@opengeni/db 0.9.3 → 0.10.7

package/src/index.ts

@@ -57,8 +57,10 @@ import type {
   SessionGoalStatus,
   SessionHumanInputRequest,
   LineageNode,
+  SessionMcpApprovalPolicy,
   SessionMcpServerMetadata,
   SessionStatus,
+  SessionToolPolicy,
   SessionTurn,
   SessionQueueSnapshot,
   SessionSystemUpdate,
@@ -101,6 +103,9 @@ import {
   SESSION_EVENT_ENVELOPE_MAX_BYTES,
   SESSION_EVENT_TYPE_MAX_BYTES,
   resolveSessionEventTypeFilters,
+  capabilityCatalogItemIsTrustedForExposure,
+  metadataWithTurnExecutionPolicyV1,
+  readTurnExecutionPolicyV1,
   reasoningEffortForMetadata,
   resolveWorkspaceMemoryEnabled,
   RigChange as RigChangeContract,
@@ -113,6 +118,7 @@ import {
   OPENGENI_HOST_EXPORT_SCHEMA_REVISION,
   HumanInputQuestion as HumanInputQuestionContract,
   SubmitHumanInputResponseRequest,
+  TurnExecutionPolicyV1,
 } from "@opengeni/contracts";
 import { environmentsEncryptionKeyBytes, type Settings } from "@opengeni/config";
 import { boundModelToolOutputItem, isCodexBilledModel } from "@opengeni/codex";
@@ -2589,6 +2595,11 @@ export async function countScheduledTasksForWorkspace(
 export type AppendEventInput = {
   type: SessionEventType;
   payload?: unknown;
+  /**
+   * Server-created retained-output evidence for canonical audit truncation.
+   * Producer payload fields are never trusted as evidence.
+   */
+  retainedOutputEvidence?: unknown;
   clientEventId?: string;
   turnId?: string | null;
   turnGeneration?: number | null;
@@ -2909,7 +2920,7 @@ export type CreateSessionMcpServerInput = {
   allowedTools?: string[] | null;
   timeoutMs?: number | null;
   cacheToolsList?: boolean | null;
-  requireApproval?: boolean | string[] | null;
+  requireApproval?: SessionMcpApprovalPolicy | null;
   connectionRef?: McpServerConnectionRef | null;
   headersEncrypted?: Record<string, string>;
 };
@@ -2924,11 +2935,16 @@ export type UpdateSessionMcpServerCredentialsResult = {
   missingIds: string[];
 };
 
+export type UpdateSessionMcpApprovalPolicyResult = {
+  server: SessionMcpServerMetadata | null;
+  changed: boolean;
+};
+
 export type SessionMcpServerForRun = SessionMcpServerMetadata & {
   allowedTools?: string[];
   timeoutMs?: number;
   cacheToolsList?: boolean;
-  requireApproval?: boolean | string[];
+  requireApproval: SessionMcpApprovalPolicy;
   headers: Record<string, string>;
 };
 
@@ -2943,6 +2959,7 @@ export type EnqueueSessionTurnInput = {
   turnInstructions?: string | null;
   resources: ResourceRef[];
   tools: ToolRef[];
+  toolsProvided?: boolean;
   model: string;
   reasoningEffort: ReasoningEffort;
   sandboxBackend: SandboxBackend;
@@ -3055,6 +3072,49 @@ export async function requireFile(
   return file;
 }
 
+export type RetainedFileArtifact = {
+  file: FileAsset;
+  uploadStatus: FileUploadStatus | null;
+  uploadExpiresAt: Date | null;
+};
+
+/**
+ * RLS-scoped file lookup with just enough upload lifecycle truth to distinguish
+ * pending, failed, and expired artifact references. The bytes and provider
+ * location remain in the existing FileAsset/object-storage seam.
+ */
+export async function getRetainedFileArtifact(
+  db: Database,
+  workspaceId: string,
+  fileId: string,
+): Promise<RetainedFileArtifact | null> {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb
+      .select({
+        file: schema.files,
+        uploadStatus: schema.fileUploads.status,
+        uploadExpiresAt: schema.fileUploads.expiresAt,
+      })
+      .from(schema.files)
+      .leftJoin(
+        schema.fileUploads,
+        and(
+          eq(schema.fileUploads.workspaceId, schema.files.workspaceId),
+          eq(schema.fileUploads.fileId, schema.files.id),
+        ),
+      )
+      .where(and(eq(schema.files.workspaceId, workspaceId), eq(schema.files.id, fileId)))
+      .orderBy(desc(schema.fileUploads.createdAt))
+      .limit(1);
+    if (!row) return null;
+    return {
+      file: mapFile(row.file),
+      uploadStatus: row.uploadStatus as FileUploadStatus | null,
+      uploadExpiresAt: row.uploadExpiresAt,
+    };
+  });
+}
+
 export async function getFileUpload(
   db: Database,
   workspaceId: string,
@@ -3895,7 +3955,17 @@ export async function listCapabilityCatalogItems(
         ),
       )
       .orderBy(asc(schema.capabilityCatalogItems.kind), asc(schema.capabilityCatalogItems.name));
-    return rows.map(mapCapabilityCatalogItem);
+    const installations = await scopedDb
+      .select()
+      .from(schema.capabilityInstallations)
+      .where(eq(schema.capabilityInstallations.workspaceId, workspaceId));
+    const installationByCapabilityId = new Map(
+      installations.map((installation) => [installation.capabilityId, installation]),
+    );
+    return rows.flatMap((row) => {
+      const exposure = catalogExposureState(row, installationByCapabilityId.get(row.id) ?? null);
+      return exposure === "blocked" ? [] : [mapCapabilityCatalogItem(row, exposure)];
+    });
   });
 }
 
@@ -3919,7 +3989,21 @@ export async function getCapabilityCatalogItem(
       )
       .orderBy(asc(sql`(${schema.capabilityCatalogItems.workspaceId} is null)`))
       .limit(1);
-    return row ? mapCapabilityCatalogItem(row) : null;
+    if (!row) {
+      return null;
+    }
+    const [installation] = await scopedDb
+      .select()
+      .from(schema.capabilityInstallations)
+      .where(
+        and(
+          eq(schema.capabilityInstallations.workspaceId, workspaceId),
+          eq(schema.capabilityInstallations.capabilityId, capabilityId),
+        ),
+      )
+      .limit(1);
+    const exposure = catalogExposureState(row, installation ?? null);
+    return exposure === "blocked" ? null : mapCapabilityCatalogItem(row, exposure);
   });
 }
 
@@ -4098,7 +4182,11 @@ export async function listEnabledMcpCapabilityServers(
   }
 
   return [...preferredByInstallation.values()].flatMap(({ item, installation }) => {
-    if (!item.endpointUrl || !mcpConnectivityOk(installation.metadata)) {
+    if (
+      catalogExposureState(item, installation) === "blocked" ||
+      !item.endpointUrl ||
+      !mcpConnectivityOk(installation.metadata)
+    ) {
       return [];
     }
     const headersEncrypted = encryptedHeadersConfig(installation.config.headersEncrypted);
@@ -8083,6 +8171,10 @@ export type CodexCredentialForRun = {
  * accessor — auto-activates a brand-new first account and ensures the
  * rotation-settings row exists.
  */
+export type UpsertCodexSubscriptionCredentialResult =
+  | { kind: "upserted"; id: string; isNew: boolean }
+  | { kind: "unresolved_redemption"; id: string; isNew: false };
+
 export async function upsertCodexSubscriptionCredential(
   db: Database,
   input: {
@@ -8097,12 +8189,54 @@ export async function upsertCodexSubscriptionCredential(
     lastRefreshAt: Date | null;
     accountEmail?: string | null;
     label?: string | null;
+    /** Direct managed-cookie human who most recently connected this row. */
+    connectedBySubjectId?: string | null;
   },
-): Promise<{ id: string; isNew: boolean }> {
+): Promise<UpsertCodexSubscriptionCredentialResult> {
   return await withRlsContext(
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
+      // Serialize both the initial partial-index insert and ownership-changing
+      // reconnects for this exact provider account. The row lock is shared with
+      // the final redemption-send fence: either reconnect wins before any send,
+      // or it observes durable provider_started truth and cannot replace its
+      // owning human while the upstream outcome is unresolved.
+      await scopedDb.execute(
+        sql`select pg_advisory_xact_lock(hashtextextended(${`codex-credential-upsert:${input.workspaceId}:${input.chatgptAccountId ?? "null"}`}, 0))`,
+      );
+      const [existing] = input.chatgptAccountId
+        ? await scopedDb
+            .select({
+              id: schema.codexSubscriptionCredentials.id,
+              connectedBySubjectId: schema.codexSubscriptionCredentials.connectedBySubjectId,
+            })
+            .from(schema.codexSubscriptionCredentials)
+            .where(
+              and(
+                eq(schema.codexSubscriptionCredentials.workspaceId, input.workspaceId),
+                eq(schema.codexSubscriptionCredentials.chatgptAccountId, input.chatgptAccountId),
+              ),
+            )
+            .for("update")
+            .limit(1)
+        : [];
+      if (existing && existing.connectedBySubjectId !== (input.connectedBySubjectId ?? null)) {
+        const [unresolved] = await scopedDb
+          .select({ id: schema.codexResetRedemptionAttempts.id })
+          .from(schema.codexResetRedemptionAttempts)
+          .where(
+            and(
+              eq(schema.codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+              eq(schema.codexResetRedemptionAttempts.credentialId, existing.id),
+              eq(schema.codexResetRedemptionAttempts.status, "provider_started"),
+            ),
+          )
+          .limit(1);
+        if (unresolved) {
+          return { kind: "unresolved_redemption", id: existing.id, isNew: false };
+        }
+      }
       const now = new Date();
       const [row] = await scopedDb
         .insert(schema.codexSubscriptionCredentials)
@@ -8118,6 +8252,7 @@ export async function upsertCodexSubscriptionCredential(
           lastRefreshAt: input.lastRefreshAt,
           accountEmail: input.accountEmail ?? null,
           label: input.label ?? null,
+          connectedBySubjectId: input.connectedBySubjectId ?? null,
           status: "active",
           lastError: null,
         })
@@ -8146,6 +8281,11 @@ export async function upsertCodexSubscriptionCredential(
             // it when still null) so a re-connect never clobbers a rename.
             accountEmail: input.accountEmail ?? null,
             label: sql`coalesce(${schema.codexSubscriptionCredentials.label}, ${input.label ?? null})`,
+            // Ownership follows the most recent connection exactly. A
+            // configured/delegated/API-key reconnect is intentionally
+            // nonhuman and clears the prior human owner, making the row
+            // view-only until a direct managed-cookie human reconnects it.
+            connectedBySubjectId: input.connectedBySubjectId ?? null,
             status: "active",
             lastError: null,
             version: sql`${schema.codexSubscriptionCredentials.version} + 1`,
@@ -8166,7 +8306,7 @@ export async function upsertCodexSubscriptionCredential(
       // keeps the original (older) value, so the two diverge. This distinguishes
       // insert from update without a second read.
       const isNew = row.createdAt.getTime() === row.updatedAt.getTime();
-      return { id: row.id, isNew };
+      return { kind: "upserted", id: row.id, isNew };
     },
   );
 }
@@ -8637,6 +8777,12 @@ export type CodexAccountStatus = {
   status: string; // active | needs_relogin | error
   /** New automatic allocations only; health/refresh and existing turns remain independent. */
   allocatorEnabled: boolean;
+  allocatorVersion: number;
+  allocatorUpdatedBySubjectId: string | null;
+  allocatorUpdatedAt: Date | null;
+  resetCreditAvailableCount: number | null;
+  resetCreditsCheckedAt: Date | null;
+  connectedBySubjectId: string | null;
   isActive: boolean;
   expiresAt: Date | null;
   lastRefreshAt: Date | null;
@@ -8664,7 +8810,15 @@ export type CodexAccountStatus = {
  * the selection cursor gives deterministic fairness after those holders drain.
  * None of these fields contains credential material.
  */
-export type CodexLeaseAccountStatus = CodexAccountStatus & {
+export type CodexLeaseAccountStatus = Omit<
+  CodexAccountStatus,
+  | "allocatorVersion"
+  | "allocatorUpdatedBySubjectId"
+  | "allocatorUpdatedAt"
+  | "resetCreditAvailableCount"
+  | "resetCreditsCheckedAt"
+  | "connectedBySubjectId"
+> & {
   activeLeaseCount: number;
   selectionCount: number;
   lastSelectedAt: Date | null;
@@ -10467,6 +10621,13 @@ export async function listCodexAccountStatuses(
         planType: schema.codexSubscriptionCredentials.planType,
         status: schema.codexSubscriptionCredentials.status,
         allocatorEnabled: schema.codexSubscriptionCredentials.allocatorEnabled,
+        allocatorVersion: schema.codexSubscriptionCredentials.allocatorVersion,
+        allocatorUpdatedBySubjectId:
+          schema.codexSubscriptionCredentials.allocatorUpdatedBySubjectId,
+        allocatorUpdatedAt: schema.codexSubscriptionCredentials.allocatorUpdatedAt,
+        resetCreditAvailableCount: schema.codexSubscriptionCredentials.resetCreditAvailableCount,
+        resetCreditsCheckedAt: schema.codexSubscriptionCredentials.resetCreditsCheckedAt,
+        connectedBySubjectId: schema.codexSubscriptionCredentials.connectedBySubjectId,
         expiresAt: schema.codexSubscriptionCredentials.expiresAt,
         lastRefreshAt: schema.codexSubscriptionCredentials.lastRefreshAt,
         lastError: schema.codexSubscriptionCredentials.lastError,
@@ -10491,6 +10652,8 @@ export async function listCodexAccountStatuses(
       ...row,
       expiresAt: codexMetadataDate(row.expiresAt),
       lastRefreshAt: codexMetadataDate(row.lastRefreshAt),
+      allocatorUpdatedAt: codexMetadataDate(row.allocatorUpdatedAt),
+      resetCreditsCheckedAt: codexMetadataDate(row.resetCreditsCheckedAt),
       primaryResetAt: codexMetadataDate(row.primaryResetAt),
       secondaryResetAt: codexMetadataDate(row.secondaryResetAt),
       usageCheckedAt: codexMetadataDate(row.usageCheckedAt),
@@ -10501,165 +10664,1051 @@ export async function listCodexAccountStatuses(
   });
 }
 
-/** The P2 usage-cache snapshot written by the refreshing usage wrapper. */
-export type CodexAccountUsageSnapshot = {
-  primaryUsedPercent: number | null;
-  primaryResetAt: Date | null;
-  secondaryUsedPercent: number | null;
-  secondaryResetAt: Date | null;
-  checkedAt: Date;
-};
+export type CodexAllocatorUpdateResult =
+  | {
+      kind: "updated" | "unchanged";
+      allocatorEnabled: boolean;
+      allocatorVersion: number;
+      allocatorUpdatedBySubjectId: string | null;
+      allocatorUpdatedAt: Date | null;
+    }
+  | {
+      kind: "conflict";
+      allocatorEnabled: boolean;
+      allocatorVersion: number;
+      allocatorUpdatedBySubjectId: string | null;
+      allocatorUpdatedAt: Date | null;
+    }
+  | { kind: "not_found" };
 
 /**
- * Cache-write for P2 quota bars: persist the five plaintext usage columns on a
- * SPECIFIC credential row. NEVER touches credential_encrypted. RLS-scoped, guarded
- * by (id, workspace_id) so it can only write a row the workspace owns. Returns true
- * iff a row was updated (false ⇒ the credential was disconnected under us — the
- * snapshot is moot, drop it). This is the only writer of the usage_checked_at TTL
- * clock that `listCodexAccountStatuses` reads back.
+ * Toggle only NEW allocator eligibility under credential-row OCC.
+ *
+ * Same-state writes are idempotent even when `expectedVersion` is stale. A real
+ * state transition requires the exact current version, increments only the
+ * allocator version, and writes one audit row in the same transaction. It never
+ * touches credential `version`, health, encrypted material, cooldown, or quota.
  */
-export async function recordCodexAccountUsage(
-  db: Database,
-  workspaceId: string,
-  credentialId: string,
-  snapshot: CodexAccountUsageSnapshot,
-): Promise<boolean> {
-  return (await recordCodexAccountUsageWithWakeTargets(db, workspaceId, credentialId, snapshot))
-    .result;
-}
-
-/** Usage-cache mutation plus its committed durable capacity-wake outbox. */
-export async function recordCodexAccountUsageWithWakeTargets(
+export async function updateCodexAllocatorEligibility(
   db: Database,
-  workspaceId: string,
-  credentialId: string,
-  snapshot: CodexAccountUsageSnapshot,
-): Promise<CodexCapacityMutationResult<boolean>> {
-  return await withCodexCapacityMutation(
+  input: {
+    accountId: string;
+    workspaceId: string;
+    credentialId: string;
+    subjectId: string;
+    enabled: boolean;
+    expectedVersion: number;
+  },
+): Promise<CodexCapacityMutationResult<CodexAllocatorUpdateResult>> {
+  return await withCodexCapacityMutation<CodexAllocatorUpdateResult>(
     db,
-    { workspaceId, reason: "codex_usage_refreshed" },
+    { workspaceId: input.workspaceId, reason: "codex_allocator_eligibility_changed" },
     async (tx) => {
-      const updated = await tx
+      const [row] = await tx
+        .select({
+          allocatorEnabled: schema.codexSubscriptionCredentials.allocatorEnabled,
+          allocatorVersion: schema.codexSubscriptionCredentials.allocatorVersion,
+          allocatorUpdatedBySubjectId:
+            schema.codexSubscriptionCredentials.allocatorUpdatedBySubjectId,
+          allocatorUpdatedAt: schema.codexSubscriptionCredentials.allocatorUpdatedAt,
+        })
+        .from(schema.codexSubscriptionCredentials)
+        .where(
+          and(
+            eq(schema.codexSubscriptionCredentials.accountId, input.accountId),
+            eq(schema.codexSubscriptionCredentials.workspaceId, input.workspaceId),
+            eq(schema.codexSubscriptionCredentials.id, input.credentialId),
+          ),
+        )
+        .for("update")
+        .limit(1);
+      if (!row) return { result: { kind: "not_found" } as const, changed: false };
+      const current = {
+        allocatorEnabled: row.allocatorEnabled,
+        allocatorVersion: row.allocatorVersion,
+        allocatorUpdatedBySubjectId: row.allocatorUpdatedBySubjectId,
+        allocatorUpdatedAt: codexMetadataDate(row.allocatorUpdatedAt),
+      };
+      if (row.allocatorEnabled === input.enabled) {
+        return { result: { kind: "unchanged", ...current } as const, changed: false };
+      }
+      if (row.allocatorVersion !== input.expectedVersion) {
+        return { result: { kind: "conflict", ...current } as const, changed: false };
+      }
+
+      const changedAt = new Date();
+      const [updated] = await tx
         .update(schema.codexSubscriptionCredentials)
         .set({
-          primaryUsedPercent: snapshot.primaryUsedPercent,
-          primaryResetAt: snapshot.primaryResetAt,
-          secondaryUsedPercent: snapshot.secondaryUsedPercent,
-          secondaryResetAt: snapshot.secondaryResetAt,
-          usageCheckedAt: snapshot.checkedAt,
-          // NB: no `version` bump and no `updatedAt` touch — usage is non-credential
-          // metadata and must NOT race the (id, version) refresh CAS in
-          // recordCodexTokenRefresh / setCodexCredentialStatus.
+          allocatorEnabled: input.enabled,
+          allocatorVersion: sql`${schema.codexSubscriptionCredentials.allocatorVersion} + 1`,
+          allocatorUpdatedBySubjectId: input.subjectId,
+          allocatorUpdatedAt: changedAt,
+          // Deliberately no credential version/updatedAt write.
         })
         .where(
           and(
-            eq(schema.codexSubscriptionCredentials.id, credentialId),
-            eq(schema.codexSubscriptionCredentials.workspaceId, workspaceId),
+            eq(schema.codexSubscriptionCredentials.accountId, input.accountId),
+            eq(schema.codexSubscriptionCredentials.workspaceId, input.workspaceId),
+            eq(schema.codexSubscriptionCredentials.id, input.credentialId),
+            eq(schema.codexSubscriptionCredentials.allocatorVersion, input.expectedVersion),
           ),
         )
-        .returning({ id: schema.codexSubscriptionCredentials.id });
-      const changed = updated.length > 0;
-      return { result: changed, changed };
+        .returning({
+          allocatorEnabled: schema.codexSubscriptionCredentials.allocatorEnabled,
+          allocatorVersion: schema.codexSubscriptionCredentials.allocatorVersion,
+          allocatorUpdatedBySubjectId:
+            schema.codexSubscriptionCredentials.allocatorUpdatedBySubjectId,
+          allocatorUpdatedAt: schema.codexSubscriptionCredentials.allocatorUpdatedAt,
+        });
+      if (!updated) {
+        throw new Error("Codex allocator row changed while locked");
+      }
+      await tx.insert(schema.auditEvents).values({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        subjectId: input.subjectId,
+        action: "codex.allocator.updated",
+        targetType: "codex_subscription_credential",
+        targetId: input.credentialId,
+        metadata: {
+          allocatorEnabled: updated.allocatorEnabled,
+          allocatorVersion: updated.allocatorVersion,
+        },
+      });
+      return {
+        result: {
+          kind: "updated",
+          allocatorEnabled: updated.allocatorEnabled,
+          allocatorVersion: updated.allocatorVersion,
+          allocatorUpdatedBySubjectId: updated.allocatorUpdatedBySubjectId,
+          allocatorUpdatedAt: codexMetadataDate(updated.allocatorUpdatedAt),
+        } as const,
+        changed: true,
+      };
     },
   );
 }
 
-export type CodexRotationSettings = {
-  activeCredentialId: string | null;
-  /** Legacy selector bit; old binaries only understand this field. */
-  rotationEnabled: boolean;
-  /** New allocator cutover bit; ignored safely by old binaries. */
-  leaseRotationEnabled: boolean;
-  rotationStrategy: string; // P1: 'most_remaining' (unused)
-};
+export const CODEX_RESET_REDEMPTION_OUTCOMES = [
+  "reset",
+  "nothingToReset",
+  "noCredit",
+  "alreadyRedeemed",
+] as const;
+export type CodexResetRedemptionOutcome = (typeof CODEX_RESET_REDEMPTION_OUTCOMES)[number];
+export type CodexResetRedemptionStatus = "processing" | "provider_started" | "completed";
 
-/**
- * Per-workspace model/provider availability policy. NULL fields = unrestricted
- * (identical to no row — the default for every workspace). Non-null
- * allowedProviders is a strict allowlist over resolved provider identities;
- * non-null allowedModels an additional exact model-id allowlist. Consumers:
- * the API model choke points (fail 422) and the worker's post-resolution gate
- * (a blocked provider never reaches a model call and never silently remaps).
- */
-export type WorkspaceModelPolicy = {
-  allowedProviders: string[] | null;
-  allowedModels: string[] | null;
+export type CodexResetRedemptionAttempt = {
+  id: string;
+  accountId: string;
+  workspaceId: string;
+  credentialId: string;
+  subjectId: string;
+  browserSessionHash: string;
+  creditId: string;
+  upstreamIdempotencyKey: string;
+  status: CodexResetRedemptionStatus;
+  outcome: CodexResetRedemptionOutcome | null;
+  claimHolderId: string | null;
+  claimExpiresAt: Date | null;
+  confirmationExpiresAt: Date;
+  providerStartedAt: Date | null;
+  completedAt: Date | null;
+  lastFailureKind: string | null;
+  retryCount: number;
+  createdAt: Date;
+  updatedAt: Date;
 };
 
-/** The per-workspace model policy row (null when none exists = unrestricted). */
-export async function getWorkspaceModelPolicy(
+function mapCodexResetRedemptionAttempt(
+  row: typeof schema.codexResetRedemptionAttempts.$inferSelect,
+): CodexResetRedemptionAttempt {
+  return {
+    id: row.id,
+    accountId: row.accountId,
+    workspaceId: row.workspaceId,
+    credentialId: row.credentialId,
+    subjectId: row.subjectId,
+    browserSessionHash: row.browserSessionHash,
+    creditId: row.creditId,
+    upstreamIdempotencyKey: row.upstreamIdempotencyKey,
+    status: row.status as CodexResetRedemptionStatus,
+    outcome: row.outcome as CodexResetRedemptionOutcome | null,
+    claimHolderId: row.claimHolderId,
+    claimExpiresAt: codexMetadataDate(row.claimExpiresAt),
+    confirmationExpiresAt: codexMetadataDate(row.confirmationExpiresAt)!,
+    providerStartedAt: codexMetadataDate(row.providerStartedAt),
+    completedAt: codexMetadataDate(row.completedAt),
+    lastFailureKind: row.lastFailureKind,
+    retryCount: row.retryCount,
+    createdAt: codexMetadataDate(row.createdAt)!,
+    updatedAt: codexMetadataDate(row.updatedAt)!,
+  };
+}
+
+/** Metadata-only attempt read used to resume a browser-session-bound ambiguity. */
+export async function getCodexResetRedemptionAttempt(
   db: Database,
   workspaceId: string,
-): Promise<WorkspaceModelPolicy | null> {
+  attemptId: string,
+): Promise<CodexResetRedemptionAttempt | null> {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [row] = await scopedDb
-      .select({
-        allowedProviders: schema.workspaceModelPolicies.allowedProviders,
-        allowedModels: schema.workspaceModelPolicies.allowedModels,
-      })
-      .from(schema.workspaceModelPolicies)
-      .where(eq(schema.workspaceModelPolicies.workspaceId, workspaceId))
+      .select()
+      .from(schema.codexResetRedemptionAttempts)
+      .where(
+        and(
+          eq(schema.codexResetRedemptionAttempts.workspaceId, workspaceId),
+          eq(schema.codexResetRedemptionAttempts.id, attemptId),
+        ),
+      )
       .limit(1);
-    return row ?? null;
+    return row ? mapCodexResetRedemptionAttempt(row) : null;
   });
 }
 
+export type CodexResetRedemptionRecovery = {
+  attemptId: string;
+  credentialId: string;
+  creditId: string;
+  status: "provider_started" | "completed";
+  outcome: CodexResetRedemptionOutcome | null;
+  providerStartedAt: Date | null;
+  completedAt: Date | null;
+  createdAt: Date;
+  updatedAt: Date;
+};
+
 /**
- * Create or replace the workspace's model policy. Passing null for a field
- * clears that restriction; a policy of {null, null} is kept as an explicit
- * "unrestricted" row (delete is not needed for correctness — it reads the same
- * as no row).
+ * Cookie-owner discovery source for durable ambiguous/completed attempts.
+ * Browser storage is never required to recover these non-secret identifiers.
  */
-export async function upsertWorkspaceModelPolicy(
+export async function listCodexResetRedemptionRecoveries(
   db: Database,
-  input: {
-    accountId: string;
-    workspaceId: string;
-    allowedProviders: string[] | null;
-    allowedModels: string[] | null;
-  },
-): Promise<WorkspaceModelPolicy> {
+  input: { accountId: string; workspaceId: string; subjectId: string },
+): Promise<CodexResetRedemptionRecovery[]> {
   return await withRlsContext(
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
-      const [row] = await scopedDb
-        .insert(schema.workspaceModelPolicies)
-        .values({
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          allowedProviders: input.allowedProviders,
-          allowedModels: input.allowedModels,
-        })
-        .onConflictDoUpdate({
-          target: [schema.workspaceModelPolicies.workspaceId],
-          set: {
-            allowedProviders: input.allowedProviders,
-            allowedModels: input.allowedModels,
-            updatedAt: new Date(),
-          },
+      const rows = await scopedDb
+        .select({
+          attemptId: schema.codexResetRedemptionAttempts.id,
+          credentialId: schema.codexResetRedemptionAttempts.credentialId,
+          creditId: schema.codexResetRedemptionAttempts.creditId,
+          status: schema.codexResetRedemptionAttempts.status,
+          outcome: schema.codexResetRedemptionAttempts.outcome,
+          providerStartedAt: schema.codexResetRedemptionAttempts.providerStartedAt,
+          completedAt: schema.codexResetRedemptionAttempts.completedAt,
+          createdAt: schema.codexResetRedemptionAttempts.createdAt,
+          updatedAt: schema.codexResetRedemptionAttempts.updatedAt,
         })
-        .returning({
-          allowedProviders: schema.workspaceModelPolicies.allowedProviders,
-          allowedModels: schema.workspaceModelPolicies.allowedModels,
-        });
-      return row!;
+        .from(schema.codexResetRedemptionAttempts)
+        .innerJoin(
+          schema.codexSubscriptionCredentials,
+          and(
+            eq(
+              schema.codexSubscriptionCredentials.id,
+              schema.codexResetRedemptionAttempts.credentialId,
+            ),
+            eq(
+              schema.codexSubscriptionCredentials.workspaceId,
+              schema.codexResetRedemptionAttempts.workspaceId,
+            ),
+          ),
+        )
+        .where(
+          and(
+            eq(schema.codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+            eq(schema.codexResetRedemptionAttempts.subjectId, input.subjectId),
+            eq(schema.codexSubscriptionCredentials.connectedBySubjectId, input.subjectId),
+            inArray(schema.codexResetRedemptionAttempts.status, ["provider_started", "completed"]),
+          ),
+        )
+        .orderBy(desc(schema.codexResetRedemptionAttempts.createdAt));
+      return rows.map((row) => ({
+        attemptId: row.attemptId,
+        credentialId: row.credentialId,
+        creditId: row.creditId,
+        status: row.status as "provider_started" | "completed",
+        outcome: row.outcome as CodexResetRedemptionOutcome | null,
+        providerStartedAt: codexMetadataDate(row.providerStartedAt),
+        completedAt: codexMetadataDate(row.completedAt),
+        createdAt: codexMetadataDate(row.createdAt)!,
+        updatedAt: codexMetadataDate(row.updatedAt)!,
+      }));
     },
   );
 }
 
-/** The per-workspace rotation/active-pointer row (null when none exists yet). */
-export async function getCodexRotationSettings(
+export type AdoptCodexResetRedemptionResult =
+  | { kind: "current" | "adopted"; attempt: CodexResetRedemptionAttempt }
+  | { kind: "in_progress" }
+  | { kind: "not_found" }
+  | { kind: "forbidden" }
+  | { kind: "conflict" };
+
+/** Adopt a released durable ambiguity/completion into the owner's current browser session. */
+export async function adoptCodexResetRedemptionAttempt(
   db: Database,
-  workspaceId: string,
-): Promise<CodexRotationSettings | null> {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const [row] = await scopedDb
-      .select({
-        activeCredentialId: schema.codexRotationSettings.activeCredentialId,
-        rotationEnabled: schema.codexRotationSettings.rotationEnabled,
-        leaseRotationEnabled: schema.codexRotationSettings.leaseRotationEnabled,
-        rotationStrategy: schema.codexRotationSettings.rotationStrategy,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    attemptId: string;
+    credentialId: string;
+    creditId: string;
+    subjectId: string;
+    browserSessionHash: string;
+  },
+): Promise<AdoptCodexResetRedemptionResult> {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (tx) => {
+        const [credential] = await tx
+          .select({
+            connectedBySubjectId: schema.codexSubscriptionCredentials.connectedBySubjectId,
+          })
+          .from(schema.codexSubscriptionCredentials)
+          .where(
+            and(
+              eq(schema.codexSubscriptionCredentials.id, input.credentialId),
+              eq(schema.codexSubscriptionCredentials.workspaceId, input.workspaceId),
+            ),
+          )
+          .for("share")
+          .limit(1);
+        if (!credential) return { kind: "not_found" } as const;
+        if (credential.connectedBySubjectId !== input.subjectId) {
+          return { kind: "forbidden" } as const;
+        }
+        const [attempt] = await tx
+          .select()
+          .from(schema.codexResetRedemptionAttempts)
+          .where(
+            and(
+              eq(schema.codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+              eq(schema.codexResetRedemptionAttempts.id, input.attemptId),
+            ),
+          )
+          .for("update")
+          .limit(1);
+        if (!attempt) return { kind: "not_found" } as const;
+        if (
+          attempt.accountId !== input.accountId ||
+          attempt.credentialId !== input.credentialId ||
+          attempt.creditId !== input.creditId ||
+          attempt.subjectId !== input.subjectId
+        ) {
+          return { kind: "conflict" } as const;
+        }
+        if (attempt.browserSessionHash === input.browserSessionHash) {
+          return { kind: "current", attempt: mapCodexResetRedemptionAttempt(attempt) } as const;
+        }
+        if (attempt.status !== "provider_started" && attempt.status !== "completed") {
+          return { kind: "conflict" } as const;
+        }
+        const claim = await tx.execute<{ claim_live: boolean }>(sql`
+          select claim_expires_at > now() as claim_live
+          from codex_reset_redemption_attempts
+          where workspace_id = ${input.workspaceId} and id = ${input.attemptId}
+        `);
+        if (claim[0]?.claim_live) return { kind: "in_progress" } as const;
+        const [adopted] = await tx
+          .update(schema.codexResetRedemptionAttempts)
+          .set({
+            browserSessionHash: input.browserSessionHash,
+            claimHolderId: null,
+            claimExpiresAt: null,
+            updatedAt: sql`now()`,
+          })
+          .where(eq(schema.codexResetRedemptionAttempts.id, input.attemptId))
+          .returning();
+        if (!adopted) throw new Error("Codex redemption adoption returned no row");
+        return { kind: "adopted", attempt: mapCodexResetRedemptionAttempt(adopted) } as const;
+      }),
+  );
+}
+
+export type ClaimCodexResetRedemptionResult =
+  | { kind: "claimed"; attempt: CodexResetRedemptionAttempt }
+  | { kind: "in_progress"; attempt: CodexResetRedemptionAttempt }
+  | { kind: "completed"; attempt: CodexResetRedemptionAttempt }
+  | { kind: "not_found" }
+  | { kind: "forbidden" }
+  | { kind: "conflict" };
+
+/**
+ * Claim or reclaim one logical redemption across API replicas/crashes.
+ *
+ * A transaction advisory lock closes the initial INSERT race. A live claim
+ * yields `in_progress`; an expired/released claim is reclaimed without changing
+ * the status or upstream key. Existing attempt identity is immutable.
+ */
+export async function claimCodexResetRedemption(
+  db: Database,
+  input: {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    credentialId: string;
+    subjectId: string;
+    browserSessionHash: string;
+    creditId: string;
+    confirmationExpiresAt: Date;
+    claimHolderId: string;
+    claimTtlMs?: number;
+  },
+): Promise<ClaimCodexResetRedemptionResult> {
+  const claimTtlMs = input.claimTtlMs ?? 60_000;
+  if (!Number.isFinite(claimTtlMs) || claimTtlMs <= 0) {
+    throw new Error("Codex redemption claim TTL must be positive");
+  }
+  if (
+    !Number.isFinite(input.confirmationExpiresAt.getTime()) ||
+    input.confirmationExpiresAt.getTime() <= Date.now()
+  ) {
+    return { kind: "forbidden" };
+  }
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (tx) => {
+        await tx.execute(
+          sql`select pg_advisory_xact_lock(hashtextextended(${`codex-reset-attempt:${input.id}`}, 0))`,
+        );
+        // A second browser tab has a different attempt UUID. Serialize on the
+        // irreversible provider credit too, then let the unique index provide
+        // the durable fail-closed backstop.
+        await tx.execute(
+          sql`select pg_advisory_xact_lock(hashtextextended(${`codex-reset-credit:${input.workspaceId}:${input.credentialId}:${input.creditId}`}, 0))`,
+        );
+        const [credential] = await tx
+          .select({
+            connectedBySubjectId: schema.codexSubscriptionCredentials.connectedBySubjectId,
+            status: schema.codexSubscriptionCredentials.status,
+          })
+          .from(schema.codexSubscriptionCredentials)
+          .where(
+            and(
+              eq(schema.codexSubscriptionCredentials.accountId, input.accountId),
+              eq(schema.codexSubscriptionCredentials.workspaceId, input.workspaceId),
+              eq(schema.codexSubscriptionCredentials.id, input.credentialId),
+            ),
+          )
+          .for("share")
+          .limit(1);
+        if (!credential) return { kind: "not_found" } as const;
+        const [existing] = await tx
+          .select()
+          .from(schema.codexResetRedemptionAttempts)
+          .where(
+            and(
+              eq(schema.codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+              eq(schema.codexResetRedemptionAttempts.id, input.id),
+            ),
+          )
+          .for("update")
+          .limit(1);
+        const now = new Date();
+        if (existing) {
+          if (
+            existing.accountId !== input.accountId ||
+            existing.credentialId !== input.credentialId ||
+            existing.subjectId !== input.subjectId ||
+            existing.browserSessionHash !== input.browserSessionHash ||
+            existing.creditId !== input.creditId
+          ) {
+            return { kind: "conflict" } as const;
+          }
+          if (credential.connectedBySubjectId !== input.subjectId) {
+            return { kind: "forbidden" } as const;
+          }
+          const mapped = mapCodexResetRedemptionAttempt(existing);
+          // Completion is durable truth. A token-health transition after the
+          // provider outcome committed must not turn an HTTP-response-loss
+          // replay into a false 403 or trigger a second consume. Current human
+          // ownership remains mandatory, but active health is needed only when
+          // work may still have to reach the provider.
+          if (mapped.status === "completed") return { kind: "completed", attempt: mapped };
+          if (credential.status !== "active") {
+            return { kind: "forbidden" } as const;
+          }
+          const claimState = await tx.execute(sql<{ claim_live: boolean }>`
+            select claim_expires_at > now() as claim_live
+            from codex_reset_redemption_attempts
+            where workspace_id = ${input.workspaceId} and id = ${input.id}
+          `);
+          if (claimState[0]?.claim_live) {
+            return { kind: "in_progress", attempt: mapped };
+          }
+          const [reclaimed] = await tx
+            .update(schema.codexResetRedemptionAttempts)
+            .set({
+              claimHolderId: input.claimHolderId,
+              claimExpiresAt: sql`now() + (${claimTtlMs} * interval '1 millisecond')`,
+              confirmationExpiresAt: input.confirmationExpiresAt,
+              lastFailureKind: null,
+              retryCount: sql`${schema.codexResetRedemptionAttempts.retryCount} + 1`,
+              updatedAt: now,
+            })
+            .where(eq(schema.codexResetRedemptionAttempts.id, input.id))
+            .returning();
+          if (!reclaimed) throw new Error("Codex redemption reclaim returned no row");
+          return {
+            kind: "claimed",
+            attempt: mapCodexResetRedemptionAttempt(reclaimed),
+          };
+        }
+
+        // Authorize before looking up credit-attempt state so a non-owner cannot
+        // distinguish an unused provider credit from one with an existing attempt.
+        if (credential.status !== "active" || credential.connectedBySubjectId !== input.subjectId) {
+          return { kind: "forbidden" } as const;
+        }
+
+        const [creditAttempt] = await tx.execute<{
+          id: string;
+          status: CodexResetRedemptionStatus;
+          claim_live: boolean | null;
+        }>(sql`
+          select id, status, claim_expires_at > now() as claim_live
+          from codex_reset_redemption_attempts
+          where workspace_id = ${input.workspaceId}
+            and credential_id = ${input.credentialId}
+            and credit_id = ${input.creditId}
+            and (status <> 'completed' or outcome in ('reset', 'alreadyRedeemed'))
+          limit 1
+          for update
+        `);
+        if (creditAttempt) {
+          // A different browser UUID may replace only definite pre-provider
+          // work whose claim is released/expired. The per-credit advisory lock
+          // serializes replacement with a late original claimant, and the
+          // DB-time predicate prevents an application-clock race. Once
+          // provider_started (or successfully completed), preserve the one
+          // upstream idempotency key and fail closed.
+          if (creditAttempt.status !== "processing" || creditAttempt.claim_live) {
+            return { kind: "conflict" } as const;
+          }
+          const removed = await tx
+            .delete(schema.codexResetRedemptionAttempts)
+            .where(
+              and(
+                eq(schema.codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+                eq(schema.codexResetRedemptionAttempts.id, creditAttempt.id),
+                eq(schema.codexResetRedemptionAttempts.status, "processing"),
+                sql`(${schema.codexResetRedemptionAttempts.claimExpiresAt} is null or ${schema.codexResetRedemptionAttempts.claimExpiresAt} <= now())`,
+              ),
+            )
+            .returning({ id: schema.codexResetRedemptionAttempts.id });
+          if (removed.length !== 1) return { kind: "conflict" } as const;
+        }
+
+        const [created] = await tx
+          .insert(schema.codexResetRedemptionAttempts)
+          .values({
+            id: input.id,
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            credentialId: input.credentialId,
+            subjectId: input.subjectId,
+            browserSessionHash: input.browserSessionHash,
+            creditId: input.creditId,
+            status: "processing",
+            claimHolderId: input.claimHolderId,
+            claimExpiresAt: sql`now() + (${claimTtlMs} * interval '1 millisecond')`,
+            confirmationExpiresAt: input.confirmationExpiresAt,
+          })
+          .returning();
+        if (!created) throw new Error("Codex redemption claim returned no row");
+        return {
+          kind: "claimed",
+          attempt: mapCodexResetRedemptionAttempt(created),
+        };
+      }),
+  );
+}
+
+export type CodexResetRedemptionSendNotReadyReason =
+  | "not_found"
+  | "identity_mismatch"
+  | "claim_expired"
+  | "confirmation_expired"
+  | "credential_unavailable"
+  | "already_completed";
+
+export type FenceCodexResetRedemptionSendResult =
+  | { kind: "ready"; attempt: CodexResetRedemptionAttempt }
+  | {
+      kind: "not_ready";
+      reason: CodexResetRedemptionSendNotReadyReason;
+    };
+
+/**
+ * Final DB-time irreversible-send fence, called only after preflight and token
+ * resolution and immediately before every provider POST (including ambiguity
+ * retries). The credential SHARE lock serializes against disconnect and
+ * ownership-changing reconnect. The claim is extended beyond the bounded
+ * consume operation in the same transaction that persists provider_started.
+ */
+export async function fenceCodexResetRedemptionSend(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    attemptId: string;
+    claimHolderId: string;
+    credentialId: string;
+    subjectId: string;
+    browserSessionHash: string;
+    sendLeaseMs?: number;
+  },
+): Promise<FenceCodexResetRedemptionSendResult> {
+  const sendLeaseMs = input.sendLeaseMs ?? 30_000;
+  if (!Number.isFinite(sendLeaseMs) || sendLeaseMs <= 10_000) {
+    throw new Error("Codex redemption send lease must exceed the bounded provider call");
+  }
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (tx) => {
+        const [credential] = await tx
+          .select({
+            connectedBySubjectId: schema.codexSubscriptionCredentials.connectedBySubjectId,
+            status: schema.codexSubscriptionCredentials.status,
+          })
+          .from(schema.codexSubscriptionCredentials)
+          .where(
+            and(
+              eq(schema.codexSubscriptionCredentials.accountId, input.accountId),
+              eq(schema.codexSubscriptionCredentials.workspaceId, input.workspaceId),
+              eq(schema.codexSubscriptionCredentials.id, input.credentialId),
+            ),
+          )
+          .for("share")
+          .limit(1);
+        const [attempt] = await tx
+          .select()
+          .from(schema.codexResetRedemptionAttempts)
+          .where(
+            and(
+              eq(schema.codexResetRedemptionAttempts.accountId, input.accountId),
+              eq(schema.codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+              eq(schema.codexResetRedemptionAttempts.id, input.attemptId),
+            ),
+          )
+          .for("update")
+          .limit(1);
+        if (!attempt) return { kind: "not_ready", reason: "not_found" } as const;
+        if (
+          attempt.credentialId !== input.credentialId ||
+          attempt.subjectId !== input.subjectId ||
+          attempt.browserSessionHash !== input.browserSessionHash ||
+          attempt.claimHolderId !== input.claimHolderId
+        ) {
+          return { kind: "not_ready", reason: "identity_mismatch" } as const;
+        }
+        if (attempt.status === "completed") {
+          return { kind: "not_ready", reason: "already_completed" } as const;
+        }
+        const [liveness] = await tx.execute<{
+          claim_live: boolean;
+          confirmation_live: boolean;
+        }>(sql`
+          select claim_expires_at > now() as claim_live,
+                 confirmation_expires_at > now() as confirmation_live
+          from codex_reset_redemption_attempts
+          where workspace_id = ${input.workspaceId} and id = ${input.attemptId}
+        `);
+        let reason: CodexResetRedemptionSendNotReadyReason;
+        if (!liveness?.claim_live) reason = "claim_expired";
+        else if (!liveness.confirmation_live) reason = "confirmation_expired";
+        else if (
+          !credential ||
+          credential.status !== "active" ||
+          credential.connectedBySubjectId !== input.subjectId
+        ) {
+          reason = "credential_unavailable";
+        } else {
+          const [ready] = await tx
+            .update(schema.codexResetRedemptionAttempts)
+            .set({
+              status: "provider_started",
+              providerStartedAt: sql`coalesce(${schema.codexResetRedemptionAttempts.providerStartedAt}, now())`,
+              claimExpiresAt: sql`now() + (${sendLeaseMs} * interval '1 millisecond')`,
+              lastFailureKind: null,
+              updatedAt: sql`now()`,
+            })
+            .where(eq(schema.codexResetRedemptionAttempts.id, input.attemptId))
+            .returning();
+          if (!ready) throw new Error("Codex redemption send fence returned no row");
+          return { kind: "ready", attempt: mapCodexResetRedemptionAttempt(ready) } as const;
+        }
+
+        // Before provider_started it is safe to remove the false logical
+        // attempt. Once provider work may have begun, preserve the upstream key
+        // and merely release this request's stale claim for owner recovery.
+        if (attempt.status === "processing") {
+          await tx
+            .delete(schema.codexResetRedemptionAttempts)
+            .where(eq(schema.codexResetRedemptionAttempts.id, input.attemptId));
+        } else {
+          await tx
+            .update(schema.codexResetRedemptionAttempts)
+            .set({
+              claimHolderId: null,
+              claimExpiresAt: null,
+              lastFailureKind: `send_fence_${reason}`,
+              updatedAt: sql`now()`,
+            })
+            .where(eq(schema.codexResetRedemptionAttempts.id, input.attemptId));
+        }
+        return { kind: "not_ready", reason } as const;
+      }),
+  );
+}
+
+/** Delete only definite pre-provider work still owned by this request. */
+export async function abandonCodexResetRedemptionBeforeProvider(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    attemptId: string;
+    claimHolderId: string;
+  },
+): Promise<boolean> {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const deleted = await scopedDb
+        .delete(schema.codexResetRedemptionAttempts)
+        .where(
+          and(
+            eq(schema.codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+            eq(schema.codexResetRedemptionAttempts.id, input.attemptId),
+            eq(schema.codexResetRedemptionAttempts.status, "processing"),
+            eq(schema.codexResetRedemptionAttempts.claimHolderId, input.claimHolderId),
+          ),
+        )
+        .returning({ id: schema.codexResetRedemptionAttempts.id });
+      return deleted.length === 1;
+    },
+  );
+}
+
+/** Release a failed claim while preserving processing/provider_started truth. */
+export async function releaseCodexResetRedemptionClaim(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    attemptId: string;
+    claimHolderId: string;
+    failureKind: string;
+  },
+): Promise<boolean> {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const rows = await scopedDb
+        .update(schema.codexResetRedemptionAttempts)
+        .set({
+          claimHolderId: null,
+          claimExpiresAt: null,
+          lastFailureKind: input.failureKind.slice(0, 100),
+          updatedAt: new Date(),
+        })
+        .where(
+          and(
+            eq(schema.codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+            eq(schema.codexResetRedemptionAttempts.id, input.attemptId),
+            eq(schema.codexResetRedemptionAttempts.claimHolderId, input.claimHolderId),
+            sql`${schema.codexResetRedemptionAttempts.status} <> 'completed'`,
+          ),
+        )
+        .returning({ id: schema.codexResetRedemptionAttempts.id });
+      return rows.length === 1;
+    },
+  );
+}
+
+/** Persist the exact provider outcome, cooldown repair, and audit atomically. */
+export async function completeCodexResetRedemption(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    attemptId: string;
+    claimHolderId: string;
+    outcome: CodexResetRedemptionOutcome;
+  },
+): Promise<CodexCapacityMutationResult<CodexResetRedemptionAttempt | null>> {
+  if (!CODEX_RESET_REDEMPTION_OUTCOMES.includes(input.outcome)) {
+    throw new Error("Unknown Codex redemption outcome");
+  }
+  return await withCodexCapacityMutation(
+    db,
+    { workspaceId: input.workspaceId, reason: "codex_reset_credit_redeemed" },
+    async (tx) => {
+      // Claims take this lock before touching the credential and attempt rows.
+      // Completion takes the same fence after the canonical capacity lock, so
+      // a claim cannot hold a credential SHARE lock while waiting for an
+      // attempt row that this transaction already owns.
+      await tx.execute(
+        sql`select pg_advisory_xact_lock(hashtextextended(${`codex-reset-attempt:${input.attemptId}`}, 0))`,
+      );
+      const [current] = await tx
+        .select()
+        .from(schema.codexResetRedemptionAttempts)
+        .where(
+          and(
+            eq(schema.codexResetRedemptionAttempts.accountId, input.accountId),
+            eq(schema.codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+            eq(schema.codexResetRedemptionAttempts.id, input.attemptId),
+          ),
+        )
+        .for("update")
+        .limit(1);
+      if (!current) return { result: null, changed: false };
+      if (current.status === "completed") {
+        return { result: mapCodexResetRedemptionAttempt(current), changed: false };
+      }
+      if (current.status !== "provider_started" || current.claimHolderId !== input.claimHolderId) {
+        return { result: null, changed: false };
+      }
+      const completedAt = new Date();
+      const [completed] = await tx
+        .update(schema.codexResetRedemptionAttempts)
+        .set({
+          status: "completed",
+          outcome: input.outcome,
+          completedAt,
+          claimHolderId: null,
+          claimExpiresAt: null,
+          lastFailureKind: null,
+          updatedAt: completedAt,
+        })
+        .where(
+          and(
+            eq(schema.codexResetRedemptionAttempts.accountId, input.accountId),
+            eq(schema.codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+            eq(schema.codexResetRedemptionAttempts.id, input.attemptId),
+          ),
+        )
+        .returning();
+      if (!completed) throw new Error("Codex redemption completion returned no row");
+      const restoresCapacity = input.outcome === "reset" || input.outcome === "alreadyRedeemed";
+      if (restoresCapacity) {
+        await tx
+          .update(schema.codexSubscriptionCredentials)
+          .set({ exhaustedUntil: null })
+          .where(
+            and(
+              eq(schema.codexSubscriptionCredentials.accountId, input.accountId),
+              eq(schema.codexSubscriptionCredentials.workspaceId, input.workspaceId),
+              eq(schema.codexSubscriptionCredentials.id, current.credentialId),
+            ),
+          );
+      }
+      await tx.insert(schema.auditEvents).values({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        subjectId: current.subjectId,
+        action: "codex.reset_credit.redemption.completed",
+        targetType: "codex_reset_redemption_attempt",
+        targetId: input.attemptId,
+        metadata: { outcome: input.outcome },
+      });
+      return {
+        result: mapCodexResetRedemptionAttempt(completed),
+        // A successful/already-applied upstream reset can make durable waiters
+        // eligible immediately even when the local cooldown was already null.
+        changed: restoresCapacity,
+      };
+    },
+  );
+}
+
+/** The P2 usage-cache snapshot written by the refreshing usage wrapper. */
+export type CodexAccountUsageSnapshot = {
+  primaryUsedPercent?: number | null;
+  primaryResetAt?: Date | null;
+  secondaryUsedPercent?: number | null;
+  secondaryResetAt?: Date | null;
+  /** Present only when the quota body parsed successfully. */
+  checkedAt?: Date;
+  resetCreditAvailableCount?: number | null;
+  resetCreditsCheckedAt?: Date | null;
+};
+
+/**
+ * Cache-write for P2 quota bars: persist the five plaintext usage columns on a
+ * SPECIFIC credential row. NEVER touches credential_encrypted. RLS-scoped, guarded
+ * by (id, workspace_id) so it can only write a row the workspace owns. Returns true
+ * iff a row was updated (false ⇒ the credential was disconnected under us — the
+ * snapshot is moot, drop it). This is the only writer of the usage_checked_at TTL
+ * clock that `listCodexAccountStatuses` reads back.
+ */
+export async function recordCodexAccountUsage(
+  db: Database,
+  workspaceId: string,
+  credentialId: string,
+  snapshot: CodexAccountUsageSnapshot,
+): Promise<boolean> {
+  return (await recordCodexAccountUsageWithWakeTargets(db, workspaceId, credentialId, snapshot))
+    .result;
+}
+
+/** Usage-cache mutation plus its committed durable capacity-wake outbox. */
+export async function recordCodexAccountUsageWithWakeTargets(
+  db: Database,
+  workspaceId: string,
+  credentialId: string,
+  snapshot: CodexAccountUsageSnapshot,
+): Promise<CodexCapacityMutationResult<boolean>> {
+  return await withCodexCapacityMutation(
+    db,
+    { workspaceId, reason: "codex_usage_refreshed" },
+    async (tx) => {
+      const updated = await tx
+        .update(schema.codexSubscriptionCredentials)
+        .set({
+          ...(snapshot.checkedAt !== undefined
+            ? {
+                primaryUsedPercent: snapshot.primaryUsedPercent ?? null,
+                primaryResetAt: snapshot.primaryResetAt ?? null,
+                secondaryUsedPercent: snapshot.secondaryUsedPercent ?? null,
+                secondaryResetAt: snapshot.secondaryResetAt ?? null,
+                usageCheckedAt: snapshot.checkedAt,
+              }
+            : {}),
+          ...(snapshot.resetCreditAvailableCount !== undefined
+            ? {
+                resetCreditAvailableCount: snapshot.resetCreditAvailableCount,
+                resetCreditsCheckedAt: snapshot.resetCreditsCheckedAt ?? null,
+              }
+            : {}),
+          // NB: no `version` bump and no `updatedAt` touch — usage is non-credential
+          // metadata and must NOT race the (id, version) refresh CAS in
+          // recordCodexTokenRefresh / setCodexCredentialStatus.
+        })
+        .where(
+          and(
+            eq(schema.codexSubscriptionCredentials.id, credentialId),
+            eq(schema.codexSubscriptionCredentials.workspaceId, workspaceId),
+          ),
+        )
+        .returning({ id: schema.codexSubscriptionCredentials.id });
+      const changed = updated.length > 0;
+      return { result: changed, changed };
+    },
+  );
+}
+
+export type CodexRotationSettings = {
+  activeCredentialId: string | null;
+  /** Legacy selector bit; old binaries only understand this field. */
+  rotationEnabled: boolean;
+  /** New allocator cutover bit; ignored safely by old binaries. */
+  leaseRotationEnabled: boolean;
+  rotationStrategy: string; // P1: 'most_remaining' (unused)
+};
+
+/**
+ * Per-workspace model/provider availability policy. NULL fields = unrestricted
+ * (identical to no row — the default for every workspace). Non-null
+ * allowedProviders is a strict allowlist over resolved provider identities;
+ * non-null allowedModels an additional exact model-id allowlist. Consumers:
+ * the API model choke points (fail 422) and the worker's post-resolution gate
+ * (a blocked provider never reaches a model call and never silently remaps).
+ */
+export type WorkspaceModelPolicy = {
+  allowedProviders: string[] | null;
+  allowedModels: string[] | null;
+};
+
+/** The per-workspace model policy row (null when none exists = unrestricted). */
+export async function getWorkspaceModelPolicy(
+  db: Database,
+  workspaceId: string,
+): Promise<WorkspaceModelPolicy | null> {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb
+      .select({
+        allowedProviders: schema.workspaceModelPolicies.allowedProviders,
+        allowedModels: schema.workspaceModelPolicies.allowedModels,
+      })
+      .from(schema.workspaceModelPolicies)
+      .where(eq(schema.workspaceModelPolicies.workspaceId, workspaceId))
+      .limit(1);
+    return row ?? null;
+  });
+}
+
+/**
+ * Create or replace the workspace's model policy. Passing null for a field
+ * clears that restriction; a policy of {null, null} is kept as an explicit
+ * "unrestricted" row (delete is not needed for correctness — it reads the same
+ * as no row).
+ */
+export async function upsertWorkspaceModelPolicy(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    allowedProviders: string[] | null;
+    allowedModels: string[] | null;
+  },
+): Promise<WorkspaceModelPolicy> {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const [row] = await scopedDb
+        .insert(schema.workspaceModelPolicies)
+        .values({
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          allowedProviders: input.allowedProviders,
+          allowedModels: input.allowedModels,
+        })
+        .onConflictDoUpdate({
+          target: [schema.workspaceModelPolicies.workspaceId],
+          set: {
+            allowedProviders: input.allowedProviders,
+            allowedModels: input.allowedModels,
+            updatedAt: new Date(),
+          },
+        })
+        .returning({
+          allowedProviders: schema.workspaceModelPolicies.allowedProviders,
+          allowedModels: schema.workspaceModelPolicies.allowedModels,
+        });
+      return row!;
+    },
+  );
+}
+
+/** The per-workspace rotation/active-pointer row (null when none exists yet). */
+export async function getCodexRotationSettings(
+  db: Database,
+  workspaceId: string,
+): Promise<CodexRotationSettings | null> {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb
+      .select({
+        activeCredentialId: schema.codexRotationSettings.activeCredentialId,
+        rotationEnabled: schema.codexRotationSettings.rotationEnabled,
+        leaseRotationEnabled: schema.codexRotationSettings.leaseRotationEnabled,
+        rotationStrategy: schema.codexRotationSettings.rotationStrategy,
       })
       .from(schema.codexRotationSettings)
       .where(eq(schema.codexRotationSettings.workspaceId, workspaceId))
@@ -11111,13 +12160,58 @@ export async function disconnectCodexAccount(
   db: Database,
   workspaceId: string,
   credentialId: string,
-): Promise<{ removed: boolean; newActiveCredentialId: string | null }> {
+): Promise<{
+  removed: boolean;
+  newActiveCredentialId: string | null;
+  blockedByUnresolvedRedemption: boolean;
+}> {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     await scopedDb.execute(sql`
       select id from codex_rotation_settings
       where workspace_id = ${workspaceId}
       for update
     `);
+    const [credential] = await scopedDb
+      .select({ id: schema.codexSubscriptionCredentials.id })
+      .from(schema.codexSubscriptionCredentials)
+      .where(
+        and(
+          eq(schema.codexSubscriptionCredentials.id, credentialId),
+          eq(schema.codexSubscriptionCredentials.workspaceId, workspaceId),
+        ),
+      )
+      .for("update")
+      .limit(1);
+    const [settingsBefore] = await scopedDb
+      .select({ activeCredentialId: schema.codexRotationSettings.activeCredentialId })
+      .from(schema.codexRotationSettings)
+      .where(eq(schema.codexRotationSettings.workspaceId, workspaceId))
+      .limit(1);
+    if (!credential) {
+      return {
+        removed: false,
+        newActiveCredentialId: settingsBefore?.activeCredentialId ?? null,
+        blockedByUnresolvedRedemption: false,
+      };
+    }
+    const [unresolved] = await scopedDb
+      .select({ id: schema.codexResetRedemptionAttempts.id })
+      .from(schema.codexResetRedemptionAttempts)
+      .where(
+        and(
+          eq(schema.codexResetRedemptionAttempts.workspaceId, workspaceId),
+          eq(schema.codexResetRedemptionAttempts.credentialId, credentialId),
+          eq(schema.codexResetRedemptionAttempts.status, "provider_started"),
+        ),
+      )
+      .limit(1);
+    if (unresolved) {
+      return {
+        removed: false,
+        newActiveCredentialId: settingsBefore?.activeCredentialId ?? null,
+        blockedByUnresolvedRedemption: true,
+      };
+    }
     const removedRows = await scopedDb
       .delete(schema.codexSubscriptionCredentials)
       .where(
@@ -11139,6 +12233,7 @@ export async function disconnectCodexAccount(
       return {
         removed: false,
         newActiveCredentialId: settingsRow?.activeCredentialId ?? null,
+        blockedByUnresolvedRedemption: false,
       };
     }
     let newActive = settingsRow?.activeCredentialId ?? null;
@@ -11157,21 +12252,47 @@ export async function disconnectCodexAccount(
           .where(eq(schema.codexRotationSettings.workspaceId, workspaceId));
       }
     }
-    return { removed: true, newActiveCredentialId: newActive };
+    return {
+      removed: true,
+      newActiveCredentialId: newActive,
+      blockedByUnresolvedRedemption: false,
+    };
   });
 }
 
-/** Legacy "disconnect all" (old workspace-wide behavior). Returns rows removed. */
+/** Legacy "disconnect all"; atomically rejects when any provider work is unresolved. */
 export async function disconnectAllCodexAccounts(
   db: Database,
   workspaceId: string,
-): Promise<number> {
+): Promise<{ removed: number; blockedCredentialIds: string[] }> {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const credentials = await scopedDb
+      .select({ id: schema.codexSubscriptionCredentials.id })
+      .from(schema.codexSubscriptionCredentials)
+      .where(eq(schema.codexSubscriptionCredentials.workspaceId, workspaceId))
+      .orderBy(asc(schema.codexSubscriptionCredentials.id))
+      .for("update");
+    if (credentials.length === 0) return { removed: 0, blockedCredentialIds: [] };
+    const blocked = await scopedDb
+      .selectDistinct({ credentialId: schema.codexResetRedemptionAttempts.credentialId })
+      .from(schema.codexResetRedemptionAttempts)
+      .where(
+        and(
+          eq(schema.codexResetRedemptionAttempts.workspaceId, workspaceId),
+          eq(schema.codexResetRedemptionAttempts.status, "provider_started"),
+        ),
+      );
+    if (blocked.length > 0) {
+      return {
+        removed: 0,
+        blockedCredentialIds: blocked.map((row) => row.credentialId).sort(),
+      };
+    }
     const rows = await scopedDb
       .delete(schema.codexSubscriptionCredentials)
       .where(eq(schema.codexSubscriptionCredentials.workspaceId, workspaceId))
       .returning({ id: schema.codexSubscriptionCredentials.id });
-    return rows.length;
+    return { removed: rows.length, blockedCredentialIds: [] };
   });
 }
 
@@ -11268,6 +12389,7 @@ function mapSessionMcpServerMetadata(
     url: row.url,
     headerNames: Object.keys(row.headersEncrypted ?? {}).sort(),
     credentialVersion: Number(row.credentialVersion),
+    requireApproval: row.requireApproval ?? false,
     connectionRef: row.connectionRef ?? null,
   };
 }
@@ -11453,13 +12575,98 @@ async function updateSessionMcpServerCredentialsInTransaction(
   return { servers, missingIds };
 }
 
+export async function updateSessionMcpApprovalPolicy(
+  db: Database,
+  input: {
+    workspaceId: string;
+    sessionId: string;
+    serverId: string;
+    requireApproval: SessionMcpApprovalPolicy;
+  },
+): Promise<UpdateSessionMcpApprovalPolicyResult> {
+  return await withWorkspaceRls(
+    db,
+    input.workspaceId,
+    async (scopedDb) =>
+      await scopedDb.transaction(
+        async (tx) => await updateSessionMcpApprovalPolicyInTransaction(tx, input),
+      ),
+  );
+}
+
+async function updateSessionMcpApprovalPolicyInTransaction(
+  tx: Pick<Database, "select" | "update">,
+  input: {
+    workspaceId: string;
+    sessionId: string;
+    serverId: string;
+    requireApproval: SessionMcpApprovalPolicy;
+  },
+): Promise<UpdateSessionMcpApprovalPolicyResult> {
+  const [existing] = await tx
+    .select()
+    .from(schema.sessionMcpServers)
+    .where(
+      and(
+        eq(schema.sessionMcpServers.workspaceId, input.workspaceId),
+        eq(schema.sessionMcpServers.sessionId, input.sessionId),
+        eq(schema.sessionMcpServers.serverId, input.serverId),
+      ),
+    )
+    .for("update")
+    .limit(1);
+  if (!existing) {
+    return { server: null, changed: false };
+  }
+  const current = existing.requireApproval ?? false;
+  if (JSON.stringify(current) === JSON.stringify(input.requireApproval)) {
+    return { server: mapSessionMcpServerMetadata(existing), changed: false };
+  }
+  const [updated] = await tx
+    .update(schema.sessionMcpServers)
+    .set({
+      requireApproval: input.requireApproval,
+      updatedAt: new Date(),
+    })
+    .where(
+      and(
+        eq(schema.sessionMcpServers.workspaceId, input.workspaceId),
+        eq(schema.sessionMcpServers.sessionId, input.sessionId),
+        eq(schema.sessionMcpServers.serverId, input.serverId),
+      ),
+    )
+    .returning();
+  if (!updated) {
+    throw new Error(`Session MCP server disappeared during policy update: ${input.serverId}`);
+  }
+  return { server: mapSessionMcpServerMetadata(updated), changed: true };
+}
+
 export async function listSessionMcpServersForRun(
   db: Database,
   workspaceId: string,
   sessionId: string,
+  attemptId: string,
   encryptionKey: Uint8Array | null,
 ): Promise<SessionMcpServerForRun[]> {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [attempt] = await scopedDb
+      .select({
+        sessionId: schema.sessionTurnAttempts.sessionId,
+        mcpApprovalPolicies: schema.sessionTurnAttempts.mcpApprovalPolicies,
+      })
+      .from(schema.sessionTurnAttempts)
+      .where(
+        and(
+          eq(schema.sessionTurnAttempts.workspaceId, workspaceId),
+          eq(schema.sessionTurnAttempts.id, attemptId),
+          inArray(schema.sessionTurnAttempts.state, ["claimed", "running"]),
+        ),
+      )
+      .limit(1);
+    if (!attempt || attempt.sessionId !== sessionId) {
+      throw new Error(`session MCP policy snapshot is unavailable for attempt ${attemptId}`);
+    }
     const rows = await scopedDb
       .select()
       .from(schema.sessionMcpServers)
@@ -11471,6 +12678,11 @@ export async function listSessionMcpServersForRun(
       )
       .orderBy(asc(schema.sessionMcpServers.createdAt), asc(schema.sessionMcpServers.serverId));
     return rows.map((row) => {
+      if (!Object.hasOwn(attempt.mcpApprovalPolicies, row.serverId)) {
+        throw new Error(
+          `session MCP policy snapshot is missing server ${row.serverId} for attempt ${attemptId}`,
+        );
+      }
       let headers: Record<string, string>;
       try {
         if (!encryptionKey && Object.keys(row.headersEncrypted ?? {}).length > 0) {
@@ -11490,7 +12702,7 @@ export async function listSessionMcpServersForRun(
         ...(row.allowedTools ? { allowedTools: row.allowedTools } : {}),
         ...(row.timeoutMs ? { timeoutMs: row.timeoutMs } : {}),
         ...(row.cacheToolsList ? { cacheToolsList: row.cacheToolsList } : {}),
-        ...(row.requireApproval != null ? { requireApproval: row.requireApproval } : {}),
+        requireApproval: attempt.mcpApprovalPolicies[row.serverId]!,
         headers,
       };
     });
@@ -11558,6 +12770,7 @@ export async function createSession(
     initialTurnInstructions?: string | null;
     resources: ResourceRef[];
     tools?: ToolRef[];
+    toolPolicy?: SessionToolPolicy | null;
     metadata: Record<string, unknown>;
     /**
      * Frozen creator authority. Legacy/test-only callers may omit this and get
@@ -11608,6 +12821,7 @@ export async function createSession(
             initialTurnInstructions: input.initialTurnInstructions ?? null,
             resources: input.resources,
             tools: input.tools ?? [],
+            toolPolicy: input.toolPolicy ?? null,
             metadata: input.metadata,
             ...creatorColumns(frozenCreator),
             model: input.model,
@@ -11662,6 +12876,7 @@ export async function createSessionWithIdempotencyKey(
     initialTurnInstructions?: string | null;
     resources: ResourceRef[];
     tools?: ToolRef[];
+    toolPolicy?: SessionToolPolicy | null;
     metadata: Record<string, unknown>;
     createdBy?: TurnInitiator;
     createdByContext?: TurnInitiatorContext;
@@ -11705,6 +12920,7 @@ export async function createSessionWithIdempotencyKey(
             initialTurnInstructions: input.initialTurnInstructions ?? null,
             resources: input.resources,
             tools: input.tools ?? [],
+            toolPolicy: input.toolPolicy ?? null,
             metadata: input.metadata,
             ...creatorColumns(frozenCreator),
             model: input.model,
@@ -13595,6 +14811,14 @@ export type ListSessionEventsOptions = {
   excludeClasses?: readonly SessionEventSemanticClass[];
   defaultExcludeTypes?: readonly SessionEventType[];
   payloadMode?: SessionEventPayloadMode;
+  /**
+   * Internal exclusive-latest selector. Eligible legacy rows with a null
+   * association remain visible, while late-rejected and duplicate callbacks do
+   * not compete with current truth. Durable session sequence is authoritative
+   * across distinct turns; turn generation is metadata only here. Callers must
+   * pair this with a single semantic class and limit 1.
+   */
+  authoritativeLatest?: boolean;
 };
 
 export type ListSessionEventPageOptions = ListSessionEventsOptions & {
@@ -13691,6 +14915,20 @@ export async function listSessionEventPage(
         eq(schema.sessionEvents.sessionId, sessionId),
         gt(schema.sessionEvents.sequence, after),
       ];
+      if (options.authoritativeLatest) {
+        // Historical rows predate association stamping and intentionally carry
+        // null. They remain eligible; explicitly stale/duplicate rows and rows
+        // carrying a duplicate reference cannot compete with current truth.
+        filters.push(
+          and(
+            or(
+              isNull(schema.sessionEvents.turnAssociation),
+              eq(schema.sessionEvents.turnAssociation, "current"),
+            )!,
+            isNull(schema.sessionEvents.duplicateOfEventId),
+          )!,
+        );
+      }
       if (typeFilters.includeTypes.length > 0) {
         filters.push(inArray(schema.sessionEvents.type, typeFilters.includeTypes));
       }
@@ -13713,9 +14951,11 @@ export async function listSessionEventPage(
         .from(schema.sessionEvents)
         .where(and(...filters))
         .orderBy(
-          direction === "before"
+          options.authoritativeLatest
             ? desc(schema.sessionEvents.sequence)
-            : asc(schema.sessionEvents.sequence),
+            : direction === "before"
+              ? desc(schema.sessionEvents.sequence)
+              : asc(schema.sessionEvents.sequence),
         )
         .limit(queryLimit);
       if (rows.length === 0) break;
@@ -13956,7 +15196,42 @@ export async function listSessionEvents(
   });
 }
 
-export type ToolspaceCallReservation = { reserved: true; count: number } | { reserved: false };
+export type ToolspaceCallReservation =
+  | { reserved: true; count: number; turn: SessionTurnForExecution }
+  | { reserved: false; reason: TurnAttemptFenceRejectReason | "budget_exhausted" };
+
+export type ToolspaceTurnAttemptClaims = {
+  sessionId: string;
+  turnId: string;
+  attemptId: string;
+  executionGeneration: number;
+};
+
+/**
+ * Admit one exact Toolspace bearer before any session credential is decrypted or
+ * any upstream schema is enumerated. This intentionally reuses the canonical
+ * activity write fence so Pause/Steer, attempt replacement, generation changes,
+ * and terminal settlement revoke a copied token at the same linearization point
+ * as other attempt-owned writes.
+ */
+export async function admitToolspaceTurnAttempt(
+  db: Database,
+  workspaceId: string,
+  claims: ToolspaceTurnAttemptClaims,
+): Promise<boolean> {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    return await scopedDb.transaction(async (tx) => {
+      const fence = await lockTurnAttemptWriteFenceTx(tx, {
+        workspaceId,
+        sessionId: claims.sessionId,
+        turnId: claims.turnId,
+        attemptId: claims.attemptId,
+        executionGeneration: claims.executionGeneration,
+      });
+      return fence.allowed && fence.turn.status === "running";
+    });
+  });
+}
 
 /**
  * Atomically reserve one toolspace call against a turn's per-turn budget.
@@ -13965,33 +15240,73 @@ export type ToolspaceCallReservation = { reserved: true; count: number } | { res
  * below `limit` and returns the post-increment value. Concurrent reservations
  * for the same turn serialize on the row lock, so exactly `limit` of N
  * simultaneous callers observe `reserved: true` — closing the read-then-append
- * TOCTOU the event-count approach had. `reserved: false` means the turn is at or
- * over budget (or the turn row no longer exists).
+ * TOCTOU the event-count approach had. The returned attempt id is captured by
+ * that same UPDATE, so callers cannot accidentally execute under a successor
+ * attempt. `reserved: false` means the turn is not executable, at/over budget,
+ * or no longer exists.
  */
-export async function reserveToolspaceCallForTurn(
+export async function reserveToolspaceCallForAttempt(
   db: Database,
-  workspaceId: string,
-  sessionId: string,
-  turnId: string,
-  limit: number,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    executionGeneration: number;
+    attemptId: string;
+    limit: number;
+  },
 ): Promise<ToolspaceCallReservation> {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const [row] = await scopedDb
-      .update(schema.sessionTurns)
-      .set({
-        toolspaceCallCount: sql`${schema.sessionTurns.toolspaceCallCount} + 1`,
-      })
-      .where(
-        and(
-          eq(schema.sessionTurns.workspaceId, workspaceId),
-          eq(schema.sessionTurns.sessionId, sessionId),
-          eq(schema.sessionTurns.id, turnId),
-          sql`${schema.sessionTurns.toolspaceCallCount} < ${limit}`,
-        ),
-      )
-      .returning({ count: schema.sessionTurns.toolspaceCallCount });
-    return row ? { reserved: true, count: Number(row.count) } : { reserved: false };
-  });
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (tx) => {
+        const fence = await lockTurnAttemptWriteFenceTx(tx as unknown as Database, {
+          workspaceId: input.workspaceId,
+          sessionId: input.sessionId,
+          turnId: input.turnId,
+          executionGeneration: input.executionGeneration,
+          attemptId: input.attemptId,
+        });
+        if (!fence.allowed) {
+          return { reserved: false, reason: fence.reason };
+        }
+        if (fence.turn.status !== "running") {
+          return { reserved: false, reason: "turn_terminal" };
+        }
+        if (Number(fence.turn.toolspaceCallCount) >= input.limit) {
+          return { reserved: false, reason: "budget_exhausted" };
+        }
+        const [row] = await tx
+          .update(schema.sessionTurns)
+          .set({
+            toolspaceCallCount: sql`${schema.sessionTurns.toolspaceCallCount} + 1`,
+          })
+          .where(
+            and(
+              eq(schema.sessionTurns.workspaceId, input.workspaceId),
+              eq(schema.sessionTurns.sessionId, input.sessionId),
+              eq(schema.sessionTurns.id, input.turnId),
+              eq(schema.sessionTurns.executionGeneration, input.executionGeneration),
+              eq(schema.sessionTurns.activeAttemptId, input.attemptId),
+              sql`${schema.sessionTurns.toolspaceCallCount} < ${input.limit}`,
+            ),
+          )
+          .returning({ count: schema.sessionTurns.toolspaceCallCount });
+        if (!row) {
+          throw new Error("Toolspace call reservation lost its locked turn");
+        }
+        return {
+          reserved: true,
+          count: Number(row.count),
+          turn: mapSessionTurnForExecution({
+            ...fence.turn,
+            toolspaceCallCount: Number(row.count),
+          }),
+        };
+      }),
+  );
 }
 
 function normalizeEventSequence(value: number | undefined, fallback: number): number {
@@ -14809,6 +16124,93 @@ async function lockTurnAttemptWriteFenceTx(
   return { allowed: true, workspace, session, turn, attempt };
 }
 
+export type InstallOrReadTurnExecutionPolicyForAttemptResult =
+  | {
+      accepted: true;
+      installed: boolean;
+      policy: TurnExecutionPolicyV1;
+      turn: SessionTurn;
+    }
+  | {
+      accepted: false;
+      reason: TurnAttemptFenceRejectReason;
+    };
+
+/**
+ * Freeze a legacy turn's execution identity at its first admitted attempt, or
+ * return the policy already accepted for this logical turn. The exact active
+ * attempt owns this mutation; malformed present metadata fails closed and a
+ * replay never replaces an existing valid policy.
+ */
+export async function installOrReadTurnExecutionPolicyForAttempt(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    executionGeneration: number;
+    attemptId: string;
+    policyForAbsent: TurnExecutionPolicyV1;
+  },
+): Promise<InstallOrReadTurnExecutionPolicyForAttemptResult> {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (tx) => {
+        const fence = await lockTurnAttemptWriteFenceTx(tx, {
+          workspaceId: input.workspaceId,
+          sessionId: input.sessionId,
+          turnId: input.turnId,
+          executionGeneration: input.executionGeneration,
+          attemptId: input.attemptId,
+        });
+        if (!fence.allowed) {
+          return { accepted: false as const, reason: fence.reason };
+        }
+
+        const existing = readTurnExecutionPolicyV1(fence.turn.metadata);
+        if (existing.kind === "valid") {
+          return {
+            accepted: true as const,
+            installed: false,
+            policy: existing.policy,
+            turn: mapSessionTurn(fence.turn),
+          };
+        }
+
+        const policy = TurnExecutionPolicyV1.parse(input.policyForAbsent);
+        const [updated] = await tx
+          .update(schema.sessionTurns)
+          .set({
+            metadata: metadataWithTurnExecutionPolicyV1(fence.turn.metadata, policy),
+            updatedAt: new Date(),
+          })
+          .where(
+            and(
+              eq(schema.sessionTurns.workspaceId, input.workspaceId),
+              eq(schema.sessionTurns.sessionId, input.sessionId),
+              eq(schema.sessionTurns.id, input.turnId),
+              eq(schema.sessionTurns.status, "running"),
+              eq(schema.sessionTurns.executionGeneration, input.executionGeneration),
+              eq(schema.sessionTurns.activeAttemptId, input.attemptId),
+            ),
+          )
+          .returning();
+        if (!updated) {
+          throw new Error("Turn execution policy owner changed while its row was locked");
+        }
+        return {
+          accepted: true as const,
+          installed: true,
+          policy,
+          turn: mapSessionTurn(updated),
+        };
+      }),
+  );
+}
+
 /**
  * Append conversation items (verbatim SDK AgentInputItems) to the session's
  * history. Idempotent on (workspace, session, position): concurrent or
@@ -14941,6 +16343,47 @@ export async function registerPendingSessionToolCall(
   );
 }
 
+/**
+ * Clear one completed Toolspace receipt after its attempt-fenced output event is
+ * durable. If control already replaced the attempt, its settlement transaction
+ * owns the receipt and will retain an explicit outcome-unknown or the durable
+ * output event instead.
+ */
+export async function clearPendingSessionToolspaceCall(
+  db: Database,
+  input: Omit<PendingSessionToolCallInput, "callType" | "callItem">,
+): Promise<{ accepted: boolean; cleared: boolean }> {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (tx) => {
+        const fence = await lockTurnAttemptWriteFenceTx(tx as unknown as Database, {
+          workspaceId: input.workspaceId,
+          sessionId: input.sessionId,
+          turnId: input.turnId,
+          executionGeneration: input.executionGeneration,
+          attemptId: input.attemptId,
+        });
+        if (!fence.allowed) return { accepted: false, cleared: false };
+        const deleted = await tx
+          .delete(schema.sessionPendingToolCalls)
+          .where(
+            and(
+              eq(schema.sessionPendingToolCalls.workspaceId, input.workspaceId),
+              eq(schema.sessionPendingToolCalls.sessionId, input.sessionId),
+              eq(schema.sessionPendingToolCalls.turnId, input.turnId),
+              eq(schema.sessionPendingToolCalls.attemptId, input.attemptId),
+              eq(schema.sessionPendingToolCalls.callId, input.callId),
+              eq(schema.sessionPendingToolCalls.callType, "toolspace_call"),
+            ),
+          )
+          .returning({ id: schema.sessionPendingToolCalls.id });
+        return { accepted: true, cleared: deleted.length === 1 };
+      }),
+  );
+}
+
 /** Record the raw SDK result without dropping the call receipt. */
 export async function recordPendingSessionToolCallResult(
   db: Database,
@@ -16618,8 +18061,9 @@ export async function acquireLease(
         // (2) Serialize ALL concurrent arrivals on this group's row. Plain FOR
         // UPDATE (block, do NOT skip) — unlike concurrent enrollment scans,
         // because we WANT the loser to block then attach, not skip and lose.
-        const rows = await tx.execute<LeaseRow>(sql`
-        select * from sandbox_leases
+        const rows = await tx.execute<LeaseRow & { draining_expired: boolean }>(sql`
+        select *, (liveness = 'draining' and expires_at <= now()) as draining_expired
+        from sandbox_leases
         where workspace_id = ${workspaceId} and sandbox_group_id = ${sandboxGroupId}
         for update
       `);
@@ -16628,6 +18072,16 @@ export async function acquireLease(
 
         let liveness = row.liveness;
 
+        // An expired DRAINING row is owned by the reaper's provider teardown,
+        // not by a new arrival. In particular, do this before image/rig conflict
+        // handling: a conflicting successor must not take the SOLO-recreate path
+        // and clear the attributed instance while the reaper/old creator still
+        // owns its termination. The row remains drainable until confirmDrainCold
+        // settles it, so callers fail closed and retry after the box is cold.
+        if (liveness === "draining" && row.draining_expired) {
+          return { role: "fenced" as const, lease: mapLeaseRow(row) };
+        }
+
         // -- SHARED STATE CONFLICT (B3 image + M3 rig): a LIVE box (warm/draining/warming)
         // was created under a specific image AND rig version. If this run resolves a
         // DIFFERENT image OR a DIFFERENT rig version (each checked only when both sides are
@@ -16690,7 +18144,9 @@ export async function acquireLease(
           liveness = "cold";
         }
 
-        // -- draining: late arrival re-arms (D1). Box still alive (grace open).
+        // -- draining: late arrival re-arms (D1) only while the grace is open.
+        // An expired row was fenced above because the reaper owns its provider
+        // teardown and must not lose the attributed instance race.
         if (liveness === "draining") {
           await upsertLeaseHolder(tx, row.id, accountId, workspaceId, kind, holderId, subjectId);
           const updated = await recomputeAndStampLease(tx, row.id, input.leaseTtlMs, "warm");
@@ -16747,8 +18203,11 @@ export async function acquireLease(
   );
 }
 
-// §4.2 — the ONLY lease_epoch++ site. CAS on (warming AND lease_epoch=expected).
-// Folds the group box-envelope (resume_backend_id/resume_state) onto the lease.
+// §4.2 — warm commit and every warming invalidation are epoch-fenced transitions.
+// CAS on (warming AND lease_epoch=expected) folds the group box-envelope
+// (resume_backend_id/resume_state) onto the lease. A rollback/reset also bumps
+// the epoch before exposing cold/draining, permanently fencing any provider
+// create callback that is still unresolved from the invalidated acquisition.
 export async function commitWarmingToWarm(
   db: Database,
   input: {
@@ -16935,7 +18394,9 @@ export async function markWarmLeaseInstanceLost(
 
 // §4.3 — caught spawn failure: warming -> cold (W3). Holders are intentionally
 // left intact — the arrival that triggered the spawn still wants a box, so the
-// next acquireLease re-CAS cold->warming.
+// next acquireLease re-CAS cold->warming. The rollback increments the epoch in
+// the same CAS, so a non-abortable provider create from this invalidated
+// acquisition can never mutate a successor that reuses the lease row.
 //
 // ARCHIVE PRESERVATION (sandbox-file-persistence): when the cold lease that was
 // selected for re-warm carried a persisted /workspace archive on its resume_state
@@ -16965,6 +18426,7 @@ export async function failWarmingToCold(
         update sandbox_leases set
           liveness = 'cold', instance_id = null,
           data_plane_url = null, terminal_data_plane_url = null, updated_at = now(),
+          lease_epoch = lease_epoch + 1,
           resume_state = case
             when (resume_state #>> '{sessionState,workspaceArchive}') is not null
               then jsonb_build_object(
@@ -17234,21 +18696,24 @@ export async function reapStaleLeaseHolders(
       `);
 
         // (c1) WARMING-death before provider create returned: no instance_id was
-        // ever persisted, so there is no provider box to stop. Reset to cold so a
-        // queued turn can re-acquire and re-spawn.
+        // ever persisted, so there is no provider box to stop. Reset to cold and
+        // bump the epoch so any late provider callback is fenced before a queued
+        // turn can re-acquire and re-spawn.
         const warmingReset = await tx.execute<{ id: string }>(sql`
         update sandbox_leases set
           liveness = 'cold', instance_id = null,
           resume_backend_id = null, resume_state = null,
-          data_plane_url = null, terminal_data_plane_url = null, updated_at = now()
+          data_plane_url = null, terminal_data_plane_url = null,
+          lease_epoch = lease_epoch + 1, updated_at = now()
         where workspace_id = ${input.workspaceId}
           and liveness = 'warming' and expires_at < now() and instance_id is null
         returning id
       `);
 
         // (c2) WARMING-death after provider create returned: instance_id is known,
-        // so do NOT drop it. Convert to immediately-drainable so the caller's
-        // provider terminate path stops the box before the lease goes cold.
+        // so do NOT drop it. Bump the epoch and convert to immediately-drainable
+        // so the caller's provider terminate path stops the box before the lease
+        // goes cold, while late creator callbacks are fenced.
         const warmingDrain = await tx.execute<{ id: string }>(sql`
         update sandbox_leases set
           liveness = 'draining',
@@ -17257,6 +18722,7 @@ export async function reapStaleLeaseHolders(
           viewer_holders = 0,
           data_plane_url = null,
           terminal_data_plane_url = null,
+          lease_epoch = lease_epoch + 1,
           expires_at = now() - interval '1 millisecond',
           updated_at = now()
         where workspace_id = ${input.workspaceId}
@@ -17510,6 +18976,7 @@ export async function reArmDrainingLease(
           updated_at = now()
         where workspace_id = ${input.workspaceId} and sandbox_group_id = ${input.sandboxGroupId}
           and liveness = 'draining'
+          and expires_at > now()
         returning id
       `);
       return { rearmed: rows.length > 0 };
@@ -21300,6 +22767,8 @@ export type InitializeSessionStartInput = {
   sessionId: string;
   clientEventId?: string;
   reasoningEffortFallback: ReasoningEffort;
+  /** Trusted create-session policy. Omitted only by legacy low-level callers. */
+  turnExecutionPolicy?: TurnExecutionPolicyV1;
   createdEventPayload: Record<string, unknown>;
   goal?: {
     text: string;
@@ -21506,6 +22975,7 @@ export async function initializeSessionStartAtomically(
               turnInstructions: session.initialTurnInstructions ?? null,
               resources: session.resources,
               tools: session.tools,
+              toolsProvided: session.toolPolicy?.mode === "explicit",
               model: session.model,
               reasoningEffort: reasoningEffortForMetadata(
                 session.metadata,
@@ -21513,7 +22983,9 @@ export async function initializeSessionStartAtomically(
               ),
               sandboxBackend: session.sandboxBackend,
               sandboxOs: session.sandboxOs,
-              metadata: {},
+              metadata: input.turnExecutionPolicy
+                ? metadataWithTurnExecutionPolicyV1({}, input.turnExecutionPolicy)
+                : {},
               lineage: {},
               ...initiatorColumns(creator),
             })
@@ -21653,6 +23125,7 @@ export async function enqueueSessionTurn(
             turnInstructions: input.turnInstructions ?? null,
             resources: input.resources,
             tools: input.tools,
+            toolsProvided: input.toolsProvided ?? false,
             model: input.model,
             reasoningEffort: input.reasoningEffort,
             sandboxBackend: input.sandboxBackend,
@@ -21963,8 +23436,24 @@ export async function claimSessionWorkForAttempt(
         if (unquiescedInterruption) {
           return { action: "unclaimed", reason: "control-pending" };
         }
-        const registerAttempt = async (turn: typeof schema.sessionTurns.$inferSelect) =>
-          await registerSessionTurnAttemptClaim(tx as unknown as Database, {
+        const registerAttempt = async (turn: typeof schema.sessionTurns.$inferSelect) => {
+          const policyRows = await tx
+            .select({
+              serverId: schema.sessionMcpServers.serverId,
+              requireApproval: schema.sessionMcpServers.requireApproval,
+            })
+            .from(schema.sessionMcpServers)
+            .where(
+              and(
+                eq(schema.sessionMcpServers.workspaceId, workspaceId),
+                eq(schema.sessionMcpServers.sessionId, sessionId),
+              ),
+            )
+            .orderBy(asc(schema.sessionMcpServers.serverId));
+          const mcpApprovalPolicies: Record<string, SessionMcpApprovalPolicy> = Object.fromEntries(
+            policyRows.map((row) => [row.serverId, row.requireApproval ?? false]),
+          );
+          return await registerSessionTurnAttemptClaim(tx as unknown as Database, {
             id: input.attemptId,
             accountId: session.accountId,
             workspaceId,
@@ -21975,7 +23464,9 @@ export async function claimSessionWorkForAttempt(
             temporalWorkflowRunId: input.workflowRunId,
             temporalActivityId: input.dispatchId,
             verifiedControlRevision: Number(workspaceControl.revision),
+            mcpApprovalPolicies,
           });
+        };
         if (session.activeTurnId !== null) {
           const [activeTurnPreview] = await tx
             .select()
@@ -24483,6 +25974,7 @@ export async function applySessionTurnSettlement(
               effectiveSessionStatus !== input.sessionStatus
               ? { ...payload, status: effectiveSessionStatus }
               : payload,
+            { fullEvidence: event.retainedOutputEvidence },
           ),
           clientEventId: event.clientEventId ?? null,
           turnId: input.turnId,
@@ -25570,6 +27062,57 @@ export async function getSessionTurn(
   });
 }
 
+/**
+ * Resolve the exact currently executable turn/attempt from authoritative
+ * pointers in one query. This avoids treating a stale session preview as proof
+ * that no attempt exists during an atomic claim transition.
+ */
+export async function getActiveSessionTurnForExecution(
+  db: Database,
+  workspaceId: string,
+  sessionId: string,
+): Promise<SessionTurnForExecution | null> {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb
+      .select({ turn: schema.sessionTurns })
+      .from(schema.sessions)
+      .innerJoin(
+        schema.sessionTurns,
+        and(
+          eq(schema.sessionTurns.workspaceId, schema.sessions.workspaceId),
+          eq(schema.sessionTurns.id, schema.sessions.activeTurnId),
+        ),
+      )
+      .innerJoin(
+        schema.sessionTurnAttempts,
+        and(
+          eq(schema.sessionTurnAttempts.workspaceId, schema.sessionTurns.workspaceId),
+          eq(schema.sessionTurnAttempts.id, schema.sessionTurns.activeAttemptId),
+        ),
+      )
+      .where(
+        and(
+          eq(schema.sessions.workspaceId, workspaceId),
+          eq(schema.sessions.id, sessionId),
+          eq(schema.sessionTurns.sessionId, sessionId),
+          eq(schema.sessionTurnAttempts.sessionId, sessionId),
+          eq(schema.sessionTurnAttempts.turnId, schema.sessionTurns.id),
+          inArray(schema.sessionTurnAttempts.state, ["claimed", "running"]),
+          inArray(schema.sessionTurns.status, ["running", "recovering", "waiting_capacity"]),
+          sql`not exists (
+            select 1
+            from ${schema.sessionAttemptInterruptions} interruption
+            where interruption.workspace_id = ${workspaceId}
+              and interruption.attempt_id = ${schema.sessionTurnAttempts.id}
+              and interruption.state in ('pending', 'delivered', 'acknowledged')
+          )`,
+        ),
+      )
+      .limit(1);
+    return row ? mapSessionTurnForExecution(row.turn) : null;
+  });
+}
+
 export async function getSessionTurnForAttempt(
   db: Database,
   workspaceId: string,
@@ -26070,40 +27613,85 @@ export async function claimPendingSessionWorkflowWakes(
 }
 
 /**
- * Acknowledge an immediate post-commit signal. An older sender may advance only
- * its own revision; it cannot clear a claim or failure state belonging to a
- * newer revision.
+ * Acknowledge an immediate post-commit signal only after it cannot strand an
+ * accepted Agent Steer. Temporal accepting a signal is transport evidence, not
+ * proof that a closing workflow observed Postgres or admitted its pending
+ * direction. While active control still has an actionable Agent Steer, retain
+ * the revision so the bounded outbox dispatcher retries signalWithStart. The
+ * attempt-fenced claim consumes the update once; a real Pause is the typed
+ * blocker and may acknowledge this revision because Resume commits a new one.
+ *
+ * An older sender may advance only its own revision; it cannot clear a claim or
+ * failure state belonging to a newer revision. The control -> workspace ->
+ * session lock prefix serializes this decision with Steer, Pause/Resume, and
+ * claim without weakening physical-quiescence admission.
  */
+export type SessionWorkflowWakeDeliveryResult =
+  | { action: "acknowledged" }
+  | { action: "pending_admission"; blocker: "pending_agent_steer" };
+
 export async function markSessionWorkflowWakeDelivered(
   db: Database,
   input: Omit<SessionWorkflowWake, "interruptionRequested">,
-): Promise<void> {
-  await withRlsContext(
+): Promise<SessionWorkflowWakeDeliveryResult> {
+  return await withRlsContext(
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
-    async (scopedDb) => {
-      const [row] = await scopedDb
-        .update(schema.sessionWorkflowWakeOutbox)
-        .set({
-          deliveredRevision: sql`greatest(${schema.sessionWorkflowWakeOutbox.deliveredRevision}, ${input.wakeRevision})`,
-          attempts: sql`case when ${schema.sessionWorkflowWakeOutbox.wakeRevision} = ${input.wakeRevision} then 0 else ${schema.sessionWorkflowWakeOutbox.attempts} end`,
-          lastError: sql`case when ${schema.sessionWorkflowWakeOutbox.wakeRevision} = ${input.wakeRevision} then null else ${schema.sessionWorkflowWakeOutbox.lastError} end`,
-          updatedAt: new Date(),
-        })
-        .where(
-          and(
-            eq(schema.sessionWorkflowWakeOutbox.workspaceId, input.workspaceId),
-            eq(schema.sessionWorkflowWakeOutbox.sessionId, input.sessionId),
-            gte(schema.sessionWorkflowWakeOutbox.wakeRevision, input.wakeRevision),
-          ),
-        )
-        .returning({ sessionId: schema.sessionWorkflowWakeOutbox.sessionId });
-      if (!row) {
-        throw new Error(
-          `Workflow wake revision ${input.wakeRevision} is not current for session ${input.sessionId}`,
+    async (scopedDb) =>
+      await scopedDb.transaction(async (tx) => {
+        const locks = await lockSessionEventWriteRows(tx as unknown as Database, {
+          workspaceId: input.workspaceId,
+          controlLock: "share",
+          sessionIds: [input.sessionId],
+        });
+        const session = locks.sessions[0];
+        if (!session) throw new Error(`Session not found: ${input.sessionId}`);
+        const effectiveControl = await evaluateSessionControl(
+          tx as unknown as Database,
+          input.workspaceId,
+          input.sessionId,
+          { workspaceControl: locks.control ?? undefined },
         );
-      }
-    },
+        if (effectiveControl.state === "active") {
+          const [pendingAgentSteer] = await tx
+            .select({ id: schema.sessionSystemUpdates.id })
+            .from(schema.sessionSystemUpdates)
+            .where(
+              and(
+                eq(schema.sessionSystemUpdates.workspaceId, input.workspaceId),
+                eq(schema.sessionSystemUpdates.sessionId, input.sessionId),
+                eq(schema.sessionSystemUpdates.kind, "agent_steer_instruction"),
+                eq(schema.sessionSystemUpdates.state, "pending"),
+              ),
+            )
+            .limit(1);
+          if (pendingAgentSteer) {
+            return { action: "pending_admission", blocker: "pending_agent_steer" } as const;
+          }
+        }
+        const [row] = await tx
+          .update(schema.sessionWorkflowWakeOutbox)
+          .set({
+            deliveredRevision: sql`greatest(${schema.sessionWorkflowWakeOutbox.deliveredRevision}, ${input.wakeRevision})`,
+            attempts: sql`case when ${schema.sessionWorkflowWakeOutbox.wakeRevision} = ${input.wakeRevision} then 0 else ${schema.sessionWorkflowWakeOutbox.attempts} end`,
+            lastError: sql`case when ${schema.sessionWorkflowWakeOutbox.wakeRevision} = ${input.wakeRevision} then null else ${schema.sessionWorkflowWakeOutbox.lastError} end`,
+            updatedAt: new Date(),
+          })
+          .where(
+            and(
+              eq(schema.sessionWorkflowWakeOutbox.workspaceId, input.workspaceId),
+              eq(schema.sessionWorkflowWakeOutbox.sessionId, input.sessionId),
+              gte(schema.sessionWorkflowWakeOutbox.wakeRevision, input.wakeRevision),
+            ),
+          )
+          .returning({ sessionId: schema.sessionWorkflowWakeOutbox.sessionId });
+        if (!row) {
+          throw new Error(
+            `Workflow wake revision ${input.wakeRevision} is not current for session ${input.sessionId}`,
+          );
+        }
+        return { action: "acknowledged" } as const;
+      }),
   );
 }
 
@@ -26639,7 +28227,9 @@ export async function appendSessionEvents(
         sessionId,
         sequence: ++sequence,
         type: input.type,
-        payload: sanitizeEventPayload(input.payload ?? {}),
+        payload: sanitizeEventPayload(input.payload ?? {}, {
+          fullEvidence: input.retainedOutputEvidence,
+        }),
         clientEventId: input.clientEventId ?? null,
         turnId: input.turnId ?? null,
         turnGeneration: input.turnGeneration ?? null,
@@ -26979,7 +28569,9 @@ export async function appendSessionEventsForTurnAttempt(
             sessionId,
             sequence: ++sequence,
             type: input.type,
-            payload: sanitizeEventPayload(input.payload ?? {}),
+            payload: sanitizeEventPayload(input.payload ?? {}, {
+              fullEvidence: input.retainedOutputEvidence,
+            }),
             clientEventId: input.clientEventId ?? null,
             turnId,
             turnGeneration: executionGeneration,
@@ -27053,7 +28645,9 @@ export async function appendSessionEventToSandboxGroup(
           sessionId: row.id,
           sequence: row.lastSequence + 1,
           type: input.type,
-          payload: sanitizeEventPayload(input.payload ?? {}),
+          payload: sanitizeEventPayload(input.payload ?? {}, {
+            fullEvidence: input.retainedOutputEvidence,
+          }),
           clientEventId: input.clientEventId ?? null,
           turnId: input.turnId ?? null,
           turnGeneration: input.turnGeneration ?? null,
@@ -27131,7 +28725,9 @@ export async function appendSessionEventsAndUpdateSession(
           sessionId,
           sequence: ++sequence,
           type: input.type,
-          payload: sanitizeEventPayload(input.payload ?? {}),
+          payload: sanitizeEventPayload(input.payload ?? {}, {
+            fullEvidence: input.retainedOutputEvidence,
+          }),
           clientEventId: input.clientEventId ?? null,
           turnId: input.turnId ?? null,
           turnGeneration: input.turnGeneration ?? null,
@@ -27166,6 +28762,10 @@ type LockedSessionUpdateContext = {
   updateSessionMcpServerCredentials: (
     updates: UpdateSessionMcpServerCredentialsInput[],
   ) => Promise<UpdateSessionMcpServerCredentialsResult>;
+  updateSessionMcpApprovalPolicy: (
+    serverId: string,
+    requireApproval: SessionMcpApprovalPolicy,
+  ) => Promise<UpdateSessionMcpApprovalPolicyResult>;
   listPendingSessionTurns: () => Promise<SessionTurn[]>;
 };
 
@@ -27218,6 +28818,13 @@ export async function appendSessionEventsWithLockedSessionUpdate(
               sessionId,
               updates,
             }),
+          updateSessionMcpApprovalPolicy: async (serverId, requireApproval) =>
+            await updateSessionMcpApprovalPolicyInTransaction(tx, {
+              workspaceId,
+              sessionId,
+              serverId,
+              requireApproval,
+            }),
           listPendingSessionTurns: async () => {
             const rows = await tx
               .select()
@@ -27255,7 +28862,9 @@ export async function appendSessionEventsWithLockedSessionUpdate(
           sessionId,
           sequence: ++sequence,
           type: input.type,
-          payload: sanitizeEventPayload(input.payload ?? {}),
+          payload: sanitizeEventPayload(input.payload ?? {}, {
+            fullEvidence: input.retainedOutputEvidence,
+          }),
           clientEventId: input.clientEventId ?? null,
           turnId: input.turnId ?? null,
           turnGeneration: input.turnGeneration ?? null,
@@ -27338,6 +28947,10 @@ function mapSession(
     instructions: row.instructions ?? null,
     resources: row.resources as ResourceRef[],
     tools: row.tools as ToolRef[],
+    toolPolicy: (row.toolPolicy as SessionToolPolicy | null) ?? {
+      mode: "legacy",
+      inheritedFromSessionId: null,
+    },
     metadata: row.metadata,
     createdBy: initiatorFromStorage(
       row.createdByKind,
@@ -27438,6 +29051,7 @@ function mapSessionTurn(row: typeof schema.sessionTurns.$inferSelect): SessionTu
     prompt: row.prompt,
     resources: row.resources as ResourceRef[],
     tools: row.tools as ToolRef[],
+    toolsProvided: row.toolsProvided,
     model: row.model,
     reasoningEffort: row.reasoningEffort as ReasoningEffort,
     sandboxBackend: row.sandboxBackend as SandboxBackend,
@@ -27613,9 +29227,76 @@ function mapImportBatch(row: typeof schema.importBatches.$inferSelect): ImportBa
   };
 }
 
+type CatalogExposureState = "trusted" | "legacy_active" | "blocked";
+
+function catalogExposureState(
+  item: typeof schema.capabilityCatalogItems.$inferSelect,
+  installation: typeof schema.capabilityInstallations.$inferSelect | null,
+): CatalogExposureState {
+  if (
+    capabilityCatalogItemIsTrustedForExposure({
+      source: item.source as CapabilitySource,
+      stale: item.stale,
+      authKind: item.authKind as CapabilityCatalogItem["authKind"],
+      metadata: item.metadata,
+    })
+  ) {
+    return "trusted";
+  }
+  // Rolling compatibility for installations enabled before registry probe
+  // provenance existed. This is deliberately narrower than the normal trust
+  // gate: only an already-active, non-stale, known-auth row with enable-time
+  // connectivity evidence can continue. A present-but-non-real probe is an
+  // explicit negative verdict and can never be grandfathered.
+  if (
+    item.source !== registryCapabilitySource ||
+    item.stale ||
+    Object.prototype.hasOwnProperty.call(item.metadata, "mcpProbe") ||
+    !item.authKind ||
+    item.authKind === "unknown" ||
+    installation?.status !== "active" ||
+    !mcpConnectivityOk(installation.metadata)
+  ) {
+    return "blocked";
+  }
+  const hasCredentialBinding =
+    !!encryptedHeadersConfig(installation.config.headersEncrypted) ||
+    !!connectionRefConfig(installation.config.connectionRef);
+  if (item.authModel && !hasCredentialBinding) {
+    return "blocked";
+  }
+  return "legacy_active";
+}
+
 function mapCapabilityCatalogItem(
   row: typeof schema.capabilityCatalogItems.$inferSelect,
+  exposure: "trusted" | "legacy_active" | "unverified" = capabilityCatalogItemIsTrustedForExposure({
+    source: row.source as CapabilitySource,
+    stale: row.stale,
+    authKind: row.authKind as CapabilityCatalogItem["authKind"],
+    metadata: row.metadata,
+  })
+    ? "trusted"
+    : "unverified",
 ): CapabilityCatalogItem {
+  const catalogTrust =
+    exposure === "legacy_active"
+      ? {
+          state: "legacy_active" as const,
+          reason: "active_installation_compatibility" as const,
+        }
+      : exposure === "trusted"
+        ? {
+            state: "trusted" as const,
+            reason:
+              row.source === registryCapabilitySource
+                ? ("verified_probe" as const)
+                : ("trusted_source" as const),
+          }
+        : {
+            state: "unverified" as const,
+            reason: "missing_verification" as const,
+          };
   const runtime =
     row.kind === "mcp" && row.endpointUrl
       ? {
@@ -27625,6 +29306,7 @@ function mapCapabilityCatalogItem(
           notes: row.authModel
             ? "Requires credential headers supplied in the enable request."
             : null,
+          catalogTrust,
         }
       : {
           available: false,
@@ -27632,6 +29314,7 @@ function mapCapabilityCatalogItem(
             row.kind === "mcp"
               ? "Remote streamable HTTP endpoint is required for runtime use."
               : null,
+          catalogTrust,
         };
   return {
     id: row.id,