deepline 0.3.403 → 0.3.405

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/runtime-event-search.ts

@@ -1837,6 +1837,316 @@ async function installNewRunProjectionMode(
   );
 }
 
+function freshLogSequenceAssignmentSql(runtimeScope: string): string {
+  const scope = requiredScope(runtimeScope);
+  const schema = quoteIdent(scope);
+  return `
+    CREATE OR REPLACE FUNCTION ${schema}.assign_fresh_log_sequences(
+      assigned_seq bigint, line_count bigint, fresh_tids tid[], fresh_event_ids text[],
+      probe_org text, probe_run_id text
+    ) RETURNS bigint LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog
+      SET enable_seqscan = off SET enable_tidscan = on AS $function$
+    DECLARE probe_scope text := ${quoteLiteral(scope)};
+            chunk_start integer; chunk_tids tid[]; assigned_count bigint;
+            assigned_total bigint; mapped_count bigint; distinct_mapped_count bigint;
+    BEGIN
+      IF line_count IS NULL OR line_count < 1 OR assigned_seq IS NULL
+         OR probe_scope IS NULL OR probe_org IS NULL OR probe_run_id IS NULL
+         OR cardinality(fresh_tids) IS DISTINCT FROM line_count
+         OR cardinality(fresh_event_ids) IS DISTINCT FROM line_count
+         OR array_lower(fresh_tids, 1) IS DISTINCT FROM 1
+         OR array_lower(fresh_event_ids, 1) IS DISTINCT FROM 1 THEN
+        RAISE EXCEPTION 'Chunk sequence assignment requires aligned fresh targets';
+      END IF;
+      SELECT count(*), count(DISTINCT fresh.tid)
+        INTO mapped_count, distinct_mapped_count
+        FROM unnest(fresh_tids) AS fresh(tid)
+       WHERE fresh.tid IS NOT NULL;
+      IF mapped_count <> line_count OR distinct_mapped_count <> line_count
+         OR EXISTS (SELECT 1 FROM unnest(fresh_event_ids) AS fresh(event_id) WHERE fresh.event_id IS NULL) THEN
+        RAISE EXCEPTION 'Chunk sequence assignment requires every exact fresh target';
+      END IF;
+      assigned_total := 0;
+      FOR chunk_start IN 1..line_count BY 256 LOOP
+        chunk_tids := fresh_tids[chunk_start:LEAST(chunk_start + 255, line_count)];
+        WITH updated AS (
+          UPDATE runtime_observability.events AS event
+             SET log_seq = assigned_seq - line_count + chunk_start - 1
+                           + array_position(chunk_tids, event.ctid)
+           WHERE event.ctid = ANY(chunk_tids)
+           RETURNING event.runtime_scope, event.org_id, event.run_id, event.event_id, event.log_seq
+        )
+        SELECT count(*), count(*) FILTER (
+          WHERE updated.runtime_scope IS NOT DISTINCT FROM probe_scope
+            AND updated.org_id IS NOT DISTINCT FROM probe_org
+            AND updated.run_id IS NOT DISTINCT FROM probe_run_id
+            AND updated.log_seq BETWEEN assigned_seq - line_count + chunk_start
+                                    AND assigned_seq - line_count + chunk_start - 1 + cardinality(chunk_tids)
+            AND updated.event_id IS NOT DISTINCT FROM fresh_event_ids[
+              (updated.log_seq - (assigned_seq - line_count))::integer
+            ]
+        ) INTO assigned_count, mapped_count FROM updated;
+        IF assigned_count <> cardinality(chunk_tids) OR mapped_count <> assigned_count THEN
+          RAISE EXCEPTION 'Chunk sequence assignment did not update every exact fresh target';
+        END IF;
+        assigned_total := assigned_total + assigned_count;
+      END LOOP;
+      IF assigned_total <> line_count THEN
+        RAISE EXCEPTION 'Chunk sequence assignment did not account for the whole batch';
+      END IF;
+      RETURN assigned_total;
+    END
+    $function$
+`;
+}
+
+function originLogIdentitySeekSql(
+  scope: string,
+  org: string,
+  id: string,
+): string {
+  // Seek the first complete identity at or after the requested key, then check
+  // equality outside LIMIT. An equality-only probe can choose an index with
+  // unbound run/time columns before event_id and reread its prefix per line.
+  return `SELECT candidate.* FROM (
+    SELECT event.runtime_scope, event.org_id, event.event_id,
+      event.run_id, event.kind, event.source_digest
+    FROM runtime_observability.events event
+    WHERE (event.runtime_scope, event.org_id, event.event_id)
+      >= (${quoteLiteral(scope)}, ${org}, ${id})
+    ORDER BY event.runtime_scope, event.org_id, event.event_id
+    LIMIT 1
+  ) candidate
+  WHERE candidate.runtime_scope = ${quoteLiteral(scope)}
+    AND candidate.org_id = ${org} AND candidate.event_id = ${id}`;
+}
+
+function originLogBatchProjectionSql(scope: string, numbered: boolean): string {
+  const schema = quoteIdent(scope);
+  return `DO $install_origin_log_targets$ BEGIN
+    CREATE OR REPLACE FUNCTION ${schema}.project_origin_log_batch_with_targets(observation ${schema}.outbox, item jsonb, run_org text, play text, compact_logs boolean, canonical_events boolean, at_time timestamptz, doc jsonb, closed boolean${numbered ? ', sequence_base bigint' : ''})
+    RETURNS TABLE(fresh_id text, fresh_tid tid, fresh_ordinal bigint) LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
+    DECLARE fresh text[]; target_tids tid[]; target_ordinals bigint[]; expected_fresh_count bigint; mismatches bigint; expected_keys jsonb; existing_identities jsonb;
+      batch_lines jsonb := item->'lines';
+      batch_ids jsonb := item->'lineIds';
+      batch_contexts jsonb := item->'lineContexts';
+      batch_metadata jsonb := item->'lineMetadata';
+      batch_event jsonb := item - 'lines' - 'lineContexts' - 'lineIds' - 'lineMetadata';
+    BEGIN
+      IF jsonb_typeof(batch_ids) IS DISTINCT FROM 'array'
+        OR jsonb_array_length(batch_ids) <> jsonb_array_length(batch_lines)
+        OR EXISTS (SELECT 1 FROM jsonb_array_elements(batch_ids) id WHERE jsonb_typeof(id) <> 'string' OR (id #>> '{}') !~ '^[A-Za-z0-9:_-]{1,128}$')
+        OR (SELECT count(DISTINCT id) FROM jsonb_array_elements(batch_ids) id) <> jsonb_array_length(batch_ids) THEN
+        RAISE EXCEPTION 'Origin log identities must be distinct bounded strings aligned with lines';
+      END IF;
+      IF EXISTS (SELECT 1 FROM jsonb_array_elements(batch_lines) line WHERE jsonb_typeof(line) <> 'string') THEN
+        RAISE EXCEPTION 'Search projection requires log line strings';
+      END IF;
+      IF item ? 'lineContexts' AND EXISTS (
+        SELECT 1 FROM jsonb_array_elements(batch_contexts) ctx
+        WHERE jsonb_typeof(ctx) NOT IN ('object', 'null')
+      ) THEN RAISE EXCEPTION 'Search projection log context must be an object'; END IF;
+      IF item ? 'lineContexts' AND EXISTS (
+        SELECT 1 FROM jsonb_array_elements(batch_contexts) ctx
+        WHERE jsonb_typeof(ctx) = 'object' AND (
+          (SELECT count(*) FROM jsonb_object_keys(ctx)) > 8 OR octet_length(ctx::text) > 2064
+          OR EXISTS (SELECT 1 FROM jsonb_each(ctx) field WHERE
+            field.key !~ '^[A-Za-z_][A-Za-z0-9_]{0,63}$' OR field.key IN ('__proto__', 'constructor', 'prototype')
+            OR jsonb_typeof(field.value) NOT IN ('string', 'number', 'boolean')
+            OR (jsonb_typeof(field.value) = 'string' AND octet_length(field.value #>> '{}') > 256)
+            OR (jsonb_typeof(field.value) = 'number' AND octet_length(field.value #>> '{}') > 32))
+        )
+      ) THEN RAISE EXCEPTION 'Search projection log context has an unsupported key or value'; END IF;
+      -- Generic plans cannot fold item field extraction or removal. Cache the
+      -- aligned arrays and event header once: rebuilding a multi-megabyte item
+      -- per line makes retained terminal envelopes quadratic even on replay.
+      -- Replan these two journal-reading statements once per batch. A cached
+      -- plan chosen on a tiny journal can retain a Seq Scan after it grows.
+      -- Values stay bound parameters; no per-identity parsing or planner GUC.
+      EXECUTE $origin_insert$
+      WITH entries AS MATERIALIZED (
+        SELECT value #>> '{}' AS body, ordinality AS ordinal,
+          'log-origin:' || $1 || ':' || ($3->>(ordinality-1)::int) AS eid,
+          NULLIF($4->(ordinality-1)::int, 'null'::jsonb) AS ctx,
+          ${schema}.run_log_metadata(value #>> '{}', $5->(ordinality-1)::int, $11) AS metadata
+        FROM jsonb_array_elements($2) WITH ORDINALITY
+      )${
+        numbered
+          ? `, fresh_entries AS MATERIALIZED (
+        SELECT entries.*, row_number() OVER (ORDER BY ordinal) AS fresh_position
+        FROM entries WHERE (
+          SELECT identity.event_id
+          FROM (${originLogIdentitySeekSql(scope, '$7', 'entries.eid')}) identity
+        ) IS NULL
+      )`
+          : ''
+      }, inserted AS (
+        INSERT INTO runtime_observability.events (
+          runtime_scope, org_id, event_id, event_seq, event_payload, occurred_at,
+          run_id, play_name, kind, level, message, log_body, source_digest, log_text_digest, search_doc${numbered ? ', log_seq' : ''}
+        ) SELECT ${quoteLiteral(scope)}, $7, eid,
+          CASE WHEN $10 THEN nextval('runtime_observability.runtime_event_order_seq') END,
+          CASE WHEN $10 THEN jsonb_strip_nulls($6 || jsonb_build_object(
+            'type', ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}, 'runId', $1,
+            'occurredAt', metadata->'occurredAt', 'level', metadata->'level', 'stepId', metadata->'stepId', 'lineOrdinal', ordinal,
+            'entryId', $3->(ordinal-1)::int, 'context', ctx)) END,
+          to_timestamp((metadata->>'occurredAt')::double precision / 1000), $1, $8, ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}, metadata->>'level',
+          CASE WHEN $9 THEN NULL ELSE left(body, 2048) END, body,
+          CASE WHEN ctx IS NULL THEN encode(sha256(convert_to(body,'UTF8')),'hex')
+            ELSE encode(sha256(convert_to(jsonb_build_array(body,ctx)::text,'UTF8')),'hex') END,
+          encode(sha256(convert_to(btrim(body),'UTF8')),'hex'),
+          $12 || (metadata - 'occurredAt') || jsonb_strip_nulls(jsonb_build_object('entryId', $3->(ordinal-1)::int, 'context', ctx))${numbered ? ', $14 + fresh_position' : ''}
+        FROM ${numbered ? 'fresh_entries' : 'entries'} WHERE NOT $13 ORDER BY ordinal
+        ON CONFLICT (runtime_scope, org_id, event_id) DO NOTHING RETURNING event_id, ctid AS inserted_tid
+      ) SELECT coalesce(array_agg(inserted.event_id ORDER BY entries.ordinal), ARRAY[]::text[]),
+               coalesce(array_agg(inserted.inserted_tid ORDER BY entries.ordinal), ARRAY[]::tid[]),
+               coalesce(array_agg(entries.ordinal ORDER BY entries.ordinal), ARRAY[]::bigint[]),
+               ${numbered ? '(SELECT count(*) FROM fresh_entries)' : 'NULL::bigint'}
+        FROM inserted JOIN entries ON entries.eid = inserted.event_id
+      $origin_insert$ INTO fresh, target_tids, target_ordinals, expected_fresh_count
+        USING observation.run_id, batch_lines, batch_ids, batch_contexts, batch_metadata,
+          batch_event, run_org, play, compact_logs, canonical_events, at_time, doc, closed${numbered ? ', sequence_base' : ''};
+      ${
+        numbered
+          ? `-- A pre-upgrade inserter can win a uniqueness race without taking
+      -- the cursor first. Never commit a hole in the precomputed fresh range.
+      IF NOT closed AND cardinality(fresh) <> expected_fresh_count THEN
+        RAISE EXCEPTION 'Origin log allocation changed during insertion' USING ERRCODE = '40001';
+      END IF;`
+          : ''
+      }
+      -- The INSERT already proves the content of every fresh identity. Only
+      -- retries or a concurrent uniqueness winner need a journal read-back.
+      -- This fast path serves both inline and background origin projection.
+      IF cardinality(fresh) = jsonb_array_length(batch_lines) THEN
+        RETURN QUERY SELECT * FROM unnest(fresh, target_tids, target_ordinals);
+        RETURN;
+      END IF;
+      -- A new READ COMMITTED statement sees a concurrent uniqueness winner.
+      -- Seek in complete identity order and verify the one candidate's key.
+      -- Per-batch planning avoids retaining a tiny-table Seq Scan; the order
+      -- also prevents choosing an index with an unbound run/time key gap.
+      SELECT jsonb_object_agg('log-origin:' || observation.run_id || ':' || (id #>> '{}'), true)
+        INTO expected_keys FROM jsonb_array_elements(batch_ids) AS ids(id);
+      EXECUTE $origin_retained$
+      SELECT jsonb_object_agg(keys.eid, (
+        SELECT jsonb_build_object('runId', event.run_id, 'kind', event.kind, 'digest', event.source_digest)
+        FROM (${originLogIdentitySeekSql(scope, '$1', 'keys.eid')}) event
+      ))
+      FROM jsonb_object_keys($2) AS keys(eid)
+      $origin_retained$ INTO existing_identities USING run_org, expected_keys;
+      -- JSON key lookups preserve one proof per identity without a join whose
+      -- generic plan can multiply the two variable-size sets. Tombstones keep
+      -- their digest/identity: retry never restores an expired body.
+      -- Stream aligned IDs with their lines: positional text[] subscripting
+      -- walks variable-width elements from the start on every lookup.
+      WITH entries AS MATERIALIZED (
+        SELECT body, 'log-origin:' || observation.run_id || ':' || id AS eid,
+          NULLIF(batch_contexts->(ordinal-1)::int, 'null'::jsonb) AS ctx
+        FROM ROWS FROM (jsonb_array_elements(batch_lines), jsonb_array_elements_text(batch_ids))
+          WITH ORDINALITY AS aligned(body, id, ordinal)
+      )
+      SELECT count(*) INTO mismatches FROM entries
+      WHERE existing_identities->eid->>'runId' IS DISTINCT FROM observation.run_id
+        OR existing_identities->eid->>'kind' IS DISTINCT FROM ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
+        OR existing_identities->eid->>'digest' IS DISTINCT FROM CASE WHEN ctx IS NULL
+          THEN encode(sha256(convert_to(body #>> '{}','UTF8')),'hex')
+          ELSE encode(sha256(convert_to(jsonb_build_array(body #>> '{}',ctx)::text,'UTF8')),'hex') END;
+      IF mismatches > 0 THEN
+        RAISE EXCEPTION 'Origin log identity changed its content or ingress is closed after terminal acceptance';
+      END IF;
+      RETURN QUERY SELECT * FROM unnest(fresh, target_tids, target_ordinals);
+        RETURN;
+    END $function$;
+    REVOKE ALL ON FUNCTION ${schema}.project_origin_log_batch_with_targets(${schema}.outbox,jsonb,text,text,boolean,boolean,timestamptz,jsonb,boolean${numbered ? ',bigint' : ''}) FROM PUBLIC;
+    END; $install_origin_log_targets$
+  `;
+}
+
+/** Deployment-only body/configuration proof. Never used for run admission. */
+export async function hasCurrentFreshLogSequenceAssignment(
+  client: PostgresSchedulerQueryClient,
+  runtimeScope: string,
+): Promise<boolean> {
+  const scope = requiredScope(runtimeScope);
+  const schema = quoteIdent(scope);
+  const sql = freshLogSequenceAssignmentSql(scope);
+  const delimiter = '$function$';
+  const expectedBody = sql
+    .slice(
+      sql.indexOf(delimiter) + delimiter.length,
+      sql.lastIndexOf(delimiter),
+    )
+    .trim();
+  const result = await client.query<{
+    body: string;
+    result: string;
+    security_definer: boolean;
+    configuration: string[];
+    private: boolean;
+    owner_matches_projector: boolean;
+    projector_body: string;
+    targets_present: boolean;
+    numbered_body: string;
+    numbered_private: boolean;
+    numbered_configuration: string[];
+    numbered_owner_matches: boolean;
+  }>(
+    `SELECT helper.prosrc AS body, pg_get_function_result(helper.oid) AS result,
+      helper.prosecdef AS security_definer, helper.proconfig AS configuration,
+      NOT EXISTS (SELECT 1 FROM aclexplode(coalesce(helper.proacl, acldefault('f', helper.proowner))) privilege
+        WHERE privilege.grantee = 0 AND privilege.privilege_type = 'EXECUTE') AS private,
+      helper.proowner = projector.proowner AS owner_matches_projector,
+      projector.prosrc AS projector_body,
+      to_regprocedure($3) IS NOT NULL AS targets_present,
+      numbered.prosrc AS numbered_body, numbered.proconfig AS numbered_configuration,
+      numbered.proowner = projector.proowner AND numbered.prosecdef AS numbered_owner_matches,
+      NOT EXISTS (SELECT 1 FROM aclexplode(coalesce(numbered.proacl, acldefault('f', numbered.proowner))) privilege
+        WHERE privilege.grantee = 0 AND privilege.privilege_type = 'EXECUTE') AS numbered_private
+    FROM pg_proc numbered CROSS JOIN pg_proc helper JOIN pg_proc projector ON projector.oid = to_regprocedure($2)
+    WHERE helper.oid = to_regprocedure($1) AND numbered.oid = to_regprocedure($4)`,
+    [
+      `${schema}.assign_fresh_log_sequences(bigint,bigint,tid[],text[],text,text)`,
+      `${schema}.project_outbox_event(${schema}.outbox)`,
+      `${schema}.project_origin_log_batch_with_targets(${schema}.outbox,jsonb,text,text,boolean,boolean,timestamptz,jsonb,boolean)`,
+      `${schema}.project_origin_log_batch_with_targets(${schema}.outbox,jsonb,text,text,boolean,boolean,timestamptz,jsonb,boolean,bigint)`,
+    ],
+  );
+  const row = result.rows[0];
+  const numberedSql = originLogBatchProjectionSql(scope, true);
+  const numberedBody = numberedSql
+    .slice(
+      numberedSql.indexOf(delimiter) + delimiter.length,
+      numberedSql.lastIndexOf(delimiter),
+    )
+    .trim();
+  const expectedCall =
+    'assigned_seq + cardinality(fresh_event_ids)) AS target;';
+  return Boolean(
+    row &&
+    row.body.trim() === expectedBody &&
+    row.result === 'bigint' &&
+    row.security_definer &&
+    row.private &&
+    row.owner_matches_projector &&
+    row.targets_present &&
+    row.numbered_body.trim() === numberedBody &&
+    row.numbered_private &&
+    row.numbered_owner_matches &&
+    JSON.stringify(row.numbered_configuration) ===
+      JSON.stringify(['search_path=pg_catalog']) &&
+    JSON.stringify([...(row.configuration ?? [])].sort()) ===
+      JSON.stringify(
+        [
+          'search_path=pg_catalog',
+          'enable_seqscan=off',
+          'enable_tidscan=on',
+        ].sort(),
+      ) &&
+    row.projector_body.includes(expectedCall),
+  );
+}
+
 /**
  * Migration installs readers with synchronous production unchanged. After
  * cutover, the producer persists raw input and only the leased dispatcher
@@ -2037,112 +2347,40 @@ export async function attachRuntimeEventSearchTriggers(
     END
     $function$
   `);
+  for (const numbered of [false, true]) {
+    await client.query(originLogBatchProjectionSql(scope, numbered));
+  }
   await client.query(`
     CREATE OR REPLACE FUNCTION ${schema}.project_origin_log_batch(observation ${schema}.outbox, item jsonb, run_org text, play text, compact_logs boolean, canonical_events boolean, at_time timestamptz, doc jsonb, closed boolean)
-    RETURNS text[] LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
-    DECLARE fresh text[]; mismatches bigint; expected_keys jsonb; existing_identities jsonb;
-      batch_lines jsonb := item->'lines';
-      batch_ids jsonb := item->'lineIds';
-      batch_contexts jsonb := item->'lineContexts';
-      batch_metadata jsonb := item->'lineMetadata';
-      batch_event jsonb := item - 'lines' - 'lineContexts' - 'lineIds' - 'lineMetadata';
-    BEGIN
-      IF jsonb_typeof(batch_ids) IS DISTINCT FROM 'array'
-        OR jsonb_array_length(batch_ids) <> jsonb_array_length(batch_lines)
-        OR EXISTS (SELECT 1 FROM jsonb_array_elements(batch_ids) id WHERE jsonb_typeof(id) <> 'string' OR (id #>> '{}') !~ '^[A-Za-z0-9:_-]{1,128}$')
-        OR (SELECT count(DISTINCT id) FROM jsonb_array_elements(batch_ids) id) <> jsonb_array_length(batch_ids) THEN
-        RAISE EXCEPTION 'Origin log identities must be distinct bounded strings aligned with lines';
-      END IF;
-      IF EXISTS (SELECT 1 FROM jsonb_array_elements(batch_lines) line WHERE jsonb_typeof(line) <> 'string') THEN
-        RAISE EXCEPTION 'Search projection requires log line strings';
-      END IF;
-      IF item ? 'lineContexts' AND EXISTS (
-        SELECT 1 FROM jsonb_array_elements(batch_contexts) ctx
-        WHERE jsonb_typeof(ctx) NOT IN ('object', 'null')
-      ) THEN RAISE EXCEPTION 'Search projection log context must be an object'; END IF;
-      IF item ? 'lineContexts' AND EXISTS (
-        SELECT 1 FROM jsonb_array_elements(batch_contexts) ctx
-        WHERE jsonb_typeof(ctx) = 'object' AND (
-          (SELECT count(*) FROM jsonb_object_keys(ctx)) > 8 OR octet_length(ctx::text) > 2064
-          OR EXISTS (SELECT 1 FROM jsonb_each(ctx) field WHERE
-            field.key !~ '^[A-Za-z_][A-Za-z0-9_]{0,63}$' OR field.key IN ('__proto__', 'constructor', 'prototype')
-            OR jsonb_typeof(field.value) NOT IN ('string', 'number', 'boolean')
-            OR (jsonb_typeof(field.value) = 'string' AND octet_length(field.value #>> '{}') > 256)
-            OR (jsonb_typeof(field.value) = 'number' AND octet_length(field.value #>> '{}') > 32))
-        )
-      ) THEN RAISE EXCEPTION 'Search projection log context has an unsupported key or value'; END IF;
-      -- Generic plans cannot fold item field extraction or removal. Cache the
-      -- aligned arrays and event header once: rebuilding a multi-megabyte item
-      -- per line makes retained terminal envelopes quadratic even on replay.
-      WITH entries AS MATERIALIZED (
-        SELECT value #>> '{}' AS body, ordinality AS ordinal,
-          'log-origin:' || observation.run_id || ':' || (batch_ids->>(ordinality-1)::int) AS eid,
-          NULLIF(batch_contexts->(ordinality-1)::int, 'null'::jsonb) AS ctx,
-          ${schema}.run_log_metadata(value #>> '{}', batch_metadata->(ordinality-1)::int, at_time) AS metadata
-        FROM jsonb_array_elements(batch_lines) WITH ORDINALITY
-      ), inserted AS (
-        INSERT INTO runtime_observability.events (
-          runtime_scope, org_id, event_id, event_seq, event_payload, occurred_at,
-          run_id, play_name, kind, level, message, log_body, source_digest, log_text_digest, search_doc
-        ) SELECT ${quoteLiteral(scope)}, run_org, eid,
-          CASE WHEN canonical_events THEN nextval('runtime_observability.runtime_event_order_seq') END,
-          CASE WHEN canonical_events THEN jsonb_strip_nulls(batch_event || jsonb_build_object(
-            'type', ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}, 'runId', observation.run_id,
-            'occurredAt', metadata->'occurredAt', 'level', metadata->'level', 'stepId', metadata->'stepId', 'lineOrdinal', ordinal,
-            'entryId', batch_ids->(ordinal-1)::int, 'context', ctx)) END,
-          to_timestamp((metadata->>'occurredAt')::double precision / 1000), observation.run_id, play, ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}, metadata->>'level',
-          CASE WHEN compact_logs THEN NULL ELSE left(body, 2048) END, body,
-          CASE WHEN ctx IS NULL THEN encode(sha256(convert_to(body,'UTF8')),'hex')
-            ELSE encode(sha256(convert_to(jsonb_build_array(body,ctx)::text,'UTF8')),'hex') END,
-          encode(sha256(convert_to(btrim(body),'UTF8')),'hex'),
-          doc || (metadata - 'occurredAt') || jsonb_strip_nulls(jsonb_build_object('entryId', batch_ids->(ordinal-1)::int, 'context', ctx))
-        FROM entries WHERE NOT closed ORDER BY ordinal
-        ON CONFLICT (runtime_scope, org_id, event_id) DO NOTHING RETURNING event_id
-      ) SELECT coalesce(array_agg(inserted.event_id ORDER BY entries.ordinal), ARRAY[]::text[])
-        INTO fresh FROM inserted JOIN entries ON entries.eid = inserted.event_id;
-      -- The INSERT already proves the content of every fresh identity. Only
-      -- retries or a concurrent uniqueness winner need a journal read-back.
-      -- This fast path serves both inline and background origin projection.
-      IF cardinality(fresh) = jsonb_array_length(batch_lines) THEN
-        RETURN fresh;
+    RETURNS text[] LANGUAGE sql SECURITY DEFINER SET search_path = pg_catalog AS $function$
+      SELECT coalesce(array_agg(target.fresh_id ORDER BY target.fresh_ordinal), ARRAY[]::text[])
+        FROM ${schema}.project_origin_log_batch_with_targets(observation, item, run_org, play, compact_logs, canonical_events, at_time, doc, closed) AS target
+    $function$
+  `);
+  await client.query(`DO $install_fresh_log_sequences$ BEGIN
+    ${freshLogSequenceAssignmentSql(scope)};
+    REVOKE ALL ON FUNCTION ${schema}.assign_fresh_log_sequences(bigint,bigint,tid[],text[],text,text),
+      ${schema}.project_origin_log_batch_with_targets(${schema}.outbox,jsonb,text,text,boolean,boolean,timestamptz,jsonb,boolean)
+    FROM PUBLIC;
+    END; $install_fresh_log_sequences$`);
+  const acquireLogCursorSql = `
+      IF NOT cursor_locked THEN
+      -- One allocation owner supplies final sequences at INSERT time. The
+      -- row fence serializes only this run and survives until the lease fence.
+      INSERT INTO runtime_observability.run_log_cursors(runtime_scope, org_id, run_id, last_seq)
+      VALUES (${quoteLiteral(scope)}, run_org, observation.run_id, 1)
+      ON CONFLICT (runtime_scope, org_id, run_id) DO NOTHING RETURNING last_seq INTO assigned_seq;
+      cursor_created := FOUND;
+      IF cursor_created THEN
+        assigned_seq := 0;
+      ELSE
+        SELECT last_seq INTO assigned_seq FROM runtime_observability.run_log_cursors
+         WHERE runtime_scope = ${quoteLiteral(scope)} AND org_id = run_org
+           AND run_id = observation.run_id FOR UPDATE;
       END IF;
-      -- A new READ COMMITTED statement sees a concurrent uniqueness winner.
-      -- Resolve the whole key set once. A per-line LATERAL lookup can choose
-      -- a non-leading event_id index scan when scope/org statistics are skewed,
-      -- re-reading the same history for every ID even though the PK is unique.
-      -- Generic plans may scan the scope/org prefix and test ANY(text[]) for
-      -- every row. Use the indexed run prefix and a once-built JSON key set.
-      SELECT jsonb_object_agg('log-origin:' || observation.run_id || ':' || (id #>> '{}'), true)
-        INTO expected_keys FROM jsonb_array_elements(batch_ids) AS ids(id);
-      SELECT jsonb_object_agg(event.event_id, jsonb_build_object(
-        'runId', event.run_id, 'kind', event.kind, 'digest', event.source_digest))
-        INTO existing_identities
-        FROM runtime_observability.events event
-       WHERE event.runtime_scope = ${quoteLiteral(scope)} AND event.org_id = run_org
-         AND event.run_id = observation.run_id AND expected_keys ? event.event_id;
-      -- JSON key lookups preserve one proof per identity without a join whose
-      -- generic plan can multiply the two variable-size sets. Tombstones keep
-      -- their digest/identity: retry never restores an expired body.
-      -- Stream aligned IDs with their lines: positional text[] subscripting
-      -- walks variable-width elements from the start on every lookup.
-      WITH entries AS MATERIALIZED (
-        SELECT body, 'log-origin:' || observation.run_id || ':' || id AS eid,
-          NULLIF(batch_contexts->(ordinal-1)::int, 'null'::jsonb) AS ctx
-        FROM ROWS FROM (jsonb_array_elements(batch_lines), jsonb_array_elements_text(batch_ids))
-          WITH ORDINALITY AS aligned(body, id, ordinal)
-      )
-      SELECT count(*) INTO mismatches FROM entries
-      WHERE existing_identities->eid->>'runId' IS DISTINCT FROM observation.run_id
-        OR existing_identities->eid->>'kind' IS DISTINCT FROM ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
-        OR existing_identities->eid->>'digest' IS DISTINCT FROM CASE WHEN ctx IS NULL
-          THEN encode(sha256(convert_to(body #>> '{}','UTF8')),'hex')
-          ELSE encode(sha256(convert_to(jsonb_build_array(body #>> '{}',ctx)::text,'UTF8')),'hex') END;
-      IF mismatches > 0 THEN
-        RAISE EXCEPTION 'Origin log identity changed its content or ingress is closed after terminal acceptance';
+        cursor_locked := true;
       END IF;
-      RETURN fresh;
-    END $function$
-  `);
+  `;
   await client.query(`
     CREATE OR REPLACE FUNCTION ${schema}.project_outbox_event(observation ${schema}.outbox) RETURNS void
     LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
@@ -2153,7 +2391,9 @@ export async function attachRuntimeEventSearchTriggers(
             log_channel text; log_position bigint; matched_event_id text; matched_doc jsonb;
             legacy_position_prefix text; position_event_ids text[];
             log_alias jsonb; position_alias jsonb; envelope_attempt jsonb;
-            line_count bigint; fresh_event_ids text[] := ARRAY[]::text[]; fresh_positions jsonb;
+            cursor_created boolean := false; cursor_locked boolean := false; line_count bigint; fresh_event_ids text[] := ARRAY[]::text[];
+            fresh_tids tid[] := ARRAY[]::tid[]; inserted_tid tid;
+            batch_fresh_ids text[]; batch_fresh_tids tid[]; fresh_target_index integer;
             recent_log_keys jsonb := '{}'::jsonb; dedupe_key text;
             terminal_overlap_counts jsonb := '{}'::jsonb;
             recent_log_keys_loaded boolean := false; recent_log_attempt text;
@@ -2333,6 +2573,9 @@ export async function attachRuntimeEventSearchTriggers(
           IF kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended} AND jsonb_typeof(item->'lines') IS DISTINCT FROM 'array' THEN
             RAISE EXCEPTION 'Search projection requires log.appended lines';
           END IF;
+          IF kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended} AND jsonb_array_length(item->'lines') > 0 THEN
+            ${acquireLogCursorSql}
+          END IF;
           IF kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended} AND item ? 'lineContexts'
             AND (jsonb_typeof(item->'lineContexts') IS DISTINCT FROM 'array'
                  OR jsonb_array_length(item->'lineContexts') <> jsonb_array_length(item->'lines')) THEN
@@ -2349,8 +2592,14 @@ export async function attachRuntimeEventSearchTriggers(
             END IF;
             IF EXISTS (SELECT 1 FROM jsonb_array_elements(item->'lineIds') id WHERE id <> 'null'::jsonb AND (jsonb_typeof(id) <> 'string' OR (id #>> '{}') !~ '^[A-Za-z0-9:_-]{1,128}$')) OR (SELECT count(id) FROM jsonb_array_elements(item->'lineIds') id WHERE id <> 'null'::jsonb) <> (SELECT count(DISTINCT id) FROM jsonb_array_elements(item->'lineIds') id WHERE id <> 'null'::jsonb) THEN RAISE EXCEPTION 'Origin log identities must be distinct bounded strings'; END IF;
             IF NOT EXISTS (SELECT 1 FROM jsonb_array_elements(item->'lineIds') id WHERE id = 'null'::jsonb) THEN
-              fresh_event_ids := fresh_event_ids || ${schema}.project_origin_log_batch(observation, item, run_org, play, compact_logs, canonical_events, at_time, doc,
-                compact_logs AND observation.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents} AND coalesce((observation.payload_json->>'_runtimeSearchRunClosed')::boolean, run_status IN ('completed','failed','cancelled')));
+              SELECT coalesce(array_agg(target.fresh_id ORDER BY target.fresh_ordinal), ARRAY[]::text[]),
+                     coalesce(array_agg(target.fresh_tid ORDER BY target.fresh_ordinal), ARRAY[]::tid[])
+                INTO batch_fresh_ids, batch_fresh_tids
+                FROM ${schema}.project_origin_log_batch_with_targets(observation, item, run_org, play, compact_logs, canonical_events, at_time, doc,
+                compact_logs AND observation.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents} AND coalesce((observation.payload_json->>'_runtimeSearchRunClosed')::boolean, run_status IN ('completed','failed','cancelled')),
+                assigned_seq + cardinality(fresh_event_ids)) AS target;
+              fresh_event_ids := fresh_event_ids || batch_fresh_ids;
+              fresh_tids := fresh_tids || batch_fresh_tids;
               CONTINUE;
             END IF;
           END IF;
@@ -2541,7 +2790,13 @@ export async function attachRuntimeEventSearchTriggers(
                   UPDATE runtime_observability.events SET search_doc = matched_doc ||
                     jsonb_build_object('logContentDigest', digest, 'logPositions',
                       coalesce(matched_doc->'logPositions', '{}'::jsonb) || jsonb_build_object(log_channel, log_position))
-                   WHERE runtime_scope = ${quoteLiteral(scope)} AND org_id = run_org AND event_id = matched_event_id;
+                   WHERE runtime_scope = ${quoteLiteral(scope)} AND org_id = run_org AND event_id = matched_event_id
+                   RETURNING ctid INTO inserted_tid;
+                  -- Aliasing a fresh line moves its tuple within this transaction.
+                  fresh_target_index := array_position(fresh_event_ids, matched_event_id);
+                  IF fresh_target_index IS NOT NULL THEN
+                    fresh_tids[fresh_target_index] := inserted_tid;
+                  END IF;
                   CONTINUE;
                 END IF;
                 line_doc := line_doc || log_alias || jsonb_build_object('logContentDigest', digest);
@@ -2560,7 +2815,7 @@ export async function attachRuntimeEventSearchTriggers(
               INSERT INTO runtime_observability.events (
                 runtime_scope, org_id, event_id, event_seq, event_payload,
                 occurred_at, run_id, play_name, kind, level, message, log_body,
-                source_digest, log_text_digest, search_doc
+                source_digest, log_text_digest, search_doc, log_seq
               ) VALUES (
                 ${quoteLiteral(scope)}, run_org, eid,
                 CASE WHEN canonical_events THEN nextval('runtime_observability.runtime_event_order_seq') END,
@@ -2574,9 +2829,11 @@ export async function attachRuntimeEventSearchTriggers(
                 line_at, observation.run_id, play,
                 ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}, line_metadata->>'level', CASE WHEN compact_logs THEN NULL ELSE left(line #>> '{}', 2048) END,
                 line #>> '{}', digest,
-                encode(sha256(convert_to(btrim(line #>> '{}'), 'UTF8')), 'hex'), line_doc
-              ) ON CONFLICT DO NOTHING;
+                encode(sha256(convert_to(btrim(line #>> '{}'), 'UTF8')), 'hex'), line_doc,
+                assigned_seq + cardinality(fresh_event_ids) + 1
+              ) ON CONFLICT DO NOTHING RETURNING ctid INTO inserted_tid;
               IF FOUND THEN
+                fresh_tids := array_append(fresh_tids, inserted_tid);
                 fresh_event_ids := array_append(fresh_event_ids, eid);
               ELSE
                 SELECT source_digest INTO existing_digest FROM runtime_observability.events
@@ -2714,6 +2971,7 @@ export async function attachRuntimeEventSearchTriggers(
             SELECT value, ordinality
               FROM jsonb_array_elements(observation.payload_json->'terminalLogLines') WITH ORDINALITY
           LOOP
+            ${acquireLogCursorSql}
             IF jsonb_typeof(line) IS DISTINCT FROM 'string' THEN
               RAISE EXCEPTION 'Search projection requires terminal log strings';
             END IF;
@@ -2765,7 +3023,7 @@ export async function attachRuntimeEventSearchTriggers(
             INSERT INTO runtime_observability.events (
               runtime_scope, org_id, event_id, event_seq, event_payload,
               occurred_at, run_id, play_name, kind, level, message, log_body,
-              source_digest, log_text_digest, search_doc
+              source_digest, log_text_digest, search_doc, log_seq
             ) VALUES (
               ${quoteLiteral(scope)}, run_org, observation.event_id || ':log:' || line_ordinal,
               CASE WHEN canonical_events THEN nextval('runtime_observability.runtime_event_order_seq') END,
@@ -2783,9 +3041,10 @@ export async function attachRuntimeEventSearchTriggers(
                 THEN encode(sha256(convert_to(line #>> '{}', 'UTF8')), 'hex')
                 ELSE encode(sha256(convert_to(jsonb_build_array(line #>> '{}', line_context)::text, 'UTF8')), 'hex') END,
               encode(sha256(convert_to(btrim(line #>> '{}'), 'UTF8')), 'hex'),
-              line_doc
-            ) ON CONFLICT DO NOTHING;
+              line_doc, assigned_seq + cardinality(fresh_event_ids) + 1
+            ) ON CONFLICT DO NOTHING RETURNING ctid INTO inserted_tid;
             IF FOUND THEN
+              fresh_tids := array_append(fresh_tids, inserted_tid);
               fresh_event_ids := array_append(
                 fresh_event_ids,
                 observation.event_id || ':log:' || line_ordinal
@@ -2796,27 +3055,14 @@ export async function attachRuntimeEventSearchTriggers(
       END IF;
       line_count := cardinality(fresh_event_ids);
       IF line_count > 0 THEN
-        INSERT INTO runtime_observability.run_log_cursors (
-          runtime_scope, org_id, run_id, last_seq
-        ) VALUES (${quoteLiteral(scope)}, run_org, observation.run_id, line_count)
-        ON CONFLICT (runtime_scope, org_id, run_id)
-        DO UPDATE SET last_seq = runtime_observability.run_log_cursors.last_seq + EXCLUDED.last_seq,
-                      updated_at = clock_timestamp()
-        RETURNING last_seq INTO assigned_seq;
-        -- Build ordinal lookup once. Generic plans estimate a run and unnest
-        -- as tiny, then compare every inserted line against the entire ID list
-        -- in a nested loop or a per-row ANY filter. Fresh IDs came only from
-        -- this transaction's inserts for this scope/org/run, so JSON key
-        -- membership preserves the complete target within the indexed run.
-        SELECT jsonb_object_agg(fresh.event_id, fresh.ordinality)
-          INTO fresh_positions
-          FROM unnest(fresh_event_ids) WITH ORDINALITY AS fresh(event_id, ordinality);
-        UPDATE runtime_observability.events AS event
-           SET log_seq = assigned_seq - line_count + (fresh_positions->>event.event_id)::bigint
-         WHERE event.runtime_scope = ${quoteLiteral(scope)}
-           AND event.org_id = run_org
-           AND event.run_id = observation.run_id
-           AND fresh_positions ? event.event_id;
+        UPDATE runtime_observability.run_log_cursors
+           SET last_seq = assigned_seq + line_count, updated_at = clock_timestamp()
+         WHERE runtime_scope = ${quoteLiteral(scope)} AND org_id = run_org
+           AND run_id = observation.run_id;
+      ELSIF cursor_created THEN
+        DELETE FROM runtime_observability.run_log_cursors
+         WHERE runtime_scope = ${quoteLiteral(scope)} AND org_id = run_org
+           AND run_id = observation.run_id;
       END IF;
       RETURN;
     END

package/dist/cli/{auth-AHF355KV.mjs → auth-D4GXO4IN.mjs}

@@ -13,13 +13,13 @@ import {
   reportSetupCompleted,
   resolvePendingAuthClaimForResume,
   statusBannerLine
-} from "./chunk-CC3QT7Q5.mjs";
-import "./chunk-VNO3VAJT.mjs";
-import "./chunk-BYBRENKM.mjs";
+} from "./chunk-3FF3SPSE.mjs";
+import "./chunk-3DWMYKWU.mjs";
+import "./chunk-TPYRDAU7.mjs";
 import "./chunk-YHPYUZZX.mjs";
 import "./chunk-DLIRSHV6.mjs";
 import "./chunk-NXGCO4JB.mjs";
-import "./chunk-JHNYOTWR.mjs";
+import "./chunk-EKWJXPIX.mjs";
 import "./chunk-WZYKRD7T.mjs";
 import "./chunk-KRD6H754.mjs";
 export {