diff --git a/.repository-projection.json b/.repository-projection.json
index 46945ba..55677f6 100644
--- a/.repository-projection.json
+++ b/.repository-projection.json
@@ -3,11 +3,11 @@
   "projection": "api",
   "projectionSchemaVersion": 1,
   "sourceRepository": "dx-corp/mono",
-  "sourceSha": "511bd2305f5a92cfbedb91208d7bc0820fda29b5",
+  "sourceSha": "4ab4845398fdca60f84eb815733b8e2361b4856d",
   "destinationRepository": "dx-corp/api",
-  "priorProjectedBase": "432a7e83b8d2367be1d8c8d65e0ee33b89dccafb",
+  "priorProjectedBase": "9b547354dfb44934b853443aa73d296901ef1d2b",
   "definitionDigest": "144b18a5c1f3e7ee6e2d1abc32f80a97adfeacd088911ec659d63622fe85d18c",
-  "toolDigest": "e9fc82741fdf4a797b076d29d51e14aced32368b",
-  "contentDigest": "f7b9283b21f4fbd1865623fee48f517eb5d2f4cb77ab5551131fd2343c7a23e8",
+  "toolDigest": "f58d71f023a4f0a27d77cb96dcc5348a40816d0b",
+  "contentDigest": "83f23b52425dd854d1716f080f280cdd7cdbc61c39a4791825db577adc46d2a0",
   "publicationEligible": true
 }
diff --git a/openapi/connectors/v1/connectors.openapi.yaml b/openapi/connectors/v1/connectors.openapi.yaml
index 1da62a4..244e403 100644
--- a/openapi/connectors/v1/connectors.openapi.yaml
+++ b/openapi/connectors/v1/connectors.openapi.yaml
@@ -874,7 +874,8 @@ paths:
       summary: CompleteOAuthFlow
       description: |-
         CompleteOAuthFlow exchanges the authorization code for access/refresh
-         tokens and registers the connection in one call.
+         tokens. Providers that authorize more than one tenant return an explicit
+         selection list; the caller completes the same state with selected_tenant_id.
       operationId: connectors.v1.ConnectorService.CompleteOAuthFlow
       parameters:
         - name: Connect-Protocol-Version
@@ -1282,6 +1283,7 @@ components:
         - AUTH_TYPE_BASIC
         - AUTH_TYPE_MTLS
         - AUTH_TYPE_GITHUB_APP
+        - AUTH_TYPE_NONE
       description: AuthType describes the authentication method for a connection.
     connectors.v1.ConnectorActionErrorKind:
       type: string
@@ -1568,8 +1570,10 @@ components:
         code:
           type: string
           title: code
-          minLength: 1
-          description: Authorization code returned by the provider on the redirect.
+          description: |-
+            Authorization code returned by the provider on the redirect. Required on
+             the first completion and empty only when selected_tenant_id completes an
+             already-custodied multi-tenant authorization.
         redirectUri:
           type: string
           title: redirect_uri
@@ -1591,6 +1595,13 @@ components:
           description: |-
             Untrusted GitHub callback coordinate; verified against the authenticated
              provider user and configured product App before connection registration.
+        selectedTenantId:
+          type: string
+          title: selected_tenant_id
+          description: |-
+            Exact provider tenant selected from a prior CompleteOAuthFlow response.
+             Leave empty on the authorization-code exchange. The server never chooses
+             an authorized tenant implicitly.
       title: CompleteOAuthFlowRequest
       additionalProperties: false
     connectors.v1.CompleteOAuthFlowResponse:
@@ -1599,6 +1610,17 @@ components:
         connection:
           title: connection
           $ref: '#/components/schemas/connectors.v1.Connection'
+        authorizedTenants:
+          type: array
+          items:
+            $ref: '#/components/schemas/connectors.v1.OAuthProviderTenant'
+          title: authorized_tenants
+          description: |-
+            Authorized provider tenants requiring explicit customer selection before
+             the connection can be registered. Empty when connection is populated.
+        tenantSelectionRequired:
+          type: boolean
+          title: tenant_selection_required
       title: CompleteOAuthFlowResponse
       additionalProperties: false
     connectors.v1.Connection:
@@ -3550,6 +3572,20 @@ components:
           $ref: '#/components/schemas/connectors.v1.UpcomingCallSourceState'
       title: ListUpcomingCallsResponse
       additionalProperties: false
+    connectors.v1.OAuthProviderTenant:
+      type: object
+      properties:
+        tenantId:
+          type: string
+          title: tenant_id
+        tenantName:
+          type: string
+          title: tenant_name
+        tenantType:
+          type: string
+          title: tenant_type
+      title: OAuthProviderTenant
+      additionalProperties: false
     connectors.v1.PreviewCustomConnectorRequest:
       type: object
       properties:
diff --git a/openapi/console/v1/console.openapi.yaml b/openapi/console/v1/console.openapi.yaml
index e3d75d7..d15f5ab 100644
--- a/openapi/console/v1/console.openapi.yaml
+++ b/openapi/console/v1/console.openapi.yaml
@@ -4680,6 +4680,222 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/console.v1.EngageStaffProductIssueReportResponse'
+  /console.v1.ConsoleService/PrepareStaffProductIssueRecovery:
+    post:
+      tags:
+        - console.v1.ConsoleService
+      summary: PrepareStaffProductIssueRecovery
+      description: PrepareStaffProductIssueRecovery advances the staff-reviewed recovery of charged failures.
+      operationId: console.v1.ConsoleService.PrepareStaffProductIssueRecovery
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/console.v1.PrepareStaffProductIssueRecoveryRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/console.v1.ProductIssueRecoveryResponse'
+  /console.v1.ConsoleService/ScanStaffProductIssueRecovery:
+    post:
+      tags:
+        - console.v1.ConsoleService
+      summary: ScanStaffProductIssueRecovery
+      description: ScanStaffProductIssueRecovery advances the staff-reviewed recovery of charged failures.
+      operationId: console.v1.ConsoleService.ScanStaffProductIssueRecovery
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/console.v1.ScanStaffProductIssueRecoveryRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/console.v1.ProductIssueRecoveryResponse'
+  /console.v1.ConsoleService/ReviewStaffProductIssueRecovery:
+    post:
+      tags:
+        - console.v1.ConsoleService
+      summary: ReviewStaffProductIssueRecovery
+      description: ReviewStaffProductIssueRecovery advances the staff-reviewed recovery of charged failures.
+      operationId: console.v1.ConsoleService.ReviewStaffProductIssueRecovery
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/console.v1.ReviewStaffProductIssueRecoveryRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/console.v1.ProductIssueRecoveryResponse'
+  /console.v1.ConsoleService/ExecuteStaffProductIssueRecovery:
+    post:
+      tags:
+        - console.v1.ConsoleService
+      summary: ExecuteStaffProductIssueRecovery
+      description: ExecuteStaffProductIssueRecovery advances the staff-reviewed recovery of charged failures.
+      operationId: console.v1.ConsoleService.ExecuteStaffProductIssueRecovery
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/console.v1.ExecuteStaffProductIssueRecoveryRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/console.v1.ProductIssueRecoveryResponse'
+  /console.v1.ConsoleService/GetProductIssueRecovery:
+    post:
+      tags:
+        - console.v1.ConsoleService
+      summary: GetProductIssueRecovery
+      description: GetProductIssueRecovery accesses only the authenticated recovery recipient or authorized staff.
+      operationId: console.v1.ConsoleService.GetProductIssueRecovery
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/console.v1.GetProductIssueRecoveryRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/console.v1.ProductIssueRecoveryResponse'
+  /console.v1.ConsoleService/ReplyProductIssueRecovery:
+    post:
+      tags:
+        - console.v1.ConsoleService
+      summary: ReplyProductIssueRecovery
+      description: ReplyProductIssueRecovery accesses only the authenticated recovery recipient or authorized staff.
+      operationId: console.v1.ConsoleService.ReplyProductIssueRecovery
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/console.v1.ReplyProductIssueRecoveryRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/console.v1.ProductIssueRecoveryResponse'
   /console.v1.ConsoleService/GetOperatingFeedback:
     post:
       tags:
@@ -17846,6 +18062,29 @@ components:
           maxItems: 200
       title: EvaluateWorkspaceArtifactStyleGuideResponse
       additionalProperties: false
+    console.v1.ExecuteStaffProductIssueRecoveryRequest:
+      type: object
+      properties:
+        organizationId:
+          type: string
+          title: organization_id
+          maxLength: 4000
+        workspaceId:
+          type: string
+          title: workspace_id
+          maxLength: 4000
+        recoveryId:
+          type: string
+          title: recovery_id
+          maxLength: 4000
+        expectedRevision:
+          type:
+            - integer
+            - string
+          title: expected_revision
+          format: int64
+      title: ExecuteStaffProductIssueRecoveryRequest
+      additionalProperties: false
     console.v1.FinalizeBusinessObjectAuthorityTransferRequest:
       type: object
       properties:
@@ -18997,6 +19236,19 @@ components:
           $ref: '#/components/schemas/console.v1.TenantPrivacySetting'
       title: GetPrivacySettingsResponse
       additionalProperties: false
+    console.v1.GetProductIssueRecoveryRequest:
+      type: object
+      properties:
+        query:
+          title: query
+          $ref: '#/components/schemas/console.v1.ConsoleQuery'
+        recoveryId:
+          type: string
+          title: recovery_id
+          maxLength: 4000
+      title: GetProductIssueRecoveryRequest
+      additionalProperties: false
+      description: Durable, explicitly scoped customer recovery contract.
     console.v1.GetProspectingWatchProgramRequest:
       type: object
       properties:
@@ -19558,6 +19810,13 @@ components:
     console.v1.InferenceCreditBalance:
       type: object
       properties:
+        compensatedMicros:
+          type:
+            - integer
+            - string
+          title: compensated_micros
+          format: int64
+          description: Original cash charges restored through verified customer recovery.
         grantedMicros:
           type:
             - integer
@@ -19744,6 +20003,12 @@ components:
     console.v1.InferenceCreditReconciliation:
       type: object
       properties:
+        compensatedDifferenceMicros:
+          type:
+            - integer
+            - string
+          title: compensated_difference_micros
+          format: int64
         balanced:
           type: boolean
           title: balanced
@@ -24912,6 +25177,60 @@ components:
           title: unavailable_reason
       title: PrepareBusinessObjectAuthorityTransferResponse
       additionalProperties: false
+    console.v1.PrepareStaffProductIssueRecoveryRequest:
+      type: object
+      properties:
+        organizationId:
+          type: string
+          title: organization_id
+          maxLength: 4000
+        workspaceId:
+          type: string
+          title: workspace_id
+          maxLength: 4000
+        sourceOrganizationId:
+          type: string
+          title: source_organization_id
+          maxLength: 4000
+        sourceWorkspaceId:
+          type: string
+          title: source_workspace_id
+          maxLength: 4000
+        reportId:
+          type: string
+          title: report_id
+          maxLength: 4000
+        errorCode:
+          type: string
+          title: error_code
+          maxLength: 4000
+        startUnixSeconds:
+          type:
+            - integer
+            - string
+          title: start_unix_seconds
+          format: int64
+        endUnixSeconds:
+          type:
+            - integer
+            - string
+          title: end_unix_seconds
+          format: int64
+        recipientPrincipalId:
+          type: string
+          title: recipient_principal_id
+          maxLength: 4000
+        customerSummary:
+          type: string
+          title: customer_summary
+          maxLength: 4000
+        deploymentVerification:
+          type: string
+          title: deployment_verification
+          maxLength: 4000
+      title: PrepareStaffProductIssueRecoveryRequest
+      additionalProperties: false
+      description: Durable, explicitly scoped customer recovery contract.
     console.v1.PrewarmOperatingThreadRequest:
       type: object
       properties:
@@ -25095,6 +25414,95 @@ components:
           title: private_route
       title: PrivateProfileRoute
       additionalProperties: false
+    console.v1.ProductIssueRecovery:
+      type: object
+      properties:
+        organizationId:
+          type: string
+          title: organization_id
+          maxLength: 4000
+        workspaceId:
+          type: string
+          title: workspace_id
+          maxLength: 4000
+        recoveryId:
+          type: string
+          title: recovery_id
+          maxLength: 4000
+        reportReference:
+          type: string
+          title: report_reference
+          maxLength: 4000
+        recipientPrincipalId:
+          type: string
+          title: recipient_principal_id
+          maxLength: 4000
+        customerSummary:
+          type: string
+          title: customer_summary
+          maxLength: 4000
+        state:
+          type: string
+          title: state
+          maxLength: 4000
+        revision:
+          type:
+            - integer
+            - string
+          title: revision
+          format: int64
+        affectedRequestCount:
+          type:
+            - integer
+            - string
+          title: affected_request_count
+          format: int64
+        expectedCreditMicros:
+          type:
+            - integer
+            - string
+          title: expected_credit_micros
+          format: int64
+        compensatedMicros:
+          type:
+            - integer
+            - string
+          title: compensated_micros
+          format: int64
+        remainingRequestCount:
+          type:
+            - integer
+            - string
+          title: remaining_request_count
+          format: int64
+        notificationId:
+          type: string
+          title: notification_id
+          maxLength: 4000
+        lastReply:
+          type: string
+          title: last_reply
+          maxLength: 4000
+        coverage:
+          type: string
+          title: coverage
+          maxLength: 4000
+        deploymentVerification:
+          type: string
+          title: deployment_verification
+          maxLength: 4000
+      title: ProductIssueRecovery
+      additionalProperties: false
+      description: Durable, explicitly scoped customer recovery contract.
+    console.v1.ProductIssueRecoveryResponse:
+      type: object
+      properties:
+        recovery:
+          title: recovery
+          $ref: '#/components/schemas/console.v1.ProductIssueRecovery'
+      title: ProductIssueRecoveryResponse
+      additionalProperties: false
+      description: Durable, explicitly scoped customer recovery contract.
     console.v1.ProductIssueReport:
       type: object
       properties:
@@ -26065,6 +26473,30 @@ components:
       required:
         - channel
       additionalProperties: false
+    console.v1.ReplyProductIssueRecoveryRequest:
+      type: object
+      properties:
+        query:
+          title: query
+          $ref: '#/components/schemas/console.v1.ConsoleQuery'
+        recoveryId:
+          type: string
+          title: recovery_id
+          maxLength: 4000
+        idempotencyKey:
+          type: string
+          title: idempotency_key
+          maxLength: 4000
+        message:
+          type: string
+          title: message
+          maxLength: 4000
+        resolved:
+          type: boolean
+          title: resolved
+      title: ReplyProductIssueRecoveryRequest
+      additionalProperties: false
+      description: Durable, explicitly scoped customer recovery contract.
     console.v1.ReserveComputerMissionApexSessionRequest:
       type: object
       properties:
@@ -26544,6 +26976,29 @@ components:
         - draft
         - receipt
       additionalProperties: false
+    console.v1.ReviewStaffProductIssueRecoveryRequest:
+      type: object
+      properties:
+        organizationId:
+          type: string
+          title: organization_id
+          maxLength: 4000
+        workspaceId:
+          type: string
+          title: workspace_id
+          maxLength: 4000
+        recoveryId:
+          type: string
+          title: recovery_id
+          maxLength: 4000
+        expectedRevision:
+          type:
+            - integer
+            - string
+          title: expected_revision
+          format: int64
+      title: ReviewStaffProductIssueRecoveryRequest
+      additionalProperties: false
     console.v1.ReviewWorkspaceMemoryRequest:
       type: object
       properties:
@@ -26793,6 +27248,30 @@ components:
           title: evidence_refs
       title: RunAsIdentitySummary
       additionalProperties: false
+    console.v1.ScanStaffProductIssueRecoveryRequest:
+      type: object
+      properties:
+        organizationId:
+          type: string
+          title: organization_id
+          maxLength: 4000
+        workspaceId:
+          type: string
+          title: workspace_id
+          maxLength: 4000
+        recoveryId:
+          type: string
+          title: recovery_id
+          maxLength: 4000
+        expectedRevision:
+          type:
+            - integer
+            - string
+          title: expected_revision
+          format: int64
+      title: ScanStaffProductIssueRecoveryRequest
+      additionalProperties: false
+      description: Durable, explicitly scoped customer recovery contract.
     console.v1.ScenarioFixture:
       type: object
       properties:
@@ -31368,6 +31847,13 @@ components:
     meter.v1.PrepaidCreditBalance:
       type: object
       properties:
+        compensatedMicros:
+          type:
+            - integer
+            - string
+          title: compensated_micros
+          format: int64
+          description: Cash recovery, separate from purchases and non-cash grants.
         developmentCreditOnly:
           type: boolean
           title: development_credit_only
@@ -31444,6 +31930,12 @@ components:
     meter.v1.PrepaidCreditReconciliation:
       type: object
       properties:
+        compensatedDifferenceMicros:
+          type:
+            - integer
+            - string
+          title: compensated_difference_micros
+          format: int64
         grantedDifferenceMicros:
           type:
             - integer
diff --git a/openapi/deixic/v1/deixic.openapi.yaml b/openapi/deixic/v1/deixic.openapi.yaml
index 7c1a154..3e38590 100644
--- a/openapi/deixic/v1/deixic.openapi.yaml
+++ b/openapi/deixic/v1/deixic.openapi.yaml
@@ -5953,6 +5953,222 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/console.v1.EngageStaffProductIssueReportResponse'
+  /deixic.v1.DeixicService/PrepareStaffProductIssueRecovery:
+    post:
+      tags:
+        - deixic.v1.DeixicService
+      summary: PrepareStaffProductIssueRecovery
+      description: PrepareStaffProductIssueRecovery advances the staff-reviewed recovery of charged failures.
+      operationId: deixic.v1.DeixicService.PrepareStaffProductIssueRecovery
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/console.v1.PrepareStaffProductIssueRecoveryRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/console.v1.ProductIssueRecoveryResponse'
+  /deixic.v1.DeixicService/ScanStaffProductIssueRecovery:
+    post:
+      tags:
+        - deixic.v1.DeixicService
+      summary: ScanStaffProductIssueRecovery
+      description: ScanStaffProductIssueRecovery advances the staff-reviewed recovery of charged failures.
+      operationId: deixic.v1.DeixicService.ScanStaffProductIssueRecovery
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/console.v1.ScanStaffProductIssueRecoveryRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/console.v1.ProductIssueRecoveryResponse'
+  /deixic.v1.DeixicService/ReviewStaffProductIssueRecovery:
+    post:
+      tags:
+        - deixic.v1.DeixicService
+      summary: ReviewStaffProductIssueRecovery
+      description: ReviewStaffProductIssueRecovery advances the staff-reviewed recovery of charged failures.
+      operationId: deixic.v1.DeixicService.ReviewStaffProductIssueRecovery
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/console.v1.ReviewStaffProductIssueRecoveryRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/console.v1.ProductIssueRecoveryResponse'
+  /deixic.v1.DeixicService/ExecuteStaffProductIssueRecovery:
+    post:
+      tags:
+        - deixic.v1.DeixicService
+      summary: ExecuteStaffProductIssueRecovery
+      description: ExecuteStaffProductIssueRecovery advances the staff-reviewed recovery of charged failures.
+      operationId: deixic.v1.DeixicService.ExecuteStaffProductIssueRecovery
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/console.v1.ExecuteStaffProductIssueRecoveryRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/console.v1.ProductIssueRecoveryResponse'
+  /deixic.v1.DeixicService/GetProductIssueRecovery:
+    post:
+      tags:
+        - deixic.v1.DeixicService
+      summary: GetProductIssueRecovery
+      description: GetProductIssueRecovery accesses only the authenticated recovery recipient or authorized staff.
+      operationId: deixic.v1.DeixicService.GetProductIssueRecovery
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/console.v1.GetProductIssueRecoveryRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/console.v1.ProductIssueRecoveryResponse'
+  /deixic.v1.DeixicService/ReplyProductIssueRecovery:
+    post:
+      tags:
+        - deixic.v1.DeixicService
+      summary: ReplyProductIssueRecovery
+      description: ReplyProductIssueRecovery accesses only the authenticated recovery recipient or authorized staff.
+      operationId: deixic.v1.DeixicService.ReplyProductIssueRecovery
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/console.v1.ReplyProductIssueRecoveryRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/console.v1.ProductIssueRecoveryResponse'
   /deixic.v1.DeixicService/GetOperatingFeedback:
     post:
       tags:
@@ -17228,6 +17444,29 @@ components:
           maxItems: 200
       title: EvaluateWorkspaceArtifactStyleGuideResponse
       additionalProperties: false
+    console.v1.ExecuteStaffProductIssueRecoveryRequest:
+      type: object
+      properties:
+        organizationId:
+          type: string
+          title: organization_id
+          maxLength: 4000
+        workspaceId:
+          type: string
+          title: workspace_id
+          maxLength: 4000
+        recoveryId:
+          type: string
+          title: recovery_id
+          maxLength: 4000
+        expectedRevision:
+          type:
+            - integer
+            - string
+          title: expected_revision
+          format: int64
+      title: ExecuteStaffProductIssueRecoveryRequest
+      additionalProperties: false
     console.v1.FinalizeBusinessObjectAuthorityTransferRequest:
       type: object
       properties:
@@ -18362,6 +18601,19 @@ components:
           $ref: '#/components/schemas/console.v1.TenantPrivacySetting'
       title: GetPrivacySettingsResponse
       additionalProperties: false
+    console.v1.GetProductIssueRecoveryRequest:
+      type: object
+      properties:
+        query:
+          title: query
+          $ref: '#/components/schemas/console.v1.ConsoleQuery'
+        recoveryId:
+          type: string
+          title: recovery_id
+          maxLength: 4000
+      title: GetProductIssueRecoveryRequest
+      additionalProperties: false
+      description: Durable, explicitly scoped customer recovery contract.
     console.v1.GetProspectingWatchProgramRequest:
       type: object
       properties:
@@ -18831,6 +19083,13 @@ components:
     console.v1.InferenceCreditBalance:
       type: object
       properties:
+        compensatedMicros:
+          type:
+            - integer
+            - string
+          title: compensated_micros
+          format: int64
+          description: Original cash charges restored through verified customer recovery.
         grantedMicros:
           type:
             - integer
@@ -19017,6 +19276,12 @@ components:
     console.v1.InferenceCreditReconciliation:
       type: object
       properties:
+        compensatedDifferenceMicros:
+          type:
+            - integer
+            - string
+          title: compensated_difference_micros
+          format: int64
         balanced:
           type: boolean
           title: balanced
@@ -23494,6 +23759,60 @@ components:
           title: unavailable_reason
       title: PrepareBusinessObjectAuthorityTransferResponse
       additionalProperties: false
+    console.v1.PrepareStaffProductIssueRecoveryRequest:
+      type: object
+      properties:
+        organizationId:
+          type: string
+          title: organization_id
+          maxLength: 4000
+        workspaceId:
+          type: string
+          title: workspace_id
+          maxLength: 4000
+        sourceOrganizationId:
+          type: string
+          title: source_organization_id
+          maxLength: 4000
+        sourceWorkspaceId:
+          type: string
+          title: source_workspace_id
+          maxLength: 4000
+        reportId:
+          type: string
+          title: report_id
+          maxLength: 4000
+        errorCode:
+          type: string
+          title: error_code
+          maxLength: 4000
+        startUnixSeconds:
+          type:
+            - integer
+            - string
+          title: start_unix_seconds
+          format: int64
+        endUnixSeconds:
+          type:
+            - integer
+            - string
+          title: end_unix_seconds
+          format: int64
+        recipientPrincipalId:
+          type: string
+          title: recipient_principal_id
+          maxLength: 4000
+        customerSummary:
+          type: string
+          title: customer_summary
+          maxLength: 4000
+        deploymentVerification:
+          type: string
+          title: deployment_verification
+          maxLength: 4000
+      title: PrepareStaffProductIssueRecoveryRequest
+      additionalProperties: false
+      description: Durable, explicitly scoped customer recovery contract.
     console.v1.PrewarmOperatingThreadRequest:
       type: object
       properties:
@@ -23677,6 +23996,95 @@ components:
           title: private_route
       title: PrivateProfileRoute
       additionalProperties: false
+    console.v1.ProductIssueRecovery:
+      type: object
+      properties:
+        organizationId:
+          type: string
+          title: organization_id
+          maxLength: 4000
+        workspaceId:
+          type: string
+          title: workspace_id
+          maxLength: 4000
+        recoveryId:
+          type: string
+          title: recovery_id
+          maxLength: 4000
+        reportReference:
+          type: string
+          title: report_reference
+          maxLength: 4000
+        recipientPrincipalId:
+          type: string
+          title: recipient_principal_id
+          maxLength: 4000
+        customerSummary:
+          type: string
+          title: customer_summary
+          maxLength: 4000
+        state:
+          type: string
+          title: state
+          maxLength: 4000
+        revision:
+          type:
+            - integer
+            - string
+          title: revision
+          format: int64
+        affectedRequestCount:
+          type:
+            - integer
+            - string
+          title: affected_request_count
+          format: int64
+        expectedCreditMicros:
+          type:
+            - integer
+            - string
+          title: expected_credit_micros
+          format: int64
+        compensatedMicros:
+          type:
+            - integer
+            - string
+          title: compensated_micros
+          format: int64
+        remainingRequestCount:
+          type:
+            - integer
+            - string
+          title: remaining_request_count
+          format: int64
+        notificationId:
+          type: string
+          title: notification_id
+          maxLength: 4000
+        lastReply:
+          type: string
+          title: last_reply
+          maxLength: 4000
+        coverage:
+          type: string
+          title: coverage
+          maxLength: 4000
+        deploymentVerification:
+          type: string
+          title: deployment_verification
+          maxLength: 4000
+      title: ProductIssueRecovery
+      additionalProperties: false
+      description: Durable, explicitly scoped customer recovery contract.
+    console.v1.ProductIssueRecoveryResponse:
+      type: object
+      properties:
+        recovery:
+          title: recovery
+          $ref: '#/components/schemas/console.v1.ProductIssueRecovery'
+      title: ProductIssueRecoveryResponse
+      additionalProperties: false
+      description: Durable, explicitly scoped customer recovery contract.
     console.v1.ProductIssueReport:
       type: object
       properties:
@@ -24620,6 +25028,30 @@ components:
       required:
         - channel
       additionalProperties: false
+    console.v1.ReplyProductIssueRecoveryRequest:
+      type: object
+      properties:
+        query:
+          title: query
+          $ref: '#/components/schemas/console.v1.ConsoleQuery'
+        recoveryId:
+          type: string
+          title: recovery_id
+          maxLength: 4000
+        idempotencyKey:
+          type: string
+          title: idempotency_key
+          maxLength: 4000
+        message:
+          type: string
+          title: message
+          maxLength: 4000
+        resolved:
+          type: boolean
+          title: resolved
+      title: ReplyProductIssueRecoveryRequest
+      additionalProperties: false
+      description: Durable, explicitly scoped customer recovery contract.
     console.v1.ReserveComputerMissionApexSessionRequest:
       type: object
       properties:
@@ -25099,6 +25531,29 @@ components:
         - draft
         - receipt
       additionalProperties: false
+    console.v1.ReviewStaffProductIssueRecoveryRequest:
+      type: object
+      properties:
+        organizationId:
+          type: string
+          title: organization_id
+          maxLength: 4000
+        workspaceId:
+          type: string
+          title: workspace_id
+          maxLength: 4000
+        recoveryId:
+          type: string
+          title: recovery_id
+          maxLength: 4000
+        expectedRevision:
+          type:
+            - integer
+            - string
+          title: expected_revision
+          format: int64
+      title: ReviewStaffProductIssueRecoveryRequest
+      additionalProperties: false
     console.v1.ReviewWorkspaceMemoryRequest:
       type: object
       properties:
@@ -25348,6 +25803,30 @@ components:
           title: evidence_refs
       title: RunAsIdentitySummary
       additionalProperties: false
+    console.v1.ScanStaffProductIssueRecoveryRequest:
+      type: object
+      properties:
+        organizationId:
+          type: string
+          title: organization_id
+          maxLength: 4000
+        workspaceId:
+          type: string
+          title: workspace_id
+          maxLength: 4000
+        recoveryId:
+          type: string
+          title: recovery_id
+          maxLength: 4000
+        expectedRevision:
+          type:
+            - integer
+            - string
+          title: expected_revision
+          format: int64
+      title: ScanStaffProductIssueRecoveryRequest
+      additionalProperties: false
+      description: Durable, explicitly scoped customer recovery contract.
     console.v1.ScenarioFixture:
       type: object
       properties:
@@ -29873,6 +30352,13 @@ components:
     meter.v1.PrepaidCreditBalance:
       type: object
       properties:
+        compensatedMicros:
+          type:
+            - integer
+            - string
+          title: compensated_micros
+          format: int64
+          description: Cash recovery, separate from purchases and non-cash grants.
         developmentCreditOnly:
           type: boolean
           title: development_credit_only
@@ -29949,6 +30435,12 @@ components:
     meter.v1.PrepaidCreditReconciliation:
       type: object
       properties:
+        compensatedDifferenceMicros:
+          type:
+            - integer
+            - string
+          title: compensated_difference_micros
+          format: int64
         grantedDifferenceMicros:
           type:
             - integer
diff --git a/openapi/meter/v1/meter.openapi.yaml b/openapi/meter/v1/meter.openapi.yaml
index 84b291c..9b21ba4 100644
--- a/openapi/meter/v1/meter.openapi.yaml
+++ b/openapi/meter/v1/meter.openapi.yaml
@@ -294,6 +294,78 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/meter.v1.ReserveWorkCreditsResponse'
+  /meter.v1.MeterService/PreviewPrepaidCompensation:
+    post:
+      tags:
+        - meter.v1.MeterService
+      summary: PreviewPrepaidCompensation
+      description: Read original settlement eligibility without accepting or issuing compensation.
+      operationId: meter.v1.MeterService.PreviewPrepaidCompensation
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/meter.v1.PreviewPrepaidCompensationRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/meter.v1.PreviewPrepaidCompensationResponse'
+  /meter.v1.MeterService/CompensatePrepaidCredit:
+    post:
+      tags:
+        - meter.v1.MeterService
+      summary: CompensatePrepaidCredit
+      description: Restore a cash-funded settled request once across all recovery incidents.
+      operationId: meter.v1.MeterService.CompensatePrepaidCredit
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/meter.v1.CompensatePrepaidCreditRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/meter.v1.CompensatePrepaidCreditResponse'
   /meter.v1.MeterService/SettlePrepaidCredits:
     post:
       tags:
@@ -1587,6 +1659,51 @@ components:
           title: warnings
       title: CheckBudgetResponse
       additionalProperties: false
+    meter.v1.CompensatePrepaidCreditRequest:
+      type: object
+      properties:
+        workspaceId:
+          type: string
+          title: workspace_id
+          maxLength: 256
+          minLength: 1
+        gatewayRequestId:
+          type: string
+          title: gateway_request_id
+          maxLength: 256
+          minLength: 1
+        incidentId:
+          type: string
+          title: incident_id
+          maxLength: 256
+          minLength: 1
+        idempotencyKey:
+          type: string
+          title: idempotency_key
+          maxLength: 256
+          minLength: 1
+      title: CompensatePrepaidCreditRequest
+      additionalProperties: false
+      description: Organization and actor come exclusively from the authenticated recovery service.
+    meter.v1.CompensatePrepaidCreditResponse:
+      type: object
+      properties:
+        compensatedMicros:
+          exclusiveMinimum: 0
+          type:
+            - integer
+            - string
+          title: compensated_micros
+          format: int64
+        receiptId:
+          type: string
+          title: receipt_id
+        duplicate:
+          type: boolean
+          title: duplicate
+          description: Another incident or retry already restored this original charge.
+      title: CompensatePrepaidCreditResponse
+      additionalProperties: false
     meter.v1.DevelopmentCreditGrant:
       type: object
       properties:
@@ -2526,9 +2643,37 @@ components:
           format: int64
       title: MeterSummaryBucket
       additionalProperties: false
+    meter.v1.PrepaidCompensationEligibility:
+      type: object
+      properties:
+        gatewayRequestId:
+          type: string
+          title: gateway_request_id
+        eligible:
+          type: boolean
+          title: eligible
+        creditMicros:
+          type:
+            - integer
+            - string
+          title: credit_micros
+          format: int64
+        reason:
+          type: string
+          title: reason
+          description: 'Stable owner codes: eligible, not_found, unsettled, zero_charge, grant_funded.'
+      title: PrepaidCompensationEligibility
+      additionalProperties: false
     meter.v1.PrepaidCreditBalance:
       type: object
       properties:
+        compensatedMicros:
+          type:
+            - integer
+            - string
+          title: compensated_micros
+          format: int64
+          description: Cash recovery, separate from purchases and non-cash grants.
         developmentCreditOnly:
           type: boolean
           title: development_credit_only
@@ -2605,6 +2750,12 @@ components:
     meter.v1.PrepaidCreditReconciliation:
       type: object
       properties:
+        compensatedDifferenceMicros:
+          type:
+            - integer
+            - string
+          title: compensated_difference_micros
+          format: int64
         grantedDifferenceMicros:
           type:
             - integer
@@ -2703,6 +2854,34 @@ components:
           $ref: '#/components/schemas/google.protobuf.Timestamp'
       title: PrepaidRunBalance
       additionalProperties: false
+    meter.v1.PreviewPrepaidCompensationRequest:
+      type: object
+      properties:
+        workspaceId:
+          type: string
+          title: workspace_id
+          maxLength: 256
+          minLength: 1
+        gatewayRequestIds:
+          type: array
+          items:
+            type: string
+            maxItems: 100
+          title: gateway_request_ids
+          maxItems: 100
+          minItems: 1
+      title: PreviewPrepaidCompensationRequest
+      additionalProperties: false
+    meter.v1.PreviewPrepaidCompensationResponse:
+      type: object
+      properties:
+        entries:
+          type: array
+          items:
+            $ref: '#/components/schemas/meter.v1.PrepaidCompensationEligibility'
+          title: entries
+      title: PreviewPrepaidCompensationResponse
+      additionalProperties: false
     meter.v1.QueryUsageRequest:
       type: object
       properties:
diff --git a/proto/connectors/v1/connectors.proto b/proto/connectors/v1/connectors.proto
index 81e2c7c..08abe68 100644
--- a/proto/connectors/v1/connectors.proto
+++ b/proto/connectors/v1/connectors.proto
@@ -181,7 +181,8 @@ service ConnectorService {
     option (common.v1.risk_level) = RISK_LEVEL_MEDIUM;
   }
   // CompleteOAuthFlow exchanges the authorization code for access/refresh
-  // tokens and registers the connection in one call.
+  // tokens. Providers that authorize more than one tenant return an explicit
+  // selection list; the caller completes the same state with selected_tenant_id.
   rpc CompleteOAuthFlow(CompleteOAuthFlowRequest) returns (CompleteOAuthFlowResponse) {
     option (common.v1.required_scopes) = "connectors:write";
     option (common.v1.organization_scope_field) = "organization_id";
@@ -271,6 +272,10 @@ enum AuthType {
   AUTH_TYPE_BASIC = 3;
   AUTH_TYPE_MTLS = 4;
   AUTH_TYPE_GITHUB_APP = 5;
+  // The provider endpoint is public and registration requires no credential.
+  // This is distinct from UNSPECIFIED, which asks the server to use the
+  // provider's configured default authentication type.
+  AUTH_TYPE_NONE = 6;
 }
 
 // HealthStatus describes the health state of a connection.
@@ -1183,8 +1188,10 @@ message CompleteOAuthFlowRequest {
   string provider_id = 3 [(buf.validate.field).string.min_len = 1];
   // State token returned from InitiateOAuthFlow.
   string state = 4 [(buf.validate.field).string.min_len = 1];
-  // Authorization code returned by the provider on the redirect.
-  string code = 5 [(buf.validate.field).string.min_len = 1];
+  // Authorization code returned by the provider on the redirect. Required on
+  // the first completion and empty only when selected_tenant_id completes an
+  // already-custodied multi-tenant authorization.
+  string code = 5;
   // Same redirect_uri passed to InitiateOAuthFlow; providers verify it.
   string redirect_uri = 6 [(buf.validate.field).string.min_len = 1];
   // Human-friendly label persisted on the connection record.
@@ -1193,10 +1200,24 @@ message CompleteOAuthFlowRequest {
   // Untrusted GitHub callback coordinate; verified against the authenticated
   // provider user and configured product App before connection registration.
   uint64 github_installation_id = 9;
+  // Exact provider tenant selected from a prior CompleteOAuthFlow response.
+  // Leave empty on the authorization-code exchange. The server never chooses
+  // an authorized tenant implicitly.
+  string selected_tenant_id = 10;
 }
 
 message CompleteOAuthFlowResponse {
   Connection connection = 1;
+  // Authorized provider tenants requiring explicit customer selection before
+  // the connection can be registered. Empty when connection is populated.
+  repeated OAuthProviderTenant authorized_tenants = 2;
+  bool tenant_selection_required = 3;
+}
+
+message OAuthProviderTenant {
+  string tenant_id = 1;
+  string tenant_name = 2;
+  string tenant_type = 3;
 }
 
 message InitiateMcpOAuthFlowRequest {
diff --git a/proto/console/v1/console.proto b/proto/console/v1/console.proto
index 6061b07..f1f2def 100644
--- a/proto/console/v1/console.proto
+++ b/proto/console/v1/console.proto
@@ -656,6 +656,7 @@ service ConsoleService {
   // ListIntegrationTiles returns setup and health tiles for onboarding.
   rpc ListIntegrationTiles(ListIntegrationTilesRequest) returns (ListIntegrationTilesResponse) {
     option (common.v1.required_scopes) = "console:read";
+    option (common.v1.required_scopes) = "connectors:read";
     option (common.v1.workspace_scope_field) = "query.workspace_id";
 
     option (common.v1.risk_level) = RISK_LEVEL_LOW;
@@ -986,6 +987,42 @@ service ConsoleService {
     option (common.v1.staff_account_required) = true;
     option (common.v1.risk_level) = RISK_LEVEL_MEDIUM;
   }
+  // PrepareStaffProductIssueRecovery advances the staff-reviewed recovery of charged failures.
+  rpc PrepareStaffProductIssueRecovery(PrepareStaffProductIssueRecoveryRequest) returns (ProductIssueRecoveryResponse) {
+    option (common.v1.required_scopes) = "support_access.manage";
+    option (common.v1.staff_account_required) = true;
+    option (common.v1.risk_level) = RISK_LEVEL_HIGH;
+  }
+  // ScanStaffProductIssueRecovery advances the staff-reviewed recovery of charged failures.
+  rpc ScanStaffProductIssueRecovery(ScanStaffProductIssueRecoveryRequest) returns (ProductIssueRecoveryResponse) {
+    option (common.v1.required_scopes) = "support_access.manage";
+    option (common.v1.staff_account_required) = true;
+    option (common.v1.risk_level) = RISK_LEVEL_HIGH;
+  }
+  // ReviewStaffProductIssueRecovery advances the staff-reviewed recovery of charged failures.
+  rpc ReviewStaffProductIssueRecovery(ReviewStaffProductIssueRecoveryRequest) returns (ProductIssueRecoveryResponse) {
+    option (common.v1.required_scopes) = "support_access.manage";
+    option (common.v1.staff_account_required) = true;
+    option (common.v1.risk_level) = RISK_LEVEL_HIGH;
+  }
+  // ExecuteStaffProductIssueRecovery advances the staff-reviewed recovery of charged failures.
+  rpc ExecuteStaffProductIssueRecovery(ExecuteStaffProductIssueRecoveryRequest) returns (ProductIssueRecoveryResponse) {
+    option (common.v1.required_scopes) = "support_access.manage";
+    option (common.v1.staff_account_required) = true;
+    option (common.v1.risk_level) = RISK_LEVEL_HIGH;
+  }
+  // GetProductIssueRecovery accesses only the authenticated recovery recipient or authorized staff.
+  rpc GetProductIssueRecovery(GetProductIssueRecoveryRequest) returns (ProductIssueRecoveryResponse) {
+    option (common.v1.required_scopes) = "console:read";
+    option (common.v1.workspace_scope_field) = "query.workspace_id";
+    option (common.v1.risk_level) = RISK_LEVEL_LOW;
+  }
+  // ReplyProductIssueRecovery accesses only the authenticated recovery recipient or authorized staff.
+  rpc ReplyProductIssueRecovery(ReplyProductIssueRecoveryRequest) returns (ProductIssueRecoveryResponse) {
+    option (common.v1.required_scopes) = "console:write";
+    option (common.v1.workspace_scope_field) = "query.workspace_id";
+    option (common.v1.risk_level) = RISK_LEVEL_LOW;
+  }
   // GetOperatingFeedback returns the latest durable feedback revision for one
   // Dex response, including a retraction marker when the operator removed it.
   rpc GetOperatingFeedback(GetOperatingFeedbackRequest) returns (GetOperatingFeedbackResponse) {
@@ -8575,6 +8612,8 @@ enum OperatingHomepageSuggestionFeedbackAction {
 
 // Model credits are separate from subscriptions; automatic refill requires explicit consent.
 message InferenceCreditBalance {
+  // Original cash charges restored through verified customer recovery.
+  int64 compensated_micros = 13 [(buf.validate.field).int64.gte = 0];
   // Non-cash development funding remains separate from purchased credits.
   int64 granted_micros = 8 [(buf.validate.field).int64.gte = 0];
   int64 expired_grant_micros = 9 [(buf.validate.field).int64.gte = 0];
@@ -8634,6 +8673,7 @@ message InferenceRunCreditBalance {
   google.protobuf.Timestamp oldest_pending_at = 6;
 }
 message InferenceCreditReconciliation {
+  int64 compensated_difference_micros = 10;
   // A comparison of materialized counters with source rows in one snapshot.
   bool balanced = 1;
   int64 purchased_difference_micros = 2;
@@ -10685,3 +10725,179 @@ message WorkspaceBrandVoice {
   uint64 version = 7;
   google.protobuf.Timestamp updated_at = 8;
 }
+
+// Durable, explicitly scoped customer recovery contract.
+message PrepareStaffProductIssueRecoveryRequest {
+  string organization_id = 1 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string workspace_id = 2 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string source_organization_id = 3 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string source_workspace_id = 4 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string report_id = 5 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string error_code = 6 [
+    (common.v1.classification) = DATA_CLASSIFICATION_SAFE,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  int64 start_unix_seconds = 7;
+  int64 end_unix_seconds = 8;
+  string recipient_principal_id = 9 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string customer_summary = 10 [
+    (common.v1.classification) = DATA_CLASSIFICATION_CONTENT,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string deployment_verification = 11 [
+    (common.v1.classification) = DATA_CLASSIFICATION_CONTENT,
+    (buf.validate.field).string.max_len = 4000
+  ];
+}
+
+// Durable, explicitly scoped customer recovery contract.
+message ScanStaffProductIssueRecoveryRequest {
+  string organization_id = 1 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string workspace_id = 2 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string recovery_id = 3 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  int64 expected_revision = 4;
+}
+
+message ReviewStaffProductIssueRecoveryRequest {
+  string organization_id = 1 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string workspace_id = 2 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string recovery_id = 3 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  int64 expected_revision = 4;
+}
+
+message ExecuteStaffProductIssueRecoveryRequest {
+  string organization_id = 1 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string workspace_id = 2 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string recovery_id = 3 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  int64 expected_revision = 4;
+}
+
+// Durable, explicitly scoped customer recovery contract.
+message GetProductIssueRecoveryRequest {
+  ConsoleQuery query = 1;
+  string recovery_id = 2 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+}
+
+// Durable, explicitly scoped customer recovery contract.
+message ReplyProductIssueRecoveryRequest {
+  ConsoleQuery query = 1;
+  string recovery_id = 2 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string idempotency_key = 3 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string message = 4 [
+    (common.v1.classification) = DATA_CLASSIFICATION_CONTENT,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  bool resolved = 5;
+}
+
+// Durable, explicitly scoped customer recovery contract.
+message ProductIssueRecovery {
+  string organization_id = 1 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string workspace_id = 2 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string recovery_id = 3 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string report_reference = 4 [
+    (common.v1.classification) = DATA_CLASSIFICATION_SAFE,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string recipient_principal_id = 5 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string customer_summary = 6 [
+    (common.v1.classification) = DATA_CLASSIFICATION_CONTENT,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string state = 7 [
+    (common.v1.classification) = DATA_CLASSIFICATION_SAFE,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  int64 revision = 8;
+  int64 affected_request_count = 9;
+  int64 expected_credit_micros = 10;
+  int64 compensated_micros = 11;
+  int64 remaining_request_count = 12;
+  string notification_id = 13 [
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string last_reply = 14 [
+    (common.v1.classification) = DATA_CLASSIFICATION_CONTENT,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string coverage = 15 [
+    (common.v1.classification) = DATA_CLASSIFICATION_SAFE,
+    (buf.validate.field).string.max_len = 4000
+  ];
+  string deployment_verification = 16 [
+    (common.v1.classification) = DATA_CLASSIFICATION_CONTENT,
+    (buf.validate.field).string.max_len = 4000
+  ];
+}
+
+// Durable, explicitly scoped customer recovery contract.
+message ProductIssueRecoveryResponse {
+  ProductIssueRecovery recovery = 1;
+}
diff --git a/proto/deixic/v1/deixic.proto b/proto/deixic/v1/deixic.proto
index 4b68d95..a595b92 100644
--- a/proto/deixic/v1/deixic.proto
+++ b/proto/deixic/v1/deixic.proto
@@ -430,6 +430,7 @@ service DeixicService {
   // Uses the canonical console.v1.ConsoleService.ListIntegrationTiles message contract.
   rpc ListIntegrationTiles(console.v1.ListIntegrationTilesRequest) returns (console.v1.ListIntegrationTilesResponse) {
     option (common.v1.required_scopes) = "console:read";
+    option (common.v1.required_scopes) = "connectors:read";
     option (common.v1.workspace_scope_field) = "query.workspace_id";
 
     option (common.v1.risk_level) = RISK_LEVEL_LOW;
@@ -1217,6 +1218,42 @@ service DeixicService {
     option (common.v1.risk_level) = RISK_LEVEL_MEDIUM;
   }
 
+  // PrepareStaffProductIssueRecovery advances the staff-reviewed recovery of charged failures.
+  rpc PrepareStaffProductIssueRecovery(console.v1.PrepareStaffProductIssueRecoveryRequest) returns (console.v1.ProductIssueRecoveryResponse) {
+    option (common.v1.required_scopes) = "support_access.manage";
+    option (common.v1.staff_account_required) = true;
+    option (common.v1.risk_level) = RISK_LEVEL_HIGH;
+  }
+  // ScanStaffProductIssueRecovery advances the staff-reviewed recovery of charged failures.
+  rpc ScanStaffProductIssueRecovery(console.v1.ScanStaffProductIssueRecoveryRequest) returns (console.v1.ProductIssueRecoveryResponse) {
+    option (common.v1.required_scopes) = "support_access.manage";
+    option (common.v1.staff_account_required) = true;
+    option (common.v1.risk_level) = RISK_LEVEL_HIGH;
+  }
+  // ReviewStaffProductIssueRecovery advances the staff-reviewed recovery of charged failures.
+  rpc ReviewStaffProductIssueRecovery(console.v1.ReviewStaffProductIssueRecoveryRequest) returns (console.v1.ProductIssueRecoveryResponse) {
+    option (common.v1.required_scopes) = "support_access.manage";
+    option (common.v1.staff_account_required) = true;
+    option (common.v1.risk_level) = RISK_LEVEL_HIGH;
+  }
+  // ExecuteStaffProductIssueRecovery advances the staff-reviewed recovery of charged failures.
+  rpc ExecuteStaffProductIssueRecovery(console.v1.ExecuteStaffProductIssueRecoveryRequest) returns (console.v1.ProductIssueRecoveryResponse) {
+    option (common.v1.required_scopes) = "support_access.manage";
+    option (common.v1.staff_account_required) = true;
+    option (common.v1.risk_level) = RISK_LEVEL_HIGH;
+  }
+  // GetProductIssueRecovery accesses only the authenticated recovery recipient or authorized staff.
+  rpc GetProductIssueRecovery(console.v1.GetProductIssueRecoveryRequest) returns (console.v1.ProductIssueRecoveryResponse) {
+    option (common.v1.required_scopes) = "console:read";
+    option (common.v1.workspace_scope_field) = "query.workspace_id";
+    option (common.v1.risk_level) = RISK_LEVEL_LOW;
+  }
+  // ReplyProductIssueRecovery accesses only the authenticated recovery recipient or authorized staff.
+  rpc ReplyProductIssueRecovery(console.v1.ReplyProductIssueRecoveryRequest) returns (console.v1.ProductIssueRecoveryResponse) {
+    option (common.v1.required_scopes) = "console:write";
+    option (common.v1.workspace_scope_field) = "query.workspace_id";
+    option (common.v1.risk_level) = RISK_LEVEL_LOW;
+  }
   // Uses the canonical console.v1.ConsoleService.GetOperatingFeedback message contract.
   rpc GetOperatingFeedback(console.v1.GetOperatingFeedbackRequest) returns (console.v1.GetOperatingFeedbackResponse) {
     option (common.v1.required_scopes) = "console:read";
diff --git a/proto/meter/v1/meter.proto b/proto/meter/v1/meter.proto
index 67a631b..90fbc8c 100644
--- a/proto/meter/v1/meter.proto
+++ b/proto/meter/v1/meter.proto
@@ -62,6 +62,18 @@ service MeterService {
     option (common.v1.workspace_scope_field) = "workspace_id";
     option (common.v1.risk_level) = RISK_LEVEL_HIGH;
   }
+  // Read original settlement eligibility without accepting or issuing compensation.
+  rpc PreviewPrepaidCompensation(PreviewPrepaidCompensationRequest) returns (PreviewPrepaidCompensationResponse) {
+    option (common.v1.required_scopes) = "meter:credits:compensate";
+    option (common.v1.workspace_scope_field) = "workspace_id";
+    option (common.v1.risk_level) = RISK_LEVEL_LOW;
+  }
+  // Restore a cash-funded settled request once across all recovery incidents.
+  rpc CompensatePrepaidCredit(CompensatePrepaidCreditRequest) returns (CompensatePrepaidCreditResponse) {
+    option (common.v1.required_scopes) = "meter:credits:compensate";
+    option (common.v1.workspace_scope_field) = "workspace_id";
+    option (common.v1.risk_level) = RISK_LEVEL_HIGH;
+  }
   // SettlePrepaidCredits operates only on the caller's authorized organization and workspace.
   rpc SettlePrepaidCredits(SettlePrepaidCreditsRequest) returns (SettlePrepaidCreditsResponse) {
     option (common.v1.required_scopes) = "meter:credits:settle";
@@ -761,6 +773,8 @@ message GetEventDashboardResponse {
 // Prepaid credits are USD amounts in integer millionths of a dollar.
 // Meter owns funding, reservations, settlement, and the available balance.
 message PrepaidCreditBalance {
+  // Cash recovery, separate from purchases and non-cash grants.
+  int64 compensated_micros = 13 [(buf.validate.field).int64.gte = 0];
   // Enrolled development programs cannot consume paid credits or trigger paid refill.
   bool development_credit_only = 12;
   // Non-cash development funding, kept separate from purchased credits.
@@ -805,6 +819,7 @@ message PrepaidRunBalance {
   google.protobuf.Timestamp oldest_pending_at = 6;
 }
 message PrepaidCreditReconciliation {
+  int64 compensated_difference_micros = 12;
   int64 granted_difference_micros = 10;
   int64 invalid_grant_allocation_count = 11 [(buf.validate.field).int64.gte = 0];
   // A comparison of materialized counters with source rows in one snapshot.
@@ -1052,3 +1067,56 @@ message ReserveWorkCreditsResponse {
   // True only for the atomic first reservation; false never authorizes execution.
   bool created = 3;
 }
+
+// Organization and actor come exclusively from the authenticated recovery service.
+message CompensatePrepaidCreditRequest {
+  string workspace_id = 1 [
+    (buf.validate.field).string.min_len = 1,
+    (buf.validate.field).string.max_len = 256,
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER
+  ];
+  string gateway_request_id = 2 [
+    (buf.validate.field).string.min_len = 1,
+    (buf.validate.field).string.max_len = 256,
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER
+  ];
+  string incident_id = 3 [
+    (buf.validate.field).string.min_len = 1,
+    (buf.validate.field).string.max_len = 256,
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER
+  ];
+  string idempotency_key = 4 [
+    (buf.validate.field).string.min_len = 1,
+    (buf.validate.field).string.max_len = 256,
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER
+  ];
+}
+message CompensatePrepaidCreditResponse {
+  int64 compensated_micros = 1 [(buf.validate.field).int64.gt = 0];
+  string receipt_id = 2 [(common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER];
+  // Another incident or retry already restored this original charge.
+  bool duplicate = 3;
+}
+
+message PreviewPrepaidCompensationRequest {
+  string workspace_id = 1 [
+    (buf.validate.field).string.min_len = 1,
+    (buf.validate.field).string.max_len = 256,
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER
+  ];
+  repeated string gateway_request_ids = 2 [
+    (buf.validate.field).repeated.min_items = 1,
+    (buf.validate.field).repeated.max_items = 100,
+    (common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER
+  ];
+}
+message PrepaidCompensationEligibility {
+  string gateway_request_id = 1 [(common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER];
+  bool eligible = 2;
+  int64 credit_micros = 3 [(buf.validate.field).int64.gte = 0];
+  // Stable owner codes: eligible, not_found, unsettled, zero_charge, grant_funded.
+  string reason = 4 [(common.v1.classification) = DATA_CLASSIFICATION_SAFE];
+}
+message PreviewPrepaidCompensationResponse {
+  repeated PrepaidCompensationEligibility entries = 1;
+}