@opengeni/db 3.7.4-canary.0 → 3.8.2-canary.0

package/drizzle/0392_context_compaction_pending_observability.sql

@@ -0,0 +1,198 @@
+-- deployment-mode: rolling
+-- Project exact-attempt automatic compaction starts into one content-free,
+-- restart-safe aggregate. Prometheus labels must never carry tenant/session ids,
+-- while process-local start/completion timestamps cannot correlate concurrent
+-- activities or survive the worker whose provider call became stuck.
+
+CREATE TABLE opengeni_private.context_compaction_pending_observations (
+  workspace_id uuid NOT NULL,
+  attempt_id uuid NOT NULL,
+  started_at timestamp with time zone NOT NULL,
+  PRIMARY KEY (workspace_id, attempt_id),
+  CONSTRAINT context_compaction_pending_observations_attempt_fk
+    FOREIGN KEY (workspace_id, attempt_id)
+    REFERENCES session_turn_attempts (workspace_id, id)
+    ON DELETE CASCADE
+);
+
+REVOKE ALL ON TABLE opengeni_private.context_compaction_pending_observations FROM PUBLIC;
+
+CREATE OR REPLACE FUNCTION opengeni_private.project_context_compaction_event()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $project_context_compaction_event$
+BEGIN
+  IF NEW.turn_attempt_id IS NULL THEN
+    RETURN NEW;
+  END IF;
+
+  IF NEW.type = 'session.context.compaction.started'
+    AND NEW.payload ->> 'trigger' = 'auto'
+  THEN
+    INSERT INTO opengeni_private.context_compaction_pending_observations (
+      workspace_id,
+      attempt_id,
+      started_at
+    ) VALUES (
+      NEW.workspace_id,
+      NEW.turn_attempt_id,
+      NEW.occurred_at
+    )
+    ON CONFLICT (workspace_id, attempt_id) DO UPDATE
+      SET started_at = EXCLUDED.started_at;
+  ELSIF NEW.type IN (
+    'session.context.compacted',
+    'session.context.compaction.skipped'
+  ) THEN
+    DELETE FROM opengeni_private.context_compaction_pending_observations pending
+    WHERE pending.workspace_id = NEW.workspace_id
+      AND pending.attempt_id = NEW.turn_attempt_id;
+  END IF;
+
+  RETURN NEW;
+END
+$project_context_compaction_event$;
+
+REVOKE ALL ON FUNCTION opengeni_private.project_context_compaction_event() FROM PUBLIC;
+
+CREATE TRIGGER session_events_project_context_compaction_pending
+AFTER INSERT ON session_events
+FOR EACH ROW
+WHEN (
+  NEW.type IN (
+    'session.context.compaction.started',
+    'session.context.compacted',
+    'session.context.compaction.skipped'
+  )
+)
+EXECUTE FUNCTION opengeni_private.project_context_compaction_event();
+
+CREATE OR REPLACE FUNCTION opengeni_private.clear_context_compaction_pending_attempt()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $clear_context_compaction_pending_attempt$
+BEGIN
+  IF OLD.state <> 'closed' AND NEW.state = 'closed' THEN
+    DELETE FROM opengeni_private.context_compaction_pending_observations pending
+    WHERE pending.workspace_id = NEW.workspace_id
+      AND pending.attempt_id = NEW.id;
+  END IF;
+  RETURN NEW;
+END
+$clear_context_compaction_pending_attempt$;
+
+REVOKE ALL ON FUNCTION opengeni_private.clear_context_compaction_pending_attempt() FROM PUBLIC;
+
+CREATE TRIGGER session_turn_attempts_clear_context_compaction_pending
+AFTER UPDATE OF state ON session_turn_attempts
+FOR EACH ROW
+WHEN (OLD.state IS DISTINCT FROM NEW.state)
+EXECUTE FUNCTION opengeni_private.clear_context_compaction_pending_attempt();
+
+CREATE OR REPLACE FUNCTION opengeni_private.clear_context_compaction_pending_turn()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $clear_context_compaction_pending_turn$
+BEGIN
+  IF OLD.active_attempt_id IS NOT NULL
+    AND OLD.active_attempt_id IS DISTINCT FROM NEW.active_attempt_id
+  THEN
+    DELETE FROM opengeni_private.context_compaction_pending_observations pending
+    WHERE pending.workspace_id = NEW.workspace_id
+      AND pending.attempt_id = OLD.active_attempt_id;
+  END IF;
+  RETURN NEW;
+END
+$clear_context_compaction_pending_turn$;
+
+REVOKE ALL ON FUNCTION opengeni_private.clear_context_compaction_pending_turn() FROM PUBLIC;
+
+CREATE TRIGGER session_turns_clear_context_compaction_pending
+AFTER UPDATE OF active_attempt_id ON session_turns
+FOR EACH ROW
+WHEN (OLD.active_attempt_id IS DISTINCT FROM NEW.active_attempt_id)
+EXECUTE FUNCTION opengeni_private.clear_context_compaction_pending_turn();
+
+-- The migration owner is bound by FORCE RLS in production. Open the standard
+-- owner-only posture window while reconstructing any automatic provider call
+-- already in flight when this rolling migration lands.
+ALTER TABLE session_events NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE session_turn_attempts NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE session_turns NO FORCE ROW LEVEL SECURITY;
+
+WITH latest_landmark AS (
+  SELECT DISTINCT ON (event.workspace_id, event.turn_attempt_id)
+    event.workspace_id,
+    event.turn_attempt_id,
+    event.type,
+    event.payload,
+    event.occurred_at
+  FROM session_events event
+  WHERE event.turn_attempt_id IS NOT NULL
+    AND event.type IN (
+      'session.context.compaction.started',
+      'session.context.compacted',
+      'session.context.compaction.skipped'
+    )
+  ORDER BY
+    event.workspace_id,
+    event.turn_attempt_id,
+    event.sequence DESC,
+    event.id DESC
+)
+INSERT INTO opengeni_private.context_compaction_pending_observations (
+  workspace_id,
+  attempt_id,
+  started_at
+)
+SELECT
+  landmark.workspace_id,
+  landmark.turn_attempt_id,
+  landmark.occurred_at
+FROM latest_landmark landmark
+JOIN session_turn_attempts attempt
+  ON attempt.workspace_id = landmark.workspace_id
+ AND attempt.id = landmark.turn_attempt_id
+JOIN session_turns turn
+  ON turn.workspace_id = attempt.workspace_id
+ AND turn.id = attempt.turn_id
+ AND turn.active_attempt_id = attempt.id
+WHERE landmark.type = 'session.context.compaction.started'
+  AND landmark.payload ->> 'trigger' = 'auto'
+  AND attempt.state IN ('claimed', 'running')
+ON CONFLICT (workspace_id, attempt_id) DO UPDATE
+  SET started_at = EXCLUDED.started_at;
+
+ALTER TABLE session_turns FORCE ROW LEVEL SECURITY;
+ALTER TABLE session_turn_attempts FORCE ROW LEVEL SECURITY;
+ALTER TABLE session_events FORCE ROW LEVEL SECURITY;
+
+CREATE OR REPLACE FUNCTION opengeni_private.context_compaction_pending_summary()
+RETURNS TABLE (pending_count bigint, oldest_started_at timestamp with time zone)
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $context_compaction_pending_summary$
+  SELECT
+    count(*)::bigint AS pending_count,
+    min(pending.started_at) AS oldest_started_at
+  FROM opengeni_private.context_compaction_pending_observations pending
+$context_compaction_pending_summary$;
+
+REVOKE ALL ON FUNCTION opengeni_private.context_compaction_pending_summary() FROM PUBLIC;
+
+DO $context_compaction_observability_grants$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.context_compaction_pending_summary()
+      TO opengeni_app;
+  END IF;
+END
+$context_compaction_observability_grants$;

package/drizzle/0393_workspace_memory_and_learning_defaults.sql

@@ -0,0 +1,102 @@
+-- deployment-mode: rolling
+-- Migration 0393: enable Workspace Memory by default and make approval-required
+-- workspace instruction/Skill learning the default when no policy revision has
+-- been activated.
+--
+-- Explicit memory opt-outs and activated learning-policy revisions remain
+-- authoritative. Existing immutable turn and learning snapshots are untouched.
+-- Materializing the Memory default in workspace settings keeps old and new
+-- rolling binaries aligned while the application resolver changes omission to
+-- enabled.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+ALTER TABLE "workspaces"
+  ALTER COLUMN "settings" SET DEFAULT '{"memoryEnabled": true}'::jsonb;
+
+UPDATE "workspaces"
+SET "settings" = jsonb_set("settings", '{memoryEnabled}', 'true'::jsonb, true)
+WHERE NOT ("settings" ? 'memoryEnabled');
+
+-- Historical no-revision snapshots were frozen with workspace_mode = 'off'.
+-- Keep those rows valid while allowing newly accepted attempts to freeze the
+-- approval-required default below.
+ALTER TABLE "workspace_learning_policy_snapshots"
+  DROP CONSTRAINT "workspace_learning_policy_snapshots_identity_chk";
+
+ALTER TABLE "workspace_learning_policy_snapshots"
+  ADD CONSTRAINT "workspace_learning_policy_snapshots_identity_chk" CHECK (
+    (
+      "revision_id" IS NULL
+      AND "revision" IS NULL
+      AND "policy_hash" IS NULL
+      AND "activation_version" = 0
+      AND "activated_at" IS NULL
+      AND "workspace_mode" IN ('off', 'suggest')
+      AND "source_overrides" = '[]'::jsonb
+    )
+    OR (
+      "revision_id" IS NOT NULL
+      AND "revision" > 0
+      AND "policy_hash" ~ '^[0-9a-f]{64}$'
+      AND "activation_version" > 0
+      AND "activated_at" IS NOT NULL
+    )
+  ) NOT VALID;
+
+ALTER TABLE "workspace_learning_policy_snapshots"
+  VALIDATE CONSTRAINT "workspace_learning_policy_snapshots_identity_chk";
+
+CREATE OR REPLACE FUNCTION workspace_learning_policy_canonical_at(
+  p_account_id uuid,
+  p_workspace_id uuid,
+  p_accepted_at timestamptz
+) RETURNS jsonb
+LANGUAGE sql
+STABLE
+AS $$
+  SELECT CASE WHEN active."id" IS NULL THEN
+    jsonb_build_object(
+      'revisionId', NULL,
+      'revision', NULL,
+      'policyHash', NULL,
+      'activationVersion', 0,
+      'activatedAt', NULL,
+      'workspaceMode', 'suggest',
+      'sourceOverrides', '[]'::jsonb
+    )
+  ELSE
+    jsonb_build_object(
+      'revisionId', revision."id"::text,
+      'revision', revision."revision",
+      'policyHash', revision."policy_hash",
+      'activationVersion', active."activation_version",
+      'activatedAt', to_char(
+        active."created_at" AT TIME ZONE 'UTC',
+        'YYYY-MM-DD"T"HH24:MI:SS.US"Z"'
+      ),
+      'workspaceMode', revision."workspace_mode",
+      'sourceOverrides', revision."source_overrides"
+    )
+  END
+  FROM (SELECT 1) singleton
+  LEFT JOIN LATERAL (
+    SELECT event.*
+    FROM "workspace_learning_policy_activation_events" event
+    WHERE event."account_id" = p_account_id
+      AND event."workspace_id" = p_workspace_id
+      AND event."created_at" <= p_accepted_at
+    ORDER BY event."created_at" DESC, event."activation_version" DESC, event."id" DESC
+    LIMIT 1
+  ) active ON true
+  LEFT JOIN "workspace_learning_policy_revisions" revision
+    ON revision."account_id" = active."account_id"
+    AND revision."workspace_id" = active."workspace_id"
+    AND revision."id" = active."new_revision_id"
+    AND revision."revision" = active."new_revision"
+    AND revision."policy_hash" = active."new_policy_hash";
+$$;
+
+REVOKE ALL ON FUNCTION workspace_learning_policy_canonical_at(uuid, uuid, timestamptz)
+  FROM PUBLIC;

package/drizzle/0394_session_selected_skill_activation.sql

@@ -0,0 +1,20 @@
+-- deployment-mode: maintenance
+-- A session-selected Skill is installed and inspectable like any other Skill,
+-- but the worker excludes it from ambient workspace resolution. An explicit
+-- session create copies the immutable artifact onto that one session.
+
+ALTER TABLE capability_facets
+  DROP CONSTRAINT capability_facets_activation_chk;
+
+ALTER TABLE capability_facets
+  ADD CONSTRAINT capability_facets_activation_chk CHECK (
+    activation_mode IN (
+      'platform_available',
+      'runtime_baseline',
+      'workspace_managed',
+      'session_selected'
+    )
+  ) NOT VALID;
+
+ALTER TABLE capability_facets
+  VALIDATE CONSTRAINT capability_facets_activation_chk;

package/drizzle/0395_scheduled_task_unclaimed_occurrence_invalidation.sql

@@ -0,0 +1,154 @@
+-- deployment-mode: rolling
+-- Pausing or soft-deleting a scheduled task is a durable first-claim cutoff.
+-- Runs whose scheduler-owned turn already exists remain accepted work and keep
+-- their normal attempt/recovery lifecycle. Every earlier occurrence becomes a
+-- terminal receipt, so a later Resume cannot revive a deposit accepted before
+-- the lifecycle boundary.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+-- Old claimers do not inspect scheduled_task_runs.status after this migration
+-- marks an occurrence terminal. Keep the rolling boundary safe in the database:
+-- every binary must cross this state transition before it can create the
+-- scheduler-owned turn or start provider work.
+CREATE FUNCTION fence_terminal_scheduled_occurrence_delivery()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $body$
+DECLARE
+  run_status text;
+BEGIN
+  SELECT run.status INTO run_status
+  FROM scheduled_task_runs run
+  WHERE run.id = OLD.scheduled_task_run_id
+    AND run.account_id = OLD.account_id
+    AND run.workspace_id = OLD.workspace_id
+    AND run.session_id = OLD.session_id
+    AND run.action_kind = 'agent_turn'
+  FOR UPDATE;
+
+  IF run_status IS DISTINCT FROM 'dispatched' THEN
+    RAISE EXCEPTION 'terminal scheduled occurrence cannot be delivered'
+      USING ERRCODE = '42501';
+  END IF;
+  RETURN NEW;
+END
+$body$;
+
+CREATE TRIGGER scheduled_terminal_occurrence_delivery_fence
+BEFORE UPDATE OF state ON session_system_updates
+FOR EACH ROW
+WHEN (
+  OLD.scheduled_task_run_id IS NOT NULL
+  AND OLD.state = 'pending'
+  AND NEW.state = 'delivered'
+)
+EXECUTE FUNCTION fence_terminal_scheduled_occurrence_delivery();
+
+CREATE FUNCTION invalidate_unclaimed_scheduled_agent_runs_on_task_inactive()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $body$
+DECLARE
+  run_row record;
+  invalidation_error text;
+BEGIN
+  invalidation_error := CASE
+    -- 0275 introduced deleted_at. JSON row introspection keeps this rolling
+    -- trigger installable in legacy-upgrade fixtures that intentionally replay
+    -- 0275 after the current tail, while current schemas still classify delete.
+    WHEN pg_catalog.to_jsonb(OLD) ->> 'deleted_at' IS NULL
+      AND pg_catalog.to_jsonb(NEW) ->> 'deleted_at' IS NOT NULL
+      THEN 'scheduled_task_deleted_before_claim'
+    ELSE 'scheduled_task_paused_before_claim'
+  END;
+
+  INSERT INTO opengeni_private.scheduled_personal_resource_capabilities (
+    backend_pid, transaction_id, capability_kind
+  ) VALUES (
+    pg_catalog.pg_backend_pid(), pg_catalog.pg_current_xact_id(), 'run_lifecycle'
+  )
+  ON CONFLICT DO NOTHING;
+
+  -- Run admission takes the task row first. Deposit and claim both lock the run
+  -- before they can publish an occurrence or a scheduler-owned turn. Once this
+  -- loop owns a run, a fresh turn lookup therefore decides the race exactly:
+  -- no turn means no claim crossed the lifecycle boundary.
+  FOR run_row IN
+    SELECT run.id
+    FROM scheduled_task_runs run
+    WHERE run.account_id = NEW.account_id
+      AND run.workspace_id = NEW.workspace_id
+      AND run.task_id = NEW.id
+      AND run.action_kind = 'agent_turn'
+      AND run.status IN ('queued', 'dispatched')
+    ORDER BY run.id
+    FOR UPDATE
+  LOOP
+    IF NOT EXISTS (
+      SELECT 1
+      FROM session_turns turn_value
+      WHERE turn_value.account_id = NEW.account_id
+        AND turn_value.workspace_id = NEW.workspace_id
+        AND turn_value.scheduled_task_run_id = run_row.id
+    ) THEN
+      UPDATE scheduled_task_runs run
+      SET status = 'skipped',
+        error = invalidation_error,
+        completed_at = pg_catalog.clock_timestamp(),
+        updated_at = pg_catalog.clock_timestamp()
+      WHERE run.id = run_row.id
+        AND run.account_id = NEW.account_id
+        AND run.workspace_id = NEW.workspace_id
+        AND run.status IN ('queued', 'dispatched');
+    END IF;
+  END LOOP;
+
+  DELETE FROM opengeni_private.scheduled_personal_resource_capabilities
+  WHERE backend_pid = pg_catalog.pg_backend_pid()
+    AND transaction_id = pg_catalog.pg_current_xact_id_if_assigned()
+    AND capability_kind = 'run_lifecycle';
+  RETURN NEW;
+EXCEPTION WHEN OTHERS THEN
+  DELETE FROM opengeni_private.scheduled_personal_resource_capabilities
+  WHERE backend_pid = pg_catalog.pg_backend_pid()
+    AND transaction_id = pg_catalog.pg_current_xact_id_if_assigned()
+    AND capability_kind = 'run_lifecycle';
+  RAISE;
+END
+$body$;
+
+CREATE TRIGGER scheduled_task_unclaimed_occurrence_invalidation
+AFTER UPDATE OF status ON scheduled_tasks
+FOR EACH ROW
+WHEN (OLD.status = 'active' AND NEW.status = 'paused')
+EXECUTE FUNCTION invalidate_unclaimed_scheduled_agent_runs_on_task_inactive();
+
+REVOKE ALL ON FUNCTION
+  invalidate_unclaimed_scheduled_agent_runs_on_task_inactive()
+  FROM PUBLIC;
+REVOKE ALL ON FUNCTION fence_terminal_scheduled_occurrence_delivery() FROM PUBLIC;
+
+DO $pin_scheduled_task_unclaimed_invalidation$
+DECLARE
+  data_schema text := pg_catalog.current_schema();
+BEGIN
+  EXECUTE pg_catalog.format(
+    'ALTER FUNCTION %I.invalidate_unclaimed_scheduled_agent_runs_on_task_inactive() '
+      || 'SET search_path = pg_catalog, %I, pg_temp',
+    data_schema,
+    data_schema
+  );
+  EXECUTE pg_catalog.format(
+    'ALTER FUNCTION %I.fence_terminal_scheduled_occurrence_delivery() '
+      || 'SET search_path = pg_catalog, %I, pg_temp',
+    data_schema,
+    data_schema
+  );
+END
+$pin_scheduled_task_unclaimed_invalidation$;

package/drizzle/0396_model_call_equivalent_credit_cost.sql

@@ -0,0 +1,28 @@
+-- deployment-mode: rolling
+-- Preserve the hypothetical OpenGeni credit price separately from both the
+-- upstream provider estimate and the amount actually priced to credits.
+-- Historical external facts remain unknown rather than being recomputed with
+-- today's margin or provider rates.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+ALTER TABLE "model_call_facts"
+  ADD COLUMN IF NOT EXISTS "equivalent_credit_cost_micros" bigint;
+
+ALTER TABLE "model_call_facts"
+  DROP CONSTRAINT IF EXISTS "model_call_facts_equivalent_credit_cost_check",
+  ADD CONSTRAINT "model_call_facts_equivalent_credit_cost_check"
+    CHECK (
+      "equivalent_credit_cost_micros" IS NULL
+      OR (
+        "equivalent_credit_cost_micros" >= 0
+        AND "estimated_provider_cost_micros" IS NOT NULL
+      )
+    ) NOT VALID;
+
+ALTER TABLE "model_call_facts"
+  VALIDATE CONSTRAINT "model_call_facts_equivalent_credit_cost_check";
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0397_sandbox_deadline_rotation_preemption.sql

@@ -0,0 +1,113 @@
+-- deployment-mode: rolling
+-- A finite provider lifetime is a hard destruction boundary. Once the normal
+-- lead-time rotation request is durable, persistent Browser/Computer placement
+-- must yield while enough time remains to quiesce writers and capture the exact
+-- workspace generation. Waiting until the provider deadline keeps the lease
+-- holder alive until the same instant the provider may destroy the box.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+DO $sandbox_deadline_rotation_preemption$
+DECLARE
+  definition text;
+  patched text;
+  eligibility_anchor constant text :=
+    E'          AND lease.provider_deadline_at <= pg_catalog.now()';
+  eligibility_replacement constant text :=
+    E'          -- 0397 deadline rotation preemption: an automatic finite-lifetime\n'
+    || E'          -- rotation yields persistent controllers at the lead boundary;\n'
+    || E'          -- unrelated operator rotations retain the hard-deadline fallback.\n'
+    || E'          AND (\n'
+    || E'            lease.rotation_reason = ''provider_deadline''\n'
+    || E'            OR lease.provider_deadline_at <= pg_catalog.now()\n'
+    || E'          )';
+  message_anchor constant text :=
+    E'          error_message = ''Interaction controller reached its sandbox provider deadline'',';
+  message_replacement constant text :=
+    E'          error_message = ''Interaction controller yielded for sandbox provider rotation'',';
+  occurrences integer;
+BEGIN
+  SELECT pg_catalog.pg_get_functiondef(
+    'opengeni_private.reap_stale_interaction_transitions(bigint)'::regprocedure
+  ) INTO definition;
+
+  IF definition IS NULL
+    OR pg_catalog.strpos(
+      definition,
+      '0391 provider-deadline interaction follow-up'
+    ) = 0
+    OR pg_catalog.strpos(
+      definition,
+      'interaction_holder.kind = ''interaction'''
+    ) = 0
+    OR pg_catalog.strpos(definition, 'provider_deadline_rotation') = 0
+  THEN
+    RAISE EXCEPTION '0397 interaction rotation prerequisite definition drift'
+      USING ERRCODE = '55000';
+  END IF;
+
+  IF pg_catalog.strpos(definition, '0397 deadline rotation preemption') > 0 THEN
+    IF pg_catalog.strpos(
+      definition,
+      'lease.rotation_reason = ''provider_deadline'''
+    ) = 0
+      OR pg_catalog.strpos(
+        definition,
+        'Interaction controller yielded for sandbox provider rotation'
+      ) = 0
+    THEN
+      RAISE EXCEPTION '0397 interaction rotation replay definition drift'
+        USING ERRCODE = '55000';
+    END IF;
+  ELSE
+    patched := definition;
+
+    occurrences := (
+      pg_catalog.length(patched)
+        - pg_catalog.length(pg_catalog.replace(patched, eligibility_anchor, ''))
+    ) / pg_catalog.length(eligibility_anchor);
+    IF occurrences <> 1 THEN
+      RAISE EXCEPTION '0397 interaction rotation eligibility anchor drift'
+        USING ERRCODE = '55000';
+    END IF;
+    patched := pg_catalog.replace(
+      patched,
+      eligibility_anchor,
+      eligibility_replacement
+    );
+
+    occurrences := (
+      pg_catalog.length(patched)
+        - pg_catalog.length(pg_catalog.replace(patched, message_anchor, ''))
+    ) / pg_catalog.length(message_anchor);
+    IF occurrences <> 1 THEN
+      RAISE EXCEPTION '0397 interaction rotation message anchor drift'
+        USING ERRCODE = '55000';
+    END IF;
+    patched := pg_catalog.replace(
+      patched,
+      message_anchor,
+      message_replacement
+    );
+
+    IF pg_catalog.strpos(patched, '0397 deadline rotation preemption') = 0
+      OR pg_catalog.strpos(
+        patched,
+        'lease.rotation_reason = ''provider_deadline'''
+      ) = 0
+      OR pg_catalog.strpos(
+        patched,
+        'OR lease.provider_deadline_at <= pg_catalog.now()'
+      ) = 0
+    THEN
+      RAISE EXCEPTION '0397 interaction rotation patch failed'
+        USING ERRCODE = '55000';
+    END IF;
+
+    EXECUTE patched;
+  END IF;
+END
+$sandbox_deadline_rotation_preemption$;
+
+RESET statement_timeout;
+RESET lock_timeout;