@opengeni/db 3.7.4 → 3.8.2-canary.0

package/src/index.ts

@@ -217,8 +217,12 @@ import {
 } from "@opengeni/contracts";
 
 import {
+  approximateSessionEventTokens,
   approvalIdentifier,
+  boundSessionEvent,
   boundWorkspaceControlEvent,
+  sessionEventJsonBytes,
+  sessionEventPayloadTruncation,
   workspaceControlUtf8Bytes,
   WORKSPACE_STATE_MEMORY_SAMPLE_LIMIT,
   SESSION_EVENT_RAW_DELTA_TYPES,
@@ -251,9 +255,17 @@ import {
   HumanInputQuestion as HumanInputQuestionContract,
   SubmitHumanInputResponseRequest,
   TurnExecutionPolicyV1,
+  OPENROUTER_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY,
+  OPENROUTER_CREDENTIAL_OPERATION_ID_METADATA_KEY,
+  VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY,
+  VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_ID_METADATA_KEY,
 } from "@opengeni/contracts";
 import {
   environmentsEncryptionKeyBytes,
+  SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS,
+  SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS,
+  WORKSPACE_OPENROUTER_CONNECTION_DOMAIN,
+  WORKSPACE_OPENROUTER_CONNECTION_ROLE,
   VERCEL_AI_GATEWAY_CONNECTION_DOMAIN,
   VERCEL_AI_GATEWAY_CONNECTION_ROLE,
   type Settings,
@@ -343,6 +355,7 @@ import {
   lockSessionEventWriteRows,
   lockWorkspaceInferenceControl,
   registerInternalUpdateWakeInTransaction,
+  registerSessionWorkflowWakeInTransaction,
   SESSION_DISCOVERY_CONTROL_TITLE_MAX_CHARS,
   assertSessionAuthoritySnapshot,
   registerSessionTurnAttemptClaim,
@@ -509,6 +522,7 @@ export {
 } from "./provision-roles";
 // Workspace Memory V1 pure domain surface (gates, render, canonical prompt text).
 export * from "./memory-domain";
+export * from "./model-catalog";
 
 import {
   dbBindingFor,
@@ -3142,6 +3156,24 @@ async function lockBackgroundCommandWorkspaceLifecycle(
   }
 }
 
+async function authorizeOrganizationWorkspaceDeletion(
+  tx: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+  },
+): Promise<void> {
+  await setSubjectRlsContext(tx, input.subjectId);
+  await tx.execute(sql`
+    select authorize_organization_shared_workspace_administration(
+      ${input.accountId}::uuid,
+      ${input.workspaceId}::uuid,
+      ${input.subjectId}
+    )
+  `);
+}
+
 /**
  * Atomically prove a workspace has no live runtime ownership and delete it.
  *
@@ -3153,10 +3185,33 @@ async function lockBackgroundCommandWorkspaceLifecycle(
  */
 export async function deleteWorkspaceIfQuiescent(
   db: Database,
-  input: { accountId: string; workspaceId: string; observer?: WorkspaceDeleteObserver },
+  input: {
+    accountId: string;
+    workspaceId: string;
+    observer?: WorkspaceDeleteObserver;
+    organizationAdministratorSubjectId?: string;
+  },
 ): Promise<DeleteWorkspaceIfQuiescentResult> {
   const transactionStartedAt = performance.now();
   try {
+    if (input.organizationAdministratorSubjectId) {
+      // Reject a clearly unauthorized caller before it can acquire or wait on
+      // the exclusive workspace lifecycle lock. This preflight is deliberately
+      // not the mutation authority: the deletion transaction repeats the same
+      // check after taking the lifecycle lock so a concurrent demotion still
+      // fails closed without reintroducing the account/lifecycle lock cycle.
+      await withRlsContext(
+        db,
+        { accountId: input.accountId, workspaceId: input.workspaceId },
+        async (scopedDb) =>
+          await authorizeOrganizationWorkspaceDeletion(scopedDb, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            subjectId: input.organizationAdministratorSubjectId!,
+          }),
+      );
+    }
+
     const result = await withRlsContext(
       db,
       { accountId: input.accountId, workspaceId: input.workspaceId },
@@ -3166,7 +3221,10 @@ export async function deleteWorkspaceIfQuiescent(
           // Adoption takes the matching shared prefix before its canonical
           // session/attempt or retained-process locks. Taking the exclusive
           // prefix first prevents parent-FK deletion from deadlocking with an
-          // already-started cross-workspace adoption.
+          // already-started cross-workspace adoption. It must also precede the
+          // organization-administration seam: that seam takes the account row
+          // FOR KEY SHARE, while ordinary deletion takes this lifecycle lock
+          // before upgrading the account row to FOR UPDATE.
           const lifecycleLockStartedAt = performance.now();
           await lockBackgroundCommandWorkspaceLifecycle(tx, [input.workspaceId], "update");
           observeWorkspaceDeletePhase(input.observer, {
@@ -3175,6 +3233,14 @@ export async function deleteWorkspaceIfQuiescent(
             durationSeconds: workspaceDeletePhaseDuration(lifecycleLockStartedAt),
           });
 
+          if (input.organizationAdministratorSubjectId) {
+            await authorizeOrganizationWorkspaceDeletion(tx, {
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              subjectId: input.organizationAdministratorSubjectId,
+            });
+          }
+
           const accountWorkspaceLockStartedAt = performance.now();
           const [account] = await tx
             .select({ id: schema.managedAccounts.id })
@@ -4623,6 +4689,7 @@ export type ModelCallFact = {
   totalTokens: number | null;
   pricedCostMicros: number;
   estimatedProviderCostMicros: number | null;
+  equivalentCreditCostMicros: number | null;
   pricingSource: "configured_list_price" | "gateway_reported" | null;
   contextContributions: readonly ModelContextContributionSummary[] | null;
   occurredAt: Date;
@@ -4658,6 +4725,7 @@ function mapModelCallFact(row: typeof schema.modelCallFacts.$inferSelect): Model
     totalTokens: row.totalTokens,
     pricedCostMicros: row.pricedCostMicros,
     estimatedProviderCostMicros: row.estimatedProviderCostMicros,
+    equivalentCreditCostMicros: row.equivalentCreditCostMicros,
     pricingSource:
       row.pricingSource === "configured_list_price" || row.pricingSource === "gateway_reported"
         ? row.pricingSource
@@ -4724,6 +4792,7 @@ export async function recordModelCallFact(
     billingPath: ModelCallBillingPath;
     pricedCostMicros: number;
     estimatedProviderCostMicros?: number | null;
+    equivalentCreditCostMicros?: number | null;
     pricingSource?: "configured_list_price" | "gateway_reported" | null;
     contextContributions?: readonly ModelContextContributionSummary[] | null;
     inputTokens?: number | null;
@@ -4747,6 +4816,20 @@ export async function recordModelCallFact(
       "recordModelCallFact: estimatedProviderCostMicros must be null or a non-negative safe integer",
     );
   }
+  if (
+    input.equivalentCreditCostMicros != null &&
+    (input.equivalentCreditCostMicros < 0 ||
+      !Number.isSafeInteger(input.equivalentCreditCostMicros))
+  ) {
+    throw new Error(
+      "recordModelCallFact: equivalentCreditCostMicros must be null or a non-negative safe integer",
+    );
+  }
+  if (input.equivalentCreditCostMicros != null && input.estimatedProviderCostMicros == null) {
+    throw new Error(
+      "recordModelCallFact: equivalentCreditCostMicros requires estimatedProviderCostMicros",
+    );
+  }
   if ((input.estimatedProviderCostMicros == null) !== (input.pricingSource == null)) {
     throw new Error(
       "recordModelCallFact: estimatedProviderCostMicros and pricingSource must be present together",
@@ -4808,6 +4891,7 @@ export async function recordModelCallFact(
           totalTokens: input.totalTokens ?? null,
           pricedCostMicros: input.pricedCostMicros,
           estimatedProviderCostMicros: input.estimatedProviderCostMicros ?? null,
+          equivalentCreditCostMicros: input.equivalentCreditCostMicros ?? null,
           pricingSource: input.pricingSource ?? null,
           contextContributions,
           occurredAt,
@@ -4825,6 +4909,7 @@ export async function recordModelCallFact(
             initiatorSubjectId: sql`coalesce(${schema.modelCallFacts.initiatorSubjectId}, excluded.initiator_subject_id)`,
             turnSource: sql`coalesce(${schema.modelCallFacts.turnSource}, excluded.turn_source)`,
             estimatedProviderCostMicros: sql`coalesce(${schema.modelCallFacts.estimatedProviderCostMicros}, excluded.estimated_provider_cost_micros)`,
+            equivalentCreditCostMicros: sql`coalesce(${schema.modelCallFacts.equivalentCreditCostMicros}, excluded.equivalent_credit_cost_micros)`,
             pricingSource: sql`coalesce(${schema.modelCallFacts.pricingSource}, excluded.pricing_source)`,
             contextContributions: sql`coalesce(${schema.modelCallFacts.contextContributions}, excluded.context_contributions)`,
           },
@@ -5202,6 +5287,8 @@ export type CreateScheduledTaskInput = {
   // The rig each run binds to (M3); active version resolved per fire at dispatch.
   rigId?: string | null;
   metadata: Record<string, unknown>;
+  /** Trusted database-only admission seam. Throwing rolls the task creation back. */
+  beforeCreateCommit?: (tx: Database) => Promise<void>;
 };
 
 export type UpdateScheduledTaskInput = Partial<{
@@ -5224,6 +5311,8 @@ export type UpdateScheduledTaskInput = Partial<{
   authorityUpdatedBy: TurnInitiator;
   authorityUpdatedByContext: TurnInitiatorContext;
   authorityUpdatedByActor: AgentSessionCreationActor | null;
+  /** Trusted database-only admission seam. Throwing rolls the task update back. */
+  beforeUpdateCommit: (tx: Database) => Promise<void>;
 }>;
 
 export type CreatePackInstallationInput = {
@@ -5358,6 +5447,51 @@ export type CreateConnectionInput = {
   updatedBySubjectId?: string | null;
 };
 
+type UpsertWorkspaceProviderApiKeyConnectionInput = {
+  accountId: string;
+  workspaceId: string;
+  operationId: string;
+  requestDigest: string;
+  credentialEncrypted: string;
+  grantedScopes?: string[];
+  expiresAt?: Date | null;
+  metadata?: Record<string, unknown>;
+  updatedBySubjectId: string;
+};
+
+type RotateWorkspaceProviderApiKeyConnectionInput = {
+  accountId: string;
+  workspaceId: string;
+  connectionId: string;
+  expectedVersion: number;
+  operationId: string;
+  requestDigest: string;
+  credentialEncrypted: string;
+  grantedScopes?: string[];
+  expiresAt?: Date | null;
+  metadata?: Record<string, unknown>;
+  updatedBySubjectId: string;
+};
+
+type RevokeWorkspaceProviderApiKeyConnectionsInput = {
+  accountId: string;
+  workspaceId: string;
+  connectionId: string;
+  expectedVersion: number;
+  updatedBySubjectId: string;
+};
+
+export type UpsertWorkspaceVercelAiGatewayConnectionInput =
+  UpsertWorkspaceProviderApiKeyConnectionInput;
+export type RotateWorkspaceVercelAiGatewayConnectionInput =
+  RotateWorkspaceProviderApiKeyConnectionInput;
+export type RevokeWorkspaceVercelAiGatewayConnectionsInput =
+  RevokeWorkspaceProviderApiKeyConnectionsInput;
+export type UpsertWorkspaceOpenRouterConnectionInput = UpsertWorkspaceProviderApiKeyConnectionInput;
+export type RotateWorkspaceOpenRouterConnectionInput = RotateWorkspaceProviderApiKeyConnectionInput;
+export type RevokeWorkspaceOpenRouterConnectionsInput =
+  RevokeWorkspaceProviderApiKeyConnectionsInput;
+
 export type UpdateConnectionInput = {
   workspaceId: string;
   connectionId: string;
@@ -5756,6 +5890,7 @@ export type InstallPortableSkillInput = {
   sourcePath: string;
   name: string;
   description: string;
+  activationMode?: "workspace_managed" | "session_selected";
   category?: string;
   tags?: string[];
   provenance?: "platform" | "deployment" | "registry" | "workspace";
@@ -5796,6 +5931,7 @@ export type PortableSkillRuntime = {
   version: string;
   name: string;
   description: string;
+  activationMode: "workspace_managed" | "session_selected";
   sourceUrl: string;
   sourceCommit: string;
   sourcePath: string;
@@ -8232,6 +8368,7 @@ export async function installPortableSkill(
         }
         if (!pluginVersion) throw new Error("Failed to create portable Skill plugin version");
 
+        const activationMode = input.activationMode ?? "workspace_managed";
         let [facet] = await tx
           .select()
           .from(schema.capabilityFacets)
@@ -8249,12 +8386,17 @@ export async function installPortableSkill(
               pluginVersionId: pluginVersion.id,
               facetKey: "skill",
               kind: "skill",
-              activationMode: "workspace_managed",
+              activationMode,
               required: true,
             })
             .returning();
         }
         if (!facet) throw new Error("Failed to create portable Skill facet");
+        if (facet.activationMode !== activationMode) {
+          throw new Error(
+            `Portable Skill ${input.capabilityId} activation mode conflicts with immutable stored content`,
+          );
+        }
 
         const [existingSkill] = await tx
           .select()
@@ -8458,16 +8600,22 @@ export async function installPortableSkill(
   );
 }
 
-/** Return exact text artifacts for active authoritative Skill installations. */
+/**
+ * Return exact text artifacts for active authoritative Skill installations.
+ * Session-selected Skills are excluded from ambient runtime resolution unless
+ * the caller is explicitly materializing one during session admission.
+ */
 export async function listInstalledPortableSkills(
   db: Database,
   workspaceId: string,
+  options: { includeSessionSelected?: boolean } = {},
 ): Promise<PortableSkillRuntime[]> {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const rows = await scopedDb
       .select({
         capabilityId: schema.capabilitySkillFacets.capabilityId,
         facetId: schema.capabilitySkillFacets.facetId,
+        activationMode: schema.capabilityFacets.activationMode,
         manifest: schema.capabilityPluginVersions.manifest,
         version: schema.capabilityPluginVersions.version,
         name: schema.capabilitySkillFacets.name,
@@ -8494,6 +8642,10 @@ export async function listInstalledPortableSkills(
           schema.capabilityPluginInstallations.id,
         ),
       )
+      .innerJoin(
+        schema.capabilityFacets,
+        eq(schema.capabilityFacets.id, schema.capabilityFacetInstallations.facetId),
+      )
       .innerJoin(
         schema.capabilitySkillFacets,
         eq(schema.capabilitySkillFacets.facetId, schema.capabilityFacetInstallations.facetId),
@@ -8518,6 +8670,14 @@ export async function listInstalledPortableSkills(
       .orderBy(asc(schema.capabilitySkillFacets.name), asc(schema.capabilitySkillFiles.path));
     const skills = new Map<string, PortableSkillRuntime>();
     for (const row of rows) {
+      if (row.activationMode !== "workspace_managed" && row.activationMode !== "session_selected") {
+        throw new Error(
+          `Installed Skill ${row.capabilityId} has invalid activation mode ${row.activationMode}`,
+        );
+      }
+      if (row.activationMode === "session_selected" && !options.includeSessionSelected) {
+        continue;
+      }
       const source = skillSourceFromManifest(row.manifest, row.capabilityId);
       const existing = skills.get(row.facetId);
       if (existing) {
@@ -8530,6 +8690,7 @@ export async function listInstalledPortableSkills(
         version: row.version,
         name: row.name,
         description: row.description,
+        activationMode: row.activationMode,
         sourceUrl: row.sourceUrl,
         sourceCommit: row.sourceCommit,
         sourcePath: row.sourcePath,
@@ -9458,6 +9619,318 @@ export async function createConnection(
   );
 }
 
+type WorkspaceProviderApiKeyConnectionKind = "vercel_gateway" | "openrouter";
+
+type WorkspaceProviderApiKeyConnectionSpec = {
+  providerDomain: string;
+  credentialRole: string;
+  operationIdMetadataKey: string;
+  operationDigestMetadataKey: string;
+  label: string;
+};
+
+function workspaceProviderApiKeyConnectionSpec(
+  providerKind: WorkspaceProviderApiKeyConnectionKind,
+): WorkspaceProviderApiKeyConnectionSpec {
+  return providerKind === "vercel_gateway"
+    ? {
+        providerDomain: VERCEL_AI_GATEWAY_CONNECTION_DOMAIN,
+        credentialRole: VERCEL_AI_GATEWAY_CONNECTION_ROLE,
+        operationIdMetadataKey: VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_ID_METADATA_KEY,
+        operationDigestMetadataKey: VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY,
+        label: "Vercel AI Gateway",
+      }
+    : {
+        providerDomain: WORKSPACE_OPENROUTER_CONNECTION_DOMAIN,
+        credentialRole: WORKSPACE_OPENROUTER_CONNECTION_ROLE,
+        operationIdMetadataKey: OPENROUTER_CREDENTIAL_OPERATION_ID_METADATA_KEY,
+        operationDigestMetadataKey: OPENROUTER_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY,
+        label: "OpenRouter",
+      };
+}
+
+async function lockWorkspaceProviderApiKeyConnection(
+  db: Database,
+  workspaceId: string,
+  providerKind: WorkspaceProviderApiKeyConnectionKind,
+): Promise<void> {
+  const lockKey =
+    providerKind === "vercel_gateway"
+      ? `workspace-vercel-ai-gateway:${workspaceId}`
+      : `workspace-openrouter:${workspaceId}`;
+  await db.execute(sql`select pg_advisory_xact_lock(hashtextextended(${lockKey}, 0))`);
+}
+
+async function upsertWorkspaceProviderApiKeyConnection(
+  db: Database,
+  providerKind: WorkspaceProviderApiKeyConnectionKind,
+  input: UpsertWorkspaceProviderApiKeyConnectionInput,
+): Promise<ConnectionMetadataWithVerification | null> {
+  const spec = workspaceProviderApiKeyConnectionSpec(providerKind);
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (txRaw) => {
+        const tx = txRaw as unknown as Database;
+        await lockWorkspaceProviderApiKeyConnection(tx, input.workspaceId, providerKind);
+        const rows = await tx
+          .select(connectionMetadataColumns)
+          .from(schema.connections)
+          .where(
+            and(
+              eq(schema.connections.accountId, input.accountId),
+              eq(schema.connections.workspaceId, input.workspaceId),
+              isNull(schema.connections.subjectId),
+              sql`lower(${schema.connections.providerDomain}) = lower(${spec.providerDomain})`,
+              eq(schema.connections.kind, "api_key"),
+              sql`${schema.connections.metadata} ->> 'credentialRole' = ${spec.credentialRole}`,
+            ),
+          )
+          .orderBy(
+            desc(sql`(${schema.connections.status} = 'active')`),
+            desc(schema.connections.updatedAt),
+            desc(schema.connections.createdAt),
+            desc(schema.connections.id),
+          )
+          .for("update");
+        const metadata = {
+          ...(input.metadata ?? {}),
+          credentialRole: spec.credentialRole,
+          [spec.operationIdMetadataKey]: input.operationId,
+          [spec.operationDigestMetadataKey]: input.requestDigest,
+        };
+        const operationRow = rows.find(
+          (row) => row.metadata[spec.operationIdMetadataKey] === input.operationId,
+        );
+        if (operationRow) {
+          return operationRow.metadata[spec.operationDigestMetadataKey] === input.requestDigest
+            ? mapConnectionMetadata(operationRow)
+            : null;
+        }
+        if (rows.some((row) => row.status !== "revoked")) return null;
+        return await createConnectionInScope(tx, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          subjectId: null,
+          providerDomain: spec.providerDomain,
+          kind: "api_key",
+          status: "active",
+          credentialEncrypted: input.credentialEncrypted,
+          grantedScopes: input.grantedScopes ?? [],
+          expiresAt: input.expiresAt ?? null,
+          metadata,
+          createdBySubjectId: input.updatedBySubjectId,
+          updatedBySubjectId: input.updatedBySubjectId,
+        });
+      }),
+  );
+}
+
+async function rotateWorkspaceProviderApiKeyConnection(
+  db: Database,
+  providerKind: WorkspaceProviderApiKeyConnectionKind,
+  input: RotateWorkspaceProviderApiKeyConnectionInput,
+): Promise<ConnectionMetadataWithVerification | null> {
+  const spec = workspaceProviderApiKeyConnectionSpec(providerKind);
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (txRaw) => {
+        const tx = txRaw as unknown as Database;
+        await lockWorkspaceProviderApiKeyConnection(tx, input.workspaceId, providerKind);
+        const rows = await tx
+          .select(connectionMetadataColumns)
+          .from(schema.connections)
+          .where(
+            and(
+              eq(schema.connections.accountId, input.accountId),
+              eq(schema.connections.workspaceId, input.workspaceId),
+              isNull(schema.connections.subjectId),
+              sql`lower(${schema.connections.providerDomain}) = lower(${spec.providerDomain})`,
+              eq(schema.connections.kind, "api_key"),
+              sql`${schema.connections.metadata} ->> 'credentialRole' = ${spec.credentialRole}`,
+            ),
+          )
+          .orderBy(desc(schema.connections.updatedAt), desc(schema.connections.id))
+          .for("update");
+        const operationRow = rows.find(
+          (row) => row.metadata[spec.operationIdMetadataKey] === input.operationId,
+        );
+        if (operationRow) {
+          return operationRow.status !== "revoked" &&
+            operationRow.metadata[spec.operationDigestMetadataKey] === input.requestDigest
+            ? mapConnectionMetadata(operationRow)
+            : null;
+        }
+        const targetRow = rows.find((row) => row.id === input.connectionId);
+        if (
+          !targetRow ||
+          targetRow.status === "revoked" ||
+          targetRow.version !== input.expectedVersion
+        ) {
+          return null;
+        }
+        const metadata = {
+          ...(input.metadata ?? {}),
+          credentialRole: spec.credentialRole,
+          [spec.operationIdMetadataKey]: input.operationId,
+          [spec.operationDigestMetadataKey]: input.requestDigest,
+        };
+        for (const row of rows.filter((candidate) => candidate.status !== "revoked")) {
+          const revoked = await revokeConnectionInScope(
+            tx,
+            input.workspaceId,
+            row.id,
+            input.updatedBySubjectId,
+            row.version,
+          );
+          if (!revoked) {
+            throw new Error(`${spec.label} connection changed during rotation`);
+          }
+        }
+        return await createConnectionInScope(tx, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          subjectId: null,
+          providerDomain: spec.providerDomain,
+          kind: "api_key",
+          status: "active",
+          credentialEncrypted: input.credentialEncrypted,
+          grantedScopes: input.grantedScopes ?? [],
+          expiresAt: input.expiresAt ?? null,
+          metadata,
+          createdBySubjectId: input.updatedBySubjectId,
+          updatedBySubjectId: input.updatedBySubjectId,
+        });
+      }),
+  );
+}
+
+async function revokeWorkspaceProviderApiKeyConnections(
+  db: Database,
+  providerKind: WorkspaceProviderApiKeyConnectionKind,
+  input: RevokeWorkspaceProviderApiKeyConnectionsInput,
+): Promise<ConnectionMetadataWithVerification | null> {
+  const spec = workspaceProviderApiKeyConnectionSpec(providerKind);
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (txRaw) => {
+        const tx = txRaw as unknown as Database;
+        await lockWorkspaceProviderApiKeyConnection(tx, input.workspaceId, providerKind);
+        const [targetRow] = await tx
+          .select(connectionMetadataColumns)
+          .from(schema.connections)
+          .where(
+            and(
+              eq(schema.connections.accountId, input.accountId),
+              eq(schema.connections.workspaceId, input.workspaceId),
+              eq(schema.connections.id, input.connectionId),
+              isNull(schema.connections.subjectId),
+            ),
+          )
+          .for("update")
+          .limit(1);
+        if (
+          !targetRow ||
+          targetRow.providerDomain.toLowerCase() !== spec.providerDomain ||
+          targetRow.kind !== "api_key" ||
+          targetRow.metadata.credentialRole !== spec.credentialRole
+        ) {
+          return null;
+        }
+        // A replay of an already-committed DELETE is idempotent for that exact
+        // connection generation. It must not sweep a newer provider connection
+        // that was established after the original response was lost.
+        if (targetRow.status === "revoked") {
+          return mapConnectionMetadata(targetRow);
+        }
+        if (targetRow.version !== input.expectedVersion) {
+          return null;
+        }
+        const providerRows = await tx
+          .select(connectionMetadataColumns)
+          .from(schema.connections)
+          .where(
+            and(
+              eq(schema.connections.accountId, input.accountId),
+              eq(schema.connections.workspaceId, input.workspaceId),
+              isNull(schema.connections.subjectId),
+              sql`lower(${schema.connections.providerDomain}) = lower(${spec.providerDomain})`,
+              eq(schema.connections.kind, "api_key"),
+              ne(schema.connections.status, "revoked"),
+              sql`${schema.connections.metadata} ->> 'credentialRole' = ${spec.credentialRole}`,
+            ),
+          )
+          .orderBy(desc(schema.connections.updatedAt), desc(schema.connections.id))
+          .for("update");
+        let result = mapConnectionMetadata(targetRow);
+        for (const row of providerRows) {
+          const revoked = await revokeConnectionInScope(
+            tx,
+            input.workspaceId,
+            row.id,
+            input.updatedBySubjectId,
+            row.version,
+          );
+          if (!revoked) {
+            throw new Error(`${spec.label} connection changed during disconnect`);
+          }
+          if (row.id === input.connectionId) result = revoked;
+        }
+        return result;
+      }),
+  );
+}
+
+/** Compatibility wrapper for the existing Vercel AI Gateway create/replay contract. */
+export async function upsertWorkspaceVercelAiGatewayConnection(
+  db: Database,
+  input: UpsertWorkspaceVercelAiGatewayConnectionInput,
+): Promise<ConnectionMetadataWithVerification | null> {
+  return await upsertWorkspaceProviderApiKeyConnection(db, "vercel_gateway", input);
+}
+
+export async function upsertWorkspaceOpenRouterConnection(
+  db: Database,
+  input: UpsertWorkspaceOpenRouterConnectionInput,
+): Promise<ConnectionMetadataWithVerification | null> {
+  return await upsertWorkspaceProviderApiKeyConnection(db, "openrouter", input);
+}
+
+/** Compatibility wrapper for the existing Vercel AI Gateway rotation contract. */
+export async function rotateWorkspaceVercelAiGatewayConnection(
+  db: Database,
+  input: RotateWorkspaceVercelAiGatewayConnectionInput,
+): Promise<ConnectionMetadataWithVerification | null> {
+  return await rotateWorkspaceProviderApiKeyConnection(db, "vercel_gateway", input);
+}
+
+export async function rotateWorkspaceOpenRouterConnection(
+  db: Database,
+  input: RotateWorkspaceOpenRouterConnectionInput,
+): Promise<ConnectionMetadataWithVerification | null> {
+  return await rotateWorkspaceProviderApiKeyConnection(db, "openrouter", input);
+}
+
+/** Compatibility wrapper for the existing Vercel AI Gateway revoke contract. */
+export async function revokeWorkspaceVercelAiGatewayConnections(
+  db: Database,
+  input: RevokeWorkspaceVercelAiGatewayConnectionsInput,
+): Promise<ConnectionMetadataWithVerification | null> {
+  return await revokeWorkspaceProviderApiKeyConnections(db, "vercel_gateway", input);
+}
+
+export async function revokeWorkspaceOpenRouterConnections(
+  db: Database,
+  input: RevokeWorkspaceOpenRouterConnectionsInput,
+): Promise<ConnectionMetadataWithVerification | null> {
+  return await revokeWorkspaceProviderApiKeyConnections(db, "openrouter", input);
+}
+
 /**
  * Serialize one provider-principal/owner connection generation. Distinct OAuth
  * starts for the same principal converge on one row, while an explicit
@@ -13493,11 +13966,21 @@ export async function loadConnectionCredentialForBroker(
   );
 }
 
-export async function workspaceVercelAiGatewayConnectionActive(
+async function getWorkspaceProviderApiKeyConnectionMetadata(
   db: Database,
   workspaceId: string,
-): Promise<boolean> {
-  return (await getWorkspaceVercelAiGatewayConnectionMetadata(db, workspaceId)) !== null;
+  providerKind: WorkspaceProviderApiKeyConnectionKind,
+): Promise<{ connectionId: string; version: number } | null> {
+  const spec = workspaceProviderApiKeyConnectionSpec(providerKind);
+  const connection = (await listConnectionsMetadata(db, workspaceId, null)).find(
+    (candidate) =>
+      candidate.subjectId === null &&
+      candidate.providerDomain.toLowerCase() === spec.providerDomain &&
+      candidate.kind === "api_key" &&
+      candidate.status === "active" &&
+      candidate.metadata.credentialRole === spec.credentialRole,
+  );
+  return connection ? { connectionId: connection.id, version: connection.version } : null;
 }
 
 /** Metadata-only capability revision input; never selects/decrypts the API key. */
@@ -13505,32 +13988,44 @@ export async function getWorkspaceVercelAiGatewayConnectionMetadata(
   db: Database,
   workspaceId: string,
 ): Promise<{ connectionId: string; version: number } | null> {
-  const gatewayConnection = (await listConnectionsMetadata(db, workspaceId, null)).find(
-    (candidate) =>
-      candidate.subjectId === null &&
-      candidate.providerDomain === VERCEL_AI_GATEWAY_CONNECTION_DOMAIN &&
-      candidate.kind === "api_key" &&
-      candidate.status === "active" &&
-      candidate.metadata.credentialRole === VERCEL_AI_GATEWAY_CONNECTION_ROLE,
-  );
-  return gatewayConnection
-    ? { connectionId: gatewayConnection.id, version: gatewayConnection.version }
-    : null;
+  return await getWorkspaceProviderApiKeyConnectionMetadata(db, workspaceId, "vercel_gateway");
 }
 
-/** Resolve only the reviewed workspace-shared AI Gateway credential shape. */
-export async function loadWorkspaceVercelAiGatewayApiKey(
+export async function getWorkspaceOpenRouterConnectionMetadata(
+  db: Database,
+  workspaceId: string,
+): Promise<{ connectionId: string; version: number } | null> {
+  return await getWorkspaceProviderApiKeyConnectionMetadata(db, workspaceId, "openrouter");
+}
+
+export async function workspaceVercelAiGatewayConnectionActive(
+  db: Database,
+  workspaceId: string,
+): Promise<boolean> {
+  return (await getWorkspaceVercelAiGatewayConnectionMetadata(db, workspaceId)) !== null;
+}
+
+export async function workspaceOpenRouterConnectionActive(
+  db: Database,
+  workspaceId: string,
+): Promise<boolean> {
+  return (await getWorkspaceOpenRouterConnectionMetadata(db, workspaceId)) !== null;
+}
+
+async function loadWorkspaceProviderApiKey(
   db: Database,
   settings: Settings,
   workspaceId: string,
+  providerKind: WorkspaceProviderApiKeyConnectionKind,
 ): Promise<string | null> {
+  const spec = workspaceProviderApiKeyConnectionSpec(providerKind);
   const metadata = (await listConnectionsMetadata(db, workspaceId, null)).find(
     (connection) =>
       connection.subjectId === null &&
-      connection.providerDomain === VERCEL_AI_GATEWAY_CONNECTION_DOMAIN &&
+      connection.providerDomain.toLowerCase() === spec.providerDomain &&
       connection.kind === "api_key" &&
       connection.status === "active" &&
-      connection.metadata.credentialRole === VERCEL_AI_GATEWAY_CONNECTION_ROLE,
+      connection.metadata.credentialRole === spec.credentialRole,
   );
   if (!metadata) {
     return null;
@@ -13538,14 +14033,14 @@ export async function loadWorkspaceVercelAiGatewayApiKey(
   const connection = await loadConnectionCredentialForBroker(db, settings, {
     workspaceId,
     connectionId: metadata.id,
-    providerDomain: VERCEL_AI_GATEWAY_CONNECTION_DOMAIN,
+    providerDomain: spec.providerDomain,
     kind: "api_key",
     allowSubjectOwned: false,
   });
   if (
     !connection ||
     connection.status !== "active" ||
-    connection.metadata.credentialRole !== VERCEL_AI_GATEWAY_CONNECTION_ROLE
+    connection.metadata.credentialRole !== spec.credentialRole
   ) {
     return null;
   }
@@ -13553,6 +14048,24 @@ export async function loadWorkspaceVercelAiGatewayApiKey(
   return typeof apiKey === "string" && apiKey.trim().length > 0 ? apiKey : null;
 }
 
+/** Resolve only the reviewed workspace-shared AI Gateway credential shape. */
+export async function loadWorkspaceVercelAiGatewayApiKey(
+  db: Database,
+  settings: Settings,
+  workspaceId: string,
+): Promise<string | null> {
+  return await loadWorkspaceProviderApiKey(db, settings, workspaceId, "vercel_gateway");
+}
+
+/** Resolve only the reviewed workspace-shared OpenRouter credential shape. */
+export async function loadWorkspaceOpenRouterApiKey(
+  db: Database,
+  settings: Settings,
+  workspaceId: string,
+): Promise<string | null> {
+  return await loadWorkspaceProviderApiKey(db, settings, workspaceId, "openrouter");
+}
+
 /**
  * Worker-only immutable credential lease for an asynchronous video operation.
  * The operation copies the already-encrypted credential envelope before its
@@ -15546,6 +16059,7 @@ export async function createScheduledTask(
     async (scopedDb) => {
       const frozenCreator = await frozenSessionCreatorForInsert(scopedDb, input);
       await setScheduledTaskAuthorityRlsContext(scopedDb, frozenCreator);
+      await input.beforeCreateCommit?.(scopedDb);
       const [row] = await scopedDb
         .insert(schema.scheduledTasks)
         .values({
@@ -15623,6 +16137,7 @@ export async function updateScheduledTask(
       });
       await setScheduledTaskAuthorityRlsContext(scopedDb, frozenUpdater);
     }
+    await input.beforeUpdateCommit?.(scopedDb);
     const [row] = await scopedDb
       .update(schema.scheduledTasks)
       .set({
@@ -16209,23 +16724,69 @@ export async function createScheduledTaskRun(
     scheduledAt?: Date | null;
     firedAt?: Date;
     acceptedExecutionSnapshot?: ScheduledTaskRunAcceptedExecutionType | null;
+    /**
+     * Trusted database-only admission seam for a fresh agent occurrence.
+     * Throwing rolls back the run insert; exact producer replay skips it.
+     */
+    beforeFreshAgentRunCommit?: (tx: Database) => Promise<void>;
   },
 ): Promise<ScheduledTaskRun> {
   return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
     if ((input.taskAuthorityRevision == null) !== (input.taskExecutionDigest == null)) {
       throw new Error("scheduled task run execution binding is incomplete");
     }
-    const [taskRow] = await scopedDb
-      .select()
-      .from(schema.scheduledTasks)
-      .where(
-        and(
-          eq(schema.scheduledTasks.workspaceId, input.workspaceId),
-          eq(schema.scheduledTasks.id, input.taskId),
-          isNull(schema.scheduledTasks.deletedAt),
-        ),
-      )
-      .limit(1);
+    let guardedAcceptedExecution: ScheduledTaskRunAcceptedExecutionType | null = null;
+    let replayedProducerRow: typeof schema.scheduledTaskRuns.$inferSelect | undefined;
+    if (input.beforeFreshAgentRunCommit) {
+      if (!input.producerKey || !input.acceptedExecutionSnapshot) {
+        throw new Error(
+          "scheduled fresh agent run commit guard requires a producer-bound accepted execution",
+        );
+      }
+      guardedAcceptedExecution = ScheduledTaskRunAcceptedExecution.parse(
+        input.acceptedExecutionSnapshot,
+      );
+      const readProducerReplay = async () => {
+        const [row] = await scopedDb
+          .select()
+          .from(schema.scheduledTaskRuns)
+          .where(
+            and(
+              eq(schema.scheduledTaskRuns.workspaceId, input.workspaceId),
+              eq(schema.scheduledTaskRuns.producerKey, input.producerKey!),
+            ),
+          )
+          .limit(1);
+        return row;
+      };
+      replayedProducerRow = await readProducerReplay();
+      // Fresh custom-model admission must precede the task row lock. Material
+      // task updates take the same advisory lock before updating that row, and
+      // acquiring them in the opposite order can deadlock behind a queued
+      // exclusive custom-model mutation. An exact durable producer replay
+      // still skips the live-model check so retirement cannot invalidate work
+      // that was already accepted.
+      if (!replayedProducerRow) {
+        try {
+          await input.beforeFreshAgentRunCommit(scopedDb);
+        } catch (error) {
+          // An overlapping producer can commit after the unlocked pre-read
+          // while this retry waits behind a queued retirement. Re-read before
+          // surfacing the mutable-model denial so the committed winner remains
+          // replayable instead of becoming a false terminal rejection.
+          replayedProducerRow = await readProducerReplay();
+          if (!replayedProducerRow) throw error;
+        }
+      }
+    }
+    const taskFilter = and(
+      eq(schema.scheduledTasks.workspaceId, input.workspaceId),
+      eq(schema.scheduledTasks.id, input.taskId),
+      isNull(schema.scheduledTasks.deletedAt),
+    );
+    const [taskRow] = input.beforeFreshAgentRunCommit
+      ? await scopedDb.select().from(schema.scheduledTasks).where(taskFilter).for("update").limit(1)
+      : await scopedDb.select().from(schema.scheduledTasks).where(taskFilter).limit(1);
     if (!taskRow) {
       throw new Error(`Scheduled task not found: ${input.taskId}`);
     }
@@ -16233,8 +16794,14 @@ export async function createScheduledTaskRun(
       "agent_turn") satisfies ScheduledTaskActionKind;
     const acceptedExecutionSnapshot =
       actionKind === "agent_turn"
-        ? ScheduledTaskRunAcceptedExecution.parse(input.acceptedExecutionSnapshot)
+        ? (guardedAcceptedExecution ??
+          ScheduledTaskRunAcceptedExecution.parse(input.acceptedExecutionSnapshot))
         : null;
+    if (input.beforeFreshAgentRunCommit && actionKind !== "agent_turn") {
+      throw new Error(
+        "scheduled fresh agent run commit guard requires a producer-bound accepted execution",
+      );
+    }
     if (
       acceptedExecutionSnapshot &&
       (acceptedExecutionSnapshot.task.id !== input.taskId ||
@@ -16245,6 +16812,27 @@ export async function createScheduledTaskRun(
     ) {
       throw new Error("scheduled task accepted execution binding changed");
     }
+    if (replayedProducerRow) {
+      if (
+        replayedProducerRow.actionKind !== "agent_turn" ||
+        replayedProducerRow.taskId !== input.taskId ||
+        replayedProducerRow.triggerType !== input.triggerType
+      ) {
+        throw new Error("scheduled task run producer identity changed");
+      }
+      if (
+        replayedProducerRow.taskAuthorityRevision !== input.taskAuthorityRevision ||
+        replayedProducerRow.taskExecutionDigest !== input.taskExecutionDigest
+      ) {
+        throw new Error("scheduled task run execution binding changed");
+      }
+      if (
+        stableJson(replayedProducerRow.acceptedExecutionSnapshot) !==
+        stableJson(acceptedExecutionSnapshot)
+      ) {
+        throw new Error("scheduled task run accepted execution changed");
+      }
+    }
     const values = {
       ...(input.runId ? { id: input.runId } : {}),
       accountId: taskRow.accountId,
@@ -16265,42 +16853,47 @@ export async function createScheduledTaskRun(
           )}::jsonb::text, 'UTF8'), 'sha256'), 'hex')`
         : null,
     };
-    let inserted: typeof schema.scheduledTaskRuns.$inferSelect | undefined;
-    if (actionKind === "agent_turn" && input.producerKey && acceptedExecutionSnapshot) {
-      const [created] = await rawRows<{ id: string }>(
-        scopedDb,
-        sql`select create_scheduled_agent_run_with_admission(
-          ${input.runId ?? randomUUID()}::uuid,
-          ${taskRow.accountId}::uuid,
-          ${taskRow.workspaceId}::uuid,
-          ${input.taskId}::uuid,
-          ${input.taskAuthorityRevision}::bigint,
-          ${input.taskExecutionDigest}::text,
-          ${input.triggerType}::text,
-          ${input.producerKey}::text,
-          ${input.scheduledAt?.toISOString() ?? null}::timestamptz,
-          ${(input.firedAt ?? new Date()).toISOString()}::timestamptz,
-          ${JSON.stringify(acceptedExecutionSnapshot)}::jsonb
-        ) as id`,
-      );
-      if (created) {
-        [inserted] = await scopedDb
-          .select()
-          .from(schema.scheduledTaskRuns)
-          .where(eq(schema.scheduledTaskRuns.id, created.id))
-          .limit(1);
+    let inserted = replayedProducerRow;
+    if (!inserted) {
+      if (actionKind === "agent_turn" && input.producerKey && acceptedExecutionSnapshot) {
+        const [created] = await rawRows<{ id: string }>(
+          scopedDb,
+          sql`select create_scheduled_agent_run_with_admission(
+            ${input.runId ?? randomUUID()}::uuid,
+            ${taskRow.accountId}::uuid,
+            ${taskRow.workspaceId}::uuid,
+            ${input.taskId}::uuid,
+            ${input.taskAuthorityRevision}::bigint,
+            ${input.taskExecutionDigest}::text,
+            ${input.triggerType}::text,
+            ${input.producerKey}::text,
+            ${input.scheduledAt?.toISOString() ?? null}::timestamptz,
+            ${(input.firedAt ?? new Date()).toISOString()}::timestamptz,
+            ${JSON.stringify(acceptedExecutionSnapshot)}::jsonb
+          ) as id`,
+        );
+        if (created) {
+          [inserted] = await scopedDb
+            .select()
+            .from(schema.scheduledTaskRuns)
+            .where(eq(schema.scheduledTaskRuns.id, created.id))
+            .limit(1);
+        }
+      } else {
+        [inserted] = input.producerKey
+          ? await scopedDb
+              .insert(schema.scheduledTaskRuns)
+              .values(values)
+              .onConflictDoNothing({
+                target: [
+                  schema.scheduledTaskRuns.workspaceId,
+                  schema.scheduledTaskRuns.producerKey,
+                ],
+                where: sql`${schema.scheduledTaskRuns.producerKey} is not null`,
+              })
+              .returning()
+          : await scopedDb.insert(schema.scheduledTaskRuns).values(values).returning();
       }
-    } else {
-      [inserted] = input.producerKey
-        ? await scopedDb
-            .insert(schema.scheduledTaskRuns)
-            .values(values)
-            .onConflictDoNothing({
-              target: [schema.scheduledTaskRuns.workspaceId, schema.scheduledTaskRuns.producerKey],
-              where: sql`${schema.scheduledTaskRuns.producerKey} is not null`,
-            })
-            .returning()
-        : await scopedDb.insert(schema.scheduledTaskRuns).values(values).returning();
     }
     const [row] = inserted
       ? [inserted]
@@ -16948,17 +17541,10 @@ async function validateScheduledTargetExecutionAtClaim(
     runId: string;
   },
 ): Promise<string | null> {
-  const [liveAuthority] = await rawRows<{ denial: string | null }>(
-    tx,
-    sql`select validate_scheduled_agent_run_live_authority(
-      ${input.accountId}::uuid,
-      ${input.workspaceId}::uuid,
-      ${input.runId}::uuid
-    ) as denial`,
-  );
-  if (liveAuthority?.denial) return liveAuthority.denial;
   const [run] = await tx
     .select({
+      status: schema.scheduledTaskRuns.status,
+      error: schema.scheduledTaskRuns.error,
       acceptedExecutionSnapshot: schema.scheduledTaskRuns.acceptedExecutionSnapshot,
     })
     .from(schema.scheduledTaskRuns)
@@ -16973,6 +17559,22 @@ async function validateScheduledTargetExecutionAtClaim(
     .limit(1)
     .for("update");
   if (!run?.acceptedExecutionSnapshot) return "scheduled_authority_snapshot_missing";
+  if (run.status !== "dispatched") {
+    return run.status === "skipped" &&
+      (run.error === "scheduled_task_paused_before_claim" ||
+        run.error === "scheduled_task_deleted_before_claim")
+      ? "scheduled_task_inactive_before_claim"
+      : "scheduled_run_terminal_before_claim";
+  }
+  const [liveAuthority] = await rawRows<{ denial: string | null }>(
+    tx,
+    sql`select validate_scheduled_agent_run_live_authority(
+      ${input.accountId}::uuid,
+      ${input.workspaceId}::uuid,
+      ${input.runId}::uuid
+    ) as denial`,
+  );
+  if (liveAuthority?.denial) return liveAuthority.denial;
   const accepted = ScheduledTaskRunAcceptedExecution.parse(run.acceptedExecutionSnapshot);
   const target = accepted.targetSessionExecution;
   if (!target) return null;
@@ -21304,6 +21906,8 @@ export async function setWorkspaceCodexSubscriptionModeInTransaction(
     workspaceId: string;
     subjectId: string | null;
     mode: WorkspaceCodexSubscriptionMode;
+    /** Effective source captured under the source lock before caller-owned credential writes. */
+    effectiveSourceBeforeMutation?: EffectiveCodexSubscriptionSource;
   },
 ): Promise<WorkspaceCodexSubscriptionSource> {
   await lockWorkspaceCodexSubscriptionSource(scopedDb, input.workspaceId);
@@ -21314,48 +21918,55 @@ export async function setWorkspaceCodexSubscriptionModeInTransaction(
   if (current.workspaceKind === "personal" && input.mode !== "automatic") {
     throw new Error("personal workspaces always use workspace Codex subscriptions");
   }
-  if (current.mode === input.mode) return current;
-  const [activeCodexTurn] = await scopedDb
-    .select({ id: schema.sessionTurns.id })
-    .from(schema.sessionTurns)
-    .where(
-      and(
-        eq(schema.sessionTurns.workspaceId, input.workspaceId),
-        inArray(schema.sessionTurns.status, ["running", "requires_action", "recovering"]),
-        sql`${schema.sessionTurns.model} like 'codex/%'`,
-      ),
-    )
-    .limit(1);
-  const [liveLease] = await scopedDb
-    .select({ id: schema.codexCredentialLeases.id })
-    .from(schema.codexCredentialLeases)
-    .where(
-      and(
-        eq(schema.codexCredentialLeases.workspaceId, input.workspaceId),
-        gt(schema.codexCredentialLeases.leasedUntil, new Date()),
-      ),
-    )
-    .limit(1);
-  if (activeCodexTurn || liveLease) {
-    throw new Error("Codex subscription source cannot change while active turns are using it");
-  }
-  await scopedDb
-    .insert(schema.workspaceCodexSubscriptionPreferences)
-    .values({
-      accountId: input.accountId,
-      workspaceId: input.workspaceId,
-      mode: input.mode,
-      updatedBySubjectId: input.subjectId,
-    })
-    .onConflictDoUpdate({
-      target: schema.workspaceCodexSubscriptionPreferences.workspaceId,
-      set: {
+  const effectiveSourceBeforeMutation =
+    input.effectiveSourceBeforeMutation ?? current.effectiveSource;
+  let next = current;
+  if (current.mode !== input.mode) {
+    await scopedDb
+      .insert(schema.workspaceCodexSubscriptionPreferences)
+      .values({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
         mode: input.mode,
         updatedBySubjectId: input.subjectId,
-        updatedAt: new Date(),
-      },
-    });
-  return await getWorkspaceCodexSubscriptionSourceScoped(scopedDb, input.workspaceId);
+      })
+      .onConflictDoUpdate({
+        target: schema.workspaceCodexSubscriptionPreferences.workspaceId,
+        set: {
+          mode: input.mode,
+          updatedBySubjectId: input.subjectId,
+          updatedAt: new Date(),
+        },
+      });
+    next = await getWorkspaceCodexSubscriptionSourceScoped(scopedDb, input.workspaceId);
+  }
+  if (next.effectiveSource !== effectiveSourceBeforeMutation) {
+    const [activeCodexTurn] = await scopedDb
+      .select({ id: schema.sessionTurns.id })
+      .from(schema.sessionTurns)
+      .where(
+        and(
+          eq(schema.sessionTurns.workspaceId, input.workspaceId),
+          inArray(schema.sessionTurns.status, ["running", "requires_action", "recovering"]),
+          sql`${schema.sessionTurns.model} like 'codex/%'`,
+        ),
+      )
+      .limit(1);
+    const [liveLease] = await scopedDb
+      .select({ id: schema.codexCredentialLeases.id })
+      .from(schema.codexCredentialLeases)
+      .where(
+        and(
+          eq(schema.codexCredentialLeases.workspaceId, input.workspaceId),
+          gt(schema.codexCredentialLeases.leasedUntil, new Date()),
+        ),
+      )
+      .limit(1);
+    if (activeCodexTurn || liveLease) {
+      throw new Error("Codex subscription source cannot change while active turns are using it");
+    }
+  }
+  return next;
 }
 
 export async function setWorkspaceCodexSubscriptionMode(
@@ -29375,6 +29986,8 @@ export type SessionCreateInput = {
   policyRole?: string | null;
   parentSessionId?: string | null;
   createIdempotencyKey?: string | null;
+  /** Exact explicit installed-Skill selection used for keyed-create replay. */
+  selectedInstalledSkillIds?: string[];
   sandboxGroupId?: string | null;
   sandboxOs?: SandboxOs;
   /** Exact accepted generated-session compaction policy; internal lifecycle callers only. */
@@ -29394,7 +30007,11 @@ export type SessionCreateInput = {
   /** Trusted, transaction-local linkage run after the exact session row and
    * MCP metadata exist but before either can commit. It must perform database
    * work only; throwing rolls the complete create/replay transaction back. */
-  beforeCreateCommit?: (tx: Database, sessionId: string) => Promise<void>;
+  beforeCreateCommit?: (
+    tx: Database,
+    sessionId: string,
+    context?: { created: boolean },
+  ) => Promise<void>;
 };
 
 type SessionDepthDecision =
@@ -29658,6 +30275,68 @@ async function existingSessionForCreateKey(
   return existing;
 }
 
+type SessionCreateReplayIdentity = {
+  requestedSessionId?: string;
+  visibility?: "user_private" | "workspace_shared";
+  variableSetIds: string[];
+  selectedInstalledSkillIds: string[];
+  initialPersonalResourceAttachmentIntent?: PersonalResourceAttachmentIntent | null;
+};
+
+// Session metadata is immutable after creation and already participates in
+// every historical schema fixture. Keep this reserved request-identity fact
+// there instead of making current code require a post-fixture sessions column.
+// Create admission always replaces a caller-supplied value for this key.
+const SESSION_CREATE_SELECTED_INSTALLED_SKILL_IDS_METADATA_KEY =
+  "_opengeni_session_create_selected_installed_skill_ids_v1";
+
+function metadataWithSelectedInstalledSkillCreateIdentity(
+  metadata: Record<string, unknown>,
+  selectedInstalledSkillIds: string[],
+): Record<string, unknown> {
+  const next = { ...metadata };
+  delete next[SESSION_CREATE_SELECTED_INSTALLED_SKILL_IDS_METADATA_KEY];
+  if (selectedInstalledSkillIds.length > 0) {
+    next[SESSION_CREATE_SELECTED_INSTALLED_SKILL_IDS_METADATA_KEY] = [...selectedInstalledSkillIds];
+  }
+  return next;
+}
+
+function selectedInstalledSkillCreateIdentity(metadata: unknown): string[] {
+  if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) return [];
+  const value = (metadata as Record<string, unknown>)[
+    SESSION_CREATE_SELECTED_INSTALLED_SKILL_IDS_METADATA_KEY
+  ];
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : [];
+}
+
+function assertSessionCreateReplayIdentity(
+  existing: typeof schema.sessions.$inferSelect,
+  input: SessionCreateReplayIdentity,
+): void {
+  if (input.requestedSessionId && existing.id !== input.requestedSessionId) {
+    throw new SessionIdConflictError(input.requestedSessionId);
+  }
+  if (
+    stableJson(existing.initialPersonalResourceAttachmentIntent ?? null) !==
+    stableJson(input.initialPersonalResourceAttachmentIntent ?? null)
+  ) {
+    throw new SessionCreateIdempotencyConflictError();
+  }
+  if (stableJson(existing.variableSetIds ?? []) !== stableJson(input.variableSetIds)) {
+    throw new SessionCreateIdempotencyConflictError();
+  }
+  if (
+    stableJson(selectedInstalledSkillCreateIdentity(existing.metadata)) !==
+    stableJson(input.selectedInstalledSkillIds)
+  ) {
+    throw new SessionCreateIdempotencyConflictError();
+  }
+  if (existing.createRequestedVisibility !== (input.visibility ?? "workspace_shared")) {
+    throw new SessionCreateIdempotencyConflictError();
+  }
+}
+
 async function lockSessionCreateIdempotencyKey(
   tx: Database,
   workspaceId: string,
@@ -29747,6 +30426,11 @@ async function createSessionInTransaction(
 ): Promise<SessionCreateResult> {
   const variableSetIds = input.variableSetIds ?? (input.variableSetId ? [input.variableSetId] : []);
   const variableSetId = variableSetIds.at(-1) ?? null;
+  const selectedInstalledSkillIds = input.selectedInstalledSkillIds ?? [];
+  const sessionMetadata = metadataWithSelectedInstalledSkillCreateIdentity(
+    input.metadata,
+    selectedInstalledSkillIds,
+  );
   const createIdempotencyKey = input.createIdempotencyKey ?? null;
   const createRequestedVisibility = input.visibility ?? "workspace_shared";
   if (createRequestedVisibility === "user_private") {
@@ -29793,21 +30477,14 @@ async function createSessionInTransaction(
       // caller-provided identity agrees with the winning request. Check this
       // before any first-turn repair so a retry cannot hide a requested-ID
       // conflict behind an apparently successful replay.
-      if (input.requestedSessionId && existing.id !== input.requestedSessionId) {
-        throw new SessionIdConflictError(input.requestedSessionId);
-      }
-      if (
-        stableJson(existing.initialPersonalResourceAttachmentIntent ?? null) !==
-        stableJson(input.initialPersonalResourceAttachmentIntent ?? null)
-      ) {
-        throw new SessionCreateIdempotencyConflictError();
-      }
-      if (stableJson(existing.variableSetIds ?? []) !== stableJson(variableSetIds)) {
-        throw new SessionCreateIdempotencyConflictError();
-      }
-      if (existing.createRequestedVisibility !== createRequestedVisibility) {
-        throw new SessionCreateIdempotencyConflictError();
-      }
+      assertSessionCreateReplayIdentity(existing, {
+        ...(input.requestedSessionId ? { requestedSessionId: input.requestedSessionId } : {}),
+        visibility: createRequestedVisibility,
+        variableSetIds,
+        selectedInstalledSkillIds: input.selectedInstalledSkillIds ?? [],
+        initialPersonalResourceAttachmentIntent:
+          input.initialPersonalResourceAttachmentIntent ?? null,
+      });
       const grouped = await sessionMcpServerMetadataForSessions(tx, input.workspaceId, [
         existing.id,
       ]);
@@ -29819,7 +30496,7 @@ async function createSessionInTransaction(
       if (!canonicalExisting) {
         throw new Error(`Session event cursor missing for session ${existing.id}`);
       }
-      await input.beforeCreateCommit?.(tx, existing.id);
+      await input.beforeCreateCommit?.(tx, existing.id, { created: false });
       return {
         session: await mapSessionWithControl(tx, canonicalExisting, grouped.get(existing.id) ?? []),
         created: false,
@@ -29932,7 +30609,7 @@ async function createSessionInTransaction(
               mode: "explicit",
               inheritedFromSessionId: input.parentSessionId ?? null,
             },
-            metadata: input.metadata,
+            metadata: sessionMetadata,
             ...creatorColumns(frozenCreator),
             ...(privateCreateOwnerMembershipId
               ? {
@@ -30006,21 +30683,14 @@ async function createSessionInTransaction(
         createIdempotencyKey,
       );
       if (existing) {
-        if (input.requestedSessionId && existing.id !== input.requestedSessionId) {
-          throw new SessionIdConflictError(input.requestedSessionId);
-        }
-        if (
-          stableJson(existing.initialPersonalResourceAttachmentIntent ?? null) !==
-          stableJson(input.initialPersonalResourceAttachmentIntent ?? null)
-        ) {
-          throw new SessionCreateIdempotencyConflictError();
-        }
-        if (stableJson(existing.variableSetIds ?? []) !== stableJson(variableSetIds)) {
-          throw new SessionCreateIdempotencyConflictError();
-        }
-        if (existing.createRequestedVisibility !== createRequestedVisibility) {
-          throw new SessionCreateIdempotencyConflictError();
-        }
+        assertSessionCreateReplayIdentity(existing, {
+          ...(input.requestedSessionId ? { requestedSessionId: input.requestedSessionId } : {}),
+          visibility: createRequestedVisibility,
+          variableSetIds,
+          selectedInstalledSkillIds: input.selectedInstalledSkillIds ?? [],
+          initialPersonalResourceAttachmentIntent:
+            input.initialPersonalResourceAttachmentIntent ?? null,
+        });
         const grouped = await sessionMcpServerMetadataForSessions(tx, input.workspaceId, [
           existing.id,
         ]);
@@ -30032,7 +30702,7 @@ async function createSessionInTransaction(
         if (!canonicalExisting) {
           throw new Error(`Session event cursor missing for session ${existing.id}`);
         }
-        await input.beforeCreateCommit?.(tx, existing.id);
+        await input.beforeCreateCommit?.(tx, existing.id, { created: false });
         return {
           session: await mapSessionWithControl(
             tx,
@@ -30069,7 +30739,7 @@ async function createSessionInTransaction(
     sessionId: inserted.id,
     servers: input.mcpServers ?? [],
   });
-  await input.beforeCreateCommit?.(tx, inserted.id);
+  await input.beforeCreateCommit?.(tx, inserted.id, { created: true });
   return {
     session: await mapSessionWithControl(tx, inserted, mcpServers),
     created: true,
@@ -30174,6 +30844,168 @@ export async function getSessionByCreateIdempotencyKey(
   });
 }
 
+/**
+ * Recover a keyed create before mutable create dependencies (notably the
+ * current model catalog) are consulted. A fully initialized queued turn gets a
+ * fresh durable wake revision from persisted state only; an uninitialized shell
+ * returns its persisted model so the caller can reopen it strictly as retained
+ * while the canonical keyed transaction repairs initialization. The same
+ * request-identity checks as transactional create replay run before any session
+ * or committed denial is returned.
+ */
+export type InitializedSessionCreateReplay =
+  | {
+      outcome: "session";
+      session: Session & { initialTurnId: string | null };
+      temporalWorkflowId: string;
+      workflowWakeRevision: number | null;
+      changed: boolean;
+    }
+  | {
+      outcome: "pending";
+      session: Session;
+    }
+  | { outcome: "denied"; denial: SessionSpawnDenial };
+
+export async function getInitializedSessionCreateReplay(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    activeManagedHumanSubjectId?: string;
+    createIdempotencyKey: string;
+    requestedSessionId?: string;
+    visibility?: "user_private" | "workspace_shared";
+    variableSetIds: string[];
+    selectedInstalledSkillIds: string[];
+    initialPersonalResourceAttachmentIntent?: PersonalResourceAttachmentIntent | null;
+    deferInitialTurn?: boolean;
+  },
+): Promise<InitializedSessionCreateReplay | null> {
+  return await withWorkspaceSubjectSessionActivityRls(
+    db,
+    input.workspaceId,
+    input.subjectId,
+    async (scopedDb) => {
+      if (input.visibility === "user_private") {
+        await scopedDb.execute(
+          sql`select pg_advisory_xact_lock(hashtextextended(${`organization-membership:${input.accountId}`}, 0))`,
+        );
+      }
+      await lockWorkspaceForSessionCreate(scopedDb, input.workspaceId, input.accountId);
+      if (input.activeManagedHumanSubjectId) {
+        await setSubjectRlsContext(scopedDb, input.activeManagedHumanSubjectId);
+        await assertActiveManagedHumanOrganizationMembership(scopedDb, {
+          accountId: input.accountId,
+          subjectId: input.activeManagedHumanSubjectId,
+        });
+      }
+      await lockSessionCreateIdempotencyKey(
+        scopedDb,
+        input.workspaceId,
+        input.createIdempotencyKey,
+      );
+
+      const existing = await existingSessionForCreateKey(
+        scopedDb,
+        input.workspaceId,
+        input.createIdempotencyKey,
+      );
+      if (!existing) {
+        const denial = await existingSpawnDenialForKey(
+          scopedDb,
+          input.workspaceId,
+          input.createIdempotencyKey,
+        );
+        return denial ? { outcome: "denied", denial } : null;
+      }
+      assertSessionCreateReplayIdentity(existing, input);
+
+      const startEvents = await scopedDb
+        .select({ id: schema.sessionEvents.id, type: schema.sessionEvents.type })
+        .from(schema.sessionEvents)
+        .where(
+          and(
+            eq(schema.sessionEvents.workspaceId, input.workspaceId),
+            eq(schema.sessionEvents.sessionId, existing.id),
+            inArray(schema.sessionEvents.type, ["session.created", "user.message"]),
+          ),
+        )
+        .orderBy(asc(schema.sessionEvents.sequence))
+        .limit(2);
+      const createdEvent = startEvents.find((event) => event.type === "session.created");
+      const initialUserEvent = startEvents.find((event) => event.type === "user.message");
+
+      const grouped = await sessionMcpServerMetadataForSessions(scopedDb, input.workspaceId, [
+        existing.id,
+      ]);
+      const session = await mapSessionWithControl(
+        scopedDb,
+        existing,
+        grouped.get(existing.id) ?? [],
+      );
+      if (!createdEvent) {
+        return { outcome: "pending", session };
+      }
+      const [initialTurn] = await scopedDb
+        .select({
+          id: schema.sessionTurns.id,
+          status: schema.sessionTurns.status,
+        })
+        .from(schema.sessionTurns)
+        .where(
+          and(
+            eq(schema.sessionTurns.workspaceId, input.workspaceId),
+            eq(schema.sessionTurns.sessionId, existing.id),
+            initialUserEvent
+              ? eq(schema.sessionTurns.triggerEventId, initialUserEvent.id)
+              : sql`false`,
+          ),
+        )
+        .limit(1);
+
+      const temporalWorkflowId = existing.temporalWorkflowId ?? `session-${existing.id}`;
+      if (existing.status === "cancelled") {
+        return {
+          outcome: "session",
+          session: { ...session, initialTurnId: initialTurn?.id ?? null },
+          temporalWorkflowId,
+          workflowWakeRevision: null,
+          changed: false,
+        };
+      }
+      if (input.deferInitialTurn === true) {
+        return {
+          outcome: "session",
+          session: { ...session, initialTurnId: initialTurn?.id ?? null },
+          temporalWorkflowId,
+          workflowWakeRevision: null,
+          changed: false,
+        };
+      }
+      if (!initialTurn) return null;
+      const workflowWakeRevision =
+        initialTurn.status === "queued" && session.effectiveControl.state === "active"
+          ? await registerSessionWorkflowWakeInTransaction(scopedDb, {
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              sessionId: existing.id,
+              temporalWorkflowId,
+              reason: "initial_session",
+            })
+          : null;
+      return {
+        outcome: "session",
+        session: { ...session, initialTurnId: initialTurn.id },
+        temporalWorkflowId,
+        workflowWakeRevision,
+        changed: workflowWakeRevision !== null,
+      };
+    },
+  );
+}
+
 export async function getSession(
   db: Database,
   workspaceId: string,
@@ -33691,7 +34523,10 @@ async function sessionDiscoveryClaimsForSessions(
   );
   const grouped = new Map<string, { claims: WorkClaimDiscoverySummary[]; truncated: boolean }>();
   for (const row of rows) {
-    const entry = grouped.get(row.sessionId) ?? { claims: [], truncated: false };
+    const entry = grouped.get(row.sessionId) ?? {
+      claims: [],
+      truncated: false,
+    };
     entry.claims.push(
       WorkClaimDiscoverySummarySchema.parse({
         id: row.id,
@@ -34013,7 +34848,10 @@ export async function listSessionDiscoverySummaries(
       const relatedAccess = rootRelatedIds.has(sessionId) ? "root" : "target";
       const goal = goalsBySession.get(sessionId);
       const latest = latestBySession.get(sessionId);
-      const claims = workClaims.get(sessionId) ?? { claims: [], truncated: false };
+      const claims = workClaims.get(sessionId) ?? {
+        claims: [],
+        truncated: false,
+      };
       const match =
         !includeWorkDiscovery ||
         row.matchClass === null ||
@@ -34525,6 +35363,8 @@ export type SessionEventPage = {
   events: SessionEvent[];
   hasMore: boolean;
   bytes: number;
+  /** True only when every full-mode event is the exact retained database row. */
+  fullPayloadsExact: boolean;
   direction: SessionEventReadDirection;
   coveredSequence: { first: number; last: number } | null;
   nextAfter: number | null;
@@ -34554,12 +35394,21 @@ type SessionEventProjectionRow = {
   duplicateReason: string | null;
 };
 
+type SessionEventProjectionMetadataRow = {
+  id: string;
+  sequence: number;
+  /** Conservative server-side size including columns omitted from the public event. */
+  transferBytes: number;
+};
+
 /**
  * Read one direction-aware session-event page. Full mode selects the canonical
- * row exactly; summary/none modes derive bounded monitoring projections in SQL
- * without rewriting the retained source. `bytes` is the exact UTF-8 size of
- * `JSON.stringify(events)`; `hasMore` is true whenever count or byte selection
- * stopped before the durable range ended.
+ * row exactly when it fits the page; an oversized historical row that predates
+ * the durable write guard is projected at the bounded database-read boundary
+ * when it would otherwise strand its cursor forever. Summary/none modes derive
+ * bounded monitoring projections in SQL without rewriting the retained source.
+ * `bytes` is the exact UTF-8 size of `JSON.stringify(events)`; `hasMore` is true
+ * whenever count or byte selection stopped before the durable range ended.
  */
 export async function listSessionEventPage(
   db: Database,
@@ -34594,6 +35443,7 @@ export async function listSessionEventPage(
     let bytes = 2; // []
     let cursor = direction === "before" ? before : after;
     let hasMore = false;
+    let fullPayloadsExact = payloadMode === "full";
     let truncatedBy: SessionEventPage["truncatedBy"] = null;
 
     for (;;) {
@@ -34638,19 +35488,89 @@ export async function listSessionEventPage(
         filters.push(lt(schema.sessionEvents.sequence, before));
       }
 
-      const rows = await scopedDb
-        .select(sessionEventProjectionSelect(payloadMode))
-        .from(schema.sessionEvents)
-        .where(and(...filters))
-        .orderBy(
-          options.authoritativeLatest
-            ? desc(schema.sessionEvents.sequence)
-            : direction === "before"
-              ? desc(schema.sessionEvents.sequence)
-              : asc(schema.sessionEvents.sequence),
-        )
-        .limit(queryLimit);
-      if (rows.length === 0) break;
+      const ordering =
+        options.authoritativeLatest || direction === "before"
+          ? desc(schema.sessionEvents.sequence)
+          : asc(schema.sessionEvents.sequence);
+      let rows: SessionEventProjectionRow[];
+      let sourceRowCount: number;
+      let sourceRowsFullyConsumed = true;
+      let databaseReadProjected = false;
+      if (payloadMode === "full") {
+        // Plan the page from bounded metadata before selecting any canonical
+        // payload. row_to_json includes private storage columns omitted by the
+        // public event, so this conservatively bounds payload transfer without
+        // moving an oversized legacy value through postgres.js.
+        const metadataRows = await scopedDb
+          .select(sessionEventProjectionMetadataSelect())
+          .from(schema.sessionEvents)
+          .where(and(...filters))
+          .orderBy(ordering)
+          .limit(queryLimit);
+        sourceRowCount = metadataRows.length;
+        if (metadataRows.length === 0) break;
+
+        const exactIds: string[] = [];
+        let projectId: string | null = null;
+        let estimatedBytes = bytes;
+        for (const metadata of metadataRows) {
+          if (events.length + exactIds.length >= requestedLimit) {
+            hasMore = true;
+            truncatedBy = "count";
+            break;
+          }
+          const separatorBytes = events.length + exactIds.length === 0 ? 0 : 1;
+          const transferBytes = Number(metadata.transferBytes);
+          if (estimatedBytes + separatorBytes + transferBytes > maxBytes) {
+            if (events.length === 0 && exactIds.length === 0) {
+              projectId = metadata.id;
+            } else {
+              hasMore = true;
+              truncatedBy = "bytes";
+            }
+            break;
+          }
+          exactIds.push(metadata.id);
+          estimatedBytes += separatorBytes + transferBytes;
+        }
+        sourceRowsFullyConsumed =
+          exactIds.length + (projectId === null ? 0 : 1) >= metadataRows.length;
+
+        if (projectId !== null) {
+          rows = await scopedDb
+            .select(sessionEventProjectionSelect("full", { databaseReadProjection: true }))
+            .from(schema.sessionEvents)
+            .where(and(...filters, eq(schema.sessionEvents.id, projectId)))
+            .orderBy(ordering)
+            .limit(1);
+          fullPayloadsExact = false;
+          databaseReadProjected = true;
+        } else if (exactIds.length > 0) {
+          rows = await scopedDb
+            .select(sessionEventProjectionSelect("full"))
+            .from(schema.sessionEvents)
+            .where(and(...filters, inArray(schema.sessionEvents.id, exactIds)))
+            .orderBy(ordering)
+            .limit(exactIds.length);
+        } else {
+          rows = [];
+        }
+      } else {
+        rows = await scopedDb
+          .select(sessionEventProjectionSelect(payloadMode))
+          .from(schema.sessionEvents)
+          .where(and(...filters))
+          .orderBy(ordering)
+          .limit(queryLimit);
+        sourceRowCount = rows.length;
+        if (rows.length === 0) break;
+      }
+
+      if (databaseReadProjected) {
+        for (const row of rows) {
+          settleDatabaseReadProjectionPayload(row.payload);
+        }
+      }
 
       for (const row of rows) {
         if (events.length >= requestedLimit) {
@@ -34658,25 +35578,33 @@ export async function listSessionEventPage(
           truncatedBy = "count";
           break;
         }
-        const event = mapProjectedEvent(row);
-        const eventBytes = utf8JsonBytes(event);
+        let event = mapProjectedEvent(row);
+        let eventBytes = utf8JsonBytes(event);
         const separatorBytes = events.length === 0 ? 0 : 1;
         if (bytes + separatorBytes + eventBytes > maxBytes) {
           if (events.length === 0) {
-            throw new RangeError(
-              `A projected session event cannot fit in the database page envelope (${eventBytes + 2} > ${maxBytes} bytes)`,
-            );
+            if (payloadMode === "full") {
+              event = boundSessionEvent(event, { surface: "database_read_projection" });
+              eventBytes = utf8JsonBytes(event);
+              fullPayloadsExact = false;
+            }
+            if (eventBytes + 2 > maxBytes) {
+              throw new RangeError(
+                `A projected session event cannot fit in the database page envelope (${eventBytes + 2} > ${maxBytes} bytes)`,
+              );
+            }
+          } else {
+            hasMore = true;
+            truncatedBy = "bytes";
+            break;
           }
-          hasMore = true;
-          truncatedBy = "bytes";
-          break;
         }
         events.push(event);
         bytes += separatorBytes + eventBytes;
         cursor = event.sequence;
       }
       if (hasMore) break;
-      if (rows.length < queryLimit) break;
+      if (sourceRowsFullyConsumed && sourceRowCount < queryLimit) break;
     }
 
     if (direction === "before") events.reverse();
@@ -34686,6 +35614,7 @@ export async function listSessionEventPage(
       events,
       hasMore,
       bytes,
+      fullPayloadsExact,
       direction,
       coveredSequence: first === null || last === null ? null : { first, last },
       nextAfter: direction === "after" ? (last ?? after) : null,
@@ -34695,7 +35624,18 @@ export async function listSessionEventPage(
   });
 }
 
-function sessionEventProjectionSelect(payloadMode: SessionEventPayloadMode = "full") {
+function sessionEventProjectionMetadataSelect() {
+  return {
+    id: schema.sessionEvents.id,
+    sequence: schema.sessionEvents.sequence,
+    transferBytes: sql<number>`octet_length(row_to_json(${schema.sessionEvents})::text)::int`,
+  } satisfies Record<keyof SessionEventProjectionMetadataRow, unknown>;
+}
+
+function sessionEventProjectionSelect(
+  payloadMode: SessionEventPayloadMode = "full",
+  options: { databaseReadProjection?: boolean } = {},
+) {
   const typeInvalid = sql`(
     octet_length(${schema.sessionEvents.type}) > ${SESSION_EVENT_TYPE_MAX_BYTES}
     or position(E'\\n' in ${schema.sessionEvents.type}) > 0
@@ -34774,10 +35714,40 @@ function sessionEventProjectionSelect(payloadMode: SessionEventPayloadMode = "fu
     )
     else opengeni_private.project_session_event_payload(${schema.sessionEvents.payload})
   end`;
+  const databaseReadProjectedPayload = sql<unknown>`case
+    when ${envelopeInvalid} then ${projectedPayload}
+    else jsonb_build_object(
+      'preview', jsonb_build_object(
+        'head', left(${schema.sessionEvents.payload}::text, 2048),
+        'omission', '[middle payload bytes omitted at bounded database read boundary]',
+        'tail', right(${schema.sessionEvents.payload}::text, 2048)
+      ),
+      'truncation', jsonb_build_object(
+        'truncated', true,
+        'surface', 'database_read_projection',
+        'reason', 'payload_bytes_exceeded',
+        'originalBytes', octet_length(${schema.sessionEvents.payload}::text),
+        'deliveredBytes', 0,
+        'omittedBytes', octet_length(${schema.sessionEvents.payload}::text),
+        'estimatedOriginalTokens', ceil(
+          octet_length(${schema.sessionEvents.payload}::text) / 4.0
+        )::integer,
+        'estimatedDeliveredTokens', 0,
+        'fullEvidence', jsonb_build_object('available', false, 'reason', 'not_retained'),
+        'details', jsonb_build_array(jsonb_build_object(
+          'path', '$',
+          'kind', 'object',
+          'originalBytes', octet_length(${schema.sessionEvents.payload}::text)
+        ))
+      )
+    )
+  end`;
   const projectedPayloadBytes = sql<number>`octet_length((${projectedPayload})::text)`;
   const selectedPayload =
     payloadMode === "full"
-      ? schema.sessionEvents.payload
+      ? options.databaseReadProjection
+        ? databaseReadProjectedPayload
+        : schema.sessionEvents.payload
       : payloadMode === "none"
         ? sql<unknown>`jsonb_build_object(
           '_monitoring', jsonb_build_object(
@@ -34804,24 +35774,59 @@ function sessionEventProjectionSelect(payloadMode: SessionEventPayloadMode = "fu
     workspaceId: schema.sessionEvents.workspaceId,
     sessionId: schema.sessionEvents.sessionId,
     sequence: schema.sessionEvents.sequence,
-    type: payloadMode === "full" ? schema.sessionEvents.type : projectedType,
+    type:
+      payloadMode === "full" && !options.databaseReadProjection
+        ? schema.sessionEvents.type
+        : projectedType,
     payload: selectedPayload,
     payloadCodecVersion:
-      payloadMode === "full" ? schema.sessionEvents.payloadCodecVersion : sql<number | null>`null`,
+      payloadMode === "full" && !options.databaseReadProjection
+        ? schema.sessionEvents.payloadCodecVersion
+        : sql<number | null>`null`,
     occurredAt: schema.sessionEvents.occurredAt,
     clientEventId:
-      payloadMode === "full" ? schema.sessionEvents.clientEventId : projectedClientEventId,
+      payloadMode === "full" && !options.databaseReadProjection
+        ? schema.sessionEvents.clientEventId
+        : projectedClientEventId,
     turnId: schema.sessionEvents.turnId,
     turnGeneration: schema.sessionEvents.turnGeneration,
     turnAttemptId: schema.sessionEvents.turnAttemptId,
     turnAssociation:
-      payloadMode === "full" ? schema.sessionEvents.turnAssociation : projectedTurnAssociation,
+      payloadMode === "full" && !options.databaseReadProjection
+        ? schema.sessionEvents.turnAssociation
+        : projectedTurnAssociation,
     duplicateOfEventId: schema.sessionEvents.duplicateOfEventId,
     duplicateReason:
-      payloadMode === "full" ? schema.sessionEvents.duplicateReason : projectedDuplicateReason,
+      payloadMode === "full" && !options.databaseReadProjection
+        ? schema.sessionEvents.duplicateReason
+        : projectedDuplicateReason,
   };
 }
 
+function settleDatabaseReadProjectionPayload(payload: unknown): void {
+  const truncation = sessionEventPayloadTruncation(payload);
+  if (truncation?.surface !== "database_read_projection") return;
+  for (let attempt = 0; attempt < 16; attempt += 1) {
+    const deliveredBytes = sessionEventJsonBytes(payload);
+    const omittedBytes =
+      truncation.originalBytes === null
+        ? null
+        : Math.max(0, truncation.originalBytes - deliveredBytes);
+    const deliveredTokens = approximateSessionEventTokens(deliveredBytes);
+    if (
+      truncation.deliveredBytes === deliveredBytes &&
+      truncation.omittedBytes === omittedBytes &&
+      truncation.estimatedDeliveredTokens === deliveredTokens
+    ) {
+      return;
+    }
+    truncation.deliveredBytes = deliveredBytes;
+    truncation.omittedBytes = omittedBytes;
+    truncation.estimatedDeliveredTokens = deliveredTokens;
+  }
+  throw new RangeError("Database-read session event payload byte accounting did not converge");
+}
+
 export async function listSessionEvents(
   db: Database,
   workspaceId: string,
@@ -35804,7 +36809,10 @@ export async function acceptSessionHumanInputResponse(
                     turnAssociation: "current",
                     sequence: session.lastSequence + 1,
                     type: "user.humanInputResponse",
-                    payload: { requestId: request.id, response: { outcome: "cancelled" } },
+                    payload: {
+                      requestId: request.id,
+                      response: { outcome: "cancelled" },
+                    },
                     clientEventId: null,
                     occurredAt,
                   },
@@ -35840,7 +36848,10 @@ export async function acceptSessionHumanInputResponse(
             });
             await tx
               .update(schema.sessions)
-              .set({ lastSequence: session.lastSequence + 1, updatedAt: new Date() })
+              .set({
+                lastSequence: session.lastSequence + 1,
+                updatedAt: new Date(),
+              })
               .where(eq(schema.sessions.id, session.id));
             event = mapEvent(inserted);
             repairedEvents = [event];
@@ -38960,6 +39971,8 @@ type LeaseRow = {
   archive_capture_generation: number | string | null;
   archive_capture_started_at: Date | string | null;
   archive_capture_deadline_at: Date | string | null;
+  /** Transaction-local PostgreSQL-clock projection used only by bounded waiters. */
+  archive_capture_remaining_ms?: number | string | null;
   archive_capture_published_at: Date | string | null;
   reaper_hold_id: string | null;
   reaper_hold_until: Date | string | null;
@@ -39149,6 +40162,9 @@ export type AcquireLeaseResult =
         | "rotation_in_progress"
         | "provider_recovery_in_progress";
       lease: LeaseSnapshot;
+      /** Remaining durable capture budget from PostgreSQL's clock. Present only
+       * for an exact active capture; callers cap it at the lifecycle ceiling. */
+      captureRemainingMs?: number;
     };
 
 export type SandboxSharedPreparationSnapshot = {
@@ -39179,7 +40195,10 @@ export type ClaimSandboxSharedPreparationInput = {
 };
 
 export type ClaimSandboxSharedPreparationResult =
-  | { role: "owner" | "joined" | "reused"; preparation: SandboxSharedPreparationSnapshot }
+  | {
+      role: "owner" | "joined" | "reused";
+      preparation: SandboxSharedPreparationSnapshot;
+    }
   | { role: "fenced"; lease: LeaseSnapshot | null };
 
 function validateSandboxSharedPreparationIdentity(input: ClaimSandboxSharedPreparationInput): void {
@@ -39304,7 +40323,10 @@ export async function claimSandboxSharedPreparation(
           Number(row.lease_epoch) !== input.expectedLeaseEpoch ||
           row.instance_id !== input.expectedInstanceId
         ) {
-          return { role: "fenced" as const, lease: row ? mapLeaseRow(row) : null };
+          return {
+            role: "fenced" as const,
+            lease: row ? mapLeaseRow(row) : null,
+          };
         }
         const holderRows = await tx.execute<{ present: boolean }>(sql`
           select exists (
@@ -39701,6 +40723,33 @@ function leaseBackendRequiresResumableInstance(row: LeaseRow): boolean {
   return fields === undefined || fields.length > 0;
 }
 
+function archiveCaptureRemainingMs(
+  row: Pick<LeaseRow, "archive_capture_remaining_ms">,
+): number | null {
+  if (row.archive_capture_remaining_ms === null || row.archive_capture_remaining_ms === undefined) {
+    return null;
+  }
+  const remainingMs = Number(row.archive_capture_remaining_ms);
+  return Number.isSafeInteger(remainingMs) &&
+    remainingMs >= 0 &&
+    remainingMs <= SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS
+    ? remainingMs
+    : null;
+}
+
+function extendSandboxTransitionDeadline(
+  currentDeadline: number,
+  hardDeadline: number,
+  remainingCaptureMs: number | null | undefined,
+  now: number,
+): number {
+  if (remainingCaptureMs === null || remainingCaptureMs === undefined) return currentDeadline;
+  return Math.min(
+    hardDeadline,
+    Math.max(currentDeadline, now + remainingCaptureMs + SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS),
+  );
+}
+
 function providerlessLeaseBackendPredicateSql() {
   const providerlessBackends = Object.entries(SANDBOX_PROVIDER_INSTANCE_ID_FIELDS_BY_BACKEND)
     .filter(([, fields]) => fields.length === 0)
@@ -40259,9 +41308,19 @@ async function acquireLeaseOnce(
         // UPDATE (block, do NOT skip) — unlike concurrent enrollment scans,
         // because we WANT the loser to block then attach, not skip and lose.
         const rows = await tx.execute<LeaseRow>(sql`
-        select *
-        from sandbox_leases
-        where workspace_id = ${workspaceId} and sandbox_group_id = ${sandboxGroupId}
+        select lease.*,
+          case
+            when lease.archive_capture_deadline_at is null then null
+            else greatest(
+              0,
+              ceil(extract(epoch from (
+                lease.archive_capture_deadline_at - clock_timestamp()
+              )) * 1000)
+            )::bigint
+          end as archive_capture_remaining_ms
+        from sandbox_leases as lease
+        where lease.workspace_id = ${workspaceId}
+          and lease.sandbox_group_id = ${sandboxGroupId}
         for update
       `);
         const row = rows[0];
@@ -40293,10 +41352,12 @@ async function acquireLeaseOnce(
         // another holder while that operation owns the exact lease: the caller
         // retries after the claim clears, before it can reach the provider.
         if (row.archive_capture_id !== null) {
+          const captureRemainingMs = archiveCaptureRemainingMs(row);
           return {
             role: "fenced" as const,
             reason: "capture_in_progress" as const,
             lease: mapLeaseRow(row),
+            ...(captureRemainingMs === null ? {} : { captureRemainingMs }),
           };
         }
 
@@ -40520,20 +41581,30 @@ export async function acquireLease(
   }
   // A bounded in-process wait must use a monotonic clock. Wall-clock steps from
   // NTP/VM resume may change timestamp interpretation, but must never stretch
-  // or prematurely consume the caller's resource budget.
-  const deadline = performance.now() + captureWaitMs;
+  // or prematurely consume the caller's resource budget. PostgreSQL projects
+  // an active claim's remaining time on its own authoritative clock; that may
+  // extend a positive caller budget after a rolling config change, but never
+  // beyond the same one-hour lifecycle ceiling.
+  const startedAt = performance.now();
+  const hardDeadline = startedAt + SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS;
+  let deadline = Math.min(hardDeadline, startedAt + captureWaitMs);
   let delayMs = 25;
   for (;;) {
     const result = await acquireLeaseOnce(db, input);
-    if (
-      result.role !== "fenced" ||
-      result.reason === "superseded" ||
-      performance.now() >= deadline
-    ) {
+    const now = performance.now();
+    if (captureWaitMs > 0 && result.role === "fenced" && result.reason === "capture_in_progress") {
+      deadline = extendSandboxTransitionDeadline(
+        deadline,
+        hardDeadline,
+        result.captureRemainingMs,
+        now,
+      );
+    }
+    if (result.role !== "fenced" || result.reason === "superseded" || now >= deadline) {
       return result;
     }
     await waitForSandboxTransition(
-      Math.min(delayMs, Math.max(1, deadline - performance.now())),
+      Math.min(delayMs, Math.max(1, deadline - now)),
       input.waitSignal,
       "Sandbox lease transition wait cancelled",
     );
@@ -44618,7 +45689,11 @@ export async function reapStaleLeaseHoldersGlobal(
   // A separate lifecycle-aware function settles only stale starting/restoring/
   // suspending/ending transitions. API controller mutations pulse their holder
   // while in flight, so the transition TTL detects an abandoned caller rather
-  // than imposing a maximum duration on profile capture or restore.
+  // than imposing a maximum duration on profile capture or restore. The same
+  // lifecycle function is also the hard provider-deadline override: once a
+  // requested finite-lifetime Modal lease is due, its controller resources are
+  // lost and their holders are released without turning timestamp age into a
+  // general active-session expiry policy.
   const rows = await db.transaction(async (txRaw) => {
     const tx = txRaw as unknown as Database;
     await tx.execute(sql`select set_config('opengeni.sandbox_recovery_protocol_v2', '1', true)`);
@@ -44723,7 +45798,10 @@ export async function countSessionRecoveryBacklog(
     quiescence_missing: 0,
     projection_stale: 0,
   };
-  const rows = await rawRows<{ state: SessionRecoveryBacklogState; count: number | string }>(
+  const rows = await rawRows<{
+    state: SessionRecoveryBacklogState;
+    count: number | string;
+  }>(
     db,
     sql`
       select state, count
@@ -44736,6 +45814,36 @@ export async function countSessionRecoveryBacklog(
   return counts;
 }
 
+export type ContextCompactionPendingSummary = {
+  pendingCount: number;
+  oldestStartedAt: Date | null;
+};
+
+/**
+ * Content-free cross-workspace projection of exact active attempts whose latest
+ * automatic compaction landmark is still `started`. The trigger-maintained
+ * private ledger survives turn-worker loss without exposing tenant identities.
+ */
+export async function getContextCompactionPendingSummary(
+  db: Database,
+): Promise<ContextCompactionPendingSummary> {
+  const rows = await rawRows<{
+    pending_count: number | string;
+    oldest_started_at: Date | string | null;
+  }>(
+    db,
+    sql`
+      select pending_count, oldest_started_at
+      from opengeni_private.context_compaction_pending_summary()
+    `,
+  );
+  const row = rows[0];
+  return {
+    pendingCount: Number(row?.pending_count ?? 0),
+    oldestStartedAt: row?.oldest_started_at == null ? null : new Date(row.oldest_started_at),
+  };
+}
+
 export async function countSandboxLeasesByLiveness(
   db: Database,
 ): Promise<Record<SandboxLeaseLiveness, number>> {
@@ -45141,6 +46249,9 @@ export class SandboxWorkspaceMutationFencedError extends Error {
       // The exact grant identity behind this writer is no longer active.
       | "authority_revoked",
     message: string,
+    /** Remaining exact archive-capture budget projected by PostgreSQL. This is
+     * observational wait input only; it never licenses capture takeover. */
+    public readonly captureRemainingMs: number | null = null,
   ) {
     super(message);
   }
@@ -46156,6 +47267,7 @@ async function advanceWorkspaceGenerationForAuthorityOnce(
             rotation_pending: boolean;
             holder_current: boolean;
             capture_in_progress: boolean;
+            archive_capture_remaining_ms: number | string | null;
           }>(sql`
             select lease.workspace_generation,
               (
@@ -46177,6 +47289,15 @@ async function advanceWorkspaceGenerationForAuthorityOnce(
                 and (${locked.expectedBackend}::text is null or lease.backend = ${locked.expectedBackend}::text)
               ) as rotation_pending,
               (lease.archive_capture_id is not null) as capture_in_progress,
+              case
+                when lease.archive_capture_deadline_at is null then null
+                else greatest(
+                  0,
+                  ceil(extract(epoch from (
+                    lease.archive_capture_deadline_at - clock_timestamp()
+                  )) * 1000)
+                )::bigint
+              end as archive_capture_remaining_ms,
               exists (
                 select 1 from sandbox_lease_holders as holder
                 where holder.lease_id = lease.id
@@ -46205,9 +47326,13 @@ async function advanceWorkspaceGenerationForAuthorityOnce(
             );
           }
           if (current[0]?.lease_current && current[0].capture_in_progress) {
+            const captureRemainingMs = archiveCaptureRemainingMs({
+              archive_capture_remaining_ms: current[0].archive_capture_remaining_ms,
+            });
             throw new SandboxWorkspaceMutationFencedError(
               "capture_in_progress",
               "Workspace mutation is waiting for the exact provider archive capture to settle",
+              captureRemainingMs,
             );
           }
           if (current[0]?.rotation_pending) {
@@ -46240,7 +47365,9 @@ async function advanceWorkspaceGenerationForAuthority(
   if (!Number.isSafeInteger(captureWaitMs) || captureWaitMs < 0 || captureWaitMs > 60 * 60_000) {
     throw new Error("Workspace archive capture wait is invalid");
   }
-  const deadline = performance.now() + captureWaitMs;
+  const startedAt = performance.now();
+  const hardDeadline = startedAt + SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS;
+  let deadline = Math.min(hardDeadline, startedAt + captureWaitMs);
   let delayMs = 25;
   let captureWaitStartedAt: number | undefined;
   let captureWaitOutcome: "completed" | "failed" = "failed";
@@ -46255,16 +47382,29 @@ async function advanceWorkspaceGenerationForAuthority(
         captureWaitOutcome = "completed";
         return admission;
       } catch (error) {
+        const now = performance.now();
+        if (
+          captureWaitMs > 0 &&
+          error instanceof SandboxWorkspaceMutationFencedError &&
+          error.code === "capture_in_progress"
+        ) {
+          deadline = extendSandboxTransitionDeadline(
+            deadline,
+            hardDeadline,
+            error.captureRemainingMs,
+            now,
+          );
+        }
         if (
           !(error instanceof SandboxWorkspaceMutationFencedError) ||
           error.code !== "capture_in_progress" ||
-          performance.now() >= deadline
+          now >= deadline
         ) {
           throw error;
         }
         captureWaitStartedAt ??= performance.now();
         await waitForSandboxTransition(
-          Math.min(delayMs, Math.max(1, deadline - performance.now())),
+          Math.min(delayMs, Math.max(1, deadline - now)),
           waitSignal,
           "Sandbox workspace mutation wait cancelled",
         );
@@ -49146,6 +50286,7 @@ export type SandboxRotationBacklog = {
   turnBlocked: number;
   directBlocked: number;
   processBlocked: number;
+  interactionBlocked: number;
 };
 
 export async function readSandboxRotationBacklog(db: Database): Promise<SandboxRotationBacklog> {
@@ -49155,7 +50296,13 @@ export async function readSandboxRotationBacklog(db: Database): Promise<SandboxR
     turn_blocked: number | string;
     direct_blocked: number | string;
     process_blocked: number | string;
-  }>(db, sql`select * from opengeni_private.sandbox_rotation_backlog()`);
+    interaction_blocked: number | string;
+  }>(
+    db,
+    sql`select backlog.*,
+          opengeni_private.sandbox_rotation_interaction_blocked() as interaction_blocked
+        from opengeni_private.sandbox_rotation_backlog() backlog`,
+  );
   const row = rows[0];
   return {
     requested: Number(row?.requested ?? 0),
@@ -49163,6 +50310,7 @@ export async function readSandboxRotationBacklog(db: Database): Promise<SandboxR
     turnBlocked: Number(row?.turn_blocked ?? 0),
     directBlocked: Number(row?.direct_blocked ?? 0),
     processBlocked: Number(row?.process_blocked ?? 0),
+    interactionBlocked: Number(row?.interaction_blocked ?? 0),
   };
 }
 
@@ -57695,6 +58843,7 @@ export async function materializeGoalContinuation(
       model: string;
       reasoningEffort: ReasoningEffort;
       latencyMode: LatencyMode;
+      turnExecutionPolicy?: TurnExecutionPolicyV1;
       tools: ToolRef[];
       sandboxBackend: SandboxBackend;
     };
@@ -59959,6 +61108,7 @@ export async function claimSessionWorkForAttempt(
           }
           const validUpdates: typeof updates = [];
           const cancelledUpdateIds: string[] = [];
+          const scheduledTaskInactiveUpdateIds: string[] = [];
           const authorityRejectedUpdateIds: string[] = [];
           const unrecognizedUpdateIds: string[] = [];
           // Retained so later consumers of the delivered batch (the child
@@ -59994,17 +61144,28 @@ export async function claimSessionWorkForAttempt(
                 })
               : null;
             if (update.scheduledTaskRunId && scheduledAuthorityDenial) {
-              await markScheduledTaskRunAuthorityRejectedInTransaction(tx as unknown as Database, {
-                workspaceId,
-                sessionId,
-                runId: update.scheduledTaskRunId,
-                error: scheduledAuthorityDenial,
-              });
+              const scheduledTaskInactive =
+                scheduledAuthorityDenial === "scheduled_task_inactive_before_claim";
+              if (!scheduledTaskInactive) {
+                await markScheduledTaskRunAuthorityRejectedInTransaction(
+                  tx as unknown as Database,
+                  {
+                    workspaceId,
+                    sessionId,
+                    runId: update.scheduledTaskRunId,
+                    error: scheduledAuthorityDenial,
+                  },
+                );
+              }
               await tx
                 .update(schema.sessionSystemUpdates)
-                .set({ state: "failed" })
+                .set({ state: scheduledTaskInactive ? "cancelled" : "failed" })
                 .where(eq(schema.sessionSystemUpdates.id, update.id));
-              authorityRejectedUpdateIds.push(update.id);
+              if (scheduledTaskInactive) {
+                scheduledTaskInactiveUpdateIds.push(update.id);
+              } else {
+                authorityRejectedUpdateIds.push(update.id);
+              }
               continue;
             }
             if (input.validatePendingSystemUpdateAuthority) {
@@ -60114,6 +61275,25 @@ export async function claimSessionWorkForAttempt(
                 occurredAt,
               });
             }
+            if (scheduledTaskInactiveUpdateIds.length > 0) {
+              cancellationEvents.push({
+                accountId,
+                workspaceId,
+                sessionId,
+                turnId: null,
+                turnGeneration: null,
+                turnAttemptId: null,
+                turnAssociation: null,
+                sequence: ++sequence,
+                type: "system.update.cancelled" as const,
+                payload: {
+                  updateIds: scheduledTaskInactiveUpdateIds,
+                  count: scheduledTaskInactiveUpdateIds.length,
+                  reason: "scheduled_task_inactive",
+                },
+                occurredAt,
+              });
+            }
             if (authorityRejectedUpdateIds.length > 0) {
               cancellationEvents.push({
                 accountId,
@@ -60252,6 +61432,25 @@ export async function claimSessionWorkForAttempt(
               occurredAt,
             });
           }
+          if (scheduledTaskInactiveUpdateIds.length > 0) {
+            events.push({
+              accountId,
+              workspaceId,
+              sessionId,
+              turnId,
+              turnGeneration,
+              turnAttemptId: input.attemptId,
+              turnAssociation: "current",
+              sequence: ++sequence,
+              type: "system.update.cancelled",
+              payload: {
+                updateIds: scheduledTaskInactiveUpdateIds,
+                count: scheduledTaskInactiveUpdateIds.length,
+                reason: "scheduled_task_inactive",
+              },
+              occurredAt,
+            });
+          }
           if (authorityRejectedUpdateIds.length > 0) {
             events.push({
               accountId,
@@ -61406,6 +62605,9 @@ export async function claimSessionWorkForAttempt(
             typeof routingGoalUpdate.payload.policy === "object"
               ? (routingGoalUpdate.payload.policy as Record<string, unknown>)
               : null;
+          let frozenTurnExecutionPolicy = goalPolicy?.turnExecutionPolicy
+            ? TurnExecutionPolicyV1.parse(goalPolicy.turnExecutionPolicy)
+            : null;
           const [latestStarted] = await tx
             .select({
               model: schema.sessionTurns.model,
@@ -61475,6 +62677,9 @@ export async function claimSessionWorkForAttempt(
             const accepted = ScheduledTaskRunAcceptedExecution.parse(
               scheduledRun.acceptedExecutionSnapshot,
             );
+            frozenTurnExecutionPolicy = accepted.turnExecutionPolicy
+              ? TurnExecutionPolicyV1.parse(accepted.turnExecutionPolicy)
+              : null;
             const targetPolicy = accepted.targetSessionExecution;
             if (targetPolicy) {
               scheduledEffectiveMcpServerIds = targetPolicy.effectiveMcpServerIds;
@@ -61696,11 +62901,28 @@ export async function claimSessionWorkForAttempt(
                   sandboxBackend,
                   sandboxOs,
                   metadata: metadataWithTurnDispatchAttempt(
-                    {
-                      internalUpdateCount: delivered.count,
-                      ...(routingGoalUpdate ? { goalId: routingGoalUpdate.payload.goalId } : {}),
-                      ...(scheduledEffectiveMcpServerIds ? { scheduledEffectiveMcpServerIds } : {}),
-                    },
+                    frozenTurnExecutionPolicy
+                      ? metadataWithTurnExecutionPolicyV1(
+                          {
+                            internalUpdateCount: delivered.count,
+                            ...(routingGoalUpdate
+                              ? { goalId: routingGoalUpdate.payload.goalId }
+                              : {}),
+                            ...(scheduledEffectiveMcpServerIds
+                              ? { scheduledEffectiveMcpServerIds }
+                              : {}),
+                          },
+                          frozenTurnExecutionPolicy,
+                        )
+                      : {
+                          internalUpdateCount: delivered.count,
+                          ...(routingGoalUpdate
+                            ? { goalId: routingGoalUpdate.payload.goalId }
+                            : {}),
+                          ...(scheduledEffectiveMcpServerIds
+                            ? { scheduledEffectiveMcpServerIds }
+                            : {}),
+                        },
                     { id: input.dispatchId, generation: 1, triggerEventId },
                   ),
                   ...initiatorColumns(internalInitiator),
@@ -64000,7 +65222,10 @@ export async function failSessionWorkBeforeAttemptClaim(
                 sessionId: input.sessionId,
                 sequence: ++sequence,
                 type: "user.humanInputResponse" as const,
-                payload: { requestId: request.id, response: { outcome: "cancelled" as const } },
+                payload: {
+                  requestId: request.id,
+                  response: { outcome: "cancelled" as const },
+                },
                 turnId: turn.id,
                 turnGeneration: request.turnGeneration,
                 turnAttemptId: null,
@@ -68648,8 +69873,9 @@ export type AddSessionSystemUpdateInput = {
   scheduledTaskRunId?: string | null;
 } & SessionSystemUpdateInputVariant;
 
-export type AddSessionSystemUpdateResult =
+export type AddSessionSystemUpdateResult<RequireIdleSession extends boolean = boolean> =
   | { added: false; reason: "session_cancelled" }
+  | (RequireIdleSession extends true ? { added: false; reason: "session_not_idle" } : never)
   | {
       added: boolean;
       reason: "added" | "duplicate";
@@ -68664,12 +69890,14 @@ export type AddSessionSystemUpdateResult =
 export type PrepareSessionSystemUpdateSourceResult = {
   /** Private, bounded, content-free source authority appended before insert. */
   lineage?: Record<string, unknown>;
+  /** Source-owned events appended before the pending-update event. */
+  events?: SessionEvent[];
 };
 
 export async function addSessionSystemUpdate(
   db: Database,
   input: AddSessionSystemUpdateInput,
-): Promise<AddSessionSystemUpdateResult> {
+): Promise<AddSessionSystemUpdateResult<false>> {
   if (input.payload.type !== input.kind) {
     throw new Error(`Internal update payload discriminator must equal kind ${input.kind}`);
   }
@@ -68680,29 +69908,34 @@ export async function addSessionSystemUpdate(
  * Persist one internal update without fabricating a user prompt or queue row.
  * Dedupe and any producer/outbox mutation commit in the same transaction.
  */
-export async function addSessionSystemUpdateWithSourceMutation(
+export async function addSessionSystemUpdateWithSourceMutation<
+  RequireIdleSession extends boolean = false,
+>(
   db: Database,
   input: AddSessionSystemUpdateInput,
   mutateSource: (
     tx: Database,
     wakeEventId: string | null,
     updateId: string | null,
+    rejectionReason: "session_cancelled" | "session_not_idle" | null,
   ) => Promise<void>,
   options: {
+    /** Admit only when the already-locked session is at its idle boundary. */
+    requireIdleSession?: RequireIdleSession;
     /** Runs under the locked session/source transaction before any update/event insert. */
     prepareSource?: (
       tx: Database,
       sessionId: string,
     ) => Promise<PrepareSessionSystemUpdateSourceResult | void>;
   } = {},
-): Promise<AddSessionSystemUpdateResult> {
+): Promise<AddSessionSystemUpdateResult<RequireIdleSession>> {
   if (Buffer.byteLength(JSON.stringify(input.payload)) > MAX_INTERNAL_UPDATE_BYTES) {
     throw new Error(`Internal update payload exceeds ${MAX_INTERNAL_UPDATE_BYTES} bytes`);
   }
   if (Buffer.byteLength(input.summary) > MAX_INTERNAL_UPDATE_BYTES) {
     throw new Error(`Internal update summary exceeds ${MAX_INTERNAL_UPDATE_BYTES} bytes`);
   }
-  return await withSessionActivityRlsContext(
+  return (await withSessionActivityRlsContext(
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) =>
@@ -68712,8 +69945,9 @@ export async function addSessionSystemUpdateWithSourceMutation(
           controlLock: "share",
           sessionIds: [input.sessionId],
         });
-        const session = locks.sessions[0];
+        let session = locks.sessions[0];
         if (!session) throw new Error(`Session not found: ${input.sessionId}`);
+        const temporalWorkflowId = session.temporalWorkflowId;
         const effectiveControl = await evaluateSessionControl(
           tx as unknown as Database,
           input.workspaceId,
@@ -68721,10 +69955,71 @@ export async function addSessionSystemUpdateWithSourceMutation(
           { workspaceControl: locks.control ?? undefined },
         );
         if (session.status === "cancelled") {
-          await mutateSource(tx as unknown as Database, null, null);
+          await mutateSource(tx as unknown as Database, null, null, "session_cancelled");
           return { added: false, reason: "session_cancelled" } as const;
         }
+        const replayExistingUpdate = async (events: SessionEvent[]) => {
+          const [existing] = await tx
+            .select()
+            .from(schema.sessionSystemUpdates)
+            .where(
+              and(
+                eq(schema.sessionSystemUpdates.workspaceId, input.workspaceId),
+                eq(schema.sessionSystemUpdates.sessionId, input.sessionId),
+                eq(schema.sessionSystemUpdates.dedupeKey, input.dedupeKey),
+              ),
+            )
+            .limit(1);
+          if (!existing) return null;
+          const [pendingEvent] = await tx
+            .select({ id: schema.sessionEvents.id })
+            .from(schema.sessionEvents)
+            .where(
+              and(
+                eq(schema.sessionEvents.workspaceId, input.workspaceId),
+                eq(schema.sessionEvents.sessionId, input.sessionId),
+                eq(schema.sessionEvents.type, "system.update.pending"),
+                sql`${schema.sessionEvents.payload} ->> 'updateId' = ${existing.id}`,
+              ),
+            )
+            .limit(1);
+          if (!pendingEvent) throw new Error("System-update pending event disappeared");
+          await mutateSource(tx as unknown as Database, pendingEvent.id, existing.id, null);
+          return {
+            added: false,
+            reason: "duplicate",
+            update: mapSessionSystemUpdate(existing),
+            shouldWake: false,
+            workflowWakeRevision: null,
+            wakeEventId: pendingEvent.id,
+            temporalWorkflowId,
+            events,
+          } as const;
+        };
+
+        if (options.requireIdleSession && session.status !== "idle") {
+          const replayed = await replayExistingUpdate([]);
+          if (replayed) {
+            return replayed;
+          }
+          await mutateSource(tx as unknown as Database, null, null, "session_not_idle");
+          return { added: false, reason: "session_not_idle" } as const;
+        }
         const prepared = await options.prepareSource?.(tx as unknown as Database, input.sessionId);
+        if ((prepared?.events?.length ?? 0) > 0) {
+          const [refreshedSession] = await tx
+            .select()
+            .from(schema.sessions)
+            .where(
+              and(
+                eq(schema.sessions.workspaceId, input.workspaceId),
+                eq(schema.sessions.id, input.sessionId),
+              ),
+            )
+            .limit(1);
+          if (!refreshedSession) throw new Error(`Session not found: ${input.sessionId}`);
+          session = refreshedSession;
+        }
         const lineage = {
           ...(input.lineage ?? {}),
           ...(prepared?.lineage ?? {}),
@@ -68769,42 +70064,9 @@ export async function addSessionSystemUpdateWithSourceMutation(
           })
           .returning();
         if (!inserted) {
-          const [existing] = await tx
-            .select()
-            .from(schema.sessionSystemUpdates)
-            .where(
-              and(
-                eq(schema.sessionSystemUpdates.workspaceId, input.workspaceId),
-                eq(schema.sessionSystemUpdates.sessionId, input.sessionId),
-                eq(schema.sessionSystemUpdates.dedupeKey, input.dedupeKey),
-              ),
-            )
-            .limit(1);
-          if (!existing) throw new Error("System-update dedupe row disappeared");
-          const [pendingEvent] = await tx
-            .select({ id: schema.sessionEvents.id })
-            .from(schema.sessionEvents)
-            .where(
-              and(
-                eq(schema.sessionEvents.workspaceId, input.workspaceId),
-                eq(schema.sessionEvents.sessionId, input.sessionId),
-                eq(schema.sessionEvents.type, "system.update.pending"),
-                sql`${schema.sessionEvents.payload} ->> 'updateId' = ${existing.id}`,
-              ),
-            )
-            .limit(1);
-          if (!pendingEvent) throw new Error("System-update pending event disappeared");
-          await mutateSource(tx as unknown as Database, pendingEvent.id, existing.id);
-          return {
-            added: false,
-            reason: "duplicate",
-            update: mapSessionSystemUpdate(existing),
-            shouldWake: false,
-            workflowWakeRevision: null,
-            wakeEventId: pendingEvent.id,
-            temporalWorkflowId: session.temporalWorkflowId,
-            events: [],
-          };
+          const replayed = await replayExistingUpdate(prepared?.events ?? []);
+          if (!replayed) throw new Error("System-update dedupe row disappeared");
+          return replayed;
         }
 
         const now = new Date();
@@ -68836,7 +70098,7 @@ export async function addSessionSystemUpdateWithSourceMutation(
           )
           .returning();
         if (!event) throw new Error("Failed to create system-update pending event");
-        await mutateSource(tx as unknown as Database, event.id, inserted.id);
+        await mutateSource(tx as unknown as Database, event.id, inserted.id, null);
         // Producer-side supersession of this child's now-stale pending notices
         // on the parent: a newer child_progress replaces an older one, and a
         // resolution supersedes the child_requires_action of the same exact
@@ -68980,11 +70242,16 @@ export async function addSessionSystemUpdateWithSourceMutation(
               temporalWorkflowId: session.temporalWorkflowId ?? `session-${session.id}`,
             })
           : null;
+        // An idle-gated admission consumes that boundary even when control or
+        // realtime ownership withholds the workflow wake. Persisting `queued`
+        // reserves the accepted work so a later distinct skip occurrence
+        // cannot cross the same idle boundary while this update is pending.
+        const shouldQueue = shouldWake || options.requireIdleSession === true;
         await tx
           .update(schema.sessions)
           .set({
             lastSequence: session.lastSequence + appendedSequences,
-            ...(shouldWake ? { status: "queued" as const } : {}),
+            ...(shouldQueue ? { status: "queued" as const } : {}),
             updatedAt: now,
           })
           .where(eq(schema.sessions.id, session.id));
@@ -68997,13 +70264,14 @@ export async function addSessionSystemUpdateWithSourceMutation(
           wakeEventId: event.id,
           temporalWorkflowId: session.temporalWorkflowId,
           events: [
+            ...(prepared?.events ?? []),
             mapEvent(event),
             ...(supersededEvent ? [mapEvent(supersededEvent)] : []),
             ...(resumedEvent ? [mapEvent(resumedEvent)] : []),
           ],
         };
       }),
-  );
+  )) as AddSessionSystemUpdateResult<RequireIdleSession>;
 }
 
 /**
@@ -71497,6 +72765,13 @@ function mapConnectionMetadata(row: {
   createdAt: Date;
   updatedAt: Date;
 }): ConnectionMetadataWithVerification {
+  const {
+    [OPENROUTER_CREDENTIAL_OPERATION_ID_METADATA_KEY]: _openRouterOperationId,
+    [OPENROUTER_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY]: _openRouterOperationDigest,
+    [VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_ID_METADATA_KEY]: _operationId,
+    [VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY]: _operationDigest,
+    ...publicMetadata
+  } = row.metadata;
   return {
     id: row.id,
     ...(row.subjectId !== null && row.authorityId ? { authorityId: row.authorityId } : {}),
@@ -71514,7 +72789,7 @@ function mapConnectionMetadata(row: {
     version: row.version,
     verifiedInstallAt: row.verifiedInstallAt?.toISOString() ?? null,
     verifiedInstallVersion: row.verifiedInstallVersion,
-    metadata: row.metadata,
+    metadata: publicMetadata,
     createdBySubjectId: row.createdBySubjectId,
     updatedBySubjectId: row.updatedBySubjectId,
     createdAt: row.createdAt.toISOString(),
@@ -71852,6 +73127,9 @@ function connectionRefConfig(value: unknown): McpServerConnectionRef | undefined
     return undefined;
   }
   const ref: McpServerConnectionRef = { providerDomain: record.providerDomain };
+  if (record.authoritySource === "host") {
+    ref.authoritySource = "host";
+  }
   if (typeof record.connectionId === "string" && record.connectionId.length > 0) {
     ref.connectionId = record.connectionId;
   }
@@ -72096,3 +73374,4 @@ export * from "./organization-recovery";
 export * from "./session-tenancy";
 export * from "./governed-learning-activation";
 export * from "./automations";
+export * from "./organization-model-providers";