deepline 0.3.306 → 0.3.308

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/runtime-event-search.ts

@@ -11,6 +11,31 @@
  * The API uses only the fixed, tenant-scoped readers in this module.
  */
 import { normalizeRuntimeSchedulerSchema } from '../runtime-scheduler-topology';
+import { createHash } from 'node:crypto';
+import {
+  getRunEventQueryFields,
+  getRunEventQueryPredicate,
+  normalizeRunEventOperationRequest,
+  normalizeRunEventQuery,
+  normalizeRunEventQueryTimestamp,
+  RunEventQueryInputError,
+  RunEventQueryDataError,
+  RUN_EVENT_QUERY_RETENTION_MS,
+  RUN_EVENT_QUERY_MAX_CURSOR_BYTES,
+  RUN_EVENT_QUERY_MAX_REQUEST_BYTES,
+  type NormalizedRunEventQuery,
+  type RunEventOperationRequest,
+  type RunEventOperationResult,
+  type RunEventQueryEvent,
+  type RunEventField,
+  type RunEventPredicate,
+  type RunEventGroupValue,
+  type RunEventScalar,
+  type RunEventQueryPage,
+  type RunEventQueryRetention,
+  type RunEventSummaryResult,
+} from '../run-event-query';
+import { RUN_LOG_LEVELS, type RunLogLevel } from '../run-event-catalog';
 import type { PostgresSchedulerQueryClient } from './postgres';
 import {
   RUN_EVENT_CONVEX_INTERNAL_KIND_SQL_LITERAL,
@@ -61,7 +86,7 @@ const RUNTIME_EVENT_LOG_POSITION_EXPRESSION = `jsonb_set(
 // Migration readiness tracks this projection body independently of scheduler
 // wire and schema versions. Bump when a changed trigger must be reinstalled.
 export const RUNTIME_EVENT_SEARCH_OUTBOX_PROJECTION_MARKER =
-  'runtime-event-search-origin-batches-log-metadata-point-replay';
+  'runtime-event-search-origin-batches-new-run-cutover-fresh-origin';
 /** Trusted trigger-authored state; absent on already-projected legacy rows. */
 export const RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD =
   '_runtimeSearchProjectionPending';
@@ -464,6 +489,576 @@ export async function searchRuntimeEvents(
   };
 }
 
+type RuntimeRunEventReadEvent = RunEventQueryEvent & {
+  receiptRef: string | null;
+};
+type RunEventQueryRow = EventRow & { cursor_occurred_at: string };
+export type RuntimeRunEventQueryReadResult =
+  | Exclude<RunEventOperationResult, { logs: unknown } | { events: unknown }>
+  | {
+      logs: RuntimeRunEventReadEvent[];
+      page: RunEventQueryPage;
+      query: NormalizedRunEventQuery;
+      retention: RunEventQueryRetention;
+    }
+  | {
+      events: RuntimeRunEventReadEvent[];
+      page: RunEventQueryPage;
+      query: NormalizedRunEventQuery;
+      retention: RunEventQueryRetention;
+    };
+type QueryCursor = {
+  format: 'run-event-query';
+  operation: 'list' | 'summarize';
+  fingerprint: string;
+  query: NormalizedRunEventQuery;
+  position: { occurredAt: string; eventId: string } | RunEventGroupValue[];
+};
+function invalidQueryCursor(): never {
+  throw new RunEventQueryInputError(
+    'Run event cursor does not match this scope, query, resource or projection. Start a new query without cursor.',
+    'invalid_run_event_cursor',
+  );
+}
+function decodeQueryCursor(value: string): QueryCursor {
+  try {
+    if (
+      !/^[A-Za-z0-9_-]+$/.test(value) ||
+      value.length > RUN_EVENT_QUERY_MAX_CURSOR_BYTES
+    )
+      return invalidQueryCursor();
+    const decoded = JSON.parse(
+      Buffer.from(value, 'base64url').toString('utf8'),
+    ) as QueryCursor;
+    if (
+      decoded.format !== 'run-event-query' ||
+      !['list', 'summarize'].includes(decoded.operation) ||
+      typeof decoded.fingerprint !== 'string' ||
+      !/^[a-f0-9]{64}$/.test(decoded.fingerprint) ||
+      !decoded.query ||
+      !decoded.position
+    )
+      return invalidQueryCursor();
+    decoded.query = normalizeRunEventQuery(decoded.query);
+    return decoded;
+  } catch {
+    return invalidQueryCursor();
+  }
+}
+function queryFingerprint(
+  scope: string,
+  org: string,
+  request: RunEventOperationRequest,
+  query: NormalizedRunEventQuery,
+): string {
+  return createHash('sha256')
+    .update(
+      JSON.stringify({
+        scope,
+        org,
+        resource: request.resource,
+        runId: request.runId ?? query.runId ?? null,
+        operation: request.operation,
+        query,
+        order:
+          request.operation === 'summarize'
+            ? 'group_key:asc'
+            : 'occurred_at:event_id:desc',
+        projection:
+          request.operation === 'list' && request.includePayloads === true,
+        groupBy:
+          request.operation === 'summarize' ? request.groupBy : undefined,
+        measures:
+          request.operation === 'summarize' ? request.measures : undefined,
+      }),
+    )
+    .digest('hex');
+}
+function queryFieldSql(field: RunEventField, params: unknown[]): string {
+  const columns: Record<string, string> = {
+    eventId: 'event_id',
+    orgId: 'org_id',
+    runtimeScope: 'runtime_scope',
+    runId: 'run_id',
+    playName: 'play_name',
+    kind: 'kind',
+  };
+  if (columns[field]) return `to_jsonb(${columns[field]})`;
+  if (field === 'occurredAt') return `to_jsonb(${queryTimestampSql()})`;
+  if (field === 'level') return 'to_jsonb(level)';
+  params.push(
+    field.startsWith('context.') ? ['context', field.slice(8)] : [field],
+  );
+  return `search_doc #> $${params.length}::text[]`;
+}
+function queryTimestampSql(): string {
+  return `to_char(occurred_at AT TIME ZONE 'UTC', CASE
+    WHEN mod(extract(microseconds FROM occurred_at)::bigint, 1000) = 0
+      THEN 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'
+      ELSE 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"' END)`;
+}
+const QUERY_DIRECT_COLUMNS: Partial<Record<RunEventField, string>> = {
+  eventId: 'event_id',
+  orgId: 'org_id',
+  runtimeScope: 'runtime_scope',
+  runId: 'run_id',
+  playName: 'play_name',
+  kind: 'kind',
+  occurredAt: 'occurred_at',
+  level: 'level',
+};
+function queryLogBodySql(): string {
+  return `CASE WHEN kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
+    AND search_doc->>'source' = 'terminal' THEN
+      regexp_replace(coalesce(log_body, message),
+        '^' || chr(1) || 'prov:[^' || chr(1) || ']*' || chr(1), '')
+    ELSE coalesce(log_body, message) END`;
+}
+function queryPredicateSql(
+  predicate: RunEventPredicate,
+  params: unknown[],
+): string {
+  if ('and' in predicate)
+    return `(${predicate.and.map((term) => queryPredicateSql(term, params)).join(' AND ')})`;
+  if ('or' in predicate)
+    return `(${predicate.or.map((term) => queryPredicateSql(term, params)).join(' OR ')})`;
+  const column = QUERY_DIRECT_COLUMNS[predicate.field];
+  if (column) {
+    if (
+      predicate.field === 'level' &&
+      ['gt', 'gte', 'lt', 'lte'].includes(predicate.op)
+    ) {
+      const index = RUN_LOG_LEVELS.indexOf(predicate.value as RunLogLevel);
+      const levels =
+        predicate.op === 'gt'
+          ? RUN_LOG_LEVELS.slice(index + 1)
+          : predicate.op === 'gte'
+            ? RUN_LOG_LEVELS.slice(index)
+            : predicate.op === 'lt'
+              ? RUN_LOG_LEVELS.slice(0, index)
+              : RUN_LOG_LEVELS.slice(0, index + 1);
+      params.push(levels);
+      return `(${column} = ANY($${params.length}::text[]))`;
+    }
+    if (predicate.op === 'exists')
+      return `(${column} IS ${predicate.value ? 'NOT ' : ''}NULL)`;
+    const bind = (value: RunEventScalar) => {
+      params.push(value);
+      return `$${params.length}${predicate.field === 'occurredAt' ? '::timestamptz' : ''}`;
+    };
+    if (predicate.op === 'in') {
+      const values = predicate.value
+        .filter((value) => value !== null)
+        .map(bind);
+      const terms = values.length
+        ? [`${column} IN (${values.join(', ')})`]
+        : [];
+      if (predicate.value.includes(null)) terms.push(`${column} IS NULL`);
+      return `(${terms.join(' OR ')})`;
+    }
+    if (predicate.value === null)
+      return `(${column} IS ${predicate.op === 'ne' ? 'NOT ' : ''}NULL)`;
+    const operator = {
+      eq: '=',
+      ne: '<>',
+      gt: '>',
+      gte: '>=',
+      lt: '<',
+      lte: '<=',
+    }[predicate.op];
+    return `(${column} ${operator} ${bind(predicate.value)})`;
+  }
+  const field = queryFieldSql(predicate.field, params);
+  if (predicate.op === 'exists')
+    return `(${field} IS ${predicate.value ? 'NOT ' : ''}NULL)`;
+  if (predicate.op === 'in') {
+    const values = predicate.value.map((value) => {
+      params.push(JSON.stringify(value));
+      return `$${params.length}::jsonb`;
+    });
+    return `(${field} IN (${values.join(', ')}))`;
+  }
+  params.push(JSON.stringify(predicate.value));
+  const value = `$${params.length}::jsonb`;
+  const operator = {
+    eq: '=',
+    ne: '<>',
+    gt: '>',
+    gte: '>=',
+    lt: '<',
+    lte: '<=',
+  }[predicate.op];
+  if (predicate.op === 'eq' || predicate.op === 'ne')
+    return `(${field} IS NOT NULL AND ${field} ${operator} ${value})`;
+  return `(jsonb_typeof(${field}) = '${typeof predicate.value === 'number' ? 'number' : 'string'}' AND ${field} ${operator} ${value})`;
+}
+function queryScopeSql(
+  scope: string,
+  org: string,
+  request: RunEventOperationRequest,
+  query: NormalizedRunEventQuery,
+): { params: unknown[]; where: string } {
+  const params: unknown[] = [scope, org, query.since, query.until];
+  // Trusted admission, tenant, runtime and retention predicates always enclose
+  // the complete user expression. An OR can never widen these constraints.
+  const predicates = [
+    'runtime_scope = $1',
+    'org_id = $2',
+    'occurred_at >= $3::timestamptz',
+    'occurred_at < $4::timestamptz',
+    "ingested_at >= clock_timestamp() - interval '7 days'",
+  ];
+  const runId = request.runId ?? query.runId;
+  if (runId !== undefined) {
+    params.push(runId);
+    predicates.push(`run_id = $${params.length}`);
+  }
+  if (request.resource === 'logs') {
+    predicates.push(`kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}`);
+    predicates.push('(log_body IS NOT NULL OR message IS NOT NULL)');
+  }
+  for (const [field, value] of [
+    ['play_name', query.playName],
+    ['kind', query.kind],
+  ] as const) {
+    if (value !== undefined) {
+      params.push(value);
+      predicates.push(`${field} = $${params.length}`);
+    }
+  }
+  if (query.stepId !== undefined) {
+    params.push(query.stepId);
+    predicates.push(`search_doc->'stepId' = to_jsonb($${params.length}::text)`);
+  }
+  if (query.minLevel !== undefined) {
+    params.push(RUN_LOG_LEVELS.slice(RUN_LOG_LEVELS.indexOf(query.minLevel)));
+    predicates.push(`level = ANY($${params.length}::text[])`);
+  }
+  if (query.text !== undefined) {
+    // Escape LIKE metacharacters: this is a literal substring search, never a
+    // user-supplied wildcard, regex or a search over a shortened response tail.
+    params.push(`%${query.text.replace(/[\\%_]/g, '\\$&')}%`);
+    predicates.push(
+      `coalesce((${queryLogBodySql()}), '') ILIKE $${params.length} ESCAPE E'\\\\'`,
+    );
+  }
+  if (query.where)
+    predicates.push(
+      queryPredicateSql(getRunEventQueryPredicate(query.where), params),
+    );
+  return { params, where: predicates.join(' AND ') };
+}
+function exactQueryNumber(value: unknown, label: string): number {
+  const number = Number(value);
+  // SQL sums are exact numeric values. Public fractional results use JS number
+  // precision; integral results must never silently lose integer precision.
+  if (
+    !Number.isFinite(number) ||
+    (Number.isInteger(number) && !Number.isSafeInteger(number)) ||
+    (label === 'count' && (!Number.isSafeInteger(number) || number < 0))
+  )
+    throw new RunEventQueryDataError(
+      `Run event ${label} cannot be represented exactly in the response.`,
+    );
+  return number;
+}
+function flatQueryEvent(row: RunEventQueryRow): RuntimeRunEventReadEvent {
+  const document = row.search_doc;
+  const metadata: Record<string, unknown> = {};
+  for (const field of [
+    'source',
+    'stepId',
+    'status',
+    'stepKind',
+    'datasetId',
+    'phase',
+    'provider',
+    'operation',
+  ] as const) {
+    if (typeof document[field] === 'string') metadata[field] = document[field];
+  }
+  if (typeof document.producerAttempt === 'number')
+    metadata.producerAttempt = document.producerAttempt;
+  if (document.context !== undefined) {
+    if (
+      document.context === null ||
+      typeof document.context !== 'object' ||
+      Array.isArray(document.context) ||
+      Object.values(document.context).some(
+        (value) =>
+          value !== null &&
+          !['string', 'number', 'boolean'].includes(typeof value),
+      )
+    )
+      throw new RunEventQueryDataError(
+        'Run event retained context is not a flat scalar object.',
+      );
+    metadata.context = document.context;
+  }
+  if (row.level !== null && !RUN_LOG_LEVELS.includes(row.level as RunLogLevel))
+    throw new RunEventQueryDataError(
+      'Run event retained level is unsupported.',
+    );
+  if (
+    row.event_payload !== null &&
+    row.event_payload !== undefined &&
+    (typeof row.event_payload !== 'object' || Array.isArray(row.event_payload))
+  )
+    throw new RunEventQueryDataError(
+      'Runtime canonical event payload is not a JSON object.',
+    );
+  return {
+    ...metadata,
+    eventId: row.event_id,
+    occurredAt: normalizeRunEventQueryTimestamp(row.cursor_occurred_at),
+    ingestedAt: iso(row.ingested_at),
+    runId: row.run_id,
+    playName: row.play_name,
+    kind: row.kind,
+    level: row.level as RunLogLevel | null,
+    message: row.message,
+    receiptRef: row.receipt_ref,
+    ...(row.event_payload == null
+      ? {}
+      : { eventPayload: row.event_payload as Record<string, unknown> }),
+  };
+}
+
+/** Reads through the existing restricted reader transaction and 3000ms budget. */
+export async function executeRuntimeEventQuery(
+  client: PostgresSchedulerQueryClient,
+  input: {
+    runtimeScope: string;
+    orgId: string;
+    request: RunEventOperationRequest;
+  },
+): Promise<RuntimeRunEventQueryReadResult> {
+  const scope = requiredScope(input.runtimeScope);
+  const org = requiredOrg(input.orgId);
+  const request = normalizeRunEventOperationRequest(input.request);
+  if (request.operation === 'fields') return getRunEventQueryFields();
+  const cursor =
+    'cursor' in request && request.cursor
+      ? decodeQueryCursor(request.cursor)
+      : undefined;
+  const criteria = Object.fromEntries(
+    Object.entries(request).filter(([key]) =>
+      [
+        'since',
+        'until',
+        'where',
+        'stepId',
+        'minLevel',
+        'text',
+        'playName',
+        'kind',
+        ...(request.resource === 'events' ? ['runId'] : []),
+      ].includes(key),
+    ),
+  );
+  // All omitted criteria are inherited from the cursor's admitted query. Any
+  // supplied criterion must normalize to exactly the original canonical fact.
+  const query = normalizeRunEventQuery({ ...cursor?.query, ...criteria });
+  const fingerprint = queryFingerprint(scope, org, request, query);
+  if (
+    cursor &&
+    (cursor.operation !== request.operation ||
+      cursor.fingerprint !== fingerprint)
+  )
+    invalidQueryCursor();
+  const retention = {
+    retainedSince: new Date(
+      Date.now() - RUN_EVENT_QUERY_RETENTION_MS,
+    ).toISOString(),
+    retentionDays: 7 as const,
+  };
+  const base = { query, retention };
+  const sql = queryScopeSql(scope, org, request, query);
+  if (request.operation === 'count') {
+    const result = await client.query<{ matched_count: string }>(
+      `SELECT count(*)::text AS matched_count FROM ${EVENTS_TABLE} WHERE ${sql.where}`,
+      sql.params,
+    );
+    return {
+      ...base,
+      matchedCount: exactQueryNumber(result.rows[0]?.matched_count, 'count'),
+      exact: true,
+    };
+  }
+  const limit = request.limit!;
+  const encode = (position: QueryCursor['position']) => {
+    const encoded = Buffer.from(
+      JSON.stringify({
+        format: 'run-event-query',
+        operation: request.operation,
+        fingerprint,
+        query,
+        position,
+      }),
+    ).toString('base64url');
+    const continuation = JSON.stringify({
+      ...request,
+      ...query,
+      cursor: encoded,
+    });
+    if (
+      encoded.length > RUN_EVENT_QUERY_MAX_CURSOR_BYTES ||
+      Buffer.byteLength(continuation, 'utf8') >
+        RUN_EVENT_QUERY_MAX_REQUEST_BYTES
+    ) {
+      throw new RunEventQueryDataError(
+        'Run event retained pagination key exceeds the continuation contract.',
+      );
+    }
+    return encoded;
+  };
+  if (request.operation === 'list') {
+    if (cursor) {
+      const position = cursor.position as RuntimeSearchCursor;
+      if (
+        Array.isArray(position) ||
+        typeof position.occurredAt !== 'string' ||
+        typeof position.eventId !== 'string' ||
+        !position.eventId ||
+        position.eventId.length > 512 ||
+        !Number.isFinite(Date.parse(position.occurredAt))
+      )
+        invalidQueryCursor();
+      sql.params.push(position.occurredAt, position.eventId);
+      sql.where += ` AND (occurred_at, event_id) < ($${sql.params.length - 1}::timestamptz, $${sql.params.length})`;
+    }
+    sql.params.push(limit + 1, request.includePayloads === true);
+    const result = await client.query<RunEventQueryRow>(
+      `SELECT event_id, occurred_at, ingested_at, run_id, play_name, kind, level,
+              ${queryTimestampSql()} AS cursor_occurred_at,
+              ${queryLogBodySql()} AS message, receipt_ref, search_doc,
+              CASE WHEN $${sql.params.length}::boolean THEN event_payload END AS event_payload
+         FROM ${EVENTS_TABLE} WHERE ${sql.where}
+         ORDER BY occurred_at DESC, event_id DESC LIMIT $${sql.params.length - 1}::integer`,
+      sql.params,
+    );
+    const hasMore = result.rows.length > limit;
+    const events = result.rows.slice(0, limit).map(flatQueryEvent);
+    const last = result.rows[Math.min(result.rows.length, limit) - 1];
+    const page = {
+      returnedCount: events.length,
+      hasMore,
+      nextCursor:
+        hasMore && last
+          ? encode({
+              occurredAt: last.cursor_occurred_at,
+              eventId: last.event_id,
+            })
+          : null,
+    };
+    return request.resource === 'logs'
+      ? { ...base, logs: events, page }
+      : { ...base, events, page };
+  }
+  const fields = request.groupBy;
+  const measures = request.measures!;
+  const groupFields = fields.map(
+    (field) =>
+      `coalesce(${queryFieldSql(field, sql.params)}, '{"missing":true}'::jsonb)`,
+  );
+  const selected = [
+    `jsonb_build_array(${groupFields.join(', ')}) AS group_key`,
+  ];
+  const invalid: string[] = [];
+  const aggregations = measures.map((measure, i) => {
+    if (measure.op === 'count') return `count(*)::text AS measure_${i}`;
+    const field = queryFieldSql(measure.field, sql.params);
+    selected.push(
+      `CASE WHEN jsonb_typeof(${field}) = 'number' THEN (${field} #>> '{}')::numeric END AS sum_${i}`,
+    );
+    invalid.push(
+      `(${field} IS NOT NULL AND jsonb_typeof(${field}) <> 'number')`,
+    );
+    return `coalesce(sum(sum_${i}), 0)::text AS measure_${i}`;
+  });
+  selected.push(
+    `${invalid.length ? invalid.join(' OR ') : 'false'} AS invalid_sum`,
+  );
+  let continuation = '';
+  if (cursor) {
+    if (
+      !Array.isArray(cursor.position) ||
+      cursor.position.length !== fields.length ||
+      cursor.position.some((value) => {
+        if (
+          value === null ||
+          typeof value === 'string' ||
+          typeof value === 'boolean'
+        )
+          return false;
+        if (typeof value === 'number') return !Number.isFinite(value);
+        return (
+          !value || value.missing !== true || Object.keys(value).length !== 1
+        );
+      })
+    )
+      invalidQueryCursor();
+    sql.params.push(JSON.stringify(cursor.position));
+    continuation = `WHERE group_key > $${sql.params.length}::jsonb`;
+  }
+  sql.params.push(limit + 1);
+  const result = await client.query<Record<string, unknown>>(
+    `WITH matched AS MATERIALIZED (
+       SELECT ${selected.join(', ')} FROM ${EVENTS_TABLE} WHERE ${sql.where}
+     ), grouped AS (
+       SELECT ${fields.length ? 'group_key' : "'[]'::jsonb AS group_key"}, ${aggregations.join(', ')} FROM matched ${fields.length ? 'GROUP BY group_key' : ''}
+     ), validation AS (
+       SELECT count(*) FILTER (WHERE invalid_sum)::text AS invalid_sum_count FROM matched
+     ), paged AS (
+       SELECT * FROM grouped ${continuation} ORDER BY group_key ASC LIMIT $${sql.params.length}::integer
+     ) SELECT paged.*, validation.invalid_sum_count FROM validation LEFT JOIN paged ON true ORDER BY group_key ASC`,
+    sql.params,
+  );
+  if (exactQueryNumber(result.rows[0]?.invalid_sum_count, 'count') > 0) {
+    const sumFields = measures.flatMap((measure) =>
+      measure.op === 'sum' ? [measure.field] : [],
+    );
+    throw new RunEventQueryDataError(
+      `Run event sum selected a nonnumeric value in ${sumFields.join(', ')}. Filter to numeric values or choose another measure.`,
+      'nonnumeric_run_event_sum',
+    );
+  }
+  const rows = result.rows.filter(
+    (row) => row.group_key !== null && row.group_key !== undefined,
+  );
+  const hasMore = rows.length > limit;
+  const groups = rows.slice(0, limit).map((row) => {
+    if (!Array.isArray(row.group_key) || row.group_key.length !== fields.length)
+      throw new RunEventQueryDataError(
+        'Run event group projection is invalid.',
+      );
+    return {
+      keys: Object.fromEntries(
+        fields.map((field, i) => [field, (row.group_key as unknown[])[i]]),
+      ),
+      measures: Object.fromEntries(
+        measures.map((measure, i) => [
+          measure.as!,
+          exactQueryNumber(row[`measure_${i}`], measure.op),
+        ]),
+      ),
+    };
+  });
+  const last = rows[Math.min(rows.length, limit) - 1];
+  return {
+    ...base,
+    groupBy: fields,
+    measures,
+    groups: groups as RunEventSummaryResult['groups'],
+    page: {
+      returnedCount: groups.length,
+      hasMore,
+      nextCursor:
+        hasMore && last ? encode(last.group_key as RunEventGroupValue[]) : null,
+    },
+  };
+}
+
 /**
  * Reads a receipt through a narrow SECURITY DEFINER function. The reader has
  * no direct grant on any scheduler receipt table, and the function checks both
@@ -976,6 +1571,7 @@ export async function setRuntimeEventDeferredProjection(
   runtimeScope: string,
   deferred: boolean,
   independent?: boolean,
+  newRunsOnly?: true,
 ): Promise<void> {
   const schema = quoteIdent(requiredScope(runtimeScope));
   if (!(await hasRuntimeEventSearchShape(client, runtimeScope))) {
@@ -991,11 +1587,38 @@ export async function setRuntimeEventDeferredProjection(
   await client.query('BEGIN');
   try {
     await client.query("SELECT set_config('lock_timeout', '1000', true)");
+    // Fence admission before outbox writes, in the normal Run -> outbox order.
+    // The admission pin and producer flags change at one committed boundary.
+    await client.query(`LOCK TABLE ${schema}.runs IN SHARE ROW EXCLUSIVE MODE`);
     // Fence trigger execution while changing mode. This operator-only lock
     // never spans projection; normal producer writes acquire no such lock.
     await client.query(
       `LOCK TABLE ${schema}.outbox IN SHARE ROW EXCLUSIVE MODE`,
     );
+    const previous = await client.query<{
+      deferred: boolean;
+      new_runs_only: boolean;
+    }>(`SELECT ${schema}.defer_runtime_event_projection() AS deferred,
+        ${schema}.new_runs_only_runtime_event_projection() AS new_runs_only`);
+    const scoped =
+      newRunsOnly === true || previous.rows[0]?.new_runs_only === true;
+    if (deferred && scoped && independent === false) {
+      throw new Error(
+        'Scoped cutover requires independent projection; use disable to stop it.',
+      );
+    }
+    if (newRunsOnly === true) {
+      if (!deferred || independent !== true) {
+        throw new Error(
+          'New-run cutover requires independent deferred projection.',
+        );
+      }
+      if (previous.rows[0]?.deferred && !previous.rows[0]?.new_runs_only) {
+        throw new Error(
+          'Drain and disable global deferred projection before a new-run cutover.',
+        );
+      }
+    }
     if (!deferred) {
       const pending = await client.query<{ event_id: string }>(
         `SELECT event_id FROM ${schema}.outbox
@@ -1019,12 +1642,14 @@ export async function setRuntimeEventDeferredProjection(
         );
     }
     await installRuntimeEventProjectionMode(client, schema, deferred);
-    if (independent !== undefined || !deferred)
+    if (independent !== undefined || !deferred || scoped)
       await installIndependentProjectionMode(
         client,
         schema,
-        deferred && independent === true,
+        deferred && (independent === true || scoped),
       );
+    if (newRunsOnly !== undefined)
+      await installNewRunProjectionMode(client, schema, newRunsOnly);
     await client.query('COMMIT');
   } catch (error) {
     await client.query('ROLLBACK');
@@ -1036,10 +1661,12 @@ export type RuntimeEventProjectionModes = {
   runtimeScope: string;
   deferred: boolean | null;
   independent: boolean | null;
+  newRunsOnly?: boolean | null;
   unavailableReason:
     | 'projection_mode_readers_missing'
     | 'deferred_projection_reader_missing'
     | 'independent_projection_reader_missing'
+    | 'new_run_projection_reader_missing'
     | null;
 };
 
@@ -1053,25 +1680,31 @@ export async function readRuntimeEventProjectionModes(
   const installed = await client.query<{
     deferred_installed: boolean;
     independent_installed: boolean;
+    new_runs_only_installed: boolean;
   }>(
     `SELECT to_regprocedure($1) IS NOT NULL AS deferred_installed,
-            to_regprocedure($2) IS NOT NULL AS independent_installed`,
+            to_regprocedure($2) IS NOT NULL AS independent_installed,
+            to_regprocedure($3) IS NOT NULL AS new_runs_only_installed`,
     [
       `${schema}.defer_runtime_event_projection()`,
       `${schema}.independent_runtime_event_projection()`,
+      `${schema}.new_runs_only_runtime_event_projection()`,
     ],
   );
   const readers = installed.rows[0];
   if (
     !readers ||
     typeof readers.deferred_installed !== 'boolean' ||
-    typeof readers.independent_installed !== 'boolean'
+    typeof readers.independent_installed !== 'boolean' ||
+    typeof readers.new_runs_only_installed !== 'boolean'
   ) {
     throw new Error('Runtime projection mode lookup returned no reader state.');
   }
   const unavailableReason = readers.deferred_installed
     ? readers.independent_installed
-      ? null
+      ? readers.new_runs_only_installed
+        ? null
+        : 'new_run_projection_reader_missing'
       : 'independent_projection_reader_missing'
     : readers.independent_installed
       ? 'deferred_projection_reader_missing'
@@ -1081,6 +1714,7 @@ export async function readRuntimeEventProjectionModes(
       runtimeScope: scope,
       deferred: null,
       independent: null,
+      newRunsOnly: null,
       unavailableReason,
     };
   }
@@ -1091,18 +1725,25 @@ export async function readRuntimeEventProjectionModes(
   const independentExpression = readers.independent_installed
     ? `${schema}.independent_runtime_event_projection()`
     : 'NULL::boolean';
+  const newRunsOnlyExpression = readers.new_runs_only_installed
+    ? `${schema}.new_runs_only_runtime_event_projection()`
+    : 'NULL::boolean';
   const result = await client.query<{
     deferred: boolean | null;
     independent: boolean | null;
+    new_runs_only: boolean | null;
   }>(
     `SELECT ${deferredExpression} AS deferred,
-            ${independentExpression} AS independent`,
+            ${independentExpression} AS independent,
+            ${newRunsOnlyExpression} AS new_runs_only`,
   );
   const modes = result.rows[0];
   if (
     !modes ||
     (readers.deferred_installed && typeof modes.deferred !== 'boolean') ||
-    (readers.independent_installed && typeof modes.independent !== 'boolean')
+    (readers.independent_installed && typeof modes.independent !== 'boolean') ||
+    (readers.new_runs_only_installed &&
+      typeof modes.new_runs_only !== 'boolean')
   ) {
     throw new Error('Runtime projection mode lookup returned invalid values.');
   }
@@ -1110,6 +1751,7 @@ export async function readRuntimeEventProjectionModes(
     runtimeScope: scope,
     deferred: modes.deferred,
     independent: modes.independent,
+    newRunsOnly: modes.new_runs_only,
     unavailableReason,
   };
 }
@@ -1121,27 +1763,32 @@ export async function inspectRuntimeEventProjection(
 ): Promise<{
   deferred: boolean;
   independent: boolean;
+  newRunsOnly: boolean | null;
   pending: number;
   blocked: number;
   oldestPendingAt: string | null;
 }> {
   const schema = quoteIdent(requiredScope(runtimeScope));
+  const modes = await readRuntimeEventProjectionModes(client, runtimeScope);
+  if (modes.deferred === null || modes.independent === null) {
+    throw new Error(
+      'Install the deferred projection readers before inspecting the outbox.',
+    );
+  }
   const result = await client.query<{
-    deferred: boolean;
-    independent: boolean;
     pending: string | number;
     blocked: string | number;
     oldest: Date | string | null;
-  }>(`SELECT ${schema}.defer_runtime_event_projection() AS deferred, ${schema}.independent_runtime_event_projection() AS independent,
-      count(*) AS pending, count(*) FILTER (WHERE failed_at IS NOT NULL) AS blocked,
+  }>(`SELECT count(*) AS pending, count(*) FILTER (WHERE failed_at IS NOT NULL) AS blocked,
       min(created_at) AS oldest
     FROM ${schema}.outbox
     WHERE delivered_at IS NULL
       AND payload_json->'${RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD}' = 'true'::jsonb`);
   const state = result.rows[0]!;
   return {
-    deferred: state.deferred,
-    independent: state.independent,
+    deferred: modes.deferred,
+    independent: modes.independent,
+    newRunsOnly: modes.newRunsOnly ?? null,
     pending: Number(state.pending),
     blocked: Number(state.blocked),
     oldestPendingAt: state.oldest === null ? null : iso(state.oldest),
@@ -1173,6 +1820,18 @@ async function installIndependentProjectionMode(
   );
 }
 
+async function installNewRunProjectionMode(
+  client: PostgresSchedulerQueryClient,
+  schema: string,
+  enabled: boolean,
+): Promise<void> {
+  await client.query(`CREATE OR REPLACE FUNCTION ${schema}.new_runs_only_runtime_event_projection()
+    RETURNS boolean LANGUAGE sql VOLATILE SET search_path = pg_catalog AS 'SELECT ${enabled ? 'true' : 'false'}'`);
+  await client.query(
+    `REVOKE ALL ON FUNCTION ${schema}.new_runs_only_runtime_event_projection() FROM PUBLIC`,
+  );
+}
+
 /**
  * Migration installs readers with synchronous production unchanged. After
  * cutover, the producer persists raw input and only the leased dispatcher
@@ -1198,6 +1857,19 @@ export async function attachRuntimeEventSearchTriggers(
   );
   if (!independentMode.rows[0]?.installed)
     await installIndependentProjectionMode(client, schema, false);
+  const newRunMode = await client.query<{ installed: boolean }>(
+    `SELECT to_regprocedure($1) IS NOT NULL AS installed`,
+    [`${schema}.new_runs_only_runtime_event_projection()`],
+  );
+  if (!newRunMode.rows[0]?.installed)
+    await installNewRunProjectionMode(client, schema, false);
+  await client.query(`CREATE OR REPLACE FUNCTION ${schema}.defer_runtime_event_projection_for_run(rid text)
+    RETURNS boolean LANGUAGE sql VOLATILE SECURITY DEFINER SET search_path = pg_catalog AS $function$
+      SELECT ${schema}.defer_runtime_event_projection() AND
+        (NOT ${schema}.new_runs_only_runtime_event_projection() OR coalesce(
+          (SELECT admission_json->>'runtimeEventProjection' = 'independent'
+            FROM ${schema}.runs WHERE run_id = rid), false))
+    $function$`);
   // Stamp new admissions once. Existing launches never acquire a producer pin
   // on replay or worker upgrade. Ignore a caller-supplied pin before cutover.
   await client.query(`CREATE OR REPLACE FUNCTION ${schema}.pin_runtime_log_identity() RETURNS trigger
@@ -1205,6 +1877,25 @@ export async function attachRuntimeEventSearchTriggers(
     BEGIN
       NEW.launch_json := NEW.launch_json - 'runtimeLogIdentity';
       NEW.admission_json := NEW.admission_json - 'runtimeLogIdentity';
+      NEW.launch_json := NEW.launch_json - 'runtimeEventProjection';
+      NEW.admission_json := NEW.admission_json - 'runtimeEventProjection';
+      IF ${schema}.new_runs_only_runtime_event_projection()
+        AND ${schema}.defer_runtime_event_projection()
+        AND ${schema}.independent_runtime_event_projection() THEN
+        -- Older writers may omit admission_json. Preserve their authority
+        -- using the same transport-free projection as normal admission.
+        NEW.admission_json := coalesce(NEW.admission_json,
+          NEW.launch_json - ARRAY[
+            'executorToken',
+            'preloadedDbSessionUnwrapKey',
+            'preloadedDbSessions',
+            'submittedAtMs',
+            'runtimeDeployVersion',
+            'coordinatorInternalToken',
+            'vercelProtectionBypassToken'
+          ]::text[])
+          || '{"runtimeEventProjection":"independent"}'::jsonb;
+      END IF;
       IF ${schema}.independent_runtime_event_projection() THEN
         NEW.launch_json := NEW.launch_json || '{"runtimeLogIdentity":"origin"}'::jsonb;
         NEW.admission_json := NEW.admission_json || '{"runtimeLogIdentity":"origin"}'::jsonb;
@@ -1227,7 +1918,7 @@ export async function attachRuntimeEventSearchTriggers(
       IF NEW.run_id IS NULL OR NEW.org_id IS NULL THEN
         RAISE EXCEPTION 'Terminal receipt search projection requires run and organization';
       END IF;
-      IF ${schema}.defer_runtime_event_projection() THEN
+      IF ${schema}.defer_runtime_event_projection_for_run(NEW.run_id) THEN
         IF NOT EXISTS (SELECT 1 FROM ${schema}.runs
           WHERE run_id = NEW.run_id AND org_id = NEW.org_id) THEN
           RAISE EXCEPTION 'Terminal receipt search projection has no matching run';
@@ -1388,6 +2079,12 @@ export async function attachRuntimeEventSearchTriggers(
         ON CONFLICT (runtime_scope, org_id, event_id) DO NOTHING RETURNING event_id
       ) SELECT coalesce(array_agg(inserted.event_id ORDER BY entries.ordinal), ARRAY[]::text[])
         INTO fresh FROM inserted JOIN entries ON entries.eid = inserted.event_id;
+      -- The INSERT already proves the content of every fresh identity. Only
+      -- retries or a concurrent uniqueness winner need a journal read-back.
+      -- This fast path serves both inline and background origin projection.
+      IF cardinality(fresh) = jsonb_array_length(item->'lines') THEN
+        RETURN fresh;
+      END IF;
       -- A new READ COMMITTED statement sees a concurrent uniqueness winner.
       -- Tombstones retain digest/identity: retry never restores an expired body.
       SELECT count(*) INTO mismatches
@@ -1432,7 +2129,7 @@ export async function attachRuntimeEventSearchTriggers(
       -- writers lock attempt before Run; this recorder must not invert that.
       -- Stable batches are ordered by the leased background prefix and cursor row.
       -- The legacy alias path still needs its old transaction mutex.
-      IF NOT ${schema}.defer_runtime_event_projection() THEN
+      IF NOT ${schema}.defer_runtime_event_projection_for_run(observation.run_id) THEN
         PERFORM pg_advisory_xact_lock(hashtext(${quoteLiteral(scope)}), hashtext(observation.run_id));
       END IF;
       SELECT org_id, play_name, run_log_store = 'planet_scale', status,
@@ -1549,7 +2246,7 @@ export async function attachRuntimeEventSearchTriggers(
         ));
       END IF;
       IF event_batch IS NOT NULL THEN
-        IF ${schema}.defer_runtime_event_projection() AND EXISTS (SELECT 1 FROM jsonb_array_elements(event_batch) entry WHERE entry->>'type' = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended} AND (NOT (entry ? 'lineIds') OR jsonb_typeof(entry->'lineIds') IS DISTINCT FROM 'array' OR EXISTS (SELECT 1 FROM jsonb_array_elements(CASE WHEN jsonb_typeof(entry->'lineIds') = 'array' THEN entry->'lineIds' ELSE '[]'::jsonb END) id WHERE id = 'null'::jsonb))) THEN
+        IF ${schema}.defer_runtime_event_projection_for_run(observation.run_id) AND EXISTS (SELECT 1 FROM jsonb_array_elements(event_batch) entry WHERE entry->>'type' = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended} AND (NOT (entry ? 'lineIds') OR jsonb_typeof(entry->'lineIds') IS DISTINCT FROM 'array' OR EXISTS (SELECT 1 FROM jsonb_array_elements(CASE WHEN jsonb_typeof(entry->'lineIds') = 'array' THEN entry->'lineIds' ELSE '[]'::jsonb END) id WHERE id = 'null'::jsonb))) THEN
           PERFORM pg_advisory_xact_lock(hashtext(${quoteLiteral(scope)}), hashtext(observation.run_id));
         END IF;
         -- Normalize old positional writers once per batch under the run mutex.
@@ -2252,7 +2949,7 @@ export async function attachRuntimeEventSearchTriggers(
     DECLARE run_closed boolean; search_payload jsonb;
     BEGIN
       IF NEW.payload_json->'${RUNTIME_EVENT_SEARCH_ONLY_FIELD}' = 'true'::jsonb THEN RETURN NEW; END IF;
-      IF ${schema}.defer_runtime_event_projection()
+      IF ${schema}.defer_runtime_event_projection_for_run(NEW.run_id)
         AND NEW.event_type <> ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runCreated} THEN
         IF NEW.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents} THEN
           -- One cheap Run fence captures whether ingress preceded terminal
@@ -2378,7 +3075,7 @@ export async function attachRuntimeEventSearchTriggers(
                 THEN NEW.runner_log_payload_json->'terminalProgressEvents'
               ELSE '[]'::jsonb END) WITH ORDINALITY AS progress(event, position)
           ));
-        IF ${schema}.defer_runtime_event_projection() THEN
+        IF ${schema}.defer_runtime_event_projection_for_run(NEW.run_id) THEN
           INSERT INTO ${schema}.outbox (event_id, run_id, event_type, payload_json, created_at)
           VALUES (observation.event_id, observation.run_id, observation.event_type,
             observation.payload_json,
@@ -2474,6 +3171,8 @@ export async function attachRuntimeEventSearchTriggers(
   await client.query(`REVOKE ALL ON FUNCTION ${schema}.project_outbox_event(${schema}.outbox),
     ${schema}.project_origin_log_batch(${schema}.outbox, jsonb, text, text, boolean, boolean, timestamptz, jsonb, boolean),
     ${schema}.independent_runtime_event_projection(),
+    ${schema}.new_runs_only_runtime_event_projection(),
+    ${schema}.defer_runtime_event_projection_for_run(text),
     ${schema}.pin_runtime_log_identity(),
     ${schema}.materialize_runtime_outbox_event(text, text),
     ${schema}.guard_runtime_outbox_ack(),
@@ -2499,6 +3198,8 @@ export async function hasRuntimeEventSearchShape(
       AND EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = to_regclass('${schema}.outbox')
         AND tgname = 'runtime_outbox_projection_ack_v1' AND tgenabled <> 'D')
       AND to_regprocedure('${schema}.defer_runtime_event_projection()') IS NOT NULL
+      AND to_regprocedure('${schema}.new_runs_only_runtime_event_projection()') IS NOT NULL
+      AND to_regprocedure('${schema}.defer_runtime_event_projection_for_run(text)') IS NOT NULL
       AND to_regclass('runtime_observability.events') IS NOT NULL
       AND to_regclass('runtime_observability.run_log_cursors') IS NOT NULL
       AND EXISTS (SELECT 1 FROM pg_attribute