deepline 0.3.281 → 0.3.283

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.281',
+  version: '0.3.283',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/observability/redaction.ts

@@ -59,19 +59,27 @@ function redactStructuredValue(
 }
 
 function redactPlainTelemetryText(value: string): string {
-  return value
-    .replace(PRIVATE_KEY_PATTERN, '[REDACTED]')
-    .replace(POSTGRES_CREDENTIAL_PATTERN, '$1[REDACTED]@')
-    .replace(AUTHORIZATION_CREDENTIAL_PATTERN, '$1$2$3 [REDACTED]')
-    .replace(BEARER_CREDENTIAL_PATTERN, 'Bearer [REDACTED]')
-    .replace(BASIC_CREDENTIAL_PATTERN, 'Basic [REDACTED]')
-    .replace(JWT_PATTERN, '[REDACTED_JWT]')
-    .replace(
-      JSON_SECRET_PATTERN,
-      (_match, keyQuote, key, separator, valueQuote) =>
-        `${keyQuote}${key}${keyQuote}${separator}${valueQuote}[REDACTED]${valueQuote}`,
-    )
-    .replace(INLINE_SECRET_PATTERN, '$1$2[REDACTED]');
+  return (
+    value
+      // Scoped to the provider host: `key` elsewhere remains an identifier.
+      .replace(
+        /https?:\/\/(?:api|bulkapi)\.millionverifier\.com(?=[:/?#]|$)[^\s"'<>]*/gi,
+        (url) =>
+          url.replace(/([?&](?:api|key)=)[^&#\s"'<>]*/gi, '$1[REDACTED]'),
+      )
+      .replace(PRIVATE_KEY_PATTERN, '[REDACTED]')
+      .replace(POSTGRES_CREDENTIAL_PATTERN, '$1[REDACTED]@')
+      .replace(AUTHORIZATION_CREDENTIAL_PATTERN, '$1$2$3 [REDACTED]')
+      .replace(BEARER_CREDENTIAL_PATTERN, 'Bearer [REDACTED]')
+      .replace(BASIC_CREDENTIAL_PATTERN, 'Basic [REDACTED]')
+      .replace(JWT_PATTERN, '[REDACTED_JWT]')
+      .replace(
+        JSON_SECRET_PATTERN,
+        (_match, keyQuote, key, separator, valueQuote) =>
+          `${keyQuote}${key}${keyQuote}${separator}${valueQuote}[REDACTED]${valueQuote}`,
+      )
+      .replace(INLINE_SECRET_PATTERN, '$1$2[REDACTED]')
+  );
 }
 
 /**

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -20567,10 +20567,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 logProvider429RetryPhase('retry_sleep_completed');
                 if (
                   !usesDurableInvocationFence &&
-                  failure.backpressureDelayMs !== null
+                  (failure.backpressureDelayMs !== null ||
+                    (failure.reason === 'rate_limit' &&
+                      failure.knownNotDispatched))
                 ) {
                   // A classified provider rejection has no completed value to
-                  // charge. The next physical attempt needs a new reservation;
+                  // charge. A credential guard refusal also releases its charge
+                  // before replying. The next attempt needs a new reservation;
                   // durable result and provider-operation keys stay unchanged.
                   deeplineRequestId = `ctx-tool-${stableDigest(`${executionRequestNonce}:provider-rate-limit-retry:${invocationAttempt}`).slice(0, 32)}`;
                 }

package/dist/bundling-sources/shared_libs/play-runtime/runner-app/index.ts

@@ -73,8 +73,10 @@ import { collectStartupEgressProbeLines } from './egress-probe';
 import {
   pushRunnerTerminal,
   runnerTerminalResultForTransport,
+  runnerTerminalHandoffForTransport,
   type PushRunnerTerminalOptions,
   type PlayRunnerTerminalTransportResult,
+  type PlayRunnerTerminalTransportEvent,
 } from './runtime-terminal-push';
 import { vercelProtectionBypassHeader } from '../vercel-protection';
 import { getPlayRuntimeBatchStrategy } from '../play-runtime-batching-registry';
@@ -1407,9 +1409,7 @@ function emitProgressSidecarEvent(event: PlayRunnerEvent): void {
 }
 
 async function writeRunnerEventToStdout(
-  event:
-    | PlayRunnerEvent
-    | { type: 'result'; result: PlayRunnerTerminalTransportResult },
+  event: PlayRunnerEvent | PlayRunnerTerminalTransportEvent,
 ): Promise<void> {
   await new Promise<void>((resolve, reject) => {
     process.stdout.write(`${JSON.stringify(event)}\n`, (error) => {
@@ -1482,9 +1482,7 @@ async function exitRunner(exitCode: number): Promise<never> {
 }
 
 async function emitAndExit(
-  event:
-    | PlayRunnerEvent
-    | { type: 'result'; result: PlayRunnerTerminalTransportResult },
+  event: PlayRunnerEvent | PlayRunnerTerminalTransportEvent,
   exitCode: number,
 ): Promise<never> {
   await writeRunnerEventToStdout(event);
@@ -3859,37 +3857,29 @@ async function main() {
     // delays the terminal beyond the cap; no-op for undiagrammed plays.
     // Runner progress joins the same terminal handoff immediately below.
     await drainPendingDocflowObservationPosts();
-    if (terminalResult) {
+    const terminalHandoff = terminalResult
+      ? runnerTerminalHandoffForTransport(terminalResult, runnerProgressPusher)
+      : null;
+    if (terminalHandoff) runnerProgressPusher = null;
+    if (terminalHandoff) {
       // Persist the exact terminal line locally before any network settlement.
       // If the gateway remains unavailable through the grace period, the shell
       // epilogue can still salvage this authored result instead of inventing a
       // runtime-limit failure after customer code already finished.
-      await writeRunnerEventToStdout({
-        type: 'result',
-        result: terminalResult,
-      });
+      await writeRunnerEventToStdout(terminalHandoff.event);
     }
     // Push execution (B2-final): the pushed terminal is what WAKES the parked
     // worker attempt. Push before exiting; on exhaustion the captured output
     // file remains the ceiling-timeout salvage source.
-    if (runnerTerminalPushContext && terminalResult) {
+    if (runnerTerminalPushContext && terminalHandoff) {
       // Every terminal boundary can wake a successor attempt. Transfer all
       // unacknowledged observations into that same ordered handoff before the
       // wake is visible; draining a suspended/failed attempt afterward lets
       // the successor claim the log channel and fence its predecessor's tail.
-      const finalProgress = runnerProgressPusher?.sealForTerminal() ?? {
-        events: [],
-        liveLogOffset: 0,
-      };
-      runnerProgressPusher = null;
-      await pushRunnerTerminalIfConfigured(terminalResult, {
+      await pushRunnerTerminalIfConfigured(terminalHandoff.event.result, {
         warn: createPostTerminalDiagnosticWriter(),
-        finalProgressLogOffset: finalProgress.liveLogOffset,
-        ...(finalProgress.events.length
-          ? {
-              finalProgressEvents: finalProgress.events,
-            }
-          : {}),
+        finalProgressLogOffset: terminalHandoff.progress?.liveLogOffset ?? 0,
+        finalProgressEvents: terminalHandoff.progress?.events,
       });
       return exitRunner(0);
     }
@@ -4174,13 +4164,12 @@ async function terminateRunnerForRuntimeDeadline(
   // the Daytona shell wrapper, whose crash epilogue owns the bounded gateway
   // push during the outer grace period. Awaiting network/progress work here
   // would let customer code continue dispatching after its deadline.
-  return emitAndExit(
-    {
-      type: 'result',
-      result: failedResult,
-    },
-    0,
+  const terminalHandoff = runnerTerminalHandoffForTransport(
+    failedResult,
+    runnerProgressPusher,
   );
+  runnerProgressPusher = null;
+  return emitAndExit(terminalHandoff.event, 0);
 }
 
 // The external watchdog samples the sandbox cgroup and raises SIGUSR2 at its

package/dist/bundling-sources/shared_libs/play-runtime/runner-app/runtime-terminal-push.ts

@@ -18,6 +18,7 @@ import {
   type RunnerGatewayTransportEvent,
 } from './runtime-gateway-transport';
 import { RUNTIME_RELIABILITY_POLICY } from '../runtime-reliability-policy';
+import type { RunnerProgressPusher } from './runtime-progress-push';
 
 /**
  * Push-execution terminal push (runs INSIDE the Daytona sandbox, B2-final).
@@ -93,6 +94,39 @@ export type PlayRunnerTerminalTransportResult =
   | (Omit<FailedRunnerResult, 'checkpoint'> &
       (OmittedTerminalCheckpoint | AbsentCheckpoint));
 
+export type PlayRunnerTerminalTransportEvent = {
+  type: 'result';
+  result: PlayRunnerTerminalTransportResult;
+  finalProgressEvents?: PlayRunnerEvent[];
+  finalProgressLogOffset?: number;
+};
+
+export function runnerTerminalHandoffForTransport(
+  result: PlayRunnerResult | PlayRunnerTerminalTransportResult,
+  progressPusher?: RunnerProgressPusher | null,
+): {
+  event: PlayRunnerTerminalTransportEvent;
+  progress?: ReturnType<RunnerProgressPusher['sealForTerminal']>;
+} {
+  const finalProgress = progressPusher?.sealForTerminal();
+  const terminalResult = runnerTerminalResultForTransport(result);
+  return {
+    event: {
+      type: 'result',
+      result: terminalResult,
+      ...(finalProgress && terminalResult.status !== 'suspended'
+        ? {
+            finalProgressLogOffset: finalProgress.liveLogOffset,
+            ...(finalProgress.events.length
+              ? { finalProgressEvents: finalProgress.events }
+              : {}),
+          }
+        : {}),
+    },
+    progress: finalProgress,
+  };
+}
+
 type SettledRunnerTerminalTransportResult = Exclude<
   PlayRunnerTerminalTransportResult,
   SuspendedRunnerResult & IncludedResumeCheckpoint

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-payload-transport.ts

@@ -205,7 +205,7 @@ function writeDiagnostic(line) {
   postTerminalDiagnosticBytesRemaining -= Buffer.byteLength(bounded, 'utf8') + 1;
 }
 
-function readResultFromOutput() {
+function readResultEventFromOutput() {
   try {
     const stat = fs.statSync(outputPath);
     const start = Math.max(0, stat.size - MAX_OUTPUT_BYTES);
@@ -225,7 +225,7 @@ function readResultFromOutput() {
           event.result &&
           ['completed', 'failed', 'suspended'].includes(event.result.status)
         ) {
-          return event.result;
+          return event;
         }
       } catch {}
     }
@@ -396,7 +396,8 @@ async function main() {
     writeDiagnostic('[crash-terminal] no push config; skipping');
     return;
   }
-  const parsedResult = readResultFromOutput();
+  const parsedResultEvent = readResultEventFromOutput();
+  const parsedResult = parsedResultEvent && parsedResultEvent.result;
   // Exit codes are authored-program output too: a play may intentionally call
   // process.exit(124). Only the separate parent watchdog writes this marker.
   const runtimeLimitExceeded = Boolean(
@@ -492,6 +493,12 @@ async function main() {
     action: 'runner_terminal',
     runId: push.runId,
     result,
+    ...(parsedResultEvent && parsedResultEvent.finalProgressEvents !== undefined
+      ? { finalProgressEvents: parsedResultEvent.finalProgressEvents }
+      : {}),
+    ...(parsedResultEvent && parsedResultEvent.finalProgressLogOffset !== undefined
+      ? { finalProgressLogOffset: parsedResultEvent.finalProgressLogOffset }
+      : {}),
   });
   for (let attempt = 1; attempt <= 3; attempt += 1) {
     const controller = new AbortController();

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/absurd-runtime-worker.ts

@@ -278,6 +278,7 @@ import {
 import {
   abandonRuntimeSandboxOperationReservation,
   bindRuntimeSandboxCapacityLease,
+  createRuntimeSandboxOperationReservation,
   readReservedDaytonaCancellationOperation,
   recordRecoveredDaytonaCancellationSandbox,
   reserveRuntimeSandboxOperation,
@@ -3889,14 +3890,22 @@ async function executeAssignedAbsurdAttempt(input: {
                     resumePendingDaytonaOperation: provider === 'daytona',
                     operationKey: `sandbox-operation:${runId}:${generation}:${provider}:${providerAttempt ?? 1}`,
                   };
-                  const reserve = () =>
-                    deps.runWithClient((client) =>
-                      reserveRuntimeSandboxOperation(
-                        client,
-                        reservationInput,
-                        options,
-                      ),
-                    );
+                  // A pooled callback may retry after its INSERT committed.
+                  // Keep unsent-create authority outside those callback retries;
+                  // a later admission invocation must reconcile the prior key.
+                  const reserveOperation =
+                    provider === 'daytona'
+                      ? createRuntimeSandboxOperationReservation(
+                          reservationInput,
+                          options,
+                        )
+                      : (client: PostgresSchedulerQueryClient) =>
+                          reserveRuntimeSandboxOperation(
+                            client,
+                            reservationInput,
+                            options,
+                          );
+                  const reserve = () => deps.runWithClient(reserveOperation);
                   const deferForSchedulerFailure = (error: unknown): never => {
                     console.warn(
                       '[absurd-runtime.worker] sandbox_capacity_admission_deferred',

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -7,6 +7,7 @@ import { mkdir, rm, writeFile } from 'node:fs/promises';
 import { createHash, randomUUID } from 'node:crypto';
 import { dirname, isAbsolute, join, relative, sep } from 'node:path';
 import { tmpdir } from 'node:os';
+import { decodeJwt } from 'jose';
 import {
   acquirePgNotifyHub,
   resolveWorkflowRuntimePostgresUrl,
@@ -18796,6 +18797,35 @@ export async function dispatchRunLedgerOutboxToLedgerThroughEventWithClientScope
     maxEvents?: number;
   },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<PostgresSchedulerOutboxDrainResult> {
+  return dispatchRunLedgerOutboxThroughEventWithScope(
+    withClient,
+    input,
+    options,
+  );
+}
+
+type RunLedgerOutboxDrainScope = {
+  runId: string;
+  leaseOwner: string;
+  targetEventId: string;
+  nextClaimed: PostgresSchedulerOutboxEvent[];
+  authority: {
+    runtimeApi: WorkerRuntimeApiContext;
+    expiresAtMs: number;
+  } | null;
+};
+
+async function dispatchRunLedgerOutboxThroughEventWithScope(
+  withClient: <T>(
+    operation: (client: PostgresSchedulerQueryClient) => Promise<T>,
+  ) => Promise<T>,
+  input: RunLedgerOutboxDispatchInput & {
+    targetEventId: string;
+    maxEvents?: number;
+  },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+  scope?: RunLedgerOutboxDrainScope,
 ): Promise<PostgresSchedulerOutboxDrainResult> {
   const runId = input.runId?.trim();
   if (!runId) {
@@ -18822,18 +18852,17 @@ export async function dispatchRunLedgerOutboxToLedgerThroughEventWithClientScope
 
   let remaining = maxEvents;
   while (remaining === null || remaining > 0) {
-    const result =
-      await dispatchRunLedgerOutboxToLedgerBatchOnceWithClientScope(
-        withClient,
-        {
-          ...input,
-          waitForRunLock: true,
-          continueThroughTerminal: false,
-          limit:
-            remaining === null ? batchSize : Math.min(batchSize, remaining),
-        },
-        options,
-      );
+    const result = await dispatchRunLedgerOutboxBatchWithScope(
+      withClient,
+      {
+        ...input,
+        waitForRunLock: true,
+        continueThroughTerminal: false,
+        limit: remaining === null ? batchSize : Math.min(batchSize, remaining),
+      },
+      options,
+      scope,
+    );
     attempted += result.attempted;
     projected += result.projected;
     failed += result.failed;
@@ -18859,7 +18888,12 @@ export async function dispatchRunLedgerOutboxToLedgerThroughEventWithClientScope
     // A projection failure is durably scheduled for retry or moved to terminal
     // DLQ. Its policy owns the next attempt; spinning here would only reclaim
     // the same failed predecessor and delay the park indefinitely.
-    if (result.projected === 0 || result.attempted === 0) break;
+    if (
+      result.projected === 0 ||
+      result.attempted === 0 ||
+      (scope && scope.nextClaimed.length === 0)
+    )
+      break;
   }
 
   // A concurrent dispatcher can claim the target between batches. An empty
@@ -18905,11 +18939,37 @@ export async function dispatchRunLedgerOutboxToLedgerBatchOnceWithClientScope(
   ) => Promise<T>,
   input: RunLedgerOutboxDispatchInput & { waitForRunLock?: boolean },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<PostgresSchedulerOutboxProjectionResult> {
+  return dispatchRunLedgerOutboxBatchWithScope(withClient, input, options);
+}
+
+async function dispatchRunLedgerOutboxBatchWithScope(
+  withClient: <T>(
+    operation: (client: PostgresSchedulerQueryClient) => Promise<T>,
+  ) => Promise<T>,
+  input: RunLedgerOutboxDispatchInput & { waitForRunLock?: boolean },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+  scope?: RunLedgerOutboxDrainScope,
 ): Promise<PostgresSchedulerOutboxProjectionResult> {
   const dispatchStartedAtMs = Date.now();
   const leaseOwner =
     input.leaseOwner?.trim() || `run-ledger-outbox-dispatch:${randomUUID()}`;
-  const events = await withClient(async (client) => {
+  const continuation: { current: RunLedgerOutboxDrainScope | null } = {
+    current: scope ?? null,
+  };
+  const releasePendingContinuation = async () => {
+    const nextClaimed = continuation.current?.nextClaimed ?? [];
+    if (nextClaimed.length === 0) return;
+    await withClient((client) =>
+      releasePostgresSchedulerOutboxLease(
+        client,
+        nextClaimed.map((event) => event.eventId),
+        { ...options, leaseOwner },
+      ),
+    );
+    nextClaimed.length = 0;
+  };
+  const claimEvents = async (client: PostgresSchedulerQueryClient) => {
     // The checkout is exclusive. Hold the existing scheduler run's row lock
     // only while choosing/claiming its outbox prefix, never over HTTP. A
     // second statement takes a fresh READ COMMITTED snapshot after the lock:
@@ -19037,7 +19097,10 @@ export async function dispatchRunLedgerOutboxToLedgerBatchOnceWithClientScope(
       await client.query('ROLLBACK');
       throw error;
     }
-  });
+  };
+  const events = scope?.nextClaimed.length
+    ? scope.nextClaimed.splice(0)
+    : await withClient(claimEvents);
   if (events.length === 0) {
     return {
       attempted: 0,
@@ -19057,9 +19120,19 @@ export async function dispatchRunLedgerOutboxToLedgerBatchOnceWithClientScope(
   try {
     const first = events[0]!;
     const tokenAuthority = input.tokenAuthority ?? 'local_mint';
+    if (
+      scope &&
+      (scope.runId !== first.runId || scope.leaseOwner !== leaseOwner)
+    ) {
+      throw new Error('Run-ledger continuation is outside its dispatch scope.');
+    }
+    if (scope?.authority && scope.authority.expiresAtMs <= Date.now()) {
+      throw new Error('Run-ledger continuation authority expired.');
+    }
     const gatewayRuntimeApi =
       tokenAuthority === 'gateway'
-        ? await loadPostgresSchedulerRuntimeApiForRun(
+        ? (scope?.authority?.runtimeApi ??
+          (await loadPostgresSchedulerRuntimeApiForRun(
             withClient,
             first.runId,
             first.leaseOwner
@@ -19068,7 +19141,7 @@ export async function dispatchRunLedgerOutboxToLedgerBatchOnceWithClientScope(
             tokenAuthority,
             options,
             input.runtimeApi?.signal,
-          )
+          )))
         : null;
     const resolvedRuntimeApi =
       gatewayRuntimeApi ??
@@ -19110,6 +19183,12 @@ export async function dispatchRunLedgerOutboxToLedgerBatchOnceWithClientScope(
       // The caller-owned admission deadline (see `signal` above) wins.
       ...(input.signal ? { signal: input.signal } : {}),
     };
+    const tokenExpiresAtMs = runtimeApiTokenExpiresAtMs(
+      runtimeApi.executorToken,
+    );
+    if (scope && gatewayRuntimeApi && tokenExpiresAtMs !== null) {
+      scope.authority = { runtimeApi, expiresAtMs: tokenExpiresAtMs };
+    }
     authorityReadyAtMs = Date.now();
     const renewDelivery = () =>
       withClient((client) =>
@@ -19123,13 +19202,14 @@ export async function dispatchRunLedgerOutboxToLedgerBatchOnceWithClientScope(
           options,
         ),
       );
-    await renewDelivery();
     // A pending start is always claimed alone because later events require its
     // snapshot. It cannot share the append endpoint, so retain that mutation
     // as its own exact delivery.
     if (first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runCreated) {
+      await renewDelivery();
       await projectPostgresSchedulerCreatedEvent(runtimeApi, first);
     } else if (first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runStarted) {
+      await renewDelivery();
       const leaseOwner = first.leaseOwner;
       const launch = leaseOwner
         ? await withClient((client) =>
@@ -19173,16 +19253,18 @@ export async function dispatchRunLedgerOutboxToLedgerBatchOnceWithClientScope(
                 deliveryDigest: batchDeliveryKey,
               }),
         });
+      } else {
+        await renewDelivery();
       }
     }
     appendFinishedAtMs = Date.now();
-    const deliveredRows = await withClient((client) =>
-      markPostgresSchedulerOutboxDeliveredRows(
-        client,
-        events.map((event) => event.eventId),
-        { ...options, leaseOwner },
-      ),
+    const acknowledgement = await acknowledgeRunLedgerPrefixWithContinuation(
+      withClient,
+      { input, events, leaseOwner, runtimeApi, scope, continuation },
+      options,
     );
+    const { deliveredRows } = acknowledgement;
+    if (!acknowledgement.continuation) await releasePendingContinuation();
     acknowledgedAtMs = Date.now();
     const markedDelivered = deliveredRows.length;
     if (input.onDelivered && deliveredRows.length > 0) {
@@ -19210,19 +19292,16 @@ export async function dispatchRunLedgerOutboxToLedgerBatchOnceWithClientScope(
       retrying: 0,
       retryingEventIds: [],
     };
-    if (
-      input.continueThroughTerminal !== true ||
-      input.headEventId ||
-      markedDelivered !== events.length
-    ) {
+    if (!acknowledgement.continuation || scope) {
       return delivered;
     }
     return await continueRunLedgerOutboxThroughTerminal(
       withClient,
-      { input, leaseOwner, runId: first.runId, delivered, events },
+      { input, delivered, scope: acknowledgement.continuation },
       options,
     );
   } catch (error) {
+    await releasePendingContinuation();
     if (input.signal?.aborted) {
       // The caller's latency budget expired; this is not a delivery failure.
       // Release the lease (fenced to this owner) without charging a
@@ -19310,19 +19389,10 @@ export async function dispatchRunLedgerOutboxToLedgerBatchOnceWithClientScope(
 }
 
 /**
- * Whoever holds a run's outbox lease delivers its terminal fact.
- *
- * A worker commits a run's terminal and immediately asks to deliver it
- * (`run-terminal:<runId>`). When another dispatcher (normally the projector)
- * is mid-append on an earlier event of the same run, that run-scoped claim
- * finds the run leased and correctly claims nothing, and the terminal then
- * waited for the projector's next wave: seconds of a finished run still
- * reading "running" (live-run-observation-e2e, 4.2 s). So the lease holder,
- * having acknowledged its batch, carries the run's terminal fact through in
- * the same turn when it is now pending. The terminal is the run's last fact,
- * so this is one finite causal drain (the same leased, idempotent
- * `dispatchRunLedgerOutboxToLedgerThroughEvent` the worker uses), not a loop;
- * a run without a pending terminal costs one indexed read.
+ * A terminal producer cannot claim an earlier prefix held by a projector.
+ * The existing owner atomically retains each successor through the persisted
+ * terminal, preserving ordered receipts without waiting for another wave.
+ * With no pending terminal, the ACK transaction retains no successor.
  */
 async function continueRunLedgerOutboxThroughTerminal(
   withClient: <T>(
@@ -19330,36 +19400,22 @@ async function continueRunLedgerOutboxThroughTerminal(
   ) => Promise<T>,
   input: {
     input: RunLedgerOutboxDispatchInput & { waitForRunLock?: boolean };
-    leaseOwner: string;
-    runId: string;
     delivered: PostgresSchedulerOutboxProjectionResult;
-    events: readonly PostgresSchedulerOutboxEvent[];
+    scope: RunLedgerOutboxDrainScope;
   },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<PostgresSchedulerOutboxProjectionResult> {
-  const terminalEventId = `run-terminal:${input.runId}`;
-  if (input.events.some((event) => event.eventId === terminalEventId)) {
-    return input.delivered;
-  }
-  const terminal = await withClient((client) =>
-    readPostgresSchedulerOutboxDeliveryStatus(
-      client,
-      { runId: input.runId, eventId: terminalEventId },
-      { ...options, includeBlocked: false },
-    ),
+  const drained = await dispatchRunLedgerOutboxThroughEventWithScope(
+    withClient,
+    {
+      ...input.input,
+      runId: input.scope.runId,
+      leaseOwner: input.scope.leaseOwner,
+      targetEventId: input.scope.targetEventId,
+    },
+    options,
+    input.scope,
   );
-  if (!terminal.exists || terminal.delivered) return input.delivered;
-  const drained =
-    await dispatchRunLedgerOutboxToLedgerThroughEventWithClientScope(
-      withClient,
-      {
-        ...input.input,
-        runId: input.runId,
-        leaseOwner: input.leaseOwner,
-        targetEventId: terminalEventId,
-      },
-      options,
-    );
   return {
     attempted: input.delivered.attempted + drained.attempted,
     projected: input.delivered.projected + drained.projected,
@@ -19371,6 +19427,120 @@ async function continueRunLedgerOutboxThroughTerminal(
   };
 }
 
+function runtimeApiTokenExpiresAtMs(token: string): number | null {
+  try {
+    const expiresAt = decodeJwt(token).exp;
+    return typeof expiresAt === 'number' && Number.isFinite(expiresAt)
+      ? expiresAt * 1_000
+      : null;
+  } catch {
+    // Opaque legacy/test tokens retain the existing fresh-authority path.
+    return null;
+  }
+}
+
+async function acknowledgeRunLedgerPrefixWithContinuation(
+  withClient: <T>(
+    operation: (client: PostgresSchedulerQueryClient) => Promise<T>,
+  ) => Promise<T>,
+  input: {
+    input: RunLedgerOutboxDispatchInput;
+    events: PostgresSchedulerOutboxEvent[];
+    leaseOwner: string;
+    runtimeApi: WorkerRuntimeApiContext;
+    scope?: RunLedgerOutboxDrainScope;
+    continuation: { current: RunLedgerOutboxDrainScope | null };
+  },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<{
+  deliveredRows: RunLedgerOutboxDeliveredRow[];
+  continuation: RunLedgerOutboxDrainScope | null;
+}> {
+  const runId = input.events[0]!.runId;
+  const targetEventId = input.scope?.targetEventId ?? `run-terminal:${runId}`;
+  const retainContinuation =
+    !!input.scope ||
+    (input.input.continueThroughTerminal === true && !input.input.headEventId);
+  return withClient(async (client) => {
+    if (retainContinuation) {
+      await client.query('BEGIN');
+    }
+    try {
+      if (retainContinuation) {
+        await client.query(
+          `SELECT set_config('lock_timeout', $1, true), set_config('statement_timeout', $2, true)`,
+          [
+            `${RUNTIME_SCHEDULER_CANCEL_LOCK_TIMEOUT_MS}ms`,
+            `${RUNTIME_SCHEDULER_CANCEL_STATEMENT_TIMEOUT_MS}ms`,
+          ],
+        );
+        // Keep the acknowledged prefix and its successor under one run lock.
+        // No competing projector can take the next head while this ACK's
+        // response is travelling back to the lease holder.
+        await client.query(
+          `SELECT run_id FROM ${tableName('runs', options)} WHERE run_id = $1 FOR UPDATE`,
+          [runId],
+        );
+      }
+      const deliveredRows = await markPostgresSchedulerOutboxDeliveredRows(
+        client,
+        input.events.map((event) => event.eventId),
+        { ...options, leaseOwner: input.leaseOwner },
+      );
+      let continuation: RunLedgerOutboxDrainScope | null = null;
+      if (
+        retainContinuation &&
+        deliveredRows.length === input.events.length &&
+        !input.events.some((event) => event.eventId === targetEventId)
+      ) {
+        const target = await readPostgresSchedulerOutboxDeliveryStatus(
+          client,
+          { runId, eventId: targetEventId },
+          options,
+        );
+        if (target.exists && !target.delivered && !target.blocked) {
+          const nextClaimed = await readPendingPostgresSchedulerOutboxEvents(
+            client,
+            {
+              runId,
+              leaseOwner: input.leaseOwner,
+              leaseSeconds: input.input.leaseSeconds ?? 120,
+              limit: Math.min(
+                RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS,
+                input.input.limit ?? 1,
+              ),
+              inTransaction: true,
+            },
+            options,
+          );
+          if (nextClaimed.length > 0) {
+            const expiresAtMs = runtimeApiTokenExpiresAtMs(
+              input.runtimeApi.executorToken,
+            );
+            continuation = input.scope ?? {
+              runId,
+              leaseOwner: input.leaseOwner,
+              targetEventId,
+              nextClaimed: [],
+              authority:
+                input.input.tokenAuthority === 'gateway' && expiresAtMs !== null
+                  ? { runtimeApi: input.runtimeApi, expiresAtMs }
+                  : null,
+            };
+            continuation.nextClaimed = nextClaimed;
+            input.continuation.current = continuation;
+          }
+        }
+      }
+      if (retainContinuation) await client.query('COMMIT');
+      return { deliveredRows, continuation };
+    } catch (error) {
+      if (retainContinuation) await client.query('ROLLBACK');
+      throw error;
+    }
+  });
+}
+
 async function projectPostgresSchedulerCreatedEvent(
   runtimeApi: WorkerRuntimeApiContext,
   event: PostgresSchedulerOutboxEvent,

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/runtime-sandbox-capacity.ts

@@ -26,6 +26,10 @@ export const RUNTIME_SANDBOX_CAPACITY_LEASE_MS = 50 * 60 * 1_000;
  */
 export type RuntimeSandboxCapacityAdmissionMode = 'observe' | 'enforce';
 
+// Only a still-unresolved admission callback can prove its own create is unsent.
+// This authority is process-local and cannot be reconstructed from stored keys.
+const unsentReservationInputs = new WeakMap<object, string>();
+
 export function runtimeSandboxCapacityAdmissionMode(
   env: Record<string, string | undefined> = process.env,
 ): RuntimeSandboxCapacityAdmissionMode {
@@ -306,10 +310,12 @@ export async function reserveRuntimeSandboxCapacityLease(
   const activeLeases = Number(observed.rows[0]?.active_leases ?? 0);
   const wouldDefer = activeLeases >= limit;
   const leaseId = input.leaseId?.trim() || randomUUID();
+  const unsentProviderOperationToken = unsentReservationInputs.get(input);
   const providerOperationToken =
     input.attempt === undefined
       ? null
-      : runtimeSandboxProviderOperationToken(leaseId);
+      : (unsentProviderOperationToken ??
+        runtimeSandboxProviderOperationToken(leaseId));
   if (
     input.resumePendingDaytonaOperation === true &&
     input.provider === RuntimeSandboxProvider.Daytona &&
@@ -342,7 +348,15 @@ export async function reserveRuntimeSandboxCapacityLease(
       );
     }
     const pendingOperation = pending.rows[0];
-    if (pendingOperation) {
+    if (
+      pendingOperation &&
+      !(
+        pendingOperation.lease_id === leaseId &&
+        pendingOperation.provider_operation_token ===
+          unsentProviderOperationToken &&
+        unsentProviderOperationToken !== undefined
+      )
+    ) {
       const pendingToken =
         pendingOperation.provider_operation_token ??
         (await backfillReservedProviderOperationToken(
@@ -424,7 +438,8 @@ export async function reserveRuntimeSandboxCapacityLease(
     if (
       input.attempt !== undefined &&
       row.provider_operation_token !== null &&
-      row.provider_operation_token !== providerOperationToken
+      row.provider_operation_token !== providerOperationToken &&
+      unsentProviderOperationToken === undefined
     ) {
       throw new Error(
         'operationKey reservation has an incompatible provider operation token.',
@@ -450,7 +465,10 @@ export async function reserveRuntimeSandboxCapacityLease(
             provider: input.provider,
             attempt: input.attempt,
             environment: input.environment ?? 'production',
-            providerOperationToken,
+            providerOperationToken:
+              unsentProviderOperationToken === undefined
+                ? providerOperationToken
+                : runtimeSandboxProviderOperationToken(leaseId),
           },
           options,
         );
@@ -462,7 +480,9 @@ export async function reserveRuntimeSandboxCapacityLease(
       limit,
       activeLeases,
       wouldDefer,
-      resumeExistingProviderOperation: false,
+      resumeExistingProviderOperation:
+        unsentProviderOperationToken !== undefined &&
+        resolvedProviderOperationToken !== unsentProviderOperationToken,
     };
   }
   if (wouldDefer && (input.mode ?? 'enforce') === 'enforce') {
@@ -545,14 +565,33 @@ export async function reserveRuntimeSandboxCapacityLease(
       'operationKey reservation did not persist the requested sandbox operation.',
     );
   }
+  const resolvedProviderOperationToken =
+    row.provider_operation_token === null && input.attempt !== undefined
+      ? await backfillReservedProviderOperationToken(
+          client,
+          {
+            leaseId,
+            orgId,
+            runId,
+            provider: input.provider,
+            attempt: input.attempt,
+            environment: input.environment ?? 'production',
+            providerOperationToken:
+              runtimeSandboxProviderOperationToken(leaseId),
+          },
+          options,
+        )
+      : row.provider_operation_token;
   return {
     granted: true,
     leaseId,
-    providerOperationToken: row.provider_operation_token,
+    providerOperationToken: resolvedProviderOperationToken,
     limit,
     activeLeases,
     wouldDefer,
-    resumeExistingProviderOperation: false,
+    resumeExistingProviderOperation:
+      unsentProviderOperationToken !== undefined &&
+      resolvedProviderOperationToken !== unsentProviderOperationToken,
   };
 }
 
@@ -649,6 +688,54 @@ export async function reserveRuntimeSandboxOperation(
   );
 }
 
+/**
+ * Create once per provider admission, outside pooled callback retries. A fresh
+ * token identifies this invocation's unsent reservation, while the deterministic
+ * operation key still coalesces concurrent admission. A losing invocation must
+ * reconcile the winning token, even on 404.
+ * The callback becomes unusable on resolution, before provider I/O can start.
+ */
+export function createRuntimeSandboxOperationReservation(
+  input: Parameters<typeof reserveRuntimeSandboxOperation>[1],
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+) {
+  if (!Number.isSafeInteger(input.attempt) || input.attempt < 1) {
+    throw new Error('attempt must be a positive safe integer.');
+  }
+  const reservationInput: Parameters<
+    typeof reserveRuntimeSandboxCapacityLease
+  >[1] = {
+    ...input,
+    leaseId: assertId(input.operationKey, 'operationKey'),
+  };
+  unsentReservationInputs.set(
+    reservationInput,
+    runtimeSandboxProviderOperationToken(randomUUID()),
+  );
+  let inFlight = false;
+  let settled = false;
+  return async (client: PostgresSchedulerQueryClient) => {
+    if (inFlight || settled) {
+      throw new Error(
+        'Sandbox reservation callback is already in use or settled.',
+      );
+    }
+    inFlight = true;
+    try {
+      const reserved = await reserveRuntimeSandboxCapacityLease(
+        client,
+        reservationInput,
+        options,
+      );
+      settled = true;
+      unsentReservationInputs.delete(reservationInput);
+      return reserved;
+    } finally {
+      inFlight = false;
+    }
+  };
+}
+
 export async function bindRuntimeSandboxCapacityLease(
   client: PostgresSchedulerQueryClient,
   input: {

package/dist/bundling-sources/shared_libs/play-runtime/tool-execute-retry-policy.ts

@@ -242,6 +242,25 @@ function isConcurrencyBackpressureResponse(input: {
   );
 }
 
+function isCredentialDispatchRefusalResponse(input: {
+  status: number;
+  bodyText: string;
+  executionFenced?: boolean;
+}): boolean {
+  // Fenced gateway attempts have their own qualified redelivery contract.
+  // This exemption is only for the ordinary execute route's released charge.
+  if (input.status !== 429 || input.executionFenced === true) return false;
+  const body = parseJsonObject(input.bodyText);
+  return (
+    body?.code === 'RATE_LIMIT' &&
+    body.failure_origin === 'deepline_rate_limit' &&
+    body.error_category === 'rate_limit' &&
+    body.rate_limit_bucket_scope === 'credential_shared' &&
+    body.rate_limit_kind === 'requests_per_second' &&
+    body.provider_request_dispatched === false
+  );
+}
+
 function isRuntimeSchedulerCapacityResponse(input: {
   status: number;
   bodyText: string;
@@ -573,6 +592,7 @@ export function classifyToolExecuteHttpFailure(input: {
   const concurrencyBackpressure = isConcurrencyBackpressureResponse(input);
   const runtimeSchedulerCapacity = isRuntimeSchedulerCapacityResponse(input);
   const providerPacingWait = isProviderPacingWaitResponse(input);
+  const credentialDispatchRefusal = isCredentialDispatchRefusalResponse(input);
   const edgeGatewayFailure = isEdgeGatewayFailureResponse(input);
   const executionFenced = input.executionFenced === true;
   const explicitRetryable = readExplicitToolHttpRetryability(input);
@@ -747,11 +767,12 @@ export function classifyToolExecuteHttpFailure(input: {
       retryDecision.reason !== 'concurrency_backpressure' &&
       retryDecision.reason !== 'runtime_scheduler_capacity' &&
       retryDecision.reason !== 'provider_pacing_wait',
-    // Scheduler capacity and the relay's explicit concurrency shed both occur
-    // before a provider request is dispatched. Carry that proof in the shared
-    // classification so the retry boundary can safely pace either response
-    // without asking a non-idempotent provider call to be replayed.
+    // Only explicit pre-dispatch refusals permit automatic replay of an
+    // operation that does not declare ordinary transient retry safety.
     knownNotDispatched:
-      runtimeSchedulerCapacity || concurrencyBackpressure || providerPacingWait,
+      runtimeSchedulerCapacity ||
+      concurrencyBackpressure ||
+      providerPacingWait ||
+      credentialDispatchRefusal,
   };
 }

package/dist/bundling-sources/shared_libs/security/secret-redaction.ts

@@ -370,6 +370,12 @@ function isPublicResultSafeTokenKey(
 }
 
 function maybeRedactString(value: string, options: SecretRedactionOptions) {
+  // These names are credentials only on MillionVerifier URLs. Keep unrelated
+  // object identifiers named `key` and other providers' query fields intact.
+  value = value.replace(
+    /https?:\/\/(?:api|bulkapi)\.millionverifier\.com(?=[:/?#]|$)[^\s"'<>]*/gi,
+    (url) => url.replace(/([?&](?:api|key)=)[^&#\s"'<>]*/gi, '$1[REDACTED]'),
+  );
   if (hasExplicitSecretValue(value, options)) {
     return REDACTED_VALUE;
   }

package/dist/cli/index.js

@@ -3515,7 +3515,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.281",
+  version: "0.3.283",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/cli/index.mjs

@@ -3510,7 +3510,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.281",
+  version: "0.3.283",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.js

@@ -1328,7 +1328,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.281",
+  version: "0.3.283",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.mjs

@@ -1232,7 +1232,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.281",
+  version: "0.3.283",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.d.mts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.281";
+    readonly version: "0.3.283";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.d.ts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.281";
+    readonly version: "0.3.283";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.js

@@ -74,7 +74,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.281",
+  version: "0.3.283",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.mjs

@@ -48,7 +48,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.281",
+  version: "0.3.283",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.3.281",
+  "version": "0.3.283",
   "description": "GTM data CLI and TypeScript SDK for coding agents",
   "license": "MIT",
   "homepage": "https://code.deepline.com",