deepline 0.3.267 → 0.3.269

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.267',
+  version: '0.3.269',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/monitors/package.json

@@ -132,7 +132,7 @@
     "@deepline/product-notifications": "workspace:*",
     "@vercel/oidc": "^3.0.5",
     "@vercel/queue": "^0.4.0",
-    "next": "16.3.0-canary.60",
+    "next": "16.3.6",
     "pg": "^8.19.0",
     "react": "19.2.5",
     "@deepline/integration-contracts": "workspace:*"

package/dist/bundling-sources/shared_libs/play-runtime/app-runtime-api.ts

@@ -265,6 +265,7 @@ type RuntimeApiRequest =
       schedulerBackend?: string | null;
       schedulerSchema?: string | null;
       runLogStore?: 'planet_scale';
+      runEventStore?: 'planet_scale';
       executionProfile?: string | null;
       runtimeReleaseId?: string | null;
       runtimeDeployVersion?: string | null;

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -25,7 +25,10 @@ import type {
   PlayRunnerRuntimeTiming,
 } from '../protocol';
 import { PROD_DEFAULT_RUNTIME_SCHEDULER_SCHEMA } from '../runtime-scheduler-topology';
-import { RUNTIME_EVENT_SEARCH_OUTBOX_PROJECTION_MARKER } from './runtime-event-search';
+import {
+  RUNTIME_EVENT_CANONICAL_RETENTION_INDEX_READY_MARKER,
+  RUNTIME_EVENT_SEARCH_OUTBOX_PROJECTION_MARKER,
+} from './runtime-event-search';
 import type { PlayRunnerRuntimeResource } from '../runner-backends/types';
 import {
   RuntimeSandboxOperationState,
@@ -317,7 +320,9 @@ const POSTGRES_SCHEDULER_SCHEMA_INIT_STATEMENT_TIMEOUT_MS = 60_000;
 // v53 refreshes the indexed runtime log reconciliation projection. Its query
 // indexes remain operator-prepared concurrently, outside shared bootstrap.
 // v54 expands the optional per-run canonical event-store marker.
-export const POSTGRES_SCHEDULER_SCHEMA_VERSION = 54;
+// v55 refreshes the unified event journal projection. The canonical retention
+// index stays operator-prepared concurrently before marked-run admission.
+export const POSTGRES_SCHEDULER_SCHEMA_VERSION = 55;
 const POSTGRES_SCHEDULER_SCHEMA_MIGRATIONS_TABLE =
   'scheduler_schema_migrations';
 export const POSTGRES_SCHEDULER_OPEN_RECOVERY_INDEX =
@@ -985,6 +990,36 @@ function newRunLogStoreSql(
   ) THEN 'planet_scale' END`;
 }
 
+/** Only new immutable admissions opt into the full typed event journal. */
+function newRunEventStoreSql(
+  launchSql: 'launch_payload.launch_json',
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): string {
+  return `CASE WHEN ${launchSql} ? 'playReference' AND EXISTS (
+    SELECT 1 FROM pg_proc AS proc
+    JOIN pg_namespace AS namespace ON namespace.oid = proc.pronamespace
+    WHERE namespace.nspname = '${schemaName(options).replace(/'/g, "''")}'
+      AND proc.proname = 'search_outbox_event'
+      AND obj_description(proc.oid, 'pg_proc') = '${RUNTIME_EVENT_SEARCH_OUTBOX_PROJECTION_MARKER.replace(/'/g, "''")}'
+  ) AND EXISTS (
+    SELECT 1 FROM pg_index AS index_row
+      WHERE index_row.indexrelid = to_regclass('runtime_observability.runtime_events_canonical_retention_idx')
+        AND index_row.indisready AND index_row.indisvalid
+        AND obj_description(index_row.indexrelid, 'pg_class') = '${RUNTIME_EVENT_CANONICAL_RETENTION_INDEX_READY_MARKER.replace(/'/g, "''")}'
+  ) AND to_regclass('runtime_observability.runtime_event_order_seq') IS NOT NULL
+    AND EXISTS (
+      SELECT 1 FROM pg_attribute AS event_column
+       WHERE event_column.attrelid = to_regclass('runtime_observability.events')
+         AND event_column.attname = 'event_seq' AND event_column.attnum > 0
+         AND NOT event_column.attisdropped
+    ) AND EXISTS (
+      SELECT 1 FROM pg_attribute AS payload_column
+       WHERE payload_column.attrelid = to_regclass('runtime_observability.events')
+         AND payload_column.attname = 'event_payload' AND payload_column.attnum > 0
+         AND NOT payload_column.attisdropped
+  ) THEN 'planet_scale' END`;
+}
+
 function tableName(
   table: string,
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
@@ -5041,7 +5076,8 @@ async function submitPostgresSchedulerRunTransaction(
           status,
           absurd_task_id,
           admission_json,
-          run_log_store
+          run_log_store,
+          run_event_store
         )
         SELECT $1, $2, $3, $4, $5, $6, $7, launch_payload.launch_json, coalesce(nullif(launch_payload.launch_json -> 'input', 'null'::jsonb), '{}'::jsonb), 'queued',
                (SELECT task_id FROM task_spawn),
@@ -5054,7 +5090,8 @@ async function submitPostgresSchedulerRunTransaction(
                  'coordinatorInternalToken',
                  'vercelProtectionBypassToken'
                ]::text[],
-               ${newRunLogStoreSql('launch_payload.launch_json', options)}
+               ${newRunLogStoreSql('launch_payload.launch_json', options)},
+               ${newRunEventStoreSql('launch_payload.launch_json', options)}
         FROM admission
         CROSS JOIN launch_payload
         WHERE NOT existing_run
@@ -5062,7 +5099,7 @@ async function submitPostgresSchedulerRunTransaction(
           AND parent_accepting
           AND NOT ${existingOnlySql}
         ON CONFLICT (run_id) DO NOTHING
-        RETURNING run_id, absurd_task_id, run_log_store
+        RETURNING run_id, absurd_task_id, run_log_store, run_event_store
       ), run_recovery AS (
         UPDATE ${tableName('runs', options)} AS runs
         SET absurd_task_id = (SELECT task_id FROM task_spawn),
@@ -5111,6 +5148,7 @@ async function submitPostgresSchedulerRunTransaction(
             'schedulerBackend', launch_payload.launch_json ->> 'schedulerBackend',
             'schedulerSchema', COALESCE(launch_payload.launch_json ->> 'schedulerSchema', '${schemaName(options)}'),
             'runLogStore', run_insert.run_log_store,
+            'runEventStore', run_insert.run_event_store,
             'executionProfile', launch_payload.launch_json ->> 'executionProfile',
             'runtimeReleaseId', launch_payload.launch_json ->> 'runtimeReleaseId',
             'runtimeDeployVersion', launch_payload.launch_json ->> 'runtimeDeployVersion',
@@ -6113,7 +6151,7 @@ export async function firePostgresSchedulerCronSchedule(
         INSERT INTO ${tableName('runs', options)} (
           run_id, org_id, play_id, play_name, graph_hash, runtime_profile,
           artifact_storage_key, launch_json, input_json, status,
-          absurd_task_id, admission_json, run_log_store
+          absurd_task_id, admission_json, run_log_store, run_event_store
         )
         SELECT $5::text,
                launch_payload.launch_json ->> 'orgId',
@@ -6135,12 +6173,13 @@ export async function firePostgresSchedulerCronSchedule(
                  'coordinatorInternalToken',
                  'vercelProtectionBypassToken'
                ]::text[],
-               ${newRunLogStoreSql('launch_payload.launch_json', options)}
+               ${newRunLogStoreSql('launch_payload.launch_json', options)},
+               ${newRunEventStoreSql('launch_payload.launch_json', options)}
         FROM occurrence
         CROSS JOIN launch_payload
         WHERE occurrence.schedule_current
           AND NOT occurrence.existing_run
-        RETURNING run_id, run_log_store
+        RETURNING run_id, run_log_store, run_event_store
       ), occurrence_admitted AS MATERIALIZED (
         SELECT true AS admitted
         FROM occurrence
@@ -6188,6 +6227,7 @@ export async function firePostgresSchedulerCronSchedule(
             'schedulerBackend', launch_payload.launch_json ->> 'schedulerBackend',
             'schedulerSchema', COALESCE(launch_payload.launch_json ->> 'schedulerSchema', '${schemaName(options)}'),
             'runLogStore', run_insert.run_log_store,
+            'runEventStore', run_insert.run_event_store,
             'executionProfile', launch_payload.launch_json ->> 'executionProfile',
             'runtimeReleaseId', launch_payload.launch_json ->> 'runtimeReleaseId',
             'runtimeDeployVersion', launch_payload.launch_json ->> 'runtimeDeployVersion',
@@ -18040,18 +18080,23 @@ export async function markPostgresSchedulerOutboxDeliveredRows(
   }>(
     `
       WITH delivered AS (
-        UPDATE ${tableName('outbox', options)}
+        UPDATE ${tableName('outbox', options)} AS outbox
         SET delivered_at = now(),
             next_attempt_at = NULL,
             last_error_json = NULL,
             lease_owner = NULL,
-            lease_expires_at = NULL
-        WHERE event_id = ANY($1::text[])
-          AND delivered_at IS NULL
-          AND ($2::text IS NULL OR lease_owner = $2)
-        RETURNING event_id,
-                  event_type,
-                  (extract(epoch FROM (delivered_at - created_at)) * 1000)::float8
+            lease_expires_at = NULL,
+            payload_json = CASE WHEN EXISTS (
+              SELECT 1 FROM ${tableName('runs', options)} AS run
+               WHERE run.run_id = outbox.run_id
+                 AND run.run_event_store = 'planet_scale'
+            ) THEN '{}'::jsonb ELSE outbox.payload_json END
+        WHERE outbox.event_id = ANY($1::text[])
+          AND outbox.delivered_at IS NULL
+          AND ($2::text IS NULL OR outbox.lease_owner = $2)
+        RETURNING outbox.event_id,
+                  outbox.event_type,
+                  (extract(epoch FROM (outbox.delivered_at - outbox.created_at)) * 1000)::float8
                     AS lag_ms
       )
       SELECT event_id,
@@ -19238,6 +19283,9 @@ async function projectPostgresSchedulerCreatedEvent(
     ...(value('runLogStore') === 'planet_scale'
       ? { runLogStore: 'planet_scale' as const }
       : {}),
+    ...(value('runEventStore') === 'planet_scale'
+      ? { runEventStore: 'planet_scale' as const }
+      : {}),
     executionProfile: value('executionProfile'),
     runtimeReleaseId: value('runtimeReleaseId'),
     runtimeDeployVersion: value('runtimeDeployVersion'),

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/runtime-event-search.ts

@@ -41,7 +41,9 @@ const RUNTIME_EVENT_LOG_POSITION_EXPRESSION = `jsonb_set(
 // Migration readiness tracks this projection body independently of scheduler
 // wire and schema versions. Bump when a changed trigger must be reinstalled.
 export const RUNTIME_EVENT_SEARCH_OUTBOX_PROJECTION_MARKER =
-  'runtime-event-search-log-context-v10-custom-position-plan';
+  'runtime-event-search-log-context-v11-unified-event-journal';
+export const RUNTIME_EVENT_CANONICAL_RETENTION_INDEX_READY_MARKER =
+  'runtime-event-canonical-retention-v1';
 export const RUNTIME_EVENTS_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
 const MAX_SEARCH_WINDOW_MS = RUNTIME_EVENTS_RETENTION_MS;
 const MAX_SEARCH_RESULTS = 200;
@@ -66,6 +68,8 @@ export type RuntimeSearchEvent = {
   message: string | null;
   receiptRef: string | null;
   searchDoc: Record<string, unknown>;
+  /** Full accepted fact, read only through the explicit bounded payload path. */
+  eventPayload?: Record<string, unknown>;
 };
 
 export type RuntimeSearchCursor = { occurredAt: string; eventId: string };
@@ -80,6 +84,7 @@ export type RuntimeEventSearchInput = {
   playName?: string;
   kind?: string;
   jsonpath?: string;
+  includePayloads?: boolean;
   cursor?: RuntimeSearchCursor;
 };
 
@@ -252,6 +257,7 @@ type EventRow = {
   message: string | null;
   receipt_ref: string | null;
   search_doc: Record<string, unknown>;
+  event_payload: unknown;
 };
 
 function iso(value: Date | string): string {
@@ -357,7 +363,10 @@ export async function searchRuntimeEvents(
       `(occurred_at, event_id) < ($${params.length - 1}::timestamptz, $${params.length})`,
     );
   }
+  const limitParam = params.length + 1;
   params.push(input.limit + 1);
+  const payloadParam = params.length + 1;
+  params.push(input.includePayloads === true);
   const result = await client.query<EventRow>(
     `SELECT event_id, occurred_at, ingested_at, run_id, play_name, kind, level,
             coalesce(message, CASE WHEN kind = 'log.appended' THEN
@@ -366,14 +375,27 @@ export async function searchRuntimeEvents(
                   '^' || chr(1) || 'prov:[^' || chr(1) || ']*' || chr(1), '')
                 ELSE log_body END, 2048)
               END) AS message,
-            receipt_ref, search_doc
+            receipt_ref, search_doc,
+            CASE WHEN $${payloadParam}::boolean THEN event_payload END AS event_payload
        FROM ${EVENTS_TABLE}
       WHERE ${predicates.join(' AND ')}
       ORDER BY occurred_at DESC, event_id DESC
-      LIMIT $${params.length}::integer`,
+      LIMIT $${limitParam}::integer`,
     params,
   );
   const hasMore = result.rows.length > input.limit;
+  if (
+    input.includePayloads === true &&
+    result.rows.some(
+      (row) =>
+        row.event_payload !== null &&
+        row.event_payload !== undefined &&
+        (typeof row.event_payload !== 'object' ||
+          Array.isArray(row.event_payload)),
+    )
+  ) {
+    throw new Error('Runtime canonical event payload is not a JSON object.');
+  }
   const events = result.rows.slice(0, input.limit).map((row) => ({
     eventId: row.event_id,
     occurredAt: iso(row.occurred_at),
@@ -384,6 +406,11 @@ export async function searchRuntimeEvents(
     level: row.level,
     message: row.message,
     receiptRef: row.receipt_ref,
+    ...(row.event_payload &&
+    typeof row.event_payload === 'object' &&
+    !Array.isArray(row.event_payload)
+      ? { eventPayload: row.event_payload as Record<string, unknown> }
+      : {}),
     searchDoc: {
       ...row.search_doc,
       orgId: org,
@@ -561,10 +588,154 @@ export async function getRuntimeRunLogPage(
   };
 }
 
+async function ensureRuntimeEventFetchReceiptFunction(
+  client: PostgresSchedulerQueryClient,
+): Promise<void> {
+  await client.query(`
+    CREATE OR REPLACE FUNCTION runtime_observability.fetch_receipt(
+      p_scope text, p_org text, p_run text, p_ref uuid
+    ) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE answer jsonb; receipt_key_value text;
+    BEGIN
+      IF p_scope !~ '^[a-z_][a-z0-9_]{0,62}$'
+        OR p_org IS NULL OR p_run IS NULL OR p_ref IS NULL
+        OR p_org IS DISTINCT FROM current_setting('app.org_id', true)
+        OR p_scope IS DISTINCT FROM current_setting('app.runtime_scope', true)
+      THEN RETURN NULL; END IF;
+      SELECT event.receipt_key INTO receipt_key_value
+        FROM runtime_observability.events AS event
+         WHERE event.runtime_scope = p_scope AND event.org_id = p_org
+           AND event.run_id = p_run AND event.receipt_ref = p_ref
+           AND event.ingested_at >= clock_timestamp() - interval '7 days';
+      IF receipt_key_value IS NULL THEN RETURN NULL; END IF;
+      EXECUTE format(
+        'SELECT jsonb_build_object(''receiptKey'', k, ''status'', status, ''output'', output_json, ''outputRef'', output_ref, ''error'', error, ''errorPayload'', error_payload) FROM %I.receipts WHERE org_id = $1 AND run_id = $2 AND k = $3 AND status IN (''completed'', ''failed'', ''skipped'')',
+        p_scope
+      ) INTO answer USING p_org, p_run, receipt_key_value;
+      RETURN answer;
+    END
+    $function$
+  `);
+  await client.query(
+    `REVOKE ALL ON FUNCTION runtime_observability.fetch_receipt(text,text,text,uuid) FROM PUBLIC`,
+  );
+}
+
 /** Attach only on the explicit migration/bootstrap path, never on a hot read. */
+export async function hasRuntimeEventSearchStorageShape(
+  client: PostgresSchedulerQueryClient,
+): Promise<boolean> {
+  const result = await client.query<{
+    ready: boolean;
+    events_policy: string | null;
+    cursors_policy: string | null;
+  }>(
+    `SELECT to_regclass('runtime_observability.events') IS NOT NULL
+      AND to_regclass('runtime_observability.run_log_cursors') IS NOT NULL
+      AND to_regclass('runtime_observability.runtime_event_order_seq') IS NOT NULL
+      AND to_regprocedure('runtime_observability.fetch_receipt(text,text,text,uuid)') IS NOT NULL
+      AND (SELECT count(*) = 19 FROM pg_attribute
+        WHERE attrelid = to_regclass('runtime_observability.events')
+          AND attname = ANY(ARRAY[
+            'runtime_scope', 'org_id', 'event_id', 'event_seq', 'event_payload',
+            'log_seq', 'occurred_at', 'ingested_at', 'run_id', 'play_name',
+            'kind', 'level', 'message', 'log_body', 'receipt_ref', 'receipt_key',
+            'source_digest', 'search_doc', 'log_text_digest'
+          ]::text[]) AND NOT attisdropped)
+      AND (SELECT count(*) = 5 FROM pg_attribute
+        WHERE attrelid = to_regclass('runtime_observability.run_log_cursors')
+          AND attname = ANY(ARRAY[
+            'runtime_scope', 'org_id', 'run_id', 'last_seq', 'updated_at'
+          ]::text[]) AND NOT attisdropped)
+      AND EXISTS (SELECT 1 FROM pg_class
+        WHERE oid = to_regclass('runtime_observability.events') AND relrowsecurity)
+      AND EXISTS (SELECT 1 FROM pg_class
+        WHERE oid = to_regclass('runtime_observability.run_log_cursors') AND relrowsecurity)
+      AND NOT EXISTS (SELECT 1 FROM pg_namespace AS namespace,
+        LATERAL aclexplode(coalesce(namespace.nspacl,
+          acldefault('n', namespace.nspowner))) AS privilege
+        WHERE namespace.oid = to_regnamespace('runtime_observability')
+          AND privilege.grantee = 0)
+      AND NOT EXISTS (SELECT 1 FROM pg_class AS relation,
+        LATERAL aclexplode(coalesce(relation.relacl,
+          acldefault('r', relation.relowner))) AS privilege
+        WHERE relation.oid IN (
+          to_regclass('runtime_observability.events'),
+          to_regclass('runtime_observability.run_log_cursors')
+        ) AND privilege.grantee = 0)
+      AND NOT EXISTS (SELECT 1 FROM pg_class AS sequence_relation,
+        LATERAL aclexplode(coalesce(sequence_relation.relacl,
+          acldefault('S', sequence_relation.relowner))) AS privilege
+        WHERE sequence_relation.oid =
+          to_regclass('runtime_observability.runtime_event_order_seq')
+          AND privilege.grantee = 0)
+      AND NOT EXISTS (SELECT 1 FROM pg_proc AS receipt_function,
+        LATERAL aclexplode(coalesce(receipt_function.proacl,
+          acldefault('f', receipt_function.proowner))) AS privilege
+        WHERE receipt_function.oid = to_regprocedure(
+          'runtime_observability.fetch_receipt(text,text,text,uuid)')
+          AND privilege.grantee = 0)
+      AND EXISTS (SELECT 1 FROM pg_policy
+        WHERE polrelid = to_regclass('runtime_observability.events')
+          AND polname = 'runtime_events_read_scope' AND polcmd = 'r'
+          AND polroles @> ARRAY[0]::oid[] AND polqual IS NOT NULL
+          AND polwithcheck IS NULL)
+      AND EXISTS (SELECT 1 FROM pg_policy
+        WHERE polrelid = to_regclass('runtime_observability.run_log_cursors')
+          AND polname = 'runtime_run_log_read_scope' AND polcmd = 'r'
+          AND polroles @> ARRAY[0]::oid[] AND polqual IS NOT NULL
+          AND polwithcheck IS NULL)
+      AND (SELECT count(*) = 6 FROM pg_index AS index_row
+        WHERE index_row.indrelid = to_regclass('runtime_observability.events')
+          AND index_row.indisready AND index_row.indisvalid
+          AND index_row.indexrelid = ANY(ARRAY[
+            to_regclass('runtime_observability.runtime_events_run_log_seq_idx'),
+            to_regclass('runtime_observability.runtime_events_org_time_idx'),
+            to_regclass('runtime_observability.runtime_events_run_time_idx'),
+            to_regclass('runtime_observability.runtime_events_doc_idx'),
+            to_regclass('runtime_observability.runtime_events_retention_idx'),
+            to_regclass('runtime_observability.runtime_events_receipt_ref_idx')
+          ]::oid[]))
+      AND to_regclass('runtime_observability.runtime_run_log_cursors_retention_idx') IS NULL
+      AS ready,
+      (SELECT pg_get_expr(polqual, polrelid) FROM pg_policy
+        WHERE polrelid = to_regclass('runtime_observability.events')
+          AND polname = 'runtime_events_read_scope') AS events_policy,
+      (SELECT pg_get_expr(polqual, polrelid) FROM pg_policy
+        WHERE polrelid = to_regclass('runtime_observability.run_log_cursors')
+          AND polname = 'runtime_run_log_read_scope') AS cursors_policy`,
+  );
+  const shape = result.rows[0];
+  const expectedPolicy = `org_id = current_setting('app.org_id', true)
+    AND runtime_scope = current_setting('app.runtime_scope', true)`;
+  return (
+    shape?.ready === true &&
+    shape.events_policy !== null &&
+    shape.events_policy !== undefined &&
+    normalizedRetentionPredicate(shape.events_policy) ===
+      normalizedRetentionPredicate(expectedPolicy) &&
+    shape.cursors_policy !== null &&
+    shape.cursors_policy !== undefined &&
+    normalizedRetentionPredicate(shape.cursors_policy) ===
+      normalizedRetentionPredicate(expectedPolicy)
+  );
+}
+
 export async function ensureRuntimeEventSearchSchema(
   client: PostgresSchedulerQueryClient,
 ): Promise<void> {
+  // Projection marker refreshes only replace function bodies and triggers.
+  // Replaying ADD COLUMN IF NOT EXISTS, DROP POLICY, or CREATE INDEX against
+  // this busy journal unnecessarily takes heavyweight locks even when the
+  // reader-first storage expansion is already complete.
+  if (await hasRuntimeEventSearchStorageShape(client)) {
+    await ensureRuntimeEventFetchReceiptFunction(client);
+    return;
+  }
+
   await client.query('CREATE SCHEMA IF NOT EXISTS runtime_observability');
   await client.query(`
     CREATE TABLE IF NOT EXISTS runtime_observability.events (
@@ -663,37 +834,7 @@ export async function ensureRuntimeEventSearchSchema(
     )`);
   await client.query(`REVOKE ALL ON SCHEMA runtime_observability FROM PUBLIC`);
   await client.query(`REVOKE ALL ON runtime_observability.events FROM PUBLIC`);
-  await client.query(`
-    CREATE OR REPLACE FUNCTION runtime_observability.fetch_receipt(
-      p_scope text, p_org text, p_run text, p_ref uuid
-    ) RETURNS jsonb
-    LANGUAGE plpgsql SECURITY DEFINER
-    SET search_path = pg_catalog
-    AS $function$
-    DECLARE answer jsonb; receipt_key_value text;
-    BEGIN
-      IF p_scope !~ '^[a-z_][a-z0-9_]{0,62}$'
-        OR p_org IS NULL OR p_run IS NULL OR p_ref IS NULL
-        OR p_org IS DISTINCT FROM current_setting('app.org_id', true)
-        OR p_scope IS DISTINCT FROM current_setting('app.runtime_scope', true)
-      THEN RETURN NULL; END IF;
-      SELECT event.receipt_key INTO receipt_key_value
-        FROM runtime_observability.events AS event
-         WHERE event.runtime_scope = p_scope AND event.org_id = p_org
-           AND event.run_id = p_run AND event.receipt_ref = p_ref
-           AND event.ingested_at >= clock_timestamp() - interval '7 days';
-      IF receipt_key_value IS NULL THEN RETURN NULL; END IF;
-      EXECUTE format(
-        'SELECT jsonb_build_object(''receiptKey'', k, ''status'', status, ''output'', output_json, ''outputRef'', output_ref, ''error'', error, ''errorPayload'', error_payload) FROM %I.receipts WHERE org_id = $1 AND run_id = $2 AND k = $3 AND status IN (''completed'', ''failed'', ''skipped'')',
-        p_scope
-      ) INTO answer USING p_org, p_run, receipt_key_value;
-      RETURN answer;
-    END
-    $function$
-  `);
-  await client.query(
-    `REVOKE ALL ON FUNCTION runtime_observability.fetch_receipt(text,text,text,uuid) FROM PUBLIC`,
-  );
+  await ensureRuntimeEventFetchReceiptFunction(client);
 }
 
 /** The exact provisioned PlanetScale reader role; never grant to a guessed role. */
@@ -710,7 +851,8 @@ export async function grantRuntimeEventReader(
   await client.query(`GRANT USAGE ON SCHEMA runtime_observability TO ${role}`);
   await client.query(`GRANT SELECT (
     runtime_scope, org_id, event_id, occurred_at, ingested_at, run_id,
-    log_seq, log_body, play_name, kind, level, message, receipt_ref, search_doc
+    log_seq, log_body, play_name, kind, level, message, receipt_ref, search_doc,
+    event_payload
   ) ON runtime_observability.events TO ${role}`);
   await client.query(`GRANT SELECT (runtime_scope, org_id, run_id, last_seq)
     ON runtime_observability.run_log_cursors TO ${role}`);
@@ -736,6 +878,7 @@ export async function hasRuntimeEventReaderGrant(
       AND has_column_privilege(roles.oid, 'runtime_observability.events', 'event_id', 'SELECT')
       AND has_column_privilege(roles.oid, 'runtime_observability.events', 'log_seq', 'SELECT')
       AND has_column_privilege(roles.oid, 'runtime_observability.events', 'log_body', 'SELECT')
+      AND has_column_privilege(roles.oid, 'runtime_observability.events', 'event_payload', 'SELECT')
       AND NOT has_column_privilege(roles.oid, 'runtime_observability.events', 'receipt_key', 'SELECT')
       AND NOT has_table_privilege(roles.oid, 'runtime_observability.events', 'INSERT')
       AND NOT has_any_column_privilege(roles.oid, 'runtime_observability.events', 'INSERT')
@@ -807,7 +950,7 @@ export async function attachRuntimeEventSearchTriggers(
   await client.query(`
     CREATE OR REPLACE FUNCTION ${schema}.search_receipt_event() RETURNS trigger
     LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
-    DECLARE play text; ref uuid;
+    DECLARE play text; ref uuid; canonical_events boolean;
     BEGIN
       IF NEW.status NOT IN ('completed', 'failed', 'skipped') THEN RETURN NEW; END IF;
       IF TG_OP = 'UPDATE' THEN
@@ -820,17 +963,26 @@ export async function attachRuntimeEventSearchTriggers(
       IF NEW.run_id IS NULL OR NEW.org_id IS NULL THEN
         RAISE EXCEPTION 'Terminal receipt search projection requires run and organization';
       END IF;
-      SELECT play_name INTO play FROM ${schema}.runs
+      -- Serialize event ordering with the same per-run lock as outbox facts.
+      PERFORM pg_advisory_xact_lock(hashtext(${quoteLiteral(scope)}), hashtext(NEW.run_id));
+      SELECT play_name, run_event_store = 'planet_scale'
+        INTO play, canonical_events FROM ${schema}.runs
        WHERE run_id = NEW.run_id AND org_id = NEW.org_id;
       IF play IS NULL THEN
         RAISE EXCEPTION 'Terminal receipt search projection has no matching run';
       END IF;
       ref := gen_random_uuid();
       INSERT INTO runtime_observability.events (
-        runtime_scope, org_id, event_id, occurred_at, run_id, play_name,
-        kind, receipt_ref, receipt_key, search_doc
+        runtime_scope, org_id, event_id, event_seq, event_payload,
+        occurred_at, run_id, play_name, kind, receipt_ref, receipt_key, search_doc
       ) VALUES (
         ${quoteLiteral(scope)}, NEW.org_id, 'receipt:' || ref::text,
+        CASE WHEN canonical_events THEN nextval('runtime_observability.runtime_event_order_seq') END,
+        CASE WHEN canonical_events THEN jsonb_build_object(
+          'type', 'receipt.' || NEW.status, 'runId', NEW.run_id,
+          'occurredAt', floor(extract(epoch FROM NEW.updated_at) * 1000)::bigint,
+          'source', 'receipt', 'status', NEW.status
+        ) END,
         NEW.updated_at, NEW.run_id, play, 'receipt.' || NEW.status,
         ref, NEW.k, jsonb_strip_nulls(jsonb_build_object(
           'kind', 'receipt.' || NEW.status, 'status', NEW.status,
@@ -851,7 +1003,7 @@ export async function attachRuntimeEventSearchTriggers(
   await client.query(`
     CREATE OR REPLACE FUNCTION ${schema}.project_outbox_event(observation ${schema}.outbox) RETURNS void
     LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
-    DECLARE run_org text; play text; compact_logs boolean; run_status text; item jsonb; line jsonb; event_batch jsonb;
+    DECLARE run_org text; play text; compact_logs boolean; canonical_events boolean; run_status text; item jsonb; line jsonb; event_batch jsonb;
             ordinal bigint; line_ordinal bigint; kind text; at_time timestamptz;
             doc jsonb; line_doc jsonb; line_context jsonb;
             eid text; existing_digest text; digest text; assigned_seq bigint; terminal_progress_identity boolean;
@@ -868,8 +1020,9 @@ export async function attachRuntimeEventSearchTriggers(
       -- scheduler's Run/attempt row-lock order. In particular, old completion
       -- writers lock attempt before Run; this recorder must not invert that.
       PERFORM pg_advisory_xact_lock(hashtext(${quoteLiteral(scope)}), hashtext(observation.run_id));
-      SELECT org_id, play_name, run_log_store = 'planet_scale', status
-        INTO run_org, play, compact_logs, run_status
+      SELECT org_id, play_name, run_log_store = 'planet_scale', status,
+             run_event_store = 'planet_scale'
+        INTO run_org, play, compact_logs, run_status, canonical_events
         FROM ${schema}.runs WHERE run_id = observation.run_id;
       IF run_org IS NULL OR play IS NULL THEN
         RAISE EXCEPTION 'Outbox search projection has no matching run';
@@ -940,7 +1093,7 @@ export async function attachRuntimeEventSearchTriggers(
             'run.completed', 'run.failed', 'run.cancelled',
             'step.started', 'step.progress', 'step.completed',
             'step.failed', 'step.skipped', 'log.appended',
-            'dataset.lifecycle', 'activity.observed'
+            'dataset.lifecycle', 'activity.observed', 'work.counters'
           ) THEN
             kind := 'runtime.event';
           END IF;
@@ -1161,10 +1314,20 @@ export async function attachRuntimeEventSearchTriggers(
                 RAISE EXCEPTION 'Run log ingress is closed after terminal acceptance';
               END IF;
               INSERT INTO runtime_observability.events (
-                runtime_scope, org_id, event_id, occurred_at, run_id, play_name,
-                kind, level, message, log_body, source_digest, log_text_digest, search_doc
+                runtime_scope, org_id, event_id, event_seq, event_payload,
+                occurred_at, run_id, play_name, kind, level, message, log_body,
+                source_digest, log_text_digest, search_doc
               ) VALUES (
-                ${quoteLiteral(scope)}, run_org, eid, at_time, observation.run_id, play,
+                ${quoteLiteral(scope)}, run_org, eid,
+                CASE WHEN canonical_events THEN nextval('runtime_observability.runtime_event_order_seq') END,
+                CASE WHEN canonical_events THEN jsonb_strip_nulls(
+                  (item - 'lines' - 'lineContexts') || jsonb_build_object(
+                    'type', 'log.appended', 'runId', observation.run_id,
+                    'occurredAt', floor(extract(epoch FROM at_time) * 1000)::bigint,
+                    'lineOrdinal', line_ordinal,
+                    'context', line_context
+                  )) END,
+                at_time, observation.run_id, play,
                 'log.appended', NULL, CASE WHEN compact_logs THEN NULL ELSE left(line #>> '{}', 2048) END,
                 line #>> '{}', digest,
                 encode(sha256(convert_to(btrim(line #>> '{}'), 'UTF8')), 'hex'), line_doc
@@ -1193,10 +1356,12 @@ export async function attachRuntimeEventSearchTriggers(
             digest := CASE WHEN terminal_progress_identity
               THEN encode(sha256(convert_to(item::text, 'UTF8')), 'hex') ELSE NULL END;
             INSERT INTO runtime_observability.events (
-              runtime_scope, org_id, event_id, occurred_at, run_id, play_name,
-              kind, source_digest, search_doc
+              runtime_scope, org_id, event_id, event_seq, event_payload,
+              occurred_at, run_id, play_name, kind, source_digest, search_doc
             ) VALUES (
               ${quoteLiteral(scope)}, run_org, eid,
+              CASE WHEN canonical_events THEN nextval('runtime_observability.runtime_event_order_seq') END,
+              CASE WHEN canonical_events THEN item END,
               at_time, observation.run_id, play, kind, digest, doc
             ) ON CONFLICT DO NOTHING;
             IF NOT FOUND AND terminal_progress_identity THEN
@@ -1215,10 +1380,22 @@ export async function attachRuntimeEventSearchTriggers(
       ) AND NOT (observation.event_type IN ('run.waiting', 'run.resumed')
                  AND observation.payload_json->>'kind' = 'detached_runner') THEN
         INSERT INTO runtime_observability.events (
-          runtime_scope, org_id, event_id, occurred_at, run_id, play_name,
-          kind, search_doc
+          runtime_scope, org_id, event_id, event_seq, event_payload,
+          occurred_at, run_id, play_name, kind, search_doc
         ) VALUES (
-          ${quoteLiteral(scope)}, run_org, observation.event_id, observation.created_at,
+          ${quoteLiteral(scope)}, run_org, observation.event_id,
+          CASE WHEN canonical_events THEN nextval('runtime_observability.runtime_event_order_seq') END,
+          CASE WHEN canonical_events THEN jsonb_strip_nulls(jsonb_build_object(
+            'type', observation.event_type, 'runId', observation.run_id,
+            'occurredAt', floor(extract(epoch FROM observation.created_at) * 1000)::bigint,
+            'source', 'system', 'playName', play,
+            'status', observation.payload_json->>'status',
+            'error', observation.payload_json->>'error',
+            'waitKind', observation.payload_json->>'waitKind',
+            'waitUntil', observation.payload_json->'waitUntil',
+            'resultSummary', observation.payload_json->'resultSummary'
+          )) END,
+          observation.created_at,
           observation.run_id, play, observation.event_type, jsonb_build_object('kind', observation.event_type, 'source', 'system')
         ) ON CONFLICT DO NOTHING;
       END IF;
@@ -1329,10 +1506,18 @@ export async function attachRuntimeEventSearchTriggers(
               line_doc := line_doc || jsonb_build_object('context', line_context);
             END IF;
             INSERT INTO runtime_observability.events (
-              runtime_scope, org_id, event_id, occurred_at, run_id, play_name,
-              kind, level, message, log_body, source_digest, log_text_digest, search_doc
+              runtime_scope, org_id, event_id, event_seq, event_payload,
+              occurred_at, run_id, play_name, kind, level, message, log_body,
+              source_digest, log_text_digest, search_doc
             ) VALUES (
               ${quoteLiteral(scope)}, run_org, observation.event_id || ':log:' || line_ordinal,
+              CASE WHEN canonical_events THEN nextval('runtime_observability.runtime_event_order_seq') END,
+              CASE WHEN canonical_events THEN jsonb_strip_nulls(jsonb_build_object(
+                'type', 'log.appended', 'runId', observation.run_id,
+                'occurredAt', floor(extract(epoch FROM observation.created_at) * 1000)::bigint,
+                'source', 'terminal', 'producerAttempt', observation.payload_json->'producerAttempt',
+                'lineOrdinal', line_ordinal, 'context', line_context
+              )) END,
               observation.created_at, observation.run_id, play, 'log.appended', NULL,
               CASE WHEN compact_logs THEN NULL ELSE left(regexp_replace(line #>> '{}',
                 '^' || chr(1) || 'prov:[^' || chr(1) || ']*' || chr(1), ''), 2048) END,
@@ -1380,6 +1565,92 @@ export async function attachRuntimeEventSearchTriggers(
       WHERE coalesce(item.value->>'type', item.value->>'key') IS DISTINCT FROM 'log.appended'
     $function$
   `);
+  await client.query(`
+    CREATE OR REPLACE FUNCTION ${schema}.convex_projection_event(value jsonb) RETURNS jsonb
+    LANGUAGE sql IMMUTABLE SET search_path = pg_catalog AS $function$
+      WITH event AS (
+        SELECT coalesce(value->>'type', value->>'key') AS kind
+      )
+      SELECT CASE
+        WHEN event.kind IN ('rollup.membership.added', 'rollup.membership.removed')
+          AND value->>'opaque' = 'true' THEN jsonb_strip_nulls(jsonb_build_object(
+            'type', event.kind, 'runId', value->'runId',
+            'occurredAt', value->'occurredAt', 'source', value->'source',
+            'opaque', true, 'payload', value->'payload'))
+        WHEN event.kind IN (
+          'run.created', 'run.started', 'run.waiting', 'run.resumed',
+          'run.completed', 'run.failed', 'run.cancelled',
+          'step.started', 'step.progress', 'step.completed',
+          'step.failed', 'step.skipped', 'dataset.lifecycle',
+          'activity.observed', 'work.counters'
+        ) THEN jsonb_strip_nulls(jsonb_build_object(
+          'type', event.kind, 'runId', value->'runId',
+          'occurredAt', value->'occurredAt', 'source', value->'source'
+        ) || CASE event.kind
+          WHEN 'run.created' THEN jsonb_build_object(
+            'playName', value->'playName', 'status', value->'status',
+            'runtimeBackend', value->'runtimeBackend')
+          WHEN 'run.started' THEN jsonb_build_object(
+            'playName', value->'playName', 'runtimeBackend', value->'runtimeBackend')
+          WHEN 'run.waiting' THEN jsonb_build_object(
+            'waitKind', value->'waitKind', 'waitUntil', value->'waitUntil')
+          WHEN 'run.completed' THEN jsonb_build_object(
+            'result', value->'result', 'resultSummary', value->'resultSummary',
+            'terminalWorkCounterSegment', value->'terminalWorkCounterSegment')
+          WHEN 'run.failed' THEN jsonb_build_object(
+            'error', value->'error', 'result', value->'result',
+            'resultSummary', value->'resultSummary',
+            'terminalWorkCounterSegment', value->'terminalWorkCounterSegment')
+          WHEN 'run.cancelled' THEN jsonb_build_object(
+            'error', value->'error', 'result', value->'result')
+          WHEN 'step.started' THEN jsonb_build_object(
+            'stepId', value->'stepId', 'label', value->'label',
+            'kind', value->'kind', 'artifactTableNamespace', value->'artifactTableNamespace')
+          WHEN 'step.progress' THEN jsonb_build_object(
+            'stepId', value->'stepId', 'label', value->'label',
+            'kind', value->'kind', 'status', value->'status', 'progress', value->'progress')
+          WHEN 'step.completed' THEN jsonb_build_object(
+            'stepId', value->'stepId', 'label', value->'label',
+            'kind', value->'kind', 'artifactTableNamespace', value->'artifactTableNamespace')
+          WHEN 'step.failed' THEN jsonb_build_object(
+            'stepId', value->'stepId', 'label', value->'label', 'kind', value->'kind',
+            'error', value->'error', 'artifactTableNamespace', value->'artifactTableNamespace')
+          WHEN 'step.skipped' THEN jsonb_build_object(
+            'stepId', value->'stepId', 'label', value->'label',
+            'kind', value->'kind', 'artifactTableNamespace', value->'artifactTableNamespace')
+          WHEN 'dataset.lifecycle' THEN jsonb_build_object(
+            'datasetId', value->'datasetId', 'path', value->'path',
+            'tableNamespace', value->'tableNamespace', 'phase', value->'phase',
+            'persistedRows', value->'persistedRows', 'succeededRows', value->'succeededRows',
+            'failedRows', value->'failedRows', 'complete', value->'complete',
+            'bornFrom', value->'bornFrom')
+          WHEN 'activity.observed' THEN jsonb_build_object(
+            'observation', value->'observation')
+          WHEN 'work.counters' THEN jsonb_build_object(
+            'attempt', value->'attempt', 'invocationSeq', value->'invocationSeq',
+            'segmentId', value->'segmentId', 'logicalCalls', value->'logicalCalls',
+            'providerRequests', value->'providerRequests', 'provider429s', value->'provider429s',
+            'final', value->'final')
+          ELSE '{}'::jsonb
+        END)
+        ELSE NULL
+      END
+      FROM event
+    $function$
+  `);
+  await client.query(`
+    CREATE OR REPLACE FUNCTION ${schema}.convex_projection_events(batch jsonb) RETURNS jsonb
+    LANGUAGE sql IMMUTABLE SET search_path = pg_catalog AS $function$
+      WITH projected AS (
+        SELECT item.ordinality,
+               ${schema}.convex_projection_event(item.value) AS value
+          FROM jsonb_array_elements(batch) WITH ORDINALITY AS item(value, ordinality)
+      )
+      SELECT coalesce(jsonb_agg(projected.value ORDER BY projected.ordinality)
+                       FILTER (WHERE projected.value IS NOT NULL), '[]'::jsonb)
+        FROM projected
+    $function$
+  `);
   await client.query(`
     CREATE OR REPLACE FUNCTION ${schema}.without_runtime_log_tail(value jsonb) RETURNS jsonb
     LANGUAGE sql IMMUTABLE SET search_path = pg_catalog AS $function$
@@ -1408,14 +1679,15 @@ export async function attachRuntimeEventSearchTriggers(
   await client.query(`
     CREATE OR REPLACE FUNCTION ${schema}.search_outbox_event() RETURNS trigger
     LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
-    DECLARE compact_logs boolean;
+    DECLARE compact_logs boolean; canonical_events boolean;
     BEGIN
       -- Project the original validated observation before replacing its
       -- transport body. Failure rolls back the outbox and canonical rows.
       PERFORM ${schema}.project_outbox_event(NEW);
-      SELECT run_log_store = 'planet_scale' INTO compact_logs
+      SELECT run_log_store = 'planet_scale', run_event_store = 'planet_scale'
+        INTO compact_logs, canonical_events
         FROM ${schema}.runs WHERE run_id = NEW.run_id;
-      IF compact_logs THEN
+      IF compact_logs OR canonical_events THEN
         NEW.payload_json := NEW.payload_json - 'terminalLogLines' - 'terminalLogContexts';
         IF NEW.event_type = 'run.events' THEN
           NEW.payload_json := jsonb_set(NEW.payload_json, '{events}',
@@ -1435,6 +1707,16 @@ export async function attachRuntimeEventSearchTriggers(
             ${schema}.without_runtime_log_tail(NEW.payload_json->'output'));
         END IF;
       END IF;
+      IF canonical_events THEN
+        IF NEW.event_type = 'run.events' THEN
+          NEW.payload_json := jsonb_set(NEW.payload_json, '{events}',
+            ${schema}.convex_projection_events(NEW.payload_json->'events'));
+        END IF;
+        IF NEW.payload_json ? 'terminalProgressEvents' THEN
+          NEW.payload_json := jsonb_set(NEW.payload_json, '{terminalProgressEvents}',
+            ${schema}.convex_projection_events(NEW.payload_json->'terminalProgressEvents'));
+        END IF;
+      END IF;
       RETURN NEW;
     END
     $function$
@@ -1444,7 +1726,8 @@ export async function attachRuntimeEventSearchTriggers(
     LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
     DECLARE observation ${schema}.outbox; compact_logs boolean;
     BEGIN
-      SELECT run_log_store = 'planet_scale' INTO compact_logs
+      SELECT run_log_store = 'planet_scale' OR run_event_store = 'planet_scale'
+        INTO compact_logs
         FROM ${schema}.runs WHERE run_id = NEW.run_id;
       IF NOT coalesce(compact_logs, false) OR NEW.runner_log_payload_json IS NULL THEN
         RETURN NEW;
@@ -1493,7 +1776,7 @@ export async function attachRuntimeEventSearchTriggers(
     CREATE OR REPLACE FUNCTION ${schema}.compact_run_log_result() RETURNS trigger
     LANGUAGE plpgsql SET search_path = pg_catalog AS $function$
     BEGIN
-      IF NEW.run_log_store = 'planet_scale' THEN
+      IF NEW.run_log_store = 'planet_scale' OR NEW.run_event_store = 'planet_scale' THEN
         IF NEW.status = 'failed' THEN
           NEW.terminal_result_json := ${schema}.compact_runner_log_envelope(NEW.terminal_result_json);
         ELSIF NEW.status = 'completed' THEN
@@ -1554,6 +1837,7 @@ export async function attachRuntimeEventSearchTriggers(
   await client.query(`REVOKE ALL ON FUNCTION ${schema}.project_outbox_event(${schema}.outbox),
     ${schema}.accept_runner_log_payload(), ${schema}.search_outbox_event(),
     ${schema}.compact_run_log_result(), ${schema}.without_log_events(jsonb),
+    ${schema}.convex_projection_event(jsonb), ${schema}.convex_projection_events(jsonb),
     ${schema}.compact_runner_log_envelope(jsonb), ${schema}.without_runtime_log_tail(jsonb)
     FROM PUBLIC`);
   // Publish readiness last, after all acceptance/compaction functions exist.
@@ -1612,6 +1896,10 @@ export async function hasRuntimeEventSearchShape(
 
 const RUNTIME_EVENT_BODY_RETENTION_PREDICATE = `kind <> 'log.appended' OR log_body IS NOT NULL
   OR message IS NOT NULL OR search_doc ? 'context'`;
+const RUNTIME_EVENT_CANONICAL_RETENTION_PREDICATE = `(kind <> 'log.appended' AND event_payload IS NULL)
+  OR (substr(kind, 1, 8) = 'receipt.' AND event_payload IS NOT NULL
+      AND (receipt_ref IS NOT NULL OR receipt_key IS NOT NULL))
+  OR (kind = 'log.appended' AND (log_body IS NOT NULL OR message IS NOT NULL OR search_doc ? 'context'))`;
 
 // pg_get_expr adds grouping and text casts. Preserve quoted literals exactly;
 // this known OR-only predicate rejects other operators, keys and literal values.
@@ -1835,54 +2123,76 @@ export async function prepareRuntimeEventRetentionIndex(
     key2: string | null;
     predicate: string | null;
   };
-  const inspect = () =>
-    client.query<IndexShape>(
-      `SELECT index.indisvalid AS valid, index.indisready AS ready, index.indisunique AS is_unique,
-      index.indrelid = to_regclass('runtime_observability.events') AS table_matches,
-      index.indnkeyatts AS key_count, index.indnatts AS attribute_count,
-      method.amname AS method,
-      pg_get_indexdef(index.indexrelid, 1, true) AS key1,
-      pg_get_indexdef(index.indexrelid, 2, true) AS key2,
-      pg_get_expr(index.indpred, index.indrelid) AS predicate
-      FROM pg_index AS index
-      JOIN pg_class AS relation ON relation.oid = index.indexrelid
-      JOIN pg_am AS method ON method.oid = relation.relam
-      WHERE index.indexrelid = to_regclass('runtime_observability.runtime_events_body_retention_idx')`,
-    );
-  const assertReady = (shape: IndexShape): void => {
-    if (!shape.valid || !shape.ready) {
+  const prepare = async (input: {
+    name: string;
+    predicate: string;
+    marksJournalReady?: boolean;
+  }) => {
+    const inspect = () =>
+      client.query<IndexShape>(
+        `SELECT index.indisvalid AS valid, index.indisready AS ready, index.indisunique AS is_unique,
+        index.indrelid = to_regclass('runtime_observability.events') AS table_matches,
+        index.indnkeyatts AS key_count, index.indnatts AS attribute_count,
+        method.amname AS method,
+        pg_get_indexdef(index.indexrelid, 1, true) AS key1,
+        pg_get_indexdef(index.indexrelid, 2, true) AS key2,
+        pg_get_expr(index.indpred, index.indrelid) AS predicate
+        FROM pg_index AS index
+        JOIN pg_class AS relation ON relation.oid = index.indexrelid
+        JOIN pg_am AS method ON method.oid = relation.relam
+        WHERE index.indexrelid = to_regclass($1)`,
+        [`runtime_observability.${input.name}`],
+      );
+    const assertReady = (shape: IndexShape): void => {
+      if (!shape.valid || !shape.ready) {
+        throw new Error(
+          `Runtime retention index ${input.name} is invalid or incomplete. Inspect the failed build; repair it explicitly before retrying.`,
+        );
+      }
+      if (
+        !shape.table_matches ||
+        shape.is_unique ||
+        shape.key_count !== 2 ||
+        shape.attribute_count !== 2 ||
+        shape.method !== 'btree' ||
+        shape.key1 !== 'ingested_at' ||
+        shape.key2 !== 'event_id' ||
+        shape.predicate === null ||
+        normalizedRetentionPredicate(shape.predicate) !==
+          normalizedRetentionPredicate(input.predicate)
+      ) {
+        throw new Error(
+          `Runtime retention index ${input.name} definition differs from its expected table, uniqueness, keys or predicate. Actual catalog shape: ${JSON.stringify(shape)}. Inspect and repair it explicitly.`,
+        );
+      }
+    };
+    const existing = (await inspect()).rows[0];
+    if (existing) assertReady(existing);
+    await client.query(`CREATE INDEX CONCURRENTLY IF NOT EXISTS ${input.name}
+      ON runtime_observability.events (ingested_at, event_id)
+      WHERE ${input.predicate}`);
+    const built = (await inspect()).rows[0];
+    if (!built) {
       throw new Error(
-        'Runtime body retention index is invalid or incomplete. Inspect the failed build; repair it explicitly before retrying.',
+        `Runtime retention index ${input.name} was not found after preparation.`,
       );
     }
-    if (
-      !shape.table_matches ||
-      shape.is_unique ||
-      shape.key_count !== 2 ||
-      shape.attribute_count !== 2 ||
-      shape.method !== 'btree' ||
-      shape.key1 !== 'ingested_at' ||
-      shape.key2 !== 'event_id' ||
-      shape.predicate === null ||
-      normalizedRetentionPredicate(shape.predicate) !==
-        normalizedRetentionPredicate(RUNTIME_EVENT_BODY_RETENTION_PREDICATE)
-    ) {
-      throw new Error(
-        'Runtime body retention index definition differs from its expected table, uniqueness, keys or predicate. Inspect and repair it explicitly.',
+    assertReady(built);
+    if (input.marksJournalReady) {
+      await client.query(
+        `COMMENT ON INDEX runtime_observability.runtime_events_canonical_retention_idx IS ${quoteLiteral(RUNTIME_EVENT_CANONICAL_RETENTION_INDEX_READY_MARKER)}`,
       );
     }
   };
-  const existing = (await inspect()).rows[0];
-  if (existing) assertReady(existing);
-  await client.query(`CREATE INDEX CONCURRENTLY IF NOT EXISTS runtime_events_body_retention_idx
-    ON runtime_observability.events (ingested_at, event_id)
-    WHERE ${RUNTIME_EVENT_BODY_RETENTION_PREDICATE}`);
-  const built = (await inspect()).rows[0];
-  if (!built)
-    throw new Error(
-      'Runtime body retention index was not found after preparation.',
-    );
-  assertReady(built);
+  await prepare({
+    name: 'runtime_events_body_retention_idx',
+    predicate: RUNTIME_EVENT_BODY_RETENTION_PREDICATE,
+  });
+  await prepare({
+    name: 'runtime_events_canonical_retention_idx',
+    predicate: RUNTIME_EVENT_CANONICAL_RETENTION_PREDICATE,
+    marksJournalReady: true,
+  });
 }
 
 /** One bounded operator-owned TTL pass. Never called by a customer request. */
@@ -1907,10 +2217,9 @@ export async function pruneRuntimeEvents(
   }
   const result = await client.query<{ event_id: string }>(
     `WITH candidates AS (
-       SELECT ctid FROM runtime_observability.events
+      SELECT ctid FROM runtime_observability.events
         WHERE ingested_at < $1::timestamptz
-          AND (kind <> 'log.appended' OR log_body IS NOT NULL
-               OR message IS NOT NULL OR search_doc ? 'context')
+          AND (${RUNTIME_EVENT_CANONICAL_RETENTION_PREDICATE})
         ORDER BY ingested_at, event_id
         LIMIT $2::integer FOR UPDATE SKIP LOCKED
      ), scrubbed AS (
@@ -1918,6 +2227,8 @@ export async function pruneRuntimeEvents(
           SET log_text_digest = coalesce(event.log_text_digest,
                 encode(sha256(convert_to(btrim(coalesce(event.log_body, event.message)), 'UTF8')), 'hex')),
               log_body = NULL, message = NULL,
+              event_payload = CASE WHEN event.event_payload IS NULL THEN NULL
+                                   ELSE event.event_payload - 'context' END,
               search_doc = jsonb_strip_nulls(jsonb_build_object(
                 'kind', 'log.appended', 'source', event.search_doc->'source',
                 'producerAttempt', event.search_doc->'producerAttempt',
@@ -1925,12 +2236,24 @@ export async function pruneRuntimeEvents(
                 'logContentDigest', event.search_doc->'logContentDigest'))
          FROM candidates WHERE event.ctid = candidates.ctid AND event.kind = 'log.appended'
          RETURNING event.event_id
+     ), scrubbed_receipts AS (
+       UPDATE runtime_observability.events AS event
+          SET receipt_ref = NULL, receipt_key = NULL
+         FROM candidates
+        WHERE event.ctid = candidates.ctid
+          AND left(event.kind, 8) = 'receipt.'
+          AND event.event_payload IS NOT NULL
+          AND (event.receipt_ref IS NOT NULL OR event.receipt_key IS NOT NULL)
+         RETURNING event.event_id
      ), deleted AS (
        DELETE FROM runtime_observability.events AS event USING candidates
         WHERE event.ctid = candidates.ctid AND event.kind <> 'log.appended'
+          AND event.event_payload IS NULL
         RETURNING event.event_id
      )
-     SELECT event_id FROM scrubbed UNION ALL SELECT event_id FROM deleted`,
+     SELECT event_id FROM scrubbed
+      UNION ALL SELECT event_id FROM scrubbed_receipts
+      UNION ALL SELECT event_id FROM deleted`,
     [input.before.toISOString(), input.limit],
   );
   // Keep identity/digests until fenced ingress and pending delivery drain. A
@@ -1956,14 +2279,12 @@ export async function inspectRuntimeEventRetention(
   }>(
     `WITH oldest AS (
        SELECT ingested_at FROM runtime_observability.events
-        WHERE kind <> 'log.appended' OR log_body IS NOT NULL
-          OR message IS NOT NULL OR search_doc ? 'context'
+        WHERE (${RUNTIME_EVENT_CANONICAL_RETENTION_PREDICATE})
         ORDER BY ingested_at, event_id LIMIT 1
      ), bounded AS (
        SELECT 1 FROM runtime_observability.events
         WHERE ingested_at < $1::timestamptz
-          AND (kind <> 'log.appended' OR log_body IS NOT NULL
-               OR message IS NOT NULL OR search_doc ? 'context')
+          AND (${RUNTIME_EVENT_CANONICAL_RETENTION_PREDICATE})
         ORDER BY ingested_at, event_id LIMIT 10001
      )
      SELECT (SELECT ingested_at FROM oldest) AS oldest,

package/dist/cli/index.js

@@ -3512,7 +3512,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.267",
+  version: "0.3.269",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/cli/index.mjs

@@ -3507,7 +3507,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.267",
+  version: "0.3.269",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.js

@@ -1325,7 +1325,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.267",
+  version: "0.3.269",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.mjs

@@ -1229,7 +1229,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.267",
+  version: "0.3.269",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.d.mts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.267";
+    readonly version: "0.3.269";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.d.ts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.267";
+    readonly version: "0.3.269";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.js

@@ -74,7 +74,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.267",
+  version: "0.3.269",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.mjs

@@ -48,7 +48,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.267",
+  version: "0.3.269",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.3.267",
+  "version": "0.3.269",
   "description": "GTM data CLI and TypeScript SDK for coding agents",
   "license": "MIT",
   "homepage": "https://code.deepline.com",