@opengeni/db 0.36.1 → 3.1.0-canary.0

package/dist/index.d.ts

@@ -1,17 +1,20 @@
-import { SessionGoalSnapshot } from "@opengeni/contracts";
-import type { AccessContext, AccessGrant, AccessPrincipalKind, ApiKey, AttemptToolResult, BillingBalance, CapabilityCatalogItem, CapabilityInstallation, CapabilityPack, CapabilitySource, ConnectionKind, ConnectionMetadata, ConnectionStatus, DocumentAuthorityKind, McpServerConnectionRef, FileAsset, FileUploadStatus, FirstPartyMcpToolName, HumanInputQuestion, HumanInputResponse, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemoryStatus, KnowledgeSourceRef, GitHubInstallationAuthorityKind, GitHubRepositoryScope, HostEventExportBatch, HostUsageExportBatch, ManagedAccount, ManagedOrganizationMembershipProjection, McpPersonalConnectionDelegation, Permission, PackInstallation, PackInstallationStatus, ResourceRef, SandboxBackend, SandboxOs, ScheduledTask, ScheduledTaskAction, ScheduledTaskActionKind, KnowledgeSourceSyncAction, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, SlackInstallationBinding, Session, SessionAuthorizationListScope, SessionListResponse, SessionEvent, SessionEventPayloadMode, SessionEventReadDirection, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalChangeKind, SessionGoalCreatedBy, SessionGoalMutationPolicy, SessionGoalRevision, SessionGoalStatus, SessionHumanInputRequest, LineageNode, SessionMcpApprovalPolicy, SessionSkill, SessionMcpServerMetadata, SessionStatus, SessionToolPolicy, SessionTurn, SessionQueueSnapshot, SessionSystemUpdate, SessionSystemUpdateKind, SystemUpdateClassification, SessionTurnSource, SessionTurnStatus, TurnInitiator, TurnInitiatorContext, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, ToolRef, ReasoningEffort, UsageEvent, Workspace, WorkspaceControlEvent, VariableSet, VariableSetSecret, VariableSetVariableMetadata, WorkspaceMember, WorkspaceMemoryPromptMode, WorkspaceRegisteredPack, Channel, Rig, RigProviderImage, RigProviderImages, RigVersion, RigChange, RigChangeKind, RigChangeStatus, RigCheck, NativeSnapshotDescriptor, TarWorkspaceArchiveDescriptor, WorkspaceArchiveDescriptor, ModalCheckpointProviderBinding, SandboxProviderContinuityRecovery } from "@opengeni/contracts";
-import { RequestHumanInteractionToolInput, XaiProviderAccountAuthoritySnapshotV1, type TimelineAnnotation } from "@opengeni/contracts";
+import { type ChildLifecycleSystemUpdateKind, type ChildRequiresActionRespondedByKind, SessionGoalSnapshot } from "@opengeni/contracts";
+import type { AccessContext, AccessGrant, AccessPrincipalKind, ApiKey, AttemptToolResult, BillingBalance, CapabilityCatalogItem, CapabilityInstallation, CapabilityPack, CapabilitySource, ConnectionKind, ConnectionMetadata, ConnectionStatus, DocumentAuthorityKind, McpServerConnectionRef, FileAsset, FileUploadStatus, FirstPartyMcpToolName, HumanInputQuestion, HumanInputResponse, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemoryStatus, KnowledgeSourceRef, GitHubInstallationAuthorityKind, GitHubRepositoryScope, HostEventExportBatch, HostUsageExportBatch, ManagedAccount, ManagedOrganizationMembershipProjection, McpPersonalConnectionDelegation, ModelContextContributionSummary, Permission, PersonalResourceAttachmentIntent, PackInstallation, PackInstallationStatus, ResourceRef, SandboxBackend, SandboxOs, ScheduledTask, ScheduledTaskAction, ScheduledTaskActionKind, KnowledgeSourceSyncAction, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunAcceptedExecution as ScheduledTaskRunAcceptedExecutionType, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, SlackInstallationBinding, Session, SessionAuthorizationListScope, SessionListResponse, SessionEvent, SessionEventPayloadMode, SessionEventReadDirection, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalChangeKind, SessionGoalCreatedBy, SessionGoalMutationPolicy, SessionGoalRevision, SessionGoalStatus, SessionHumanInputRequest, LineageNode, SessionMcpApprovalPolicy, SessionSkill, SessionMcpServerMetadata, SessionStatus, SessionToolPolicy, SessionTurn, SessionQueueSnapshot, SessionSystemUpdate, SessionSystemUpdateKind, SystemUpdateClassification, SessionTurnSource, SessionTurnStatus, TurnInitiator, TurnInitiatorContext, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, ToolRef, ReasoningEffort, UsageEvent, Workspace, WorkspaceControlEvent, VariableSet, VariableSetSecret, VariableSetVariableMetadata, WorkspaceMember, WorkspaceMemoryPromptMode, WorkspaceRegisteredPack, Channel, Rig, RigProviderImage, RigProviderImages, RigVersion, RigVerificationHealth, RigChange, RigChangeKind, RigChangeStatus, RigCheck, NativeSnapshotDescriptor, TarWorkspaceArchiveDescriptor, WorkspaceArchiveDescriptor, ModalCheckpointProviderBinding, SandboxProviderContinuityRecovery } from "@opengeni/contracts";
+import { type WorkspaceArchiveObjectRef, RequestHumanInteractionToolInput, XaiProviderAccountAuthoritySnapshotV1, type TimelineAnnotation } from "@opengeni/contracts";
 import { type LatencyMode, SessionSystemUpdatePayload, TurnExecutionPolicyV1 } from "@opengeni/contracts";
 import { type Settings } from "@opengeni/config";
 import { type CodexFetch } from "@opengeni/codex";
 export { isCodexBilledModel } from "@opengeni/codex";
+export * from "./pr-review.js";
 import { type SQL } from "drizzle-orm";
 export { frozenInitiatorForCommandActor, type FrozenTurnInitiator } from "./turn-initiator.js";
 export { LOSSLESS_TEXT_PREFIX } from "./lossless-json.js";
+import { type NewSessionDraftSnapshot } from "./new-session-drafts.js";
 import { type SessionDiscoveryControl, type SessionCommandActor, type SessionTurnAttemptOutcome } from "./session-control.js";
 import { type SessionRealtimeContinuityEntry } from "./session-realtime-context.js";
 import * as schema from "./schema.js";
 export { sql as dbSql } from "drizzle-orm";
+export * from "./child-lifecycle-notices.js";
 export * from "./session-control.js";
 export * from "./session-queue-commands.js";
 export * from "./session-realtime.js";
@@ -20,17 +23,30 @@ export * from "./session-realtime-ledger.js";
 export * from "./new-session-drafts.js";
 export * from "./workspace-instruction-policies.js";
 export * from "./company-profile.js";
+export * from "./company-profile-agent-admin.js";
 export * from "./workspace-learning-policy.js";
+export * from "./governed-learning-evaluator.js";
 export * from "./slack-task-policy.js";
 export * from "./preference-registry.js";
 export * from "./memory-governance.js";
 export * from "./memory-slack-delivery.js";
 export * from "./scoped-knowledge.js";
+export * from "./company-brain.js";
+export * from "./company-brain-governed-writes.js";
+export * from "./company-brain-context-selection.js";
 export * from "./knowledge-source-sync.js";
 export * from "./task-notes.js";
+export * from "./managed-human-provisioning.js";
+export * from "./organization-membership-backfill.js";
+export * from "./connection-tenancy-backfill.js";
 export * from "./generated-images.js";
 export * from "./slack-user-link-access.js";
+export * from "./slack-routing.js";
+export * from "./slack-routing-personal-workspace.js";
+export * from "./workspace-membership-permissions.js";
 export * from "./video-generation.js";
+export * from "./user-resource-authority.js";
+export * from "./connection-authority.js";
 export * from "./xai-subscription.js";
 export { interruptedToolCallResult } from "./session-tool-call-settlement.js";
 export { decryptEnvironmentValue, encryptEnvironmentValue } from "./environment-crypto.js";
@@ -41,12 +57,14 @@ export * from "./capability-integrations.js";
 export * from "./integration-bindings.js";
 export * from "./integration-facets.js";
 export * from "./insights.js";
+export * from "./organization-membership-lifecycle.js";
+export { rlsSubjectIdOrEmpty, subjectHasLiveWorkspaceAuthorityInScope, } from "./workspace-authority.js";
 export { memoryTextForStorage } from "./memory-domain.js";
 export { migrate, runMigrations } from "./migrate.js";
 export { provisionRoles, type ProvisionResult, type ProvisionRolesOptions, } from "./provision-roles.js";
 export * from "./memory-domain.js";
 import { type Database, type SessionActivityDatabase } from "./database.js";
-export { createDb, registerDbBinding, retrySessionActivityRls, rlsContextForWorkspace, rlsStrategyFor, setRlsContext, setSubjectRlsContext, withAccountRls, withDatabaseStatementTimeout, withRlsContext, withSessionActivityRlsContext, withSessionActivitySavepoint, withWorkspaceRls, withWorkspaceSessionActivityRls, withWorkspaceSubjectRls, withWorkspaceSubjectSessionActivityRls, withWorkspaceUsageLock, withSandboxProviderReadLock, SandboxProviderReadLockUnavailableError, type CreateDbOptions, type Database, type DbClient, type SessionActivityDatabase, type RlsContext, type SessionRlsActorContext, type RlsStrategy, type SandboxProviderReadLockIdentity, type UserLookup, } from "./database.js";
+export { createDb, registerDbBinding, retrySessionActivityRls, rlsContextForWorkspace, rlsStrategyFor, setRlsContext, setSubjectRlsContext, withAccountRls, withDatabaseStatementTimeout, withRlsContext, withSessionActivityRlsContext, withSessionActivitySavepoint, withWorkspaceRls, withWorkspaceSessionActivityRls, withWorkspaceSubjectRls, withWorkspaceSubjectSessionActivityRls, withWorkspaceUsageLock, withSandboxProviderReadLock, SandboxProviderReadLockUnavailableError, type CreateDbOptions, type Database, type DbClient, type SessionActivityDatabase, type RlsContext, type SessionRlsActorContext, type RlsStrategy, type SandboxProviderReadLockIdentity, type ManagedUserProfile, type UserLookup, type UserProfileLookup, } from "./database.js";
 export { withSessionRlsActorContext } from "./database.js";
 import { buildCodexTokenResolver as buildCodexTokenResolverCore, fetchCodexRateLimitResetCreditsForAccount as fetchCodexRateLimitResetCreditsForAccountCore, fetchCodexUsageForAccount as fetchCodexUsageForAccountCore, type CodexAccountUsageSnapshot, type CodexAuthDeps, type CodexCredentialForRun } from "./codex-token-resolver.js";
 import { buildConnectionTokenResolver as buildConnectionTokenResolverCore, type ConnectionBrokerDeps, type ConnectionCredentialForBroker, type ConnectionTokenResolverOptions } from "./connection-token-resolver.js";
@@ -232,6 +250,14 @@ export declare function resolveDocumentIndexAuthority(db: Database, input: {
     documentId: string;
 }): Promise<DocumentIndexAuthority | null>;
 export declare const allWorkspacePermissions: Permission[];
+/**
+ * Runtime capabilities for the authenticated managed human's personal
+ * workspace. This projection is deliberately not an administrative grant:
+ * workspace administration is a wildcard over member management and API-key
+ * delegation, either of which would let the owner create another principal
+ * with ambient access to the private workspace.
+ */
+export declare const managedPersonalWorkspacePermissions: Permission[];
 export declare const allAccountPermissions: Permission[];
 export type BootstrapWorkspaceInput = {
     accountExternalSource: string;
@@ -250,6 +276,7 @@ export declare function ensureManagedAccessForUser(db: Database, input: {
     userId: string;
     email: string;
     name: string;
+    emailVerified?: boolean;
 }): Promise<AccessContext>;
 export type ManagedAccessProvisioningResult = {
     accessContext: AccessContext;
@@ -259,6 +286,7 @@ export declare function ensureManagedAccessForUserWithOrganizationMemberships(db
     userId: string;
     email: string;
     name: string;
+    emailVerified?: boolean;
 }): Promise<ManagedAccessProvisioningResult>;
 export declare function getWorkspace(db: Database, workspaceId: string): Promise<Workspace | null>;
 export declare function getManagedAccount(db: Database, accountId: string): Promise<ManagedAccount | null>;
@@ -273,6 +301,20 @@ export declare function createWorkspace(db: Database, input: {
     externalId?: string | null;
     agentInstructions?: string | null;
 }): Promise<Workspace>;
+/**
+ * Create one shared workspace through the direct managed-human organization
+ * control plane. Organization authority is rechecked inside the lifecycle
+ * function, the operation id is replay-safe, and no operational
+ * workspace_memberships row is created for the actor.
+ */
+export declare function createOrganizationSharedWorkspace(db: Database, input: {
+    organizationId: string;
+    actorSubjectId: string;
+    name: string;
+    slug?: string | null;
+    agentInstructions?: string | null;
+    operationId: string;
+}): Promise<Workspace>;
 export declare function grantWorkspaceAccess(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -281,18 +323,55 @@ export declare function grantWorkspaceAccess(db: Database, input: {
     role?: string;
     permissions: Permission[];
 }): Promise<void>;
+/**
+ * Organization control-plane metadata update for one shared workspace. This
+ * capability never creates a workspace membership or an operational grant for
+ * the actor; the database excludes every Personal workspace before mutation.
+ */
+export declare function updateOrganizationSharedWorkspace(db: Database, input: {
+    organizationId: string;
+    workspaceId: string;
+    actorSubjectId: string;
+    name?: string;
+    slug?: string | null;
+    agentInstructions?: string | null;
+}): Promise<Workspace>;
+/** Same authority as metadata administration, preserving the canonical
+ * workspace-settings merge and inference-control lock path. */
+export declare function updateOrganizationSharedWorkspaceSettings(db: Database, input: {
+    organizationId: string;
+    workspaceId: string;
+    actorSubjectId: string;
+    patch: Record<string, unknown>;
+}): Promise<Workspace>;
+/** Assign or update one active organization member in one shared workspace. */
+export declare function upsertOrganizationSharedWorkspaceMember(db: Database, input: {
+    organizationId: string;
+    workspaceId: string;
+    actorSubjectId: string;
+    targetOrganizationMembershipId: string;
+    subjectLabel?: string | null;
+    role?: string;
+    permissions: Permission[];
+    requireExisting: boolean;
+}): Promise<WorkspaceMember>;
 export declare function updateWorkspace(db: Database, workspaceId: string, input: {
     name?: string;
     slug?: string | null;
     agentInstructions?: string | null;
 }): Promise<Workspace>;
-export declare function updateWorkspaceSettings(db: Database, workspaceId: string, patch: Record<string, unknown>): Promise<Workspace>;
+export declare function updateWorkspaceSettings(db: Database, workspaceId: string, patch: Record<string, unknown>, options?: {
+    /**
+     * Bound the workspace control prefix wait (request-scoped API callers pass
+     * `workspaceControlRequestLockTimeoutMs()`); omit for lifecycle callers.
+     */
+    controlLockTimeoutMs?: number;
+}): Promise<Workspace>;
 export declare function setWorkspaceDefaultRig(db: Database, workspaceId: string, rigId: string | null): Promise<Workspace>;
 export declare function getWorkspaceGrant(db: Database, subjectId: string, workspaceId: string, provenance?: {
     principalKind?: AccessPrincipalKind;
 }): Promise<AccessGrant | null>;
 export declare function listWorkspaceMembers(db: Database, workspaceId: string): Promise<WorkspaceMember[]>;
-export declare function removeWorkspaceMember(db: Database, workspaceId: string, subjectId: string): Promise<boolean>;
 /**
  * Resolve a managed user email to its user id.
  *
@@ -311,12 +390,26 @@ export declare function removeWorkspaceMember(db: Database, workspaceId: string,
  * unknown users are deferred.
  */
 export declare function getManagedUserByEmail(db: Database, email: string): Promise<string | null>;
+/**
+ * Resolve the safe profile fields organization administrators need to manage
+ * their own roster. Embedded deployments can provide the same projection
+ * through `userProfileLookup` without exposing their identity store schema.
+ */
+export declare function getManagedUserProfilesByIds(db: Database, userIds: readonly string[]): Promise<Array<{
+    id: string;
+    name: string | null;
+    email: string;
+}>>;
 export declare function deleteWorkspace(db: Database, workspaceId: string): Promise<void>;
 export type TemporalScheduleCleanupClaim = {
     id: string;
     accountId: string;
     workspaceId: string;
     temporalScheduleId: string;
+    scheduledTaskId: string | null;
+    connectorCleanupSubjectId: string | null;
+    connectorCleanupSnapshot: unknown | null;
+    connectorCleanupCompletedAt: Date | null;
     claimId: string;
     attemptCount: number;
 };
@@ -324,7 +417,7 @@ export type DeleteWorkspaceIfQuiescentResult = {
     status: "deleted";
     temporalScheduleCleanups: TemporalScheduleCleanupClaim[];
 } | {
-    status: "not_found" | "only_workspace" | "active_sessions" | "active_video_generations" | "live_sandboxes";
+    status: "not_found" | "only_workspace" | "active_sessions" | "active_video_generations" | "active_background_commands" | "live_sandboxes";
 };
 /**
  * Atomically prove a workspace has no live runtime ownership and delete it.
@@ -355,10 +448,16 @@ export declare function settleTemporalScheduleCleanup(db: Database, input: {
     claimId: string;
     error?: string | null;
 }): Promise<boolean>;
+/** Persist the connector half of a combined cleanup before attempting Temporal. */
+export declare function completeTemporalScheduleConnectorCleanup(db: Database, input: {
+    id: string;
+    claimId: string;
+}): Promise<boolean>;
 export declare function createApiKey(db: Database, input: {
     accountId: string;
     workspaceId?: string | null;
     name: string;
+    description?: string | null;
     prefix: string;
     keyHash: string;
     permissions: Permission[];
@@ -489,6 +588,7 @@ export type ModelCallFact = {
     pricedCostMicros: number;
     estimatedProviderCostMicros: number | null;
     pricingSource: "configured_list_price" | "gateway_reported" | null;
+    contextContributions: readonly ModelContextContributionSummary[] | null;
     occurredAt: Date;
     recordedAt: Date;
 };
@@ -510,6 +610,7 @@ export declare function recordModelCallFact(db: Database, input: {
     pricedCostMicros: number;
     estimatedProviderCostMicros?: number | null;
     pricingSource?: "configured_list_price" | "gateway_reported" | null;
+    contextContributions?: readonly ModelContextContributionSummary[] | null;
     inputTokens?: number | null;
     outputTokens?: number | null;
     cachedTokens?: number | null;
@@ -632,6 +733,12 @@ export type UpdateScheduledTaskInput = Partial<{
     variableSetId: string | null;
     rigId: string | null;
     metadata: Record<string, unknown>;
+    refreshPersonalResourceAuthority: boolean;
+    cloneConnectionAuthorityFromRevision: number;
+    clonePersonalResourceAuthorityFromRevision: number;
+    authorityUpdatedBy: TurnInitiator;
+    authorityUpdatedByContext: TurnInitiatorContext;
+    authorityUpdatedByActor: AgentSessionCreationActor | null;
 }>;
 export type CreatePackInstallationInput = {
     accountId: string;
@@ -778,6 +885,25 @@ export type PersistProviderOAuthConnectionInput = CreateConnectionInput & {
     providerPrincipalId: string;
     requestedConnectionId?: string;
     requestedConnectionVersion?: number;
+    /**
+     * Require this exact subject to retain live workspace authority in the same
+     * transaction that persists the credential. This is only a consistency
+     * fence: the caller must separately prove that the subject is the
+     * authenticated managed human before opting in.
+     */
+    requireLiveUserAuthority?: boolean;
+    /** Permission that must remain present while the owner row is locked. */
+    requiredLiveUserPermission?: "connections:write";
+    /**
+     * Permit the canonical managed-human personal-workspace exception when no
+     * ordinary membership row exists. The caller must have authenticated that
+     * exact human before opting in.
+     */
+    allowCanonicalPersonalWorkspaceOwner?: boolean;
+    /** Keep at most one non-revoked provider principal for this owner/family. */
+    exclusiveProviderPrincipalPerOwner?: boolean;
+    /** Existing values for these metadata keys survive exact-principal convergence. */
+    preserveExistingMetadataKeys?: readonly string[];
 };
 export type UpdateSlackBotDocumentDestinationInput = {
     accountId: string;
@@ -817,6 +943,58 @@ export declare class ConnectionDisconnectGenerationError extends Error {
     readonly code = "CONNECTION_GENERATION_CHANGED";
     constructor();
 }
+export type PersonalGitHubRepositoryPermissions = {
+    pull: boolean;
+    push: boolean;
+    admin: boolean;
+    maintain: boolean;
+    triage: boolean;
+};
+export type PersonalGitHubSelectedRepositoryRecord = {
+    repositoryId: string;
+    fullName: string;
+    canonicalUrl: string;
+    defaultBranch: string;
+    visibility: "public" | "private" | "internal";
+    private: boolean;
+    archived: boolean;
+    disabled: boolean;
+    permissions: PersonalGitHubRepositoryPermissions;
+    selectedAccess: "read" | "write";
+    selectionGeneration: number;
+    selectedAt: string;
+    lastVerifiedAt: string;
+};
+export type PersonalGitHubRepositorySelectionState = {
+    connectionAuthorityGeneration: number;
+    credentialBindingId: string;
+    providerPrincipalId: string;
+    selectionGeneration: number;
+    repositories: PersonalGitHubSelectedRepositoryRecord[];
+};
+export type PersonalGitHubVerifiedRepositoryInput = Omit<PersonalGitHubSelectedRepositoryRecord, "selectionGeneration" | "selectedAt">;
+export type PersonalGitHubRepositorySelectionMutationInput = {
+    accountId: string;
+    originWorkspaceId: string;
+    subjectId: string;
+    connectionId: string;
+    expectedConnectionAuthorityGeneration: number;
+    expectedSelectionGeneration: number;
+    idempotencyKey: string;
+    repositories: PersonalGitHubVerifiedRepositoryInput[];
+};
+export declare class PersonalGitHubRepositorySelectionChangedError extends Error {
+    readonly code = "PERSONAL_GITHUB_REPOSITORY_SELECTION_CHANGED";
+    constructor();
+}
+export declare class PersonalGitHubRepositorySelectionIdempotencyError extends Error {
+    readonly code = "PERSONAL_GITHUB_REPOSITORY_IDEMPOTENCY_KEY_REUSED";
+    constructor();
+}
+export declare class PersonalGitHubRepositorySelectionUnavailableError extends Error {
+    readonly code = "PERSONAL_GITHUB_REPOSITORY_SELECTION_UNAVAILABLE";
+    constructor();
+}
 /** Server-owned verification facts; public schemas expose them read-only and nullable. */
 export type ConnectionMetadataWithVerification = ConnectionMetadata & {
     verifiedInstallAt: string | null;
@@ -994,6 +1172,8 @@ export type RegistryCapabilityCatalogItemInput = {
     scopesHint?: string[];
     homepageUrl?: string | null;
     installUrl?: string | null;
+    /** Curated catalog grouping. Defaults to the registry-wide "integrations". */
+    category?: string | null;
     tags?: string[];
     metadata?: Record<string, unknown>;
 };
@@ -1178,7 +1358,7 @@ export type EnqueueSessionTurnInput = {
     temporalWorkflowId: string;
     source: SessionTurnSource;
     prompt: string;
-    turnInstructions?: string | null;
+    modelContext?: string | null;
     resources: ResourceRef[];
     tools: ToolRef[];
     toolsProvided?: boolean;
@@ -1196,15 +1376,12 @@ export type EnqueueSessionTurnInput = {
     /** Steer inserts before all waiting prompts; Send appends after them. */
     placement?: "head" | "tail";
 };
-/**
- * Worker-only turn projection. Host instructions are durable execution input,
- * never part of the public SessionTurn/queue/HTTP contract.
- */
+/** Worker-only turn projection with causal authority omitted from public APIs. */
 export type SessionTurnForExecution = SessionTurn & {
-    turnInstructions: string | null;
     personalConnectionDelegations: McpPersonalConnectionDelegation[];
     /** Worker-only causal authority; never inferred from the current worker. */
     initiatingHumanSubjectId: string | null;
+    scheduledTaskRunId: string | null;
     xaiProviderAccountAuthoritySnapshot: XaiProviderAccountAuthoritySnapshotV1;
     goalSnapshot: SessionGoalSnapshot;
 };
@@ -1251,10 +1428,41 @@ export declare function prepareGeneratedWorkspaceFile(db: Database, input: Prepa
 }>;
 export declare function getFile(db: Database, workspaceId: string, fileId: string): Promise<FileAsset | null>;
 export declare function requireFile(db: Database, workspaceId: string, fileId: string): Promise<FileAsset>;
+/**
+ * Subject-bound file read for user-visible and model-injection surfaces. The
+ * database predicate returns true for ordinary workspace files, but Drive-
+ * derived bytes require current per-object ACL evidence for every protecting
+ * mapping. Missing/stale/mixed denied mappings therefore look not found.
+ */
+export declare function requireFileForSubject(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string | null;
+    fileId: string;
+}): Promise<FileAsset>;
+/**
+ * Resolve a Document's immutable origin File through one database authority
+ * statement. The resolver proves target-workspace Document visibility, live
+ * portable-owner authority, and provider ACL before returning origin metadata;
+ * it never grants generic visibility into the origin workspace's Files.
+ */
+export declare function resolveDocumentOriginalFileForSubject(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    documentId: string;
+}): Promise<FileAsset | null>;
+/** Batch form of requireFileForSubject; unauthorized or missing ids are omitted. */
+export declare function getFilesForSubject(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string | null;
+    fileIds: readonly string[];
+}): Promise<FileAsset[]>;
 /** One RLS-scoped query for all attachment metadata needed by a model turn. */
 export declare function getFiles(db: Database, workspaceId: string, fileIds: readonly string[]): Promise<FileAsset[]>;
 /** Build the canonical user row with stable attachment refs, never inline bytes. */
-export declare function durableUserHistoryItem(prompt: string, resources: readonly ResourceRef[], annotations?: readonly TimelineAnnotation[]): Record<string, unknown>;
+export declare function durableUserHistoryItem(prompt: string, resources: readonly ResourceRef[], annotations?: readonly TimelineAnnotation[], modelContext?: string | null, goalSnapshot?: SessionGoalSnapshot): Record<string, unknown>;
 export type RetainedFileArtifact = {
     file: FileAsset;
     uploadStatus: FileUploadStatus | null;
@@ -1485,6 +1693,22 @@ export declare function markStaleRegistryCatalogItems(db: Database, activeKeys:
 }>, importBatchId: string): Promise<number>;
 export declare function upsertCapabilityCatalogItem(db: Database, input: CreateCapabilityCatalogItemInput): Promise<CapabilityCatalogItem>;
 export declare function listCapabilityCatalogItems(db: Database, workspaceId: string): Promise<CapabilityCatalogItem[]>;
+/**
+ * Declarative OAuth profile carried by a global (registry-imported) catalog
+ * row for an exact MCP URL, or null when no row declares one. Only global
+ * rows are consulted: a workspace-created row must not steer another
+ * workspace's OAuth flow, and the OAuth client applies the profile as a
+ * narrowing constraint over its defaults.
+ *
+ * A stale row's profile still applies deliberately: staleness hides the row
+ * from the browse surface, but dropping its declared fences on staleness
+ * would loosen an ownership or origin constraint. Non-stale rows win when a
+ * duplicate `mcp_url` exists under two provider domains; the remaining id
+ * tie-break is only for determinism. The value is returned raw (whatever the
+ * row carries) so the caller's validation decides how a malformed profile
+ * fails; absence of the key is the only null.
+ */
+export declare function getGlobalCatalogOAuthProfile(db: Database, workspaceId: string, mcpUrl: string): Promise<unknown | null>;
 export declare function getCapabilityCatalogItem(db: Database, workspaceId: string, capabilityId: string): Promise<CapabilityCatalogItem | null>;
 /**
  * Install one immutable, already-validated Skill through the authoritative
@@ -1509,6 +1733,12 @@ export declare function disableCapabilityInstallation(db: Database, workspaceId:
 export declare function listCapabilityInstallations(db: Database, workspaceId: string): Promise<CapabilityInstallation[]>;
 export declare function getCapabilityInstallation(db: Database, workspaceId: string, capabilityId: string): Promise<CapabilityInstallation | null>;
 export declare function listEnabledMcpCapabilityServers(db: Database, workspaceId: string): Promise<EnabledMcpCapabilityServer[]>;
+/**
+ * Metadata-only projection of runnable capability MCP server ids. The query
+ * deliberately computes credential-presence booleans in PostgreSQL and never
+ * selects stored header ciphertext or connection-reference contents.
+ */
+export declare function listEnabledMcpCapabilityServerIds(db: Database, workspaceId: string): Promise<string[]>;
 /**
  * Decrypts an enabled capability MCP's stored credential headers. Returns
  * null when the server has none, and "unavailable" when headers exist but
@@ -1533,6 +1763,14 @@ export declare function createConnection(db: Database, input: CreateConnectionIn
 export declare function persistProviderOAuthConnection(db: Database, input: PersistProviderOAuthConnectionInput): Promise<ConnectionMetadataWithVerification | null>;
 export declare function listConnectionsMetadata(db: Database, workspaceId: string, subjectId?: string | null): Promise<ConnectionMetadataWithVerification[]>;
 export declare function getConnectionMetadata(db: Database, workspaceId: string, connectionId: string, subjectId?: string | null): Promise<ConnectionMetadataWithVerification | null>;
+export declare function getPersonalGitHubRepositorySelectionState(db: Database, input: {
+    accountId: string;
+    originWorkspaceId: string;
+    subjectId: string;
+    connectionId: string;
+}): Promise<PersonalGitHubRepositorySelectionState | null>;
+export declare function replacePersonalGitHubRepositorySelections(db: Database, input: PersonalGitHubRepositorySelectionMutationInput): Promise<PersonalGitHubRepositorySelectionState>;
+export declare function verifyPersonalGitHubRepositorySelections(db: Database, input: PersonalGitHubRepositorySelectionMutationInput): Promise<PersonalGitHubRepositorySelectionState>;
 export declare function updateConnection(db: Database, input: UpdateConnectionInput): Promise<ConnectionMetadataWithVerification | null>;
 /**
  * Updates only pre-validated workspace Slack-bot destination metadata while
@@ -1580,6 +1818,11 @@ export type SlackBotUserLink = {
     slackUserId: string;
     subjectId: string;
     linkedBySubjectId: string;
+    /**
+     * The exact Slack interaction id that durably claimed this identity's
+     * one-time onboarding hint, or `null` when the hint has not been shown.
+     */
+    firstTaskHintInteractionId: string | null;
     createdAt: Date;
     updatedAt: Date;
 };
@@ -1610,6 +1853,25 @@ export type SlackInteractionInboxEntry = {
     createdAt: Date;
     updatedAt: Date;
 };
+export type SlackAppHomeRefresh = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    slackTeamId: string;
+    slackUserId: string;
+    providerEventId: string;
+    providerViewHash: string | null;
+    desiredRevision: number;
+    processedRevision: number;
+    claimHolderId: string | null;
+    claimExpiresAt: Date | null;
+    attemptCount: number;
+    retryAt: Date | null;
+    lastErrorCode: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+};
 export type SlackInteraction = {
     id: string;
     accountId: string;
@@ -1632,6 +1894,11 @@ export type SlackInteraction = {
     deliveryRetryAt: Date | null;
     deliveryLastErrorCode: string | null;
     ackSlackMessageTs: string | null;
+    /**
+     * Frozen once: whether this interaction's acknowledgement renders the
+     * one-time onboarding hint. `null` means the decision is unresolved.
+     */
+    firstTaskHint: boolean | null;
     progressCount: number;
     terminalDeliveryState: "open" | "completed" | "failed" | "cancelled" | "blocked";
     createdAt: Date;
@@ -1671,9 +1938,63 @@ export type SlackInteractionActionHandle = {
     updatedAt: Date;
 };
 export declare function resolveSlackInstallationRoute(db: Database, slackTeamId: string): Promise<SlackInstallationRoute | null>;
-export declare function saveSlackBotUserLink(db: Database, input: Omit<SlackBotUserLink, "id" | "createdAt" | "updatedAt">): Promise<SlackBotUserLink>;
+export declare function saveSlackBotUserLink(db: Database, input: Omit<SlackBotUserLink, "id" | "createdAt" | "updatedAt" | "firstTaskHintInteractionId">): Promise<SlackBotUserLink>;
 export declare function getSlackBotUserLink(db: Database, workspaceId: string, connectionId: string, slackUserId: string): Promise<SlackBotUserLink | null>;
+/**
+ * Resolve, exactly once, whether one Slack interaction's acknowledgement
+ * renders the one-time onboarding hint, and freeze that answer on the
+ * interaction row.
+ *
+ * `slack_bot_post_operations` binds one operation id to one request digest that
+ * covers the message text, so an acknowledgement re-rendered after a crash, a
+ * lost provider response, or a replica race must produce the same bytes or the
+ * ledger rejects it. Rendering therefore reads a frozen fact instead of asking
+ * a mutable question: the first call decides, every later call replays the
+ * stored decision, and unlinking plus relinking the Slack identity cannot flip
+ * an acknowledgement that was already rendered.
+ *
+ * The per-identity claim row is the single source of truth and is replay-stable:
+ * the frozen answer is exactly "this identity's one claim names THIS
+ * interaction". At most one interaction per Slack identity per installation is
+ * therefore granted the hint, whichever resolver wins the claim, and the freeze
+ * is a separate compare-and-set whose losers read back the stored byte rather
+ * than their own recomputed one. This is deliberately not one transaction: the
+ * claim is a home-tenancy row and the freeze is a target-tenancy row, and one
+ * transaction carries one RLS scope. Failure raises instead of degrading to "no
+ * hint": a caller must never bind a post operation to text that depends on an
+ * unresolved answer.
+ */
+export declare function resolveSlackInteractionFirstTaskHint(db: Database, input: {
+    /** HOME: the installation workspace that owns the identity link. */
+    workspaceId: string;
+    connectionId: string;
+    slackUserId: string;
+    interactionId: string;
+    /**
+     * TARGET: the workspace that owns the interaction row. Defaults to HOME,
+     * which is what every caller means until routing exists.
+     */
+    interactionWorkspaceId?: string;
+}): Promise<boolean>;
 export declare function deleteSlackBotUserLink(db: Database, workspaceId: string, connectionId: string, slackUserId: string): Promise<boolean>;
+export declare function enqueueSlackAppHomeRefresh(db: Database, input: Pick<SlackAppHomeRefresh, "accountId" | "workspaceId" | "connectionId" | "slackTeamId" | "slackUserId" | "providerEventId" | "providerViewHash">): Promise<SlackAppHomeRefresh>;
+export declare function claimSlackAppHomeRefresh(db: Database, claimHolderId: string, claimLeaseMs: number): Promise<SlackAppHomeRefresh | null>;
+export declare function renewSlackAppHomeRefreshClaim(db: Database, input: {
+    refresh: Pick<SlackAppHomeRefresh, "id" | "accountId" | "workspaceId">;
+    claimHolderId: string;
+    claimLeaseMs: number;
+}): Promise<boolean>;
+export declare function settleSlackAppHomeRefresh(db: Database, input: {
+    refresh: Pick<SlackAppHomeRefresh, "id" | "accountId" | "workspaceId" | "desiredRevision">;
+    claimHolderId: string;
+    errorCode?: string | null;
+}): Promise<boolean>;
+export declare function releaseSlackAppHomeRefresh(db: Database, input: {
+    refresh: Pick<SlackAppHomeRefresh, "id" | "accountId" | "workspaceId" | "desiredRevision">;
+    claimHolderId: string;
+    errorCode: string;
+    retryAt: Date;
+}): Promise<boolean>;
 export declare function enqueueSlackInteractionInbox(db: Database, input: Omit<SlackInteractionInboxEntry, "id" | "status" | "claimHolderId" | "claimExpiresAt" | "attemptCount" | "retryAt" | "lastErrorCode" | "reactionContextCheckpoint" | "processedAt" | "createdAt" | "updatedAt">): Promise<{
     inserted: boolean;
     entry: SlackInteractionInboxEntry;
@@ -1696,12 +2017,36 @@ export declare function releaseSlackInteractionInbox(db: Database, input: {
     errorCode: string;
     retryAt: Date;
 }): Promise<boolean>;
-export declare function getOrCreateSlackInteraction(db: Database, input: Omit<SlackInteraction, "id" | "initiatingSlackUserId" | "sessionReservationId" | "sessionId" | "lastDeliveredSessionEventSequence" | "deliveryClaimHolderId" | "deliveryClaimExpiresAt" | "deliveryAttemptCount" | "deliveryRetryAt" | "deliveryLastErrorCode" | "ackSlackMessageTs" | "progressCount" | "terminalDeliveryState" | "createdAt" | "updatedAt"> & {
+export declare function getOrCreateSlackInteraction(db: Database, input: Omit<SlackInteraction, "id" | "initiatingSlackUserId" | "sessionReservationId" | "sessionId" | "lastDeliveredSessionEventSequence" | "deliveryClaimHolderId" | "deliveryClaimExpiresAt" | "deliveryAttemptCount" | "deliveryRetryAt" | "deliveryLastErrorCode" | "ackSlackMessageTs" | "firstTaskHint" | "progressCount" | "terminalDeliveryState" | "createdAt" | "updatedAt"> & {
     initiatingSlackUserId?: string | null;
 }): Promise<{
     created: boolean;
     interaction: SlackInteraction;
 }>;
+/**
+ * Connection-scoped thread continuation. `slack_interactions_route_uq` is
+ * `(connection_id, route_key)`, so one Slack thread maps to exactly one
+ * interaction across every workspace this installation can address. The
+ * content-free tenancy probe resolves which workspace that is; the full row is
+ * then read under that workspace's own RLS scope, so nothing is widened.
+ *
+ * `accountId` is the organization the caller is acting for, and the probe is
+ * fenced on it: crossing workspaces within one organization is the whole point,
+ * crossing organizations never is.
+ */
+export declare function getSlackInteractionByConnectionRoute(db: Database, input: {
+    accountId: string;
+    connectionId: string;
+    routeKey: string;
+}): Promise<SlackInteraction | null>;
+/**
+ * Workspace-fenced route lookup.
+ *
+ * This is NOT the thread-continuation read: `slack_interactions_route_uq` is
+ * `(connection_id, route_key)` and therefore connection-global, so a thread that
+ * belongs to another workspace this installation can address is invisible here.
+ * Use `getSlackInteractionByConnectionRoute` for continuation.
+ */
 export declare function getSlackInteractionByRoute(db: Database, workspaceId: string, connectionId: string, routeKey: string): Promise<SlackInteraction | null>;
 export declare function getSlackInteractionById(db: Database, input: {
     accountId: string;
@@ -2028,6 +2373,7 @@ export declare function loadConnectionCredentialForBroker(db: Database, settings
     kind?: ConnectionKind;
     subjectId?: string | null;
     allowSubjectOwned?: boolean;
+    expectedAuthorityGeneration?: number;
 }): Promise<ConnectionCredentialForBroker | null>;
 export declare function workspaceVercelAiGatewayConnectionActive(db: Database, workspaceId: string): Promise<boolean>;
 /** Metadata-only capability revision input; never selects/decrypts the API key. */
@@ -2056,6 +2402,7 @@ export declare function recordConnectionTokenRefresh(db: Database, input: {
     credentialEncrypted: string;
     expiresAt: Date | null;
     grantedScopes?: string[];
+    metadata?: Record<string, unknown>;
     lastRefreshAt: Date;
     subjectId?: string | null;
 }): Promise<boolean>;
@@ -2193,7 +2540,28 @@ export declare function listSocialPosts(db: Database, options: {
 export declare function createScheduledTask(db: Database, input: CreateScheduledTaskInput): Promise<ScheduledTask>;
 export declare function updateScheduledTask(db: Database, workspaceId: string, taskId: string, input: UpdateScheduledTaskInput): Promise<ScheduledTask>;
 export declare function getScheduledTask(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask | null>;
+/** Internal delete-recovery lookup; public list/get surfaces hide tombstones. */
+export declare function getScheduledTaskIncludingDeleted(db: Database, workspaceId: string, taskId: string): Promise<(ScheduledTask & {
+    deletedAt: string | null;
+}) | null>;
+/** Task-first deletion lock; call only inside the surrounding lifecycle transaction. */
+export declare function getScheduledTaskIncludingDeletedForUpdate(db: Database, workspaceId: string, taskId: string): Promise<(ScheduledTask & {
+    deletedAt: string | null;
+}) | null>;
 export declare function getScheduledTaskPersonalConnectionDelegations(db: Database, workspaceId: string, taskId: string): Promise<McpPersonalConnectionDelegation[]>;
+/**
+ * Lock and project the exact mutable incident-task authority inside a caller's
+ * dispatch/claim transaction. Returning the frozen personal delegation tuple
+ * from the same row prevents a later task edit from mixing with the task
+ * snapshot used for preflight.
+ */
+export declare function requireScheduledTaskIncidentAuthorityInTransaction(tx: Database, input: {
+    workspaceId: string;
+    taskId: string;
+}): Promise<{
+    task: ScheduledTask;
+    personalConnectionDelegations: McpPersonalConnectionDelegation[];
+}>;
 export declare function getScheduledTaskXaiProviderAccountAuthoritySnapshot(db: Database, workspaceId: string, taskId: string): Promise<XaiProviderAccountAuthoritySnapshotV1>;
 export declare function requireScheduledTask(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask>;
 export declare class ScheduledTaskTargetConflictError extends Error {
@@ -2219,18 +2587,114 @@ export declare function listScheduledTasks(db: Database, workspaceId: string, li
 export declare function listKnowledgeSourceSyncTasksForConnection(db: Database, workspaceId: string, connectionId: string, pageSize?: number): Promise<Array<ScheduledTask & {
     action: KnowledgeSourceSyncAction;
 }>>;
-export declare function deleteScheduledTask(db: Database, workspaceId: string, taskId: string): Promise<void>;
+export declare function deleteScheduledTask(db: Database, workspaceId: string, taskId: string, options?: {
+    connectorCleanupSubjectId?: string;
+    connectorCleanupCompleted?: boolean;
+    expectedAuthorityRevision?: number;
+    expectedExecutionDigest?: string;
+}): Promise<{
+    cleanup: TemporalScheduleCleanupClaim | null;
+    changed: boolean;
+}>;
 export declare function createScheduledTaskRun(db: Database, input: {
+    runId?: string;
     workspaceId: string;
     taskId: string;
+    /** Exact task snapshot read by the dispatching worker. */
+    taskAuthorityRevision?: number | null;
+    /** Exact task snapshot read by the dispatching worker. */
+    taskExecutionDigest?: string | null;
     triggerType: ScheduledTaskTriggerType;
     /** Stable Temporal workflow/activity producer identity for replay repair. */
     producerKey?: string | null;
     scheduledAt?: Date | null;
     firedAt?: Date;
+    acceptedExecutionSnapshot?: ScheduledTaskRunAcceptedExecutionType | null;
 }): Promise<ScheduledTaskRun>;
+export declare function getScheduledTaskRunAcceptedExecution(db: Database, input: {
+    workspaceId: string;
+    runId: string;
+}): Promise<ScheduledTaskRunAcceptedExecutionType | null>;
+export declare function getScheduledTaskRunByProducerKey(db: Database, input: {
+    workspaceId: string;
+    taskId: string;
+    triggerType: ScheduledTaskTriggerType;
+    producerKey: string;
+}): Promise<ScheduledTaskRun | null>;
+export type ScheduledTaskRunPersonalResourceAuthority = {
+    taskId: string;
+    taskAuthorityRevision: number;
+    executionDigest: string;
+    initiatingHumanSubjectId: string;
+    resources: Array<{
+        resourceKind: "variable_set" | "rig";
+        resourceId: string;
+        resourceVersionId: string;
+        selectionSources: string[];
+        authorityId: string;
+        authorityGeneration: number;
+        grantId: string;
+        grantGeneration: number;
+        grantMode: "once" | "session" | "always";
+    }>;
+};
+export declare function getScheduledTaskRunPersonalResourceAuthority(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    runId: string;
+}): Promise<ScheduledTaskRunPersonalResourceAuthority | null>;
+export declare function materializeScheduledTaskReusableSessionFromRun(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    taskId: string;
+    runId: string;
+    sessionId: string;
+    sourceTaskAuthorityRevision: number;
+    sourceExecutionDigest: string;
+}): Promise<number>;
+export declare function bindScheduledTaskRunSessionInTransaction(tx: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    runId: string;
+    sessionId: string;
+}): Promise<void>;
+export declare function getScheduledTaskPersonalResourceAuthoritySubject(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    taskId: string;
+    taskAuthorityRevision: number;
+}): Promise<string | null>;
+export declare function getScheduledTaskRevisionAuthoritySubject(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    taskId: string;
+    taskAuthorityRevision: number;
+}): Promise<string | null>;
+export declare function getScheduledTaskRevisionAuthority(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    taskId: string;
+    taskAuthorityRevision: number;
+}): Promise<{
+    subjectId: string;
+    organizationMembershipId: string;
+    membershipAuthorizationRevision: number;
+} | null>;
 /** Failure settlement must not rewrite a source already committed as dispatched. */
 export declare function markScheduledTaskRunFailedIfQueued(db: Database, workspaceId: string, runId: string, error: string): Promise<void>;
+export declare function markScheduledTaskRunSkippedIfQueued(db: Database, input: {
+    workspaceId: string;
+    runId: string;
+    sessionId: string;
+    error: string;
+}): Promise<void>;
+/** Claim-time stale-authority settlement; no model/tool/sandbox work has started. */
+export declare function markScheduledTaskRunAuthorityRejectedInTransaction(tx: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    runId: string;
+    error?: string;
+}): Promise<void>;
 export declare function updateScheduledTaskRun(db: Database, workspaceId: string, runId: string, input: Partial<{
     status: ScheduledTaskRunStatus;
     sessionId: string | null;
@@ -2246,13 +2710,17 @@ export declare function settleScheduledTaskRunInTransaction(tx: Database, input:
     workspaceId: string;
     runId: string;
     sessionId: string;
-    triggerEventId: string;
-    status: "dispatched";
+    triggerEventId: string | null;
+    status: "dispatched" | "skipped";
+    error?: string | null;
 }): Promise<void>;
 export declare function listScheduledTaskRuns(db: Database, workspaceId: string, taskId: string, limit?: number): Promise<ScheduledTaskRun[]>;
 export declare function createVariableSet(db: Database, input: {
     accountId: string;
     workspaceId: string;
+    scope?: VariableSet["scope"];
+    subjectId?: string;
+    allowOrganization?: boolean;
     name: string;
     description?: string | null;
     variables?: Array<{
@@ -2260,9 +2728,14 @@ export declare function createVariableSet(db: Database, input: {
         valueEncrypted: string;
     }>;
 }): Promise<VariableSet>;
-export declare function listVariableSets(db: Database, workspaceId: string): Promise<VariableSet[]>;
-export declare function getVariableSet(db: Database, workspaceId: string, variableSetId: string): Promise<VariableSet | null>;
-export declare function getVariableSetByName(db: Database, workspaceId: string, name: string): Promise<VariableSet | null>;
+export type VariableSetAccessContext = {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+};
+export declare function listVariableSets(db: Database, context: VariableSetAccessContext): Promise<VariableSet[]>;
+export declare function getVariableSet(db: Database, context: VariableSetAccessContext, variableSetId: string): Promise<VariableSet | null>;
+export declare function getVariableSetByName(db: Database, context: VariableSetAccessContext, name: string, scope?: VariableSet["scope"]): Promise<VariableSet | null>;
 export type VariableSetSecretAuditActor = {
     kind: "subject";
 } | {
@@ -2294,22 +2767,35 @@ export declare function readVariableSetSecretAtomically(db: Database, input: {
     actor: VariableSetSecretAuditActor;
     decrypt: (valueEncrypted: string) => string;
 }): Promise<VariableSetSecret | null>;
-export declare function updateVariableSet(db: Database, workspaceId: string, variableSetId: string, input: {
+export declare function updateVariableSet(db: Database, context: VariableSetAccessContext, variableSetId: string, input: {
     name?: string;
     description?: string | null;
+    allowOrganization?: boolean;
 }): Promise<VariableSet>;
-export declare function deleteVariableSet(db: Database, workspaceId: string, variableSetId: string): Promise<boolean>;
-export declare function countVariableSets(db: Database, workspaceId: string): Promise<number>;
+export declare class VariableSetAttachedError extends Error {
+    readonly name = "VariableSetAttachedError";
+    constructor(cause?: unknown);
+}
+export declare function deleteVariableSet(db: Database, context: VariableSetAccessContext, variableSetId: string, options?: {
+    allowOrganization?: boolean;
+}): Promise<boolean>;
+export declare function countVariableSets(db: Database, context: VariableSetAccessContext, scope?: VariableSet["scope"]): Promise<number>;
 export declare function countScheduledTasksUsingVariableSet(db: Database, workspaceId: string, variableSetId: string): Promise<number>;
 export declare function countActiveSessionsUsingVariableSet(db: Database, workspaceId: string, variableSetId: string): Promise<number>;
 export declare function setVariableSetVariable(db: Database, input: {
     accountId: string;
     workspaceId: string;
+    subjectId: string;
     variableSetId: string;
     name: string;
     valueEncrypted: string;
+    allowOrganization?: boolean;
 }): Promise<VariableSetVariableMetadata>;
-export declare function deleteVariableSetVariable(db: Database, workspaceId: string, variableSetId: string, name: string): Promise<boolean>;
+export declare function deleteVariableSetVariable(db: Database, input: VariableSetAccessContext & {
+    variableSetId: string;
+    name: string;
+    allowOrganization?: boolean;
+}): Promise<boolean>;
 export declare class RigChangeTransitionError extends Error {
     readonly changeId: string;
     readonly fromStatus: string;
@@ -2338,14 +2824,22 @@ export type RigVersionContentInput = {
 export declare function createRig(db: Database, input: {
     accountId: string;
     workspaceId: string;
+    scope?: Rig["scope"];
+    subjectId?: string;
+    allowOrganization?: boolean;
     name: string;
     description?: string | null;
     createdBy?: string | null;
     initialVersion?: RigVersionContentInput;
 }): Promise<Rig>;
-export declare function listRigs(db: Database, workspaceId: string): Promise<Rig[]>;
-export declare function getRig(db: Database, workspaceId: string, rigId: string): Promise<Rig | null>;
-export declare function getRigByName(db: Database, workspaceId: string, name: string): Promise<Rig | null>;
+export type RigAccessContext = {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+};
+export declare function listRigs(db: Database, access: string | RigAccessContext): Promise<Rig[]>;
+export declare function getRig(db: Database, access: string | RigAccessContext, rigId: string): Promise<Rig | null>;
+export declare function getRigByName(db: Database, access: string | RigAccessContext, name: string, scope?: Rig["scope"]): Promise<Rig | null>;
 export declare function updateRig(db: Database, workspaceId: string, rigId: string, input: {
     name?: string;
     description?: string | null;
@@ -2355,6 +2849,14 @@ export declare function deleteRigIfNoActiveSessions(db: Database, workspaceId: s
     deleted: boolean;
     activeSessionCount: number;
 }>;
+export declare function updateScopedRig(db: Database, access: RigAccessContext, rigId: string, input: {
+    name?: string;
+    description?: string | null;
+    allowOrganization?: boolean;
+}): Promise<Rig>;
+export declare function revokeScopedRig(db: Database, access: RigAccessContext, rigId: string, options?: {
+    allowOrganization?: boolean;
+}): Promise<void>;
 export declare class ChannelNameConflictError extends Error {
     constructor(name: string);
 }
@@ -2373,14 +2875,21 @@ export declare function getChannel(db: Database, workspaceId: string, channelId:
 export declare function updateChannel(db: Database, workspaceId: string, channelId: string, input: {
     name?: string | undefined;
     description?: string | null | undefined;
+    pinned?: boolean | undefined;
 }): Promise<Channel | null>;
 export declare function deleteChannel(db: Database, workspaceId: string, channelId: string): Promise<boolean>;
+/**
+ * Replaces the complete project order in one workspace-scoped transaction.
+ * Callers must supply every current project exactly once so a stale drag can
+ * never silently discard a concurrently created project.
+ */
+export declare function reorderChannels(db: Database, workspaceId: string, channelIds: readonly string[]): Promise<Channel[] | null>;
 export declare function setSessionChannel(db: Database, input: {
     workspaceId: string;
     sessionId: string;
     channelId: string | null;
 }): Promise<boolean>;
-export declare function countRigs(db: Database, workspaceId: string): Promise<number>;
+export declare function countRigs(db: Database, access: string | RigAccessContext, scope?: Rig["scope"]): Promise<number>;
 export declare function countSessionsUsingRig(db: Database, workspaceId: string, rigId: string): Promise<number>;
 export declare function createRigVersion(db: Database, workspaceId: string, rigId: string, input: RigVersionContentInput, options?: {
     activate?: boolean;
@@ -2416,6 +2925,29 @@ export declare function listRigVersionMonitoringSummaries(db: Database, workspac
     total: number;
 }>;
 export declare function getRigVersion(db: Database, workspaceId: string, rigId: string, versionId: string): Promise<RigVersion | null>;
+/** Credential-free exact retained Rig metadata under the target workspace's
+ * scoped organization/user authority. Unlike the physical-workspace helpers,
+ * this remains valid for a personal-origin Rig granted into another workspace. */
+export declare function getScheduledScopedRigVersionMetadata(db: Database, access: RigAccessContext, rigId: string, versionId: string): Promise<{
+    name: string;
+    version: RigVersion;
+    health: RigVerificationHealth;
+} | null>;
+export declare function materializeRigVersionForAttempt(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string | null;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+}): Promise<{
+    rigName: string;
+    version: RigVersion;
+} | null>;
+/** Metadata-only health for one exact frozen rig version. Never reads setup,
+ * variable values, credential material, or the currently active version. */
+export declare function getRigVersionHealth(db: Database, workspaceId: string, rigId: string, versionId: string): Promise<RigVerificationHealth | null>;
 export declare function getRigVersionById(db: Database, workspaceId: string, versionId: string): Promise<RigVersion | null>;
 export type RigProviderImageBuildClaim = {
     status: "claimed";
@@ -2491,16 +3023,286 @@ export declare function beginRigChangeVerificationAttempt(db: Database, workspac
     startedAt: string;
     allowAlreadyVerifying?: boolean;
 }): Promise<RigChange>;
+export declare function getScheduledVariableSetExpectedGenerationForAttempt(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    /** Actor subject for RLS (a service initiator on pure scheduled turns). */
+    subjectId: string;
+    /** Exact causal human, or null for a pure service attempt (workspace/org sets only). */
+    initiatingHumanSubjectId: string | null;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    variableSetId: string;
+}): Promise<number | null>;
 /**
  * The ONLY helper that selects value_encrypted. Used exclusively by the worker
  * activity that materializes a sandbox for a run whose session carries an
  * variableSet attachment. Do not call from API routes: values are write-only.
  */
-export declare function getVariableSetValuesForRun(db: Database, workspaceId: string, variableSetId: string): Promise<{
+/**
+ * Live session authority epoch, for stamping viewer-facing claims (stream
+ * tokens, viewer holders). Identity/epoch only; NULL when the session is not
+ * visible in this workspace.
+ */
+export declare function getSessionAuthorityEpoch(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+}): Promise<number | null>;
+/**
+ * ORACLE, NOT AN AUTHORIZATION. It sets `opengeni.subject_id` from its own
+ * argument, so `list_self_organization_memberships`' `42501` guard is satisfied
+ * for whatever subject the caller NAMES: it answers for ANY subject and cannot
+ * establish who the caller is. Passing it a request-derived subject is a
+ * vulnerability. Call it only about a subject you are already entitled to ask
+ * about — one authenticated out of band, or the frozen owner of a delegation
+ * you already hold. The `named` prefix is the warning: you are naming a subject,
+ * not proving you are one.
+ *
+ * When the subject IS the caller, use {@link subjectHasLiveWorkspaceAuthorityInScope}
+ * instead: it refuses to set the subject GUC at all, so the oracle shape is
+ * unrepresentable there. Both exist on purpose — some callers legitimately ask
+ * about a non-caller subject, which the in-scope variant cannot express.
+ *
+ * The authority rule itself lives in that in-scope variant; this is a scope
+ * wrapper over it, so there is one implementation.
+ *
+ * The prior `opengeni.subject_id` is restored before returning, so probing a
+ * named subject cannot leak it into the rest of a caller's transaction.
+ */
+export declare function namedSubjectHasLiveWorkspaceAuthority(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+}): Promise<boolean>;
+/**
+ * The ONLY place a Slack request may reach a managed human's personal
+ * workspace. Returns the grant a routed Slack target may act under, or null.
+ *
+ * A Slack webhook has no caller subject: `subjectId` is read out of band from a
+ * durable `slack_bot_user_links` row, whose only writers sit behind a verified
+ * managed-human cookie or a `members:manage` grant. That is why this uses
+ * {@link namedSubjectHasLiveWorkspaceAuthority} rather than the in-scope
+ * variant - the subject was authenticated elsewhere, and this seam is naming
+ * it, not proving it. Callers must therefore never pass a subject taken from a
+ * Slack payload; pass only `link.subjectId`.
+ *
+ * Ordinary membership first, then a derived-and-fenced pointer path (the same
+ * shape as `requirePersonalGitHubCallbackGrant`):
+ *
+ * - `getWorkspaceGrant` is a bare `workspace_memberships` join and is NOT
+ *   widened here, because `accessGrantAuthorization` calls it for every
+ *   principal kind including API keys and delegated bearers; widening it would
+ *   hand a bearer principal personal-workspace access.
+ * - The pointer path accepts only the subject's OWN `personalWorkspaceId` from
+ *   an ACTIVE membership in exactly `targetAccountId`, then re-checks live
+ *   authority. The workspace id is never taken from a route row or a Slack
+ *   payload - it must equal the pointer.
+ * - No Slack branch is ever added to `canonicalManagedCookieContexts`: that
+ *   `WeakSet` has exactly one writer, the Better Auth cookie branch of
+ *   `resolveAccessContext`, and a Slack-signed webhook can never be in it.
+ *
+ * Slack sessions stay `workspace_shared`: this grant is passed as an ordinary
+ * grant, and `createSessionForRequest` is still called WITHOUT its
+ * `authorization` argument, so Slack privacy remains
+ * `slack_interactions.visibility`.
+ */
+export declare function resolveSlackTargetAuthority(db: Database, input: {
+    subjectId: string;
+    targetAccountId: string;
+    targetWorkspaceId: string;
+}): Promise<AccessGrant | null>;
+/**
+ * Read-only organization tenancy inventory (0285): content-free counts of
+ * every legacy-attribution population the backfill/parity program gates on.
+ * Integers only - no identities, names, keys, or values.
+ */
+export declare function inventoryOrganizationTenancy(db: Database, input: {
+    organizationId: string;
+}): Promise<Record<string, unknown>>;
+/**
+ * How much independent evidence a parity gate carries.
+ *
+ * - `constraint` / `trigger`: the property is already enforced by the physical
+ *   schema, so the gate is a shadow verification that the enforcement is still
+ *   present and validated - it cannot be the first line of defence.
+ * - `runtime`: nothing in the schema prevents the violation. These are the
+ *   gates that carry real evidence about a cutover.
+ */
+export type TenancyParityGateBasis = "constraint" | "trigger" | "runtime";
+export interface TenancyParityGateDefinition {
+    readonly id: string;
+    readonly title: string;
+    readonly basis: TenancyParityGateBasis;
+    /** What a violation means, and why it must never resolve to user authority. */
+    readonly rule: string;
+}
+export interface TenancyParityGateResult extends TenancyParityGateDefinition {
+    readonly status: "pass" | "fail";
+    readonly violations: number;
+    /** Bounded row identifiers only - never subjects, names, keys, or values. */
+    readonly evidence: readonly string[];
+    readonly evidenceTruncated: boolean;
+}
+export interface TenancyParityLaneDefinition {
+    readonly id: string;
+    readonly title: string;
+    /**
+     * `drainable`: a backfill can take it to zero.
+     * `observation`: immutable history, reported over a bounded recent window so
+     * that "the lane stopped being exercised" is still a reachable zero.
+     */
+    readonly kind: "drainable" | "observation";
+    /** The workstream that owns draining this lane, when it is not this one. */
+    readonly owner?: string;
+}
+export interface TenancyParityLaneResult extends TenancyParityLaneDefinition {
+    readonly count: number;
+    readonly drained: boolean;
+}
+export interface TenancyParityUnverifiable {
+    readonly id: string;
+    readonly title: string;
+    /** Why no honest number exists for this property today. */
+    readonly reason: string;
+}
+export interface TenancyParityReport {
+    readonly schemaVersion: 1;
+    readonly organizationId: string;
+    readonly generatedAt: string;
+    readonly evidenceLimit: number;
+    readonly observationWindowDays: number;
+    /** `fail` when any invariant gate has at least one violation. */
+    readonly status: "pass" | "fail";
+    /** Every gate passes AND every compatibility lane is drained. */
+    readonly cutoverReady: boolean;
+    readonly summary: {
+        readonly gates: number;
+        readonly gatesFailed: number;
+        readonly violations: number;
+        readonly lanes: number;
+        readonly lanesUndrained: number;
+        readonly unverifiable: number;
+    };
+    readonly gates: readonly TenancyParityGateResult[];
+    readonly lanes: readonly TenancyParityLaneResult[];
+    readonly unverifiable: readonly TenancyParityUnverifiable[];
+}
+/**
+ * Ordered catalog of the organization-tenancy parity gates (phase E). Every id
+ * matches a key emitted by `check_organization_tenancy_parity` (migration
+ * 0298); a gate present here but absent from the seam is reported as a
+ * structural mismatch rather than silently passing.
+ */
+export declare const TENANCY_PARITY_GATES: readonly TenancyParityGateDefinition[];
+/**
+ * Compatibility lanes. These are legacy populations, NOT invariant violations:
+ * a non-zero lane blocks a cutover but is not schema corruption.
+ */
+export declare const TENANCY_PARITY_LANES: readonly TenancyParityLaneDefinition[];
+/**
+ * Properties phase E names that have no honest measurement today. They are
+ * reported explicitly instead of being emitted as a counter that can never
+ * reach zero.
+ */
+export declare const TENANCY_PARITY_UNVERIFIABLE: readonly TenancyParityUnverifiable[];
+/**
+ * Compose the operator-facing parity report from the raw seam output. Pure and
+ * total: an id the seam did not emit is reported as a failing gate with an
+ * explicit structural-mismatch violation rather than silently passing.
+ */
+export declare function composeTenancyParityReport(raw: Record<string, unknown>, options?: {
+    generatedAt?: string;
+}): TenancyParityReport;
+/**
+ * Read-only organization tenancy parity check (0298, phase E). Verifies the
+ * structural tenancy invariants, reports the compatibility lanes, and names the
+ * properties that are currently unverifiable. It never writes, repairs, or
+ * widens anything, and no reported mismatch is resolved toward user authority.
+ */
+export declare function checkOrganizationTenancyParity(db: Database, input: {
+    organizationId: string;
+    evidenceLimit?: number;
+    observationWindowDays?: number;
+    generatedAt?: string;
+}): Promise<TenancyParityReport>;
+/**
+ * Organization-tenancy phase D classification assertion (0291) for Variable Sets, Rigs, and
+ * Connected Machines. Read-only over every resource table: it proves each row
+ * already carries an explicit terminal authority classification and never
+ * rewrites one. Supplying `runKey` additionally records the verdicts durably
+ * through the 0286 tenancy backfill ledger (one receipt per family plus one
+ * append-only unresolved row per resource that could not be proven); the
+ * result reports `ledgerAvailable` so a run that could not record its
+ * obligations is visible rather than silent. A run key may be used once - the
+ * ledger refuses to re-open a settled receipt.
+ */
+export declare function verifyOrganizationResourceClassification(db: Database, input: {
+    organizationId: string;
+    runKey?: string | null;
+}): Promise<Record<string, unknown>>;
+/**
+ * Organization-tenancy phase D session ownership classification (0297). Read-only over
+ * `sessions`: it proves every attributed session points at one live,
+ * internally consistent organization membership, and names a fixed reason code
+ * for every session it refuses to attribute. Supplying `runKey` additionally
+ * records those refusals durably through the tenancy backfill ledger (one
+ * `sessions` receipt plus one append-only unresolved row each); the result
+ * reports `ledgerAvailable` so a run that could not record its obligations is
+ * visible rather than silent. A run key may be used once - the ledger refuses
+ * to re-open a settled receipt.
+ *
+ * It never writes a session row and never infers user authority from
+ * `created_by`, a default workspace, or current workspace access.
+ */
+export declare function classifyOrganizationSessionOwnership(db: Database, input: {
+    organizationId: string;
+    runKey?: string | null;
+}): Promise<Record<string, unknown>>;
+/**
+ * Organization-tenancy phase D session ownership backfill (0297). One bounded, resumable,
+ * idempotent batch of the only two deterministic repairs: a session sitting in
+ * exactly one active membership's personal workspace whose creator subject is
+ * that same membership, and the parent-inheritance closure migration 0225's own
+ * trigger would have produced. `dryRun` defaults to true. Candidates are
+ * claimed with `FOR UPDATE ... SKIP LOCKED`, so concurrent drivers never
+ * contend; keep calling while `moreLikely` is true.
+ */
+export declare function backfillOrganizationSessionOwnership(db: Database, input: {
+    organizationId: string;
+    limit?: number;
+    dryRun?: boolean;
+    runKey?: string | null;
+}): Promise<Record<string, unknown>>;
+export declare function getVariableSetValuesForRun(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    variableSetId: string;
+    authority: {
+        kind: "agent_attempt";
+        subjectId: string;
+        sessionId: string;
+        turnId: string;
+        attemptId: string;
+        executionGeneration: number;
+        initiatingHumanSubjectId?: string | null;
+    } | {
+        kind: "session_attach";
+        sessionId: string;
+        /** The authenticated route subject driving the attach (0282); null
+         *  records the explicit legacy sentinel `service:session`. */
+        subjectId: string | null;
+        initiatingHumanSubjectId?: string | null;
+    };
+}): Promise<{
     variableSet: {
         id: string;
         name: string;
         description: string | null;
+        scope: VariableSet["scope"];
+        generation: number;
     };
     values: Record<string, string>;
 } | null>;
@@ -2532,6 +3334,8 @@ export type VariableSetForRun = {
     id: string;
     name: string;
     description: string | null;
+    scope: VariableSet["scope"];
+    generation: number;
     values: Record<string, string>;
 };
 /**
@@ -2548,7 +3352,27 @@ export type VariableSetForRun = {
  * missing key or a deleted variableSet throws (names/ids only in messages) instead
  * of silently running without the secrets the run expects.
  */
-export declare function loadVariableSetForRun(db: Database, settings: Settings, workspaceId: string, variableSetId: string | null): Promise<VariableSetForRun | null>;
+export declare function loadVariableSetForRun(db: Database, settings: Settings, input: {
+    accountId: string;
+    workspaceId: string;
+    variableSetId: string | null;
+    authority: {
+        kind: "agent_attempt";
+        subjectId: string;
+        sessionId: string;
+        turnId: string;
+        attemptId: string;
+        executionGeneration: number;
+        initiatingHumanSubjectId?: string | null;
+    } | {
+        kind: "session_attach";
+        sessionId: string;
+        /** The authenticated route subject driving the attach (0282); null
+         *  records the explicit legacy sentinel `service:session`. */
+        subjectId: string | null;
+        initiatingHumanSubjectId?: string | null;
+    };
+}): Promise<VariableSetForRun | null>;
 /** @deprecated use loadVariableSetForRun */
 export declare const loadWorkspaceEnvironmentForRun: typeof loadVariableSetForRun;
 /** @deprecated use VariableSetForRun */
@@ -3575,7 +4399,7 @@ export type ConnectorActionInvocation = {
     toolName: string;
     arguments: unknown;
     /** Explicit per-session MCP approval, rather than a connector-policy decision. */
-    approvalMode?: "session_mcp";
+    approvalMode?: "session_mcp" | "connector_write";
 };
 export type PrepareConnectorActionApprovalResult = {
     managed: false;
@@ -3597,7 +4421,7 @@ export type BeginConnectorActionExecutionResult = {
 } | {
     allowed: false;
     managed: true;
-    reason: "approval_required" | "blocked" | "rejected" | "already_executed" | "uncertain_retry";
+    reason: "approval_required" | "blocked" | "rejected" | "already_executed" | "uncertain_retry" | "not_executed";
     requestId: string;
     actionFingerprint: string;
 };
@@ -3639,6 +4463,23 @@ export declare function upsertConnectorActionPolicy(db: Database, input: {
     policy: typeof schema.connectorActionPolicies.$inferSelect;
     changed: boolean;
 }>;
+/**
+ * Install a risk-appropriate connector default without overwriting an explicit
+ * user choice that already exists for the same immutable connector action.
+ */
+export declare function ensureConnectorActionPolicyDefault(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    connectionId: string;
+    serverId: string;
+    toolName: string;
+    actionName: string;
+    policy: ConnectorActionPolicyDecision;
+}): Promise<{
+    policy: typeof schema.connectorActionPolicies.$inferSelect;
+    changed: boolean;
+}>;
 export declare function prepareConnectorActionApproval(db: Database, identity: ConnectorActionAttemptIdentity, invocation: ConnectorActionInvocation): Promise<PrepareConnectorActionApprovalResult>;
 export declare function beginConnectorActionExecution(db: Database, identity: ConnectorActionAttemptIdentity, invocation: ConnectorActionInvocation): Promise<BeginConnectorActionExecutionResult>;
 export declare function completeConnectorActionExecution(db: Database, input: {
@@ -3646,7 +4487,7 @@ export declare function completeConnectorActionExecution(db: Database, input: {
     workspaceId: string;
     requestId: string;
     attemptId: string;
-    outcome: "completed" | "uncertain";
+    outcome: "completed" | "uncertain" | "not_executed";
 }): Promise<void>;
 /** Read the persisted deployment fallback; process configuration is not policy authority. */
 export declare function getNestedAgentDepthDeploymentPolicy(db: Database): Promise<NestedAgentDepthDeploymentPolicy>;
@@ -3658,12 +4499,16 @@ export declare class SessionIdConflictError extends Error {
     readonly sessionId: string;
     constructor(sessionId: string);
 }
+export declare class SessionCreateIdempotencyConflictError extends Error {
+    constructor();
+}
 export type SessionCreateInput = {
     requestedSessionId?: string;
     accountId: string;
     workspaceId: string;
+    visibility?: "user_private" | "workspace_shared";
     initialMessage: string;
-    initialTurnInstructions?: string | null;
+    initialModelContext?: string | null;
     resources: ResourceRef[];
     skills?: SessionSkill[];
     tools?: ToolRef[];
@@ -3673,6 +4518,8 @@ export type SessionCreateInput = {
     createdByContext?: TurnInitiatorContext;
     createdByActor?: AgentSessionCreationActor | null;
     model: string;
+    reasoningEffort: ReasoningEffort;
+    latencyMode: LatencyMode;
     sandboxBackend: SandboxBackend;
     variableSetId?: string | null;
     rigId?: string | null;
@@ -3686,8 +4533,16 @@ export type SessionCreateInput = {
     createIdempotencyKey?: string | null;
     sandboxGroupId?: string | null;
     sandboxOs?: SandboxOs;
+    /** Exact accepted generated-session compaction policy; internal lifecycle callers only. */
+    frozenCodexCompactionMode?: Session["codexCompactionMode"];
+    /** Exact accepted root-session depth policy; internal lifecycle callers only. */
+    frozenNestedAgentDepthPolicy?: {
+        effectiveMaxNestedAgentDepth: number;
+        nestedAgentDepthPolicySource: NestedAgentDepthPolicySource;
+    };
     mcpServers?: CreateSessionMcpServerInput[];
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+    initialPersonalResourceAttachmentIntent?: PersonalResourceAttachmentIntent | null;
     initialXaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;
     maxNestedAgentDepthOverride?: number | null;
     allowNestedAgentDepthIncrease?: boolean;
@@ -3716,11 +4571,38 @@ export declare function createSessionWithIdempotencyKeyResult(db: Database, inpu
  * admission transaction and then surfaced as SessionSpawnDeniedDbError;
  * callers that need a structured result use createSessionWithIdempotencyKeyResult.
  */
-export declare function createSessionWithIdempotencyKey(db: Database, input: SessionCreateInput & {
-    createIdempotencyKey: string;
-}): Promise<SessionCreateSuccessResult>;
-export declare function getSessionByCreateIdempotencyKey(db: Database, workspaceId: string, createIdempotencyKey: string): Promise<Session | null>;
-export declare function getSession(db: Database, workspaceId: string, sessionId: string): Promise<Session | null>;
+export declare function createSessionWithIdempotencyKey(db: Database, input: SessionCreateInput & {
+    createIdempotencyKey: string;
+}): Promise<SessionCreateSuccessResult>;
+export declare function getSessionByCreateIdempotencyKey(db: Database, workspaceId: string, createIdempotencyKey: string): Promise<Session | null>;
+export declare function getSession(db: Database, workspaceId: string, sessionId: string): Promise<Session | null>;
+export type DeleteSessionTreeIfQuiescentResult = {
+    status: "deleted";
+    deletedSessionCount: number;
+} | {
+    status: "not_found" | "not_root" | "active_sessions" | "active_video_generations" | "active_background_commands" | "live_sandboxes" | "externally_referenced";
+};
+/**
+ * Permanently delete one complete root session tree after proving that no
+ * runtime or provider-side owner can still act on it.
+ *
+ * The workspace-control and tree row locks fence new sessions and concurrent
+ * lifecycle changes. Session-owned evidence follows the migration-owned
+ * cascade; immutable workspace-level provenance and independent forks
+ * deliberately retain RESTRICT and surface `externally_referenced` instead of
+ * being orphaned.
+ */
+export declare function deleteSessionTreeIfQuiescent(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    sessionId: string;
+    /**
+     * Bound the workspace control prefix wait (request-scoped API callers pass
+     * `workspaceControlRequestLockTimeoutMs()`); omit for lifecycle callers.
+     * Exceeding it throws `WorkspaceControlBusyError` before any row is read.
+     */
+    controlLockTimeoutMs?: number;
+}): Promise<DeleteSessionTreeIfQuiescentResult>;
 export type SessionAuthorityProjection = {
     sessionId: string;
     rootSessionId: string;
@@ -3765,26 +4647,75 @@ export type ListSessionsOptions = {
     limit?: number;
     parentSessionId?: string | null;
 };
-export type SessionListCursor = {
+export type SessionListSnapshotCursor = {
+    kind: "snapshot";
     snapshotId: string;
     offset: number;
     parentSessionFilter: string;
     search: string | null;
+    archiveMode: "active" | "archived";
+};
+export type SessionListKeysetCursor = {
+    kind: "keyset";
+    /** Decimal committed workspace activity revision frozen on page one. */
+    snapshotRevision: string;
+    /** Exact PostgreSQL timestamp text, including microseconds. */
+    sortAt: string;
+    id: string;
+    parentSessionFilter: string;
+    search: string | null;
+    archiveMode: "active" | "archived";
 };
+export type SessionListCursor = SessionListSnapshotCursor | SessionListKeysetCursor;
 export type ListSessionsForSubjectOptions = ListSessionsOptions & {
     subjectId: string;
     cursor?: SessionListCursor | undefined;
     search?: string | undefined;
     /** Return only the complete personal pin projection; never scan/snapshot ordinary rows. */
     pinsOnly?: boolean | undefined;
-    /** Materialize a continuation snapshot. Disable for legacy one-page array reads. */
+    /** List personally archived chats instead of active chats. */
+    archivedOnly?: boolean | undefined;
+    /** Return a continuation cursor. Disable for legacy one-page array reads. */
     materializeSnapshot?: boolean | undefined;
     authorizationScope?: SessionAuthorizationListScope | undefined;
+    /** See {@link PersonalWorkspaceOwnerException}. Absent means "no exception". */
+    personalWorkspaceOwnerException?: PersonalWorkspaceOwnerException | undefined;
 };
+/**
+ * Whether the caller may use the owner-only managed personal-workspace
+ * exception on this request.
+ *
+ * A managed human's personal workspace has NO `workspace_memberships` row
+ * (migration 0219 raises on one), so a bare membership fence denies the one
+ * human who always belongs. The `organization_memberships.personal_workspace_id`
+ * pointer is their whole grant, and
+ * {@link subjectHasLiveWorkspaceAuthorityInScope} is the single resolver for it.
+ *
+ * **This flag is the authorization.** The resolver it gates is not: it answers
+ * "does subject X hold authority here" and establishes nothing about who the
+ * caller is. The exception is for "the canonical managed-cookie (Better Auth)
+ * session" only — "Bearer/delegated principals, API keys, and account or
+ * organization administrators receive no personal-workspace access through that
+ * exception" — and a host-signed delegated bearer chooses its own `subjectId`,
+ * `principalKind`, `metadata.delegated`, and `serviceInitiator` claims, so no
+ * inspection of the grant can carry that distinction. Set this ONLY from
+ * `AccessGrantAuthorization.canonicalManagedHumanSession` (`@opengeni/core`),
+ * which reflects HOW the request authenticated. Omitted/false keeps the
+ * historical bare-membership fence exactly.
+ */
+export type PersonalWorkspaceOwnerException = boolean;
 export declare class SessionPinVersionConflictError extends Error {
     readonly current: Pick<Session, "pinned" | "pinnedAt" | "pinVersion">;
     constructor(current: Pick<Session, "pinned" | "pinnedAt" | "pinVersion">);
 }
+export declare class SessionAttentionVersionConflictError extends Error {
+    readonly current: Pick<Session, "unread" | "activelyWorking" | "attentionVersion">;
+    constructor(current: Pick<Session, "unread" | "activelyWorking" | "attentionVersion">);
+}
+export declare class SessionArchiveVersionConflictError extends Error {
+    readonly current: Pick<Session, "archived" | "archivedAt" | "archiveVersion">;
+    constructor(current: Pick<Session, "archived" | "archivedAt" | "archiveVersion">);
+}
 export declare class SessionListCursorError extends Error {
     constructor(message?: string);
 }
@@ -3794,9 +4725,6 @@ export declare class SessionListCursorExpiredError extends Error {
 export declare class SessionListAccessError extends Error {
     constructor(message?: string);
 }
-export declare class SessionListSnapshotLimitError extends Error {
-    constructor(message?: string);
-}
 export declare class SessionPinAccessError extends Error {
     constructor(message?: string);
 }
@@ -3818,7 +4746,15 @@ export declare function projectSessionForRelatedAccess(session: Session, access:
  * fixed node/depth budget. `truncated=true` makes every count an explicit lower
  * bound when a deep, wide, overlapping, or cyclic graph reaches that budget.
  */
-export declare function sessionTreeStatsForSessions(db: Database, workspaceId: string, rootIds: string[]): Promise<Map<string, SessionTreeStats>>;
+export declare function sessionTreeStatsForSessions(db: Database, workspaceId: string, rootIds: string[], subjectId?: string): Promise<Map<string, SessionTreeStats>>;
+/**
+ * When each given `requires_action` session's own open turn entered that
+ * state: the oldest still-open `requires_action` turn per session. Only the
+ * ids whose current status is `requires_action` should be passed; the lookup
+ * walks `session_turns_workspace_queue_idx` per session and returns no row
+ * for sessions with no such turn.
+ */
+export declare function sessionRequiresActionSinceForSessions(db: Database, workspaceId: string, sessionIds: readonly string[]): Promise<Map<string, string>>;
 /**
  * Convert the embedding host's complete list scope into a workspace-bound SQL
  * predicate. Root scopes include every descendant through the durable parent
@@ -3826,9 +4762,16 @@ export declare function sessionTreeStatsForSessions(db: Database, workspaceId: s
  * `UNION ALL`) makes legacy cycles terminate without a caller-sized path array.
  */
 export declare function sessionAuthorizationScopeFilter(scope: SessionAuthorizationListScope): SQL;
-export declare const SESSION_LIST_SNAPSHOT_MAX_IDS = 5000;
-export declare const SESSION_LIST_SNAPSHOT_MAX_ACTIVE_PER_SUBJECT = 32;
-/** Opaque, URL-safe cursor encoding for a server-owned activity snapshot. */
+/**
+ * The reserved slot a session-visibility transition leaves behind when it strips
+ * a now-`user_private` session identity out of another subject's cached page
+ * (migration 0301). Replacing rather than removing the slot keeps snapshot
+ * cardinality and every in-flight cursor offset byte-stable; `gen_random_uuid()`
+ * never emits the nil UUID, so the slot resolves to no session and the hydration
+ * below drops it exactly as it already drops a row RLS hid between pages.
+ */
+export declare const SESSION_LIST_SNAPSHOT_REDACTED_SESSION_ID = "00000000-0000-0000-0000-000000000000";
+/** Opaque, URL-safe cursor encoding for bounded session-list pagination. */
 export declare function encodeSessionListCursor(cursor: SessionListCursor): string;
 /** Decode and validate a cursor before it reaches any SQL predicate. */
 export declare function decodeSessionListCursor(value: string): SessionListCursor | null;
@@ -3837,10 +4780,11 @@ export declare function reapExpiredSessionListSnapshots(db: Database, limit?: nu
 /**
  * Server-authoritative member-specific page. Pinned rows are returned separately
  * and omitted from ordinary pages, so list pagination cannot duplicate a
- * session. The first page materializes the complete ordinary activity order in
- * a short-lived, subject-scoped snapshot; continuation cursors carry only that
- * snapshot id and offset, while the page joins live session rows for current
- * lifecycle/title data.
+ * session. New pages use a bounded activity-revision keyset: page one freezes
+ * the committed workspace revision and every continuation reads only `limit +
+ * 1` candidate ids. Legacy short-lived snapshot cursors remain readable during
+ * rolling upgrades, while hydration always joins live rows for current
+ * lifecycle/title and authorization data.
  */
 export declare function listSessionsForSubject(db: Database, workspaceId: string, options: ListSessionsForSubjectOptions): Promise<SessionListResponse>;
 /** Read a session with the caller subject's personal pin projection. */
@@ -3857,6 +4801,34 @@ export declare function setSessionPin(db: Database, input: {
     sessionId: string;
     pinned: boolean;
     expectedVersion?: number | undefined;
+    /** See {@link PersonalWorkspaceOwnerException}. Absent means "no exception". */
+    personalWorkspaceOwnerException?: PersonalWorkspaceOwnerException | undefined;
+}): Promise<Session | null>;
+/**
+ * Idempotently update one member's explicit follow-up state. Route reads remain
+ * side-effect free: a foreground client acknowledges its exact rendered event
+ * frontier through this mutation, and later durable events remain unread.
+ */
+export declare function setSessionAttention(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    sessionId: string;
+    unread?: boolean | undefined;
+    acknowledgedThroughSequence?: number | undefined;
+    activelyWorking?: boolean | undefined;
+    expectedVersion?: number | undefined;
+}): Promise<Session | null>;
+/**
+ * Archive or restore one root chat for a single member. Archiving also removes
+ * personal pin/follow-up labels so hidden work cannot remain in active rail
+ * sections. Descendants inherit visibility from the archived root at list time.
+ */
+export declare function setSessionArchive(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    sessionId: string;
+    archived: boolean;
+    expectedVersion?: number | undefined;
 }): Promise<Session | null>;
 export declare function listSessions(db: Database, workspaceId: string, limit?: number): Promise<Session[]>;
 export declare function listSessions(db: Database, workspaceId: string, options?: ListSessionsOptions): Promise<Session[]>;
@@ -3990,6 +4962,15 @@ export type ListSessionEventsOptions = {
     includeClasses?: readonly SessionEventSemanticClass[];
     excludeClasses?: readonly SessionEventSemanticClass[];
     defaultExcludeTypes?: readonly SessionEventType[];
+    /**
+     * Agent-monitoring conversation boundary: omit a human/API `user.message`
+     * whose accepted turn was never claimed (`session_turns.started_at IS NULL`),
+     * whether it is still queued or reached a terminal state before any claim.
+     * The row appears at its own sequence once the turn is claimed. Forensic,
+     * SSE, and REST readers leave this unset so the retained event log stays
+     * exact.
+     */
+    excludeUnclaimedHumanPrompts?: boolean;
     payloadMode?: SessionEventPayloadMode;
     /**
      * Internal exclusive-latest selector. Eligible legacy rows with a null
@@ -4032,6 +5013,8 @@ export declare function listSessionEvents(db: Database, workspaceId: string, ses
 export declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, after: number, limit?: number): Promise<SessionEvent[]>;
 export declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, options: ListSessionEventsOptions): Promise<SessionEvent[]>;
 export declare function getSessionEvent(db: Database, workspaceId: string, eventId: string): Promise<SessionEvent | null>;
+/** Read one durable event under the exact human subject visibility projection. */
+export declare function getSessionEventForSubject(db: Database, workspaceId: string, subjectId: string, eventId: string): Promise<SessionEvent | null>;
 export declare function listWorkspaceControlEvents(db: Database, workspaceId: string, after?: number, limit?: number): Promise<WorkspaceControlEvent[]>;
 export declare function getWorkspaceControlEvent(db: Database, workspaceId: string, eventId: string): Promise<WorkspaceControlEvent | null>;
 /**
@@ -4108,6 +5091,8 @@ export declare function acceptSessionHumanInputResponse(db: Database, input: {
     requestId: string;
     response: unknown;
     respondedBy: string;
+    /** Bounded responder kind for the parent's resolution notice; derived from `respondedBy` when omitted. */
+    respondedByKind?: ChildRequiresActionRespondedByKind;
     clientEventId?: string | null;
     expireOnly?: boolean;
 }): Promise<AcceptSessionHumanInputResponseResult>;
@@ -4123,6 +5108,43 @@ export declare function getHumanInputResumeForEvent(db: Database, workspaceId: s
     response: HumanInputResponse;
 } | null>;
 export type TurnAttemptFenceRejectReason = "workspace_paused" | "session_paused" | "pending_control" | "active_turn_changed" | "generation_changed" | "attempt_changed" | "turn_terminal" | "not_found";
+export declare class SessionBackgroundCommandAdoptionFencedError extends Error {
+    readonly reason: TurnAttemptFenceRejectReason;
+    readonly name = "SessionBackgroundCommandAdoptionFencedError";
+    constructor(reason: TurnAttemptFenceRejectReason);
+}
+/** Transfer one exact Connected Machine operation from a live turn attempt to
+ * its session. The canonical write fence gives adoption a total order with
+ * Steer, session/workspace Pause, terminal Cancel, and quiescent tree deletion:
+ * an earlier adoption is visible to later control, while earlier control makes
+ * this stale attempt fail before a session-owned row can appear. */
+export declare function adoptConnectedMachineSessionBackgroundCommand(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    executionGeneration: number;
+    attemptId: string;
+    commandId: string;
+    controlWorkspaceId: string;
+    enrollmentId: string;
+    connectionInstanceId: string;
+    opId: string;
+    command: string;
+}): Promise<{
+    id: string;
+    workspaceId: string;
+    sessionId: string;
+    provider: "connected_machine" | "managed";
+    state: "exited" | "lost" | "running" | "stopping";
+    commandPreview: string;
+    cancelRequestedAt: string | null;
+    exitCode: number | null;
+    settlementReason: string | null;
+    startedAt: string;
+    settledAt: string | null;
+    updatedAt: string;
+}>;
 export type InstallOrReadTurnExecutionPolicyForAttemptResult = {
     accepted: true;
     installed: boolean;
@@ -4203,6 +5225,32 @@ export declare function recordPendingSessionToolCallResult(db: Database, input:
     accepted: boolean;
     recorded: boolean;
 }>;
+export type OpenSuffixInterruptionKind = "human_input" | "approval" | "interaction_intervention";
+export type OpenSuffixPendingToolCall = {
+    callId: string;
+    callType: string;
+    callItem: Record<string, unknown>;
+    interruptionKind: OpenSuffixInterruptionKind;
+    tiedReasoningItems: Array<Record<string, unknown>>;
+    resultItem: Record<string, unknown> | null;
+    modelToolOutputTruncationTokens: number | null;
+};
+/**
+ * Bind unpaired interruption calls and their tied reasoning onto existing
+ * pending receipts. Fail closed when any interruption call is missing.
+ */
+export declare function attachOpenSuffixToPendingToolCalls(db: Database, input: Omit<PendingSessionToolCallInput, "callId" | "callType" | "callItem"> & {
+    members: Array<{
+        callId: string;
+        interruptionKind: OpenSuffixInterruptionKind;
+        reasoningItems: Array<Record<string, unknown>>;
+    }>;
+}): Promise<{
+    accepted: boolean;
+    attached: number;
+}>;
+/** Turn-scoped interruption suffix rows, including already-settled members. */
+export declare function listTurnOpenSuffixToolCalls(db: Database, workspaceId: string, sessionId: string, turnId: string): Promise<OpenSuffixPendingToolCall[]>;
 /**
  * Remove completed receipts only after the full SDK call/result batch is
  * durable. Until then every raw result remains available to an attempt-ending
@@ -4760,6 +5808,12 @@ export interface AcquireLeaseInput {
     kind: LeaseHolderKind;
     holderId: string;
     subjectId?: string | null;
+    /** Viewer holders only (0281): the authenticated viewer subject recorded on
+     *  the holder row - identity only, never a secret value. */
+    viewerSubjectId?: string;
+    /** Viewer holders only (0281): the session authority epoch observed at
+     *  attach, mirrored into the scoped stream token's claims. */
+    viewerAuthorityEpoch?: number;
     backend: string;
     os?: string;
     image?: string | null;
@@ -5374,6 +6428,29 @@ export declare function releaseLeaseHolder(db: Database, input: {
     liveness: SandboxLeaseLiveness;
     refcount: number;
 } | null>;
+export type LeaseHolderHeartbeatFence = "unsupported_kind" | "lease_missing" | "holder_gone" | "epoch" | "liveness" | "rotation_requested";
+export type LeaseHolderHeartbeatStatus = {
+    holderAlive: false;
+    leaseExtended: false;
+    fence: "unsupported_kind" | "lease_missing" | "holder_gone";
+} | {
+    holderAlive: true;
+    leaseExtended: true;
+    fence: null;
+} | {
+    holderAlive: true;
+    leaseExtended: false;
+    fence: "epoch" | "liveness" | "rotation_requested";
+};
+export declare function heartbeatLeaseHolderStatus(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    kind: LeaseHolderKind;
+    holderId: string;
+    leaseTtlMs: number;
+    expectedEpoch: number;
+}): Promise<LeaseHolderHeartbeatStatus>;
 export declare function heartbeatLeaseHolder(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -5383,6 +6460,37 @@ export declare function heartbeatLeaseHolder(db: Database, input: {
     leaseTtlMs: number;
     expectedEpoch: number;
 }): Promise<boolean>;
+export type ReinstateTurnLeaseHolderResult = {
+    status: "present" | "reinstated";
+    lease: LeaseSnapshot;
+} | {
+    status: "lease_missing" | "lease_fenced" | "capture_in_progress" | "reaper_held" | "attempt_fenced";
+};
+/**
+ * Defense in depth for the orderly provider-deadline rotation checkpoint: put the
+ * exact canonical turn holder back onto the lease it is still physically using.
+ * The warm capture claim requires exactly this holder, so a holder lost while
+ * the attempt is still the active writer (a stale release, a reap race) would
+ * otherwise silently disable the rotation checkpoint and let the reaper
+ * terminate the box under the running turn.
+ *
+ * Fenced hard: the lease must still be the established epoch and provider
+ * instance, carry no capture/teardown claim and no active reaper hold, and the
+ * attempt must still be the turn's active `claimed`/`running` writer on a
+ * session of this group. A draining lease that passes those fences re-arms to
+ * warm exactly like a late arrival in `acquireLease`; a cold or superseded lease
+ * is never touched. Idempotent: an existing holder is reported `present`.
+ */
+export declare function reinstateTurnLeaseHolder(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    sessionId: string;
+    attemptId: string;
+    expectedEpoch: number;
+    expectedInstanceId: string;
+    leaseTtlMs: number;
+}): Promise<ReinstateTurnLeaseHolderResult>;
 /**
  * HOLDER-LIVENESS touch: refresh ONLY this holder's last_heartbeat_at. The
  * warmup phase of a turn (acquire -> waitForWarm -> establish/cold-restore ->
@@ -5477,9 +6585,9 @@ export declare function confirmDrainCold(db: Database, input: {
     wentCold: boolean;
 }>;
 export declare class SandboxWorkspaceMutationFencedError extends Error {
-    readonly code: "attempt_fenced" | "holder_fenced" | "lease_fenced" | "route_fenced" | "process_fenced" | "capture_in_progress" | "admission_fenced" | "operation_invalid" | "generation_exhausted";
+    readonly code: "attempt_fenced" | "holder_fenced" | "lease_fenced" | "rotation_in_progress" | "route_fenced" | "process_fenced" | "capture_in_progress" | "admission_fenced" | "operation_invalid" | "generation_exhausted" | "authority_unattributed" | "authority_revoked";
     readonly name: string;
-    constructor(code: "attempt_fenced" | "holder_fenced" | "lease_fenced" | "route_fenced" | "process_fenced" | "capture_in_progress" | "admission_fenced" | "operation_invalid" | "generation_exhausted", message: string);
+    constructor(code: "attempt_fenced" | "holder_fenced" | "lease_fenced" | "rotation_in_progress" | "route_fenced" | "process_fenced" | "capture_in_progress" | "admission_fenced" | "operation_invalid" | "generation_exhausted" | "authority_unattributed" | "authority_revoked", message: string);
 }
 export type SandboxWorkspaceMutationAdmission = {
     id: string;
@@ -5573,7 +6681,7 @@ export declare function retainedProcessReconciliationProof(process: SandboxRetai
 export declare class SandboxRetainedProcessPromotionFencedError extends SandboxWorkspaceMutationFencedError {
     readonly process: SandboxRetainedProcess;
     readonly name = "SandboxRetainedProcessPromotionFencedError";
-    constructor(code: "attempt_fenced" | "holder_fenced" | "lease_fenced" | "route_fenced" | "process_fenced" | "admission_fenced", message: string, process: SandboxRetainedProcess);
+    constructor(code: "attempt_fenced" | "holder_fenced" | "lease_fenced" | "route_fenced" | "process_fenced" | "admission_fenced" | "authority_unattributed" | "authority_revoked", message: string, process: SandboxRetainedProcess);
 }
 /**
  * Advance the live workspace's mutation generation before an acknowledged
@@ -5599,6 +6707,11 @@ export declare function advanceWorkspaceGeneration(db: Database, input: {
     captureWaitMs?: number;
     /** Cancel the bounded transition wait without creating an admission. */
     waitSignal?: AbortSignal;
+    /** Observe only time actually spent blocked behind an archive capture. */
+    onCaptureWait?: (observation: {
+        durationMs: number;
+        outcome: "completed" | "failed";
+    }) => void;
     /** Active-routed mutations bind to the exact session pointer. Omitted means
      * an intentional home-provider write outside the routing surface. */
     routeKind?: "home" | "active";
@@ -5607,13 +6720,17 @@ export declare function advanceWorkspaceGeneration(db: Database, input: {
 }): Promise<SandboxWorkspaceMutationAdmission>;
 /** Admit an API/direct mutation under an exact request holder and active route.
  * Direct actors intentionally have no turn identity and can never inherit the
- * attempt-quiescence archive fallback. */
+ * attempt-quiescence archive fallback. `initiatorSubjectId` is the exact
+ * authenticated principal behind the request and is required: it is this
+ * writer's only causal identity, and it is re-proved against the live grant
+ * inside the admission transaction. */
 export declare function advanceWorkspaceGenerationForDirectRequest(db: Database, input: {
     accountId: string;
     workspaceId: string;
     sessionId: string;
     requestId: string;
     holderId: string;
+    initiatorSubjectId: string;
     sandboxGroupId: string;
     expectedEpoch: number;
     expectedInstanceId: string;
@@ -5666,6 +6783,7 @@ export declare function verifyDirectWorkspaceMutationSettlement(db: Database, in
     sessionId: string;
     requestId: string;
     holderId: string;
+    initiatorSubjectId: string;
     sandboxGroupId: string;
     expectedEpoch: number;
     expectedInstanceId: string;
@@ -5700,6 +6818,10 @@ export declare function retainWorkspaceMutationProcess(db: Database, input: {
         key: string;
         binding: ModalCheckpointProviderBinding;
     } | null;
+    backgroundCommand?: {
+        commandId: string;
+        command: string;
+    };
     owner: {
         kind: "turn";
         turnId: string;
@@ -5716,6 +6838,7 @@ export declare function retainWorkspaceMutationProcess(db: Database, input: {
         kind: "direct";
         requestId: string;
         holderId: string;
+        initiatorSubjectId: string;
         sandboxGroupId: string;
         expectedEpoch: number;
         expectedInstanceId: string;
@@ -5731,7 +6854,8 @@ export declare function getRetainedProcess(db: Database, input: {
     processId: string;
 }): Promise<SandboxRetainedProcess | null>;
 /** Claim a bounded, oldest-due batch of active retained processes whose exact
- * owner attempt is closed (or whose direct request already returned). Claim
+ * owner attempt is closed, whose direct request returned, or whose lifecycle
+ * was explicitly transferred to a session background command. Claim
  * expiry only recovers coordination after worker death; it is never provider
  * exit proof. Rows that settle between the global claim and scoped read are
  * deliberately omitted. */
@@ -6087,10 +7211,13 @@ export declare function persistDrainSnapshot(db: Database, input: {
     workspaceArchiveMeta?: never;
     checkpointArtifactId?: never;
 } | {
-    /** Base64 provider receipt or tar archive from the verified runtime capture. */
-    workspaceArchive: string;
+    /** Base64 provider receipt or tar archive from the verified runtime capture.
+     *  Omit when `workspaceArchiveRef` locates object-storage bytes. */
+    workspaceArchive?: string;
     /** Exact descriptor is mandatory for every new publication. */
     workspaceArchiveMeta: SandboxArchiveRevision;
+    /** Object-storage locator for tar bytes. When set, inline bytes are omitted. */
+    workspaceArchiveRef?: WorkspaceArchiveObjectRef | null;
     /** Required for Modal-native descriptors; absent for actual tar archives. */
     checkpointArtifactId?: string | null;
 })): Promise<{
@@ -6122,6 +7249,7 @@ export declare function rotateWorkspaceArchives(input: {
 }): {
     previousArchive: string | null;
     previousArchiveMeta: SandboxArchiveRevision | null;
+    previousArchiveRef: WorkspaceArchiveObjectRef | null;
 };
 /**
  * MID-SESSION /workspace snapshot fold (sandbox-file-persistence). The WARM
@@ -6145,10 +7273,13 @@ export declare function persistWarmSnapshot(db: Database, input: {
     expectedInstanceId: string;
     expectedWorkspaceGeneration: number;
     captureId: string;
-    /** base64 of the provider snapshot-ref / tar archive from persistWorkspace(). */
-    workspaceArchive: string;
+    /** base64 of the provider snapshot-ref / tar archive from persistWorkspace().
+     *  Omit when `workspaceArchiveRef` locates object-storage bytes. */
+    workspaceArchive?: string;
     /** Exact verified archive/tree descriptor produced by the runtime capture. */
     workspaceArchiveMeta: SandboxArchiveRevision;
+    /** Object-storage locator for tar bytes. When set, inline bytes are omitted. */
+    workspaceArchiveRef?: WorkspaceArchiveObjectRef | null;
     checkpointArtifactId?: string | null;
     /** Snapshots newer than this many ms are kept (throttle); 0 = always write. */
     minIntervalMs: number;
@@ -6334,10 +7465,29 @@ export type SandboxKind = (typeof schema.sandboxKindValues)[number];
 export type EnrollmentExposure = (typeof schema.enrollmentExposureValues)[number];
 export type EnrollmentStatus = (typeof schema.enrollmentStatusValues)[number];
 export type EnrollmentOs = (typeof schema.enrollmentOsValues)[number];
+export type AgentUpdateStatus = (typeof schema.agentUpdateStatusValues)[number];
+export type EnrollmentAgentUpdateRecord = {
+    operationId: string;
+    status: AgentUpdateStatus;
+    targetVersion: string;
+    expectedBinarySha256: string | null;
+    errorCode: string | null;
+    retryable: boolean;
+    rolledBack: boolean;
+    connectionInstanceId: string;
+    connectionGeneration: number;
+    requestedAt: string;
+    updatedAt: string;
+    completedAt: string | null;
+};
 export type EnrollmentRecord = {
     id: string;
     accountId: string;
     workspaceId: string;
+    scope: "organization" | "workspace" | "user";
+    generation: number;
+    sandboxId?: string | null;
+    sandboxName?: string | null;
     pubkey: string;
     exposure: EnrollmentExposure;
     hasDisplay: boolean;
@@ -6346,10 +7496,28 @@ export type EnrollmentRecord = {
      *  not granted); null when capture is permitted or the machine is headless. */
     desktopUnavailableReason: string | null;
     allowScreenControl: boolean;
+    operationPolicy: {
+        memoryMaxBytes: number | null;
+        memoryHighBytes: number | null;
+        cpuMaxMillicores: number | null;
+        revision: number;
+        updatedAt: string | null;
+    };
     status: EnrollmentStatus;
     credentialGeneration: number;
+    /** Exact live runner instance receiving this machine's control traffic. */
+    connectionInstanceId: string | null;
+    /** Monotonic authority generation, advanced only when a different runner claims. */
+    connectionGeneration: number;
+    /** Server-clock expiry for the live runner claim. */
+    connectionLeaseExpiresAt: string | null;
+    /** Valid competing processes denied while another runner held authority. */
+    connectionDuplicateDeniedCount: number;
+    connectionDuplicateDeniedAt: string | null;
     os: EnrollmentOs;
     arch: string;
+    /** Exact absolute launch root last reported by an authoritative runner Hello. */
+    workspaceRoot: string | null;
     lastSeenAt: string | null;
     /** When the machine announced a clean GoingOffline; the liveness derivation reads
      *  an un-cleared marker as offline immediately. NULL ⇒ no goodbye pending. */
@@ -6357,6 +7525,11 @@ export type EnrollmentRecord = {
     /** The typed reason string of the pending clean going-offline (e.g.
      *  GOING_OFFLINE_REASON_UPDATE); NULL when there is no un-cleared marker. */
     wentOfflineReason: string | null;
+    agentVersion: string | null;
+    agentBinarySha256: string | null;
+    agentUpdateChannel: "stable" | "beta" | null;
+    agentCapabilities: Record<string, boolean>;
+    agentUpdate: EnrollmentAgentUpdateRecord | null;
     createdAt: string;
     revokedAt: string | null;
     updatedAt: string;
@@ -6368,6 +7541,8 @@ export type SandboxRecord = {
     kind: SandboxKind;
     name: string;
     enrollmentId: string | null;
+    scope?: "organization" | "workspace" | "user";
+    generation?: number;
     createdAt: string;
     updatedAt: string;
 };
@@ -6381,8 +7556,117 @@ export declare function createEnrollment(db: Database, input: {
     os?: EnrollmentOs;
     arch?: string;
 }): Promise<EnrollmentRecord>;
-export declare function getEnrollment(db: Database, workspaceId: string, enrollmentId: string): Promise<EnrollmentRecord | null>;
-export declare function listEnrollments(db: Database, workspaceId: string, options?: {
+export declare function getEnrollment(db: Database, access: string | {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+}, enrollmentId: string): Promise<EnrollmentRecord | null>;
+/** Read an enrollment only while its exact runner claim is live according to
+ * PostgreSQL's clock. Callers receive capability + process identity from one
+ * snapshot and never reinterpret lease time using an API host's wall clock. */
+export declare function getLiveEnrollmentConnection(db: Database, access: string | {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+}, enrollmentId: string): Promise<EnrollmentRecord | null>;
+export declare function assertPersonalMachineForAttempt(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    enrollmentId: string;
+    requireActiveSandbox?: boolean;
+}): Promise<boolean>;
+/** Resolve one personal Connected Machine's live runner only after the exact
+ * accepted attempt and its immutable snapshot/current grant pass pre-use in the
+ * same transaction and PostgreSQL snapshot. This is the last DB boundary used
+ * immediately before a worker or one-off provider dispatch. */
+export declare function resolvePersonalMachineConnectionForAttempt(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    enrollmentId: string;
+    requireActiveSandbox?: boolean;
+}): Promise<EnrollmentRecord | null>;
+export declare function authorizePersonalMachineForAttempt(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    enrollmentId: string;
+    requireActiveSandbox?: boolean;
+}): Promise<boolean>;
+/** Revision-fenced workspace-operator update of one Connected Machine's optional
+ * command resource policy. NULL remains unrestricted. The active-enrollment check,
+ * CAS, mutation, and audit receipt share one RLS transaction. */
+export declare function updateEnrollmentOperationPolicy(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    enrollmentId: string;
+    subjectId?: string;
+    expectedRevision: number;
+    memoryMaxBytes: number | null;
+    memoryHighBytes: number | null;
+    cpuMaxMillicores?: number | null;
+}): Promise<EnrollmentRecord | null>;
+export type EnrollmentConnectionClaim = {
+    claimed: boolean;
+    connectionInstanceId: string | null;
+    connectionGeneration: number;
+    connectionLeaseExpiresAt: string | null;
+};
+/**
+ * Claims or renews one enrollment's exact live runner instance under the
+ * enrollment-row lock. A second process holding the same valid bearer is denied
+ * while the current runner heartbeats. Once the lease expires, a successor
+ * advances the generation and receives a different NATS address; the old socket
+ * can no longer receive operations even if its short-lived user JWT has not yet
+ * expired.
+ */
+export declare function claimEnrollmentConnection(db: Database, input: {
+    workspaceId: string;
+    enrollmentId: string;
+    credentialGeneration: number;
+    connectionInstanceId: string;
+    leaseMs: number;
+}): Promise<EnrollmentConnectionClaim>;
+/** Renew only the exact active runner. Stale heartbeats never extend or steal a
+ * successor's lease. */
+export declare function renewEnrollmentConnection(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    enrollmentId: string;
+    connectionInstanceId: string;
+    leaseMs: number;
+}): Promise<{
+    renewed: boolean;
+}>;
+/** Release only the exact active runner. A late goodbye from a fenced process is
+ * ignored and cannot mark its successor offline. */
+export declare function releaseEnrollmentConnection(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    enrollmentId: string;
+    connectionInstanceId: string;
+    reason: string;
+}): Promise<{
+    released: boolean;
+}>;
+export declare function listEnrollments(db: Database, access: string | {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+}, options?: {
     status?: EnrollmentStatus;
 }): Promise<EnrollmentRecord[]>;
 export type MachineRemovalOutcome = (typeof schema.machineRemovalOperationOutcomeValues)[number];
@@ -6461,6 +7745,8 @@ export declare function clearEnrollmentWentOffline(db: Database, input: {
     accountId: string;
     workspaceId: string;
     enrollmentId: string;
+    /** When present, only the exact still-live runner may clear the marker. */
+    connectionInstanceId?: string;
 }): Promise<{
     cleared: boolean;
 }>;
@@ -6470,6 +7756,8 @@ export declare function setEnrollmentDisplayState(db: Database, input: {
     enrollmentId: string;
     hasDisplay: boolean;
     desktopUnavailableReason: string | null;
+    /** When present, fence the update to the exact still-live runner. */
+    connectionInstanceId?: string;
 }): Promise<{
     updated: boolean;
 }>;
@@ -6478,6 +7766,61 @@ export declare function setEnrollmentOpStreamState(db: Database, input: {
     workspaceId: string;
     enrollmentId: string;
     opStream: boolean;
+    /** When present, fence the update to the exact still-live runner. */
+    connectionInstanceId?: string;
+}): Promise<{
+    updated: boolean;
+}>;
+/** Refresh the exact running agent build/capabilities from an authoritative
+ * process Hello. A pending update becomes succeeded only when the successor
+ * reports BOTH the requested version and the artifact digest selected from the
+ * signed manifest. Merely reaching `restarting` never counts as success. */
+export declare function setEnrollmentAgentRuntime(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    enrollmentId: string;
+    connectionInstanceId: string;
+    agentVersion: string | null;
+    binarySha256: string | null;
+    updateChannel: "stable" | "beta" | null;
+    capabilities: Record<string, boolean>;
+    /** Omitted when an older or malformed Hello did not report a usable root. */
+    workspaceRoot?: string;
+    completedUpdate: {
+        operationId: string;
+        targetVersion: string;
+        binarySha256: string;
+    } | null;
+}): Promise<{
+    updated: boolean;
+    updateCompleted: boolean;
+}>;
+/** Atomically reserve the one process-global update slot on an exact live
+ * runner generation. An in-flight operation is never overwritten. */
+export declare function beginEnrollmentAgentUpdate(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    enrollmentId: string;
+    connectionInstanceId: string;
+    connectionGeneration: number;
+    operationId: string;
+    targetVersion: string;
+}): Promise<EnrollmentRecord | null>;
+/** Fold one progress event/dispatch failure into the reserved update. Exact
+ * operation + process authority coordinates fence stale events; monotonic rank
+ * prevents reordered NATS delivery from regressing the UI. */
+export declare function advanceEnrollmentAgentUpdate(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    enrollmentId: string;
+    connectionInstanceId: string;
+    connectionGeneration: number;
+    operationId: string;
+    status: Exclude<AgentUpdateStatus, "requested" | "succeeded">;
+    expectedBinarySha256?: string | null;
+    errorCode?: string | null;
+    retryable?: boolean;
+    rolledBack?: boolean;
 }): Promise<{
     updated: boolean;
 }>;
@@ -6540,6 +7883,8 @@ export declare function finalizeEnrollmentByToken(db: Database, input: {
 export declare function approveDeviceEnrollmentRequest(db: Database, input: {
     accountId: string;
     workspaceId: string;
+    scope?: EnrollmentRecord["scope"];
+    allowOrganization?: boolean;
     requestId: string;
     allowScreenControl: boolean;
     approvedBySubjectId: string;
@@ -6572,7 +7917,11 @@ export declare function createSandbox(db: Database, input: {
     name: string;
     enrollmentId?: string | null;
 }): Promise<SandboxRecord>;
-export declare function getSandbox(db: Database, workspaceId: string, sandboxId: string): Promise<SandboxRecord | null>;
+export declare function getSandbox(db: Database, access: string | {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+}, sandboxId: string): Promise<SandboxRecord | null>;
 export declare function listSandboxes(db: Database, workspaceId: string): Promise<SandboxRecord[]>;
 export type ActiveSandboxPointer = {
     activeSandboxId: string | null;
@@ -6593,6 +7942,13 @@ export declare function setActiveSandbox(db: Database, input: {
     sessionId: string;
     targetSandboxId: string | null;
     expectedEpoch: number;
+    subjectId?: string;
+    personalMachineAttempt?: {
+        turnId: string;
+        attemptId: string;
+        executionGeneration: number;
+        initiatingHumanSubjectId: string;
+    };
     workingDir?: string | null;
 }): Promise<{
     swapped: boolean;
@@ -6780,6 +8136,7 @@ export type CreateSessionGoalInput = {
     sessionId: string;
     text: string;
     successCriteria?: string | null;
+    rootConstraints?: string[];
     maxAutoContinuations?: number | null;
     mutationPolicy?: SessionGoalMutationPolicy;
     expectedObjectiveRevision?: number;
@@ -6787,17 +8144,20 @@ export type CreateSessionGoalInput = {
     changeKind?: SessionGoalChangeKind;
     changeRationale?: string;
     sourceProposalId?: string;
+    rollbackOfRevisionId?: string;
     createdBy: SessionGoalCreatedBy;
 };
 export declare function createSessionGoal(db: Database, input: CreateSessionGoalInput): Promise<SessionGoal>;
 export declare function getSessionGoal(db: Database, workspaceId: string, sessionId: string): Promise<SessionGoal | null>;
 export type SessionGoalContinuationProjection = {
     state: "inactive" | "scheduled" | "running" | "blocked" | "invariant_broken";
-    reason: "goal_inactive" | "wake_pending" | "continuation_pending" | "human_work_pending" | "goal_turn_running" | "human_turn_running" | "workstream_paused" | "approval_required" | "provider_backpressure" | "session_cancelled" | "system_work_pending" | "missing_obligation";
+    reason: "goal_inactive" | "wake_pending" | "continuation_pending" | "human_work_pending" | "goal_turn_running" | "human_turn_running" | "workstream_paused" | "approval_required" | "provider_backpressure" | "session_cancelled" | "system_work_pending" | "held_for_input" | "backoff_pending" | "missing_obligation";
     wakeRevision: number;
     observedRevision: number;
     nextAttemptAt: string | null;
     lastError: string | null;
+    /** The agent's stated `goal_wait` reason while `held_for_input`; null otherwise. */
+    holdReason: string | null;
 };
 /**
  * Read the goal and its autonomy state from one repeatable Postgres snapshot.
@@ -6823,6 +8183,21 @@ export declare function upsertSessionGoal(db: Database, input: CreateSessionGoal
     goal: SessionGoal;
     replaced: boolean;
 }>;
+/**
+ * Re-arm one reusable scheduled goal exactly once per admitted run. The receipt,
+ * goal mutation, and timeline fact share the canonical session lock transaction,
+ * so crash recovery cannot reset counters or append goal.set twice.
+ */
+export declare function upsertScheduledSessionGoalForRun(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    runId: string;
+    text: string;
+    successCriteria?: string | null;
+    maxAutoContinuations?: number | null;
+    mutationPolicy?: SessionGoalMutationPolicy;
+}): Promise<SessionEvent[]>;
 /**
  * Agent/API goal_set: session sequence ownership, the create-or-replace
  * mutation, and goal.set timeline fact commit together. The session-first lock
@@ -6838,12 +8213,32 @@ export declare function upsertSessionGoalWithEvent(db: Database, input: CreateSe
     events: SessionEvent[];
 }>;
 export declare function listSessionGoalRevisions(db: Database, workspaceId: string, sessionId: string): Promise<SessionGoalRevision[]>;
+export declare function listSessionGoalRevisionPage(db: Database, workspaceId: string, sessionId: string, options?: {
+    limit: number;
+    before?: string;
+}): Promise<{
+    revisions: SessionGoalRevision[];
+    hasMore: boolean;
+    nextCursor: string | null;
+}>;
 export declare function getSessionGoalRevision(db: Database, workspaceId: string, sessionId: string, revisionId: string): Promise<SessionGoalRevision | null>;
+export declare function rejectSessionGoalRevisionWithEvent(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    revisionId: string;
+    expectedObjectiveRevision: number;
+    rationale: string;
+}): Promise<{
+    revision: SessionGoalRevision;
+    events: SessionEvent[];
+    replay: boolean;
+}>;
 /**
  * Low-level semantic goal revision. The established lifecycle version still
  * advances so stale continuation updates are cancelled, while the migration
- * trigger advances the separate objective revision. A semantic rewrite is not
- * execution progress and therefore never resets the no-progress streak.
+ * trigger advances the separate objective revision. A semantic rewrite does
+ * not synthesize or consume another continuation.
  */
 export declare function updateSessionGoal(db: Database, workspaceId: string, sessionId: string, input: {
     text?: string;
@@ -6886,6 +8281,44 @@ export declare function updateSessionGoalWithEvent(db: Database, workspaceId: st
  * revision. The attempt-fenced operation receipt makes a recovered tool call
  * converge on the original event instead of manufacturing progress twice.
  */
+/**
+ * Column set that retires an agent-declared `goal_wait` hold. Spread into every
+ * goal head mutation (status transition, applied semantic revision, replace) so
+ * newer truth never sits behind an older wait.
+ */
+export declare const SESSION_GOAL_HOLD_MIN_SECONDS = 30;
+export declare const SESSION_GOAL_HOLD_MAX_SECONDS: number;
+/**
+ * Agent `goal_wait`: record that the active goal's next continuation should
+ * wait for child results, a message, a human prompt, or the deadline instead of
+ * materializing immediately after the declaring turn ends.
+ *
+ * The hold is bound to the exact caller turn. The materializer honors it only
+ * while that turn is still the latest finished turn and `now < until`; it
+ * never consumes the wake/observed revision ledger. The receipt, goal
+ * mutation, and `goal.held` timeline fact commit under the canonical goal
+ * event-write prefix (control FOR SHARE -> workspace FOR KEY SHARE -> session
+ * FOR NO KEY UPDATE), never a workspace FOR UPDATE. A replacement attempt
+ * replaying the same target-scoped operation key receives the stored result.
+ */
+export declare function holdSessionGoalContinuationWithEvent(db: Database, workspaceId: string, sessionId: string, input: {
+    reason: string;
+    untilSeconds: number;
+    command: {
+        accountId: string;
+        actor: Extract<SessionCommandActor, {
+            type: "agent_attempt";
+        }>;
+        operationKey: string;
+    };
+}): Promise<{
+    goal: SessionGoal;
+    events: SessionEvent[];
+    operationId: string;
+    replay: boolean;
+    holdTurnId: string;
+    untilAt: string;
+}>;
 export declare function recordSessionGoalProgressWithEvent(db: Database, workspaceId: string, sessionId: string, input: {
     progressNote: string;
     command: {
@@ -6970,7 +8403,7 @@ export type GoalContinuationDecision = {
     decision: "queue";
 } | {
     decision: "paused";
-    reason: "no_progress" | "max_auto_continuations" | "limits";
+    reason: "max_auto_continuations" | "limits";
     goal: SessionGoal;
 } | {
     decision: "continue";
@@ -6982,20 +8415,38 @@ export type GoalContinuationDecision = {
  * Core continuation decision, taken in one transaction with the goal row
  * locked. Queued work always wins; any non-terminal turn (queued, running, or
  * requires_action awaiting a human approval) blocks auto-continuation. The
- * no-progress and max-continuation guards mutate counters here only, so a
- * replaying workflow re-reads recorded activity results and never recomputes
- * them.
+ * optional max-continuation guard mutates its counter here only, so a replaying
+ * workflow re-reads recorded activity results and never recomputes it.
  */
 export declare function evaluateGoalContinuation(db: Database, input: {
     workspaceId: string;
     sessionId: string;
     defaultMaxAutoContinuations?: number | null;
-    noProgressLimit: number;
     budgetBlocked?: string | null;
 }): Promise<GoalContinuationDecision>;
+export declare const GOAL_IDLE_BACKOFF_WAKE_REASON = "goal_idle_backoff";
+/**
+ * Pacing between consecutive no-input goal continuations. `scheduleMs[n - 1]`
+ * (last entry repeats) is the delay before the n-th consecutive continuation,
+ * measured from when the previous continuation turn finished; `maxMs` bounds
+ * every delay. Omitted/null means no backoff (the legacy immediate behavior).
+ */
+export type GoalIdleBackoffPolicy = {
+    scheduleMs: readonly number[];
+    maxMs: number;
+};
 export type MaterializeGoalContinuationResult = {
     action: "none" | "queue";
     events: [];
+} | {
+    action: "held";
+    events: [];
+    holdTurnId: string;
+    holdUntil: Date;
+} | {
+    action: "deferred";
+    events: [];
+    notBefore: Date;
 } | {
     action: "paused";
     events: SessionEvent[];
@@ -7010,7 +8461,7 @@ export type MaterializeGoalContinuationResult = {
  * Consume one durable goal-wake revision into one continuation obligation.
  *
  * This is deliberately one outer PostgreSQL transaction. The existing locked
- * evaluator runs as a nested savepoint, so its no-progress/counter mutation is
+ * evaluator runs as a nested savepoint, so its counter mutation is
  * rolled back if prompt construction, update/event insertion, metering, or the
  * workflow-wake outbox write fails. Retrying after a lost COMMIT response sees
  * the same stable goal revision and the already-pending update; it never spends
@@ -7022,8 +8473,8 @@ export declare function materializeGoalContinuation(db: Database, input: {
     sessionId: string;
     workflowId: string;
     defaultMaxAutoContinuations?: number | null;
-    noProgressLimit: number;
     budgetBlocked?: string | null;
+    idleBackoff?: GoalIdleBackoffPolicy | null;
     policy: {
         model: string;
         reasoningEffort: ReasoningEffort;
@@ -7045,15 +8496,34 @@ export type InitializeSessionStartInput = {
     goal?: {
         text: string;
         successCriteria?: string | null;
+        rootConstraints?: string[];
         maxAutoContinuations?: number | null;
         mutationPolicy?: SessionGoalMutationPolicy;
+        createdBy?: SessionGoalCreatedBy;
     } | null;
     consumeNewSessionDraft?: {
         subjectId: string;
         expectedRevision: number;
+        expectedSnapshot?: NewSessionDraftSnapshot;
+        acceptedSelection?: {
+            channelId: string | null;
+            targetSandboxId: string | null;
+            workingDir: string | null;
+        };
+    } | null;
+    /** Successful create that preserves, rather than consumes, the draft. */
+    rememberNewSessionSelection?: {
+        subjectId: string;
+        acceptedSelection: {
+            channelId: string | null;
+            targetSandboxId: string | null;
+            workingDir: string | null;
+        };
     } | null;
     /** Persist session.created only; realtime will supply the first human turn. */
     deferInitialTurn?: boolean;
+    /** Public status persisted with a deferred session start. Defaults to idle. */
+    deferredStatus?: Extract<SessionStatus, "idle" | "queued">;
 };
 export type InitializeSessionStartResult = {
     events: SessionEvent[];
@@ -7092,6 +8562,13 @@ export type ClaimSessionWorkForAttemptInput = {
     attemptId: string;
     dispatchId: string;
     trigger: SessionWorkTrigger;
+    /** Optional worker-owned mutable-authority fence for pending machine inputs. */
+    validatePendingSystemUpdateAuthority?: (tx: Database, update: SessionSystemUpdate) => Promise<{
+        action: "accept";
+    } | {
+        action: "reject";
+        reason: string;
+    }>;
 };
 export type ClaimSessionWorkForAttemptResult = {
     action: "claimed";
@@ -7237,7 +8714,6 @@ export type SessionWorkPeek = {
 } | {
     kind: "idle";
 };
-/** Read durable session state without reserving a turn-worker slot or mutating it. */
 export declare function peekSessionWork(db: Database, workspaceId: string, sessionId: string): Promise<SessionWorkPeek>;
 export type FailSessionWorkBeforeAttemptClaimInput = {
     accountId: string;
@@ -7315,11 +8791,12 @@ export type ApplySessionTurnSettlementInput = {
     activeTurnId: string | null;
     events: AppendEventInput[];
     /**
-     * A mid-turn SDK freeze installed atomically with requires_action. Human
-     * input requests are public protocol rows; ordinary approvals remain only in
-     * pendingApprovals. No request can become visible without the exact frozen
-     * RunState needed to resume it, and no frozen request can miss its status
-     * transition/events because all writes share this transaction.
+     * A mid-turn requires_action freeze. Human-input rows and interaction
+     * interventions are public protocol; ordinary approvals remain in
+     * pendingApprovals. Pause attaches the bounded open suffix on
+     * `session_pending_tool_calls` and stores the open-suffix sentinel here.
+     * Resume uses the suffix plus paired history and must not call
+     * `RunState.fromString`.
      */
     runState?: {
         serializedRunState: string;
@@ -7355,6 +8832,7 @@ export type ApplySessionTurnSettlementInput = {
 export type ApplySessionTurnSettlementResult = {
     action: "settled";
     events: SessionEvent[];
+    canonicalStartupMilestones: CanonicalTurnStartupMilestoneReceipt[];
     recordingMutationApplied: boolean;
 } | {
     action: "stale";
@@ -7369,6 +8847,12 @@ export type ApplySessionTurnSettlementHooks = {
         turnId: string;
     }) => void | Promise<void>) | undefined;
 };
+export type CanonicalTurnStartupMilestoneReceipt = {
+    milestone: "queue" | "provider_dispatch" | "first_byte";
+    outcome: "completed" | "failed";
+    eventId: string;
+    durationMs: number;
+};
 /**
  * Atomically append terminal/requires-action truth, update the exact turn, and
  * transition the owning session. A superseded dispatch or closed control gate
@@ -7525,12 +9009,30 @@ export declare function getSessionTurnForAttempt(db: Database, workspaceId: stri
  * the model that actually ran rather than reverting to a stale default.
  */
 export declare function getLatestStartedSessionTurn(db: Database, workspaceId: string, sessionId: string): Promise<SessionTurn | null>;
+/**
+ * Freeze the effective policy an internal scheduled update would inherit from
+ * an existing session at occurrence admission. The later claim consumes this
+ * exact policy instead of re-reading whichever turn happened to start most
+ * recently in the meantime.
+ */
+export declare function getScheduledTargetSessionExecution(db: Database, workspaceId: string, sessionId: string, authoritySubjectId?: string | null): Promise<ScheduledTaskRunAcceptedExecutionType["targetSessionExecution"]>;
 export declare function listSessionTurns(db: Database, workspaceId: string, sessionId: string, limit?: number): Promise<SessionTurn[]>;
 export declare function listPendingSessionTurns(db: Database, workspaceId: string, sessionId: string): Promise<SessionTurn[]>;
 export declare function getSessionQueueSnapshot(db: Database, workspaceId: string, sessionId: string): Promise<SessionQueueSnapshot | null>;
-type ChildTerminalResultPayload = Extract<SessionSystemUpdatePayload, {
-    type: "child_terminal_result";
+type ChildLifecycleOutboxPayload = Extract<SessionSystemUpdatePayload, {
+    type: ChildLifecycleSystemUpdateKind;
 }>;
+/** Derive the bounded responder kind of a human-input/approval resolution. */
+export declare function childRequiresActionRespondedByKindFor(respondedBy: string, explicit?: ChildRequiresActionRespondedByKind): ChildRequiresActionRespondedByKind;
+/** The exact kind/payload pair of one child-lifecycle outbox row, correlated for typed re-insert. */
+export type SessionSystemUpdateOutboxKindPayload = {
+    [Kind in ChildLifecycleSystemUpdateKind]: {
+        kind: Kind;
+        payload: Extract<SessionSystemUpdatePayload, {
+            type: Kind;
+        }>;
+    };
+}[ChildLifecycleSystemUpdateKind];
 export type SessionSystemUpdateOutboxDelivery = {
     id: string;
     status: "pending" | "delivered";
@@ -7539,15 +9041,17 @@ export type SessionSystemUpdateOutboxDelivery = {
     sourceSessionId: string;
     targetSessionId: string;
     dedupeKey: string;
-    kind: "child_terminal_result";
+    kind: ChildLifecycleSystemUpdateKind;
     classification: SystemUpdateClassification;
     sourceId: string;
     summary: string;
-    payload: ChildTerminalResultPayload;
+    payload: ChildLifecycleOutboxPayload;
     lineage: Record<string, unknown>;
     personalConnectionDelegations: McpPersonalConnectionDelegation[];
     xaiProviderAccountAuthoritySnapshot: XaiProviderAccountAuthoritySnapshotV1;
 };
+/** Narrow an outbox row back to its correlated typed kind/payload input variant. */
+export declare function sessionSystemUpdateOutboxKindPayload(outbox: Pick<SessionSystemUpdateOutboxDelivery, "kind" | "payload">): SessionSystemUpdateOutboxKindPayload;
 /**
  * Read the exact durable parent-update row created by terminal turn settlement.
  * Failure delivery must never upsert this row: settlement owns its payload and
@@ -7654,6 +9158,7 @@ export type AddSessionSystemUpdateInput = {
     lineage?: Record<string, unknown>;
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
     xaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;
+    scheduledTaskRunId?: string | null;
 } & SessionSystemUpdateInputVariant;
 export type AddSessionSystemUpdateResult = {
     added: false;
@@ -7668,12 +9173,46 @@ export type AddSessionSystemUpdateResult = {
     temporalWorkflowId: string | null;
     events: SessionEvent[];
 };
+export type PrepareSessionSystemUpdateSourceResult = {
+    /** Private, bounded, content-free source authority appended before insert. */
+    lineage?: Record<string, unknown>;
+};
 export declare function addSessionSystemUpdate(db: Database, input: AddSessionSystemUpdateInput): Promise<AddSessionSystemUpdateResult>;
 /**
  * Persist one internal update without fabricating a user prompt or queue row.
  * Dedupe and any producer/outbox mutation commit in the same transaction.
  */
-export declare function addSessionSystemUpdateWithSourceMutation(db: Database, input: AddSessionSystemUpdateInput, mutateSource: (tx: Database, wakeEventId: string | null, updateId: string | null) => Promise<void>): Promise<AddSessionSystemUpdateResult>;
+export declare function addSessionSystemUpdateWithSourceMutation(db: Database, input: AddSessionSystemUpdateInput, mutateSource: (tx: Database, wakeEventId: string | null, updateId: string | null) => Promise<void>, options?: {
+    /** Runs under the locked session/source transaction before any update/event insert. */
+    prepareSource?: (tx: Database, sessionId: string) => Promise<PrepareSessionSystemUpdateSourceResult | void>;
+}): Promise<AddSessionSystemUpdateResult>;
+/**
+ * One durable machine input by id, under the ordinary workspace RLS scope.
+ * The row outlives delivery, so a late bounded projection of an already
+ * announced `system.update.pending` event (Slack notification delivery)
+ * resolves the exact typed notice instead of re-deriving it from the
+ * lossy event preview. Read-only: it never mutates or consumes the update.
+ */
+export declare function getSessionSystemUpdateById(db: Database, workspaceId: string, sessionId: string, updateId: string): Promise<SessionSystemUpdate | null>;
+/**
+ * Whether the parent already holds a `child_requires_action_resolved` notice
+ * for one exact blocked boundary. Read-only, under the ordinary workspace RLS
+ * scope, and answered entirely from the PARENT's own rows: the child session is
+ * never read.
+ *
+ * A resolution supersedes a still-pending `child_requires_action` in the same
+ * commit, but a notice already claimed into a parent turn is `delivered` and
+ * keeps that state forever. A late reader (Slack delivery running behind a
+ * widened retry window) therefore cannot decide staleness from `state` alone.
+ * One accepted response advances that exact (child, turn, generation) boundary
+ * - a re-freeze is a new generation and a new notice - so the presence of the
+ * resolution row in any state is the durable "no longer blocked" fact.
+ */
+export declare function childRequiresActionResolutionExists(db: Database, workspaceId: string, sessionId: string, boundary: {
+    childSessionId: string;
+    childTurnId: string;
+    childTurnGeneration: number;
+}): Promise<boolean>;
 export declare function listOutstandingSessionSystemUpdates(db: Database, workspaceId: string, sessionId: string): Promise<SessionSystemUpdate[]>;
 /** Internal updates atomically attached when this inference was claimed. */
 export declare function listSessionSystemUpdatesForTurn(db: Database, workspaceId: string, sessionId: string, turnId: string): Promise<SessionSystemUpdate[]>;
@@ -7698,6 +9237,8 @@ export declare function acceptSessionApprovalDecision(db: Database, input: {
     sessionId: string;
     subjectId: string;
     payload: Record<string, unknown>;
+    /** Bounded decider kind for the parent's resolution notice; `human` when omitted. */
+    respondedByKind?: ChildRequiresActionRespondedByKind;
     clientEventId?: string | null;
     interactionIntervention?: {
         interventionId: string;
@@ -7731,6 +9272,7 @@ export declare function expireSessionInteractionIntervention(db: Database, input
 export declare function appendSessionEventsForTurnAttempt(db: Database, workspaceId: string, sessionId: string, turnId: string, executionGeneration: number, attemptId: string, inputs: AppendEventInput[]): Promise<{
     events: SessionEvent[];
     accepted: boolean;
+    canonicalStartupMilestones: CanonicalTurnStartupMilestoneReceipt[];
 }>;
 /**
  * Commit one exact-attempt mutation and its timeline projection together. The
@@ -7741,6 +9283,7 @@ export declare function mutateAndAppendSessionEventsForTurnAttempt(db: Database,
     events: SessionEvent[];
     accepted: boolean;
     mutationApplied: boolean;
+    canonicalStartupMilestones: CanonicalTurnStartupMilestoneReceipt[];
 }>;
 export type SettleCodemodeOperationWithOutputInput = {
     accountId: string;
@@ -7837,5 +9380,8 @@ export * from "./browser-auth.js";
 export * from "./browser-downloads.js";
 export * from "./attached-browser-devices.js";
 export * from "./interaction-revisions.js";
+export * from "./interaction-placement-loss.js";
 export * from "./canonical-human-identities.js";
 export * from "./session-tenancy.js";
+export * from "./governed-learning-activation.js";
+export * from "./automations.js";