@opengeni/worker-bundle 1.0.0-canary.0 → 1.0.0

package/src/activities/scheduled-tasks.ts

@@ -1,3 +1,8 @@
+import { getScheduledTaskClaudeProviderAccountAuthoritySnapshot } from "@opengeni/db";
+import {
+  ATLASSIAN_NATIVE_RETIRED_REASON,
+  isRetiredNativeAtlassianTask,
+} from "@opengeni/contracts/atlassian-native-retirement";
 import {
   AUTOMATIC_SESSION_TITLE_FALLBACK,
   DEFAULT_FIRST_PARTY_MCP_PERMISSIONS,
@@ -10,28 +15,46 @@ import {
   SessionAgentAccess,
   SessionMemoryScope,
   normalizeAutomaticSessionTitle,
+  metadataWithTurnExecutionPolicyV1,
+  mergeResourceRefs,
   scheduledOccurrencePayloadUtf8Bytes,
   stableJson,
   TurnExecutionPolicyV1,
   type ScheduledTask,
   type ScheduledTaskRun,
+  type ResolvedAgentConfig,
 } from "@opengeni/contracts";
 import {
-  defaultSessionMcpServerIds,
   openGeniSlackBotMetadata,
   requireOpenGeniSlackBotConnection,
+  withScheduledSlackBotPostingTools,
   resolveWorkspaceCatalogSettings,
+  resolveScheduledTaskDefaultModel,
   resolveSessionToolPolicy,
   workspaceCustomModelReference,
   lockActiveCustomModelForAdmission,
   scheduledSlackBotConnectionId,
+  freezeConnectionAccounts,
+  ConnectionAccountSelectionError,
+  scheduledConnectionSurfaceEligibility,
+  scheduledConnectionTools,
+  settingsWithEnabledCapabilityMcpServers,
+  settingsWithSessionMcpServerMetadata,
   swapActiveSandbox,
+  applySessionAgentConfigWriteThrough,
+  resolveSessionAgentConfigForCreate,
+  recordSessionCreated,
+  recordUserMessageAccepted,
+  type ProductUsageMetricsSink,
 } from "@opengeni/core";
 import {
   appendSessionEvents,
   addSessionSystemUpdateWithSourceMutation,
   bindScheduledTaskRunSessionInTransaction,
   createScheduledTaskRun,
+  recordScheduledTaskAdmissionFailure,
+  recordScheduledTaskAdmissionRefusal,
+  type ScheduledTaskAdmissionRefusalReason,
   createSession,
   createSessionWithIdempotencyKeyResult,
   enqueueSessionWorkflowWakeIfRunnable,
@@ -41,7 +64,6 @@ import {
   getScheduledTaskRunAcceptedExecution,
   getScheduledTaskRunByProducerKey,
   getScheduledTargetSessionExecution,
-  getScheduledTaskPersonalConnectionDelegations,
   getScheduledTaskRunPersonalResourceAuthority,
   getScheduledTaskPersonalResourceAuthoritySubject,
   getScheduledTaskRevisionAuthority,
@@ -53,11 +75,11 @@ import {
   getNestedAgentDepthDeploymentPolicy,
   getSessionByCreateIdempotencyKey,
   getSessionCreationExecutionPolicy,
+  metadataWithAgentConfigCreateIdentity,
   getVariableSet,
   isCodexBilledModel,
   initializeSessionStartAtomically,
   materializeScheduledTaskReusableSessionFromRun,
-  listEnabledMcpCapabilityServerIds,
   listInstalledApiIntegrationServerIdsForDelegations,
   markScheduledTaskRunFailedIfQueued,
   markScheduledTaskRunSkippedIfQueued,
@@ -112,6 +134,30 @@ type ScheduledTemporalActivityIdentity = {
   activityId: string;
 };
 
+export function scheduledTaskRunExecutionPolicy(
+  policy: TurnExecutionPolicyV1,
+  input: DispatchScheduledTaskRunInput,
+  creatorRestriction?: "developer_setup",
+): TurnExecutionPolicyV1 {
+  return creatorRestriction === "developer_setup" ||
+    (input.triggerType !== "scheduled" && input.credentialRestriction === "developer_setup")
+    ? { ...policy, credentialRestriction: "developer_setup" }
+    : policy;
+}
+
+/** Only a creator ceiling is standing; a manual caller ceiling is per-run. */
+export function scheduledSessionExecutionPolicyMetadata(
+  policy: unknown,
+  creatorRestriction?: "developer_setup",
+): Record<string, unknown> {
+  if (policy === undefined || policy === null) return {};
+  const acceptedPolicy = TurnExecutionPolicyV1.parse(policy);
+  return creatorRestriction === "developer_setup" &&
+    acceptedPolicy.credentialRestriction === "developer_setup"
+    ? metadataWithTurnExecutionPolicyV1({}, acceptedPolicy)
+    : {};
+}
+
 export function scheduledTaskRunProducerKey(
   input: DispatchScheduledTaskRunInput,
   suppliedActivityIdentity?: ScheduledTemporalActivityIdentity,
@@ -181,6 +227,15 @@ export function scheduledTaskGeneratedSessionCreateIdempotencyKey(producerKey: s
  * alone, with no Intl call and so no host ICU or tzdata build to make the two
  * texts differ.
  */
+/** A scheduler-generated run session: a service-created root session. */
+function recordScheduledSessionCreated(observability: ProductUsageMetricsSink | undefined): void {
+  recordSessionCreated(observability, {
+    surface: "scheduled",
+    createdByKind: "service",
+    parentSessionId: null,
+  });
+}
+
 export function scheduledTaskSessionTitle(taskName: string): string {
   return normalizeAutomaticSessionTitle(taskName) ?? "Scheduled run";
 }
@@ -280,6 +335,9 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
         producerKey: stableProducerKey,
       });
       if (priorRun?.actionKind === "agent_turn") {
+        if (priorRun.admissionDiagnostic || priorRun.admissionRefusal) {
+          return scheduledAdmissionRefusalResult(priorRun);
+        }
         const acceptedExecution = await getScheduledTaskRunAcceptedExecution(db, {
           workspaceId: input.workspaceId,
           runId: priorRun.id,
@@ -294,6 +352,15 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
           }
           throw new Error("scheduled agent run is missing accepted execution truth");
         }
+        if (priorRun.status === "queued" && isRetiredNativeAtlassianTask(acceptedExecution.task)) {
+          await markScheduledTaskRunFailedIfQueued(
+            db,
+            priorRun.workspaceId,
+            priorRun.id,
+            ATLASSIAN_NATIVE_RETIRED_REASON,
+          );
+          return scheduledRunTerminalResult(ATLASSIAN_NATIVE_RETIRED_REASON);
+        }
         await recordScheduledTaskFiredUsage(db, acceptedExecution, priorRun);
         if (priorRun.status === "dispatched") {
           return await replayScheduledTaskDispatch({
@@ -317,6 +384,7 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
           try {
             return await recoverBoundScheduledTaskDispatch({
               db,
+              observability: baseService.observability,
               bus,
               settings,
               wakeSessionWorkflow,
@@ -361,6 +429,8 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
       if (!task) {
         return { action: "deleted" };
       }
+      if (isRetiredNativeAtlassianTask(task))
+        return { action: "blocked", reason: ATLASSIAN_NATIVE_RETIRED_REASON };
       if (task.action.kind !== "agent_turn") {
         return { action: "blocked", reason: "legacy_source_schedule_requires_migration" };
       }
@@ -391,20 +461,6 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
       if (incidentDeclaration.action === "blocked") {
         return incidentDeclaration;
       }
-      const taskPersonalConnectionDelegations = await getScheduledTaskPersonalConnectionDelegations(
-        db,
-        task.workspaceId,
-        task.id,
-      );
-      const taskConnectionAuthoritySubjects = [
-        ...new Set(
-          taskPersonalConnectionDelegations.map((delegation) => delegation.ownerSubjectId),
-        ),
-      ];
-      if (taskConnectionAuthoritySubjects.length > 1) {
-        throw new Error("scheduled connection authority has multiple causal humans");
-      }
-      const taskConnectionAuthoritySubjectId = taskConnectionAuthoritySubjects[0] ?? null;
       const taskPersonalResourceAuthoritySubjectId =
         await getScheduledTaskPersonalResourceAuthoritySubject(db, {
           accountId: task.accountId,
@@ -418,17 +474,52 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
         taskId: task.id,
         taskAuthorityRevision: task.authorityRevision,
       });
+      const taskAuthoritySubjectId = task.ownerSubjectId;
+      // Every pre-admission refusal below is recorded as a visible run receipt
+      // under this producer identity instead of throwing (a thrown activity is
+      // retried to exhaustion and leaves no run) or returning a bare blocked
+      // result (the occurrence silently disappears). Terminal refusals are
+      // deterministic for this task revision and digest; transient ones
+      // (`retryable`) are skipped and a later occurrence is admitted normally.
+      // Redelivery replays the same receipt, so no occurrence gets two runs.
+      const refuseAdmission = async (
+        reason: ScheduledTaskAdmissionRefusalReason,
+        retryable: boolean,
+        detail: string,
+      ): Promise<DispatchScheduledTaskRunResult> => {
+        console.warn(
+          `[scheduled-task] refused occurrence of ${task.id} (revision ${task.authorityRevision}): ${reason}: ${detail}`,
+        );
+        const receipt = await recordScheduledTaskAdmissionRefusal(db, {
+          workspaceId: task.workspaceId,
+          taskId: task.id,
+          taskAuthorityRevision: task.authorityRevision,
+          taskExecutionDigest: task.executionDigest,
+          triggerType: input.triggerType,
+          producerKey: stableProducerKey,
+          reason,
+          retryable,
+        });
+        if (!receipt.admissionRefusal) {
+          // A concurrent delivery accepted this producer first. Follow the
+          // existing exact-receipt recovery path, never replace its outcome.
+          return createScheduledTaskActivities(services).dispatchScheduledTaskRun(input);
+        }
+        return scheduledAdmissionRefusalResult(receipt);
+      };
       if (
-        taskConnectionAuthoritySubjectId &&
-        taskPersonalResourceAuthoritySubjectId &&
-        taskConnectionAuthoritySubjectId !== taskPersonalResourceAuthoritySubjectId
+        task.action.kind === "agent_turn" &&
+        ((taskRevisionAuthority?.subjectId ?? null) !== taskAuthoritySubjectId ||
+          [taskPersonalResourceAuthoritySubjectId].some(
+            (subject) => subject !== null && subject !== taskAuthoritySubjectId,
+          ))
       ) {
-        throw new Error("scheduled authority classes have different causal humans");
+        return await refuseAdmission(
+          "scheduled_authority_unavailable",
+          false,
+          "scheduled authority differs from its immutable execution owner",
+        );
       }
-      const taskAuthoritySubjectId =
-        taskRevisionAuthority?.subjectId ??
-        taskPersonalResourceAuthoritySubjectId ??
-        taskConnectionAuthoritySubjectId;
       const acceptedTargetSessionId =
         task.runMode === "existing_session"
           ? task.targetSessionId
@@ -450,29 +541,157 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
           )
         : null;
       const settings = await settingsForTask(task, targetSessionExecutionBase?.model);
-      const model = task.agentConfig.model ?? settings.openaiModel;
-      const reasoningEffort = task.agentConfig.reasoningEffort ?? settings.openaiReasoningEffort;
+      // A task that names no model resolves the new-chat default at each fresh
+      // occurrence (saved workspace default, then a usable connected
+      // subscription under the task's frozen SuperGrok authority, then the
+      // credits default while the organization holds a credit balance, then the
+      // deployment default). A frozen SuperGrok pool that is gone only means
+      // SuperGrok is not ready. The accepted execution freezes the result, so
+      // retries and recovery never resolve again. Existing-session runs keep
+      // that session's model.
+      const resolvedDefault =
+        task.agentConfig.model || targetSessionExecutionBase
+          ? null
+          : await resolveScheduledTaskDefaultModel(db, settings, task);
+      const model = task.agentConfig.model ?? resolvedDefault?.model ?? settings.openaiModel;
+      const reasoningEffort =
+        task.agentConfig.reasoningEffort ??
+        resolvedDefault?.reasoningEffort ??
+        settings.openaiReasoningEffort;
       let sandboxBackend = task.agentConfig.sandboxBackend ?? settings.sandboxBackend;
       let sandboxOs: "linux" | "macos" | "windows" = "linux";
-      const taskTools = withFirstPartyTools(settings, task.agentConfig.tools);
+      let taskTools = withFirstPartyTools(settings, task.agentConfig.tools);
       // A task created by a live agent attempt froze its creator's effective
       // first-party selection, permission set, and session access policy;
       // its generated sessions inherit that boundary under today's
       // deployment ceiling. A human/API-created task (null policy) keeps the
       // deployment default exactly as before.
       const creatorPolicy = await getScheduledTaskCreatorPolicy(db, task.workspaceId, task.id);
-      const firstPartyMcpTools = creatorPolicy?.firstPartyMcpTools
-        ? allowedFirstPartyMcpToolsForSession(settings, creatorPolicy.firstPartyMcpTools)
-        : resolveFirstPartyMcpToolPolicy(settings).default;
+      // A person-chosen Slack channel adds only the two bot posting tools;
+      // they post nowhere else, whatever the creator's own selection was.
+      let firstPartyMcpTools = withScheduledSlackBotPostingTools(
+        creatorPolicy?.firstPartyMcpTools
+          ? allowedFirstPartyMcpToolsForSession(settings, creatorPolicy.firstPartyMcpTools)
+          : resolveFirstPartyMcpToolPolicy(settings).default,
+        task.agentConfig,
+        resolveFirstPartyMcpToolPolicy(settings).allowed,
+      );
+      // Agent configuration for generated sessions (null = legacy). The
+      // scheduled baseline above (creator policy or deployment default) is
+      // what "all" reproduces; capabilities only narrow it. Frozen into the
+      // accepted execution so retries and recovery never resolve again.
+      let resolvedAgentConfig: ResolvedAgentConfig | null = null;
+      let resolvedAgentInstructions: string | undefined;
+      const generatedTarget =
+        task.runMode === "new_session_per_run" ||
+        (task.runMode === "reusable_session" && task.reusableSessionId === null);
+      if (generatedTarget) {
+        try {
+          const agentResolution = resolveSessionAgentConfigForCreate({
+            settings,
+            creator: "scheduled",
+            request: task.agentConfig.agent,
+            instructions: undefined,
+            workspaceSettings: (await requireWorkspace(db, task.workspaceId)).settings,
+            parent: null,
+            goal: task.agentConfig.goal !== undefined,
+          });
+          resolvedAgentConfig = agentResolution.config;
+          resolvedAgentInstructions = agentResolution.instructions;
+          const written = applySessionAgentConfigWriteThrough({
+            config: resolvedAgentConfig,
+            firstPartyMcpTools,
+            tools: taskTools,
+            toolPolicy: { mode: "explicit", inheritedFromSessionId: null },
+            productServerIds: task.agentConfig.tools.map((tool) => tool.id),
+          });
+          firstPartyMcpTools = written.firstPartyMcpTools;
+          taskTools = written.tools;
+        } catch (error) {
+          const status =
+            error instanceof Error ? (error as Error & { status?: unknown }).status : undefined;
+          if (!(error instanceof Error) || status !== 422) throw error;
+          return await refuseAdmission(
+            "scheduled_authority_unavailable",
+            false,
+            `scheduled agent configuration is not admissible: ${error.message}`,
+          );
+        }
+      }
       const firstPartyMcpPermissions = creatorPolicy?.firstPartyMcpPermissions
         ? [...creatorPolicy.firstPartyMcpPermissions]
         : [...DEFAULT_FIRST_PARTY_MCP_PERMISSIONS];
+      // A fresh occurrence resolves the immutable owner's current accounts.
+      // Retry/recovery above uses the already accepted occurrence snapshot.
+      const connectionSettings = await settingsWithEnabledCapabilityMcpServers(
+        db,
+        task.workspaceId,
+        settings,
+        taskAuthoritySubjectId ? { subjectId: taskAuthoritySubjectId } : {},
+      );
+      const connectionTarget =
+        acceptedTargetSessionId && targetSessionExecutionBase
+          ? await requireSession(db, task.workspaceId, acceptedTargetSessionId)
+          : null;
+      const connectionTools = await scheduledConnectionTools(
+        db,
+        task.workspaceId,
+        connectionSettings,
+        connectionTarget,
+        taskTools,
+        taskAuthoritySubjectId ?? undefined,
+      );
+      const taskConnections = await freezeConnectionAccounts({
+        db,
+        accountId: task.accountId,
+        workspaceId: task.workspaceId,
+        settings: connectionTarget
+          ? settingsWithSessionMcpServerMetadata(connectionSettings, connectionTarget.mcpServers)
+          : connectionSettings,
+        tools: connectionTools,
+        resources: mergeResourceRefs(connectionTarget?.resources ?? [], task.agentConfig.resources),
+        source: taskAuthoritySubjectId
+          ? { kind: "subject", subjectId: taskAuthoritySubjectId, accountId: task.accountId }
+          : { kind: "none" },
+        authoritySelections: task.agentConfig.connectionAccounts ?? [],
+        authoritySelectionsFrozen: task.agentConfig.connectionAccountsFrozen === true,
+        ...scheduledConnectionSurfaceEligibility(
+          settings,
+          connectionTarget ?? {
+            firstPartyMcpTools,
+            firstPartyMcpPermissions,
+          },
+        ),
+      }).catch((error: unknown) => {
+        if (error instanceof ConnectionAccountSelectionError) return error;
+        throw error;
+      });
+      if (taskConnections instanceof ConnectionAccountSelectionError) {
+        const receipt = await recordScheduledTaskAdmissionFailure(db, {
+          workspaceId: task.workspaceId,
+          taskId: task.id,
+          taskAuthorityRevision: task.authorityRevision,
+          taskExecutionDigest: task.executionDigest,
+          triggerType: input.triggerType,
+          producerKey: stableProducerKey,
+          diagnostic: taskConnections.diagnostic,
+        });
+        if (!receipt.admissionDiagnostic) {
+          // A concurrent delivery accepted this producer first. Follow the
+          // existing exact-receipt recovery path, never replace its outcome.
+          return createScheduledTaskActivities(services).dispatchScheduledTaskRun(input);
+        }
+        return scheduledAdmissionRefusalResult(receipt);
+      }
+      const {
+        personalConnectionDelegations: taskPersonalConnectionDelegations,
+        mcpAccountBindings: taskMcpAccountBindings,
+      } = taskConnections;
+      const taskConnectionAuthoritySubjectId =
+        taskPersonalConnectionDelegations.length > 0 ? taskAuthoritySubjectId : null;
       const creatorSessionPolicy = scheduledCreatorSessionPolicyInput(
         creatorPolicy?.sessionPolicy ?? null,
       );
-      const generatedTarget =
-        task.runMode === "new_session_per_run" ||
-        (task.runMode === "reusable_session" && task.reusableSessionId === null);
       if (generatedTarget && task.agentConfig.machineTarget) {
         const access = {
           accountId: task.accountId,
@@ -490,16 +709,37 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
           !machine.enrollmentId ||
           machine.scope === "user"
         ) {
-          throw new Error("scheduled Connected Machine target is unavailable");
+          return await refuseAdmission(
+            "machine_target_unavailable",
+            false,
+            "scheduled Connected Machine target is unavailable",
+          );
         }
         const enrollment = await getEnrollment(db, access, machine.enrollmentId);
-        if (!enrollment || enrollment.status !== "active") {
-          throw new Error("scheduled Connected Machine enrollment is unavailable");
+        if (!enrollment) {
+          return await refuseAdmission(
+            "machine_target_unavailable",
+            false,
+            "scheduled Connected Machine enrollment is gone",
+          );
+        }
+        if (enrollment.status !== "active") {
+          // A paused/suspended enrollment can be re-activated; skip this
+          // occurrence rather than failing the schedule.
+          return await refuseAdmission(
+            "machine_enrollment_inactive",
+            true,
+            `scheduled Connected Machine enrollment is ${enrollment.status}`,
+          );
         }
         sandboxBackend = "selfhosted";
         sandboxOs = enrollment.os;
       } else if (generatedTarget && sandboxBackend === "selfhosted") {
-        throw new Error("self-hosted scheduled task has no Connected Machine target");
+        return await refuseAdmission(
+          "machine_target_unavailable",
+          false,
+          "self-hosted scheduled task has no Connected Machine target",
+        );
       }
       const generatedSessionDepthPolicy = generatedTarget
         ? await (async () => {
@@ -537,20 +777,16 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
         : null;
       const targetSessionExecution = targetSessionExecutionBase
         ? await (async () => {
-            const [capabilityServerIds, apiIntegrationServerIds] = await Promise.all([
-              listEnabledMcpCapabilityServerIds(db, task.workspaceId),
-              listInstalledApiIntegrationServerIdsForDelegations(
+            const apiIntegrationServerIds =
+              await listInstalledApiIntegrationServerIdsForDelegations(
                 db,
                 task.workspaceId,
                 taskPersonalConnectionDelegations,
-              ),
+              );
+            const availableMcpServerIds = new Set([
+              ...connectionSettings.mcpServers.map((server) => server.id),
+              ...apiIntegrationServerIds,
             ]);
-            const workspaceDefaultMcpServerIds = new Set(
-              settings.mcpServers.map((server) => server.id),
-            );
-            for (const id of capabilityServerIds) workspaceDefaultMcpServerIds.add(id);
-            for (const id of apiIntegrationServerIds) workspaceDefaultMcpServerIds.add(id);
-            const availableMcpServerIds = new Set(workspaceDefaultMcpServerIds);
             for (const id of targetSessionExecutionBase.mcpServerIds) {
               availableMcpServerIds.add(id);
             }
@@ -558,9 +794,10 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
               toolPolicy: targetSessionExecutionBase.toolPolicy,
               sessionTools: targetSessionExecutionBase.tools,
               availableMcpServerIds,
-              defaultMcpServerIds: defaultSessionMcpServerIds(
-                [...workspaceDefaultMcpServerIds].map((id) => ({ id })),
-              ),
+              defaultMcpServerIds: [
+                ...connectionTools.map((tool) => tool.id),
+                ...apiIntegrationServerIds,
+              ],
             });
             return {
               ...targetSessionExecutionBase,
@@ -589,7 +826,11 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
             )
           : null;
       if (generatedTarget && task.variableSetId && !acceptedVariableSet) {
-        throw new Error(`variable set not found: ${task.variableSetId}`);
+        return await refuseAdmission(
+          "variable_set_unavailable",
+          false,
+          `variable set not found: ${task.variableSetId}`,
+        );
       }
       const acceptedRig =
         generatedTarget && task.rigId
@@ -604,12 +845,17 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
             )
           : null;
       if (generatedTarget && task.rigId && (!acceptedRig || !acceptedRig.activeVersion)) {
-        throw new Error(`rig has no active version to bind: ${task.rigId}`);
+        return await refuseAdmission(
+          "rig_version_unavailable",
+          false,
+          `sandbox environment has no active version to bind: ${task.rigId}`,
+        );
       }
-      const acceptedRigDefaultVariableSets = acceptedRig?.activeVersion
+      const acceptedRigDefaultVariableSetRows = acceptedRig?.activeVersion
         ? await Promise.all(
-            acceptedRig.activeVersion.defaultVariableSetIds.map(async (variableSetId) => {
-              const variableSet = await getVariableSet(
+            acceptedRig.activeVersion.defaultVariableSetIds.map(async (variableSetId) => ({
+              variableSetId,
+              variableSet: await getVariableSet(
                 db,
                 {
                   accountId: task.accountId,
@@ -617,14 +863,23 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                   subjectId: taskAuthoritySubjectId ?? task.createdBy.subjectId,
                 },
                 variableSetId,
-              );
-              if (!variableSet) {
-                throw new Error(`rig default Variable Set not found: ${variableSetId}`);
-              }
-              return { id: variableSet.id, generation: variableSet.generation };
-            }),
+              ),
+            })),
           )
         : [];
+      const missingRigDefaultVariableSet = acceptedRigDefaultVariableSetRows.find(
+        (row) => !row.variableSet,
+      );
+      if (missingRigDefaultVariableSet) {
+        return await refuseAdmission(
+          "variable_set_unavailable",
+          false,
+          `sandbox environment default Variable Set not found: ${missingRigDefaultVariableSet.variableSetId}`,
+        );
+      }
+      const acceptedRigDefaultVariableSets = acceptedRigDefaultVariableSetRows.map(
+        ({ variableSet }) => ({ id: variableSet!.id, generation: variableSet!.generation }),
+      );
       let incidentPreflightRequired = incidentDeclaration.action === "required";
       if (incidentPreflightRequired) {
         const existingSessionId =
@@ -688,6 +943,8 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
       }
       const taskXaiProviderAccountAuthoritySnapshot =
         await getScheduledTaskXaiProviderAccountAuthoritySnapshot(db, task.workspaceId, task.id);
+      const taskClaudeProviderAccountAuthoritySnapshot =
+        await getScheduledTaskClaudeProviderAccountAuthoritySnapshot(db, task.workspaceId, task.id);
       // A scheduled bot selection was authorized when the task was written,
       // but connection status and tenant/role binding are mutable. Revalidate
       // before any session/model cost and never fall back to a personal Slack
@@ -703,7 +960,7 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
         ? openGeniSlackBotMetadata(slackBotConnection.metadata)
         : null;
       if (slackBotConnection && !slackBotMetadata) {
-        throw new Error("OpenGeni Slack bot connection metadata is invalid");
+        throw new Error("Opengeni Slack bot connection metadata is invalid");
       }
       const xaiAuthoritySubjectId =
         taskXaiProviderAccountAuthoritySnapshot.scope === "user" &&
@@ -711,21 +968,67 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
           ? task.createdBy.subjectId
           : null;
       if (taskXaiProviderAccountAuthoritySnapshot.scope === "user" && !xaiAuthoritySubjectId) {
-        throw new Error("scheduled user-scoped xAI authority has no causal human");
+        return await refuseAdmission(
+          "scheduled_authority_unavailable",
+          false,
+          "scheduled user-scoped xAI authority has no causal human",
+        );
       }
       if (
         xaiAuthoritySubjectId &&
         taskAuthoritySubjectId &&
         xaiAuthoritySubjectId !== taskAuthoritySubjectId
       ) {
-        throw new Error("scheduled authority classes have different causal humans");
+        return await refuseAdmission(
+          "scheduled_authority_unavailable",
+          false,
+          "scheduled authority classes have different causal humans",
+        );
       }
-      const causalHumanSubjectId = taskAuthoritySubjectId ?? xaiAuthoritySubjectId;
+      const claudeAuthoritySubjectId =
+        taskClaudeProviderAccountAuthoritySnapshot.scope === "user" && task.ownerSubjectId
+          ? task.ownerSubjectId
+          : null;
+      if (
+        taskClaudeProviderAccountAuthoritySnapshot.scope === "user" &&
+        !claudeAuthoritySubjectId
+      ) {
+        return await refuseAdmission(
+          "scheduled_authority_unavailable",
+          false,
+          "scheduled user-scoped Claude authority has no causal human",
+        );
+      }
+      if (
+        claudeAuthoritySubjectId &&
+        taskAuthoritySubjectId &&
+        claudeAuthoritySubjectId !== taskAuthoritySubjectId
+      ) {
+        return await refuseAdmission(
+          "scheduled_authority_unavailable",
+          false,
+          "scheduled authority classes have different causal humans",
+        );
+      }
+      const causalHumanSubjectId =
+        taskAuthoritySubjectId ?? xaiAuthoritySubjectId ?? claudeAuthoritySubjectId;
+      if (
+        xaiAuthoritySubjectId &&
+        claudeAuthoritySubjectId &&
+        xaiAuthoritySubjectId !== claudeAuthoritySubjectId
+      )
+        return await refuseAdmission(
+          "scheduled_authority_unavailable",
+          false,
+          "scheduled subscription pools have different causal humans",
+        );
       if (
         task.agentConfig.knowledgeSource &&
         causalHumanSubjectId !== task.agentConfig.knowledgeSource.initiatingSubjectId
       ) {
-        throw new Error(
+        return await refuseAdmission(
+          "scheduled_authority_unavailable",
+          false,
           "Source schedule requires its connection owner's current human authorization; update the source schedule to authorize it",
         );
       }
@@ -737,7 +1040,11 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
         (acceptedVariableSet?.scope === "user" || acceptedRig?.scope === "user") &&
         !causalHumanSubjectId
       ) {
-        throw new Error("scheduled personal-resource execution has no causal human");
+        return await refuseAdmission(
+          "scheduled_authority_unavailable",
+          false,
+          "scheduled personal-resource execution has no causal human",
+        );
       }
       const admissionDenial = await agentRunAdmissionDenial(
         { ...baseService, settings },
@@ -746,10 +1053,13 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
           workspaceId: task.workspaceId,
           model: targetSessionExecution?.model ?? model,
           requestedAgentRuns: input.agentRunUsageIdempotencyKey ? 0 : 1,
+          initiatingHumanSubjectId: causalHumanSubjectId,
         },
       );
       if (admissionDenial) {
-        return { action: "blocked", reason: admissionDenial };
+        // Credits and monthly limits clear on their own (top-up, new period):
+        // skip this occurrence visibly; a later one is admitted normally.
+        return await refuseAdmission(admissionDenial, true, "agent run admission denied");
       }
       const acceptedModel = targetSessionExecution?.model ?? model;
       const acceptedReasoningEffort = targetSessionExecution?.reasoningEffort ?? reasoningEffort;
@@ -772,23 +1082,28 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
             }
           }
         : undefined;
-      const turnExecutionPolicy: TurnExecutionPolicyV1 = resolveTurnExecutionPolicyV1(settings, {
-        modelId: acceptedModel,
-        requestedModelId: generatedTarget && task.agentConfig.model ? task.agentConfig.model : null,
-        modelSource: generatedTarget
-          ? task.agentConfig.model
-            ? "explicit"
-            : "deployment"
-          : "session",
-        reasoningEffort: acceptedReasoningEffort,
-        reasoningSource: generatedTarget
-          ? task.agentConfig.reasoningEffort
-            ? "explicit"
-            : "deployment"
-          : "session",
-        latencyMode: acceptedLatencyMode,
-        latencyModeSource: generatedTarget ? "deployment" : "session",
-      });
+      const turnExecutionPolicy = scheduledTaskRunExecutionPolicy(
+        resolveTurnExecutionPolicyV1(settings, {
+          modelId: acceptedModel,
+          requestedModelId:
+            generatedTarget && task.agentConfig.model ? task.agentConfig.model : null,
+          modelSource: generatedTarget
+            ? task.agentConfig.model
+              ? "explicit"
+              : "deployment"
+            : "session",
+          reasoningEffort: acceptedReasoningEffort,
+          reasoningSource: generatedTarget
+            ? task.agentConfig.reasoningEffort
+              ? "explicit"
+              : "deployment"
+            : "session",
+          latencyMode: acceptedLatencyMode,
+          latencyModeSource: generatedTarget ? "deployment" : "session",
+        }),
+        input,
+        creatorPolicy?.credentialRestriction,
+      );
       const deferredEvents: Array<{
         sessionId: string;
         events: Awaited<ReturnType<typeof appendSessionEvents>>;
@@ -821,6 +1136,12 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
           resolvedTools: taskTools,
           resolvedFirstPartyMcpTools: firstPartyMcpTools,
           resolvedFirstPartyMcpPermissions: firstPartyMcpPermissions,
+          ...(resolvedAgentConfig
+            ? {
+                resolvedAgentConfig,
+                ...(resolvedAgentInstructions !== undefined ? { resolvedAgentInstructions } : {}),
+              }
+            : {}),
           resolvedVariableSet: acceptedVariableSet
             ? { id: acceptedVariableSet.id, generation: acceptedVariableSet.generation }
             : null,
@@ -843,11 +1164,14 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
           targetSessionExecution,
           generatedSessionBinding,
           personalConnectionDelegations: taskPersonalConnectionDelegations,
+          mcpAccountBindings: taskMcpAccountBindings,
           personalResourceAuthoritySubjectId: taskPersonalResourceAuthoritySubjectId,
           causalHumanSubjectId,
           causalHumanAuthority: taskRevisionAuthority,
           xaiProviderAccountAuthoritySnapshot: taskXaiProviderAccountAuthoritySnapshot,
+          claudeProviderAccountAuthoritySnapshot: taskClaudeProviderAccountAuthoritySnapshot,
           xaiAuthoritySubjectId,
+          claudeAuthoritySubjectId,
           connectionAuthoritySubjectId: taskConnectionAuthoritySubjectId,
           triggerInitiator: input.initiator ?? { kind: "service", subjectId: "scheduler" },
           agentRunUsageIdempotencyKey: input.agentRunUsageIdempotencyKey ?? null,
@@ -966,16 +1290,7 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                 taskId: task.id,
               },
             );
-            if (
-              stableJson({
-                task: exactAuthority.task,
-                personalConnectionDelegations: exactAuthority.personalConnectionDelegations,
-              }) !==
-              stableJson({
-                task,
-                personalConnectionDelegations: taskPersonalConnectionDelegations,
-              })
-            ) {
+            if (stableJson(exactAuthority) !== stableJson(task)) {
               throw new IncidentTelemetryPreflightBlockedError(
                 "incident_preflight_metadata_missing",
               );
@@ -1009,7 +1324,7 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
             if (task.rigId) {
               const rig = acceptedRig;
               if (!rig || !rig.activeVersion) {
-                throw new Error(`rig has no active version to bind: ${task.rigId}`);
+                throw new Error(`sandbox environment has no active version to bind: ${task.rigId}`);
               }
               frozenRigId = rig.id;
               frozenRigVersionId =
@@ -1017,7 +1332,9 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                   (resource) => resource.resourceKind === "rig" && resource.resourceId === rig.id,
                 )?.resourceVersionId ?? rig.activeVersion.id;
               if (frozenRigVersionId !== rig.activeVersion.id) {
-                throw new Error("scheduled run rig version changed during admission");
+                throw new Error(
+                  "scheduled run sandbox environment version changed during admission",
+                );
               }
             }
             let session: Awaited<ReturnType<typeof createSession>>;
@@ -1034,6 +1351,10 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                 tools: taskTools,
                 firstPartyMcpTools,
                 firstPartyMcpPermissions,
+                ...(resolvedAgentConfig ? { agentConfig: resolvedAgentConfig } : {}),
+                ...(resolvedAgentInstructions !== undefined
+                  ? { instructions: resolvedAgentInstructions }
+                  : {}),
                 ...creatorSessionPolicy,
                 ...(task.agentConfig.knowledgeSource?.destination.kind === "personal"
                   ? {
@@ -1043,6 +1364,10 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                   : {}),
                 metadata: {
                   ...taskMetadata,
+                  ...scheduledSessionExecutionPolicyMetadata(
+                    turnExecutionPolicy,
+                    creatorPolicy?.credentialRestriction,
+                  ),
                   model,
                   reasoningEffort,
                   scheduledTaskId: task.id,
@@ -1074,6 +1399,8 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                 rigVersionId: frozenRigVersionId,
                 personalConnectionDelegations: [],
                 initialXaiProviderAccountAuthoritySnapshot: taskXaiProviderAccountAuthoritySnapshot,
+                initialClaudeProviderAccountAuthoritySnapshot:
+                  taskClaudeProviderAccountAuthoritySnapshot,
                 maxNestedAgentDepthOverride: task.agentConfig.maxNestedAgentDepth ?? null,
                 frozenNestedAgentDepthPolicy: {
                   effectiveMaxNestedAgentDepth:
@@ -1138,6 +1465,7 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
               }
               session = created.session;
               sessionCreated = created.created;
+              if (sessionCreated) recordScheduledSessionCreated(baseService.observability);
               if (!sessionCreated) {
                 await bindScheduledTaskRunSessionInTransaction(dispatchDb, {
                   accountId: task.accountId,
@@ -1171,7 +1499,7 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                 (task.agentConfig.slackBotConnectionId ?? null)
               ) {
                 throw new Error(
-                  "scheduled alert occurrence OpenGeni Slack bot binding does not match its canonical session",
+                  "scheduled alert occurrence Opengeni Slack bot binding does not match its canonical session",
                 );
               }
             }
@@ -1366,9 +1694,12 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                   task.createdBy.kind === "subject"
                     ? { xaiAuthoritySubjectId: task.createdBy.subjectId }
                     : {}),
+                  ...(claudeAuthoritySubjectId ? { claudeAuthoritySubjectId } : {}),
                 },
                 personalConnectionDelegations: taskPersonalConnectionDelegations,
+                mcpAccountBindings: taskMcpAccountBindings,
                 xaiProviderAccountAuthoritySnapshot: taskXaiProviderAccountAuthoritySnapshot,
+                claudeProviderAccountAuthoritySnapshot: taskClaudeProviderAccountAuthoritySnapshot,
                 scheduledTaskRunId: run.id,
               },
               async (tx, wakeEventId, _updateId, rejectionReason) => {
@@ -1421,6 +1752,9 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                 run: { ...run, status: "skipped" as const, error },
               };
             }
+            if (scheduledUpdate.added) {
+              recordUserMessageAccepted(baseService.observability, { surface: "scheduled" });
+            }
             if (scheduledUpdate.added && scheduledUpdate.events.length > 0) {
               if (deferPublications) {
                 deferredEvents.push({
@@ -1460,9 +1794,8 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
             // the locked admission check below remains authoritative. Mirrors
             // apps/api/src/domain/sessions.ts.
             assertReusableSessionRevivable(session.status);
-            // Defensive backstop for the API-level 409: a reusable session keeps
-            // its creation-time attachment, so a diverged task attachment must
-            // fail the run instead of silently running with the wrong secrets.
+            // Slack routing remains bound to the reusable chat; execution
+            // attachments come from its accepted target snapshot.
             assertReusableSessionBindingMatches(session, task);
             const bundled = await addSessionSystemUpdateWithSourceMutation(
               dispatchDb,
@@ -1493,9 +1826,12 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                   task.createdBy.kind === "subject"
                     ? { xaiAuthoritySubjectId: task.createdBy.subjectId }
                     : {}),
+                  ...(claudeAuthoritySubjectId ? { claudeAuthoritySubjectId } : {}),
                 },
                 personalConnectionDelegations: taskPersonalConnectionDelegations,
+                mcpAccountBindings: taskMcpAccountBindings,
                 xaiProviderAccountAuthoritySnapshot: taskXaiProviderAccountAuthoritySnapshot,
+                claudeProviderAccountAuthoritySnapshot: taskClaudeProviderAccountAuthoritySnapshot,
                 scheduledTaskRunId: run.id,
               },
               async (tx, wakeEventId, _updateId, rejectionReason) => {
@@ -1563,6 +1899,9 @@ export function createScheduledTaskActivities(services: () => Promise<ControlAct
                 run: { ...run, status: "skipped" as const, error },
               };
             }
+            if (bundled.added) {
+              recordUserMessageAccepted(baseService.observability, { surface: "scheduled" });
+            }
             if (bundled.added && bundled.events.length > 0) {
               if (deferPublications) {
                 deferredEvents.push({
@@ -1687,28 +2026,24 @@ class IncidentTelemetryPreflightBlockedError extends Error {
 }
 
 /**
- * Defensive backstop for the API-level 409: a reusable/existing target session
- * keeps its creation-time attachment, so a diverged task attachment or Slack
- * bot binding must settle the run terminally instead of silently running with
- * the wrong secrets - on the first attempt and on every recovery attempt.
+ * Defensive backstop for the API-level Slack binding guard. Variable Sets
+ * belong to the live target and are fenced by its accepted execution snapshot,
+ * not by the task's retained creation defaults.
  */
 function assertReusableSessionBindingMatches(
-  session: { variableSetId: string | null; metadata: Record<string, unknown> },
-  task: Pick<ScheduledTask, "variableSetId" | "agentConfig">,
+  session: { metadata: Record<string, unknown> },
+  task: Pick<ScheduledTask, "runMode" | "agentConfig">,
 ): void {
-  if ((session.variableSetId ?? null) !== (task.variableSetId ?? null)) {
-    throw new ScheduledRunTerminalAuthorityError(
-      "scheduled_reusable_binding_changed",
-      "scheduled task variableSet attachment does not match its reusable session",
-    );
-  }
+  // Existing-chat messages use the target policy frozen at admission. Task
+  // creation defaults are not an additional authority or binding constraint.
+  if (task.runMode === "existing_session") return;
   if (
     scheduledSlackBotConnectionId(session.metadata) !==
     (task.agentConfig.slackBotConnectionId ?? null)
   ) {
     throw new ScheduledRunTerminalAuthorityError(
       "scheduled_reusable_binding_changed",
-      "scheduled task OpenGeni Slack bot binding does not match its reusable session",
+      "scheduled task Opengeni Slack bot binding does not match its reusable session",
     );
   }
 }
@@ -1766,9 +2101,31 @@ function scheduledRunRecoveryTerminalError(
   return null;
 }
 
+/** The blocked result of a diagnostic (refused) run receipt, fresh or replayed. */
+function scheduledAdmissionRefusalResult(
+  run: Pick<ScheduledTaskRun, "id" | "admissionDiagnostic" | "admissionRefusal">,
+): Extract<DispatchScheduledTaskRunResult, { action: "blocked" }> {
+  if (run.admissionRefusal) {
+    return {
+      action: "blocked",
+      reason: run.admissionRefusal.reason as ScheduledTaskAdmissionRefusalReason,
+      runId: run.id,
+      refusal: run.admissionRefusal,
+    };
+  }
+  return {
+    action: "blocked",
+    reason: "connection_account_unavailable",
+    runId: run.id,
+    ...(run.admissionDiagnostic ? { diagnostic: run.admissionDiagnostic } : {}),
+  };
+}
+
 function scheduledRunTerminalResult(
   error: string | null,
 ): Extract<DispatchScheduledTaskRunResult, { action: "blocked" }> {
+  if (error === ATLASSIAN_NATIVE_RETIRED_REASON)
+    return { action: "blocked", reason: ATLASSIAN_NATIVE_RETIRED_REASON };
   if (error === "scheduled_authority_exhausted") {
     return { action: "blocked", reason: "scheduled_authority_exhausted" };
   }
@@ -1799,18 +2156,10 @@ async function prepareIncidentTelemetrySource(input: {
   workspaceId: string;
   sessionId: string;
   alertOccurrenceLabels: Readonly<Record<string, string>> | null;
-  acceptedExecution?: ScheduledTaskRunAcceptedExecution;
+  acceptedExecution: ScheduledTaskRunAcceptedExecution;
 }) {
   const session = await requireSession(input.tx, input.workspaceId, input.sessionId);
-  const { task, personalConnectionDelegations } = input.acceptedExecution
-    ? {
-        task: input.acceptedExecution.task,
-        personalConnectionDelegations: input.acceptedExecution.personalConnectionDelegations,
-      }
-    : await requireScheduledTaskIncidentAuthorityInTransaction(input.tx, {
-        workspaceId: input.workspaceId,
-        taskId: input.taskId,
-      });
+  const { task, personalConnectionDelegations } = input.acceptedExecution;
   const responder = await resolveIncidentTelemetryResponderMetadata({
     db: input.tx,
     settings: input.settings,
@@ -1818,39 +2167,34 @@ async function prepareIncidentTelemetrySource(input: {
     session,
     personalConnectionDelegations,
     personalResourceAuthoritySubjectId:
-      input.acceptedExecution?.personalResourceAuthoritySubjectId ?? null,
-    ...(input.acceptedExecution
+      input.acceptedExecution.personalResourceAuthoritySubjectId ?? null,
+    executionPolicy: input.acceptedExecution.targetSessionExecution
       ? {
-          executionPolicy: input.acceptedExecution.targetSessionExecution
-            ? {
-                tools: input.acceptedExecution.targetSessionExecution.tools,
-                firstPartyMcpTools:
-                  input.acceptedExecution.targetSessionExecution.firstPartyMcpTools,
-                firstPartyMcpPermissions:
-                  input.acceptedExecution.targetSessionExecution.firstPartyMcpPermissions,
-                variableSetIds: input.acceptedExecution.targetSessionExecution.variableSets.map(
-                  (variableSet) => variableSet.id,
-                ),
-                variableSetId: input.acceptedExecution.targetSessionExecution.variableSetId,
-                rigId: input.acceptedExecution.targetSessionExecution.rigId,
-                rigVersionId: input.acceptedExecution.targetSessionExecution.rigVersionId,
-                toolPolicy: input.acceptedExecution.targetSessionExecution.toolPolicy,
-                mcpServerIds: input.acceptedExecution.targetSessionExecution.mcpServerIds,
-                toolPolicyVersion: input.acceptedExecution.targetSessionExecution.toolPolicyVersion,
-              }
-            : {
-                tools: input.acceptedExecution.resolvedTools,
-                firstPartyMcpTools: input.acceptedExecution.resolvedFirstPartyMcpTools,
-                firstPartyMcpPermissions: input.acceptedExecution.resolvedFirstPartyMcpPermissions,
-                variableSetId: input.acceptedExecution.resolvedVariableSet?.id ?? null,
-                rigId: input.acceptedExecution.resolvedRig?.id ?? null,
-                rigVersionId: input.acceptedExecution.resolvedRig?.versionId ?? null,
-                toolPolicy: session.toolPolicy,
-                mcpServerIds: [],
-                toolPolicyVersion: session.toolPolicyVersion,
-              },
+          tools: input.acceptedExecution.targetSessionExecution.tools,
+          firstPartyMcpTools: input.acceptedExecution.targetSessionExecution.firstPartyMcpTools,
+          firstPartyMcpPermissions:
+            input.acceptedExecution.targetSessionExecution.firstPartyMcpPermissions,
+          variableSetIds: input.acceptedExecution.targetSessionExecution.variableSets.map(
+            (variableSet) => variableSet.id,
+          ),
+          variableSetId: input.acceptedExecution.targetSessionExecution.variableSetId,
+          rigId: input.acceptedExecution.targetSessionExecution.rigId,
+          rigVersionId: input.acceptedExecution.targetSessionExecution.rigVersionId,
+          toolPolicy: input.acceptedExecution.targetSessionExecution.toolPolicy,
+          mcpServerIds: input.acceptedExecution.targetSessionExecution.mcpServerIds,
+          toolPolicyVersion: input.acceptedExecution.targetSessionExecution.toolPolicyVersion,
         }
-      : {}),
+      : {
+          tools: input.acceptedExecution.resolvedTools,
+          firstPartyMcpTools: input.acceptedExecution.resolvedFirstPartyMcpTools,
+          firstPartyMcpPermissions: input.acceptedExecution.resolvedFirstPartyMcpPermissions,
+          variableSetId: input.acceptedExecution.resolvedVariableSet?.id ?? null,
+          rigId: input.acceptedExecution.resolvedRig?.id ?? null,
+          rigVersionId: input.acceptedExecution.resolvedRig?.versionId ?? null,
+          toolPolicy: session.toolPolicy,
+          mcpServerIds: [],
+          toolPolicyVersion: session.toolPolicyVersion,
+        },
   });
   const preflight = evaluateIncidentTelemetryPreflight({
     agentConfig: task.agentConfig,
@@ -1967,6 +2311,7 @@ async function seedScheduledGeneratedSessionRoute(input: {
 
 async function recoverBoundScheduledTaskDispatch(input: {
   db: Database;
+  observability?: ProductUsageMetricsSink | undefined;
   bus: ControlActivityServices["bus"];
   settings: ControlActivityServices["settings"];
   wakeSessionWorkflow: WakeSessionWorkflowSignal | null;
@@ -1981,6 +2326,11 @@ async function recoverBoundScheduledTaskDispatch(input: {
   const generatedSession =
     task.runMode === "new_session_per_run" ||
     (task.runMode === "reusable_session" && task.reusableSessionId === null);
+  // The immutable creator policy determines standing session authority, not
+  // a manual caller's per-run ceiling. Read it for creation and recovery checks.
+  const recoveredCreatorPolicy = generatedSession
+    ? await getScheduledTaskCreatorPolicy(input.db, task.workspaceId, task.id)
+    : null;
   const frozenSlack = input.acceptedExecution.resolvedSlackBotConnection;
   if (frozenSlack) {
     const currentSlack = await requireOpenGeniSlackBotConnection(
@@ -2003,9 +2353,8 @@ async function recoverBoundScheduledTaskDispatch(input: {
   let session: Awaited<ReturnType<typeof createSession>>;
   if (input.run.sessionId) {
     session = await requireSession(input.db, task.workspaceId, input.run.sessionId);
-    // A bound existing/reusable target must still carry the exact Variable Set
-    // and Slack bot binding frozen with this occurrence; recovery must fail the
-    // run terminally rather than deliver into a diverged session.
+    // Preserve the reusable chat's Slack routing; the accepted target snapshot
+    // independently fences its current Variable Set attachments during recovery.
     if (!generatedSession) assertReusableSessionBindingMatches(session, task);
   } else if (generatedSession) {
     const variableSet = input.acceptedExecution.resolvedVariableSet;
@@ -2049,14 +2398,6 @@ async function recoverBoundScheduledTaskDispatch(input: {
     }
     const taskMetadata = { ...task.agentConfig.metadata };
     delete taskMetadata[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];
-    // Tools and permissions were frozen into the accepted execution. The
-    // creator session policy is immutable on the task row (a tombstoned task
-    // still answers), so re-reading it here is deterministic for the same run.
-    const recoveredCreatorPolicy = await getScheduledTaskCreatorPolicy(
-      input.db,
-      task.workspaceId,
-      task.id,
-    );
     const created = await createSessionWithIdempotencyKeyResult(input.db, {
       accountId: task.accountId,
       workspaceId: task.workspaceId,
@@ -2066,6 +2407,12 @@ async function recoverBoundScheduledTaskDispatch(input: {
       tools: input.acceptedExecution.resolvedTools,
       firstPartyMcpTools: input.acceptedExecution.resolvedFirstPartyMcpTools,
       firstPartyMcpPermissions: input.acceptedExecution.resolvedFirstPartyMcpPermissions,
+      ...(input.acceptedExecution.resolvedAgentConfig
+        ? { agentConfig: input.acceptedExecution.resolvedAgentConfig }
+        : {}),
+      ...(input.acceptedExecution.resolvedAgentInstructions !== undefined
+        ? { instructions: input.acceptedExecution.resolvedAgentInstructions }
+        : {}),
       ...scheduledCreatorSessionPolicyInput(recoveredCreatorPolicy?.sessionPolicy ?? null),
       ...(task.agentConfig.knowledgeSource?.destination.kind === "personal"
         ? {
@@ -2075,6 +2422,10 @@ async function recoverBoundScheduledTaskDispatch(input: {
         : {}),
       metadata: {
         ...taskMetadata,
+        ...scheduledSessionExecutionPolicyMetadata(
+          input.acceptedExecution.turnExecutionPolicy,
+          recoveredCreatorPolicy?.credentialRestriction,
+        ),
         model: input.acceptedExecution.resolvedModel,
         reasoningEffort: input.acceptedExecution.resolvedReasoningEffort,
         scheduledTaskId: task.id,
@@ -2103,6 +2454,8 @@ async function recoverBoundScheduledTaskDispatch(input: {
       personalConnectionDelegations: [],
       initialXaiProviderAccountAuthoritySnapshot:
         input.acceptedExecution.xaiProviderAccountAuthoritySnapshot,
+      initialClaudeProviderAccountAuthoritySnapshot:
+        input.acceptedExecution.claudeProviderAccountAuthoritySnapshot,
       maxNestedAgentDepthOverride: task.agentConfig.maxNestedAgentDepth ?? null,
       frozenNestedAgentDepthPolicy: {
         effectiveMaxNestedAgentDepth:
@@ -2133,6 +2486,7 @@ async function recoverBoundScheduledTaskDispatch(input: {
     });
     if (created.denied) throw new SessionSpawnDeniedDbError(created.denial);
     session = created.session;
+    if (created.created) recordScheduledSessionCreated(input.observability);
     if (!created.created) {
       await bindScheduledTaskRunSessionInTransaction(input.db, {
         accountId: task.accountId,
@@ -2203,20 +2557,27 @@ async function recoverBoundScheduledTaskDispatch(input: {
     );
     const expectedTaskMetadata = { ...task.agentConfig.metadata };
     delete expectedTaskMetadata[OPENGENI_SLACK_BOT_SESSION_METADATA_KEY];
-    const expectedMetadata = {
-      ...expectedTaskMetadata,
-      model: input.acceptedExecution.resolvedModel,
-      reasoningEffort: input.acceptedExecution.resolvedReasoningEffort,
-      scheduledTaskId: task.id,
-      scheduledTaskRunMode: task.runMode,
-      ...(task.agentConfig.goal ? { scheduledTaskGoal: task.agentConfig.goal } : {}),
-      scheduledTaskRunId: canonicalGeneratedRunId,
-      ...(frozenSlack ? { [OPENGENI_SLACK_BOT_SESSION_METADATA_KEY]: frozenSlack.id } : {}),
-    };
+    const expectedMetadata = metadataWithAgentConfigCreateIdentity(
+      {
+        ...expectedTaskMetadata,
+        ...scheduledSessionExecutionPolicyMetadata(
+          input.acceptedExecution.turnExecutionPolicy,
+          recoveredCreatorPolicy?.credentialRestriction,
+        ),
+        model: input.acceptedExecution.resolvedModel,
+        reasoningEffort: input.acceptedExecution.resolvedReasoningEffort,
+        scheduledTaskId: task.id,
+        scheduledTaskRunMode: task.runMode,
+        ...(task.agentConfig.goal ? { scheduledTaskGoal: task.agentConfig.goal } : {}),
+        scheduledTaskRunId: canonicalGeneratedRunId,
+        ...(frozenSlack ? { [OPENGENI_SLACK_BOT_SESSION_METADATA_KEY]: frozenSlack.id } : {}),
+      },
+      input.acceptedExecution.resolvedAgentConfig,
+    );
     if (
       session.createIdempotencyKey !== expectedCreateKey ||
       session.initialMessage !== task.agentConfig.prompt ||
-      session.instructions !== null ||
+      session.instructions !== (input.acceptedExecution.resolvedAgentInstructions ?? null) ||
       session.policyRole !== null ||
       stableJson(session.skills) !== "[]" ||
       stableJson(session.toolPolicy) !==
@@ -2258,6 +2619,8 @@ async function recoverBoundScheduledTaskDispatch(input: {
         stableJson(input.acceptedExecution.resolvedFirstPartyMcpTools) ||
       stableJson(session.firstPartyMcpPermissions) !==
         stableJson(input.acceptedExecution.resolvedFirstPartyMcpPermissions) ||
+      stableJson(session.agent) !==
+        stableJson(input.acceptedExecution.resolvedAgentConfig ?? null) ||
       session.maxNestedAgentDepthOverride !== (task.agentConfig.maxNestedAgentDepth ?? null) ||
       (session.variableSetId ?? null) !==
         (input.acceptedExecution.resolvedVariableSet?.id ?? null) ||
@@ -2354,10 +2717,16 @@ async function recoverBoundScheduledTaskDispatch(input: {
         ...(input.acceptedExecution.xaiAuthoritySubjectId
           ? { xaiAuthoritySubjectId: input.acceptedExecution.xaiAuthoritySubjectId }
           : {}),
+        ...(input.acceptedExecution.claudeAuthoritySubjectId
+          ? { claudeAuthoritySubjectId: input.acceptedExecution.claudeAuthoritySubjectId }
+          : {}),
       },
       personalConnectionDelegations: input.acceptedExecution.personalConnectionDelegations,
+      mcpAccountBindings: input.acceptedExecution.mcpAccountBindings ?? null,
       xaiProviderAccountAuthoritySnapshot:
         input.acceptedExecution.xaiProviderAccountAuthoritySnapshot,
+      claudeProviderAccountAuthoritySnapshot:
+        input.acceptedExecution.claudeProviderAccountAuthoritySnapshot,
       scheduledTaskRunId: input.run.id,
     },
     async (tx, wakeEventId, _updateId, rejectionReason) => {
@@ -2422,6 +2791,9 @@ async function recoverBoundScheduledTaskDispatch(input: {
   ) {
     return { action: "blocked", reason: "scheduled_run_terminal" };
   }
+  if (scheduledUpdate.added) {
+    recordUserMessageAccepted(input.observability, { surface: "scheduled" });
+  }
   if (scheduledUpdate.added && scheduledUpdate.events.length > 0) {
     await publishDurableSessionEvents(
       input.bus,