryKey().defaultRandom(),
     accountId: uuid("account_id")
@@ -809,121 +1858,145 @@ export const codexAppsSettings = pgTable(
     workspaceId: uuid("workspace_id")
       .notNull()
       .references(() => workspaces.id, { onDelete: "cascade" }),
-    credentialId: uuid("credential_id"),
+    connectionId: uuid("connection_id")
+      .notNull()
+      .references(() => connections.id, { onDelete: "cascade" }),
+    slackTeamId: text("slack_team_id").notNull(),
+    slackChannelId: text("slack_channel_id").notNull(),
+    targetAccountId: uuid("target_account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    targetWorkspaceId: uuid("target_workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    decidedBySubjectId: text("decided_by_subject_id").notNull(),
+    decidedBySlackUserId: text("decided_by_slack_user_id").notNull(),
+    source: text("source").$type<"picker" | "admin">().notNull(),
     version: integer("version").notNull().default(1),
-    designatedAt: timestamp("designated_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
+    channel: unique("slack_channel_routes_channel_uq").on(table.connectionId, table.slackChannelId),
     workspaceAccount: foreignKey({
-      name: "codex_apps_settings_workspace_account_fk",
+      name: "slack_channel_routes_workspace_account_fk",
       columns: [table.workspaceId, table.accountId],
       foreignColumns: [workspaces.id, workspaces.accountId],
     }).onDelete("cascade"),
-    credentialScope: foreignKey({
-      name: "codex_apps_settings_credential_scope_fk",
-      columns: [table.workspaceId, table.accountId, table.credentialId],
-      foreignColumns: [
-        codexSubscriptionCredentials.workspaceId,
-        codexSubscriptionCredentials.accountId,
-        codexSubscriptionCredentials.id,
-      ],
+    targetWorkspaceAccount: foreignKey({
+      name: "slack_channel_routes_target_workspace_account_fk",
+      columns: [table.targetWorkspaceId, table.targetAccountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
     }).onDelete("cascade"),
-    workspace: uniqueIndex("codex_apps_settings_workspace_idx").on(table.workspaceId),
-    designationShape: check(
-      "codex_apps_settings_designation_shape_chk",
-      sql`${table.version} > 0 and (
-        (${table.credentialId} is null and ${table.designatedAt} is null)
-        or
-        (${table.credentialId} is not null and ${table.designatedAt} is not null)
-      )`,
+    target: index("slack_channel_routes_target_idx").on(table.targetWorkspaceId, table.slackTeamId),
+    sameAccount: check(
+      "slack_channel_routes_same_account_check",
+      sql`${table.targetAccountId} = ${table.accountId}`,
+    ),
+    bounded: check(
+      "slack_channel_routes_bounds_check",
+      sql`octet_length(${table.slackTeamId}) between 1 and 64
+        and octet_length(${table.slackChannelId}) between 1 and 64
+        and octet_length(${table.decidedBySubjectId}) between 1 and 1024
+        and octet_length(${table.decidedBySlackUserId}) between 1 and 64
+        and ${table.source} in ('picker', 'admin')
+        and ${table.version} > 0`,
     ),
   }),
 );
 
-// One durable logical human redemption. `processing` means the fresh provider
-// detail preflight is still owed; `provider_started` means the POST may have
-// reached upstream and every retry must reuse upstreamIdempotencyKey without
-// requiring the credit to remain visible as available.
-export const codexResetRedemptionAttempts = pgTable(
-  "codex_reset_redemption_attempts",
+/**
+ * Per-Slack-human direct-message workspace routing, same HOME/TARGET split as
+ * {@link slackChannelRoutes}. Absent a row, a DM derives that human's own
+ * personal workspace from their active organization membership pointer; the
+ * workspace id is never accepted from a Slack payload or from this table.
+ */
+export const slackUserDmRoutes = pgTable(
+  "slack_user_dm_routes",
   {
-    id: uuid("id").primaryKey(),
+    id: uuid("id").primaryKey().defaultRandom(),
     accountId: uuid("account_id")
       .notNull()
       .references(() => managedAccounts.id, { onDelete: "cascade" }),
     workspaceId: uuid("workspace_id")
       .notNull()
       .references(() => workspaces.id, { onDelete: "cascade" }),
-    credentialId: uuid("credential_id").notNull(),
-    subjectId: text("subject_id").notNull(),
-    browserSessionHash: text("browser_session_hash").notNull(),
-    creditId: text("credit_id").notNull(),
-    upstreamIdempotencyKey: uuid("upstream_idempotency_key").notNull().defaultRandom(),
-    status: text("status").notNull().default("processing"),
-    outcome: text("outcome"),
-    claimHolderId: uuid("claim_holder_id"),
-    claimExpiresAt: timestamp("claim_expires_at", { withTimezone: true }),
-    confirmationExpiresAt: timestamp("confirmation_expires_at", {
-      withTimezone: true,
-    }).notNull(),
-    providerStartedAt: timestamp("provider_started_at", { withTimezone: true }),
-    completedAt: timestamp("completed_at", { withTimezone: true }),
-    lastFailureKind: text("last_failure_kind"),
-    retryCount: integer("retry_count").notNull().default(0),
+    connectionId: uuid("connection_id")
+      .notNull()
+      .references(() => connections.id, { onDelete: "cascade" }),
+    slackTeamId: text("slack_team_id").notNull(),
+    slackUserId: text("slack_user_id").notNull(),
+    targetAccountId: uuid("target_account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    targetWorkspaceId: uuid("target_workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    decidedBySubjectId: text("decided_by_subject_id").notNull(),
+    decidedBySlackUserId: text("decided_by_slack_user_id").notNull(),
+    source: text("source").$type<"picker" | "admin">().notNull(),
+    version: integer("version").notNull().default(1),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
+    user: unique("slack_user_dm_routes_user_uq").on(table.connectionId, table.slackUserId),
     workspaceAccount: foreignKey({
-      name: "codex_reset_redemption_workspace_account_fk",
+      name: "slack_user_dm_routes_workspace_account_fk",
       columns: [table.workspaceId, table.accountId],
       foreignColumns: [workspaces.id, workspaces.accountId],
     }).onDelete("cascade"),
-    upstreamKey: uniqueIndex("codex_reset_redemption_upstream_key_idx").on(
-      table.upstreamIdempotencyKey,
-    ),
-    credentialCredit: uniqueIndex("codex_reset_redemption_credential_credit_idx")
-      .on(table.workspaceId, table.credentialId, table.creditId)
-      .where(
-        sql`${table.status} <> 'completed' or ${table.outcome} in ('reset', 'alreadyRedeemed')`,
-      ),
-    workspaceCredential: index("codex_reset_redemption_workspace_credential_idx").on(
-      table.workspaceId,
-      table.credentialId,
-      table.createdAt,
-    ),
-    claimExpiry: index("codex_reset_redemption_claim_expiry_idx")
-      .on(table.claimExpiresAt)
-      .where(sql`${table.status} <> 'completed'`),
-    statusValid: check(
-      "codex_reset_redemption_status_check",
-      sql`${table.status} in ('processing', 'provider_started', 'completed')`,
-    ),
-    outcomeValid: check(
-      "codex_reset_redemption_outcome_check",
-      sql`${table.outcome} is null or ${table.outcome} in ('reset', 'nothingToReset', 'noCredit', 'alreadyRedeemed')`,
-    ),
-    completionConsistent: check(
-      "codex_reset_redemption_completed_check",
-      sql`(${table.status} = 'completed') = (${table.outcome} is not null and ${table.completedAt} is not null)`,
-    ),
-    retryCountValid: check(
-      "codex_reset_redemption_retry_count_check",
-      sql`${table.retryCount} >= 0`,
+    targetWorkspaceAccount: foreignKey({
+      name: "slack_user_dm_routes_target_workspace_account_fk",
+      columns: [table.targetWorkspaceId, table.targetAccountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    target: index("slack_user_dm_routes_target_idx").on(table.targetWorkspaceId, table.slackTeamId),
+    sameAccount: check(
+      "slack_user_dm_routes_same_account_check",
+      sql`${table.targetAccountId} = ${table.accountId}`,
     ),
-    humanSubjectValid: check(
-      "codex_reset_redemption_human_subject_check",
-      sql`${table.subjectId} like 'user:_%'`,
+    bounded: check(
+      "slack_user_dm_routes_bounds_check",
+      sql`octet_length(${table.slackTeamId}) between 1 and 64
+        and octet_length(${table.slackUserId}) between 1 and 64
+        and octet_length(${table.decidedBySubjectId}) between 1 and 1024
+        and octet_length(${table.decidedBySlackUserId}) between 1 and 64
+        and ${table.source} in ('picker', 'admin')
+        and ${table.version} > 0`,
     ),
   }),
 );
 
-// Generic external-service credential spine. credential_encrypted is the ONLY
-// secret-bearing column; normal API reads use metadata-only helpers below the DB
-// layer. Runtime token material is decrypted only by the broker accessor.
-export const connections = pgTable(
-  "connections",
+/**
+ * The pending first-use Slack workspace picker.
+ *
+ * `slack_interaction_action_handles` cannot carry it: that table's `sessionId`
+ * is NOT NULL and composite-FK'd to an existing `slack_interactions` row, while
+ * a picker exists BEFORE any session.
+ *
+ * `inboxId` deliberately carries no foreign key. The `awaiting_choice` inbox row
+ * is settled `processed` before the human answers - the answer arrives as its
+ * own `block_action` inbox row - so this column is provenance, not a live edge.
+ *
+ * `requestText` mirrors the inbox's exact 12000 byte bound so a prompt can
+ * always carry the originating row's text losslessly.
+ *
+ * `providerEventId` is the ORIGINAL event, and it is PROVENANCE, not the id the
+ * answer re-materializes under. Migration 0335's comment claims the answer can
+ * re-insert the original event id under the inbox's own
+ * `(connection_id, provider_event_id)` dedupe unique; that is wrong, and the
+ * migration's bytes are frozen so the claim is corrected here instead. The
+ * original inbox row still exists and is settled `processed`, so re-inserting
+ * its id conflicts and does nothing, and the chosen workspace would never start
+ * any work at all. The answer must enqueue a DERIVED id -
+ * `<originalProviderEventId>:route:<promptId>` - which is unique per prompt and
+ * still idempotent, so a double-click cannot create two sessions. The
+ * `(connection_id, provider_event_id)` unique on this table is what makes
+ * Slack's retries of the same event unable to post a second picker.
+ */
+export const slackRoutePrompts = pgTable(
+  "slack_route_prompts",
   {
     id: uuid("id").primaryKey().defaultRandom(),
     accountId: uuid("account_id")
@@ -932,54 +2005,107 @@ export const connections = pgTable(
     workspaceId: uuid("workspace_id")
       .notNull()
       .references(() => workspaces.id, { onDelete: "cascade" }),
-    subjectId: text("subject_id"),
-    providerDomain: text("provider_domain").notNull(),
-    kind: text("kind").notNull(),
-    status: text("status").notNull().default("active"),
-    credentialEncrypted: text("credential_encrypted").notNull(),
-    grantedScopes: jsonb("granted_scopes").$type<string[]>().notNull().default([]),
-    expiresAt: timestamp("expires_at", { withTimezone: true }),
-    lastRefreshAt: timestamp("last_refresh_at", { withTimezone: true }),
-    lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
-    lastError: text("last_error"),
-    version: integer("version").notNull().default(1),
-    // Server-owned proof that the dedicated install route verified the exact
-    // credential at this connection version. Generic/legacy writers cannot set
-    // these columns, and migration 0131 clears them when protected fields change
-    // without a fresh verification in the same statement.
-    verifiedInstallAt: timestamp("verified_install_at", { withTimezone: true }),
-    verifiedInstallVersion: integer("verified_install_version"),
-    metadata: jsonb("metadata").$type<Record<string, unknown>>().notNull().default({}),
-    createdBySubjectId: text("created_by_subject_id"),
-    updatedBySubjectId: text("updated_by_subject_id"),
+    connectionId: uuid("connection_id")
+      .notNull()
+      .references(() => connections.id, { onDelete: "cascade" }),
+    inboxId: uuid("inbox_id").notNull(),
+    slackTeamId: text("slack_team_id").notNull(),
+    slackUserId: text("slack_user_id").notNull(),
+    slackChannelId: text("slack_channel_id").notNull(),
+    slackMessageTs: text("slack_message_ts").notNull(),
+    providerEventId: text("provider_event_id").notNull(),
+    triggerKind: text("trigger_kind")
+      .$type<
+        | "app_mention"
+        | "dm"
+        | "reaction"
+        | "slash_command"
+        | "message_shortcut"
+        | "thread_reply"
+        | "block_action"
+      >()
+      .notNull(),
+    requestText: text("request_text").notNull(),
+    hasFiles: boolean("has_files").notNull().default(false),
+    slackThreadTs: text("slack_thread_ts"),
+    messageOperationId: uuid("message_operation_id").notNull(),
+    status: text("status")
+      .$type<"pending" | "answered" | "expired" | "cancelled">()
+      .notNull()
+      .default("pending"),
+    answeredTargetAccountId: uuid("answered_target_account_id"),
+    answeredTargetWorkspaceId: uuid("answered_target_workspace_id"),
+    answeredBySubjectId: text("answered_by_subject_id"),
+    answeredAt: timestamp("answered_at", { withTimezone: true }),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
-    workspaceProviderStatus: index("connections_workspace_provider_status_idx").on(
-      table.workspaceId,
-      table.providerDomain,
-      table.status,
+    inbox: unique("slack_route_prompts_inbox_uq").on(table.connectionId, table.inboxId),
+    providerEvent: unique("slack_route_prompts_event_uq").on(
+      table.connectionId,
+      table.providerEventId,
     ),
-    workspaceSubjectProvider: index("connections_workspace_subject_provider_idx").on(
+    tenantIdentity: unique("slack_route_prompts_identity_uq").on(
+      table.accountId,
       table.workspaceId,
-      table.subjectId,
-      table.providerDomain,
+      table.id,
     ),
-    workspaceKind: index("connections_workspace_kind_idx").on(table.workspaceId, table.kind),
-    workspaceExpires: index("connections_workspace_expires_idx").on(
-      table.workspaceId,
-      table.expiresAt,
+    workspaceAccount: foreignKey({
+      name: "slack_route_prompts_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    pending: index("slack_route_prompts_pending_idx")
+      .on(table.expiresAt, table.id)
+      .where(sql`${table.status} = 'pending'`),
+    statusValid: check(
+      "slack_route_prompts_status_check",
+      sql`${table.status} in ('pending', 'answered', 'expired', 'cancelled')`,
+    ),
+    triggerValid: check(
+      "slack_route_prompts_trigger_check",
+      sql`${table.triggerKind} in (
+        'app_mention', 'dm', 'reaction', 'slash_command',
+        'message_shortcut', 'thread_reply', 'block_action'
+      )`,
+    ),
+    answerConsistent: check(
+      "slack_route_prompts_answer_check",
+      sql`(${table.status} = 'answered') = (${table.answeredTargetWorkspaceId} is not null)
+        and (${table.answeredTargetAccountId} is null) = (${table.answeredTargetWorkspaceId} is null)
+        and (${table.answeredTargetAccountId} is null
+          or ${table.answeredTargetAccountId} = ${table.accountId})
+        and (${table.answeredTargetWorkspaceId} is null) = (${table.answeredAt} is null)`,
+    ),
+    bounded: check(
+      "slack_route_prompts_bounds_check",
+      sql`octet_length(${table.slackTeamId}) between 1 and 64
+        and octet_length(${table.slackUserId}) between 1 and 64
+        and octet_length(${table.slackChannelId}) between 1 and 64
+        and octet_length(${table.slackMessageTs}) between 1 and 64
+        and octet_length(${table.providerEventId}) between 1 and 256
+        and octet_length(${table.requestText}) between 1 and 12000
+        and (${table.slackThreadTs} is null
+          or octet_length(${table.slackThreadTs}) between 1 and 64)
+        and (${table.answeredBySubjectId} is null
+          or octet_length(${table.answeredBySubjectId}) between 1 and 1024)`,
     ),
   }),
 );
 
-// One durable routing authority per installed Slack team. The active partial
-// unique index is the database fence that prevents a team from being routed to
-// two OpenGeni workspaces. Legacy ambiguous rows are retained as quarantined
-// evidence instead of deleting credentials or guessing a winner.
-export const slackInstallationBindings = pgTable(
-  "slack_installation_bindings",
+/**
+ * One row per workspace offered by a {@link slackRoutePrompts} card. The row id
+ * is the Slack button `value`, so it must be a UUID: the block-action normalizer
+ * already requires that shape, which is why the picker uses buttons rather than
+ * a `static_select` (whose `selected_option.value` the normalizer never reads).
+ *
+ * These rows are a snapshot taken at prompt time and are NEVER authority. The
+ * answer path re-authorizes the chosen workspace live.
+ */
+export const slackRoutePromptOptions = pgTable(
+  "slack_route_prompt_options",
   {
     id: uuid("id").primaryKey().defaultRandom(),
     accountId: uuid("account_id")
@@ -988,55 +2114,54 @@ export const slackInstallationBindings = pgTable(
     workspaceId: uuid("workspace_id")
       .notNull()
       .references(() => workspaces.id, { onDelete: "cascade" }),
-    connectionId: uuid("connection_id")
+    promptId: uuid("prompt_id").notNull(),
+    candidateAccountId: uuid("candidate_account_id")
       .notNull()
-      .references(() => connections.id, { onDelete: "cascade" }),
-    slackTeamId: text("slack_team_id").notNull(),
-    slackTeamName: text("slack_team_name").notNull(),
-    botId: text("bot_id").notNull(),
-    botUserId: text("bot_user_id").notNull(),
-    botDisplayName: text("bot_display_name").notNull(),
-    state: text("state").$type<"active" | "quarantined">().notNull(),
-    quarantineReason: text("quarantine_reason"),
-    version: integer("version").notNull().default(1),
-    createdBySubjectId: text("created_by_subject_id"),
-    updatedBySubjectId: text("updated_by_subject_id"),
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    candidateWorkspaceId: uuid("candidate_workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    candidateLabel: text("candidate_label").notNull(),
+    position: integer("position").notNull(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
-    connection: uniqueIndex("slack_installation_bindings_connection_uq").on(table.connectionId),
-    activeTeam: uniqueIndex("slack_installation_bindings_active_team_uq")
-      .on(table.slackTeamId)
-      .where(sql`${table.state} = 'active'`),
-    workspaceState: index("slack_installation_bindings_workspace_state_idx").on(
-      table.workspaceId,
-      table.state,
-      table.updatedAt,
-    ),
     workspaceAccount: foreignKey({
-      name: "slack_installation_bindings_workspace_account_fk",
+      name: "slack_route_prompt_options_workspace_account_fk",
       columns: [table.workspaceId, table.accountId],
       foreignColumns: [workspaces.id, workspaces.accountId],
     }).onDelete("cascade"),
-    stateValid: check(
-      "slack_installation_bindings_state_check",
-      sql`${table.state} in ('active', 'quarantined')`,
-    ),
-    quarantineConsistent: check(
-      "slack_installation_bindings_quarantine_check",
-      sql`(${table.state} = 'active' and ${table.quarantineReason} is null)
-        or (${table.state} = 'quarantined' and length(btrim(${table.quarantineReason})) > 0)`,
+    promptIdentity: foreignKey({
+      name: "slack_route_prompt_options_prompt_fk",
+      columns: [table.accountId, table.workspaceId, table.promptId],
+      foreignColumns: [
+        slackRoutePrompts.accountId,
+        slackRoutePrompts.workspaceId,
+        slackRoutePrompts.id,
+      ],
+    }).onDelete("cascade"),
+    candidateWorkspaceAccount: foreignKey({
+      name: "slack_route_prompt_options_candidate_workspace_account_fk",
+      columns: [table.candidateWorkspaceId, table.candidateAccountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    promptWorkspace: unique("slack_route_prompt_options_prompt_workspace_uq").on(
+      table.promptId,
+      table.candidateWorkspaceId,
     ),
-    identityBounded: check(
-      "slack_installation_bindings_identity_check",
-      sql`octet_length(${table.slackTeamId}) between 1 and 64
-        and octet_length(${table.slackTeamName}) between 1 and 256
-        and octet_length(${table.botId}) between 1 and 64
-        and octet_length(${table.botUserId}) between 1 and 64
-        and ${table.botDisplayName} = 'OpenGeni'`,
+    promptPosition: unique("slack_route_prompt_options_prompt_position_uq").on(
+      table.promptId,
+      table.position,
+    ),
+    sameAccount: check(
+      "slack_route_prompt_options_same_account_check",
+      sql`${table.candidateAccountId} = ${table.accountId}`,
+    ),
+    bounded: check(
+      "slack_route_prompt_options_bounds_check",
+      sql`octet_length(${table.candidateLabel}) between 1 and 128
+        and ${table.position} >= 0`,
     ),
-    versionPositive: check("slack_installation_bindings_version_check", sql`${table.version} > 0`),
   }),
 );
 
@@ -1143,6 +2268,9 @@ export const slackBotUserLinks = pgTable(
     slackUserId: text("slack_user_id").notNull(),
     subjectId: text("subject_id").notNull(),
     linkedBySubjectId: text("linked_by_subject_id").notNull(),
+    // The exact interaction id that won this identity's one-time onboarding
+    // hint. NULL means the hint has not been shown yet.
+    firstTaskHintInteractionId: uuid("first_task_hint_interaction_id"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
@@ -1368,6 +2496,21 @@ export const slackInteractionInbox = pgTable(
     retryAt: timestamp("retry_at", { withTimezone: true }),
     lastErrorCode: text("last_error_code"),
     reactionContextCheckpoint: jsonb("reaction_context_checkpoint").$type<unknown>(),
+    // Workspace routing decision, persisted on the claimed row so a retry after
+    // a crash re-uses the same decision rather than re-asking. `accountId` and
+    // `workspaceId` above stay HOME (the installation's credential tenancy) and
+    // stay NOT NULL: `workspace_rls_visible` is strict equality, so a NULL
+    // workspace would make an un-routed row invisible to every tenant including
+    // its own. NULL `routeState` means "legacy / never routed" and is exactly
+    // pre-routing behaviour.
+    routeState: text("route_state").$type<"resolved" | "awaiting_choice" | "denied">(),
+    // Deliberately no foreign key: an inbox row is short-lived and
+    // definer-claimed, so a runtime re-check degrades to "ask again" while an FK
+    // would hard-fail on a workspace deleted mid-flight.
+    targetAccountId: uuid("target_account_id"),
+    targetWorkspaceId: uuid("target_workspace_id"),
+    routePromptId: uuid("route_prompt_id"),
+    routePromptExpiresAt: timestamp("route_prompt_expires_at", { withTimezone: true }),
     processedAt: timestamp("processed_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
@@ -1390,6 +2533,73 @@ export const slackInteractionInbox = pgTable(
   }),
 );
 
+// Coalesced private App Home refresh authority. One row per installed Slack
+// connection/user serializes provider replacement calls while allowing event
+// retries and newer opens to converge on the latest requested revision.
+export const slackAppHomeRefreshes = pgTable(
+  "slack_app_home_refreshes",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    connectionId: uuid("connection_id")
+      .notNull()
+      .references(() => connections.id, { onDelete: "cascade" }),
+    slackTeamId: text("slack_team_id").notNull(),
+    slackUserId: text("slack_user_id").notNull(),
+    providerEventId: text("provider_event_id").notNull(),
+    providerViewHash: text("provider_view_hash"),
+    desiredRevision: integer("desired_revision").notNull().default(1),
+    processedRevision: integer("processed_revision").notNull().default(0),
+    claimHolderId: uuid("claim_holder_id"),
+    claimExpiresAt: timestamp("claim_expires_at", { withTimezone: true }),
+    attemptCount: integer("attempt_count").notNull().default(0),
+    retryAt: timestamp("retry_at", { withTimezone: true }),
+    lastErrorCode: text("last_error_code"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    connectionUser: uniqueIndex("slack_app_home_refreshes_connection_user_uq").on(
+      table.connectionId,
+      table.slackUserId,
+    ),
+    pending: index("slack_app_home_refreshes_pending_idx")
+      .on(table.retryAt, table.updatedAt, table.id)
+      .where(sql`${table.processedRevision} < ${table.desiredRevision}`),
+    workspaceAccount: foreignKey({
+      name: "slack_app_home_refreshes_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    bounds: check(
+      "slack_app_home_refreshes_bounds_check",
+      sql`octet_length(${table.slackTeamId}) between 1 and 64
+        and octet_length(${table.slackUserId}) between 1 and 64
+        and octet_length(${table.providerEventId}) between 1 and 256
+        and (${table.providerViewHash} is null
+          or octet_length(${table.providerViewHash}) between 1 and 256)
+        and (${table.lastErrorCode} is null
+          or octet_length(${table.lastErrorCode}) between 1 and 128)`,
+    ),
+    revisions: check(
+      "slack_app_home_refreshes_revisions_check",
+      sql`${table.desiredRevision} > 0
+        and ${table.processedRevision} >= 0
+        and ${table.processedRevision} <= ${table.desiredRevision}
+        and ${table.attemptCount} >= 0`,
+    ),
+    claim: check(
+      "slack_app_home_refreshes_claim_check",
+      sql`(${table.claimHolderId} is null) = (${table.claimExpiresAt} is null)`,
+    ),
+  }),
+);
+
 export const slackInteractions = pgTable(
   "slack_interactions",
   {
@@ -1426,6 +2636,15 @@ export const slackInteractions = pgTable(
     deliveryRetryAt: timestamp("delivery_retry_at", { withTimezone: true }),
     deliveryLastErrorCode: text("delivery_last_error_code"),
     ackSlackMessageTs: text("ack_slack_message_ts"),
+    // Frozen once: whether this interaction's acknowledgement renders the
+    // one-time onboarding hint. NULL means the decision has not been resolved.
+    firstTaskHint: boolean("first_task_hint"),
+    // The routed workspace's display name, frozen when the interaction binds.
+    // A live lookup at post time would be wrong: a workspace rename between the
+    // original post and a reconciliation makes `reconcilePostMessage`'s
+    // byte-compare raise `post_reconciliation_mismatch`. NULL means no
+    // per-message workspace line.
+    routedWorkspaceLabel: text("routed_workspace_label"),
     progressCount: integer("progress_count").notNull().default(0),
     terminalDeliveryState: text("terminal_delivery_state")
       .$type<"open" | "completed" | "failed" | "cancelled" | "blocked">()
@@ -2440,6 +3659,9 @@ export const channels = pgTable(
       .references(() => workspaces.id, { onDelete: "cascade" }),
     name: text("name").notNull(),
     description: text("description"),
+    pinned: boolean("pinned").notNull().default(false),
+    // Explicit user order within the pinned and unpinned project groups.
+    sortOrder: integer("sort_order").notNull().default(0),
     // Attribution string: 'user:<subject>' | 'session:<id>' | 'system'.
     createdBy: text("created_by"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -2464,10 +3686,10 @@ export const sessions = pgTable(
     status: text("status").notNull().default("queued"),
     initialMessage: losslessText("initial_message").notNull(),
     initialMessageCodecVersion: losslessCodecVersion("initial_message_codec_version"),
-    // Invisible host context frozen with the winning session create. The
-    // initial turn copies this value so an idempotent repair can never adopt a
-    // retrying caller's different instructions.
-    initialTurnInstructions: text("initial_turn_instructions"),
+    // Model-visible application context frozen with the winning create. The
+    // initial turn copies it into the canonical user message so an idempotent
+    // repair cannot adopt a retrying caller's different message context.
+    initialModelContext: text("initial_model_context"),
     title: text("title"),
     titleSource: text("title_source"),
     // Per-session agent persona/system instructions supplied at create (the
@@ -2500,6 +3722,9 @@ export const sessions = pgTable(
     ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
     ownerSubjectId: text("owner_subject_id"),
     visibility: text("visibility").notNull().default("workspace_shared"),
+    createRequestedVisibility: text("create_requested_visibility")
+      .notNull()
+      .default("workspace_shared"),
     authorityEpoch: integer("authority_epoch").notNull().default(1),
     // Independent-copy provenance. A destination may use either visibility and
     // may live in another workspace in the same organization; no live process,
@@ -2510,6 +3735,10 @@ export const sessions = pgTable(
     forkedAt: timestamp("forked_at", { withTimezone: true }),
     forkedByOrganizationMembershipId: uuid("forked_by_organization_membership_id"),
     model: text("model").notNull(),
+    // Immutable session-default execution policy. Follow-up composer drafts and
+    // accepted turns are separate authorities and never mutate these columns.
+    reasoningEffort: text("reasoning_effort").notNull(),
+    latencyMode: text("latency_mode").notNull(),
     sandboxBackend: text("sandbox_backend").notNull(),
     // The OS this session's box runs. Defaults to 'linux' (today's only OS, so
     // every existing + new row is a behavior-preserving no-op). CHECK-constrained
@@ -2539,13 +3768,10 @@ export const sessions = pgTable(
     // sandbox. integer (NOT bigint) — the lease-epoch spike: int8 reads back as a
     // JS string and breaks the strict fence; int4 returns a number.
     activeEpoch: integer("active_epoch").notNull().default(0),
-    // The session's WORKING DIRECTORY — the path/cwd base the (selfhosted) box's
-    // agent/terminal/file-dock operate under. A launch-workspace_root-relative
-    // subdir or an absolute machine path; surfaced alongside the active-sandbox
-    // pointer (readActiveSandbox) and written through the epoch-fenced
-    // setActiveSandbox CAS, NOT the row INSERT. NULL (the default) ⇒ today's
-    // behavior exactly — the agent substitutes its workspace_root for an empty cwd,
-    // so an unset working_dir is a byte-identical no-op. Create-time only (Stage A).
+    // The session's effective absolute Connected Machine root. New attaches
+    // resolve an optional relative request against the persisted Hello root and
+    // write the result through the epoch-fenced setActiveSandbox CAS. Legacy
+    // rows may still be null/relative and are resolved at establishment.
     workingDir: text("working_dir"),
     variableSetId: uuid("variable_set_id").references(() => workspaceVariableSets.id, {
       onDelete: "set null",
@@ -2577,6 +3803,12 @@ export const sessions = pgTable(
       .$type<McpPersonalConnectionDelegation[]>()
       .notNull()
       .default([]),
+    // Initial accepted-work staging only. The initializer consumes this inside
+    // the same transaction that inserts the first logical turn and grant
+    // snapshots; runtime never authorizes from the session field.
+    initialPersonalResourceAttachmentIntent: jsonb(
+      "initial_personal_resource_attachment_intent",
+    ).$type<PersonalResourceAttachmentIntent>(),
     initialXaiProviderAccountAuthoritySnapshot: jsonb(
       "initial_xai_provider_account_authority_snapshot",
     )
@@ -2593,8 +3825,8 @@ export const sessions = pgTable(
     // spawning a worker); null for direct API creates and scheduled-task runs.
     // When set, this worker's terminal-for-now transitions wake the parent so a
     // manager can orchestrate workers without busy-polling. The migration-owned
-    // self-reference uses ON DELETE RESTRICT so immutable hierarchy and
-    // authority lineage cannot be silently orphaned by a parent hard delete.
+    // self-reference uses ON DELETE CASCADE so the explicit quiescent root-tree
+    // deletion lifecycle removes the complete hierarchy atomically.
     parentSessionId: uuid("parent_session_id"),
     // Exact parent turn whose worker-signed attempt created this child. This is
     // private immutable authority lineage: child completion copies personal MCP
@@ -2676,6 +3908,14 @@ export const sessions = pgTable(
     }),
   },
   (table) => ({
+    reasoningEffortValid: check(
+      "sessions_reasoning_effort_check",
+      sql`${table.reasoningEffort} in ('none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max')`,
+    ),
+    latencyModeValid: check(
+      "sessions_latency_mode_check",
+      sql`${table.latencyMode} in ('standard', 'priority', 'fast')`,
+    ),
     accountIdentity: uniqueIndex("sessions_id_account_idx").on(table.id, table.accountId),
     workspaceIdentity: uniqueIndex("sessions_workspace_id_idx").on(table.workspaceId, table.id),
     workspaceCreated: index("sessions_workspace_created_idx").on(
@@ -2762,6 +4002,11 @@ export const sessions = pgTable(
       table.rootSessionId,
       table.nestedAgentDepth,
     ),
+    initialModelContextValid: check(
+      "sessions_initial_model_context_check",
+      sql`${table.initialModelContext} is null
+        or opengeni_private.model_context_value_valid(${table.initialModelContext})`,
+    ),
   }),
 );
 
@@ -2797,6 +4042,18 @@ export const organizationUserResourceGrants = pgTable(
       table.workspaceId,
       table.status,
     ),
+    activeIdentity: uniqueIndex("organization_user_resource_grants_active_identity_uq")
+      .on(
+        table.accountId,
+        table.authorityId,
+        table.workspaceId,
+        table.action,
+        table.mode,
+        table.context,
+        sql`coalesce(${table.sessionId}, '00000000-0000-0000-0000-000000000000'::uuid)`,
+        sql`coalesce(${table.authorityEpoch}, 0)`,
+      )
+      .where(sql`${table.status} = 'active'`),
     authority: foreignKey({
       name: "organization_user_resource_grants_authority_fk",
       columns: [table.authorityId, table.accountId],
@@ -2949,7 +4206,7 @@ export const sessionRealtimeModes = pgTable(
     ),
     endReasonValid: check(
       "session_realtime_modes_end_reason_check",
-      sql`${table.endReason} is null or ${table.endReason} in ('user_stop', 'browser_unload', 'lease_expired')`,
+      sql`${table.endReason} is null or ${table.endReason} in ('user_stop', 'browser_unload', 'lease_expired', 'authority_revoked')`,
     ),
     versionValid: check("session_realtime_modes_version_check", sql`${table.version} >= 1`),
     epochValid: check("session_realtime_modes_epoch_check", sql`${table.connectionEpoch} >= 1`),
@@ -3115,6 +4372,9 @@ export const sessionRealtimeEntries = pgTable(
     textCodecVersion: losslessCodecVersion("text_codec_version"),
     payload: losslessJsonb("payload").$type<Record<string, unknown>>().notNull().default({}),
     payloadCodecVersion: losslessCodecVersion("payload_codec_version"),
+    // Application context for an exact provider-in delegation or finalized
+    // transcript. It is materialized as ordinary user-role message content.
+    modelContext: text("model_context"),
     clientAckedAt: timestamp("client_acked_at", { withTimezone: true }),
     providerAckedAt: timestamp("provider_acked_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -3190,6 +4450,15 @@ export const sessionRealtimeEntries = pgTable(
         or (${table.kind} = 'assistant_transcript' and ${table.role} = 'assistant' and ${table.text} is not null)
         or (${table.kind} not in ('user_transcript', 'assistant_transcript') and ${table.role} is null)`,
     ),
+    modelContextValid: check(
+      "session_realtime_entries_model_context_check",
+      sql`${table.modelContext} is null
+        or (
+          ${table.direction} = 'provider_in'
+          and ${table.kind} in ('delegation_call', 'user_transcript', 'assistant_transcript')
+          and opengeni_private.model_context_value_valid(${table.modelContext})
+        )`,
+    ),
   }),
 );
 
@@ -3240,10 +4509,11 @@ export const sessionSpawnDenials = pgTable(
   }),
 );
 
-// Per-authenticated-subject session organization. This is deliberately a
-// relation instead of a session column: one member's pin must never reorder a
-// shared workspace for another member, and a session's own activity timestamps
-// must remain agent/runtime truth. `subjectId` is the trusted AccessGrant
+// Per-authenticated-subject session organization and follow-up state. This is
+// deliberately a relation instead of session columns: one member's pin,
+// acknowledgment, or actively-working label must never affect another member,
+// and a session's own activity timestamps must remain agent/runtime truth.
+// `subjectId` is the trusted AccessGrant
 // subject, which is text because configured/delegated principals are not always
 // UUIDs. The account/workspace pair carries the standard forced-RLS boundary.
 export const sessionPins = pgTable(
@@ -3267,13 +4537,38 @@ export const sessionPins = pgTable(
     pinned: boolean("pinned").notNull().default(true),
     pinnedAt: timestamp("pinned_at", { withTimezone: true }).defaultNow(),
     version: integer("version").notNull().default(1),
+    // A session is unread for this subject whenever its durable event sequence
+    // has advanced beyond this explicit acknowledgment fence. Merely opening a
+    // route never changes the fence.
+    acknowledgedSequence: integer("acknowledged_sequence").notNull().default(0),
+    activelyWorking: boolean("actively_working").notNull().default(false),
+    attentionVersion: integer("attention_version").notNull().default(0),
+    archived: boolean("archived").notNull().default(false),
+    archivedAt: timestamp("archived_at", { withTimezone: true }),
+    archiveVersion: integer("archive_version").notNull().default(0),
   },
   (table) => ({
     subjectNonempty: check(
       "session_pins_subject_nonempty",
       sql`length(btrim(${table.subjectId})) > 0`,
     ),
-    versionPositive: check("session_pins_version_positive", sql`${table.version} >= 1`),
+    versionNonnegative: check("session_pins_version_nonnegative", sql`${table.version} >= 0`),
+    acknowledgedSequenceFloor: check(
+      "session_pins_acknowledged_sequence_floor",
+      sql`${table.acknowledgedSequence} >= -1`,
+    ),
+    attentionVersionNonnegative: check(
+      "session_pins_attention_version_nonnegative",
+      sql`${table.attentionVersion} >= 0`,
+    ),
+    archiveVersionNonnegative: check(
+      "session_pins_archive_version_nonnegative",
+      sql`${table.archiveVersion} >= 0`,
+    ),
+    archiveStateConsistent: check(
+      "session_pins_archive_state_consistent",
+      sql`((${table.archived}) and (${table.archivedAt}) is not null) or ((not ${table.archived}) and (${table.archivedAt}) is null)`,
+    ),
     stateConsistent: check(
       "session_pins_state_consistent",
       sql`((${table.pinned}) and (${table.pinnedAt}) is not null) or ((not ${table.pinned}) and (${table.pinnedAt}) is null)`,
@@ -3300,15 +4595,22 @@ export const sessionPins = pgTable(
       table.pinnedAt.desc(),
       table.sessionId.desc(),
     ),
+    subjectArchived: index("session_pins_workspace_subject_archived_idx").on(
+      table.workspaceId,
+      table.subjectId,
+      table.archived,
+      table.archivedAt.desc(),
+      table.sessionId.desc(),
+    ),
   }),
 );
 
-// A short-lived server-owned continuation snapshot for the pin-aware session
-// list. The ordinary list is ordered by mutable activity, so a cursor cannot
-// safely replay that order from updated_at alone across HTTP requests. The
-// snapshot stores the already-ordered ordinary ids; the list query still joins
-// live session rows for current lifecycle/title data and expires snapshots
-// opportunistically.
+// Rolling-compatibility storage for pre-keyset session-list cursors. New page
+// one reads freeze the committed workspace activity revision in an opaque
+// updated_at/id keyset and create no row here. Old API replicas and cursors may
+// retain an already-ordered id array for its short TTL, so current replicas keep
+// reading, visibility-stripping, member-cleaning, and reaping those rows until
+// the compatibility table is retired by a later migration.
 export const sessionListSnapshots = pgTable(
   "session_list_snapshots",
   {
@@ -3318,6 +4620,7 @@ export const sessionListSnapshots = pgTable(
     subjectId: text("subject_id").notNull(),
     parentSessionFilter: text("parent_session_filter").notNull().default("all"),
     search: text("search"),
+    archiveMode: text("archive_mode").$type<"active" | "archived">().notNull().default("active"),
     ordinarySessionIds: uuid("ordinary_session_ids")
       .array()
       .notNull()
@@ -3343,6 +4646,10 @@ export const sessionListSnapshots = pgTable(
       "session_list_snapshots_search_length",
       sql`${table.search} is null or length(${table.search}) <= 200`,
     ),
+    archiveModeValid: check(
+      "session_list_snapshots_archive_mode_valid",
+      sql`${table.archiveMode} in ('active', 'archived')`,
+    ),
     workspaceExpiry: index("session_list_snapshots_workspace_expiry_idx").on(
       table.workspaceId,
       table.subjectId,
@@ -4216,6 +5523,12 @@ export const documents = pgTable(
     authorityKind: text("authority_kind").notNull().default("workspace"),
     authorityWorkspaceId: uuid("authority_workspace_id"),
     authoritySubjectId: text("authority_subject_id"),
+    // Activated personal documents follow their organization membership across
+    // workspaces. Legacy personal rows retain a null authority id and their
+    // original workspace anchor; originWorkspaceId is provenance only.
+    authorityId: uuid("authority_id"),
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
+    originWorkspaceId: uuid("origin_workspace_id").notNull(),
     // Per-document access controls. visibility 'private' restricts human reads to
     // created_by (a grant subject id, not a uuid); agent_access=false hides the
     // document from agent retrieval surfaces (docs MCP) while humans keep REST.
@@ -4274,16 +5587,29 @@ export const documents = pgTable(
       columns: [table.authorityWorkspaceId, table.accountId],
       foreignColumns: [workspaces.id, workspaces.accountId],
     }).onDelete("restrict"),
+    userAuthority: foreignKey({
+      name: "documents_user_authority_fk",
+      columns: [table.authorityId, table.accountId, table.ownerOrganizationMembershipId],
+      foreignColumns: [
+        organizationUserResourceAuthorities.id,
+        organizationUserResourceAuthorities.accountId,
+        organizationUserResourceAuthorities.organizationMembershipId,
+      ],
+    }).onDelete("restrict"),
     authorityState: check(
       "documents_authority_chk",
-      sql`(${table.authorityKind} = 'organization' and ${table.authorityWorkspaceId} is null and ${table.authoritySubjectId} is null)
-        or (${table.authorityKind} = 'workspace' and ${table.authorityWorkspaceId} = ${table.workspaceId} and ${table.authoritySubjectId} is null)
-        or (${table.authorityKind} = 'personal' and ${table.authorityWorkspaceId} = ${table.workspaceId} and nullif(btrim(${table.authoritySubjectId}), '') is not null and octet_length(convert_to(${table.authoritySubjectId}, 'UTF8')) <= 1024 and ${table.authoritySubjectId} = ${table.createdBy})`,
+      sql`(${table.authorityKind} = 'organization' and ${table.authorityWorkspaceId} is null and ${table.authoritySubjectId} is null and ${table.authorityId} is null and ${table.ownerOrganizationMembershipId} is null)
+        or (${table.authorityKind} = 'workspace' and ${table.authorityWorkspaceId} = ${table.workspaceId} and ${table.authoritySubjectId} is null and ${table.authorityId} is null and ${table.ownerOrganizationMembershipId} is null)
+        or (${table.authorityKind} = 'personal' and nullif(btrim(${table.authoritySubjectId}), '') is not null and octet_length(convert_to(${table.authoritySubjectId}, 'UTF8')) <= 1024 and ${table.authoritySubjectId} = ${table.createdBy} and ((${table.authorityWorkspaceId} = ${table.workspaceId} and ${table.authorityId} is null and ${table.ownerOrganizationMembershipId} is null) or (${table.authorityWorkspaceId} is null and ${table.authorityId} is not null and ${table.ownerOrganizationMembershipId} is not null)))`,
     ),
     authorityVisibility: check(
       "documents_authority_visibility_chk",
       sql`(${table.authorityKind} = 'personal') = (${table.visibility} = 'private')`,
     ),
+    originWorkspace: check(
+      "documents_origin_workspace_chk",
+      sql`${table.originWorkspaceId} = ${table.workspaceId}`,
+    ),
     visibilityState: check(
       "documents_visibility_chk",
       sql`${table.visibility} in ('workspace', 'private')`,
@@ -4338,6 +5664,8 @@ export const documentChunks = pgTable(
     authorityKind: text("authority_kind").notNull().default("workspace"),
     authorityWorkspaceId: uuid("authority_workspace_id"),
     authoritySubjectId: text("authority_subject_id"),
+    authorityId: uuid("authority_id"),
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
     embedding: vector("embedding").notNull(),
     embeddingModel: text("embedding_model").notNull(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -4360,11 +5688,20 @@ export const documentChunks = pgTable(
       columns: [table.authorityWorkspaceId, table.accountId],
       foreignColumns: [workspaces.id, workspaces.accountId],
     }).onDelete("restrict"),
+    userAuthority: foreignKey({
+      name: "document_chunks_user_authority_fk",
+      columns: [table.authorityId, table.accountId, table.ownerOrganizationMembershipId],
+      foreignColumns: [
+        organizationUserResourceAuthorities.id,
+        organizationUserResourceAuthorities.accountId,
+        organizationUserResourceAuthorities.organizationMembershipId,
+      ],
+    }).onDelete("restrict"),
     authorityState: check(
       "document_chunks_authority_chk",
-      sql`(${table.authorityKind} = 'organization' and ${table.authorityWorkspaceId} is null and ${table.authoritySubjectId} is null)
-        or (${table.authorityKind} = 'workspace' and ${table.authorityWorkspaceId} = ${table.workspaceId} and ${table.authoritySubjectId} is null)
-        or (${table.authorityKind} = 'personal' and ${table.authorityWorkspaceId} = ${table.workspaceId} and nullif(btrim(${table.authoritySubjectId}), '') is not null and octet_length(convert_to(${table.authoritySubjectId}, 'UTF8')) <= 1024)`,
+      sql`(${table.authorityKind} = 'organization' and ${table.authorityWorkspaceId} is null and ${table.authoritySubjectId} is null and ${table.authorityId} is null and ${table.ownerOrganizationMembershipId} is null)
+        or (${table.authorityKind} = 'workspace' and ${table.authorityWorkspaceId} = ${table.workspaceId} and ${table.authoritySubjectId} is null and ${table.authorityId} is null and ${table.ownerOrganizationMembershipId} is null)
+        or (${table.authorityKind} = 'personal' and nullif(btrim(${table.authoritySubjectId}), '') is not null and octet_length(convert_to(${table.authoritySubjectId}, 'UTF8')) <= 1024 and ((${table.authorityWorkspaceId} = ${table.workspaceId} and ${table.authorityId} is null and ${table.ownerOrganizationMembershipId} is null) or (${table.authorityWorkspaceId} is null and ${table.authorityId} is not null and ${table.ownerOrganizationMembershipId} is not null)))`,
     ),
   }),
 );
@@ -4493,13 +5830,20 @@ export const sessionTurns = pgTable(
     temporalWorkflowId: text("temporal_workflow_id").notNull(),
     status: text("status").notNull(),
     source: text("source").notNull().default("user"),
+    // Immutable user-facing admission intent. Physical execution still uses
+    // status=queued until a worker claims the row; this field keeps that
+    // implementation queue distinct from prompts genuinely waiting behind
+    // other work. Null is reserved for rolling/legacy writers and non-human
+    // turns, and is projected conservatively as visible queue work.
+    promptRouting: text("prompt_routing"),
     position: bigint("position", { mode: "number" }).notNull(),
     prompt: losslessText("prompt").notNull(),
     promptCodecVersion: losslessCodecVersion("prompt_codec_version"),
     annotations: jsonb("annotations").$type<TimelineAnnotation[]>().notNull().default([]),
-    // Host context for this exact turn. System-level at runtime and deliberately
-    // separate from the visible prompt/event payload.
-    turnInstructions: text("turn_instructions"),
+    // Application context for this exact user message. It is copied into the
+    // canonical user-role history item at claim and omitted from public queue
+    // projections; full event/audit data retains it.
+    modelContext: text("model_context"),
     resources: jsonb("resources").$type<unknown[]>().notNull().default([]),
     tools: jsonb("tools").$type<unknown[]>().notNull().default([]),
     // false = inherit the durable session policy; true = this turn explicitly
@@ -4546,15 +5890,28 @@ export const sessionTurns = pgTable(
       .$type<McpPersonalConnectionDelegation[]>()
       .notNull()
       .default([]),
+    // Credential-free public summary of a turn-bound personal Variable
+    // Set/Rig attachment. Exact resource and grant identity lives only in the
+    // immutable accepted-work snapshot tables.
+    personalResourceAttachmentSummary: jsonb(
+      "personal_resource_attachment_summary",
+    ).$type<PersonalResourceAttachmentSummary>(),
+    // 0 = legacy attempt-selected authority; 1 = immutable logical-turn
+    // snapshots. Drained migration 0306 makes every new atomic attachment v1.
+    personalResourceProtocolVersion: integer("personal_resource_protocol_version")
+      .notNull()
+      .default(0),
+    // Immutable scheduled occurrence that accepted this logical turn. Null for
+    // ordinary human, goal, child, and unrelated internal work.
+    scheduledTaskRunId: uuid("scheduled_task_run_id"),
     xaiProviderAccountAuthoritySnapshot: jsonb("xai_provider_account_authority_snapshot")
       .$type<XaiProviderAccountAuthoritySnapshotV1>()
       .notNull()
       .default(WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1),
     cancelledBy: text("cancelled_by"),
     cancelReason: text("cancel_reason"),
-    // Atomic per-turn codemode call budget counter (migration 0043). Incremented
-    // by a single conditional UPDATE at tools/call time; the row lock serializes
-    // concurrent reservations so exactly `codemodeMaxCallsPerTurn` succeed.
+    // Leftover unused counter from the removed per-turn Codemode call cap
+    // (migrations 0043/0205). New writers do not increment it; do not enforce.
     codemodeCallCount: integer("codemode_call_count").notNull().default(0),
     startedAt: timestamp("started_at", { withTimezone: true }),
     finishedAt: timestamp("finished_at", { withTimezone: true }),
@@ -4575,10 +5932,162 @@ export const sessionTurns = pgTable(
     oneCurrentInference: uniqueIndex("session_turns_one_current_inference_uq")
       .on(table.workspaceId, table.sessionId)
       .where(sql`${table.status} in ('running','requires_action','recovering','waiting_capacity')`),
+    // Agent-monitoring "was this prompt's turn ever claimed" probe
+    // (`excludeUnclaimedHumanPromptEventFilter`), migration 0322.
+    unclaimedPromptTrigger: index("session_turns_unclaimed_prompt_trigger_idx")
+      .on(table.workspaceId, table.sessionId, table.triggerEventId)
+      .where(sql`${table.startedAt} is null`),
     latencyModeValid: check(
       "session_turns_latency_mode_check",
       sql`${table.latencyMode} in ('standard', 'priority', 'fast')`,
     ),
+    modelContextValid: check(
+      "session_turns_model_context_check",
+      sql`${table.modelContext} is null
+        or opengeni_private.model_context_value_valid(${table.modelContext})`,
+    ),
+  }),
+);
+
+/** Immutable logical-turn receipt for atomic personal-resource issuance. */
+export const turnPersonalResourceAttachmentReceipts = pgTable(
+  "turn_personal_resource_attachment_receipts",
+  {
+    turnId: uuid("turn_id")
+      .primaryKey()
+      .references(() => sessionTurns.id, { onDelete: "cascade" }),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    sessionId: uuid("session_id").notNull(),
+    initiatingHumanSubjectId: text("initiating_human_subject_id").notNull(),
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id").notNull(),
+    membershipAuthorizationRevision: bigint("membership_authorization_revision", {
+      mode: "number",
+    }).notNull(),
+    sessionVisibility: text("session_visibility").notNull(),
+    sessionAuthorityEpoch: integer("session_authority_epoch").notNull(),
+    grantMode: text("grant_mode").notNull(),
+    sharedOutputWarningVersion: integer("shared_output_warning_version").notNull(),
+    sharedOutputAcknowledged: boolean("shared_output_acknowledged").notNull(),
+    requestDigest: bytea("request_digest").notNull(),
+    resourceCount: integer("resource_count").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceTurn: foreignKey({
+      name: "turn_personal_resource_attachment_receipts_workspace_turn_fk",
+      columns: [table.workspaceId, table.turnId],
+      foreignColumns: [sessionTurns.workspaceId, sessionTurns.id],
+    }).onDelete("cascade"),
+    identity: check(
+      "turn_personal_resource_attachment_receipts_identity_chk",
+      sql`${table.sessionAuthorityEpoch} > 0
+        and octet_length(${table.initiatingHumanSubjectId}) between 1 and 512
+        and ${table.membershipAuthorizationRevision} > 0
+        and ${table.resourceCount} between 1 and 28
+        and ${table.grantMode} in ('once', 'session', 'always')
+        and ${table.sessionVisibility} in ('user_private', 'workspace_shared')
+        and ${table.sharedOutputWarningVersion} = 1
+        and (${table.sessionVisibility} <> 'workspace_shared'
+          or ${table.sharedOutputAcknowledged})`,
+    ),
+  }),
+);
+
+/** Exact resource/grant authority frozen on one accepted logical turn. */
+export const turnPersonalResourceSnapshots = pgTable(
+  "turn_personal_resource_snapshots",
+  {
+    turnId: uuid("turn_id").notNull(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    sessionId: uuid("session_id").notNull(),
+    resourceKind: text("resource_kind").notNull(),
+    resourceId: uuid("resource_id").notNull(),
+    resourceVersionId: uuid("resource_version_id"),
+    selectionSources: text("selection_sources").array().notNull(),
+    action: text("action").notNull(),
+    originWorkspaceId: uuid("origin_workspace_id").notNull(),
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id").notNull(),
+    membershipAuthorizationRevision: bigint("membership_authorization_revision", {
+      mode: "number",
+    }).notNull(),
+    authorityId: uuid("authority_id").notNull(),
+    authorityGeneration: bigint("authority_generation", { mode: "number" }).notNull(),
+    grantId: uuid("grant_id").notNull(),
+    grantGeneration: bigint("grant_generation", { mode: "number" }).notNull(),
+    grantMode: text("grant_mode").notNull(),
+    grantContext: text("grant_context").notNull(),
+    grantSessionId: uuid("grant_session_id"),
+    grantAuthorityEpoch: integer("grant_authority_epoch"),
+    canonicalDelegation: jsonb("canonical_delegation").$type<UserResourceDelegation>().notNull(),
+    snapshotDigest: bytea("snapshot_digest").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    pk: primaryKey({ columns: [table.turnId, table.resourceKind, table.resourceId] }),
+    receipt: foreignKey({
+      name: "turn_personal_resource_snapshots_receipt_fk",
+      columns: [table.turnId],
+      foreignColumns: [turnPersonalResourceAttachmentReceipts.turnId],
+    }).onDelete("cascade"),
+    authority: index("turn_personal_resource_snapshots_authority_idx").on(table.authorityId),
+    grant: index("turn_personal_resource_snapshots_grant_idx").on(table.grantId),
+    kind: check(
+      "turn_personal_resource_snapshots_kind_chk",
+      sql`(${table.resourceKind} = 'variable_set'
+          and ${table.action} = 'variable_set.use'
+          and ${table.resourceVersionId} is null)
+        or (${table.resourceKind} = 'rig'
+          and ${table.action} = 'rig.use'
+          and ${table.resourceVersionId} is not null)
+        or (${table.resourceKind} = 'connected_machine'
+          and ${table.action} = 'connected_machine.use'
+          and ${table.resourceVersionId} is null)`,
+    ),
+    generations: check(
+      "turn_personal_resource_snapshots_generation_chk",
+      sql`${table.membershipAuthorizationRevision} > 0
+        and ${table.authorityGeneration} > 0
+        and ${table.grantGeneration} > 0
+        and cardinality(${table.selectionSources}) between 1 and 26`,
+    ),
+    grantShape: check(
+      "turn_personal_resource_snapshots_grant_chk",
+      sql`${table.grantMode} in ('once', 'session', 'always')
+        and ${table.grantContext} in ('user_private', 'workspace_shared')
+        and ((${table.grantMode} = 'always'
+            and ${table.grantSessionId} is null
+            and ${table.grantAuthorityEpoch} is null)
+          or (${table.grantMode} in ('once', 'session')
+            and ${table.grantSessionId} = ${table.sessionId}
+            and ${table.grantAuthorityEpoch} > 0))`,
+    ),
+  }),
+);
+
+/** One once grant may belong to one accepted logical turn only. */
+export const turnPersonalResourceOnceReceipts = pgTable(
+  "turn_personal_resource_once_receipts",
+  {
+    grantId: uuid("grant_id").primaryKey(),
+    turnId: uuid("turn_id").notNull(),
+    accountId: uuid("account_id").notNull(),
+    authorityId: uuid("authority_id").notNull(),
+    authorityGeneration: bigint("authority_generation", { mode: "number" }).notNull(),
+    grantGeneration: bigint("grant_generation", { mode: "number" }).notNull(),
+    consumedAt: timestamp("consumed_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    receipt: foreignKey({
+      name: "turn_personal_resource_once_receipts_turn_fk",
+      columns: [table.turnId],
+      foreignColumns: [turnPersonalResourceAttachmentReceipts.turnId],
+    }).onDelete("cascade"),
+    generations: check(
+      "turn_personal_resource_once_receipts_generation_chk",
+      sql`${table.authorityGeneration} > 0 and ${table.grantGeneration} > 0`,
+    ),
   }),
 );
 
@@ -4670,6 +6179,9 @@ export const sessionTurnAttempts = pgTable(
     authorityEpoch: integer("authority_epoch").notNull(),
     authorityVisibility: text("authority_visibility").notNull(),
     authorityOwnerOrganizationMembershipId: uuid("authority_owner_organization_membership_id"),
+    personalResourceProtocolVersion: integer("personal_resource_protocol_version")
+      .notNull()
+      .default(0),
     // Immutable policy snapshot captured under the session lock at claim.
     mcpApprovalPolicies: jsonb("mcp_approval_policies")
       .$type<Record<string, SessionMcpApprovalPolicy>>()
@@ -4698,7 +6210,7 @@ export const sessionTurnAttempts = pgTable(
       name: "session_turn_attempts_workspace_session_fk",
       columns: [table.workspaceId, table.sessionId],
       foreignColumns: [sessions.workspaceId, sessions.id],
-    }).onDelete("restrict"),
+    }).onDelete("cascade"),
     workspaceTurn: foreignKey({
       name: "session_turn_attempts_workspace_turn_fk",
       columns: [table.workspaceId, table.turnId],
@@ -4782,6 +6294,202 @@ export const sessionTurnAttempts = pgTable(
   }),
 );
 
+// Per-turn startup SLO checkpoint ledger (migration 0318). One row per
+// (turn, milestone, outcome); the transaction whose
+// `insert ... on conflict do nothing returning` returns the row is the
+// canonical inserter and the sole metric receipt, so recovery and replay
+// conflict without re-reading the turn's session_events. `pre_ledger_history`
+// rows seal a turn whose startup predates the ledger.
+export const sessionTurnStartupMilestones = pgTable(
+  "session_turn_startup_milestones",
+  {
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    sessionId: uuid("session_id").notNull(),
+    turnId: uuid("turn_id").notNull(),
+    milestone: text("milestone").notNull(),
+    outcome: text("outcome").notNull(),
+    canonicalSource: text("canonical_source").notNull(),
+    eventId: uuid("event_id"),
+    occurredAt: timestamp("occurred_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    pk: primaryKey({
+      name: "session_turn_startup_milestones_pkey",
+      columns: [table.workspaceId, table.turnId, table.milestone, table.outcome],
+    }),
+    workspaceAccount: foreignKey({
+      name: "session_turn_startup_milestones_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    workspaceSession: foreignKey({
+      name: "session_turn_startup_milestones_workspace_session_fk",
+      columns: [table.workspaceId, table.sessionId],
+      foreignColumns: [sessions.workspaceId, sessions.id],
+    }).onDelete("cascade"),
+    workspaceTurn: foreignKey({
+      name: "session_turn_startup_milestones_workspace_turn_fk",
+      columns: [table.workspaceId, table.turnId],
+      foreignColumns: [sessionTurns.workspaceId, sessionTurns.id],
+    }).onDelete("cascade"),
+    workspaceSessionIndex: index("session_turn_startup_milestones_workspace_session_idx").on(
+      table.workspaceId,
+      table.sessionId,
+    ),
+    milestoneCheck: check(
+      "session_turn_startup_milestones_milestone_chk",
+      sql`${table.milestone} in ('queue', 'provider_dispatch', 'first_byte')`,
+    ),
+    outcomeCheck: check(
+      "session_turn_startup_milestones_outcome_chk",
+      sql`${table.outcome} in ('completed', 'failed')`,
+    ),
+    checkpointCheck: check(
+      "session_turn_startup_milestones_checkpoint_chk",
+      sql`${table.outcome} = 'completed' or ${table.milestone} = 'first_byte'`,
+    ),
+    canonicalSourceCheck: check(
+      "session_turn_startup_milestones_canonical_source_chk",
+      sql`(${table.canonicalSource} = 'inserted_event' and ${table.eventId} is not null and ${table.occurredAt} is not null) or (${table.canonicalSource} = 'pre_ledger_history' and ${table.outcome} = 'completed' and ${table.eventId} is null and ${table.occurredAt} is null)`,
+    ),
+  }),
+);
+
+// Credential-free authority captured with the accepted logical turn. Runtime
+// credential resolution loads this canonical row by exact turn + tool surface;
+// a caller-provided snapshot is never authority.
+export const turnConnectionAuthoritySnapshots = pgTable(
+  "turn_connection_authority_snapshots",
+  {
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    sessionId: uuid("session_id").notNull(),
+    turnId: uuid("turn_id").notNull(),
+    serverId: text("server_id").notNull(),
+    connectionId: uuid("connection_id").notNull(),
+    connectionGeneration: bigint("connection_generation", { mode: "number" }).notNull(),
+    originWorkspaceId: uuid("origin_workspace_id").notNull(),
+    providerDomain: text("provider_domain").notNull(),
+    connectionKind: text("connection_kind").notNull(),
+    authorityScope: text("authority_scope").notNull(),
+    authoritySource: text("authority_source").notNull(),
+    ownerSubjectId: text("owner_subject_id"),
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
+    membershipAuthorizationRevision: bigint("membership_authorization_revision", {
+      mode: "number",
+    }),
+    authorityId: uuid("authority_id"),
+    authorityGeneration: bigint("authority_generation", { mode: "number" }),
+    grantId: uuid("grant_id"),
+    grantGeneration: bigint("grant_generation", { mode: "number" }),
+    grantMode: text("grant_mode"),
+    grantContext: text("grant_context"),
+    grantSessionId: uuid("grant_session_id"),
+    grantAuthorityEpoch: integer("grant_authority_epoch"),
+    sessionVisibility: text("session_visibility").notNull(),
+    sessionAuthorityEpoch: integer("session_authority_epoch").notNull(),
+    canonicalSnapshot: jsonb("canonical_snapshot").$type<Record<string, unknown>>().notNull(),
+    snapshotDigest: bytea("snapshot_digest").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    identity: primaryKey({ columns: [table.turnId, table.serverId] }),
+    turn: foreignKey({
+      name: "turn_connection_authority_turn_fk",
+      columns: [table.workspaceId, table.turnId],
+      foreignColumns: [sessionTurns.workspaceId, sessionTurns.id],
+    }).onDelete("cascade"),
+    connection: foreignKey({
+      name: "turn_connection_authority_connection_fk",
+      columns: [table.connectionId],
+      foreignColumns: [connections.id],
+    }).onDelete("restrict"),
+    membership: foreignKey({
+      name: "turn_connection_authority_membership_fk",
+      columns: [table.ownerOrganizationMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    authority: foreignKey({
+      name: "turn_connection_authority_authority_fk",
+      columns: [table.authorityId, table.accountId],
+      foreignColumns: [
+        organizationUserResourceAuthorities.id,
+        organizationUserResourceAuthorities.accountId,
+      ],
+    }).onDelete("restrict"),
+    grant: foreignKey({
+      name: "turn_connection_authority_grant_fk",
+      columns: [table.grantId, table.accountId],
+      foreignColumns: [organizationUserResourceGrants.id, organizationUserResourceGrants.accountId],
+    }).onDelete("restrict"),
+    connectionLookup: index("turn_connection_authority_connection_idx").on(
+      table.accountId,
+      table.connectionId,
+      table.turnId,
+      table.serverId,
+    ),
+    serverValid: check(
+      "turn_connection_authority_server_check",
+      sql`octet_length(${table.serverId}) between 1 and 256`,
+    ),
+    generationValid: check(
+      "turn_connection_authority_generation_check",
+      sql`${table.connectionGeneration} > 0 and ${table.sessionAuthorityEpoch} > 0`,
+    ),
+  }),
+);
+
+// One metadata-only authorization fact per caller-preallocated physical
+// provider request. No credential, header, body, provider response, or content
+// is retained in this table.
+export const connectionUseAuditFacts = pgTable(
+  "connection_use_audit_facts",
+  {
+    physicalRequestId: uuid("physical_request_id").primaryKey(),
+    usePhase: text("use_phase").notNull(),
+    requestDigest: bytea("request_digest").notNull(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    sessionId: uuid("session_id").notNull(),
+    turnId: uuid("turn_id").notNull(),
+    attemptId: uuid("attempt_id").notNull(),
+    executionGeneration: integer("execution_generation").notNull(),
+    serverId: text("server_id").notNull(),
+    connectionId: uuid("connection_id"),
+    connectionGeneration: bigint("connection_generation", { mode: "number" }),
+    authorityScope: text("authority_scope"),
+    ownerSubjectId: text("owner_subject_id"),
+    authorityId: uuid("authority_id"),
+    grantId: uuid("grant_id"),
+    initiatorKind: text("initiator_kind"),
+    initiatorSubjectId: text("initiator_subject_id"),
+    initiatingHumanSubjectId: text("initiating_human_subject_id"),
+    authorityEpoch: integer("authority_epoch"),
+    authorityVisibility: text("authority_visibility"),
+    authorityOwnerOrganizationMembershipId: uuid("authority_owner_organization_membership_id"),
+    outcome: text("outcome").notNull(),
+    denialReason: text("denial_reason"),
+    occurredAt: timestamp("occurred_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    attempt: index("connection_use_audit_attempt_idx").on(
+      table.workspaceId,
+      table.attemptId,
+      table.occurredAt,
+    ),
+    shapeValid: check(
+      "connection_use_audit_shape_check",
+      sql`octet_length(${table.serverId}) between 1 and 256
+        and octet_length(${table.requestDigest}) = 32
+        and ${table.executionGeneration} > 0
+        and ${table.usePhase} in ('credential_resolution', 'provider_request')
+        and ${table.outcome} in ('authorized', 'denied')`,
+    ),
+  }),
+);
+
 // Immutable executable tool universe admitted to one exact attempt. Model MCP
 // and sandbox Codemode use the same digest and opaque identities from this row.
 export const sessionAttemptToolCatalogs = pgTable(
@@ -5185,7 +6893,7 @@ export const sessionCommandReceipts = pgTable(
       name: "session_command_receipts_target_session_fk",
       columns: [table.workspaceId, table.targetSessionId],
       foreignColumns: [sessions.workspaceId, sessions.id],
-    }).onDelete("restrict"),
+    }).onDelete("cascade"),
     targetTurn: foreignKey({
       name: "session_command_receipts_target_turn_fk",
       columns: [table.workspaceId, table.targetTurnId],
@@ -5251,7 +6959,7 @@ export const workspaceControlEvents = pgTable(
       name: "workspace_control_events_root_session_fk",
       columns: [table.workspaceId, table.rootSessionId],
       foreignColumns: [sessions.workspaceId, sessions.id],
-    }).onDelete("restrict"),
+    }).onDelete("cascade"),
     workspaceRevision: uniqueIndex("workspace_control_events_workspace_revision_uq").on(
       table.workspaceId,
       table.revision,
@@ -5299,7 +7007,7 @@ export const sessionAttemptInterruptions = pgTable(
       name: "session_attempt_interruptions_workspace_session_fk",
       columns: [table.workspaceId, table.sessionId],
       foreignColumns: [sessions.workspaceId, sessions.id],
-    }).onDelete("restrict"),
+    }).onDelete("cascade"),
     operation: foreignKey({
       name: "session_attempt_interruptions_operation_fk",
       columns: [table.workspaceId, table.operationId],
@@ -5319,7 +7027,7 @@ export const sessionAttemptInterruptions = pgTable(
       .where(sql`${table.state} in ('pending', 'delivered', 'acknowledged')`),
     kindValid: check(
       "session_attempt_interruptions_kind_check",
-      sql`${table.kind} in ('session_pause', 'workspace_pause', 'steer', 'maintenance')`,
+      sql`${table.kind} in ('session_pause', 'workspace_pause', 'steer', 'maintenance', 'authority_change', 'organization_membership_revoked')`,
     ),
     stateValid: check(
       "session_attempt_interruptions_state_check",
@@ -5459,6 +7167,9 @@ export const sessionSystemUpdates = pgTable(
       .$type<XaiProviderAccountAuthoritySnapshotV1>()
       .notNull()
       .default(WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1),
+    // Private scheduled-occurrence authority linkage. Public update/event
+    // projections intentionally omit this producer identifier.
+    scheduledTaskRunId: uuid("scheduled_task_run_id"),
     // pending is visible queue truth; delivered means its exact model-memory
     // batch was durably claimed. Terminal cancellation/supersession is explicit.
     state: text("state").notNull().default("pending"),
@@ -5474,7 +7185,7 @@ export const sessionSystemUpdates = pgTable(
   (table) => ({
     kindValid: check(
       "system_updates_kind_check",
-      sql`${table.kind} in ('scheduled_occurrence', 'goal_continuation', 'agent_message', 'agent_steer_instruction', 'child_terminal_result', 'media_generation_result')`,
+      sql`${table.kind} in ('scheduled_occurrence', 'goal_continuation', 'agent_message', 'agent_steer_instruction', 'child_terminal_result', 'media_generation_result', 'child_requires_action', 'child_requires_action_resolved', 'child_paused', 'child_waiting_capacity', 'child_progress')`,
     ),
     payloadKindValid: check(
       "system_updates_payload_kind_check",
@@ -5495,6 +7206,11 @@ export const sessionSystemUpdates = pgTable(
       table.state,
       table.createdAt,
     ),
+    // Producer-side supersession / resolution of one child's pending notices
+    // of one kind on the parent (migration 0325).
+    pendingKindSource: index("session_system_updates_pending_kind_source_idx")
+      .on(table.workspaceId, table.sessionId, table.kind, table.sourceId)
+      .where(sql`${table.state} = 'pending'`),
     onePendingSteer: uniqueIndex("session_system_updates_one_pending_steer_idx")
       .on(table.workspaceId, table.sessionId)
       .where(sql`${table.kind} = 'agent_steer_instruction' and ${table.state} = 'pending'`),
@@ -5561,11 +7277,11 @@ export const sessionSystemUpdateOutbox = pgTable(
   (table) => ({
     kindValid: check(
       "system_update_outbox_kind_check",
-      sql`${table.kind} = 'child_terminal_result'`,
+      sql`${table.kind} in ('child_terminal_result', 'child_requires_action', 'child_requires_action_resolved', 'child_paused', 'child_waiting_capacity', 'child_progress')`,
     ),
     payloadKindValid: check(
       "system_update_outbox_payload_kind_check",
-      sql`${table.payload} ->> 'type' = 'child_terminal_result'`,
+      sql`${table.payload} ->> 'type' = ${table.kind}`,
     ),
     dedupe: uniqueIndex("session_system_update_outbox_dedupe_uq").on(
       table.workspaceId,
@@ -5647,6 +7363,7 @@ export const sessionGoals = pgTable(
     status: text("status").notNull().default("active"), // active | paused | completed
     text: text("text").notNull(),
     successCriteria: text("success_criteria"),
+    rootConstraints: jsonb("root_constraints").$type<string[]>().notNull().default([]),
     evidence: text("evidence"), // set by goal_complete
     rationale: text("rationale"), // set by goal_pause
     pausedReason: text("paused_reason"), // agent | user_pause | api | no_progress | max_auto_continuations | limits
@@ -5680,6 +7397,15 @@ export const sessionGoals = pgTable(
     })
       .notNull()
       .default(0),
+    // Agent-declared continuation hold (`goal_wait`, migration 0317). Honored
+    // only while `continuationHoldTurnId` is still the latest finished turn and
+    // the deadline has not passed; it never consumes the wake/observed ledger.
+    // Any newer finished turn, a passed deadline, or a goal mutation clears all
+    // four columns together.
+    continuationHoldTurnId: uuid("continuation_hold_turn_id"),
+    continuationHoldUntil: timestamp("continuation_hold_until", { withTimezone: true }),
+    continuationHoldReason: text("continuation_hold_reason"),
+    continuationHoldSetAt: timestamp("continuation_hold_set_at", { withTimezone: true }),
     metadata: jsonb("metadata").$type<Record<string, unknown>>().notNull().default({}),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
@@ -5698,6 +7424,10 @@ export const sessionGoals = pgTable(
       "session_goals_continuation_revision_check",
       sql`${table.continuationWakeRevision} >= 0 and ${table.continuationObservedRevision} >= 0 and ${table.continuationObservedRevision} <= ${table.continuationWakeRevision} and ${table.continuationWakeRevision} <= 9007199254740991 and ${table.continuationObservedRevision} <= 9007199254740991`,
     ),
+    continuationHoldValid: check(
+      "session_goals_continuation_hold_check",
+      sql`(${table.continuationHoldTurnId} is null and ${table.continuationHoldUntil} is null and ${table.continuationHoldReason} is null and ${table.continuationHoldSetAt} is null) or (${table.continuationHoldTurnId} is not null and ${table.continuationHoldUntil} is not null and ${table.continuationHoldSetAt} is not null and (${table.continuationHoldReason} is null or octet_length(${table.continuationHoldReason}) <= 2048))`,
+    ),
   }),
 );
 
@@ -5720,12 +7450,14 @@ export const sessionGoalRevisions = pgTable(
     resultObjectiveRevision: integer("result_objective_revision"),
     text: text("text").notNull(),
     successCriteria: text("success_criteria"),
+    rootConstraints: jsonb("root_constraints").$type<string[]>().notNull().default([]),
     mutationPolicy: text("mutation_policy").$type<SessionGoalMutationPolicy>().notNull(),
     rationale: text("rationale").notNull(),
     actor: text("actor").$type<"agent" | "api" | "scheduled_task">().notNull(),
     actorTurnId: uuid("actor_turn_id"),
     actorAttemptId: uuid("actor_attempt_id"),
     proposalId: uuid("proposal_id"),
+    rollbackOfRevisionId: uuid("rollback_of_revision_id"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
@@ -5754,6 +7486,11 @@ export const sessionGoalRevisions = pgTable(
       columns: [table.workspaceId, table.proposalId],
       foreignColumns: [table.workspaceId, table.id],
     }).onDelete("restrict"),
+    rollbackOfRevision: foreignKey({
+      name: "session_goal_revisions_rollback_of_revision_fk",
+      columns: [table.workspaceId, table.rollbackOfRevisionId],
+      foreignColumns: [table.workspaceId, table.id],
+    }).onDelete("restrict"),
     appliedRevision: uniqueIndex("session_goal_revisions_applied_revision_uq")
       .on(table.workspaceId, table.goalId, table.resultObjectiveRevision)
       .where(sql`${table.disposition} = 'applied'`),
@@ -5763,6 +7500,14 @@ export const sessionGoalRevisions = pgTable(
       table.createdAt,
       table.id,
     ),
+    proposalDecision: uniqueIndex("session_goal_revisions_proposal_decision_uq")
+      .on(table.workspaceId, table.proposalId)
+      .where(
+        sql`${table.proposalId} is not null and ${table.disposition} in ('applied', 'rejected')`,
+      ),
+    rollbackRequest: uniqueIndex("session_goal_revisions_rollback_request_uq")
+      .on(table.workspaceId, table.goalId, table.rollbackOfRevisionId, table.baseObjectiveRevision)
+      .where(sql`${table.disposition} = 'applied' and ${table.rollbackOfRevisionId} is not null`),
     dispositionValid: check(
       "session_goal_revisions_disposition_chk",
       sql`${table.disposition} in ('applied', 'proposed', 'rejected')`,
@@ -5780,6 +7525,12 @@ export const sessionGoalRevisions = pgTable(
       sql`(${table.disposition} = 'applied' and ${table.resultObjectiveRevision} = ${table.baseObjectiveRevision} + 1)
         or (${table.disposition} in ('proposed', 'rejected') and ${table.resultObjectiveRevision} is null)`,
     ),
+    lineageShape: check(
+      "session_goal_revisions_lineage_shape_chk",
+      sql`(${table.disposition} = 'proposed' and ${table.proposalId} is null and ${table.rollbackOfRevisionId} is null)
+        or (${table.disposition} = 'rejected' and ${table.proposalId} is not null and ${table.rollbackOfRevisionId} is null)
+        or (${table.disposition} = 'applied' and not (${table.proposalId} is not null and ${table.rollbackOfRevisionId} is not null))`,
+    ),
   }),
 );
 
@@ -6256,6 +8007,12 @@ export const sessionPendingToolCalls = pgTable(
     callType: text("call_type").notNull(),
     callItem: losslessJsonb("call_item").$type<Record<string, unknown>>().notNull(),
     callItemCodecVersion: losslessCodecVersion("call_item_codec_version"),
+    interruptionKind: text("interruption_kind"),
+    tiedReasoningItems: losslessJsonb("tied_reasoning_items")
+      .$type<Array<Record<string, unknown>>>()
+      .notNull()
+      .default([]),
+    tiedReasoningItemsCodecVersion: losslessCodecVersion("tied_reasoning_items_codec_version"),
     modelToolOutputTruncationTokens: integer("model_tool_output_truncation_tokens"),
     resultItem: losslessJsonb("result_item").$type<Record<string, unknown>>(),
     resultItemCodecVersion: losslessCodecVersion("result_item_codec_version"),
@@ -6280,6 +8037,14 @@ export const sessionPendingToolCalls = pgTable(
       table.sessionId,
       table.turnId,
     ),
+    interruptionKindValid: check(
+      "session_pending_tool_calls_interruption_kind_chk",
+      sql`${table.interruptionKind} is null or ${table.interruptionKind} in ('human_input', 'approval', 'interaction_intervention')`,
+    ),
+    tiedReasoningItemsArray: check(
+      "session_pending_tool_calls_tied_reasoning_items_chk",
+      sql`jsonb_typeof(${table.tiedReasoningItems}) = 'array'`,
+    ),
   }),
 );
 
@@ -6718,6 +8483,11 @@ export const sandboxLeaseHolders = pgTable(
     holderId: text("holder_id").notNull(),
     // The attributing session within the (possibly shared) group.
     subjectId: uuid("subject_id"),
+    // Viewer holders only (0281): the authenticated viewer subject and the
+    // session authority epoch observed at attach - identities and epochs
+    // only, mirrored into the scoped stream token's claims.
+    viewerSubjectId: text("viewer_subject_id"),
+    viewerAuthorityEpoch: integer("viewer_authority_epoch"),
     lastHeartbeatAt: timestamp("last_heartbeat_at", { withTimezone: true }).notNull().defaultNow(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   },
@@ -6739,6 +8509,14 @@ export const sandboxLeaseHolders = pgTable(
 
 export const sandboxWorkspaceMutationActorKindValues = ["turn", "direct", "process"] as const;
 export const sandboxWorkspaceMutationHolderKindValues = ["turn", "direct", "process"] as const;
+// The causal principal behind an admitted workspace writer. `subject`/`service`
+// are the canonical `session_turns` initiator vocabulary; `legacy_unattributed`
+// exists only for rows written before migration 0277 recorded any authority.
+export const sandboxWorkspaceMutationInitiatorKindValues = [
+  "subject",
+  "service",
+  "legacy_unattributed",
+] as const;
 
 // Durable admission ledger for every provider operation that may mutate a
 // persistable /workspace. The row is inserted atomically with the lease's
@@ -6783,6 +8561,29 @@ export const sandboxWorkspaceMutationAdmissions = pgTable(
     routeEpoch: integer("route_epoch").notNull(),
     workspaceGeneration: integer("workspace_generation").notNull(),
     operation: text("operation").notNull(),
+    // Exact authority admitted with this operation (migration 0277). Identities
+    // and epochs only, never a secret value. `legacy_unattributed` marks a
+    // pre-0277 `direct`/`process` row whose authority was never recorded; a
+    // post-0277 writer never produces it and new admission refuses it.
+    initiatorKind: text("initiator_kind", {
+      enum: sandboxWorkspaceMutationInitiatorKindValues,
+    })
+      .notNull()
+      .default("legacy_unattributed"),
+    initiatorSubjectId: text("initiator_subject_id").notNull().default("unattributed-legacy"),
+    initiatingHumanSubjectId: text("initiating_human_subject_id"),
+    // The grant identity that authorized the causal human, plus the
+    // authorization revision observed at admission. The revision is audit
+    // evidence: a role change is not a revocation and must not fence a writer.
+    initiatorOrganizationMembershipId: uuid("initiator_organization_membership_id"),
+    initiatorAuthorizationRevision: bigint("initiator_authorization_revision", { mode: "number" }),
+    // Session tenancy authority observed when the operation was admitted; the
+    // same triple `session_turn_attempts` freezes for a turn.
+    authorityEpoch: integer("authority_epoch"),
+    authorityVisibility: text("authority_visibility", {
+      enum: ["user_private", "workspace_shared"],
+    }),
+    authorityOwnerOrganizationMembershipId: uuid("authority_owner_organization_membership_id"),
     providerOutcome: text("provider_outcome", {
       enum: ["resolved", "rejected", "retained"],
     }),
@@ -6833,6 +8634,65 @@ export const sandboxWorkspaceMutationAdmissions = pgTable(
       table.actorKind,
       table.actorId,
     ),
+    initiatorMembership: foreignKey({
+      name: "sandbox_workspace_mutation_admissions_initiator_membership_fk",
+      columns: [table.initiatorOrganizationMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    authorityOwnerMembership: foreignKey({
+      name: "sandbox_workspace_mutation_admissions_authority_owner_fk",
+      columns: [table.authorityOwnerOrganizationMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    initiator: index("sandbox_workspace_mutation_admissions_initiator_idx")
+      .on(table.accountId, table.initiatorOrganizationMembershipId)
+      .where(sql`${table.settledAt} is null`),
+    initiatorValid: check(
+      "sandbox_workspace_mutation_admissions_initiator_check",
+      sql`(
+          ${table.initiatorKind} = 'legacy_unattributed'
+          and ${table.initiatorSubjectId} = 'unattributed-legacy'
+          and ${table.initiatingHumanSubjectId} is null
+          and ${table.initiatorOrganizationMembershipId} is null
+          and ${table.initiatorAuthorizationRevision} is null
+        ) or (
+          ${table.initiatorKind} in ('subject', 'service')
+          and length(btrim(${table.initiatorSubjectId})) between 1 and 1024
+          and ${table.initiatorSubjectId} <> 'unattributed-legacy'
+          and (
+            ${table.initiatingHumanSubjectId} is null
+            or length(btrim(${table.initiatingHumanSubjectId})) between 1 and 1024
+          )
+          and (
+            ${table.initiatorOrganizationMembershipId} is null
+            or ${table.initiatingHumanSubjectId} is not null
+          )
+          and (
+            ${table.initiatorAuthorizationRevision} is null
+            or (
+              ${table.initiatorAuthorizationRevision} > 0
+              and ${table.initiatorOrganizationMembershipId} is not null
+            )
+          )
+        )`,
+    ),
+    tenancyValid: check(
+      "sandbox_workspace_mutation_admissions_tenancy_check",
+      sql`(
+          ${table.authorityEpoch} is null
+          and ${table.authorityVisibility} is null
+          and ${table.authorityOwnerOrganizationMembershipId} is null
+        ) or (
+          ${table.authorityEpoch} is not null
+          and ${table.authorityVisibility} is not null
+          and ${table.authorityEpoch} > 0
+          and ${table.authorityVisibility} in ('user_private', 'workspace_shared')
+          and (
+            ${table.authorityVisibility} <> 'user_private'
+            or ${table.authorityOwnerOrganizationMembershipId} is not null
+          )
+        )`,
+    ),
     generationValid: check(
       "sandbox_workspace_mutation_admissions_generation_check",
       sql`${table.workspaceGeneration} > 0
@@ -6927,6 +8787,23 @@ export const sandboxRetainedProcesses = pgTable(
     routeTargetId: uuid("route_target_id"),
     routeEpoch: integer("route_epoch").notNull(),
     providerSessionId: integer("provider_session_id").notNull(),
+    // Authority frozen when the process was retained (migration 0277). A
+    // `legacy_unattributed` process keeps running; only its next workspace
+    // mutation is refused, because nothing may invent an owner for it.
+    initiatorKind: text("initiator_kind", {
+      enum: sandboxWorkspaceMutationInitiatorKindValues,
+    })
+      .notNull()
+      .default("legacy_unattributed"),
+    initiatorSubjectId: text("initiator_subject_id").notNull().default("unattributed-legacy"),
+    initiatingHumanSubjectId: text("initiating_human_subject_id"),
+    initiatorOrganizationMembershipId: uuid("initiator_organization_membership_id"),
+    initiatorAuthorizationRevision: bigint("initiator_authorization_revision", { mode: "number" }),
+    authorityEpoch: integer("authority_epoch"),
+    authorityVisibility: text("authority_visibility", {
+      enum: ["user_private", "workspace_shared"],
+    }),
+    authorityOwnerOrganizationMembershipId: uuid("authority_owner_organization_membership_id"),
     state: text("state", { enum: sandboxRetainedProcessStateValues }).notNull().default("active"),
     exitCode: integer("exit_code"),
     settlementReason: text("settlement_reason"),
@@ -7009,6 +8886,68 @@ export const sandboxRetainedProcesses = pgTable(
     activeInventory: index("sandbox_retained_processes_active_inventory_idx")
       .on(table.ownerActorKind, table.workspaceId, table.ownerTurnId, table.ownerAttemptId)
       .where(sql`${table.state} = 'active'`),
+    initiatorMembership: foreignKey({
+      name: "sandbox_retained_processes_initiator_membership_fk",
+      columns: [table.initiatorOrganizationMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    authorityOwnerMembership: foreignKey({
+      name: "sandbox_retained_processes_authority_owner_fk",
+      columns: [table.authorityOwnerOrganizationMembershipId, table.accountId],
+      foreignColumns: [organizationMemberships.id, organizationMemberships.accountId],
+    }).onDelete("restrict"),
+    initiator: index("sandbox_retained_processes_initiator_idx")
+      .on(table.accountId, table.initiatorOrganizationMembershipId)
+      .where(sql`${table.state} = 'active'`),
+    initiatingHuman: index("sandbox_retained_processes_initiating_human_idx")
+      .on(table.accountId, table.initiatingHumanSubjectId)
+      .where(sql`${table.state} = 'active'`),
+    initiatorValid: check(
+      "sandbox_retained_processes_initiator_check",
+      sql`(
+          ${table.initiatorKind} = 'legacy_unattributed'
+          and ${table.initiatorSubjectId} = 'unattributed-legacy'
+          and ${table.initiatingHumanSubjectId} is null
+          and ${table.initiatorOrganizationMembershipId} is null
+          and ${table.initiatorAuthorizationRevision} is null
+        ) or (
+          ${table.initiatorKind} in ('subject', 'service')
+          and length(btrim(${table.initiatorSubjectId})) between 1 and 1024
+          and ${table.initiatorSubjectId} <> 'unattributed-legacy'
+          and (
+            ${table.initiatingHumanSubjectId} is null
+            or length(btrim(${table.initiatingHumanSubjectId})) between 1 and 1024
+          )
+          and (
+            ${table.initiatorOrganizationMembershipId} is null
+            or ${table.initiatingHumanSubjectId} is not null
+          )
+          and (
+            ${table.initiatorAuthorizationRevision} is null
+            or (
+              ${table.initiatorAuthorizationRevision} > 0
+              and ${table.initiatorOrganizationMembershipId} is not null
+            )
+          )
+        )`,
+    ),
+    tenancyValid: check(
+      "sandbox_retained_processes_tenancy_check",
+      sql`(
+          ${table.authorityEpoch} is null
+          and ${table.authorityVisibility} is null
+          and ${table.authorityOwnerOrganizationMembershipId} is null
+        ) or (
+          ${table.authorityEpoch} is not null
+          and ${table.authorityVisibility} is not null
+          and ${table.authorityEpoch} > 0
+          and ${table.authorityVisibility} in ('user_private', 'workspace_shared')
+          and (
+            ${table.authorityVisibility} <> 'user_private'
+            or ${table.authorityOwnerOrganizationMembershipId} is not null
+          )
+        )`,
+    ),
     identityValid: check(
       "sandbox_retained_processes_identity_check",
       sql`${table.leaseEpoch} >= 0
@@ -7111,6 +9050,166 @@ export const sandboxRetainedProcesses = pgTable(
   }),
 );
 
+export const sessionBackgroundCommands = pgTable(
+  "session_background_commands",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    sessionId: uuid("session_id").notNull(),
+    provider: text("provider", { enum: ["managed", "connected_machine"] }).notNull(),
+    state: text("state", { enum: ["running", "stopping", "exited", "lost"] })
+      .notNull()
+      .default("running"),
+    retainedProcessId: uuid("retained_process_id"),
+    controlWorkspaceId: uuid("control_workspace_id"),
+    enrollmentId: uuid("enrollment_id"),
+    connectionInstanceId: text("connection_instance_id"),
+    opId: text("op_id"),
+    commandPreview: text("command_preview").notNull().default(""),
+    cancelRequestedAt: timestamp("cancel_requested_at", { withTimezone: true }),
+    cancelRequestedBy: text("cancel_requested_by"),
+    exitCode: integer("exit_code"),
+    settlementReason: text("settlement_reason"),
+    startedAt: timestamp("started_at", { withTimezone: true }).notNull().defaultNow(),
+    settledAt: timestamp("settled_at", { withTimezone: true }),
+    reconcileAfter: timestamp("reconcile_after", { withTimezone: true }).notNull().defaultNow(),
+    reconcileClaimId: uuid("reconcile_claim_id"),
+    reconcileClaimedAt: timestamp("reconcile_claimed_at", { withTimezone: true }),
+    reconcileAttempts: integer("reconcile_attempts").notNull().default(0),
+    lastReconcileOutcome: text("last_reconcile_outcome"),
+    reconcileProofOutcome: text("reconcile_proof_outcome", { enum: ["exited", "lost"] }),
+    reconcileProofExitCode: integer("reconcile_proof_exit_code"),
+    reconcileProofReason: text("reconcile_proof_reason"),
+    reconcileProofObservedAt: timestamp("reconcile_proof_observed_at", { withTimezone: true }),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceAccount: foreignKey({
+      name: "session_background_commands_workspace_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("cascade"),
+    workspaceSession: foreignKey({
+      name: "session_background_commands_session_fk",
+      columns: [table.workspaceId, table.sessionId],
+      foreignColumns: [sessions.workspaceId, sessions.id],
+    }).onDelete("cascade"),
+    controlWorkspaceAccount: foreignKey({
+      name: "session_background_commands_control_workspace_fk",
+      columns: [table.controlWorkspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+    }).onDelete("restrict"),
+    retainedProcess: foreignKey({
+      name: "session_background_commands_process_fk",
+      columns: [table.retainedProcessId],
+      foreignColumns: [sandboxRetainedProcesses.id],
+    }).onDelete("restrict"),
+    managedProcess: uniqueIndex("session_background_commands_process_uq")
+      .on(table.retainedProcessId)
+      .where(sql`${table.retainedProcessId} is not null`),
+    connectedOp: uniqueIndex("session_background_commands_connected_op_uq")
+      .on(table.controlWorkspaceId, table.enrollmentId, table.connectionInstanceId, table.opId)
+      .where(sql`${table.provider} = 'connected_machine'`),
+    activeSession: index("session_background_commands_active_session_idx")
+      .on(table.workspaceId, table.sessionId, table.state, table.startedAt, table.id)
+      .where(sql`${table.state} in ('running', 'stopping')`),
+    stopping: index("session_background_commands_stopping_idx")
+      .on(table.reconcileAfter, table.cancelRequestedAt, table.id)
+      .where(sql`${table.state} in ('running', 'stopping')`),
+    providerValid: check(
+      "session_background_commands_provider_check",
+      sql`${table.provider} in ('managed', 'connected_machine')`,
+    ),
+    stateValid: check(
+      "session_background_commands_state_check",
+      sql`${table.state} in ('running', 'stopping', 'exited', 'lost')`,
+    ),
+    providerIdentityValid: check(
+      "session_background_commands_provider_identity_check",
+      sql`(
+          ${table.provider} = 'managed'
+          and ${table.retainedProcessId} is not null
+          and ${table.controlWorkspaceId} is null
+          and ${table.enrollmentId} is null
+          and ${table.connectionInstanceId} is null
+          and ${table.opId} is null
+        ) or (
+          ${table.provider} = 'connected_machine'
+          and ${table.retainedProcessId} is null
+          and ${table.controlWorkspaceId} is not null
+          and ${table.enrollmentId} is not null
+          and ${table.connectionInstanceId} is not null
+          and octet_length(${table.connectionInstanceId}) between 1 and 128
+          and ${table.opId} is not null
+          and octet_length(${table.opId}) between 1 and 256
+        )`,
+    ),
+    lifecycleValid: check(
+      "session_background_commands_lifecycle_check",
+      sql`(
+          ${table.state} = 'running'
+          and ${table.cancelRequestedAt} is null
+          and ${table.cancelRequestedBy} is null
+          and ${table.exitCode} is null
+          and ${table.settlementReason} is null
+          and ${table.settledAt} is null
+        ) or (
+          ${table.state} = 'stopping'
+          and ${table.cancelRequestedAt} is not null
+          and ${table.cancelRequestedBy} is not null
+          and octet_length(btrim(${table.cancelRequestedBy})) between 1 and 1024
+          and ${table.exitCode} is null
+          and ${table.settlementReason} is null
+          and ${table.settledAt} is null
+        ) or (
+          ${table.state} = 'exited'
+          and ${table.settledAt} is not null
+          and octet_length(btrim(${table.settlementReason})) between 1 and 512
+        ) or (
+          ${table.state} = 'lost'
+          and ${table.exitCode} is null
+          and ${table.settledAt} is not null
+          and octet_length(btrim(${table.settlementReason})) between 1 and 512
+        )`,
+    ),
+    previewValid: check(
+      "session_background_commands_preview_check",
+      sql`octet_length(${table.commandPreview}) <= 2048`,
+    ),
+    reconcileValid: check(
+      "session_background_commands_reconcile_check",
+      sql`${table.reconcileAttempts} >= 0
+        and (
+          (${table.reconcileClaimId} is null and ${table.reconcileClaimedAt} is null)
+          or (${table.reconcileClaimId} is not null and ${table.reconcileClaimedAt} is not null)
+        )
+        and (
+          ${table.lastReconcileOutcome} is null
+          or octet_length(${table.lastReconcileOutcome}) between 1 and 64
+        )
+        and (
+          (
+            ${table.reconcileProofOutcome} is null
+            and ${table.reconcileProofExitCode} is null
+            and ${table.reconcileProofReason} is null
+            and ${table.reconcileProofObservedAt} is null
+          ) or (
+            ${table.reconcileProofOutcome} = 'exited'
+            and ${table.reconcileProofExitCode} is not null
+            and octet_length(btrim(${table.reconcileProofReason})) between 1 and 512
+            and ${table.reconcileProofObservedAt} is not null
+          ) or (
+            ${table.reconcileProofOutcome} = 'lost'
+            and ${table.reconcileProofExitCode} is null
+            and octet_length(btrim(${table.reconcileProofReason})) between 1 and 512
+            and ${table.reconcileProofObservedAt} is not null
+          )
+        )`,
+    ),
+  }),
+);
+
 // The recording lifecycle states (P4.3). Exported so the activity + the query
 // layer share one source of truth for the §3.1 state machine.
 export const sessionRecordingStateValues = [
@@ -7331,6 +9430,17 @@ export const enrollmentExposureValues = ["whole-machine"] as const;
 export const enrollmentStatusValues = ["active", "revoked"] as const;
 export const enrollmentOsValues = ["linux", "macos", "windows"] as const;
 export const sandboxKindValues = ["modal", "selfhosted"] as const;
+export const agentUpdateStatusValues = [
+  "requested",
+  "accepted",
+  "waiting_for_idle",
+  "downloading",
+  "verifying",
+  "applying",
+  "restarting",
+  "succeeded",
+  "failed",
+] as const;
 
 // One row per registered machine. The agent's ed25519 PUBLIC key IS the machine
 // identity (the NATS control-plane subject the agent subscribes to maps to it).
@@ -7348,6 +9458,11 @@ export const enrollments = pgTable(
     workspaceId: uuid("workspace_id")
       .notNull()
       .references(() => workspaces.id, { onDelete: "cascade" }),
+    authorityScope: text("authority_scope").notNull().default("workspace"),
+    authorityId: uuid("authority_id"),
+    ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
+    originWorkspaceId: uuid("origin_workspace_id"),
+    generation: bigint("generation", { mode: "number" }).notNull().default(1),
     // The agent's ed25519 public key (the machine identity).
     pubkey: text("pubkey").notNull(),
     exposure: text("exposure", { enum: enrollmentExposureValues })
@@ -7366,13 +9481,49 @@ export const enrollments = pgTable(
     // from every connect Hello alongside has_display.
     desktopUnavailableReason: text("desktop_unavailable_reason"),
     allowScreenControl: boolean("allow_screen_control").notNull().default(false),
+    // Optional per-connection command policy. NULL is the unrestricted default.
+    // Values remain within JavaScript's exact-integer wire range; local runner and
+    // ancestor host policy may only tighten them at execution.
+    operationMemoryMaxBytes: bigint("operation_memory_max_bytes", {
+      mode: "number",
+    }),
+    operationMemoryHighBytes: bigint("operation_memory_high_bytes", {
+      mode: "number",
+    }),
+    operationCpuMaxMillicores: bigint("operation_cpu_max_millicores", {
+      mode: "number",
+    }),
+    operationPolicyRevision: integer("operation_policy_revision").notNull().default(0),
+    operationPolicyUpdatedAt: timestamp("operation_policy_updated_at", {
+      withTimezone: true,
+    }),
     status: text("status", { enum: enrollmentStatusValues }).notNull().default("active"),
     // Credential-family fence. Existing rows/migration-era bearers are generation
     // 1; every successful re-enrollment increments this atomically before a new
     // bearer is signed. Auth and self-revoke require an exact row/claim match.
     credentialGeneration: integer("credential_generation").notNull().default(1),
+    // One live runner instance owns this enrollment's data-plane address at a
+    // time. Auth-callout claims/renews the lease before NATS grants a connection;
+    // every operational subject includes the instance id, so an older still-open
+    // socket cannot receive work after a successor claims authority.
+    connectionInstanceId: text("connection_instance_id"),
+    connectionGeneration: integer("connection_generation").notNull().default(0),
+    connectionLeaseExpiresAt: timestamp("connection_lease_expires_at", {
+      withTimezone: true,
+    }),
+    // Durable diagnostics for valid cloned credentials / duplicate daemons that
+    // were blocked while another process held the live authority lease.
+    connectionDuplicateDeniedCount: integer("connection_duplicate_denied_count")
+      .notNull()
+      .default(0),
+    connectionDuplicateDeniedAt: timestamp("connection_duplicate_denied_at", {
+      withTimezone: true,
+    }),
     os: text("os", { enum: enrollmentOsValues }).notNull().default("linux"),
     arch: text("arch").notNull().default("x86_64"),
+    // Exact absolute launch root reported by the authoritative runner Hello.
+    // Null means no current runner has supplied a usable root yet.
+    workspaceRoot: text("workspace_root"),
     // Heartbeat liveness cursor. Null until the first connect.
     lastSeenAt: timestamp("last_seen_at", { withTimezone: true }),
     // Clean going-offline marker (migration 0049). Set when the machine announces a
@@ -7383,18 +9534,154 @@ export const enrollments = pgTable(
     // (the default) ⇒ no goodbye pending — today's last_seen-aging behavior.
     wentOfflineAt: timestamp("went_offline_at", { withTimezone: true }),
     wentOfflineReason: text("went_offline_reason"),
+    // Exact running build + negotiated capability truth, refreshed from the
+    // authoritative process Hello. Null means an older agent has not reported it.
+    agentVersion: text("agent_version"),
+    agentBinarySha256: text("agent_binary_sha256"),
+    agentUpdateChannel: text("agent_update_channel", {
+      enum: ["stable", "beta"] as const,
+    }),
+    agentCapabilities: jsonb("agent_capabilities")
+      .$type<Record<string, boolean>>()
+      .notNull()
+      .default({}),
+    // One current/most-recent self-update. The accepting connection coordinates
+    // fence every progress write; a successor Hello is the only success signal.
+    agentUpdateOperationId: uuid("agent_update_operation_id"),
+    agentUpdateStatus: text("agent_update_status", {
+      enum: agentUpdateStatusValues,
+    }),
+    agentUpdateTargetVersion: text("agent_update_target_version"),
+    agentUpdateExpectedBinarySha256: text("agent_update_expected_binary_sha256"),
+    agentUpdateErrorCode: text("agent_update_error_code"),
+    agentUpdateRetryable: boolean("agent_update_retryable").notNull().default(false),
+    agentUpdateRolledBack: boolean("agent_update_rolled_back").notNull().default(false),
+    agentUpdateConnectionInstanceId: text("agent_update_connection_instance_id"),
+    agentUpdateConnectionGeneration: integer("agent_update_connection_generation"),
+    agentUpdateRequestedAt: timestamp("agent_update_requested_at", {
+      withTimezone: true,
+    }),
+    agentUpdateUpdatedAt: timestamp("agent_update_updated_at", {
+      withTimezone: true,
+    }),
+    agentUpdateCompletedAt: timestamp("agent_update_completed_at", {
+      withTimezone: true,
+    }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     revokedAt: timestamp("revoked_at", { withTimezone: true }),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
-    // One enrollment per (workspace, pubkey): a re-enroll is an idempotent upsert.
-    workspacePubkey: uniqueIndex("enrollments_workspace_pubkey_idx").on(
-      table.workspaceId,
-      table.pubkey,
-    ),
+    // One enrollment identity per authority boundary and pubkey. Revocation keeps
+    // the identity so a re-enroll can reactivate the same durable row.
+    workspacePubkey: uniqueIndex("enrollments_workspace_pubkey_idx")
+      .on(table.workspaceId, table.pubkey)
+      .where(sql`${table.authorityScope} = 'workspace'`),
+    organizationPubkey: uniqueIndex("enrollments_organization_pubkey_idx")
+      .on(table.accountId, table.pubkey)
+      .where(sql`${table.authorityScope} = 'organization'`),
+    userPubkey: uniqueIndex("enrollments_user_pubkey_idx")
+      .on(table.accountId, table.ownerOrganizationMembershipId, table.pubkey)
+      .where(sql`${table.authorityScope} = 'user'`),
     // List a workspace's ACTIVE machines without scanning revoked rows.
     workspaceStatus: index("enrollments_workspace_status_idx").on(table.workspaceId, table.status),
+    authorityShape: check(
+      "enrollments_authority_shape_check",
+      sql`(
+        ${table.authorityScope} in ('organization', 'workspace')
+        and ${table.authorityId} is null
+        and ${table.ownerOrganizationMembershipId} is null
+      ) or (
+        ${table.authorityScope} = 'user'
+        and ${table.authorityId} is not null
+        and ${table.ownerOrganizationMembershipId} is not null
+      )`,
+    ),
+    authorityScopeValid: check(
+      "enrollments_authority_scope_check",
+      sql`${table.authorityScope} in ('organization', 'workspace', 'user')`,
+    ),
+    generationPositive: check("enrollments_generation_check", sql`${table.generation} > 0`),
+    authority: foreignKey({
+      name: "enrollments_authority_fk",
+      columns: [table.authorityId, table.accountId, table.ownerOrganizationMembershipId],
+      foreignColumns: [
+        organizationUserResourceAuthorities.id,
+        organizationUserResourceAuthorities.accountId,
+        organizationUserResourceAuthorities.organizationMembershipId,
+      ],
+    }).onDelete("restrict"),
+    connectionAuthorityShape: check(
+      "enrollments_connection_authority_shape_chk",
+      sql`(${table.connectionInstanceId} is null and ${table.connectionLeaseExpiresAt} is null)
+        or (${table.connectionInstanceId} is not null
+          and length(${table.connectionInstanceId}) between 1 and 128
+          and ${table.connectionLeaseExpiresAt} is not null)`,
+    ),
+    connectionGenerationNonnegative: check(
+      "enrollments_connection_generation_chk",
+      sql`${table.connectionGeneration} >= 0`,
+    ),
+    operationMemoryMaxShape: check(
+      "enrollments_operation_memory_max_shape_chk",
+      sql`${table.operationMemoryMaxBytes} is null or (${table.operationMemoryMaxBytes} > 0 and ${table.operationMemoryMaxBytes} <= 9007199254740991)`,
+    ),
+    operationMemoryHighShape: check(
+      "enrollments_operation_memory_high_shape_chk",
+      sql`${table.operationMemoryHighBytes} is null or (${table.operationMemoryHighBytes} > 0 and ${table.operationMemoryHighBytes} <= 9007199254740991)`,
+    ),
+    operationMemoryOrder: check(
+      "enrollments_operation_memory_order_chk",
+      sql`${table.operationMemoryMaxBytes} is null or ${table.operationMemoryHighBytes} is null or ${table.operationMemoryHighBytes} <= ${table.operationMemoryMaxBytes}`,
+    ),
+    operationCpuShape: check(
+      "enrollments_operation_cpu_shape_chk",
+      sql`${table.operationCpuMaxMillicores} is null or ${table.operationCpuMaxMillicores} between 1 and 4294967295`,
+    ),
+    operationPolicyRevisionNonnegative: check(
+      "enrollments_operation_policy_revision_chk",
+      sql`${table.operationPolicyRevision} >= 0`,
+    ),
+    agentBinarySha256Shape: check(
+      "enrollments_agent_binary_sha256_chk",
+      sql`${table.agentBinarySha256} is null or ${table.agentBinarySha256} ~ '^[0-9a-f]{64}$'`,
+    ),
+    agentUpdateChannelShape: check(
+      "enrollments_agent_update_channel_chk",
+      sql`${table.agentUpdateChannel} is null or ${table.agentUpdateChannel} in ('stable', 'beta')`,
+    ),
+    agentUpdateExpectedBinarySha256Shape: check(
+      "enrollments_agent_update_expected_binary_sha256_chk",
+      sql`${table.agentUpdateExpectedBinarySha256} is null or ${table.agentUpdateExpectedBinarySha256} ~ '^[0-9a-f]{64}$'`,
+    ),
+    agentUpdateStateShape: check(
+      "enrollments_agent_update_state_shape_chk",
+      sql`(
+        (${table.agentUpdateOperationId} is null
+          and ${table.agentUpdateStatus} is null
+          and ${table.agentUpdateTargetVersion} is null
+          and ${table.agentUpdateConnectionInstanceId} is null
+          and ${table.agentUpdateConnectionGeneration} is null
+          and ${table.agentUpdateRequestedAt} is null
+          and ${table.agentUpdateUpdatedAt} is null)
+        or
+        (${table.agentUpdateOperationId} is not null
+          and ${table.agentUpdateStatus} in (
+            'requested', 'accepted', 'waiting_for_idle', 'downloading', 'verifying',
+            'applying', 'restarting', 'succeeded', 'failed'
+          )
+          and ${table.agentUpdateTargetVersion} is not null
+          and ${table.agentUpdateConnectionInstanceId} is not null
+          and ${table.agentUpdateConnectionGeneration} is not null
+          and ${table.agentUpdateConnectionGeneration} >= 0
+          and ${table.agentUpdateRequestedAt} is not null
+          and ${table.agentUpdateUpdatedAt} is not null)
+      )`,
+    ),
+    connectionDuplicateDeniedCountNonnegative: check(
+      "enrollments_connection_duplicate_denied_count_chk",
+      sql`${table.connectionDuplicateDeniedCount} >= 0`,
+    ),
   }),
 );
 
@@ -7696,6 +9983,12 @@ export const scheduledTasks = pgTable(
       .$type<XaiProviderAccountAuthoritySnapshotV1>()
       .notNull()
       .default(WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1),
+    authorityRevision: bigint("authority_revision", { mode: "number" }).notNull().default(1),
+    // The migration-owned BEFORE INSERT/UPDATE trigger replaces this client
+    // placeholder with the canonical whole-row execution digest.
+    executionDigest: text("execution_digest")
+      .notNull()
+      .$defaultFn(() => ""),
     reusableSessionId: uuid("reusable_session_id").references(() => sessions.id, {
       onDelete: "set null",
     }),
@@ -7707,6 +10000,7 @@ export const scheduledTasks = pgTable(
     // in migration 0047 (forward-reference pattern). Consumed in M3.
     rigId: uuid("rig_id"),
     metadata: jsonb("metadata").$type<Record<string, unknown>>().notNull().default({}),
+    deletedAt: timestamp("deleted_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
@@ -7738,6 +10032,12 @@ export const temporalScheduleCleanupOutbox = pgTable(
     accountId: uuid("account_id").notNull(),
     workspaceId: uuid("workspace_id").notNull(),
     temporalScheduleId: text("temporal_schedule_id").notNull(),
+    scheduledTaskId: uuid("scheduled_task_id"),
+    connectorCleanupSubjectId: text("connector_cleanup_subject_id"),
+    connectorCleanupSnapshot: jsonb("connector_cleanup_snapshot"),
+    connectorCleanupCompletedAt: timestamp("connector_cleanup_completed_at", {
+      withTimezone: true,
+    }),
     claimId: uuid("claim_id"),
     claimUntil: timestamp("claim_until", { withTimezone: true }),
     attemptCount: integer("attempt_count").notNull().default(0),
@@ -7761,6 +10061,58 @@ export const temporalScheduleCleanupOutbox = pgTable(
         and ${table.attemptCount} >= 0
         and ((${table.claimId} is null and ${table.claimUntil} is null)
           or (${table.claimId} is not null and ${table.claimUntil} is not null))
+        and ((${table.scheduledTaskId} is null and ${table.connectorCleanupSubjectId} is null
+              and ${table.connectorCleanupSnapshot} is null)
+          or (${table.scheduledTaskId} is not null and ${table.connectorCleanupSubjectId} is not null
+              and ${table.connectorCleanupSnapshot} is not null))
+        and (${table.connectorCleanupSnapshot} is not null
+          or ${table.connectorCleanupCompletedAt} is null)
+        and (${table.connectorCleanupSubjectId} is null
+          or octet_length(${table.connectorCleanupSubjectId}) between 1 and 4096)
+        and (${table.connectorCleanupSnapshot} is null or (
+          jsonb_typeof(${table.connectorCleanupSnapshot}) = 'object'
+          and ${table.connectorCleanupSnapshot} ?& array[
+            'version','taskId','accountId','workspaceId','connectorKind','connectionId',
+            'connectionVersion','sourceId','sourceLifecycleGeneration',
+            'sourceConfigGeneration','externalSourceId','subjectId'
+          ]
+          and ${table.connectorCleanupSnapshot} - array[
+            'version','taskId','accountId','workspaceId','connectorKind','connectionId',
+            'connectionVersion','sourceId','sourceLifecycleGeneration',
+            'sourceConfigGeneration','externalSourceId','subjectId'
+          ]::text[] = '{}'::jsonb
+          and jsonb_typeof(${table.connectorCleanupSnapshot}->'version') = 'number'
+          and jsonb_typeof(${table.connectorCleanupSnapshot}->'taskId') = 'string'
+          and jsonb_typeof(${table.connectorCleanupSnapshot}->'accountId') = 'string'
+          and jsonb_typeof(${table.connectorCleanupSnapshot}->'workspaceId') = 'string'
+          and jsonb_typeof(${table.connectorCleanupSnapshot}->'connectorKind') = 'string'
+          and jsonb_typeof(${table.connectorCleanupSnapshot}->'connectionId') = 'string'
+          and jsonb_typeof(${table.connectorCleanupSnapshot}->'connectionVersion') = 'number'
+          and jsonb_typeof(${table.connectorCleanupSnapshot}->'sourceId') = 'string'
+          and jsonb_typeof(${table.connectorCleanupSnapshot}->'sourceLifecycleGeneration') = 'number'
+          and jsonb_typeof(${table.connectorCleanupSnapshot}->'sourceConfigGeneration') = 'number'
+          and jsonb_typeof(${table.connectorCleanupSnapshot}->'externalSourceId') = 'string'
+          and jsonb_typeof(${table.connectorCleanupSnapshot}->'subjectId') = 'string'
+          and ${table.connectorCleanupSnapshot}->>'version' = '1'
+          and ${table.connectorCleanupSnapshot}->>'connectorKind' in ('google_drive','atlassian')
+          and ${table.connectorCleanupSnapshot}->>'subjectId' = ${table.connectorCleanupSubjectId}
+          and ${table.connectorCleanupSnapshot}->>'taskId' = ${table.scheduledTaskId}::text
+          and ${table.connectorCleanupSnapshot}->>'accountId' = ${table.accountId}::text
+          and ${table.connectorCleanupSnapshot}->>'workspaceId' = ${table.workspaceId}::text
+          and octet_length(${table.connectorCleanupSnapshot}->>'externalSourceId') between 1 and 2048
+          and octet_length(${table.connectorCleanupSnapshot}->>'subjectId') between 1 and 4096
+          and ${table.connectorCleanupSnapshot}->>'taskId' ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'
+          and ${table.connectorCleanupSnapshot}->>'accountId' ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'
+          and ${table.connectorCleanupSnapshot}->>'workspaceId' ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'
+          and ${table.connectorCleanupSnapshot}->>'connectionId' ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'
+          and ${table.connectorCleanupSnapshot}->>'sourceId' ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'
+          and ${table.connectorCleanupSnapshot}->>'connectionVersion' ~ '^[1-9][0-9]*$'
+          and ${table.connectorCleanupSnapshot}->>'sourceLifecycleGeneration' ~ '^[1-9][0-9]*$'
+          and ${table.connectorCleanupSnapshot}->>'sourceConfigGeneration' ~ '^[1-9][0-9]*$'
+          and (${table.connectorCleanupSnapshot}->>'connectionVersion')::numeric <= 9007199254740991
+          and (${table.connectorCleanupSnapshot}->>'sourceLifecycleGeneration')::numeric <= 9007199254740991
+          and (${table.connectorCleanupSnapshot}->>'sourceConfigGeneration')::numeric <= 9007199254740991
+        ))
         and (${table.lastError} is null or length(${table.lastError}) <= 2000)`,
     ),
   }),
@@ -7778,14 +10130,16 @@ export const scheduledTaskRuns = pgTable(
       .references(() => workspaces.id, { onDelete: "cascade" }),
     taskId: uuid("task_id")
       .notNull()
-      .references(() => scheduledTasks.id, { onDelete: "cascade" }),
+      .references(() => scheduledTasks.id),
+    taskAuthorityRevision: bigint("task_authority_revision", {
+      mode: "number",
+    }),
+    taskExecutionDigest: text("task_execution_digest"),
     status: text("status").notNull().default("queued"),
     triggerType: text("trigger_type").notNull(),
     scheduledAt: timestamp("scheduled_at", { withTimezone: true }),
     firedAt: timestamp("fired_at", { withTimezone: true }).notNull().defaultNow(),
-    sessionId: uuid("session_id").references(() => sessions.id, {
-      onDelete: "set null",
-    }),
+    sessionId: uuid("session_id").references(() => sessions.id),
     triggerEventId: uuid("trigger_event_id"),
     actionKind: text("action_kind").notNull().default("agent_turn"),
     knowledgeSyncRunId: uuid("knowledge_sync_run_id"),
@@ -7794,6 +10148,10 @@ export const scheduledTaskRuns = pgTable(
     // Stable Temporal producer identity. Activity replay/re-dispatch returns
     // the exact run instead of allocating a second schedule source row.
     producerKey: text("producer_key"),
+    // Complete credential-free accepted execution truth. It is private worker
+    // authority and never appears in public scheduled-run projections.
+    acceptedExecutionSnapshot: jsonb("accepted_execution_snapshot").$type<unknown>(),
+    acceptedExecutionDigest: text("accepted_execution_digest"),
     error: text("error"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
@@ -7900,45 +10258,186 @@ export const githubInstallations = pgTable(
         )
       `,
     ),
-    authorityNonce: uniqueIndex("github_installations_authority_nonce_uq")
-      .on(table.authorityNonce)
-      .where(sql`${table.authorityNonce} is not null`),
+    authorityNonce: uniqueIndex("github_installations_authority_nonce_uq")
+      .on(table.authorityNonce)
+      .where(sql`${table.authorityNonce} is not null`),
+  }),
+);
+
+export const githubInstallationRepositories = pgTable(
+  "github_installation_repositories",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    installationId: integer("installation_id").notNull(),
+    repositoryId: bigint("repository_id", { mode: "number" }).notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    installationRepository: uniqueIndex("github_install_repo_workspace_installation_repo_idx").on(
+      table.workspaceId,
+      table.installationId,
+      table.repositoryId,
+    ),
+    workspaceInstallation: index("github_install_repo_workspace_installation_idx").on(
+      table.workspaceId,
+      table.installationId,
+    ),
+    workspaceAccount: foreignKey({
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+      name: "github_installation_repositories_workspace_account_fk",
+    }).onDelete("cascade"),
+    installationBinding: foreignKey({
+      columns: [table.workspaceId, table.installationId],
+      foreignColumns: [githubInstallations.workspaceId, githubInstallations.installationId],
+      name: "github_installation_repositories_installation_fk",
+    }).onDelete("cascade"),
+  }),
+);
+
+export const prReviewAppRegistrations = pgTable(
+  "pr_review_app_registrations",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    sourceId: uuid("source_id").notNull(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    provider: text("provider").notNull(),
+    providerBaseUrl: text("provider_base_url").notNull(),
+    appId: text("app_id"),
+    credentialKind: text("credential_kind").notNull(),
+    credentialEncrypted: text("credential_encrypted"),
+    accessTokenExpiresAt: timestamp("access_token_expires_at", { withTimezone: true }),
+    webhookAuthKind: text("webhook_auth_kind").notNull(),
+    webhookUsername: text("webhook_username"),
+    status: text("status").notNull().default("active"),
+    createdBySubjectId: text("created_by_subject_id").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceRegistration: uniqueIndex("pr_review_app_registrations_workspace_id_uq").on(
+      table.workspaceId,
+      table.id,
+    ),
+    workspaceRegistrationProvider: uniqueIndex(
+      "pr_review_app_registrations_workspace_id_provider_uq",
+    ).on(table.workspaceId, table.id, table.provider),
+    workspaceProviderName: uniqueIndex("pr_review_app_registrations_workspace_provider_name_uq").on(
+      table.workspaceId,
+      table.provider,
+      table.name,
+    ),
+    workspaceStatus: index("pr_review_app_registrations_workspace_status_idx").on(
+      table.workspaceId,
+      table.status,
+    ),
+    providerCheck: check(
+      "pr_review_app_registrations_provider_chk",
+      sql`${table.provider} in ('github', 'gitlab', 'azure_devops')`,
+    ),
+    credentialCheck: check(
+      "pr_review_app_registrations_credential_chk",
+      sql`(
+        (${table.provider} = 'github' and ${table.credentialKind} = 'github_app' and ${table.credentialEncrypted} is not null and ${table.appId} is not null)
+        or
+        (${table.provider} in ('gitlab', 'azure_devops') and ${table.credentialKind} = 'provider_token' and ${table.credentialEncrypted} is not null)
+      )`,
+    ),
+    webhookAuthCheck: check(
+      "pr_review_app_registrations_webhook_auth_chk",
+      sql`(
+        (${table.provider} = 'github' and ${table.webhookAuthKind} = 'hmac_sha256')
+        or (${table.provider} = 'gitlab' and ${table.webhookAuthKind} = 'shared_token')
+        or (${table.provider} = 'azure_devops' and ${table.webhookAuthKind} = 'basic' and ${table.webhookUsername} is not null)
+      )`,
+    ),
+    statusCheck: check(
+      "pr_review_app_registrations_status_chk",
+      sql`${table.status} in ('active', 'disabled')`,
+    ),
+    workspaceAccount: foreignKey({
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+      name: "pr_review_app_registrations_workspace_account_fk",
+    }).onDelete("cascade"),
   }),
 );
 
-export const githubInstallationRepositories = pgTable(
-  "github_installation_repositories",
+export const prReviewRepositoryBindings = pgTable(
+  "pr_review_repository_bindings",
   {
     id: uuid("id").primaryKey().defaultRandom(),
+    triggerId: uuid("trigger_id").notNull(),
     accountId: uuid("account_id")
       .notNull()
       .references(() => managedAccounts.id, { onDelete: "cascade" }),
     workspaceId: uuid("workspace_id")
       .notNull()
       .references(() => workspaces.id, { onDelete: "cascade" }),
-    installationId: integer("installation_id").notNull(),
-    repositoryId: bigint("repository_id", { mode: "number" }).notNull(),
+    registrationId: uuid("registration_id").notNull(),
+    provider: text("provider").notNull(),
+    repositoryUri: text("repository_uri").notNull(),
+    repositoryFullName: text("repository_full_name").notNull(),
+    providerRepositoryId: text("provider_repository_id").notNull(),
+    installationId: text("installation_id"),
+    projectId: text("project_id"),
+    model: text("model"),
+    additionalInstructions: text("additional_instructions"),
+    status: text("status").notNull().default("active"),
+    createdBySubjectId: text("created_by_subject_id").notNull(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
-    installationRepository: uniqueIndex("github_install_repo_workspace_installation_repo_idx").on(
+    workspaceBinding: uniqueIndex("pr_review_repository_bindings_workspace_id_uq").on(
       table.workspaceId,
-      table.installationId,
-      table.repositoryId,
+      table.id,
     ),
-    workspaceInstallation: index("github_install_repo_workspace_installation_idx").on(
+    workspaceBindingRegistrationProvider: uniqueIndex(
+      "pr_review_repo_workspace_registration_provider_uq",
+    ).on(table.workspaceId, table.id, table.registrationId, table.provider),
+    registrationRepository: uniqueIndex("pr_review_repository_bindings_registration_repo_uq").on(
+      table.registrationId,
+      table.providerRepositoryId,
+    ),
+    triggerIdentity: uniqueIndex("pr_review_repository_bindings_trigger_uq").on(table.triggerId),
+    workspaceStatus: index("pr_review_repository_bindings_workspace_status_idx").on(
       table.workspaceId,
-      table.installationId,
+      table.status,
+    ),
+    providerCheck: check(
+      "pr_review_repository_bindings_provider_chk",
+      sql`${table.provider} in ('github', 'gitlab', 'azure_devops')`,
+    ),
+    statusCheck: check(
+      "pr_review_repository_bindings_status_chk",
+      sql`${table.status} in ('active', 'disabled')`,
     ),
     workspaceAccount: foreignKey({
       columns: [table.workspaceId, table.accountId],
       foreignColumns: [workspaces.id, workspaces.accountId],
-      name: "github_installation_repositories_workspace_account_fk",
+      name: "pr_review_repository_bindings_workspace_account_fk",
     }).onDelete("cascade"),
-    installationBinding: foreignKey({
-      columns: [table.workspaceId, table.installationId],
-      foreignColumns: [githubInstallations.workspaceId, githubInstallations.installationId],
-      name: "github_installation_repositories_installation_fk",
+    registration: foreignKey({
+      columns: [table.workspaceId, table.registrationId, table.provider],
+      foreignColumns: [
+        prReviewAppRegistrations.workspaceId,
+        prReviewAppRegistrations.id,
+        prReviewAppRegistrations.provider,
+      ],
+      name: "pr_review_repository_bindings_registration_fk",
     }).onDelete("cascade"),
   }),
 );
@@ -8060,6 +10559,8 @@ export const modelCallFacts = pgTable(
       mode: "number",
     }),
     pricingSource: text("pricing_source"),
+    contextContributions:
+      jsonb("context_contributions").$type<readonly ModelContextContributionSummary[]>(),
     occurredAt: timestamp("occurred_at", { withTimezone: true }).notNull(),
     recordedAt: timestamp("recorded_at", { withTimezone: true }).notNull().defaultNow(),
   },
@@ -8130,6 +10631,10 @@ export const modelCallFacts = pgTable(
       "model_call_facts_model_bytes_check",
       sql`octet_length(${table.model}) between 1 and 512`,
     ),
+    contextContributionsValid: check(
+      "model_call_facts_context_contributions_check",
+      sql`opengeni_private.model_context_contributions_valid(${table.contextContributions})`,
+    ),
   }),
 );
 
@@ -8433,6 +10938,10 @@ export const packInstallations = pgTable(
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
+    workspaceIdentity: uniqueIndex("pack_installations_workspace_id_uq").on(
+      table.workspaceId,
+      table.id,
+    ),
     workspacePack: uniqueIndex("pack_installations_workspace_pack_idx").on(
       table.workspaceId,
       table.packId,
@@ -8479,6 +10988,376 @@ export const packInstallationComponents = pgTable(
   }),
 );
 
+export const automationSources = pgTable(
+  "automation_sources",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    endpointId: uuid("endpoint_id").notNull().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    adapterId: text("adapter_id").notNull(),
+    configuration: jsonb("configuration").$type<Record<string, unknown>>().notNull().default({}),
+    webhookSecretEncrypted: text("webhook_secret_encrypted").notNull(),
+    status: text("status").notNull().default("active"),
+    version: integer("version").notNull().default(1),
+    packInstallationId: uuid("pack_installation_id"),
+    packConnectorId: text("pack_connector_id"),
+    createdBySubjectId: text("created_by_subject_id").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    endpoint: uniqueIndex("automation_sources_endpoint_uq").on(table.endpointId),
+    workspaceIdentity: uniqueIndex("automation_sources_workspace_id_uq").on(
+      table.workspaceId,
+      table.id,
+    ),
+    workspaceStatus: index("automation_sources_workspace_status_idx").on(
+      table.workspaceId,
+      table.status,
+    ),
+    shape: check(
+      "automation_sources_shape_chk",
+      sql`${table.status} in ('active', 'disabled')
+        and ${table.version} > 0
+        and octet_length(${table.name}) between 1 and 512
+        and octet_length(${table.adapterId}) between 1 and 128
+        and octet_length(${table.createdBySubjectId}) between 1 and 4096
+        and jsonb_typeof(${table.configuration}) = 'object'
+        and ((${table.packInstallationId} is null and ${table.packConnectorId} is null)
+          or (${table.packInstallationId} is not null
+            and octet_length(${table.packConnectorId}) between 1 and 128))`,
+    ),
+    workspaceAccount: foreignKey({
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+      name: "automation_sources_workspace_account_fk",
+    }).onDelete("cascade"),
+    packInstallation: foreignKey({
+      columns: [table.workspaceId, table.packInstallationId],
+      foreignColumns: [packInstallations.workspaceId, packInstallations.id],
+      name: "automation_sources_pack_installation_fk",
+    }).onDelete("cascade"),
+  }),
+);
+
+/** Credential-free global webhook routing. Possession of the opaque endpoint
+ * UUID locates the tenant; authentication still requires the encrypted secret
+ * on the FORCE-RLS source row before any payload is parsed or accepted. */
+export const automationWebhookEndpoints = pgTable(
+  "automation_webhook_endpoints",
+  {
+    endpointId: uuid("endpoint_id").primaryKey(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    sourceId: uuid("source_id")
+      .notNull()
+      .references(() => automationSources.id, { onDelete: "cascade" }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    source: uniqueIndex("automation_webhook_endpoints_source_uq").on(table.sourceId),
+    workspaceAccount: foreignKey({
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+      name: "automation_webhook_endpoints_workspace_account_fk",
+    }).onDelete("cascade"),
+  }),
+);
+
+export const automationTriggers = pgTable(
+  "automation_triggers",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id")
+      .notNull()
+      .references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    sourceId: uuid("source_id").notNull(),
+    name: text("name").notNull(),
+    status: text("status").notNull().default("active"),
+    currentRevision: integer("current_revision").notNull().default(1),
+    packInstallationId: uuid("pack_installation_id"),
+    packTemplateId: text("pack_template_id"),
+    createdBySubjectId: text("created_by_subject_id").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceIdentity: uniqueIndex("automation_triggers_workspace_id_uq").on(
+      table.workspaceId,
+      table.id,
+    ),
+    workspaceSourceIdentity: uniqueIndex("automation_triggers_workspace_source_id_uq").on(
+      table.workspaceId,
+      table.id,
+      table.sourceId,
+    ),
+    workspaceStatus: index("automation_triggers_workspace_status_idx").on(
+      table.workspaceId,
+      table.status,
+    ),
+    source: foreignKey({
+      columns: [table.workspaceId, table.sourceId],
+      foreignColumns: [automationSources.workspaceId, automationSources.id],
+      name: "automation_triggers_source_fk",
+    }).onDelete("cascade"),
+    packInstallation: foreignKey({
+      columns: [table.workspaceId, table.packInstallationId],
+      foreignColumns: [packInstallations.workspaceId, packInstallations.id],
+      name: "automation_triggers_pack_installation_fk",
+    }).onDelete("cascade"),
+    workspaceAccount: foreignKey({
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+      name: "automation_triggers_workspace_account_fk",
+    }).onDelete("cascade"),
+    shape: check(
+      "automation_triggers_shape_chk",
+      sql`${table.status} in ('active', 'paused', 'disabled')
+        and ${table.currentRevision} > 0
+        and octet_length(${table.name}) between 1 and 512
+        and octet_length(${table.createdBySubjectId}) between 1 and 4096
+        and ((${table.packInstallationId} is null and ${table.packTemplateId} is null)
+          or (${table.packInstallationId} is not null and octet_length(${table.packTemplateId}) between 1 and 128))`,
+    ),
+  }),
+);
+
+export const automationTriggerRevisions = pgTable(
+  "automation_trigger_revisions",
+  {
+    triggerId: uuid("trigger_id").notNull(),
+    revision: integer("revision").notNull(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    adapterId: text("adapter_id").notNull(),
+    eventTypes: jsonb("event_types").$type<string[]>().notNull(),
+    configuration: jsonb("configuration").$type<Record<string, unknown>>().notNull().default({}),
+    parameters: jsonb("parameters").$type<Record<string, unknown>>().notNull().default({}),
+    sessionTemplate: jsonb("session_template").$type<AutomationSessionTemplate>().notNull(),
+    createdBySubjectId: text("created_by_subject_id").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    identity: primaryKey({ columns: [table.triggerId, table.revision] }),
+    trigger: foreignKey({
+      columns: [table.workspaceId, table.triggerId],
+      foreignColumns: [automationTriggers.workspaceId, automationTriggers.id],
+      name: "automation_trigger_revisions_trigger_fk",
+    }).onDelete("cascade"),
+    workspaceAccount: foreignKey({
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+      name: "automation_trigger_revisions_workspace_account_fk",
+    }).onDelete("cascade"),
+    shape: check(
+      "automation_trigger_revisions_shape_chk",
+      sql`${table.revision} > 0
+        and octet_length(${table.adapterId}) between 1 and 128
+        and jsonb_typeof(${table.eventTypes}) = 'array'
+        and jsonb_array_length(${table.eventTypes}) between 1 and 64
+        and jsonb_typeof(${table.configuration}) = 'object'
+        and jsonb_typeof(${table.parameters}) = 'object'
+        and jsonb_typeof(${table.sessionTemplate}) = 'object'`,
+    ),
+  }),
+);
+
+export const automationTriggerEvents = pgTable(
+  "automation_trigger_events",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    sourceId: uuid("source_id").notNull(),
+    sourceVersion: integer("source_version").notNull(),
+    sourceConfiguration: jsonb("source_configuration").$type<Record<string, unknown>>().notNull(),
+    matchedTriggerRevisions: jsonb("matched_trigger_revisions")
+      .$type<Array<{ triggerId: string; revision: number }>>()
+      .notNull(),
+    deliveryKey: text("delivery_key").notNull(),
+    requestDigest: text("request_digest").notNull(),
+    adapterId: text("adapter_id").notNull(),
+    eventType: text("event_type").notNull(),
+    occurrenceKey: text("occurrence_key").notNull(),
+    normalizedEvent: jsonb("normalized_event").$type<Record<string, unknown>>().notNull(),
+    status: text("status").notNull().default("accepted"),
+    ignoredReason: text("ignored_reason"),
+    errorCode: text("error_code"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    sourceDelivery: uniqueIndex("automation_trigger_events_source_delivery_uq").on(
+      table.sourceId,
+      table.deliveryKey,
+    ),
+    workspaceCreated: index("automation_trigger_events_workspace_created_idx").on(
+      table.workspaceId,
+      table.createdAt,
+    ),
+    workspaceSourceIdentity: uniqueIndex("automation_trigger_events_workspace_source_id_uq").on(
+      table.workspaceId,
+      table.sourceId,
+      table.id,
+    ),
+    source: foreignKey({
+      columns: [table.workspaceId, table.sourceId],
+      foreignColumns: [automationSources.workspaceId, automationSources.id],
+      name: "automation_trigger_events_source_fk",
+    }).onDelete("cascade"),
+    workspaceAccount: foreignKey({
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+      name: "automation_trigger_events_workspace_account_fk",
+    }).onDelete("cascade"),
+    shape: check(
+      "automation_trigger_events_shape_chk",
+      sql`${table.status} in ('accepted', 'ignored', 'failed')
+        and ${table.sourceVersion} > 0
+        and jsonb_typeof(${table.sourceConfiguration}) = 'object'
+        and jsonb_typeof(${table.matchedTriggerRevisions}) = 'array'
+        and jsonb_array_length(${table.matchedTriggerRevisions}) <= 32
+        and ${table.requestDigest} ~ '^[0-9a-f]{64}$'
+        and octet_length(${table.deliveryKey}) between 1 and 1024
+        and octet_length(${table.eventType}) between 1 and 256
+        and octet_length(${table.occurrenceKey}) between 1 and 1024
+        and jsonb_typeof(${table.normalizedEvent}) = 'object'`,
+    ),
+  }),
+);
+
+export const automationRuns = pgTable(
+  "automation_runs",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    sourceId: uuid("source_id").notNull(),
+    triggerId: uuid("trigger_id").notNull(),
+    triggerRevision: integer("trigger_revision").notNull(),
+    eventId: uuid("event_id").notNull(),
+    occurrenceKey: text("occurrence_key").notNull(),
+    acceptedExecution: jsonb("accepted_execution").$type<AutomationAcceptedExecution>().notNull(),
+    status: text("status").notNull().default("queued"),
+    sessionId: uuid("session_id").references(() => sessions.id, { onDelete: "set null" }),
+    errorCode: text("error_code"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    triggerOccurrence: uniqueIndex("automation_runs_trigger_occurrence_uq").on(
+      table.triggerId,
+      table.occurrenceKey,
+    ),
+    workspaceStatus: index("automation_runs_workspace_status_idx").on(
+      table.workspaceId,
+      table.status,
+      table.createdAt,
+    ),
+    workspaceTriggerIdentity: uniqueIndex("automation_runs_workspace_trigger_id_uq").on(
+      table.workspaceId,
+      table.triggerId,
+      table.id,
+    ),
+    source: foreignKey({
+      columns: [table.workspaceId, table.sourceId],
+      foreignColumns: [automationSources.workspaceId, automationSources.id],
+      name: "automation_runs_source_fk",
+    }).onDelete("restrict"),
+    triggerSource: foreignKey({
+      columns: [table.workspaceId, table.triggerId, table.sourceId],
+      foreignColumns: [
+        automationTriggers.workspaceId,
+        automationTriggers.id,
+        automationTriggers.sourceId,
+      ],
+      name: "automation_runs_trigger_source_fk",
+    }).onDelete("restrict"),
+    triggerRevisionFk: foreignKey({
+      columns: [table.triggerId, table.triggerRevision],
+      foreignColumns: [automationTriggerRevisions.triggerId, automationTriggerRevisions.revision],
+      name: "automation_runs_trigger_revision_fk",
+    }).onDelete("restrict"),
+    event: foreignKey({
+      columns: [table.workspaceId, table.sourceId, table.eventId],
+      foreignColumns: [
+        automationTriggerEvents.workspaceId,
+        automationTriggerEvents.sourceId,
+        automationTriggerEvents.id,
+      ],
+      name: "automation_runs_event_fk",
+    }).onDelete("restrict"),
+    workspaceAccount: foreignKey({
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+      name: "automation_runs_workspace_account_fk",
+    }).onDelete("cascade"),
+    shape: check(
+      "automation_runs_shape_chk",
+      sql`${table.triggerRevision} > 0
+        and ${table.status} in ('queued', 'dispatching', 'dispatched', 'skipped', 'failed')
+        and octet_length(${table.occurrenceKey}) between 1 and 1024
+        and jsonb_typeof(${table.acceptedExecution}) = 'object'`,
+    ),
+  }),
+);
+
+export const automationRunEventLinks = pgTable(
+  "automation_run_event_links",
+  {
+    runId: uuid("run_id")
+      .notNull()
+      .references(() => automationRuns.id, { onDelete: "cascade" }),
+    eventId: uuid("event_id")
+      .notNull()
+      .references(() => automationTriggerEvents.id, { onDelete: "cascade" }),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    sourceId: uuid("source_id").notNull(),
+    triggerId: uuid("trigger_id").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    identity: primaryKey({ columns: [table.runId, table.eventId] }),
+    eventTrigger: uniqueIndex("automation_run_event_links_event_trigger_uq").on(
+      table.eventId,
+      table.triggerId,
+    ),
+    run: foreignKey({
+      columns: [table.workspaceId, table.triggerId, table.runId],
+      foreignColumns: [automationRuns.workspaceId, automationRuns.triggerId, automationRuns.id],
+      name: "automation_run_event_links_run_fk",
+    }).onDelete("cascade"),
+    event: foreignKey({
+      columns: [table.workspaceId, table.sourceId, table.eventId],
+      foreignColumns: [
+        automationTriggerEvents.workspaceId,
+        automationTriggerEvents.sourceId,
+        automationTriggerEvents.id,
+      ],
+      name: "automation_run_event_links_event_fk",
+    }).onDelete("cascade"),
+    workspaceAccount: foreignKey({
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+      name: "automation_run_event_links_workspace_account_fk",
+    }).onDelete("cascade"),
+  }),
+);
+
 export const workspacePacks = pgTable(
   "workspace_packs",
   {
@@ -9223,22 +12102,31 @@ export const rigs = pgTable(
     description: text("description"),
     // Attribution string: 'user:<subject>' | 'session:<id>' | 'system'.
     createdBy: text("created_by"),
-    // Inert migration-0230 identity foundation. Existing DAO/API/runtime paths
-    // omit these fields and keep their historical workspace authority.
     authorityScope: text("authority_scope").notNull().default("workspace"),
     authorityId: uuid("authority_id"),
     ownerOrganizationMembershipId: uuid("owner_organization_membership_id"),
     originWorkspaceId: uuid("origin_workspace_id"),
+    generation: bigint("generation", { mode: "number" }).notNull().default(1),
+    status: text("status").notNull().default("active"),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => ({
-    workspaceName: uniqueIndex("rigs_workspace_name_idx").on(table.workspaceId, table.name),
+    workspaceName: uniqueIndex("rigs_workspace_name_active_idx")
+      .on(table.workspaceId, table.name)
+      .where(sql`${table.authorityScope} = 'workspace' and ${table.status} = 'active'`),
+    organizationName: uniqueIndex("rigs_organization_name_active_idx")
+      .on(table.accountId, table.name)
+      .where(sql`${table.authorityScope} = 'organization' and ${table.status} = 'active'`),
+    userName: uniqueIndex("rigs_user_name_active_idx")
+      .on(table.accountId, table.ownerOrganizationMembershipId, table.name)
+      .where(sql`${table.authorityScope} = 'user' and ${table.status} = 'active'`),
     workspaceCreated: index("rigs_workspace_created_idx").on(table.workspaceId, table.createdAt),
     authorityShape: check(
       "rigs_authority_shape_check",
       sql`(
-          ${table.authorityScope} = 'workspace'
+          ${table.authorityScope} in ('organization', 'workspace')
           and ${table.authorityId} is null
           and ${table.ownerOrganizationMembershipId} is null
         ) or (
@@ -9249,7 +12137,14 @@ export const rigs = pgTable(
     ),
     authorityScopeValid: check(
       "rigs_authority_scope_check",
-      sql`${table.authorityScope} in ('workspace', 'user')`,
+      sql`${table.authorityScope} in ('organization', 'workspace', 'user')`,
+    ),
+    generationPositive: check("rigs_generation_check", sql`${table.generation} > 0`),
+    statusValid: check("rigs_status_check", sql`${table.status} in ('active', 'revoked')`),
+    revocationShape: check(
+      "rigs_revocation_check",
+      sql`(${table.status} = 'active' and ${table.revokedAt} is null)
+        or (${table.status} = 'revoked' and ${table.revokedAt} is not null)`,
     ),
     authority: foreignKey({
       name: "rigs_authority_fk",
@@ -9367,6 +12262,9 @@ export * from "./preference-registry-schema";
 export * from "./memory-governance-schema";
 export * from "./scoped-knowledge-schema";
 export * from "./task-notes-schema";
+export * from "./company-brain-context-selection-schema";
+export * from "./governed-learning-evaluator-schema";
+export * from "./governed-learning-activation-schema";
 export * from "./knowledge-source-sync-schema";
 export * from "./transcription-recordings-schema";
 export * from "./interaction-schema";