@opengeni/db 1.0.2 → 1.2.0

package/dist/session-tenancy.d.ts

@@ -6,6 +6,12 @@ export declare class SessionTenancyConflictError extends Error {
     readonly name = "SessionTenancyConflictError";
     constructor(reason: "not_quiescent" | "authority_epoch" | "operation_reuse", blocker?: SessionTenancyBlocker | null, options?: ErrorOptions);
 }
+/**
+ * The organization's owner/admin Only-me setting does not permit a new private
+ * session (or private transition) in this shared workspace. Activation itself is
+ * universal since migration 0611; the name and the SESSION_TENANCY_NOT_ACTIVATED
+ * wire code are kept for client compatibility.
+ */
 export declare class SessionTenancyNotActivatedError extends Error {
     readonly name = "SessionTenancyNotActivatedError";
     constructor(options?: ErrorOptions);
@@ -83,7 +89,6 @@ export type ForkSessionContentResult = {
     runtimeEventId: string | null;
     runtimeEventSequence: number | null;
 };
-export declare function sessionTenancyProductActivated(db: Database, workspaceId: string): Promise<boolean>;
 export declare function getPrivateSessionCreatePolicy(db: Database, input: {
     workspaceId: string;
     actorSubjectId: string;

package/dist/session-tenancy.js

@@ -12,11 +12,10 @@ import {
   openPrivateChildSessionCreateCapability,
   openPrivateSessionCreateCapability,
   replayAppliedSessionFork,
-  sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-UEQQ2WWU.js";
-import "./chunk-56MYWKQV.js";
-import "./chunk-LDTQGYD2.js";
+} from "./chunk-3TGYFFZR.js";
+import "./chunk-O2Y5E5M3.js";
+import "./chunk-FWQNHNOU.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {
@@ -33,7 +32,6 @@ export {
   openPrivateChildSessionCreateCapability,
   openPrivateSessionCreateCapability,
   replayAppliedSessionFork,
-  sessionTenancyProductActivated,
   transitionSessionVisibility
 };
 //# sourceMappingURL=session-tenancy.js.map

package/dist/video-generation.js

@@ -29,10 +29,10 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-MACELCXG.js";
+} from "./chunk-UCIMHNII.js";
 import "./chunk-4UJCXBR2.js";
-import "./chunk-56MYWKQV.js";
-import "./chunk-LDTQGYD2.js";
+import "./chunk-O2Y5E5M3.js";
+import "./chunk-FWQNHNOU.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/workspace-tool-defaults.js

@@ -1,12 +1,12 @@
 import {
   lockWorkspaceInferenceControl
-} from "./chunk-7S53WLPI.js";
-import "./chunk-MACELCXG.js";
+} from "./chunk-CYP72JTQ.js";
+import "./chunk-UCIMHNII.js";
 import "./chunk-4UJCXBR2.js";
 import {
   withWorkspaceRls
-} from "./chunk-56MYWKQV.js";
-import "./chunk-LDTQGYD2.js";
+} from "./chunk-O2Y5E5M3.js";
+import "./chunk-FWQNHNOU.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 

package/drizzle/0610_artifact_catalog_pins.sql

@@ -0,0 +1,165 @@
+-- deployment-mode: rolling
+-- Shared discovery metadata only. Existing content and authorization domains
+-- remain canonical; older binaries keep their original publication capability.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+CREATE TABLE opengeni_private.artifact_catalog_pins (
+  account_id uuid NOT NULL,
+  workspace_id uuid NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  kind text NOT NULL CHECK (kind IN ('site','document','spreadsheet','presentation','image','file')),
+  artifact_id text NOT NULL CHECK (length(artifact_id) BETWEEN 1 AND 128),
+  pinned_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (account_id, workspace_id, kind, artifact_id)
+);
+ALTER TABLE opengeni_private.artifact_catalog_pins ENABLE ROW LEVEL SECURITY;
+ALTER TABLE opengeni_private.artifact_catalog_pins FORCE ROW LEVEL SECURITY;
+CREATE POLICY workspace_isolation ON opengeni_private.artifact_catalog_pins
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+CREATE FUNCTION opengeni_private.update_artifact_pin(
+  p_account uuid, p_workspace uuid, p_kind text, p_id text, p_pinned boolean
+) RETURNS void LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $body$
+DECLARE v_visible boolean := false;
+BEGIN
+  IF p_account IS NULL OR p_workspace IS NULL OR p_kind IS NULL OR p_id IS NULL OR p_pinned IS NULL
+    OR p_account IS DISTINCT FROM opengeni_private.current_account_id()
+    OR p_workspace IS DISTINCT FROM opengeni_private.current_workspace_id()
+    OR p_kind NOT IN ('site','document','spreadsheet','presentation','image','file')
+    OR length(p_id) NOT BETWEEN 1 AND 128
+  THEN RAISE EXCEPTION 'artifact pin scope mismatch' USING ERRCODE = '42501'; END IF;
+  -- Serialize opposite writes even before the first row exists.
+  PERFORM pg_advisory_xact_lock(hashtextextended('artifact-pin:' || p_account || ':' || p_workspace || ':' || p_kind || ':' || p_id, 0));
+  IF p_kind = 'site' THEN
+    SELECT EXISTS (SELECT 1 FROM workspace_artifacts a WHERE a.account_id=p_account
+      AND a.workspace_id=p_workspace AND a.id::text=p_id) INTO v_visible;
+  ELSIF p_kind IN ('document','spreadsheet','presentation') THEN
+    SELECT EXISTS (SELECT 1 FROM editable_artifacts a WHERE a.account_id=p_account
+      AND a.workspace_id=p_workspace AND a.id=p_id AND a.modality=p_kind) INTO v_visible;
+  ELSE
+    SELECT EXISTS (SELECT 1 FROM files f WHERE f.account_id=p_account AND f.workspace_id=p_workspace
+      AND f.id::text=p_id AND f.status='ready'
+      AND (f.private_owner_subject_ids IS NULL OR nullif(current_setting('opengeni.private_file_owner',true),'')=ANY(f.private_owner_subject_ids))
+      AND ((p_kind='image' AND EXISTS (SELECT 1 FROM generated_image_artifacts g
+        WHERE g.account_id=p_account AND g.workspace_id=p_workspace AND g.artifact_id=f.id AND g.status='ready'))
+        OR (EXISTS (SELECT 1 FROM opengeni_private.sandbox_file_publications p
+          WHERE p.account_id=p_account AND p.workspace_id=p_workspace AND p.file_id=f.id)
+          AND p_kind=CASE WHEN f.content_type IN ('image/png','image/jpeg','image/gif','image/webp','image/avif','image/svg+xml')
+            THEN 'image' ELSE 'file' END))) INTO v_visible;
+  END IF;
+  -- Also validate unpin: no probe or write for missing, foreign or hidden targets.
+  IF NOT v_visible THEN RAISE EXCEPTION 'artifact pin target unavailable' USING ERRCODE = '42501'; END IF;
+  IF p_pinned THEN
+    INSERT INTO opengeni_private.artifact_catalog_pins(account_id,workspace_id,kind,artifact_id)
+      VALUES(p_account,p_workspace,p_kind,p_id) ON CONFLICT DO NOTHING;
+  ELSE
+    DELETE FROM opengeni_private.artifact_catalog_pins p WHERE p.account_id=p_account
+      AND p.workspace_id=p_workspace AND p.kind=p_kind AND p.artifact_id=p_id;
+  END IF;
+END $body$;
+
+CREATE FUNCTION opengeni_private.list_artifact_pins(p_account uuid, p_workspace uuid)
+RETURNS TABLE(kind text, artifact_id text)
+LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $body$
+BEGIN
+  IF p_account IS NULL OR p_workspace IS NULL
+    OR p_account IS DISTINCT FROM opengeni_private.current_account_id()
+    OR p_workspace IS DISTINCT FROM opengeni_private.current_workspace_id()
+  THEN RAISE EXCEPTION 'artifact pin scope mismatch' USING ERRCODE = '42501'; END IF;
+  -- Only joined to independently authorized candidates. Private files remain
+  -- hidden even when the migration owner is a superuser rather than FORCE-RLS-bound.
+  RETURN QUERY SELECT p.kind,p.artifact_id FROM opengeni_private.artifact_catalog_pins p
+    WHERE p.account_id=p_account AND p.workspace_id=p_workspace
+      AND (p.kind NOT IN ('file','image') OR EXISTS (SELECT 1 FROM files f
+        WHERE f.account_id=p_account AND f.workspace_id=p_workspace AND f.id::text=p.artifact_id AND f.status='ready'
+          AND (f.private_owner_subject_ids IS NULL OR nullif(current_setting('opengeni.private_file_owner',true),'')=ANY(f.private_owner_subject_ids))));
+END $body$;
+
+-- A page-local re-sort is incorrect: this bounded branch must apply the same
+-- leading pin key and frontier as the complete union before taking its LIMIT.
+CREATE FUNCTION opengeni_private.list_sandbox_file_publications_pinned(
+  p_account uuid, p_workspace uuid, p_query jsonb
+) RETURNS TABLE(file_id uuid, title text, kind text, source_session_id uuid, published_at timestamptz, pinned boolean)
+LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $body$
+DECLARE
+  v_limit integer := (p_query->>'limit')::integer;
+  v_sort text := p_query->>'sort';
+  v_after text := p_query#>>'{after,key}';
+  v_after_pinned boolean := coalesce((p_query#>>'{after,pinned}')::boolean,false);
+BEGIN
+  IF p_account IS NULL OR p_workspace IS NULL
+    OR p_account IS DISTINCT FROM opengeni_private.current_account_id()
+    OR p_workspace IS DISTINCT FROM opengeni_private.current_workspace_id()
+    OR v_limit IS NULL OR v_limit NOT BETWEEN 1 AND 201
+    OR v_sort IS NULL OR v_sort NOT IN ('updated','newest','title')
+    OR jsonb_typeof(p_query) IS DISTINCT FROM 'object'
+    OR jsonb_typeof(p_query->'kinds') IS DISTINCT FROM 'array'
+    OR jsonb_array_length(p_query->'kinds') NOT BETWEEN 1 AND 2
+    OR length(coalesce(p_query->>'q',''))>200
+  THEN RAISE EXCEPTION 'publication list scope mismatch' USING ERRCODE = '42501'; END IF;
+  RETURN QUERY WITH candidates AS (
+    SELECT p.file_id, f.filename AS title,
+      CASE WHEN f.content_type IN ('image/png','image/jpeg','image/gif','image/webp','image/avif','image/svg+xml')
+        THEN 'image' ELSE 'file' END AS kind,
+      p.source_session_id, p.published_at,
+      CASE WHEN v_sort='title' THEN lower(f.filename)
+        ELSE to_char(p.published_at AT TIME ZONE 'UTC','YYYY-MM-DD"T"HH24:MI:SS.US') END AS sort_key
+    FROM opengeni_private.sandbox_file_publications p JOIN files f
+      ON f.account_id=p.account_id AND f.workspace_id=p.workspace_id AND f.id=p.file_id
+    WHERE p.account_id=p_account AND p.workspace_id=p_workspace AND f.status='ready'
+      AND (f.private_owner_subject_ids IS NULL OR nullif(current_setting('opengeni.private_file_owner',true),'')=ANY(f.private_owner_subject_ids))
+      AND (p_query->>'sourceSessionId' IS NULL OR p.source_session_id=(p_query->>'sourceSessionId')::uuid)
+      AND p.published_at<=(p_query->>'snapshotAt')::timestamptz
+      AND strpos(lower(f.filename),lower(coalesce(p_query->>'q','')))>0
+  ), ordered AS (
+    SELECT c.*, (pins.artifact_id IS NOT NULL) AS pinned FROM candidates c
+      LEFT JOIN opengeni_private.list_artifact_pins(p_account,p_workspace) pins
+        ON pins.kind=c.kind AND pins.artifact_id=c.file_id::text
+  ) SELECT c.file_id,c.title,c.kind,c.source_session_id,c.published_at,c.pinned FROM ordered c
+    WHERE (p_query->'kinds') ? c.kind AND (v_after IS NULL OR c.pinned<v_after_pinned OR
+      (c.pinned=v_after_pinned AND (
+        (v_sort='title' AND c.sort_key COLLATE "C">v_after COLLATE "C") OR
+        (v_sort<>'title' AND c.sort_key COLLATE "C"<v_after COLLATE "C") OR
+        (c.sort_key=v_after AND (c.kind COLLATE "C",c.file_id::text COLLATE "C")>
+          ((p_query#>>'{after,kind}') COLLATE "C",(p_query#>>'{after,id}') COLLATE "C")))))
+    ORDER BY c.pinned DESC, CASE WHEN v_sort='title' THEN c.sort_key END COLLATE "C" ASC,
+      CASE WHEN v_sort<>'title' THEN c.sort_key END COLLATE "C" DESC,c.kind COLLATE "C",c.file_id::text COLLATE "C"
+    LIMIT v_limit;
+END $body$;
+REVOKE ALL ON TABLE opengeni_private.artifact_catalog_pins FROM PUBLIC;
+REVOKE ALL ON FUNCTION opengeni_private.update_artifact_pin(uuid,uuid,text,text,boolean),
+  opengeni_private.list_artifact_pins(uuid,uuid),
+  opengeni_private.list_sandbox_file_publications_pinned(uuid,uuid,jsonb) FROM PUBLIC;
+
+DO $grants$
+DECLARE target_schema text := current_schema(); recipient record; routine text;
+BEGIN
+  FOREACH routine IN ARRAY ARRAY['update_artifact_pin(uuid,uuid,text,text,boolean)',
+    'list_artifact_pins(uuid,uuid)','list_sandbox_file_publications_pinned(uuid,uuid,jsonb)']
+  LOOP
+    EXECUTE format('ALTER FUNCTION opengeni_private.%s SET search_path = pg_catalog, %I, pg_temp', routine, target_schema);
+    -- Strip inherited default function ACLs, then grant only existing runtimes.
+    FOR recipient IN SELECT DISTINCT acl.grantee,r.rolname FROM pg_proc p
+      CROSS JOIN LATERAL aclexplode(p.proacl) acl LEFT JOIN pg_roles r ON r.oid=acl.grantee
+      WHERE p.oid=to_regprocedure('opengeni_private.' || routine) AND acl.grantee<>p.proowner
+    LOOP
+      EXECUTE format('REVOKE ALL ON FUNCTION opengeni_private.%s FROM %s', routine,
+        CASE WHEN recipient.grantee=0 THEN 'PUBLIC' ELSE quote_ident(recipient.rolname) END);
+    END LOOP;
+  END LOOP;
+  FOR recipient IN SELECT DISTINCT acl.grantee,r.rolname FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace
+    CROSS JOIN LATERAL aclexplode(c.relacl) acl LEFT JOIN pg_roles r ON r.oid=acl.grantee
+    WHERE n.nspname='opengeni_private' AND c.relname='artifact_catalog_pins' AND acl.grantee<>c.relowner
+  LOOP
+    EXECUTE format('REVOKE ALL ON TABLE opengeni_private.artifact_catalog_pins FROM %s',
+      CASE WHEN recipient.grantee=0 THEN 'PUBLIC' ELSE quote_ident(recipient.rolname) END);
+  END LOOP;
+  FOR recipient IN SELECT DISTINCT r.rolname FROM pg_proc p
+    CROSS JOIN LATERAL aclexplode(p.proacl) acl JOIN pg_roles r ON r.oid=acl.grantee
+    WHERE p.oid=to_regprocedure('opengeni_private.record_sandbox_file_publication(uuid,uuid,uuid,uuid)')
+      AND acl.privilege_type='EXECUTE' AND acl.grantee<>p.proowner
+  LOOP
+    EXECUTE format('GRANT EXECUTE ON FUNCTION opengeni_private.update_artifact_pin(uuid,uuid,text,text,boolean), opengeni_private.list_artifact_pins(uuid,uuid), opengeni_private.list_sandbox_file_publications_pinned(uuid,uuid,jsonb) TO %I', recipient.rolname);
+  END LOOP;
+END $grants$;

package/drizzle/0611_universal_session_tenancy_activation.sql

@@ -0,0 +1,166 @@
+-- deployment-mode: rolling
+-- Retire per-organization session-tenancy activation. Every organization is
+-- activated: private ("Only me") sessions, visibility transitions, forks and
+-- personal-resource grants no longer require a version-1
+-- session_tenancy_activations receipt, and the owner/admin Only-me setting
+-- (organization_private_session_settings) now defaults to ENABLED when an
+-- organization has no row. Owners/admins may still disable it; an explicit
+-- disabled row keeps gating new Only-me chats in shared workspaces.
+--
+-- No receipts are written and no data is backfilled. The receipt keeps exactly
+-- one meaning: opengeni_private.session_tenancy_account_activated (0340) still
+-- retires the legacy_user connection and unattributed-writer compatibility
+-- lanes only for organizations that already hold one. Organizations without a
+-- receipt keep those lanes exactly as before this migration, so no stored
+-- authority becomes invisible and no ownership is inferred.
+--
+-- Rolling: this only widens product predicates and flips a missing-row default.
+-- A pre-0611 binary keeps working against the rewritten routines: its own
+-- receipt probe (session_tenancy_product_activated) now answers true, its
+-- startup interlock probe (session_tenancy_any_product_activation) answers
+-- false regardless of the retired environment switch, and every routine keeps
+-- its signature, owner, ACL, SECURITY DEFINER and search_path. No table is
+-- locked or rewritten.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+-- Remove the receipt prerequisite from every runtime predicate and default the
+-- Only-me setting to enabled. Each rewrite replaces one exact, reviewed
+-- fragment of the live definition; a changed shape aborts instead of silently
+-- leaving a receipt gate behind. Owner, grants, SECURITY DEFINER and
+-- search_path are preserved by CREATE OR REPLACE of the catalog's own
+-- definition.
+DO $universal_session_tenancy_predicates$
+DECLARE
+  data_schema text := pg_catalog.current_schema();
+  target regprocedure;
+  definition text;
+  rewrite record;
+  occurrences integer;
+  -- Fragments below are routine SOURCE text matched against
+  -- pg_get_functiondef, never queries: this block reads only the catalog.
+  -- The table names are spliced in so the source is not mistaken for a
+  -- migration-time row read of a FORCE-RLS table.
+  receipts constant text := 'session_tenancy_activations';
+  settings constant text := 'organization_private_session_settings';
+  receipt_gate constant text :=
+    E'  IF NOT EXISTS (\n'
+    || E'    SELECT 1 FROM ' || receipts || E' activation\n'
+    || E'    WHERE activation.account_id = p_account_id AND activation.activation_version = 1\n'
+    || E'  ) THEN\n'
+    || E'    RAISE EXCEPTION ''session tenancy product is not activated'' USING ERRCODE = ''42501'';\n'
+    || E'  END IF;\n';
+  receipt_gate_removed constant text :=
+    E'  -- 0611: every organization is session-tenancy activated.\n';
+  setting_receipt_gate constant text :=
+    E'  IF p_enabled AND NOT session_tenancy_product_activated(p_account_id, 1) THEN\n'
+    || E'    RAISE EXCEPTION ''session tenancy product surface is not available for this organization'' USING ERRCODE = ''55000'';\n'
+    || E'  END IF;\n';
+BEGIN
+  FOR rewrite IN
+    SELECT * FROM (VALUES
+      (1, pg_catalog.format('%I.session_tenancy_product_activated(uuid,integer)', data_schema),
+        E'    AND EXISTS (\n'
+          || E'    SELECT 1 FROM ' || receipts || E' activation\n'
+          || E'    WHERE activation.account_id = p_account_id\n'
+          || E'      AND activation.activation_version = p_activation_version\n'
+          || E'  )',
+        E'    AND p_account_id IS NOT NULL\n'
+          || E'    AND p_activation_version IS NOT DISTINCT FROM 1'),
+      -- The value-free startup interlock is retired with the deployment switch.
+      -- Answering false keeps every earlier binary startable regardless of the
+      -- removed OPENGENI_ORGANIZATION_TENANCY_CANONICAL_ACTIVATION_ENABLED value.
+      (3, pg_catalog.format('%I.session_tenancy_any_product_activation()', data_schema),
+        E'  SELECT EXISTS (\n'
+          || E'    SELECT 1 FROM ' || receipts || E'\n'
+          || E'  ) INTO activated;',
+        E'  activated := false;'),
+      (4, pg_catalog.format(
+          '%I.list_self_user_resource_authorities(uuid,uuid,text,uuid,integer)', data_schema),
+        receipt_gate, receipt_gate_removed),
+      (5, pg_catalog.format(
+          '%I.issue_self_user_resource_grant(uuid,uuid,uuid,text,text,text,uuid,integer,boolean)',
+          data_schema),
+        receipt_gate, receipt_gate_removed),
+      (6, pg_catalog.format('%I.revoke_self_user_resource_grant(uuid,uuid,uuid)', data_schema),
+        receipt_gate, receipt_gate_removed),
+      (7, pg_catalog.format(
+          '%I.accept_turn_personal_resource_attachment(uuid,uuid,uuid,uuid,text,integer,boolean,integer)',
+          data_schema),
+        receipt_gate, receipt_gate_removed),
+      -- Only-me chats default to enabled: only an explicit disabled row gates.
+      (8, pg_catalog.format('%I.organization_private_sessions_enabled(uuid)', data_schema),
+        E'    AND session_tenancy_product_activated(p_account_id, 1)\n'
+          || E'    AND EXISTS (\n'
+          || E'      SELECT 1 FROM ' || settings || E' setting\n'
+          || E'      WHERE setting.account_id = p_account_id AND setting.enabled\n'
+          || E'    )',
+        E'    AND NOT EXISTS (\n'
+          || E'      SELECT 1 FROM ' || settings || E' setting\n'
+          || E'      WHERE setting.account_id = p_account_id AND NOT setting.enabled\n'
+          || E'    )'),
+      (9, pg_catalog.format(
+          '%I.get_organization_private_session_settings(uuid,text)', data_schema),
+        E'    ''enabled'', coalesce(setting.enabled, false),\n',
+        E'    ''enabled'', coalesce(setting.enabled, true),\n'),
+      (10, pg_catalog.format(
+          '%I.update_organization_private_session_settings(uuid,text,boolean,bigint,uuid)',
+          data_schema),
+        setting_receipt_gate, ''),
+      (11, pg_catalog.format(
+          '%I.update_organization_private_session_settings(uuid,text,boolean,bigint,uuid)',
+          data_schema),
+        E'  did_change := coalesce(setting.enabled, false) IS DISTINCT FROM p_enabled;\n',
+        E'  did_change := coalesce(setting.enabled, true) IS DISTINCT FROM p_enabled;\n')
+    ) AS rewrites(ordinal, signature, old_fragment, new_fragment)
+    ORDER BY ordinal
+  LOOP
+    target := pg_catalog.to_regprocedure(rewrite.signature);
+    IF target IS NULL THEN
+      RAISE EXCEPTION 'universal session tenancy predicate is missing: %', rewrite.signature
+        USING ERRCODE = '55000';
+    END IF;
+    definition := pg_catalog.pg_get_functiondef(target);
+    occurrences := (
+      pg_catalog.length(definition)
+        - pg_catalog.length(pg_catalog.replace(definition, rewrite.old_fragment, ''))
+    ) / pg_catalog.length(rewrite.old_fragment);
+    IF occurrences <> 1 THEN
+      RAISE EXCEPTION 'universal session tenancy predicate shape changed: % (% matches)',
+        rewrite.signature, occurrences USING ERRCODE = '55000';
+    END IF;
+    EXECUTE pg_catalog.replace(definition, rewrite.old_fragment, rewrite.new_fragment);
+  END LOOP;
+
+  -- Fail closed if any other routine still consults the receipt table. Only
+  -- the retained, now-dormant receipt writers (operator, greenfield and
+  -- additional-organization activation, plus the operator preference
+  -- enabler's lock) and the private legacy-lane retirement predicate may.
+  -- That predicate is not a product prerequisite: it closes the legacy_user
+  -- connection and unattributed-writer compatibility lanes only for an
+  -- organization that already holds a receipt.
+  IF EXISTS (
+    SELECT 1 FROM pg_catalog.pg_proc routine
+    JOIN pg_catalog.pg_namespace namespace ON namespace.oid = routine.pronamespace
+    WHERE namespace.nspname IN (data_schema, 'opengeni_private')
+      AND routine.prosrc LIKE '%session_tenancy_activations%'
+      AND routine.proname NOT IN (
+        'activate_session_tenancy_product',
+        'activate_greenfield_session_tenancy_from_setup',
+        'activate_session_tenancy_from_additional_organization',
+        'enable_organization_private_sessions_from_activation',
+        'session_tenancy_account_activated'
+      )
+  ) THEN
+    RAISE EXCEPTION 'a runtime routine still requires a session tenancy activation receipt'
+      USING ERRCODE = '55000';
+  END IF;
+END
+$universal_session_tenancy_predicates$;
+
+COMMENT ON FUNCTION session_tenancy_product_activated(uuid, integer) IS
+  'Universal since 0611: true for the transaction''s own organization at activation version 1. No per-organization receipt is required.';
+COMMENT ON FUNCTION opengeni_private.session_tenancy_account_activated(uuid) IS
+  'Legacy-lane retirement predicate (0340): true when the transaction''s own organization holds a receipt. Since 0611 it gates no product surface; it only closes the legacy_user connection and unattributed-writer lanes.';
+COMMENT ON FUNCTION session_tenancy_any_product_activation() IS
+  'Retired by 0611 with OPENGENI_ORGANIZATION_TENANCY_CANONICAL_ACTIVATION_ENABLED. Always false so no binary enforces the removed startup interlock.';

package/drizzle/0612_scheduled_model_unavailable_refusal.sql

@@ -0,0 +1,21 @@
+-- deployment-mode: rolling
+-- A scheduled occurrence whose model is retired or no longer in the catalog is
+-- refused as a visible terminal run (`scheduled_model_unavailable`) instead of
+-- exhausting activity retries and leaving no run. Preserve the immutable 0539
+-- refusal lifecycle (as extended by 0552), adding only this reason. Exact
+-- anchoring refuses an unexpected deployed guard definition. Old binaries never
+-- write the new reason, so this is rolling-safe.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+DO $scheduled_model_refusal$
+DECLARE
+  definition text:=pg_get_functiondef('opengeni_private.guard_scheduled_admission_refusal()'::regprocedure);
+  anchor text:='''monthly_agent_run_limit'', ''allowance_exhausted'')';
+BEGIN
+  IF strpos(definition,anchor)=0 OR strpos(substr(definition,strpos(definition,anchor)+length(anchor)),anchor)>0 THEN
+    RAISE EXCEPTION '0612 unexpected scheduled refusal guard definition' USING ERRCODE='55000';
+  END IF;
+  EXECUTE replace(definition,anchor,
+    '''monthly_agent_run_limit'', ''allowance_exhausted'', ''scheduled_model_unavailable'')');
+END $scheduled_model_refusal$;