deepline 0.3.392 → 0.3.394

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -1,3 +1,4 @@
+import { escapeLiteral } from 'pg';
 import {
   readRowFailureCounts,
   type RowFailureCounts,
@@ -514,6 +515,8 @@ type PostgresSchedulerClaimExecutionOptions = Pick<
    * for a detached-runner attempt must not overwrite an authoritative pushed
    * runner terminal that won after the attempt was claimed. */
   preserveRunnerTerminal?: boolean;
+  /** Recheck typed-wait custody and cancellation at the actual failure write. */
+  protectWaitingSuspensionFailure?: boolean;
 };
 
 export type PostgresSchedulerWorkerOnceResult =
@@ -8575,6 +8578,72 @@ export async function claimPostgresSchedulerWaitingDetachedAttemptForTerminal(
   return claimed.rows.length > 0;
 }
 
+/**
+ * Prepare only an owned, retained suspension for a failure terminal. Unlike an
+ * engine wake, this never clears the user's wait or emits `run.resumed`.
+ */
+export async function claimPostgresSchedulerWaitingSuspensionAttemptForFailure(
+  client: PostgresSchedulerQueryClient,
+  input: { runId: string; attempt: number; leaseToken: string },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<'prepared' | 'fence_lost' | 'not_applicable'> {
+  await client.query('BEGIN ISOLATION LEVEL READ COMMITTED');
+  try {
+    // A cancellation marker can commit without the custody lock. Acquire the
+    // locks first, then evaluate it in a fresh statement snapshot; a guard in
+    // the lock-taking statement could predate that cancellation.
+    await client.query(
+      `WITH ${runtimeSandboxCustodyLocksSql('run.run_id = $1', options)}
+       SELECT count(*) FROM custody_attempts`,
+      [input.runId],
+    );
+    const claimed = await client.query<{
+      applicable: boolean;
+      prepared: boolean;
+    }>(
+      `
+      WITH waiting_suspension AS MATERIALIZED (
+        SELECT run_id FROM ${tableName('runs', options)}
+        WHERE run_id = $1 AND status = 'waiting'
+          AND suspension_json ->> 'kind' <> 'detached_runner'
+      ), prepared AS (
+      UPDATE ${tableName('attempts', options)} AS target
+      SET status = 'running', heartbeat_at = now(), updated_at = now()
+      FROM ${tableName('runs', options)} AS run
+      WHERE target.run_id = $1 AND target.attempt = $2
+        AND target.lease_token = $3 AND target.status IN ('waiting', 'running')
+        AND run.run_id = target.run_id AND run.status = 'waiting'
+        AND run.suspension_json ->> 'kind' <> 'detached_runner'
+        AND target.runner_result_json ->> 'status' = 'suspended'
+        AND target.runner_result_json -> 'suspension' = run.suspension_json
+        AND NOT EXISTS (
+          SELECT 1 FROM ${tableName('attempts', options)} AS newer
+          WHERE newer.run_id = target.run_id AND newer.attempt > target.attempt
+            AND newer.status IN ('claimed', 'running', 'waiting', 'completed', 'failed')
+        )
+        AND NOT EXISTS (
+          SELECT 1 FROM ${tableName('control', options)} AS cancel
+          WHERE cancel.key = 'runtime_cancel:' || target.run_id
+        )
+      RETURNING target.run_id
+      )
+      SELECT EXISTS (SELECT 1 FROM waiting_suspension) AS applicable,
+             EXISTS (SELECT 1 FROM prepared) AS prepared
+      `,
+      [input.runId, input.attempt, input.leaseToken],
+    );
+    await client.query('COMMIT');
+    return claimed.rows[0]?.prepared
+      ? 'prepared'
+      : claimed.rows[0]?.applicable
+        ? 'fence_lost'
+        : 'not_applicable';
+  } catch (error) {
+    await client.query('ROLLBACK');
+    throw error;
+  }
+}
+
 export type PostgresSchedulerRecoveryCircuit = {
   dependency: string;
   state: 'closed' | 'open' | 'half_open';
@@ -12960,7 +13029,7 @@ export async function readPostgresSchedulerRunnerTerminal(
   return result.rows[0]?.runner_result_json ?? null;
 }
 
-async function readPostgresSchedulerRunnerTerminalReceivedAtMs(
+export async function readPostgresSchedulerRunnerTerminalReceivedAtMs(
   client: PostgresSchedulerQueryClient,
   input: { runId: string; attempt: number },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
@@ -13630,6 +13699,8 @@ export async function failPostgresSchedulerAttempt(
      * after claim. Resumable `suspended` receipts may be superseded by the
      * hard ceiling in the same fenced statement. */
     preserveRunnerTerminal?: boolean;
+    /** Internal typed-wait failure path; absence retains ordinary terminal semantics. */
+    protectWaitingSuspensionFailure?: boolean;
     sandboxCrashDiagnostic?: PostgresSchedulerSandboxCrashDiagnosticRequest;
     /** Progress facts the ledger must apply before the terminal fact. Omitted
      * from the payload when empty. */
@@ -13700,8 +13771,9 @@ export async function failPostgresSchedulerAttempt(
   const terminalLogMetadata = terminalLogEntries.map((entry) =>
     normalizePlayLogMetadata(entry.metadata),
   );
-  const failed = await client.query<{ run_id: string }>(
-    `
+  const writeFailure = () =>
+    client.query<{ run_id: string }>(
+      `
       WITH ${runtimeSandboxCustodyLocksSql('run.run_id = $1', options)}, failed AS (
         UPDATE ${tableName('attempts', options)}
         SET status = 'failed',
@@ -13759,6 +13831,27 @@ export async function failPostgresSchedulerAttempt(
             OR runner_result_json IS NULL
             OR runner_result_json ->> 'status' = 'suspended'
           )
+          ${
+            input.protectWaitingSuspensionFailure
+              ? `
+          AND EXISTS (
+            SELECT 1 FROM custody_runs AS run
+            WHERE run.run_id = $1 AND run.status = 'waiting'
+              AND run.suspension_json ->> 'kind' <> 'detached_runner'
+              AND attempts.runner_result_json ->> 'status' = 'suspended'
+              AND attempts.runner_result_json -> 'suspension' = run.suspension_json
+          )
+          AND NOT EXISTS (
+            SELECT 1 FROM ${tableName('control', options)} AS cancel
+            WHERE cancel.key = 'runtime_cancel:' || $1
+          )
+          AND NOT EXISTS (
+            SELECT 1 FROM ${tableName('attempts', options)} AS newer
+            WHERE newer.run_id = $1 AND newer.attempt > $2
+              AND newer.status IN ('claimed', 'running', 'waiting', 'completed', 'failed')
+          )`
+              : ''
+          }
         RETURNING
           run_id,
           attempt,
@@ -13956,36 +14049,75 @@ export async function failPostgresSchedulerAttempt(
       )
       SELECT run_id FROM notify_terminal
     `,
-    [
-      input.runId,
-      input.attempt,
-      input.leaseToken,
-      stringifyPostgresJson({ message: input.error }),
-      stringifyPostgresJson(terminalResult ?? null),
-      postgresSchedulerNotifyChannel('terminal', options),
-      JSON.stringify({ runId: input.runId, status: 'failed' }),
-      stringifyPostgresJson(ledgerTerminalResult ?? null),
-      runtimeTerminalReasonFromError(input.error),
-      stringifyPostgresJson(input.sandboxCrashDiagnostic ?? null),
-      input.preserveRunnerTerminal === true,
-      JSON.stringify(terminalLogLines),
-      stringifyPostgresJson(resultSummary),
-      JSON.stringify(terminalLogContexts),
-      stringifyPostgresJson(terminalWorkCounterSegment ?? null),
-      stringifyPostgresJson(
-        sanitizeTerminalProgressEvents(input.terminalProgressEvents),
-      ),
-      JSON.stringify(terminalLogMetadata),
-      stringifyPostgresJson(
-        terminalLogIds
-          ? terminalLogEntries.map((entry) => entry.entryId)
-          : null,
-      ),
-    ],
-  );
+      [
+        input.runId,
+        input.attempt,
+        input.leaseToken,
+        stringifyPostgresJson({ message: input.error }),
+        stringifyPostgresJson(terminalResult ?? null),
+        postgresSchedulerNotifyChannel('terminal', options),
+        JSON.stringify({ runId: input.runId, status: 'failed' }),
+        stringifyPostgresJson(ledgerTerminalResult ?? null),
+        runtimeTerminalReasonFromError(input.error),
+        stringifyPostgresJson(input.sandboxCrashDiagnostic ?? null),
+        input.preserveRunnerTerminal === true,
+        JSON.stringify(terminalLogLines),
+        stringifyPostgresJson(resultSummary),
+        JSON.stringify(terminalLogContexts),
+        stringifyPostgresJson(terminalWorkCounterSegment ?? null),
+        stringifyPostgresJson(
+          sanitizeTerminalProgressEvents(input.terminalProgressEvents),
+        ),
+        JSON.stringify(terminalLogMetadata),
+        stringifyPostgresJson(
+          terminalLogIds
+            ? terminalLogEntries.map((entry) => entry.entryId)
+            : null,
+        ),
+      ],
+    );
+  const failed = input.protectWaitingSuspensionFailure
+    ? await withWaitingSuspensionFailureCustody(
+        client,
+        input.runId,
+        writeFailure,
+        options,
+      )
+    : await writeFailure();
   return failed.rows.length > 0;
 }
 
+/** The terminal statement gets a fresh snapshot after every custody lock. */
+async function withWaitingSuspensionFailureCustody<T>(
+  client: PostgresSchedulerQueryClient,
+  runId: string,
+  write: () => Promise<T>,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<T> {
+  await client.query('BEGIN ISOLATION LEVEL READ COMMITTED');
+  try {
+    await client.query(
+      `WITH ${runtimeSandboxCustodyLocksSql('run.run_id = $1', options)}
+       SELECT count(*) FROM custody_operations`,
+      [runId],
+    );
+    const result = await write();
+    await client.query('COMMIT');
+    return result;
+  } catch (error) {
+    try {
+      await client.query('ROLLBACK');
+    } catch (rollbackError) {
+      throw new AggregateError(
+        [error, rollbackError],
+        'Typed suspension failure rollback failed.',
+        { cause: error },
+      );
+    }
+    throw error;
+  }
+}
+
 /**
  * Cancel a run: terminal `cancelled` status, all live attempts cancelled, and
  * terminal notify so observers settle immediately. An in-flight executor's
@@ -15171,6 +15303,9 @@ export async function executePostgresSchedulerClaim(
         ...(options.preserveRunnerTerminal
           ? { preserveRunnerTerminal: true }
           : {}),
+        ...(options.protectWaitingSuspensionFailure
+          ? { protectWaitingSuspensionFailure: true }
+          : {}),
         terminalProgressEvents: [
           ...terminalWorkCounterProgressEventsFromRunnerResult(
             terminalFailureResult,
@@ -18371,24 +18506,98 @@ export async function readPendingPostgresSchedulerOutboxEvents(
  * successor. The receiver's ingress capability and frozen receipts still
  * determine which causal facts may share a prefix.
  */
-async function claimPostgresSchedulerOutboxPrefix(
-  client: PostgresSchedulerQueryClient,
+type RunLedgerTransportCandidate = {
+  eventId: string;
+  eventType: string;
+  deliveryKey: string;
+};
+
+function runLedgerZeroEffectTransportSql(alias: string): string {
+  return `${alias}.event_type IN (${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runWaiting}, ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runResumed})
+    AND jsonb_typeof(${alias}.payload_json) = 'object'
+    AND ${alias}.payload_json->'kind' = '"detached_runner"'::jsonb
+    AND ${alias}.delivery_key IS NOT NULL AND ${alias}.delivery_key <> ''
+    AND ${alias}.payload_json->'${RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD}' IS DISTINCT FROM 'true'::jsonb
+    AND ${alias}.payload_json->'${RUNTIME_EVENT_SEARCH_ONLY_FIELD}' IS DISTINCT FROM 'true'::jsonb
+    AND to_jsonb(${alias})->>'delivery_batch_started_at' IS NULL
+    AND ${alias}.failed_at IS NULL
+    AND coalesce(${alias}.next_attempt_at, ${alias}.created_at) <= now()
+    AND ${alias}.lease_owner IS NULL AND ${alias}.lease_expires_at IS NULL`;
+}
+
+type RunLedgerTransportDelivery = {
+  eventIds: string[];
+  deliveries: RunLedgerOutboxDeliveredRow[];
+};
+
+type RunLedgerOutboxPrefixClaimRow = {
+  row_kind:
+    | 'claimed'
+    | 'delivered'
+    | 'transport_delivered'
+    | 'transport_unconfirmed';
+  event_id: string;
+  run_id: string;
+  event_type: string;
+  payload_json: unknown;
+  created_at: Date;
+  delivery_key: string | null;
+  lag_ms: number | string | null;
+  lease_owner?: string | null;
+  delivery_frozen?: boolean;
+  lease_remaining_ms?: number | string | null;
+};
+
+type RunLedgerFreshClaimLeaseFacts = {
+  leaseOwner: string;
+  prefix: readonly { eventId: string; deliveryKey: string }[];
+  remainingLeaseMs: number;
+};
+
+type RunLedgerFreshClaimFirstHttpProof = RunLedgerFreshClaimLeaseFacts & {
+  receivedAtMonotonicMs: number;
+};
+
+function freshRunLedgerClaimCoversFirstHttp(
+  proof: RunLedgerFreshClaimFirstHttpProof | null,
+  events: readonly PostgresSchedulerOutboxEvent[],
+  leaseOwner: string,
+  requiredRemainingMs: number,
+): boolean {
+  if (
+    !proof ||
+    proof.leaseOwner !== leaseOwner ||
+    proof.prefix.length !== events.length
+  )
+    return false;
+  const elapsedMs = performance.now() - proof.receivedAtMonotonicMs;
+  return (
+    Number.isFinite(elapsedMs) &&
+    elapsedMs >= 0 &&
+    proof.remainingLeaseMs - elapsedMs > requiredRemainingMs &&
+    proof.prefix.every(
+      (fact, index) =>
+        fact.eventId === events[index]?.eventId &&
+        fact.deliveryKey === events[index]?.deliveryKey &&
+        events[index]?.leaseOwner === leaseOwner,
+    )
+  );
+}
+
+/** One SQL owner for the legacy client transaction and the optional server operation. */
+function runLedgerOutboxPrefixClaimSql(
   input: NonNullable<
     Parameters<typeof readPendingPostgresSchedulerOutboxEvents>[1]
   >,
-  options?: Pick<PostgresSchedulerOptions, 'schema'>,
-  acknowledgement?: { eventIds: string[]; targetEventId: string },
-): Promise<{
-  events: PostgresSchedulerOutboxEvent[];
-  deliveredRows: RunLedgerOutboxDeliveredRow[];
-}> {
-  const requestedLimit = Math.floor(input.limit ?? 1);
-  const limit = Number.isFinite(requestedLimit)
-    ? Math.max(1, requestedLimit)
-    : 1;
+  options: Pick<PostgresSchedulerOptions, 'schema'> | undefined,
+  acknowledgement: { eventIds: string[]; targetEventId: string } | undefined,
+  supportsTerminalBatchMarker: boolean,
+  fence?: { runId: string; expectedHeadEventId?: string },
+): string {
   const runId = input.runId?.trim() || null;
-  const leaseOwner = input.leaseOwner?.trim() || null;
-  const leaseSeconds = Math.max(5, Math.min(300, input.leaseSeconds ?? 30));
+  const lockFence = fence
+    ? `current_setting('deepline.run_ledger_outbox_lock', true) = ${escapeLiteral(fence.runId)}`
+    : undefined;
   const pending = (alias: string) =>
     `${alias}.delivered_at IS NULL${
       acknowledgement ? ` AND NOT (${alias}.event_id = ANY($5::text[]))` : ''
@@ -18398,34 +18607,33 @@ async function claimPostgresSchedulerOutboxPrefix(
   // fact makes a single run's burst quadratic. Failed/delayed heads must
   // remain in this seek so they still block their causal successors.
   const seekRunHead = runId !== null && !input.extendOwnedHead;
-  const claim = async (supportsTerminalBatchMarker: boolean) => {
-    const urgentLifecyclePendingSql = (alias: string) =>
-      input.searchOnly === true
-        ? runLedgerTerminalPendingSql(alias, options)
-        : runLedgerUrgentLifecyclePendingSql(
-            alias,
-            options,
-            // Every claimed row belongs to the selected run. An independent
-            // wait probe evaluates once, instead of scanning its backlog for
-            // each row whose delivery batch is being frozen.
-            runId !== null ? '$2::text' : undefined,
-          );
-    // Search is locally indexed and acknowledged; it has no remote ingress
-    // receipt to freeze. Preserve causal ordering/due/lease checks, but admit
-    // its full prefix. Lifecycle ingress prefixes require receiver support.
-    const ingressPrefixSql =
-      input.searchOnly === true
-        ? 'true'
-        : supportsTerminalBatchMarker && input.allowIngressPrefix === true
-          ? `(head.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents})`
-          : 'false';
-    const findSearchBlockersOnce = seekRunHead && input.searchOnly === true;
-    const searchFactColumnsSql = (alias: string) =>
-      `${alias}.event_id, ${alias}.run_id, ${alias}.event_type,
-       ${alias}.created_at, ${alias}.failed_at, ${alias}.next_attempt_at,
-       ${alias}.lease_owner, ${alias}.lease_expires_at,
-       ${supportsTerminalBatchMarker ? `${alias}.delivery_batch_started_at` : 'NULL::timestamptz AS delivery_batch_started_at'}`;
-    const blockingPredecessorSql = (alias: string) => `(
+  const urgentLifecyclePendingSql = (alias: string) =>
+    input.searchOnly === true
+      ? runLedgerTerminalPendingSql(alias, options)
+      : runLedgerUrgentLifecyclePendingSql(
+          alias,
+          options,
+          // Every claimed row belongs to the selected run. An independent
+          // wait probe evaluates once, instead of scanning its backlog for
+          // each row whose delivery batch is being frozen.
+          runId !== null ? '$2::text' : undefined,
+        );
+  // Search is locally indexed and acknowledged; it has no remote ingress
+  // receipt to freeze. Preserve causal ordering/due/lease checks, but admit
+  // its full prefix. Lifecycle ingress prefixes require receiver support.
+  const ingressPrefixSql =
+    input.searchOnly === true
+      ? 'true'
+      : supportsTerminalBatchMarker && input.allowIngressPrefix === true
+        ? `(head.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents})`
+        : 'false';
+  const findSearchBlockersOnce = seekRunHead && input.searchOnly === true;
+  const searchFactColumnsSql = (alias: string) =>
+    `${alias}.event_id, ${alias}.run_id, ${alias}.event_type,
+     ${alias}.created_at, ${alias}.failed_at, ${alias}.next_attempt_at,
+     ${alias}.lease_owner, ${alias}.lease_expires_at,
+     ${supportsTerminalBatchMarker ? `${alias}.delivery_batch_started_at` : 'NULL::timestamptz AS delivery_batch_started_at'}`;
+  const blockingPredecessorSql = (alias: string) => `(
       (${alias}.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents}
        AND NOT (${ingressPrefixSql}))
       OR (${supportsTerminalBatchMarker && input.allowIngressPrefix === true ? `head.delivery_batch_started_at IS NOT NULL AND ${alias}.delivery_batch_started_at IS NULL` : 'false'})
@@ -18438,21 +18646,11 @@ async function claimPostgresSchedulerOutboxPrefix(
         AND ${alias}.lease_owner IS DISTINCT FROM $3::text
       )
     )`;
-    return await client.query<{
-      row_kind: 'claimed' | 'delivered';
-      event_id: string;
-      run_id: string;
-      event_type: string;
-      payload_json: unknown;
-      created_at: Date;
-      delivery_key: string | null;
-      lag_ms: number | string | null;
-    }>(
-      `
+  return `
       WITH ${
         acknowledgement
           ? `delivered AS (
-        ${runLedgerAcknowledgeSql(options, '$5', '$3')}
+        ${runLedgerAcknowledgeSql(options, '$5', '$3', lockFence, runId === null ? undefined : '$2')}
       ),`
           : ''
       } ${
@@ -18486,6 +18684,8 @@ async function claimPostgresSchedulerOutboxPrefix(
         ${seekRunHead ? 'JOIN pending_head ON pending_head.event_id = candidate.event_id' : ''}
         ${input.extendOwnedHead ? 'JOIN owned_run ON owned_run.run_id = candidate.run_id' : ''}
         WHERE ${pending('candidate')}
+          ${lockFence ? `AND (${lockFence})` : ''}
+          ${fence?.expectedHeadEventId ? `AND candidate.event_id = ${escapeLiteral(fence.expectedHeadEventId)}` : ''}
           AND ${searchLaneSql('candidate')} = ${input.searchOnly === true ? 'true' : 'false'}
           ${
             acknowledgement
@@ -18742,7 +18942,9 @@ async function claimPostgresSchedulerOutboxPrefix(
         WHERE outbox.event_id = candidates.event_id
         RETURNING outbox.event_id, outbox.run_id, outbox.event_type,
                   outbox.payload_json, outbox.created_at, outbox.lease_owner,
-                  outbox.delivery_key
+                  outbox.delivery_key,
+                  ${supportsTerminalBatchMarker ? 'outbox.delivery_batch_started_at IS NOT NULL' : 'false'} AS delivery_frozen,
+                  (extract(epoch FROM (outbox.lease_expires_at - statement_timestamp())) * 1000)::float8 AS lease_remaining_ms
       )
       ${
         acknowledgement
@@ -18759,7 +18961,7 @@ async function claimPostgresSchedulerOutboxPrefix(
       SELECT * FROM (
         SELECT 'claimed'::text AS row_kind,
                event_id, run_id, event_type, payload_json, created_at, lease_owner,
-               delivery_key, NULL::float8 AS lag_ms
+               delivery_key, NULL::float8 AS lag_ms, delivery_frozen, lease_remaining_ms
         FROM claimed
         ${
           acknowledgement
@@ -18767,109 +18969,483 @@ async function claimPostgresSchedulerOutboxPrefix(
         SELECT 'delivered'::text AS row_kind,
                event_id, NULL::text AS run_id, event_type, NULL::jsonb AS payload_json,
                NULL::timestamptz AS created_at, NULL::text AS lease_owner,
-               NULL::text AS delivery_key, lag_ms
+               NULL::text AS delivery_key, lag_ms, false AS delivery_frozen, NULL::float8 AS lease_remaining_ms
         FROM notified`
             : ''
         }
       ) AS result
       ORDER BY row_kind, ${runLedgerOrderSql('result')}
-    `,
-      [
-        limit,
-        runId,
-        leaseOwner,
-        leaseSeconds,
-        ...(acknowledgement
-          ? [
-              acknowledgement.eventIds,
-              acknowledgement.targetEventId,
-              postgresSchedulerNotifyChannel('terminal', options),
-            ]
-          : input.extendOwnedHead
-            ? [input.extendOwnedHead]
-            : []),
-      ],
-    );
-  };
-  let result;
-  const useSavepoint =
-    input.inTransaction && !input.restartTransactionOnMissingMarker;
-  if (useSavepoint) await client.query('SAVEPOINT run_ledger_claim');
-  if (supportsOutboxDeliveryBatchMarker(options)) {
-    try {
-      result = await claim(true);
-    } catch (error) {
-      if (!isMissingOutboxDeliveryBatchMarker(error)) throw error;
-      markOutboxDeliveryBatchMarkerUnavailable(options);
-      // The ACK caller owns the whole short transaction. Roll it back and
-      // repeat only this missing-column adapter, avoiding two SAVEPOINT round
-      // trips on every successful acknowledgement.
-      if (acknowledgement || input.restartTransactionOnMissingMarker)
-        throw error;
-      if (useSavepoint)
-        await client.query('ROLLBACK TO SAVEPOINT run_ledger_claim');
-      result = await claim(false);
+    `;
+}
+
+const runLedgerOutboxBatchUnsupportedClients = new WeakSet<object>();
+
+function isUnsupportedRunLedgerOutboxBatch(error: unknown): boolean {
+  return (
+    !!error &&
+    typeof error === 'object' &&
+    'code' in error &&
+    error.code === '42601' &&
+    'message' in error &&
+    error.message ===
+      'cannot insert multiple commands into a prepared statement'
+  );
+}
+
+/** Render only the canonical owner's typed arguments using node-postgres quoting. */
+function runLedgerOutboxPrefixClaimBatchSql(input: {
+  sql: string;
+  schema?: string;
+  params: unknown[];
+  runId: string;
+  waitForRunLock: boolean;
+  lockStrength?: 'no_key_update';
+  transportHeadSql?: string;
+}): string {
+  const encoded = escapeLiteral(JSON.stringify(input.params));
+  const parameter = (index: number) => {
+    const value = input.params[index - 1];
+    if (Array.isArray(value)) {
+      return `(SELECT ARRAY(SELECT jsonb_array_elements_text(values_json->${index - 1})) FROM run_ledger_parameters)`;
     }
-  } else {
-    result = await claim(false);
-  }
-  if (useSavepoint) await client.query('RELEASE SAVEPOINT run_ledger_claim');
-  const events = result.rows
-    .filter((row) => row.row_kind === 'claimed')
-    .map((row) => {
-      if (!row.delivery_key) {
-        throw new Error(
-          `Run-ledger outbox event ${row.event_id} has no delivery key.`,
-        );
-      }
-      return {
-        eventId: row.event_id,
-        runId: row.run_id,
-        eventType: row.event_type,
-        payload: row.payload_json,
-        createdAt: row.created_at,
-        leaseOwner: leaseOwner,
-        deliveryKey: row.delivery_key,
-      };
-    });
-  const deliveredRows = result.rows
-    .filter((row) => row.row_kind === 'delivered')
-    .map((row) => {
-      const lagMs = Number(row.lag_ms);
-      return {
-        eventType: row.event_type,
-        lagMs: Number.isFinite(lagMs) ? Math.max(0, lagMs) : 0,
-      };
-    });
-  return { events, deliveredRows };
+    const type = typeof value === 'number' ? 'integer' : 'text';
+    const encodedParameter = `(SELECT (values_json->>${index - 1})::${type} FROM run_ledger_parameters)`;
+    return index === 1 && input.transportHeadSql
+      ? `(${encodedParameter} - current_setting('deepline.run_ledger_transport_ack_count')::integer)`
+      : encodedParameter;
+  };
+  // Skip quoted identifiers/strings and comments. A run or event ID may
+  // legitimately contain "$1"; only actual bind tokens may be rendered.
+  const claimSql = input.sql
+    .replace(
+      /'(?:[^']|'')*'|"(?:[^"]|"")*"|--[^\n]*|\/\*[\s\S]*?\*\/|\$(\d+)\b/g,
+      (match, index: string | undefined) =>
+        index ? parameter(Number(index)) : match,
+    )
+    .replace(
+      /^\s*WITH\s/,
+      `WITH run_ledger_parameters AS MATERIALIZED (SELECT ${encoded}::jsonb AS values_json), `,
+    );
+  return `BEGIN;
+    SELECT set_config('lock_timeout', '${RUNTIME_SCHEDULER_CANCEL_LOCK_TIMEOUT_MS}ms', true),
+           set_config('statement_timeout', '${RUNTIME_SCHEDULER_CANCEL_STATEMENT_TIMEOUT_MS}ms', true);
+    SELECT set_config('deepline.run_ledger_outbox_lock', coalesce((
+      SELECT run_id FROM ${tableName('runs', { schema: input.schema })}
+      WHERE run_id = ${escapeLiteral(input.runId)} FOR ${input.lockStrength === 'no_key_update' ? 'NO KEY UPDATE' : 'UPDATE'}${input.waitForRunLock ? '' : ' SKIP LOCKED'}
+    ), ''), true);
+    ${input.transportHeadSql ? `SELECT set_config('deepline.run_ledger_transport_ack_count', '0', true);\n    ${input.transportHeadSql};` : ''}
+    ${claimSql};
+    COMMIT;`;
 }
 
 /**
- * Read the exact next moment at which durable outbox work can become claimable.
- *
- * A live lease is not eligible until it expires; an unleased row is eligible at
- * its retry time. The recovery controller uses this to sleep until real work
- * exists instead of having every runtime worker poll the whole outbox.
+ * One simple-protocol request, still separate READ COMMITTED statements. The run
+ * lock and the subsequent claim therefore keep a fresh snapshot after a writer
+ * commits. No transaction or lease checkout is retained over an HTTP append.
  */
-export async function readPostgresSchedulerOutboxNextDueAt(
+async function claimRunLedgerOutboxPrefixInBatch(
   client: PostgresSchedulerQueryClient,
-  options?: Pick<PostgresSchedulerOptions, 'schema'> & {
-    lane?: 'lifecycle' | 'observability';
-    /** Read one notified run's clock instead of enumerating every pending run. */
-    runId?: string;
+  input: NonNullable<
+    Parameters<typeof readPendingPostgresSchedulerOutboxEvents>[1]
+  > & {
+    runId: string;
+    waitForRunLock: boolean;
+    expectedHeadEventId?: string;
+    lockStrength?: 'no_key_update';
+    transportCandidate?: RunLedgerTransportCandidate;
+    recoverTransportDelivery?: boolean;
   },
-): Promise<Date | null> {
-  const lanes =
-    options?.lane === 'lifecycle'
-      ? [false]
-      : options?.lane === 'observability'
-        ? [true]
-        : [false, true];
-  const runId = options?.runId?.trim() || null;
-  const result = await client.query<{ due_at: Date | string | null }>(
-    `
-      -- Seek distinct run identities without reading their pending fact tails.
-      WITH RECURSIVE ${
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+  acknowledgement?: { eventIds: string[]; targetEventId: string },
+): Promise<{
+  events: PostgresSchedulerOutboxEvent[];
+  deliveredRows: RunLedgerOutboxDeliveredRow[];
+  freshClaimLease?: RunLedgerFreshClaimLeaseFacts;
+  transportDelivered?: RunLedgerTransportDelivery;
+  transportOwnershipUnconfirmed?: boolean;
+} | null> {
+  if (
+    runLedgerOutboxBatchUnsupportedClients.has(client) ||
+    !supportsOutboxDeliveryBatchMarker(options)
+  )
+    return null;
+  const leaseOwner = input.leaseOwner?.trim() || null;
+  const requestedLimit = Math.floor(input.limit ?? 1);
+  const limit = Number.isFinite(requestedLimit)
+    ? Math.max(acknowledgement ? 0 : 1, requestedLimit)
+    : 1;
+  const params = [
+    limit,
+    input.runId,
+    leaseOwner,
+    Math.max(5, Math.min(300, input.leaseSeconds ?? 30)),
+    ...(acknowledgement
+      ? [
+          acknowledgement.eventIds,
+          acknowledgement.targetEventId,
+          postgresSchedulerNotifyChannel('terminal', options),
+        ]
+      : input.extendOwnedHead
+        ? [input.extendOwnedHead]
+        : []),
+  ];
+  // Detached parks/resumes have no public ledger effects. Under the existing
+  // run/head locks a never-leased, never-frozen carrier may be acknowledged
+  // locally before the next READ COMMITTED statement claims its successor.
+  // Keep the successor's existing run.events-first receipt shape unchanged.
+  const transportHeadSql =
+    input.transportCandidate !== undefined &&
+    input.allowIngressPrefix === true &&
+    !input.searchOnly &&
+    !input.extendOwnedHead &&
+    !input.expectedHeadEventId &&
+    !acknowledgement &&
+    limit >= 2
+      ? `WITH transport_head AS MATERIALIZED (
+          SELECT pending.* FROM ${tableName('outbox', options)} AS pending
+          WHERE pending.run_id = ${escapeLiteral(input.runId)}
+            AND current_setting('deepline.run_ledger_outbox_lock', true) = ${escapeLiteral(input.runId)}
+            AND pending.delivered_at IS NULL
+            AND NOT ${searchLaneSql('pending')}
+          ORDER BY ${runLedgerOrderSql('pending')}
+          LIMIT 1 FOR UPDATE
+        ), eligible_transport_head AS MATERIALIZED (
+          SELECT head.* FROM transport_head AS head
+          WHERE current_setting('deepline.run_ledger_outbox_lock', true) = ${escapeLiteral(input.runId)}
+            AND head.event_id = ${escapeLiteral(input.transportCandidate!.eventId)}
+            AND head.delivery_key = ${escapeLiteral(input.transportCandidate!.deliveryKey)}
+            AND ${runLedgerZeroEffectTransportSql('head')}
+            AND ${runLedgerTerminalPendingSql('head', options)}
+            AND EXISTS (
+              SELECT 1 FROM (
+                SELECT successor.* FROM ${tableName('outbox', options)} AS successor
+                WHERE successor.run_id = head.run_id AND successor.delivered_at IS NULL
+                  AND NOT ${searchLaneSql('successor')} AND successor.event_id <> head.event_id
+                ORDER BY ${runLedgerOrderSql('successor')} LIMIT 1
+              ) AS successor
+              WHERE successor.failed_at IS NULL
+                AND coalesce(successor.next_attempt_at, successor.created_at) <= now()
+                AND successor.lease_owner IS NULL AND successor.lease_expires_at IS NULL
+            )
+            AND NOT EXISTS (
+              SELECT 1 FROM ${tableName('outbox', options)} AS active
+              WHERE active.run_id = head.run_id AND active.delivered_at IS NULL
+                AND NOT ${searchLaneSql('active')}
+                AND active.lease_owner IS NOT NULL AND active.lease_expires_at > now()
+            )
+        ), delivered AS (
+          ${runLedgerAcknowledgeSql(
+            options,
+            'ARRAY(SELECT event_id FROM eligible_transport_head)',
+            'NULL',
+            `current_setting('deepline.run_ledger_outbox_lock', true) = ${escapeLiteral(input.runId)}`,
+            escapeLiteral(input.runId),
+          )}
+        )${
+          input.recoverTransportDelivery === true
+            ? `, prior_transport AS MATERIALIZED (
+          SELECT prior.event_id, prior.run_id, prior.event_type, prior.delivery_key,
+                 (extract(epoch FROM (prior.delivered_at-prior.created_at))*1000)::float8 AS lag_ms,
+                 to_jsonb(prior)->>'delivery_batch_started_at' IS NULL AND EXISTS (
+                   SELECT 1 FROM ${tableName('outbox', options)} AS successor
+                   WHERE successor.run_id = prior.run_id AND successor.delivered_at IS NULL
+                     AND successor.lease_owner = ${escapeLiteral(leaseOwner!)}
+                     AND successor.lease_expires_at > clock_timestamp()
+                     AND successor.xmin = prior.xmin
+                     AND NOT ${searchLaneSql('successor')}
+                 ) AS owned
+          FROM ${tableName('outbox', options)} AS prior
+          WHERE current_setting('deepline.run_ledger_outbox_lock', true) = ${escapeLiteral(input.runId)}
+            AND prior.run_id = ${escapeLiteral(input.runId)}
+            AND prior.event_id = ${escapeLiteral(input.transportCandidate!.eventId)}
+            AND prior.delivery_key = ${escapeLiteral(input.transportCandidate!.deliveryKey)}
+            AND prior.event_type = ${escapeLiteral(input.transportCandidate!.eventType)}
+            AND prior.delivered_at IS NOT NULL
+            AND NOT EXISTS (SELECT 1 FROM delivered)
+        )`
+            : ''
+        }, transport_deliveries AS MATERIALIZED (
+          SELECT delivered.event_id, head.run_id, delivered.event_type, head.delivery_key, delivered.lag_ms
+          FROM delivered JOIN eligible_transport_head AS head ON head.event_id = delivered.event_id
+          ${
+            input.recoverTransportDelivery === true
+              ? `UNION ALL
+          SELECT event_id,run_id,event_type,delivery_key,lag_ms FROM prior_transport WHERE owned`
+              : ''
+          }
+        )
+        SELECT 'transport_delivered'::text AS row_kind,
+               delivered.event_id, delivered.run_id, delivered.event_type,
+               NULL::jsonb AS payload_json, NULL::timestamptz AS created_at,
+               NULL::text AS lease_owner, delivered.delivery_key, delivered.lag_ms,
+               false AS delivery_frozen, NULL::float8 AS lease_remaining_ms,
+               set_config('deepline.run_ledger_transport_ack_count',
+                          (SELECT count(*) FROM transport_deliveries)::text, true),
+               pg_notify(${escapeLiteral(postgresSchedulerNotifyChannel('terminal', options))},
+                         json_build_object('eventId', delivered.event_id, 'kind', 'outbox_delivered')::text)::text
+        FROM transport_deliveries AS delivered
+        ${
+          input.recoverTransportDelivery === true
+            ? `UNION ALL
+        SELECT 'transport_unconfirmed'::text,event_id,run_id,event_type,NULL::jsonb,NULL::timestamptz,
+               NULL::text,delivery_key,lag_ms,false,NULL::float8,NULL::text,NULL::text
+        FROM prior_transport WHERE NOT owned`
+            : ''
+        }`
+      : undefined;
+  let result: QueryResult<RunLedgerOutboxPrefixClaimRow>;
+  try {
+    // No parameters: node-postgres sends the whole transaction through the
+    // simple protocol, with all values escaped by its own literal encoder.
+    result = await client.query<RunLedgerOutboxPrefixClaimRow>(
+      runLedgerOutboxPrefixClaimBatchSql({
+        sql: runLedgerOutboxPrefixClaimSql(
+          input,
+          options,
+          acknowledgement,
+          true,
+          {
+            runId: input.runId,
+            expectedHeadEventId: input.expectedHeadEventId,
+          },
+        ),
+        params,
+        runId: input.runId,
+        waitForRunLock: input.waitForRunLock,
+        lockStrength: input.lockStrength,
+        schema: options?.schema,
+        transportHeadSql,
+      }),
+    );
+  } catch (error) {
+    if (isUnsupportedRunLedgerOutboxBatch(error)) {
+      // This exact parse rejection precedes execution of BEGIN. An extended-
+      // protocol test driver keeps the existing adapter for this checkout.
+      runLedgerOutboxBatchUnsupportedClients.add(client);
+      return null;
+    }
+    try {
+      await client.query('ROLLBACK');
+    } catch (rollbackError) {
+      console.error('[run-ledger-outbox.batch_rollback_failed]', {
+        error: errorMessage(error),
+        rollbackError: errorMessage(rollbackError),
+      });
+      throw error;
+    }
+    if (!isMissingOutboxDeliveryBatchMarker(error)) throw error;
+    markOutboxDeliveryBatchMarkerUnavailable(options);
+    return null;
+  }
+  // pg returns every command result; adapters may already flatten their rows.
+  // SET/lock/COMMIT rows never enter the claim projection.
+  const results: QueryResult<RunLedgerOutboxPrefixClaimRow>[] = Array.isArray(
+    result,
+  )
+    ? result
+    : [result];
+  return projectRunLedgerOutboxPrefixRows(
+    results
+      .flatMap((entry) => entry.rows)
+      .filter(
+        (row) =>
+          row.row_kind === 'claimed' ||
+          row.row_kind === 'delivered' ||
+          row.row_kind === 'transport_delivered' ||
+          row.row_kind === 'transport_unconfirmed',
+      ),
+    leaseOwner,
+  );
+}
+
+async function claimPostgresSchedulerOutboxPrefix(
+  client: PostgresSchedulerQueryClient,
+  input: NonNullable<
+    Parameters<typeof readPendingPostgresSchedulerOutboxEvents>[1]
+  >,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+  acknowledgement?: { eventIds: string[]; targetEventId: string },
+): Promise<{
+  events: PostgresSchedulerOutboxEvent[];
+  deliveredRows: RunLedgerOutboxDeliveredRow[];
+  freshClaimLease?: RunLedgerFreshClaimLeaseFacts;
+}> {
+  const requestedLimit = Math.floor(input.limit ?? 1);
+  const limit = Number.isFinite(requestedLimit)
+    ? Math.max(1, requestedLimit)
+    : 1;
+  const runId = input.runId?.trim() || null;
+  const leaseOwner = input.leaseOwner?.trim() || null;
+  const leaseSeconds = Math.max(5, Math.min(300, input.leaseSeconds ?? 30));
+  const claim = async (supportsTerminalBatchMarker: boolean) => {
+    return await client.query<RunLedgerOutboxPrefixClaimRow>(
+      runLedgerOutboxPrefixClaimSql(
+        input,
+        options,
+        acknowledgement,
+        supportsTerminalBatchMarker,
+      ),
+      [
+        limit,
+        runId,
+        leaseOwner,
+        leaseSeconds,
+        ...(acknowledgement
+          ? [
+              acknowledgement.eventIds,
+              acknowledgement.targetEventId,
+              postgresSchedulerNotifyChannel('terminal', options),
+            ]
+          : input.extendOwnedHead
+            ? [input.extendOwnedHead]
+            : []),
+      ],
+    );
+  };
+  let result;
+  const useSavepoint =
+    input.inTransaction && !input.restartTransactionOnMissingMarker;
+  if (useSavepoint) await client.query('SAVEPOINT run_ledger_claim');
+  if (supportsOutboxDeliveryBatchMarker(options)) {
+    try {
+      result = await claim(true);
+    } catch (error) {
+      if (!isMissingOutboxDeliveryBatchMarker(error)) throw error;
+      markOutboxDeliveryBatchMarkerUnavailable(options);
+      // The ACK caller owns the whole short transaction. Roll it back and
+      // repeat only this missing-column adapter, avoiding two SAVEPOINT round
+      // trips on every successful acknowledgement.
+      if (acknowledgement || input.restartTransactionOnMissingMarker)
+        throw error;
+      if (useSavepoint)
+        await client.query('ROLLBACK TO SAVEPOINT run_ledger_claim');
+      result = await claim(false);
+    }
+  } else {
+    result = await claim(false);
+  }
+  if (useSavepoint) await client.query('RELEASE SAVEPOINT run_ledger_claim');
+  return projectRunLedgerOutboxPrefixRows(result.rows, leaseOwner);
+}
+
+function projectRunLedgerOutboxPrefixRows(
+  rows: RunLedgerOutboxPrefixClaimRow[],
+  leaseOwner: string | null,
+): {
+  events: PostgresSchedulerOutboxEvent[];
+  deliveredRows: RunLedgerOutboxDeliveredRow[];
+  freshClaimLease?: RunLedgerFreshClaimLeaseFacts;
+  transportDelivered?: RunLedgerTransportDelivery;
+  transportOwnershipUnconfirmed?: boolean;
+} {
+  const events = rows
+    .filter((row) => row.row_kind === 'claimed')
+    .map((row) => {
+      if (!row.delivery_key) {
+        throw new Error(
+          `Run-ledger outbox event ${row.event_id} has no delivery key.`,
+        );
+      }
+      return {
+        eventId: row.event_id,
+        runId: row.run_id,
+        eventType: row.event_type,
+        payload: row.payload_json,
+        createdAt: row.created_at,
+        leaseOwner: leaseOwner,
+        deliveryKey: row.delivery_key,
+      };
+    });
+  const deliveredRows = rows
+    .filter((row) => row.row_kind === 'delivered')
+    .map((row) => {
+      const lagMs = Number(row.lag_ms);
+      return {
+        eventType: row.event_type,
+        lagMs: Number.isFinite(lagMs) ? Math.max(0, lagMs) : 0,
+      };
+    });
+  const claimedRows = rows.filter((row) => row.row_kind === 'claimed');
+  const remainingLeases = claimedRows.map((row) =>
+    typeof row.lease_remaining_ms === 'number' ||
+    (typeof row.lease_remaining_ms === 'string' &&
+      row.lease_remaining_ms.trim())
+      ? Number(row.lease_remaining_ms)
+      : NaN,
+  );
+  const freshClaimLease =
+    leaseOwner &&
+    claimedRows.length > 0 &&
+    claimedRows.every(
+      (row) => row.lease_owner === leaseOwner && row.delivery_frozen === true,
+    ) &&
+    remainingLeases.every(
+      (remaining) => Number.isFinite(remaining) && remaining > 0,
+    )
+      ? {
+          leaseOwner,
+          prefix: events.map(({ eventId, deliveryKey }) => ({
+            eventId,
+            deliveryKey,
+          })),
+          remainingLeaseMs: Math.floor(
+            remainingLeases.reduce(
+              (minimum, remaining) => Math.min(minimum, remaining),
+              Infinity,
+            ),
+          ),
+        }
+      : undefined;
+  const transportRows = rows.filter(
+    (row) => row.row_kind === 'transport_delivered',
+  );
+  return {
+    events,
+    deliveredRows,
+    ...(freshClaimLease ? { freshClaimLease } : {}),
+    ...(rows.some((row) => row.row_kind === 'transport_unconfirmed')
+      ? { transportOwnershipUnconfirmed: true }
+      : {}),
+    ...(transportRows.length > 0
+      ? {
+          transportDelivered: {
+            eventIds: transportRows.map((row) => row.event_id),
+            deliveries: transportRows.map((row) => ({
+              eventType: row.event_type,
+              lagMs: Math.max(0, Number(row.lag_ms) || 0),
+            })),
+          },
+        }
+      : {}),
+  };
+}
+
+/**
+ * Read the exact next moment at which durable outbox work can become claimable.
+ *
+ * A live lease is not eligible until it expires; an unleased row is eligible at
+ * its retry time. The recovery controller uses this to sleep until real work
+ * exists instead of having every runtime worker poll the whole outbox.
+ */
+export async function readPostgresSchedulerOutboxNextDueAt(
+  client: PostgresSchedulerQueryClient,
+  options?: Pick<PostgresSchedulerOptions, 'schema'> & {
+    lane?: 'lifecycle' | 'observability';
+    /** Read one notified run's clock instead of enumerating every pending run. */
+    runId?: string;
+  },
+): Promise<Date | null> {
+  const lanes =
+    options?.lane === 'lifecycle'
+      ? [false]
+      : options?.lane === 'observability'
+        ? [true]
+        : [false, true];
+  const runId = options?.runId?.trim() || null;
+  const result = await client.query<{ due_at: Date | string | null }>(
+    `
+      -- Seek distinct run identities without reading their pending fact tails.
+      WITH RECURSIVE ${
         runId
           ? 'pending_runs AS (SELECT $1::text AS run_id)'
           : runLedgerPendingRunsSql(
@@ -19414,11 +19990,17 @@ export async function markPostgresSchedulerOutboxDelivered(
   ).length;
 }
 
-/** Shared lease-fenced ACK, including the canonical retained-payload cleanup. */
+/**
+ * Shared lease-fenced ACK, including the canonical retained-payload cleanup.
+ * Known-run callers keep that scope visible to the planner: a materialized ID
+ * array alone can make stale pending-index statistics favor a cross-run scan.
+ */
 function runLedgerAcknowledgeSql(
   options: Pick<PostgresSchedulerOptions, 'schema'> | undefined,
   eventIdsParameter: string,
   leaseOwnerParameter: string,
+  lockFence?: string,
+  runIdParameter?: string,
 ): string {
   return `UPDATE ${tableName('outbox', options)} AS outbox
         SET delivered_at = now(),
@@ -19432,6 +20014,8 @@ function runLedgerAcknowledgeSql(
                  AND run.run_event_store = 'planet_scale'
             ) THEN '{}'::jsonb ELSE outbox.payload_json END
         WHERE outbox.event_id = ANY(${eventIdsParameter}::text[])
+          ${runIdParameter ? `AND outbox.run_id = ${runIdParameter}::text` : ''}
+          ${lockFence ? `AND (${lockFence})` : ''}
           AND outbox.delivered_at IS NULL
           AND (${leaseOwnerParameter}::text IS NULL OR outbox.lease_owner = ${leaseOwnerParameter})
         RETURNING outbox.event_id,
@@ -20373,6 +20957,18 @@ async function dispatchRunLedgerOutboxBatchWithScope(
          ELSE ${runLedgerDispatchLaunchSql('runs')}
        END`
     : 'NULL::jsonb';
+  const transportHeadSelection =
+    tokenAuthority === 'gateway' &&
+    !input.searchOnly &&
+    !input.headEventId &&
+    (input.limit ?? 1) >= 2
+      ? `(SELECT CASE WHEN ${runLedgerZeroEffectTransportSql('transport')} THEN
+         jsonb_build_object('eventId', transport.event_id, 'eventType', transport.event_type, 'deliveryKey', transport.delivery_key)
+         ELSE NULL::jsonb END
+       FROM ${tableName('outbox', options)} AS transport
+       WHERE transport.run_id = runs.run_id AND transport.delivered_at IS NULL AND NOT ${searchLaneSql('transport')}
+       ORDER BY ${runLedgerOrderSql('transport')} LIMIT 1)`
+      : 'NULL::jsonb';
   const continuation: { current: RunLedgerOutboxDrainScope | null } = {
     current: scope ?? null,
   };
@@ -20412,88 +21008,25 @@ async function dispatchRunLedgerOutboxBatchWithScope(
   // An abandoned attempt that already handed its lease back on a checkout it
   // held does not spend another checkout on the same release.
   const abandonedLease = { released: false };
-  const claimEvents = async (client: PostgresSchedulerQueryClient) => {
-    claimInvocations += 1;
-    const abandonedHeadEventId = input.headEventId?.trim();
-    if (
-      input.signal?.aborted &&
-      (claimInvocations === 1 || abandonedHeadEventId)
-    ) {
-      // The caller's deadline elapsed while this checkout was queued. Its
-      // attempt is already abandoned, so taking a lease now could only keep
-      // the durable projector off the row until that lease expires. Claim
-      // nothing: the row stays pending and unleased for its next owner.
-      if (claimInvocations > 1 && abandonedHeadEventId) {
-        // An earlier invocation's COMMIT may have reached the server before
-        // its connection failed, so this owner can already hold the named
-        // head. Hand it back here, fenced to this owner; returning empty
-        // would leave that lease with nobody to release it. After a rolled
-        // back invocation it matches no row. A failure propagates, so the
-        // attempt is never reported as settled.
-        await releasePostgresSchedulerOutboxLease(
-          client,
-          [abandonedHeadEventId],
-          { ...options, leaseOwner },
-        );
-      }
-      const unclaimed: {
-        events: PostgresSchedulerOutboxEvent[];
-        launchJson: unknown;
-        ingressPrefixClaimed: boolean;
-      } = { events: [], launchJson: undefined, ingressPrefixClaimed: false };
-      return unclaimed;
-    }
-    // A re-invocation with no named head claims again under the same owner,
-    // as it always has; the abort check after the claim releases by id.
-    // The checkout is exclusive. Hold the existing scheduler run's row lock
-    // only while choosing/claiming its outbox prefix, never over HTTP. A
-    // second statement takes a fresh READ COMMITTED snapshot after the lock:
-    // late producer commits cannot split one run between different heads.
-    await client.query('BEGIN');
-    try {
-      const targetRunId = input.runId?.trim() || null;
-      let lockedRun: {
-        rows: { run_id: string; dispatch_launch_json: unknown }[];
-      } | null = null;
-      if (input.waitForRunLock && targetRunId) {
-        // A synchronous drain must not mistake a busy run for an empty
-        // outbox. In particular, cancellation owns its pending prefix lease,
-        // so returning early also prevents background recovery from helping.
-        // Wait only for this run, under the existing cancellation SQL budget,
-        // then select the prefix using a fresh READ COMMITTED snapshot. The
-        // transaction still ends before HTTP; background claims keep SKIP LOCKED.
-        await client.query(
-          `SELECT set_config('lock_timeout', $1, true),
-                  set_config('statement_timeout', $2, true)`,
-          [
-            `${RUNTIME_SCHEDULER_CANCEL_LOCK_TIMEOUT_MS}ms`,
-            `${RUNTIME_SCHEDULER_CANCEL_STATEMENT_TIMEOUT_MS}ms`,
-          ],
-        );
-        lockedRun = await client.query<{
-          run_id: string;
-          dispatch_launch_json: unknown;
-        }>(
-          `SELECT runs.run_id,
-                  ${needsLaunch ? runLedgerDispatchLaunchSql('runs') : 'NULL::jsonb'} AS dispatch_launch_json
-           FROM ${tableName('runs', options)} AS runs
-           WHERE runs.run_id = $1 FOR UPDATE`,
-          [targetRunId],
-        );
-      }
-      // A worker fast path always names one run. Keep that lookup on the
-      // run-scoped outbox prefix: combining it with global recovery through a
-      // nullable predicate made PostgreSQL materialize every pending run head
-      // for each lifecycle transition. Only the two dedicated projectors may
-      // perform the global indexed head discovery below.
-      const selected =
-        (input.headEventId ? null : lockedRun) ??
-        (targetRunId
-          ? await client.query<{
-              run_id: string;
-              dispatch_launch_json: unknown;
-            }>(
-              `
+  const selectRunForClaim = async (
+    client: PostgresSchedulerQueryClient,
+    targetRunId: string | null,
+    lockedRun: {
+      rows: {
+        run_id: string;
+        dispatch_launch_json: unknown;
+        transport_head?: RunLedgerTransportCandidate | null;
+      }[];
+    } | null = null,
+  ) => {
+    return await ((input.headEventId ? null : lockedRun) ??
+      (targetRunId
+        ? await client.query<{
+            run_id: string;
+            dispatch_launch_json: unknown;
+            transport_head?: RunLedgerTransportCandidate | null;
+          }>(
+            `
             WITH head AS MATERIALIZED (
               SELECT pending.run_id,
                      pending.event_id,
@@ -20509,7 +21042,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
               ORDER BY ${runLedgerOrderSql('pending')}
               LIMIT 1
             )
-            SELECT runs.run_id, ${launchSelection} AS dispatch_launch_json
+            SELECT runs.run_id, ${launchSelection} AS dispatch_launch_json, ${transportHeadSelection} AS transport_head
             FROM head
             JOIN ${tableName('runs', options)} AS runs ON runs.run_id = head.run_id
             WHERE head.failed_at IS NULL
@@ -20526,12 +21059,13 @@ async function dispatchRunLedgerOutboxBatchWithScope(
               )
             FOR UPDATE OF runs SKIP LOCKED
           `,
-              [targetRunId, leaseOwner, input.headEventId?.trim() || null],
-            )
-          : await client.query<{
-              run_id: string;
-              dispatch_launch_json: unknown;
-            }>(`
+            [targetRunId, leaseOwner, input.headEventId?.trim() || null],
+          )
+        : await client.query<{
+            run_id: string;
+            dispatch_launch_json: unknown;
+            transport_head?: RunLedgerTransportCandidate | null;
+          }>(`
             WITH RECURSIVE ${runLedgerPendingRunsSql(options, input.searchOnly === true)}, heads AS MATERIALIZED (
               SELECT pending_run.run_id, head.*
               FROM pending_runs AS pending_run
@@ -20550,7 +21084,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
                 LIMIT 1
               ) AS head
             )
-            SELECT runs.run_id, ${launchSelection} AS dispatch_launch_json
+            SELECT runs.run_id, ${launchSelection} AS dispatch_launch_json, ${transportHeadSelection} AS transport_head
             FROM heads AS head
             JOIN ${tableName('runs', options)} AS runs ON runs.run_id = head.run_id
             WHERE head.failed_at IS NULL
@@ -20579,29 +21113,192 @@ async function dispatchRunLedgerOutboxBatchWithScope(
             }
                      head.created_at, runs.run_id
             FOR UPDATE OF runs SKIP LOCKED LIMIT 1
-          `));
-      const runId = selected.rows[0]?.run_id;
-      let ingressPrefixClaimed = false;
-      if (
-        runId &&
-        tokenAuthority === 'gateway' &&
-        !input.searchOnly &&
-        (input.limit ?? 1) === ingressPrefixLimit
-      ) {
-        try {
-          const launch = parseRunLedgerDispatchLaunch(
-            selected.rows[0]?.dispatch_launch_json,
-          );
-          ingressPrefixClaimed =
-            launch.runId === runId &&
-            usableRunLedgerExecutorToken(launch, reuseMarginMs, options)
-              ?.runLedgerIngressPrefixBatching === true;
-        } catch {
-          // Malformed launches retain the existing post-claim failure policy.
-        }
+          `)));
+  };
+  const ingressPrefixSupported = (selected: {
+    rows: {
+      run_id: string;
+      dispatch_launch_json: unknown;
+      transport_head?: RunLedgerTransportCandidate | null;
+    }[];
+  }) => {
+    const runId = selected.rows[0]?.run_id;
+    if (
+      runId &&
+      tokenAuthority === 'gateway' &&
+      !input.searchOnly &&
+      (input.limit ?? 1) === ingressPrefixLimit
+    ) {
+      try {
+        const launch = parseRunLedgerDispatchLaunch(
+          selected.rows[0]?.dispatch_launch_json,
+        );
+        return (
+          launch.runId === runId &&
+          usableRunLedgerExecutorToken(launch, reuseMarginMs, options)
+            ?.runLedgerIngressPrefixBatching === true
+        );
+      } catch {
+        // Malformed launches retain the existing post-claim failure policy.
       }
+    }
+    return false;
+  };
+  // Retain a chosen run across a checkout's connection retry: an ambiguous
+  // committed claim must be reread under the same owner rather than abandoned
+  // by a global scan that now sees its own active lease.
+  let selectedFastRun: {
+    rows: {
+      run_id: string;
+      dispatch_launch_json: unknown;
+      transport_head?: RunLedgerTransportCandidate | null;
+    }[];
+  } | null = null;
+  const claimFastEvents = async (client: PostgresSchedulerQueryClient) => {
+    if (
+      runLedgerOutboxBatchUnsupportedClients.has(client) ||
+      !supportsOutboxDeliveryBatchMarker(options) ||
+      input.signal?.aborted
+    )
+      return null;
+    const targetRunId = input.runId?.trim() || null;
+    const selected =
+      selectedFastRun ??
+      (input.waitForRunLock && targetRunId
+        ? await client.query<{
+            run_id: string;
+            dispatch_launch_json: unknown;
+            transport_head?: RunLedgerTransportCandidate | null;
+          }>(
+            `SELECT runs.run_id, ${needsLaunch ? runLedgerDispatchLaunchSql('runs') : 'NULL::jsonb'} AS dispatch_launch_json, ${transportHeadSelection} AS transport_head
+             FROM ${tableName('runs', options)} AS runs WHERE runs.run_id = $1`,
+            [targetRunId],
+          )
+        : await selectRunForClaim(client, targetRunId));
+    const runId = selected.rows[0]?.run_id;
+    if (!runId)
+      return {
+        events: [],
+        launchJson: undefined,
+        ingressPrefixClaimed: false,
+        freshClaimLease: undefined,
+        transportDelivered: undefined,
+        transportOwnershipUnconfirmed: undefined,
+      };
+    selectedFastRun = selected;
+    const ingressPrefixClaimed = ingressPrefixSupported(selected);
+    claimInvocations += 1;
+    const result = await claimRunLedgerOutboxPrefixInBatch(
+      client,
+      {
+        runId,
+        leaseOwner,
+        leaseSeconds: input.leaseSeconds ?? 120,
+        limit: input.limit ?? 1,
+        searchOnly: input.searchOnly,
+        allowIngressPrefix: ingressPrefixClaimed,
+        waitForRunLock: input.waitForRunLock === true,
+        expectedHeadEventId: input.headEventId?.trim() || undefined,
+        transportCandidate:
+          !input.headEventId && ingressPrefixClaimed
+            ? (selected.rows[0]?.transport_head ?? undefined)
+            : undefined,
+        recoverTransportDelivery: claimInvocations > 1,
+      },
+      options,
+    );
+    if (result === null) return null;
+    return {
+      events: result.events,
+      launchJson: selected.rows[0]?.dispatch_launch_json,
+      ingressPrefixClaimed,
+      freshClaimLease: result.freshClaimLease,
+      transportDelivered: result.transportDelivered,
+      transportOwnershipUnconfirmed: result.transportOwnershipUnconfirmed,
+    };
+  };
+  const claimEvents = async (client: PostgresSchedulerQueryClient) => {
+    claimInvocations += 1;
+    const abandonedHeadEventId = input.headEventId?.trim();
+    if (
+      input.signal?.aborted &&
+      (claimInvocations === 1 || abandonedHeadEventId)
+    ) {
+      // The caller's deadline elapsed while this checkout was queued. Its
+      // attempt is already abandoned, so taking a lease now could only keep
+      // the durable projector off the row until that lease expires. Claim
+      // nothing: the row stays pending and unleased for its next owner.
+      if (claimInvocations > 1 && abandonedHeadEventId) {
+        // An earlier invocation's COMMIT may have reached the server before
+        // its connection failed, so this owner can already hold the named
+        // head. Hand it back here, fenced to this owner; returning empty
+        // would leave that lease with nobody to release it. After a rolled
+        // back invocation it matches no row. A failure propagates, so the
+        // attempt is never reported as settled.
+        await releasePostgresSchedulerOutboxLease(
+          client,
+          [abandonedHeadEventId],
+          { ...options, leaseOwner },
+        );
+      }
+      const unclaimed: {
+        events: PostgresSchedulerOutboxEvent[];
+        launchJson: unknown;
+        ingressPrefixClaimed: boolean;
+        freshClaimLease?: RunLedgerFreshClaimLeaseFacts;
+        transportDelivered?: RunLedgerTransportDelivery;
+        transportOwnershipUnconfirmed?: boolean;
+      } = { events: [], launchJson: undefined, ingressPrefixClaimed: false };
+      return unclaimed;
+    }
+    // A re-invocation with no named head claims again under the same owner,
+    // as it always has; the abort check after the claim releases by id.
+    // The checkout is exclusive. Hold the existing scheduler run's row lock
+    // only while choosing/claiming its outbox prefix, never over HTTP. A
+    // second statement takes a fresh READ COMMITTED snapshot after the lock:
+    // late producer commits cannot split one run between different heads.
+    await client.query('BEGIN');
+    try {
+      const targetRunId = input.runId?.trim() || null;
+      let lockedRun: {
+        rows: { run_id: string; dispatch_launch_json: unknown }[];
+      } | null = null;
+      if (input.waitForRunLock && targetRunId) {
+        // A synchronous drain must not mistake a busy run for an empty
+        // outbox. In particular, cancellation owns its pending prefix lease,
+        // so returning early also prevents background recovery from helping.
+        // Wait only for this run, under the existing cancellation SQL budget,
+        // then select the prefix using a fresh READ COMMITTED snapshot. The
+        // transaction still ends before HTTP; background claims keep SKIP LOCKED.
+        await client.query(
+          `SELECT set_config('lock_timeout', $1, true),
+                  set_config('statement_timeout', $2, true)`,
+          [
+            `${RUNTIME_SCHEDULER_CANCEL_LOCK_TIMEOUT_MS}ms`,
+            `${RUNTIME_SCHEDULER_CANCEL_STATEMENT_TIMEOUT_MS}ms`,
+          ],
+        );
+        lockedRun = await client.query<{
+          run_id: string;
+          dispatch_launch_json: unknown;
+        }>(
+          `SELECT runs.run_id,
+                  ${needsLaunch ? runLedgerDispatchLaunchSql('runs') : 'NULL::jsonb'} AS dispatch_launch_json
+           FROM ${tableName('runs', options)} AS runs
+           WHERE runs.run_id = $1 FOR UPDATE`,
+          [targetRunId],
+        );
+      }
+      // A worker fast path always names one run. Keep that lookup on the
+      // run-scoped outbox prefix: combining it with global recovery through a
+      // nullable predicate made PostgreSQL materialize every pending run head
+      // for each lifecycle transition. Only the two dedicated projectors may
+      // perform the global indexed head discovery below.
+      const selected = await selectRunForClaim(client, targetRunId, lockedRun);
+      const runId = selected.rows[0]?.run_id;
+      const ingressPrefixClaimed = ingressPrefixSupported(selected);
       const claimed = runId
-        ? await readPendingPostgresSchedulerOutboxEvents(
+        ? await claimPostgresSchedulerOutboxPrefix(
             client,
             {
               limit: input.limit ?? 1,
@@ -20615,16 +21312,19 @@ async function dispatchRunLedgerOutboxBatchWithScope(
             },
             options,
           )
-        : [];
+        : { events: [], freshClaimLease: undefined };
       await client.query('COMMIT');
       // The launch is immutable. Carry only its authority/routing fields from
       // the run we already locked, rather than queuing another scarce checkout
       // between the claim and gateway request. The gateway still proves the
       // active outbox lease; no database checkout spans either HTTP hop.
       return {
-        events: claimed,
+        events: claimed.events,
         launchJson: selected.rows[0]?.dispatch_launch_json,
         ingressPrefixClaimed,
+        freshClaimLease: claimed.freshClaimLease,
+        transportDelivered: undefined,
+        transportOwnershipUnconfirmed: undefined,
       };
     } catch (error) {
       await client.query('ROLLBACK');
@@ -20634,9 +21334,19 @@ async function dispatchRunLedgerOutboxBatchWithScope(
   const preclaimed = scope?.nextClaimed.length
     ? scope.nextClaimed.splice(0)
     : null;
+  const claimStartedAtMonotonicMs = performance.now();
   const claimed = preclaimed
-    ? { events: preclaimed, launchJson: null, ingressPrefixClaimed: false }
+    ? {
+        events: preclaimed,
+        launchJson: null,
+        ingressPrefixClaimed: false,
+        freshClaimLease: undefined,
+        transportDelivered: undefined,
+        transportOwnershipUnconfirmed: undefined,
+      }
     : await withClient(async (client) => {
+        const fast = await claimFastEvents(client);
+        if (fast !== null) return fast;
         try {
           return await claimEvents(client);
         } catch (error) {
@@ -20646,10 +21356,58 @@ async function dispatchRunLedgerOutboxBatchWithScope(
           return claimEvents(client);
         }
       });
+  const claimReceivedAtMonotonicMs = performance.now();
+  // Debit the complete admission/claim/COMMIT round trip, even though SQL's
+  // lease observation occurred later. This is a conservative local proof.
+  const claimElapsedMs = claimReceivedAtMonotonicMs - claimStartedAtMonotonicMs;
+  let freshClaimFirstHttpProof: RunLedgerFreshClaimFirstHttpProof | null =
+    claimed.freshClaimLease &&
+    Number.isFinite(claimElapsedMs) &&
+    claimElapsedMs >= 0
+      ? {
+          ...claimed.freshClaimLease,
+          remainingLeaseMs: Math.floor(
+            claimed.freshClaimLease.remainingLeaseMs - claimElapsedMs,
+          ),
+          receivedAtMonotonicMs: claimReceivedAtMonotonicMs,
+        }
+      : null;
   const { launchJson } = claimed;
+  const transportDelivered = claimed.transportDelivered;
+  const withTransportDelivered = (
+    result: PostgresSchedulerOutboxProjectionResult,
+  ): PostgresSchedulerOutboxProjectionResult =>
+    transportDelivered
+      ? {
+          ...result,
+          attempted: transportDelivered.eventIds.length + result.attempted,
+          projected: transportDelivered.eventIds.length + result.projected,
+          eventIds: [...transportDelivered.eventIds, ...result.eventIds],
+        }
+      : result;
+  if (transportDelivered && input.onDelivered) {
+    try {
+      input.onDelivered(transportDelivered.deliveries);
+    } catch (error) {
+      console.warn('[run-ledger-outbox.delivery_observer_failed]', {
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
   let events = claimed.events;
+  const unconfirmedTransportError = claimed.transportOwnershipUnconfirmed
+    ? new RunLedgerProjectionLeaseLostError('delivery_lease_not_current')
+    : null;
+  if (unconfirmedTransportError)
+    console.error('[run-ledger-outbox.batch_dispatch_failed]', {
+      runId: input.runId ?? events[0]?.runId ?? null,
+      code: runLedgerDeliveryFailure({ error: unconfirmedTransportError }).code,
+      failureReason: unconfirmedTransportError.reason,
+      error: 'Local transport ACK transaction ownership is unconfirmed.',
+      eventIds: events.map((event) => event.eventId),
+    });
   if (events.length === 0) {
-    return {
+    return withTransportDelivered({
       attempted: 0,
       projected: 0,
       eventIds: [],
@@ -20657,7 +21415,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       failedEventIds: [],
       retrying: 0,
       retryingEventIds: [],
-    };
+    });
   }
 
   const claimedAtMs = Date.now();
@@ -20694,6 +21452,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
           ) === true,
       )
     ) {
+      freshClaimFirstHttpProof = null;
       if (!input.materializeObservability) {
         // Inline admission/lifecycle/read-heal paths must never index logs.
         // Release and wake the existing projector without charging a retry.
@@ -20817,11 +21576,12 @@ async function dispatchRunLedgerOutboxBatchWithScope(
     // any authority or renewal work. The abort branch below hands the lease
     // straight back without charging a projection attempt.
     input.signal?.throwIfAborted();
+    if (unconfirmedTransportError) throw unconfirmedTransportError;
     // The ledger converter rejects raw deferred facts. Inline callers hand
     // them off; the background owner projects them before inspecting the
     // compact lifecycle payload or deciding that it needs no HTTP append.
     const initialHandedOff = await materializeDeferredObservability();
-    if (initialHandedOff) return initialHandedOff;
+    if (initialHandedOff) return withTransportDelivered(initialHandedOff);
     if (input.searchOnly) {
       if (
         events.some(
@@ -21005,6 +21765,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       events.length === 1 &&
       first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents
     ) {
+      freshClaimFirstHttpProof = null;
       const widen = async (client: PostgresSchedulerQueryClient) => {
         await client.query('BEGIN');
         try {
@@ -21045,6 +21806,21 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         }
       };
       const widened = await withClient(async (client) => {
+        const fast = await claimRunLedgerOutboxPrefixInBatch(
+          client,
+          {
+            runId: first.runId,
+            leaseOwner,
+            leaseSeconds: input.leaseSeconds ?? 120,
+            limit: ingressPrefixLimit,
+            allowIngressPrefix: true,
+            extendOwnedHead: first.eventId,
+            waitForRunLock: true,
+            lockStrength: 'no_key_update',
+          },
+          options,
+        );
+        if (fast !== null) return fast.events;
         try {
           return await widen(client);
         } catch (error) {
@@ -21062,13 +21838,17 @@ async function dispatchRunLedgerOutboxBatchWithScope(
     // Widening can add deferred facts to the lease. Project the complete
     // frozen prefix before any HTTP append, including its newly claimed rows.
     const handedOff = await materializeDeferredObservability();
-    if (handedOff) return handedOff;
+    if (handedOff) return withTransportDelivered(handedOff);
     if (ledgerEvents !== null) {
       ledgerEvents = events.flatMap(
         buildRunLedgerEventsFromPostgresSchedulerOutbox,
       );
     }
+    let firstHttpRenewal = true;
     const renewDelivery = async () => {
+      const firstRenewal = firstHttpRenewal;
+      firstHttpRenewal = false;
+      let authorityRefreshed = false;
       const currentAuthority = authorityScope.authority;
       if (
         runtimeApi &&
@@ -21080,6 +21860,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       ) {
         // Initial delivery reuses the claim's routing fields. Renewal must
         // reread authority so an origin change cannot pass under that cache.
+        authorityRefreshed = true;
         const refreshed = await loadPostgresSchedulerRuntimeApiForRun(
           withClient,
           first.runId,
@@ -21106,6 +21887,26 @@ async function dispatchRunLedgerOutboxBatchWithScope(
           expiresAtMs: runtimeApiTokenExpiresAtMs(runtimeApi.executorToken),
         };
       }
+      if (
+        firstRenewal &&
+        terminalRunId === first.runId &&
+        tokenAuthority === 'gateway' &&
+        runtimeApi?.runLedgerIngressPrefixBatching === true &&
+        ledgerEvents !== null &&
+        !authorityRefreshed &&
+        !input.signal?.aborted &&
+        !runtimeApi.signal?.aborted &&
+        freshRunLedgerClaimCoversFirstHttp(
+          freshClaimFirstHttpProof,
+          events,
+          leaseOwner,
+          reuseMarginMs,
+        )
+      ) {
+        // The claim already froze this exact receipt and supplied enough live
+        // lease for HTTP plus SQL. The receiver still validates ownership.
+        return;
+      }
       const renewed = await withClient(async (client) => {
         const eventIds = events.map((event) => event.eventId);
         if (input.signal?.aborted) {
@@ -21251,18 +22052,19 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         });
       }
     }
-    const delivered: PostgresSchedulerOutboxProjectionResult = {
-      attempted: events.length,
-      projected: markedDelivered,
-      eventIds:
-        markedDelivered === events.length
-          ? events.map((event) => event.eventId)
-          : [],
-      failed: 0,
-      failedEventIds: [],
-      retrying: 0,
-      retryingEventIds: [],
-    };
+    const delivered: PostgresSchedulerOutboxProjectionResult =
+      withTransportDelivered({
+        attempted: events.length,
+        projected: markedDelivered,
+        eventIds:
+          markedDelivered === events.length
+            ? events.map((event) => event.eventId)
+            : [],
+        failed: 0,
+        failedEventIds: [],
+        retrying: 0,
+        retryingEventIds: [],
+      });
     if (!acknowledgement.continuation || scope) {
       return delivered;
     }
@@ -21280,6 +22082,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
     await releasePendingContinuation();
     if (
       input.signal?.aborted ||
+      claimed.transportOwnershipUnconfirmed ||
       (error instanceof RunLedgerProjectionLeaseLostError &&
         error.reason === 'head_lease_owner_mismatch')
     ) {
@@ -21335,7 +22138,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         error.reason === 'head_lease_owner_mismatch'
           ? eventIds
           : released;
-      return {
+      return withTransportDelivered({
         attempted: events.length,
         projected: 0,
         eventIds: [],
@@ -21343,7 +22146,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         failedEventIds: [],
         retrying: handedOff.length,
         retryingEventIds: handedOff,
-      };
+      });
     }
     if (error instanceof DeferredRuntimeProjectionInputError) {
       const outcome = await withClient(
@@ -21383,7 +22186,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         code: error.code,
         detail: error.message,
       });
-      return {
+      return withTransportDelivered({
         attempted: events.length,
         projected: 0,
         eventIds: [],
@@ -21391,7 +22194,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         failedEventIds: failed,
         retrying: retrying.length,
         retryingEventIds: retrying,
-      };
+      });
     }
     let settlement: { blocked: string[]; retrying: string[] };
     try {
@@ -21456,7 +22259,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         settlementError,
         deliveryError: error,
       });
-      return {
+      return withTransportDelivered({
         attempted: events.length,
         projected: 0,
         eventIds: [],
@@ -21464,7 +22267,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         failedEventIds: [],
         retrying: events.length,
         retryingEventIds: events.map((event) => event.eventId),
-      };
+      });
     }
     const failure = runLedgerDeliveryFailure({ error });
     console.warn('[run-ledger-outbox.batch_dispatch_failed]', {
@@ -21478,7 +22281,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         ? { projectionMismatch: failure.projectionMismatch }
         : {}),
     });
-    return {
+    return withTransportDelivered({
       attempted: events.length,
       projected: 0,
       eventIds: [],
@@ -21486,7 +22289,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       failedEventIds: settlement.blocked,
       retrying: settlement.retrying.length,
       retryingEventIds: settlement.retrying,
-    };
+    });
   } finally {
     const settledAtMs = Date.now();
     const headAgeAtClaimMs = Math.max(
@@ -21614,6 +22417,48 @@ async function acknowledgeRunLedgerPrefixWithContinuation(
     !!input.scope ||
     (input.input.continueThroughTerminal === true && !input.input.headEventId);
   return withClient(async (client) => {
+    if (retainContinuation) {
+      const eventIds = input.events.map((event) => event.eventId);
+      const claimSuccessor =
+        input.continuationAllowance !== 0 && !eventIds.includes(targetEventId);
+      const fast = await claimRunLedgerOutboxPrefixInBatch(
+        client,
+        {
+          runId,
+          leaseOwner: input.leaseOwner,
+          leaseSeconds: input.input.leaseSeconds ?? 120,
+          limit: claimSuccessor
+            ? Math.min(
+                RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS,
+                input.runtimeApi?.runLedgerIngressPrefixBatching === true
+                  ? RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS
+                  : (input.input.limit ?? 1),
+                input.continuationAllowance ??
+                  RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS,
+              )
+            : 0,
+          allowIngressPrefix:
+            input.runtimeApi?.runLedgerIngressPrefixBatching === true,
+          waitForRunLock: true,
+        },
+        options,
+        { eventIds, targetEventId },
+      );
+      if (fast !== null) {
+        let continuation: RunLedgerOutboxDrainScope | null = null;
+        if (fast.events.length > 0) {
+          continuation = input.scope ?? {
+            runId,
+            leaseOwner: input.leaseOwner,
+            targetEventId,
+            nextClaimed: [],
+          };
+          continuation.nextClaimed = fast.events;
+          input.continuation.current = continuation;
+        }
+        return { deliveredRows: fast.deliveredRows, continuation };
+      }
+    }
     const acknowledge = async () => {
       if (retainContinuation) {
         await client.query('BEGIN');