deepline 0.3.289 → 0.3.291

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -1,3 +1,9 @@
+import {
+  parseRunLedgerDispatchLaunch,
+  runLedgerDispatchLaunchSql,
+  type RunLedgerDispatchLaunch,
+} from './run-ledger-dispatch-authority';
+import { normalizeRunLogIds } from '../run-log-buffer';
 import {
   retainedPlayPipelineFields,
   hydrateRetainedPlayPipelines,
@@ -28,6 +34,8 @@ import type {
 import { PROD_DEFAULT_RUNTIME_SCHEDULER_SCHEMA } from '../runtime-scheduler-topology';
 import {
   RUNTIME_EVENT_CANONICAL_RETENTION_INDEX_READY_MARKER,
+  RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD,
+  RUNTIME_EVENT_SEARCH_ONLY_FIELD,
   RUNTIME_EVENT_SEARCH_OUTBOX_PROJECTION_MARKER,
 } from './runtime-event-search';
 import type { PlayRunnerRuntimeResource } from '../runner-backends/types';
@@ -83,6 +91,8 @@ import {
 import { normalizePlayDocflowNodeIoState } from '../docflow-node-io';
 import {
   normalizePlayLogContext,
+  normalizePlayLogMetadata,
+  type PlayLogMetadata,
   type PlayLogContext,
 } from '../log-context';
 import {
@@ -105,7 +115,6 @@ import {
   RUN_SCHEDULER_OUTBOX_START_EVENT_TYPES,
   RUN_SCHEDULER_OUTBOX_EVENT_TYPE,
   RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL,
-  RUN_SCHEDULER_OUTBOX_PREFIX_STOP_EVENT_TYPES,
   RUN_SCHEDULER_OUTBOX_TERMINAL_EVENT_TYPES,
 } from '../run-event-catalog';
 import { stableStringify } from '../../plays/row-identity';
@@ -336,7 +345,10 @@ const POSTGRES_SCHEDULER_SCHEMA_INIT_STATEMENT_TIMEOUT_MS = 60_000;
 // recovery, which scans only active runs for each release lane.
 // v57 refreshes log-position lookups after the operator concurrently prepares
 // channel-specific indexes; outgoing readers retain the existing GIN index.
-export const POSTGRES_SCHEDULER_SCHEMA_VERSION = 57;
+// v58 installs deferred outbox readers while retaining synchronous writers
+// until the separately operated, reader-first cutover.
+// v59 adds origin identity bulk projection and independent durable search progress.
+export const POSTGRES_SCHEDULER_SCHEMA_VERSION = 59;
 const POSTGRES_SCHEDULER_SCHEMA_MIGRATIONS_TABLE =
   'scheduler_schema_migrations';
 export const POSTGRES_SCHEDULER_OPEN_RECOVERY_INDEX =
@@ -471,11 +483,9 @@ type PostgresSchedulerClaimExecutionOptions = Pick<
   /** Internal provider-read coordinates which must survive terminal-worker
    * loss. They are persisted only on the matching durable cleanup obligation. */
   sandboxCrashDiagnostic?: PostgresSchedulerSandboxCrashDiagnosticRequest;
-  /** Settled progress facts for a failed runner result, folded before the
-   * terminal write. They travel in the `run.failed` outbox row ahead of the
-   * terminal fact, the same carrier a direct completion uses, so the ledger
-   * settles them before the run's terminal makes its steps immutable. */
-  failedTerminalProgressEvents?: readonly unknown[];
+  /** Final step facts folded into the terminal outbox instead of a separate
+   * progress write immediately ahead of the terminal. */
+  terminalProgressEvents?: readonly unknown[];
   /** Forwarded to `failPostgresSchedulerAttempt`: a failure terminal written
    * for a detached-runner attempt must not overwrite an authoritative pushed
    * runner terminal that won after the attempt was claimed. */
@@ -1928,6 +1938,24 @@ export async function hasCurrentPostgresSchedulerSchemaShape(
             AND index_row.indrelid = to_regclass($3)
             AND index_row.indisready AND index_row.indisvalid
         )
+        AND EXISTS (
+          SELECT 1 FROM pg_index AS index_row
+          JOIN pg_class AS index_class ON index_class.oid = index_row.indexrelid
+          JOIN pg_namespace AS index_namespace ON index_namespace.oid = index_class.relnamespace
+          WHERE index_namespace.nspname = $1
+            AND index_class.relname = 'runtime_scheduler_outbox_lifecycle_pending_order_idx'
+            AND index_row.indrelid = to_regclass($3)
+            AND index_row.indisready AND index_row.indisvalid
+        )
+        AND EXISTS (
+          SELECT 1 FROM pg_index AS index_row
+          JOIN pg_class AS index_class ON index_class.oid = index_row.indexrelid
+          JOIN pg_namespace AS index_namespace ON index_namespace.oid = index_class.relnamespace
+          WHERE index_namespace.nspname = $1
+            AND index_class.relname = 'runtime_scheduler_outbox_search_pending_order_idx'
+            AND index_row.indrelid = to_regclass($3)
+            AND index_row.indisready AND index_row.indisvalid
+        )
         AND EXISTS (
           SELECT 1 FROM pg_index AS index_row
           JOIN pg_class AS index_class ON index_class.oid = index_row.indexrelid
@@ -2461,6 +2489,7 @@ export async function ensurePostgresSchedulerLaunchAdmissionFunctions(
         jsonb_set(
           launch_json - ARRAY[
             'launchIdentityDigest',
+            'runtimeLogIdentity',
             'executorToken',
             'inputFileId',
             'preloadedDbSessionUnwrapKey',
@@ -3944,6 +3973,26 @@ export async function ensurePostgresSchedulerSchema(
           )
           WHERE delivered_at IS NULL
       `);
+      await client.query(`
+        CREATE INDEX IF NOT EXISTS runtime_scheduler_outbox_lifecycle_pending_order_idx
+          ON ${tableName('outbox', options)} (
+            run_id,
+            (CASE event_type WHEN ${RUN_EVENT_KIND_SQL_LITERAL.runCreated} THEN 0 WHEN ${RUN_EVENT_KIND_SQL_LITERAL.runStarted} THEN 1 ELSE 2 END),
+            created_at,
+            event_id
+          )
+          WHERE delivered_at IS NULL AND ${searchLaneSql('outbox')} = false
+      `);
+      await client.query(`
+        CREATE INDEX IF NOT EXISTS runtime_scheduler_outbox_search_pending_order_idx
+          ON ${tableName('outbox', options)} (
+            run_id,
+            (CASE event_type WHEN ${RUN_EVENT_KIND_SQL_LITERAL.runCreated} THEN 0 WHEN ${RUN_EVENT_KIND_SQL_LITERAL.runStarted} THEN 1 ELSE 2 END),
+            created_at,
+            event_id
+          )
+          WHERE delivered_at IS NULL AND ${searchLaneSql('outbox')} = true
+      `);
       await client.query(`
         CREATE INDEX IF NOT EXISTS runtime_scheduler_outbox_lease_health_idx
           ON ${tableName('outbox', options)}
@@ -4094,6 +4143,22 @@ const POSTGRES_SCHEDULER_RUNTIME_ADMIN_INDEXES = [
       created_at, event_id)
       WHERE delivered_at IS NULL`,
   },
+  {
+    name: 'runtime_scheduler_outbox_lifecycle_pending_order_idx',
+    table: 'outbox',
+    definition: `(run_id,
+      (CASE event_type WHEN ${RUN_EVENT_KIND_SQL_LITERAL.runCreated} THEN 0 WHEN ${RUN_EVENT_KIND_SQL_LITERAL.runStarted} THEN 1 ELSE 2 END),
+      created_at, event_id)
+      WHERE delivered_at IS NULL AND ${searchLaneSql('outbox')} = false`,
+  },
+  {
+    name: 'runtime_scheduler_outbox_search_pending_order_idx',
+    table: 'outbox',
+    definition: `(run_id,
+      (CASE event_type WHEN ${RUN_EVENT_KIND_SQL_LITERAL.runCreated} THEN 0 WHEN ${RUN_EVENT_KIND_SQL_LITERAL.runStarted} THEN 1 ELSE 2 END),
+      created_at, event_id)
+      WHERE delivered_at IS NULL AND ${searchLaneSql('outbox')} = true`,
+  },
   {
     name: 'runtime_scheduler_outbox_lease_health_idx',
     table: 'outbox',
@@ -10318,8 +10383,8 @@ export async function recordPostgresSchedulerRunnerTerminal(
   const recorded = await client.query<{ run_id: string }>(
     `
       WITH accepted AS MATERIALIZED (
-        -- Match direct completion's Run -> attempt lock order. The log
-        -- acceptance trigger also locks the Run for sequence assignment.
+        -- Record the authoritative terminal boundary before accepting the
+        -- attempt payload; deferred log indexing owns no Run row lock.
         SELECT clock_timestamp() AS accepted_at
           FROM ${tableName('runs', options)}
          WHERE run_id = $1
@@ -10758,6 +10823,8 @@ export async function directCompletePostgresSchedulerRunnerTerminal(
             'producerAttempt', $2::integer,
             'terminalLogLines', $7::jsonb,
             'terminalLogContexts', $17::jsonb,
+            'terminalLogMetadata', $20::jsonb,
+            'terminalLogIds', $19::jsonb->'terminalLogIds',
             'terminalProgressEvents', coalesce((
               SELECT accepted.runner_log_payload_json->'terminalProgressEvents'
               FROM completed_attempt AS accepted
@@ -10802,6 +10869,7 @@ export async function directCompletePostgresSchedulerRunnerTerminal(
       JSON.stringify(terminalLogProjection.lineContexts),
       stringifyPostgresJson(terminalWorkCounterSegment ?? null),
       stringifyPostgresJson(runnerTerminalLogPayload(input)),
+      JSON.stringify(terminalLogProjection.lineMetadata),
     ],
   );
   if (completed.rows.length > 0) return 'completed';
@@ -13134,7 +13202,10 @@ export async function completePostgresSchedulerAttempt(
     runtimeTiming?: PlayRunnerRuntimeTiming | null;
     terminalLogLines?: readonly string[] | null;
     terminalLogContexts?: readonly (PlayLogContext | null)[] | null;
+    terminalLogMetadata?: readonly (PlayLogMetadata | null)[] | null;
+    terminalLogIds?: readonly (string | null)[] | null;
     terminalWorkCounterSegment?: PlayRunLedgerTerminalWorkCounterSegment;
+    terminalProgressEvents?: readonly unknown[];
   },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<boolean> {
@@ -13151,10 +13222,24 @@ export async function completePostgresSchedulerAttempt(
       'Terminal log contexts must align with terminal log lines.',
     );
   }
+  if (
+    input.terminalLogMetadata != null &&
+    input.terminalLogMetadata.length !== (input.terminalLogLines ?? []).length
+  ) {
+    throw new TypeError(
+      'Terminal log metadata must align with terminal log lines.',
+    );
+  }
+  const terminalLogIds = normalizeRunLogIds(
+    input.terminalLogIds,
+    input.terminalLogLines ?? [],
+  );
   const terminalLogEntries = (input.terminalLogLines ?? [])
     .map((line, index) => ({
       line: line.trim(),
       context: input.terminalLogContexts?.[index] ?? null,
+      metadata: input.terminalLogMetadata?.[index] ?? null,
+      entryId: terminalLogIds?.[index] ?? null,
     }))
     .filter((entry) => entry.line.length > 0)
     .slice(-LOG_TAIL_LIMIT);
@@ -13162,6 +13247,9 @@ export async function completePostgresSchedulerAttempt(
   const terminalLogContexts = terminalLogEntries.map((entry) =>
     normalizePlayLogContext(entry.context),
   );
+  const terminalLogMetadata = terminalLogEntries.map((entry) =>
+    normalizePlayLogMetadata(entry.metadata),
+  );
   const completed = await client.query<{ run_id: string }>(
     `
       WITH ${runtimeSandboxCustodyLocksSql('run.run_id = $1', options)}, completed AS (
@@ -13340,9 +13428,15 @@ export async function completePostgresSchedulerAttempt(
             'producerAttempt', $2::integer,
             'terminalLogLines', $8::jsonb,
             'terminalLogContexts', $11::jsonb,
+            'terminalLogMetadata', $13::jsonb,
+            'terminalLogIds', $15::jsonb,
             'resultSummary', $10::jsonb,
             'terminalWorkCounterSegment', $12::jsonb
-          ),
+          ) || CASE
+            WHEN jsonb_array_length($14::jsonb) > 0
+              THEN jsonb_build_object('terminalProgressEvents', $14::jsonb)
+            ELSE '{}'::jsonb
+          END,
           ${causalOutboxCreatedAt('run_terminal.run_id', options)}
         FROM run_terminal
         ON CONFLICT (event_id) DO NOTHING
@@ -13365,6 +13459,13 @@ export async function completePostgresSchedulerAttempt(
       stringifyPostgresJson(resultSummary),
       JSON.stringify(terminalLogContexts),
       stringifyPostgresJson(input.terminalWorkCounterSegment ?? null),
+      JSON.stringify(terminalLogMetadata),
+      JSON.stringify(input.terminalProgressEvents ?? []),
+      stringifyPostgresJson(
+        terminalLogIds
+          ? terminalLogEntries.map((entry) => entry.entryId)
+          : null,
+      ),
     ],
   );
   if (completed.rows.length === 0) {
@@ -13383,13 +13484,15 @@ export async function failPostgresSchedulerAttempt(
     result?: unknown;
     terminalLogLines?: readonly string[] | null;
     terminalLogContexts?: readonly (PlayLogContext | null)[] | null;
+    terminalLogMetadata?: readonly (PlayLogMetadata | null)[] | null;
+    terminalLogIds?: readonly (string | null)[] | null;
     /** Refuse to overwrite an authoritative detached runner terminal that won
      * after claim. Resumable `suspended` receipts may be superseded by the
      * hard ceiling in the same fenced statement. */
     preserveRunnerTerminal?: boolean;
     sandboxCrashDiagnostic?: PostgresSchedulerSandboxCrashDiagnosticRequest;
-    /** Progress facts the ledger must apply before `run.failed` (see
-     * `failedTerminalProgressEvents`). Omitted from the payload when empty. */
+    /** Progress facts the ledger must apply before the terminal fact. Omitted
+     * from the payload when empty. */
     terminalProgressEvents?: readonly unknown[];
   },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
@@ -13429,10 +13532,24 @@ export async function failPostgresSchedulerAttempt(
       'Terminal log contexts must align with terminal log lines.',
     );
   }
+  if (
+    input.terminalLogMetadata != null &&
+    input.terminalLogMetadata.length !== (input.terminalLogLines ?? []).length
+  ) {
+    throw new TypeError(
+      'Terminal log metadata must align with terminal log lines.',
+    );
+  }
+  const terminalLogIds = normalizeRunLogIds(
+    input.terminalLogIds,
+    input.terminalLogLines ?? [],
+  );
   const terminalLogEntries = (input.terminalLogLines ?? [])
     .map((line, index) => ({
       line: line.trim(),
       context: input.terminalLogContexts?.[index] ?? null,
+      metadata: input.terminalLogMetadata?.[index] ?? null,
+      entryId: terminalLogIds?.[index] ?? null,
     }))
     .filter((entry) => entry.line.length > 0)
     .slice(-LOG_TAIL_LIMIT);
@@ -13440,6 +13557,9 @@ export async function failPostgresSchedulerAttempt(
   const terminalLogContexts = terminalLogEntries.map((entry) =>
     normalizePlayLogContext(entry.context),
   );
+  const terminalLogMetadata = terminalLogEntries.map((entry) =>
+    normalizePlayLogMetadata(entry.metadata),
+  );
   const failed = await client.query<{ run_id: string }>(
     `
       WITH ${runtimeSandboxCustodyLocksSql('run.run_id = $1', options)}, failed AS (
@@ -13678,6 +13798,8 @@ export async function failPostgresSchedulerAttempt(
             'producerAttempt', $2::integer,
             'terminalLogLines', $12::jsonb,
             'terminalLogContexts', $14::jsonb,
+            'terminalLogMetadata', $17::jsonb,
+            'terminalLogIds', $18::jsonb,
             'resultSummary', $13::jsonb,
             'terminalWorkCounterSegment', $15::jsonb
           ) || CASE
@@ -13711,6 +13833,12 @@ export async function failPostgresSchedulerAttempt(
       JSON.stringify(terminalLogContexts),
       stringifyPostgresJson(terminalWorkCounterSegment ?? null),
       stringifyPostgresJson(input.terminalProgressEvents ?? []),
+      JSON.stringify(terminalLogMetadata),
+      stringifyPostgresJson(
+        terminalLogIds
+          ? terminalLogEntries.map((entry) => entry.entryId)
+          : null,
+      ),
     ],
   );
   return failed.rows.length > 0;
@@ -14413,6 +14541,8 @@ function runnerTerminalLogPayload(input: {
     producerAttempt: input.attempt,
     terminalLogLines: projection.lines,
     terminalLogContexts: projection.lineContexts,
+    terminalLogMetadata: projection.lineMetadata,
+    ...(projection.lineIds ? { terminalLogIds: projection.lineIds } : {}),
     terminalProgressEvents: input.terminalProgressEvents ?? [],
     // Older runner envelopes conveyed these diagnostics only in tagged log
     // text. Preserve their small structured facts before removing that text.
@@ -14433,21 +14563,28 @@ function runnerTerminalLogPayload(input: {
 function terminalLogProjectionForOutbox(
   runnerResult: unknown,
   mode: PostgresSchedulerTerminalLogOutbox | undefined,
-): { lines: string[]; lineContexts: Array<PlayLogContext | null> } {
+): {
+  lines: string[];
+  lineContexts: Array<PlayLogContext | null>;
+  lineMetadata: Array<PlayLogMetadata | null>;
+  lineIds?: Array<string | null>;
+} {
   if (
     mode !== 'ctx_log_tail' ||
     !runnerResult ||
     typeof runnerResult !== 'object'
   ) {
-    return { lines: [], lineContexts: [] };
+    return { lines: [], lineContexts: [], lineMetadata: [] };
   }
   const result = runnerResult as {
     logs?: unknown;
     logContexts?: unknown;
+    logMetadata?: unknown;
+    logIds?: unknown;
   };
   const logs = result.logs;
   if (!Array.isArray(logs)) {
-    return { lines: [], lineContexts: [] };
+    return { lines: [], lineContexts: [], lineMetadata: [] };
   }
   if (
     result.logContexts !== undefined &&
@@ -14456,9 +14593,19 @@ function terminalLogProjectionForOutbox(
   ) {
     throw new TypeError('Terminal log contexts must align with runner logs.');
   }
+  if (
+    result.logMetadata !== undefined &&
+    (!Array.isArray(result.logMetadata) ||
+      result.logMetadata.length !== logs.length)
+  )
+    throw new TypeError('Terminal log metadata must align with logs.');
+  const logMetadata = Array.isArray(result.logMetadata)
+    ? result.logMetadata
+    : undefined;
   const logContexts = Array.isArray(result.logContexts)
     ? result.logContexts
     : undefined;
+  const logIds = normalizeRunLogIds(result.logIds, logs);
   const entries = logs
     .map((line, index) => {
       if (typeof line !== 'string') return null;
@@ -14475,16 +14622,26 @@ function terminalLogProjectionForOutbox(
       return {
         line: line.trim(),
         context: normalizePlayLogContext(logContexts?.[index]),
+        metadata: normalizePlayLogMetadata(logMetadata?.[index]),
+        entryId: logIds?.[index] ?? null,
       };
     })
     .filter(
-      (entry): entry is { line: string; context: PlayLogContext | null } =>
-        entry !== null,
+      (
+        entry,
+      ): entry is {
+        line: string;
+        context: PlayLogContext | null;
+        metadata: PlayLogMetadata | null;
+        entryId: string | null;
+      } => entry !== null,
     )
     .slice(-LOG_TAIL_LIMIT);
   return {
     lines: entries.map((entry) => entry.line),
     lineContexts: entries.map((entry) => entry.context),
+    lineMetadata: entries.map((entry) => entry.metadata),
+    ...(logIds ? { lineIds: entries.map((entry) => entry.entryId) } : {}),
   };
 }
 
@@ -14733,6 +14890,9 @@ export async function executePostgresSchedulerClaim(
         runtimeTiming: extractRunnerRuntimeTiming(output),
         terminalLogLines: terminalLogProjection.lines,
         terminalLogContexts: terminalLogProjection.lineContexts,
+        terminalLogMetadata: terminalLogProjection.lineMetadata,
+        terminalProgressEvents: options.terminalProgressEvents,
+        terminalLogIds: terminalLogProjection.lineIds,
         terminalWorkCounterSegment: terminalWorkCounterSegmentFromRunnerResult(
           output,
           claim.attempt,
@@ -14794,12 +14954,14 @@ export async function executePostgresSchedulerClaim(
         result: terminalFailureResult,
         terminalLogLines: terminalLogProjection.lines,
         terminalLogContexts: terminalLogProjection.lineContexts,
+        terminalLogMetadata: terminalLogProjection.lineMetadata,
+        terminalLogIds: terminalLogProjection.lineIds,
         sandboxCrashDiagnostic: options.sandboxCrashDiagnostic,
         ...(options.preserveRunnerTerminal
           ? { preserveRunnerTerminal: true }
           : {}),
-        ...(runnerFailureResult && options.failedTerminalProgressEvents?.length
-          ? { terminalProgressEvents: options.failedTerminalProgressEvents }
+        ...(options.terminalProgressEvents?.length
+          ? { terminalProgressEvents: options.terminalProgressEvents }
           : {}),
       },
       options,
@@ -14987,6 +15149,9 @@ export function buildPostgresSchedulerRunnerContext(
   const rootRunId = launch.rootRunId?.trim() || launch.runId;
   return {
     executorToken: launch.executorToken,
+    ...(launch.runtimeLogIdentity === 'origin'
+      ? { runtimeLogIdentity: 'origin' as const }
+      : {}),
     baseUrl: runtimeApiBaseUrlFromLaunch(launch),
     executionGatewayBaseUrl,
     receiptGatewayBaseUrl,
@@ -17388,6 +17553,12 @@ async function appendRunLedgerOutboxFact(
     WITH admitted AS MATERIALIZED (
       SELECT run_id FROM ${tableName('runs', options)}
       WHERE run_id = $1 AND org_id = $2
+      -- Evaluate ingress time only after the projector/lifecycle fence. An
+      -- insert waiting behind a frozen receipt must become its successor,
+      -- never a late predecessor that changes the attempted receipt.
+      -- NO KEY UPDATE still permits legacy inserts' foreign-key KEY SHARE
+      -- while they finish under the event-search advisory mutex.
+      FOR NO KEY UPDATE
     ), recorded AS (
       INSERT INTO ${tableName('outbox', options)}
         (event_id, run_id, event_type, payload_json, created_at)
@@ -17413,23 +17584,43 @@ export { RunLedgerProjectionLeaseLostError } from '../run-ledger-projection-cont
 /** Extend only our still-live lease before another bounded transport piece. */
 export async function renewPostgresRunLedgerDelivery(
   client: PostgresSchedulerQueryClient,
-  input: { eventIds: string[]; leaseOwner: string; leaseSeconds: number },
+  input: {
+    eventIds: string[];
+    leaseOwner: string;
+    leaseSeconds: number;
+    /** Freeze an ingress receipt before any HTTP attempt, including singletons. */
+    freezeReceipt?: boolean;
+  },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<void> {
-  const result = await client.query<{ event_id: string }>(
-    `
+  const renew = (freezeReceipt: boolean) =>
+    client.query<{ event_id: string }>(
+      `
     UPDATE ${tableName('outbox', options)}
     SET lease_expires_at = now() + make_interval(secs => $3::integer)
+        ${freezeReceipt ? ', delivery_batch_started_at = coalesce(delivery_batch_started_at, statement_timestamp())' : ''}
     WHERE event_id = ANY($1::text[]) AND lease_owner = $2
       AND delivered_at IS NULL AND failed_at IS NULL AND lease_expires_at > now()
     RETURNING event_id
   `,
-    [
-      input.eventIds,
-      input.leaseOwner,
-      Math.max(5, Math.min(300, input.leaseSeconds)),
-    ],
-  );
+      [
+        input.eventIds,
+        input.leaseOwner,
+        Math.max(5, Math.min(300, input.leaseSeconds)),
+      ],
+    );
+  let result;
+  try {
+    result = await renew(
+      input.freezeReceipt === true &&
+        supportsOutboxDeliveryBatchMarker(options),
+    );
+  } catch (error) {
+    if (!input.freezeReceipt || !isMissingOutboxDeliveryBatchMarker(error))
+      throw error;
+    markOutboxDeliveryBatchMarkerUnavailable(options);
+    result = await renew(false);
+  }
   if (result.rows.length !== input.eventIds.length)
     throw new RunLedgerProjectionLeaseLostError('delivery_lease_not_current');
 }
@@ -17457,6 +17648,7 @@ export async function assertPostgresRunLedgerDelivery(
   const result = await client.query<{
     delivery_key: string;
     event_type: string;
+    delivery_batch_started_at: string | null;
     lease_owner: string | null;
     lease_live: boolean;
     due: boolean;
@@ -17467,6 +17659,8 @@ export async function assertPostgresRunLedgerDelivery(
     `
     SELECT outbox.delivery_key,
            outbox.event_type,
+           -- Row JSON keeps this optional on historical scheduler schemas.
+           to_jsonb(outbox)->>'delivery_batch_started_at' AS delivery_batch_started_at,
            outbox.lease_owner,
            outbox.lease_expires_at > now() AS lease_live,
            coalesce(outbox.next_attempt_at, outbox.created_at) <= now() AS due,
@@ -17476,6 +17670,7 @@ export async function assertPostgresRunLedgerDelivery(
     FROM ${tableName('outbox', options)} AS outbox
     JOIN ${tableName('runs', options)} AS runs ON runs.run_id = outbox.run_id
     WHERE outbox.run_id = $1 AND runs.org_id = $2
+      AND NOT ${searchLaneSql('outbox')}
       AND outbox.delivered_at IS NULL
     ORDER BY ${runLedgerOrderSql('outbox')}
     -- Later producer facts cannot belong to this receipt. Do not hydrate their
@@ -17497,9 +17692,12 @@ export async function assertPostgresRunLedgerDelivery(
   // Cancellation may own several pending facts at once. Validate the exact
   // contiguous, due prefix named by the receipt instead of all rows sharing
   // that cancellation lease.
+  const ingressReceiptStarted =
+    rows[0]?.event_type === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents &&
+    rows[0]?.delivery_batch_started_at != null;
   const prefix: typeof rows = [];
   let prefixStopReason: RunLedgerProjectionLeaseLostReason | null = null;
-  for (const row of rows) {
+  for (const [index, row] of rows.entries()) {
     if (row.lease_owner !== leaseOwner) {
       prefixStopReason = 'prefix_lease_owner_mismatch';
       break;
@@ -17516,11 +17714,6 @@ export async function assertPostgresRunLedgerDelivery(
       prefixStopReason = 'predecessor_failed';
       break;
     }
-    if (
-      prefix.length > 0 &&
-      row.event_type === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents
-    )
-      break;
     prefix.push(row);
 
     const first = prefix[0]!;
@@ -17567,10 +17760,17 @@ export async function assertPostgresRunLedgerDelivery(
           runId: input.runId,
           deliveryKey: first.delivery_key,
         });
+    // A receipt already attempted as a compound prefix cannot be split by
+    // an older competing projector after lease expiry. Reject with the normal
+    // retryable lease-lost response until a capable writer reclaims it whole.
+    const atStartedPrefixEnd =
+      !ingressReceiptStarted ||
+      rows[index + 1]?.delivery_batch_started_at == null;
     if (
-      input.idempotencyKey === expectedKey ||
-      input.idempotencyKey === batchKey ||
-      legacySingletonKey
+      atStartedPrefixEnd &&
+      (input.idempotencyKey === expectedKey ||
+        input.idempotencyKey === batchKey ||
+        legacySingletonKey)
     ) {
       if (input.projectedEvents === undefined) return;
       const prefixEvents: PlayRunLedgerIngressEvent[] = [];
@@ -17612,11 +17812,18 @@ export async function assertPostgresRunLedgerDelivery(
 
     if (
       prefix.length === 1 &&
-      RUN_SCHEDULER_OUTBOX_PREFIX_STOP_EVENT_TYPES.includes(first.event_type)
+      RUN_SCHEDULER_OUTBOX_START_EVENT_TYPES.includes(first.event_type)
     ) {
       break;
     }
-    if (terminal || prefix.length >= RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS) {
+    // A frozen ingress receipt can include late runner logs after terminal.
+    // Prove its complete immutable boundary, including transport chunks after
+    // terminal, rather than splitting a receipt that has already been attempted.
+    if (
+      (terminal && !ingressReceiptStarted) ||
+      (ingressReceiptStarted && atStartedPrefixEnd) ||
+      prefix.length >= RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS
+    ) {
       break;
     }
   }
@@ -17631,7 +17838,11 @@ function runLedgerPrecedesSql(
   successor: string,
   inclusive = false,
 ): string {
-  return `${runLedgerPositionSql(predecessor)} ${inclusive ? '<=' : '<'} ${runLedgerPositionSql(successor)}`;
+  return `(${searchLaneSql(predecessor)} = ${searchLaneSql(successor)} AND ${runLedgerPositionSql(predecessor)} ${inclusive ? '<=' : '<'} ${runLedgerPositionSql(successor)})`;
+}
+
+function searchLaneSql(alias: string): string {
+  return `coalesce(${alias}.payload_json->'${RUNTIME_EVENT_SEARCH_ONLY_FIELD}' = 'true'::jsonb, false)`;
 }
 
 function runLedgerPositionSql(alias: string): string {
@@ -17658,6 +17869,32 @@ function runLedgerTerminalPendingSql(
   )`;
 }
 
+function runLedgerWaitingRunsSql(
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+  runIdParameter?: string,
+): string {
+  return `SELECT DISTINCT waiting_event.run_id
+    FROM ${tableName('outbox', options)} AS waiting_event
+    WHERE waiting_event.event_type = ${RUN_EVENT_KIND_SQL_LITERAL.runWaiting}
+      -- Detached runner parks are transport-only and project no public wait.
+      AND waiting_event.payload_json->>'kind' IS DISTINCT FROM 'detached_runner'
+      AND waiting_event.delivered_at IS NULL
+      AND waiting_event.failed_at IS NULL
+      AND coalesce(waiting_event.next_attempt_at, waiting_event.created_at) <= now()
+      ${runIdParameter ? `AND (${runIdParameter}::text IS NULL OR waiting_event.run_id = ${runIdParameter}::text)` : ''}`;
+}
+
+function runLedgerWaitingPendingSql(alias: string): string {
+  return `(${alias}.run_id IN (SELECT run_id FROM waiting_runs))`;
+}
+
+function runLedgerUrgentLifecyclePendingSql(
+  alias: string,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): string {
+  return `(${runLedgerTerminalPendingSql(alias, options)} OR ${runLedgerWaitingPendingSql(alias)})`;
+}
+
 /**
  * Claim a causal prefix, preserving the v33 adapter while the additive batch
  * marker is absent. An enclosing transaction uses a savepoint so the missing
@@ -17670,11 +17907,43 @@ export async function readPendingPostgresSchedulerOutboxEvents(
     runId?: string | null;
     leaseOwner?: string | null;
     leaseSeconds?: number;
+    /** Independent raw search work uses the same outbox leases and controls. */
+    searchOnly?: boolean;
+    /** Advertised by the launch-pinned receipt verifier, never inferred locally. */
+    allowIngressPrefix?: boolean;
+    /** Extend this still-owned head atomically under the run cancellation fence. */
+    extendOwnedHead?: string;
     /** The dispatcher owns a short, exclusive claim transaction. */
     inTransaction?: boolean;
   } = {},
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<PostgresSchedulerOutboxEvent[]> {
+  const { events } = await claimPostgresSchedulerOutboxPrefix(
+    client,
+    input,
+    options,
+  );
+  return events;
+}
+
+/**
+ * ACK and next-prefix selection share one statement after the run lock. Data
+ * CTEs use the statement's original snapshot, so every pending-row predicate
+ * explicitly excludes the acknowledged IDs. A partial ACK cannot claim a
+ * successor. The receiver's ingress capability and frozen receipts still
+ * determine which causal facts may share a prefix.
+ */
+async function claimPostgresSchedulerOutboxPrefix(
+  client: PostgresSchedulerQueryClient,
+  input: NonNullable<
+    Parameters<typeof readPendingPostgresSchedulerOutboxEvents>[1]
+  >,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+  acknowledgement?: { eventIds: string[]; targetEventId: string },
+): Promise<{
+  events: PostgresSchedulerOutboxEvent[];
+  deliveredRows: RunLedgerOutboxDeliveredRow[];
+}> {
   const requestedLimit = Math.floor(input.limit ?? 1);
   const limit = Number.isFinite(requestedLimit)
     ? Math.max(1, requestedLimit)
@@ -17682,20 +17951,76 @@ export async function readPendingPostgresSchedulerOutboxEvents(
   const runId = input.runId?.trim() || null;
   const leaseOwner = input.leaseOwner?.trim() || null;
   const leaseSeconds = Math.max(5, Math.min(300, input.leaseSeconds ?? 30));
-  const claim = async (supportsTerminalBatchMarker: boolean) =>
-    await client.query<{
+  const pending = (alias: string) =>
+    `${alias}.delivered_at IS NULL${
+      acknowledgement ? ` AND NOT (${alias}.event_id = ANY($5::text[]))` : ''
+    }`;
+  const claim = async (supportsTerminalBatchMarker: boolean) => {
+    const urgentLifecyclePendingSql = (alias: string) =>
+      input.searchOnly === true
+        ? runLedgerTerminalPendingSql(alias, options)
+        : runLedgerUrgentLifecyclePendingSql(alias, options);
+    const ingressPrefixSql =
+      supportsTerminalBatchMarker && input.allowIngressPrefix === true
+        ? `(head.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents} AND ${urgentLifecyclePendingSql('head')})`
+        : 'false';
+    return await client.query<{
+      row_kind: 'claimed' | 'delivered';
       event_id: string;
       run_id: string;
       event_type: string;
       payload_json: unknown;
       created_at: Date;
       delivery_key: string | null;
+      lag_ms: number | string | null;
     }>(
       `
-      WITH head AS MATERIALIZED (
-        SELECT candidate.event_id, candidate.run_id, candidate.event_type
+      WITH ${
+        acknowledgement
+          ? `delivered AS (
+        ${runLedgerAcknowledgeSql(options, '$5', '$3')}
+      ),`
+          : ''
+      } ${
+        input.searchOnly === true
+          ? ''
+          : `waiting_runs AS MATERIALIZED (
+        ${runLedgerWaitingRunsSql(options, '$2')}
+      ), `
+      }${
+        input.extendOwnedHead
+          ? `owned_run AS MATERIALIZED (
+        SELECT run_id FROM ${tableName('runs', options)}
+        WHERE run_id = $2
+        -- This dispatcher already owns the head. A producer holding the run
+        -- lock is not a lost delivery lease: wait for its short transaction,
+        -- then revalidate the head below. New-run selection still skips locks.
+        FOR UPDATE
+      ),`
+          : ''
+      } head AS MATERIALIZED (
+        SELECT candidate.event_id, candidate.run_id, candidate.event_type,
+               ${supportsTerminalBatchMarker ? 'candidate.delivery_batch_started_at' : 'NULL::timestamptz'} AS delivery_batch_started_at
         FROM ${tableName('outbox', options)} AS candidate
-        WHERE candidate.delivered_at IS NULL
+        ${input.extendOwnedHead ? 'JOIN owned_run ON owned_run.run_id = candidate.run_id' : ''}
+        WHERE ${pending('candidate')}
+          AND ${searchLaneSql('candidate')} = ${input.searchOnly === true ? 'true' : 'false'}
+          ${
+            acknowledgement
+              ? `AND (SELECT count(*) FROM delivered) = cardinality($5::text[])
+          AND EXISTS (
+            SELECT 1 FROM ${tableName('outbox', options)} AS target
+            WHERE target.run_id = $2 AND target.event_id = $6
+              AND ${pending('target')} AND target.failed_at IS NULL
+          )`
+              : ''
+          }
+          ${
+            input.extendOwnedHead
+              ? `AND candidate.event_id = $5
+          AND candidate.lease_owner = $3 AND candidate.lease_expires_at > now()`
+              : ''
+          }
           AND candidate.failed_at IS NULL
           AND coalesce(candidate.next_attempt_at, candidate.created_at) <= now()
           AND ($2::text IS NULL OR candidate.run_id = $2)
@@ -17711,7 +18036,8 @@ export async function readPendingPostgresSchedulerOutboxEvents(
           AND NOT EXISTS (
             SELECT 1 FROM ${tableName('outbox', options)} AS active
             WHERE active.run_id = candidate.run_id
-              AND active.delivered_at IS NULL
+              AND ${pending('active')}
+              AND ${searchLaneSql('active')} = ${searchLaneSql('candidate')}
               AND active.lease_owner IS NOT NULL
               AND active.lease_expires_at > now()
               AND active.lease_owner IS DISTINCT FROM $3::text
@@ -17723,7 +18049,7 @@ export async function readPendingPostgresSchedulerOutboxEvents(
             SELECT 1
             FROM ${tableName('outbox', options)} AS predecessor
             WHERE predecessor.run_id = candidate.run_id
-              AND predecessor.delivered_at IS NULL
+              AND ${pending('predecessor')}
               AND ${runLedgerPrecedesSql('predecessor', 'candidate')}
           )
         -- A new durable admission has no causal dependency on unrelated
@@ -17738,7 +18064,8 @@ export async function readPendingPostgresSchedulerOutboxEvents(
           CASE
             WHEN candidate.event_type = ${RUN_EVENT_KIND_SQL_LITERAL.runCreated} THEN 0
             WHEN ${runLedgerTerminalPendingSql('candidate', options)} THEN 1
-            ELSE 2
+            ${input.searchOnly === true ? '' : `WHEN ${runLedgerWaitingPendingSql('candidate')} THEN 2`}
+            ELSE 3
           END,
           coalesce(candidate.next_attempt_at, candidate.created_at),
           candidate.created_at,
@@ -17749,17 +18076,26 @@ export async function readPendingPostgresSchedulerOutboxEvents(
         SELECT outbox.event_id
         FROM ${tableName('outbox', options)} AS outbox
         JOIN head ON head.run_id = outbox.run_id
-        WHERE outbox.delivered_at IS NULL
+        WHERE ${pending('outbox')}
+          AND ${searchLaneSql('outbox')} = ${input.searchOnly === true ? 'true' : 'false'}
           AND outbox.failed_at IS NULL
           -- Admission is causally first and must be projected alone. A later
           -- start/terminal append may not leapfrog a delayed queued row.
           AND (
             head.event_type NOT IN (${RUN_EVENT_KIND_SQL_LITERAL.runCreated}, ${RUN_EVENT_KIND_SQL_LITERAL.runStarted}, ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents})
             OR outbox.event_id = head.event_id
+            OR (head.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents}
+                AND ${ingressPrefixSql})
           )
-          -- An ingress row already contains a producer's bounded batch. Keep
-          -- its receipt stable independently of the recovery caller's limit.
-          AND (outbox.event_type <> ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents} OR outbox.event_id = head.event_id)
+          -- Only a receiver with the exact-prefix verifier may combine ingress
+          -- facts while draining a pending terminal. Old launch origins and
+          -- schemas retain each producer's existing singleton receipt.
+          AND (outbox.event_type <> ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents}
+               OR outbox.event_id = head.event_id
+               OR ${ingressPrefixSql})
+          -- Once any ingress prefix was attempted, its receipt is immutable,
+          -- including singleton appends whose HTTP/ACK outcome was ambiguous.
+          AND (${supportsTerminalBatchMarker && input.allowIngressPrefix === true ? 'head.delivery_batch_started_at IS NULL OR outbox.delivery_batch_started_at IS NOT NULL' : 'true'})
           AND coalesce(outbox.next_attempt_at, outbox.created_at) <= now()
           AND (
             $3::text IS NULL
@@ -17777,7 +18113,7 @@ export async function readPendingPostgresSchedulerOutboxEvents(
             SELECT 1
             FROM ${tableName('outbox', options)} AS terminal_predecessor
             WHERE terminal_predecessor.run_id = outbox.run_id
-              AND terminal_predecessor.delivered_at IS NULL
+              AND ${pending('terminal_predecessor')}
               AND ${
                 supportsTerminalBatchMarker
                   ? 'terminal_predecessor.delivery_batch_started_at IS NOT NULL'
@@ -17799,10 +18135,12 @@ export async function readPendingPostgresSchedulerOutboxEvents(
             SELECT 1
             FROM ${tableName('outbox', options)} AS predecessor
             WHERE predecessor.run_id = outbox.run_id
-              AND predecessor.delivered_at IS NULL
+              AND ${pending('predecessor')}
               AND ${runLedgerPrecedesSql('predecessor', 'outbox')}
               AND (
-                predecessor.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents}
+                (predecessor.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents}
+                 AND NOT (${ingressPrefixSql}))
+                OR (${supportsTerminalBatchMarker && input.allowIngressPrefix === true ? 'head.delivery_batch_started_at IS NOT NULL AND predecessor.delivery_batch_started_at IS NULL' : 'false'})
                 OR predecessor.failed_at IS NOT NULL
                 OR coalesce(predecessor.next_attempt_at, predecessor.created_at) > now()
                 OR (
@@ -17833,8 +18171,8 @@ export async function readPendingPostgresSchedulerOutboxEvents(
             ${
               supportsTerminalBatchMarker
                 ? `, delivery_batch_started_at = CASE
-              WHEN terminal_batch.has_terminal
-                THEN COALESCE(outbox.delivery_batch_started_at, clock_timestamp())
+              WHEN terminal_batch.has_terminal ${input.allowIngressPrefix === true ? `OR ${urgentLifecyclePendingSql('outbox')}` : ''}
+                THEN COALESCE(outbox.delivery_batch_started_at, statement_timestamp())
               ELSE outbox.delivery_batch_started_at
             END`
                 : ''
@@ -17846,13 +18184,53 @@ export async function readPendingPostgresSchedulerOutboxEvents(
                   outbox.payload_json, outbox.created_at, outbox.lease_owner,
                   outbox.delivery_key
       )
-      SELECT event_id, run_id, event_type, payload_json, created_at, lease_owner,
-             delivery_key
-      FROM claimed
-      ORDER BY ${runLedgerOrderSql('claimed')}
+      ${
+        acknowledgement
+          ? `, notified AS MATERIALIZED (
+        SELECT delivered.*,
+               pg_notify(
+                 $7,
+                 json_build_object('eventId', event_id, 'kind', 'outbox_delivered')::text
+               ) AS notification
+        FROM delivered
+      )`
+          : ''
+      }
+      SELECT * FROM (
+        SELECT 'claimed'::text AS row_kind,
+               event_id, run_id, event_type, payload_json, created_at, lease_owner,
+               delivery_key, NULL::float8 AS lag_ms
+        FROM claimed
+        ${
+          acknowledgement
+            ? `UNION ALL
+        SELECT 'delivered'::text AS row_kind,
+               event_id, NULL::text AS run_id, event_type, NULL::jsonb AS payload_json,
+               NULL::timestamptz AS created_at, NULL::text AS lease_owner,
+               NULL::text AS delivery_key, lag_ms
+        FROM notified`
+            : ''
+        }
+      ) AS result
+      ORDER BY row_kind, ${runLedgerOrderSql('result')}
     `,
-      [limit, runId, leaseOwner, leaseSeconds],
+      [
+        limit,
+        runId,
+        leaseOwner,
+        leaseSeconds,
+        ...(acknowledgement
+          ? [
+              acknowledgement.eventIds,
+              acknowledgement.targetEventId,
+              postgresSchedulerNotifyChannel('terminal', options),
+            ]
+          : input.extendOwnedHead
+            ? [input.extendOwnedHead]
+            : []),
+      ],
     );
+  };
   let result;
   if (input.inTransaction) await client.query('SAVEPOINT run_ledger_claim');
   if (supportsOutboxDeliveryBatchMarker(options)) {
@@ -17860,9 +18238,13 @@ export async function readPendingPostgresSchedulerOutboxEvents(
       result = await claim(true);
     } catch (error) {
       if (!isMissingOutboxDeliveryBatchMarker(error)) throw error;
+      markOutboxDeliveryBatchMarkerUnavailable(options);
+      // The ACK caller owns the whole short transaction. Roll it back and
+      // repeat only this missing-column adapter, avoiding two SAVEPOINT round
+      // trips on every successful acknowledgement.
+      if (acknowledgement) throw error;
       if (input.inTransaction)
         await client.query('ROLLBACK TO SAVEPOINT run_ledger_claim');
-      markOutboxDeliveryBatchMarkerUnavailable(options);
       result = await claim(false);
     }
   } else {
@@ -17870,22 +18252,34 @@ export async function readPendingPostgresSchedulerOutboxEvents(
   }
   if (input.inTransaction)
     await client.query('RELEASE SAVEPOINT run_ledger_claim');
-  return result.rows.map((row) => {
-    if (!row.delivery_key) {
-      throw new Error(
-        `Run-ledger outbox event ${row.event_id} has no delivery key.`,
-      );
-    }
-    return {
-      eventId: row.event_id,
-      runId: row.run_id,
-      eventType: row.event_type,
-      payload: row.payload_json,
-      createdAt: row.created_at,
-      leaseOwner: leaseOwner,
-      deliveryKey: row.delivery_key,
-    };
-  });
+  const events = result.rows
+    .filter((row) => row.row_kind === 'claimed')
+    .map((row) => {
+      if (!row.delivery_key) {
+        throw new Error(
+          `Run-ledger outbox event ${row.event_id} has no delivery key.`,
+        );
+      }
+      return {
+        eventId: row.event_id,
+        runId: row.run_id,
+        eventType: row.event_type,
+        payload: row.payload_json,
+        createdAt: row.created_at,
+        leaseOwner: leaseOwner,
+        deliveryKey: row.delivery_key,
+      };
+    });
+  const deliveredRows = result.rows
+    .filter((row) => row.row_kind === 'delivered')
+    .map((row) => {
+      const lagMs = Number(row.lag_ms);
+      return {
+        eventType: row.event_type,
+        lagMs: Number.isFinite(lagMs) ? Math.max(0, lagMs) : 0,
+      };
+    });
+  return { events, deliveredRows };
 }
 
 /**
@@ -17910,6 +18304,7 @@ export async function readPostgresSchedulerOutboxNextDueAt(
         (SELECT max(active.lease_expires_at)
          FROM ${tableName('outbox', options)} AS active
          WHERE active.run_id = candidate.run_id
+           AND ${searchLaneSql('active')} = ${searchLaneSql('candidate')}
            AND active.delivered_at IS NULL AND active.lease_owner IS NOT NULL
            AND active.lease_expires_at > now())
       )) AS due_at
@@ -18149,7 +18544,7 @@ export async function purgePostgresSchedulerDeliveredOutboxRetentionBatch(
               '{events}',
               (SELECT jsonb_agg(
                  CASE WHEN item.value->>'type' = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
-                   THEN item.value - 'lines' - 'lineContexts'
+                   THEN item.value - 'lines' - 'lineContexts' - 'lineMetadata' - 'lineIds'
                    ELSE item.value
                  END ORDER BY item.ordinality
                )
@@ -18162,11 +18557,11 @@ export async function purgePostgresSchedulerDeliveredOutboxRetentionBatch(
             )
             WHEN jsonb_typeof(outbox.payload_json->'terminalProgressEvents') = 'array'
               THEN jsonb_set(
-                outbox.payload_json - 'terminalLogLines' - 'terminalLogContexts',
+                outbox.payload_json - 'terminalLogLines' - 'terminalLogContexts' - 'terminalLogMetadata' - 'terminalLogIds',
                 '{terminalProgressEvents}',
                 coalesce((SELECT jsonb_agg(
                    CASE WHEN item.value->>'type' = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
-                     THEN item.value - 'lines' - 'lineContexts'
+                     THEN item.value - 'lines' - 'lineContexts' - 'lineMetadata' - 'lineIds'
                      ELSE item.value
                    END ORDER BY item.ordinality
                  )
@@ -18174,7 +18569,7 @@ export async function purgePostgresSchedulerDeliveredOutboxRetentionBatch(
                      WITH ORDINALITY AS item(value, ordinality)), '[]'::jsonb),
                 false
               )
-            ELSE outbox.payload_json - 'terminalLogLines' - 'terminalLogContexts'
+            ELSE outbox.payload_json - 'terminalLogLines' - 'terminalLogContexts' - 'terminalLogMetadata' - 'terminalLogIds'
           END
          FROM candidates
         WHERE outbox.event_id = candidates.event_id`,
@@ -18236,6 +18631,17 @@ function runLedgerDeliveryFailure(input: { error: unknown }): {
   projectionMismatch: RunLedgerProjectionMismatchDiagnostic | null;
   retryAfterMs: number | null;
 } {
+  if (input.error instanceof RunLedgerProjectionLeaseLostError) {
+    return {
+      permanent: false,
+      code: 'RUN_LEDGER_DELIVERY_LEASE_LOST',
+      status: null,
+      retryable: true,
+      failureReason: input.error.reason,
+      projectionMismatch: input.error.projectionMismatch ?? null,
+      retryAfterMs: null,
+    };
+  }
   if (input.error instanceof AppRuntimeApiResponseError) {
     // Projection is idempotent. A dependency can incorrectly send
     // `retryable:false` with a transient overload response, but that metadata
@@ -18416,6 +18822,32 @@ export async function markPostgresSchedulerOutboxDelivered(
   ).length;
 }
 
+/** Shared lease-fenced ACK, including the canonical retained-payload cleanup. */
+function runLedgerAcknowledgeSql(
+  options: Pick<PostgresSchedulerOptions, 'schema'> | undefined,
+  eventIdsParameter: string,
+  leaseOwnerParameter: string,
+): string {
+  return `UPDATE ${tableName('outbox', options)} AS outbox
+        SET delivered_at = now(),
+            next_attempt_at = NULL,
+            last_error_json = NULL,
+            lease_owner = NULL,
+            lease_expires_at = NULL,
+            payload_json = CASE WHEN EXISTS (
+              SELECT 1 FROM ${tableName('runs', options)} AS run
+               WHERE run.run_id = outbox.run_id
+                 AND run.run_event_store = 'planet_scale'
+            ) THEN '{}'::jsonb ELSE outbox.payload_json END
+        WHERE outbox.event_id = ANY(${eventIdsParameter}::text[])
+          AND outbox.delivered_at IS NULL
+          AND (${leaseOwnerParameter}::text IS NULL OR outbox.lease_owner = ${leaseOwnerParameter})
+        RETURNING outbox.event_id,
+                  outbox.event_type,
+                  (extract(epoch FROM (outbox.delivered_at - outbox.created_at)) * 1000)::float8
+                    AS lag_ms`;
+}
+
 /**
  * Lease-fenced acknowledgement that also reports each row's event type and
  * commit-to-acknowledgement lag on the database clock, so lag metrics never
@@ -18436,24 +18868,7 @@ export async function markPostgresSchedulerOutboxDeliveredRows(
   }>(
     `
       WITH delivered AS (
-        UPDATE ${tableName('outbox', options)} AS outbox
-        SET delivered_at = now(),
-            next_attempt_at = NULL,
-            last_error_json = NULL,
-            lease_owner = NULL,
-            lease_expires_at = NULL,
-            payload_json = CASE WHEN EXISTS (
-              SELECT 1 FROM ${tableName('runs', options)} AS run
-               WHERE run.run_id = outbox.run_id
-                 AND run.run_event_store = 'planet_scale'
-            ) THEN '{}'::jsonb ELSE outbox.payload_json END
-        WHERE outbox.event_id = ANY($1::text[])
-          AND outbox.delivered_at IS NULL
-          AND ($2::text IS NULL OR outbox.lease_owner = $2)
-        RETURNING outbox.event_id,
-                  outbox.event_type,
-                  (extract(epoch FROM (outbox.delivered_at - outbox.created_at)) * 1000)::float8
-                    AS lag_ms
+        ${runLedgerAcknowledgeSql(options, '$1', '$2')}
       )
       SELECT event_id,
              event_type,
@@ -18538,6 +18953,22 @@ function normalizeOutboxIngressPreview(
 export function buildRunLedgerEventsFromPostgresSchedulerOutbox(
   event: PostgresSchedulerOutboxEvent,
 ): PlayRunLedgerIngressEvent[] {
+  if (
+    payloadField(event.payload, RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD) ===
+    true
+  ) {
+    throw new Error(
+      'Deferred outbox input must be projected before ledger delivery.',
+    );
+  }
+  if (
+    payloadField(event.payload, RUNTIME_EVENT_SEARCH_ONLY_FIELD) === true ||
+    event.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.receiptEvent ||
+    event.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runnerLogs
+  ) {
+    // Search-only carriers are already durable in the canonical journal.
+    return [];
+  }
   const occurredAt = event.createdAt.getTime();
   if (event.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents) {
     const events = payloadField(event.payload, 'events');
@@ -18591,6 +19022,7 @@ export function buildRunLedgerEventsFromPostgresSchedulerOutbox(
     );
     const lines = stringArrayPayloadField(event.payload, 'terminalLogLines');
     const lineContexts = terminalLogContextsPayloadField(event.payload, lines);
+    const lineMetadata = terminalLogMetadataPayloadField(event.payload, lines);
     const resultSummary = payloadField(event.payload, 'resultSummary');
     return [
       ...progressEvents.map(normalizeOutboxIngressPreview),
@@ -18604,6 +19036,7 @@ export function buildRunLedgerEventsFromPostgresSchedulerOutbox(
               source: 'worker',
               lines,
               ...(lineContexts ? { lineContexts } : {}),
+              ...(lineMetadata ? { lineMetadata } : {}),
             } as PlayRunLedgerEvent,
           ]),
       {
@@ -18633,6 +19066,7 @@ export function buildRunLedgerEventsFromPostgresSchedulerOutbox(
     );
     const lines = stringArrayPayloadField(event.payload, 'terminalLogLines');
     const lineContexts = terminalLogContextsPayloadField(event.payload, lines);
+    const lineMetadata = terminalLogMetadataPayloadField(event.payload, lines);
     const result = terminalRunResultForLedger(
       payloadField(event.payload, 'result'),
     );
@@ -18649,6 +19083,7 @@ export function buildRunLedgerEventsFromPostgresSchedulerOutbox(
               source: 'worker',
               lines,
               ...(lineContexts ? { lineContexts } : {}),
+              ...(lineMetadata ? { lineMetadata } : {}),
             } as PlayRunLedgerEvent,
           ]),
       {
@@ -18774,6 +19209,8 @@ export type PostgresSchedulerOutboxMaterializationPlan = {
 };
 
 const RUN_LEDGER_KNOWN_OUTBOX_EVENT_TYPES: ReadonlySet<string> = new Set([
+  RUN_SCHEDULER_OUTBOX_EVENT_TYPE.receiptEvent,
+  RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runnerLogs,
   RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents,
   RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runStarted,
   RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runCompleted,
@@ -18891,7 +19328,7 @@ export async function listPostgresSchedulerOutboxMaterializationPlans(
  * - `local_mint`: sign the token in-process with `BETTER_AUTH_SECRET`. ONLY the
  *   app (Vercel) legitimately holds the signing key, so this is app-side only
  *   (read-model heal path). It is the AUTHORITATIVE projector.
- * - `gateway`: always prove the active outbox lease to the launch-pinned
+ * - `gateway`: for every app-runtime append, prove the active outbox lease to the launch-pinned
  *   deployment and receive a short-lived executor JWT
  *   (`requestRunLedgerDispatchToken`), even if the caller supplied a
  *   `runtimeApi`. The Fly worker has no signing key and MUST use this. A
@@ -18912,6 +19349,21 @@ export type RunLedgerOutboxTokenAuthority = 'local_mint' | 'gateway';
 /** Cross-run service policy; causal order within a run is always unchanged. */
 export type RunLedgerOutboxHeadPriority = 'admission_first' | 'oldest_ready';
 
+class DeferredRuntimeProjectionInputError extends AppRuntimeApiResponseError {
+  constructor(
+    readonly eventId: string,
+    detail: string,
+  ) {
+    super({
+      action: 'project_run_events',
+      status: 422,
+      code: 'runtime_event_projection_invalid',
+      retryable: false,
+      detail,
+    });
+  }
+}
+
 const POSTGRES_SCHEDULER_CANCELLATION_OUTBOX_LEASE_SECONDS =
   // The direct projection can run for the full app-runtime request deadline.
   // Keep another 30 seconds for dispatch setup and acknowledgement so a
@@ -18942,8 +19394,12 @@ export function postgresSchedulerCancellationOutboxLease(runId: string): {
 }
 
 export type RunLedgerOutboxDispatchInput = {
+  /** Only the existing background projector claims the independent search prefix. */
+  searchOnly?: boolean;
+  /** Only the existing background projector indexes deferred raw inputs. */
+  materializeObservability?: boolean;
   /**
-   * Optional runtime context. `gateway` authority always replaces its
+   * Optional runtime context. For an app-runtime append, `gateway` replaces its
    * credentials with a fresh lease-scoped token and keeps only supported
    * transport options; `local_mint` and the default authority preserve the
    * explicit context as before.
@@ -18983,8 +19439,9 @@ export type RunLedgerOutboxDispatchInput = {
    * untargeted fast path) set this: after acknowledging a batch, also carry
    * the run's terminal fact through when it is now pending (see
    * `continueRunLedgerOutboxThroughTerminal`). Callers that drive their own
-   * bounded batches over a pre-leased prefix (cancellation, inline
-   * `run.created`, the targeted terminal drain) leave it unset.
+   * bounded batches (cancellation, inline `run.created`, the targeted terminal
+   * drain) leave it unset. Targeted drains retain successors through their
+   * explicit run/owner/target scope instead.
    */
   continueThroughTerminal?: boolean;
 };
@@ -19066,7 +19523,10 @@ type RunLedgerOutboxAuthorityScope = {
   authority: {
     runId: string;
     leaseOwner: string;
-    runtimeApi: WorkerRuntimeApiContext;
+    runtimeApi: WorkerRuntimeApiContext & {
+      refreshExecutorToken?: () => Promise<string>;
+      invalidateExecutorToken?: () => void;
+    };
     expiresAtMs: number | null;
   } | null;
 };
@@ -19101,6 +19561,9 @@ async function dispatchRunLedgerOutboxThroughEventWithScope(
     input.leaseOwner?.trim() ||
     scope?.leaseOwner ||
     `run-ledger-outbox-dispatch:${randomUUID()}`;
+  // The same owner retains each successor in the ACK transaction, including
+  // for a fresh worker drain that did not arrive with a preclaimed prefix.
+  scope ??= { runId, leaseOwner, targetEventId, nextClaimed: [] };
   const scopedInput = { ...input, leaseOwner };
   const batchSize = RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS;
   const eventIds: string[] = [];
@@ -19111,80 +19574,92 @@ async function dispatchRunLedgerOutboxThroughEventWithScope(
   let failed = 0;
   let retrying = 0;
 
-  let remaining = maxEvents;
-  while (remaining === null || remaining > 0) {
-    const result = await dispatchRunLedgerOutboxBatchWithScope(
-      withClient,
-      {
-        ...scopedInput,
-        waitForRunLock: true,
-        continueThroughTerminal: false,
-        limit: remaining === null ? batchSize : Math.min(batchSize, remaining),
-      },
-      options,
-      scope,
-      authorityScope,
-    );
-    attempted += result.attempted;
-    projected += result.projected;
-    failed += result.failed;
-    retrying += result.retrying;
-    eventIds.push(...result.eventIds);
-    failedEventIds.push(...result.failedEventIds);
-    retryingEventIds.push(...result.retryingEventIds);
-    if (remaining !== null) remaining -= result.attempted;
-    if (result.eventIds.includes(targetEventId)) {
-      return {
-        attempted,
-        projected,
-        eventIds,
-        failed,
-        failedEventIds,
-        retrying,
-        retryingEventIds,
-        targetEventId,
-        targetDelivered: true,
-        targetBlocked: false,
-      };
+  try {
+    let remaining = maxEvents;
+    while (remaining === null || remaining > 0) {
+      const result = await dispatchRunLedgerOutboxBatchWithScope(
+        withClient,
+        {
+          ...scopedInput,
+          waitForRunLock: true,
+          continueThroughTerminal: false,
+          limit:
+            remaining === null ? batchSize : Math.min(batchSize, remaining),
+        },
+        options,
+        scope,
+        authorityScope,
+        remaining,
+      );
+      attempted += result.attempted;
+      projected += result.projected;
+      failed += result.failed;
+      retrying += result.retrying;
+      eventIds.push(...result.eventIds);
+      failedEventIds.push(...result.failedEventIds);
+      retryingEventIds.push(...result.retryingEventIds);
+      if (remaining !== null) remaining -= result.attempted;
+      if (result.eventIds.includes(targetEventId)) {
+        return {
+          attempted,
+          projected,
+          eventIds,
+          failed,
+          failedEventIds,
+          retrying,
+          retryingEventIds,
+          targetEventId,
+          targetDelivered: true,
+          targetBlocked: false,
+        };
+      }
+      // A projection failure is durably scheduled for retry or moved to terminal
+      // DLQ. Its policy owns the next attempt; spinning here would only reclaim
+      // the same failed predecessor and delay the park indefinitely.
+      // An absent target cannot retain a successor in ACK. Keep the existing
+      // fresh-claim traversal in that case until ready work is exhausted.
+      if (result.projected === 0 || result.attempted === 0) break;
     }
-    // A projection failure is durably scheduled for retry or moved to terminal
-    // DLQ. Its policy owns the next attempt; spinning here would only reclaim
-    // the same failed predecessor and delay the park indefinitely.
-    if (
-      result.projected === 0 ||
-      result.attempted === 0 ||
-      (scope && scope.nextClaimed.length === 0)
-    )
-      break;
-  }
-
-  // A concurrent dispatcher can claim the target between batches. An empty
-  // drain therefore does not prove delivery; read the durable acknowledgement
-  // before reporting the target as pending.
-  const target = await withClient((client) =>
-    readPostgresSchedulerOutboxDeliveryStatus(
-      client,
-      { runId, eventId: targetEventId },
-      options,
-    ),
-  );
-  return {
-    attempted,
-    projected,
-    eventIds,
-    failed,
-    failedEventIds,
-    retrying,
-    retryingEventIds,
-    targetEventId,
-    targetDelivered: target.delivered,
-    targetBlocked: target.blocked,
-  };
-}
 
-/**
- * Project one run's currently due non-start lifecycle events in one app-runtime
- * append. The outbox remains the authority: all rows are leased first and are
+    // A concurrent dispatcher can claim the target between batches. An empty
+    // drain therefore does not prove delivery; read the durable acknowledgement
+    // before reporting the target as pending.
+    const target = await withClient((client) =>
+      readPostgresSchedulerOutboxDeliveryStatus(
+        client,
+        { runId, eventId: targetEventId },
+        options,
+      ),
+    );
+    return {
+      attempted,
+      projected,
+      eventIds,
+      failed,
+      failedEventIds,
+      retrying,
+      retryingEventIds,
+      targetEventId,
+      targetDelivered: target.delivered,
+      targetBlocked: target.blocked,
+    };
+  } finally {
+    if (scope.nextClaimed.length > 0) {
+      await withClient((client) =>
+        releasePostgresSchedulerOutboxLease(
+          client,
+          scope.nextClaimed.map((event) => event.eventId),
+          { ...options, leaseOwner },
+        ),
+      );
+      scope.nextClaimed.length = 0;
+    }
+  }
+}
+
+/**
+ * Project one run's currently due non-start lifecycle events in one app-runtime
+ * append. The outbox remains the authority: all rows are leased first and are
  * marked delivered only after the atomic append succeeds. This preserves event
  * order while avoiding one callback round trip for `waiting -> resumed ->
  * terminal`, the normal detached-run completion shape.
@@ -19219,10 +19694,20 @@ async function dispatchRunLedgerOutboxBatchWithScope(
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
   scope?: RunLedgerOutboxDrainScope,
   authorityScope: RunLedgerOutboxAuthorityScope = { authority: null },
+  remainingEvents: number | null = null,
 ): Promise<PostgresSchedulerOutboxProjectionResult> {
   const dispatchStartedAtMs = Date.now();
+  const tokenAuthority = input.tokenAuthority ?? 'local_mint';
   const leaseOwner =
     input.leaseOwner?.trim() || `run-ledger-outbox-dispatch:${randomUUID()}`;
+  const needsLaunch =
+    !input.searchOnly && (tokenAuthority === 'gateway' || !input.runtimeApi);
+  const launchSelection = needsLaunch
+    ? `CASE
+         WHEN ${runLedgerSearchOnlyOutboxFactSql('head')} THEN NULL::jsonb
+         ELSE ${runLedgerDispatchLaunchSql('runs')}
+       END`
+    : 'NULL::jsonb';
   const continuation: { current: RunLedgerOutboxDrainScope | null } = {
     current: scope ?? null,
   };
@@ -19272,22 +19757,27 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       // for each lifecycle transition. Only the two dedicated projectors may
       // perform the global distinct-head scan below.
       const selected = targetRunId
-        ? await client.query<{ run_id: string }>(
+        ? await client.query<{
+            run_id: string;
+            dispatch_launch_json: unknown;
+          }>(
             `
             WITH head AS MATERIALIZED (
               SELECT pending.run_id,
                      pending.event_id,
                      pending.event_type,
+                     pending.payload_json,
                      pending.created_at,
                      pending.next_attempt_at,
                      pending.failed_at
               FROM ${tableName('outbox', options)} AS pending
               WHERE pending.run_id = $1
                 AND pending.delivered_at IS NULL
+                AND ${searchLaneSql('pending')} = ${input.searchOnly === true ? 'true' : 'false'}
               ORDER BY ${runLedgerOrderSql('pending')}
               LIMIT 1
             )
-            SELECT runs.run_id
+            SELECT runs.run_id, ${launchSelection} AS dispatch_launch_json
             FROM head
             JOIN ${tableName('runs', options)} AS runs ON runs.run_id = head.run_id
             WHERE head.failed_at IS NULL
@@ -19296,6 +19786,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
               AND NOT EXISTS (
                 SELECT 1 FROM ${tableName('outbox', options)} AS active
                 WHERE active.run_id = runs.run_id
+                  AND ${searchLaneSql('active')} = ${input.searchOnly === true ? 'true' : 'false'}
                   AND active.delivered_at IS NULL
                   AND active.lease_owner IS NOT NULL
                   AND active.lease_expires_at > now()
@@ -19305,20 +19796,31 @@ async function dispatchRunLedgerOutboxBatchWithScope(
           `,
             [targetRunId, leaseOwner, input.headEventId?.trim() || null],
           )
-        : await client.query<{ run_id: string }>(`
-            WITH heads AS MATERIALIZED (
+        : await client.query<{
+            run_id: string;
+            dispatch_launch_json: unknown;
+          }>(`
+            WITH ${
+              input.searchOnly === true
+                ? ''
+                : `waiting_runs AS MATERIALIZED (
+              ${runLedgerWaitingRunsSql(options)}
+            ), `
+            }heads AS MATERIALIZED (
               SELECT DISTINCT ON (pending.run_id)
                 pending.run_id,
                 pending.event_id,
                 pending.event_type,
+                pending.payload_json,
                 pending.created_at,
                 pending.next_attempt_at,
                 pending.failed_at
               FROM ${tableName('outbox', options)} AS pending
               WHERE pending.delivered_at IS NULL
+                AND ${searchLaneSql('pending')} = ${input.searchOnly === true ? 'true' : 'false'}
               ORDER BY pending.run_id, ${runLedgerOrderSql('pending')}
             )
-            SELECT runs.run_id
+            SELECT runs.run_id, ${launchSelection} AS dispatch_launch_json
             FROM heads AS head
             JOIN ${tableName('runs', options)} AS runs ON runs.run_id = head.run_id
             WHERE head.failed_at IS NULL
@@ -19326,12 +19828,13 @@ async function dispatchRunLedgerOutboxBatchWithScope(
               AND NOT EXISTS (
                 SELECT 1 FROM ${tableName('outbox', options)} AS active
                 WHERE active.run_id = runs.run_id
+                  AND ${searchLaneSql('active')} = ${input.searchOnly === true ? 'true' : 'false'}
                   AND active.delivered_at IS NULL
                   AND active.lease_owner IS NOT NULL
                   AND active.lease_expires_at > now()
               )
             -- admission_first: admission, then the causal head of a run with
-            -- a pending terminal, then FIFO progress. oldest_ready keeps its
+            -- a pending terminal or public wait, then FIFO progress. oldest_ready keeps its
             -- pure age order so continuous admissions/terminals cannot starve
             -- ordinary progress.
             ORDER BY ${
@@ -19340,7 +19843,8 @@ async function dispatchRunLedgerOutboxBatchWithScope(
                 : `CASE
                        WHEN head.event_type = ${RUN_EVENT_KIND_SQL_LITERAL.runCreated} THEN 0
                        WHEN ${runLedgerTerminalPendingSql('head', options)} THEN 1
-                       ELSE 2
+                       ${input.searchOnly === true ? '' : `WHEN ${runLedgerWaitingPendingSql('head')} THEN 2`}
+                       ELSE 3
                      END,`
             }
                      head.created_at, runs.run_id
@@ -19356,20 +19860,33 @@ async function dispatchRunLedgerOutboxBatchWithScope(
               leaseOwner,
               leaseSeconds: input.leaseSeconds ?? 120,
               inTransaction: true,
+              searchOnly: input.searchOnly,
             },
             options,
           )
         : [];
       await client.query('COMMIT');
-      return claimed;
+      // The launch is immutable. Carry only its authority/routing fields from
+      // the run we already locked, rather than queuing another scarce checkout
+      // between the claim and gateway request. The gateway still proves the
+      // active outbox lease; no database checkout spans either HTTP hop.
+      return {
+        events: claimed,
+        launchJson: selected.rows[0]?.dispatch_launch_json,
+      };
     } catch (error) {
       await client.query('ROLLBACK');
       throw error;
     }
   };
-  const events = scope?.nextClaimed.length
+  const preclaimed = scope?.nextClaimed.length
     ? scope.nextClaimed.splice(0)
+    : null;
+  const claimed = preclaimed
+    ? { events: preclaimed, launchJson: null }
     : await withClient(claimEvents);
+  const { launchJson } = claimed;
+  let events = claimed.events;
   if (events.length === 0) {
     return {
       attempted: 0,
@@ -19386,17 +19903,160 @@ async function dispatchRunLedgerOutboxBatchWithScope(
   let authorityReadyAtMs: number | null = null;
   let appendFinishedAtMs: number | null = null;
   let acknowledgedAtMs: number | null = null;
+  const materializeDeferredObservability = async () => {
+    if (
+      events.some(
+        (event) =>
+          payloadField(
+            event.payload,
+            RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD,
+          ) === true,
+      )
+    ) {
+      if (!input.materializeObservability) {
+        // Inline admission/lifecycle/read-heal paths must never index logs.
+        // Release and wake the existing projector without charging a retry.
+        const released = await withClient((client) =>
+          releasePostgresSchedulerOutboxLease(
+            client,
+            events.map((event) => event.eventId),
+            { ...options, leaseOwner },
+          ),
+        );
+        return {
+          attempted: events.length,
+          projected: 0,
+          eventIds: [],
+          failed: 0,
+          failedEventIds: [],
+          retrying: released.length,
+          retryingEventIds: released,
+        };
+      }
+      for (const event of events) {
+        if (
+          payloadField(
+            event.payload,
+            RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD,
+          ) !== true
+        )
+          continue;
+        await withClient(async (client) => {
+          await renewPostgresRunLedgerDelivery(
+            client,
+            {
+              eventIds: events.map((row) => row.eventId),
+              leaseOwner,
+              leaseSeconds: 120,
+            },
+            options,
+          );
+          // Keep projection below its renewed lease. The final payload update
+          // fences ownership; indexing locks neither outbox nor Run rows.
+          await client.query('BEGIN');
+          try {
+            // Let PostgreSQL cancel before the pool's client-side timeout,
+            // so rollback completes while the checkout is still usable.
+            await client.query(
+              "SELECT set_config('statement_timeout', $1, true)",
+              [
+                `${Math.min(60_000, RUNTIME_RELIABILITY_POLICY.schedulerDatabase.queryTimeoutMs - 1_000)}ms`,
+              ],
+            );
+            const result = await client.query<{ payload: unknown }>(
+              `SELECT ${quoteIdent(schemaName(options))}.materialize_runtime_outbox_event($1, $2) AS payload`,
+              [event.eventId, leaseOwner],
+            );
+            await client.query('COMMIT');
+            event.payload = result.rows[0]!.payload;
+          } catch (error) {
+            await client.query('ROLLBACK');
+            if (
+              error &&
+              typeof error === 'object' &&
+              'code' in error &&
+              error.code === 'P0001'
+            ) {
+              // The installed projector's explicit RAISEs reject malformed
+              // or conflicting immutable facts. Retain them in the existing
+              // quarantine instead of retrying the same invalid input forever.
+              throw new DeferredRuntimeProjectionInputError(
+                event.eventId,
+                error instanceof Error
+                  ? error.message
+                  : 'Invalid runtime event projection input.',
+              );
+            }
+            throw error;
+          }
+        });
+      }
+    }
+    return null;
+  };
   try {
+    // The ledger converter rejects raw deferred facts. Inline callers hand
+    // them off; the background owner projects them before inspecting the
+    // compact lifecycle payload or deciding that it needs no HTTP append.
+    const initialHandedOff = await materializeDeferredObservability();
+    if (initialHandedOff) return initialHandedOff;
+    if (input.searchOnly) {
+      if (
+        events.some(
+          (event) =>
+            payloadField(event.payload, RUNTIME_EVENT_SEARCH_ONLY_FIELD) !==
+            true,
+        )
+      )
+        throw new Error('Search lease includes a lifecycle fact.');
+      const delivered = await withClient((client) =>
+        markPostgresSchedulerOutboxDeliveredRows(
+          client,
+          events.map((event) => event.eventId),
+          { ...options, leaseOwner },
+        ),
+      );
+      if (delivered.length !== events.length)
+        throw new RunLedgerProjectionLeaseLostError(
+          'delivery_lease_not_current',
+        );
+      if (input.onDelivered) {
+        try {
+          input.onDelivered(delivered);
+        } catch (error) {
+          console.warn('[run-ledger-outbox.delivery_observer_failed]', {
+            error: error instanceof Error ? error.message : String(error),
+          });
+        }
+      }
+      return {
+        attempted: events.length,
+        projected: delivered.length,
+        eventIds: events.map((event) => event.eventId),
+        failed: 0,
+        failedEventIds: [],
+        retrying: 0,
+        retryingEventIds: [],
+      };
+    }
     const first = events[0]!;
-    const tokenAuthority = input.tokenAuthority ?? 'local_mint';
+    let ledgerEvents = RUN_SCHEDULER_OUTBOX_START_EVENT_TYPES.includes(
+      first.eventType,
+    )
+      ? null
+      : events.flatMap(buildRunLedgerEventsFromPostgresSchedulerOutbox);
+    // Search-only facts are already durable and have no ledger projection.
+    // Validate and acknowledge them without acquiring runtime authority or
+    // renewing a network-delivery lease. A following terminal still uses the
+    // same fenced continuation and loads authority only when it needs a write.
     if (
       scope &&
       (scope.runId !== first.runId || scope.leaseOwner !== leaseOwner)
     ) {
       throw new Error('Run-ledger continuation is outside its dispatch scope.');
     }
-    // Minted executor authority is reused only inside this finite run/owner
-    // drain and only while it can cover the HTTP request plus its SQL renewal.
+    const needsRuntimeApi = ledgerEvents === null || ledgerEvents.length > 0;
+    let runtimeApi: WorkerRuntimeApiContext | null = null;
     const reuseMarginMs =
       Math.max(
         1,
@@ -19406,23 +20066,36 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         ),
       ) + RUNTIME_RELIABILITY_POLICY.schedulerDatabase.queryTimeoutMs;
     const cachedAuthority = authorityScope.authority;
+    const resolveRunRuntimeApi = () =>
+      launchJson !== null
+        ? resolvePostgresSchedulerRuntimeApiForRun(
+            launchJson,
+            first.runId,
+            first.leaseOwner
+              ? { eventId: first.eventId, leaseOwner: first.leaseOwner }
+              : null,
+            tokenAuthority,
+            options,
+            input.runtimeApi?.signal,
+          )
+        : loadPostgresSchedulerRuntimeApiForRun(
+            withClient,
+            first.runId,
+            first.leaseOwner
+              ? { eventId: first.eventId, leaseOwner: first.leaseOwner }
+              : null,
+            tokenAuthority,
+            options,
+            input.runtimeApi?.signal,
+          );
     const gatewayRuntimeApi =
-      tokenAuthority === 'gateway'
+      needsRuntimeApi && tokenAuthority === 'gateway'
         ? cachedAuthority?.runId === first.runId &&
           cachedAuthority.leaseOwner === leaseOwner &&
           cachedAuthority.expiresAtMs !== null &&
           cachedAuthority.expiresAtMs > Date.now() + reuseMarginMs
           ? cachedAuthority.runtimeApi
-          : await loadPostgresSchedulerRuntimeApiForRun(
-              withClient,
-              first.runId,
-              first.leaseOwner
-                ? { eventId: first.eventId, leaseOwner: first.leaseOwner }
-                : null,
-              tokenAuthority,
-              options,
-              input.runtimeApi?.signal,
-            )
+          : await resolveRunRuntimeApi()
         : null;
     if (
       gatewayRuntimeApi &&
@@ -19434,67 +20107,101 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         'Run Ledger dispatch origin changed within an immutable launch.',
       );
     }
-    const resolvedRuntimeApi =
-      gatewayRuntimeApi ??
-      input.runtimeApi ??
-      (await loadPostgresSchedulerRuntimeApiForRun(
-        withClient,
-        first.runId,
-        first.leaseOwner
-          ? { eventId: first.eventId, leaseOwner: first.leaseOwner }
-          : null,
-        tokenAuthority,
-        options,
-      ));
-    const runtimeApi = {
-      ...resolvedRuntimeApi,
-      ...(gatewayRuntimeApi && input.runtimeApi
-        ? {
-            ...(input.runtimeApi.fetch
-              ? { fetch: input.runtimeApi.fetch }
-              : {}),
-            ...(input.runtimeApi.requestTimeoutMs !== undefined
-              ? { requestTimeoutMs: input.runtimeApi.requestTimeoutMs }
-              : {}),
-            ...(input.runtimeApi.onResponseMeta
-              ? { onResponseMeta: input.runtimeApi.onResponseMeta }
-              : {}),
-            ...(input.runtimeApi.runtimeTestFaultHeader !== undefined
-              ? {
-                  runtimeTestFaultHeader:
-                    input.runtimeApi.runtimeTestFaultHeader,
-                }
-              : {}),
-            ...(input.runtimeApi.signal
-              ? { signal: input.runtimeApi.signal }
-              : {}),
-          }
-        : {}),
-      retryPolicy: 'none' as const,
-      // The caller-owned admission deadline (see `signal` above) wins.
-      ...(input.signal ? { signal: input.signal } : {}),
-    };
-    const tokenExpiresAtMs = runtimeApiTokenExpiresAtMs(
-      runtimeApi.executorToken,
-    );
-    if (tokenAuthority === 'gateway' && gatewayRuntimeApi) {
-      authorityScope.authority = {
-        runId: first.runId,
-        leaseOwner,
-        runtimeApi,
-        expiresAtMs: tokenExpiresAtMs,
+    if (needsRuntimeApi) {
+      const resolvedRuntimeApi =
+        gatewayRuntimeApi ?? input.runtimeApi ?? (await resolveRunRuntimeApi());
+      runtimeApi = {
+        ...resolvedRuntimeApi,
+        ...(gatewayRuntimeApi && input.runtimeApi
+          ? {
+              ...(input.runtimeApi.fetch
+                ? { fetch: input.runtimeApi.fetch }
+                : {}),
+              ...(input.runtimeApi.requestTimeoutMs !== undefined
+                ? { requestTimeoutMs: input.runtimeApi.requestTimeoutMs }
+                : {}),
+              ...(input.runtimeApi.onResponseMeta
+                ? { onResponseMeta: input.runtimeApi.onResponseMeta }
+                : {}),
+              ...(input.runtimeApi.runtimeTestFaultHeader !== undefined
+                ? {
+                    runtimeTestFaultHeader:
+                      input.runtimeApi.runtimeTestFaultHeader,
+                  }
+                : {}),
+              ...(input.runtimeApi.signal
+                ? { signal: input.runtimeApi.signal }
+                : {}),
+            }
+          : {}),
+        retryPolicy: 'none' as const,
+        // The caller-owned admission deadline (see `signal` above) wins.
+        ...(input.signal ? { signal: input.signal } : {}),
       };
+      if (tokenAuthority === 'gateway' && gatewayRuntimeApi) {
+        authorityScope.authority = {
+          runId: first.runId,
+          leaseOwner,
+          runtimeApi,
+          expiresAtMs: runtimeApiTokenExpiresAtMs(runtimeApi.executorToken),
+        };
+      }
+      authorityReadyAtMs = Date.now();
+    }
+    // The initial claim deliberately uses the old contract until its immutable
+    // launch receiver advertises support. Widen under the same run/owner fence
+    // before the first HTTP append, so an already-finished run need not pay one
+    // authority/append/ACK round trip for every ingress predecessor.
+    if (
+      runtimeApi?.runLedgerIngressPrefixBatching === true &&
+      events.length === 1 &&
+      first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents
+    ) {
+      const widened = await withClient((client) =>
+        readPendingPostgresSchedulerOutboxEvents(
+          client,
+          {
+            runId: first.runId,
+            leaseOwner,
+            leaseSeconds: input.leaseSeconds ?? 120,
+            limit: Math.min(
+              RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS,
+              remainingEvents ?? RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS,
+            ),
+            allowIngressPrefix: true,
+            extendOwnedHead: first.eventId,
+          },
+          options,
+        ),
+      );
+      if (widened[0]?.eventId !== first.eventId) {
+        throw new RunLedgerProjectionLeaseLostError(
+          'head_lease_owner_mismatch',
+        );
+      }
+      events = widened;
+    }
+    // Widening can add deferred facts to the lease. Project the complete
+    // frozen prefix before any HTTP append, including its newly claimed rows.
+    const handedOff = await materializeDeferredObservability();
+    if (handedOff) return handedOff;
+    if (ledgerEvents !== null) {
+      ledgerEvents = events.flatMap(
+        buildRunLedgerEventsFromPostgresSchedulerOutbox,
+      );
     }
-    authorityReadyAtMs = Date.now();
     const renewDelivery = async () => {
       const currentAuthority = authorityScope.authority;
       if (
+        runtimeApi &&
         tokenAuthority === 'gateway' &&
         currentAuthority?.runId === first.runId &&
         currentAuthority.leaseOwner === leaseOwner &&
         currentAuthority.expiresAtMs !== null &&
         currentAuthority.expiresAtMs <= Date.now() + reuseMarginMs
       ) {
+        // Initial delivery reuses the claim's routing fields. Renewal must
+        // reread authority so an origin change cannot pass under that cache.
         const refreshed = await loadPostgresSchedulerRuntimeApiForRun(
           withClient,
           first.runId,
@@ -19508,14 +20215,16 @@ async function dispatchRunLedgerOutboxBatchWithScope(
             'Run Ledger dispatch origin changed within an immutable launch.',
           );
         }
-        runtimeApi.executorToken = refreshed.executorToken;
+        runtimeApi.executorToken = refreshed.refreshExecutorToken
+          ? await refreshed.refreshExecutorToken()
+          : refreshed.executorToken;
         runtimeApi.vercelProtectionBypassToken =
           refreshed.vercelProtectionBypassToken;
         authorityScope.authority = {
           runId: first.runId,
           leaseOwner,
           runtimeApi,
-          expiresAtMs: runtimeApiTokenExpiresAtMs(refreshed.executorToken),
+          expiresAtMs: runtimeApiTokenExpiresAtMs(runtimeApi.executorToken),
         };
       }
       await withClient((client) =>
@@ -19525,70 +20234,107 @@ async function dispatchRunLedgerOutboxBatchWithScope(
             eventIds: events.map((event) => event.eventId),
             leaseOwner,
             leaseSeconds: input.leaseSeconds ?? 120,
+            freezeReceipt:
+              runtimeApi?.runLedgerIngressPrefixBatching === true &&
+              events.some(
+                (event) =>
+                  event.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents,
+              ),
           },
           options,
         ),
       );
     };
-    // A pending start is always claimed alone because later events require its
-    // snapshot. It cannot share the append endpoint, so retain that mutation
-    // as its own exact delivery.
-    if (first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runCreated) {
-      await renewDelivery();
-      await projectPostgresSchedulerCreatedEvent(runtimeApi, first);
-    } else if (first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runStarted) {
-      await renewDelivery();
-      const leaseOwner = first.leaseOwner;
-      const launch = leaseOwner
-        ? await withClient((client) =>
-            readRunLedgerDispatchLaunchForLease(
-              client,
-              {
-                runId: first.runId,
-                eventId: first.eventId,
-                leaseOwner,
-              },
-              options,
-            ),
-          )
-        : null;
-      await projectPostgresSchedulerStartEvent(runtimeApi, first, launch);
-    } else {
-      const ledgerEvents = events.flatMap(
-        buildRunLedgerEventsFromPostgresSchedulerOutbox,
-      );
-      if (ledgerEvents.length > 0) {
-        const terminal = [...events]
-          .reverse()
-          .find((event) =>
-            RUN_SCHEDULER_OUTBOX_TERMINAL_EVENT_TYPES.includes(event.eventType),
-          );
-        const batchDeliveryKey = createHash('sha256')
-          .update(events.map((event) => event.deliveryKey).join('\n'))
-          .digest('hex');
-        await projectRunEventsViaAppRuntime(runtimeApi, {
-          playId: first.runId,
-          events: ledgerEvents,
-          deliveryLeaseOwner: leaseOwner,
-          beforeBatch: renewDelivery,
-          idempotencyKey: terminal
-            ? buildRunLedgerTerminalIdempotencyKey({
-                runId: first.runId,
-                deliveryKey: terminal.deliveryKey,
-              })
-            : buildRunLedgerEventsIdempotencyKey({
-                runId: first.runId,
-                deliveryDigest: batchDeliveryKey,
-              }),
-        });
-      } else {
-        await renewDelivery();
+    if (needsRuntimeApi && runtimeApi) {
+      const append = async (runtimeApi: WorkerRuntimeApiContext) => {
+        // A pending start is always claimed alone because later events require
+        // its snapshot. Retain that mutation as its own exact delivery.
+        if (first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runCreated) {
+          await renewDelivery();
+          await projectPostgresSchedulerCreatedEvent(runtimeApi, first);
+        } else if (
+          first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runStarted
+        ) {
+          await renewDelivery();
+          const startLeaseOwner = first.leaseOwner;
+          const launch = startLeaseOwner
+            ? await withClient((client) =>
+                readRunLedgerDispatchLaunchForLease(
+                  client,
+                  {
+                    runId: first.runId,
+                    eventId: first.eventId,
+                    leaseOwner: startLeaseOwner,
+                  },
+                  options,
+                ),
+              )
+            : null;
+          await projectPostgresSchedulerStartEvent(runtimeApi, first, launch);
+        } else if (ledgerEvents && ledgerEvents.length > 0) {
+          const terminal = [...events]
+            .reverse()
+            .find((event) =>
+              RUN_SCHEDULER_OUTBOX_TERMINAL_EVENT_TYPES.includes(
+                event.eventType,
+              ),
+            );
+          const batchDeliveryKey = createHash('sha256')
+            .update(events.map((event) => event.deliveryKey).join('\n'))
+            .digest('hex');
+          // The transport renews before every HTTP chunk; another renewal here
+          // would add a checkout without protecting an intervening side effect.
+          await projectRunEventsViaAppRuntime(runtimeApi, {
+            playId: first.runId,
+            events: ledgerEvents,
+            deliveryLeaseOwner: leaseOwner,
+            beforeBatch: renewDelivery,
+            idempotencyKey: terminal
+              ? buildRunLedgerTerminalIdempotencyKey({
+                  runId: first.runId,
+                  deliveryKey: terminal.deliveryKey,
+                })
+              : buildRunLedgerEventsIdempotencyKey({
+                  runId: first.runId,
+                  deliveryDigest: batchDeliveryKey,
+                }),
+          });
+        }
+      };
+      try {
+        await append(runtimeApi);
+      } catch (error) {
+        // Refresh a reused authority once through this delivery's active lease.
+        // Both attempts retain the same fenced append and idempotency key.
+        if (
+          !gatewayRuntimeApi?.refreshExecutorToken ||
+          !(error instanceof AppRuntimeApiResponseError) ||
+          error.status !== 401
+        )
+          throw error;
+        runtimeApi.executorToken = await gatewayRuntimeApi.refreshExecutorToken();
+        await append(runtimeApi);
       }
+    } else if (tokenAuthority !== 'gateway') {
+      // App-side acknowledgement retains lease validation. The gateway can
+      // acknowledge a durable search-only fact without a network lease hop.
+      await renewDelivery();
     }
     appendFinishedAtMs = Date.now();
     const acknowledgement = await acknowledgeRunLedgerPrefixWithContinuation(
       withClient,
-      { input, events, leaseOwner, runtimeApi, scope, continuation },
+      {
+        input,
+        events,
+        leaseOwner,
+        runtimeApi,
+        scope,
+        continuation,
+        continuationAllowance:
+          remainingEvents === null
+            ? null
+            : Math.max(0, remainingEvents - events.length),
+      },
       options,
     );
     const { deliveredRows } = acknowledgement;
@@ -19630,6 +20376,10 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       authorityScope,
     );
   } catch (error) {
+    // A failed append must reacquire receiver truth on its next attempt,
+    // including an older receiver that rejected a frozen compound receipt.
+    authorityScope.authority?.runtimeApi.invalidateExecutorToken?.();
+    authorityScope.authority = null;
     await releasePendingContinuation();
     if (input.signal?.aborted) {
       // The caller's latency budget expired; this is not a delivery failure.
@@ -19654,25 +20404,98 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         retryingEventIds: released,
       };
     }
-    const settlement = await withClient(async (client) => {
-      const blocked: string[] = [];
-      const retrying: string[] = [];
-      for (const event of events) {
-        const outcome = await settlePostgresSchedulerOutboxFailure(
+    if (error instanceof DeferredRuntimeProjectionInputError) {
+      const outcome = await withClient((client) =>
+        settlePostgresSchedulerOutboxFailure(client, error.eventId, error, {
+          ...options,
+          leaseOwner,
+        }),
+      );
+      // Earlier facts may already be indexed. Only the invalid immutable row
+      // is quarantined; valid predecessors remain deliverable in causal order.
+      const released = await withClient((client) =>
+        releasePostgresSchedulerOutboxLease(
           client,
-          event.eventId,
-          error,
+          events
+            .filter((event) => event.eventId !== error.eventId)
+            .map((event) => event.eventId),
           { ...options, leaseOwner },
-        );
-        if (outcome === 'blocked') blocked.push(event.eventId);
-        else retrying.push(event.eventId);
+        ),
+      );
+      const failed = outcome === 'blocked' ? [error.eventId] : [];
+      const retrying =
+        outcome === 'blocked' ? released : [...released, error.eventId];
+      console.error('[run-ledger-outbox.invalid_projection_input]', {
+        eventId: error.eventId,
+        code: error.code,
+        detail: error.message,
+      });
+      return {
+        attempted: events.length,
+        projected: 0,
+        eventIds: [],
+        failed: failed.length,
+        failedEventIds: failed,
+        retrying: retrying.length,
+        retryingEventIds: retrying,
+      };
+    }
+    const settlement = await withClient(async (client) => {
+      await client.query('BEGIN');
+      try {
+        const blocked: string[] = [];
+        const retrying: string[] = [];
+        const ownedRetrying: string[] = [];
+        for (const event of events) {
+          const outcome = await settlePostgresSchedulerOutboxFailure(
+            client,
+            event.eventId,
+            error,
+            { ...options, leaseOwner },
+          );
+          if (outcome === 'blocked') blocked.push(event.eventId);
+          else retrying.push(event.eventId);
+          if (outcome === 'retrying') ownedRetrying.push(event.eventId);
+        }
+        // All members of this failed append must become due together. Keep
+        // the existing per-row retry policy, taking its latest deadline only
+        // for rows this owner actually settled, before releasing their locks.
+        if (ownedRetrying.length > 1) {
+          await client.query(
+            `
+            WITH retry AS (
+              SELECT max(next_attempt_at) AS retry_at
+              FROM ${tableName('outbox', options)}
+              WHERE event_id = ANY($1::text[])
+                AND delivered_at IS NULL AND failed_at IS NULL
+            )
+            UPDATE ${tableName('outbox', options)} AS outbox
+            SET next_attempt_at = retry.retry_at
+            FROM retry
+            WHERE outbox.event_id = ANY($1::text[])
+              AND outbox.delivered_at IS NULL AND outbox.failed_at IS NULL
+              AND retry.retry_at IS NOT NULL
+          `,
+            [ownedRetrying],
+          );
+        }
+        await client.query('COMMIT');
+        return { blocked, retrying };
+      } catch (settlementError) {
+        await client.query('ROLLBACK');
+        throw settlementError;
       }
-      return { blocked, retrying };
     });
+    const failure = runLedgerDeliveryFailure({ error });
     console.warn('[run-ledger-outbox.batch_dispatch_failed]', {
       runId: input.runId ?? null,
       eventIds: events.map((event) => event.eventId),
       error: error instanceof Error ? error.message : String(error),
+      code: failure.code,
+      failureReason: failure.failureReason,
+      ...(failure.projectionMismatch
+        ? { projectionMismatch: failure.projectionMismatch }
+        : {}),
     });
     return {
       attempted: events.length,
@@ -19781,9 +20604,10 @@ async function acknowledgeRunLedgerPrefixWithContinuation(
     input: RunLedgerOutboxDispatchInput;
     events: PostgresSchedulerOutboxEvent[];
     leaseOwner: string;
-    runtimeApi: WorkerRuntimeApiContext;
+    runtimeApi: WorkerRuntimeApiContext | null;
     scope?: RunLedgerOutboxDrainScope;
     continuation: { current: RunLedgerOutboxDrainScope | null };
+    continuationAllowance: number | null;
   },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<{
@@ -19796,74 +20620,86 @@ async function acknowledgeRunLedgerPrefixWithContinuation(
     !!input.scope ||
     (input.input.continueThroughTerminal === true && !input.input.headEventId);
   return withClient(async (client) => {
-    if (retainContinuation) {
-      await client.query('BEGIN');
-    }
-    try {
+    const acknowledge = async () => {
       if (retainContinuation) {
-        await client.query(
-          `SELECT set_config('lock_timeout', $1, true), set_config('statement_timeout', $2, true)`,
-          [
-            `${RUNTIME_SCHEDULER_CANCEL_LOCK_TIMEOUT_MS}ms`,
-            `${RUNTIME_SCHEDULER_CANCEL_STATEMENT_TIMEOUT_MS}ms`,
-          ],
-        );
-        // Keep the acknowledged prefix and its successor under one run lock.
-        // No competing projector can take the next head while this ACK's
-        // response is travelling back to the lease holder.
-        await client.query(
-          `SELECT run_id FROM ${tableName('runs', options)} WHERE run_id = $1 FOR UPDATE`,
-          [runId],
-        );
+        await client.query('BEGIN');
       }
-      const deliveredRows = await markPostgresSchedulerOutboxDeliveredRows(
-        client,
-        input.events.map((event) => event.eventId),
-        { ...options, leaseOwner: input.leaseOwner },
-      );
-      let continuation: RunLedgerOutboxDrainScope | null = null;
-      if (
-        retainContinuation &&
-        deliveredRows.length === input.events.length &&
-        !input.events.some((event) => event.eventId === targetEventId)
-      ) {
-        const target = await readPostgresSchedulerOutboxDeliveryStatus(
-          client,
-          { runId, eventId: targetEventId },
-          options,
-        );
-        if (target.exists && !target.delivered && !target.blocked) {
-          const nextClaimed = await readPendingPostgresSchedulerOutboxEvents(
-            client,
-            {
-              runId,
-              leaseOwner: input.leaseOwner,
-              leaseSeconds: input.input.leaseSeconds ?? 120,
-              limit: Math.min(
-                RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS,
-                input.input.limit ?? 1,
-              ),
-              inTransaction: true,
-            },
-            options,
+      try {
+        if (retainContinuation) {
+          await client.query(
+            `SELECT set_config('lock_timeout', $1, true), set_config('statement_timeout', $2, true)`,
+            [
+              `${RUNTIME_SCHEDULER_CANCEL_LOCK_TIMEOUT_MS}ms`,
+              `${RUNTIME_SCHEDULER_CANCEL_STATEMENT_TIMEOUT_MS}ms`,
+            ],
+          );
+          // Keep the acknowledged prefix and its successor under one run lock.
+          // No competing projector can take the next head while this ACK's
+          // response is travelling back to the lease holder.
+          await client.query(
+            `SELECT run_id FROM ${tableName('runs', options)} WHERE run_id = $1 FOR UPDATE`,
+            [runId],
           );
-          if (nextClaimed.length > 0) {
-            continuation = input.scope ?? {
-              runId,
-              leaseOwner: input.leaseOwner,
-              targetEventId,
-              nextClaimed: [],
-            };
-            continuation.nextClaimed = nextClaimed;
-            input.continuation.current = continuation;
-          }
         }
+        const eventIds = input.events.map((event) => event.eventId);
+        const { deliveredRows, events: nextClaimed } =
+          retainContinuation &&
+          input.continuationAllowance !== 0 &&
+          !eventIds.includes(targetEventId)
+            ? await claimPostgresSchedulerOutboxPrefix(
+                client,
+                {
+                  runId,
+                  leaseOwner: input.leaseOwner,
+                  leaseSeconds: input.input.leaseSeconds ?? 120,
+                  limit: Math.min(
+                    RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS,
+                    input.runtimeApi?.runLedgerIngressPrefixBatching === true
+                      ? RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS
+                      : (input.input.limit ?? 1),
+                    input.continuationAllowance ??
+                      RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS,
+                  ),
+                  allowIngressPrefix:
+                    input.runtimeApi?.runLedgerIngressPrefixBatching === true,
+                },
+                options,
+                { eventIds, targetEventId },
+              )
+            : {
+                deliveredRows: await markPostgresSchedulerOutboxDeliveredRows(
+                  client,
+                  eventIds,
+                  { ...options, leaseOwner: input.leaseOwner },
+                ),
+                events: [],
+              };
+        let continuation: RunLedgerOutboxDrainScope | null = null;
+        if (nextClaimed.length > 0) {
+          continuation = input.scope ?? {
+            runId,
+            leaseOwner: input.leaseOwner,
+            targetEventId,
+            nextClaimed: [],
+          };
+          continuation.nextClaimed = nextClaimed;
+          input.continuation.current = continuation;
+        }
+        if (retainContinuation) await client.query('COMMIT');
+        return { deliveredRows, continuation };
+      } catch (error) {
+        if (retainContinuation) await client.query('ROLLBACK');
+        throw error;
       }
-      if (retainContinuation) await client.query('COMMIT');
-      return { deliveredRows, continuation };
+    };
+    try {
+      return await acknowledge();
     } catch (error) {
-      if (retainContinuation) await client.query('ROLLBACK');
-      throw error;
+      if (!isMissingOutboxDeliveryBatchMarker(error)) throw error;
+      // The first statement recorded this operation-local missing column and
+      // rolled back its ACK. Reacquire the run lock and take a fresh snapshot
+      // for the existing compatibility claim, without another ledger append.
+      return await acknowledge();
     }
   });
 }
@@ -20019,70 +20855,45 @@ async function projectPostgresSchedulerStartEvent(
   });
 }
 
-export type RunLedgerDispatchLaunch = Pick<
-  PlaySchedulerSubmitInput,
-  | 'runId'
-  | 'playId'
-  | 'playName'
-  | 'executorToken'
-  | 'baseUrl'
-  | 'runtimeApiBaseUrl'
-  | 'runtimeTokenOrigin'
-  | 'orgId'
-  | 'runtimeAuthority'
-  | 'vercelProtectionBypassToken'
->;
+export type { RunLedgerDispatchLaunch } from './run-ledger-dispatch-authority';
 
-/** Authority reads never transfer customer input, artifacts or execution graphs. */
-function runLedgerDispatchLaunchSql(alias: string): string {
-  const fields: (keyof RunLedgerDispatchLaunch)[] = [
-    'runId',
-    'playId',
-    'playName',
-    'executorToken',
-    'baseUrl',
-    'runtimeApiBaseUrl',
-    'runtimeTokenOrigin',
-    'orgId',
-    'runtimeAuthority',
-    'vercelProtectionBypassToken',
-  ];
-  return `jsonb_build_object(${fields
-    .map((field) => `'${field}', ${alias}.launch_json->'${field}'`)
-    .join(', ')})`;
+/** Search-only `run.events` facts settle without consulting launch credentials. */
+function runLedgerSearchOnlyOutboxFactSql(alias: string): string {
+  const events = `CASE
+    WHEN jsonb_typeof(${alias}.payload_json->'events') = 'array'
+      THEN ${alias}.payload_json->'events'
+    ELSE '[]'::jsonb
+  END`;
+  return `(
+    ${alias}.event_type = '${RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents}'
+    AND ${alias}.payload_json->>'logBodyStore' = 'planet_scale'
+    AND jsonb_array_length(${events}) = 0
+  )`;
 }
 
-async function loadPostgresSchedulerRuntimeApiForRun(
-  withClient: <T>(
-    operation: (client: PostgresSchedulerQueryClient) => Promise<T>,
-  ) => Promise<T>,
+async function resolvePostgresSchedulerRuntimeApiForRun(
+  launchJson: unknown,
   runId: string,
   dispatchLease: { eventId: string; leaseOwner: string } | null,
   tokenAuthority: RunLedgerOutboxTokenAuthority,
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
   signal?: AbortSignal,
-): Promise<WorkerRuntimeApiContext> {
-  // Release the scarce scheduler checkout before the token authority hop.
-  // A slow gateway must not retain either projector pool client, and its
-  // launch context must not hydrate customer execution graphs.
-  const result = await withClient((client) =>
-    client.query<{ launch_json: unknown }>(
-      `SELECT ${runLedgerDispatchLaunchSql('runs')} AS launch_json
-       FROM ${tableName('runs', options)} AS runs
-       WHERE run_id = $1
-       LIMIT 1`,
-      [runId],
-    ),
-  );
-  const launch: RunLedgerDispatchLaunch = parseLaunchJson(
-    result.rows[0]?.launch_json,
-  );
+): Promise<
+  WorkerRuntimeApiContext & {
+    refreshExecutorToken?: () => Promise<string>;
+    invalidateExecutorToken?: () => void;
+  }
+> {
+  const launch = parseRunLedgerDispatchLaunch(launchJson);
   if (!launch?.baseUrl) {
     throw new Error(
       `Run-ledger outbox dispatcher cannot resolve runtime API context for ${runId}.`,
     );
   }
   let executorToken: string;
+  let runLedgerIngressPrefixBatching: true | undefined;
+  let refreshExecutorToken: (() => Promise<string>) | undefined;
+  let invalidateExecutorToken: (() => void) | undefined;
   if (tokenAuthority === 'local_mint') {
     // App-side authoritative projector: sign in-process. NEVER reached on the
     // Fly worker (it passes `gateway`), so this is the only place `BETTER_AUTH_
@@ -20101,34 +20912,120 @@ async function loadPostgresSchedulerRuntimeApiForRun(
         `Run-ledger outbox gateway dispatch for ${runId} requires an active outbox lease.`,
       );
     }
-    executorToken = await requestRunLedgerDispatchToken({
+    const dispatchRequest = {
       launch,
       eventId: dispatchLease.eventId,
       leaseOwner: dispatchLease.leaseOwner,
       schedulerSchema: options?.schema ?? null,
       signal,
-    });
+    };
+    const dispatchAuthority =
+      await requestRunLedgerDispatchToken(dispatchRequest);
+    invalidateExecutorToken = () =>
+      runLedgerDispatchTokens.delete(dispatchAuthority.cacheKey);
+    if (dispatchAuthority.reused) {
+      refreshExecutorToken = async () =>
+        (await requestRunLedgerDispatchToken(dispatchRequest, true))
+          .executorToken;
+    }
+    executorToken = dispatchAuthority.executorToken;
+    runLedgerIngressPrefixBatching =
+      dispatchAuthority.runLedgerIngressPrefixBatching;
   }
   return {
     baseUrl: runtimeApiBaseUrlFromLaunch(launch),
     executorToken,
+    ...(runLedgerIngressPrefixBatching
+      ? { runLedgerIngressPrefixBatching }
+      : {}),
     vercelProtectionBypassToken: launch.vercelProtectionBypassToken ?? null,
+    ...(refreshExecutorToken ? { refreshExecutorToken } : {}),
+    ...(invalidateExecutorToken ? { invalidateExecutorToken } : {}),
   };
 }
 
-async function requestRunLedgerDispatchToken(input: {
-  launch: RunLedgerDispatchLaunch;
-  eventId: string;
-  leaseOwner: string;
-  schedulerSchema: string | null;
-  signal?: AbortSignal;
-}): Promise<string> {
+async function loadPostgresSchedulerRuntimeApiForRun(
+  withClient: <T>(
+    operation: (client: PostgresSchedulerQueryClient) => Promise<T>,
+  ) => Promise<T>,
+  runId: string,
+  dispatchLease: { eventId: string; leaseOwner: string } | null,
+  tokenAuthority: RunLedgerOutboxTokenAuthority,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+  signal?: AbortSignal,
+): ReturnType<typeof resolvePostgresSchedulerRuntimeApiForRun> {
+  // A continuation already owns its next event lease, so its launch context
+  // is not part of the preclaim result. Load only the authority fields here.
+  const result = await withClient((client) =>
+    client.query<{ launch_json: unknown }>(
+      `SELECT ${runLedgerDispatchLaunchSql('runs')} AS launch_json
+       FROM ${tableName('runs', options)} AS runs
+       WHERE run_id = $1
+       LIMIT 1`,
+      [runId],
+    ),
+  );
+  return resolvePostgresSchedulerRuntimeApiForRun(
+    result.rows[0]?.launch_json,
+    runId,
+    dispatchLease,
+    tokenAuthority,
+    options,
+    signal,
+  );
+}
+
+// Only freshly gateway-issued legacy run.progress authority is reused.
+// Prefix advertisements are reacquired for each drain because they select its
+// receipt shape, including recovery across receiver capability changes. This is not
+// a lease cache: every delivery still claims, renews, and proves its own lease
+// at append. Include the complete pinned authority/routing and internal-token
+// fingerprint so a different run, schema, origin, or authority never shares it.
+const RUN_LEDGER_DISPATCH_TOKEN_CACHE_MS = 30_000;
+const RUN_LEDGER_DISPATCH_TOKEN_CACHE_ENTRIES = 256;
+const runLedgerDispatchTokens = new Map<
+  string,
+  { token: string; expiresAt: number; runLedgerIngressPrefixBatching?: true }
+>();
+
+async function requestRunLedgerDispatchToken(
+  input: {
+    launch: RunLedgerDispatchLaunch;
+    eventId: string;
+    leaseOwner: string;
+    schedulerSchema: string | null;
+    signal?: AbortSignal;
+  },
+  forceFresh = false,
+): Promise<{
+  executorToken: string;
+  reused: boolean;
+  cacheKey: string;
+  runLedgerIngressPrefixBatching?: true;
+}> {
   const internalToken = process.env.DEEPLINE_INTERNAL_TOKEN?.trim();
   if (!internalToken || !input.eventId || !input.leaseOwner) {
     throw new Error(
       'Run-ledger outbox recovery requires a valid dispatch lease and DEEPLINE_INTERNAL_TOKEN.',
     );
   }
+  input.signal?.throwIfAborted();
+  const { executorToken: _storedToken, ...authority } = input.launch;
+  const cacheKey = createHash('sha256')
+    .update(JSON.stringify([input.schedulerSchema, authority, internalToken]))
+    .digest('hex');
+  const now = Date.now();
+  for (const [key, entry] of runLedgerDispatchTokens) {
+    if (entry.expiresAt <= now) runLedgerDispatchTokens.delete(key);
+  }
+  const cached = runLedgerDispatchTokens.get(cacheKey);
+  if (!forceFresh && cached)
+    return {
+      executorToken: cached.token,
+      reused: true,
+      cacheKey,
+    };
+  runLedgerDispatchTokens.delete(cacheKey);
   const url = `${runtimeApiBaseUrlFromLaunch(input.launch).replace(/\/$/, '')}/api/v2/internal/play-runtime/run-ledger-dispatch-token`;
   const vercelProtectionHeaders = await vercelProtectionBypassHeaders({
     baseUrl: runtimeApiBaseUrlFromLaunch(input.launch),
@@ -20164,6 +21061,7 @@ async function requestRunLedgerDispatchToken(input: {
     try {
       return JSON.parse(responseText) as {
         executorToken?: unknown;
+        runLedgerIngressPrefixBatching?: unknown;
         error?: unknown;
         code?: unknown;
         retryable?: unknown;
@@ -20196,7 +21094,53 @@ async function requestRunLedgerDispatchToken(input: {
             : 'invalid response',
     });
   }
-  return body.executorToken;
+  // Decode only the lifetime, never an authentication decision: the app
+  // validates the signature, run scope, and live delivery lease on append.
+  // Opaque/older token formats continue to work without this optimization.
+  try {
+    const claims = JSON.parse(
+      Buffer.from(
+        body.executorToken.split('.')[1] ?? '',
+        'base64url',
+      ).toString(),
+    ) as { exp?: unknown };
+    if (
+      body.runLedgerIngressPrefixBatching === undefined &&
+      typeof claims.exp === 'number' &&
+      Number.isFinite(claims.exp)
+    ) {
+      const expiresAt = Math.min(
+        Date.now() + RUN_LEDGER_DISPATCH_TOKEN_CACHE_MS,
+        claims.exp * 1_000 - 5_000,
+      );
+      if (expiresAt > Date.now()) {
+        runLedgerDispatchTokens.set(cacheKey, {
+          token: body.executorToken,
+          expiresAt,
+        });
+        while (
+          runLedgerDispatchTokens.size > RUN_LEDGER_DISPATCH_TOKEN_CACHE_ENTRIES
+        ) {
+          runLedgerDispatchTokens.delete(
+            runLedgerDispatchTokens.keys().next().value!,
+          );
+        }
+      }
+    }
+  } catch {
+    // A cache miss never changes delivery or hides a gateway rejection.
+  }
+  if (body.runLedgerIngressPrefixBatching !== undefined) {
+    runLedgerDispatchTokens.delete(cacheKey);
+  }
+  return {
+    executorToken: body.executorToken,
+    reused: false,
+    cacheKey,
+    ...(body.runLedgerIngressPrefixBatching === true
+      ? { runLedgerIngressPrefixBatching: true as const }
+      : {}),
+  };
 }
 
 export async function requestComputeBillingDispatchToken(input: {
@@ -20272,27 +21216,7 @@ export async function requestComputeBillingDispatchToken(input: {
   return body.executorToken;
 }
 
-/** Read only the immutable authority/routing fields under the same lease fence. */
-export async function readRunLedgerDispatchAuthorityForLease(
-  client: PostgresSchedulerQueryClient,
-  input: { runId: string; eventId: string; leaseOwner: string },
-  options?: Pick<PostgresSchedulerOptions, 'schema'>,
-): Promise<RunLedgerDispatchLaunch | null> {
-  const result = await client.query<{ launch_json: unknown }>(
-    `SELECT ${runLedgerDispatchLaunchSql('runs')} AS launch_json
-     FROM ${tableName('outbox', options)} outbox
-     JOIN ${tableName('runs', options)} runs ON runs.run_id = outbox.run_id
-     WHERE outbox.event_id = $1
-       AND outbox.run_id = $2
-       AND outbox.lease_owner = $3
-       AND outbox.lease_expires_at > now()
-       AND outbox.delivered_at IS NULL
-       AND outbox.failed_at IS NULL
-     LIMIT 1`,
-    [input.eventId, input.runId, input.leaseOwner],
-  );
-  return result.rows[0] ? parseLaunchJson(result.rows[0].launch_json) : null;
-}
+export { readRunLedgerDispatchAuthorityForLease } from './run-ledger-dispatch-authority';
 
 export async function readRunLedgerDispatchLaunchForLease(
   client: PostgresSchedulerQueryClient,
@@ -20379,6 +21303,20 @@ function terminalLogContextsPayloadField(
   return value.map(normalizePlayLogContext);
 }
 
+function terminalLogMetadataPayloadField(
+  payload: unknown,
+  lines: readonly string[],
+): Array<PlayLogMetadata | null> | null {
+  const value = payloadField(payload, 'terminalLogMetadata');
+  if (value === undefined) return null;
+  if (!Array.isArray(value) || value.length !== lines.length) {
+    throw new TypeError(
+      'Terminal log metadata must align with terminal log lines.',
+    );
+  }
+  return value.map(normalizePlayLogMetadata);
+}
+
 function ledgerEventsPayloadField(
   payload: unknown,
   key: string,
@@ -20415,22 +21353,10 @@ function sourcePayloadField(
 }
 
 function parseLaunchJson(value: unknown): PlaySchedulerSubmitInput {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    throw new Error('Postgres scheduler launch_json is not an object.');
-  }
-  const launch = value as Partial<PlaySchedulerSubmitInput>;
-  if (
-    typeof launch.runId !== 'string' ||
-    typeof launch.playId !== 'string' ||
-    typeof launch.playName !== 'string' ||
-    typeof launch.executorToken !== 'string' ||
-    typeof launch.baseUrl !== 'string'
-  ) {
-    throw new Error(
-      'Postgres scheduler launch_json is missing required fields.',
-    );
-  }
-  return hydrateRetainedPlayPipelines(launch as PlaySchedulerSubmitInput);
+  const launch = parseRunLedgerDispatchLaunch(
+    value,
+  ) as PlaySchedulerSubmitInput;
+  return hydrateRetainedPlayPipelines(launch);
 }
 
 function parsePostgresSchedulerCronSourcePin(