deepline 0.3.289 → 0.3.291

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/runtime-event-search.ts

@@ -1,9 +1,14 @@
 /**
  * The customer-visible, append-only search projection of durable Play facts.
  *
- * Outbox and receipt triggers write small rows in their authoritative SQL
- * transaction. They never deliver work, replay a Play, or copy receipt output.
- * The API may read only through fixed, tenant-scoped queries in this module.
+ * After reader-first cutover, triggers persist raw input in the existing
+ * outbox. The leased dispatcher projects and compacts it before delivery.
+ * PlanetScale runtime_observability.events is the single log/event/receipt
+ * discovery surface. JSONPath runs natively against its indexed search_doc;
+ * exact identities use indexed columns on that same table. Full saved results
+ * resolve through the scoped fetch_receipt capability, never a second search
+ * store or a CLI-side scan. Receipt output remains authoritative in its store.
+ * The API uses only the fixed, tenant-scoped readers in this module.
  */
 import { normalizeRuntimeSchedulerSchema } from '../runtime-scheduler-topology';
 import type { PostgresSchedulerQueryClient } from './postgres';
@@ -56,7 +61,11 @@ const RUNTIME_EVENT_LOG_POSITION_EXPRESSION = `jsonb_set(
 // Migration readiness tracks this projection body independently of scheduler
 // wire and schema versions. Bump when a changed trigger must be reinstalled.
 export const RUNTIME_EVENT_SEARCH_OUTBOX_PROJECTION_MARKER =
-  'runtime-event-search-log-context-v14-btree-position';
+  'runtime-event-search-origin-batches-log-metadata';
+/** Trusted trigger-authored state; absent on already-projected legacy rows. */
+export const RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD =
+  '_runtimeSearchProjectionPending';
+export const RUNTIME_EVENT_SEARCH_ONLY_FIELD = '_runtimeSearchOnly';
 export const RUNTIME_EVENT_CANONICAL_RETENTION_INDEX_READY_MARKER =
   'runtime-event-canonical-retention-v1';
 export const RUNTIME_EVENTS_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
@@ -172,7 +181,7 @@ function parseRuntimeEventJsonpath(value: string): RuntimeEventPredicate[] {
     );
   }
   const clause =
-    /\$\.(orgId|runId|playName|runtimeScope|producerAttempt|kind|status|source|stepId|stepKind|datasetId|phase|provider|operation|context\.[A-Za-z_][A-Za-z0-9_]{0,63})\s*==\s*("(?:\\.|[^"\\])*"|true|false|-?\d+(?:\.\d+)?)/y;
+    /\$\.(eventId|orgId|runId|playName|runtimeScope|producerAttempt|kind|status|source|level|stepId|stepKind|datasetId|phase|provider|operation|context\.[A-Za-z_][A-Za-z0-9_]{0,63})\s*==\s*("(?:\\.|[^"\\])*"|true|false|-?\d+(?:\.\d+)?)/y;
   let position = 0;
   let clauses = 0;
   const predicates: RuntimeEventPredicate[] = [];
@@ -209,7 +218,9 @@ function parseRuntimeEventJsonpath(value: string): RuntimeEventPredicate[] {
       );
     }
     if (
-      ['orgId', 'runId', 'playName', 'runtimeScope'].includes(match[1]) &&
+      ['eventId', 'orgId', 'runId', 'playName', 'runtimeScope'].includes(
+        match[1],
+      ) &&
       typeof parsed !== 'string'
     ) {
       throw new RuntimeEventInputError(
@@ -226,6 +237,14 @@ function parseRuntimeEventJsonpath(value: string): RuntimeEventPredicate[] {
         'Runtime event producerAttempt requires a positive integer.',
       );
     }
+    if (
+      match[1] === 'level' &&
+      !['debug', 'info', 'warn', 'error'].includes(String(parsed))
+    ) {
+      throw new RuntimeEventInputError(
+        'Runtime event level requires debug, info, warn or error.',
+      );
+    }
     predicates.push({ path: match[1], literal: match[2], value: parsed });
     if (
       match[1].startsWith('context.') &&
@@ -343,6 +362,7 @@ export async function searchRuntimeEvents(
   addExact('kind', input.kind);
   if (input.jsonpath !== undefined) {
     const identityColumns = {
+      eventId: 'event_id',
       orgId: 'org_id',
       runId: 'run_id',
       playName: 'play_name',
@@ -950,11 +970,131 @@ export async function hasRuntimeEventReaderGrant(
   return result.rows[0]?.ready === true;
 }
 
+/** Deployment-owned cutover; install readers everywhere before enabling. */
+export async function setRuntimeEventDeferredProjection(
+  client: PostgresSchedulerQueryClient,
+  runtimeScope: string,
+  deferred: boolean,
+  independent?: boolean,
+): Promise<void> {
+  const schema = quoteIdent(requiredScope(runtimeScope));
+  if (!(await hasRuntimeEventSearchShape(client, runtimeScope))) {
+    throw new Error(
+      'Install the deferred outbox reader before changing projection mode.',
+    );
+  }
+  if (deferred && !(await hasRuntimeEventLogPositionIndex(client))) {
+    throw new Error(
+      'Prepare the log-position indexes before enabling deferred projection.',
+    );
+  }
+  await client.query('BEGIN');
+  try {
+    await client.query("SELECT set_config('lock_timeout', '1000', true)");
+    // Fence trigger execution while changing mode. This operator-only lock
+    // never spans projection; normal producer writes acquire no such lock.
+    await client.query(
+      `LOCK TABLE ${schema}.outbox IN SHARE ROW EXCLUSIVE MODE`,
+    );
+    if (!deferred) {
+      const pending = await client.query<{ event_id: string }>(
+        `SELECT event_id FROM ${schema}.outbox
+          WHERE delivered_at IS NULL
+            AND payload_json->'${RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD}' = 'true'::jsonb
+          LIMIT 1`,
+      );
+      if (pending.rows.length > 0) {
+        throw new Error(
+          'Drain deferred outbox rows before returning to synchronous projection.',
+        );
+      }
+    }
+    if (independent === false || !deferred) {
+      const raw = await client.query<{ event_id: string }>(
+        `SELECT event_id FROM ${schema}.outbox WHERE delivered_at IS NULL AND payload_json->'${RUNTIME_EVENT_SEARCH_ONLY_FIELD}' = 'true'::jsonb LIMIT 1`,
+      );
+      if (raw.rows.length)
+        throw new Error(
+          'Drain independent search rows before disabling independent projection.',
+        );
+    }
+    await installRuntimeEventProjectionMode(client, schema, deferred);
+    if (independent !== undefined || !deferred)
+      await installIndependentProjectionMode(
+        client,
+        schema,
+        deferred && independent === true,
+      );
+    await client.query('COMMIT');
+  } catch (error) {
+    await client.query('ROLLBACK');
+    throw error;
+  }
+}
+
+/** Operator state uses the same durable pending set as the outbox projector. */
+export async function inspectRuntimeEventProjection(
+  client: PostgresSchedulerQueryClient,
+  runtimeScope: string,
+): Promise<{
+  deferred: boolean;
+  independent: boolean;
+  pending: number;
+  blocked: number;
+  oldestPendingAt: string | null;
+}> {
+  const schema = quoteIdent(requiredScope(runtimeScope));
+  const result = await client.query<{
+    deferred: boolean;
+    independent: boolean;
+    pending: string | number;
+    blocked: string | number;
+    oldest: Date | string | null;
+  }>(`SELECT ${schema}.defer_runtime_event_projection() AS deferred, ${schema}.independent_runtime_event_projection() AS independent,
+      count(*) AS pending, count(*) FILTER (WHERE failed_at IS NOT NULL) AS blocked,
+      min(created_at) AS oldest
+    FROM ${schema}.outbox
+    WHERE delivered_at IS NULL
+      AND payload_json->'${RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD}' = 'true'::jsonb`);
+  const state = result.rows[0]!;
+  return {
+    deferred: state.deferred,
+    independent: state.independent,
+    pending: Number(state.pending),
+    blocked: Number(state.blocked),
+    oldestPendingAt: state.oldest === null ? null : iso(state.oldest),
+  };
+}
+
+async function installRuntimeEventProjectionMode(
+  client: PostgresSchedulerQueryClient,
+  schema: string,
+  deferred: boolean,
+): Promise<void> {
+  await client.query(`CREATE OR REPLACE FUNCTION ${schema}.defer_runtime_event_projection()
+    RETURNS boolean LANGUAGE sql VOLATILE SET search_path = pg_catalog
+    AS 'SELECT ${deferred ? 'true' : 'false'}'`);
+  await client.query(
+    `REVOKE ALL ON FUNCTION ${schema}.defer_runtime_event_projection() FROM PUBLIC`,
+  );
+}
+
+async function installIndependentProjectionMode(
+  client: PostgresSchedulerQueryClient,
+  schema: string,
+  enabled: boolean,
+): Promise<void> {
+  await client.query(`CREATE OR REPLACE FUNCTION ${schema}.independent_runtime_event_projection()
+    RETURNS boolean LANGUAGE sql VOLATILE SET search_path = pg_catalog AS 'SELECT ${enabled ? 'true' : 'false'}'`);
+  await client.query(
+    `REVOKE ALL ON FUNCTION ${schema}.independent_runtime_event_projection() FROM PUBLIC`,
+  );
+}
+
 /**
- * Triggers are attached to each scheduler namespace by the explicit migration.
- * Search writes are atomic with the already-durable outbox/receipt write. A
- * trigger failure is loud so no authoritative write can silently lose its
- * corresponding search history after enablement.
+ * Migration installs readers with synchronous production unchanged. After
+ * cutover, the producer persists raw input and only the leased dispatcher
+ * projects and compacts it, atomically, before acknowledging its outbox row.
  */
 export async function attachRuntimeEventSearchTriggers(
   client: PostgresSchedulerQueryClient,
@@ -962,6 +1102,33 @@ export async function attachRuntimeEventSearchTriggers(
 ): Promise<void> {
   const scope = requiredScope(runtimeScope);
   const schema = quoteIdent(scope);
+  // Refreshing the reader must preserve an already-enabled producer cutover.
+  const mode = await client.query<{ installed: boolean }>(
+    `SELECT to_regprocedure($1) IS NOT NULL AS installed`,
+    [`${schema}.defer_runtime_event_projection()`],
+  );
+  if (!mode.rows[0]?.installed) {
+    await installRuntimeEventProjectionMode(client, schema, false);
+  }
+  const independentMode = await client.query<{ installed: boolean }>(
+    `SELECT to_regprocedure($1) IS NOT NULL AS installed`,
+    [`${schema}.independent_runtime_event_projection()`],
+  );
+  if (!independentMode.rows[0]?.installed)
+    await installIndependentProjectionMode(client, schema, false);
+  // Stamp new admissions once. Existing launches never acquire a producer pin
+  // on replay or worker upgrade. Ignore a caller-supplied pin before cutover.
+  await client.query(`CREATE OR REPLACE FUNCTION ${schema}.pin_runtime_log_identity() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
+    BEGIN
+      NEW.launch_json := NEW.launch_json - 'runtimeLogIdentity';
+      NEW.admission_json := NEW.admission_json - 'runtimeLogIdentity';
+      IF ${schema}.independent_runtime_event_projection() THEN
+        NEW.launch_json := NEW.launch_json || '{"runtimeLogIdentity":"origin"}'::jsonb;
+        NEW.admission_json := NEW.admission_json || '{"runtimeLogIdentity":"origin"}'::jsonb;
+      END IF;
+      RETURN NEW;
+    END $function$`);
   await client.query(`
     CREATE OR REPLACE FUNCTION ${schema}.search_receipt_event() RETURNS trigger
     LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
@@ -978,6 +1145,23 @@ export async function attachRuntimeEventSearchTriggers(
       IF NEW.run_id IS NULL OR NEW.org_id IS NULL THEN
         RAISE EXCEPTION 'Terminal receipt search projection requires run and organization';
       END IF;
+      IF ${schema}.defer_runtime_event_projection() THEN
+        IF NOT EXISTS (SELECT 1 FROM ${schema}.runs
+          WHERE run_id = NEW.run_id AND org_id = NEW.org_id) THEN
+          RAISE EXCEPTION 'Terminal receipt search projection has no matching run';
+        END IF;
+        ref := gen_random_uuid();
+        INSERT INTO ${schema}.outbox (event_id, run_id, event_type, payload_json, created_at)
+        VALUES ('receipt:' || ref::text, NEW.run_id,
+          ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.receiptEvent},
+          jsonb_strip_nulls(jsonb_build_object(
+            'orgId', NEW.org_id, 'receiptRef', ref, 'receiptKey', NEW.k,
+            'status', NEW.status, 'occurredAt', NEW.updated_at,
+            'producerAttempt', NEW.lease_owner_attempt)),
+          GREATEST(clock_timestamp(), coalesce((SELECT max(created_at) + interval '1 microsecond'
+            FROM ${schema}.outbox WHERE run_id = NEW.run_id), clock_timestamp())));
+        RETURN NEW;
+      END IF;
       -- Serialize event ordering with the same per-run lock as outbox facts.
       PERFORM pg_advisory_xact_lock(hashtext(${quoteLiteral(scope)}), hashtext(NEW.run_id));
       SELECT play_name, run_event_store = 'planet_scale'
@@ -1001,7 +1185,19 @@ export async function attachRuntimeEventSearchTriggers(
         NEW.updated_at, NEW.run_id, play, 'receipt.' || NEW.status,
         ref, NEW.k, jsonb_strip_nulls(jsonb_build_object(
           'kind', 'receipt.' || NEW.status, 'status', NEW.status,
-          'source', 'receipt', 'producerAttempt', NEW.lease_owner_attempt
+          'source', 'receipt', 'producerAttempt', NEW.lease_owner_attempt,
+          -- Only the reserved runtime diagnostic record supplies this flat
+          -- context. Ordinary authored receipt outputs are never indexed.
+          'context', CASE WHEN NEW.k LIKE 'tool-evidence:%'
+            AND NEW.output_json->>'kind' = 'tool_call_evidence' THEN jsonb_strip_nulls(jsonb_build_object(
+              'callKey', NEW.output_json#>'{context,callKey}',
+              'toolId', NEW.output_json#>'{context,toolId}',
+              'callStatus', NEW.output_json#>'{context,callStatus}',
+              'stepId', NEW.output_json#>'{context,stepId}',
+              'dataset', NEW.output_json#>'{context,dataset}',
+              'column', NEW.output_json#>'{context,column}',
+              'rowKey', NEW.output_json#>'{context,rowKey}'
+            )) END
         ))
       );
       RETURN NEW;
@@ -1009,18 +1205,129 @@ export async function attachRuntimeEventSearchTriggers(
     $function$
   `);
   await client.query(`DO $create$ BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = '${schema}.runs'::regclass
+      AND tgname = 'runtime_run_log_identity') THEN
+      CREATE TRIGGER runtime_run_log_identity BEFORE INSERT ON ${schema}.runs
+        FOR EACH ROW EXECUTE FUNCTION ${schema}.pin_runtime_log_identity();
+    END IF;
     IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = '${schema}.receipts'::regclass
       AND tgname = 'runtime_receipt_event_v1') THEN
       CREATE TRIGGER runtime_receipt_event_v1 AFTER INSERT OR UPDATE ON ${schema}.receipts
         FOR EACH ROW EXECUTE FUNCTION ${schema}.search_receipt_event();
     END IF;
   END $create$`);
+  await client.query(`
+    CREATE OR REPLACE FUNCTION ${schema}.run_log_metadata(line text, metadata jsonb, fallback_at timestamptz) RETURNS jsonb
+    LANGUAGE plpgsql IMMUTABLE SET search_path = pg_catalog AS $function$
+    DECLARE clean text; message text; level text; at_time timestamptz := fallback_at;
+    BEGIN
+      clean := regexp_replace(line, '^' || chr(1) || 'prov:[^' || chr(1) || ']*' || chr(1), '');
+      IF metadata IS NOT NULL AND metadata <> 'null'::jsonb THEN
+        IF jsonb_typeof(metadata) IS DISTINCT FROM 'object'
+          OR NOT coalesce(metadata->>'level' IN ('debug','info','warn','error'), false)
+          OR jsonb_typeof(metadata->'occurredAt') IS DISTINCT FROM 'number'
+          OR NOT coalesce(metadata->>'occurredAt' ~ '^[1-9][0-9]{0,15}$', false)
+          OR (metadata ? 'stepId' AND (jsonb_typeof(metadata->'stepId') IS DISTINCT FROM 'string'
+            OR length(metadata->>'stepId') NOT BETWEEN 1 AND 256)) THEN
+          RAISE EXCEPTION 'Run log metadata is invalid';
+        END IF;
+        RETURN jsonb_strip_nulls(jsonb_build_object('level', metadata->'level',
+          'occurredAt', metadata->'occurredAt', 'stepId', metadata->'stepId'));
+      END IF;
+      -- Historical lines already carry the original ISO time and severity.
+      IF clean ~ '^\\[[-0-9]{10}T[0-9:.]+Z\\]' THEN
+        BEGIN at_time := substring(clean from '^\\[([^]]+)\\]')::timestamptz;
+        EXCEPTION WHEN invalid_datetime_format OR datetime_field_overflow THEN at_time := fallback_at; END;
+      END IF;
+      message := regexp_replace(clean, '^\\[[-0-9]{10}T[0-9:.]+Z\\][ ]*', '');
+      level := CASE
+        WHEN message ~* '^\\[(error|console.error)\\]' THEN 'error'
+        WHEN message ~* '^\\[(warn|console.warn)\\]' THEN 'warn'
+        WHEN message ~* '^\\[info\\]' THEN 'info'
+        WHEN message ~* '^\\[(debug|console.debug|perf|runtime.(phase_summary|logs|log_transport))\\]'
+          OR line ~ ('^' || chr(1) || 'prov:(infra|receipt|replay)' || chr(1)) THEN 'debug'
+        ELSE 'info' END;
+      RETURN jsonb_build_object('level', level, 'occurredAt', floor(extract(epoch FROM at_time) * 1000)::bigint);
+    END
+    $function$
+  `);
+  await client.query(`
+    CREATE OR REPLACE FUNCTION ${schema}.project_origin_log_batch(observation ${schema}.outbox, item jsonb, run_org text, play text, compact_logs boolean, canonical_events boolean, at_time timestamptz, doc jsonb, closed boolean)
+    RETURNS text[] LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
+    DECLARE fresh text[]; mismatches bigint;
+    BEGIN
+      IF jsonb_typeof(item->'lineIds') IS DISTINCT FROM 'array'
+        OR jsonb_array_length(item->'lineIds') <> jsonb_array_length(item->'lines')
+        OR EXISTS (SELECT 1 FROM jsonb_array_elements(item->'lineIds') id WHERE jsonb_typeof(id) <> 'string' OR (id #>> '{}') !~ '^[A-Za-z0-9:_-]{1,128}$')
+        OR (SELECT count(DISTINCT id) FROM jsonb_array_elements(item->'lineIds') id) <> jsonb_array_length(item->'lineIds') THEN
+        RAISE EXCEPTION 'Origin log identities must be distinct bounded strings aligned with lines';
+      END IF;
+      IF EXISTS (SELECT 1 FROM jsonb_array_elements(item->'lines') line WHERE jsonb_typeof(line) <> 'string') THEN
+        RAISE EXCEPTION 'Search projection requires log line strings';
+      END IF;
+      IF item ? 'lineContexts' AND EXISTS (
+        SELECT 1 FROM jsonb_array_elements(item->'lineContexts') ctx
+        WHERE jsonb_typeof(ctx) NOT IN ('object', 'null')
+      ) THEN RAISE EXCEPTION 'Search projection log context must be an object'; END IF;
+      IF item ? 'lineContexts' AND EXISTS (
+        SELECT 1 FROM jsonb_array_elements(item->'lineContexts') ctx
+        WHERE jsonb_typeof(ctx) = 'object' AND (
+          (SELECT count(*) FROM jsonb_object_keys(ctx)) > 8 OR octet_length(ctx::text) > 2064
+          OR EXISTS (SELECT 1 FROM jsonb_each(ctx) field WHERE
+            field.key !~ '^[A-Za-z_][A-Za-z0-9_]{0,63}$' OR field.key IN ('__proto__', 'constructor', 'prototype')
+            OR jsonb_typeof(field.value) NOT IN ('string', 'number', 'boolean')
+            OR (jsonb_typeof(field.value) = 'string' AND octet_length(field.value #>> '{}') > 256)
+            OR (jsonb_typeof(field.value) = 'number' AND octet_length(field.value #>> '{}') > 32))
+        )
+      ) THEN RAISE EXCEPTION 'Search projection log context has an unsupported key or value'; END IF;
+      WITH entries AS MATERIALIZED (
+        SELECT value #>> '{}' AS body, ordinality AS ordinal,
+          'log-origin:' || observation.run_id || ':' || (item->'lineIds'->>(ordinality-1)::int) AS eid,
+          NULLIF(item->'lineContexts'->(ordinality-1)::int, 'null'::jsonb) AS ctx,
+          ${schema}.run_log_metadata(value #>> '{}', item->'lineMetadata'->(ordinality-1)::int, at_time) AS metadata
+        FROM jsonb_array_elements(item->'lines') WITH ORDINALITY
+      ), inserted AS (
+        INSERT INTO runtime_observability.events (
+          runtime_scope, org_id, event_id, event_seq, event_payload, occurred_at,
+          run_id, play_name, kind, level, message, log_body, source_digest, log_text_digest, search_doc
+        ) SELECT ${quoteLiteral(scope)}, run_org, eid,
+          CASE WHEN canonical_events THEN nextval('runtime_observability.runtime_event_order_seq') END,
+          CASE WHEN canonical_events THEN jsonb_strip_nulls((item - 'lines' - 'lineContexts' - 'lineIds' - 'lineMetadata') || jsonb_build_object(
+            'type', ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}, 'runId', observation.run_id,
+            'occurredAt', metadata->'occurredAt', 'level', metadata->'level', 'stepId', metadata->'stepId', 'lineOrdinal', ordinal,
+            'entryId', item->'lineIds'->(ordinal-1)::int, 'context', ctx)) END,
+          to_timestamp((metadata->>'occurredAt')::double precision / 1000), observation.run_id, play, ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}, metadata->>'level',
+          CASE WHEN compact_logs THEN NULL ELSE left(body, 2048) END, body,
+          CASE WHEN ctx IS NULL THEN encode(sha256(convert_to(body,'UTF8')),'hex')
+            ELSE encode(sha256(convert_to(jsonb_build_array(body,ctx)::text,'UTF8')),'hex') END,
+          encode(sha256(convert_to(btrim(body),'UTF8')),'hex'),
+          doc || (metadata - 'occurredAt') || jsonb_strip_nulls(jsonb_build_object('entryId', item->'lineIds'->(ordinal-1)::int, 'context', ctx))
+        FROM entries WHERE NOT closed ORDER BY ordinal
+        ON CONFLICT (runtime_scope, org_id, event_id) DO NOTHING RETURNING event_id
+      ) SELECT coalesce(array_agg(inserted.event_id ORDER BY entries.ordinal), ARRAY[]::text[])
+        INTO fresh FROM inserted JOIN entries ON entries.eid = inserted.event_id;
+      -- A new READ COMMITTED statement sees a concurrent uniqueness winner.
+      -- Tombstones retain digest/identity: retry never restores an expired body.
+      SELECT count(*) INTO mismatches
+      FROM jsonb_array_elements(item->'lines') WITH ORDINALITY AS entries(body, ordinal)
+      LEFT JOIN runtime_observability.events event ON event.runtime_scope = ${quoteLiteral(scope)} AND event.org_id = run_org
+        AND event.event_id = 'log-origin:' || observation.run_id || ':' || (item->'lineIds'->>(ordinal-1)::int)
+      WHERE event.run_id IS DISTINCT FROM observation.run_id OR event.kind IS DISTINCT FROM ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
+        OR event.source_digest IS DISTINCT FROM CASE WHEN NULLIF(item->'lineContexts'->(ordinal-1)::int, 'null'::jsonb) IS NULL
+          THEN encode(sha256(convert_to(body #>> '{}','UTF8')),'hex')
+          ELSE encode(sha256(convert_to(jsonb_build_array(body #>> '{}',item->'lineContexts'->(ordinal-1)::int)::text,'UTF8')),'hex') END;
+      IF mismatches > 0 THEN
+        RAISE EXCEPTION 'Origin log identity changed its content or ingress is closed after terminal acceptance';
+      END IF;
+      RETURN fresh;
+    END $function$
+  `);
   await client.query(`
     CREATE OR REPLACE FUNCTION ${schema}.project_outbox_event(observation ${schema}.outbox) RETURNS void
     LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
     DECLARE run_org text; play text; compact_logs boolean; canonical_events boolean; run_status text; item jsonb; line jsonb; event_batch jsonb;
             ordinal bigint; line_ordinal bigint; kind text; at_time timestamptz;
-            doc jsonb; line_doc jsonb; line_context jsonb;
+            doc jsonb; line_doc jsonb; line_context jsonb; line_metadata jsonb; line_at timestamptz;
             eid text; existing_digest text; digest text; assigned_seq bigint; terminal_progress_identity boolean;
             log_channel text; log_position bigint; matched_event_id text; matched_doc jsonb;
             legacy_position_prefix text; position_event_ids text[];
@@ -1033,7 +1340,11 @@ export async function attachRuntimeEventSearchTriggers(
       -- Log ordering owns a transaction-scoped mutex, independent of the
       -- scheduler's Run/attempt row-lock order. In particular, old completion
       -- writers lock attempt before Run; this recorder must not invert that.
-      PERFORM pg_advisory_xact_lock(hashtext(${quoteLiteral(scope)}), hashtext(observation.run_id));
+      -- Stable batches are ordered by the leased background prefix and cursor row.
+      -- The legacy alias path still needs its old transaction mutex.
+      IF NOT ${schema}.defer_runtime_event_projection() THEN
+        PERFORM pg_advisory_xact_lock(hashtext(${quoteLiteral(scope)}), hashtext(observation.run_id));
+      END IF;
       SELECT org_id, play_name, run_log_store = 'planet_scale', status,
              run_event_store = 'planet_scale'
         INTO run_org, play, compact_logs, run_status, canonical_events
@@ -1041,6 +1352,35 @@ export async function attachRuntimeEventSearchTriggers(
       IF run_org IS NULL OR play IS NULL THEN
         RAISE EXCEPTION 'Outbox search projection has no matching run';
       END IF;
+      IF observation.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.receiptEvent} THEN
+        IF observation.payload_json->>'orgId' IS DISTINCT FROM run_org
+          OR NOT coalesce(observation.payload_json->>'status' IN ('completed', 'failed', 'skipped'), false)
+          OR nullif(observation.payload_json->>'receiptKey', '') IS NULL
+          OR observation.payload_json->>'receiptRef' IS NULL
+          OR observation.payload_json->>'occurredAt' IS NULL THEN
+          RAISE EXCEPTION 'Deferred receipt event has invalid identity or status';
+        END IF;
+        INSERT INTO runtime_observability.events (
+          runtime_scope, org_id, event_id, event_seq, event_payload,
+          occurred_at, run_id, play_name, kind, receipt_ref, receipt_key, search_doc
+        ) VALUES (
+          ${quoteLiteral(scope)}, run_org, observation.event_id,
+          CASE WHEN canonical_events THEN nextval('runtime_observability.runtime_event_order_seq') END,
+          CASE WHEN canonical_events THEN jsonb_build_object(
+            'type', 'receipt.' || (observation.payload_json->>'status'), 'runId', observation.run_id,
+            'occurredAt', floor(extract(epoch FROM (observation.payload_json->>'occurredAt')::timestamptz) * 1000)::bigint,
+            'source', 'receipt', 'status', observation.payload_json->>'status') END,
+          (observation.payload_json->>'occurredAt')::timestamptz,
+          observation.run_id, play, 'receipt.' || (observation.payload_json->>'status'),
+          (observation.payload_json->>'receiptRef')::uuid,
+          observation.payload_json->>'receiptKey',
+          jsonb_strip_nulls(jsonb_build_object(
+            'kind', 'receipt.' || (observation.payload_json->>'status'),
+            'status', observation.payload_json->>'status', 'source', 'receipt',
+            'producerAttempt', observation.payload_json->'producerAttempt'))
+        ) ON CONFLICT DO NOTHING;
+        RETURN;
+      END IF;
       IF observation.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents} THEN
         event_batch := observation.payload_json->'events';
         IF jsonb_typeof(event_batch) IS DISTINCT FROM 'array' THEN
@@ -1071,7 +1411,9 @@ export async function attachRuntimeEventSearchTriggers(
             'type', ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}, 'runId', observation.run_id, 'source', 'terminal',
             'producerAttempt', envelope_attempt, 'channelOffset', 0,
             'lines', observation.payload_json->'terminalLogLines',
-            'lineContexts', observation.payload_json->'terminalLogContexts'
+            'lineContexts', observation.payload_json->'terminalLogContexts',
+            'lineMetadata', observation.payload_json->'terminalLogMetadata',
+            'lineIds', NULLIF(observation.payload_json->'terminalLogIds', 'null'::jsonb)
           ))
         );
       END IF;
@@ -1117,11 +1459,14 @@ export async function attachRuntimeEventSearchTriggers(
         ));
       END IF;
       IF event_batch IS NOT NULL THEN
+        IF ${schema}.defer_runtime_event_projection() AND EXISTS (SELECT 1 FROM jsonb_array_elements(event_batch) entry WHERE entry->>'type' = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended} AND (NOT (entry ? 'lineIds') OR jsonb_typeof(entry->'lineIds') IS DISTINCT FROM 'array' OR EXISTS (SELECT 1 FROM jsonb_array_elements(CASE WHEN jsonb_typeof(entry->'lineIds') = 'array' THEN entry->'lineIds' ELSE '[]'::jsonb END) id WHERE id = 'null'::jsonb))) THEN
+          PERFORM pg_advisory_xact_lock(hashtext(${quoteLiteral(scope)}), hashtext(observation.run_id));
+        END IF;
         -- Normalize old positional writers once per batch under the run mutex.
         -- Per-line lookups must remain digest-selective: an OR fallback for
         -- unmarked rows otherwise scans the whole attempt for every new line.
         IF EXISTS (SELECT 1 FROM jsonb_array_elements(event_batch) AS entry
-          WHERE entry->>'type' = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}) THEN
+          WHERE entry->>'type' = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended} AND (NOT (entry ? 'lineIds') OR EXISTS (SELECT 1 FROM jsonb_array_elements(CASE WHEN jsonb_typeof(entry->'lineIds') = 'array' THEN entry->'lineIds' ELSE '[]'::jsonb END) id WHERE id = 'null'::jsonb))) THEN
           UPDATE runtime_observability.events AS event SET search_doc = event.search_doc ||
             jsonb_build_object('logContentDigest', event.source_digest) ||
             CASE WHEN NOT (event.search_doc ? 'logPositions')
@@ -1134,7 +1479,7 @@ export async function attachRuntimeEventSearchTriggers(
               ELSE '{}'::jsonb END
            WHERE event.runtime_scope = ${quoteLiteral(scope)} AND event.org_id = run_org
              AND event.run_id = observation.run_id AND event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
-             AND event.source_digest IS NOT NULL AND NOT (event.search_doc ? 'logContentDigest')
+             AND event.source_digest IS NOT NULL AND NOT (event.search_doc ? 'logContentDigest') AND NOT (event.search_doc ? 'entryId')
              AND (event.search_doc->>'producerAttempt') ~ '^[1-9][0-9]{0,5}$';
         END IF;
         FOR item, ordinal IN SELECT value, ordinality FROM jsonb_array_elements(event_batch) WITH ORDINALITY LOOP
@@ -1172,12 +1517,28 @@ export async function attachRuntimeEventSearchTriggers(
                  OR jsonb_array_length(item->'lineContexts') <> jsonb_array_length(item->'lines')) THEN
             RAISE EXCEPTION 'Search projection requires lineContexts aligned to log lines';
           END IF;
+          IF kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended} AND item ? 'lineMetadata'
+            AND (jsonb_typeof(item->'lineMetadata') IS DISTINCT FROM 'array'
+              OR jsonb_array_length(item->'lineMetadata') <> jsonb_array_length(item->'lines')) THEN
+            RAISE EXCEPTION 'Run log metadata must align with lines';
+          END IF;
+          IF kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended} AND item ? 'lineIds' THEN
+            IF jsonb_typeof(item->'lineIds') IS DISTINCT FROM 'array' OR jsonb_array_length(item->'lineIds') <> jsonb_array_length(item->'lines') THEN
+              RAISE EXCEPTION 'Origin log identities must align with lines';
+            END IF;
+            IF EXISTS (SELECT 1 FROM jsonb_array_elements(item->'lineIds') id WHERE id <> 'null'::jsonb AND (jsonb_typeof(id) <> 'string' OR (id #>> '{}') !~ '^[A-Za-z0-9:_-]{1,128}$')) OR (SELECT count(id) FROM jsonb_array_elements(item->'lineIds') id WHERE id <> 'null'::jsonb) <> (SELECT count(DISTINCT id) FROM jsonb_array_elements(item->'lineIds') id WHERE id <> 'null'::jsonb) THEN RAISE EXCEPTION 'Origin log identities must be distinct bounded strings'; END IF;
+            IF NOT EXISTS (SELECT 1 FROM jsonb_array_elements(item->'lineIds') id WHERE id = 'null'::jsonb) THEN
+              fresh_event_ids := fresh_event_ids || ${schema}.project_origin_log_batch(observation, item, run_org, play, compact_logs, canonical_events, at_time, doc,
+                compact_logs AND observation.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents} AND coalesce((observation.payload_json->>'_runtimeSearchRunClosed')::boolean, run_status IN ('completed','failed','cancelled')));
+              CONTINUE;
+            END IF;
+          END IF;
           IF kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended} THEN
             FOR line, line_ordinal IN SELECT value, ordinality FROM jsonb_array_elements(item->'lines') WITH ORDINALITY LOOP
               IF jsonb_typeof(line) IS DISTINCT FROM 'string' THEN
                 RAISE EXCEPTION 'Search projection requires log line strings';
               END IF;
-              IF (item->>'source' IS DISTINCT FROM 'coordinator')
+              IF NULLIF(item->'lineIds'->((line_ordinal-1)::int), 'null'::jsonb) IS NULL AND (item->>'source' IS DISTINCT FROM 'coordinator')
                 AND NOT coalesce((item->>'channelOffset') ~ '^[0-9]{1,12}$', false) THEN
                 IF NOT recent_log_keys_loaded OR recent_log_attempt IS DISTINCT FROM item->>'producerAttempt' THEN
                   SELECT coalesce(jsonb_object_agg(recent.dedupe_key, true), '{}'::jsonb)
@@ -1187,6 +1548,7 @@ export async function attachRuntimeEventSearchTriggers(
                         FROM runtime_observability.events AS event
                        WHERE event.runtime_scope = ${quoteLiteral(scope)} AND event.org_id = run_org
                          AND event.run_id = observation.run_id AND event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
+                         AND NOT (event.search_doc ? 'entryId')
                          AND event.log_seq IS NOT NULL AND (event.log_text_digest IS NOT NULL OR event.log_body IS NOT NULL)
                          AND (item->>'producerAttempt' IS NULL
                            OR event.search_doc->>'producerAttempt' = item->>'producerAttempt')
@@ -1231,8 +1593,10 @@ export async function attachRuntimeEventSearchTriggers(
                   RAISE EXCEPTION 'Search projection log context has an unsupported key or value';
                 END IF;
               END IF;
-              line_doc := CASE WHEN line_context IS NULL THEN doc
-                ELSE doc || jsonb_build_object('context', line_context) END;
+              line_metadata := ${schema}.run_log_metadata(line #>> '{}', item->'lineMetadata'->((line_ordinal - 1)::int), at_time);
+              line_at := to_timestamp((line_metadata->>'occurredAt')::double precision / 1000);
+              line_doc := (CASE WHEN line_context IS NULL THEN doc
+                ELSE doc || jsonb_build_object('context', line_context) END) || (line_metadata - 'occurredAt');
               eid := CASE WHEN (item->>'channelOffset') ~ '^[0-9]{1,12}$'
                 AND (item->>'producerAttempt') ~ '^[0-9]{1,6}$'
                 THEN 'log:' || observation.run_id || ':' || (item->>'producerAttempt') || ':' ||
@@ -1241,7 +1605,11 @@ export async function attachRuntimeEventSearchTriggers(
               digest := CASE WHEN line_context IS NULL
                 THEN encode(sha256(convert_to(line #>> '{}', 'UTF8')), 'hex')
                 ELSE encode(sha256(convert_to(jsonb_build_array(line #>> '{}', line_context)::text, 'UTF8')), 'hex') END;
-              IF (item->>'channelOffset') ~ '^[0-9]{1,12}$'
+              IF NULLIF(item->'lineIds'->((line_ordinal-1)::int), 'null'::jsonb) IS NOT NULL THEN
+                IF jsonb_typeof(item->'lineIds'->((line_ordinal-1)::int)) <> 'string' OR (item->'lineIds'->>((line_ordinal-1)::int)) !~ '^[A-Za-z0-9:_-]{1,128}$' THEN RAISE EXCEPTION 'Origin log identity must be a bounded string'; END IF;
+                eid := 'log-origin:' || observation.run_id || ':' || (item->'lineIds'->>((line_ordinal-1)::int));
+                line_doc := line_doc || jsonb_build_object('entryId', item->'lineIds'->((line_ordinal-1)::int));
+              ELSIF (item->>'channelOffset') ~ '^[0-9]{1,12}$'
                 AND (item->>'producerAttempt') ~ '^[1-9][0-9]{0,5}$' THEN
                 -- These transports retain different buffers. Their offsets
                 -- are immutable within a channel, never interchangeable.
@@ -1340,7 +1708,7 @@ export async function attachRuntimeEventSearchTriggers(
                    AND event.run_id = observation.run_id AND event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
                    AND event.source_digest IS NOT NULL
                    AND event.search_doc ? 'producerAttempt'
-                   AND event.search_doc ? 'logContentDigest'
+                   AND event.search_doc ? 'logContentDigest' AND NOT (event.search_doc ? 'entryId')
                    AND event.search_doc->>'producerAttempt' = ((item->>'producerAttempt')::integer)::text
                    AND event.source_digest = digest
                    AND event.search_doc @> jsonb_build_object('logContentDigest', digest)
@@ -1361,7 +1729,8 @@ export async function attachRuntimeEventSearchTriggers(
               -- retry of an accepted position is harmless; a new position
               -- after terminal closure must never recreate expired history.
               IF compact_logs AND observation.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents}
-                AND run_status IN ('completed', 'failed', 'cancelled')
+                AND coalesce((observation.payload_json->>'_runtimeSearchRunClosed')::boolean,
+                  run_status IN ('completed', 'failed', 'cancelled'))
                 AND NOT EXISTS (SELECT 1 FROM runtime_observability.events
                   WHERE runtime_scope = ${quoteLiteral(scope)} AND org_id = run_org
                     AND event_id = eid) THEN
@@ -1375,14 +1744,14 @@ export async function attachRuntimeEventSearchTriggers(
                 ${quoteLiteral(scope)}, run_org, eid,
                 CASE WHEN canonical_events THEN nextval('runtime_observability.runtime_event_order_seq') END,
                 CASE WHEN canonical_events THEN jsonb_strip_nulls(
-                  (item - 'lines' - 'lineContexts') || jsonb_build_object(
+                  (item - 'lines' - 'lineContexts' - 'lineMetadata' - 'lineIds') || jsonb_build_object(
                     'type', ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}, 'runId', observation.run_id,
-                    'occurredAt', floor(extract(epoch FROM at_time) * 1000)::bigint,
+                    'occurredAt', line_metadata->'occurredAt', 'level', line_metadata->'level', 'stepId', line_metadata->'stepId',
                     'lineOrdinal', line_ordinal,
                     'context', line_context
                   )) END,
-                at_time, observation.run_id, play,
-                ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}, NULL, CASE WHEN compact_logs THEN NULL ELSE left(line #>> '{}', 2048) END,
+                line_at, observation.run_id, play,
+                ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}, line_metadata->>'level', CASE WHEN compact_logs THEN NULL ELSE left(line #>> '{}', 2048) END,
                 line #>> '{}', digest,
                 encode(sha256(convert_to(btrim(line #>> '{}'), 'UTF8')), 'hex'), line_doc
               ) ON CONFLICT DO NOTHING;
@@ -1462,6 +1831,15 @@ export async function attachRuntimeEventSearchTriggers(
           AND NOT (observation.payload_json ? 'terminalLogLines') THEN
           RAISE EXCEPTION 'Search projection requires terminalLogLines for terminalLogContexts';
         END IF;
+        IF observation.payload_json ? 'terminalLogMetadata'
+          AND NOT (observation.payload_json ? 'terminalLogLines') THEN
+          RAISE EXCEPTION 'Search projection requires terminalLogLines for terminalLogMetadata';
+        END IF;
+        IF observation.payload_json ? 'terminalLogMetadata'
+          AND (jsonb_typeof(observation.payload_json->'terminalLogMetadata') IS DISTINCT FROM 'array'
+            OR jsonb_array_length(observation.payload_json->'terminalLogMetadata') <> jsonb_array_length(observation.payload_json->'terminalLogLines')) THEN
+          RAISE EXCEPTION 'Search projection requires terminalLogMetadata aligned to terminalLogLines';
+        END IF;
         IF observation.event_type IN (${RUN_EVENT_TERMINAL_LOG_CARRIER_SQL_LIST})
           AND observation.payload_json ? 'terminalLogLines'
           AND NOT coalesce((envelope_attempt #>> '{}') ~ '^[1-9][0-9]{0,5}$', false) THEN
@@ -1494,6 +1872,7 @@ export async function attachRuntimeEventSearchTriggers(
                          AND event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
                          AND (observation.payload_json->>'producerAttempt' IS NULL
                            OR event.search_doc->>'producerAttempt' = observation.payload_json->>'producerAttempt')
+                         AND NOT (event.search_doc ? 'entryId')
                          AND event.log_seq IS NOT NULL AND (event.log_text_digest IS NOT NULL OR event.log_body IS NOT NULL)
                        ORDER BY event.log_seq DESC
                        LIMIT 256
@@ -1503,7 +1882,7 @@ export async function attachRuntimeEventSearchTriggers(
                     FROM runtime_observability.events AS event
                    WHERE event.runtime_scope = ${quoteLiteral(scope)}
                      AND event.org_id = run_org AND event.run_id = observation.run_id
-                     AND event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended} AND (event.log_text_digest IS NOT NULL OR event.log_body IS NOT NULL)
+                     AND event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended} AND NOT (event.search_doc ? 'entryId') AND (event.log_text_digest IS NOT NULL OR event.log_body IS NOT NULL)
                      AND event.event_id = ANY(fresh_event_ids)
                      AND (observation.payload_json->>'producerAttempt' IS NULL
                        OR event.search_doc->>'producerAttempt' = observation.payload_json->>'producerAttempt')
@@ -1553,7 +1932,9 @@ export async function attachRuntimeEventSearchTriggers(
                 RAISE EXCEPTION 'Search projection terminal log context has an unsupported key or value';
               END IF;
             END IF;
-            line_doc := jsonb_strip_nulls(jsonb_build_object(
+            line_metadata := ${schema}.run_log_metadata(line #>> '{}', observation.payload_json->'terminalLogMetadata'->((line_ordinal - 1)::int), observation.created_at);
+            line_at := to_timestamp((line_metadata->>'occurredAt')::double precision / 1000);
+            line_doc := (line_metadata - 'occurredAt') || jsonb_strip_nulls(jsonb_build_object(
               'kind', ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}, 'source', 'terminal',
               'producerAttempt', observation.payload_json->'producerAttempt'
             ));
@@ -1569,11 +1950,11 @@ export async function attachRuntimeEventSearchTriggers(
               CASE WHEN canonical_events THEN nextval('runtime_observability.runtime_event_order_seq') END,
               CASE WHEN canonical_events THEN jsonb_strip_nulls(jsonb_build_object(
                 'type', ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}, 'runId', observation.run_id,
-                'occurredAt', floor(extract(epoch FROM observation.created_at) * 1000)::bigint,
+                'occurredAt', line_metadata->'occurredAt', 'level', line_metadata->'level', 'stepId', line_metadata->'stepId',
                 'source', 'terminal', 'producerAttempt', observation.payload_json->'producerAttempt',
                 'lineOrdinal', line_ordinal, 'context', line_context
               )) END,
-              observation.created_at, observation.run_id, play, ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}, NULL,
+              line_at, observation.run_id, play, ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}, line_metadata->>'level',
               CASE WHEN compact_logs THEN NULL ELSE left(regexp_replace(line #>> '{}',
                 '^' || chr(1) || 'prov:[^' || chr(1) || ']*' || chr(1), ''), 2048) END,
               line #>> '{}',
@@ -1720,7 +2101,7 @@ export async function attachRuntimeEventSearchTriggers(
     LANGUAGE sql IMMUTABLE SET search_path = pg_catalog AS $function$
       WITH envelope AS (
         SELECT CASE WHEN jsonb_typeof(value) = 'object' THEN
-          (value - 'logContexts') || CASE WHEN value ? 'logs'
+          (value - 'logContexts' - 'logMetadata' - 'logIds') || CASE WHEN value ? 'logs'
             THEN jsonb_build_object('logs', '[]'::jsonb) ELSE '{}'::jsonb END
           ELSE value END AS result
       )
@@ -1730,50 +2111,150 @@ export async function attachRuntimeEventSearchTriggers(
     $function$
   `);
   await client.query(`
-    CREATE OR REPLACE FUNCTION ${schema}.search_outbox_event() RETURNS trigger
+    CREATE OR REPLACE FUNCTION ${schema}.compact_runtime_outbox_payload(observation ${schema}.outbox) RETURNS jsonb
     LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
     DECLARE compact_logs boolean; canonical_events boolean;
     BEGIN
-      -- Project the original validated observation before replacing its
-      -- transport body. Failure rolls back the outbox and canonical rows.
-      PERFORM ${schema}.project_outbox_event(NEW);
       SELECT run_log_store = 'planet_scale', run_event_store = 'planet_scale'
         INTO compact_logs, canonical_events
-        FROM ${schema}.runs WHERE run_id = NEW.run_id;
+        FROM ${schema}.runs WHERE run_id = observation.run_id;
       IF compact_logs OR canonical_events THEN
-        NEW.payload_json := NEW.payload_json - 'terminalLogLines' - 'terminalLogContexts';
-        IF NEW.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents} THEN
-          NEW.payload_json := jsonb_set(NEW.payload_json, '{events}',
-            ${schema}.without_log_events(NEW.payload_json->'events'))
+        observation.payload_json := observation.payload_json - 'terminalLogLines' - 'terminalLogContexts' - 'terminalLogIds' - 'terminalLogMetadata';
+        IF observation.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents} THEN
+          observation.payload_json := jsonb_set(observation.payload_json, '{events}',
+            ${schema}.without_log_events(observation.payload_json->'events'))
             || jsonb_build_object('logBodyStore', 'planet_scale');
         END IF;
-        IF NEW.payload_json ? 'terminalProgressEvents' THEN
-          NEW.payload_json := jsonb_set(NEW.payload_json, '{terminalProgressEvents}',
-            ${schema}.without_log_events(NEW.payload_json->'terminalProgressEvents'));
+        IF observation.payload_json ? 'terminalProgressEvents' THEN
+          observation.payload_json := jsonb_set(observation.payload_json, '{terminalProgressEvents}',
+            ${schema}.without_log_events(observation.payload_json->'terminalProgressEvents'));
         END IF;
-        IF NEW.event_type = ${RUN_EVENT_KIND_SQL_LITERAL.runFailed} AND NEW.payload_json ? 'result' THEN
-          NEW.payload_json := jsonb_set(NEW.payload_json, '{result}',
-            ${schema}.compact_runner_log_envelope(NEW.payload_json->'result'));
+        IF observation.event_type = ${RUN_EVENT_KIND_SQL_LITERAL.runFailed} AND observation.payload_json ? 'result' THEN
+          observation.payload_json := jsonb_set(observation.payload_json, '{result}',
+            ${schema}.compact_runner_log_envelope(observation.payload_json->'result'));
         END IF;
-        IF NEW.event_type = ${RUN_EVENT_KIND_SQL_LITERAL.runCompleted} AND NEW.payload_json ? 'output' THEN
-          NEW.payload_json := jsonb_set(NEW.payload_json, '{output}',
-            ${schema}.without_runtime_log_tail(NEW.payload_json->'output'));
+        IF observation.event_type = ${RUN_EVENT_KIND_SQL_LITERAL.runCompleted} AND observation.payload_json ? 'output' THEN
+          observation.payload_json := jsonb_set(observation.payload_json, '{output}',
+            ${schema}.without_runtime_log_tail(observation.payload_json->'output'));
         END IF;
       END IF;
       IF canonical_events THEN
+        IF observation.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents} THEN
+          observation.payload_json := jsonb_set(observation.payload_json, '{events}',
+            ${schema}.convex_projection_events(observation.payload_json->'events'));
+        END IF;
+        IF observation.payload_json ? 'terminalProgressEvents' THEN
+          observation.payload_json := jsonb_set(observation.payload_json, '{terminalProgressEvents}',
+            ${schema}.convex_projection_events(observation.payload_json->'terminalProgressEvents'));
+        END IF;
+      END IF;
+      RETURN observation.payload_json - '${RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD}' - '_runtimeSearchRunClosed';
+    END
+    $function$
+  `);
+  await client.query(`
+    CREATE OR REPLACE FUNCTION ${schema}.search_outbox_event() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
+    DECLARE run_closed boolean; search_payload jsonb;
+    BEGIN
+      IF NEW.payload_json->'${RUNTIME_EVENT_SEARCH_ONLY_FIELD}' = 'true'::jsonb THEN RETURN NEW; END IF;
+      IF ${schema}.defer_runtime_event_projection()
+        AND NEW.event_type <> ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runCreated} THEN
         IF NEW.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents} THEN
-          NEW.payload_json := jsonb_set(NEW.payload_json, '{events}',
-            ${schema}.convex_projection_events(NEW.payload_json->'events'));
+          -- One cheap Run fence captures whether ingress preceded terminal
+          -- closure. No indexed log lookup or search mutex runs under it.
+          SELECT status IN ('completed', 'failed', 'cancelled') INTO run_closed
+            FROM ${schema}.runs WHERE run_id = NEW.run_id FOR SHARE;
+          NEW.created_at := GREATEST(NEW.created_at, clock_timestamp(),
+            coalesce((SELECT max(created_at) + interval '1 microsecond'
+              FROM ${schema}.outbox WHERE run_id = NEW.run_id), clock_timestamp()));
+        ELSE
+          SELECT status IN ('completed', 'failed', 'cancelled') INTO run_closed
+            FROM ${schema}.runs WHERE run_id = NEW.run_id;
         END IF;
-        IF NEW.payload_json ? 'terminalProgressEvents' THEN
-          NEW.payload_json := jsonb_set(NEW.payload_json, '{terminalProgressEvents}',
-            ${schema}.convex_projection_events(NEW.payload_json->'terminalProgressEvents'));
+        NEW.payload_json := NEW.payload_json || jsonb_build_object(
+          '${RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD}', true,
+          '_runtimeSearchRunClosed', coalesce(run_closed, false));
+        IF ${schema}.independent_runtime_event_projection() THEN
+          IF NEW.event_type IN (${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.receiptEvent}, ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runnerLogs}) OR (NEW.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents} AND jsonb_typeof(NEW.payload_json->'events') = 'array' AND NOT EXISTS (SELECT 1 FROM jsonb_array_elements(NEW.payload_json->'events') item WHERE item->>'type' IS DISTINCT FROM ${RUN_EVENT_KIND_SQL_LITERAL.logAppended})) THEN
+            NEW.payload_json := NEW.payload_json || jsonb_build_object('${RUNTIME_EVENT_SEARCH_ONLY_FIELD}', true);
+          ELSE
+            search_payload := NEW.payload_json || jsonb_build_object('${RUNTIME_EVENT_SEARCH_ONLY_FIELD}', true, '_runtimeSearchEventId', NEW.event_id);
+            INSERT INTO ${schema}.outbox(event_id, run_id, event_type, payload_json, created_at)
+              VALUES ('search:' || NEW.event_id, NEW.run_id, NEW.event_type, search_payload, NEW.created_at)
+              ON CONFLICT (event_id) DO NOTHING;
+            NEW.payload_json := ${schema}.compact_runtime_outbox_payload(NEW);
+          END IF;
         END IF;
+        RETURN NEW;
+      END IF;
+      -- Legacy writers retain their atomic projection until explicit cutover.
+      NEW.payload_json := NEW.payload_json - '${RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD}' - '_runtimeSearchRunClosed';
+      PERFORM ${schema}.project_outbox_event(NEW);
+      NEW.payload_json := ${schema}.compact_runtime_outbox_payload(NEW);
+      -- The search rows above are committed atomically with this outbox row.
+      -- When compaction leaves no ledger event to project, settle the no-op
+      -- receipt here so a delayed log-search fact cannot hold up run terminal
+      -- projection behind the scheduler outbox.
+      IF NEW.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents}
+        AND NEW.payload_json->>'logBodyStore' = 'planet_scale'
+        AND jsonb_typeof(NEW.payload_json->'events') = 'array'
+        AND jsonb_array_length(NEW.payload_json->'events') = 0 THEN
+        NEW.delivered_at := coalesce(NEW.delivered_at, clock_timestamp());
       END IF;
       RETURN NEW;
     END
     $function$
   `);
+  await client.query(`
+    CREATE OR REPLACE FUNCTION ${schema}.guard_runtime_outbox_ack() RETURNS trigger
+    LANGUAGE plpgsql SET search_path = pg_catalog AS $function$
+    BEGIN
+      IF OLD.delivered_at IS NULL AND NEW.delivered_at IS NOT NULL
+        AND OLD.payload_json->'${RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD}' = 'true'::jsonb THEN
+        RAISE EXCEPTION 'Deferred outbox input must be projected before acknowledgement' USING ERRCODE = '55000';
+      END IF;
+      RETURN NEW;
+    END
+    $function$
+  `);
+  await client.query(`DO $create$ BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = '${schema}.outbox'::regclass
+      AND tgname = 'runtime_outbox_projection_ack_v1') THEN
+      CREATE TRIGGER runtime_outbox_projection_ack_v1 BEFORE UPDATE OF delivered_at ON ${schema}.outbox
+        FOR EACH ROW EXECUTE FUNCTION ${schema}.guard_runtime_outbox_ack();
+    END IF;
+  END $create$`);
+  await client.query(`
+    CREATE OR REPLACE FUNCTION ${schema}.materialize_runtime_outbox_event(eid text, owner text) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
+    DECLARE observation ${schema}.outbox; projection_observation ${schema}.outbox;
+    BEGIN
+      SELECT * INTO observation FROM ${schema}.outbox
+       WHERE event_id = eid AND lease_owner = owner AND lease_expires_at > clock_timestamp()
+         AND delivered_at IS NULL AND failed_at IS NULL;
+      IF NOT FOUND THEN
+        RAISE EXCEPTION 'Deferred event projection lease is not current' USING ERRCODE = '40001';
+      END IF;
+      IF observation.payload_json->'${RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD}' = 'true'::jsonb THEN
+        projection_observation := observation;
+        projection_observation.event_id := coalesce(observation.payload_json->>'_runtimeSearchEventId', observation.event_id);
+        PERFORM ${schema}.project_outbox_event(projection_observation);
+        observation.payload_json := ${schema}.compact_runtime_outbox_payload(observation);
+        -- Project against immutable input without locking the outbox row.
+        -- Cancellation may transfer its lease while indexing is in flight.
+        -- This final fence rolls the journal back if ownership changed.
+        UPDATE ${schema}.outbox SET payload_json = observation.payload_json
+         WHERE event_id = eid AND lease_owner = owner AND lease_expires_at > clock_timestamp()
+           AND delivered_at IS NULL AND failed_at IS NULL;
+        IF NOT FOUND THEN
+          RAISE EXCEPTION 'Deferred event projection lease is not current' USING ERRCODE = '40001';
+        END IF;
+      END IF;
+      RETURN observation.payload_json;
+    END
+    $function$
+  `);
   await client.query(`
     CREATE OR REPLACE FUNCTION ${schema}.accept_runner_log_payload() RETURNS trigger
     LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
@@ -1803,7 +2284,16 @@ export async function attachRuntimeEventSearchTriggers(
                 THEN NEW.runner_log_payload_json->'terminalProgressEvents'
               ELSE '[]'::jsonb END) WITH ORDINALITY AS progress(event, position)
           ));
-        PERFORM ${schema}.project_outbox_event(observation);
+        IF ${schema}.defer_runtime_event_projection() THEN
+          INSERT INTO ${schema}.outbox (event_id, run_id, event_type, payload_json, created_at)
+          VALUES (observation.event_id, observation.run_id, observation.event_type,
+            observation.payload_json,
+            GREATEST(clock_timestamp(), coalesce((SELECT max(created_at) + interval '1 microsecond'
+              FROM ${schema}.outbox WHERE run_id = NEW.run_id), clock_timestamp())))
+          ON CONFLICT (event_id) DO NOTHING;
+        ELSE
+          PERFORM ${schema}.project_outbox_event(observation);
+        END IF;
         NEW.runner_result_json := ${schema}.compact_runner_log_envelope(NEW.runner_result_json);
         IF jsonb_array_length(observation.payload_json->'recoveredRuntimeDiagnostics') > 0
           AND (NOT (NEW.runner_result_json ? 'runtimeDiagnostics')
@@ -1888,10 +2378,16 @@ export async function attachRuntimeEventSearchTriggers(
     END IF;
   END $create$`);
   await client.query(`REVOKE ALL ON FUNCTION ${schema}.project_outbox_event(${schema}.outbox),
+    ${schema}.project_origin_log_batch(${schema}.outbox, jsonb, text, text, boolean, boolean, timestamptz, jsonb, boolean),
+    ${schema}.independent_runtime_event_projection(),
+    ${schema}.pin_runtime_log_identity(),
+    ${schema}.materialize_runtime_outbox_event(text, text),
+    ${schema}.guard_runtime_outbox_ack(),
+    ${schema}.compact_runtime_outbox_payload(${schema}.outbox),
     ${schema}.accept_runner_log_payload(), ${schema}.search_outbox_event(),
     ${schema}.compact_run_log_result(), ${schema}.without_log_events(jsonb),
     ${schema}.convex_projection_event(jsonb), ${schema}.convex_projection_events(jsonb),
-    ${schema}.compact_runner_log_envelope(jsonb), ${schema}.without_runtime_log_tail(jsonb)
+    ${schema}.run_log_metadata(text, jsonb, timestamptz), ${schema}.compact_runner_log_envelope(jsonb), ${schema}.without_runtime_log_tail(jsonb)
     FROM PUBLIC`);
   // Publish readiness last, after all acceptance/compaction functions exist.
   await client.query(
@@ -1905,7 +2401,11 @@ export async function hasRuntimeEventSearchShape(
 ): Promise<boolean> {
   const schema = quoteIdent(requiredScope(runtimeScope));
   const result = await client.query<{ ready: boolean }>(
-    `SELECT to_regclass('runtime_observability.events') IS NOT NULL
+    `SELECT to_regprocedure('${schema}.materialize_runtime_outbox_event(text,text)') IS NOT NULL
+      AND EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = to_regclass('${schema}.outbox')
+        AND tgname = 'runtime_outbox_projection_ack_v1' AND tgenabled <> 'D')
+      AND to_regprocedure('${schema}.defer_runtime_event_projection()') IS NOT NULL
+      AND to_regclass('runtime_observability.events') IS NOT NULL
       AND to_regclass('runtime_observability.run_log_cursors') IS NOT NULL
       AND EXISTS (SELECT 1 FROM pg_attribute
         WHERE attrelid = to_regclass('runtime_observability.events')
@@ -2345,6 +2845,7 @@ export async function pruneRuntimeEvents(
               search_doc = jsonb_strip_nulls(jsonb_build_object(
                 'kind', ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}, 'source', event.search_doc->'source',
                 'producerAttempt', event.search_doc->'producerAttempt',
+                'entryId', event.search_doc->'entryId',
                 'logPositions', event.search_doc->'logPositions',
                 'logContentDigest', event.search_doc->'logContentDigest'))
          FROM candidates WHERE event.ctid = candidates.ctid AND event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}