deepline 0.3.248 → 0.3.250

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/runtime-event-search.ts

@@ -12,7 +12,7 @@ const EVENTS_TABLE = 'runtime_observability.events';
 // Migration readiness tracks this projection body independently of scheduler
 // wire and schema versions. Bump when a changed trigger must be reinstalled.
 export const RUNTIME_EVENT_SEARCH_OUTBOX_PROJECTION_MARKER =
-  'runtime-event-search-log-context-v7-terminal-progress-counts-auto-scope-log-mutex-channel-aliases';
+  'runtime-event-search-log-context-v8-terminal-progress-counts-compact-first-progress-channel-aliases';
 export const RUNTIME_EVENTS_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
 const MAX_SEARCH_WINDOW_MS = RUNTIME_EVENTS_RETENTION_MS;
 const MAX_SEARCH_RESULTS = 200;
@@ -459,6 +459,7 @@ export async function getRuntimeRunLogPage(
          FROM runtime_observability.events
         WHERE runtime_scope = $1 AND org_id = $2 AND run_id = $3
           AND kind = 'log.appended' AND log_seq IS NOT NULL
+          AND (log_body IS NOT NULL OR message IS NOT NULL)
           AND ingested_at >= clock_timestamp() - interval '7 days'
      ), run_cursor AS (
        SELECT last_seq
@@ -469,6 +470,7 @@ export async function getRuntimeRunLogPage(
          FROM runtime_observability.events
         WHERE runtime_scope = $1 AND org_id = $2 AND run_id = $3
           AND kind = 'log.appended' AND log_seq IS NOT NULL
+          AND (log_body IS NOT NULL OR message IS NOT NULL)
           AND ingested_at >= clock_timestamp() - interval '7 days'
           ${pageWhere}
         ORDER BY log_seq ${pageOrder}
@@ -798,56 +800,60 @@ export async function attachRuntimeEventSearchTriggers(
     END IF;
   END $create$`);
   await client.query(`
-    CREATE OR REPLACE FUNCTION ${schema}.search_outbox_event() RETURNS trigger
+    CREATE OR REPLACE FUNCTION ${schema}.project_outbox_event(observation ${schema}.outbox) RETURNS void
     LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
-    DECLARE run_org text; play text; item jsonb; line jsonb; event_batch jsonb;
+    DECLARE run_org text; play text; compact_logs boolean; run_status text; item jsonb; line jsonb; event_batch jsonb;
             ordinal bigint; line_ordinal bigint; kind text; at_time timestamptz;
             doc jsonb; line_doc jsonb; line_context jsonb;
-            eid text; existing_digest text; digest text; assigned_seq bigint;
+            eid text; existing_digest text; digest text; assigned_seq bigint; terminal_progress_identity boolean;
             log_channel text; log_position bigint; matched_event_id text; matched_doc jsonb;
             legacy_position_prefix text; log_alias jsonb; envelope_attempt jsonb;
             line_count bigint; fresh_event_ids text[] := ARRAY[]::text[];
             recent_log_keys jsonb := '{}'::jsonb; dedupe_key text;
             terminal_overlap_counts jsonb := '{}'::jsonb;
-            recent_log_keys_loaded boolean := false;
+            recent_log_keys_loaded boolean := false; recent_log_attempt text;
     BEGIN
-      -- Serialize log ordering without taking scheduler Run/attempt row locks.
-      -- Completion writers can own an attempt before updating its Run.
-      PERFORM pg_advisory_xact_lock(hashtext(${quoteLiteral(scope)}), hashtext(NEW.run_id));
-      SELECT org_id, play_name INTO run_org, play FROM ${schema}.runs WHERE run_id = NEW.run_id;
+      -- Log ordering owns a transaction-scoped mutex, independent of the
+      -- scheduler's Run/attempt row-lock order. In particular, old completion
+      -- writers lock attempt before Run; this recorder must not invert that.
+      PERFORM pg_advisory_xact_lock(hashtext(${quoteLiteral(scope)}), hashtext(observation.run_id));
+      SELECT org_id, play_name, run_log_store = 'planet_scale', status
+        INTO run_org, play, compact_logs, run_status
+        FROM ${schema}.runs WHERE run_id = observation.run_id;
       IF run_org IS NULL OR play IS NULL THEN
         RAISE EXCEPTION 'Outbox search projection has no matching run';
       END IF;
-      IF NEW.event_type = 'run.events' THEN
-        event_batch := NEW.payload_json->'events';
+      IF observation.event_type = 'run.events' THEN
+        event_batch := observation.payload_json->'events';
         IF jsonb_typeof(event_batch) IS DISTINCT FROM 'array' THEN
           RAISE EXCEPTION 'Search projection requires run.events array';
         END IF;
-        IF jsonb_array_length(event_batch) = 0 THEN
+        IF jsonb_array_length(event_batch) = 0
+          AND observation.payload_json->>'logBodyStore' IS DISTINCT FROM 'planet_scale' THEN
           RAISE EXCEPTION 'Search projection requires nonempty run.events array';
         END IF;
-      ELSIF NEW.event_type IN ('run.completed', 'run.failed')
-        AND NEW.payload_json ? 'terminalProgressEvents' THEN
-        event_batch := NEW.payload_json->'terminalProgressEvents';
+      ELSIF observation.event_type IN ('run.completed', 'run.failed', 'runner.logs')
+        AND observation.payload_json ? 'terminalProgressEvents' THEN
+        event_batch := observation.payload_json->'terminalProgressEvents';
         IF jsonb_typeof(event_batch) IS DISTINCT FROM 'array' THEN
           RAISE EXCEPTION 'Search projection requires terminalProgressEvents array';
         END IF;
       END IF;
       -- Ordinary terminal SQL already binds the attempt in its counter
       -- segment; compact carriers also name it at the top level.
-      envelope_attempt := coalesce(NULLIF(NEW.payload_json->'producerAttempt', 'null'::jsonb),
-        NEW.payload_json->'terminalWorkCounterSegment'->'attempt');
+      envelope_attempt := coalesce(NULLIF(observation.payload_json->'producerAttempt', 'null'::jsonb),
+        observation.payload_json->'terminalWorkCounterSegment'->'attempt');
       -- The retained envelope has its own position space: it can contain
       -- diagnostics absent from both live delivery and ctx-only replay.
-      IF NEW.event_type IN ('run.completed', 'run.failed')
-        AND NEW.payload_json ? 'terminalLogLines'
+      IF observation.event_type IN ('run.completed', 'run.failed', 'runner.logs')
+        AND observation.payload_json ? 'terminalLogLines'
         AND (envelope_attempt #>> '{}') ~ '^[1-9][0-9]{0,5}$' THEN
         event_batch := coalesce(event_batch, '[]'::jsonb) || jsonb_build_array(
           jsonb_strip_nulls(jsonb_build_object(
-            'type', 'log.appended', 'runId', NEW.run_id, 'source', 'terminal',
+            'type', 'log.appended', 'runId', observation.run_id, 'source', 'terminal',
             'producerAttempt', envelope_attempt, 'channelOffset', 0,
-            'lines', NEW.payload_json->'terminalLogLines',
-            'lineContexts', NEW.payload_json->'terminalLogContexts'
+            'lines', observation.payload_json->'terminalLogLines',
+            'lineContexts', observation.payload_json->'terminalLogContexts'
           ))
         );
       END IF;
@@ -860,21 +866,21 @@ export async function attachRuntimeEventSearchTriggers(
           UPDATE runtime_observability.events AS event SET search_doc = event.search_doc ||
             jsonb_build_object('logContentDigest', event.source_digest) ||
             CASE WHEN NOT (event.search_doc ? 'logPositions')
-              AND left(event.event_id, length('log:' || NEW.run_id || ':' || (event.search_doc->>'producerAttempt') || ':')) =
-                'log:' || NEW.run_id || ':' || (event.search_doc->>'producerAttempt') || ':'
-              AND substring(event.event_id FROM length('log:' || NEW.run_id || ':' || (event.search_doc->>'producerAttempt') || ':') + 1) ~ '^[0-9]{1,12}$'
+              AND left(event.event_id, length('log:' || observation.run_id || ':' || (event.search_doc->>'producerAttempt') || ':')) =
+                'log:' || observation.run_id || ':' || (event.search_doc->>'producerAttempt') || ':'
+              AND substring(event.event_id FROM length('log:' || observation.run_id || ':' || (event.search_doc->>'producerAttempt') || ':') + 1) ~ '^[0-9]{1,12}$'
               THEN jsonb_build_object('logPositions', jsonb_build_object(
                 CASE WHEN event.search_doc->>'source' = 'coordinator' THEN 'replay' ELSE 'worker' END,
-                substring(event.event_id FROM length('log:' || NEW.run_id || ':' || (event.search_doc->>'producerAttempt') || ':') + 1)::bigint))
+                substring(event.event_id FROM length('log:' || observation.run_id || ':' || (event.search_doc->>'producerAttempt') || ':') + 1)::bigint))
               ELSE '{}'::jsonb END
            WHERE event.runtime_scope = ${quoteLiteral(scope)} AND event.org_id = run_org
-             AND event.run_id = NEW.run_id AND event.kind = 'log.appended'
+             AND event.run_id = observation.run_id AND event.kind = 'log.appended'
              AND event.source_digest IS NOT NULL AND NOT (event.search_doc ? 'logContentDigest')
              AND (event.search_doc->>'producerAttempt') ~ '^[1-9][0-9]{0,5}$';
         END IF;
         FOR item, ordinal IN SELECT value, ordinality FROM jsonb_array_elements(event_batch) WITH ORDINALITY LOOP
           IF jsonb_typeof(item) IS DISTINCT FROM 'object'
-            OR item->>'runId' IS DISTINCT FROM NEW.run_id THEN
+            OR item->>'runId' IS DISTINCT FROM observation.run_id THEN
             RAISE EXCEPTION 'Search projection event has invalid run identity';
           END IF;
           kind := coalesce(item->>'type', item->>'key');
@@ -889,7 +895,7 @@ export async function attachRuntimeEventSearchTriggers(
           END IF;
           at_time := CASE WHEN (item->>'occurredAt') ~ '^[0-9]{12,14}$'
             THEN to_timestamp((item->>'occurredAt')::double precision / 1000)
-            ELSE NEW.created_at END;
+            ELSE observation.created_at END;
           doc := jsonb_strip_nulls(jsonb_build_object(
             'kind', kind, 'source', left(item->>'source', 64),
             'producerAttempt', CASE WHEN (item->>'producerAttempt') ~ '^[0-9]{1,6}$'
@@ -920,19 +926,22 @@ export async function attachRuntimeEventSearchTriggers(
               END IF;
               IF (item->>'source' IS DISTINCT FROM 'coordinator')
                 AND NOT coalesce((item->>'channelOffset') ~ '^[0-9]{1,12}$', false) THEN
-                IF NOT recent_log_keys_loaded THEN
+                IF NOT recent_log_keys_loaded OR recent_log_attempt IS DISTINCT FROM item->>'producerAttempt' THEN
                   SELECT coalesce(jsonb_object_agg(recent.dedupe_key, true), '{}'::jsonb)
                     INTO recent_log_keys
                     FROM (
-                      SELECT encode(sha256(convert_to(btrim(event.log_body), 'UTF8')), 'hex') AS dedupe_key
+                      SELECT coalesce(event.log_text_digest, encode(sha256(convert_to(btrim(event.log_body), 'UTF8')), 'hex')) AS dedupe_key
                         FROM runtime_observability.events AS event
                        WHERE event.runtime_scope = ${quoteLiteral(scope)} AND event.org_id = run_org
-                         AND event.run_id = NEW.run_id AND event.kind = 'log.appended'
-                         AND event.log_seq IS NOT NULL AND event.log_body IS NOT NULL
+                         AND event.run_id = observation.run_id AND event.kind = 'log.appended'
+                         AND event.log_seq IS NOT NULL AND (event.log_text_digest IS NOT NULL OR event.log_body IS NOT NULL)
+                         AND (item->>'producerAttempt' IS NULL
+                           OR event.search_doc->>'producerAttempt' = item->>'producerAttempt')
                        ORDER BY event.log_seq DESC
                        LIMIT 256
                     ) AS recent;
                   recent_log_keys_loaded := true;
+                  recent_log_attempt := item->>'producerAttempt';
                 END IF;
                 dedupe_key := encode(
                   sha256(convert_to(btrim(line #>> '{}'), 'UTF8')), 'hex'
@@ -973,9 +982,9 @@ export async function attachRuntimeEventSearchTriggers(
                 ELSE doc || jsonb_build_object('context', line_context) END;
               eid := CASE WHEN (item->>'channelOffset') ~ '^[0-9]{1,12}$'
                 AND (item->>'producerAttempt') ~ '^[0-9]{1,6}$'
-                THEN 'log:' || NEW.run_id || ':' || (item->>'producerAttempt') || ':' ||
+                THEN 'log:' || observation.run_id || ':' || (item->>'producerAttempt') || ':' ||
                      ((item->>'channelOffset')::bigint + line_ordinal - 1)::text
-                ELSE NEW.event_id || ':' || ordinal || ':' || line_ordinal END;
+                ELSE observation.event_id || ':' || ordinal || ':' || line_ordinal END;
               digest := CASE WHEN line_context IS NULL
                 THEN encode(sha256(convert_to(line #>> '{}', 'UTF8')), 'hex')
                 ELSE encode(sha256(convert_to(jsonb_build_array(line #>> '{}', line_context)::text, 'UTF8')), 'hex') END;
@@ -987,9 +996,9 @@ export async function attachRuntimeEventSearchTriggers(
                   WHEN 'coordinator' THEN 'replay' WHEN 'terminal' THEN 'envelope'
                   ELSE 'worker' END;
                 log_position := (item->>'channelOffset')::bigint + line_ordinal - 1;
-                legacy_position_prefix := 'log:' || NEW.run_id || ':' || (item->>'producerAttempt') || ':';
+                legacy_position_prefix := 'log:' || observation.run_id || ':' || (item->>'producerAttempt') || ':';
                 eid := CASE WHEN log_channel = 'worker' THEN legacy_position_prefix
-                  ELSE 'log-' || log_channel || ':' || NEW.run_id || ':' || (item->>'producerAttempt') || ':' END
+                  ELSE 'log-' || log_channel || ':' || observation.run_id || ':' || (item->>'producerAttempt') || ':' END
                   || log_position::text;
                 -- Older coordinator replays used the worker-shaped primary
                 -- key. Do not overwrite it when a delayed worker owns a
@@ -1000,7 +1009,7 @@ export async function attachRuntimeEventSearchTriggers(
                      AND search_doc->>'source' = 'coordinator'
                      AND NOT (coalesce(search_doc->'logPositions', '{}'::jsonb) ? 'worker')
                 ) THEN
-                  eid := 'log-worker:' || NEW.run_id || ':' || (item->>'producerAttempt') || ':' || log_position::text;
+                  eid := 'log-worker:' || observation.run_id || ':' || (item->>'producerAttempt') || ':' || log_position::text;
                 END IF;
                 log_alias := jsonb_build_object('producerAttempt', (item->>'producerAttempt')::integer,
                   'logPositions', jsonb_build_object(log_channel, log_position));
@@ -1011,7 +1020,7 @@ export async function attachRuntimeEventSearchTriggers(
                   INTO matched_event_id, existing_digest, matched_doc
                   FROM runtime_observability.events AS event
                  WHERE event.runtime_scope = ${quoteLiteral(scope)} AND event.org_id = run_org
-                   AND event.run_id = NEW.run_id AND event.kind = 'log.appended'
+                   AND event.run_id = observation.run_id AND event.kind = 'log.appended'
                    AND event.search_doc @> log_alias;
                 IF matched_event_id IS NOT NULL THEN
                   IF existing_digest IS DISTINCT FROM digest THEN
@@ -1026,7 +1035,7 @@ export async function attachRuntimeEventSearchTriggers(
                   INTO matched_event_id, matched_doc
                   FROM runtime_observability.events AS event
                  WHERE event.runtime_scope = ${quoteLiteral(scope)} AND event.org_id = run_org
-                   AND event.run_id = NEW.run_id AND event.kind = 'log.appended'
+                   AND event.run_id = observation.run_id AND event.kind = 'log.appended'
                    AND event.search_doc @> jsonb_build_object(
                      'producerAttempt', (item->>'producerAttempt')::integer, 'logContentDigest', digest)
                    AND event.source_digest = digest
@@ -1043,12 +1052,24 @@ export async function attachRuntimeEventSearchTriggers(
                 END IF;
                 line_doc := line_doc || log_alias || jsonb_build_object('logContentDigest', digest);
               END IF;
+              -- Serialize with terminal acceptance on the log mutex. A late
+              -- retry of an accepted position is harmless; a new position
+              -- after terminal closure must never recreate expired history.
+              IF compact_logs AND observation.event_type = 'run.events'
+                AND run_status IN ('completed', 'failed', 'cancelled')
+                AND NOT EXISTS (SELECT 1 FROM runtime_observability.events
+                  WHERE runtime_scope = ${quoteLiteral(scope)} AND org_id = run_org
+                    AND event_id = eid) THEN
+                RAISE EXCEPTION 'Run log ingress is closed after terminal acceptance';
+              END IF;
               INSERT INTO runtime_observability.events (
                 runtime_scope, org_id, event_id, occurred_at, run_id, play_name,
-                kind, level, message, log_body, source_digest, search_doc
+                kind, level, message, log_body, source_digest, log_text_digest, search_doc
               ) VALUES (
-                ${quoteLiteral(scope)}, run_org, eid, at_time, NEW.run_id, play,
-                'log.appended', NULL, left(line #>> '{}', 2048), line #>> '{}', digest, line_doc
+                ${quoteLiteral(scope)}, run_org, eid, at_time, observation.run_id, play,
+                'log.appended', NULL, CASE WHEN compact_logs THEN NULL ELSE left(line #>> '{}', 2048) END,
+                line #>> '{}', digest,
+                encode(sha256(convert_to(btrim(line #>> '{}'), 'UTF8')), 'hex'), line_doc
               ) ON CONFLICT DO NOTHING;
               IF FOUND THEN
                 fresh_event_ids := array_append(fresh_event_ids, eid);
@@ -1062,45 +1083,64 @@ export async function attachRuntimeEventSearchTriggers(
               END IF;
             END LOOP;
           ELSE
+            -- Final progress may arrive in the first terminal receipt and
+            -- again in completion. One attempt/ordinal owns one immutable fact.
+            terminal_progress_identity := observation.event_type IN ('runner.logs', 'run.completed', 'run.failed')
+              AND coalesce((observation.payload_json->>'producerAttempt') ~ '^[1-9][0-9]{0,5}$', false);
+            eid := CASE WHEN terminal_progress_identity
+              THEN 'terminal-progress:' || observation.run_id || ':' ||
+                (observation.payload_json->>'producerAttempt') || ':' ||
+                coalesce(item->>'_runtimeProgressOrdinal', ordinal::text)
+              ELSE observation.event_id || ':' || ordinal END;
+            digest := CASE WHEN terminal_progress_identity
+              THEN encode(sha256(convert_to(item::text, 'UTF8')), 'hex') ELSE NULL END;
             INSERT INTO runtime_observability.events (
               runtime_scope, org_id, event_id, occurred_at, run_id, play_name,
-              kind, search_doc
+              kind, source_digest, search_doc
             ) VALUES (
-              ${quoteLiteral(scope)}, run_org, NEW.event_id || ':' || ordinal,
-              at_time, NEW.run_id, play, kind, doc
-            );
+              ${quoteLiteral(scope)}, run_org, eid,
+              at_time, observation.run_id, play, kind, digest, doc
+            ) ON CONFLICT DO NOTHING;
+            IF NOT FOUND AND terminal_progress_identity THEN
+              SELECT source_digest INTO existing_digest FROM runtime_observability.events
+               WHERE runtime_scope = ${quoteLiteral(scope)} AND org_id = run_org AND event_id = eid;
+              IF existing_digest IS DISTINCT FROM digest THEN
+                RAISE EXCEPTION 'Progress event identity changed its content';
+              END IF;
+            END IF;
           END IF;
         END LOOP;
       END IF;
-      IF NEW.event_type IN (
+      IF observation.event_type IN (
         'run.created', 'run.started', 'run.waiting', 'run.resumed',
         'run.completed', 'run.failed', 'run.cancelled'
-      ) AND NOT (NEW.event_type IN ('run.waiting', 'run.resumed')
-                 AND NEW.payload_json->>'kind' = 'detached_runner') THEN
+      ) AND NOT (observation.event_type IN ('run.waiting', 'run.resumed')
+                 AND observation.payload_json->>'kind' = 'detached_runner') THEN
         INSERT INTO runtime_observability.events (
           runtime_scope, org_id, event_id, occurred_at, run_id, play_name,
           kind, search_doc
         ) VALUES (
-          ${quoteLiteral(scope)}, run_org, NEW.event_id, NEW.created_at,
-          NEW.run_id, play, NEW.event_type, jsonb_build_object('kind', NEW.event_type, 'source', 'system')
-        );
+          ${quoteLiteral(scope)}, run_org, observation.event_id, observation.created_at,
+          observation.run_id, play, observation.event_type, jsonb_build_object('kind', observation.event_type, 'source', 'system')
+        ) ON CONFLICT DO NOTHING;
+      END IF;
+      IF observation.event_type IN ('run.completed', 'run.failed', 'runner.logs') THEN
         -- Detached runners deliver their retained ctx.log tail in the terminal
         -- outbox fact rather than a run.events batch. Project it from that
         -- authoritative write so search and the existing log stream agree.
-        IF NEW.event_type IN ('run.completed', 'run.failed')
-          AND NEW.payload_json ? 'terminalLogContexts'
-          AND NOT (NEW.payload_json ? 'terminalLogLines') THEN
+        IF observation.payload_json ? 'terminalLogContexts'
+          AND NOT (observation.payload_json ? 'terminalLogLines') THEN
           RAISE EXCEPTION 'Search projection requires terminalLogLines for terminalLogContexts';
         END IF;
-        IF NEW.event_type IN ('run.completed', 'run.failed')
-          AND NEW.payload_json ? 'terminalLogLines'
+        IF observation.event_type IN ('run.completed', 'run.failed', 'runner.logs')
+          AND observation.payload_json ? 'terminalLogLines'
           AND NOT coalesce((envelope_attempt #>> '{}') ~ '^[1-9][0-9]{0,5}$', false) THEN
-          IF jsonb_typeof(NEW.payload_json->'terminalLogLines') IS DISTINCT FROM 'array' THEN
+          IF jsonb_typeof(observation.payload_json->'terminalLogLines') IS DISTINCT FROM 'array' THEN
             RAISE EXCEPTION 'Search projection requires terminalLogLines array';
           END IF;
-          IF NEW.payload_json ? 'terminalLogContexts'
-            AND (jsonb_typeof(NEW.payload_json->'terminalLogContexts') IS DISTINCT FROM 'array'
-                 OR jsonb_array_length(NEW.payload_json->'terminalLogContexts') <> jsonb_array_length(NEW.payload_json->'terminalLogLines')) THEN
+          IF observation.payload_json ? 'terminalLogContexts'
+            AND (jsonb_typeof(observation.payload_json->'terminalLogContexts') IS DISTINCT FROM 'array'
+                 OR jsonb_array_length(observation.payload_json->'terminalLogContexts') <> jsonb_array_length(observation.payload_json->'terminalLogLines')) THEN
             RAISE EXCEPTION 'Search projection requires terminalLogContexts aligned to terminalLogLines';
           END IF;
           -- Count matching bodies already projected, including progress lines
@@ -1115,30 +1155,34 @@ export async function attachRuntimeEventSearchTriggers(
             FROM (
               SELECT candidate.dedupe_key, count(*) AS occurrences
                 FROM (
-                  SELECT encode(sha256(convert_to(btrim(recent.log_body), 'UTF8')), 'hex') AS dedupe_key
+                  SELECT coalesce(recent.log_text_digest, encode(sha256(convert_to(btrim(recent.log_body), 'UTF8')), 'hex')) AS dedupe_key
                     FROM (
-                      SELECT event.log_body
+                      SELECT event.log_body, event.log_text_digest
                         FROM runtime_observability.events AS event
                        WHERE event.runtime_scope = ${quoteLiteral(scope)}
-                         AND event.org_id = run_org AND event.run_id = NEW.run_id
+                         AND event.org_id = run_org AND event.run_id = observation.run_id
                          AND event.kind = 'log.appended'
-                         AND event.log_seq IS NOT NULL AND event.log_body IS NOT NULL
+                         AND (observation.payload_json->>'producerAttempt' IS NULL
+                           OR event.search_doc->>'producerAttempt' = observation.payload_json->>'producerAttempt')
+                         AND event.log_seq IS NOT NULL AND (event.log_text_digest IS NOT NULL OR event.log_body IS NOT NULL)
                        ORDER BY event.log_seq DESC
                        LIMIT 256
                     ) AS recent
                   UNION ALL
-                  SELECT encode(sha256(convert_to(btrim(event.log_body), 'UTF8')), 'hex')
+                  SELECT coalesce(event.log_text_digest, encode(sha256(convert_to(btrim(event.log_body), 'UTF8')), 'hex'))
                     FROM runtime_observability.events AS event
                    WHERE event.runtime_scope = ${quoteLiteral(scope)}
-                     AND event.org_id = run_org AND event.run_id = NEW.run_id
-                     AND event.kind = 'log.appended' AND event.log_body IS NOT NULL
+                     AND event.org_id = run_org AND event.run_id = observation.run_id
+                     AND event.kind = 'log.appended' AND (event.log_text_digest IS NOT NULL OR event.log_body IS NOT NULL)
                      AND event.event_id = ANY(fresh_event_ids)
+                     AND (observation.payload_json->>'producerAttempt' IS NULL
+                       OR event.search_doc->>'producerAttempt' = observation.payload_json->>'producerAttempt')
                 ) AS candidate
                GROUP BY candidate.dedupe_key
             ) AS counted;
           FOR line, line_ordinal IN
             SELECT value, ordinality
-              FROM jsonb_array_elements(NEW.payload_json->'terminalLogLines') WITH ORDINALITY
+              FROM jsonb_array_elements(observation.payload_json->'terminalLogLines') WITH ORDINALITY
           LOOP
             IF jsonb_typeof(line) IS DISTINCT FROM 'string' THEN
               RAISE EXCEPTION 'Search projection requires terminal log strings';
@@ -1154,8 +1198,8 @@ export async function attachRuntimeEventSearchTriggers(
               CONTINUE;
             END IF;
             line_context := NULL;
-            IF NEW.payload_json ? 'terminalLogContexts' THEN
-              line_context := NEW.payload_json->'terminalLogContexts'->((line_ordinal - 1)::int);
+            IF observation.payload_json ? 'terminalLogContexts' THEN
+              line_context := observation.payload_json->'terminalLogContexts'->((line_ordinal - 1)::int);
               IF jsonb_typeof(line_context) = 'null' THEN
                 line_context := NULL;
               ELSIF jsonb_typeof(line_context) IS DISTINCT FROM 'object' THEN
@@ -1179,28 +1223,32 @@ export async function attachRuntimeEventSearchTriggers(
                 RAISE EXCEPTION 'Search projection terminal log context has an unsupported key or value';
               END IF;
             END IF;
-            line_doc := jsonb_build_object('kind', 'log.appended', 'source', 'terminal');
+            line_doc := jsonb_strip_nulls(jsonb_build_object(
+              'kind', 'log.appended', 'source', 'terminal',
+              'producerAttempt', observation.payload_json->'producerAttempt'
+            ));
             IF line_context IS NOT NULL THEN
               line_doc := line_doc || jsonb_build_object('context', line_context);
             END IF;
             INSERT INTO runtime_observability.events (
               runtime_scope, org_id, event_id, occurred_at, run_id, play_name,
-              kind, level, message, log_body, source_digest, search_doc
+              kind, level, message, log_body, source_digest, log_text_digest, search_doc
             ) VALUES (
-              ${quoteLiteral(scope)}, run_org, NEW.event_id || ':log:' || line_ordinal,
-              NEW.created_at, NEW.run_id, play, 'log.appended', NULL,
-              left(regexp_replace(line #>> '{}',
-                '^' || chr(1) || 'prov:[^' || chr(1) || ']*' || chr(1), ''), 2048),
+              ${quoteLiteral(scope)}, run_org, observation.event_id || ':log:' || line_ordinal,
+              observation.created_at, observation.run_id, play, 'log.appended', NULL,
+              CASE WHEN compact_logs THEN NULL ELSE left(regexp_replace(line #>> '{}',
+                '^' || chr(1) || 'prov:[^' || chr(1) || ']*' || chr(1), ''), 2048) END,
               line #>> '{}',
               CASE WHEN line_context IS NULL
                 THEN encode(sha256(convert_to(line #>> '{}', 'UTF8')), 'hex')
                 ELSE encode(sha256(convert_to(jsonb_build_array(line #>> '{}', line_context)::text, 'UTF8')), 'hex') END,
+              encode(sha256(convert_to(btrim(line #>> '{}'), 'UTF8')), 'hex'),
               line_doc
             ) ON CONFLICT DO NOTHING;
             IF FOUND THEN
               fresh_event_ids := array_append(
                 fresh_event_ids,
-                NEW.event_id || ':log:' || line_ordinal
+                observation.event_id || ':log:' || line_ordinal
               );
             END IF;
           END LOOP;
@@ -1210,7 +1258,7 @@ export async function attachRuntimeEventSearchTriggers(
       IF line_count > 0 THEN
         INSERT INTO runtime_observability.run_log_cursors (
           runtime_scope, org_id, run_id, last_seq
-        ) VALUES (${quoteLiteral(scope)}, run_org, NEW.run_id, line_count)
+        ) VALUES (${quoteLiteral(scope)}, run_org, observation.run_id, line_count)
         ON CONFLICT (runtime_scope, org_id, run_id)
         DO UPDATE SET last_seq = runtime_observability.run_log_cursors.last_seq + EXCLUDED.last_seq,
                       updated_at = clock_timestamp()
@@ -1222,20 +1270,168 @@ export async function attachRuntimeEventSearchTriggers(
            AND event.org_id = run_org
            AND event.event_id = fresh.event_id;
       END IF;
+      RETURN;
+    END
+    $function$
+  `);
+  await client.query(`
+    CREATE OR REPLACE FUNCTION ${schema}.without_log_events(batch jsonb) RETURNS jsonb
+    LANGUAGE sql IMMUTABLE SET search_path = pg_catalog AS $function$
+      SELECT coalesce(jsonb_agg(item.value ORDER BY item.ordinality), '[]'::jsonb)
+      FROM jsonb_array_elements(batch) WITH ORDINALITY AS item(value, ordinality)
+      WHERE coalesce(item.value->>'type', item.value->>'key') IS DISTINCT FROM 'log.appended'
+    $function$
+  `);
+  await client.query(`
+    CREATE OR REPLACE FUNCTION ${schema}.without_runtime_log_tail(value jsonb) RETURNS jsonb
+    LANGUAGE sql IMMUTABLE SET search_path = pg_catalog AS $function$
+      SELECT CASE
+        -- This reserved metadata shape is produced by the runtime. Authored
+        -- output/checkpoint strings and unrelated metadata are left intact.
+        WHEN jsonb_typeof(value#>'{_metadata,runLogTail,tail}') = 'array'
+          AND jsonb_typeof(value#>'{_metadata,runLogTail,totalLogCount}') = 'number'
+        THEN value #- '{_metadata,runLogTail}' ELSE value END
+    $function$
+  `);
+  await client.query(`
+    CREATE OR REPLACE FUNCTION ${schema}.compact_runner_log_envelope(value jsonb) RETURNS jsonb
+    LANGUAGE sql IMMUTABLE SET search_path = pg_catalog AS $function$
+      WITH envelope AS (
+        SELECT CASE WHEN jsonb_typeof(value) = 'object' THEN
+          (value - 'logContexts') || CASE WHEN value ? 'logs'
+            THEN jsonb_build_object('logs', '[]'::jsonb) ELSE '{}'::jsonb END
+          ELSE value END AS result
+      )
+      SELECT CASE WHEN result ? 'output' THEN jsonb_set(result, '{output}',
+        ${schema}.without_runtime_log_tail(result->'output')) ELSE result END
+      FROM envelope
+    $function$
+  `);
+  await client.query(`
+    CREATE OR REPLACE FUNCTION ${schema}.search_outbox_event() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
+    DECLARE compact_logs boolean;
+    BEGIN
+      -- Project the original validated observation before replacing its
+      -- transport body. Failure rolls back the outbox and canonical rows.
+      PERFORM ${schema}.project_outbox_event(NEW);
+      SELECT run_log_store = 'planet_scale' INTO compact_logs
+        FROM ${schema}.runs WHERE run_id = NEW.run_id;
+      IF compact_logs THEN
+        NEW.payload_json := NEW.payload_json - 'terminalLogLines' - 'terminalLogContexts';
+        IF NEW.event_type = 'run.events' THEN
+          NEW.payload_json := jsonb_set(NEW.payload_json, '{events}',
+            ${schema}.without_log_events(NEW.payload_json->'events'))
+            || jsonb_build_object('logBodyStore', 'planet_scale');
+        END IF;
+        IF NEW.payload_json ? 'terminalProgressEvents' THEN
+          NEW.payload_json := jsonb_set(NEW.payload_json, '{terminalProgressEvents}',
+            ${schema}.without_log_events(NEW.payload_json->'terminalProgressEvents'));
+        END IF;
+        IF NEW.event_type = 'run.failed' AND NEW.payload_json ? 'result' THEN
+          NEW.payload_json := jsonb_set(NEW.payload_json, '{result}',
+            ${schema}.compact_runner_log_envelope(NEW.payload_json->'result'));
+        END IF;
+        IF NEW.event_type = 'run.completed' AND NEW.payload_json ? 'output' THEN
+          NEW.payload_json := jsonb_set(NEW.payload_json, '{output}',
+            ${schema}.without_runtime_log_tail(NEW.payload_json->'output'));
+        END IF;
+      END IF;
       RETURN NEW;
     END
     $function$
   `);
-  await client.query(
-    `COMMENT ON FUNCTION ${schema}.search_outbox_event() IS ${quoteLiteral(RUNTIME_EVENT_SEARCH_OUTBOX_PROJECTION_MARKER)}`,
-  );
+  await client.query(`
+    CREATE OR REPLACE FUNCTION ${schema}.accept_runner_log_payload() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
+    DECLARE observation ${schema}.outbox; compact_logs boolean;
+    BEGIN
+      SELECT run_log_store = 'planet_scale' INTO compact_logs
+        FROM ${schema}.runs WHERE run_id = NEW.run_id;
+      IF NOT coalesce(compact_logs, false) OR NEW.runner_log_payload_json IS NULL THEN
+        RETURN NEW;
+      END IF;
+      IF OLD.runner_result_json IS NULL THEN
+        NEW.runner_result_digest := encode(
+          sha256(convert_to(NEW.runner_result_json::text, 'UTF8')), 'hex');
+        observation.event_id := 'runner-terminal-logs:' || NEW.run_id || ':' || NEW.attempt;
+        observation.run_id := NEW.run_id;
+        observation.event_type := 'runner.logs';
+        observation.created_at := coalesce(NEW.runner_terminal_received_at, clock_timestamp());
+        observation.payload_json := jsonb_set(NEW.runner_log_payload_json,
+          '{terminalProgressEvents}', (
+            SELECT coalesce(jsonb_agg(
+              CASE WHEN event->>'type' = 'log.appended' THEN event
+                ELSE event || jsonb_build_object('_runtimeProgressOrdinal', position) END
+              ORDER BY position), '[]'::jsonb)
+            FROM jsonb_array_elements(CASE
+              WHEN jsonb_typeof(NEW.runner_log_payload_json->'terminalProgressEvents') = 'array'
+                THEN NEW.runner_log_payload_json->'terminalProgressEvents'
+              ELSE '[]'::jsonb END) WITH ORDINALITY AS progress(event, position)
+          ));
+        PERFORM ${schema}.project_outbox_event(observation);
+        NEW.runner_result_json := ${schema}.compact_runner_log_envelope(NEW.runner_result_json);
+        IF jsonb_array_length(observation.payload_json->'recoveredRuntimeDiagnostics') > 0
+          AND (NOT (NEW.runner_result_json ? 'runtimeDiagnostics')
+            OR jsonb_typeof(NEW.runner_result_json->'runtimeDiagnostics') = 'array') THEN
+          NEW.runner_result_json := jsonb_set(NEW.runner_result_json, '{runtimeDiagnostics}',
+            coalesce(NEW.runner_result_json->'runtimeDiagnostics', '[]'::jsonb)
+              || (observation.payload_json->'recoveredRuntimeDiagnostics'));
+        END IF;
+        -- Retain only the first accepted non-log facts. Gateway retries
+        -- regenerate transport timestamps, so completion must reuse these
+        -- facts rather than compare newly generated progress with the first.
+        NEW.runner_log_payload_json := jsonb_build_object(
+          'terminalProgressEvents', ${schema}.without_log_events(
+            observation.payload_json->'terminalProgressEvents'));
+      ELSE
+        NEW.runner_log_payload_json := OLD.runner_log_payload_json;
+      END IF;
+      RETURN NEW;
+    END
+    $function$
+  `);
+  await client.query(`
+    CREATE OR REPLACE FUNCTION ${schema}.compact_run_log_result() RETURNS trigger
+    LANGUAGE plpgsql SET search_path = pg_catalog AS $function$
+    BEGIN
+      IF NEW.run_log_store = 'planet_scale' THEN
+        IF NEW.status = 'failed' THEN
+          NEW.terminal_result_json := ${schema}.compact_runner_log_envelope(NEW.terminal_result_json);
+        ELSIF NEW.status = 'completed' THEN
+          NEW.terminal_result_json := ${schema}.without_runtime_log_tail(NEW.terminal_result_json);
+        END IF;
+      END IF;
+      RETURN NEW;
+    END
+    $function$
+  `);
+  // Replacing AFTER with BEFORE is one DDL transaction, so live inserts cannot
+  // observe an interval with no projector. All older unmarked runs stay full.
   await client.query(`DO $create$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = '${schema}.outbox'::regclass
-      AND tgname = 'runtime_outbox_event_v1') THEN
-      CREATE TRIGGER runtime_outbox_event_v1 AFTER INSERT ON ${schema}.outbox
-        FOR EACH ROW EXECUTE FUNCTION ${schema}.search_outbox_event();
+    DROP TRIGGER IF EXISTS runtime_outbox_event_v1 ON ${schema}.outbox;
+    CREATE TRIGGER runtime_outbox_event_v1 BEFORE INSERT ON ${schema}.outbox
+      FOR EACH ROW EXECUTE FUNCTION ${schema}.search_outbox_event();
+    IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = '${schema}.attempts'::regclass
+      AND tgname = 'runtime_attempt_log_acceptance') THEN
+      CREATE TRIGGER runtime_attempt_log_acceptance BEFORE UPDATE OF runner_result_json ON ${schema}.attempts
+        FOR EACH ROW EXECUTE FUNCTION ${schema}.accept_runner_log_payload();
+    END IF;
+    IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = '${schema}.runs'::regclass
+      AND tgname = 'runtime_run_log_result') THEN
+      CREATE TRIGGER runtime_run_log_result BEFORE UPDATE OF terminal_result_json ON ${schema}.runs
+        FOR EACH ROW EXECUTE FUNCTION ${schema}.compact_run_log_result();
     END IF;
   END $create$`);
+  await client.query(`REVOKE ALL ON FUNCTION ${schema}.project_outbox_event(${schema}.outbox),
+    ${schema}.accept_runner_log_payload(), ${schema}.search_outbox_event(),
+    ${schema}.compact_run_log_result(), ${schema}.without_log_events(jsonb),
+    ${schema}.compact_runner_log_envelope(jsonb), ${schema}.without_runtime_log_tail(jsonb)
+    FROM PUBLIC`);
+  // Publish readiness last, after all acceptance/compaction functions exist.
+  await client.query(
+    `COMMENT ON FUNCTION ${schema}.search_outbox_event() IS ${quoteLiteral(RUNTIME_EVENT_SEARCH_OUTBOX_PROJECTION_MARKER)}`,
+  );
 }
 
 export async function hasRuntimeEventSearchShape(
@@ -1252,6 +1448,9 @@ export async function hasRuntimeEventSearchShape(
       AND EXISTS (SELECT 1 FROM pg_attribute
         WHERE attrelid = to_regclass('runtime_observability.events')
           AND attname = 'log_body' AND NOT attisdropped)
+      AND EXISTS (SELECT 1 FROM pg_attribute
+        WHERE attrelid = to_regclass('runtime_observability.events')
+          AND attname = 'log_text_digest' AND NOT attisdropped)
       AND EXISTS (SELECT 1 FROM pg_class
         WHERE oid = to_regclass('runtime_observability.events') AND relrowsecurity)
       AND EXISTS (SELECT 1 FROM pg_class
@@ -1259,7 +1458,12 @@ export async function hasRuntimeEventSearchShape(
       AND EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = '${schema}.receipts'::regclass
         AND tgname = 'runtime_receipt_event_v1' AND NOT tgisinternal)
       AND EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = '${schema}.outbox'::regclass
-        AND tgname = 'runtime_outbox_event_v1' AND NOT tgisinternal)
+        AND tgname = 'runtime_outbox_event_v1' AND NOT tgisinternal
+        AND tgenabled <> 'D' AND (tgtype & 2) = 2)
+      AND EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = '${schema}.attempts'::regclass
+        AND tgname = 'runtime_attempt_log_acceptance' AND NOT tgisinternal AND tgenabled <> 'D')
+      AND EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = '${schema}.runs'::regclass
+        AND tgname = 'runtime_run_log_result' AND NOT tgisinternal AND tgenabled <> 'D')
       AND EXISTS (SELECT 1 FROM pg_proc AS proc
         JOIN pg_namespace AS namespace ON namespace.oid = proc.pronamespace
         WHERE namespace.nspname = $1 AND proc.proname = 'search_outbox_event'
@@ -1271,6 +1475,83 @@ export async function hasRuntimeEventSearchShape(
   return result.rows[0]?.ready === true;
 }
 
+const RUNTIME_EVENT_BODY_RETENTION_PREDICATE = `kind <> 'log.appended' OR log_body IS NOT NULL
+  OR message IS NOT NULL OR search_doc ? 'context'`;
+
+// pg_get_expr adds grouping and text casts. Preserve quoted literals exactly;
+// this known OR-only predicate rejects other operators, keys and literal values.
+function normalizedRetentionPredicate(value: string): string {
+  return (value.match(/'(?:''|[^'])*'|::text\b|[()\s]+|./g) ?? [])
+    .filter((token) => !/^(?:::text|[()\s]+)$/.test(token))
+    .join('');
+}
+
+/** Operator-only concurrent index build; never part of runtime bootstrap. */
+export async function prepareRuntimeEventRetentionIndex(
+  client: PostgresSchedulerQueryClient,
+): Promise<void> {
+  type IndexShape = {
+    valid: boolean;
+    ready: boolean;
+    is_unique: boolean;
+    table_matches: boolean;
+    key_count: number;
+    attribute_count: number;
+    method: string;
+    key1: string | null;
+    key2: string | null;
+    predicate: string | null;
+  };
+  const inspect = () =>
+    client.query<IndexShape>(
+      `SELECT index.indisvalid AS valid, index.indisready AS ready, index.indisunique AS is_unique,
+      index.indrelid = to_regclass('runtime_observability.events') AS table_matches,
+      index.indnkeyatts AS key_count, index.indnatts AS attribute_count,
+      method.amname AS method,
+      pg_get_indexdef(index.indexrelid, 1, true) AS key1,
+      pg_get_indexdef(index.indexrelid, 2, true) AS key2,
+      pg_get_expr(index.indpred, index.indrelid) AS predicate
+      FROM pg_index AS index
+      JOIN pg_class AS relation ON relation.oid = index.indexrelid
+      JOIN pg_am AS method ON method.oid = relation.relam
+      WHERE index.indexrelid = to_regclass('runtime_observability.runtime_events_body_retention_idx')`,
+    );
+  const assertReady = (shape: IndexShape): void => {
+    if (!shape.valid || !shape.ready) {
+      throw new Error(
+        'Runtime body retention index is invalid or incomplete. Inspect the failed build; repair it explicitly before retrying.',
+      );
+    }
+    if (
+      !shape.table_matches ||
+      shape.is_unique ||
+      shape.key_count !== 2 ||
+      shape.attribute_count !== 2 ||
+      shape.method !== 'btree' ||
+      shape.key1 !== 'ingested_at' ||
+      shape.key2 !== 'event_id' ||
+      shape.predicate === null ||
+      normalizedRetentionPredicate(shape.predicate) !==
+        normalizedRetentionPredicate(RUNTIME_EVENT_BODY_RETENTION_PREDICATE)
+    ) {
+      throw new Error(
+        'Runtime body retention index definition differs from its expected table, uniqueness, keys or predicate. Inspect and repair it explicitly.',
+      );
+    }
+  };
+  const existing = (await inspect()).rows[0];
+  if (existing) assertReady(existing);
+  await client.query(`CREATE INDEX CONCURRENTLY IF NOT EXISTS runtime_events_body_retention_idx
+    ON runtime_observability.events (ingested_at, event_id)
+    WHERE ${RUNTIME_EVENT_BODY_RETENTION_PREDICATE}`);
+  const built = (await inspect()).rows[0];
+  if (!built)
+    throw new Error(
+      'Runtime body retention index was not found after preparation.',
+    );
+  assertReady(built);
+}
+
 /** One bounded operator-owned TTL pass. Never called by a customer request. */
 export async function pruneRuntimeEvents(
   client: PostgresSchedulerQueryClient,
@@ -1295,16 +1576,32 @@ export async function pruneRuntimeEvents(
     `WITH candidates AS (
        SELECT ctid FROM runtime_observability.events
         WHERE ingested_at < $1::timestamptz
+          AND (kind <> 'log.appended' OR log_body IS NOT NULL
+               OR message IS NOT NULL OR search_doc ? 'context')
         ORDER BY ingested_at, event_id
         LIMIT $2::integer FOR UPDATE SKIP LOCKED
+     ), scrubbed AS (
+       UPDATE runtime_observability.events AS event
+          SET log_text_digest = coalesce(event.log_text_digest,
+                encode(sha256(convert_to(btrim(coalesce(event.log_body, event.message)), 'UTF8')), 'hex')),
+              log_body = NULL, message = NULL,
+              search_doc = jsonb_strip_nulls(jsonb_build_object(
+                'kind', 'log.appended', 'source', event.search_doc->'source',
+                'producerAttempt', event.search_doc->'producerAttempt',
+                'logPositions', event.search_doc->'logPositions',
+                'logContentDigest', event.search_doc->'logContentDigest'))
+         FROM candidates WHERE event.ctid = candidates.ctid AND event.kind = 'log.appended'
+         RETURNING event.event_id
+     ), deleted AS (
+       DELETE FROM runtime_observability.events AS event USING candidates
+        WHERE event.ctid = candidates.ctid AND event.kind <> 'log.appended'
+        RETURNING event.event_id
      )
-     DELETE FROM runtime_observability.events AS event USING candidates
-      WHERE event.ctid = candidates.ctid
-     RETURNING event.event_id`,
+     SELECT event_id FROM scrubbed UNION ALL SELECT event_id FROM deleted`,
     [input.before.toISOString(), input.limit],
   );
-  // Keep the small per-run high-water marks after log bodies expire. A delayed
-  // accepted batch must not restart that run at sequence 1 and break cursors.
+  // Keep identity/digests until fenced ingress and pending delivery drain. A
+  // high-water mark alone cannot recognize a resent producer offset.
   return result.rows.length;
 }
 
@@ -1326,10 +1623,14 @@ export async function inspectRuntimeEventRetention(
   }>(
     `WITH oldest AS (
        SELECT ingested_at FROM runtime_observability.events
+        WHERE kind <> 'log.appended' OR log_body IS NOT NULL
+          OR message IS NOT NULL OR search_doc ? 'context'
         ORDER BY ingested_at, event_id LIMIT 1
      ), bounded AS (
        SELECT 1 FROM runtime_observability.events
         WHERE ingested_at < $1::timestamptz
+          AND (kind <> 'log.appended' OR log_body IS NOT NULL
+               OR message IS NOT NULL OR search_doc ? 'context')
         ORDER BY ingested_at, event_id LIMIT 10001
      )
      SELECT (SELECT ingested_at FROM oldest) AS oldest,