@opengeni/db 1.0.2 → 1.1.0

package/drizzle/0611_universal_session_tenancy_activation.sql

@@ -0,0 +1,166 @@
+-- deployment-mode: rolling
+-- Retire per-organization session-tenancy activation. Every organization is
+-- activated: private ("Only me") sessions, visibility transitions, forks and
+-- personal-resource grants no longer require a version-1
+-- session_tenancy_activations receipt, and the owner/admin Only-me setting
+-- (organization_private_session_settings) now defaults to ENABLED when an
+-- organization has no row. Owners/admins may still disable it; an explicit
+-- disabled row keeps gating new Only-me chats in shared workspaces.
+--
+-- No receipts are written and no data is backfilled. The receipt keeps exactly
+-- one meaning: opengeni_private.session_tenancy_account_activated (0340) still
+-- retires the legacy_user connection and unattributed-writer compatibility
+-- lanes only for organizations that already hold one. Organizations without a
+-- receipt keep those lanes exactly as before this migration, so no stored
+-- authority becomes invisible and no ownership is inferred.
+--
+-- Rolling: this only widens product predicates and flips a missing-row default.
+-- A pre-0611 binary keeps working against the rewritten routines: its own
+-- receipt probe (session_tenancy_product_activated) now answers true, its
+-- startup interlock probe (session_tenancy_any_product_activation) answers
+-- false regardless of the retired environment switch, and every routine keeps
+-- its signature, owner, ACL, SECURITY DEFINER and search_path. No table is
+-- locked or rewritten.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+-- Remove the receipt prerequisite from every runtime predicate and default the
+-- Only-me setting to enabled. Each rewrite replaces one exact, reviewed
+-- fragment of the live definition; a changed shape aborts instead of silently
+-- leaving a receipt gate behind. Owner, grants, SECURITY DEFINER and
+-- search_path are preserved by CREATE OR REPLACE of the catalog's own
+-- definition.
+DO $universal_session_tenancy_predicates$
+DECLARE
+  data_schema text := pg_catalog.current_schema();
+  target regprocedure;
+  definition text;
+  rewrite record;
+  occurrences integer;
+  -- Fragments below are routine SOURCE text matched against
+  -- pg_get_functiondef, never queries: this block reads only the catalog.
+  -- The table names are spliced in so the source is not mistaken for a
+  -- migration-time row read of a FORCE-RLS table.
+  receipts constant text := 'session_tenancy_activations';
+  settings constant text := 'organization_private_session_settings';
+  receipt_gate constant text :=
+    E'  IF NOT EXISTS (\n'
+    || E'    SELECT 1 FROM ' || receipts || E' activation\n'
+    || E'    WHERE activation.account_id = p_account_id AND activation.activation_version = 1\n'
+    || E'  ) THEN\n'
+    || E'    RAISE EXCEPTION ''session tenancy product is not activated'' USING ERRCODE = ''42501'';\n'
+    || E'  END IF;\n';
+  receipt_gate_removed constant text :=
+    E'  -- 0611: every organization is session-tenancy activated.\n';
+  setting_receipt_gate constant text :=
+    E'  IF p_enabled AND NOT session_tenancy_product_activated(p_account_id, 1) THEN\n'
+    || E'    RAISE EXCEPTION ''session tenancy product surface is not available for this organization'' USING ERRCODE = ''55000'';\n'
+    || E'  END IF;\n';
+BEGIN
+  FOR rewrite IN
+    SELECT * FROM (VALUES
+      (1, pg_catalog.format('%I.session_tenancy_product_activated(uuid,integer)', data_schema),
+        E'    AND EXISTS (\n'
+          || E'    SELECT 1 FROM ' || receipts || E' activation\n'
+          || E'    WHERE activation.account_id = p_account_id\n'
+          || E'      AND activation.activation_version = p_activation_version\n'
+          || E'  )',
+        E'    AND p_account_id IS NOT NULL\n'
+          || E'    AND p_activation_version IS NOT DISTINCT FROM 1'),
+      -- The value-free startup interlock is retired with the deployment switch.
+      -- Answering false keeps every earlier binary startable regardless of the
+      -- removed OPENGENI_ORGANIZATION_TENANCY_CANONICAL_ACTIVATION_ENABLED value.
+      (3, pg_catalog.format('%I.session_tenancy_any_product_activation()', data_schema),
+        E'  SELECT EXISTS (\n'
+          || E'    SELECT 1 FROM ' || receipts || E'\n'
+          || E'  ) INTO activated;',
+        E'  activated := false;'),
+      (4, pg_catalog.format(
+          '%I.list_self_user_resource_authorities(uuid,uuid,text,uuid,integer)', data_schema),
+        receipt_gate, receipt_gate_removed),
+      (5, pg_catalog.format(
+          '%I.issue_self_user_resource_grant(uuid,uuid,uuid,text,text,text,uuid,integer,boolean)',
+          data_schema),
+        receipt_gate, receipt_gate_removed),
+      (6, pg_catalog.format('%I.revoke_self_user_resource_grant(uuid,uuid,uuid)', data_schema),
+        receipt_gate, receipt_gate_removed),
+      (7, pg_catalog.format(
+          '%I.accept_turn_personal_resource_attachment(uuid,uuid,uuid,uuid,text,integer,boolean,integer)',
+          data_schema),
+        receipt_gate, receipt_gate_removed),
+      -- Only-me chats default to enabled: only an explicit disabled row gates.
+      (8, pg_catalog.format('%I.organization_private_sessions_enabled(uuid)', data_schema),
+        E'    AND session_tenancy_product_activated(p_account_id, 1)\n'
+          || E'    AND EXISTS (\n'
+          || E'      SELECT 1 FROM ' || settings || E' setting\n'
+          || E'      WHERE setting.account_id = p_account_id AND setting.enabled\n'
+          || E'    )',
+        E'    AND NOT EXISTS (\n'
+          || E'      SELECT 1 FROM ' || settings || E' setting\n'
+          || E'      WHERE setting.account_id = p_account_id AND NOT setting.enabled\n'
+          || E'    )'),
+      (9, pg_catalog.format(
+          '%I.get_organization_private_session_settings(uuid,text)', data_schema),
+        E'    ''enabled'', coalesce(setting.enabled, false),\n',
+        E'    ''enabled'', coalesce(setting.enabled, true),\n'),
+      (10, pg_catalog.format(
+          '%I.update_organization_private_session_settings(uuid,text,boolean,bigint,uuid)',
+          data_schema),
+        setting_receipt_gate, ''),
+      (11, pg_catalog.format(
+          '%I.update_organization_private_session_settings(uuid,text,boolean,bigint,uuid)',
+          data_schema),
+        E'  did_change := coalesce(setting.enabled, false) IS DISTINCT FROM p_enabled;\n',
+        E'  did_change := coalesce(setting.enabled, true) IS DISTINCT FROM p_enabled;\n')
+    ) AS rewrites(ordinal, signature, old_fragment, new_fragment)
+    ORDER BY ordinal
+  LOOP
+    target := pg_catalog.to_regprocedure(rewrite.signature);
+    IF target IS NULL THEN
+      RAISE EXCEPTION 'universal session tenancy predicate is missing: %', rewrite.signature
+        USING ERRCODE = '55000';
+    END IF;
+    definition := pg_catalog.pg_get_functiondef(target);
+    occurrences := (
+      pg_catalog.length(definition)
+        - pg_catalog.length(pg_catalog.replace(definition, rewrite.old_fragment, ''))
+    ) / pg_catalog.length(rewrite.old_fragment);
+    IF occurrences <> 1 THEN
+      RAISE EXCEPTION 'universal session tenancy predicate shape changed: % (% matches)',
+        rewrite.signature, occurrences USING ERRCODE = '55000';
+    END IF;
+    EXECUTE pg_catalog.replace(definition, rewrite.old_fragment, rewrite.new_fragment);
+  END LOOP;
+
+  -- Fail closed if any other routine still consults the receipt table. Only
+  -- the retained, now-dormant receipt writers (operator, greenfield and
+  -- additional-organization activation, plus the operator preference
+  -- enabler's lock) and the private legacy-lane retirement predicate may.
+  -- That predicate is not a product prerequisite: it closes the legacy_user
+  -- connection and unattributed-writer compatibility lanes only for an
+  -- organization that already holds a receipt.
+  IF EXISTS (
+    SELECT 1 FROM pg_catalog.pg_proc routine
+    JOIN pg_catalog.pg_namespace namespace ON namespace.oid = routine.pronamespace
+    WHERE namespace.nspname IN (data_schema, 'opengeni_private')
+      AND routine.prosrc LIKE '%session_tenancy_activations%'
+      AND routine.proname NOT IN (
+        'activate_session_tenancy_product',
+        'activate_greenfield_session_tenancy_from_setup',
+        'activate_session_tenancy_from_additional_organization',
+        'enable_organization_private_sessions_from_activation',
+        'session_tenancy_account_activated'
+      )
+  ) THEN
+    RAISE EXCEPTION 'a runtime routine still requires a session tenancy activation receipt'
+      USING ERRCODE = '55000';
+  END IF;
+END
+$universal_session_tenancy_predicates$;
+
+COMMENT ON FUNCTION session_tenancy_product_activated(uuid, integer) IS
+  'Universal since 0611: true for the transaction''s own organization at activation version 1. No per-organization receipt is required.';
+COMMENT ON FUNCTION opengeni_private.session_tenancy_account_activated(uuid) IS
+  'Legacy-lane retirement predicate (0340): true when the transaction''s own organization holds a receipt. Since 0611 it gates no product surface; it only closes the legacy_user connection and unattributed-writer lanes.';
+COMMENT ON FUNCTION session_tenancy_any_product_activation() IS
+  'Retired by 0611 with OPENGENI_ORGANIZATION_TENANCY_CANONICAL_ACTIVATION_ENABLED. Always false so no binary enforces the removed startup interlock.';

package/drizzle/0612_scheduled_model_unavailable_refusal.sql

@@ -0,0 +1,21 @@
+-- deployment-mode: rolling
+-- A scheduled occurrence whose model is retired or no longer in the catalog is
+-- refused as a visible terminal run (`scheduled_model_unavailable`) instead of
+-- exhausting activity retries and leaving no run. Preserve the immutable 0539
+-- refusal lifecycle (as extended by 0552), adding only this reason. Exact
+-- anchoring refuses an unexpected deployed guard definition. Old binaries never
+-- write the new reason, so this is rolling-safe.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+DO $scheduled_model_refusal$
+DECLARE
+  definition text:=pg_get_functiondef('opengeni_private.guard_scheduled_admission_refusal()'::regprocedure);
+  anchor text:='''monthly_agent_run_limit'', ''allowance_exhausted'')';
+BEGIN
+  IF strpos(definition,anchor)=0 OR strpos(substr(definition,strpos(definition,anchor)+length(anchor)),anchor)>0 THEN
+    RAISE EXCEPTION '0612 unexpected scheduled refusal guard definition' USING ERRCODE='55000';
+  END IF;
+  EXECUTE replace(definition,anchor,
+    '''monthly_agent_run_limit'', ''allowance_exhausted'', ''scheduled_model_unavailable'')');
+END $scheduled_model_refusal$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -115,12 +115,12 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "1.0.2",
-    "@opengeni/codex": "1.0.2",
-    "@opengeni/config": "1.0.2",
-    "@opengeni/contracts": "1.0.2",
-    "@opengeni/network": "1.0.2",
-    "@opengeni/observability": "1.0.2",
+    "@opengeni/codemode": "1.1.0",
+    "@opengeni/codex": "1.1.0",
+    "@opengeni/config": "1.1.0",
+    "@opengeni/contracts": "1.1.0",
+    "@opengeni/network": "1.1.0",
+    "@opengeni/observability": "1.1.0",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },

package/src/artifact-catalog.ts

@@ -2,7 +2,13 @@ import type { ArtifactCatalogKind, ArtifactCatalogListQuery } from "@opengeni/co
 import { sql, type SQL } from "drizzle-orm";
 import { withRlsContext, type Database } from "./database";
 
-export type ArtifactCatalogPosition = { key: string; kind: ArtifactCatalogKind; id: string };
+export type ArtifactCatalogPosition = {
+  key: string;
+  kind: ArtifactCatalogKind;
+  id: string;
+  /** Legacy cursor frontiers did not carry this bit. */
+  pinned?: boolean | undefined;
+};
 /** Internal candidates are NOT an authorized public projection. */
 export type ArtifactCatalogCandidate = {
   id: string;
@@ -16,8 +22,22 @@ export type ArtifactCatalogCandidate = {
   source_session_id: string | null;
   version_id: string | null;
   sort_key: string;
+  pinned?: boolean;
 };
 
+/** API callers must first verify publish permission and domain-specific read authority. */
+export async function updateArtifactPin(
+  db: Database,
+  scope: { accountId: string; workspaceId: string },
+  input: { kind: ArtifactCatalogKind; artifactId: string; pinned: boolean },
+): Promise<void> {
+  await withRlsContext(db, scope, async (tx) => {
+    await tx.execute(sql`select opengeni_private.update_artifact_pin(
+      ${scope.accountId}::uuid, ${scope.workspaceId}::uuid,
+      ${input.kind}::text, ${input.artifactId}::text, ${input.pinned}::boolean)`);
+  });
+}
+
 /** Called only after immutable bytes have been retained by explicit publication. */
 export async function recordSandboxFilePublication(
   db: Database,
@@ -84,7 +104,7 @@ export async function listArtifactCatalogCandidates(
     branches.push(sql`
     SELECT p.file_id::text AS id, p.kind, p.title, 'active'::text AS status,
       p.published_at AS created_at, p.published_at AS updated_at, p.source_session_id, NULL::text AS version_id, 'sandbox_file'::text AS origin
-    FROM opengeni_private.list_sandbox_file_publications(${scope.accountId}::uuid, ${scope.workspaceId}::uuid,
+    FROM opengeni_private.list_sandbox_file_publications_pinned(${scope.accountId}::uuid, ${scope.workspaceId}::uuid,
       ${JSON.stringify({ sourceSessionId: source, q: query.q, kinds: publishedKinds, sort: query.sort, snapshotAt: input.snapshotAt, after: input.after, limit: input.limit })}::jsonb) p`);
   if (!branches.length) return [];
   const sort =
@@ -95,22 +115,28 @@ export async function listArtifactCatalogCandidates(
         : sql`to_char(updated_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US')`;
   const descending = query.sort !== "title";
   const position = input.after;
-  const keyset = !position
+  const secondaryKeyset = !position
     ? sql`true`
     : sql`(
     sort_key COLLATE "C" ${descending ? sql`<` : sql`>`} ${position.key} COLLATE "C"
     OR (sort_key = ${position.key} AND (kind COLLATE "C", id COLLATE "C") > (${position.kind}, ${position.id})))`;
+  const keyset = !position
+    ? sql`true`
+    : sql`(pinned < ${position.pinned ?? false}::boolean OR
+        (pinned = ${position.pinned ?? false}::boolean AND ${secondaryKeyset}))`;
   return withRlsContext(
     db,
     scope,
     async (tx) => {
       const result = await tx.execute(sql`
       WITH candidates AS (${sql.join(branches, sql` UNION ALL `)}),
-      ordered AS (SELECT *, ${sort} AS sort_key FROM candidates
+      ordered AS (SELECT candidates.*, ${sort} AS sort_key, (pins.artifact_id IS NOT NULL) AS pinned
+        FROM candidates LEFT JOIN opengeni_private.list_artifact_pins(${scope.accountId}::uuid, ${scope.workspaceId}::uuid) pins
+          ON pins.kind = candidates.kind AND pins.artifact_id = candidates.id
         WHERE status = ${query.status} AND created_at <= ${input.snapshotAt}::timestamptz
           ${query.q ? sql`AND strpos(lower(title), lower(${query.q})) > 0` : sql``})
       SELECT * FROM ordered WHERE ${keyset}
-      ORDER BY sort_key COLLATE "C" ${descending ? sql`DESC` : sql`ASC`}, kind COLLATE "C", id COLLATE "C"
+      ORDER BY pinned DESC, sort_key COLLATE "C" ${descending ? sql`DESC` : sql`ASC`}, kind COLLATE "C", id COLLATE "C"
       LIMIT ${input.limit}`);
       return (
         Array.isArray(result) ? result : (result as { rows: ArtifactCatalogCandidate[] }).rows

package/src/index.ts

@@ -6,6 +6,7 @@ import {
 } from "./inbox-execution-context";
 import { parentOutboxAuthorityTx } from "./child-outbox-authority";
 export { SubscriptionAccountChangedError } from "./subscription-account-conflict";
+import type { GoalAdmissionPausedReason } from "@opengeni/contracts";
 import {
   claudeSubscriptionAccountRepository,
   claudeSubscriptionTables,
@@ -439,7 +440,6 @@ import {
   closePrivateSessionCreateCapability,
   openPrivateChildSessionCreateCapability,
   openPrivateSessionCreateCapability,
-  sessionTenancyProductActivated,
 } from "./session-tenancy";
 import {
   completeCodemodeOperationInTransaction,
@@ -18575,6 +18575,7 @@ export type ScheduledTaskAdmissionRefusalReason =
   | "machine_enrollment_inactive"
   | "variable_set_unavailable"
   | "rig_version_unavailable"
+  | "scheduled_model_unavailable"
   | "insufficient_credits"
   | "allowance_exhausted"
   | "monthly_model_cost_limit"
@@ -37685,11 +37686,6 @@ async function readSessionListForSubject(
           throw new SessionListAccessError();
         }
 
-        const tenancyActivated = await sessionTenancyProductActivated(
-          tx as unknown as Database,
-          workspaceId,
-        );
-
         const archiveMode = options.archiveStatus ?? (options.archivedOnly ? "archived" : "active");
         const sortBy = options.sortBy ?? (archiveMode === "archived" ? "archivedAt" : "updatedAt");
         if (options.archivedOnly && archiveMode !== "archived") {
@@ -38139,7 +38135,7 @@ async function readSessionListForSubject(
                       ? { archivedAt: exactArchiveTimestamps.get(session.id)! }
                       : {}),
                   },
-                  { subjectId: options.subjectId, activated: tenancyActivated },
+                  { subjectId: options.subjectId },
                 ),
                 ...(sortBy === "updatedAt" && exactOrdinaryTimestamps.has(session.id)
                   ? { updatedAt: exactOrdinaryTimestamps.get(session.id)! }
@@ -38395,7 +38391,6 @@ export async function getSessionForSubject(
     const mcpServers = await sessionMcpServerMetadataForSessions(scopedDb, workspaceId, [
       sessionId,
     ]);
-    const tenancyActivated = await sessionTenancyProductActivated(scopedDb, workspaceId);
     const failureDiagnostics = await sessionFailureDiagnostics(scopedDb, workspaceId, session);
     return projectSessionForRelatedAccess(
       {
@@ -38407,7 +38402,7 @@ export async function getSessionForSubject(
           mapSessionAttention(session, row.pin),
           mapSessionArchive(row.pin),
           undefined,
-          { subjectId, activated: tenancyActivated },
+          { subjectId },
         )),
         failureDiagnostics,
       },
@@ -44562,6 +44557,19 @@ export async function applyContextCompaction(
             ),
           );
         const supersededFrom = Math.floor(Number(maxPosition)) + 1;
+        // Installing a successful summary is model progress, including a
+        // maintenance turn that never enters the ordinary response stream.
+        // Clear only provider recovery under the same locked attempt fence.
+        if (providerRecoveryCountFromTurnMetadata(fence.turn!.metadata) > 0) {
+          await tx
+            .update(schema.sessionTurns)
+            .set({
+              metadata: metadataWithoutProviderRecoveryCount(fence.turn!.metadata),
+              version: fence.turn!.version + 1,
+              updatedAt: new Date(),
+            })
+            .where(eq(schema.sessionTurns.id, input.turnId));
+        }
         await tx
           .update(schema.sessionHistoryItems)
           .set({ active: false })
@@ -68341,6 +68349,16 @@ export async function updateSessionTitleWithEvent(
   );
 }
 
+/** Read-only admission at a locked paused-to-active transition. */
+export type SessionGoalResumeValidation = (
+  tx: Database,
+  session: Pick<
+    Session,
+    "accountId" | "workspaceId" | "model" | "codexCompactionMode" | "latencyMode"
+  >,
+  causalTurn: { id: string; initiatingHumanSubjectId: string | null } | null,
+) => Promise<void>;
+
 /**
  * Status transition helper. Idempotent: requesting the current status returns
  * `changed: false` so callers can skip emitting a duplicate event. `completed`
@@ -68360,6 +68378,8 @@ export async function setSessionGoalStatus(
     reportDeliveries?: SessionGoalReportDelivery[];
     reportArtifactActor?: ReportArtifactActor;
     commandActor?: Extract<SessionCommandActor, { type: "agent_attempt" }>;
+    /** Runs under the canonical control/session/goal locks, before a paused goal changes. */
+    beforeResume?: SessionGoalResumeValidation;
   },
 ): Promise<{
   goal: SessionGoal;
@@ -68409,6 +68429,51 @@ export async function setSessionGoalStatus(
     if (existing.status === "completed") {
       throw new Error("session goal is completed; set a new goal to continue");
     }
+    if (input.status === "active" && input.beforeResume) {
+      const [effectiveSession] = await withEffectiveSessionPolicy(scopedDb, workspaceId, [session]);
+      // An accepted running turn owns the work the goal will continue after it
+      // settles. An idle Resume uses the exact latest-finished causal row.
+      const causalTurnFilter = session.activeTurnId
+        ? or(
+            eq(schema.sessionTurns.id, session.activeTurnId),
+            sql`${schema.sessionTurns.finishedAt} is not null`,
+          )
+        : sql`${schema.sessionTurns.finishedAt} is not null`;
+      const [causalTurn] = await scopedDb
+        .select({
+          id: schema.sessionTurns.id,
+          initiatingHumanSubjectId: schema.sessionTurns.initiatingHumanSubjectId,
+        })
+        .from(schema.sessionTurns)
+        .where(
+          and(
+            eq(schema.sessionTurns.workspaceId, workspaceId),
+            eq(schema.sessionTurns.sessionId, sessionId),
+            causalTurnFilter,
+          ),
+        )
+        .orderBy(
+          ...(session.activeTurnId
+            ? [desc(sql`${schema.sessionTurns.id} = ${session.activeTurnId}`)]
+            : []),
+          desc(schema.sessionTurns.finishedAt),
+          desc(schema.sessionTurns.position),
+          desc(schema.sessionTurns.createdAt),
+          desc(schema.sessionTurns.id),
+        )
+        .limit(1);
+      await input.beforeResume(
+        scopedDb,
+        {
+          accountId: session.accountId,
+          workspaceId,
+          model: effectiveSession!.model,
+          latencyMode: effectiveSession!.latencyMode as Session["latencyMode"],
+          codexCompactionMode: session.codexCompactionMode as Session["codexCompactionMode"],
+        },
+        causalTurn ?? null,
+      );
+    }
     if (input.status === "completed") {
       await verifyGoalReportDeliveries(scopedDb, {
         accountId: session.accountId,
@@ -68502,6 +68567,7 @@ export async function setSessionGoalStatusWithEvent(
     reportDeliveries?: SessionGoalReportDelivery[];
     reportArtifactActor?: ReportArtifactActor;
     commandActor?: Extract<SessionCommandActor, { type: "agent_attempt" }>;
+    beforeResume?: SessionGoalResumeValidation;
     event: SetSessionGoalStatusEvent;
   },
 ): Promise<{
@@ -68535,6 +68601,7 @@ export async function setSessionGoalStatusWithEvent(
           : {}),
         ...(input.reportArtifactActor ? { reportArtifactActor: input.reportArtifactActor } : {}),
         ...(input.commandActor ? { commandActor: input.commandActor } : {}),
+        ...(input.beforeResume ? { beforeResume: input.beforeResume } : {}),
         ...(input.evidence !== undefined ? { evidence: input.evidence } : {}),
         ...(input.rationale !== undefined ? { rationale: input.rationale } : {}),
         ...(input.pausedReason !== undefined ? { pausedReason: input.pausedReason } : {}),
@@ -68633,7 +68700,7 @@ export type GoalContinuationDecision =
   | { decision: "queue" }
   | {
       decision: "paused";
-      reason: "max_auto_continuations" | "limits" | "allowance";
+      reason: "max_auto_continuations" | "limits" | GoalAdmissionPausedReason;
       goal: SessionGoal;
     }
   | {
@@ -68712,7 +68779,7 @@ export async function evaluateGoalContinuation(
     // decision (before the counter bump) so a budget pause never consumes
     // continuation budget.
     budgetBlocked?: string | null;
-    budgetPausedReason?: "limits" | "allowance" | undefined;
+    budgetPausedReason?: "limits" | GoalAdmissionPausedReason | undefined;
   },
 ): Promise<GoalContinuationDecision> {
   return await withWorkspaceRls(
@@ -68974,7 +69041,7 @@ export async function materializeGoalContinuation(
     workflowId: string;
     defaultMaxAutoContinuations?: number | null;
     budgetBlocked?: string | null;
-    budgetPausedReason?: "limits" | "allowance" | undefined;
+    budgetPausedReason?: "limits" | GoalAdmissionPausedReason | undefined;
     /** Trusted worker admission, evaluated under the same session/goal locks
      * as lineage materialization. Never substitutes a mutable latest human. */
     admission?: (
@@ -68982,7 +69049,7 @@ export async function materializeGoalContinuation(
       causalTurn: { id: string; initiatingHumanSubjectId: string | null } | null,
     ) => Promise<{
       budgetBlocked: string | null;
-      budgetPausedReason?: "limits" | "allowance";
+      budgetPausedReason?: "limits" | GoalAdmissionPausedReason;
     }>;
     idleBackoff?: GoalIdleBackoffPolicy | null;
     policy: {
@@ -78873,6 +78940,8 @@ function metadataWithoutProviderRecoveryCount(
 ): Record<string, unknown> {
   const next = { ...(metadata ?? {}) };
   delete next.providerRecoveryCount;
+  delete next.providerRecoveryStartedAt;
+  delete next.providerRecoveryReason;
   return next;
 }
 
@@ -81315,7 +81384,15 @@ export async function requestSessionTurnRecovery(
                 }
               : {}),
             ...(input.providerRecoveryCount !== undefined
-              ? { providerRecoveryCount: input.providerRecoveryCount }
+              ? {
+                  providerRecoveryCount: input.providerRecoveryCount,
+                  providerRecoveryStartedAt:
+                    providerRecoveryCountFromTurnMetadata(turn.metadata) > 0 &&
+                    typeof turn.metadata?.providerRecoveryStartedAt === "string"
+                      ? turn.metadata.providerRecoveryStartedAt
+                      : now.toISOString(),
+                  providerRecoveryReason: input.reason,
+                }
               : {}),
           },
           updatedAt: now,
@@ -86759,7 +86836,7 @@ async function mapSessionWithControl(
   },
   archive: Pick<Session, "archived" | "archivedAt" | "archiveVersion"> = mapSessionArchive(null),
   workspaceControl?: WorkspaceControlRow,
-  tenancyViewer?: { subjectId: string; activated: boolean },
+  tenancyViewer?: { subjectId: string },
 ): Promise<Session> {
   const controls = await sessionControlProjections(db, row.workspaceId, [row.id], workspaceControl);
   const control = controls.get(row.id);
@@ -86896,7 +86973,7 @@ function mapSession(
     attentionVersion: 0,
   },
   archive: Pick<Session, "archived" | "archivedAt" | "archiveVersion"> = mapSessionArchive(null),
-  tenancyViewer?: { subjectId: string; activated: boolean },
+  tenancyViewer?: { subjectId: string },
 ): Session {
   const bundledSkillIds = bundledSkillSelectionFromMetadata(row.metadata);
   return {
@@ -86930,9 +87007,7 @@ function mapSession(
     toolPolicyVersion: Number(row.toolPolicyVersion),
     mcpApprovalPolicies: row.mcpApprovalPolicies,
     metadata: row.metadata,
-    ...(tenancyViewer?.activated
-      ? { tenancy: mapSessionTenancy(row, tenancyViewer.subjectId) }
-      : {}),
+    ...(tenancyViewer ? { tenancy: mapSessionTenancy(row, tenancyViewer.subjectId) } : {}),
     createdBy: initiatorFromStorage(
       row.createdByKind,
       row.createdBySubjectId,

package/src/provision-roles.ts

@@ -2163,6 +2163,22 @@ BEGIN
       REVOKE ALL ON FUNCTION opengeni_private.record_sandbox_file_publication(uuid,uuid,uuid,uuid) FROM PUBLIC;
       REVOKE ALL ON FUNCTION opengeni_private.list_sandbox_file_publications(uuid,uuid,jsonb) FROM PUBLIC;
     END IF;
+    IF to_regclass('opengeni_private.artifact_catalog_pins') IS NOT NULL THEN
+      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.artifact_catalog_pins FROM %I', ${literal(role)});
+      -- Table revocation does not remove column ACLs. Reconcile every current
+      -- column for both the runtime and PUBLIC, including future additions.
+      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.artifact_catalog_pins FROM %I',
+        (SELECT string_agg(quote_ident(attname),',' ORDER BY attnum) FROM pg_attribute
+          WHERE attrelid='opengeni_private.artifact_catalog_pins'::regclass AND attnum>0 AND NOT attisdropped),
+        ${literal(role)});
+      REVOKE ALL ON TABLE opengeni_private.artifact_catalog_pins FROM PUBLIC;
+      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.artifact_catalog_pins FROM PUBLIC',
+        (SELECT string_agg(quote_ident(attname),',' ORDER BY attnum) FROM pg_attribute
+          WHERE attrelid='opengeni_private.artifact_catalog_pins'::regclass AND attnum>0 AND NOT attisdropped));
+      REVOKE ALL ON FUNCTION opengeni_private.update_artifact_pin(uuid,uuid,text,text,boolean),
+        opengeni_private.list_artifact_pins(uuid,uuid),
+        opengeni_private.list_sandbox_file_publications_pinned(uuid,uuid,jsonb) FROM PUBLIC;
+    END IF;
     IF to_regclass('opengeni_private.slack_file_upload_operations') IS NOT NULL THEN
       -- Ordinary RLS repositories own the upload CAS, not owner capabilities.
       -- Never allow deletion/truncation to erase its durable completion fence.

package/src/runtime-posture-cli.ts

@@ -25,8 +25,6 @@ try {
     rlsStrategy: settings.rlsStrategy,
     expectedRole: settings.runtimeDatabaseRole,
     targetSchema: settings.dbSchema.trim() || "public",
-    organizationTenancyCanonicalActivationEnabled:
-      settings.organizationTenancyCanonicalActivationEnabled,
   });
   // Structural evidence only: never print a connection string, secret, GUC, or
   // tenant row. The command is intended for release Jobs and audit artifacts.