@opengeni/db 0.7.3 → 0.10.7

package/src/session-queue-commands.ts

@@ -1,18 +1,24 @@
 import {
+  metadataWithTurnExecutionPolicyV1,
   mergeResourceRefs,
   mergeToolRefs,
+  turnExecutionPolicyAuditMetadata,
   type ReasoningEffort,
   type ResourceRef,
+  type SessionToolPolicy,
   type ToolRef,
+  type TurnExecutionPolicyV1,
 } from "@opengeni/contracts";
 import { and, asc, eq, inArray, sql } from "drizzle-orm";
 import type { Database } from "./index";
+import { sanitizeEventPayload } from "./event-payload-sanitizer";
 import { closePendingSessionToolCallsInTransaction } from "./session-tool-call-settlement";
 import {
   assertAgentCommandAuthorityInTransaction,
   autoResumeSessionBranchInTransaction,
   canonicalSessionCommandHash,
   evaluateSessionControl,
+  lockSessionEventWriteRows,
   lockWorkspaceInferenceControl,
   registerInternalUpdateWakeInTransaction,
   reserveSessionCommandReceipt,
@@ -24,6 +30,12 @@ import {
   updateSessionCommandReceiptResult,
 } from "./session-control";
 import * as schema from "./schema";
+import {
+  frozenInitiatorForCommandActor,
+  initiatorColumns,
+  initiatorFromStorage,
+  type FrozenTurnInitiator,
+} from "./turn-initiator";
 
 export type QueueCommandConflictCode =
   | "QUEUE_VERSION_CHANGED"
@@ -31,7 +43,8 @@ export type QueueCommandConflictCode =
   | "QUEUE_ANCHOR_CHANGED"
   | "PROMPT_CHANGED"
   | "DRAFT_CHANGED"
-  | "DRAFT_NOT_EMPTY";
+  | "DRAFT_NOT_EMPTY"
+  | "EDIT_SOURCE_CHANGED";
 
 export class QueueCommandConflictError extends Error {
   readonly name = "QueueCommandConflictError";
@@ -99,12 +112,13 @@ async function lockSession(
   workspaceId: string,
   sessionId: string,
 ): Promise<typeof schema.sessions.$inferSelect> {
-  const [session] = await db
-    .select()
-    .from(schema.sessions)
-    .where(and(eq(schema.sessions.workspaceId, workspaceId), eq(schema.sessions.id, sessionId)))
-    .for("update")
-    .limit(1);
+  const locks = await lockSessionEventWriteRows(db, {
+    workspaceId,
+    controlLock: "already_locked",
+    workspaceLock: "already_locked",
+    sessionIds: [sessionId],
+  });
+  const session = locks.sessions[0];
   if (!session) throw new Error(`Session not found: ${sessionId}`);
   return session;
 }
@@ -142,7 +156,7 @@ export async function supersedeSessionCurrentDirectionInTransaction(
       lastSequence: input.lastSequence,
     };
   }
-  const [current] = await db
+  const [preview] = await db
     .select()
     .from(schema.sessionTurns)
     .where(
@@ -152,8 +166,15 @@ export async function supersedeSessionCurrentDirectionInTransaction(
         eq(schema.sessionTurns.id, input.activeTurnId),
       ),
     )
-    .for("update")
     .limit(1);
+  const locks = await lockSessionEventWriteRows(db, {
+    workspaceId: input.workspaceId,
+    controlLock: "already_locked",
+    workspaceLock: "already_locked",
+    turnIds: [input.activeTurnId],
+    attemptIds: preview?.activeAttemptId ? [preview.activeAttemptId] : [],
+  });
+  const current = locks.turns[0];
   if (!current) {
     throw new SessionControlInvariantError(
       `Session ${input.sessionId} points to missing active turn ${input.activeTurnId}`,
@@ -206,6 +227,44 @@ export async function supersedeSessionCurrentDirectionInTransaction(
     sequence: input.lastSequence,
     now,
   });
+  const cancelledHumanInputs = await db
+    .update(schema.sessionHumanInputRequests)
+    .set({
+      status: "cancelled",
+      response: { outcome: "cancelled" },
+      respondedBy:
+        input.actor.type === "agent_attempt"
+          ? `attempt:${input.actor.attemptId}`
+          : input.actor.subjectId,
+      respondedAt: now,
+      updatedAt: now,
+    })
+    .where(
+      and(
+        eq(schema.sessionHumanInputRequests.workspaceId, input.workspaceId),
+        eq(schema.sessionHumanInputRequests.sessionId, input.sessionId),
+        eq(schema.sessionHumanInputRequests.turnId, current.id),
+        eq(schema.sessionHumanInputRequests.status, "pending"),
+      ),
+    )
+    .returning({ id: schema.sessionHumanInputRequests.id });
+  let lastSequence = closedTools.sequence;
+  if (cancelledHumanInputs.length > 0) {
+    await db.insert(schema.sessionEvents).values(
+      cancelledHumanInputs.map((request) => ({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        sessionId: input.sessionId,
+        sequence: ++lastSequence,
+        type: "user.humanInputResponse",
+        turnId: current.id,
+        turnGeneration: current.executionGeneration,
+        turnAssociation: "current",
+        payload: { requestId: request.id, response: { outcome: "cancelled" } },
+        occurredAt: now,
+      })),
+    );
+  }
   await db
     .update(schema.sessionTurns)
     .set({
@@ -248,7 +307,7 @@ export async function supersedeSessionCurrentDirectionInTransaction(
     interruptionCount: 0,
     replacedTurn: current,
     liveCurrentTurnId: null,
-    lastSequence: closedTools.sequence,
+    lastSequence,
   };
 }
 
@@ -274,7 +333,16 @@ async function loadQueuedTurns(
       asc(schema.sessionTurns.createdAt),
       asc(schema.sessionTurns.id),
     );
-  return lock ? await query.for("update") : await query;
+  const rows = await query;
+  if (!lock || rows.length === 0) return rows;
+  const locks = await lockSessionEventWriteRows(db, {
+    workspaceId,
+    controlLock: "already_locked",
+    workspaceLock: "already_locked",
+    turnIds: rows.map((row) => row.id),
+  });
+  const byId = new Map(locks.turns.map((row) => [row.id, row]));
+  return rows.map((row) => byId.get(row.id)).filter((row): row is QueuedTurnRow => Boolean(row));
 }
 
 async function normalizeQueuePositions(
@@ -314,13 +382,19 @@ function draftIsNonEmpty(draft: ComposerDraftRow): boolean {
     draft.text.length > 0 ||
     draft.resources.length > 0 ||
     draft.tools.length > 0 ||
+    draft.toolsProvided ||
     draft.sourceTurnId !== null
   );
 }
 
 export async function getComposerDraftInTransaction(
   db: Database,
-  input: { workspaceId: string; sessionId: string; subjectId: string; lock?: boolean },
+  input: {
+    workspaceId: string;
+    sessionId: string;
+    subjectId: string;
+    lock?: boolean;
+  },
 ): Promise<ComposerDraftRow | null> {
   const query = db
     .select()
@@ -348,13 +422,21 @@ export async function saveComposerDraftInTransaction(
     text: string;
     resources: ResourceRef[];
     tools: ToolRef[];
+    toolsProvided: boolean;
     model: string;
     reasoningEffort: ReasoningEffort;
   },
 ): Promise<ComposerDraftRow> {
   await lockWorkspaceInferenceControl(db, input.workspaceId, "share");
+  await lockSessionEventWriteRows(db, {
+    workspaceId: input.workspaceId,
+    controlLock: "already_locked",
+  });
   await lockSession(db, input.workspaceId, input.sessionId);
-  const current = await getComposerDraftInTransaction(db, { ...input, lock: true });
+  const current = await getComposerDraftInTransaction(db, {
+    ...input,
+    lock: true,
+  });
   const currentRevision = current?.revision ?? 0;
   if (currentRevision !== input.expectedRevision) {
     throw new QueueCommandConflictError("DRAFT_CHANGED", "Composer draft changed", {
@@ -372,10 +454,14 @@ export async function saveComposerDraftInTransaction(
     text: input.text,
     resources: input.resources,
     tools: input.tools,
+    toolsProvided: input.toolsProvided,
     model: input.model,
     reasoningEffort: input.reasoningEffort,
-    sourceTurnId: null,
-    sourceTurnVersion: null,
+    // A queue edit is still the same accepted work item. Preserve its frozen
+    // initiator through arbitrary draft saves; only a genuinely new compose or
+    // Steer captures the submitting actor.
+    sourceTurnId: current?.sourceTurnId ?? null,
+    sourceTurnVersion: current?.sourceTurnVersion ?? null,
     updatedAt: new Date(),
   };
   const [saved] = current
@@ -403,6 +489,10 @@ export async function moveQueuedTurnInTransaction(
   },
 ): Promise<QueueCommandResult> {
   await lockWorkspaceInferenceControl(db, input.workspaceId, "share");
+  await lockSessionEventWriteRows(db, {
+    workspaceId: input.workspaceId,
+    controlLock: "already_locked",
+  });
   const session = await lockSession(db, input.workspaceId, input.sessionId);
   const requestHash = canonicalSessionCommandHash({
     beforeTurnId: input.beforeTurnId,
@@ -494,7 +584,11 @@ export async function moveQueuedTurnInTransaction(
     eventIds.push(event.id);
     await db
       .update(schema.sessions)
-      .set({ queueVersion, lastSequence: session.lastSequence + 1, updatedAt: new Date() })
+      .set({
+        queueVersion,
+        lastSequence: session.lastSequence + 1,
+        updatedAt: new Date(),
+      })
       .where(eq(schema.sessions.id, input.sessionId));
   }
   const receipt = await updateSessionCommandReceiptResult(db, reserved.receipt.id, {
@@ -525,6 +619,10 @@ export async function deleteSessionQueueItemInTransaction(
   },
 ): Promise<QueueCommandResult> {
   await lockWorkspaceInferenceControl(db, input.workspaceId, "share");
+  await lockSessionEventWriteRows(db, {
+    workspaceId: input.workspaceId,
+    controlLock: "already_locked",
+  });
   const session = await lockSession(db, input.workspaceId, input.sessionId);
   const requestHash = canonicalSessionCommandHash({
     expectedTurnVersion: input.expectedTurnVersion,
@@ -549,18 +647,14 @@ export async function deleteSessionQueueItemInTransaction(
       replay: true,
     };
   }
-  const [turn] = await db
-    .select()
-    .from(schema.sessionTurns)
-    .where(
-      and(
-        eq(schema.sessionTurns.workspaceId, input.workspaceId),
-        eq(schema.sessionTurns.sessionId, input.sessionId),
-        eq(schema.sessionTurns.id, input.turnId),
-      ),
-    )
-    .for("update")
-    .limit(1);
+  const turn = (
+    await lockSessionEventWriteRows(db, {
+      workspaceId: input.workspaceId,
+      controlLock: "already_locked",
+      workspaceLock: "already_locked",
+      turnIds: [input.turnId],
+    })
+  ).turns[0];
   if (!turn || turn.status !== "queued" || !["user", "api"].includes(turn.source)) {
     throw new QueueCommandConflictError("QUEUE_PROMPT_STARTED", "Prompt is no longer waiting", {
       queueVersion: session.queueVersion,
@@ -616,7 +710,11 @@ export async function deleteSessionQueueItemInTransaction(
   if (!event) throw new Error("Queue delete event was not inserted");
   await db
     .update(schema.sessions)
-    .set({ queueVersion, lastSequence: session.lastSequence + 1, updatedAt: now })
+    .set({
+      queueVersion,
+      lastSequence: session.lastSequence + 1,
+      updatedAt: now,
+    })
     .where(eq(schema.sessions.id, input.sessionId));
   const receipt = await updateSessionCommandReceiptResult(db, reserved.receipt.id, {
     queueVersion,
@@ -648,6 +746,10 @@ export async function editQueuedTurnInTransaction(
   },
 ): Promise<EditQueueCommandResult> {
   await lockWorkspaceInferenceControl(db, input.workspaceId, "share");
+  await lockSessionEventWriteRows(db, {
+    workspaceId: input.workspaceId,
+    controlLock: "already_locked",
+  });
   const session = await lockSession(db, input.workspaceId, input.sessionId);
   const requestHash = canonicalSessionCommandHash({
     expectedTurnVersion: input.expectedTurnVersion,
@@ -664,7 +766,10 @@ export async function editQueuedTurnInTransaction(
     operationKey: input.operationKey,
     canonicalRequestHash: requestHash,
   });
-  const existingDraft = await getComposerDraftInTransaction(db, { ...input, lock: true });
+  const existingDraft = await getComposerDraftInTransaction(db, {
+    ...input,
+    lock: true,
+  });
   if (reserved.replay && reserved.receipt.appliedQueueVersion !== null) {
     if (!existingDraft) throw new Error("Replayed queue Edit has no durable draft");
     return {
@@ -689,18 +794,14 @@ export async function editQueuedTurnInTransaction(
       draftRevision,
     });
   }
-  const [turn] = await db
-    .select()
-    .from(schema.sessionTurns)
-    .where(
-      and(
-        eq(schema.sessionTurns.workspaceId, input.workspaceId),
-        eq(schema.sessionTurns.sessionId, input.sessionId),
-        eq(schema.sessionTurns.id, input.turnId),
-      ),
-    )
-    .for("update")
-    .limit(1);
+  const turn = (
+    await lockSessionEventWriteRows(db, {
+      workspaceId: input.workspaceId,
+      controlLock: "already_locked",
+      workspaceLock: "already_locked",
+      turnIds: [input.turnId],
+    })
+  ).turns[0];
   if (!turn || turn.status !== "queued" || !["user", "api"].includes(turn.source)) {
     throw new QueueCommandConflictError("QUEUE_PROMPT_STARTED", "Prompt is no longer waiting", {
       queueVersion: session.queueVersion,
@@ -725,6 +826,7 @@ export async function editQueuedTurnInTransaction(
     text: turn.prompt,
     resources: turn.resources,
     tools: turn.tools,
+    toolsProvided: turn.toolsProvided,
     model: turn.model,
     reasoningEffort: turn.reasoningEffort,
     sourceTurnId: turn.id,
@@ -780,7 +882,11 @@ export async function editQueuedTurnInTransaction(
   if (!event) throw new Error("Queue edit event was not inserted");
   await db
     .update(schema.sessions)
-    .set({ queueVersion, lastSequence: session.lastSequence + 1, updatedAt: now })
+    .set({
+      queueVersion,
+      lastSequence: session.lastSequence + 1,
+      updatedAt: now,
+    })
     .where(eq(schema.sessions.id, input.sessionId));
   const receipt = await updateSessionCommandReceiptResult(db, reserved.receipt.id, {
     queueVersion,
@@ -788,7 +894,14 @@ export async function editQueuedTurnInTransaction(
     draftRevision: nextDraftRevision,
     result: { sourceTurnId: turn.id },
   });
-  return { receipt, queueVersion, items: remaining, draft, eventIds: [event.id], replay: false };
+  return {
+    receipt,
+    queueVersion,
+    items: remaining,
+    draft,
+    eventIds: [event.id],
+    replay: false,
+  };
 }
 
 export async function steerQueuedTurnInTransaction(
@@ -804,7 +917,18 @@ export async function steerQueuedTurnInTransaction(
     operationKey: string;
   },
 ): Promise<SteerQueueCommandResult> {
-  await lockWorkspaceInferenceControl(db, input.workspaceId, "update");
+  const workspaceControl = await lockWorkspaceInferenceControl(db, input.workspaceId, "update");
+  await lockSessionEventWriteRows(db, {
+    workspaceId: input.workspaceId,
+    controlLock: "already_locked",
+    sessionIds:
+      input.actor.type === "agent_attempt"
+        ? [input.actor.sessionId, input.sessionId]
+        : [input.sessionId],
+    turnIds:
+      input.actor.type === "agent_attempt" ? [input.actor.turnId, input.turnId] : [input.turnId],
+    attemptIds: input.actor.type === "agent_attempt" ? [input.actor.attemptId] : [],
+  });
   const requestHash = canonicalSessionCommandHash({
     expectedTurnVersion: input.expectedTurnVersion,
     controlEtag: input.controlEtag ?? null,
@@ -843,7 +967,7 @@ export async function steerQueuedTurnInTransaction(
     });
   }
   const before = await evaluateSessionControl(db, input.workspaceId, input.sessionId, {
-    lock: "share",
+    workspaceControl,
   });
   if (input.controlEtag && input.controlEtag !== before.controlEtag) {
     throw new SessionControlConflictError();
@@ -885,6 +1009,7 @@ export async function steerQueuedTurnInTransaction(
   });
   const interruptionCount = supersession.interruptionCount;
   const supersededTurnId = supersession.replacedTurn?.id ?? null;
+  const supersededAttemptId = supersession.replacedTurn?.activeAttemptId ?? null;
   const liveCurrentTurnId = supersession.liveCurrentTurnId;
 
   const withoutTarget = rows.filter((row) => row.id !== target.id);
@@ -899,7 +1024,17 @@ export async function steerQueuedTurnInTransaction(
   const queueVersion = session.queueVersion + 1;
   await db
     .update(schema.sessionTurns)
-    .set({ version: target.version + 1, updatedAt: now })
+    .set({
+      version: target.version + 1,
+      metadata: {
+        ...target.metadata,
+        delivery: "steer",
+        replacedTurnId: supersededTurnId,
+        replacedAttemptId: supersededAttemptId,
+        interruptionCount,
+      },
+      updatedAt: now,
+    })
     .where(eq(schema.sessionTurns.id, target.id));
   let sequence = supersession.lastSequence;
   const actor =
@@ -998,33 +1133,62 @@ export async function submitHumanPromptInTransaction(
     workspaceId: string;
     sessionId: string;
     subjectId: string;
+    subjectLabel?: string;
     actor: SessionCommandActor;
     operationKey: string;
     delivery: "send" | "steer";
     controlEtag?: string | null;
     expectedDraftRevision?: number | null;
     text: string;
+    turnInstructions?: string | null;
     resources: ResourceRef[];
     tools: ToolRef[];
+    toolsProvided?: boolean;
     model?: string | null;
     reasoningEffort?: ReasoningEffort | null;
     reasoningEffortFallback: ReasoningEffort;
+    /** Trusted API/core admission snapshot. Omitted only by legacy low-level callers. */
+    turnExecutionPolicy?: TurnExecutionPolicyV1;
     source: "user" | "api";
-    mcpCredentialUpdates?: Array<{ id: string; headersEncrypted: Record<string, string> }>;
+    mcpCredentialUpdates?: Array<{
+      id: string;
+      headersEncrypted: Record<string, string>;
+    }>;
   },
 ): Promise<SubmitHumanPromptResult> {
-  await lockWorkspaceInferenceControl(db, input.workspaceId, "update");
+  const workspaceControl = await lockWorkspaceInferenceControl(db, input.workspaceId, "update");
+  await lockSessionEventWriteRows(db, {
+    workspaceId: input.workspaceId,
+    controlLock: "already_locked",
+    sessionIds:
+      input.actor.type === "agent_attempt"
+        ? [input.actor.sessionId, input.sessionId]
+        : [input.sessionId],
+    turnIds: input.actor.type === "agent_attempt" ? [input.actor.turnId] : [],
+    attemptIds: input.actor.type === "agent_attempt" ? [input.actor.attemptId] : [],
+  });
   const requestHash = canonicalSessionCommandHash({
     delivery: input.delivery,
     controlEtag: input.controlEtag ?? null,
     expectedDraftRevision: input.expectedDraftRevision ?? null,
     text: input.text,
+    turnInstructions: input.turnInstructions ?? null,
     resources: input.resources,
     tools: input.tools,
+    toolsProvided: input.toolsProvided === true,
     model: input.model ?? null,
     reasoningEffort: input.reasoningEffort ?? null,
     source: input.source,
     mcpCredentialUpdates: input.mcpCredentialUpdates ?? [],
+    ...(input.actor.type === "service"
+      ? {
+          serviceInitiator: {
+            subjectId: input.actor.subjectId,
+            subjectLabel: input.actor.subjectLabel ?? null,
+            context: input.actor.context ?? {},
+          },
+        }
+      : {}),
   });
   const reserved = await reserveSessionCommandReceipt(db, {
     accountId: input.accountId,
@@ -1063,7 +1227,7 @@ export async function submitHumanPromptInTransaction(
   }
 
   const before = await evaluateSessionControl(db, input.workspaceId, input.sessionId, {
-    lock: "share",
+    workspaceControl,
   });
   if (input.controlEtag && input.controlEtag !== before.controlEtag) {
     throw new SessionControlConflictError();
@@ -1076,7 +1240,14 @@ export async function submitHumanPromptInTransaction(
       input.actor.type === "agent_attempt"
         ? `attempt:${input.actor.attemptId}`
         : input.actor.subjectId,
-    reason: input.delivery === "steer" ? "human_steer" : "human_send",
+    reason:
+      input.actor.type === "service"
+        ? input.delivery === "steer"
+          ? "service_steer"
+          : "service_send"
+        : input.delivery === "steer"
+          ? "human_steer"
+          : "human_send",
     observedControlEtag: input.controlEtag ?? null,
   });
   const session = await lockSession(db, input.workspaceId, input.sessionId);
@@ -1113,6 +1284,7 @@ export async function submitHumanPromptInTransaction(
         text: draft.text,
         resources: draft.resources,
         tools: draft.tools,
+        toolsProvided: draft.toolsProvided,
         model: draft.model,
         reasoningEffort: draft.reasoningEffort,
       }) !==
@@ -1120,6 +1292,7 @@ export async function submitHumanPromptInTransaction(
           text: input.text,
           resources: input.resources,
           tools: input.tools,
+          toolsProvided: input.toolsProvided === true,
           model: input.model ?? session.model,
           reasoningEffort: input.reasoningEffort ?? input.reasoningEffortFallback,
         })
@@ -1135,6 +1308,52 @@ export async function submitHumanPromptInTransaction(
     }
   }
 
+  let editedSourceTurn: QueuedTurnRow | undefined;
+  let editedSourceTurnInstructions: string | null | undefined;
+  if (draft?.sourceTurnId) {
+    const sourceLocks = await lockSessionEventWriteRows(db, {
+      workspaceId: input.workspaceId,
+      controlLock: "already_locked",
+      workspaceLock: "already_locked",
+      turnIds: [draft.sourceTurnId],
+    });
+    const sourceTurn = sourceLocks.turns[0];
+    const sourceTurnVersion = draft.sourceTurnVersion;
+    const sourceMetadata = sourceTurn?.metadata ?? {};
+    const sourceIsExactWithdrawnRevision =
+      sourceTurn !== undefined &&
+      sourceTurn.accountId === input.accountId &&
+      sourceTurn.workspaceId === input.workspaceId &&
+      sourceTurn.sessionId === input.sessionId &&
+      (sourceTurn.source === "user" || sourceTurn.source === "api") &&
+      sourceTurn.status === "withdrawn_for_edit" &&
+      sourceTurnVersion !== null &&
+      sourceTurn.version === sourceTurnVersion + 1 &&
+      sourceTurn.cancelledBy === input.subjectId &&
+      sourceTurn.cancelReason === "withdrawn_for_edit" &&
+      sourceTurn.activeAttemptId === null &&
+      sourceMetadata.delivery !== "steer";
+    if (!sourceIsExactWithdrawnRevision) {
+      throw new QueueCommandConflictError(
+        "EDIT_SOURCE_CHANGED",
+        "Edited prompt source changed or is no longer withdrawn for edit",
+        {
+          queueVersion: session.queueVersion,
+          draftRevision: draft.revision,
+          ...(sourceTurn ? { turnVersion: sourceTurn.version } : {}),
+        },
+      );
+    }
+    // This is the sole private-instruction source for an edited replacement.
+    // It is deliberately held separately from the public draft and event
+    // projections below. The public draft is expected to differ after editing;
+    // source identity is fenced by its exact withdrawn row version, not by
+    // comparing the replacement content with the old prompt. A client-supplied
+    // instruction value must never override the private source value.
+    editedSourceTurn = sourceTurn;
+    editedSourceTurnInstructions = sourceTurn.turnInstructions ?? null;
+  }
+
   for (const update of input.mcpCredentialUpdates ?? []) {
     const [server] = await db
       .update(schema.sessionMcpServers)
@@ -1155,6 +1374,28 @@ export async function submitHumanPromptInTransaction(
   }
 
   const now = new Date();
+  let frozenInitiator: FrozenTurnInitiator;
+  if (input.delivery === "send" && draft?.sourceTurnId) {
+    const sourceTurn = editedSourceTurn;
+    if (!sourceTurn) {
+      throw new SessionControlInvariantError("Edited prompt source turn is missing");
+    }
+    frozenInitiator = {
+      initiator: initiatorFromStorage(
+        sourceTurn.initiatorKind,
+        sourceTurn.initiatorSubjectId,
+        sourceTurn.initiatorContext ?? {},
+      ),
+      context: sourceTurn.initiatorContext ?? {},
+    };
+  } else {
+    frozenInitiator = await frozenInitiatorForCommandActor(
+      db,
+      input.workspaceId,
+      input.actor,
+      input.subjectLabel,
+    );
+  }
   const acceptedEventId = crypto.randomUUID();
   const turnId = crypto.randomUUID();
   const workflowId = session.temporalWorkflowId ?? `session-${session.id}`;
@@ -1168,14 +1409,19 @@ export async function submitHumanPromptInTransaction(
       sequence: ++sequence,
       type: "user.message",
       clientEventId: input.operationKey,
-      payload: {
+      payload: sanitizeEventPayload({
         text: input.text,
         ...(input.resources.length ? { resources: input.resources } : {}),
-        ...(input.tools.length ? { tools: input.tools } : {}),
+        ...(input.toolsProvided === true
+          ? { tools: input.tools }
+          : input.tools.length
+            ? { tools: input.tools }
+            : {}),
         ...(input.model ? { model: input.model } : {}),
         ...(input.reasoningEffort ? { reasoningEffort: input.reasoningEffort } : {}),
         delivery: input.delivery,
-      },
+        initiator: frozenInitiator.initiator,
+      }),
       occurredAt: now,
     },
   ];
@@ -1193,13 +1439,21 @@ export async function submitHumanPromptInTransaction(
       source: input.source,
       position: input.delivery === "steer" ? 0 : existingQueued.length + 1,
       prompt: input.text,
+      turnInstructions:
+        editedSourceTurnInstructions !== undefined
+          ? editedSourceTurnInstructions
+          : (input.turnInstructions ?? null),
       resources: input.resources,
       tools: input.tools,
+      toolsProvided: input.toolsProvided === true,
       model: input.model ?? session.model,
       reasoningEffort: input.reasoningEffort ?? input.reasoningEffortFallback,
       sandboxBackend: session.sandboxBackend,
-      metadata: {},
+      metadata: input.turnExecutionPolicy
+        ? metadataWithTurnExecutionPolicyV1({}, input.turnExecutionPolicy)
+        : {},
       lineage: { actor: input.actor.type },
+      ...initiatorColumns(frozenInitiator),
     })
     .returning();
   if (!turn) throw new SessionControlInvariantError("Prompt turn was not inserted");
@@ -1210,7 +1464,12 @@ export async function submitHumanPromptInTransaction(
     sequence: ++sequence,
     type: "turn.queued",
     turnId,
-    payload: { turnId, triggerEventId: acceptedEventId, source: input.source },
+    payload: {
+      turnId,
+      triggerEventId: acceptedEventId,
+      source: input.source,
+      initiator: frozenInitiator.initiator,
+    },
     occurredAt: now,
   });
 
@@ -1238,7 +1497,36 @@ export async function submitHumanPromptInTransaction(
   for (const event of eventValues) event.sequence = ++sequence;
   const interruptionCount = supersession.interruptionCount;
   const replacedTurnId = supersession.replacedTurn?.id ?? null;
+  const replacedAttemptId = supersession.replacedTurn?.activeAttemptId ?? null;
   const liveCurrentTurnId = supersession.liveCurrentTurnId;
+  // Durable provenance for the queue projection. Until the superseded attempt
+  // loses inference, user-visible output, and workspace-persistence authority,
+  // its exact first-class attempt has no quiescence receipt. Pairing that
+  // attempt with the replacement lets every client render "Stopping previous
+  // attempt…" truthfully across refresh/reconnect, even though logical
+  // settlement has already cleared sessions.active_turn_id. Do not infer this
+  // state from a local request spinner or queue position.
+  if (input.delivery === "steer") {
+    await db
+      .update(schema.sessionTurns)
+      .set({
+        metadata: {
+          ...turn.metadata,
+          delivery: "steer",
+          replacedTurnId,
+          replacedAttemptId,
+          interruptionCount,
+        },
+        updatedAt: now,
+      })
+      .where(
+        and(
+          eq(schema.sessionTurns.workspaceId, input.workspaceId),
+          eq(schema.sessionTurns.sessionId, input.sessionId),
+          eq(schema.sessionTurns.id, turnId),
+        ),
+      );
+  }
   if (supersession.replacedTurn) {
     const current = supersession.replacedTurn;
     if (!liveCurrentTurnId) {
@@ -1301,7 +1589,9 @@ export async function submitHumanPromptInTransaction(
     .update(schema.sessions)
     .set({
       resources: mergeResourceRefs(session.resources as ResourceRef[], input.resources),
-      tools: mergeToolRefs(session.tools as ToolRef[], input.tools),
+      tools: sessionToolPolicyIsFixed(session.toolPolicy)
+        ? session.tools
+        : mergeToolRefs(session.tools as ToolRef[], input.tools),
       activeTurnId: input.delivery === "steer" ? liveCurrentTurnId : session.activeTurnId,
       status: nextStatus,
       queueVersion,
@@ -1331,7 +1621,14 @@ export async function submitHumanPromptInTransaction(
     action: input.delivery === "steer" ? "session.prompt.steer" : "session.prompt.send",
     targetType: "session_turn",
     targetId: turnId,
-    metadata: { operationId: reserved.receipt.id, replacedTurnId, interruptionCount },
+    metadata: {
+      operationId: reserved.receipt.id,
+      replacedTurnId,
+      interruptionCount,
+      ...(input.turnExecutionPolicy
+        ? turnExecutionPolicyAuditMetadata(input.turnExecutionPolicy, turnId)
+        : {}),
+    },
   });
   const eventIds = eventRows.map((event) => event.id);
   const receipt = await updateSessionCommandReceiptResult(db, reserved.receipt.id, {
@@ -1347,6 +1644,11 @@ export async function submitHumanPromptInTransaction(
       interruptionCount,
       replacedTurnId,
       workspaceControlEventId: resumed.workspaceControlEventId,
+      ...(input.turnExecutionPolicy
+        ? {
+            executionPolicy: turnExecutionPolicyAuditMetadata(input.turnExecutionPolicy, turnId),
+          }
+        : {}),
     },
   });
   return {
@@ -1362,6 +1664,12 @@ export async function submitHumanPromptInTransaction(
   };
 }
 
+function sessionToolPolicyIsFixed(value: unknown): boolean {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const mode = (value as Partial<SessionToolPolicy>).mode;
+  return mode === "workspace_default" || mode === "explicit" || mode === "inherited";
+}
+
 export async function sendAgentMessageInTransaction(
   db: Database,
   input: {
@@ -1373,7 +1681,14 @@ export async function sendAgentMessageInTransaction(
     text: string;
   },
 ): Promise<AgentInternalUpdateCommandResult> {
-  await lockWorkspaceInferenceControl(db, input.workspaceId, "share");
+  const workspaceControl = await lockWorkspaceInferenceControl(db, input.workspaceId, "share");
+  await lockSessionEventWriteRows(db, {
+    workspaceId: input.workspaceId,
+    controlLock: "already_locked",
+    sessionIds: [input.actor.sessionId, input.targetSessionId],
+    turnIds: [input.actor.turnId],
+    attemptIds: [input.actor.attemptId],
+  });
   const requestHash = canonicalSessionCommandHash({ text: input.text });
   const reserved = await reserveSessionCommandReceipt(db, {
     accountId: input.accountId,
@@ -1424,7 +1739,7 @@ export async function sendAgentMessageInTransaction(
     );
   }
   const effective = await evaluateSessionControl(db, input.workspaceId, input.targetSessionId, {
-    lock: "share",
+    workspaceControl,
   });
   const now = new Date();
   const [update] = await db
@@ -1538,6 +1853,13 @@ export async function steerAgentSessionInTransaction(
   },
 ): Promise<AgentInternalUpdateCommandResult> {
   await lockWorkspaceInferenceControl(db, input.workspaceId, "update");
+  await lockSessionEventWriteRows(db, {
+    workspaceId: input.workspaceId,
+    controlLock: "already_locked",
+    sessionIds: [input.actor.sessionId, input.targetSessionId],
+    turnIds: [input.actor.turnId],
+    attemptIds: [input.actor.attemptId],
+  });
   const reserved = await reserveSessionCommandReceipt(db, {
     accountId: input.accountId,
     workspaceId: input.workspaceId,
@@ -1546,7 +1868,9 @@ export async function steerAgentSessionInTransaction(
     targetSessionId: input.targetSessionId,
     targetTurnId: null,
     operationKey: input.operationKey,
-    canonicalRequestHash: canonicalSessionCommandHash({ instruction: input.instruction }),
+    canonicalRequestHash: canonicalSessionCommandHash({
+      instruction: input.instruction,
+    }),
   });
   if (reserved.replay) {
     const updateId = String(reserved.receipt.result.updateId ?? "");