@opengeni/db 0.7.3 → 0.10.7

package/dist/schema.d.ts

@@ -1,3 +1,3 @@
 import 'drizzle-orm';
 import 'drizzle-orm/pg-core';
-export { m as agentRunStates, n as apiKeys, o as auditEvents, p as billingCustomers, q as capabilityCatalogItems, r as capabilityInstallations, t as codexCapacityWaiters, u as codexCredentialLeases, v as codexRotationSettings, w as codexSubscriptionCredentials, c as composerDrafts, x as connections, y as creditLedgerEntries, z as deviceEnrollmentRequests, g as deviceEnrollmentStatusValues, A as documentBases, B as documentChunks, C as documents, f as enrollmentExposureValues, e as enrollmentOsValues, h as enrollmentStatusValues, D as enrollments, E as fileUploads, F as files, G as githubInstallations, H as importBatches, I as integrationOauthClients, J as integrationOauthStateNonces, K as knowledgeMemories, L as machineMetricsLatest, M as machineMetricsSeries, N as managedAccounts, O as packInstallations, P as rigChanges, Q as rigVersions, R as rigs, i as sandboxKindValues, S as sandboxLeaseHolders, T as sandboxLeaseLivenessValues, U as sandboxLeases, V as sandboxPtySessions, W as sandboxSessionEnvelopes, X as sandboxes, Y as scheduledTaskRuns, Z as scheduledTasks, _ as sessionAttemptInterruptions, s as sessionCommandReceipts, $ as sessionEvents, a0 as sessionGoals, a1 as sessionHistoryItems, a2 as sessionListSnapshots, a3 as sessionMcpServers, a4 as sessionPendingToolCalls, a5 as sessionPins, j as sessionRecordingCodecValues, k as sessionRecordingModeValues, l as sessionRecordingStateValues, a6 as sessionRecordings, a7 as sessionSystemUpdateOutbox, a8 as sessionSystemUpdates, a as sessionTurnAttempts, b as sessionTurns, a9 as sessionWorkflowWakeOutbox, aa as sessions, ab as socialConnections, ac as socialPosts, ad as stripeWebhookEvents, ae as usageEvents, af as workspaceCaptures, ag as workspaceControlEvents, ah as workspaceInferenceControls, ai as workspaceMemberships, aj as workspaceModelPolicies, ak as workspacePacks, al as workspaceVariableSetVariables, am as workspaceVariableSets, an as workspaces } from './schema-BN5mB9xZ.js';
+export { n as agentRunStates, o as apiKeys, p as auditEvents, q as billingCustomers, r as capabilityCatalogItems, t as capabilityInstallations, u as codexCapacityWaiters, v as codexCredentialLeases, x as codexResetRedemptionAttempts, y as codexRotationSettings, z as codexSubscriptionCredentials, d as composerDrafts, A as connections, B as creditLedgerEntries, C as deviceEnrollmentRequests, h as deviceEnrollmentStatusValues, D as documentBases, E as documentChunks, F as documents, g as enrollmentExposureValues, f as enrollmentOsValues, i as enrollmentStatusValues, G as enrollments, H as fileUploads, I as files, J as githubInstallationRepositories, K as githubInstallations, L as hostExportConfig, M as hostExportConsumers, N as hostExportCursorState, O as hostExportDeadLetters, P as hostExportOutbox, Q as importBatches, R as integrationOauthClients, S as integrationOauthStateNonces, T as knowledgeMemories, U as machineMetricsLatest, V as machineMetricsSeries, W as managedAccounts, X as packInstallations, Y as rigChanges, Z as rigVersions, _ as rigs, j as sandboxKindValues, $ as sandboxLeaseHolders, a0 as sandboxLeaseLivenessValues, a1 as sandboxLeases, a2 as sandboxPtySessions, a3 as sandboxSessionEnvelopes, a4 as sandboxes, a5 as scheduledTaskRuns, a6 as scheduledTasks, a7 as sessionAttemptInterruptions, s as sessionCommandReceipts, a8 as sessionEvents, a9 as sessionGoals, aa as sessionHistoryItems, ab as sessionHumanInputRequests, ac as sessionListSnapshots, ad as sessionMcpServers, ae as sessionPendingToolCalls, af as sessionPins, k as sessionRecordingCodecValues, l as sessionRecordingModeValues, m as sessionRecordingStateValues, ag as sessionRecordings, ah as sessionSystemUpdateOutbox, ai as sessionSystemUpdates, c as sessionTurnAttempts, b as sessionTurns, aj as sessionWorkflowWakeOutbox, a as sessions, ak as socialConnections, al as socialPosts, am as stripeWebhookEvents, an as usageEvents, ao as workspaceCaptures, ap as workspaceControlEvents, aq as workspaceInferenceControls, ar as workspaceMemberships, as as workspaceModelPolicies, at as workspacePacks, au as workspaceSessionActivityRevisions, av as workspaceVariableSetVariables, aw as workspaceVariableSets, w as workspaces } from './schema-CqkzrBRS.js';

package/dist/schema.js

@@ -7,6 +7,7 @@ import {
   capabilityInstallations,
   codexCapacityWaiters,
   codexCredentialLeases,
+  codexResetRedemptionAttempts,
   codexRotationSettings,
   codexSubscriptionCredentials,
   composerDrafts,
@@ -23,7 +24,13 @@ import {
   enrollments,
   fileUploads,
   files,
+  githubInstallationRepositories,
   githubInstallations,
+  hostExportConfig,
+  hostExportConsumers,
+  hostExportCursorState,
+  hostExportDeadLetters,
+  hostExportOutbox,
   importBatches,
   integrationOauthClients,
   integrationOauthStateNonces,
@@ -49,6 +56,7 @@ import {
   sessionEvents,
   sessionGoals,
   sessionHistoryItems,
+  sessionHumanInputRequests,
   sessionListSnapshots,
   sessionMcpServers,
   sessionPendingToolCalls,
@@ -73,10 +81,11 @@ import {
   workspaceMemberships,
   workspaceModelPolicies,
   workspacePacks,
+  workspaceSessionActivityRevisions,
   workspaceVariableSetVariables,
   workspaceVariableSets,
   workspaces
-} from "./chunk-B22X3IEZ.js";
+} from "./chunk-P6PKXY5W.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,
@@ -87,6 +96,7 @@ export {
   capabilityInstallations,
   codexCapacityWaiters,
   codexCredentialLeases,
+  codexResetRedemptionAttempts,
   codexRotationSettings,
   codexSubscriptionCredentials,
   composerDrafts,
@@ -103,7 +113,13 @@ export {
   enrollments,
   fileUploads,
   files,
+  githubInstallationRepositories,
   githubInstallations,
+  hostExportConfig,
+  hostExportConsumers,
+  hostExportCursorState,
+  hostExportDeadLetters,
+  hostExportOutbox,
   importBatches,
   integrationOauthClients,
   integrationOauthStateNonces,
@@ -129,6 +145,7 @@ export {
   sessionEvents,
   sessionGoals,
   sessionHistoryItems,
+  sessionHumanInputRequests,
   sessionListSnapshots,
   sessionMcpServers,
   sessionPendingToolCalls,
@@ -153,6 +170,7 @@ export {
   workspaceMemberships,
   workspaceModelPolicies,
   workspacePacks,
+  workspaceSessionActivityRevisions,
   workspaceVariableSetVariables,
   workspaceVariableSets,
   workspaces

package/drizzle/0053_codex_credential_leases.sql

@@ -1,5 +1,5 @@
 -- 0053_codex_credential_leases.sql
--- OPE-21: fair, atomic Codex subscription selection across worker replicas.
+-- tracking-21: fair, atomic Codex subscription selection across worker replicas.
 --
 -- Every field in this migration is workspace-local. In particular, the same
 -- external ChatGPT subscription connected in two workspaces is intentionally
@@ -227,4 +227,4 @@ BEGIN
       app_role
     );
   END IF;
-END $$;
+END $$;

package/drizzle/0057_durable_queue_control.sql

@@ -1,4 +1,4 @@
--- OPE-18/OPE-21/OPE-22: one prompt queue, one current inference, portable
+-- tracking-18/tracking-21/tracking-22: one prompt queue, one current inference, portable
 -- compaction, attempt-fenced publication, coalesced internal updates, and
 -- session/workspace Pause.
 --

package/drizzle/0061_session_workflow_wake_outbox.sql

@@ -1,4 +1,4 @@
--- OPE-50: replace the blind periodic scan of "enrollable" sessions with a
+-- tracking-50: replace the blind periodic scan of "enrollable" sessions with a
 -- transactional, revisioned, coalescing delivery ledger. Postgres is the
 -- durable work source; a Temporal signal is an idempotent nudge.
 

package/drizzle/0062_session_list_snapshot_reaper.sql

@@ -1,4 +1,4 @@
--- OPE-44: session list reads are serializable and subject-scoped. Performing a
+-- tracking-44: session list reads are serializable and subject-scoped. Performing a
 -- global expired-row delete inside every read makes concurrent API replicas
 -- conflict on the same rows. Move TTL cleanup to one bounded SKIP LOCKED
 -- reaper operation and keep the request transaction strictly request-local.

package/drizzle/0063_session_control_mega_foundation.sql

@@ -1,5 +1,5 @@
 -- deployment-mode: maintenance
--- OPE-18/OPE-54: one-way queue/control maintenance cutover. Old workers are
+-- tracking-18/tracking-54: one-way queue/control maintenance cutover. Old workers are
 -- drained before this migration; obsolete columns are removed in this same
 -- transaction so no mixed runtime architecture can survive deployment.
 

package/drizzle/0064_rotation_strategy_sharded_backfill.sql

@@ -0,0 +1,15 @@
+-- deployment-mode: rolling
+-- tracking-36: the strategy picker is gone — rotation-enabled always behaves as
+-- sticky-sharded (worker-side effectiveRotationStrategy normalizes every read).
+-- Backfill stored legacy values so the column tells the truth going forward.
+-- The column itself is KEPT (old-binary rollback safety): an old worker reading
+-- 'sharded' runs the strategy that was already live on every real workspace.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+UPDATE "codex_rotation_settings"
+SET "rotation_strategy" = 'sharded'
+WHERE "rotation_strategy" IS DISTINCT FROM 'sharded';
+
+ALTER TABLE "codex_rotation_settings" ALTER COLUMN "rotation_strategy" SET DEFAULT 'sharded';

package/drizzle/0065_codex_subscription_overview.sql

@@ -0,0 +1,168 @@
+-- deployment-mode: maintenance
+-- Codex quota: trustworthy Codex subscription overview, allocator OCC/audit, and
+-- owning-human reset-credit redemption.
+--
+-- Old API binaries do not write connected_by_subject_id and do not fence
+-- disconnect/reconnect against unresolved provider attempts. Drain every old
+-- API replica before applying this migration, then start only this revision;
+-- mixed-version writers would invalidate the owning-human redemption boundary.
+--
+-- tracking-21 exclusively owns allocator_enabled in migration 0053. This migration
+-- only adds the independent OCC/audit fields, provider summary cache, connecting
+-- human attribution, and the durable ambiguity-safe redemption state machine.
+
+ALTER TABLE "codex_subscription_credentials"
+  ADD COLUMN IF NOT EXISTS "allocator_version" integer NOT NULL DEFAULT 1,
+  ADD COLUMN IF NOT EXISTS "allocator_updated_by_subject_id" text,
+  ADD COLUMN IF NOT EXISTS "allocator_updated_at" timestamptz,
+  ADD COLUMN IF NOT EXISTS "reset_credit_available_count" integer,
+  ADD COLUMN IF NOT EXISTS "reset_credits_checked_at" timestamptz,
+  ADD COLUMN IF NOT EXISTS "connected_by_subject_id" text;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'codex_subscription_credentials_allocator_version_check'
+      AND conrelid = 'codex_subscription_credentials'::regclass
+  ) THEN
+    ALTER TABLE "codex_subscription_credentials"
+      ADD CONSTRAINT "codex_subscription_credentials_allocator_version_check"
+      CHECK (allocator_version > 0) NOT VALID;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'codex_subscription_credentials_reset_count_check'
+      AND conrelid = 'codex_subscription_credentials'::regclass
+  ) THEN
+    ALTER TABLE "codex_subscription_credentials"
+      ADD CONSTRAINT "codex_subscription_credentials_reset_count_check"
+      CHECK (reset_credit_available_count IS NULL OR reset_credit_available_count >= 0) NOT VALID;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'codex_subscription_credentials_human_owner_check'
+      AND conrelid = 'codex_subscription_credentials'::regclass
+  ) THEN
+    ALTER TABLE "codex_subscription_credentials"
+      ADD CONSTRAINT "codex_subscription_credentials_human_owner_check"
+      CHECK (connected_by_subject_id IS NULL OR connected_by_subject_id LIKE 'user:_%') NOT VALID;
+  END IF;
+END $$;
+
+ALTER TABLE "codex_subscription_credentials"
+  VALIDATE CONSTRAINT "codex_subscription_credentials_allocator_version_check";
+ALTER TABLE "codex_subscription_credentials"
+  VALIDATE CONSTRAINT "codex_subscription_credentials_reset_count_check";
+ALTER TABLE "codex_subscription_credentials"
+  VALIDATE CONSTRAINT "codex_subscription_credentials_human_owner_check";
+
+CREATE TABLE IF NOT EXISTS "codex_reset_redemption_attempts" (
+  -- Browser-generated logical id. Reusing it is what prevents one ambiguous
+  -- click/reload/retry from becoming a second logical redemption.
+  "id" uuid PRIMARY KEY NOT NULL,
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "credential_id" uuid NOT NULL,
+  "subject_id" text NOT NULL,
+  -- SHA-256 of the Better Auth session id. The raw session id and cookies never
+  -- enter product tables, logs, audit metadata, or browser responses.
+  "browser_session_hash" text NOT NULL,
+  -- Required for an ambiguity retry. It is intentionally absent from audit and
+  -- event metadata; provider opaque ids are not observability dimensions.
+  "credit_id" text NOT NULL,
+  -- Generated once by the server and reused for every upstream retry.
+  "upstream_idempotency_key" uuid NOT NULL DEFAULT gen_random_uuid(),
+  "status" text NOT NULL DEFAULT 'processing',
+  "outcome" text,
+  "claim_holder_id" uuid,
+  "claim_expires_at" timestamptz,
+  "confirmation_expires_at" timestamptz NOT NULL,
+  "provider_started_at" timestamptz,
+  "completed_at" timestamptz,
+  "last_failure_kind" text,
+  "retry_count" integer NOT NULL DEFAULT 0,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "codex_reset_redemption_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id")
+    ON DELETE CASCADE,
+  -- Deliberately no credential FK: a disconnect must never cascade-delete the
+  -- only durable upstream redeem_request_id after provider work may have begun.
+  -- Accessors validate and lock the workspace credential before every send;
+  -- completed history may outlive a later safe credential disconnect.
+  CONSTRAINT "codex_reset_redemption_status_check"
+    CHECK (status IN ('processing', 'provider_started', 'completed')),
+  CONSTRAINT "codex_reset_redemption_outcome_check"
+    CHECK (outcome IS NULL OR outcome IN ('reset', 'nothingToReset', 'noCredit', 'alreadyRedeemed')),
+  CONSTRAINT "codex_reset_redemption_completed_check"
+    CHECK ((status = 'completed') = (outcome IS NOT NULL AND completed_at IS NOT NULL)),
+  CONSTRAINT "codex_reset_redemption_retry_count_check"
+    CHECK (retry_count >= 0),
+  CONSTRAINT "codex_reset_redemption_human_subject_check"
+    CHECK (subject_id LIKE 'user:_%')
+);
+
+-- Keep this additive/idempotent for forward recovery from a previously completed
+-- equivalent schema state.
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'codex_reset_redemption_human_subject_check'
+      AND conrelid = 'codex_reset_redemption_attempts'::regclass
+  ) THEN
+    ALTER TABLE "codex_reset_redemption_attempts"
+      ADD CONSTRAINT "codex_reset_redemption_human_subject_check"
+      CHECK (subject_id LIKE 'user:_%') NOT VALID;
+  END IF;
+END $$;
+ALTER TABLE "codex_reset_redemption_attempts"
+  VALIDATE CONSTRAINT "codex_reset_redemption_human_subject_check";
+
+CREATE UNIQUE INDEX IF NOT EXISTS "codex_reset_redemption_upstream_key_idx"
+  ON "codex_reset_redemption_attempts" ("upstream_idempotency_key");
+-- A provider credit can have only one active or successfully consumed logical
+-- attempt. Provider outcomes nothingToReset/noCredit are explicitly non-success
+-- outcomes and must not permanently prevent a later, newly confirmed attempt.
+CREATE UNIQUE INDEX IF NOT EXISTS "codex_reset_redemption_credential_credit_idx"
+  ON "codex_reset_redemption_attempts" ("workspace_id", "credential_id", "credit_id")
+  WHERE status <> 'completed' OR outcome IN ('reset', 'alreadyRedeemed');
+CREATE INDEX IF NOT EXISTS "codex_reset_redemption_workspace_credential_idx"
+  ON "codex_reset_redemption_attempts" ("workspace_id", "credential_id", "created_at" DESC);
+CREATE INDEX IF NOT EXISTS "codex_reset_redemption_claim_expiry_idx"
+  ON "codex_reset_redemption_attempts" ("claim_expires_at")
+  WHERE status <> 'completed';
+
+ALTER TABLE "codex_reset_redemption_attempts" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "codex_reset_redemption_attempts" FORCE ROW LEVEL SECURITY;
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE schemaname = current_schema()
+      AND tablename = 'codex_reset_redemption_attempts'
+      AND policyname = 'workspace_isolation'
+  ) THEN
+    DROP POLICY workspace_isolation ON "codex_reset_redemption_attempts";
+  END IF;
+END $$;
+
+CREATE POLICY workspace_isolation ON "codex_reset_redemption_attempts"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+DO $$
+DECLARE
+  target_schema text := current_schema();
+  app_role text := 'opengeni_app';
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = app_role) THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO %I',
+      target_schema,
+      app_role
+    );
+  END IF;
+END $$;

package/drizzle/0065_session_attempt_quiescence.sql

@@ -0,0 +1,26 @@
+-- deployment-mode: maintenance
+-- A cancelled attempt records the exact boundary after which it has no
+-- inference, user-visible output, or workspace-persistence authority.
+-- Fenced/idempotent cleanup and telemetry may still finish. Temporal
+-- independently waits for the activity to terminate; this receipt lets queue
+-- admission and UI state use durable truth.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '5min';
+
+ALTER TABLE "session_turn_attempts"
+  ADD COLUMN "quiesced_at" timestamptz;
+
+-- Maintenance mode drains the pre-cutover workers before this backfill, so an
+-- interrupted attempt that is already closed has also left its physical
+-- activity. Seed only that historical population; new activity/workflow code
+-- owns all later receipts.
+UPDATE "session_turn_attempts" AS attempt
+SET "quiesced_at" = COALESCE(attempt."closed_at", attempt."updated_at", now())
+WHERE attempt."state" = 'closed'
+  AND EXISTS (
+    SELECT 1
+    FROM "session_attempt_interruptions" AS interruption
+    WHERE interruption."workspace_id" = attempt."workspace_id"
+      AND interruption."attempt_id" = attempt."id"
+  );

package/drizzle/0065_session_tool_policy.sql

@@ -0,0 +1,38 @@
+-- deployment-mode: rolling
+-- Persist the origin of a session's tool allow-list. NULL is a
+-- deliberate legacy marker for rows created before policy provenance existed.
+ALTER TABLE "sessions"
+  ADD COLUMN IF NOT EXISTS "tool_policy" jsonb;
+
+ALTER TABLE "sessions"
+  DROP CONSTRAINT IF EXISTS "sessions_tool_policy_shape_check";
+
+ALTER TABLE "sessions"
+  ADD CONSTRAINT "sessions_tool_policy_shape_check"
+  CHECK (
+    "tool_policy" IS NULL
+    OR (
+      jsonb_typeof("tool_policy") = 'object'
+      AND "tool_policy" ? 'mode'
+      AND ("tool_policy" ->> 'mode') IN ('workspace_default', 'explicit', 'inherited', 'legacy')
+      AND "tool_policy" ? 'inheritedFromSessionId'
+      AND (
+        ("tool_policy" ->> 'inheritedFromSessionId') IS NULL
+        OR ("tool_policy" ->> 'inheritedFromSessionId') ~ '^[0-9a-fA-F-]{36}$'
+      )
+    )
+  ) NOT VALID;
+
+-- Follow-up turns also need provenance: an omitted tools key inherits the
+-- session policy, while an explicit array replaces it for that turn (subject
+-- to the session subset fence). Existing turns used merge semantics and their
+-- selected refs are already materialized on sessions.tools, so false preserves
+-- their effective allow-list during the rolling upgrade.
+ALTER TABLE "session_turns"
+  ADD COLUMN IF NOT EXISTS "tools_provided" boolean NOT NULL DEFAULT false;
+
+-- Human composer drafts need the same provenance across reloads. Without this,
+-- [] cannot distinguish "inherit the session policy" from an intentional
+-- per-turn empty selection.
+ALTER TABLE "composer_drafts"
+  ADD COLUMN IF NOT EXISTS "tools_provided" boolean NOT NULL DEFAULT false;

package/drizzle/0066_session_interruption_attempt_lookup.sql

@@ -0,0 +1,4 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE INDEX CONCURRENTLY "session_attempt_interruptions_attempt_lookup_idx"
+  ON "session_attempt_interruptions" ("workspace_id", "session_id", "attempt_id", "requested_at" DESC);

package/drizzle/0067_session_event_payload_bounds.sql

@@ -0,0 +1,209 @@
+-- deployment-mode: rolling
+-- tracking-64: session_events is the lossy human/audit projection, not a blob store.
+-- Install the BEFORE trigger before the NOT VALID check so an older pod in the
+-- same rolling deployment is normalized instead of having an oversized write
+-- rejected. Historical oversized rows stay readable and can be defensively
+-- bounded by NATS/SSE; NOT VALID enforces the invariant for every new row.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+CREATE OR REPLACE FUNCTION opengeni_private.project_session_event_payload(source_payload jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql
+IMMUTABLE
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  original_bytes integer;
+  delivered_bytes integer;
+  bounded jsonb;
+BEGIN
+  original_bytes := octet_length(source_payload::text);
+  IF original_bytes <= 65536 THEN
+    RETURN source_payload;
+  END IF;
+
+  -- This is intentionally a small content-free fallback. Normal application
+  -- writers produce richer deterministic head/tail previews before INSERT; the
+  -- trigger exists for rolling old binaries and unforeseen direct writers.
+  bounded := jsonb_strip_nulls(jsonb_build_object(
+    'id', left(source_payload ->> 'id', 256),
+    'name', left(coalesce(source_payload ->> 'name', source_payload ->> 'toolName'), 256),
+    'type', left(source_payload ->> 'type', 128),
+    'status', left(source_payload ->> 'status', 128),
+    'code', left(source_payload ->> 'code', 128),
+    'isError', source_payload -> 'isError',
+    'preview', '[event payload omitted by durable audit storage guard]',
+    'truncation', jsonb_build_object(
+      'truncated', true,
+      'surface', 'database_guard',
+      'reason', 'database_guard',
+      'originalBytes', original_bytes,
+      'deliveredBytes', 0,
+      'omittedBytes', original_bytes,
+      'estimatedOriginalTokens', ceil(original_bytes / 4.0)::integer,
+      'estimatedDeliveredTokens', 0,
+      'fullEvidence', jsonb_build_object('available', false, 'reason', 'not_retained'),
+      'details', jsonb_build_array(jsonb_build_object(
+        'path', '$',
+        'kind', 'object',
+        'originalBytes', original_bytes
+      ))
+    )
+  ));
+
+  -- Size fields affect their own JSON width. Converge to an exact fixed point
+  -- without retaining any omitted content; fail the write rather than publish
+  -- false accounting if PostgreSQL's representation ever stops converging.
+  FOR pass IN 1..8 LOOP
+    delivered_bytes := octet_length(bounded::text);
+    EXIT WHEN (bounded #>> '{truncation,deliveredBytes}')::integer = delivered_bytes
+      AND (bounded #>> '{truncation,omittedBytes}')::integer
+        = greatest(0, original_bytes - delivered_bytes)
+      AND (bounded #>> '{truncation,estimatedDeliveredTokens}')::integer
+        = ceil(delivered_bytes / 4.0)::integer;
+    bounded := jsonb_set(bounded, '{truncation,deliveredBytes}', to_jsonb(delivered_bytes), false);
+    bounded := jsonb_set(
+      bounded,
+      '{truncation,omittedBytes}',
+      to_jsonb(greatest(0, original_bytes - delivered_bytes)),
+      false
+    );
+    bounded := jsonb_set(
+      bounded,
+      '{truncation,estimatedDeliveredTokens}',
+      to_jsonb(ceil(delivered_bytes / 4.0)::integer),
+      false
+    );
+  END LOOP;
+
+  delivered_bytes := octet_length(bounded::text);
+  IF (bounded #>> '{truncation,deliveredBytes}')::integer <> delivered_bytes
+    OR (bounded #>> '{truncation,omittedBytes}')::integer
+      <> greatest(0, original_bytes - delivered_bytes)
+    OR (bounded #>> '{truncation,estimatedDeliveredTokens}')::integer
+      <> ceil(delivered_bytes / 4.0)::integer THEN
+    RAISE EXCEPTION 'session event payload accounting failed to converge';
+  END IF;
+
+  RETURN bounded;
+END;
+$function$;
+
+CREATE OR REPLACE FUNCTION opengeni_private.bound_session_event_payload()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  original_type text := NEW.type;
+  original_event_bytes integer;
+  fields jsonb := '[]'::jsonb;
+  delivered text;
+BEGIN
+  original_event_bytes := octet_length(row_to_json(NEW)::text);
+  -- Bound every free-form envelope string by UTF-8 bytes. left() uses
+  -- characters, so one quarter of each byte limit is a conservative bound for
+  -- both ASCII and four-byte Unicode without ever splitting a code point.
+  IF octet_length(NEW.type) > 256 OR position(E'\n' in NEW.type) > 0
+    OR position(E'\r' in NEW.type) > 0 THEN
+    delivered := 'session.event.envelope_omitted';
+    fields := fields || jsonb_build_array(jsonb_build_object(
+      'field', 'type',
+      'originalBytes', octet_length(NEW.type),
+      'deliveredBytes', octet_length(delivered)
+    ));
+    NEW.type := delivered;
+  END IF;
+
+  IF NEW.client_event_id IS NOT NULL AND octet_length(NEW.client_event_id) > 1024 THEN
+    delivered := left(NEW.client_event_id, 256);
+    fields := fields || jsonb_build_array(jsonb_build_object(
+      'field', 'clientEventId',
+      'originalBytes', octet_length(NEW.client_event_id),
+      'deliveredBytes', octet_length(delivered)
+    ));
+    NEW.client_event_id := delivered;
+  END IF;
+
+  IF NEW.producer_id IS NOT NULL AND octet_length(NEW.producer_id) > 1024 THEN
+    delivered := left(NEW.producer_id, 256);
+    fields := fields || jsonb_build_array(jsonb_build_object(
+      'field', 'producerId',
+      'originalBytes', octet_length(NEW.producer_id),
+      'deliveredBytes', octet_length(delivered)
+    ));
+    NEW.producer_id := delivered;
+  END IF;
+
+  IF NEW.turn_association IS NOT NULL AND NEW.turn_association NOT IN (
+    'current', 'late_rejected', 'duplicate'
+  ) THEN
+    fields := fields || jsonb_build_array(jsonb_build_object(
+      'field', 'turnAssociation',
+      'originalBytes', octet_length(NEW.turn_association),
+      'deliveredBytes', 0
+    ));
+    NEW.turn_association := NULL;
+  END IF;
+
+  IF NEW.duplicate_reason IS NOT NULL AND octet_length(NEW.duplicate_reason) > 4096 THEN
+    delivered := left(NEW.duplicate_reason, 1024);
+    fields := fields || jsonb_build_array(jsonb_build_object(
+      'field', 'duplicateReason',
+      'originalBytes', octet_length(NEW.duplicate_reason),
+      'deliveredBytes', octet_length(delivered)
+    ));
+    NEW.duplicate_reason := delivered;
+  END IF;
+
+  IF jsonb_array_length(fields) > 0 THEN
+    NEW.payload := jsonb_build_object(
+      'preview', '[legacy event envelope normalized by durable audit storage guard]',
+      'originalEventBytes', original_event_bytes,
+      'originalType', left(original_type, 64),
+      'envelopeProjection', jsonb_build_object(
+        'truncated', true,
+        'surface', 'database_guard',
+        'fields', fields
+      ),
+      'fullEvidence', jsonb_build_object('available', false, 'reason', 'not_retained')
+    );
+  END IF;
+
+  NEW.payload := opengeni_private.project_session_event_payload(NEW.payload);
+  RETURN NEW;
+END;
+$function$;
+
+DROP TRIGGER IF EXISTS session_events_bound_payload_before_insert ON session_events;
+CREATE TRIGGER session_events_bound_payload_before_insert
+BEFORE INSERT OR UPDATE OF payload, type, client_event_id, producer_id, turn_association, duplicate_reason
+ON session_events
+FOR EACH ROW
+EXECUTE FUNCTION opengeni_private.bound_session_event_payload();
+
+ALTER TABLE session_events
+  ADD CONSTRAINT session_events_payload_bytes_check
+  CHECK (octet_length(payload::text) <= 65536)
+  NOT VALID,
+  ADD CONSTRAINT session_events_type_bytes_check
+  CHECK (
+    octet_length(type) <= 256
+    AND position(E'\n' in type) = 0
+    AND position(E'\r' in type) = 0
+  )
+  NOT VALID,
+  ADD CONSTRAINT session_events_client_event_id_bytes_check
+  CHECK (client_event_id IS NULL OR octet_length(client_event_id) <= 1024)
+  NOT VALID,
+  ADD CONSTRAINT session_events_producer_id_bytes_check
+  CHECK (producer_id IS NULL OR octet_length(producer_id) <= 1024)
+  NOT VALID,
+  ADD CONSTRAINT session_events_turn_association_bytes_check
+  CHECK (turn_association IS NULL OR octet_length(turn_association) <= 64)
+  NOT VALID,
+  ADD CONSTRAINT session_events_duplicate_reason_bytes_check
+  CHECK (duplicate_reason IS NULL OR octet_length(duplicate_reason) <= 4096)
+  NOT VALID;