@opengeni/db 3.2.0-canary.0 → 3.4.0-canary.0

package/src/index.ts

@@ -18,9 +18,11 @@ import {
   OrganizationMember,
   WorkspaceMember as WorkspaceMemberContract,
   SessionGoalSnapshot,
+  AUTOMATIC_SESSION_TITLE_FALLBACK,
   ScheduledTaskRunAcceptedExecution,
   SessionGoalRootConstraintsWrite,
   normalizeSessionGoalRootConstraints,
+  normalizeAutomaticSessionTitle,
   sessionVisibilityToPublic,
   sessionGoalUtf8Bytes,
 } from "@opengeni/contracts";
@@ -425,6 +427,7 @@ export * from "./company-brain-context-selection";
 export * from "./knowledge-source-sync";
 export * from "./task-notes";
 export * from "./managed-human-provisioning";
+export * from "./managed-user-setup";
 export * from "./organization-membership-backfill";
 export * from "./connection-tenancy-backfill";
 export * from "./generated-images";
@@ -451,6 +454,8 @@ export * from "./capability-integrations";
 export * from "./integration-bindings";
 export * from "./integration-facets";
 export * from "./insights";
+export * from "./insights-model-bundle";
+export * from "./insights-usage-bundle";
 export * from "./organization-membership-lifecycle";
 import { assertActiveManagedHumanOrganizationMembership } from "./organization-membership-lifecycle";
 // Deliberately NOT `export *`: `accountIdInRlsScope` is an internal convenience
@@ -1502,6 +1507,7 @@ export async function ensureManagedAccessForUser(
     email: string;
     name: string;
     emailVerified?: boolean;
+    provisionFallbackOrganization?: boolean;
   },
 ): Promise<AccessContext> {
   return (await ensureManagedAccessForUserWithOrganizationMemberships(db, input)).accessContext;
@@ -1646,6 +1652,7 @@ export async function ensureManagedAccessForUserWithOrganizationMemberships(
     email: string;
     name: string;
     emailVerified?: boolean;
+    provisionFallbackOrganization?: boolean;
   },
 ): Promise<ManagedAccessProvisioningResult> {
   const subjectId = `user:${input.userId}`;
@@ -1710,18 +1717,6 @@ export async function ensureManagedAccessForUserWithOrganizationMemberships(
         (membership) => membership.status === "suspended" || membership.status === "revoked",
       )
     ) {
-      if (
-        fallbackAccount &&
-        existingOrganizationMemberships.some(
-          (membership) => membership.organizationId === fallbackAccount.id,
-        )
-      ) {
-        return await projectManagedOrganizationAccess(txDb, {
-          subjectId,
-          subjectLabel,
-          organizationMemberships: existingOrganizationMemberships,
-        });
-      }
       return {
         accessContext: {
           mode: "managed",
@@ -1755,6 +1750,20 @@ export async function ensureManagedAccessForUserWithOrganizationMemberships(
         organizationMemberships: [],
       };
     }
+    if (input.provisionFallbackOrganization === false) {
+      return {
+        accessContext: {
+          mode: "managed",
+          subjectId,
+          subjectLabel,
+          accountGrants: [],
+          workspaceGrants: [],
+          defaultAccountId: null,
+          defaultWorkspaceId: null,
+        },
+        organizationMemberships: [],
+      };
+    }
     const accountName = input.name || input.email;
     let [account] = await tx
       .select()
@@ -1776,7 +1785,9 @@ export async function ensureManagedAccessForUserWithOrganizationMemberships(
         })
         .onConflictDoUpdate({
           target: [schema.managedAccounts.externalSource, schema.managedAccounts.externalId],
-          set: { name: accountName, updatedAt: new Date() },
+          // The insert race may converge here, but later access refreshes must
+          // never turn one-shot signup intent into an organization rename.
+          set: { updatedAt: new Date() },
         })
         .returning();
     }
@@ -1810,7 +1821,8 @@ export async function ensureManagedAccessForUserWithOrganizationMemberships(
         })
         .onConflictDoUpdate({
           target: [schema.workspaces.externalSource, schema.workspaces.externalId],
-          set: { name: "Default workspace", updatedAt: new Date() },
+          // Preserve a later administrator rename on legacy fallback workspaces.
+          set: { updatedAt: new Date() },
         })
         .returning();
     }
@@ -2050,7 +2062,13 @@ export async function getWorkspace(db: Database, workspaceId: string): Promise<W
     .from(schema.workspaces)
     .where(eq(schema.workspaces.id, workspaceId))
     .limit(1);
-  return row ? mapWorkspace(row, await workspaceControlProjection(db, row.id)) : null;
+  return row
+    ? mapWorkspace(
+        row,
+        await workspaceControlProjection(db, row.id),
+        await workspaceKindProjection(db, row),
+      )
+    : null;
 }
 
 export async function getManagedAccount(
@@ -2087,7 +2105,11 @@ export async function listWorkspacesForSubject(
     .limit(limit);
   return await Promise.all(
     rows.map(async (row) =>
-      mapWorkspace(row.workspace, await workspaceControlProjection(db, row.workspace.id)),
+      mapWorkspace(
+        row.workspace,
+        await workspaceControlProjection(db, row.workspace.id),
+        await workspaceKindProjection(db, row.workspace),
+      ),
     ),
   );
 }
@@ -2136,13 +2158,17 @@ export async function createWorkspace(
       workspaceId: row.id,
       accountId: row.accountId,
     });
-    return mapWorkspace(row, {
-      state: "active",
-      revision: 0,
-      reason: null,
-      changedBy: null,
-      changedAt: null,
-    });
+    return mapWorkspace(
+      row,
+      {
+        state: "active",
+        revision: 0,
+        reason: null,
+        changedBy: null,
+        changedAt: null,
+      },
+      "shared",
+    );
   });
 }
 
@@ -2356,7 +2382,11 @@ export async function updateWorkspace(
   if (!row) {
     throw new Error(`Workspace not found: ${workspaceId}`);
   }
-  return mapWorkspace(row, await workspaceControlProjection(db, workspaceId));
+  return mapWorkspace(
+    row,
+    await workspaceControlProjection(db, workspaceId),
+    await workspaceKindProjection(db, row),
+  );
 }
 
 // Deep-merge (top-level) a settings patch into workspaces.settings, atomically.
@@ -2417,6 +2447,7 @@ export async function updateWorkspaceSettings(
           return mapWorkspace(
             row,
             await workspaceControlProjection(tx as unknown as Database, workspaceId),
+            await workspaceKindProjection(tx as unknown as Database, row),
           );
         }),
     );
@@ -2432,7 +2463,11 @@ export async function updateWorkspaceSettings(
   if (!row) {
     throw new Error(`Workspace not found: ${workspaceId}`);
   }
-  return mapWorkspace(row, await workspaceControlProjection(db, workspaceId));
+  return mapWorkspace(
+    row,
+    await workspaceControlProjection(db, workspaceId),
+    await workspaceKindProjection(db, row),
+  );
 }
 
 export async function setWorkspaceDefaultRig(
@@ -2451,7 +2486,11 @@ export async function setWorkspaceDefaultRig(
   if (!row) {
     throw new Error(`Workspace not found: ${workspaceId}`);
   }
-  return mapWorkspace(row, await workspaceControlProjection(db, workspaceId));
+  return mapWorkspace(
+    row,
+    await workspaceControlProjection(db, workspaceId),
+    await workspaceKindProjection(db, row),
+  );
 }
 
 export async function getWorkspaceGrant(
@@ -15899,17 +15938,31 @@ async function validateScheduledTargetExecutionAtClaim(
       ),
     )
     .orderBy(asc(schema.sessionMcpServers.serverId));
-  const variableSet = target.variableSetId
-    ? await getVariableSet(
+  const targetVariableSets =
+    target.variableSets.length > 0
+      ? target.variableSets
+      : target.variableSetId && target.variableSetGeneration
+        ? [
+            {
+              id: target.variableSetId,
+              generation: target.variableSetGeneration,
+            },
+          ]
+        : [];
+  const liveVariableSets = await Promise.all(
+    targetVariableSets.map(async (selected) => {
+      const variableSet = await getVariableSet(
         tx,
         {
           accountId: input.accountId,
           workspaceId: input.workspaceId,
           subjectId: accepted.personalResourceAuthoritySubjectId ?? "scheduled-task",
         },
-        target.variableSetId,
-      )
-    : null;
+        selected.id,
+      );
+      return variableSet ? { id: variableSet.id, generation: variableSet.generation } : null;
+    }),
+  );
   const [rigVersion] =
     target.rigId && target.rigVersionId
       ? await tx
@@ -15950,8 +16003,10 @@ async function validateScheduledTargetExecutionAtClaim(
     stableJson(target.toolPolicy) !== stableJson(input.session.toolPolicy) ||
     stableJson(target.mcpServerIds) !== stableJson(mcpServers.map((server) => server.id)) ||
     target.toolPolicyVersion !== input.session.toolPolicyVersion ||
-    target.variableSetId !== (input.session.variableSetId ?? null) ||
-    target.variableSetGeneration !== (variableSet?.generation ?? null) ||
+    stableJson(targetVariableSets) !==
+      stableJson(liveVariableSets.filter((value) => value !== null)) ||
+    stableJson(targetVariableSets.map((variableSet) => variableSet.id)) !==
+      stableJson((input.session.variableSetIds as string[]) ?? []) ||
     target.rigId !== (input.session.rigId ?? null) ||
     target.rigVersionId !== (input.session.rigVersionId ?? null) ||
     stableJson(target.rigDefaultVariableSets) !==
@@ -16339,7 +16394,7 @@ export class VariableSetAttachedError extends Error {
 
   constructor(cause?: unknown) {
     super(
-      "variable set remains attached to a scheduled task or active session",
+      "variable set remains attached to a scheduled task or session",
       cause === undefined ? undefined : { cause },
     );
   }
@@ -16422,8 +16477,14 @@ export async function countActiveSessionsUsingVariableSet(
       .where(
         and(
           eq(schema.sessions.workspaceId, workspaceId),
-          eq(schema.sessions.variableSetId, variableSetId),
-          inArray(schema.sessions.status, ["queued", "running", "requires_action"]),
+          sql`${schema.sessions.variableSetIds} ? ${variableSetId}`,
+          inArray(schema.sessions.status, [
+            "queued",
+            "running",
+            "requires_action",
+            "recovering",
+            "waiting_capacity",
+          ]),
         ),
       );
     return Number(count);
@@ -16528,7 +16589,15 @@ export class RigChangeAlreadyVerifyingError extends Error {
   }
 }
 
+export class RigImageOverrideUnsupportedError extends Error {
+  constructor() {
+    super("Rig image overrides are unsupported; Rigs use the deployment platform sandbox image");
+    this.name = "RigImageOverrideUnsupportedError";
+  }
+}
+
 export type RigVersionContentInput = {
+  /** @deprecated Rig versions always use the deployment platform sandbox image. */
   image?: string | null;
   setupScript?: string | null;
   checks?: RigCheck[];
@@ -16538,6 +16607,12 @@ export type RigVersionContentInput = {
   createdBy?: string | null;
 };
 
+function assertRigUsesPlatformImage(input: RigVersionContentInput | undefined): void {
+  if (input?.image != null) {
+    throw new RigImageOverrideUnsupportedError();
+  }
+}
+
 function mapRigVersion(row: typeof schema.rigVersions.$inferSelect): RigVersion {
   return {
     id: row.id,
@@ -16773,6 +16848,7 @@ export async function createRig(
     initialVersion?: RigVersionContentInput;
   },
 ): Promise<Rig> {
+  assertRigUsesPlatformImage(input.initialVersion);
   if (input.scope !== undefined || input.subjectId !== undefined) {
     return await withRlsContext(
       db,
@@ -16786,7 +16862,7 @@ export async function createRig(
             ${input.accountId}::uuid, ${input.workspaceId}::uuid,
             ${input.scope ?? "workspace"}, ${input.name}, ${input.description ?? null},
             ${input.createdBy ?? null}, ${JSON.stringify({
-              image: content.image ?? null,
+              image: null,
               setupScript: content.setupScript ?? null,
               checks: content.checks ?? [],
               credentialHooks: content.credentialHooks ?? [],
@@ -16826,7 +16902,7 @@ export async function createRig(
           workspaceId: input.workspaceId,
           rigId: rigRow.id,
           version: 1,
-          image: content.image ?? null,
+          image: null,
           setupScript: content.setupScript ?? null,
           checks: content.checks ?? [],
           credentialHooks: content.credentialHooks ?? [],
@@ -17180,6 +17256,66 @@ function isSessionChannelFkViolation(error: unknown): boolean {
   );
 }
 
+const sessionVariableSetSelectionFkConstraints = new Set([
+  // Legacy final-entry mirror on sessions.variable_set_id.
+  "sessions_environment_id_fkey",
+  // Ordered attachment projection populated by the session INSERT/UPDATE trigger.
+  "session_variable_set_attachments_variable_set_id_fkey",
+]);
+
+/** A selected Variable Set disappeared after validation; unrelated FKs stay loud. */
+function isSessionVariableSetSelectionFkViolation(error: unknown): boolean {
+  return (
+    nestedPostgresSqlState(error) === "23503" &&
+    sessionVariableSetSelectionFkConstraints.has(safeDatabaseErrorFacts(error).constraint ?? "")
+  );
+}
+
+export class SessionVariableSetSelectionUnavailableError extends Error {
+  readonly variableSetIds: string[];
+
+  constructor(variableSetIds: string[], cause?: unknown) {
+    super(
+      "One or more selected Variable Sets are no longer available.",
+      cause === undefined ? undefined : { cause },
+    );
+    this.name = "SessionVariableSetSelectionUnavailableError";
+    this.variableSetIds = variableSetIds;
+  }
+}
+
+async function translateSessionVariableSetSelectionCreateError(
+  db: Database,
+  input: SessionCreateInput,
+  error: unknown,
+): Promise<never> {
+  if (!isSessionVariableSetSelectionFkViolation(error) || !input.subjectId) throw error;
+
+  // The failed create transaction, including its session row and projection
+  // trigger, has rolled back. Resolve the exact requested identities under the
+  // original account/workspace/subject RLS scope before translating the known
+  // FK race. If every identity is still available, preserve the original
+  // integrity failure so an unrelated defect cannot be hidden.
+  const variableSetIds = [
+    ...new Set(input.variableSetIds ?? (input.variableSetId ? [input.variableSetId] : [])),
+  ];
+  const unavailableVariableSetIds: string[] = [];
+  for (const variableSetId of variableSetIds) {
+    const current = await getVariableSet(
+      db,
+      {
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        subjectId: input.subjectId,
+      },
+      variableSetId,
+    );
+    if (!current) unavailableVariableSetIds.push(variableSetId);
+  }
+  if (unavailableVariableSetIds.length === 0) throw error;
+  throw new SessionVariableSetSelectionUnavailableError(unavailableVariableSetIds, error);
+}
+
 function mapChannel(row: typeof schema.channels.$inferSelect): Channel {
   return {
     id: row.id,
@@ -17422,6 +17558,311 @@ export async function setSessionChannel(
   });
 }
 
+export type UpdateSessionVariableSetsResult =
+  | { status: "updated"; event: SessionEvent }
+  | { status: "unchanged" }
+  | { status: "invalid_variable_sets"; variableSetIds: string[] }
+  | {
+      status: "blocked";
+      reason: "turn_in_flight" | "shared_sandbox_group" | "live_sandbox_holders";
+    }
+  | { status: "not_found" };
+
+/**
+ * Replace the complete ordered session Variable Set selection at a quiescent
+ * turn boundary. The session row + FK-backed attachment trigger + audit/event
+ * evidence commit together. A live managed box is fenced for rotation so its
+ * baked environment can never serve the next turn after a detach.
+ */
+export async function updateSessionVariableSets(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    subjectId: string;
+    variableSets: Array<{
+      id: string;
+      name: string;
+      scope: VariableSet["scope"];
+    }>;
+  },
+): Promise<UpdateSessionVariableSetsResult> {
+  return await withWorkspaceSubjectSessionActivityRls<UpdateSessionVariableSetsResult>(
+    db,
+    input.workspaceId,
+    input.subjectId,
+    async (scopedDb) =>
+      await scopedDb.transaction(async (rawTx) => {
+        const tx = rawTx as unknown as Database;
+        const locks = await lockSessionEventWriteRows(tx, {
+          workspaceId: input.workspaceId,
+          controlLock: "share",
+          sessionIds: [input.sessionId],
+        });
+        const session = locks.sessions[0];
+        if (!session || session.accountId !== input.accountId) return { status: "not_found" };
+        // Prompt admission and turn claim both take the same session-row lock
+        // before creating or claiming work. Inspect the complete tenancy
+        // quiescence set while that lock is held so an accepted queued turn can
+        // neither slip through this mutation nor be admitted against the old
+        // Variable Set selection after this transaction commits.
+        const [pendingWork] = await rawRows<{ blocker: string | null }>(
+          tx,
+          sql`select case
+            when ${session.activeTurnId}::uuid is not null
+              or exists (select 1 from ${schema.sessionTurns} turn_row
+                where turn_row.workspace_id = ${input.workspaceId}
+                  and turn_row.session_id = ${input.sessionId}
+                  and turn_row.status in (
+                    'queued', 'running', 'requires_action', 'recovering', 'waiting_capacity'
+                  ))
+              then 'nonterminal_turn'
+            when exists (select 1 from ${schema.sessionTurnAttempts} attempt_row
+                where attempt_row.workspace_id = ${input.workspaceId}
+                  and attempt_row.session_id = ${input.sessionId}
+                  and attempt_row.state <> 'closed')
+              then 'nonterminal_attempt'
+            when exists (select 1 from ${schema.sessionAttemptInterruptions} interruption_row
+                where interruption_row.workspace_id = ${input.workspaceId}
+                  and interruption_row.session_id = ${input.sessionId}
+                  and interruption_row.state in ('pending', 'delivered', 'acknowledged'))
+              then 'unsettled_interruption'
+            when exists (select 1 from ${schema.sessionSystemUpdates} update_row
+                where update_row.workspace_id = ${input.workspaceId}
+                  and update_row.session_id = ${input.sessionId}
+                  and update_row.state = 'pending')
+              then 'pending_system_update'
+            when exists (select 1 from ${schema.sessionHumanInputRequests} request_row
+                where request_row.workspace_id = ${input.workspaceId}
+                  and request_row.session_id = ${input.sessionId}
+                  and request_row.status = 'pending')
+              then 'pending_human_input'
+            when exists (select 1 from ${schema.sessionPendingToolCalls} tool_row
+                where tool_row.workspace_id = ${input.workspaceId}
+                  and tool_row.session_id = ${input.sessionId})
+              then 'pending_tool_receipt'
+            when exists (select 1 from ${schema.agentRunStates} run_state
+                where run_state.workspace_id = ${input.workspaceId}
+                  and run_state.session_id = ${input.sessionId})
+              then 'run_state'
+            when exists (select 1 from ${schema.sessionGoals} goal_row
+                where goal_row.workspace_id = ${input.workspaceId}
+                  and goal_row.session_id = ${input.sessionId}
+                  and goal_row.status = 'active')
+              then 'active_goal'
+            when exists (select 1 from ${schema.codexCapacityWaiters} codex_waiter
+                where codex_waiter.workspace_id = ${input.workspaceId}
+                  and codex_waiter.session_id = ${input.sessionId}
+                  and codex_waiter.status = 'waiting')
+              or exists (select 1 from ${schema.xaiCapacityWaiters} xai_waiter
+                where xai_waiter.workspace_id = ${input.workspaceId}
+                  and xai_waiter.session_id = ${input.sessionId}
+                  and xai_waiter.status = 'waiting')
+              then 'capacity_waiter'
+            when exists (select 1 from ${schema.sessionRealtimeModes} realtime_mode
+                where realtime_mode.workspace_id = ${input.workspaceId}
+                  and realtime_mode.session_id = ${input.sessionId}
+                  and realtime_mode.state = 'active')
+              or exists (select 1 from ${schema.sessionRealtimeConnections} realtime_connection
+                where realtime_connection.workspace_id = ${input.workspaceId}
+                  and realtime_connection.session_id = ${input.sessionId}
+                  and realtime_connection.state in ('negotiating', 'ready', 'active'))
+              then 'active_realtime'
+            when exists (select 1 from ${schema.scheduledTasks} scheduled_task
+                where scheduled_task.workspace_id = ${input.workspaceId}
+                  and scheduled_task.reusable_session_id = ${input.sessionId}
+                  and scheduled_task.status = 'active')
+              then 'active_scheduled_task'
+            when exists (select 1 from ${schema.sandboxWorkspaceMutationAdmissions} admission_row
+                where admission_row.workspace_id = ${input.workspaceId}
+                  and admission_row.session_id = ${input.sessionId}
+                  and admission_row.settled_at is null)
+              then 'workspace_mutation_admission'
+            when exists (select 1 from ${schema.sandboxRetainedProcesses} process_row
+                where process_row.workspace_id = ${input.workspaceId}
+                  and process_row.session_id = ${input.sessionId}
+                  and process_row.state = 'active')
+              then 'retained_process'
+            else null
+          end as blocker`,
+        );
+        if (pendingWork?.blocker !== null && pendingWork?.blocker !== undefined) {
+          return { status: "blocked", reason: "turn_in_flight" };
+        }
+        const [groupCount] = await rawRows<{ count: number }>(
+          tx,
+          sql`select count(*)::int as count
+          from sessions
+          where workspace_id = ${input.workspaceId}
+            and sandbox_group_id = ${session.sandboxGroupId}`,
+        );
+        if (Number(groupCount?.count ?? 0) > 1) {
+          return { status: "blocked", reason: "shared_sandbox_group" };
+        }
+        // Serialize with the get-or-create admission path even when this group
+        // has never materialized a lease row. Once a row exists, lock it too:
+        // every ordinary holder acquire and retained-process promotion takes
+        // that row lock before publishing its holder.
+        await lockSandboxLeaseAdmission(tx, input.workspaceId, session.sandboxGroupId);
+        await tx.execute(sql`select id
+          from sandbox_leases
+          where workspace_id = ${input.workspaceId}
+            and sandbox_group_id = ${session.sandboxGroupId}
+          for update`);
+        const [holderCount] = await rawRows<{ count: number }>(
+          tx,
+          sql`select count(*)::int as count
+          from sandbox_lease_holders holder
+          join sandbox_leases lease on lease.id = holder.lease_id
+          where lease.workspace_id = ${input.workspaceId}
+            and lease.sandbox_group_id = ${session.sandboxGroupId}`,
+        );
+        if (Number(holderCount?.count ?? 0) > 0) {
+          return { status: "blocked", reason: "live_sandbox_holders" };
+        }
+
+        const previousIds =
+          (session.variableSetIds as string[]) ??
+          (session.variableSetId ? [session.variableSetId] : []);
+        const nextIds = input.variableSets.map((variableSet) => variableSet.id);
+        if (stableJson(previousIds) === stableJson(nextIds)) {
+          return { status: "unchanged" };
+        }
+
+        const now = new Date();
+        await tx
+          .update(schema.sessions)
+          .set({
+            variableSetIds: nextIds,
+            variableSetId: nextIds.at(-1) ?? null,
+            updatedAt: now,
+          })
+          .where(
+            and(
+              eq(schema.sessions.workspaceId, input.workspaceId),
+              eq(schema.sessions.id, input.sessionId),
+            ),
+          );
+        await tx.execute(sql`update sandbox_leases set
+          rotation_requested_at = coalesce(rotation_requested_at, now()),
+          rotation_reason = coalesce(rotation_reason, 'operator'),
+          expires_at = least(expires_at, now()),
+          updated_at = now()
+        where workspace_id = ${input.workspaceId}
+          and sandbox_group_id = ${session.sandboxGroupId}
+          and liveness <> 'cold'`);
+
+        const previous = new Set(previousIds);
+        const next = new Set(nextIds);
+        const addedIds = nextIds.filter((id) => !previous.has(id));
+        const removedIds = previousIds.filter((id) => !next.has(id));
+        const sequence = session.lastSequence + 1;
+        const [eventRow] = await tx
+          .insert(schema.sessionEvents)
+          .values(
+            withLosslessContentWriteVersion(
+              {
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                sessionId: input.sessionId,
+                sequence,
+                type: "session.variable_sets.updated",
+                payload: {
+                  actor: input.subjectId,
+                  variableSets: input.variableSets,
+                  addedIds,
+                  removedIds,
+                  collisionPolicy: "later_selected_set_wins",
+                  effectiveOn: "next_turn_or_sandbox_operation",
+                },
+                occurredAt: now,
+              },
+              "payload",
+              "payloadCodecVersion",
+            ),
+          )
+          .returning();
+        if (!eventRow) throw new Error("Failed to append session Variable Set update event");
+        await tx
+          .update(schema.sessions)
+          .set({ lastSequence: sequence })
+          .where(
+            and(
+              eq(schema.sessions.workspaceId, input.workspaceId),
+              eq(schema.sessions.id, input.sessionId),
+            ),
+          );
+        const auditChanges = [
+          ...addedIds.map((id) => ({
+            action: "session.variable_set.attached",
+            id,
+          })),
+          ...removedIds.map((id) => ({
+            action: "session.variable_set.detached",
+            id,
+          })),
+          ...(addedIds.length === 0 && removedIds.length === 0
+            ? [
+                {
+                  action: "session.variable_sets.reordered",
+                  id: input.sessionId,
+                },
+              ]
+            : []),
+        ];
+        await tx.insert(schema.auditEvents).values(
+          auditChanges.map(({ action, id }) =>
+            withLosslessContentWriteVersion(
+              {
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                subjectId: input.subjectId,
+                action,
+                targetType: "session",
+                targetId: input.sessionId,
+                metadata: {
+                  sessionId: input.sessionId,
+                  ...(action === "session.variable_sets.reordered"
+                    ? { variableSetIds: nextIds }
+                    : { variableSetId: id }),
+                },
+              },
+              "metadata",
+              "metadataCodecVersion",
+            ),
+          ),
+        );
+        return { status: "updated", event: mapEvent(eventRow) };
+      }),
+  ).catch(async (error: unknown) => {
+    if (!isSessionVariableSetSelectionFkViolation(error)) throw error;
+
+    // The failed transaction, including the session row, projection trigger,
+    // lease rotation, event, and audit writes, has rolled back. Re-resolve the
+    // exact requested identities under the same tenant/subject authority so a
+    // concurrent revoke/delete is translated without masking any other FK bug.
+    const unavailableVariableSetIds: string[] = [];
+    for (const variableSet of input.variableSets) {
+      const current = await getVariableSet(
+        db,
+        {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          subjectId: input.subjectId,
+        },
+        variableSet.id,
+      );
+      if (!current) unavailableVariableSetIds.push(variableSet.id);
+    }
+    if (unavailableVariableSetIds.length === 0) throw error;
+    return {
+      status: "invalid_variable_sets",
+      variableSetIds: unavailableVariableSetIds,
+    };
+  });
+}
+
 export async function countRigs(
   db: Database,
   access: string | RigAccessContext,
@@ -17473,6 +17914,7 @@ export async function createRigVersion(
   input: RigVersionContentInput,
   options: { activate?: boolean } = {},
 ): Promise<RigVersion> {
+  assertRigUsesPlatformImage(input);
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [rig] = await scopedDb
       .select({ id: schema.rigs.id, accountId: schema.rigs.accountId })
@@ -17511,7 +17953,7 @@ export async function createRigVersion(
         workspaceId,
         rigId,
         version: nextVersion,
-        image: input.image ?? null,
+        image: null,
         setupScript: input.setupScript ?? null,
         checks: input.checks ?? [],
         credentialHooks: input.credentialHooks ?? [],
@@ -17543,6 +17985,7 @@ export async function createRigVersionForChangePromotion(
     providerImages?: RigProviderImages;
   },
 ): Promise<{ version: RigVersion; change: RigChange }> {
+  assertRigUsesPlatformImage(input);
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [rig] = await scopedDb
       .select({ id: schema.rigs.id, accountId: schema.rigs.accountId })
@@ -17627,7 +18070,7 @@ export async function createRigVersionForChangePromotion(
         workspaceId,
         rigId,
         version: nextVersion,
-        image: input.image ?? null,
+        image: null,
         setupScript: input.setupScript ?? null,
         checks: input.checks ?? [],
         credentialHooks: input.credentialHooks ?? [],
@@ -17948,9 +18391,9 @@ async function retainRigProviderImageArtifacts(
 
 /**
  * Claim the one provider-image build slot for an existing immutable rig
- * version. A finalized ready image is never overwritten in place: if the
- * effective base/content identity changed, callers must mint/verify a new rig
- * version and runtime setup remains the truthful fallback for this one.
+ * version. The setup hash fences definition drift. Deployment base-image and
+ * provider-image protocol rotations may replace operational metadata for the
+ * same setup; late finalizers remain fenced by the build request id.
  */
 export async function claimRigVersionProviderImageBuild(
   db: Database,
@@ -17987,22 +18430,24 @@ export async function claimRigVersionProviderImageBuild(
         existing.contentHash === candidate.contentHash &&
         existing.setupHash === candidate.setupHash &&
         existing.sourceImage === candidate.sourceImage;
+      const sameSetup = existing.setupHash === candidate.setupHash;
       if (existing.status === "ready") {
-        if (!sameContent) return { status: "conflict", image: existing };
-        const retained = await retainRigProviderImageArtifacts(scopedDb, input.workspaceId, {
-          [existing.backend]: existing,
-        });
-        if (retained[existing.backend] && existing.coldBootValidation?.version === 1) {
-          return { status: "ready", image: existing };
+        if (sameContent) {
+          const retained = await retainRigProviderImageArtifacts(scopedDb, input.workspaceId, {
+            [existing.backend]: existing,
+          });
+          if (retained[existing.backend] && existing.coldBootValidation?.version === 1) {
+            return { status: "ready", image: existing };
+          }
         }
       }
       if (existing.status === "unsupported" && sameContent && !input.retryUnsupported) {
         return { status: "unsupported", image: existing };
       }
-      if (!sameContent) {
+      if (!sameContent && !sameSetup) {
         return { status: "conflict", image: existing };
       }
-      if (existing.status === "building") {
+      if (sameContent && existing.status === "building") {
         const startedAtMs = Date.parse(existing.startedAt);
         if (
           Number.isFinite(startedAtMs) &&
@@ -26912,6 +27357,7 @@ export type SessionCreateInput = {
   reasoningEffort: ReasoningEffort;
   latencyMode: LatencyMode;
   sandboxBackend: SandboxBackend;
+  variableSetIds?: string[];
   variableSetId?: string | null;
   rigId?: string | null;
   rigVersionId?: string | null;
@@ -27292,6 +27738,8 @@ async function createSessionInTransaction(
   input: SessionCreateInput,
   id: string,
 ): Promise<SessionCreateResult> {
+  const variableSetIds = input.variableSetIds ?? (input.variableSetId ? [input.variableSetId] : []);
+  const variableSetId = variableSetIds.at(-1) ?? null;
   const createIdempotencyKey = input.createIdempotencyKey ?? null;
   const createRequestedVisibility = input.visibility ?? "workspace_shared";
   if (createRequestedVisibility === "user_private") {
@@ -27347,6 +27795,9 @@ async function createSessionInTransaction(
       ) {
         throw new SessionCreateIdempotencyConflictError();
       }
+      if (stableJson(existing.variableSetIds ?? []) !== stableJson(variableSetIds)) {
+        throw new SessionCreateIdempotencyConflictError();
+      }
       if (existing.createRequestedVisibility !== createRequestedVisibility) {
         throw new SessionCreateIdempotencyConflictError();
       }
@@ -27457,6 +27908,8 @@ async function createSessionInTransaction(
             workspaceId: input.workspaceId,
             initialMessage: input.initialMessage,
             initialModelContext: input.initialModelContext ?? null,
+            title: AUTOMATIC_SESSION_TITLE_FALLBACK,
+            titleSource: "agent",
             resources: input.resources,
             skills: input.skills ?? [],
             tools: input.tools ?? [],
@@ -27478,7 +27931,8 @@ async function createSessionInTransaction(
             sandboxBackend: input.sandboxBackend,
             sandboxOs: input.sandboxOs ?? "linux",
             sandboxGroupId: input.sandboxGroupId ?? id,
-            variableSetId: input.variableSetId ?? null,
+            variableSetIds,
+            variableSetId,
             rigId: input.rigId ?? null,
             rigVersionId: input.rigVersionId ?? null,
             channelId: input.channelId ?? null,
@@ -27546,6 +28000,9 @@ async function createSessionInTransaction(
         ) {
           throw new SessionCreateIdempotencyConflictError();
         }
+        if (stableJson(existing.variableSetIds ?? []) !== stableJson(variableSetIds)) {
+          throw new SessionCreateIdempotencyConflictError();
+        }
         if (existing.createRequestedVisibility !== createRequestedVisibility) {
           throw new SessionCreateIdempotencyConflictError();
         }
@@ -27597,15 +28054,20 @@ export async function createSession(db: Database, input: SessionCreateInput): Pr
   // Generate the id up front so the same uuid can seed sandbox_group_id for a
   // singleton group (sandbox_group_id cannot SQL-default to id).
   const id = input.requestedSessionId ?? crypto.randomUUID();
-  const result = await withSessionActivityRlsContext(
-    db,
-    { accountId: input.accountId, workspaceId: input.workspaceId },
-    async (scopedDb) =>
-      await withSessionActivitySavepoint(
-        scopedDb,
-        async (tx) => await createSessionInTransaction(tx, input, id),
-      ),
-  );
+  let result: SessionCreateResult;
+  try {
+    result = await withSessionActivityRlsContext(
+      db,
+      { accountId: input.accountId, workspaceId: input.workspaceId },
+      async (scopedDb) =>
+        await withSessionActivitySavepoint(
+          scopedDb,
+          async (tx) => await createSessionInTransaction(tx, input, id),
+        ),
+    );
+  } catch (error) {
+    return await translateSessionVariableSetSelectionCreateError(db, input, error);
+  }
   if (result.denied) {
     // Throw only after withRlsContext's outer transaction commits the denial.
     throw new SessionSpawnDeniedDbError(result.denial);
@@ -27630,15 +28092,19 @@ export async function createSessionWithIdempotencyKeyResult(
   // Generate the id up front so the same uuid can seed sandbox_group_id for a
   // singleton group (sandbox_group_id cannot SQL-default to id).
   const id = input.requestedSessionId ?? crypto.randomUUID();
-  return await withSessionActivityRlsContext(
-    db,
-    { accountId: input.accountId, workspaceId: input.workspaceId },
-    async (scopedDb) =>
-      await withSessionActivitySavepoint(
-        scopedDb,
-        async (tx) => await createSessionInTransaction(tx, input, id),
-      ),
-  );
+  try {
+    return await withSessionActivityRlsContext(
+      db,
+      { accountId: input.accountId, workspaceId: input.workspaceId },
+      async (scopedDb) =>
+        await withSessionActivitySavepoint(
+          scopedDb,
+          async (tx) => await createSessionInTransaction(tx, input, id),
+        ),
+    );
+  } catch (error) {
+    return await translateSessionVariableSetSelectionCreateError(db, input, error);
+  }
 }
 
 /**
@@ -28322,6 +28788,26 @@ export async function listDistinctVariableSetIdsInGroup(
   });
 }
 
+/** Ordered Variable Set selections across every member of a sandbox group. */
+export async function listDistinctVariableSetSelectionsInGroup(
+  db: Database,
+  workspaceId: string,
+  sandboxGroupId: string,
+): Promise<string[][]> {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const rows = await scopedDb
+      .selectDistinct({ variableSetIds: schema.sessions.variableSetIds })
+      .from(schema.sessions)
+      .where(
+        and(
+          eq(schema.sessions.workspaceId, workspaceId),
+          eq(schema.sessions.sandboxGroupId, sandboxGroupId),
+        ),
+      );
+    return rows.map((row) => (row.variableSetIds as string[]) ?? []);
+  });
+}
+
 // M3 rig sharing gate: the distinct frozen rig_version_ids across a group's
 // sessions. Mirrors listDistinctVariableSetIdsInGroup — the box's rig-baked
 // setup is fixed at cold-create, so a session joining a group must carry the
@@ -36282,6 +36768,24 @@ async function upsertLeaseHolder(
   `);
 }
 
+/**
+ * Fence first lease materialization against control-plane mutations that must
+ * prove the sandbox group has no holders. The lease-row lock remains the
+ * canonical holder lock once the row exists; this advisory lock covers only
+ * the otherwise-unlockable absent-row window.
+ */
+async function lockSandboxLeaseAdmission(
+  tx: Database,
+  workspaceId: string,
+  sandboxGroupId: string,
+): Promise<void> {
+  await tx.execute(
+    sql`select pg_advisory_xact_lock(hashtextextended(
+      ${`sandbox-lease-admission:${workspaceId}:${sandboxGroupId}`}, 0
+    ))`,
+  );
+}
+
 // §4.1 — the get-or-create critical section. ONE transaction:
 // insert-or-nothing -> SELECT … FOR UPDATE (block, not skip) -> branch -> bump.
 // The single most load-bearing function: the sole double-spawn guard.
@@ -36304,6 +36808,7 @@ async function acquireLeaseOnce(
         const tx = txRaw as unknown as Database;
         const image = input.image ?? null;
         const rigVersionId = input.rigVersionId ?? null;
+        await lockSandboxLeaseAdmission(tx, workspaceId, sandboxGroupId);
         // (1) Materialize the singleton row if absent. ON CONFLICT DO NOTHING + the
         // unique index = idempotent under a race; concurrent inserts collapse to
         // one row. expires_at seeded so a never-warmed cold row has a valid TTL. The
@@ -52777,10 +53282,21 @@ export async function recordSessionGoalProgressWithEvent(
 }
 
 /**
- * Sets a session's display title. The clobber guard lives entirely in this
- * single atomic UPDATE: a user-set title is permanent, so agent/auto writes
- * carry an `AND title_source IS DISTINCT FROM 'user'` guard (NULL-safe in
- * Postgres) while user writes are unconditional. Never read-modify-write.
+ * Low-level row-only session-title update used by database-specific callers and
+ * tests. Public product writers should use `updateSessionTitleWithEvent` so the
+ * observable event commits atomically with this state transition. The clobber
+ * guard lives entirely in this single atomic UPDATE: a user-set title is
+ * permanent, so agent/auto writes
+ * are first normalized through the shared short/sensitive-safe automatic-title
+ * policy, then carry an `AND title_source IS DISTINCT FROM 'user'` guard
+ * (NULL-safe in Postgres) while user writes are unconditional. Automatic
+ * writes also bind the exact normalized candidate to a transaction-local
+ * database capability, so a pre-policy binary cannot bypass normalization
+ * during a rolling deployment. Never read-modify-write.
+ *
+ * `expectedCurrent`, when supplied, is an additional NULL-safe compare-and-set
+ * fence. It is used by stale/retry-prone producers such as scheduled dispatch:
+ * the write succeeds only if both the durable title and source still match.
  * Re-applying the exact title is also a no-op so a confused agent cannot churn
  * `updated_at` every turn. Returns `{ updated, title }`: `updated` is false when
  * the value was unchanged or an agent write was skipped because a user title
@@ -52794,13 +53310,37 @@ export async function updateSessionTitle(
     sessionId: string;
     title: string;
     source: "user" | "agent";
+    expectedCurrent?: {
+      title: string | null;
+      source: "user" | "agent" | null;
+    };
   },
 ): Promise<{ updated: boolean; title: string | null }> {
   return await withWorkspaceSessionActivityRls(db, input.workspaceId, async (scopedDb) => {
+    const title =
+      input.source === "agent" ? normalizeAutomaticSessionTitle(input.title) : input.title;
+    if (title === null) {
+      const [existing] = await scopedDb
+        .select({ title: schema.sessions.title })
+        .from(schema.sessions)
+        .where(
+          and(
+            eq(schema.sessions.workspaceId, input.workspaceId),
+            eq(schema.sessions.id, input.sessionId),
+          ),
+        )
+        .limit(1);
+      return { updated: false, title: existing?.title ?? null };
+    }
+    if (input.source === "agent") {
+      await scopedDb.execute(
+        sql`select pg_catalog.set_config('opengeni.automatic_session_title_v1_candidate', ${title}, true)`,
+      );
+    }
     const [row] = await scopedDb
       .update(schema.sessions)
       .set({
-        title: input.title,
+        title,
         titleSource: input.source,
         updatedAt: new Date(),
       })
@@ -52808,10 +53348,16 @@ export async function updateSessionTitle(
         and(
           eq(schema.sessions.workspaceId, input.workspaceId),
           eq(schema.sessions.id, input.sessionId),
-          sql`${schema.sessions.title} is distinct from ${input.title}`,
+          sql`${schema.sessions.title} is distinct from ${title}`,
           ...(input.source === "agent"
             ? [sql`${schema.sessions.titleSource} is distinct from 'user'`]
             : []),
+          ...(input.expectedCurrent
+            ? [
+                sql`${schema.sessions.title} is not distinct from ${input.expectedCurrent.title}`,
+                sql`${schema.sessions.titleSource} is not distinct from ${input.expectedCurrent.source}`,
+              ]
+            : []),
         ),
       )
       .returning({ title: schema.sessions.title });
@@ -52832,6 +53378,113 @@ export async function updateSessionTitle(
   });
 }
 
+/**
+ * Atomically set a session title and append its public `session.title_set`
+ * event under the canonical workspace/session event-write lock. The row CAS,
+ * durable sequence, and event either all commit or all roll back, so a newer
+ * title writer can never commit between the authoritative update and an older
+ * event append.
+ *
+ * Exact retries are naturally idempotent: the unchanged-title predicate (and,
+ * for stale producers, `expectedCurrent`) makes a committed retry a no-op with
+ * no duplicate event. Automatic titles retain the rolling-deployment trigger's
+ * exact transaction-local candidate capability.
+ */
+export async function updateSessionTitleWithEvent(
+  db: Database,
+  input: {
+    workspaceId: string;
+    sessionId: string;
+    title: string;
+    source: "user" | "agent";
+    expectedCurrent?: {
+      title: string | null;
+      source: "user" | "agent" | null;
+    };
+  },
+): Promise<{ updated: boolean; title: string | null; events: SessionEvent[] }> {
+  const title =
+    input.source === "agent" ? normalizeAutomaticSessionTitle(input.title) : input.title;
+  return await retryWorkspaceSessionEventActivityPersistence(
+    db,
+    input.workspaceId,
+    true,
+    {
+      stage: "session_title.update_with_event",
+      eventTypes: ["session.title_set"],
+      maxAttempts: 3,
+    },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (tx) => {
+        const locks = await lockSessionEventWriteRows(tx as unknown as Database, {
+          workspaceId: input.workspaceId,
+          controlLock: "none",
+          sessionIds: [input.sessionId],
+        });
+        const session = locks.sessions[0];
+        if (!session) return { updated: false, title: null, events: [] };
+        if (title === null) {
+          return { updated: false, title: session.title, events: [] };
+        }
+        if (input.source === "agent") {
+          await tx.execute(
+            sql`select pg_catalog.set_config('opengeni.automatic_session_title_v1_candidate', ${title}, true)`,
+          );
+        }
+        const now = new Date();
+        const sequence = session.lastSequence + 1;
+        const [updated] = await tx
+          .update(schema.sessions)
+          .set({
+            title,
+            titleSource: input.source,
+            lastSequence: sequence,
+            updatedAt: now,
+          })
+          .where(
+            and(
+              eq(schema.sessions.workspaceId, input.workspaceId),
+              eq(schema.sessions.id, input.sessionId),
+              sql`${schema.sessions.title} is distinct from ${title}`,
+              ...(input.source === "agent"
+                ? [sql`${schema.sessions.titleSource} is distinct from 'user'`]
+                : []),
+              ...(input.expectedCurrent
+                ? [
+                    sql`${schema.sessions.title} is not distinct from ${input.expectedCurrent.title}`,
+                    sql`${schema.sessions.titleSource} is not distinct from ${input.expectedCurrent.source}`,
+                  ]
+                : []),
+            ),
+          )
+          .returning({ title: schema.sessions.title });
+        if (!updated) {
+          return { updated: false, title: session.title, events: [] };
+        }
+        const [event] = await tx
+          .insert(schema.sessionEvents)
+          .values(
+            withLosslessContentWriteVersion(
+              {
+                accountId: session.accountId,
+                workspaceId: input.workspaceId,
+                sessionId: input.sessionId,
+                sequence,
+                type: "session.title_set",
+                payload: { title: updated.title ?? title, source: input.source },
+                occurredAt: now,
+              },
+              "payload",
+              "payloadCodecVersion",
+            ),
+          )
+          .returning();
+        if (!event) throw new Error("Failed to append session.title_set event");
+        return { updated: true, title: updated.title, events: [mapEvent(event)] };
+      }),
+  );
+}
+
 /**
  * Status transition helper. Idempotent: requesting the current status returns
  * `changed: false` so callers can skip emitting a duplicate event. `completed`
@@ -56986,17 +57639,33 @@ export async function claimSessionWorkForAttempt(
                   ),
                 )
                 .orderBy(asc(schema.sessionMcpServers.serverId));
-              const targetVariableSet = targetPolicy.variableSetId
-                ? await getVariableSet(
+              const targetVariableSets =
+                targetPolicy.variableSets.length > 0
+                  ? targetPolicy.variableSets
+                  : targetPolicy.variableSetId && targetPolicy.variableSetGeneration
+                    ? [
+                        {
+                          id: targetPolicy.variableSetId,
+                          generation: targetPolicy.variableSetGeneration,
+                        },
+                      ]
+                    : [];
+              const liveVariableSets = await Promise.all(
+                targetVariableSets.map(async (selected) => {
+                  const variableSet = await getVariableSet(
                     tx as unknown as Database,
                     {
                       accountId: session.accountId,
                       workspaceId,
                       subjectId: accepted.personalResourceAuthoritySubjectId ?? "scheduled-task",
                     },
-                    targetPolicy.variableSetId,
-                  )
-                : null;
+                    selected.id,
+                  );
+                  return variableSet
+                    ? { id: variableSet.id, generation: variableSet.generation }
+                    : null;
+                }),
+              );
               if (
                 targetPolicy.sessionId !== sessionId ||
                 targetPolicy.visibility !== session.visibility ||
@@ -57009,8 +57678,10 @@ export async function claimSessionWorkForAttempt(
                 stableJson(targetPolicy.mcpServerIds) !==
                   stableJson(targetMcpServers.map((server) => server.id)) ||
                 targetPolicy.toolPolicyVersion !== session.toolPolicyVersion ||
-                targetPolicy.variableSetId !== (session.variableSetId ?? null) ||
-                targetPolicy.variableSetGeneration !== (targetVariableSet?.generation ?? null) ||
+                stableJson(targetVariableSets) !==
+                  stableJson(liveVariableSets.filter((value) => value !== null)) ||
+                stableJson(targetVariableSets.map((variableSet) => variableSet.id)) !==
+                  stableJson((session.variableSetIds as string[]) ?? []) ||
                 targetPolicy.rigId !== (session.rigId ?? null) ||
                 targetPolicy.rigVersionId !== (session.rigVersionId ?? null) ||
                 targetPolicy.maxNestedAgentDepthOverride !==
@@ -62478,6 +63149,7 @@ export async function getScheduledTargetSessionExecution(
         firstPartyMcpPermissions: schema.sessions.firstPartyMcpPermissions,
         toolPolicy: schema.sessions.toolPolicy,
         toolPolicyVersion: schema.sessions.toolPolicyVersion,
+        variableSetIds: schema.sessions.variableSetIds,
         variableSetId: schema.sessions.variableSetId,
         rigId: schema.sessions.rigId,
         rigVersionId: schema.sessions.rigVersionId,
@@ -62500,8 +63172,9 @@ export async function getScheduledTargetSessionExecution(
       )
       .orderBy(asc(schema.sessionMcpServers.serverId));
     const latestStarted = await latestStartedSessionTurnRow(scopedDb, workspaceId, sessionId);
-    const variableSet = session.variableSetId
-      ? await getVariableSet(
+    const variableSets = await Promise.all(
+      ((session.variableSetIds as string[]) ?? []).map(async (variableSetId) => {
+        const variableSet = await getVariableSet(
           scopedDb,
           {
             accountId: session.accountId,
@@ -62510,12 +63183,14 @@ export async function getScheduledTargetSessionExecution(
             // user-owned sets resolve only for the frozen causal subject.
             subjectId: authoritySubjectId ?? "scheduled-task",
           },
-          session.variableSetId,
-        )
-      : null;
-    if (session.variableSetId && !variableSet) {
-      throw new Error("scheduled target session variable set is unavailable");
-    }
+          variableSetId,
+        );
+        if (!variableSet) {
+          throw new Error(`scheduled target session Variable Set is unavailable: ${variableSetId}`);
+        }
+        return { id: variableSet.id, generation: variableSet.generation };
+      }),
+    );
     const rigMetadata =
       session.rigId && session.rigVersionId
         ? await getScheduledScopedRigVersionMetadata(
@@ -62573,8 +63248,9 @@ export async function getScheduledTargetSessionExecution(
       mcpServerIds: targetMcpServers.map((server) => server.id),
       effectiveMcpServerIds: targetMcpServers.map((server) => server.id),
       toolPolicyVersion: session.toolPolicyVersion,
+      variableSets,
       variableSetId: session.variableSetId ?? null,
-      variableSetGeneration: variableSet?.generation ?? null,
+      variableSetGeneration: variableSets.at(-1)?.generation ?? null,
       rigId: session.rigId ?? null,
       rigVersionId: session.rigVersionId ?? null,
       rigDefaultVariableSets,
@@ -63357,6 +64033,93 @@ export async function claimPendingSessionSystemUpdateOutbox(
   return deliveries;
 }
 
+export type AutomaticSessionTitleFanoutDelivery = {
+  outboxId: string;
+  event: SessionEvent;
+};
+
+/**
+ * Claim migration-created title events for deployment-wide NATS fanout. The
+ * function is SECURITY DEFINER because one control worker drains obligations
+ * across workspaces; callers receive only the exact already-public event
+ * projection, never arbitrary session rows.
+ */
+export async function claimAutomaticSessionTitleFanout(
+  db: Database,
+  limit = 100,
+): Promise<AutomaticSessionTitleFanoutDelivery[]> {
+  const rows = await rawRows<{
+    outbox_id: string;
+    workspace_id: string;
+    session_id: string;
+    event_id: string;
+    sequence: number;
+    type: string;
+    payload: unknown;
+    payload_codec_version: number | null;
+    occurred_at: Date | string;
+    client_event_id: string | null;
+    turn_id: string | null;
+    turn_generation: number | null;
+    turn_attempt_id: string | null;
+    turn_association: string | null;
+    duplicate_of_event_id: string | null;
+    duplicate_reason: string | null;
+  }>(db, sql`select * from opengeni_private.claim_automatic_session_title_fanout_v1(${limit})`);
+  return rows.map((row) => ({
+    outboxId: row.outbox_id,
+    event: {
+      id: row.event_id,
+      workspaceId: row.workspace_id,
+      sessionId: row.session_id,
+      sequence: row.sequence,
+      type: row.type as SessionEventType,
+      payload: fromPostgresLosslessJson(row.payload, row.payload_codec_version),
+      occurredAt:
+        row.occurred_at instanceof Date
+          ? row.occurred_at.toISOString()
+          : new Date(row.occurred_at).toISOString(),
+      clientEventId: row.client_event_id,
+      turnId: row.turn_id,
+      turnGeneration: row.turn_generation,
+      turnAttemptId: row.turn_attempt_id,
+      turnAssociation: row.turn_association as SessionEvent["turnAssociation"],
+      duplicateOfEventId: row.duplicate_of_event_id,
+      duplicateReason: row.duplicate_reason,
+    },
+  }));
+}
+
+export async function markAutomaticSessionTitleFanoutDelivered(
+  db: Database,
+  delivery: AutomaticSessionTitleFanoutDelivery,
+): Promise<boolean> {
+  const [row] = await rawRows<{ changed: boolean }>(
+    db,
+    sql`select opengeni_private.mark_automatic_session_title_fanout_delivered_v1(
+      ${delivery.outboxId}::uuid,
+      ${delivery.event.id}::uuid
+    ) as changed`,
+  );
+  return row?.changed === true;
+}
+
+export async function markAutomaticSessionTitleFanoutFailed(
+  db: Database,
+  delivery: AutomaticSessionTitleFanoutDelivery,
+  error: string,
+): Promise<boolean> {
+  const [row] = await rawRows<{ changed: boolean }>(
+    db,
+    sql`select opengeni_private.mark_automatic_session_title_fanout_failed_v1(
+      ${delivery.outboxId}::uuid,
+      ${delivery.event.id}::uuid,
+      ${error}
+    ) as changed`,
+  );
+  return row?.changed === true;
+}
+
 export type SessionWorkflowWake = {
   accountId: string;
   workspaceId: string;
@@ -65909,6 +66672,8 @@ function mapSession(
     activeSandboxId: row.activeSandboxId ?? null,
     activeEpoch: Number(row.activeEpoch),
     workingDir: row.workingDir ?? null,
+    variableSetIds:
+      (row.variableSetIds as string[]) ?? (row.variableSetId ? [row.variableSetId] : []),
     variableSetId: row.variableSetId,
     environmentId: row.variableSetId,
     // The rig + frozen rig version the session rides (M3). Both null for a
@@ -66420,13 +67185,35 @@ async function workspaceControlProjection(
   });
 }
 
+async function workspaceKindProjection(
+  db: Database,
+  row: Pick<typeof schema.workspaces.$inferSelect, "id" | "accountId">,
+): Promise<Workspace["kind"]> {
+  return await withRlsContext(
+    db,
+    { accountId: row.accountId, workspaceId: row.id },
+    async (scopedDb) => {
+      const [kind] = await rawRows<{ kind: string }>(
+        scopedDb,
+        sql`select get_workspace_kind(${row.accountId}::uuid, ${row.id}::uuid) as kind`,
+      );
+      if (kind?.kind !== "personal" && kind?.kind !== "shared") {
+        throw new Error(`Workspace ${row.id} has no canonical kind`);
+      }
+      return kind.kind;
+    },
+  );
+}
+
 function mapWorkspace(
   row: typeof schema.workspaces.$inferSelect,
   inferenceControl: Workspace["inferenceControl"],
+  kind: Workspace["kind"],
 ): Workspace {
   return {
     id: row.id,
     accountId: row.accountId,
+    kind,
     name: row.name,
     slug: row.slug,
     externalSource: row.externalSource,