@opengeni/db 4.0.0-canary.1 → 4.0.0-canary.2

package/dist/managed-auth-session-sets.js

@@ -20,9 +20,9 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-I6YPQMAL.js";
-import "./chunk-ZQ32COTC.js";
-import "./chunk-XAKQCOF3.js";
+} from "./chunk-VU2IK37Y.js";
+import "./chunk-XIYAXH47.js";
+import "./chunk-PWJJKCTF.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ManagedAuthActorMutationInFlightError,

package/dist/schema.d.ts

@@ -41096,6 +41096,57 @@ export declare const sessionBackgroundCommands: import("drizzle-orm/pg-core").Pg
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        launchTurnId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "launch_turn_id";
+            tableName: "session_background_commands";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        launchAttemptId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "launch_attempt_id";
+            tableName: "session_background_commands";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        launchExecutionGeneration: import("drizzle-orm/pg-core").PgColumn<{
+            name: "launch_execution_generation";
+            tableName: "session_background_commands";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         controlWorkspaceId: import("drizzle-orm/pg-core").PgColumn<{
             name: "control_workspace_id";
             tableName: "session_background_commands";

package/dist/schema.js

@@ -350,7 +350,7 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-XAKQCOF3.js";
+} from "./chunk-PWJJKCTF.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,

package/dist/session-background-commands.d.ts

@@ -47,6 +47,9 @@ export declare function insertManagedSessionBackgroundCommandInTransaction(db: D
     commandId: string;
     retainedProcessId: string;
     command: string;
+    turnId?: string;
+    attemptId?: string;
+    executionGeneration?: number;
 }): Promise<SessionBackgroundCommand>;
 /** @internal Caller must already hold the canonical exact-attempt fence. */
 export declare function insertConnectedMachineSessionBackgroundCommandInTransaction(db: Database, input: {
@@ -59,6 +62,9 @@ export declare function insertConnectedMachineSessionBackgroundCommandInTransact
     connectionInstanceId: string;
     opId: string;
     command: string;
+    turnId?: string;
+    attemptId?: string;
+    executionGeneration?: number;
 }): Promise<SessionBackgroundCommand>;
 /** Claim exact Connected Machine locators globally for provider reconciliation.
  * The SECURITY DEFINER SQL function owns the bounded SKIP LOCKED inventory;

package/dist/session-background-commands.js

@@ -22,10 +22,10 @@ import {
   settleClaimedConnectedMachineBackgroundCommandWithMutation,
   settleConnectedMachineSessionBackgroundCommandWithMutation,
   settleSessionBackgroundCommandForRetainedProcessInTransaction
-} from "./chunk-FVZINOBB.js";
-import "./chunk-A5RFBEZR.js";
-import "./chunk-ZQ32COTC.js";
-import "./chunk-XAKQCOF3.js";
+} from "./chunk-DUB3LUVM.js";
+import "./chunk-CQF6G4IF.js";
+import "./chunk-XIYAXH47.js";
+import "./chunk-PWJJKCTF.js";
 import "./chunk-PZ5AY32C.js";
 export {
   COMMAND_OUTPUT_DEFAULT_BYTES,

package/dist/session-command-output.js

@@ -1,10 +1,10 @@
 import {
   lockSessionEventWriteRows
-} from "./chunk-FVZINOBB.js";
-import "./chunk-A5RFBEZR.js";
+} from "./chunk-DUB3LUVM.js";
+import "./chunk-CQF6G4IF.js";
 import {
   withSessionActivityRlsContext
-} from "./chunk-ZQ32COTC.js";
+} from "./chunk-XIYAXH47.js";
 import {
   fromPostgresLosslessJson,
   sandboxRetainedProcesses,
@@ -12,7 +12,7 @@ import {
   sessionEvents,
   sessions,
   withLosslessContentWriteVersion
-} from "./chunk-XAKQCOF3.js";
+} from "./chunk-PWJJKCTF.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/session-command-output.ts

package/dist/session-event-slices.js

@@ -1,13 +1,13 @@
 import {
   rawRows,
   withWorkspaceRls
-} from "./chunk-ZQ32COTC.js";
+} from "./chunk-XIYAXH47.js";
 import {
   LOSSLESS_JSON_STRING_PREFIX,
   fromPostgresLosslessJson,
   sessionEvents,
   sessionTurns
-} from "./chunk-XAKQCOF3.js";
+} from "./chunk-PWJJKCTF.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/session-event-slices.ts

package/dist/session-tenancy.js

@@ -14,9 +14,9 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-2HGYCAXN.js";
-import "./chunk-ZQ32COTC.js";
-import "./chunk-XAKQCOF3.js";
+} from "./chunk-B5Y3TCSP.js";
+import "./chunk-XIYAXH47.js";
+import "./chunk-PWJJKCTF.js";
 import "./chunk-PZ5AY32C.js";
 export {
   SessionTenancyAccessError,

package/dist/video-generation.js

@@ -29,9 +29,9 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-A5RFBEZR.js";
-import "./chunk-ZQ32COTC.js";
-import "./chunk-XAKQCOF3.js";
+} from "./chunk-CQF6G4IF.js";
+import "./chunk-XIYAXH47.js";
+import "./chunk-PWJJKCTF.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ACTIVE_VIDEO_GENERATION_STATUSES,

package/drizzle/0419_background_command_launch_authority.sql

@@ -0,0 +1,56 @@
+-- deployment-mode: rolling
+-- New adoption writers freeze their already-fenced launch attempt. Older
+-- writers leave this tuple absent; never invent authority for legacy commands.
+ALTER TABLE session_background_commands
+  ADD COLUMN launch_turn_id uuid,
+  ADD COLUMN launch_attempt_id uuid,
+  ADD COLUMN launch_execution_generation integer,
+  ADD CONSTRAINT session_background_commands_launch_identity_check CHECK (
+    (launch_turn_id IS NULL AND launch_attempt_id IS NULL AND launch_execution_generation IS NULL)
+    OR (launch_turn_id IS NOT NULL AND launch_attempt_id IS NOT NULL AND launch_execution_generation IS NOT NULL AND launch_execution_generation > 0)
+  );
+
+CREATE FUNCTION fence_background_command_launch_identity()
+RETURNS trigger LANGUAGE plpgsql SET search_path = pg_catalog, public AS $$
+DECLARE matches_launch boolean;
+BEGIN
+  IF TG_OP = 'UPDATE' THEN
+    IF ROW(NEW.launch_turn_id, NEW.launch_attempt_id, NEW.launch_execution_generation,
+           NEW.account_id, NEW.workspace_id, NEW.session_id, NEW.provider,
+           NEW.retained_process_id, NEW.control_workspace_id, NEW.enrollment_id,
+           NEW.connection_instance_id, NEW.op_id)
+       IS DISTINCT FROM
+       ROW(OLD.launch_turn_id, OLD.launch_attempt_id, OLD.launch_execution_generation,
+           OLD.account_id, OLD.workspace_id, OLD.session_id, OLD.provider,
+           OLD.retained_process_id, OLD.control_workspace_id, OLD.enrollment_id,
+           OLD.connection_instance_id, OLD.op_id) THEN
+      RAISE EXCEPTION 'background command launch identity is immutable' USING ERRCODE = '23514';
+    END IF;
+    RETURN NEW;
+  END IF;
+  IF NEW.launch_turn_id IS NOT NULL AND NEW.launch_attempt_id IS NOT NULL
+     AND NEW.launch_execution_generation IS NOT NULL THEN
+    -- The migrator also supports dedicated data schemas. Never resolve an
+    -- unrelated public table when this trigger belongs to another schema.
+    EXECUTE format(
+      'SELECT EXISTS (
+        SELECT 1 FROM %I.session_turn_attempts a
+        JOIN %I.session_turns t ON t.id = a.turn_id AND t.workspace_id = a.workspace_id
+          AND t.session_id = a.session_id AND t.account_id = a.account_id
+        WHERE a.id = $1 AND a.turn_id = $2
+          AND a.workspace_id = $3 AND a.session_id = $4
+          AND a.account_id = $5 AND a.execution_generation = $6
+      )', TG_TABLE_SCHEMA, TG_TABLE_SCHEMA
+    ) INTO matches_launch USING NEW.launch_attempt_id, NEW.launch_turn_id,
+      NEW.workspace_id, NEW.session_id, NEW.account_id, NEW.launch_execution_generation;
+    IF NOT matches_launch THEN
+      RAISE EXCEPTION 'background command launch attempt does not match session' USING ERRCODE = '23514';
+    END IF;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+REVOKE ALL ON FUNCTION fence_background_command_launch_identity() FROM PUBLIC;
+CREATE TRIGGER session_background_commands_launch_identity_fence
+BEFORE INSERT OR UPDATE ON session_background_commands
+FOR EACH ROW EXECUTE FUNCTION fence_background_command_launch_identity();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "4.0.0-canary.1",
+  "version": "4.0.0-canary.2",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -86,11 +86,11 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "^0.4.27-canary.1",
-    "@opengeni/codex": "^0.2.21-canary.1",
-    "@opengeni/config": "^1.0.0-canary.1",
-    "@opengeni/contracts": "^2.13.0-canary.1",
-    "@opengeni/network": "^0.3.0-canary.1",
+    "@opengeni/codemode": "^0.4.27-canary.2",
+    "@opengeni/codex": "^0.2.21-canary.2",
+    "@opengeni/config": "^1.0.0-canary.2",
+    "@opengeni/contracts": "^2.13.0-canary.2",
+    "@opengeni/network": "^0.3.0-canary.2",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },

package/src/index.ts

@@ -38395,6 +38395,9 @@ export async function adoptManagedSessionBackgroundCommand(
           commandId: input.processId,
           retainedProcessId: input.processId,
           command: input.command,
+          turnId: input.turnId,
+          attemptId: input.attemptId,
+          executionGeneration: input.executionGeneration,
         });
       }),
   );
@@ -61784,7 +61787,9 @@ function systemUpdateCausalHumanTurnId(
       : null;
   const value = isChildLifecycleSystemUpdateKind(update.kind)
     ? lineage?.parentTurnId
-    : update.kind === "goal_continuation"
+    : update.kind === "goal_continuation" ||
+        update.kind === "background_command_result" ||
+        update.kind === "session_wait_timeout"
       ? lineage?.causalTurnId
       : null;
   if (typeof value !== "string" || !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/iu.test(value)) {
@@ -61829,7 +61834,12 @@ function systemUpdateCausalExecutionKey(
 ): string | null {
   const targetTurnId = systemUpdateCausalHumanTurnId(update);
   if (targetTurnId) return `target-turn:${targetTurnId}`;
-  if (isChildLifecycleSystemUpdateKind(update.kind) || update.kind === "goal_continuation") {
+  if (
+    isChildLifecycleSystemUpdateKind(update.kind) ||
+    update.kind === "goal_continuation" ||
+    update.kind === "background_command_result" ||
+    update.kind === "session_wait_timeout"
+  ) {
     // Malformed historical authority-bearing rows still own distinct claims.
     // They may carry ordinary authority-neutral context, but they must never
     // borrow another child, goal, or Steer's causal principal.
@@ -66376,6 +66386,10 @@ async function settleSessionInputWaitInActivity(
     }
     const deadlineAt = expected.inputWaitUntil.toISOString();
     const reason = expected.inputWaitReason;
+    const causalAuthority = await sameSessionCausalAuthorityTx(db as unknown as Database, {
+      ...input,
+      turnId: input.waitTurnId,
+    });
     try {
       const result = await addSessionSystemUpdateWithSourceMutation(
         db,
@@ -66384,6 +66398,11 @@ async function settleSessionInputWaitInActivity(
           workspaceId: input.workspaceId,
           sessionId: input.sessionId,
           kind: "session_wait_timeout",
+          personalConnectionDelegations: causalAuthority?.personalConnectionDelegations ?? [],
+          xaiProviderAccountAuthoritySnapshot:
+            causalAuthority?.xaiProviderAccountAuthoritySnapshot ??
+            WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1,
+          lineage: causalAuthority?.lineage ?? {},
           classification: "info",
           sourceId: input.waitTurnId,
           dedupeKey: `session-input-wait-timeout:${input.waitTurnId}`,
@@ -66572,6 +66591,11 @@ export type FailSessionWorkBeforeAttemptClaimInput = {
   workflowId: string;
   trigger: SessionWorkTrigger;
   error: string;
+  /** Already-classified admission facts from the failed worker activity. */
+  admissionFailure?: {
+    disposition: "retryable" | "permanent";
+    code: "db_deadlock" | "db_serialization_failure" | "db_failure" | "claim_invariant";
+  };
 };
 
 export type FailSessionWorkBeforeAttemptClaimResult =
@@ -66955,6 +66979,8 @@ export async function failSessionWorkBeforeAttemptClaim(
             payload: {
               status: "failed",
               code: "pre_claim_failure",
+              error: input.error,
+              ...(input.admissionFailure ? { admissionFailure: input.admissionFailure } : {}),
               ...(!turn ? { failedSystemUpdateIds } : {}),
             },
             turnId: turn?.id ?? null,
@@ -67284,6 +67310,8 @@ export async function recoverSessionWorkFailedBeforeAttemptClaim(
           .select({
             id: schema.sessionSystemUpdates.id,
             kind: schema.sessionSystemUpdates.kind,
+            sourceId: schema.sessionSystemUpdates.sourceId,
+            dedupeKey: schema.sessionSystemUpdates.dedupeKey,
             lineage: schema.sessionSystemUpdates.lineage,
             deliveredTurnId: schema.sessionSystemUpdates.deliveredTurnId,
             deliveredHistoryItemId: schema.sessionSystemUpdates.deliveredHistoryItemId,
@@ -67388,22 +67416,71 @@ export async function recoverSessionWorkFailedBeforeAttemptClaim(
         }
 
         const causalTurnIds = new Set<string>();
+        const repairedAuthorities = new Map<
+          string,
+          NonNullable<Awaited<ReturnType<typeof sameSessionCausalAuthorityTx>>>
+        >();
         for (const update of failedUpdates) {
-          const causalTurnId = systemUpdateCausalHumanTurnId(update);
+          let causalTurnId = systemUpdateCausalHumanTurnId(update);
           const lineage =
             update.lineage && typeof update.lineage === "object" && !Array.isArray(update.lineage)
               ? (update.lineage as Record<string, unknown>)
               : null;
           if (
-            !isChildLifecycleSystemUpdateKind(update.kind) ||
-            !causalTurnId ||
-            lineage?.parentSessionId !== input.sessionId ||
             update.deliveredTurnId !== null ||
             update.deliveredHistoryItemId !== null ||
             update.deliveredAt !== null
-          ) {
+          )
             return { action: "stale", event: null } as const;
-          }
+          if (isChildLifecycleSystemUpdateKind(update.kind)) {
+            if (!causalTurnId || lineage?.parentSessionId !== input.sessionId) {
+              return { action: "stale", event: null } as const;
+            }
+          } else if (update.kind === "background_command_result") {
+            if (
+              !update.sourceId ||
+              !UUID_PATTERN.test(update.sourceId) ||
+              update.dedupeKey !== `background-command-result:${update.sourceId}`
+            ) {
+              return { action: "stale", event: null } as const;
+            }
+            const authority = await backgroundCommandCausalAuthorityTx(tx as unknown as Database, {
+              accountId: session.accountId,
+              workspaceId,
+              sessionId: input.sessionId,
+              commandId: update.sourceId,
+            });
+            if (!authority) return { action: "stale", event: null } as const;
+            repairedAuthorities.set(update.id, authority);
+            causalTurnId = authority.lineage.causalTurnId;
+          } else if (update.kind === "session_wait_timeout") {
+            if (
+              !update.sourceId ||
+              !UUID_PATTERN.test(update.sourceId) ||
+              update.dedupeKey !== `session-input-wait-timeout:${update.sourceId}`
+            ) {
+              return { action: "stale", event: null } as const;
+            }
+            const [timeoutProof] = await tx.execute(sql`
+              select id from session_events
+              where workspace_id = ${workspaceId} and session_id = ${input.sessionId}
+                and type = 'session.wait.finished'
+                and payload ->> 'waitTurnId' = ${update.sourceId}
+                and payload ->> 'outcome' = 'timeout'
+                and sequence < ${input.expectedFailureEventSequence}
+              limit 1`);
+            if (!timeoutProof) return { action: "stale", event: null } as const;
+            const authority = await sameSessionCausalAuthorityTx(tx as unknown as Database, {
+              accountId: session.accountId,
+              workspaceId,
+              sessionId: input.sessionId,
+              turnId: update.sourceId,
+            });
+            if (!authority) return { action: "stale", event: null } as const;
+            repairedAuthorities.set(update.id, authority);
+            causalTurnId = authority.lineage.causalTurnId;
+          } else return { action: "stale", event: null } as const;
+          if (!causalTurnId) return { action: "stale", event: null } as const;
           causalTurnIds.add(causalTurnId);
         }
         const causalTurns = await tx
@@ -67432,6 +67509,27 @@ export async function recoverSessionWorkFailedBeforeAttemptClaim(
           return { action: "stale", event: null } as const;
         }
 
+        // Only after every exact failed member and causal receipt passes do
+        // we repair typed authority; message/event content is never rewritten.
+        for (const update of failedUpdates) {
+          const authority = repairedAuthorities.get(update.id);
+          if (!authority) continue;
+          await tx
+            .update(schema.sessionSystemUpdates)
+            .set({
+              personalConnectionDelegations: authority.personalConnectionDelegations,
+              xaiProviderAccountAuthoritySnapshot: authority.xaiProviderAccountAuthoritySnapshot,
+              lineage: { ...update.lineage, ...authority.lineage },
+            })
+            .where(
+              and(
+                eq(schema.sessionSystemUpdates.id, update.id),
+                eq(schema.sessionSystemUpdates.workspaceId, workspaceId),
+                eq(schema.sessionSystemUpdates.sessionId, input.sessionId),
+                eq(schema.sessionSystemUpdates.state, "failed"),
+              ),
+            );
+        }
         const restored = await tx
           .update(schema.sessionSystemUpdates)
           .set({ state: "pending" })
@@ -67622,6 +67720,7 @@ export async function settleSessionIdleWithParentOutbox(
       action: "settled";
       changed: boolean;
       episodeKey: string;
+      notifyParent: boolean;
       events: SessionEvent[];
     }
   | { action: "stale"; episodeKey: null; events: [] }
@@ -67717,11 +67816,30 @@ export async function settleSessionIdleWithParentOutbox(
       // notification to the newest non-status event, not to the idle status
       // event this settlement just appended (or a prior identical idle event).
       const episodeKey = String(Number(episodeSequence));
-      if (!session.parentSessionId) {
+      // Workflow closure is not work completion. Input waits (including a
+      // due timeout not yet materialized) and active goals retain obligations
+      // even while their workflow run truthfully parks the session as idle.
+      const waitState = await sessionInputWaitStateTx(tx, workspaceId, sessionId, session);
+      const [goal] = await tx
+        .select({ status: schema.sessionGoals.status })
+        .from(schema.sessionGoals)
+        .where(
+          and(
+            eq(schema.sessionGoals.workspaceId, workspaceId),
+            eq(schema.sessionGoals.sessionId, sessionId),
+          ),
+        )
+        .limit(1);
+      const ongoingWork =
+        waitState.disposition === "held" ||
+        waitState.disposition === "timeout" ||
+        goal?.status === "active";
+      if (!session.parentSessionId || ongoingWork) {
         return {
           action: "settled",
           changed: events.length > 0,
           episodeKey,
+          notifyParent: false,
           events,
         } as const;
       }
@@ -67741,6 +67859,7 @@ export async function settleSessionIdleWithParentOutbox(
         action: "settled",
         changed: events.length > 0,
         episodeKey,
+        notifyParent: true,
         events,
       } as const;
     });
@@ -72799,6 +72918,129 @@ export async function addSessionSystemUpdateWithSourceMutation<
   )) as AddSessionSystemUpdateResult<RequireIdleSession>;
 }
 
+async function sameSessionCausalAuthorityTx(
+  tx: Database,
+  input: { accountId: string; workspaceId: string; sessionId: string; turnId: string },
+) {
+  const [turn] = await tx
+    .select()
+    .from(schema.sessionTurns)
+    .where(
+      and(
+        eq(schema.sessionTurns.accountId, input.accountId),
+        eq(schema.sessionTurns.workspaceId, input.workspaceId),
+        eq(schema.sessionTurns.sessionId, input.sessionId),
+        eq(schema.sessionTurns.id, input.turnId),
+      ),
+    )
+    .limit(1);
+  if (!turn) return null;
+  const personalConnectionDelegations = personalConnectionDelegationsForSameSessionSuccessor(
+    parsedPersonalConnectionDelegations(
+      turn.personalConnectionDelegations,
+      `session_turns:${turn.id}`,
+    ),
+    input.sessionId,
+  );
+  const xaiProviderAccountAuthoritySnapshot = XaiProviderAccountAuthoritySnapshotV1.parse(
+    turn.xaiProviderAccountAuthoritySnapshot,
+  );
+  const human =
+    turn.initiatingHumanSubjectId ??
+    (turn.initiatorKind === "subject" ? turn.initiatorSubjectId : null);
+  if (
+    !human &&
+    (personalConnectionDelegations.some((d) => d.userDelegation) ||
+      xaiProviderAccountAuthoritySnapshot.scope === "user")
+  ) {
+    throw new SessionControlInvariantError("Causal turn lost its personal execution authority");
+  }
+  return {
+    personalConnectionDelegations,
+    xaiProviderAccountAuthoritySnapshot,
+    lineage: {
+      causalTurnId: turn.id,
+      ...(human && personalConnectionDelegations.some((d) => d.userDelegation)
+        ? { connectionAuthoritySubjectId: human }
+        : {}),
+      ...(human && xaiProviderAccountAuthoritySnapshot.scope === "user"
+        ? { xaiAuthoritySubjectId: human }
+        : {}),
+    },
+  };
+}
+
+/** Resolve only the immutable launch receipt, including pre-0419 managed rows.
+ * Legacy Connected Machine rows have no durable launch identity and stay
+ * unattributed. Neither a current session owner nor its latest turn is a substitute. */
+async function backgroundCommandCausalAuthorityTx(
+  tx: Database,
+  input: { accountId: string; workspaceId: string; sessionId: string; commandId: string },
+) {
+  const [command] = await tx
+    .select()
+    .from(schema.sessionBackgroundCommands)
+    .where(
+      and(
+        eq(schema.sessionBackgroundCommands.accountId, input.accountId),
+        eq(schema.sessionBackgroundCommands.workspaceId, input.workspaceId),
+        eq(schema.sessionBackgroundCommands.sessionId, input.sessionId),
+        eq(schema.sessionBackgroundCommands.id, input.commandId),
+      ),
+    )
+    .limit(1);
+  if (!command || !["exited", "lost"].includes(command.state) || !command.settledAt) return null;
+  let turnId = command.launchTurnId;
+  let attemptId = command.launchAttemptId;
+  let generation = command.launchExecutionGeneration;
+  if (!turnId && command.provider === "managed" && command.retainedProcessId) {
+    const [process] = await tx
+      .select()
+      .from(schema.sandboxRetainedProcesses)
+      .where(
+        and(
+          eq(schema.sandboxRetainedProcesses.id, command.retainedProcessId),
+          eq(schema.sandboxRetainedProcesses.accountId, input.accountId),
+          eq(schema.sandboxRetainedProcesses.workspaceId, input.workspaceId),
+          eq(schema.sandboxRetainedProcesses.sessionId, input.sessionId),
+        ),
+      )
+      .limit(1);
+    if (process?.ownerActorKind === "turn" && process.ownerActorId === process.ownerAttemptId) {
+      turnId = process.ownerTurnId;
+      attemptId = process.ownerAttemptId;
+      generation = process.ownerExecutionGeneration;
+    }
+  }
+  if (!turnId || !attemptId || !generation) return null;
+  const [attempt] = await tx
+    .select({ id: schema.sessionTurnAttempts.id })
+    .from(schema.sessionTurnAttempts)
+    .where(
+      and(
+        eq(schema.sessionTurnAttempts.id, attemptId),
+        eq(schema.sessionTurnAttempts.accountId, input.accountId),
+        eq(schema.sessionTurnAttempts.workspaceId, input.workspaceId),
+        eq(schema.sessionTurnAttempts.sessionId, input.sessionId),
+        eq(schema.sessionTurnAttempts.turnId, turnId),
+        eq(schema.sessionTurnAttempts.executionGeneration, generation),
+      ),
+    )
+    .limit(1);
+  if (!attempt) return null;
+  const authority = await sameSessionCausalAuthorityTx(tx, { ...input, turnId });
+  return authority
+    ? {
+        ...authority,
+        lineage: {
+          ...authority.lineage,
+          causalAttemptId: attemptId,
+          causalExecutionGeneration: generation,
+        },
+      }
+    : null;
+}
+
 function backgroundCommandTerminalMutation(input: {
   accountId: string;
   workspaceId: string;
@@ -72934,6 +73176,10 @@ function backgroundCommandTerminalMutation(input: {
         ...(command.failure ? { failure: command.failure } : {}),
         outputLocator,
       };
+      const causalAuthority = await backgroundCommandCausalAuthorityTx(tx as unknown as Database, {
+        ...input,
+        commandId: command.id,
+      });
       const [insertedUpdate] = await tx
         .insert(schema.sessionSystemUpdates)
         .values(
@@ -72949,7 +73195,15 @@ function backgroundCommandTerminalMutation(input: {
                 dedupeKey: `background-command-result:${command.id}`,
                 summary,
                 payload,
-                lineage: { commandId: command.id, provider: command.provider },
+                personalConnectionDelegations: causalAuthority?.personalConnectionDelegations ?? [],
+                xaiProviderAccountAuthoritySnapshot:
+                  causalAuthority?.xaiProviderAccountAuthoritySnapshot ??
+                  WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1,
+                lineage: {
+                  commandId: command.id,
+                  provider: command.provider,
+                  ...causalAuthority?.lineage,
+                },
                 state: "pending",
               },
               "summary",