deepline 0.3.290 → 0.3.292

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -91,6 +91,8 @@ import {
 import { normalizePlayDocflowNodeIoState } from '../docflow-node-io';
 import {
   normalizePlayLogContext,
+  normalizePlayLogMetadata,
+  type PlayLogMetadata,
   type PlayLogContext,
 } from '../log-context';
 import {
@@ -481,11 +483,9 @@ type PostgresSchedulerClaimExecutionOptions = Pick<
   /** Internal provider-read coordinates which must survive terminal-worker
    * loss. They are persisted only on the matching durable cleanup obligation. */
   sandboxCrashDiagnostic?: PostgresSchedulerSandboxCrashDiagnosticRequest;
-  /** Settled progress facts for a failed runner result, folded before the
-   * terminal write. They travel in the `run.failed` outbox row ahead of the
-   * terminal fact, the same carrier a direct completion uses, so the ledger
-   * settles them before the run's terminal makes its steps immutable. */
-  failedTerminalProgressEvents?: readonly unknown[];
+  /** Final step facts folded into the terminal outbox instead of a separate
+   * progress write immediately ahead of the terminal. */
+  terminalProgressEvents?: readonly unknown[];
   /** Forwarded to `failPostgresSchedulerAttempt`: a failure terminal written
    * for a detached-runner attempt must not overwrite an authoritative pushed
    * runner terminal that won after the attempt was claimed. */
@@ -10823,6 +10823,7 @@ export async function directCompletePostgresSchedulerRunnerTerminal(
             'producerAttempt', $2::integer,
             'terminalLogLines', $7::jsonb,
             'terminalLogContexts', $17::jsonb,
+            'terminalLogMetadata', $20::jsonb,
             'terminalLogIds', $19::jsonb->'terminalLogIds',
             'terminalProgressEvents', coalesce((
               SELECT accepted.runner_log_payload_json->'terminalProgressEvents'
@@ -10868,6 +10869,7 @@ export async function directCompletePostgresSchedulerRunnerTerminal(
       JSON.stringify(terminalLogProjection.lineContexts),
       stringifyPostgresJson(terminalWorkCounterSegment ?? null),
       stringifyPostgresJson(runnerTerminalLogPayload(input)),
+      JSON.stringify(terminalLogProjection.lineMetadata),
     ],
   );
   if (completed.rows.length > 0) return 'completed';
@@ -13200,8 +13202,10 @@ export async function completePostgresSchedulerAttempt(
     runtimeTiming?: PlayRunnerRuntimeTiming | null;
     terminalLogLines?: readonly string[] | null;
     terminalLogContexts?: readonly (PlayLogContext | null)[] | null;
+    terminalLogMetadata?: readonly (PlayLogMetadata | null)[] | null;
     terminalLogIds?: readonly (string | null)[] | null;
     terminalWorkCounterSegment?: PlayRunLedgerTerminalWorkCounterSegment;
+    terminalProgressEvents?: readonly unknown[];
   },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<boolean> {
@@ -13218,6 +13222,14 @@ export async function completePostgresSchedulerAttempt(
       'Terminal log contexts must align with terminal log lines.',
     );
   }
+  if (
+    input.terminalLogMetadata != null &&
+    input.terminalLogMetadata.length !== (input.terminalLogLines ?? []).length
+  ) {
+    throw new TypeError(
+      'Terminal log metadata must align with terminal log lines.',
+    );
+  }
   const terminalLogIds = normalizeRunLogIds(
     input.terminalLogIds,
     input.terminalLogLines ?? [],
@@ -13226,6 +13238,7 @@ export async function completePostgresSchedulerAttempt(
     .map((line, index) => ({
       line: line.trim(),
       context: input.terminalLogContexts?.[index] ?? null,
+      metadata: input.terminalLogMetadata?.[index] ?? null,
       entryId: terminalLogIds?.[index] ?? null,
     }))
     .filter((entry) => entry.line.length > 0)
@@ -13234,6 +13247,9 @@ export async function completePostgresSchedulerAttempt(
   const terminalLogContexts = terminalLogEntries.map((entry) =>
     normalizePlayLogContext(entry.context),
   );
+  const terminalLogMetadata = terminalLogEntries.map((entry) =>
+    normalizePlayLogMetadata(entry.metadata),
+  );
   const completed = await client.query<{ run_id: string }>(
     `
       WITH ${runtimeSandboxCustodyLocksSql('run.run_id = $1', options)}, completed AS (
@@ -13412,10 +13428,15 @@ export async function completePostgresSchedulerAttempt(
             'producerAttempt', $2::integer,
             'terminalLogLines', $8::jsonb,
             'terminalLogContexts', $11::jsonb,
-            'terminalLogIds', $13::jsonb,
+            'terminalLogMetadata', $13::jsonb,
+            'terminalLogIds', $15::jsonb,
             'resultSummary', $10::jsonb,
             'terminalWorkCounterSegment', $12::jsonb
-          ),
+          ) || CASE
+            WHEN jsonb_array_length($14::jsonb) > 0
+              THEN jsonb_build_object('terminalProgressEvents', $14::jsonb)
+            ELSE '{}'::jsonb
+          END,
           ${causalOutboxCreatedAt('run_terminal.run_id', options)}
         FROM run_terminal
         ON CONFLICT (event_id) DO NOTHING
@@ -13438,6 +13459,8 @@ export async function completePostgresSchedulerAttempt(
       stringifyPostgresJson(resultSummary),
       JSON.stringify(terminalLogContexts),
       stringifyPostgresJson(input.terminalWorkCounterSegment ?? null),
+      JSON.stringify(terminalLogMetadata),
+      JSON.stringify(input.terminalProgressEvents ?? []),
       stringifyPostgresJson(
         terminalLogIds
           ? terminalLogEntries.map((entry) => entry.entryId)
@@ -13461,14 +13484,15 @@ export async function failPostgresSchedulerAttempt(
     result?: unknown;
     terminalLogLines?: readonly string[] | null;
     terminalLogContexts?: readonly (PlayLogContext | null)[] | null;
+    terminalLogMetadata?: readonly (PlayLogMetadata | null)[] | null;
     terminalLogIds?: readonly (string | null)[] | null;
     /** Refuse to overwrite an authoritative detached runner terminal that won
      * after claim. Resumable `suspended` receipts may be superseded by the
      * hard ceiling in the same fenced statement. */
     preserveRunnerTerminal?: boolean;
     sandboxCrashDiagnostic?: PostgresSchedulerSandboxCrashDiagnosticRequest;
-    /** Progress facts the ledger must apply before `run.failed` (see
-     * `failedTerminalProgressEvents`). Omitted from the payload when empty. */
+    /** Progress facts the ledger must apply before the terminal fact. Omitted
+     * from the payload when empty. */
     terminalProgressEvents?: readonly unknown[];
   },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
@@ -13508,6 +13532,14 @@ export async function failPostgresSchedulerAttempt(
       'Terminal log contexts must align with terminal log lines.',
     );
   }
+  if (
+    input.terminalLogMetadata != null &&
+    input.terminalLogMetadata.length !== (input.terminalLogLines ?? []).length
+  ) {
+    throw new TypeError(
+      'Terminal log metadata must align with terminal log lines.',
+    );
+  }
   const terminalLogIds = normalizeRunLogIds(
     input.terminalLogIds,
     input.terminalLogLines ?? [],
@@ -13516,6 +13548,7 @@ export async function failPostgresSchedulerAttempt(
     .map((line, index) => ({
       line: line.trim(),
       context: input.terminalLogContexts?.[index] ?? null,
+      metadata: input.terminalLogMetadata?.[index] ?? null,
       entryId: terminalLogIds?.[index] ?? null,
     }))
     .filter((entry) => entry.line.length > 0)
@@ -13524,6 +13557,9 @@ export async function failPostgresSchedulerAttempt(
   const terminalLogContexts = terminalLogEntries.map((entry) =>
     normalizePlayLogContext(entry.context),
   );
+  const terminalLogMetadata = terminalLogEntries.map((entry) =>
+    normalizePlayLogMetadata(entry.metadata),
+  );
   const failed = await client.query<{ run_id: string }>(
     `
       WITH ${runtimeSandboxCustodyLocksSql('run.run_id = $1', options)}, failed AS (
@@ -13762,7 +13798,8 @@ export async function failPostgresSchedulerAttempt(
             'producerAttempt', $2::integer,
             'terminalLogLines', $12::jsonb,
             'terminalLogContexts', $14::jsonb,
-            'terminalLogIds', $17::jsonb,
+            'terminalLogMetadata', $17::jsonb,
+            'terminalLogIds', $18::jsonb,
             'resultSummary', $13::jsonb,
             'terminalWorkCounterSegment', $15::jsonb
           ) || CASE
@@ -13796,6 +13833,7 @@ export async function failPostgresSchedulerAttempt(
       JSON.stringify(terminalLogContexts),
       stringifyPostgresJson(terminalWorkCounterSegment ?? null),
       stringifyPostgresJson(input.terminalProgressEvents ?? []),
+      JSON.stringify(terminalLogMetadata),
       stringifyPostgresJson(
         terminalLogIds
           ? terminalLogEntries.map((entry) => entry.entryId)
@@ -14503,6 +14541,7 @@ function runnerTerminalLogPayload(input: {
     producerAttempt: input.attempt,
     terminalLogLines: projection.lines,
     terminalLogContexts: projection.lineContexts,
+    terminalLogMetadata: projection.lineMetadata,
     ...(projection.lineIds ? { terminalLogIds: projection.lineIds } : {}),
     terminalProgressEvents: input.terminalProgressEvents ?? [],
     // Older runner envelopes conveyed these diagnostics only in tagged log
@@ -14527,6 +14566,7 @@ function terminalLogProjectionForOutbox(
 ): {
   lines: string[];
   lineContexts: Array<PlayLogContext | null>;
+  lineMetadata: Array<PlayLogMetadata | null>;
   lineIds?: Array<string | null>;
 } {
   if (
@@ -14534,16 +14574,17 @@ function terminalLogProjectionForOutbox(
     !runnerResult ||
     typeof runnerResult !== 'object'
   ) {
-    return { lines: [], lineContexts: [] };
+    return { lines: [], lineContexts: [], lineMetadata: [] };
   }
   const result = runnerResult as {
     logs?: unknown;
     logContexts?: unknown;
+    logMetadata?: unknown;
     logIds?: unknown;
   };
   const logs = result.logs;
   if (!Array.isArray(logs)) {
-    return { lines: [], lineContexts: [] };
+    return { lines: [], lineContexts: [], lineMetadata: [] };
   }
   if (
     result.logContexts !== undefined &&
@@ -14552,6 +14593,15 @@ function terminalLogProjectionForOutbox(
   ) {
     throw new TypeError('Terminal log contexts must align with runner logs.');
   }
+  if (
+    result.logMetadata !== undefined &&
+    (!Array.isArray(result.logMetadata) ||
+      result.logMetadata.length !== logs.length)
+  )
+    throw new TypeError('Terminal log metadata must align with logs.');
+  const logMetadata = Array.isArray(result.logMetadata)
+    ? result.logMetadata
+    : undefined;
   const logContexts = Array.isArray(result.logContexts)
     ? result.logContexts
     : undefined;
@@ -14572,6 +14622,7 @@ function terminalLogProjectionForOutbox(
       return {
         line: line.trim(),
         context: normalizePlayLogContext(logContexts?.[index]),
+        metadata: normalizePlayLogMetadata(logMetadata?.[index]),
         entryId: logIds?.[index] ?? null,
       };
     })
@@ -14581,6 +14632,7 @@ function terminalLogProjectionForOutbox(
       ): entry is {
         line: string;
         context: PlayLogContext | null;
+        metadata: PlayLogMetadata | null;
         entryId: string | null;
       } => entry !== null,
     )
@@ -14588,6 +14640,7 @@ function terminalLogProjectionForOutbox(
   return {
     lines: entries.map((entry) => entry.line),
     lineContexts: entries.map((entry) => entry.context),
+    lineMetadata: entries.map((entry) => entry.metadata),
     ...(logIds ? { lineIds: entries.map((entry) => entry.entryId) } : {}),
   };
 }
@@ -14837,6 +14890,8 @@ export async function executePostgresSchedulerClaim(
         runtimeTiming: extractRunnerRuntimeTiming(output),
         terminalLogLines: terminalLogProjection.lines,
         terminalLogContexts: terminalLogProjection.lineContexts,
+        terminalLogMetadata: terminalLogProjection.lineMetadata,
+        terminalProgressEvents: options.terminalProgressEvents,
         terminalLogIds: terminalLogProjection.lineIds,
         terminalWorkCounterSegment: terminalWorkCounterSegmentFromRunnerResult(
           output,
@@ -14899,13 +14954,14 @@ export async function executePostgresSchedulerClaim(
         result: terminalFailureResult,
         terminalLogLines: terminalLogProjection.lines,
         terminalLogContexts: terminalLogProjection.lineContexts,
+        terminalLogMetadata: terminalLogProjection.lineMetadata,
         terminalLogIds: terminalLogProjection.lineIds,
         sandboxCrashDiagnostic: options.sandboxCrashDiagnostic,
         ...(options.preserveRunnerTerminal
           ? { preserveRunnerTerminal: true }
           : {}),
-        ...(runnerFailureResult && options.failedTerminalProgressEvents?.length
-          ? { terminalProgressEvents: options.failedTerminalProgressEvents }
+        ...(options.terminalProgressEvents?.length
+          ? { terminalProgressEvents: options.terminalProgressEvents }
           : {}),
       },
       options,
@@ -17862,6 +17918,32 @@ export async function readPendingPostgresSchedulerOutboxEvents(
   } = {},
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<PostgresSchedulerOutboxEvent[]> {
+  const { events } = await claimPostgresSchedulerOutboxPrefix(
+    client,
+    input,
+    options,
+  );
+  return events;
+}
+
+/**
+ * ACK and next-prefix selection share one statement after the run lock. Data
+ * CTEs use the statement's original snapshot, so every pending-row predicate
+ * explicitly excludes the acknowledged IDs. A partial ACK cannot claim a
+ * successor. The receiver's ingress capability and frozen receipts still
+ * determine which causal facts may share a prefix.
+ */
+async function claimPostgresSchedulerOutboxPrefix(
+  client: PostgresSchedulerQueryClient,
+  input: NonNullable<
+    Parameters<typeof readPendingPostgresSchedulerOutboxEvents>[1]
+  >,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+  acknowledgement?: { eventIds: string[]; targetEventId: string },
+): Promise<{
+  events: PostgresSchedulerOutboxEvent[];
+  deliveredRows: RunLedgerOutboxDeliveredRow[];
+}> {
   const requestedLimit = Math.floor(input.limit ?? 1);
   const limit = Number.isFinite(requestedLimit)
     ? Math.max(1, requestedLimit)
@@ -17869,6 +17951,10 @@ export async function readPendingPostgresSchedulerOutboxEvents(
   const runId = input.runId?.trim() || null;
   const leaseOwner = input.leaseOwner?.trim() || null;
   const leaseSeconds = Math.max(5, Math.min(300, input.leaseSeconds ?? 30));
+  const pending = (alias: string) =>
+    `${alias}.delivered_at IS NULL${
+      acknowledgement ? ` AND NOT (${alias}.event_id = ANY($5::text[]))` : ''
+    }`;
   const claim = async (supportsTerminalBatchMarker: boolean) => {
     const urgentLifecyclePendingSql = (alias: string) =>
       input.searchOnly === true
@@ -17879,15 +17965,23 @@ export async function readPendingPostgresSchedulerOutboxEvents(
         ? `(head.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents} AND ${urgentLifecyclePendingSql('head')})`
         : 'false';
     return await client.query<{
+      row_kind: 'claimed' | 'delivered';
       event_id: string;
       run_id: string;
       event_type: string;
       payload_json: unknown;
       created_at: Date;
       delivery_key: string | null;
+      lag_ms: number | string | null;
     }>(
       `
       WITH ${
+        acknowledgement
+          ? `delivered AS (
+        ${runLedgerAcknowledgeSql(options, '$5', '$3')}
+      ),`
+          : ''
+      } ${
         input.searchOnly === true
           ? ''
           : `waiting_runs AS MATERIALIZED (
@@ -17898,7 +17992,10 @@ export async function readPendingPostgresSchedulerOutboxEvents(
           ? `owned_run AS MATERIALIZED (
         SELECT run_id FROM ${tableName('runs', options)}
         WHERE run_id = $2
-        FOR UPDATE SKIP LOCKED
+        -- This dispatcher already owns the head. A producer holding the run
+        -- lock is not a lost delivery lease: wait for its short transaction,
+        -- then revalidate the head below. New-run selection still skips locks.
+        FOR UPDATE
       ),`
           : ''
       } head AS MATERIALIZED (
@@ -17906,8 +18003,18 @@ export async function readPendingPostgresSchedulerOutboxEvents(
                ${supportsTerminalBatchMarker ? 'candidate.delivery_batch_started_at' : 'NULL::timestamptz'} AS delivery_batch_started_at
         FROM ${tableName('outbox', options)} AS candidate
         ${input.extendOwnedHead ? 'JOIN owned_run ON owned_run.run_id = candidate.run_id' : ''}
-        WHERE candidate.delivered_at IS NULL
+        WHERE ${pending('candidate')}
           AND ${searchLaneSql('candidate')} = ${input.searchOnly === true ? 'true' : 'false'}
+          ${
+            acknowledgement
+              ? `AND (SELECT count(*) FROM delivered) = cardinality($5::text[])
+          AND EXISTS (
+            SELECT 1 FROM ${tableName('outbox', options)} AS target
+            WHERE target.run_id = $2 AND target.event_id = $6
+              AND ${pending('target')} AND target.failed_at IS NULL
+          )`
+              : ''
+          }
           ${
             input.extendOwnedHead
               ? `AND candidate.event_id = $5
@@ -17929,8 +18036,8 @@ export async function readPendingPostgresSchedulerOutboxEvents(
           AND NOT EXISTS (
             SELECT 1 FROM ${tableName('outbox', options)} AS active
             WHERE active.run_id = candidate.run_id
+              AND ${pending('active')}
               AND ${searchLaneSql('active')} = ${searchLaneSql('candidate')}
-              AND active.delivered_at IS NULL
               AND active.lease_owner IS NOT NULL
               AND active.lease_expires_at > now()
               AND active.lease_owner IS DISTINCT FROM $3::text
@@ -17942,7 +18049,7 @@ export async function readPendingPostgresSchedulerOutboxEvents(
             SELECT 1
             FROM ${tableName('outbox', options)} AS predecessor
             WHERE predecessor.run_id = candidate.run_id
-              AND predecessor.delivered_at IS NULL
+              AND ${pending('predecessor')}
               AND ${runLedgerPrecedesSql('predecessor', 'candidate')}
           )
         -- A new durable admission has no causal dependency on unrelated
@@ -17969,7 +18076,7 @@ export async function readPendingPostgresSchedulerOutboxEvents(
         SELECT outbox.event_id
         FROM ${tableName('outbox', options)} AS outbox
         JOIN head ON head.run_id = outbox.run_id
-        WHERE outbox.delivered_at IS NULL
+        WHERE ${pending('outbox')}
           AND ${searchLaneSql('outbox')} = ${input.searchOnly === true ? 'true' : 'false'}
           AND outbox.failed_at IS NULL
           -- Admission is causally first and must be projected alone. A later
@@ -18006,7 +18113,7 @@ export async function readPendingPostgresSchedulerOutboxEvents(
             SELECT 1
             FROM ${tableName('outbox', options)} AS terminal_predecessor
             WHERE terminal_predecessor.run_id = outbox.run_id
-              AND terminal_predecessor.delivered_at IS NULL
+              AND ${pending('terminal_predecessor')}
               AND ${
                 supportsTerminalBatchMarker
                   ? 'terminal_predecessor.delivery_batch_started_at IS NOT NULL'
@@ -18028,7 +18135,7 @@ export async function readPendingPostgresSchedulerOutboxEvents(
             SELECT 1
             FROM ${tableName('outbox', options)} AS predecessor
             WHERE predecessor.run_id = outbox.run_id
-              AND predecessor.delivered_at IS NULL
+              AND ${pending('predecessor')}
               AND ${runLedgerPrecedesSql('predecessor', 'outbox')}
               AND (
                 (predecessor.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents}
@@ -18077,17 +18184,50 @@ export async function readPendingPostgresSchedulerOutboxEvents(
                   outbox.payload_json, outbox.created_at, outbox.lease_owner,
                   outbox.delivery_key
       )
-      SELECT event_id, run_id, event_type, payload_json, created_at, lease_owner,
-             delivery_key
-      FROM claimed
-      ORDER BY ${runLedgerOrderSql('claimed')}
+      ${
+        acknowledgement
+          ? `, notified AS MATERIALIZED (
+        SELECT delivered.*,
+               pg_notify(
+                 $7,
+                 json_build_object('eventId', event_id, 'kind', 'outbox_delivered')::text
+               ) AS notification
+        FROM delivered
+      )`
+          : ''
+      }
+      SELECT * FROM (
+        SELECT 'claimed'::text AS row_kind,
+               event_id, run_id, event_type, payload_json, created_at, lease_owner,
+               delivery_key, NULL::float8 AS lag_ms
+        FROM claimed
+        ${
+          acknowledgement
+            ? `UNION ALL
+        SELECT 'delivered'::text AS row_kind,
+               event_id, NULL::text AS run_id, event_type, NULL::jsonb AS payload_json,
+               NULL::timestamptz AS created_at, NULL::text AS lease_owner,
+               NULL::text AS delivery_key, lag_ms
+        FROM notified`
+            : ''
+        }
+      ) AS result
+      ORDER BY row_kind, ${runLedgerOrderSql('result')}
     `,
       [
         limit,
         runId,
         leaseOwner,
         leaseSeconds,
-        ...(input.extendOwnedHead ? [input.extendOwnedHead] : []),
+        ...(acknowledgement
+          ? [
+              acknowledgement.eventIds,
+              acknowledgement.targetEventId,
+              postgresSchedulerNotifyChannel('terminal', options),
+            ]
+          : input.extendOwnedHead
+            ? [input.extendOwnedHead]
+            : []),
       ],
     );
   };
@@ -18098,9 +18238,13 @@ export async function readPendingPostgresSchedulerOutboxEvents(
       result = await claim(true);
     } catch (error) {
       if (!isMissingOutboxDeliveryBatchMarker(error)) throw error;
+      markOutboxDeliveryBatchMarkerUnavailable(options);
+      // The ACK caller owns the whole short transaction. Roll it back and
+      // repeat only this missing-column adapter, avoiding two SAVEPOINT round
+      // trips on every successful acknowledgement.
+      if (acknowledgement) throw error;
       if (input.inTransaction)
         await client.query('ROLLBACK TO SAVEPOINT run_ledger_claim');
-      markOutboxDeliveryBatchMarkerUnavailable(options);
       result = await claim(false);
     }
   } else {
@@ -18108,22 +18252,34 @@ export async function readPendingPostgresSchedulerOutboxEvents(
   }
   if (input.inTransaction)
     await client.query('RELEASE SAVEPOINT run_ledger_claim');
-  return result.rows.map((row) => {
-    if (!row.delivery_key) {
-      throw new Error(
-        `Run-ledger outbox event ${row.event_id} has no delivery key.`,
-      );
-    }
-    return {
-      eventId: row.event_id,
-      runId: row.run_id,
-      eventType: row.event_type,
-      payload: row.payload_json,
-      createdAt: row.created_at,
-      leaseOwner: leaseOwner,
-      deliveryKey: row.delivery_key,
-    };
-  });
+  const events = result.rows
+    .filter((row) => row.row_kind === 'claimed')
+    .map((row) => {
+      if (!row.delivery_key) {
+        throw new Error(
+          `Run-ledger outbox event ${row.event_id} has no delivery key.`,
+        );
+      }
+      return {
+        eventId: row.event_id,
+        runId: row.run_id,
+        eventType: row.event_type,
+        payload: row.payload_json,
+        createdAt: row.created_at,
+        leaseOwner: leaseOwner,
+        deliveryKey: row.delivery_key,
+      };
+    });
+  const deliveredRows = result.rows
+    .filter((row) => row.row_kind === 'delivered')
+    .map((row) => {
+      const lagMs = Number(row.lag_ms);
+      return {
+        eventType: row.event_type,
+        lagMs: Number.isFinite(lagMs) ? Math.max(0, lagMs) : 0,
+      };
+    });
+  return { events, deliveredRows };
 }
 
 /**
@@ -18388,7 +18544,7 @@ export async function purgePostgresSchedulerDeliveredOutboxRetentionBatch(
               '{events}',
               (SELECT jsonb_agg(
                  CASE WHEN item.value->>'type' = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
-                   THEN item.value - 'lines' - 'lineContexts' - 'lineIds'
+                   THEN item.value - 'lines' - 'lineContexts' - 'lineMetadata' - 'lineIds'
                    ELSE item.value
                  END ORDER BY item.ordinality
                )
@@ -18401,11 +18557,11 @@ export async function purgePostgresSchedulerDeliveredOutboxRetentionBatch(
             )
             WHEN jsonb_typeof(outbox.payload_json->'terminalProgressEvents') = 'array'
               THEN jsonb_set(
-                outbox.payload_json - 'terminalLogLines' - 'terminalLogContexts' - 'terminalLogIds',
+                outbox.payload_json - 'terminalLogLines' - 'terminalLogContexts' - 'terminalLogMetadata' - 'terminalLogIds',
                 '{terminalProgressEvents}',
                 coalesce((SELECT jsonb_agg(
                    CASE WHEN item.value->>'type' = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
-                     THEN item.value - 'lines' - 'lineContexts' - 'lineIds'
+                     THEN item.value - 'lines' - 'lineContexts' - 'lineMetadata' - 'lineIds'
                      ELSE item.value
                    END ORDER BY item.ordinality
                  )
@@ -18413,7 +18569,7 @@ export async function purgePostgresSchedulerDeliveredOutboxRetentionBatch(
                      WITH ORDINALITY AS item(value, ordinality)), '[]'::jsonb),
                 false
               )
-            ELSE outbox.payload_json - 'terminalLogLines' - 'terminalLogContexts' - 'terminalLogIds'
+            ELSE outbox.payload_json - 'terminalLogLines' - 'terminalLogContexts' - 'terminalLogMetadata' - 'terminalLogIds'
           END
          FROM candidates
         WHERE outbox.event_id = candidates.event_id`,
@@ -18475,6 +18631,17 @@ function runLedgerDeliveryFailure(input: { error: unknown }): {
   projectionMismatch: RunLedgerProjectionMismatchDiagnostic | null;
   retryAfterMs: number | null;
 } {
+  if (input.error instanceof RunLedgerProjectionLeaseLostError) {
+    return {
+      permanent: false,
+      code: 'RUN_LEDGER_DELIVERY_LEASE_LOST',
+      status: null,
+      retryable: true,
+      failureReason: input.error.reason,
+      projectionMismatch: input.error.projectionMismatch ?? null,
+      retryAfterMs: null,
+    };
+  }
   if (input.error instanceof AppRuntimeApiResponseError) {
     // Projection is idempotent. A dependency can incorrectly send
     // `retryable:false` with a transient overload response, but that metadata
@@ -18655,6 +18822,32 @@ export async function markPostgresSchedulerOutboxDelivered(
   ).length;
 }
 
+/** Shared lease-fenced ACK, including the canonical retained-payload cleanup. */
+function runLedgerAcknowledgeSql(
+  options: Pick<PostgresSchedulerOptions, 'schema'> | undefined,
+  eventIdsParameter: string,
+  leaseOwnerParameter: string,
+): string {
+  return `UPDATE ${tableName('outbox', options)} AS outbox
+        SET delivered_at = now(),
+            next_attempt_at = NULL,
+            last_error_json = NULL,
+            lease_owner = NULL,
+            lease_expires_at = NULL,
+            payload_json = CASE WHEN EXISTS (
+              SELECT 1 FROM ${tableName('runs', options)} AS run
+               WHERE run.run_id = outbox.run_id
+                 AND run.run_event_store = 'planet_scale'
+            ) THEN '{}'::jsonb ELSE outbox.payload_json END
+        WHERE outbox.event_id = ANY(${eventIdsParameter}::text[])
+          AND outbox.delivered_at IS NULL
+          AND (${leaseOwnerParameter}::text IS NULL OR outbox.lease_owner = ${leaseOwnerParameter})
+        RETURNING outbox.event_id,
+                  outbox.event_type,
+                  (extract(epoch FROM (outbox.delivered_at - outbox.created_at)) * 1000)::float8
+                    AS lag_ms`;
+}
+
 /**
  * Lease-fenced acknowledgement that also reports each row's event type and
  * commit-to-acknowledgement lag on the database clock, so lag metrics never
@@ -18675,24 +18868,7 @@ export async function markPostgresSchedulerOutboxDeliveredRows(
   }>(
     `
       WITH delivered AS (
-        UPDATE ${tableName('outbox', options)} AS outbox
-        SET delivered_at = now(),
-            next_attempt_at = NULL,
-            last_error_json = NULL,
-            lease_owner = NULL,
-            lease_expires_at = NULL,
-            payload_json = CASE WHEN EXISTS (
-              SELECT 1 FROM ${tableName('runs', options)} AS run
-               WHERE run.run_id = outbox.run_id
-                 AND run.run_event_store = 'planet_scale'
-            ) THEN '{}'::jsonb ELSE outbox.payload_json END
-        WHERE outbox.event_id = ANY($1::text[])
-          AND outbox.delivered_at IS NULL
-          AND ($2::text IS NULL OR outbox.lease_owner = $2)
-        RETURNING outbox.event_id,
-                  outbox.event_type,
-                  (extract(epoch FROM (outbox.delivered_at - outbox.created_at)) * 1000)::float8
-                    AS lag_ms
+        ${runLedgerAcknowledgeSql(options, '$1', '$2')}
       )
       SELECT event_id,
              event_type,
@@ -18846,6 +19022,7 @@ export function buildRunLedgerEventsFromPostgresSchedulerOutbox(
     );
     const lines = stringArrayPayloadField(event.payload, 'terminalLogLines');
     const lineContexts = terminalLogContextsPayloadField(event.payload, lines);
+    const lineMetadata = terminalLogMetadataPayloadField(event.payload, lines);
     const resultSummary = payloadField(event.payload, 'resultSummary');
     return [
       ...progressEvents.map(normalizeOutboxIngressPreview),
@@ -18859,6 +19036,7 @@ export function buildRunLedgerEventsFromPostgresSchedulerOutbox(
               source: 'worker',
               lines,
               ...(lineContexts ? { lineContexts } : {}),
+              ...(lineMetadata ? { lineMetadata } : {}),
             } as PlayRunLedgerEvent,
           ]),
       {
@@ -18888,6 +19066,7 @@ export function buildRunLedgerEventsFromPostgresSchedulerOutbox(
     );
     const lines = stringArrayPayloadField(event.payload, 'terminalLogLines');
     const lineContexts = terminalLogContextsPayloadField(event.payload, lines);
+    const lineMetadata = terminalLogMetadataPayloadField(event.payload, lines);
     const result = terminalRunResultForLedger(
       payloadField(event.payload, 'result'),
     );
@@ -18904,6 +19083,7 @@ export function buildRunLedgerEventsFromPostgresSchedulerOutbox(
               source: 'worker',
               lines,
               ...(lineContexts ? { lineContexts } : {}),
+              ...(lineMetadata ? { lineMetadata } : {}),
             } as PlayRunLedgerEvent,
           ]),
       {
@@ -19148,7 +19328,7 @@ export async function listPostgresSchedulerOutboxMaterializationPlans(
  * - `local_mint`: sign the token in-process with `BETTER_AUTH_SECRET`. ONLY the
  *   app (Vercel) legitimately holds the signing key, so this is app-side only
  *   (read-model heal path). It is the AUTHORITATIVE projector.
- * - `gateway`: always prove the active outbox lease to the launch-pinned
+ * - `gateway`: for every app-runtime append, prove the active outbox lease to the launch-pinned
  *   deployment and receive a short-lived executor JWT
  *   (`requestRunLedgerDispatchToken`), even if the caller supplied a
  *   `runtimeApi`. The Fly worker has no signing key and MUST use this. A
@@ -19219,7 +19399,7 @@ export type RunLedgerOutboxDispatchInput = {
   /** Only the existing background projector indexes deferred raw inputs. */
   materializeObservability?: boolean;
   /**
-   * Optional runtime context. `gateway` authority always replaces its
+   * Optional runtime context. For an app-runtime append, `gateway` replaces its
    * credentials with a fresh lease-scoped token and keeps only supported
    * transport options; `local_mint` and the default authority preserve the
    * explicit context as before.
@@ -19518,13 +19698,16 @@ async function dispatchRunLedgerOutboxBatchWithScope(
 ): Promise<PostgresSchedulerOutboxProjectionResult> {
   const dispatchStartedAtMs = Date.now();
   const tokenAuthority = input.tokenAuthority ?? 'local_mint';
-  const dispatchLaunchSql =
-    !input.searchOnly && (tokenAuthority === 'gateway' || !input.runtimeApi)
-      ? runLedgerDispatchLaunchSql('runs')
-      : 'NULL::jsonb';
-  let claimedLaunchJson: unknown;
   const leaseOwner =
     input.leaseOwner?.trim() || `run-ledger-outbox-dispatch:${randomUUID()}`;
+  const needsLaunch =
+    !input.searchOnly && (tokenAuthority === 'gateway' || !input.runtimeApi);
+  const launchSelection = needsLaunch
+    ? `CASE
+         WHEN ${runLedgerSearchOnlyOutboxFactSql('head')} THEN NULL::jsonb
+         ELSE ${runLedgerDispatchLaunchSql('runs')}
+       END`
+    : 'NULL::jsonb';
   const continuation: { current: RunLedgerOutboxDrainScope | null } = {
     current: scope ?? null,
   };
@@ -19576,13 +19759,14 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       const selected = targetRunId
         ? await client.query<{
             run_id: string;
-            dispatch_launch_json?: unknown;
+            dispatch_launch_json: unknown;
           }>(
             `
             WITH head AS MATERIALIZED (
               SELECT pending.run_id,
                      pending.event_id,
                      pending.event_type,
+                     pending.payload_json,
                      pending.created_at,
                      pending.next_attempt_at,
                      pending.failed_at
@@ -19593,7 +19777,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
               ORDER BY ${runLedgerOrderSql('pending')}
               LIMIT 1
             )
-            SELECT runs.run_id, ${dispatchLaunchSql} AS dispatch_launch_json
+            SELECT runs.run_id, ${launchSelection} AS dispatch_launch_json
             FROM head
             JOIN ${tableName('runs', options)} AS runs ON runs.run_id = head.run_id
             WHERE head.failed_at IS NULL
@@ -19614,7 +19798,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
           )
         : await client.query<{
             run_id: string;
-            dispatch_launch_json?: unknown;
+            dispatch_launch_json: unknown;
           }>(`
             WITH ${
               input.searchOnly === true
@@ -19627,6 +19811,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
                 pending.run_id,
                 pending.event_id,
                 pending.event_type,
+                pending.payload_json,
                 pending.created_at,
                 pending.next_attempt_at,
                 pending.failed_at
@@ -19635,7 +19820,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
                 AND ${searchLaneSql('pending')} = ${input.searchOnly === true ? 'true' : 'false'}
               ORDER BY pending.run_id, ${runLedgerOrderSql('pending')}
             )
-            SELECT runs.run_id, ${dispatchLaunchSql} AS dispatch_launch_json
+            SELECT runs.run_id, ${launchSelection} AS dispatch_launch_json
             FROM heads AS head
             JOIN ${tableName('runs', options)} AS runs ON runs.run_id = head.run_id
             WHERE head.failed_at IS NULL
@@ -19680,24 +19865,28 @@ async function dispatchRunLedgerOutboxBatchWithScope(
             options,
           )
         : [];
-      // Authority/routing is immutable and already lives on the locked Run.
-      // Capture only its existing narrow projection with the successful lease
-      // claim, then release the checkout before requesting gateway authority.
-      // The gateway still independently proves that this lease is current.
-      const launchJson = selected.rows[0]?.dispatch_launch_json;
-      if (claimed.length > 0 && launchJson != null) {
-        claimedLaunchJson = launchJson;
-      }
       await client.query('COMMIT');
-      return claimed;
+      // The launch is immutable. Carry only its authority/routing fields from
+      // the run we already locked, rather than queuing another scarce checkout
+      // between the claim and gateway request. The gateway still proves the
+      // active outbox lease; no database checkout spans either HTTP hop.
+      return {
+        events: claimed,
+        launchJson: selected.rows[0]?.dispatch_launch_json,
+      };
     } catch (error) {
       await client.query('ROLLBACK');
       throw error;
     }
   };
-  let events = scope?.nextClaimed.length
+  const preclaimed = scope?.nextClaimed.length
     ? scope.nextClaimed.splice(0)
+    : null;
+  const claimed = preclaimed
+    ? { events: preclaimed, launchJson: null }
     : await withClient(claimEvents);
+  const { launchJson } = claimed;
+  let events = claimed.events;
   if (events.length === 0) {
     return {
       attempted: 0,
@@ -19806,13 +19995,12 @@ async function dispatchRunLedgerOutboxBatchWithScope(
     return null;
   };
   try {
-    if (!input.materializeObservability) {
-      const handedOff = await materializeDeferredObservability();
-      if (handedOff) return handedOff;
-    }
+    // The ledger converter rejects raw deferred facts. Inline callers hand
+    // them off; the background owner projects them before inspecting the
+    // compact lifecycle payload or deciding that it needs no HTTP append.
+    const initialHandedOff = await materializeDeferredObservability();
+    if (initialHandedOff) return initialHandedOff;
     if (input.searchOnly) {
-      const handedOff = await materializeDeferredObservability();
-      if (handedOff) return handedOff;
       if (
         events.some(
           (event) =>
@@ -19852,18 +20040,23 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       };
     }
     const first = events[0]!;
-    const claimedLaunch =
-      claimedLaunchJson == null
-        ? undefined
-        : parseLaunchJson(claimedLaunchJson);
+    let ledgerEvents = RUN_SCHEDULER_OUTBOX_START_EVENT_TYPES.includes(
+      first.eventType,
+    )
+      ? null
+      : events.flatMap(buildRunLedgerEventsFromPostgresSchedulerOutbox);
+    // Search-only facts are already durable and have no ledger projection.
+    // Validate and acknowledge them without acquiring runtime authority or
+    // renewing a network-delivery lease. A following terminal still uses the
+    // same fenced continuation and loads authority only when it needs a write.
     if (
       scope &&
       (scope.runId !== first.runId || scope.leaseOwner !== leaseOwner)
     ) {
       throw new Error('Run-ledger continuation is outside its dispatch scope.');
     }
-    // Minted executor authority is reused only inside this finite run/owner
-    // drain and only while it can cover the HTTP request plus its SQL renewal.
+    const needsRuntimeApi = ledgerEvents === null || ledgerEvents.length > 0;
+    let runtimeApi: WorkerRuntimeApiContext | null = null;
     const reuseMarginMs =
       Math.max(
         1,
@@ -19873,24 +20066,36 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         ),
       ) + RUNTIME_RELIABILITY_POLICY.schedulerDatabase.queryTimeoutMs;
     const cachedAuthority = authorityScope.authority;
+    const resolveRunRuntimeApi = () =>
+      launchJson !== null
+        ? resolvePostgresSchedulerRuntimeApiForRun(
+            launchJson,
+            first.runId,
+            first.leaseOwner
+              ? { eventId: first.eventId, leaseOwner: first.leaseOwner }
+              : null,
+            tokenAuthority,
+            options,
+            input.runtimeApi?.signal,
+          )
+        : loadPostgresSchedulerRuntimeApiForRun(
+            withClient,
+            first.runId,
+            first.leaseOwner
+              ? { eventId: first.eventId, leaseOwner: first.leaseOwner }
+              : null,
+            tokenAuthority,
+            options,
+            input.runtimeApi?.signal,
+          );
     const gatewayRuntimeApi =
-      tokenAuthority === 'gateway'
+      needsRuntimeApi && tokenAuthority === 'gateway'
         ? cachedAuthority?.runId === first.runId &&
           cachedAuthority.leaseOwner === leaseOwner &&
           cachedAuthority.expiresAtMs !== null &&
           cachedAuthority.expiresAtMs > Date.now() + reuseMarginMs
           ? cachedAuthority.runtimeApi
-          : await loadPostgresSchedulerRuntimeApiForRun(
-              withClient,
-              first.runId,
-              first.leaseOwner
-                ? { eventId: first.eventId, leaseOwner: first.leaseOwner }
-                : null,
-              tokenAuthority,
-              options,
-              input.runtimeApi?.signal,
-              claimedLaunch,
-            )
+          : await resolveRunRuntimeApi()
         : null;
     if (
       gatewayRuntimeApi &&
@@ -19902,66 +20107,53 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         'Run Ledger dispatch origin changed within an immutable launch.',
       );
     }
-    const resolvedRuntimeApi =
-      gatewayRuntimeApi ??
-      input.runtimeApi ??
-      (await loadPostgresSchedulerRuntimeApiForRun(
-        withClient,
-        first.runId,
-        first.leaseOwner
-          ? { eventId: first.eventId, leaseOwner: first.leaseOwner }
-          : null,
-        tokenAuthority,
-        options,
-        undefined,
-        claimedLaunch,
-      ));
-    const runtimeApi = {
-      ...resolvedRuntimeApi,
-      ...(gatewayRuntimeApi && input.runtimeApi
-        ? {
-            ...(input.runtimeApi.fetch
-              ? { fetch: input.runtimeApi.fetch }
-              : {}),
-            ...(input.runtimeApi.requestTimeoutMs !== undefined
-              ? { requestTimeoutMs: input.runtimeApi.requestTimeoutMs }
-              : {}),
-            ...(input.runtimeApi.onResponseMeta
-              ? { onResponseMeta: input.runtimeApi.onResponseMeta }
-              : {}),
-            ...(input.runtimeApi.runtimeTestFaultHeader !== undefined
-              ? {
-                  runtimeTestFaultHeader:
-                    input.runtimeApi.runtimeTestFaultHeader,
-                }
-              : {}),
-            ...(input.runtimeApi.signal
-              ? { signal: input.runtimeApi.signal }
-              : {}),
-          }
-        : {}),
-      retryPolicy: 'none' as const,
-      // The caller-owned admission deadline (see `signal` above) wins.
-      ...(input.signal ? { signal: input.signal } : {}),
-    };
-    const tokenExpiresAtMs = runtimeApiTokenExpiresAtMs(
-      runtimeApi.executorToken,
-    );
-    if (tokenAuthority === 'gateway' && gatewayRuntimeApi) {
-      authorityScope.authority = {
-        runId: first.runId,
-        leaseOwner,
-        runtimeApi,
-        expiresAtMs: tokenExpiresAtMs,
+    if (needsRuntimeApi) {
+      const resolvedRuntimeApi =
+        gatewayRuntimeApi ?? input.runtimeApi ?? (await resolveRunRuntimeApi());
+      runtimeApi = {
+        ...resolvedRuntimeApi,
+        ...(gatewayRuntimeApi && input.runtimeApi
+          ? {
+              ...(input.runtimeApi.fetch
+                ? { fetch: input.runtimeApi.fetch }
+                : {}),
+              ...(input.runtimeApi.requestTimeoutMs !== undefined
+                ? { requestTimeoutMs: input.runtimeApi.requestTimeoutMs }
+                : {}),
+              ...(input.runtimeApi.onResponseMeta
+                ? { onResponseMeta: input.runtimeApi.onResponseMeta }
+                : {}),
+              ...(input.runtimeApi.runtimeTestFaultHeader !== undefined
+                ? {
+                    runtimeTestFaultHeader:
+                      input.runtimeApi.runtimeTestFaultHeader,
+                  }
+                : {}),
+              ...(input.runtimeApi.signal
+                ? { signal: input.runtimeApi.signal }
+                : {}),
+            }
+          : {}),
+        retryPolicy: 'none' as const,
+        // The caller-owned admission deadline (see `signal` above) wins.
+        ...(input.signal ? { signal: input.signal } : {}),
       };
+      if (tokenAuthority === 'gateway' && gatewayRuntimeApi) {
+        authorityScope.authority = {
+          runId: first.runId,
+          leaseOwner,
+          runtimeApi,
+          expiresAtMs: runtimeApiTokenExpiresAtMs(runtimeApi.executorToken),
+        };
+      }
+      authorityReadyAtMs = Date.now();
     }
-    authorityReadyAtMs = Date.now();
     // The initial claim deliberately uses the old contract until its immutable
     // launch receiver advertises support. Widen under the same run/owner fence
     // before the first HTTP append, so an already-finished run need not pay one
     // authority/append/ACK round trip for every ingress predecessor.
     if (
-      runtimeApi.runLedgerIngressPrefixBatching === true &&
+      runtimeApi?.runLedgerIngressPrefixBatching === true &&
       events.length === 1 &&
       first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents
     ) {
@@ -19982,32 +20174,34 @@ async function dispatchRunLedgerOutboxBatchWithScope(
           options,
         ),
       );
-      // Expansion uses SKIP LOCKED on the run fence. A concurrent lifecycle
-      // writer can make it empty while our original head lease remains live.
-      // Keep that singleton; mandatory renewal below still rejects expired
-      // or replaced ownership and freezes its receipt before any HTTP append.
-      if (widened.length > 0) {
-        if (widened[0]!.eventId !== first.eventId) {
-          throw new RunLedgerProjectionLeaseLostError(
-            'head_lease_owner_mismatch',
-          );
-        }
-        events = widened;
+      if (widened[0]?.eventId !== first.eventId) {
+        throw new RunLedgerProjectionLeaseLostError(
+          'head_lease_owner_mismatch',
+        );
       }
+      events = widened;
     }
     // Widening can add deferred facts to the lease. Project the complete
     // frozen prefix before any HTTP append, including its newly claimed rows.
     const handedOff = await materializeDeferredObservability();
     if (handedOff) return handedOff;
+    if (ledgerEvents !== null) {
+      ledgerEvents = events.flatMap(
+        buildRunLedgerEventsFromPostgresSchedulerOutbox,
+      );
+    }
     const renewDelivery = async () => {
       const currentAuthority = authorityScope.authority;
       if (
+        runtimeApi &&
         tokenAuthority === 'gateway' &&
         currentAuthority?.runId === first.runId &&
         currentAuthority.leaseOwner === leaseOwner &&
         currentAuthority.expiresAtMs !== null &&
         currentAuthority.expiresAtMs <= Date.now() + reuseMarginMs
       ) {
+        // Initial delivery reuses the claim's routing fields. Renewal must
+        // reread authority so an origin change cannot pass under that cache.
         const refreshed = await loadPostgresSchedulerRuntimeApiForRun(
           withClient,
           first.runId,
@@ -20041,7 +20235,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
             leaseOwner,
             leaseSeconds: input.leaseSeconds ?? 120,
             freezeReceipt:
-              runtimeApi.runLedgerIngressPrefixBatching === true &&
+              runtimeApi?.runLedgerIngressPrefixBatching === true &&
               events.some(
                 (event) =>
                   event.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents,
@@ -20051,37 +20245,33 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         ),
       );
     };
-    const append = async () => {
-      // A pending start is always claimed alone because later events require its
-      // snapshot. It cannot share the append endpoint, so retain that mutation
-      // as its own exact delivery.
-      if (first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runCreated) {
-        await renewDelivery();
-        await projectPostgresSchedulerCreatedEvent(runtimeApi, first);
-      } else if (
-        first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runStarted
-      ) {
-        await renewDelivery();
-        const leaseOwner = first.leaseOwner;
-        const launch = leaseOwner
-          ? await withClient((client) =>
-              readRunLedgerDispatchLaunchForLease(
-                client,
-                {
-                  runId: first.runId,
-                  eventId: first.eventId,
-                  leaseOwner,
-                },
-                options,
-              ),
-            )
-          : null;
-        await projectPostgresSchedulerStartEvent(runtimeApi, first, launch);
-      } else {
-        const ledgerEvents = events.flatMap(
-          buildRunLedgerEventsFromPostgresSchedulerOutbox,
-        );
-        if (ledgerEvents.length > 0) {
+    if (needsRuntimeApi && runtimeApi) {
+      const append = async (runtimeApi: WorkerRuntimeApiContext) => {
+        // A pending start is always claimed alone because later events require
+        // its snapshot. Retain that mutation as its own exact delivery.
+        if (first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runCreated) {
+          await renewDelivery();
+          await projectPostgresSchedulerCreatedEvent(runtimeApi, first);
+        } else if (
+          first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runStarted
+        ) {
+          await renewDelivery();
+          const startLeaseOwner = first.leaseOwner;
+          const launch = startLeaseOwner
+            ? await withClient((client) =>
+                readRunLedgerDispatchLaunchForLease(
+                  client,
+                  {
+                    runId: first.runId,
+                    eventId: first.eventId,
+                    leaseOwner: startLeaseOwner,
+                  },
+                  options,
+                ),
+              )
+            : null;
+          await projectPostgresSchedulerStartEvent(runtimeApi, first, launch);
+        } else if (ledgerEvents && ledgerEvents.length > 0) {
           const terminal = [...events]
             .reverse()
             .find((event) =>
@@ -20092,6 +20282,8 @@ async function dispatchRunLedgerOutboxBatchWithScope(
           const batchDeliveryKey = createHash('sha256')
             .update(events.map((event) => event.deliveryKey).join('\n'))
             .digest('hex');
+          // The transport renews before every HTTP chunk; another renewal here
+          // would add a checkout without protecting an intervening side effect.
           await projectRunEventsViaAppRuntime(runtimeApi, {
             playId: first.runId,
             events: ledgerEvents,
@@ -20107,25 +20299,26 @@ async function dispatchRunLedgerOutboxBatchWithScope(
                   deliveryDigest: batchDeliveryKey,
                 }),
           });
-        } else {
-          await renewDelivery();
         }
+      };
+      try {
+        await append(runtimeApi);
+      } catch (error) {
+        // Refresh a reused authority once through this delivery's active lease.
+        // Both attempts retain the same fenced append and idempotency key.
+        if (
+          !gatewayRuntimeApi?.refreshExecutorToken ||
+          !(error instanceof AppRuntimeApiResponseError) ||
+          error.status !== 401
+        )
+          throw error;
+        runtimeApi.executorToken = await gatewayRuntimeApi.refreshExecutorToken();
+        await append(runtimeApi);
       }
-    };
-    try {
-      await append();
-    } catch (error) {
-      // A cached authority can be invalidated by signer rotation. Refresh it
-      // once through this delivery's active lease; the append remains fenced
-      // and carries the same idempotency key on both attempts.
-      if (
-        !gatewayRuntimeApi?.refreshExecutorToken ||
-        !(error instanceof AppRuntimeApiResponseError) ||
-        error.status !== 401
-      )
-        throw error;
-      runtimeApi.executorToken = await gatewayRuntimeApi.refreshExecutorToken();
-      await append();
+    } else if (tokenAuthority !== 'gateway') {
+      // App-side acknowledgement retains lease validation. The gateway can
+      // acknowledge a durable search-only fact without a network lease hop.
+      await renewDelivery();
     }
     appendFinishedAtMs = Date.now();
     const acknowledgement = await acknowledgeRunLedgerPrefixWithContinuation(
@@ -20293,10 +20486,16 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         throw settlementError;
       }
     });
+    const failure = runLedgerDeliveryFailure({ error });
     console.warn('[run-ledger-outbox.batch_dispatch_failed]', {
       runId: input.runId ?? null,
       eventIds: events.map((event) => event.eventId),
       error: error instanceof Error ? error.message : String(error),
+      code: failure.code,
+      failureReason: failure.failureReason,
+      ...(failure.projectionMismatch
+        ? { projectionMismatch: failure.projectionMismatch }
+        : {}),
     });
     return {
       attempted: events.length,
@@ -20405,7 +20604,7 @@ async function acknowledgeRunLedgerPrefixWithContinuation(
     input: RunLedgerOutboxDispatchInput;
     events: PostgresSchedulerOutboxEvent[];
     leaseOwner: string;
-    runtimeApi: WorkerRuntimeApiContext;
+    runtimeApi: WorkerRuntimeApiContext | null;
     scope?: RunLedgerOutboxDrainScope;
     continuation: { current: RunLedgerOutboxDrainScope | null };
     continuationAllowance: number | null;
@@ -20421,81 +20620,86 @@ async function acknowledgeRunLedgerPrefixWithContinuation(
     !!input.scope ||
     (input.input.continueThroughTerminal === true && !input.input.headEventId);
   return withClient(async (client) => {
-    if (retainContinuation) {
-      await client.query('BEGIN');
-    }
-    try {
+    const acknowledge = async () => {
       if (retainContinuation) {
-        await client.query(
-          `SELECT set_config('lock_timeout', $1, true), set_config('statement_timeout', $2, true)`,
-          [
-            `${RUNTIME_SCHEDULER_CANCEL_LOCK_TIMEOUT_MS}ms`,
-            `${RUNTIME_SCHEDULER_CANCEL_STATEMENT_TIMEOUT_MS}ms`,
-          ],
-        );
-        // Keep the acknowledged prefix and its successor under one run lock.
-        // No competing projector can take the next head while this ACK's
-        // response is travelling back to the lease holder.
-        await client.query(
-          `SELECT run_id FROM ${tableName('runs', options)} WHERE run_id = $1 FOR UPDATE`,
-          [runId],
-        );
+        await client.query('BEGIN');
       }
-      const deliveredRows = await markPostgresSchedulerOutboxDeliveredRows(
-        client,
-        input.events.map((event) => event.eventId),
-        { ...options, leaseOwner: input.leaseOwner },
-      );
-      let continuation: RunLedgerOutboxDrainScope | null = null;
-      if (
-        retainContinuation &&
-        input.continuationAllowance !== 0 &&
-        deliveredRows.length === input.events.length &&
-        !input.events.some((event) => event.eventId === targetEventId)
-      ) {
-        const target = await readPostgresSchedulerOutboxDeliveryStatus(
-          client,
-          { runId, eventId: targetEventId },
-          options,
-        );
-        if (target.exists && !target.delivered && !target.blocked) {
-          const nextClaimed = await readPendingPostgresSchedulerOutboxEvents(
-            client,
-            {
-              runId,
-              leaseOwner: input.leaseOwner,
-              leaseSeconds: input.input.leaseSeconds ?? 120,
-              limit: Math.min(
-                RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS,
-                input.runtimeApi.runLedgerIngressPrefixBatching === true
-                  ? RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS
-                  : (input.input.limit ?? 1),
-                input.continuationAllowance ??
-                  RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS,
-              ),
-              allowIngressPrefix:
-                input.runtimeApi.runLedgerIngressPrefixBatching === true,
-              inTransaction: true,
-            },
-            options,
+      try {
+        if (retainContinuation) {
+          await client.query(
+            `SELECT set_config('lock_timeout', $1, true), set_config('statement_timeout', $2, true)`,
+            [
+              `${RUNTIME_SCHEDULER_CANCEL_LOCK_TIMEOUT_MS}ms`,
+              `${RUNTIME_SCHEDULER_CANCEL_STATEMENT_TIMEOUT_MS}ms`,
+            ],
+          );
+          // Keep the acknowledged prefix and its successor under one run lock.
+          // No competing projector can take the next head while this ACK's
+          // response is travelling back to the lease holder.
+          await client.query(
+            `SELECT run_id FROM ${tableName('runs', options)} WHERE run_id = $1 FOR UPDATE`,
+            [runId],
           );
-          if (nextClaimed.length > 0) {
-            continuation = input.scope ?? {
-              runId,
-              leaseOwner: input.leaseOwner,
-              targetEventId,
-              nextClaimed: [],
-            };
-            continuation.nextClaimed = nextClaimed;
-            input.continuation.current = continuation;
-          }
         }
+        const eventIds = input.events.map((event) => event.eventId);
+        const { deliveredRows, events: nextClaimed } =
+          retainContinuation &&
+          input.continuationAllowance !== 0 &&
+          !eventIds.includes(targetEventId)
+            ? await claimPostgresSchedulerOutboxPrefix(
+                client,
+                {
+                  runId,
+                  leaseOwner: input.leaseOwner,
+                  leaseSeconds: input.input.leaseSeconds ?? 120,
+                  limit: Math.min(
+                    RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS,
+                    input.runtimeApi?.runLedgerIngressPrefixBatching === true
+                      ? RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS
+                      : (input.input.limit ?? 1),
+                    input.continuationAllowance ??
+                      RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS,
+                  ),
+                  allowIngressPrefix:
+                    input.runtimeApi?.runLedgerIngressPrefixBatching === true,
+                },
+                options,
+                { eventIds, targetEventId },
+              )
+            : {
+                deliveredRows: await markPostgresSchedulerOutboxDeliveredRows(
+                  client,
+                  eventIds,
+                  { ...options, leaseOwner: input.leaseOwner },
+                ),
+                events: [],
+              };
+        let continuation: RunLedgerOutboxDrainScope | null = null;
+        if (nextClaimed.length > 0) {
+          continuation = input.scope ?? {
+            runId,
+            leaseOwner: input.leaseOwner,
+            targetEventId,
+            nextClaimed: [],
+          };
+          continuation.nextClaimed = nextClaimed;
+          input.continuation.current = continuation;
+        }
+        if (retainContinuation) await client.query('COMMIT');
+        return { deliveredRows, continuation };
+      } catch (error) {
+        if (retainContinuation) await client.query('ROLLBACK');
+        throw error;
       }
-      if (retainContinuation) await client.query('COMMIT');
-      return { deliveredRows, continuation };
+    };
+    try {
+      return await acknowledge();
     } catch (error) {
-      if (retainContinuation) await client.query('ROLLBACK');
-      throw error;
+      if (!isMissingOutboxDeliveryBatchMarker(error)) throw error;
+      // The first statement recorded this operation-local missing column and
+      // rolled back its ACK. Reacquire the run lock and take a fresh snapshot
+      // for the existing compatibility claim, without another ledger append.
+      return await acknowledge();
     }
   });
 }
@@ -20653,37 +20857,34 @@ async function projectPostgresSchedulerStartEvent(
 
 export type { RunLedgerDispatchLaunch } from './run-ledger-dispatch-authority';
 
-async function loadPostgresSchedulerRuntimeApiForRun(
-  withClient: <T>(
-    operation: (client: PostgresSchedulerQueryClient) => Promise<T>,
-  ) => Promise<T>,
+/** Search-only `run.events` facts settle without consulting launch credentials. */
+function runLedgerSearchOnlyOutboxFactSql(alias: string): string {
+  const events = `CASE
+    WHEN jsonb_typeof(${alias}.payload_json->'events') = 'array'
+      THEN ${alias}.payload_json->'events'
+    ELSE '[]'::jsonb
+  END`;
+  return `(
+    ${alias}.event_type = '${RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents}'
+    AND ${alias}.payload_json->>'logBodyStore' = 'planet_scale'
+    AND jsonb_array_length(${events}) = 0
+  )`;
+}
+
+async function resolvePostgresSchedulerRuntimeApiForRun(
+  launchJson: unknown,
   runId: string,
   dispatchLease: { eventId: string; leaseOwner: string } | null,
   tokenAuthority: RunLedgerOutboxTokenAuthority,
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
   signal?: AbortSignal,
-  claimedLaunch?: RunLedgerDispatchLaunch,
 ): Promise<
   WorkerRuntimeApiContext & {
     refreshExecutorToken?: () => Promise<string>;
     invalidateExecutorToken?: () => void;
   }
 > {
-  // Release the scarce scheduler checkout before the token authority hop.
-  // A slow gateway must not retain either projector pool client, and its
-  // launch context must not hydrate customer execution graphs.
-  const launch: RunLedgerDispatchLaunch =
-    claimedLaunch ??
-    (await withClient(async (client) => {
-      const result = await client.query<{ launch_json: unknown }>(
-        `SELECT ${runLedgerDispatchLaunchSql('runs')} AS launch_json
-         FROM ${tableName('runs', options)} AS runs
-         WHERE run_id = $1
-         LIMIT 1`,
-        [runId],
-      );
-      return parseLaunchJson(result.rows[0]?.launch_json);
-    }));
+  const launch = parseRunLedgerDispatchLaunch(launchJson);
   if (!launch?.baseUrl) {
     throw new Error(
       `Run-ledger outbox dispatcher cannot resolve runtime API context for ${runId}.`,
@@ -20743,6 +20944,37 @@ async function loadPostgresSchedulerRuntimeApiForRun(
   };
 }
 
+async function loadPostgresSchedulerRuntimeApiForRun(
+  withClient: <T>(
+    operation: (client: PostgresSchedulerQueryClient) => Promise<T>,
+  ) => Promise<T>,
+  runId: string,
+  dispatchLease: { eventId: string; leaseOwner: string } | null,
+  tokenAuthority: RunLedgerOutboxTokenAuthority,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+  signal?: AbortSignal,
+): ReturnType<typeof resolvePostgresSchedulerRuntimeApiForRun> {
+  // A continuation already owns its next event lease, so its launch context
+  // is not part of the preclaim result. Load only the authority fields here.
+  const result = await withClient((client) =>
+    client.query<{ launch_json: unknown }>(
+      `SELECT ${runLedgerDispatchLaunchSql('runs')} AS launch_json
+       FROM ${tableName('runs', options)} AS runs
+       WHERE run_id = $1
+       LIMIT 1`,
+      [runId],
+    ),
+  );
+  return resolvePostgresSchedulerRuntimeApiForRun(
+    result.rows[0]?.launch_json,
+    runId,
+    dispatchLease,
+    tokenAuthority,
+    options,
+    signal,
+  );
+}
+
 // Only freshly gateway-issued legacy run.progress authority is reused.
 // Prefix advertisements are reacquired for each drain because they select its
 // receipt shape, including recovery across receiver capability changes. This is not
@@ -21071,6 +21303,20 @@ function terminalLogContextsPayloadField(
   return value.map(normalizePlayLogContext);
 }
 
+function terminalLogMetadataPayloadField(
+  payload: unknown,
+  lines: readonly string[],
+): Array<PlayLogMetadata | null> | null {
+  const value = payloadField(payload, 'terminalLogMetadata');
+  if (value === undefined) return null;
+  if (!Array.isArray(value) || value.length !== lines.length) {
+    throw new TypeError(
+      'Terminal log metadata must align with terminal log lines.',
+    );
+  }
+  return value.map(normalizePlayLogMetadata);
+}
+
 function ledgerEventsPayloadField(
   payload: unknown,
   key: string,