deepline 0.3.460 → 0.3.462

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -1,4 +1,10 @@
+import {
+  terminalRuntimePerformanceFromStats,
+  normalizeTerminalRuntimePerformance,
+  normalizeTerminalRuntimePerformanceUnavailableReason,
+} from '../terminal-runtime-performance';
 import { escapeLiteral } from 'pg';
+import { assertWorkReceiptKeyMutable } from '../work-receipt-storage-contract';
 import {
   readRowFailureCounts,
   type RowFailureCounts,
@@ -179,6 +185,7 @@ import {
   resolveLateRuntimeSandboxComputeItems,
   resolveRuntimeSandboxComputeItems,
 } from '../sandbox-compute-usage';
+import { PLAY_RUNNER_TERMINAL_GRACE_SECONDS } from '../runtime-constants';
 import { assertNodeRunnableArtifact } from '../../plays/artifact-kind-guard';
 import {
   artifactKindForBackend,
@@ -375,14 +382,18 @@ const POSTGRES_SCHEDULER_SCHEMA_INIT_STATEMENT_TIMEOUT_MS = 60_000;
 // Failed facts remain indexed: their live leases still fence the run.
 // v63 adds optional rate-probe count and clock baselines. Older writers ignore them;
 // unexpanded acquires retain their existing operation-local measurement.
+// v64 adds the optional per-run array-input intent used by terminal retirement.
+// Existing runs default to false and older workers ignore the column.
 // This marker records deployment work, never a runtime schema floor.
-export const POSTGRES_SCHEDULER_SCHEMA_VERSION = 63;
+export const POSTGRES_SCHEDULER_SCHEMA_VERSION = 64;
 const POSTGRES_SCHEDULER_SCHEMA_MIGRATIONS_TABLE =
   'scheduler_schema_migrations';
 export const POSTGRES_SCHEDULER_OPEN_RECOVERY_INDEX =
   'runtime_scheduler_runs_open_recovery_idx';
 export const POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX =
   'runtime_scheduler_sandbox_capacity_leases_custody_idx';
+export const POSTGRES_SCHEDULER_LEGACY_CLEANUP_PENDING_INDEX =
+  'runtime_scheduler_sandbox_cleanup_legacy_pending_idx';
 const POSTGRES_SCHEDULER_DEPENDENCY_CIRCUITS_TABLE =
   'runtime_dependency_circuits';
 /**
@@ -661,6 +672,10 @@ export type PostgresSchedulerRunStatusSnapshot = {
   /** Included only for callers that explicitly request admission identity. */
   definitionScope?: 'org' | 'system';
   status: string;
+  /** Immutable log-store marker from the org-owned scheduler run row. */
+  runLogStore?: 'planet_scale';
+  /** Schema actually queried for this run; never inferred from its name. */
+  schedulerSchema?: string;
   playName: string;
   graphHash: string | null;
   runtimeBackend: string | null;
@@ -683,6 +698,7 @@ export type PostgresSchedulerRunStatusSnapshot = {
 type RunStatusRow = RunRow & {
   play_name: string;
   org_id: string | null;
+  run_log_store: string | null;
   graph_hash: string | null;
   runtime_profile: string | null;
   launch_json: unknown;
@@ -1266,6 +1282,8 @@ export type PostgresSchedulerSchemaShapeRequirements = Readonly<{
   rateScopeRetryAfter?: boolean;
   /** v48 expands compact log storage; prior readers ignore these columns. */
   runtimeLogStorage?: boolean;
+  /** v64 records whether terminal projection owns array-input retirement. */
+  arrayInputIntent?: boolean;
 }>;
 
 export async function hasCurrentPostgresSchedulerSchemaShape(
@@ -1905,6 +1923,17 @@ export async function hasCurrentPostgresSchedulerSchemaShape(
             ) = 2
           )
         )
+        AND (
+          $40::boolean = false
+          OR EXISTS (
+            SELECT 1 FROM information_schema.columns
+            WHERE table_schema = $1 AND table_name = 'runs'
+              AND column_name = 'array_input_started'
+              AND data_type = 'boolean'
+              AND is_nullable = 'NO'
+              AND column_default IS NOT NULL
+          )
+        )
         AS ready
     `,
     [
@@ -1947,6 +1976,7 @@ export async function hasCurrentPostgresSchedulerSchemaShape(
       `${quotedSchema}.${quoteIdent('rate_scope_holds')}`,
       requirements.runtimeLogStorage !== false,
       requirements.gatewayReaderFence !== false,
+      requirements.arrayInputIntent !== false,
     ],
   );
   if (currentShape.rows[0]?.ready !== true) return false;
@@ -2254,9 +2284,19 @@ export async function ensurePostgresSchedulerOnlineAdditiveExpansion(
       )} (state, updated_at)
   `);
   await ensurePostgresSchedulerRunLogStorageExpansion(client, options);
+  await ensurePostgresSchedulerArrayInputIntentExpansion(client, options);
   await ensurePostgresSchedulerGatewayReaderFenceSchema(client, options);
 }
 
+/** Deployment-owned v64 expansion; absent values retain legacy behavior. */
+async function ensurePostgresSchedulerArrayInputIntentExpansion(
+  client: PostgresSchedulerQueryClient,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<void> {
+  await client.query(`ALTER TABLE ${tableName('runs', options)}
+    ADD COLUMN IF NOT EXISTS array_input_started boolean NOT NULL DEFAULT false`);
+}
+
 /** Deployment-only expansion; absent values keep legacy storage authoritative. */
 async function ensurePostgresSchedulerRunLogStorageExpansion(
   client: PostgresSchedulerQueryClient,
@@ -2556,6 +2596,8 @@ export async function ensurePostgresSchedulerLaunchAdmissionFunctions(
             'coordinatorInternalToken',
             'baseUrl',
             'runtimeApiBaseUrl',
+            'arrayInputTerminalRetirementSupported',
+            'arrayInputTerminalProjectionOrigin',
             'vercelProtectionBypassToken'
           ]::text[],
           '{maxConcurrentExternalCalls}',
@@ -2726,6 +2768,7 @@ export async function ensurePostgresSchedulerSchema(
         terminalComputeBillingOutboxTrigger: false,
         outboxWakeTrigger: false,
         cronScheduleSchema: false,
+        arrayInputIntent: false,
       }));
     const schemaCoreIsCurrent =
       schemaIsCurrent || schemaIsCurrentWithoutAdditiveFastPathObjects;
@@ -2746,6 +2789,9 @@ export async function ensurePostgresSchedulerSchema(
     const hasLegacyAdmissionRows =
       legacyAdmissionRows?.rows[0]?.present === true;
     if (schemaCoreIsCurrent) {
+      if (!schemaIsCurrent) {
+        await ensurePostgresSchedulerArrayInputIntentExpansion(client, options);
+      }
       if (!options?.deferRuntimeAdminIndexes) {
         await ensurePostgresSchedulerSandboxCustodyIndex(client, {
           schema,
@@ -2800,6 +2846,9 @@ export async function ensurePostgresSchedulerSchema(
       finished_at timestamptz
     )
   `);
+    // Reader-first expansion. A registered array-input intent makes terminal
+    // projection responsible for retiring tenant input pages before outbox ACK.
+    await ensurePostgresSchedulerArrayInputIntentExpansion(client, options);
     await client.query(`
     ALTER TABLE ${tableName('runs', options)}
       ADD COLUMN IF NOT EXISTS runtime_timing_json jsonb
@@ -3734,6 +3783,8 @@ export async function ensurePostgresSchedulerSchema(
           'coordinatorInternalToken',
           'baseUrl',
           'runtimeApiBaseUrl',
+          'arrayInputTerminalRetirementSupported',
+          'arrayInputTerminalProjectionOrigin',
           'vercelProtectionBypassToken'
           ]::text[],
           '{maxConcurrentExternalCalls}',
@@ -4201,6 +4252,14 @@ const POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX_DEFINITION = {
   definition: '(run_id, lease_id)',
 } as const;
 
+// Optional deploy-owned optimization for the v12 compatibility read. The
+// claimant still scans correctly if this index has not been built yet.
+const POSTGRES_SCHEDULER_LEGACY_CLEANUP_PENDING_INDEX_DEFINITION = {
+  name: POSTGRES_SCHEDULER_LEGACY_CLEANUP_PENDING_INDEX,
+  table: 'sandbox_cleanup_jobs',
+  definition: "(sandbox_id) WHERE status <> 'deleted'",
+} as const;
+
 const POSTGRES_SCHEDULER_RUNTIME_ADMIN_INDEXES = [
   POSTGRES_SCHEDULER_SANDBOX_CUSTODY_INDEX_DEFINITION,
   {
@@ -4490,6 +4549,19 @@ export async function ensurePostgresSchedulerSandboxCustodyIndex(
   );
 }
 
+/** Build outside live-schema transactions; absence never blocks cleanup. */
+export async function ensurePostgresSchedulerLegacyCleanupPendingIndex(
+  client: PostgresSchedulerQueryClient,
+  options: Pick<PostgresSchedulerOptions, 'schema'> & { concurrently: boolean },
+): Promise<void> {
+  await ensurePostgresSchedulerIndex(
+    client,
+    POSTGRES_SCHEDULER_LEGACY_CLEANUP_PENDING_INDEX_DEFINITION,
+    options,
+    options.concurrently,
+  );
+}
+
 export async function readPostgresSchedulerOpenRecoveryIndexState(
   client: PostgresSchedulerQueryClient,
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
@@ -6844,7 +6916,6 @@ export async function repairPostgresSchedulerCronFire(
 
 function runtimeReleaseAdmissionKeys(input: {
   releaseId: string;
-  admissionEpoch: number;
   environment?: 'preview' | 'production';
 }) {
   const releaseId = input.releaseId.trim();
@@ -6864,14 +6935,53 @@ function runtimeReleaseAdmissionKeys(input: {
     : [releaseAdmissionKey];
   if (!releaseId)
     throw new Error('Runtime release admission requires releaseId.');
-  if (!Number.isSafeInteger(input.admissionEpoch) || input.admissionEpoch < 0) {
+  return { releaseAdmissionLockKeys, releaseAdmissionWriteKeys };
+}
+
+function runtimeReleaseAdmissionEpoch(value: unknown): number {
+  const epoch = value;
+  if (typeof epoch !== 'number' || !Number.isSafeInteger(epoch) || epoch < 0) {
     throw new Error(
       'Runtime release admission requires a non-negative safe-integer admissionEpoch.',
     );
   }
-  return { releaseAdmissionLockKeys, releaseAdmissionWriteKeys };
+  return epoch;
+}
+
+/** Read the same highest-epoch, closed-wins fence used by run admission. */
+export async function readPostgresSchedulerRuntimeReleaseAdmission(
+  client: PostgresSchedulerQueryClient,
+  input: { releaseId: string; environment?: 'preview' | 'production' },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<{ accepting: boolean; admissionEpoch: number } | null> {
+  const { releaseAdmissionWriteKeys } = runtimeReleaseAdmissionKeys(input);
+  const result = await client.query<{
+    accepting: boolean;
+    admission_epoch: string;
+  }>(
+    `SELECT admission.accepting, admission.admission_epoch::text AS admission_epoch
+       FROM ${tableName('runtime_release_admission', options)} AS admission
+      WHERE admission.release_id = ANY($1::text[])
+      ORDER BY admission.admission_epoch DESC, admission.accepting ASC
+      LIMIT 1`,
+    [releaseAdmissionWriteKeys],
+  );
+  const row = result.rows[0];
+  return row
+    ? {
+        accepting: row.accepting,
+        admissionEpoch: runtimeReleaseAdmissionEpoch(
+          Number(row.admission_epoch),
+        ),
+      }
+    : null;
 }
 
+/**
+ * Opening callers must own a transaction and roll it back on refusal: a
+ * concurrent higher fence can reject one key after another was updated.
+ * Closing remains a monotonic write-if-newer and permits a stale no-op.
+ */
 export async function setPostgresSchedulerRuntimeReleaseAdmission(
   client: PostgresSchedulerQueryClient,
   input: {
@@ -6884,7 +6994,12 @@ export async function setPostgresSchedulerRuntimeReleaseAdmission(
 ): Promise<void> {
   const { releaseAdmissionLockKeys, releaseAdmissionWriteKeys } =
     runtimeReleaseAdmissionKeys(input);
-  await client.query(
+  runtimeReleaseAdmissionEpoch(input.admissionEpoch);
+  const result = await client.query<{
+    release_id: string;
+    accepting: boolean;
+    admission_epoch: string;
+  }>(
     `
       WITH admission_lock AS MATERIALIZED (
         SELECT pg_advisory_xact_lock(
@@ -6909,6 +7024,7 @@ export async function setPostgresSchedulerRuntimeReleaseAdmission(
           admission_epoch = excluded.admission_epoch,
           updated_at = now()
       WHERE excluded.admission_epoch >= admission.admission_epoch
+      RETURNING release_id, accepting, admission_epoch::text AS admission_epoch
     `,
     [
       releaseAdmissionLockKeys,
@@ -6917,6 +7033,23 @@ export async function setPostgresSchedulerRuntimeReleaseAdmission(
       releaseAdmissionWriteKeys,
     ],
   );
+  if (
+    input.accepting &&
+    (result.rows.length !== releaseAdmissionWriteKeys.length ||
+      new Set(result.rows.map((row) => row.release_id)).size !==
+        releaseAdmissionWriteKeys.length ||
+      result.rows.some(
+        (row) =>
+          !releaseAdmissionWriteKeys.includes(row.release_id) ||
+          row.accepting !== true ||
+          runtimeReleaseAdmissionEpoch(Number(row.admission_epoch)) !==
+            input.admissionEpoch,
+      ))
+  ) {
+    throw new Error(
+      `Runtime release admission opening refused for "${input.releaseId}" at epoch ${input.admissionEpoch}.`,
+    );
+  }
 }
 
 /**
@@ -6935,6 +7068,7 @@ export async function withPostgresSchedulerClosedReleaseAdmission<T>(
   operation: () => Promise<T>,
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<{ guarded: false } | { guarded: true; value: T }> {
+  runtimeReleaseAdmissionEpoch(input.admissionEpoch);
   const { releaseAdmissionLockKeys } = runtimeReleaseAdmissionKeys(input);
   await client.query('BEGIN ISOLATION LEVEL READ COMMITTED');
   try {
@@ -10748,7 +10882,8 @@ export async function settlePostgresSchedulerRuntimeResources(
  * retried push is idempotent and a duplicate can never rewrite the recorded
  * outcome. Returns true when a terminal is durably recorded for the attempt
  * (either by this call or an earlier one); false when the attempt row does not
- * exist (unknown attempt — the caller must reject, not invent state).
+ * exist or a synthetic loss presents an obsolete heartbeat identity. Ordinary
+ * ingress must reject an unknown attempt rather than invent state.
  */
 export async function recordPostgresSchedulerRunnerTerminal(
   client: PostgresSchedulerQueryClient,
@@ -10757,6 +10892,9 @@ export async function recordPostgresSchedulerRunnerTerminal(
     attempt: number;
     result: unknown;
     terminalProgressEvents?: readonly unknown[];
+    /** Only synthetic runner-loss outcomes use this exact liveness fence.
+     * Undefined preserves ordinary terminal ingress; null confirms no heartbeat. */
+    expectedHeartbeatIdentity?: string | null;
   },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<boolean> {
@@ -10771,7 +10909,9 @@ export async function recordPostgresSchedulerRunnerTerminal(
        )
       UPDATE ${tableName('attempts', options)} AS target
       SET runner_result_json = COALESCE(target.runner_result_json, $3::jsonb),
-          runner_log_payload_json = CASE WHEN EXISTS (
+          runner_log_payload_json = CASE
+            WHEN target.runner_result_json IS NOT NULL THEN target.runner_log_payload_json
+            WHEN EXISTS (
             SELECT 1 FROM ${tableName('runs', options)} AS log_run
              WHERE log_run.run_id = target.run_id AND log_run.run_log_store = 'planet_scale'
           ) THEN $4::jsonb ELSE NULL END,
@@ -10830,6 +10970,11 @@ export async function recordPostgresSchedulerRunnerTerminal(
       FROM accepted
       WHERE target.run_id = $1
         AND target.attempt = $2
+        AND (
+          NOT $5::boolean
+          OR target.runner_result_json IS NOT NULL
+          OR target.heartbeat_at IS NOT DISTINCT FROM $6::timestamptz
+        )
       RETURNING target.run_id
     `,
     [
@@ -10837,6 +10982,8 @@ export async function recordPostgresSchedulerRunnerTerminal(
       input.attempt,
       stringifyPostgresJson(input.result ?? null),
       stringifyPostgresJson(runnerTerminalLogPayload(input)),
+      input.expectedHeartbeatIdentity !== undefined,
+      input.expectedHeartbeatIdentity ?? null,
     ],
   );
   return recorded.rows.length > 0;
@@ -10871,6 +11018,29 @@ function terminalWorkCounterSegmentFromRunnerResult(
   });
 }
 
+/** Only the authenticated raw runner envelope supplies this fact. */
+function terminalRuntimePerformanceFacts(result: unknown, attempt: number) {
+  const envelope =
+    result && typeof result === 'object' && !Array.isArray(result)
+      ? (result as { stats?: unknown })
+      : undefined;
+  const identity = terminalWorkCounterSegmentFromRunnerResult(result, attempt);
+  const performance = identity
+    ? terminalRuntimePerformanceFromStats(envelope?.stats, identity)
+    : undefined;
+  const hasResources =
+    envelope?.stats &&
+    typeof envelope.stats === 'object' &&
+    Object.hasOwn(envelope.stats, 'runtimeResources');
+  return {
+    performance,
+    unavailableReason:
+      hasResources && !performance
+        ? ('invalid_runner_stats' as const)
+        : undefined,
+  };
+}
+
 /** Close the admitted invocation in the same durable fact as its terminal. */
 function terminalWorkCounterProgressEventsFromRunnerResult(
   result: unknown,
@@ -10972,6 +11142,10 @@ export async function directCompletePostgresSchedulerRunnerTerminal(
     input.result,
     input.attempt,
   );
+  const terminalPerformanceFacts = terminalRuntimePerformanceFacts(
+    input.result,
+    input.attempt,
+  );
   // `workCompletedAtMs` is useful lifecycle telemetry, but it comes from the
   // sandbox process where play code can alter Date.now. Billing must stop on
   // the first database receipt, whose clock and first-write semantics are
@@ -11198,7 +11372,8 @@ export async function directCompletePostgresSchedulerRunnerTerminal(
             finished_at = now(),
             updated_at = now()
         WHERE run_id IN (SELECT run_id FROM completed_attempt)
-        RETURNING run_id
+        RETURNING run_id, launch_json#>>'{contractSnapshot,compatibility,terminalRuntimePerformanceSupported}' = 'true' AS terminal_runtime_performance_supported,
+          launch_json#>>'{contractSnapshot,compatibility,terminalRuntimeBodyAdmissionSupported}' = 'true' AS terminal_runtime_body_admission_supported
       ),
       compute_billing_job AS (
         INSERT INTO ${tableName('compute_billing_jobs_v2', options)} (run_id)
@@ -11242,7 +11417,18 @@ export async function directCompletePostgresSchedulerRunnerTerminal(
             ), $8::jsonb),
             'resultSummary', $16::jsonb,
             'terminalWorkCounterSegment', $18::jsonb
-          ),
+          ) || CASE WHEN run_terminal.terminal_runtime_performance_supported THEN jsonb_build_object(
+            'terminalRuntimePerformance', CASE
+              WHEN run_terminal.terminal_runtime_body_admission_supported THEN $21::jsonb
+              WHEN jsonb_typeof($21::jsonb->'memoryAdmission') = 'object' THEN
+                CASE WHEN ($21::jsonb->'memoryAdmission') - 'toolResponseBody' = '{}'::jsonb
+                  THEN $21::jsonb - 'memoryAdmission'
+                  ELSE jsonb_set($21::jsonb, '{memoryAdmission}', ($21::jsonb->'memoryAdmission') - 'toolResponseBody')
+                END
+              ELSE $21::jsonb
+            END,
+            'terminalRuntimePerformanceUnavailableReason', $22::text
+          ) ELSE '{}'::jsonb END,
           ${causalOutboxCreatedAt('run_terminal.run_id', options)}
         FROM run_terminal
         ON CONFLICT (event_id) DO NOTHING
@@ -11282,6 +11468,8 @@ export async function directCompletePostgresSchedulerRunnerTerminal(
       stringifyPostgresJson(terminalWorkCounterSegment ?? null),
       stringifyPostgresJson(runnerTerminalLogPayload(input)),
       JSON.stringify(terminalLogProjection.lineMetadata),
+      stringifyPostgresJson(terminalPerformanceFacts.performance ?? null),
+      terminalPerformanceFacts.unavailableReason ?? null,
     ],
   );
   if (completed.rows.length > 0) return 'completed';
@@ -12426,10 +12614,171 @@ export async function claimPostgresSchedulerSandboxCleanupJobs(
           (provider) => provider === 'daytona' || provider === 'modal',
         );
   if (providers?.length === 0) return [];
-  // Adopt any obligation written by a draining v12 worker. This stays
-  // idempotent because deleted v2 rows remain as the durable completion fact.
-  await client.query(
-    `
+  // The v12 table retains deleted history. Avoid planning the lineage repair
+  // when neither a legacy row nor a v2 NULL-domain duplicate needs adoption.
+  // A row arriving after this read is picked up by the next claim poll; the
+  // provider-qualified v2 claim below still runs on every call.
+  const adoptionWork = await client.query<{ pending: boolean }>(`
+    SELECT EXISTS (
+      SELECT 1 FROM ${tableName('sandbox_cleanup_jobs_v2', options)}
+      WHERE provider = 'daytona' AND routing_domain IS NULL
+        AND status <> 'deleted'
+    ) OR EXISTS (
+      SELECT 1 FROM ${tableName('sandbox_cleanup_jobs', options)}
+      WHERE status <> 'deleted'
+    ) AS pending
+  `);
+  if (typeof adoptionWork.rows[0]?.pending !== 'boolean') {
+    throw new Error(
+      'Sandbox cleanup adoption preflight returned no pending proof.',
+    );
+  }
+  // A v12 NULL-domain row can be copied to v2 before provider deletion gives
+  // the v2 tombstone its observed domain. The moved primary key would
+  // otherwise make every later adoption recreate a pending NULL-domain row.
+  // Reconcile only the exact original identity proved by the immutable
+  // provider confirmation and the matching deleted v2 tombstone.
+  if (adoptionWork.rows[0].pending)
+    await client.query(
+      `
+      WITH pending_legacy AS MATERIALIZED (
+        SELECT sandbox_id, run_id, attempt, environment, routing_domain,
+               attempt_count, failure_count, available_at, last_error,
+               created_at, blocked_at, block_reason
+        FROM ${tableName('sandbox_cleanup_jobs', options)}
+        WHERE status <> 'deleted'
+      ), unresolved_null_domain AS MATERIALIZED (
+        SELECT sandbox_id, run_id, attempt, environment
+        FROM ${tableName('sandbox_cleanup_jobs_v2', options)}
+        WHERE provider = 'daytona'
+          AND routing_domain IS NULL
+          AND status <> 'deleted'
+        UNION
+        SELECT sandbox_id, run_id, attempt, environment
+        FROM pending_legacy
+        WHERE routing_domain IS NULL
+      ), confirmed_null_domain AS MATERIALIZED (
+        SELECT
+          deleted.sandbox_id, deleted.run_id, deleted.attempt,
+          deleted.environment,
+          MIN(COALESCE(deleted.deleted_at, confirmation.created_at)) AS confirmed_deleted_at
+        FROM unresolved_null_domain AS original
+        JOIN ${tableName('sandbox_cleanup_jobs_v2', options)} AS deleted
+          ON deleted.sandbox_id = original.sandbox_id
+         AND deleted.run_id = original.run_id
+         AND deleted.attempt = original.attempt
+         AND deleted.environment = original.environment
+        JOIN ${tableName('sandbox_cleanup_events_v2', options)} AS confirmation
+          ON confirmation.provider = deleted.provider
+         AND confirmation.sandbox_id = deleted.sandbox_id
+         AND confirmation.run_id = deleted.run_id
+         AND confirmation.attempt = deleted.attempt
+         AND confirmation.routing_domain IS NULL
+         AND confirmation.event_type = 'provider_delete_confirmed'
+         AND confirmation.details_json->>'providerOutcome' = 'deleted'
+         AND confirmation.details_json->>'routingDomain' = deleted.routing_domain
+        WHERE deleted.provider = 'daytona'
+          AND deleted.status = 'deleted'
+          AND deleted.routing_domain IS NOT NULL
+        GROUP BY deleted.sandbox_id, deleted.run_id, deleted.attempt,
+                 deleted.environment
+      ), settled_duplicate AS (
+        UPDATE ${tableName('sandbox_cleanup_jobs_v2', options)} AS pending
+        SET status = 'deleted',
+            deleted_at = confirmed.confirmed_deleted_at,
+            lease_owner = NULL,
+            lease_expires_at = NULL,
+            last_error = NULL,
+            updated_at = clock_timestamp()
+        FROM confirmed_null_domain AS confirmed
+        WHERE pending.provider = 'daytona'
+          AND pending.sandbox_id = confirmed.sandbox_id
+          AND pending.run_id = confirmed.run_id
+          AND pending.attempt = confirmed.attempt
+          AND pending.environment = confirmed.environment
+          AND pending.routing_domain IS NULL
+          AND pending.status <> 'deleted'
+        RETURNING pending.sandbox_id
+      ), proven_legacy AS MATERIALIZED (
+        SELECT legacy.sandbox_id, legacy.run_id, legacy.attempt,
+               legacy.environment, legacy.routing_domain,
+               COALESCE(
+                 (
+                   SELECT deleted.deleted_at
+                   FROM ${tableName('sandbox_cleanup_jobs_v2', options)} AS deleted
+                   WHERE deleted.provider = 'daytona'
+                     AND deleted.sandbox_id = legacy.sandbox_id
+                     AND deleted.run_id = legacy.run_id
+                     AND deleted.attempt = legacy.attempt
+                     AND deleted.environment = legacy.environment
+                     AND deleted.routing_domain IS NOT DISTINCT FROM legacy.routing_domain
+                     AND deleted.status = 'deleted'
+                 ),
+                 (
+                   SELECT confirmed.confirmed_deleted_at
+                   FROM confirmed_null_domain AS confirmed
+                   WHERE legacy.routing_domain IS NULL
+                     AND confirmed.sandbox_id = legacy.sandbox_id
+                     AND confirmed.run_id = legacy.run_id
+                     AND confirmed.attempt = legacy.attempt
+                     AND confirmed.environment = legacy.environment
+                 ),
+                 (
+                   SELECT MIN(confirmation.created_at)
+                   FROM ${tableName('sandbox_cleanup_events_v2', options)} AS confirmation
+                   WHERE confirmation.provider = 'daytona'
+                     AND confirmation.sandbox_id = legacy.sandbox_id
+                     AND confirmation.run_id = legacy.run_id
+                     AND confirmation.attempt = legacy.attempt
+                     AND confirmation.routing_domain IS NOT DISTINCT FROM legacy.routing_domain
+                     AND confirmation.event_type = 'provider_delete_confirmed'
+                     AND confirmation.details_json->>'providerOutcome' IN ('deleted', 'already_absent')
+                     AND confirmation.details_json->>'routingDomain' IS NOT DISTINCT FROM legacy.routing_domain
+                 )
+               ) AS confirmed_deleted_at
+        FROM pending_legacy AS legacy
+        WHERE (
+            EXISTS (
+              SELECT 1
+              FROM ${tableName('sandbox_cleanup_jobs_v2', options)} AS deleted
+              WHERE deleted.provider = 'daytona'
+                AND deleted.sandbox_id = legacy.sandbox_id
+                AND deleted.run_id = legacy.run_id
+                AND deleted.attempt = legacy.attempt
+                AND deleted.environment = legacy.environment
+                AND deleted.routing_domain IS NOT DISTINCT FROM legacy.routing_domain
+                AND deleted.status = 'deleted'
+            )
+            OR (
+              legacy.routing_domain IS NULL
+              AND EXISTS (
+                SELECT 1 FROM confirmed_null_domain AS confirmed
+                WHERE confirmed.sandbox_id = legacy.sandbox_id
+                  AND confirmed.run_id = legacy.run_id
+                  AND confirmed.attempt = legacy.attempt
+                  AND confirmed.environment = legacy.environment
+              )
+            )
+          )
+      ), settled_legacy AS (
+        UPDATE ${tableName('sandbox_cleanup_jobs', options)} AS legacy
+        SET status = 'deleted',
+            deleted_at = COALESCE(proven.confirmed_deleted_at, legacy.deleted_at),
+            lease_owner = NULL,
+            lease_expires_at = NULL,
+            last_error = NULL,
+            updated_at = clock_timestamp()
+        FROM proven_legacy AS proven
+        -- Completion locks v2 before legacy. Consume the v2 update first so
+        -- concurrent adoption cannot acquire the same rows in reverse order.
+        CROSS JOIN (SELECT count(*) FROM settled_duplicate) AS duplicate_fence
+        WHERE legacy.sandbox_id = proven.sandbox_id
+          AND legacy.run_id = proven.run_id
+          AND legacy.attempt = proven.attempt
+          AND legacy.environment = proven.environment
+          AND legacy.routing_domain IS NOT DISTINCT FROM proven.routing_domain
+        RETURNING legacy.sandbox_id
+      )
       INSERT INTO ${tableName('sandbox_cleanup_jobs_v2', options)} (
         provider,
         sandbox_id,
@@ -12463,11 +12812,18 @@ export async function claimPostgresSchedulerSandboxCleanupJobs(
         now(),
         blocked_at,
         block_reason
-      FROM ${tableName('sandbox_cleanup_jobs', options)}
-      WHERE status <> 'deleted'
+      FROM pending_legacy AS legacy
+      WHERE NOT EXISTS (
+          SELECT 1 FROM proven_legacy AS proven
+          WHERE proven.sandbox_id = legacy.sandbox_id
+            AND proven.run_id = legacy.run_id
+            AND proven.attempt = legacy.attempt
+            AND proven.environment = legacy.environment
+            AND proven.routing_domain IS NOT DISTINCT FROM legacy.routing_domain
+        )
       ON CONFLICT (provider, sandbox_id, routing_domain_key) DO NOTHING
     `,
-  );
+    );
   const claimed = await client.query<{
     provider: 'daytona' | 'modal';
     sandbox_id: string;
@@ -12768,6 +13124,62 @@ export async function recordPostgresSchedulerSandboxCleanupEvent(
   );
 }
 
+export type PostgresSchedulerSandboxDeleteAcceptance = {
+  acceptedAtMs: number;
+  /** The organization of the sandbox Daytona accepted the delete for. */
+  organizationId: string | null;
+};
+
+/**
+ * The first delete the provider accepted for this job. A cleanup that was
+ * accepted and is awaiting its read-back reads this between claims.
+ */
+export async function readPostgresSchedulerSandboxDeleteAcceptance(
+  client: PostgresSchedulerQueryClient,
+  input: {
+    provider: 'daytona' | 'modal';
+    sandboxId: string;
+    routingDomain: string | null;
+    runId: string;
+    attempt: number;
+  },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<PostgresSchedulerSandboxDeleteAcceptance | null> {
+  const accepted = await client.query<{
+    accepted_at_ms: string;
+    organization_id: string | null;
+  }>(
+    `
+      SELECT
+        (extract(epoch FROM created_at) * 1000)::bigint::text AS accepted_at_ms,
+        details_json->>'routingDomain' AS organization_id
+      FROM ${tableName('sandbox_cleanup_events_v2', options)}
+      WHERE run_id = $1
+        AND attempt = $2
+        AND provider = $3
+        AND sandbox_id = $4
+        AND routing_domain IS NOT DISTINCT FROM $5
+        AND event_type = 'provider_delete_accepted'
+      ORDER BY created_at, event_id
+      LIMIT 1
+    `,
+    [
+      input.runId,
+      input.attempt,
+      input.provider,
+      input.sandboxId,
+      input.routingDomain?.trim() || null,
+    ],
+  );
+  const row = accepted.rows[0];
+  return row
+    ? {
+        acceptedAtMs: Number(row.accepted_at_ms),
+        organizationId: row.organization_id,
+      }
+    : null;
+}
+
 export async function completePostgresSchedulerSandboxCleanupJob(
   client: PostgresSchedulerQueryClient,
   input: {
@@ -12789,21 +13201,39 @@ export async function completePostgresSchedulerSandboxCleanupJob(
   | 'missing_obligation'
   | 'wrong_routing_domain'
 > {
+  // `deleted_at` feeds billing end times, so it stays the moment the provider
+  // took the delete. Waiting for the read-back must not bill the customer for
+  // Daytona's record outliving it; `delete_confirmed_at` keeps the confirmation.
   const completed = await client.query<{ outcome: string }>(
     `
       WITH ${runtimeSandboxCustodyLocksSql('run.run_id = $3', options)}, current_job AS MATERIALIZED (
-        SELECT status, attempt_count, lease_owner, routing_domain
+        SELECT status, attempt_count, lease_owner, routing_domain, environment
         FROM ${tableName('sandbox_cleanup_jobs_v2', options)} AS sandbox_cleanup_jobs_v2
         CROSS JOIN (SELECT count(*) FROM custody_operations) AS operation_locks
         WHERE provider = $8
           AND sandbox_id = $1
+          AND run_id = $3
+          AND attempt = $4
           AND routing_domain IS NOT DISTINCT FROM $9
         FOR UPDATE OF sandbox_cleanup_jobs_v2
       ),
+      delete_acceptance AS MATERIALIZED (
+        SELECT min(event.created_at) AS accepted_at
+        FROM ${tableName('sandbox_cleanup_events_v2', options)} AS event
+        WHERE event.run_id = $3
+          AND event.attempt = $4
+          AND event.provider = $8
+          AND event.sandbox_id = $1
+          AND event.routing_domain IS NOT DISTINCT FROM $9
+          AND event.event_type = 'provider_delete_accepted'
+      ),
       completed AS (
         UPDATE ${tableName('sandbox_cleanup_jobs_v2', options)} AS target
         SET status = 'deleted',
-            deleted_at = clock_timestamp(),
+            deleted_at = COALESCE(
+              (SELECT accepted_at FROM delete_acceptance),
+              clock_timestamp()
+            ),
             routing_domain = COALESCE(
               target.routing_domain,
               NULLIF($7::text, '')
@@ -12815,6 +13245,8 @@ export async function completePostgresSchedulerSandboxCleanupJob(
         FROM current_job
         WHERE target.provider = $8
           AND target.sandbox_id = $1
+          AND target.run_id = $3
+          AND target.attempt = $4
           AND target.routing_domain IS NOT DISTINCT FROM $9
           AND current_job.status <> 'deleted'
           AND (
@@ -12884,7 +13316,12 @@ export async function completePostgresSchedulerSandboxCleanupJob(
                    )
                   THEN resource || jsonb_build_object(
                     'billingEndedAt',
-                    extract(epoch FROM clock_timestamp()) * 1000
+                    extract(
+                      epoch FROM COALESCE(
+                        (SELECT accepted_at FROM delete_acceptance),
+                        clock_timestamp()
+                      )
+                    ) * 1000
                   )
                   ELSE resource
                 END
@@ -13012,6 +13449,25 @@ export async function completePostgresSchedulerSandboxCleanupJob(
         )
         RETURNING provider, sandbox_id, routing_domain
       ),
+      legacy_completion AS (
+        UPDATE ${tableName('sandbox_cleanup_jobs', options)} AS legacy
+        SET status = 'deleted',
+            deleted_at = COALESCE(legacy.deleted_at, clock_timestamp()),
+            lease_owner = NULL,
+            lease_expires_at = NULL,
+            last_error = NULL,
+            updated_at = clock_timestamp()
+        FROM provider_confirmation AS confirmation
+        CROSS JOIN current_job
+        WHERE confirmation.provider = 'daytona'
+          AND legacy.sandbox_id = confirmation.sandbox_id
+          AND legacy.run_id = $3
+          AND legacy.attempt = $4
+          AND legacy.environment = current_job.environment
+          AND legacy.routing_domain IS NOT DISTINCT FROM confirmation.routing_domain
+          AND legacy.status <> 'deleted'
+        RETURNING legacy.sandbox_id
+      ),
       durable_completion AS (
         INSERT INTO ${tableName('sandbox_cleanup_events_v2', options)} (
           provider,
@@ -13272,6 +13728,8 @@ export type PostgresSchedulerCompletedRunnerTerminal = {
   attempt: number;
   leaseToken: string;
   result: unknown;
+  /** The detached suspension still on the run, when there is one. */
+  suspension?: unknown;
 };
 
 export async function listPostgresSchedulerCompletedRunnerTerminals(
@@ -13311,14 +13769,16 @@ export async function listPostgresSchedulerCompletedRunnerTerminals(
                  terminals.run_id,
                  terminals.attempt,
                  terminals.lease_token,
-                 terminals.runner_result_json
+                 terminals.runner_result_json,
+                 terminals.suspension_json
           FROM requested_lanes AS lanes
           CROSS JOIN LATERAL (
             SELECT runs.launch_json ->> 'absurdReleaseId' AS release_id,
                    attempts.run_id,
                    attempts.attempt,
                    attempts.lease_token,
-                   attempts.runner_result_json
+                   attempts.runner_result_json,
+                   runs.suspension_json
             FROM ${tableName('runs', options)} AS runs
             JOIN ${tableName('attempts', options)} AS attempts
               ON attempts.run_id = runs.run_id
@@ -13344,7 +13804,8 @@ export async function listPostgresSchedulerCompletedRunnerTerminals(
                    attempts.run_id,
                    attempts.attempt,
                    attempts.lease_token,
-                   attempts.runner_result_json
+                   attempts.runner_result_json,
+                   runs.suspension_json
             FROM ${tableName('attempts', options)} AS attempts
             JOIN ${tableName('runs', options)} AS runs
               ON runs.run_id = attempts.run_id
@@ -13365,6 +13826,7 @@ export async function listPostgresSchedulerCompletedRunnerTerminals(
     attempt: number;
     lease_token: string;
     runner_result_json: unknown;
+    suspension_json: unknown;
   }>(terminalQuery.sql, terminalQuery.params);
   return terminals.rows.map((row) => ({
     releaseId: row.release_id,
@@ -13372,56 +13834,319 @@ export async function listPostgresSchedulerCompletedRunnerTerminals(
     attempt: row.attempt,
     leaseToken: row.lease_token,
     result: row.runner_result_json,
+    suspension: row.suspension_json,
   }));
 }
 
+/** A parked detached runner whose heartbeat is stale beyond its own lease. */
+export type PostgresSchedulerStaleDetachedRunner = {
+  provider: 'daytona' | 'modal';
+  releaseId: string | null;
+  runId: string;
+  attempt: number;
+  leaseToken: string;
+  /** Postgres text, so the verdict fence compares every microsecond. */
+  heartbeatAt: string | null;
+  heartbeatAtMs: number | null;
+  suspension: unknown;
+};
+
+/** A runner terminal on a live attempt, on any lane. Identity only: its result
+ * can be large, so settlement reads it one run at a time. */
+export type PostgresSchedulerUnsettledRunnerTerminal = {
+  releaseId: string | null;
+  runId: string;
+  attempt: number;
+  leaseToken: string;
+  suspension: unknown;
+};
+
 /**
- * Read the detached runner's most recent liveness fact for timeout diagnosis.
- * This is observability only: scheduler state remains authoritative and this
- * read must never alter retry or terminal behavior.
+ * Read-only discovery for the liveness sweep, across every release lane. It
+ * selects only runners that need action: a stale parked runner to inspect, or a
+ * recorded terminal to settle. A live heartbeat, a resumable `suspended`
+ * receipt, a passed hard ceiling (its sweep owns that), a newer attempt, and a
+ * queued cancellation all leave a runner out.
+ *
+ * Each provider pages separately, so one provider's backlog cannot crowd out
+ * the other, and `afterRunIds` lets a caller walk past candidates it has read.
  */
-export async function readPostgresSchedulerRunnerLiveness(
+export async function listPostgresSchedulerDetachedRunnerLivenessWork(
   client: PostgresSchedulerQueryClient,
-  input: { runId: string; attempt: number },
+  input: {
+    limit: number;
+    defaultHeartbeatTimeoutMs: number;
+    afterRunIds: Partial<Record<'daytona' | 'modal', string | null>>;
+  },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<{
-  heartbeatAt: string | null;
-  updatedAt: string | null;
-  status: string;
-} | null> {
-  const result = await client.query<{
-    heartbeat_at: string | Date | null;
-    updated_at: string | Date | null;
-    status: string;
+  stale: PostgresSchedulerStaleDetachedRunner[];
+  terminals: PostgresSchedulerUnsettledRunnerTerminal[];
+}> {
+  const rows = await client.query<{
+    work: 'inspect' | 'settle';
+    provider: 'daytona' | 'modal';
+    absurd_release_id: string | null;
+    run_id: string;
+    attempt: number;
+    lease_token: string;
+    heartbeat_at: string | null;
+    heartbeat_at_ms: string | null;
+    suspension_json: unknown;
   }>(
     `
-      SELECT heartbeat_at, updated_at, status
-      FROM ${tableName('attempts', options)}
-      WHERE run_id = $1 AND attempt = $2
+      WITH detached AS MATERIALIZED (
+        SELECT
+          runs.run_id,
+          attempts.attempt,
+          attempts.lease_token,
+          attempts.status AS attempt_status,
+          runs.status AS run_status,
+          attempts.heartbeat_at,
+          attempts.runner_result_json IS NULL AS no_runner_result,
+          attempts.runner_result_json ->> 'status' AS runner_result_status,
+          runs.suspension_json,
+          runs.wait_deadline,
+          NULLIF(runs.launch_json ->> 'absurdReleaseId', '') AS absurd_release_id,
+          COALESCE(
+            NULLIF(runs.suspension_json -> 'runtimeSandboxRef' ->> 'provider', ''),
+            NULLIF(runs.suspension_json ->> 'sandboxProvider', ''),
+            'daytona'
+          ) AS provider
+        FROM ${tableName('runs', options)} AS runs
+        JOIN ${tableName('attempts', options)} AS attempts
+          ON attempts.run_id = runs.run_id
+         AND attempts.attempt = (runs.suspension_json ->> 'runnerAttempt')::integer
+        WHERE runs.status IN ('running', 'waiting')
+          AND runs.suspension_json ->> 'kind' = 'detached_runner'
+          AND attempts.status IN ('running', 'waiting')
+          AND attempts.lease_token IS NOT NULL
+          AND NOT EXISTS (
+            SELECT 1
+            FROM ${tableName('attempts', options)} AS newer
+            WHERE newer.run_id = attempts.run_id
+              AND newer.attempt > attempts.attempt
+              AND newer.status IN ('claimed', 'running', 'waiting', 'completed', 'failed')
+          )
+      ),
+      unsettled AS (
+        SELECT *
+        FROM detached
+        WHERE runner_result_status IN ('completed', 'failed')
+        ORDER BY run_id ASC
+        LIMIT $1
+      ),
+      stale AS (
+        SELECT
+          detached.*,
+          row_number() OVER (PARTITION BY provider ORDER BY run_id ASC) AS provider_rank
+        FROM detached
+        WHERE provider IN ('daytona', 'modal')
+          AND no_runner_result
+          AND attempt_status = 'waiting'
+          AND run_status = 'waiting'
+          AND (wait_deadline IS NULL OR wait_deadline > clock_timestamp())
+          AND run_id > COALESCE($2::jsonb ->> provider, '')
+          AND NOT EXISTS (
+            SELECT 1
+            FROM ${tableName('control', options)} AS cancel
+            WHERE cancel.key = 'runtime_cancel:' || detached.run_id
+          )
+          AND COALESCE(
+            heartbeat_at,
+            CASE
+              WHEN jsonb_typeof(suspension_json -> 'startedAtMs') = 'number'
+              THEN to_timestamp((suspension_json ->> 'startedAtMs')::double precision / 1000)
+            END
+          ) + (
+            CASE
+              WHEN jsonb_typeof(suspension_json -> 'heartbeatTimeoutMs') = 'number'
+               AND (suspension_json ->> 'heartbeatTimeoutMs')::double precision >= 0
+              THEN (suspension_json ->> 'heartbeatTimeoutMs')::double precision
+              ELSE $3::double precision
+            END
+          ) * interval '1 millisecond' <= clock_timestamp()
+      )
+      SELECT
+        'settle' AS work, provider, absurd_release_id, run_id, attempt,
+        lease_token, heartbeat_at::text AS heartbeat_at,
+        (extract(epoch FROM heartbeat_at) * 1000)::bigint::text AS heartbeat_at_ms,
+        suspension_json
+      FROM unsettled
+      UNION ALL
+      SELECT
+        'inspect', provider, absurd_release_id, run_id, attempt,
+        lease_token, heartbeat_at::text,
+        (extract(epoch FROM heartbeat_at) * 1000)::bigint::text,
+        suspension_json
+      FROM stale
+      WHERE provider_rank <= $1
+      ORDER BY run_id ASC
     `,
-    [input.runId, input.attempt],
+    [
+      Math.min(100, Math.max(1, Math.floor(input.limit))),
+      JSON.stringify(input.afterRunIds),
+      input.defaultHeartbeatTimeoutMs,
+    ],
   );
-  const row = result.rows[0];
-  if (!row) return null;
-  const normalizeTimestamp = (value: string | Date | null): string | null =>
-    value instanceof Date ? value.toISOString() : value;
+  const identity = (row: (typeof rows.rows)[number]) => ({
+    releaseId: row.absurd_release_id,
+    runId: row.run_id,
+    attempt: row.attempt,
+    leaseToken: row.lease_token,
+    suspension: row.suspension_json,
+  });
   return {
-    heartbeatAt: normalizeTimestamp(row.heartbeat_at),
-    updatedAt: normalizeTimestamp(row.updated_at),
-    status: row.status,
+    stale: rows.rows
+      .filter((row) => row.work === 'inspect')
+      .map((row) => ({
+        ...identity(row),
+        provider: row.provider,
+        heartbeatAt: row.heartbeat_at,
+        heartbeatAtMs:
+          row.heartbeat_at_ms === null ? null : Number(row.heartbeat_at_ms),
+      })),
+    terminals: rows.rows
+      .filter((row) => row.work === 'settle')
+      .map((row) => identity(row)),
   };
 }
 
 /**
- * Durable authority for detached-runner progress projection.
+ * The sweep's first write. It records the same runner terminal the parked
+ * attempt would, so whichever of the sweep and the wake path settles it commits
+ * one verdict. Everything the provider read could have outdated is fenced in
+ * this one statement: the run must still be parked on this exact attempt, with
+ * the same lease and the same heartbeat, no terminal, no newer attempt, and no
+ * queued cancellation. A false return means something moved during the read,
+ * and it wins.
  *
- * An older runner can keep posting after a timeout starts its replacement.
- * Require this exact attempt to remain active, the run to remain nonterminal,
- * and no newer attempt to exist. Gateway replicas must never infer this fence
- * from process memory.
+ * Takes the Run lock before the attempt lock, matching detached restore.
  */
-function runnerProgressAttemptCurrentCondition(
-  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+export async function recordPostgresSchedulerDetachedRunnerLivenessVerdict(
+  client: PostgresSchedulerQueryClient,
+  input: {
+    runId: string;
+    attempt: number;
+    leaseToken: string;
+    observedHeartbeatAt: string | null;
+    result: unknown;
+  },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<boolean> {
+  const recorded = await client.query<{ run_id: string }>(
+    `
+      WITH parked_run AS MATERIALIZED (
+        SELECT run_id, run_log_store
+        FROM ${tableName('runs', options)}
+        WHERE run_id = $1
+          AND status = 'waiting'
+          AND suspension_json ->> 'kind' = 'detached_runner'
+          AND suspension_json -> 'runnerAttempt' = to_jsonb($2::integer)
+        FOR NO KEY UPDATE
+      ),
+      accepted AS MATERIALIZED (
+        SELECT clock_timestamp() AS accepted_at
+      )
+      UPDATE ${tableName('attempts', options)} AS target
+      SET runner_result_json = $5::jsonb,
+          runner_log_payload_json = CASE
+            WHEN parked_run.run_log_store = 'planet_scale' THEN $6::jsonb
+            ELSE NULL
+          END,
+          runner_terminal_received_at = accepted.accepted_at,
+          heartbeat_at = now(),
+          updated_at = now()
+      FROM parked_run, accepted
+      WHERE target.run_id = parked_run.run_id
+        AND target.attempt = $2
+        AND target.status = 'waiting'
+        AND target.lease_token = $3
+        AND target.heartbeat_at IS NOT DISTINCT FROM $4::timestamptz
+        AND target.runner_result_json IS NULL
+        AND NOT EXISTS (
+          SELECT 1
+          FROM ${tableName('attempts', options)} AS newer
+          WHERE newer.run_id = target.run_id
+            AND newer.attempt > target.attempt
+            AND newer.status IN ('claimed', 'running', 'waiting', 'completed', 'failed')
+        )
+        AND NOT EXISTS (
+          SELECT 1
+          FROM ${tableName('control', options)} AS cancel
+          WHERE cancel.key = 'runtime_cancel:' || target.run_id
+        )
+      RETURNING target.run_id
+    `,
+    [
+      input.runId,
+      input.attempt,
+      input.leaseToken,
+      input.observedHeartbeatAt,
+      stringifyPostgresJson(input.result ?? null),
+      stringifyPostgresJson(
+        runnerTerminalLogPayload({
+          attempt: input.attempt,
+          result: input.result,
+        }),
+      ),
+    ],
+  );
+  return recorded.rows.length > 0;
+}
+
+/**
+ * Read the detached runner's most recent liveness fact for timeout diagnosis.
+ * The raw timestamp identity retains PostgreSQL precision for synthetic
+ * runner-loss arbitration; the normalized timestamp remains diagnostic.
+ */
+export async function readPostgresSchedulerRunnerLiveness(
+  client: PostgresSchedulerQueryClient,
+  input: { runId: string; attempt: number },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<{
+  heartbeatAt: string | null;
+  heartbeatIdentity: string | null;
+  updatedAt: string | null;
+  status: string;
+} | null> {
+  const result = await client.query<{
+    heartbeat_at: string | Date | null;
+    heartbeat_identity: string | null;
+    updated_at: string | Date | null;
+    status: string;
+  }>(
+    `
+      SELECT heartbeat_at,
+        to_char(heartbeat_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"') AS heartbeat_identity,
+        updated_at, status
+      FROM ${tableName('attempts', options)}
+      WHERE run_id = $1 AND attempt = $2
+    `,
+    [input.runId, input.attempt],
+  );
+  const row = result.rows[0];
+  if (!row) return null;
+  const normalizeTimestamp = (value: string | Date | null): string | null =>
+    value instanceof Date ? value.toISOString() : value;
+  return {
+    heartbeatAt: normalizeTimestamp(row.heartbeat_at),
+    heartbeatIdentity: row.heartbeat_identity,
+    updatedAt: normalizeTimestamp(row.updated_at),
+    status: row.status,
+  };
+}
+
+/**
+ * Durable authority for detached-runner progress projection.
+ *
+ * An older runner can keep posting after a timeout starts its replacement.
+ * Require this exact attempt to remain active, the run to remain nonterminal,
+ * and no newer attempt to exist. Gateway replicas must never infer this fence
+ * from process memory.
+ */
+function runnerProgressAttemptCurrentCondition(
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): string {
   return `EXISTS (
         SELECT 1
@@ -13482,6 +14207,92 @@ export async function readPostgresSchedulerRunnerAttemptAuthority(
   };
 }
 
+export type PostgresSchedulerExecutorAttemptStanding = {
+  runStatus: string;
+  /** Null when the token names no attempt, or no row exists for it. */
+  attemptStatus: string | null;
+  /** A newer attempt exists. Assigning one retires every older attempt. */
+  superseded: boolean;
+};
+
+/**
+ * Where an executor token's run and attempt stand, for the gateway's attempt
+ * fence. It reads the same facts as `runnerProgressAttemptCurrentCondition`
+ * but keeps them apart, because only some of them are permanent. Returns null
+ * when the run is missing.
+ */
+export async function readPostgresSchedulerExecutorAttemptStanding(
+  client: PostgresSchedulerQueryClient,
+  input: { runId: string; attempt: number | null },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<PostgresSchedulerExecutorAttemptStanding | null> {
+  const result = await client.query<{
+    run_status: string;
+    attempt_status: string | null;
+    superseded: boolean;
+  }>(
+    `
+      SELECT run.status AS run_status,
+             attempt.status AS attempt_status,
+             EXISTS (
+               SELECT 1
+               FROM ${tableName('attempts', options)} AS newer_attempt
+               WHERE newer_attempt.run_id = run.run_id
+                 AND newer_attempt.attempt > $2::integer
+             ) AS superseded
+      FROM ${tableName('runs', options)} AS run
+      LEFT JOIN ${tableName('attempts', options)} AS attempt
+        ON attempt.run_id = run.run_id
+       AND attempt.attempt = $2::integer
+      WHERE run.run_id = $1
+    `,
+    [input.runId, input.attempt],
+  );
+  const row = result.rows[0];
+  if (!row) return null;
+  return {
+    runStatus: row.run_status,
+    attemptStatus: row.attempt_status ?? null,
+    superseded: row.superseded === true,
+  };
+}
+
+/**
+ * Register the terminal cleanup obligation before the first external tenant
+ * array-input write. Updating the run row serializes this intent with every
+ * terminal transition, so a terminal that wins first rejects the write, and a
+ * registered write is visible to terminal outbox delivery after any crash.
+ */
+export async function registerPostgresSchedulerArrayInputIntent(
+  client: PostgresSchedulerQueryClient,
+  input: { orgId: string; runId: string; attempt: number },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<boolean> {
+  const registered = await client.query<{ run_id: string }>(
+    `
+      UPDATE ${tableName('runs', options)} AS run
+      SET array_input_started = true
+      WHERE run.run_id = $1
+        AND run.org_id = $2
+        AND run.status IN ('queued', 'running', 'waiting')
+        AND EXISTS (
+          SELECT 1 FROM ${tableName('attempts', options)} AS current_attempt
+          WHERE current_attempt.run_id = run.run_id
+            AND current_attempt.attempt = $3
+            AND current_attempt.status IN ('claimed', 'running', 'waiting')
+            AND NOT EXISTS (
+              SELECT 1 FROM ${tableName('attempts', options)} AS newer_attempt
+              WHERE newer_attempt.run_id = current_attempt.run_id
+                AND newer_attempt.attempt > current_attempt.attempt
+            )
+        )
+      RETURNING run.run_id
+    `,
+    [input.runId, input.orgId, input.attempt],
+  );
+  return registered.rows.length === 1;
+}
+
 /**
  * Push execution (B2-final): the detached runner's liveness/cancellation poll.
  * Bumps `heartbeat_at` on the runner's attempt row (the same liveness column
@@ -13650,10 +14461,16 @@ export async function completePostgresSchedulerAttempt(
     terminalLogMetadata?: readonly (PlayLogMetadata | null)[] | null;
     terminalLogIds?: readonly (string | null)[] | null;
     terminalWorkCounterSegment?: PlayRunLedgerTerminalWorkCounterSegment;
+    /** Canonical runner stats, never Play output metadata. */
+    terminalRuntimeStats?: unknown;
     terminalProgressEvents?: readonly unknown[];
   },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<boolean> {
+  const terminalPerformanceFacts = terminalRuntimePerformanceFacts(
+    { stats: input.terminalRuntimeStats },
+    input.attempt,
+  );
   const terminalResult = assertTerminalRunResultWithinLimit(input.output);
   const ledgerTerminalResult = terminalRunResultForLedger(terminalResult, {
     content: 'full',
@@ -13838,7 +14655,8 @@ export async function completePostgresSchedulerAttempt(
             updated_at = now()
         WHERE run_id IN (SELECT run_id FROM completed)
           AND status IN ('queued', 'running', 'waiting')
-        RETURNING run_id
+        RETURNING run_id, launch_json#>>'{contractSnapshot,compatibility,terminalRuntimePerformanceSupported}' = 'true' AS terminal_runtime_performance_supported,
+          launch_json#>>'{contractSnapshot,compatibility,terminalRuntimeBodyAdmissionSupported}' = 'true' AS terminal_runtime_body_admission_supported
       ),
       compute_billing_job AS (
         INSERT INTO ${tableName('compute_billing_jobs_v2', options)} (run_id)
@@ -13877,7 +14695,18 @@ export async function completePostgresSchedulerAttempt(
             'terminalLogIds', $15::jsonb,
             'resultSummary', $10::jsonb,
             'terminalWorkCounterSegment', $12::jsonb
-          ) || CASE
+          ) || CASE WHEN run_terminal.terminal_runtime_performance_supported THEN jsonb_build_object(
+            'terminalRuntimePerformance', CASE
+              WHEN run_terminal.terminal_runtime_body_admission_supported THEN $16::jsonb
+              WHEN jsonb_typeof($16::jsonb->'memoryAdmission') = 'object' THEN
+                CASE WHEN ($16::jsonb->'memoryAdmission') - 'toolResponseBody' = '{}'::jsonb
+                  THEN $16::jsonb - 'memoryAdmission'
+                  ELSE jsonb_set($16::jsonb, '{memoryAdmission}', ($16::jsonb->'memoryAdmission') - 'toolResponseBody')
+                END
+              ELSE $16::jsonb
+            END,
+            'terminalRuntimePerformanceUnavailableReason', $17::text
+          ) ELSE '{}'::jsonb END || CASE
             WHEN jsonb_array_length($14::jsonb) > 0
               THEN jsonb_build_object('terminalProgressEvents', $14::jsonb)
             ELSE '{}'::jsonb
@@ -13913,6 +14742,8 @@ export async function completePostgresSchedulerAttempt(
           ? terminalLogEntries.map((entry) => entry.entryId)
           : null,
       ),
+      stringifyPostgresJson(terminalPerformanceFacts.performance ?? null),
+      terminalPerformanceFacts.unavailableReason ?? null,
     ],
   );
   if (completed.rows.length === 0) {
@@ -13971,6 +14802,10 @@ export async function failPostgresSchedulerAttempt(
     input.result,
     input.attempt,
   );
+  const terminalPerformanceFacts = terminalRuntimePerformanceFacts(
+    input.result,
+    input.attempt,
+  );
   // Keep the recovery tail separate from result: large failures are represented
   // by a result reference, but their customer guidance must still be logged.
   if (
@@ -14233,7 +15068,8 @@ export async function failPostgresSchedulerAttempt(
             updated_at = now()
         WHERE run_id IN (SELECT run_id FROM failed)
           AND status IN ('queued', 'running', 'waiting')
-        RETURNING run_id
+        RETURNING run_id, launch_json#>>'{contractSnapshot,compatibility,terminalRuntimePerformanceSupported}' = 'true' AS terminal_runtime_performance_supported,
+          launch_json#>>'{contractSnapshot,compatibility,terminalRuntimeBodyAdmissionSupported}' = 'true' AS terminal_runtime_body_admission_supported
       ),
       compute_billing_job AS (
         INSERT INTO ${tableName('compute_billing_jobs_v2', options)} (run_id)
@@ -14273,7 +15109,18 @@ export async function failPostgresSchedulerAttempt(
             'terminalLogIds', $18::jsonb,
             'resultSummary', $13::jsonb,
             'terminalWorkCounterSegment', $15::jsonb
-          ) || CASE
+          ) || CASE WHEN run_terminal.terminal_runtime_performance_supported THEN jsonb_build_object(
+            'terminalRuntimePerformance', CASE
+              WHEN run_terminal.terminal_runtime_body_admission_supported THEN $19::jsonb
+              WHEN jsonb_typeof($19::jsonb->'memoryAdmission') = 'object' THEN
+                CASE WHEN ($19::jsonb->'memoryAdmission') - 'toolResponseBody' = '{}'::jsonb
+                  THEN $19::jsonb - 'memoryAdmission'
+                  ELSE jsonb_set($19::jsonb, '{memoryAdmission}', ($19::jsonb->'memoryAdmission') - 'toolResponseBody')
+                END
+              ELSE $19::jsonb
+            END,
+            'terminalRuntimePerformanceUnavailableReason', $20::text
+          ) ELSE '{}'::jsonb END || CASE
             WHEN jsonb_array_length($16::jsonb) > 0
               THEN jsonb_build_object('terminalProgressEvents', $16::jsonb)
             ELSE '{}'::jsonb
@@ -14312,6 +15159,8 @@ export async function failPostgresSchedulerAttempt(
             ? terminalLogEntries.map((entry) => entry.entryId)
             : null,
         ),
+        stringifyPostgresJson(terminalPerformanceFacts.performance ?? null),
+        terminalPerformanceFacts.unavailableReason ?? null,
       ],
     );
   const failed = input.protectWaitingSuspensionFailure
@@ -14878,10 +15727,16 @@ export async function finalizePostgresSchedulerComputeBilling(
       'Late runtime resource billing is waiting for provider-confirmed cleanup or its bounded billing ceiling.',
     );
   }
-  const lateItems = resolveLateRuntimeSandboxComputeItems({
-    resources: lateResources,
-    endedAt: Date.now(),
-  });
+  const lateItems =
+    lateResources.length === 0
+      ? []
+      : resolveLateRuntimeSandboxComputeItems({
+          resources: lateResources,
+          endedAt: Date.now(),
+          maxBillingDurationSeconds:
+            sandboxRuntimeLimitsFromContractSnapshot(launch.contractSnapshot)
+              .timeoutSeconds + PLAY_RUNNER_TERMINAL_GRACE_SECONDS,
+        });
   for (const item of lateItems) {
     const adjustmentSessionId = `${launch.runId}:late-resource:${createHash(
       'sha256',
@@ -15500,6 +16355,7 @@ export async function executePostgresSchedulerClaim(
         attempt: claim.attempt,
         leaseToken: claim.leaseToken,
         output: terminalOutput,
+        terminalRuntimeStats: (output as { stats?: unknown } | null)?.stats,
         rowOutcomes: (output as { rowOutcomes?: unknown } | null)?.rowOutcomes,
         runtimeTiming: extractRunnerRuntimeTiming(output),
         terminalLogLines: terminalLogProjection.lines,
@@ -16268,6 +17124,7 @@ export async function claimPostgresSchedulerReceipt(
   input: ClaimRuntimeStepReceiptInput,
   options: PostgresSchedulerReceiptOptions,
 ): Promise<RuntimeStepReceipt | null> {
+  assertWorkReceiptKeyMutable(input.key);
   const runAttempt = normalizePostgresSchedulerReceiptRunAttempt(
     input.runAttempt,
   );
@@ -16427,6 +17284,7 @@ export async function claimPostgresSchedulerReceipts(
   input: ClaimRuntimeStepReceiptsInput,
   options: PostgresSchedulerReceiptOptions,
 ): Promise<Array<RuntimeStepReceipt | null>> {
+  for (const key of input.keys) assertWorkReceiptKeyMutable(key);
   if (input.keys.length === 0) return [];
   const runAttempt = normalizePostgresSchedulerReceiptRunAttempt(
     input.runAttempt,
@@ -16771,6 +17629,7 @@ export async function completePostgresSchedulerReceipt(
   input: RuntimeStepReceiptCompletionInput & { returnOutput?: boolean },
   options: PostgresSchedulerReceiptOptions,
 ): Promise<RuntimeStepReceipt | null> {
+  assertWorkReceiptKeyMutable(input.key);
   if (input.leaseId === COMPLETED_RECEIPT_CACHE_INSERT_LEASE_ID) {
     const inserted = await client.query<ReceiptRow>(
       `
@@ -17038,6 +17897,8 @@ export async function completePostgresSchedulerReceipts(
   },
   options: PostgresSchedulerReceiptOptions,
 ): Promise<Array<RuntimeStepReceipt | null>> {
+  for (const receipt of input.receipts)
+    assertWorkReceiptKeyMutable(receipt.key);
   if (input.receipts.length === 0) return [];
   const cacheInsertIndexes: number[] = [];
   const leasedIndexes: number[] = [];
@@ -17193,6 +18054,7 @@ export async function failPostgresSchedulerReceipt(
   input: FailRuntimeStepReceiptInput,
   options: PostgresSchedulerReceiptOptions,
 ): Promise<RuntimeStepReceipt | null> {
+  assertWorkReceiptKeyMutable(input.key);
   const runAttempt = normalizePostgresSchedulerReceiptRunAttempt(
     input.runAttempt,
   );
@@ -17243,6 +18105,8 @@ export async function failPostgresSchedulerReceipts(
   input: FailRuntimeStepReceiptsInput,
   options: PostgresSchedulerReceiptOptions,
 ): Promise<Array<RuntimeStepReceipt | null>> {
+  for (const receipt of input.receipts)
+    assertWorkReceiptKeyMutable(receipt.key);
   if (input.receipts.length === 0) return [];
   const normalized = input.receipts.map((receipt) => ({
     ...receipt,
@@ -17351,6 +18215,7 @@ export async function releasePostgresSchedulerReceipt(
   input: ReleaseRuntimeStepReceiptInput,
   options: PostgresSchedulerReceiptOptions,
 ): Promise<RuntimeStepReceipt | null> {
+  assertWorkReceiptKeyMutable(input.key);
   const runAttempt = normalizePostgresSchedulerReceiptRunAttempt(
     input.runAttempt,
   );
@@ -17437,6 +18302,8 @@ async function markPostgresSchedulerReceiptsStatus(
   status: 'running' | 'queued',
   options: PostgresSchedulerReceiptOptions,
 ): Promise<Array<RuntimeStepReceipt | null>> {
+  for (const receipt of input.receipts)
+    assertWorkReceiptKeyMutable(receipt.key);
   if (input.receipts.length === 0) return [];
   const normalized = input.receipts.map((receipt) => ({
     ...receipt,
@@ -17543,6 +18410,7 @@ export async function heartbeatPostgresSchedulerReceipts(
   input: HeartbeatRuntimeStepReceiptsInput,
   options: PostgresSchedulerReceiptOptions,
 ): Promise<Array<RuntimeStepReceipt | null>> {
+  for (const key of input.keys) assertWorkReceiptKeyMutable(key);
   if (input.keys.length === 0) return [];
   if (
     input.leaseIds !== undefined &&
@@ -17640,6 +18508,7 @@ export async function skipPostgresSchedulerReceipt(
   input: SkipRuntimeStepReceiptInput,
   options: PostgresSchedulerReceiptOptions,
 ): Promise<RuntimeStepReceipt | null> {
+  assertWorkReceiptKeyMutable(input.key);
   const runAttempt = normalizePostgresSchedulerReceiptRunAttempt(
     input.runAttempt,
   );
@@ -18113,6 +18982,7 @@ export async function readPostgresSchedulerRunStatus(
         | 'run_id'
         | 'org_id'
         | 'status'
+        | 'run_log_store'
         | 'play_name'
         | 'graph_hash'
         | 'runtime_profile'
@@ -18126,6 +18996,7 @@ export async function readPostgresSchedulerRunStatus(
     >(
       `
       SELECT scheduler_run.run_id, scheduler_run.org_id, scheduler_run.status,
+        scheduler_run.run_log_store,
         scheduler_run.play_name, scheduler_run.graph_hash,
         scheduler_run.runtime_profile, scheduler_run.created_at,
         scheduler_run.updated_at, scheduler_run.started_at,
@@ -18146,6 +19017,10 @@ export async function readPostgresSchedulerRunStatus(
         ? { definitionScope: row.definition_scope }
         : {}),
       status: row.status,
+      ...(row.run_log_store === 'planet_scale'
+        ? { runLogStore: 'planet_scale' as const }
+        : {}),
+      schedulerSchema: schemaName(options),
       playName: row.play_name,
       graphHash: row.graph_hash,
       runtimeBackend: null,
@@ -18172,6 +19047,7 @@ export async function readPostgresSchedulerRunStatus(
   const result = await client.query<RunStatusRow>(
     `
       SELECT scheduler_run.run_id, scheduler_run.org_id, scheduler_run.status,
+        scheduler_run.run_log_store,
         scheduler_run.play_name, scheduler_run.graph_hash,
         scheduler_run.runtime_profile, scheduler_run.launch_json,
         scheduler_run.suspension_json, scheduler_run.terminal_result_json,
@@ -18200,6 +19076,10 @@ export async function readPostgresSchedulerRunStatus(
       ? { definitionScope: row.definition_scope }
       : {}),
     status: row.status,
+    ...(row.run_log_store === 'planet_scale'
+      ? { runLogStore: 'planet_scale' as const }
+      : {}),
+    schedulerSchema: schemaName(options),
     playName: row.play_name,
     graphHash: row.graph_hash,
     runtimeBackend: launch.runtimeBackend || null,
@@ -18468,7 +19348,52 @@ function outboxNotFailedSql(alias: string): string {
 // Share that existing boundary between its SQL snapshot and prefix validation.
 const RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS = 8;
 
-/** Only the currently claimed causal prefix may use the projection write path. */
+/** Read only after the caller proved its terminal outbox delivery lease. */
+export async function readPostgresSchedulerTerminalArrayInputIntent(
+  client: PostgresSchedulerQueryClient,
+  input: { orgId: string; runId: string },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<{ playName: string | null; started: boolean }> {
+  return readTerminalArrayInputIntentForScope(client, input, options);
+}
+
+/** Internal dispatch already owns the run's outbox lease; receiver reads also bind its org. */
+async function readTerminalArrayInputIntentForScope(
+  client: PostgresSchedulerQueryClient,
+  input: { orgId?: string; runId: string },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<{ playName: string | null; started: boolean }> {
+  // Historical scheduler schemas have no marker. Inspect only a terminal
+  // delivery, then read the scalar column directly when it exists. Converting
+  // the whole wide run tuple to JSON for every outbox fact would copy launch,
+  // input, and checkpoint payloads just to access this one bit.
+  const column = await client.query<{ present: boolean }>(
+    `SELECT EXISTS (
+      SELECT 1 FROM pg_attribute
+      WHERE attrelid = to_regclass($1)
+        AND attname = 'array_input_started'
+        AND NOT attisdropped
+    ) AS present`,
+    [tableName('runs', options)],
+  );
+  if (column.rows[0]?.present !== true) {
+    return { playName: null, started: false };
+  }
+  const run = await client.query<{
+    array_input_started: boolean;
+    play_name: string;
+  }>(
+    `SELECT array_input_started, play_name FROM ${tableName('runs', options)}
+     WHERE run_id = $1 ${input.orgId === undefined ? '' : 'AND org_id = $2'}
+       AND status IN ('completed', 'failed', 'cancelled')`,
+    input.orgId === undefined ? [input.runId] : [input.runId, input.orgId],
+  );
+  return {
+    playName: run.rows[0]?.play_name ?? null,
+    started: run.rows[0]?.array_input_started === true,
+  };
+}
+
 export async function assertPostgresRunLedgerDelivery(
   client: PostgresSchedulerQueryClient,
   input: {
@@ -18630,6 +19555,15 @@ export async function assertPostgresRunLedgerDelivery(
         runEventsForAppRuntimeProjectionCandidates(
           prefixEvents,
           input.projectionChunk,
+          input.projectedEvents.every(
+            (event) =>
+              !Object.hasOwn(event, 'terminalRuntimePerformance') &&
+              !Object.hasOwn(
+                event,
+                'terminalRuntimePerformanceUnavailableReason',
+              ),
+          ),
+          input.projectedEvents,
         ).map((candidate) =>
           candidate === null
             ? null
@@ -18722,6 +19656,105 @@ function runLedgerPendingRunsSql(
   )`;
 }
 
+/** The causal first head is chosen before eligibility filtering. */
+function runLedgerDiscoveryHeadsSql(
+  options: Pick<PostgresSchedulerOptions, 'schema'> | undefined,
+  searchOnly: boolean,
+  includePayload = false,
+): string {
+  return `WITH RECURSIVE ${runLedgerPendingRunsSql(options, searchOnly)}, heads AS MATERIALIZED (
+              SELECT pending_run.run_id, head.*
+              FROM pending_runs AS pending_run
+              CROSS JOIN LATERAL (
+                SELECT pending.event_id,
+                       pending.event_type,
+                       ${includePayload ? 'pending.payload_json,' : ''}
+                       pending.created_at,
+                       pending.next_attempt_at,
+                       pending.failed_at
+                FROM ${tableName('outbox', options)} AS pending
+                WHERE pending.run_id = pending_run.run_id
+                  AND pending.delivered_at IS NULL
+                  AND ${searchLaneSql('pending')} = ${searchOnly ? 'true' : 'false'}
+                ORDER BY ${runLedgerOrderSql('pending')}
+                LIMIT 1
+              ) AS head
+            )`;
+}
+
+function runLedgerReadyHeadSql(
+  options: Pick<PostgresSchedulerOptions, 'schema'> | undefined,
+  searchOnly: boolean,
+): string {
+  return `head.failed_at IS NULL
+    AND coalesce(head.next_attempt_at, head.created_at) <= now()
+    AND NOT EXISTS (
+      SELECT 1 FROM ${tableName('outbox', options)} AS active
+      WHERE active.run_id = runs.run_id
+        AND ${searchLaneSql('active')} = ${String(searchOnly)}
+        AND active.delivered_at IS NULL
+        AND active.lease_owner IS NOT NULL
+        AND active.lease_expires_at > now()
+    )`;
+}
+
+function runLedgerAdmissionOrderSql(
+  options: Pick<PostgresSchedulerOptions, 'schema'> | undefined,
+  searchOnly: boolean,
+): string {
+  return `CASE
+    WHEN head.event_type = ${RUN_EVENT_KIND_SQL_LITERAL.runCreated} THEN 0
+    WHEN ${runLedgerTerminalPendingSql('head', options)} THEN 1
+    ${searchOnly ? '' : `WHEN ${runLedgerWaitingPendingSql('head', options)} THEN 2`}
+    ELSE 3
+  END,`;
+}
+
+export type RunLedgerOutboxAdmissionHint = {
+  origin: 'admission_snapshot';
+  runId: string;
+};
+
+/**
+ * Read a small ordered, discardable window; it reserves no run or delivery.
+ * Every hinted claim still uses the canonical run-scoped locking/lease path.
+ * This is only used after productive delivery, leaving idle probes unchanged.
+ */
+export async function readPostgresSchedulerOutboxAdmissionHints(
+  client: PostgresSchedulerQueryClient,
+  input: { limit: number; excludeRunIds: readonly string[] },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<RunLedgerOutboxAdmissionHint[]> {
+  if (
+    !Number.isInteger(input.limit) ||
+    input.limit < 1 ||
+    input.limit > 3 ||
+    input.excludeRunIds.length > 32 ||
+    input.excludeRunIds.some((runId) => !runId || runId.trim() !== runId) ||
+    new Set(input.excludeRunIds).size !== input.excludeRunIds.length
+  )
+    throw new Error(
+      'Outbox admission discovery requires1–3 hints and at most32 distinct in-flight run ids.',
+    );
+  const result = await client.query<{ run_id: string }>(
+    `
+    ${runLedgerDiscoveryHeadsSql(options, false)}
+    SELECT runs.run_id
+    FROM heads AS head
+    JOIN ${tableName('runs', options)} AS runs ON runs.run_id = head.run_id
+    WHERE ${runLedgerReadyHeadSql(options, false)}
+      AND NOT (runs.run_id = ANY($2::text[]))
+    ORDER BY ${runLedgerAdmissionOrderSql(options, false)} head.created_at, runs.run_id
+    LIMIT $1
+  `,
+    [input.limit, input.excludeRunIds],
+  );
+  return result.rows.map<RunLedgerOutboxAdmissionHint>(({ run_id }) => ({
+    origin: 'admission_snapshot',
+    runId: run_id,
+  }));
+}
+
 /** Prioritize a terminal's causal head without skipping its predecessors. */
 function runLedgerTerminalPendingSql(
   alias: string,
@@ -18832,6 +19865,7 @@ type RunLedgerOutboxPrefixClaimRow = {
     | 'delivered'
     | 'transport_delivered'
     | 'transport_unconfirmed';
+  array_input_started?: boolean;
   event_id: string;
   run_id: string;
   event_type: string;
@@ -19369,6 +20403,7 @@ function runLedgerOutboxPrefixClaimBatchSql(input: {
   waitForRunLock: boolean;
   lockStrength?: 'no_key_update';
   transportHeadSql?: string;
+  readArrayInputIntent?: boolean;
 }): string {
   // Ordinary claims have four bounded primitive arguments. Give PostgreSQL
   // constants instead of a scalar InitPlan for every repeated argument. Keep
@@ -19424,10 +20459,19 @@ function runLedgerOutboxPrefixClaimBatchSql(input: {
   return `BEGIN;
     SELECT set_config('lock_timeout', '${RUNTIME_SCHEDULER_CANCEL_LOCK_TIMEOUT_MS}ms', true),
            set_config('statement_timeout', '${RUNTIME_SCHEDULER_CANCEL_STATEMENT_TIMEOUT_MS}ms', true);
-    SELECT set_config('deepline.run_ledger_outbox_lock', coalesce((
+    ${
+      input.readArrayInputIntent
+        ? `WITH locked_run AS MATERIALIZED (
+      SELECT run_id, array_input_started FROM ${tableName('runs', { schema: input.schema })}
+      WHERE run_id = ${escapeLiteral(input.runId)} FOR ${input.lockStrength === 'no_key_update' ? 'NO KEY UPDATE' : 'UPDATE'}${input.waitForRunLock ? '' : ' SKIP LOCKED'}
+    )
+    SELECT set_config('deepline.run_ledger_outbox_lock', coalesce((SELECT run_id FROM locked_run), ''), true),
+           (SELECT array_input_started FROM locked_run) AS array_input_started;`
+        : `SELECT set_config('deepline.run_ledger_outbox_lock', coalesce((
       SELECT run_id FROM ${tableName('runs', { schema: input.schema })}
       WHERE run_id = ${escapeLiteral(input.runId)} FOR ${input.lockStrength === 'no_key_update' ? 'NO KEY UPDATE' : 'UPDATE'}${input.waitForRunLock ? '' : ' SKIP LOCKED'}
-    ), ''), true);
+    ), ''), true);`
+    }
     ${input.transportHeadSql ? `SELECT set_config('deepline.run_ledger_transport_ack_count', '0', true);\n    ${input.transportHeadSql};` : ''}
     ${claimSql};
     COMMIT;`;
@@ -19451,6 +20495,7 @@ async function claimRunLedgerOutboxPrefixInBatch(
     /** Discover the zero-effect transport head under this transaction's run lock. */
     discoverTransportHead?: boolean;
     recoverTransportDelivery?: boolean;
+    readArrayInputIntent?: boolean;
   },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
   acknowledgement?: {
@@ -19464,6 +20509,7 @@ async function claimRunLedgerOutboxPrefixInBatch(
   freshClaimLease?: RunLedgerFreshClaimLeaseFacts;
   transportDelivered?: RunLedgerTransportDelivery;
   transportOwnershipUnconfirmed?: boolean;
+  arrayInputStarted?: boolean;
 } | null> {
   if (
     runLedgerOutboxBatchUnsupportedClients.has(client) ||
@@ -19653,6 +20699,7 @@ async function claimRunLedgerOutboxPrefixInBatch(
         lockStrength: input.lockStrength,
         schema: options?.schema,
         transportHeadSql,
+        readArrayInputIntent: input.readArrayInputIntent !== false,
       }),
     );
   } catch (error) {
@@ -19671,6 +20718,26 @@ async function claimRunLedgerOutboxPrefixInBatch(
       });
       throw error;
     }
+    if (
+      input.readArrayInputIntent !== false &&
+      error !== null &&
+      typeof error === 'object' &&
+      'code' in error &&
+      error.code === '42703' &&
+      'message' in error &&
+      typeof error.message === 'string' &&
+      /\barray_input_started\b/.test(error.message)
+    ) {
+      // Retry only this absent optional column after the owned transaction
+      // rolled back. Do not cache absence across a concurrent schema expansion;
+      // terminal delivery will use the historical read path for this claim.
+      return claimRunLedgerOutboxPrefixInBatch(
+        client,
+        { ...input, readArrayInputIntent: false },
+        options,
+        acknowledgement,
+      );
+    }
     if (!isMissingOutboxDeliveryBatchMarker(error)) throw error;
     markOutboxDeliveryBatchMarkerUnavailable(options);
     return null;
@@ -19682,18 +20749,22 @@ async function claimRunLedgerOutboxPrefixInBatch(
   )
     ? result
     : [result];
-  return projectRunLedgerOutboxPrefixRows(
-    results
-      .flatMap((entry) => entry.rows)
-      .filter(
+  const rows = results.flatMap((entry) => entry.rows);
+  return {
+    ...projectRunLedgerOutboxPrefixRows(
+      rows.filter(
         (row) =>
           row.row_kind === 'claimed' ||
           row.row_kind === 'delivered' ||
           row.row_kind === 'transport_delivered' ||
           row.row_kind === 'transport_unconfirmed',
       ),
-    leaseOwner,
-  );
+      leaseOwner,
+    ),
+    arrayInputStarted: rows.find(
+      (row) => typeof row.array_input_started === 'boolean',
+    )?.array_input_started,
+  };
 }
 
 async function claimPostgresSchedulerOutboxPrefix(
@@ -20677,6 +21748,30 @@ export function buildRunLedgerEventsFromPostgresSchedulerOutbox(
       normalizePlayRunLedgerTerminalWorkCounterSegment(
         payloadField(event.payload, 'terminalWorkCounterSegment'),
       );
+    const rawPerformance = payloadField(
+      event.payload,
+      'terminalRuntimePerformance',
+    );
+    const terminalRuntimePerformance =
+      payloadField(event.payload, 'terminalWorkCounterSegment') == null ||
+      terminalWorkCounterSegment
+        ? normalizeTerminalRuntimePerformance(
+            rawPerformance,
+            terminalWorkCounterSegment,
+          )
+        : undefined;
+    const terminalRuntimePerformanceUnavailableReason =
+      !terminalRuntimePerformance
+        ? (normalizeTerminalRuntimePerformanceUnavailableReason(
+            payloadField(
+              event.payload,
+              'terminalRuntimePerformanceUnavailableReason',
+            ),
+          ) ??
+          (rawPerformance != null
+            ? ('invalid_terminal_performance' as const)
+            : undefined))
+        : undefined;
     const progressEvents = ledgerEventsPayloadField(
       event.payload,
       'terminalProgressEvents',
@@ -20707,6 +21802,10 @@ export function buildRunLedgerEventsFromPostgresSchedulerOutbox(
         occurredAt,
         source: 'system',
         ...(terminalWorkCounterSegment ? { terminalWorkCounterSegment } : {}),
+        ...(terminalRuntimePerformance ? { terminalRuntimePerformance } : {}),
+        ...(terminalRuntimePerformanceUnavailableReason
+          ? { terminalRuntimePerformanceUnavailableReason }
+          : {}),
         result: terminalRunResultForLedger(
           payloadField(event.payload, 'output'),
         ),
@@ -20721,6 +21820,30 @@ export function buildRunLedgerEventsFromPostgresSchedulerOutbox(
       normalizePlayRunLedgerTerminalWorkCounterSegment(
         payloadField(event.payload, 'terminalWorkCounterSegment'),
       );
+    const rawPerformance = payloadField(
+      event.payload,
+      'terminalRuntimePerformance',
+    );
+    const terminalRuntimePerformance =
+      payloadField(event.payload, 'terminalWorkCounterSegment') == null ||
+      terminalWorkCounterSegment
+        ? normalizeTerminalRuntimePerformance(
+            rawPerformance,
+            terminalWorkCounterSegment,
+          )
+        : undefined;
+    const terminalRuntimePerformanceUnavailableReason =
+      !terminalRuntimePerformance
+        ? (normalizeTerminalRuntimePerformanceUnavailableReason(
+            payloadField(
+              event.payload,
+              'terminalRuntimePerformanceUnavailableReason',
+            ),
+          ) ??
+          (rawPerformance != null
+            ? ('invalid_terminal_performance' as const)
+            : undefined))
+        : undefined;
     const progressEvents = ledgerEventsPayloadField(
       event.payload,
       'terminalProgressEvents',
@@ -20754,6 +21877,10 @@ export function buildRunLedgerEventsFromPostgresSchedulerOutbox(
         occurredAt,
         source: 'system',
         ...(terminalWorkCounterSegment ? { terminalWorkCounterSegment } : {}),
+        ...(terminalRuntimePerformance ? { terminalRuntimePerformance } : {}),
+        ...(terminalRuntimePerformanceUnavailableReason
+          ? { terminalRuntimePerformanceUnavailableReason }
+          : {}),
         error: stringPayloadField(event.payload, 'error'),
         ...(result === null || result === undefined ? {} : { result }),
         ...(resultSummary === undefined || resultSummary === null
@@ -21230,6 +22357,7 @@ type RunLedgerOutboxDrainScope = {
   leaseOwner: string;
   targetEventId: string;
   nextClaimed: PostgresSchedulerOutboxEvent[];
+  nextArrayInputStarted?: boolean;
 };
 
 type RunLedgerOutboxAuthorityScope = {
@@ -21563,37 +22691,11 @@ async function dispatchRunLedgerOutboxBatchWithScope(
             dispatch_launch_json: unknown;
             transport_head?: RunLedgerTransportCandidate | null;
           }>(`
-            WITH RECURSIVE ${runLedgerPendingRunsSql(options, input.searchOnly === true)}, heads AS MATERIALIZED (
-              SELECT pending_run.run_id, head.*
-              FROM pending_runs AS pending_run
-              CROSS JOIN LATERAL (
-                SELECT pending.event_id,
-                       pending.event_type,
-                       ${needsLaunch ? 'pending.payload_json,' : ''}
-                       pending.created_at,
-                       pending.next_attempt_at,
-                       pending.failed_at
-                FROM ${tableName('outbox', options)} AS pending
-                WHERE pending.run_id = pending_run.run_id
-                  AND pending.delivered_at IS NULL
-                  AND ${searchLaneSql('pending')} = ${input.searchOnly === true ? 'true' : 'false'}
-                ORDER BY ${runLedgerOrderSql('pending')}
-                LIMIT 1
-              ) AS head
-            )
+            ${runLedgerDiscoveryHeadsSql(options, input.searchOnly === true, needsLaunch)}
             SELECT runs.run_id, ${launchSelection} AS dispatch_launch_json, ${transportHeadSelection} AS transport_head
             FROM heads AS head
             JOIN ${tableName('runs', options)} AS runs ON runs.run_id = head.run_id
-            WHERE head.failed_at IS NULL
-              AND coalesce(head.next_attempt_at, head.created_at) <= now()
-              AND NOT EXISTS (
-                SELECT 1 FROM ${tableName('outbox', options)} AS active
-                WHERE active.run_id = runs.run_id
-                  AND ${searchLaneSql('active')} = ${input.searchOnly === true ? 'true' : 'false'}
-                  AND active.delivered_at IS NULL
-                  AND active.lease_owner IS NOT NULL
-                  AND active.lease_expires_at > now()
-              )
+            WHERE ${runLedgerReadyHeadSql(options, input.searchOnly === true)}
             -- admission_first: admission, then the causal head of a run with
             -- a pending terminal or public wait, then FIFO progress. oldest_ready keeps its
             -- pure age order so continuous admissions/terminals cannot starve
@@ -21601,12 +22703,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
             ORDER BY ${
               input.headPriority === 'oldest_ready'
                 ? ''
-                : `CASE
-                       WHEN head.event_type = ${RUN_EVENT_KIND_SQL_LITERAL.runCreated} THEN 0
-                       WHEN ${runLedgerTerminalPendingSql('head', options)} THEN 1
-                       ${input.searchOnly === true ? '' : `WHEN ${runLedgerWaitingPendingSql('head', options)} THEN 2`}
-                       ELSE 3
-                     END,`
+                : runLedgerAdmissionOrderSql(options, input.searchOnly === true)
             }
                      head.created_at, runs.run_id
             FOR UPDATE OF runs SKIP LOCKED LIMIT 1
@@ -21732,6 +22829,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       freshClaimLease: result.freshClaimLease,
       transportDelivered: result.transportDelivered,
       transportOwnershipUnconfirmed: result.transportOwnershipUnconfirmed,
+      arrayInputStarted: result.arrayInputStarted,
     };
   };
   const claimEvents = async (client: PostgresSchedulerQueryClient) => {
@@ -21765,6 +22863,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         freshClaimLease?: RunLedgerFreshClaimLeaseFacts;
         transportDelivered?: RunLedgerTransportDelivery;
         transportOwnershipUnconfirmed?: boolean;
+        arrayInputStarted?: boolean;
       } = { events: [], launchJson: undefined, ingressPrefixClaimed: false };
       return unclaimed;
     }
@@ -21842,6 +22941,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         freshClaimLease: claimed.freshClaimLease,
         transportDelivered: undefined,
         transportOwnershipUnconfirmed: undefined,
+        arrayInputStarted: undefined,
       };
     } catch (error) {
       await client.query('ROLLBACK');
@@ -21851,6 +22951,9 @@ async function dispatchRunLedgerOutboxBatchWithScope(
   const preclaimed = scope?.nextClaimed.length
     ? scope.nextClaimed.splice(0)
     : null;
+  let terminalArrayProjectionOrigin: string | null | undefined;
+  const terminalArrayProjectionOriginFailure: { current?: { error: unknown } } =
+    {};
   const claimStartedAtMonotonicMs = performance.now();
   const claimed = preclaimed
     ? {
@@ -21860,18 +22963,46 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         freshClaimLease: undefined,
         transportDelivered: undefined,
         transportOwnershipUnconfirmed: undefined,
+        arrayInputStarted: scope?.nextArrayInputStarted,
       }
     : await withClient(async (client) => {
         const fast = await claimFastEvents(client);
-        if (fast !== null) return fast;
-        try {
-          return await claimEvents(client);
-        } catch (error) {
-          if (!isMissingOutboxDeliveryBatchMarker(error)) throw error;
-          // claimEvents rolled back. Reacquire the run fence and its fresh
-          // snapshot using only the named missing-column compatibility path.
-          return claimEvents(client);
+        let result: Awaited<ReturnType<typeof claimEvents>>;
+        if (fast !== null) {
+          result = fast;
+        } else {
+          try {
+            result = await claimEvents(client);
+          } catch (error) {
+            if (!isMissingOutboxDeliveryBatchMarker(error)) throw error;
+            // claimEvents rolled back. Reacquire the run fence and its fresh
+            // snapshot using only the named missing-column compatibility path.
+            result = await claimEvents(client);
+          }
+        }
+        if (
+          result.events.some((event) =>
+            RUN_SCHEDULER_OUTBOX_TERMINAL_EVENT_TYPES.includes(event.eventType),
+          )
+        ) {
+          // Reuse the claim checkout. Ordinary terminals must not acquire an
+          // extra scarce client merely to prove that no array was staged.
+          try {
+            terminalArrayProjectionOrigin =
+              await readTerminalArrayProjectionOrigin(
+                (operation) => operation(client),
+                result.launchJson,
+                result.events[0]!.runId,
+                options,
+                result.arrayInputStarted,
+              );
+          } catch (error) {
+            // The claim committed. Settle a routing failure through the same
+            // fenced delivery policy below instead of stranding its lease.
+            terminalArrayProjectionOriginFailure.current = { error };
+          }
         }
+        return result;
       });
   const claimReceivedAtMonotonicMs = performance.now();
   // Debit the complete admission/claim/COMMIT round trip, even though SQL's
@@ -22182,6 +23313,9 @@ async function dispatchRunLedgerOutboxBatchWithScope(
     // any authority or renewal work. The abort branch below hands the lease
     // straight back without charging a projection attempt.
     input.signal?.throwIfAborted();
+    if (terminalArrayProjectionOriginFailure.current) {
+      throw terminalArrayProjectionOriginFailure.current.error;
+    }
     if (unconfirmedTransportError) throw unconfirmedTransportError;
     // The ledger converter rejects raw deferred facts. Inline callers hand
     // them off; the background owner projects them before inspecting the
@@ -22251,6 +23385,16 @@ async function dispatchRunLedgerOutboxBatchWithScope(
     )
       ? null
       : events.flatMap(buildRunLedgerEventsFromPostgresSchedulerOutbox);
+    const terminalProjection =
+      events.some((event) =>
+        RUN_SCHEDULER_OUTBOX_TERMINAL_EVENT_TYPES.includes(event.eventType),
+      ) ||
+      ledgerEvents?.some(
+        (event) =>
+          event.type === RUN_EVENT_KIND.runCompleted ||
+          event.type === RUN_EVENT_KIND.runFailed ||
+          event.type === RUN_EVENT_KIND.runCancelled,
+      ) === true;
     // Search-only facts are already durable and have no ledger projection.
     // Validate and acknowledge them without acquiring runtime authority or
     // renewing a network-delivery lease. A following terminal still uses the
@@ -22269,9 +23413,23 @@ async function dispatchRunLedgerOutboxBatchWithScope(
     ) => {
       authorityObserved.token = observation;
     };
+    const readTerminalProjectionOrigin = async () => {
+      if (terminalArrayProjectionOrigin === undefined) {
+        terminalArrayProjectionOrigin = await readTerminalArrayProjectionOrigin(
+          withClient,
+          launchJson,
+          first.runId,
+          options,
+          claimed.arrayInputStarted,
+        );
+      }
+      return terminalArrayProjectionOrigin;
+    };
+    if (terminalProjection) await readTerminalProjectionOrigin();
     const resolveRunRuntimeApi = () =>
       launchJson !== null
         ? resolvePostgresSchedulerRuntimeApiForRun(
+            withClient,
             launchJson,
             first.runId,
             first.leaseOwner
@@ -22282,6 +23440,8 @@ async function dispatchRunLedgerOutboxBatchWithScope(
             input.runtimeApi?.signal,
             reuseMarginMs,
             observeDispatchTokenResponse,
+            terminalProjection,
+            terminalArrayProjectionOrigin,
           )
         : loadPostgresSchedulerRuntimeApiForRun(
             withClient,
@@ -22294,10 +23454,13 @@ async function dispatchRunLedgerOutboxBatchWithScope(
             input.runtimeApi?.signal,
             reuseMarginMs,
             observeDispatchTokenResponse,
+            terminalProjection,
+            terminalArrayProjectionOrigin,
           );
     const gatewayRuntimeApi =
       needsRuntimeApi && tokenAuthority === 'gateway'
-        ? cachedAuthority?.runId === first.runId &&
+        ? (!terminalProjection || terminalArrayProjectionOrigin === null) &&
+          cachedAuthority?.runId === first.runId &&
           cachedAuthority.leaseOwner === leaseOwner &&
           cachedAuthority.expiresAtMs !== null &&
           cachedAuthority.expiresAtMs > Date.now() + reuseMarginMs
@@ -22315,13 +23478,30 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       cachedAuthority.leaseOwner === leaseOwner &&
       cachedAuthority.runtimeApi.baseUrl !== gatewayRuntimeApi.baseUrl
     ) {
-      throw new Error(
-        'Run Ledger dispatch origin changed within an immutable launch.',
-      );
+      const terminalOrigin = terminalProjection
+        ? await readTerminalProjectionOrigin()
+        : null;
+      if (gatewayRuntimeApi.baseUrl !== terminalOrigin) {
+        throw new Error(
+          'Run Ledger dispatch origin changed within an immutable launch.',
+        );
+      }
     }
     if (needsRuntimeApi) {
+      let suppliedRuntimeApi = input.runtimeApi;
+      if (terminalProjection && suppliedRuntimeApi && !gatewayRuntimeApi) {
+        const terminalOrigin = await readTerminalProjectionOrigin();
+        if (terminalOrigin) {
+          suppliedRuntimeApi = {
+            ...suppliedRuntimeApi,
+            baseUrl: terminalOrigin,
+          };
+        }
+      }
       const resolvedRuntimeApi =
-        gatewayRuntimeApi ?? input.runtimeApi ?? (await resolveRunRuntimeApi());
+        gatewayRuntimeApi ??
+        suppliedRuntimeApi ??
+        (await resolveRunRuntimeApi());
       runtimeApi = {
         ...resolvedRuntimeApi,
         ...(tokenAuthority === 'local_mint' && input.appRuntimeFetch
@@ -23119,6 +24299,7 @@ async function acknowledgeRunLedgerPrefixWithContinuation(
             nextClaimed: [],
           };
           continuation.nextClaimed = fast.events;
+          continuation.nextArrayInputStarted = fast.arrayInputStarted;
           input.continuation.current = continuation;
         }
         return { deliveredRows: fast.deliveredRows, continuation };
@@ -23195,6 +24376,7 @@ async function acknowledgeRunLedgerPrefixWithContinuation(
             nextClaimed: [],
           };
           continuation.nextClaimed = nextClaimed;
+          continuation.nextArrayInputStarted = undefined;
           input.continuation.current = continuation;
         }
         if (retainContinuation) await client.query('COMMIT');
@@ -23370,6 +24552,48 @@ async function projectPostgresSchedulerStartEvent(
 
 export type { RunLedgerDispatchLaunch } from './run-ledger-dispatch-authority';
 
+async function readTerminalArrayProjectionOrigin(
+  withClient: RunLedgerOutboxWithClient,
+  launchJson: unknown,
+  runId: string,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+  arrayInputStarted?: boolean,
+): Promise<string | null> {
+  const started =
+    arrayInputStarted ??
+    (
+      await withClient((client) =>
+        readTerminalArrayInputIntentForScope(client, { runId }, options),
+      )
+    ).started;
+  // Legacy deliveries may supply their runtime authority directly. They need
+  // no launch parsing or routing lookup when there is no durable array intent.
+  if (!started) return null;
+  const launch = parseRunLedgerDispatchLaunch(
+    launchJson ??
+      (
+        await withClient((client) =>
+          client.query<{ launch_json: unknown }>(
+            `SELECT ${runLedgerDispatchLaunchSql('runs')} AS launch_json
+             FROM ${tableName('runs', options)} AS runs WHERE run_id = $1`,
+            [runId],
+          ),
+        )
+      ).rows[0]?.launch_json,
+  );
+  const origin = launch.arrayInputTerminalProjectionOrigin;
+  if (
+    launch.arrayInputTerminalRetirementSupported !== true ||
+    typeof origin !== 'string' ||
+    !isImmutableRuntimeExecutionRecoveryOrigin(origin)
+  ) {
+    throw new Error(
+      'Staged array input has no immutable terminal projection receiver.',
+    );
+  }
+  return origin;
+}
+
 /** Search-only `run.events` facts settle without consulting launch credentials. */
 function runLedgerSearchOnlyOutboxFactSql(alias: string): string {
   const events = `CASE
@@ -23385,6 +24609,7 @@ function runLedgerSearchOnlyOutboxFactSql(alias: string): string {
 }
 
 async function resolvePostgresSchedulerRuntimeApiForRun(
+  withClient: RunLedgerOutboxWithClient,
   launchJson: unknown,
   runId: string,
   dispatchLease: { eventId: string; leaseOwner: string } | null,
@@ -23395,6 +24620,8 @@ async function resolvePostgresSchedulerRuntimeApiForRun(
   onDispatchTokenResponse?: (
     observation: RunLedgerDispatchTokenObservation,
   ) => void,
+  terminalProjection = false,
+  terminalArrayProjectionOrigin?: string | null,
 ): Promise<
   WorkerRuntimeApiContext & {
     refreshExecutorToken?: () => Promise<string>;
@@ -23407,6 +24634,18 @@ async function resolvePostgresSchedulerRuntimeApiForRun(
       `Run-ledger outbox dispatcher cannot resolve runtime API context for ${runId}.`,
     );
   }
+  let receiverBaseUrl = runtimeApiBaseUrlFromLaunch(launch);
+  if (terminalProjection) {
+    receiverBaseUrl =
+      (terminalArrayProjectionOrigin === undefined
+        ? await readTerminalArrayProjectionOrigin(
+            withClient,
+            launch,
+            runId,
+            options,
+          )
+        : terminalArrayProjectionOrigin) ?? receiverBaseUrl;
+  }
   let executorToken: string;
   let runLedgerIngressPrefixBatching: true | undefined;
   let refreshExecutorToken: (() => Promise<string>) | undefined;
@@ -23435,12 +24674,12 @@ async function resolvePostgresSchedulerRuntimeApiForRun(
       leaseOwner: dispatchLease.leaseOwner,
       schedulerSchema: options?.schema ?? null,
       signal,
+      receiverBaseUrl,
     };
-    const preMintedToken = usableRunLedgerExecutorToken(
-      launch,
-      tokenReuseMarginMs,
-      options,
-    );
+    const preMintedToken =
+      receiverBaseUrl === runtimeApiBaseUrlFromLaunch(launch)
+        ? usableRunLedgerExecutorToken(launch, tokenReuseMarginMs, options)
+        : null;
     if (preMintedToken) {
       // Admission minted this token with only `run.ledger.project`.
       // Each projection request still proves its exact outbox lease at the
@@ -23476,8 +24715,18 @@ async function resolvePostgresSchedulerRuntimeApiForRun(
         dispatchAuthority.runLedgerIngressPrefixBatching;
     }
   }
+  // A mutable source can seal array pages after this prefix was claimed.
+  // Never widen a nonterminal receipt into a terminal on an older receiver;
+  // the next claim will see the terminal and select its immutable owner.
+  if (
+    launch.arrayInputTerminalRetirementSupported === true &&
+    typeof launch.arrayInputTerminalProjectionOrigin === 'string' &&
+    launch.arrayInputTerminalProjectionOrigin !== receiverBaseUrl
+  ) {
+    runLedgerIngressPrefixBatching = undefined;
+  }
   return {
-    baseUrl: runtimeApiBaseUrlFromLaunch(launch),
+    baseUrl: receiverBaseUrl,
     executorToken,
     ...(runLedgerIngressPrefixBatching
       ? { runLedgerIngressPrefixBatching }
@@ -23501,6 +24750,8 @@ async function loadPostgresSchedulerRuntimeApiForRun(
   onDispatchTokenResponse?: (
     observation: RunLedgerDispatchTokenObservation,
   ) => void,
+  terminalProjection = false,
+  terminalArrayProjectionOrigin?: string | null,
 ): ReturnType<typeof resolvePostgresSchedulerRuntimeApiForRun> {
   // A continuation already owns its next event lease, so its launch context
   // is not part of the preclaim result. Load only the authority fields here.
@@ -23514,6 +24765,7 @@ async function loadPostgresSchedulerRuntimeApiForRun(
     ),
   );
   return resolvePostgresSchedulerRuntimeApiForRun(
+    withClient,
     result.rows[0]?.launch_json,
     runId,
     dispatchLease,
@@ -23522,6 +24774,8 @@ async function loadPostgresSchedulerRuntimeApiForRun(
     signal,
     tokenReuseMarginMs,
     onDispatchTokenResponse,
+    terminalProjection,
+    terminalArrayProjectionOrigin,
   );
 }
 
@@ -23702,6 +24956,7 @@ async function requestRunLedgerDispatchToken(
     leaseOwner: string;
     schedulerSchema: string | null;
     signal?: AbortSignal;
+    receiverBaseUrl: string;
   },
   forceFresh = false,
 ): Promise<{
@@ -23721,7 +24976,14 @@ async function requestRunLedgerDispatchToken(
   input.signal?.throwIfAborted();
   const { executorToken: _storedToken, ...authority } = input.launch;
   const cacheKey = createHash('sha256')
-    .update(JSON.stringify([input.schedulerSchema, authority, internalToken]))
+    .update(
+      JSON.stringify([
+        input.schedulerSchema,
+        authority,
+        input.receiverBaseUrl,
+        internalToken,
+      ]),
+    )
     .digest('hex');
   const now = Date.now();
   for (const [key, entry] of runLedgerDispatchTokens) {
@@ -23738,7 +25000,7 @@ async function requestRunLedgerDispatchToken(
         : {}),
     };
   runLedgerDispatchTokens.delete(cacheKey);
-  const url = `${runtimeApiBaseUrlFromLaunch(input.launch).replace(/\/$/, '')}/api/v2/internal/play-runtime/run-ledger-dispatch-token`;
+  const url = `${input.receiverBaseUrl.replace(/\/$/, '')}/api/v2/internal/play-runtime/run-ledger-dispatch-token`;
   const requestSignal = input.signal
     ? AbortSignal.any([
         input.signal,
@@ -23752,7 +25014,7 @@ async function requestRunLedgerDispatchToken(
     schedulerSchema: input.schedulerSchema,
   });
   const response = await fetchWithVercelProtectionBypass({
-    baseUrl: runtimeApiBaseUrlFromLaunch(input.launch),
+    baseUrl: input.receiverBaseUrl,
     token: input.launch.vercelProtectionBypassToken,
     signal: requestSignal,
     send: (protectionHeaders) =>
@@ -23809,9 +25071,7 @@ async function requestRunLedgerDispatchToken(
   }
   const reusablePrefix =
     body.runLedgerIngressPrefixBatching === true &&
-    isImmutableRuntimeExecutionRecoveryOrigin(
-      runtimeApiBaseUrlFromLaunch(input.launch),
-    );
+    isImmutableRuntimeExecutionRecoveryOrigin(input.receiverBaseUrl);
   // Decode only the lifetime, never an authentication decision: the app
   // validates the signature, run scope, and live delivery lease on append.
   // Opaque/older token formats continue to work without this optimization.