@opengeni/db 4.3.2 → 4.3.3-canary.1

package/src/index.ts

@@ -1,3 +1,5 @@
+import { codexSelectionDiagnostics } from "./codex-selection-diagnostics";
+export { codexSelectionDiagnostics } from "./codex-selection-diagnostics";
 import {
   latestStartedSessionTurnQuery,
   withLatestStartedSessionPolicy,
@@ -272,6 +274,7 @@ import {
   SANDBOX_PROVIDER_INSTANCE_ID_FIELDS_BY_BACKEND,
   parseWorkspaceArchiveDescriptor,
   parseWorkspaceArchiveObjectRef,
+  validateWorkspaceArchiveObjectRef,
   workspaceArchivePayloadPresent,
   omitInlineWorkspaceArchiveWhenObjectRefPresent,
   type WorkspaceArchiveObjectRef,
@@ -334,7 +337,6 @@ import {
 } from "@opengeni/contracts";
 import {
   environmentsEncryptionKeyBytes,
-  SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS,
   SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS,
   WORKSPACE_OPENROUTER_CONNECTION_DOMAIN,
   WORKSPACE_OPENROUTER_CONNECTION_ROLE,
@@ -342,6 +344,7 @@ import {
   VERCEL_AI_GATEWAY_CONNECTION_ROLE,
   type Settings,
 } from "@opengeni/config";
+import { SandboxTransitionWaitBudget } from "./sandbox-transition-wait";
 import { normalizeWorkspaceMembershipPermissions } from "./workspace-membership-permissions";
 import {
   canonicalizePersistedHistoryItem,
@@ -398,6 +401,8 @@ import {
 export { LOSSLESS_TEXT_PREFIX } from "./lossless-json";
 import {
   projectSessionMcpProgressText,
+  projectSessionTextPrefix,
+  sessionTextStoragePrefixChars,
   SESSION_MCP_PROGRESS_STORAGE_CHARS,
   sessionMcpProgressScalarIsEncodedSql,
 } from "./session-mcp-progress";
@@ -29659,6 +29664,114 @@ export async function setSessionCodexPin(
 }
 
 /** Written by the worker at the turn boundary; drives the in-session indicator. */
+/** Commit observed assignment and its events together under the exact live attempt.
+ * Allocation still uses its frozen policy snapshot; this is observation only.
+ * Replays return the same receipt and never manufacture a second switch.
+ */
+export async function recordSessionCodexSelectionForTurnAttempt(
+  db: Database,
+  input: {
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    credentialId: string;
+    strategy: string;
+    reusedLease: boolean;
+    pinnedCredentialId: string | null;
+    pinSource: "manual" | "policy" | null;
+    eligibleCount: number;
+    connectedCount: number;
+  },
+): Promise<{ events: SessionEvent[]; diagnostics: ReturnType<typeof codexSelectionDiagnostics> }> {
+  return await withWorkspaceSessionEventActivityRls(db, input.workspaceId, true, async (tx) => {
+    const fence = await lockTurnAttemptWriteFenceTx(tx, {
+      workspaceId: input.workspaceId,
+      sessionId: input.sessionId,
+      turnId: input.turnId,
+      executionGeneration: input.executionGeneration,
+      attemptId: input.attemptId,
+      sessionLock: "no_key_update",
+    });
+    if (!fence.allowed || !fence.session) throw new CodexCredentialLeaseAttemptFencedError();
+    const key = `opengeni:codex-selection:${input.attemptId}`;
+    const prior = await tx
+      .select()
+      .from(schema.sessionEvents)
+      .where(
+        and(
+          eq(schema.sessionEvents.workspaceId, input.workspaceId),
+          eq(schema.sessionEvents.sessionId, input.sessionId),
+          inArray(schema.sessionEvents.clientEventId, [key, `${key}:switch`]),
+        ),
+      )
+      .orderBy(asc(schema.sessionEvents.sequence));
+    if (prior.length) {
+      const receipt = prior.find((event) => event.type === "codex.credential.selected");
+      if (!receipt) throw new Error("Codex selection receipt missing");
+      const payload = sessionEventPayloadRecord(receipt.payload, receipt.payloadCodecVersion);
+      if (payload.credentialId !== input.credentialId)
+        throw new Error("An attempt cannot record two different Codex selections");
+      return {
+        events: prior.map(mapEvent),
+        diagnostics: {
+          transition: payload.transition,
+          source: payload.source,
+          reason: payload.reason,
+        } as ReturnType<typeof codexSelectionDiagnostics>,
+      };
+    }
+    const previousCredentialId = fence.session.codexLastCredentialId;
+    const diagnostics = codexSelectionDiagnostics({ ...input, previousCredentialId });
+    const events: AppendEventInput[] = [];
+    if (previousCredentialId !== null && previousCredentialId !== input.credentialId) {
+      events.push({
+        type: "codex.account.switched",
+        clientEventId: `${key}:switch`,
+        payload: {
+          fromAccountId: previousCredentialId,
+          toAccountId: input.credentialId,
+          reason: diagnostics.source === "manual_pin" ? "manual" : "rotation",
+        },
+      });
+    }
+    events.push({
+      type: "codex.credential.selected",
+      clientEventId: key,
+      payload: {
+        credentialId: input.credentialId,
+        strategy: input.strategy,
+        ...diagnostics,
+        previousCredentialId,
+        eligibleCount: input.eligibleCount,
+        connectedCount: input.connectedCount,
+        reused: input.reusedLease,
+      },
+    });
+    await tx
+      .update(schema.sessions)
+      .set({ codexLastCredentialId: input.credentialId })
+      .where(
+        and(
+          eq(schema.sessions.workspaceId, input.workspaceId),
+          eq(schema.sessions.id, input.sessionId),
+        ),
+      );
+    const appended = await appendSessionEventsForTurnAttempt(
+      tx,
+      input.workspaceId,
+      input.sessionId,
+      input.turnId,
+      input.executionGeneration,
+      input.attemptId,
+      events,
+    );
+    if (!appended.accepted) throw new CodexCredentialLeaseAttemptFencedError();
+    return { events: appended.events, diagnostics };
+  });
+}
+
 export async function recordSessionActiveCodexCredential(
   db: Database,
   workspaceId: string,
@@ -35194,6 +35307,120 @@ export async function listSessionsForSubject(
 }
 
 /** Read a session with the caller subject's personal pin projection. */
+/** Read failure evidence at the already-authorized detail cursor, never a browser page.
+ * Event rows are immutable; the sequence fence keeps these reads coherent even
+ * if another turn is accepted while the detail projection is being assembled.
+ * Keep this off fleet/list/worker reads. Existing type/turn indexes cover it.
+ */
+async function sessionFailureDiagnostics(
+  db: Database,
+  workspaceId: string,
+  session: { id: string; lastSequence: number; status: string },
+): Promise<Session["failureDiagnostics"]> {
+  if (session.status !== "failed") return null;
+  const scope = and(
+    eq(schema.sessionEvents.workspaceId, workspaceId),
+    eq(schema.sessionEvents.sessionId, session.id),
+    lte(schema.sessionEvents.sequence, session.lastSequence),
+    isNull(schema.sessionEvents.duplicateOfEventId),
+    or(
+      isNull(schema.sessionEvents.turnAssociation),
+      eq(schema.sessionEvents.turnAssociation, "current"),
+    ),
+  );
+  // Transfer only codec-aware prefixes. Cutting an encoded storage scalar
+  // directly would show base64 rather than the accepted logical error text.
+  const maxChars = 1024;
+  const storageChars = sessionTextStoragePrefixChars(maxChars);
+  const diagnosticFields = ["error", "message", "detail", "lastRetryableError", "code", "status"];
+  const boundedFields = diagnosticFields.flatMap((field) => {
+    const scalar = sql`case when jsonb_typeof(${schema.sessionEvents.payload}->${field}::text) = 'string'
+      then ${schema.sessionEvents.payload}->>${field}::text else null end`;
+    return [
+      sql`${field}::text`,
+      sql`jsonb_build_object(
+      'prefix', left(${scalar}, ${storageChars}), 'chars', char_length(${scalar}),
+      'encoded', ${sessionMcpProgressScalarIsEncodedSql(scalar, schema.sessionEvents.payloadCodecVersion)})`,
+    ];
+  });
+  const projectedPayload = sql<Record<string, unknown>>`jsonb_build_object(
+    ${sql.join(boundedFields, sql`, `)},
+    'providerRecoveryCount', case when jsonb_typeof(${schema.sessionEvents.payload}->'providerRecoveryCount') = 'number'
+      and length((${schema.sessionEvents.payload}->'providerRecoveryCount')::text) <= 16
+      then ${schema.sessionEvents.payload}->'providerRecoveryCount' else 'null'::jsonb end)`;
+  const latest = async (type: string) => {
+    const [row] = await db
+      .select({
+        id: schema.sessionEvents.id,
+        sequence: schema.sessionEvents.sequence,
+        turnId: schema.sessionEvents.turnId,
+        occurredAt: schema.sessionEvents.occurredAt,
+        codecVersion: schema.sessionEvents.payloadCodecVersion,
+        payload: projectedPayload,
+      })
+      .from(schema.sessionEvents)
+      .where(and(scope, eq(schema.sessionEvents.type, type)))
+      .orderBy(desc(schema.sessionEvents.sequence))
+      .limit(1);
+    if (!row) return null;
+    const payload: Record<string, unknown> = {
+      providerRecoveryCount: row.payload.providerRecoveryCount,
+    };
+    const truncatedFields: string[] = [];
+    for (const field of diagnosticFields) {
+      const stored = row.payload[field] as {
+        prefix: string | null;
+        chars: number | null;
+        encoded: boolean;
+      };
+      const projected = projectSessionTextPrefix(
+        stored.prefix,
+        stored.chars,
+        row.codecVersion,
+        stored.encoded,
+        maxChars,
+      );
+      payload[field] = projected.text;
+      if (projected.textTruncated || (projected.originalChars ?? 0) > maxChars)
+        truncatedFields.push(field);
+    }
+    // Six 1024-character logical strings remain below 40KiB even when JSON
+    // escapes every character as six bytes. Stored values remain untouched.
+    payload.projection = { fieldsOnly: true, fieldLimitChars: maxChars, truncatedFields };
+    return { ...row, payload, occurredAt: row.occurredAt.toISOString() };
+  };
+  const turnFailure = await latest("turn.failed");
+  const latestStatus = await latest("session.status.changed");
+  const statusPayload = latestStatus?.payload as Record<string, unknown> | undefined;
+  // Do not associate an earlier failure with a later recorded revival.
+  if (
+    latestStatus &&
+    (!turnFailure || latestStatus.sequence > turnFailure.sequence) &&
+    typeof statusPayload?.status === "string" &&
+    statusPayload.status !== "failed"
+  )
+    return null;
+  const preClaimFailure =
+    statusPayload?.status === "failed" && statusPayload.code === "pre_claim_failure"
+      ? latestStatus
+      : null;
+  const failure =
+    preClaimFailure &&
+    (!turnFailure ||
+      (preClaimFailure.sequence > turnFailure.sequence &&
+        (!preClaimFailure.turnId || preClaimFailure.turnId !== turnFailure.turnId)))
+      ? preClaimFailure
+      : turnFailure;
+  if (!failure) return null;
+  return {
+    eventId: failure.id,
+    sequence: failure.sequence,
+    turnId: failure.turnId ?? null,
+    occurredAt: failure.occurredAt,
+    payload: failure.payload,
+  };
+}
+
 export async function getSessionForSubject(
   db: Database,
   workspaceId: string,
@@ -35203,8 +35430,22 @@ export async function getSessionForSubject(
 ): Promise<Session | null> {
   return await withWorkspaceSubjectRls(db, workspaceId, subjectId, async (scopedDb) => {
     const [row] = await scopedDb
-      .select({ session: schema.sessions, pin: schema.sessionPins })
+      .select({
+        session: schema.sessions,
+        pin: schema.sessionPins,
+        cursor: schema.sessionEventCursors,
+      })
       .from(schema.sessions)
+      // Status and replay cursor must share one statement snapshot. Otherwise a
+      // concurrent revival can pair an old failed row with a new running cursor,
+      // causing the browser to skip the very event that would refresh its status.
+      .leftJoin(
+        schema.sessionEventCursors,
+        and(
+          eq(schema.sessionEventCursors.workspaceId, schema.sessions.workspaceId),
+          eq(schema.sessionEventCursors.sessionId, schema.sessions.id),
+        ),
+      )
       .leftJoin(
         schema.sessionPins,
         and(
@@ -35229,25 +35470,40 @@ export async function getSessionForSubject(
       )
       .limit(1);
     if (!row) return null;
-    const [session] = await canonicalSessionRowsFromEventCursors(scopedDb, workspaceId, [
-      row.session,
-    ]);
+    if (
+      !row.cursor ||
+      row.cursor.accountId !== row.session.accountId ||
+      row.cursor.lastSequence < row.session.lastSequence
+    ) {
+      throw new Error(`Session event cursor invariant failed for session ${sessionId}`);
+    }
+    const [session] = await withLatestStartedSessionPolicy(
+      scopedDb,
+      workspaceId,
+      await withCurrentSessionInputWait(scopedDb, workspaceId, [
+        { ...row.session, lastSequence: row.cursor.lastSequence },
+      ]),
+    );
     if (!session) throw new Error(`Session event cursor missing for session ${sessionId}`);
     const mcpServers = await sessionMcpServerMetadataForSessions(scopedDb, workspaceId, [
       sessionId,
     ]);
     const tenancyActivated = await sessionTenancyProductActivated(scopedDb, workspaceId);
+    const failureDiagnostics = await sessionFailureDiagnostics(scopedDb, workspaceId, session);
     return projectSessionForRelatedAccess(
-      await mapSessionWithControl(
-        scopedDb,
-        session,
-        mcpServers.get(sessionId) ?? [],
-        mapSessionPin(row.pin),
-        mapSessionAttention(session, row.pin),
-        mapSessionArchive(row.pin),
-        undefined,
-        { subjectId, activated: tenancyActivated },
-      ),
+      {
+        ...(await mapSessionWithControl(
+          scopedDb,
+          session,
+          mcpServers.get(sessionId) ?? [],
+          mapSessionPin(row.pin),
+          mapSessionAttention(session, row.pin),
+          mapSessionArchive(row.pin),
+          undefined,
+          { subjectId, activated: tenancyActivated },
+        )),
+        failureDiagnostics,
+      },
       relatedSessionAccess,
     );
   });
@@ -43118,19 +43374,6 @@ function archiveCaptureRemainingMs(
     : null;
 }
 
-function extendSandboxTransitionDeadline(
-  currentDeadline: number,
-  hardDeadline: number,
-  remainingCaptureMs: number | null | undefined,
-  now: number,
-): number {
-  if (remainingCaptureMs === null || remainingCaptureMs === undefined) return currentDeadline;
-  return Math.min(
-    hardDeadline,
-    Math.max(currentDeadline, now + remainingCaptureMs + SANDBOX_LIFECYCLE_RETRY_HANDOFF_GRACE_MS),
-  );
-}
-
 function providerlessLeaseBackendPredicateSql() {
   const providerlessBackends = Object.entries(SANDBOX_PROVIDER_INSTANCE_ID_FIELDS_BY_BACKEND)
     .filter(([, fields]) => fields.length === 0)
@@ -43975,33 +44218,27 @@ export async function acquireLease(
   // NTP/VM resume may change timestamp interpretation, but must never stretch
   // or prematurely consume the caller's resource budget. PostgreSQL projects
   // an active claim's remaining time on its own authoritative clock; that may
-  // extend a positive caller budget after a rolling config change, but never
-  // beyond the same one-hour lifecycle ceiling.
+  // extend a positive caller budget once after a rolling config change. Later
+  // capture retries must not keep renewing a waiter's observational budget.
   const startedAt = performance.now();
-  const hardDeadline = startedAt + SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS;
-  let deadline = Math.min(hardDeadline, startedAt + captureWaitMs);
+  const waitBudget = new SandboxTransitionWaitBudget(captureWaitMs, startedAt);
   let delayMs = 25;
   for (;;) {
     const result = await acquireLeaseOnce(db, input);
     const now = performance.now();
     if (captureWaitMs > 0 && result.role === "fenced" && result.reason === "capture_in_progress") {
-      deadline = extendSandboxTransitionDeadline(
-        deadline,
-        hardDeadline,
-        result.captureRemainingMs,
-        now,
-      );
+      waitBudget.observeCapture(result.captureRemainingMs, now);
     }
     if (
       result.role !== "fenced" ||
       result.reason === "superseded" ||
       result.reason === "rotation_in_progress" ||
-      now >= deadline
+      now >= waitBudget.deadline
     ) {
       return result;
     }
     await waitForSandboxTransition(
-      Math.min(delayMs, Math.max(1, deadline - now)),
+      Math.min(delayMs, Math.max(1, waitBudget.deadline - now)),
       input.waitSignal,
       "Sandbox lease transition wait cancelled",
     );
@@ -50127,8 +50364,7 @@ async function advanceWorkspaceGenerationForAuthority(
     throw new Error("Workspace archive capture wait is invalid");
   }
   const startedAt = performance.now();
-  const hardDeadline = startedAt + SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS;
-  let deadline = Math.min(hardDeadline, startedAt + captureWaitMs);
+  const waitBudget = new SandboxTransitionWaitBudget(captureWaitMs, startedAt);
   let delayMs = 25;
   let captureWaitStartedAt: number | undefined;
   let captureWaitOutcome: "completed" | "failed" = "failed";
@@ -50149,23 +50385,18 @@ async function advanceWorkspaceGenerationForAuthority(
           error instanceof SandboxWorkspaceMutationFencedError &&
           error.code === "capture_in_progress"
         ) {
-          deadline = extendSandboxTransitionDeadline(
-            deadline,
-            hardDeadline,
-            error.captureRemainingMs,
-            now,
-          );
+          waitBudget.observeCapture(error.captureRemainingMs, now);
         }
         if (
           !(error instanceof SandboxWorkspaceMutationFencedError) ||
           error.code !== "capture_in_progress" ||
-          now >= deadline
+          now >= waitBudget.deadline
         ) {
           throw error;
         }
         captureWaitStartedAt ??= performance.now();
         await waitForSandboxTransition(
-          Math.min(delayMs, Math.max(1, deadline - now)),
+          Math.min(delayMs, Math.max(1, waitBudget.deadline - now)),
           waitSignal,
           "Sandbox workspace mutation wait cancelled",
         );
@@ -52239,12 +52470,12 @@ export async function claimWorkspaceArchiveCapture(
     throw new Error("Workspace archive capture timeout is invalid");
   }
   const operationId = input.operationId ?? input.captureId;
-  // captureId owns one DB callback; providerRequestId owns the external
-  // operation. Modal's wire contract explicitly defines snapshotId as an
-  // idempotency key, so every Temporal retry of one logical capture must reuse
-  // it. Other providers still retain the stable lineage for late-result
-  // adoption, but may not replay the physical request before its deadline.
-  const providerRequestId = operationId;
+  // A fresh admission-fenced capture gets a fresh provider request identity.
+  // After a released failure, writers may re-arm this same lease epoch before
+  // the drain workflow retries. Reusing its operationId could then retrieve an
+  // older provider snapshot as the newer workspace generation. Replacements of
+  // an uninterrupted claim retain this stored identity for late-result adoption.
+  const providerRequestId = randomUUID();
   const captureAttempt = input.attempt ?? 1;
   const providerReplaySafe = input.providerReplaySafe === true;
   const takeoverSafe = input.takeoverSafe === true;
@@ -53448,13 +53679,30 @@ export async function adoptLegacyModalCheckpointArtifact(
 }
 
 function publishedWorkspaceArchiveFields(input: {
+  accountId: string;
+  workspaceId: string;
+  sandboxGroupId: string;
+  workspaceArchiveMeta: SandboxArchiveRevision;
   workspaceArchive?: string | null;
   workspaceArchiveRef?: WorkspaceArchiveObjectRef | null;
 }): {
   workspaceArchive?: string;
   workspaceArchiveRef?: WorkspaceArchiveObjectRef;
 } {
-  const ref = parseWorkspaceArchiveObjectRef(input.workspaceArchiveRef) ?? undefined;
+  const ref =
+    input.workspaceArchiveRef == null
+      ? undefined
+      : (validateWorkspaceArchiveObjectRef(input.workspaceArchiveRef, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sandboxGroupId: input.sandboxGroupId,
+          descriptor: input.workspaceArchiveMeta,
+        }) ?? undefined);
+  if (input.workspaceArchiveRef != null && !ref) {
+    throw new Error(
+      "Invalid workspace archive object ref: publication scope or descriptor mismatch",
+    );
+  }
   const inline =
     typeof input.workspaceArchive === "string" && input.workspaceArchive.length > 0
       ? input.workspaceArchive
@@ -53475,6 +53723,30 @@ function publishedWorkspaceArchiveFields(input: {
   return { workspaceArchive: inline };
 }
 
+/** Object-candidate outcome from the publication transaction, independent of
+ * lifecycle `wrote`. Absent for inline/provider receipts and pure CAS checks.
+ * `unused` is NOT a retirement receipt: only the owner of a fresh candidate with
+ * no other publication in flight may use it for immediate cleanup. Exceptions
+ * give no disposition (commit may have happened). Legacy/shared keys and evicted
+ * refs need durable no-reattachment evidence before deletion. */
+export type WorkspaceArchiveCandidateDisposition = "adopted" | "already_referenced" | "unused";
+
+function workspaceArchiveCandidateFields(
+  candidate: WorkspaceArchiveObjectRef | undefined,
+  lockedResumeState: Record<string, unknown> | null | undefined,
+): { candidateDisposition?: WorkspaceArchiveCandidateDisposition } {
+  if (!candidate) return {};
+  const sessionState = lockedResumeState?.sessionState as Record<string, unknown> | undefined;
+  const referenced = [
+    sessionState?.workspaceArchiveRef,
+    sessionState?.workspaceArchivePrevRef,
+  ].some((value) => {
+    const ref = parseWorkspaceArchiveObjectRef(value);
+    return ref?.key === candidate.key && ref.backend === candidate.backend;
+  });
+  return { candidateDisposition: referenced ? "already_referenced" : "unused" };
+}
+
 export async function persistDrainSnapshot(
   db: Database,
   input: {
@@ -53511,12 +53783,14 @@ export async function persistDrainSnapshot(
 ): Promise<{
   wrote: boolean;
   archiveRevision: string | null;
+  candidateDisposition?: WorkspaceArchiveCandidateDisposition;
 }> {
   const workspaceArchiveMeta =
     input.workspaceArchive === null ? null : parseArchiveRevision(input.workspaceArchiveMeta);
   if (input.workspaceArchive !== null && !workspaceArchiveMeta) {
     throw new Error("Invalid verified workspace archive descriptor");
   }
+  const published = input.workspaceArchive === null ? null : publishedWorkspaceArchiveFields(input);
   if (
     workspaceArchiveMeta?.version === 2 &&
     (workspaceArchiveMeta.provider === "modal_snapshot_filesystem" ||
@@ -53575,10 +53849,15 @@ export async function persistDrainSnapshot(
         for update
       `);
       const row = guard[0];
+      const candidateFields = workspaceArchiveCandidateFields(
+        published?.workspaceArchiveRef,
+        row?.resume_state,
+      );
       if (!row) {
         return {
           wrote: false,
           archiveRevision: null,
+          ...candidateFields,
         };
       }
       const sourceLeaseMatches =
@@ -53624,7 +53903,7 @@ export async function persistDrainSnapshot(
         lateReceipt.providerRequestId === input.providerRequestId &&
         !row.unsettled_mutation;
       if (!activePublication && !coldLatePublication) {
-        return { wrote: false, archiveRevision: null };
+        return { wrote: false, archiveRevision: null, ...candidateFields };
       }
       const priorArchive = row.prior_archive ?? null;
       const priorArchivePrev = row.prior_archive_prev ?? null;
@@ -53642,7 +53921,7 @@ export async function persistDrainSnapshot(
           archiveRevision: null,
         };
       }
-      const published = publishedWorkspaceArchiveFields(input);
+      if (!published) throw new Error("Missing workspace archive publication fields");
       const priorMeta = parseArchiveRevision(priorSessionState?.workspaceArchiveMeta);
       if (activePublication && row.archive_capture_published_at !== null) {
         // A predecessor and its successor may receive the same provider result.
@@ -53668,7 +53947,7 @@ export async function persistDrainSnapshot(
               )
           `);
         }
-        return { wrote: true, archiveRevision: priorMeta.revision };
+        return { wrote: true, archiveRevision: priorMeta.revision, ...candidateFields };
       }
       const rotation = rotateWorkspaceArchives({
         resumeState: row.resume_state,
@@ -53729,11 +54008,13 @@ export async function persistDrainSnapshot(
         return {
           wrote: false,
           archiveRevision: null,
+          ...candidateFields,
         };
       }
       return {
         wrote: true,
         archiveRevision: workspaceArchiveMeta?.revision ?? null,
+        ...(published.workspaceArchiveRef ? { candidateDisposition: "adopted" as const } : {}),
       };
     },
   );
@@ -54132,6 +54413,7 @@ export async function persistWarmSnapshot(
   throttled: boolean;
   superseded: boolean;
   archiveRevision: string | null;
+  candidateDisposition?: WorkspaceArchiveCandidateDisposition;
 }> {
   const capturedAtMs = input.capturedAtMs ?? Date.now();
   const workspaceArchiveMeta = parseArchiveRevision(input.workspaceArchiveMeta);
@@ -54201,6 +54483,26 @@ export async function persistWarmSnapshot(
             (attempt.outcome === "completed" ||
               attempt.outcome === "failed" ||
               attempt.outcome === "requires_action"));
+      // Even a replay rejected by the attempt/epoch/capture guards may name
+      // a committed current or previous object. Inspect those slots under the
+      // same lease lock as publication, after the canonical workspace lock.
+      // This conveys no retirement or no-future-reattachment authority.
+      const candidateLease = published.workspaceArchiveRef
+        ? await scopedDb.execute<{ resume_state: Record<string, unknown> | null }>(sql`
+            select jsonb_build_object('sessionState', jsonb_build_object(
+              'workspaceArchiveRef', resume_state #> '{sessionState,workspaceArchiveRef}',
+              'workspaceArchivePrevRef', resume_state #> '{sessionState,workspaceArchivePrevRef}'
+            )) as resume_state
+            from sandbox_leases
+            where workspace_id = ${input.workspaceId}
+              and sandbox_group_id = ${input.sandboxGroupId}
+            for update
+          `)
+        : [];
+      const candidateFields = workspaceArchiveCandidateFields(
+        published.workspaceArchiveRef,
+        candidateLease[0]?.resume_state,
+      );
       if (
         !attempt ||
         attempt.accountId !== input.accountId ||
@@ -54213,6 +54515,7 @@ export async function persistWarmSnapshot(
           throttled: false,
           superseded: true,
           archiveRevision: null,
+          ...candidateFields,
         };
       }
       const guard = await scopedDb.execute<{
@@ -54270,6 +54573,7 @@ export async function persistWarmSnapshot(
           throttled: false,
           superseded: false,
           archiveRevision: null,
+          ...candidateFields,
         };
       }
       const priorArchive = guard[0]!.prior_archive ?? null;
@@ -54290,6 +54594,7 @@ export async function persistWarmSnapshot(
           throttled: false,
           superseded: true,
           archiveRevision: null,
+          ...candidateFields,
         };
       }
       if (
@@ -54302,6 +54607,7 @@ export async function persistWarmSnapshot(
           throttled: true,
           superseded: false,
           archiveRevision: null,
+          ...candidateFields,
         };
       }
       const rotation = rotateWorkspaceArchives({
@@ -54323,6 +54629,7 @@ export async function persistWarmSnapshot(
           throttled: false,
           superseded: false,
           archiveRevision: null,
+          ...candidateFields,
         };
       }
       const livenessGuard: "warm" | "draining" = rowLiveness;
@@ -54355,6 +54662,7 @@ export async function persistWarmSnapshot(
           throttled: false,
           superseded: false,
           archiveRevision: null,
+          ...candidateFields,
         };
       }
       return {
@@ -54362,6 +54670,7 @@ export async function persistWarmSnapshot(
         throttled: false,
         superseded: false,
         archiveRevision: workspaceArchiveMeta.revision,
+        ...(published.workspaceArchiveRef ? { candidateDisposition: "adopted" as const } : {}),
       };
     },
   );
@@ -64024,6 +64333,7 @@ export async function claimSessionWorkForAttempt(
       stage: "session_attempts.claim",
       eventTypes: ["session.turn.attempt_claimed"],
       maxAttempts: 3,
+      organizationMembershipFence: true,
     },
     async (scopedDb) =>
       await withSessionActivitySavepoint(scopedDb, async (tx) => {