@opengeni/db 3.4.0-canary.2 → 3.5.2-canary.0

package/src/provision-roles.ts

@@ -533,6 +533,31 @@ async function grantAppRoleIfSchemaExists(
   ]
     .map(literal)
     .join(", ")}]`;
+  const managedAuthSessionSetRoutines = `ARRAY[${[
+    "get_canonical_human_exact_login_binding(text,text)",
+    "managed_auth_session_set_authority_state(text)",
+    "managed_auth_session_set_snapshot(text,text,boolean,boolean,boolean)",
+    "managed_auth_session_set_bootstrap(text,text,text,text,uuid,text,bigint,bigint)",
+    "managed_auth_session_set_begin_transaction(text,text,text,uuid,text,bigint,uuid,bigint,text,text,uuid,uuid,text,timestamp with time zone)",
+    "managed_auth_session_set_complete_transaction(text,text,uuid,text,bigint,bigint,uuid,text,text,text)",
+    "managed_auth_session_set_mutate(text,text,uuid,text,bigint,bigint,text,uuid,uuid,uuid,text,text)",
+    "managed_auth_actor_mutation_fence(text,bigint,uuid)",
+    "managed_auth_actor_mutation_lease_acquire(text,bigint,uuid,integer)",
+    "managed_auth_actor_mutation_lease_release(text,uuid)",
+    "managed_auth_actor_mutation_lease_validate(text,bigint,uuid)",
+    "managed_auth_adopted_session_snapshot(text)",
+    "managed_auth_isolated_session_reap(integer)",
+    "managed_auth_expired_session_set_reap(integer)",
+    "managed_auth_session_set_operation_receipt(text,uuid,text,text)",
+  ]
+    .map(literal)
+    .join(", ")}]`;
+  const organizationRecoveryRoutines = `ARRAY[${[
+    "get_organization_recovery_overview(uuid,text,jsonb,text,text)",
+    "organization_recovery_command(jsonb)",
+  ]
+    .map(literal)
+    .join(", ")}]`;
   await sql.unsafe(`
 DO $$
 DECLARE
@@ -1226,6 +1251,30 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    FOREACH routine_signature IN ARRAY ${managedAuthSessionSetRoutines} LOOP
+      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature)) IS NOT NULL THEN
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC',
+          ${literal(schema)}, routine_signature
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',
+          ${literal(schema)}, routine_signature, ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    FOREACH routine_signature IN ARRAY ${organizationRecoveryRoutines} LOOP
+      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature)) IS NOT NULL THEN
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC',
+          ${literal(schema)}, routine_signature
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',
+          ${literal(schema)}, routine_signature, ${literal(role)}
+        );
+      END IF;
+    END LOOP;
     -- Migration 0225 creates these target-schema-local session visibility
     -- capabilities before opengeni_app may exist. Re-converge their exact
     -- EXECUTE grants for migrate-then-provision installs without granting

package/src/runtime-posture.ts

@@ -324,6 +324,49 @@ const CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES = [
   "canonical_human_login_bindings",
   "canonical_human_identity_operations",
 ] as const;
+const MANAGED_AUTH_SESSION_SET_ROUTINES = [
+  "get_canonical_human_exact_login_binding(text, text)",
+  "managed_auth_session_set_authority_state(text)",
+  "managed_auth_session_set_snapshot(text, text, boolean, boolean, boolean)",
+  "managed_auth_session_set_bootstrap(text, text, text, text, uuid, text, bigint, bigint)",
+  "managed_auth_session_set_begin_transaction(text, text, text, uuid, text, bigint, uuid, bigint, text, text, uuid, uuid, text, timestamp with time zone)",
+  "managed_auth_session_set_complete_transaction(text, text, uuid, text, bigint, bigint, uuid, text, text, text)",
+  "managed_auth_session_set_mutate(text, text, uuid, text, bigint, bigint, text, uuid, uuid, uuid, text, text)",
+  "managed_auth_actor_mutation_fence(text, bigint, uuid)",
+  "managed_auth_actor_mutation_lease_acquire(text, bigint, uuid, integer)",
+  "managed_auth_actor_mutation_lease_release(text, uuid)",
+  "managed_auth_actor_mutation_lease_validate(text, bigint, uuid)",
+  "managed_auth_adopted_session_snapshot(text)",
+  "managed_auth_isolated_session_reap(integer)",
+  "managed_auth_expired_session_set_reap(integer)",
+  "managed_auth_session_set_operation_receipt(text, uuid, text, text)",
+] as const;
+const MANAGED_AUTH_SESSION_SET_AUTHORITY_TABLES = [
+  "managed_auth_actor_mutation_leases",
+  "managed_auth_browser_installations",
+  "managed_auth_session_sets",
+  "managed_auth_login_slots",
+  "managed_auth_login_return_intents",
+  "managed_auth_login_transaction_rate_limits",
+  "managed_auth_login_transactions",
+  "managed_auth_session_set_operations",
+] as const;
+const ORGANIZATION_RECOVERY_ROUTINES = [
+  "get_organization_recovery_overview(uuid, text, jsonb, text, text)",
+  "organization_recovery_command(jsonb)",
+] as const;
+const ORGANIZATION_RECOVERY_AUTHORITY_TABLES = [
+  "organization_recovery_approvals",
+  "organization_recovery_command_receipts",
+  "organization_recovery_custodian_acceptances",
+  "organization_recovery_custodians",
+  "organization_recovery_events",
+  "organization_recovery_notification_attempts",
+  "organization_recovery_notification_outbox",
+  "organization_recovery_operations",
+  "organization_recovery_policies",
+  "organization_recovery_policy_heads",
+] as const;
 const SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE =
   "session_private_actor_visible(uuid, uuid, uuid, text)";
 const SESSION_REFERENCE_VISIBLE_ROUTINE = "session_reference_visible(uuid, uuid, uuid)";
@@ -511,6 +554,8 @@ export const RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES = [
   ...SCOPED_COMPUTE_AUTHORITY_ROUTINES,
   ...SCHEDULED_PERSONAL_RESOURCE_ROUTINES,
   ...CANONICAL_HUMAN_IDENTITY_ROUTINES,
+  ...MANAGED_AUTH_SESSION_SET_ROUTINES,
+  ...ORGANIZATION_RECOVERY_ROUTINES,
   ...TASK_NOTE_CAPABILITY_ROUTINES,
   SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE,
   SESSION_REFERENCE_VISIBLE_ROUTINE,
@@ -702,6 +747,14 @@ export const FORCE_RLS_TABLES = [
   "machine_metrics_latest",
   "machine_metrics_series",
   "machine_removal_operations",
+  "managed_auth_actor_mutation_leases",
+  "managed_auth_browser_installations",
+  "managed_auth_login_return_intents",
+  "managed_auth_login_slots",
+  "managed_auth_login_transaction_rate_limits",
+  "managed_auth_login_transactions",
+  "managed_auth_session_set_operations",
+  "managed_auth_session_sets",
   "memory_slack_publication_configurations",
   "memory_slack_publication_receipts",
   "memory_slack_publications",
@@ -716,6 +769,16 @@ export const FORCE_RLS_TABLES = [
   "organization_private_session_setting_events",
   "organization_private_session_settings",
   "organization_profile_events",
+  "organization_recovery_approvals",
+  "organization_recovery_command_receipts",
+  "organization_recovery_custodian_acceptances",
+  "organization_recovery_custodians",
+  "organization_recovery_events",
+  "organization_recovery_notification_attempts",
+  "organization_recovery_notification_outbox",
+  "organization_recovery_operations",
+  "organization_recovery_policies",
+  "organization_recovery_policy_heads",
   "organization_shared_workspace_administration_capabilities",
   "organization_user_resource_authorities",
   "organization_user_resource_grants",
@@ -1202,6 +1265,14 @@ export const PROTECTED_NO_DIRECT_DML_TABLES = [
   "host_export_cursor_state",
   "host_export_dead_letters",
   "host_export_outbox",
+  "managed_auth_actor_mutation_leases",
+  "managed_auth_browser_installations",
+  "managed_auth_login_return_intents",
+  "managed_auth_login_slots",
+  "managed_auth_login_transaction_rate_limits",
+  "managed_auth_login_transactions",
+  "managed_auth_session_set_operations",
+  "managed_auth_session_sets",
   "organization_invitation_binding_events",
   "organization_membership_invitations",
   "organization_membership_lifecycle_events",
@@ -1210,6 +1281,16 @@ export const PROTECTED_NO_DIRECT_DML_TABLES = [
   "organization_private_session_setting_events",
   "organization_private_session_settings",
   "organization_profile_events",
+  "organization_recovery_approvals",
+  "organization_recovery_command_receipts",
+  "organization_recovery_custodian_acceptances",
+  "organization_recovery_custodians",
+  "organization_recovery_events",
+  "organization_recovery_notification_attempts",
+  "organization_recovery_notification_outbox",
+  "organization_recovery_operations",
+  "organization_recovery_policies",
+  "organization_recovery_policy_heads",
   "organization_shared_workspace_administration_capabilities",
   "organization_user_resource_authorities",
   "organization_user_resource_grants",
@@ -1301,6 +1382,8 @@ export type RuntimeDatabasePostureOptions = {
   protectedTables?: readonly string[];
   tablePrivileges?: RuntimeTablePrivilegeContract;
   protectedNoDirectDmlTables?: readonly string[];
+  targetSchemaCapabilityRoutines?: readonly string[];
+  targetSchemaForbiddenRoutines?: readonly string[];
   organizationTenancyCanonicalActivationEnabled?: boolean;
 };
 
@@ -1436,6 +1519,10 @@ export async function inspectRuntimeDatabasePosture(
   options: RuntimeDatabasePostureOptions,
 ): Promise<RuntimeDatabasePosture> {
   const targetSchema = options.targetSchema?.trim() || "public";
+  const targetSchemaCapabilityRoutines =
+    options.targetSchemaCapabilityRoutines ?? RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES;
+  const targetSchemaForbiddenRoutines =
+    options.targetSchemaForbiddenRoutines ?? RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES;
 
   return await db.transaction(
     async (tx) => {
@@ -1710,10 +1797,9 @@ export async function inspectRuntimeDatabasePosture(
             and (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')') = any(
               array[
                 ${sql.join(
-                  [
-                    ...RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES,
-                    ...RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES,
-                  ].map((name) => sql`${name}`),
+                  [...targetSchemaCapabilityRoutines, ...targetSchemaForbiddenRoutines].map(
+                    (name) => sql`${name}`,
+                  ),
                   sql`, `,
                 )}
               ]::text[]
@@ -1826,6 +1912,10 @@ export function evaluateRuntimeDatabasePosture(
     options.protectedNoDirectDmlTables ??
       (options.protectedTables ? [] : PROTECTED_NO_DIRECT_DML_TABLES),
   );
+  const targetSchemaCapabilityRoutines =
+    options.targetSchemaCapabilityRoutines ?? RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES;
+  const targetSchemaForbiddenRoutines =
+    options.targetSchemaForbiddenRoutines ?? RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES;
 
   if (identity.currentUser !== expectedRole || identity.sessionUser !== expectedRole) {
     violations.push(
@@ -1956,7 +2046,7 @@ export function evaluateRuntimeDatabasePosture(
   }
 
   const targetSchemaOwner = posture.schemas.find((schema) => schema.name === targetSchema)?.owner;
-  for (const forbiddenRoutine of RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES) {
+  for (const forbiddenRoutine of targetSchemaForbiddenRoutines) {
     const matches = posture.targetRoutines.filter((routine) => routine.name === forbiddenRoutine);
     if (matches.length !== 1) {
       violations.push(
@@ -1983,7 +2073,7 @@ export function evaluateRuntimeDatabasePosture(
       violations.push(`PUBLIC has forbidden owner-internal helper ${routine.name}`);
     }
   }
-  for (const expectedRoutine of RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES) {
+  for (const expectedRoutine of targetSchemaCapabilityRoutines) {
     const matches = posture.targetRoutines.filter((routine) => routine.name === expectedRoutine);
     if (matches.length !== 1) {
       violations.push(
@@ -2252,6 +2342,42 @@ export function evaluateRuntimeDatabasePosture(
           );
         }
       }
+    } else if ((ORGANIZATION_RECOVERY_ROUTINES as readonly string[]).includes(routine.name)) {
+      const authorityTables = ORGANIZATION_RECOVERY_AUTHORITY_TABLES.filter((tableName) =>
+        tableByName.has(tableName),
+      ).map((tableName) => tableByName.get(tableName)!);
+      const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+      if (authorityTables.length !== ORGANIZATION_RECOVERY_AUTHORITY_TABLES.length) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} organization recovery authority tables are missing`,
+        );
+      } else if (authorityOwners.size !== 1) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`,
+        );
+      } else if (routine.owner !== authorityTables[0]!.owner) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0]!.owner}`,
+        );
+      }
+    } else if ((MANAGED_AUTH_SESSION_SET_ROUTINES as readonly string[]).includes(routine.name)) {
+      const authorityTables = MANAGED_AUTH_SESSION_SET_AUTHORITY_TABLES.filter((tableName) =>
+        tableByName.has(tableName),
+      ).map((tableName) => tableByName.get(tableName)!);
+      const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+      if (authorityTables.length !== MANAGED_AUTH_SESSION_SET_AUTHORITY_TABLES.length) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} managed auth session-set authority tables are missing`,
+        );
+      } else if (authorityOwners.size !== 1) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`,
+        );
+      } else if (routine.owner !== authorityTables[0]!.owner) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0]!.owner}`,
+        );
+      }
     } else if ((CANONICAL_HUMAN_IDENTITY_ROUTINES as readonly string[]).includes(routine.name)) {
       const authorityTables = CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES.filter((tableName) =>
         tableByName.has(tableName),

package/src/schema.ts

@@ -46,6 +46,8 @@ import {
 import { losslessCodecVersion, losslessJsonb, losslessText } from "./lossless-columns";
 
 export * from "./editable-artifacts-schema";
+export * from "./managed-auth-session-set-schema";
+export * from "./organization-recovery-schema";
 
 const vector = customType<{ data: number[]; driverData: string }>({
   dataType() {

package/src/session-control.ts

@@ -2224,8 +2224,8 @@ export async function updateSessionCommandReceiptResult(
 export type SessionControlMutationResult = {
   receipt: SessionCommandReceiptRow;
   control: EffectiveSessionControl;
-  sessionControlEventId: string;
-  workspaceControlEventId: string;
+  sessionControlEventId: string | null;
+  workspaceControlEventId: string | null;
   interruptionCount: number;
   backgroundCommandCount: number;
   wakeCount: number;
@@ -2233,6 +2233,7 @@ export type SessionControlMutationResult = {
   cancelledTurnCount: number;
   affectedSessionEvents: Array<{ sessionId: string; eventIds: string[] }>;
   workflowWake: SessionControlWorkflowWake | null;
+  outcome: "changed" | "unchanged" | "replayed";
   replay: boolean;
 };
 
@@ -2278,6 +2279,115 @@ async function pendingSessionControlWorkflowWake(
   };
 }
 
+async function sessionPauseEffectsNeeded(
+  db: Database,
+  input: { workspaceId: string; sessionId: string; directPauseRevision: number },
+): Promise<boolean> {
+  const rows = await db.execute<{ needed: boolean }>(sql`
+    with recursive subtree(id, path, cycle) as (
+      select session.id, array[session.id]::uuid[], false
+      from ${schema.sessions} session
+      where session.workspace_id = ${input.workspaceId}
+        and session.id = ${input.sessionId}
+      union all
+      select child.id, parent.path || child.id, child.id = any(parent.path)
+      from subtree parent
+      join ${schema.sessions} child
+        on child.workspace_id = ${input.workspaceId}
+       and child.parent_session_id = parent.id
+      where not parent.cycle
+        and cardinality(parent.path) <= ${SESSION_ANCESTRY_LIMIT}
+    ), scoped_sessions as (
+      select session.id, session.subtree_run_override_revision
+      from subtree
+      join ${schema.sessions} session
+        on session.workspace_id = ${input.workspaceId}
+       and session.id = subtree.id
+      where not subtree.cycle
+    )
+    select exists (
+      select 1
+      from scoped_sessions session
+      where session.subtree_run_override_revision > ${input.directPauseRevision}
+      union all
+      select 1
+      from ${schema.sessionTurnAttempts} attempt
+      join scoped_sessions session on session.id = attempt.session_id
+      where attempt.workspace_id = ${input.workspaceId}
+        and attempt.state in ('claimed', 'running')
+        and not exists (
+          select 1
+          from ${schema.sessionAttemptInterruptions} interruption
+          where interruption.workspace_id = attempt.workspace_id
+            and interruption.attempt_id = attempt.id
+            and interruption.kind in ('session_pause', 'workspace_pause')
+            and interruption.state in ('pending', 'delivered', 'acknowledged')
+        )
+      union all
+      select 1
+      from ${schema.sessionBackgroundCommands} command
+      join scoped_sessions session on session.id = command.session_id
+      where command.workspace_id = ${input.workspaceId}
+        and command.state = 'running'
+    ) as needed
+  `);
+  return rows[0]?.needed ?? false;
+}
+
+async function workspacePauseEffectsNeeded(
+  db: Database,
+  input: { workspaceId: string; workspacePauseRevision: number },
+): Promise<boolean> {
+  const rows = await db.execute<{ needed: boolean }>(sql`
+    select exists (
+      select 1
+      from ${schema.sessions} session
+      where session.workspace_id = ${input.workspaceId}
+        and session.subtree_run_override_revision > ${input.workspacePauseRevision}
+      union all
+      select 1
+      from ${schema.sessionTurnAttempts} attempt
+      where attempt.workspace_id = ${input.workspaceId}
+        and attempt.state in ('claimed', 'running')
+        and not exists (
+          select 1
+          from ${schema.sessionAttemptInterruptions} interruption
+          where interruption.workspace_id = attempt.workspace_id
+            and interruption.attempt_id = attempt.id
+            and interruption.kind in ('session_pause', 'workspace_pause')
+            and interruption.state in ('pending', 'delivered', 'acknowledged')
+        )
+      union all
+      select 1
+      from ${schema.sessionBackgroundCommands} command
+      where command.workspace_id = ${input.workspaceId}
+        and command.state = 'running'
+    ) as needed
+  `);
+  return rows[0]?.needed ?? false;
+}
+
+async function continuableWakeRepairNeeded(
+  db: Database,
+  input: { workspaceId: string; rootSessionId: string | null },
+): Promise<boolean> {
+  const rows = await db.execute<{ needed: boolean }>(sql`
+    select exists (
+      select 1
+      from opengeni_private.list_continuable_sessions(
+        ${input.workspaceId}::uuid,
+        ${input.rootSessionId}::uuid
+      ) eligible
+      left join ${schema.sessionWorkflowWakeOutbox} wake
+        on wake.workspace_id = eligible.workspace_id
+       and wake.session_id = eligible.session_id
+      where wake.session_id is null
+        or wake.wake_revision <= wake.delivered_revision
+    ) as needed
+  `);
+  return rows[0]?.needed ?? false;
+}
+
 async function loadSessionSubtreeIds(
   db: Database,
   workspaceId: string,
@@ -3017,13 +3127,23 @@ export async function mutateSessionControlInTransaction(
     operationKey: input.operationKey,
     canonicalRequestHash: hash,
   });
-  if (reserved.replay && reserved.receipt.appliedControlRevision !== null) {
-    const workspaceControlEventId = String(reserved.receipt.result.workspaceControlEventId ?? "");
-    if (!workspaceControlEventId) {
+  if (reserved.replay) {
+    const storedOutcome = reserved.receipt.result.outcome;
+    const unchanged =
+      storedOutcome === "unchanged" && reserved.receipt.appliedControlRevision === null;
+    if (!unchanged && reserved.receipt.appliedControlRevision === null) {
+      throw new SessionControlInvariantError(
+        "Replayed session control receipt has no applied control revision",
+      );
+    }
+    const workspaceControlEventId = unchanged
+      ? null
+      : String(reserved.receipt.result.workspaceControlEventId ?? "");
+    if (!unchanged && !workspaceControlEventId) {
       throw new SessionControlInvariantError("Replayed session control receipt has no event");
     }
-    const sessionControlEventId = String(reserved.receipt.result.eventId ?? "");
-    if (!sessionControlEventId) {
+    const sessionControlEventId = unchanged ? null : String(reserved.receipt.result.eventId ?? "");
+    if (!unchanged && !sessionControlEventId) {
       throw new SessionControlInvariantError(
         "Replayed session control receipt has no session event",
       );
@@ -3046,13 +3166,16 @@ export async function mutateSessionControlInTransaction(
             sessionId: string;
             eventIds: string[];
           }>)
-        : [{ sessionId: input.sessionId, eventIds: [sessionControlEventId] }],
+        : sessionControlEventId
+          ? [{ sessionId: input.sessionId, eventIds: [sessionControlEventId] }]
+          : [],
       workflowWake: await pendingSessionControlWorkflowWake(
         db,
         input.workspaceId,
         input.sessionId,
         wakeCount,
       ),
+      outcome: "replayed",
       replay: true,
     };
   }
@@ -3074,6 +3197,59 @@ export async function mutateSessionControlInTransaction(
     throw new SessionControlConflictError();
   }
 
+  if (input.action !== "cancel") {
+    const targetSession = locks.sessions.find((session) => session.id === input.sessionId);
+    if (!targetSession) {
+      throw new SessionControlInvariantError(`Session ${input.sessionId} disappeared`);
+    }
+    const directPauseRevision = asSafeRevision(
+      targetSession.directPauseRevision,
+      "direct pause revision",
+    );
+    const changed =
+      input.action === "pause"
+        ? targetSession.directControlState !== "paused" ||
+          directPauseRevision === null ||
+          (await sessionPauseEffectsNeeded(db, {
+            workspaceId: input.workspaceId,
+            sessionId: input.sessionId,
+            directPauseRevision,
+          }))
+        : before.state === "paused" ||
+          (await continuableWakeRepairNeeded(db, {
+            workspaceId: input.workspaceId,
+            rootSessionId: input.sessionId,
+          }));
+    if (!changed) {
+      const receipt = await updateSessionCommandReceiptResult(db, reserved.receipt.id, {
+        result: {
+          outcome: "unchanged",
+          interruptionCount: 0,
+          backgroundCommandCount: 0,
+          wakeCount: 0,
+          cancelledSessionCount: 0,
+          cancelledTurnCount: 0,
+          affectedSessionEvents: [],
+        },
+      });
+      return {
+        receipt,
+        control: before,
+        sessionControlEventId: null,
+        workspaceControlEventId: null,
+        interruptionCount: 0,
+        backgroundCommandCount: 0,
+        wakeCount: 0,
+        cancelledSessionCount: 0,
+        cancelledTurnCount: 0,
+        affectedSessionEvents: [],
+        workflowWake: null,
+        outcome: "unchanged",
+        replay: false,
+      };
+    }
+  }
+
   const revision = nextRevision(workspace);
   await advanceWorkspaceRevision(db, input.workspaceId, revision);
   const updatedRows = await db
@@ -3281,6 +3457,7 @@ export async function mutateSessionControlInTransaction(
   const receipt = await updateSessionCommandReceiptResult(db, reserved.receipt.id, {
     controlRevision: revision,
     result: {
+      outcome: "changed",
       interruptionCount,
       backgroundCommandCount,
       wakeCount,
@@ -3311,6 +3488,7 @@ export async function mutateSessionControlInTransaction(
       input.sessionId,
       wakeCount,
     ),
+    outcome: "changed",
     replay: false,
   };
 }
@@ -3406,11 +3584,12 @@ export async function autoResumeSessionBranchInTransaction(
 export type WorkspaceControlMutationResult = {
   receipt: SessionCommandReceiptRow;
   revision: number;
-  workspaceControlEventId: string;
+  workspaceControlEventId: string | null;
   workspaceState: EffectiveControlState;
   interruptionCount: number;
   backgroundCommandCount: number;
   wakeCount: number;
+  outcome: "changed" | "unchanged" | "replayed";
   replay: boolean;
 };
 
@@ -3449,19 +3628,33 @@ export async function mutateWorkspaceControlInTransaction(
     operationKey: input.operationKey,
     canonicalRequestHash: hash,
   });
-  if (reserved.replay && reserved.receipt.appliedControlRevision !== null) {
-    const workspaceControlEventId = String(reserved.receipt.result.workspaceControlEventId ?? "");
-    if (!workspaceControlEventId) {
+  if (reserved.replay) {
+    const storedOutcome = reserved.receipt.result.outcome;
+    const unchanged =
+      storedOutcome === "unchanged" && reserved.receipt.appliedControlRevision === null;
+    if (!unchanged && reserved.receipt.appliedControlRevision === null) {
+      throw new SessionControlInvariantError(
+        "Replayed workspace control receipt has no applied control revision",
+      );
+    }
+    const workspaceControlEventId = unchanged
+      ? null
+      : String(reserved.receipt.result.workspaceControlEventId ?? "");
+    if (!unchanged && !workspaceControlEventId) {
       throw new SessionControlInvariantError("Replayed workspace control receipt has no event");
     }
     return {
       receipt: reserved.receipt,
-      revision: Number(reserved.receipt.appliedControlRevision),
-      workspaceControlEventId,
-      workspaceState: input.action === "pause" ? "paused" : "active",
+      revision:
+        reserved.receipt.appliedControlRevision === null
+          ? currentRevision
+          : Number(reserved.receipt.appliedControlRevision),
+      workspaceControlEventId: workspaceControlEventId || null,
+      workspaceState: workspace.workspaceState === "paused" ? "paused" : "active",
       interruptionCount: Number(reserved.receipt.result.interruptionCount ?? 0),
       backgroundCommandCount: Number(reserved.receipt.result.backgroundCommandCount ?? 0),
       wakeCount: Number(reserved.receipt.result.wakeCount ?? 0),
+      outcome: "replayed",
       replay: true,
     };
   }
@@ -3469,6 +3662,45 @@ export async function mutateWorkspaceControlInTransaction(
     if (input.expectedRevision !== currentRevision) throw new SessionControlConflictError();
   }
 
+  const workspacePauseRevision = asSafeRevision(
+    workspace.workspacePauseRevision,
+    "workspace pause revision",
+  );
+  const changed =
+    input.action === "pause"
+      ? workspace.workspaceState !== "paused" ||
+        workspacePauseRevision === null ||
+        (await workspacePauseEffectsNeeded(db, {
+          workspaceId: input.workspaceId,
+          workspacePauseRevision,
+        }))
+      : workspace.workspaceState !== "active" ||
+        (await continuableWakeRepairNeeded(db, {
+          workspaceId: input.workspaceId,
+          rootSessionId: null,
+        }));
+  if (!changed) {
+    const receipt = await updateSessionCommandReceiptResult(db, reserved.receipt.id, {
+      result: {
+        outcome: "unchanged",
+        interruptionCount: 0,
+        backgroundCommandCount: 0,
+        wakeCount: 0,
+      },
+    });
+    return {
+      receipt,
+      revision: currentRevision,
+      workspaceControlEventId: null,
+      workspaceState: workspace.workspaceState === "paused" ? "paused" : "active",
+      interruptionCount: 0,
+      backgroundCommandCount: 0,
+      wakeCount: 0,
+      outcome: "unchanged",
+      replay: false,
+    };
+  }
+
   const revision = nextRevision(workspace);
   const actor =
     input.actor.type === "agent_attempt"
@@ -3533,7 +3765,13 @@ export async function mutateWorkspaceControlInTransaction(
         });
   const receipt = await updateSessionCommandReceiptResult(db, reserved.receipt.id, {
     controlRevision: revision,
-    result: { interruptionCount, backgroundCommandCount, wakeCount, workspaceControlEventId },
+    result: {
+      outcome: "changed",
+      interruptionCount,
+      backgroundCommandCount,
+      wakeCount,
+      workspaceControlEventId,
+    },
   });
   return {
     receipt,
@@ -3543,6 +3781,7 @@ export async function mutateWorkspaceControlInTransaction(
     interruptionCount,
     backgroundCommandCount,
     wakeCount,
+    outcome: "changed",
     replay: false,
   };
 }