deepline 0.3.461 → 0.3.463

package/dist/bundling-sources/shared_libs/play-runtime/runtime-api.ts

@@ -34,6 +34,7 @@ import {
 } from './runtime-pg-driver';
 import {
   createDeferredPlayDataset,
+  iteratePlayDatasetInputPages,
   type PlayDataset,
 } from '../plays/dataset';
 import type {
@@ -50,6 +51,7 @@ import {
 } from '../play-data-plane/sheet-contract';
 import {
   RuntimeSheetColumns,
+  RuntimeSheetColumnSchemaChangeRequired,
   type RuntimeSheetColumnTypes,
 } from '../play-data-plane/sheet-column-storage';
 import {
@@ -116,9 +118,27 @@ import {
 } from './postgres-json';
 import { RECEIPT_STATUS_CODE, receiptStatusFromCode } from './receipt-status';
 import {
+  assertWorkReceiptKeyMutable,
   WORK_RECEIPT_EXECUTION_LOCK_TABLE,
   RUNTIME_SHEET_WRITE_INTENT_RECEIPT_KIND,
 } from './work-receipt-storage-contract';
+import type {
+  RuntimeArrayInputScope,
+  RuntimeArrayInputOccurrence,
+  RuntimeArrayInputManifest,
+} from './array-input-store';
+import { RuntimeArrayInputStoreUnavailableError } from './array-input-store';
+import {
+  getRuntimeArrayInputManifest as getRuntimeArrayInputManifestReceipt,
+  beginRuntimeArrayInput as beginRuntimeArrayInputReceipt,
+  putRuntimeArrayInputPage as putRuntimeArrayInputPageReceipt,
+  sealRuntimeArrayInput as sealRuntimeArrayInputReceipt,
+  readRuntimeArrayInputPage as readRuntimeArrayInputPageReceipt,
+  type RuntimeArrayInputBegin,
+  type RuntimeArrayInputPutPage,
+  type RuntimeArrayInputSeal,
+  type RuntimeArrayInputReceiptPort,
+} from './runtime-array-input-receipts';
 import {
   workReceiptClaimableStatusCodes,
   workReceiptActiveOwnerPredicateSql,
@@ -135,6 +155,7 @@ import type { MapRowOutcome } from './durability-store';
 import { RUNTIME_CAPACITY_POLICY } from './runtime-capacity-policy';
 import type { RUNTIME_SHEET_ADMISSION_CAPABILITIES } from './runtime-operation-contract';
 import {
+  chunkPreparedRuntimeSheetRows,
   normalizeRuntimeMapInputIndex,
   prepareRuntimeSheetRowsForJsonTransport,
   prepareRuntimeSheetRowTransitions,
@@ -153,12 +174,17 @@ import {
   LEGACY_RUNTIME_RECEIPT_WIRE_HEADER,
 } from './runtime-contract';
 import { PLAY_RUNTIME_API_COMPAT_PATH } from './runtime-api-paths';
+import { RUNNER_GATEWAY_CONNECTION_RETRY_BUDGET_MS } from './runtime-constants';
 import {
   PLAY_RUNTIME_SHEET_ATTEMPT_LEASE_TTL_MS,
   PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
 } from './lease-policy';
 import { BoundedBatchFunction } from './bounded-batch-function';
-import { jsonByteLengthUpTo } from './output-size-limits';
+import {
+  jsonByteLengthUpTo,
+  RUNNER_TERMINAL_PUSH_MAX_BODY_BYTES,
+  RUNTIME_SHEET_START_TARGET_BODY_BYTES,
+} from './output-size-limits';
 import {
   parseRuntimeTestFaultCounts,
   PLAY_RUNTIME_TEST_FAULT_HEADER,
@@ -188,6 +214,9 @@ type RuntimeApiContext = {
   disablePostgresPoolCache?: boolean | null;
   postgresSessionUnwrapKey?: string | null;
   abortSignal?: AbortSignal | null;
+  onSheetMapCompletion?: (
+    diagnostics: RuntimeSheetMapCompletionDiagnostics,
+  ) => void | Promise<void>;
 };
 
 const RUNTIME_RUN_DATASET_CATALOG_TABLE = '_deepline_run_datasets';
@@ -357,6 +386,7 @@ const runtimeSheetEnsureCache = new Map<
   { expiresAt: number; promise: Promise<void> }
 >();
 const DIRECT_POSTGRES_BATCH_SIZE = 10_000;
+const RUNTIME_MAP_SQL_BATCH_INPUT_BYTES = 2 * 1024 * 1024;
 const RUNTIME_DB_SESSION_ROW_LIMIT_FLOOR = DIRECT_POSTGRES_BATCH_SIZE;
 const APPEND_KEY_SUFFIX_LENGTH = 12;
 // On-demand (create_db_session) mint TTL. Deliberately NOT aligned with
@@ -427,6 +457,7 @@ export class RuntimeSheetDatasetReadBatchTooLargeError extends Error {
 // make progress instead of aborting a healthy queued start after 30 seconds.
 const RUNTIME_SHEET_ADMISSION_REQUEST_TIMEOUT_MS = 10 * 60_000;
 const RUNTIME_SHEET_COMPLETION_SERVER_OPERATION_TIMEOUT_MS = 75_000;
+const RUNTIME_POSTGRES_ROLLBACK_CLEANUP_TIMEOUT_MS = 1_000;
 // Server admission is bounded to 30s and the single connection attempt to
 // 10s. Keep the transport outside that envelope so it never retries while the
 // first server-side write can still be active.
@@ -540,10 +571,13 @@ export type RuntimeSheetTiming = {
 type RuntimeMapCompletionPhase =
   | 'dbSessionAcquire'
   | 'poolAcquire'
+  | 'tenantAdmission'
+  | 'physicalConnect'
   | 'transactionBegin'
   | 'mapRowsUpdate'
   | 'missingRowsInsert'
   | 'failedRowsUpdate'
+  | 'membershipCapture'
   | 'transactionCommit'
   | 'queryClient';
 
@@ -555,12 +589,34 @@ type RuntimeMapCompletionDiagnostics = Record<
   provisioningRetryAttempts: number;
 };
 
+/**
+ * Fixed, payload-free elapsed timings. Nested phases overlap: poolAcquire includes
+ * tenantAdmission and physicalConnect (the bounded driver connect attempt).
+ */
+export type RuntimeSheetMapCompletionDiagnostics =
+  RuntimeMapCompletionDiagnostics & {
+    event: 'finished';
+    outcome: 'succeeded' | 'failed';
+    inputRows: number;
+    uniqueRows: number;
+    completedRows: number;
+    failedRows: number;
+    chunks: number;
+    updatedRows: number;
+    fencedRows: number;
+    totalMs: number;
+  };
+
 function createRuntimeMapCompletionDiagnostics(): RuntimeMapCompletionDiagnostics {
   return {
     dbSessionAcquireMs: 0,
     dbSessionAcquireFailures: 0,
     poolAcquireMs: 0,
     poolAcquireFailures: 0,
+    tenantAdmissionMs: 0,
+    tenantAdmissionFailures: 0,
+    physicalConnectMs: 0,
+    physicalConnectFailures: 0,
     transactionBeginMs: 0,
     transactionBeginFailures: 0,
     mapRowsUpdateMs: 0,
@@ -569,6 +625,8 @@ function createRuntimeMapCompletionDiagnostics(): RuntimeMapCompletionDiagnostic
     missingRowsInsertFailures: 0,
     failedRowsUpdateMs: 0,
     failedRowsUpdateFailures: 0,
+    membershipCaptureMs: 0,
+    membershipCaptureFailures: 0,
     transactionCommitMs: 0,
     transactionCommitFailures: 0,
     queryClientMs: 0,
@@ -689,6 +747,26 @@ type RuntimeApiActionRequest =
   | {
       action: 'runtime_receipts_release_attempt';
       input: Parameters<typeof releaseRuntimeWorkReceipts>[1];
+    }
+  | {
+      action: 'runtime_array_input_get_manifest';
+      input: Parameters<typeof getRuntimeArrayInputManifest>[1];
+    }
+  | {
+      action: 'runtime_array_input_begin';
+      input: Parameters<typeof beginRuntimeArrayInput>[1];
+    }
+  | {
+      action: 'runtime_array_input_put_page';
+      input: Parameters<typeof putRuntimeArrayInputPage>[1];
+    }
+  | {
+      action: 'runtime_array_input_seal';
+      input: Parameters<typeof sealRuntimeArrayInput>[1];
+    }
+  | {
+      action: 'runtime_array_input_read_page';
+      input: Parameters<typeof readRuntimeArrayInputPage>[1];
     };
 
 /**
@@ -869,23 +947,42 @@ async function readRuntimeApiResponseJson(input: {
 async function postRuntimeApi<TResponse>(
   context: RuntimeApiContext,
   body: RuntimeApiActionRequest,
+  preparedBodyJson?: string,
 ): Promise<TResponse> {
   const url = resolveRuntimeApiUrl(context);
   const vercelHeaders = vercelProtectionBypassHeader(
     context.vercelProtectionBypassToken,
   );
+  // Older receipt gateways validate their top-level scope before dispatching
+  // an action. Include the same authenticated input scope so an unsupported
+  // named array action reaches their explicit unsupported-action response.
+  const requestBody =
+    body.action === 'runtime_array_input_get_manifest' ||
+    body.action === 'runtime_array_input_begin' ||
+    body.action === 'runtime_array_input_put_page' ||
+    body.action === 'runtime_array_input_seal' ||
+    body.action === 'runtime_array_input_read_page'
+      ? { ...body, playName: body.input.playName, runId: body.input.runId }
+      : body;
   const maxAttempts = runtimeApiMaxAttempts(body.action);
-  const operationStartedAt = Date.now();
-  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+  const budget = startRuntimeApiRetryBudget(body.action);
+  let unreachableError: Error | null = null;
+  for (let attempt = 1; ; attempt += 1) {
     let response: Response | null = null;
     let parsed: Record<string, unknown> | null = null;
     const abortController = new AbortController();
-    const operationRemainingMs = runtimeApiOperationRemainingMs(
-      body.action,
-      operationStartedAt,
-    );
+    const previousAttemptUnreachable =
+      budget.unreachableAttemptStartedAt !== null;
+    const attemptStartedAt = startRuntimeApiAttempt(budget);
+    const operationRemainingMs =
+      runtimeApiRetryDeadlineAt(
+        budget,
+        previousAttemptUnreachable ? 'no_response' : 'response',
+      ) - attemptStartedAt;
     if (operationRemainingMs <= 0) {
-      throw runtimeApiTotalDeadlineError(body.action);
+      throw previousAttemptUnreachable && unreachableError
+        ? unreachableError
+        : runtimeApiTotalDeadlineError(body.action);
     }
     const timeout = setTimeout(
       () => abortController.abort(),
@@ -895,7 +992,9 @@ async function postRuntimeApi<TResponse>(
       response = await fetch(url, {
         method: 'POST',
         headers: resolveRuntimeApiHeaders(context, vercelHeaders),
-        body: JSON.stringify(prepareRetainedPlayPipelinesForTransport(body)),
+        body:
+          preparedBodyJson ??
+          JSON.stringify(prepareRetainedPlayPipelinesForTransport(requestBody)),
         signal: context.abortSignal
           ? AbortSignal.any([context.abortSignal, abortController.signal])
           : abortController.signal,
@@ -929,28 +1028,39 @@ async function postRuntimeApi<TResponse>(
       if (context.abortSignal?.aborted) {
         throw context.abortSignal.reason ?? error;
       }
-      if (
-        runtimeApiOperationRemainingMs(body.action, operationStartedAt) <= 0
-      ) {
-        throw runtimeApiTotalDeadlineError(body.action);
-      }
-      if (attempt < maxAttempts) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (response) {
+        // A status line arrived and then its body failed or stalled. The
+        // gateway answered, so this spends the ordinary attempt ladder; only a
+        // request that got no response at all retries through a network cut.
+        const bodyError = new Error(
+          `Runtime API request to ${url} failed while reading the response body (status ${response.status}): ${message}`,
+        );
+        budget.respondedAttempts += 1;
+        if (budget.respondedAttempts >= maxAttempts) throw bodyError;
         await sleepRuntimeApiRetry({
           action: body.action,
           attempt,
-          operationStartedAt,
+          deadlineAt: runtimeApiRetryDeadlineAt(budget, 'response'),
+          deadlineError: bodyError,
           abortSignal: context.abortSignal ?? undefined,
         });
         continue;
       }
-      const message = error instanceof Error ? error.message : String(error);
-      throw new Error(
-        `Runtime API request to ${url} failed ${
-          response
-            ? 'while reading the response body'
-            : 'before receiving a response'
-        }: ${message}`,
+      // No response arrived: DNS, connect, reset, or the request timeout.
+      // Keep trying through a sandbox network cut.
+      budget.unreachableAttemptStartedAt = attemptStartedAt;
+      unreachableError = new Error(
+        `Runtime API request to ${url} failed before receiving a response: ${message}`,
       );
+      await sleepRuntimeApiRetry({
+        action: body.action,
+        attempt,
+        deadlineAt: runtimeApiRetryDeadlineAt(budget, 'no_response'),
+        deadlineError: unreachableError,
+        abortSignal: context.abortSignal ?? undefined,
+      });
+      continue;
     } finally {
       clearTimeout(timeout);
     }
@@ -963,11 +1073,13 @@ async function postRuntimeApi<TResponse>(
       // response body. Treat that as a transport failure, not a typed success:
       // every runtime action returns a JSON object and runtime writes are
       // already retry-safe across the equivalent fetch-failed boundary.
-      if (attempt < maxAttempts) {
+      budget.respondedAttempts += 1;
+      if (budget.respondedAttempts < maxAttempts) {
         await sleepRuntimeApiRetry({
           action: body.action,
           attempt,
-          operationStartedAt,
+          deadlineAt: runtimeApiRetryDeadlineAt(budget, 'response'),
+          deadlineError: runtimeApiTotalDeadlineError(body.action),
           abortSignal: context.abortSignal ?? undefined,
         });
         continue;
@@ -1034,12 +1146,14 @@ async function postRuntimeApi<TResponse>(
         isTransientRuntimeApiErrorMessage(
           `${typeof parsed?.error === 'string' ? parsed.error : ''}\n${details ?? ''}`,
         ));
-    if (shouldRetryRuntimeResponse && attempt < maxAttempts) {
+    budget.respondedAttempts += 1;
+    if (shouldRetryRuntimeResponse && budget.respondedAttempts < maxAttempts) {
       await sleepRuntimeApiRetry({
         action: body.action,
         attempt,
         retryAfterMs,
-        operationStartedAt,
+        deadlineAt: runtimeApiRetryDeadlineAt(budget, 'response'),
+        deadlineError: runtimeApiTotalDeadlineError(body.action),
         abortSignal: context.abortSignal ?? undefined,
       });
       continue;
@@ -1072,14 +1186,28 @@ async function postRuntimeApi<TResponse>(
         new Error(`${errorMessage} (${diagnosticContext}).`),
       );
     }
+    if (
+      (body.action === 'runtime_array_input_get_manifest' ||
+        body.action === 'runtime_array_input_begin') &&
+      (((response.status === 403 || response.status === 409) &&
+        errorCode === 'RUNTIME_ARRAY_INPUT_UNAVAILABLE' &&
+        (parsed?.action === undefined || parsed.action === body.action)) ||
+        (response.status === 400 &&
+          errorMessage === 'Unsupported receipt gateway action.' &&
+          parsed?.action === body.action) ||
+        ((response.status === 400 || response.status === 403) &&
+          (errorMessage === 'Unsupported runtime action capability scope.' ||
+            errorMessage === 'Unsupported runtime data-plane action.' ||
+            errorMessage === `Unsupported action: ${body.action}`)))
+    ) {
+      throw new RuntimeArrayInputStoreUnavailableError();
+    }
     throw new Error(
       details
         ? `${errorMessage} (${diagnosticContext}): ${details}`
         : `${errorMessage} (${diagnosticContext}).`,
     );
   }
-
-  throw new Error('Runtime API request failed after retries.');
 }
 
 function runtimeApiRetryDelayMs(
@@ -1087,8 +1215,11 @@ function runtimeApiRetryDelayMs(
   attempt: number,
   retryAfterMs?: number,
 ): number {
+  // An operation runs past the ladder only after attempts that got no
+  // response; it then waits the ladder's last step.
+  const delays = runtimeApiRetryDelaysForAction(action);
   const configuredDelay =
-    runtimeApiRetryDelaysForAction(action)[attempt - 1] ??
+    delays[Math.min(attempt, delays.length) - 1] ??
     RUNTIME_API_DEFAULT_RETRY_AFTER_MS;
   return retryAfterMs === undefined
     ? configuredDelay
@@ -1107,15 +1238,55 @@ function runtimeApiRequestTimeoutMs(
     : RUNTIME_API_REQUEST_TIMEOUT_MS;
 }
 
-function runtimeApiOperationRemainingMs(
+/**
+ * Retry bookkeeping for one runtime API operation. Attempts that got a
+ * response spend the action's attempt ladder and, for map-row completion, its
+ * total deadline. An attempt that got no response at all retries until
+ * RUNNER_GATEWAY_CONNECTION_RETRY_BUDGET_MS after the operation began, and the
+ * time spent unreachable is not charged to the response budget.
+ */
+type RuntimeApiRetryBudget = {
+  action: RuntimeApiActionRequest['action'];
+  startedAt: number;
+  respondedAttempts: number;
+  unreachableMs: number;
+  /** Start of the latest attempt, while that attempt got no response. */
+  unreachableAttemptStartedAt: number | null;
+};
+
+function startRuntimeApiRetryBudget(
   action: RuntimeApiActionRequest['action'],
-  startedAt: number,
+): RuntimeApiRetryBudget {
+  return {
+    action,
+    startedAt: Date.now(),
+    respondedAttempts: 0,
+    unreachableMs: 0,
+    unreachableAttemptStartedAt: null,
+  };
+}
+
+/** Charges the previous attempt's time to the outage if it got no response. */
+function startRuntimeApiAttempt(budget: RuntimeApiRetryBudget): number {
+  const now = Date.now();
+  if (budget.unreachableAttemptStartedAt !== null) {
+    budget.unreachableMs += now - budget.unreachableAttemptStartedAt;
+    budget.unreachableAttemptStartedAt = null;
+  }
+  return now;
+}
+
+function runtimeApiRetryDeadlineAt(
+  budget: RuntimeApiRetryBudget,
+  failure: 'response' | 'no_response',
 ): number {
-  return action === 'runtime_sheet_complete_map_rows'
-    ? Math.max(
-        0,
-        RUNTIME_SHEET_COMPLETION_TOTAL_TIMEOUT_MS - (Date.now() - startedAt),
-      )
+  if (failure === 'no_response') {
+    return budget.startedAt + RUNNER_GATEWAY_CONNECTION_RETRY_BUDGET_MS;
+  }
+  return budget.action === 'runtime_sheet_complete_map_rows'
+    ? budget.startedAt +
+        budget.unreachableMs +
+        RUNTIME_SHEET_COMPLETION_TOTAL_TIMEOUT_MS
     : Number.POSITIVE_INFINITY;
 }
 
@@ -1132,7 +1303,8 @@ async function sleepRuntimeApiRetry(input: {
   action: RuntimeApiActionRequest['action'];
   attempt: number;
   retryAfterMs?: number;
-  operationStartedAt: number;
+  deadlineAt: number;
+  deadlineError: Error;
   abortSignal?: AbortSignal;
 }): Promise<void> {
   const requestedDelayMs = runtimeApiRetryDelayMs(
@@ -1140,12 +1312,9 @@ async function sleepRuntimeApiRetry(input: {
     input.attempt,
     input.retryAfterMs,
   );
-  const operationRemainingMs = runtimeApiOperationRemainingMs(
-    input.action,
-    input.operationStartedAt,
-  );
+  const operationRemainingMs = input.deadlineAt - Date.now();
   if (operationRemainingMs <= 0) {
-    throw runtimeApiTotalDeadlineError(input.action);
+    throw input.deadlineError;
   }
   const delayMs = Math.min(requestedDelayMs, operationRemainingMs);
   await new Promise<void>((resolve, reject) => {
@@ -1164,7 +1333,7 @@ async function sleepRuntimeApiRetry(input: {
     input.abortSignal?.addEventListener('abort', onAbort, { once: true });
   });
   if (requestedDelayMs >= operationRemainingMs) {
-    throw runtimeApiTotalDeadlineError(input.action);
+    throw input.deadlineError;
   }
 }
 
@@ -2119,11 +2288,14 @@ async function connectRuntimePostgresPool(
   lane: RuntimePostgresLane,
   postgresUrl: string,
   signal?: AbortSignal | null,
+  completionDiagnostics?: RuntimeMapCompletionDiagnostics,
 ): Promise<RuntimePoolClient> {
   const admissionStartedAt = Date.now();
-  const releaseAdmission = await admission.acquire(lane, {
-    signal: signal ?? undefined,
-  });
+  const releaseAdmission = await measureRuntimeSheetPhase(
+    completionDiagnostics,
+    'tenantAdmission',
+    () => admission.acquire(lane, { signal: signal ?? undefined }),
+  );
   const admissionWaitMs = Math.max(0, Date.now() - admissionStartedAt);
   if (admissionWaitMs > 0) {
     const telemetry = admission.snapshot()[lane];
@@ -2142,6 +2314,8 @@ async function connectRuntimePostgresPool(
   }
   let timedOut = false;
   let timeout: ReturnType<typeof setTimeout> | null = null;
+  const physicalConnectStartedAt = Date.now();
+  let physicalConnectFailed = false;
   const connectPromise = pool.connect();
   connectPromise
     .then((client) => {
@@ -2185,11 +2359,19 @@ async function connectRuntimePostgresPool(
       },
     };
   } catch (error) {
+    physicalConnectFailed = true;
     if (!timedOut) {
       releaseAdmission();
     }
     throw error;
   } finally {
+    if (completionDiagnostics) {
+      completionDiagnostics.physicalConnectMs +=
+        Date.now() - physicalConnectStartedAt;
+      completionDiagnostics.physicalConnectFailures += Number(
+        physicalConnectFailed,
+      );
+    }
     if (timeout) {
       clearTimeout(timeout);
     }
@@ -2386,6 +2568,27 @@ async function awaitRuntimePostgresOperation<T>(input: {
   });
 }
 
+async function rollbackRuntimePostgresTransaction(
+  client: RuntimePoolClient,
+): Promise<void> {
+  await awaitRuntimePostgresOperation({
+    client,
+    deadlineAt: Date.now() + RUNTIME_POSTGRES_ROLLBACK_CLEANUP_TIMEOUT_MS,
+    operation: client.query('ROLLBACK'),
+  });
+}
+
+class RuntimeSheetTransactionRollbackError extends AggregateError {
+  constructor(operationError: unknown, rollbackError: unknown) {
+    super(
+      [operationError, rollbackError],
+      'Runtime Sheet transaction rollback failed; transaction state is unknown',
+      { cause: operationError },
+    );
+    this.name = 'RuntimeSheetTransactionRollbackError';
+  }
+}
+
 async function withRuntimePostgres<T>(
   session: RuntimePostgresSession,
   fn: (
@@ -2404,6 +2607,7 @@ async function withRuntimePostgres<T>(
   let requestLocalPool: RuntimePool | null = null;
   let poolLease: RuntimePostgresPoolLease | null = null;
   let roleTransactionStarted = false;
+  let discardClient = false;
   let operationDeadlineAt: number | null = null;
   const cachePool =
     (options.cachePool ?? true) && canReuseRuntimePostgresPoolsAcrossRequests();
@@ -2430,6 +2634,7 @@ async function withRuntimePostgres<T>(
             lane,
             session.postgresUrl,
             options.signal,
+            options.completionDiagnostics,
           ),
       );
       operationDeadlineAt =
@@ -2461,17 +2666,22 @@ async function withRuntimePostgres<T>(
       }
       break;
     } catch (error) {
+      let failure = error;
       if (client) {
         if (roleTransactionStarted) {
-          await awaitRuntimePostgresOperation({
-            client,
-            deadlineAt: operationDeadlineAt,
-            operation: client.query('ROLLBACK'),
-            signal: options.signal,
-          }).catch(() => {});
-          roleTransactionStarted = false;
+          try {
+            await rollbackRuntimePostgresTransaction(client);
+          } catch (rollbackError) {
+            discardClient = true;
+            failure = new RuntimeSheetTransactionRollbackError(
+              error,
+              rollbackError,
+            );
+          } finally {
+            roleTransactionStarted = false;
+          }
         }
-        client.release();
+        client.release(discardClient);
         client = null;
       }
       // Queue overflow and caller cancellation happen before pool.connect().
@@ -2491,9 +2701,10 @@ async function withRuntimePostgres<T>(
       poolLease = null;
       if (
         attempt >= maxConnectAttempts ||
-        !isTransientRuntimePostgresConnectionError(error)
+        failure instanceof RuntimeSheetTransactionRollbackError ||
+        !isTransientRuntimePostgresConnectionError(failure)
       ) {
-        throw error;
+        throw failure;
       }
       await sleep(
         RUNTIME_POSTGRES_CONNECT_RETRY_DELAYS_MS[attempt - 1] ??
@@ -2530,18 +2741,22 @@ async function withRuntimePostgres<T>(
     }
     return result;
   } catch (error) {
+    if (error instanceof RuntimeSheetTransactionRollbackError) {
+      discardClient = true;
+    }
     if (roleTransactionStarted) {
-      await awaitRuntimePostgresOperation({
-        client,
-        deadlineAt: operationDeadlineAt,
-        operation: client.query('ROLLBACK'),
-        signal: options.signal,
-      }).catch(() => {});
-      roleTransactionStarted = false;
+      try {
+        await rollbackRuntimePostgresTransaction(client);
+      } catch (rollbackError) {
+        discardClient = true;
+        throw new RuntimeSheetTransactionRollbackError(error, rollbackError);
+      } finally {
+        roleTransactionStarted = false;
+      }
     }
     throw error;
   } finally {
-    client.release();
+    client.release(discardClient);
     await poolLease?.release();
     if (requestLocalPool) {
       await Promise.resolve(requestLocalPool.end()).catch(() => {});
@@ -2673,6 +2888,7 @@ async function withRuntimeSheetProvisioningRetry<T>(
       retried: false,
       error: error instanceof Error ? error.message : String(error),
     });
+    if (error instanceof RuntimeSheetTransactionRollbackError) throw error;
     if (isMissingRelationError(error)) {
       const ensureStartedAt = Date.now();
       await ensureRuntimeSheet(context, {
@@ -2741,77 +2957,109 @@ async function withRuntimeSheetQueryClient<T>(
     statementTimeoutMs?: number;
     timings?: RuntimeSheetTiming[];
     completionDiagnostics?: RuntimeMapCompletionDiagnostics;
+    concurrentColumnPreparation?: boolean;
   },
-  operation: (client: RuntimeQueryClient) => Promise<T>,
+  operation: (
+    client: RuntimeQueryClient,
+    columnLockMode: 'shared' | 'exclusive',
+  ) => Promise<T>,
 ): Promise<T> {
   const resultStartedAt = Date.now();
+  let columnLockMode: 'shared' | 'exclusive' = input.concurrentColumnPreparation
+    ? 'shared'
+    : 'exclusive';
   const resultPromise = withRuntimeSheetProvisioningRetry(
     context,
     { ...input, session },
     async () => {
       if (
         !input.transactional &&
+        !input.concurrentColumnPreparation &&
         input.statementTimeoutMs === undefined &&
         isRuntimeOneShotQueryFactoryRegistered()
       ) {
         const operationStartedAt = Date.now();
-        return await withRuntimeOneShotPostgres(session, operation).finally(
-          () => {
-            input.timings?.push({
-              phase: 'one_shot_operation',
-              ms: Date.now() - operationStartedAt,
-            });
-          },
-        );
+        return await withRuntimeOneShotPostgres(session, (client) =>
+          operation(client, 'exclusive'),
+        ).finally(() => {
+          input.timings?.push({
+            phase: 'one_shot_operation',
+            ms: Date.now() - operationStartedAt,
+          });
+        });
       }
 
-      return await withRuntimePostgres(
-        session,
-        async (client, transaction) => {
-          const managesTransaction =
-            (input.transactional || input.statementTimeoutMs !== undefined) &&
-            !transaction.active;
-          if (managesTransaction) {
-            await measureRuntimeSheetPhase(
-              input.completionDiagnostics,
-              'transactionBegin',
-              () => client.query('BEGIN'),
-            );
-          }
-          try {
-            if (input.statementTimeoutMs !== undefined) {
-              await client.query(
-                `SET LOCAL statement_timeout TO ${Math.max(1, Math.floor(input.statementTimeoutMs))}`,
-              );
-            }
-            const result = await operation(client);
+      const runTransaction = () =>
+        withRuntimePostgres(
+          session,
+          async (client, transaction) => {
+            const managesTransaction =
+              (input.concurrentColumnPreparation ||
+                input.transactional ||
+                input.statementTimeoutMs !== undefined) &&
+              !transaction.active;
             if (managesTransaction) {
               await measureRuntimeSheetPhase(
                 input.completionDiagnostics,
-                'transactionCommit',
-                () => client.query('COMMIT'),
+                'transactionBegin',
+                () => client.query('BEGIN'),
               );
             }
-            return result;
-          } catch (error) {
-            if (managesTransaction) {
-              await client.query('ROLLBACK').catch(() => {});
+            try {
+              if (input.statementTimeoutMs !== undefined) {
+                await client.query(
+                  `SET LOCAL statement_timeout TO ${Math.max(1, Math.floor(input.statementTimeoutMs))}`,
+                );
+              }
+              const result = await operation(client, columnLockMode);
+              if (managesTransaction) {
+                await measureRuntimeSheetPhase(
+                  input.completionDiagnostics,
+                  'transactionCommit',
+                  () => client.query('COMMIT'),
+                );
+              }
+              return result;
+            } catch (error) {
+              if (managesTransaction) {
+                try {
+                  await rollbackRuntimePostgresTransaction(client);
+                } catch (rollbackError) {
+                  throw new RuntimeSheetTransactionRollbackError(
+                    error,
+                    rollbackError,
+                  );
+                }
+              }
+              throw error;
             }
-            throw error;
-          }
-        },
-        {
-          cachePool: !context.disablePostgresPoolCache,
-          maxConnectAttempts:
-            input.statementTimeoutMs === undefined ? undefined : 1,
-          operationTimeoutMs:
-            input.statementTimeoutMs === undefined
-              ? undefined
-              : RUNTIME_SHEET_COMPLETION_SERVER_OPERATION_TIMEOUT_MS,
-          signal: context.abortSignal,
-          completionDiagnostics: input.completionDiagnostics,
-        },
-      );
+          },
+          {
+            cachePool: !context.disablePostgresPoolCache,
+            maxConnectAttempts:
+              input.statementTimeoutMs === undefined ? undefined : 1,
+            operationTimeoutMs:
+              input.statementTimeoutMs === undefined
+                ? undefined
+                : RUNTIME_SHEET_COMPLETION_SERVER_OPERATION_TIMEOUT_MS,
+            signal: context.abortSignal,
+            completionDiagnostics: input.completionDiagnostics,
+          },
+        );
+      try {
+        return await runTransaction();
+      } catch (error) {
+        if (
+          columnLockMode !== 'shared' ||
+          !(error instanceof RuntimeSheetColumnSchemaChangeRequired)
+        )
+          throw error;
+        // The entire role/row transaction has confirmed rollback. Re-read
+        // accepted rows, intent and schema under the existing exclusive fence;
+        // never upgrade a shared lock or retain a pre-rollback SQL snapshot.
+        columnLockMode = 'exclusive';
+        return await runTransaction();
+      }
     },
   );
   if (input.completionDiagnostics) {
@@ -3628,19 +3876,32 @@ async function readRuntimeRows(
         );
       }
       const { rows } = await client.query(
+        // Select the preferred status once, using early-exit witnesses. A
+        // window aggregate forces every fresh run row through WindowAgg even
+        // for the first small page. Keep the same statement snapshot, status
+        // preference, freshness predicate and public offset semantics.
         `WITH scoped AS (
-           SELECT *,
-                  bool_or(_status = 'enriched') OVER () AS __has_enriched,
-                  bool_or(_status = 'failed') OVER () AS __has_failed
-           FROM ${sheetTable(session)}
-           WHERE _run_id = $1::text
-             AND ${runtimeSheetResultFreshnessSql('_cell_meta', '$1::text')}
+           SELECT CASE
+             WHEN EXISTS (
+               SELECT 1 FROM ${sheetTable(session)}
+               WHERE _run_id = $1::text
+                 AND ${runtimeSheetResultFreshnessSql('_cell_meta', '$1::text')}
+                 AND _status = 'enriched'
+             ) THEN 'enriched'
+             WHEN EXISTS (
+               SELECT 1 FROM ${sheetTable(session)}
+               WHERE _run_id = $1::text
+                 AND ${runtimeSheetResultFreshnessSql('_cell_meta', '$1::text')}
+                 AND _status = 'failed'
+             ) THEN 'failed'
+           END AS preferred_status
          )
          SELECT *
-         FROM scoped
-         WHERE (__has_enriched AND _status = 'enriched')
-            OR (NOT __has_enriched AND __has_failed AND _status = 'failed')
-            OR (NOT __has_enriched AND NOT __has_failed)
+         FROM ${sheetTable(session)}
+         WHERE _run_id = $1::text
+           AND ${runtimeSheetResultFreshnessSql('_cell_meta', '$1::text')}
+           AND ((SELECT preferred_status FROM scoped) IS NULL
+             OR _status = (SELECT preferred_status FROM scoped))
          ORDER BY _input_index ASC NULLS LAST, _created_at ASC, _key ASC
          LIMIT $2 OFFSET $3`,
         [input.runId, input.limit, input.offset],
@@ -4104,15 +4365,29 @@ async function prepareRuntimeSheetDatasetRows(
       );
     const { rows } = await client.query(
       `
-       WITH input_rows AS (
-          SELECT DISTINCT ON (key_values._key)
-                 key_values._key, payload_values.payload, index_values._input_index
-          FROM unnest($1::text[]) WITH ORDINALITY AS key_values(_key, ord)
-          JOIN unnest($2::jsonb[]) WITH ORDINALITY AS payload_values(payload, ord)
-            ON payload_values.ord = key_values.ord
-          JOIN unnest($3::bigint[]) WITH ORDINALITY AS index_values(_input_index, ord)
-            ON index_values.ord = key_values.ord
-          ORDER BY key_values._key, key_values.ord
+       WITH input_rows AS MATERIALIZED (
+          SELECT DISTINCT ON (input_values._key)
+                 input_values._key, input_values._input_index, input_values.ord
+          FROM unnest($1::text[], $3::bigint[])
+            WITH ORDINALITY AS input_values(_key, _input_index, ord)
+          WHERE input_values.ord <= LEAST(
+            COALESCE(cardinality($1::text[]), 0),
+            COALESCE(cardinality($2::jsonb[]), 0),
+            COALESCE(cardinality($3::bigint[]), 0)
+          )
+          ORDER BY input_values._key, input_values.ord
+       ),
+       input_payloads AS MATERIALIZED (
+          SELECT payload_values.payload, payload_values.ord
+          FROM unnest($2::jsonb[]) WITH ORDINALITY AS payload_values(payload, ord)
+       ),
+       physical_input_rows AS NOT MATERIALIZED (
+          -- Repeated admission/fence scans retain only narrow identities.
+          -- Keep one unsorted payload spool and join its original ordinal only
+          -- in physical write paths; do not materialize this wide join again.
+          SELECT input_rows._key, input_rows._input_index, input_payloads.payload
+          FROM input_rows
+          JOIN input_payloads ON input_payloads.ord = input_rows.ord
        ),
        preexisting_rows AS (
           -- Force is new intent across runs, not across scheduler attempts of
@@ -4134,7 +4409,7 @@ async function prepareRuntimeSheetDatasetRows(
               _input_index = input_rows._input_index,
               _updated_at = now(),
               _version = ${nextRuntimeSheetVersionExpression(session)}${input.physicalRefreshSetSql}
-          FROM input_rows
+          FROM physical_input_rows AS input_rows
           WHERE target._key = input_rows._key
             AND target._status = 'enriched'
             AND COALESCE(target._write_version, 0) < $12::bigint
@@ -4155,7 +4430,7 @@ async function prepareRuntimeSheetDatasetRows(
               _attempt_seq = $10::integer,
               _updated_at = now(),
               _version = ${nextRuntimeSheetVersionExpression(session)}${input.physicalRefreshSetSql}
-          FROM input_rows
+          FROM physical_input_rows AS input_rows
           WHERE target._key = input_rows._key
             AND target._status = 'failed'
             AND COALESCE(target._write_version, 0) < $12::bigint
@@ -4166,7 +4441,7 @@ async function prepareRuntimeSheetDatasetRows(
           SET _input_index = input_rows._input_index,
               _updated_at = now(),
               _version = ${nextRuntimeSheetVersionExpression(session)}${input.physicalRefreshSetSql}
-          FROM input_rows
+          FROM physical_input_rows AS input_rows
           WHERE target._key = input_rows._key
             AND target._write_version = $12::bigint
             AND target._status <> 'stale'
@@ -4200,7 +4475,7 @@ async function prepareRuntimeSheetDatasetRows(
         inserted_rows AS (
           INSERT INTO ${sheetTable(session)} (_key, _status, _run_id, _input_index, _attempt_id, _attempt_owner_run_id, _attempt_expires_at, _attempt_seq, _write_version, _writer_run_id, _created_at${input.physicalInsertColumnsSql})
           SELECT input_rows._key, 'pending', $4::text, input_rows._input_index, $7::text, $8::text, $9::timestamptz, $10::integer, $12::bigint, $4::text, now()${input.physicalInsertValuesSql}
-          FROM input_rows
+          FROM physical_input_rows AS input_rows
           LEFT JOIN ${sheetTable(session)} AS existing_input ON existing_input._key = input_rows._key
           ${input.physicalInsertJoinSql}
           ON CONFLICT (_key) DO UPDATE SET
@@ -4251,7 +4526,7 @@ async function prepareRuntimeSheetDatasetRows(
               _error = NULL,
               _updated_at = now(),
               _version = ${nextRuntimeSheetVersionExpression(session)}${input.physicalRefreshSetSql}
-          FROM input_rows
+          FROM physical_input_rows AS input_rows
           WHERE target._key = input_rows._key
             AND target._status IN ('pending', 'running')
             AND COALESCE(target._write_version, 0) < $12::bigint
@@ -4965,7 +5240,9 @@ async function getRuntimeWorkReceiptSession(
     playName: string;
     key: string;
   },
+  access: 'read' | 'mutate' = 'mutate',
 ): Promise<RuntimePostgresSession> {
+  if (access === 'mutate') assertWorkReceiptKeyMutable(input.key);
   const playName = context.playName?.trim() || input.playName;
   if (!playName) {
     throw new Error('Runtime work receipts require a playName.');
@@ -5033,15 +5310,23 @@ async function getRuntimeWorkReceiptSessionForKeys(
     playName: string;
     keys: string[];
   },
+  access: 'read' | 'mutate' = 'mutate',
 ): Promise<RuntimePostgresSession> {
+  if (access === 'mutate') {
+    for (const key of input.keys) assertWorkReceiptKeyMutable(key);
+  }
   const firstKey = input.keys.find((key) => key.trim());
   if (!firstKey) {
     throw new Error('Runtime work receipt batch requires at least one key.');
   }
-  const session = await getRuntimeWorkReceiptSession(context, {
-    playName: input.playName,
-    key: firstKey,
-  });
+  const session = await getRuntimeWorkReceiptSession(
+    context,
+    {
+      playName: input.playName,
+      key: firstKey,
+    },
+    access,
+  );
   for (const key of input.keys) {
     validateRuntimeWorkReceiptKeyScope(session, { key });
   }
@@ -5073,6 +5358,121 @@ async function readRuntimeWorkReceipt(
   return rows[0] ? mapRuntimeWorkReceiptRow(rows[0]) : null;
 }
 
+async function withRuntimeArrayInputReceiptPort<T>(
+  context: RuntimeApiContext,
+  input: RuntimeArrayInputScope,
+  operation: (port: RuntimeArrayInputReceiptPort) => Promise<T>,
+): Promise<T> {
+  const orgId = context.orgId?.trim();
+  if (!orgId || !input.playName?.trim() || !input.runId?.trim()) {
+    throw new Error('Runtime array input requires exact org/play/run scope.');
+  }
+  if (
+    (context.playName && context.playName !== input.playName) ||
+    (context.runId && context.runId !== input.runId)
+  ) {
+    throw new Error('Runtime array input is outside the execution scope.');
+  }
+  const session = await getRuntimeWorkReceiptSessionForRun(context, {
+    playName: input.playName,
+  });
+  if (session.target.orgId !== orgId || session.playName !== input.playName) {
+    throw new Error('Runtime array input session is outside execution scope.');
+  }
+  return await operation({
+    orgId,
+    playName: input.playName,
+    runId: input.runId,
+    table: workReceiptTable(session),
+    outerTransaction:
+      Boolean(session.executionRole) &&
+      !isRuntimeOneShotQueryFactoryRegistered(),
+    withClient: (callback) =>
+      withRuntimeWorkReceiptClient(context, session, callback),
+  });
+}
+
+export async function getRuntimeArrayInputManifest(
+  context: RuntimeApiContext,
+  input: RuntimeArrayInputScope,
+): Promise<RuntimeArrayInputManifest> {
+  if (context.dbSessionStrategy === 'gateway_only') {
+    return await postRuntimeApi<RuntimeArrayInputManifest>(context, {
+      action: 'runtime_array_input_get_manifest',
+      input,
+    });
+  }
+  return await withRuntimeArrayInputReceiptPort(context, input, (port) =>
+    getRuntimeArrayInputManifestReceipt(port, input),
+  );
+}
+
+export async function beginRuntimeArrayInput(
+  context: RuntimeApiContext,
+  input: RuntimeArrayInputBegin,
+): Promise<void> {
+  if (context.dbSessionStrategy === 'gateway_only') {
+    await postRuntimeApi(context, {
+      action: 'runtime_array_input_begin',
+      input,
+    });
+    return;
+  }
+  await withRuntimeArrayInputReceiptPort(context, input, (port) =>
+    beginRuntimeArrayInputReceipt(port, input),
+  );
+}
+
+export async function putRuntimeArrayInputPage(
+  context: RuntimeApiContext,
+  input: RuntimeArrayInputPutPage,
+): Promise<void> {
+  if (context.dbSessionStrategy === 'gateway_only') {
+    await postRuntimeApi(context, {
+      action: 'runtime_array_input_put_page',
+      input,
+    });
+    return;
+  }
+  await withRuntimeArrayInputReceiptPort(context, input, (port) =>
+    putRuntimeArrayInputPageReceipt(port, input),
+  );
+}
+
+export async function sealRuntimeArrayInput(
+  context: RuntimeApiContext,
+  input: RuntimeArrayInputSeal,
+): Promise<void> {
+  if (context.dbSessionStrategy === 'gateway_only') {
+    await postRuntimeApi(context, {
+      action: 'runtime_array_input_seal',
+      input,
+    });
+    return;
+  }
+  await withRuntimeArrayInputReceiptPort(context, input, (port) =>
+    sealRuntimeArrayInputReceipt(port, input),
+  );
+}
+
+export async function readRuntimeArrayInputPage(
+  context: RuntimeApiContext,
+  input: RuntimeArrayInputScope & { ordinal: number },
+): Promise<{ offset: number; rows: RuntimeArrayInputOccurrence[] }> {
+  if (context.dbSessionStrategy === 'gateway_only') {
+    return await postRuntimeApi<{
+      offset: number;
+      rows: RuntimeArrayInputOccurrence[];
+    }>(context, {
+      action: 'runtime_array_input_read_page',
+      input,
+    });
+  }
+  return await withRuntimeArrayInputReceiptPort(context, input, (port) =>
+    readRuntimeArrayInputPageReceipt(port, input),
+  );
+}
+
 export async function getRuntimeWorkReceipt(
   context: RuntimeApiContext,
   input: {
@@ -5080,10 +5480,14 @@ export async function getRuntimeWorkReceipt(
     key: string;
   },
 ): Promise<WorkReceipt | null> {
-  const session = await getRuntimeWorkReceiptSession(context, {
-    playName: input.playName,
-    key: input.key,
-  });
+  const session = await getRuntimeWorkReceiptSession(
+    context,
+    {
+      playName: input.playName,
+      key: input.key,
+    },
+    'read',
+  );
   return await withRuntimeWorkReceiptClient(context, session, async (client) =>
     readRuntimeWorkReceipt(client, session, input.key),
   );
@@ -5100,10 +5504,14 @@ export async function getRuntimeWorkReceipts(
     ...new Set(input.keys.map((key) => key.trim()).filter(Boolean)),
   ];
   if (keys.length === 0) return [];
-  const session = await getRuntimeWorkReceiptSessionForKeys(context, {
-    playName: input.playName,
-    keys,
-  });
+  const session = await getRuntimeWorkReceiptSessionForKeys(
+    context,
+    {
+      playName: input.playName,
+      keys,
+    },
+    'read',
+  );
   return await withRuntimeWorkReceiptClient(
     context,
     session,
@@ -6206,6 +6614,8 @@ export async function completeRuntimeWorkReceipts(
     returnOutput?: boolean;
   },
 ): Promise<Array<WorkReceipt | null>> {
+  for (const receipt of input.receipts)
+    assertWorkReceiptKeyMutable(receipt.key);
   const receipts = input.receipts.filter((receipt) => receipt.key.trim());
   if (receipts.length === 0) return [];
   if (
@@ -6989,33 +7399,501 @@ export async function skipRuntimeWorkReceipt(
   );
 }
 
-/**
- * Prepare one dataset page and return its row dispositions and write version.
- * With stableWriteIntent, the first admission for a run/table is durable in
- * the same transaction as its rows; subsequent pages and wakes reuse it even
- * after losing all runner-local state. A new run admits a newer intent.
- * Gateway transport uses a named operation; an older receiver cannot silently
- * ignore this opt-in or trigger unsafe legacy admission.
- */
-export async function startRuntimeSheetDataset(
+type RuntimeSheetDatasetStartInput = Parameters<
+  typeof startRuntimeSheetDataset
+>[1];
+
+/** Leave 50 KB of headroom below the 4.5 MB Vercel Function body ceiling. */
+const RUNTIME_SHEET_START_REQUEST_MAX_BYTES = 4_450_000;
+
+function runtimeSheetStartIntentId(
+  input: RuntimeSheetDatasetStartInput,
+): string {
+  const inputOffset = Math.max(0, Math.floor(input.inputOffset ?? 0));
+  const digest = createHash('sha256')
+    .update(input.playName)
+    .update('\0')
+    .update(input.runId)
+    .update('\0')
+    .update(input.tableNamespace)
+    .update('\0')
+    .update(String(inputOffset))
+    .update('\0');
+  for (const row of input.rows) {
+    const serializedRow = JSON.stringify(row);
+    digest.update(serializedRow ?? 'undefined').update('\0');
+  }
+  const value = digest.digest('hex').slice(0, 32);
+  return `sheet-attempt:${value}`;
+}
+
+function runtimeSheetStartRequestBytes(input: {
+  request: RuntimeApiActionRequest;
+  limitBytes: number;
+}): { bytes: number; exceeded: boolean } {
+  const body = prepareRetainedPlayPipelinesForTransport(input.request);
+  const measurement = jsonByteLengthUpTo(body, input.limitBytes);
+  return { bytes: measurement.bytes, exceeded: measurement.exceeded };
+}
+
+async function startRuntimeSheetDatasetViaGateway(
   context: RuntimeApiContext,
-  input: {
-    playName: string;
-    tableNamespace: string;
-    playInput?: Record<string, unknown> | null;
-    sheetContract: PlaySheetContract;
-    rows: Record<string, unknown>[];
-    runId: string;
-    attemptId?: string | null;
-    attemptOwnerRunId?: string | null;
-    attemptExpiresAt?: string | null;
-    attemptSeq?: number | null;
-    attemptLeaseTtlMs?: number | null;
-    writeVersion?: number | null;
-    /** Retain this run/table's first admission across pages, retries and wakes. Absence keeps legacy allocation. */
-    stableWriteIntent?: boolean;
-    /** Return completed durable cells separately from merged source rows. */
-    includePreviousCells?: boolean;
+  input: RuntimeSheetDatasetStartInput,
+): Promise<PrepareRuntimeSheetResult> {
+  const request = (
+    pageInput: RuntimeSheetDatasetStartInput,
+  ): RuntimeApiActionRequest => ({
+    action:
+      pageInput.stableWriteIntent === true
+        ? 'runtime_sheet_start_with_intent'
+        : 'runtime_sheet_start',
+    // Sheet admission consumes rows, not the full authored Play input. Exclude
+    // that duplicate payload from both sizing and every actual page request.
+    input: { ...pageInput, playInput: undefined, pendingRerunAdmission: true },
+  });
+  const completeRequest = request(input);
+  if (
+    !runtimeSheetStartRequestBytes({
+      request: completeRequest,
+      limitBytes: RUNTIME_SHEET_START_REQUEST_MAX_BYTES,
+    }).exceeded
+  ) {
+    return await postRuntimeApi<PrepareRuntimeSheetResult>(
+      context,
+      completeRequest,
+    );
+  }
+
+  const requestInput: RuntimeSheetDatasetStartInput = {
+    ...input,
+    attemptId: input.attemptId?.trim() || runtimeSheetStartIntentId(input),
+    pendingRerunAdmission: true,
+  };
+  // Keep every page under the app-function ingress ceiling while preserving
+  // the stable write intent, rerun admission, and attempt fence.
+  const inputOffset = Math.max(0, Math.floor(input.inputOffset ?? 0));
+  const continuationInput: RuntimeSheetDatasetStartInput = {
+    ...requestInput,
+    inputOffset,
+    rows: [],
+  };
+  const emptyRequestBytes = runtimeSheetStartRequestBytes({
+    request: request(continuationInput),
+    limitBytes: RUNTIME_SHEET_START_REQUEST_MAX_BYTES,
+  });
+  if (emptyRequestBytes.exceeded) {
+    throw new Error(
+      `Runtime sheet start metadata exceeds the ${RUNTIME_SHEET_START_REQUEST_MAX_BYTES}-byte app request budget before row data is included.`,
+    );
+  }
+  // Leave space for fields returned by the first page and sent on continuation.
+  const rowPageBudgetBytes =
+    RUNTIME_SHEET_START_REQUEST_MAX_BYTES - emptyRequestBytes.bytes - 4 * 1024;
+  if (rowPageBudgetBytes < 1) {
+    throw new Error(
+      'Runtime sheet start metadata leaves no room for a row in the app request budget.',
+    );
+  }
+
+  const pageResults: PrepareRuntimeSheetResult[] = [];
+  let pageInput = continuationInput;
+  const startedAt = Date.now();
+  for await (const page of iteratePlayDatasetInputPages(input.rows, {
+    maxPageBytes: rowPageBudgetBytes,
+    estimateRowBytes: (row) => {
+      const measured = jsonByteLengthUpTo(
+        row,
+        RUNTIME_SHEET_START_REQUEST_MAX_BYTES,
+      );
+      return measured.bytes + 1;
+    },
+  })) {
+    const nextInput: RuntimeSheetDatasetStartInput = {
+      ...pageInput,
+      rows: page.rows,
+      inputOffset: inputOffset + page.offset,
+    };
+    const pageRequest = request(nextInput);
+    const pageBytes = runtimeSheetStartRequestBytes({
+      request: pageRequest,
+      limitBytes: RUNTIME_SHEET_START_REQUEST_MAX_BYTES,
+    });
+    if (pageBytes.exceeded) {
+      throw new Error(
+        `A runtime sheet start page exceeds the ${RUNTIME_SHEET_START_REQUEST_MAX_BYTES}-byte app request budget.`,
+      );
+    }
+    const result = await postRuntimeApi<PrepareRuntimeSheetResult>(
+      context,
+      pageRequest,
+    );
+    pageResults.push(result);
+    pageInput = {
+      ...nextInput,
+      attemptId: result.attemptId ?? nextInput.attemptId,
+      attemptOwnerRunId:
+        result.attemptOwnerRunId ?? nextInput.attemptOwnerRunId,
+      attemptExpiresAt: result.attemptExpiresAt ?? nextInput.attemptExpiresAt,
+      attemptSeq: result.attemptSeq ?? nextInput.attemptSeq,
+      writeVersion: result.writeVersion ?? nextInput.writeVersion,
+    };
+  }
+
+  if (pageResults.length === 0) {
+    return await postRuntimeApi<PrepareRuntimeSheetResult>(
+      context,
+      request(continuationInput),
+    );
+  }
+  if (pageResults.length === 1) return pageResults[0]!;
+
+  const latest = pageResults.at(-1)!;
+  const pendingRows = pageResults.flatMap((result) => result.pendingRows);
+  const completedRows = pageResults.flatMap((result) => result.completedRows);
+  const blockedRows = pageResults.flatMap((result) => result.blockedRows);
+  const inserted = pageResults.reduce(
+    (total, result) => total + result.inserted,
+    0,
+  );
+  const skipped = pageResults.reduce(
+    (total, result) => total + result.skipped,
+    0,
+  );
+  const lastDefined = <T>(
+    select: (result: PrepareRuntimeSheetResult) => T | null | undefined,
+  ) => {
+    for (let index = pageResults.length - 1; index >= 0; index -= 1) {
+      const value = select(pageResults[index]!);
+      if (value != null) return value;
+    }
+    return undefined;
+  };
+  return {
+    ...(input.includePreviousCells
+      ? {
+          previousCells: pageResults.flatMap(
+            (result) => result.previousCells ?? [],
+          ),
+        }
+      : {}),
+    inserted,
+    skipped,
+    pendingRows,
+    completedRows,
+    blockedRows,
+    tableNamespace: latest.tableNamespace,
+    attemptId:
+      lastDefined((result) => result.attemptId) ??
+      requestInput.attemptId ??
+      undefined,
+    attemptOwnerRunId:
+      lastDefined((result) => result.attemptOwnerRunId) ??
+      requestInput.attemptOwnerRunId ??
+      undefined,
+    attemptExpiresAt:
+      lastDefined((result) => result.attemptExpiresAt) ??
+      requestInput.attemptExpiresAt ??
+      undefined,
+    attemptSeq:
+      lastDefined((result) => result.attemptSeq) ??
+      requestInput.attemptSeq ??
+      undefined,
+    writeVersion:
+      lastDefined((result) => result.writeVersion) ??
+      requestInput.writeVersion ??
+      undefined,
+    timings: [
+      {
+        phase: 'gateway_page_batch',
+        ms: Date.now() - startedAt,
+        rows: input.rows.length,
+        chunks: pageResults.length,
+        inserted,
+        skipped,
+        pending: pendingRows.length,
+        completed: completedRows.length,
+      },
+    ],
+  };
+}
+
+/**
+ * Prepare one dataset page and return its row dispositions and write version.
+ * With stableWriteIntent, the first admission for a run/table is durable in
+ * the same transaction as its rows; subsequent pages and wakes reuse it even
+ * after losing all runner-local state. A new run admits a newer intent.
+ * Gateway transport uses a named operation; an older receiver cannot silently
+ * ignore this opt-in or trigger unsafe legacy admission.
+ */
+function runtimeSheetInputRowIdentity(
+  row: Record<string, unknown>,
+  tableNamespace: string,
+): { key: string; cleanedRow: Record<string, unknown> } {
+  // Use the same identity before transport paging and inside the receiver.
+  const cleanedRow = toSerializableCsvAliasedRow(row);
+  return {
+    key:
+      resolveMapRowOutcomeKey(row) ??
+      derivePlayRowIdentity(cleanedRow, tableNamespace),
+    cleanedRow,
+  };
+}
+
+type RuntimeSheetStartInput = Parameters<typeof startRuntimeSheetDataset>[1];
+type RuntimeSheetStartMetadata = Omit<
+  RuntimeSheetStartInput,
+  'rows' | 'playInput'
+>;
+type RuntimeSheetStartAction =
+  | 'runtime_sheet_start'
+  | 'runtime_sheet_start_with_intent';
+type RuntimeSheetStartTransportPage = {
+  rowsJson: string[];
+  inputOffset?: number;
+};
+
+function serializeRuntimeSheetStartRequest(
+  action: RuntimeSheetStartAction,
+  metadata: RuntimeSheetStartMetadata,
+  rowsJson: readonly string[],
+): string {
+  const prepared = prepareRetainedPlayPipelinesForTransport({
+    action,
+    input: metadata,
+  });
+  const inputJson = JSON.stringify(prepared.input);
+  return `{"action":${JSON.stringify(prepared.action)},"input":${inputJson.slice(0, -1)}${inputJson.length > 2 ? ',' : ''}"rows":[${rowsJson.join(',')}]}}`;
+}
+
+/**
+ * Local admission pages, not a new wire response. Consumers must retain each
+ * page's history/row-memory checks rather than merge a source-sized response.
+ * The runner supplies its existing persistence retry around each fixed page.
+ */
+export async function* startRuntimeSheetDatasetPages(
+  context: RuntimeApiContext,
+  input: RuntimeSheetStartInput,
+  options?: {
+    runPage?: (
+      operation: () => Promise<PrepareRuntimeSheetResult>,
+    ) => Promise<PrepareRuntimeSheetResult>;
+  },
+): AsyncGenerator<PrepareRuntimeSheetResult> {
+  const runPage =
+    options?.runPage ??
+    ((operation: () => Promise<PrepareRuntimeSheetResult>) => operation());
+  if (context.dbSessionStrategy !== 'gateway_only') {
+    yield await runPage(() => startRuntimeSheetDataset(context, input));
+    return;
+  }
+  const action: RuntimeSheetStartAction =
+    input.stableWriteIntent === true
+      ? 'runtime_sheet_start_with_intent'
+      : 'runtime_sheet_start';
+  // playInput is not read by sheet admission. Repeating the entire authored
+  // input beside every bounded row page would defeat the transport boundary.
+  const frozenMetadata = JSON.parse(
+    JSON.stringify({
+      ...input,
+      rows: undefined,
+      playInput: undefined,
+      pendingRerunAdmission: true,
+    }),
+  ) as RuntimeSheetStartMetadata;
+  const tableNamespace = frozenMetadata.tableNamespace;
+  const includePreviousCells = frozenMetadata.includePreviousCells === true;
+  const previousCellsBudgetBytes = frozenMetadata.previousCellsBudgetBytes;
+  const attemptOwnerRunId =
+    normalizeRuntimeSheetAttemptOwnerRunId(frozenMetadata);
+  const attemptSeq = normalizeRuntimeRunAttempt(frozenMetadata.attemptSeq);
+  // Array JSON encodes holes/undefined as null; preserve that wire behavior on
+  // the unchanged single-page path as well as ordinary JSON value snapshots.
+  const rowsJson = Array.from(
+    input.rows,
+    (row) => JSON.stringify(row) ?? 'null',
+  );
+  const rowBytes = rowsJson.reduce(
+    (total, row) => total + Buffer.byteLength(row, 'utf8'),
+    Math.max(0, rowsJson.length - 1),
+  );
+  const fullBytes =
+    Buffer.byteLength(
+      serializeRuntimeSheetStartRequest(action, frozenMetadata, []),
+      'utf8',
+    ) + rowBytes;
+  const pages: RuntimeSheetStartTransportPage[] = [];
+  let duplicateRows = 0;
+  if (fullBytes <= RUNNER_TERMINAL_PUSH_MAX_BODY_BYTES) {
+    // Keep every previously transportable admission as one transaction, with
+    // its existing receiver-side deduplication and optional response fields.
+    pages.push({ rowsJson });
+  } else {
+    frozenMetadata.attemptId = normalizeRuntimeSheetAttemptId(
+      frozenMetadata.attemptId,
+    );
+    const inputOffset = Math.max(
+      0,
+      Math.floor(frozenMetadata.inputOffset ?? 0),
+    );
+    if (!Number.isSafeInteger(inputOffset + rowsJson.length)) {
+      throw new Error('Runtime sheet start requires safe global row indexes.');
+    }
+    // Reserve the longest valid version/index before ANY page is admitted.
+    // A late oversized row or contract must not leave earlier pages pending.
+    const framingBytes = Buffer.byteLength(
+      serializeRuntimeSheetStartRequest(
+        action,
+        {
+          ...frozenMetadata,
+          writeVersion: Number.MAX_SAFE_INTEGER,
+          inputOffset: Number.MAX_SAFE_INTEGER,
+        },
+        [],
+      ),
+      'utf8',
+    );
+    const seen = new Set<string>();
+    let page: RuntimeSheetStartTransportPage = { rowsJson: [] };
+    let pageBytes = framingBytes;
+    for (let index = 0; index < rowsJson.length; index += 1) {
+      const row: unknown = JSON.parse(rowsJson[index]!);
+      rowsJson[index] = '';
+      if (!row || typeof row !== 'object' || Array.isArray(row)) {
+        throw new Error(
+          `Runtime sheet start row ${index} must encode an object.`,
+        );
+      }
+      const sourceRow = row as Record<string, unknown>;
+      const { key } = runtimeSheetInputRowIdentity(sourceRow, tableNamespace);
+      if (seen.has(key)) {
+        duplicateRows += 1;
+        continue;
+      }
+      seen.add(key);
+      const serialized = JSON.stringify({
+        ...sourceRow,
+        ...mapRowOutcomeRuntimeFields({
+          key,
+          inputIndex:
+            normalizeRuntimeMapInputIndex(
+              sourceRow[MAP_ROW_OUTCOME_RUNTIME_FIELDS.inputIndex],
+            ) ?? inputOffset + index,
+        }),
+      });
+      const bytes = Buffer.byteLength(serialized, 'utf8');
+      if (framingBytes + bytes > RUNNER_TERMINAL_PUSH_MAX_BODY_BYTES) {
+        throw new Error(
+          `Runtime sheet start row ${index} exceeds the ${RUNNER_TERMINAL_PUSH_MAX_BODY_BYTES} byte request-body limit.`,
+        );
+      }
+      const separatorBytes = page.rowsJson.length > 0 ? 1 : 0;
+      if (
+        page.rowsJson.length > 0 &&
+        pageBytes + separatorBytes + bytes >
+          RUNTIME_SHEET_START_TARGET_BODY_BYTES
+      ) {
+        pages.push(page);
+        page = { rowsJson: [] };
+        pageBytes = framingBytes;
+      }
+      if (page.rowsJson.length === 0) page.inputOffset = inputOffset + index;
+      pageBytes += bytes + (page.rowsJson.length > 0 ? 1 : 0);
+      page.rowsJson.push(serialized);
+    }
+    if (page.rowsJson.length > 0) pages.push(page);
+    if (pages.length === 0) {
+      throw new Error(
+        'Runtime sheet start metadata exceeds the request-body limit.',
+      );
+    }
+  }
+
+  let writeVersion = frozenMetadata.writeVersion;
+  let membershipCapture: boolean | undefined;
+  for (const [index, page] of pages.entries()) {
+    const pageMetadata = {
+      ...frozenMetadata,
+      ...(page.inputOffset !== undefined
+        ? { inputOffset: page.inputOffset }
+        : {}),
+      ...(writeVersion != null ? { writeVersion } : {}),
+    };
+    const preparedBodyJson = serializeRuntimeSheetStartRequest(
+      action,
+      pageMetadata,
+      page.rowsJson,
+    );
+    if (
+      Buffer.byteLength(preparedBodyJson, 'utf8') >
+      RUNNER_TERMINAL_PUSH_MAX_BODY_BYTES
+    ) {
+      throw new Error(
+        'Runtime sheet start page exceeded its preflight body budget.',
+      );
+    }
+    const request = JSON.parse(preparedBodyJson) as Extract<
+      RuntimeApiActionRequest,
+      { action: RuntimeSheetStartAction }
+    >;
+    const result = await runPage(() =>
+      postRuntimeApi<PrepareRuntimeSheetResult>(
+        context,
+        request,
+        preparedBodyJson,
+      ),
+    );
+    page.rowsJson.length = 0;
+    if (includePreviousCells) {
+      assertDatasetAdmissionHistory(result, previousCellsBudgetBytes);
+    }
+    if (pages.length > 1) {
+      const admittedVersion = result.writeVersion;
+      if (
+        typeof admittedVersion !== 'number' ||
+        !Number.isSafeInteger(admittedVersion) ||
+        admittedVersion <= 0 ||
+        (writeVersion != null && result.writeVersion !== writeVersion) ||
+        normalizeTableNamespace(result.tableNamespace) !==
+          normalizeTableNamespace(tableNamespace) ||
+        (result.attemptId !== undefined &&
+          result.attemptId !== frozenMetadata.attemptId) ||
+        (result.attemptOwnerRunId !== undefined &&
+          result.attemptOwnerRunId !== attemptOwnerRunId) ||
+        (result.attemptSeq !== undefined && result.attemptSeq !== attemptSeq) ||
+        (index > 0 && result.membershipCapture !== membershipCapture)
+      ) {
+        throw new Error(
+          'Runtime sheet admission pages disagree on their write intent or identity.',
+        );
+      }
+      writeVersion = result.writeVersion;
+    }
+    membershipCapture = result.membershipCapture;
+    yield index === 0 && duplicateRows > 0
+      ? { ...result, skipped: result.skipped + duplicateRows }
+      : result;
+  }
+}
+
+export async function startRuntimeSheetDataset(
+  context: RuntimeApiContext,
+  input: {
+    playName: string;
+    tableNamespace: string;
+    playInput?: Record<string, unknown> | null;
+    sheetContract: PlaySheetContract;
+    rows: Record<string, unknown>[];
+    runId: string;
+    attemptId?: string | null;
+    attemptOwnerRunId?: string | null;
+    attemptExpiresAt?: string | null;
+    attemptSeq?: number | null;
+    attemptLeaseTtlMs?: number | null;
+    writeVersion?: number | null;
+    /** Retain this run/table's first admission across pages, retries and wakes. Absence keeps legacy allocation. */
+    stableWriteIntent?: boolean;
+    /** Return completed durable cells separately from merged source rows. */
+    includePreviousCells?: boolean;
     previousCellsBudgetBytes?: number;
     inputOffset?: number;
     force?: boolean;
@@ -7033,15 +7911,7 @@ export async function startRuntimeSheetDataset(
   };
   if (context.dbSessionStrategy === 'gateway_only') {
     return checkedResult(
-      await postRuntimeApi<PrepareRuntimeSheetResult>(context, {
-        // A named operation prevents an old gateway from silently ignoring the
-        // intent opt-in and re-admitting this run under a new version.
-        action:
-          input.stableWriteIntent === true
-            ? 'runtime_sheet_start_with_intent'
-            : 'runtime_sheet_start',
-        input: { ...input, pendingRerunAdmission: true },
-      }),
+      await startRuntimeSheetDatasetViaGateway(context, input),
     );
   }
   const totalStartedAt = Date.now();
@@ -7103,10 +7973,10 @@ export async function startRuntimeSheetDataset(
     // Materializes projected CSV aliases as visible cells and drops internal
     // __deepline* keys — a plain spread would silently lose the
     // non-enumerable alias fields on the JSON payload boundary.
-    const cleanedRow = toSerializableCsvAliasedRow(row);
-    const key =
-      resolveMapRowOutcomeKey(row) ??
-      derivePlayRowIdentity(cleanedRow, input.tableNamespace);
+    const { cleanedRow, key } = runtimeSheetInputRowIdentity(
+      row,
+      input.tableNamespace,
+    );
     const source =
       row.__deeplineSourceRow && typeof row.__deeplineSourceRow === 'object'
         ? (sanitizePostgresJsonValue(row.__deeplineSourceRow) as Record<
@@ -7210,9 +8080,10 @@ export async function startRuntimeSheetDataset(
       tableNamespace: input.tableNamespace,
       sheetContract: input.sheetContract,
       transactional: needsTransaction,
+      concurrentColumnPreparation: true,
       timings,
     },
-    async (client) => {
+    async (client, columnLockMode) => {
       const attemptExpiryStartedAt = Date.now();
       const attemptExpiresAt = await mintRuntimeSheetAttemptExpiresAt(
         client,
@@ -7224,6 +8095,7 @@ export async function startRuntimeSheetDataset(
         input,
       );
       const columnTypes = await RuntimeSheetColumns.prepareWrite(client, {
+        lockMode: columnLockMode,
         schema: session.postgres.schema,
         table: session.postgres.sheetTable,
         columns: physicalSheetColumnProjections(input.sheetContract).map(
@@ -7781,6 +8653,7 @@ function physicalRuntimeSheetUpdateSql(
 }
 
 type CompleteRuntimeMapRowChunksInput = {
+  columnLockMode: 'shared' | 'exclusive';
   chunks: RuntimePreparedCompletedRow[][];
   physicalColumnProjections: PhysicalSheetColumnProjection[];
   runId: string;
@@ -7951,45 +8824,57 @@ function writableEnrichedRuntimeSheetAttemptSql(
 async function completeRuntimeMapRowChunks(
   client: RuntimeQueryClient,
   session: RuntimePostgresSession,
-  input: CompleteRuntimeMapRowChunksInput,
-): Promise<RuntimeMapRowsMutationResult> {
+  input: CompleteRuntimeMapRowChunksInput & {
+    exactKeyChunks: RuntimePreparedCompletedRow[][][];
+  },
+): Promise<RuntimeMapRowsMutationResult & { allExactRowsUpdated: boolean }> {
   let updated = 0;
+  // Exact submitted keys are deduplicated before chunking. A physical update
+  // locks each existing key until this transaction commits; only that proof
+  // permits skipping missing-row discovery. Repair counts are not key coverage.
+  let allExactRowsUpdated = true;
   const fencedRows: RuntimeMapRowsStaleRow[] = [];
-  for (const chunk of input.chunks) {
-    const chunkKeys = chunk.map((row) => row.key);
-    const chunkInputIndexes = chunk.map((row) => row.input_index);
-    const chunkDataPatches = chunk.map((row) => row.data_patch_json);
-    const chunkCellMetaPatches = chunk.map((row) => row.cell_meta_patch_json);
-    const targetChangedPatchedCellSql = changedPatchedCellSql(
-      'target',
-      'updates.data_patch',
-      input.physicalColumnProjections,
-    );
-    const writableEnrichedAttemptSql = writableEnrichedRuntimeSheetAttemptSql(
-      'target',
-      '$10::text',
-      '$11::timestamptz',
-      '$12',
-    );
-    const writableNonTerminalAttemptSql = `(
+  // Preserve the original row-count units: every exact write precedes all
+  // input-index repairs within that unit, regardless of payload subdivision.
+  for (const exactKeyChunks of input.exactKeyChunks) {
+    const repairChunk: RuntimePreparedCompletedRow[] = [];
+    for (const chunk of exactKeyChunks) {
+      const chunkKeys = chunk.map((row) => row.key);
+      const chunkInputIndexes = chunk.map((row) => row.input_index);
+      const chunkDataPatches = chunk.map((row) => row.data_patch_json);
+      const chunkCellMetaPatches = chunk.map((row) => row.cell_meta_patch_json);
+      const targetChangedPatchedCellSql = changedPatchedCellSql(
+        'target',
+        'updates.data_patch',
+        input.physicalColumnProjections,
+      );
+      const writableEnrichedAttemptSql = writableEnrichedRuntimeSheetAttemptSql(
+        'target',
+        '$10::text',
+        '$11::timestamptz',
+        '$12',
+      );
+      const writableNonTerminalAttemptSql = `(
       target._status <> 'enriched'
       AND (
         ${activeRuntimeSheetAttemptFenceSql('target', '$9::text', '$10::text', '$11::timestamptz', '$12::integer')}
         OR coalesce(target._attempt_owner_run_id, target._run_id) IS DISTINCT FROM $10::text
       )
     )`;
-    const matchingUpdatesSql = `WITH mutation_context AS (SELECT $6::text AS play_name, $7::text AS table_namespace, $11::timestamptz AS attempt_expires_at, $12::integer AS attempt_seq), updates AS (
-         SELECT key_values._key,
-                input_index_values.input_index,
-                data_values.data_patch,
-                cell_meta_values.cell_meta_patch
-         FROM unnest($1::text[]) WITH ORDINALITY AS key_values(_key, ord)
-         JOIN unnest($2::bigint[]) WITH ORDINALITY AS input_index_values(input_index, ord)
-           ON input_index_values.ord = key_values.ord
-         JOIN unnest($3::jsonb[]) WITH ORDINALITY AS data_values(data_patch, ord)
-           ON data_values.ord = key_values.ord
-         JOIN unnest($4::jsonb[]) WITH ORDINALITY AS cell_meta_values(cell_meta_patch, ord)
-           ON cell_meta_values.ord = key_values.ord
+      const matchingUpdatesSql = `WITH mutation_context AS (SELECT $6::text AS play_name, $7::text AS table_namespace, $11::timestamptz AS attempt_expires_at, $12::integer AS attempt_seq), updates AS (
+         SELECT input_values._key,
+                input_values.input_index,
+                input_values.ord AS submitted_ordinal,
+                input_values.data_patch,
+                input_values.cell_meta_patch
+         FROM unnest($1::text[], $2::bigint[], $3::jsonb[], $4::jsonb[])
+           WITH ORDINALITY AS input_values(_key, input_index, data_patch, cell_meta_patch, ord)
+         WHERE input_values.ord <= LEAST(
+           COALESCE(cardinality($1::text[]), 0),
+           COALESCE(cardinality($2::bigint[]), 0),
+           COALESCE(cardinality($3::jsonb[]), 0),
+           COALESCE(cardinality($4::jsonb[]), 0)
+         )
        ),
        matched_updates AS (
          SELECT target._key AS matched_key,
@@ -7997,18 +8882,21 @@ async function completeRuntimeMapRowChunks(
                 target._status AS prev_status,
                 target._cell_meta AS prev_cell_meta,
                 updates.input_index,
+                updates.submitted_ordinal,
                 updates.data_patch,
                 updates.cell_meta_patch
            FROM updates
            JOIN ${sheetTable(session)} AS target
              ON target._key = updates._key
        )`;
-    const writableRowsSql = `target._key = updates.matched_key
+      // Membership must not promote a run-wide partial index over exact keys
+      // when statistics underestimate a fresh run. Keep negated fencing intact.
+      const writableRowsSql = `target._key = updates.matched_key
 		           AND ($13::bigint IS NULL OR target._write_version = $13::bigint)
                    AND ($13::bigint IS NOT NULL OR target._status <> 'enriched')
 		           AND NOT (${newerTerminalRuntimeSheetRowSql('target', '$11::timestamptz', '$12::integer', '$9::text', '$10::text')})
            AND (
-             ($9::text IS NULL AND target._run_id = $5::text)
+             ($9::text IS NULL AND coalesce(target._run_id = $5::text, false))
              OR ($9::text IS NOT NULL AND ${writableNonTerminalAttemptSql})
              OR ($9::text IS NOT NULL AND ${activeRuntimeSheetAttemptFenceSql('target', '$9::text', '$10::text', '$11::timestamptz', '$12::integer')})
 		             OR ($9::text IS NOT NULL AND ${writableEnrichedAttemptSql})
@@ -8045,46 +8933,76 @@ async function completeRuntimeMapRowChunks(
                 WHERE coalesce(target._cell_meta -> field_values.field ->> 'status', '') <> 'completed'
              )
            )`;
-    const mutationParams = [
-      chunkKeys,
-      chunkInputIndexes,
-      chunkDataPatches,
-      chunkCellMetaPatches,
-      input.runId,
-      input.normalizedPlayName,
-      input.normalizedTableNamespace,
-      [...new Set(input.outputFields)],
-      input.attemptId,
-      input.attemptOwnerRunId,
-      input.attemptExpiresAt,
-      input.attemptSeq,
-      input.writeVersion,
-    ];
-    const columnTypes = await RuntimeSheetColumns.prepareWrite(client, {
-      schema: session.postgres.schema,
-      table: session.postgres.sheetTable,
-      columns: input.physicalColumnProjections,
-      rows: async () => {
-        const accepted = await client.query<{
-          data_patch: Record<string, unknown>;
-        }>(
-          `${matchingUpdatesSql}
-           SELECT updates.data_patch
+      const mutationParams = [
+        chunkKeys,
+        chunkInputIndexes,
+        chunkDataPatches,
+        chunkCellMetaPatches,
+        input.runId,
+        input.normalizedPlayName,
+        input.normalizedTableNamespace,
+        [...new Set(input.outputFields)],
+        input.attemptId,
+        input.attemptOwnerRunId,
+        input.attemptExpiresAt,
+        input.attemptSeq,
+        input.writeVersion,
+      ];
+      const columnTypes = await RuntimeSheetColumns.prepareWrite(client, {
+        lockMode: input.columnLockMode,
+        schema: session.postgres.schema,
+        table: session.postgres.sheetTable,
+        columns: input.physicalColumnProjections,
+        rows: async () => {
+          const accepted = await client.query<{
+            submitted_ordinal: number | string;
+          }>(
+            `${matchingUpdatesSql}
+           SELECT updates.submitted_ordinal
            FROM matched_updates AS updates
            JOIN ${sheetTable(session)} AS target ON target._key = updates.matched_key
            WHERE ${writableRowsSql}
            FOR UPDATE OF target`,
-          mutationParams,
-        );
-        return accepted.rows.map((row) => row.data_patch);
-      },
-    });
-    const { rows } = await client.query<{
-      updated: number;
-      matched_keys: string[];
-      fenced_rows: unknown;
-    }>(
-      `${matchingUpdatesSql},
+            mutationParams,
+          );
+          // Ordinality identifies the original parameter even if UTF8 text
+          // transport replaces a lone surrogate or makes two keys collide.
+          // Decode only the already-sanitized JSON parameter; never re-run
+          // authored toJSON or deduplicate accepted physical-key collisions.
+          const seen = new Set<number>();
+          return accepted.rows.map((row) => {
+            const raw = row.submitted_ordinal;
+            const ordinal =
+              typeof raw === 'number'
+                ? raw
+                : typeof raw === 'string'
+                  ? Number(raw)
+                  : NaN;
+            if (
+              !Number.isSafeInteger(ordinal) ||
+              ordinal < 1 ||
+              ordinal > chunk.length ||
+              (typeof raw === 'string' && String(ordinal) !== raw) ||
+              seen.has(ordinal)
+            ) {
+              throw new Error(
+                'Runtime Sheet accepted-ordinal evidence is invalid.',
+              );
+            }
+            seen.add(ordinal);
+            return JSON.parse(chunk[ordinal - 1]!.data_patch_json) as Record<
+              string,
+              unknown
+            >;
+          });
+        },
+      });
+      const { rows } = await client.query<{
+        updated: number;
+        matched_keys: string[];
+        fenced_rows: unknown;
+      }>(
+        `${matchingUpdatesSql},
        applied_rows AS (
          UPDATE ${sheetTable(session)} AS target
          SET _status = 'enriched',
@@ -8224,23 +9142,31 @@ async function completeRuntimeMapRowChunks(
          coalesce((SELECT jsonb_agg(jsonb_build_object('key', _key, 'reason', reason, 'rowVersionStamp', row_write_version)) FROM fenced_rows), '[]'::jsonb) AS fenced_rows,
          (SELECT count(*)::int FROM summary_delta) AS summary_delta_count,
          (SELECT count(*)::int FROM column_delta) AS column_delta_count`,
-      mutationParams,
-    );
-    const matchedKeys = new Set(rows[0]?.matched_keys ?? []);
-    const chunkFencedRows = parseRuntimeMapRowsFencedRows(rows[0]?.fenced_rows);
-    // An exact-version replay that already produced the same terminal value is
-    // accepted idempotently even when SQL has no physical mutation to apply.
-    // Stale versions remain excluded through fenced_rows.
-    const appliedCount = Number(rows[0]?.updated ?? 0);
-    updated += appliedCount;
-    fencedRows.push(...chunkFencedRows);
-    if (matchedKeys.size === chunk.length) {
-      continue;
-    }
+        mutationParams,
+      );
+      const matchedKeys = new Set(rows[0]?.matched_keys ?? []);
+      const chunkFencedRows = parseRuntimeMapRowsFencedRows(
+        rows[0]?.fenced_rows,
+      );
+      // An exact-version replay that already produced the same terminal value is
+      // accepted idempotently even when SQL has no physical mutation to apply.
+      // Stale versions remain excluded through fenced_rows.
+      const appliedCount = Number(rows[0]?.updated ?? 0);
+      if (matchedKeys.size !== chunk.length || appliedCount !== chunk.length) {
+        allExactRowsUpdated = false;
+      }
+      updated += appliedCount;
+      fencedRows.push(...chunkFencedRows);
+      if (matchedKeys.size === chunk.length) {
+        continue;
+      }
 
-    const repairChunk = chunk.filter(
-      (row) => !matchedKeys.has(row.key) && row.input_index !== null,
-    );
+      repairChunk.push(
+        ...chunk.filter(
+          (row) => !matchedKeys.has(row.key) && row.input_index !== null,
+        ),
+      );
+    }
     if (repairChunk.length === 0) {
       continue;
     }
@@ -8252,7 +9178,7 @@ async function completeRuntimeMapRowChunks(
     updated += repaired.updated;
     fencedRows.push(...repaired.fencedRows);
   }
-  return { updated, fencedRows };
+  return { updated, fencedRows, allExactRowsUpdated };
 }
 
 async function completeRuntimeMapRowChunksWithInputIndexRepair(
@@ -8360,6 +9286,7 @@ async function completeRuntimeMapRowChunksWithInputIndexRepair(
       input.writeVersion,
     ];
     const columnTypes = await RuntimeSheetColumns.prepareWrite(client, {
+      lockMode: input.columnLockMode,
       schema: session.postgres.schema,
       table: session.postgres.sheetTable,
       columns: input.physicalColumnProjections,
@@ -8546,6 +9473,7 @@ async function insertMissingCompletedMapRowChunks(
     const chunkDataPatches = chunk.map((row) => row.data_patch_json);
     const chunkCellMetaPatches = chunk.map((row) => row.cell_meta_patch_json);
     const columnTypes = await RuntimeSheetColumns.prepareWrite(client, {
+      lockMode: input.columnLockMode,
       schema: session.postgres.schema,
       table: session.postgres.sheetTable,
       columns: input.physicalColumnProjections,
@@ -8553,13 +9481,19 @@ async function insertMissingCompletedMapRowChunks(
         const accepted = await client.query<{
           data_patch: Record<string, unknown>;
         }>(
-          `SELECT incoming.data_patch FROM jsonb_to_recordset($1::jsonb)
-             AS incoming(key text, input_index bigint, data_patch jsonb)
+          `WITH exact_key_missing AS MATERIALIZED (
+             SELECT incoming.* FROM jsonb_to_recordset($1::jsonb)
+               AS incoming(key text, input_index bigint, data_patch jsonb)
+             WHERE NOT EXISTS (
+               SELECT 1 FROM ${sheetTable(session)} AS target
+               WHERE target._key = incoming.key
+             )
+           )
+           SELECT incoming.data_patch FROM exact_key_missing AS incoming
            WHERE NOT EXISTS (
              SELECT 1 FROM ${sheetTable(session)} AS target
-             WHERE target._key = incoming.key
-               OR (incoming.input_index IS NOT NULL AND target._run_id = $2::text
-                   AND target._input_index = incoming.input_index)
+             WHERE incoming.input_index IS NOT NULL AND target._run_id = $2::text
+               AND target._input_index = incoming.input_index
            )`,
           [
             stringifyPostgresJson(
@@ -8602,20 +9536,28 @@ async function insertMissingCompletedMapRowChunks(
          JOIN unnest($4::jsonb[]) WITH ORDINALITY AS cell_meta_values(cell_meta_patch, ord)
            ON cell_meta_values.ord = key_values.ord
        ),
-       -- Decode only accepted rows: a rejected replay may contain values
-       -- incompatible with the stored native types.
-       missing_rows AS MATERIALIZED (
+       -- Keep input-index repair behind exact-key misses: otherwise the OR
+       -- can read a whole run's index entries for every existing key.
+       exact_key_missing AS MATERIALIZED (
          SELECT input_rows.*
            FROM input_rows
           WHERE NOT EXISTS (
             SELECT 1
               FROM ${sheetTable(session)} AS target
              WHERE target._key = input_rows._key
-                OR (
-                  input_rows.input_index IS NOT NULL
-                  AND target._run_id = $5::text
-                  AND target._input_index = input_rows.input_index
-                )
+          )
+       ),
+       -- Decode only accepted rows: a rejected replay may contain values
+       -- incompatible with the stored native types.
+       missing_rows AS MATERIALIZED (
+         SELECT exact_key_missing.*
+           FROM exact_key_missing
+          WHERE NOT EXISTS (
+            SELECT 1
+              FROM ${sheetTable(session)} AS target
+             WHERE exact_key_missing.input_index IS NOT NULL
+               AND target._run_id = $5::text
+               AND target._input_index = exact_key_missing.input_index
           )
        ),
        inserted_rows AS (
@@ -8741,6 +9683,7 @@ async function failRuntimeMapRowChunks(
   client: RuntimeQueryClient,
   session: RuntimePostgresSession,
   input: {
+    columnLockMode: 'shared' | 'exclusive';
     chunks: RuntimePreparedFailedRow[][];
     physicalColumnProjections: PhysicalSheetColumnProjection[];
     forceTerminal?: boolean;
@@ -8767,24 +9710,10 @@ async function failRuntimeMapRowChunks(
       'updates.data_patch',
       input.physicalColumnProjections,
     );
-    // Per-field failed-cell counts for the column summary, computed from the
-    // cell meta patches (a failed row records exactly which cell failed).
-    const failedCellCounts = new Map<string, number>();
-    for (const row of chunk) {
-      for (const [field, meta] of Object.entries(row.cell_meta_patch)) {
-        if (
-          meta &&
-          typeof meta === 'object' &&
-          (meta as { status?: unknown }).status === 'failed'
-        ) {
-          failedCellCounts.set(field, (failedCellCounts.get(field) ?? 0) + 1);
-        }
-      }
-    }
-    const failedCellFields = [...failedCellCounts.keys()];
-    const failedCellTotals = failedCellFields.map(
-      (field) => failedCellCounts.get(field) ?? 0,
-    );
+    // Keep legacy parameter positions stable; deltas now come from applied
+    // physical winners and their previous cells, never submitted aliases.
+    const failedCellFields: string[] = [];
+    const failedCellTotals: number[] = [];
     const matchingUpdatesSql = `WITH mutation_context AS (SELECT $7::text AS play_name, $8::text AS table_namespace, $9::text[] AS failed_fields, $10::int[] AS failed_totals, $12::text AS attempt_owner_run_id, $13::timestamptz AS attempt_expires_at, $14::integer AS attempt_seq), updates AS (
          SELECT key_values._key,
                 input_index_values.input_index,
@@ -8856,6 +9785,7 @@ async function failRuntimeMapRowChunks(
       input.writeVersion,
     ];
     const columnTypes = await RuntimeSheetColumns.prepareWrite(client, {
+      lockMode: input.columnLockMode,
       schema: session.postgres.schema,
       table: session.postgres.sheetTable,
       columns: input.physicalColumnProjections,
@@ -8896,7 +9826,10 @@ async function failRuntimeMapRowChunks(
          FROM matched_updates AS updates, ${sheetTable(session)} AS prev
          WHERE ${writableRowsSql}
            AND prev._key = target._key
-         RETURNING target._key, prev._status AS prev_status
+         RETURNING target._key, prev._status AS prev_status,
+                   prev._cell_meta AS prev_cell_meta,
+                   target._cell_meta AS next_cell_meta,
+                   updates.cell_meta_patch
        ),
        applied_count AS (
          SELECT count(*)::bigint AS c,
@@ -8972,20 +9905,45 @@ async function failRuntimeMapRowChunks(
            _updated_at = now()
          RETURNING 1
        ),
+       cell_status_delta AS (
+         SELECT field_values.field,
+                sum((coalesce(applied_rows.next_cell_meta -> field_values.field ->> 'status', '') = 'failed')::int
+                  - (coalesce(applied_rows.prev_cell_meta -> field_values.field ->> 'status', '') = 'failed')::int)::int AS failed,
+                -- Completed output counts are admitted by the completed-row
+                -- writer. Partial failed rows may carry uncounted completed
+                -- cells; only remove a cell counted on an enriched row.
+                -count(*) FILTER (
+                  WHERE applied_rows.prev_status = 'enriched'
+                    AND coalesce(applied_rows.prev_cell_meta -> field_values.field ->> 'status', '') = 'completed'
+                    AND coalesce(applied_rows.next_cell_meta -> field_values.field ->> 'status', '') <> 'completed'
+                )::int AS completed
+           FROM applied_rows
+           CROSS JOIN LATERAL jsonb_object_keys(
+             CASE WHEN jsonb_typeof(applied_rows.cell_meta_patch) = 'object'
+               THEN applied_rows.cell_meta_patch ELSE '{}'::jsonb END
+           ) AS field_values(field)
+          GROUP BY field_values.field
+       ),
        column_delta AS (
          INSERT INTO ${columnSummaryTable(session)} AS target (
            play_name,
            table_namespace,
            field,
-           failed
+           failed,
+           completed
          )
-         SELECT $7::text, $8::text, field_values.field, count_values.c
-           FROM unnest($9::text[]) WITH ORDINALITY AS field_values(field, ord)
-           JOIN unnest($10::int[]) WITH ORDINALITY AS count_values(c, ord)
-             ON count_values.ord = field_values.ord
-          WHERE EXISTS (SELECT 1 FROM applied_rows)
+         SELECT $7::text, $8::text, field, GREATEST(failed, 0), GREATEST(completed, 0)
+           FROM cell_status_delta
+          WHERE failed <> 0 OR completed <> 0
          ON CONFLICT (play_name, table_namespace, field) DO UPDATE SET
-           failed = GREATEST(target.failed + EXCLUDED.failed, 0),
+           failed = GREATEST(target.failed + (
+             SELECT delta.failed FROM cell_status_delta AS delta
+              WHERE delta.field = EXCLUDED.field
+           ), 0),
+           completed = GREATEST(target.completed + (
+             SELECT delta.completed FROM cell_status_delta AS delta
+              WHERE delta.field = EXCLUDED.field
+           ), 0),
            _updated_at = now()
          RETURNING 1
        )
@@ -9002,6 +9960,40 @@ async function failRuntimeMapRowChunks(
   return { updated, fencedRows };
 }
 
+/** Post only rows already canonicalized by this module's owning operation. */
+async function postPreparedRuntimeMapRows(
+  context: RuntimeApiContext & { playName: string },
+  input: Parameters<typeof completeRuntimeMapRows>[1],
+  submittedKeys: string[],
+): Promise<RuntimeMapRowsWriteResult> {
+  const result = await postRuntimeApi<
+    Partial<RuntimeMapRowsWriteResult> &
+      Pick<RuntimeMapRowsWriteResult, 'updated' | 'fencedKeys'>
+  >(context, {
+    action: 'runtime_sheet_complete_map_rows',
+    input,
+  });
+  const staleKeys =
+    result.staleKeys ?? result.staleDroppedKeys ?? result.fencedKeys;
+  return {
+    ...classifyRuntimeMapRowsWrite({
+      submittedKeys,
+      updated: result.updated,
+      fencedKeys: staleKeys,
+      // A gateway that predates stale reasons omits staleRows; keep it
+      // absent so the caller classifies those keys as unreported.
+      fencedRows: Array.isArray(result.staleRows)
+        ? parseRuntimeMapRowsFencedRows(result.staleRows)
+        : undefined,
+    }),
+    // Preserve the gateway's compatibility classification during rollout.
+    fencedKeys: result.fencedKeys,
+    ...(typeof result.runtimeTestPageTailHoldMs === 'number'
+      ? { runtimeTestPageTailHoldMs: result.runtimeTestPageTailHoldMs }
+      : {}),
+  };
+}
+
 /**
  * Mark map rows terminal in the per-run scoped Postgres sheet table by key.
  * Writes enriched output values into materialized physical columns, flips
@@ -9052,35 +10044,13 @@ export async function completeRuntimeMapRows(
       runId: input.runId,
       outputFields: input.outputFields ?? [],
     });
-    const result = await postRuntimeApi<
-      Partial<RuntimeMapRowsWriteResult> &
-        Pick<RuntimeMapRowsWriteResult, 'updated' | 'fencedKeys'>
-    >(context, {
-      action: 'runtime_sheet_complete_map_rows',
-      input: { ...input, rows },
-    });
-    const submittedKeys = keyedRows
-      .map((row) => row.key)
-      .filter((key): key is string => Boolean(key));
-    const staleKeys =
-      result.staleKeys ?? result.staleDroppedKeys ?? result.fencedKeys;
-    return {
-      ...classifyRuntimeMapRowsWrite({
-        submittedKeys,
-        updated: result.updated,
-        fencedKeys: staleKeys,
-        // A gateway that predates stale reasons omits staleRows; keep it
-        // absent so the caller classifies those keys as unreported.
-        fencedRows: Array.isArray(result.staleRows)
-          ? parseRuntimeMapRowsFencedRows(result.staleRows)
-          : undefined,
-      }),
-      // Preserve the gateway's compatibility classification during rollout.
-      fencedKeys: result.fencedKeys,
-      ...(typeof result.runtimeTestPageTailHoldMs === 'number'
-        ? { runtimeTestPageTailHoldMs: result.runtimeTestPageTailHoldMs }
-        : {}),
-    };
+    return postPreparedRuntimeMapRows(
+      context,
+      { ...input, rows },
+      keyedRows
+        .map((row) => row.key)
+        .filter((key): key is string => Boolean(key)),
+    );
   }
   const sheetContract = augmentSheetContractWithDatasetFields({
     contract: input.sheetContract,
@@ -9097,22 +10067,35 @@ export async function completeRuntimeMapRows(
   let updatedRowCount = 0;
   let fencedRowCount = 0;
   const logCompletion = () => {
-    console.info(
-      '[runtime-sheet-map-completion]',
-      JSON.stringify({
-        event: 'finished',
-        outcome: completionOutcome,
-        inputRows: input.rows.length,
-        uniqueRows: uniqueRowCount,
-        completedRows: completedRowCount,
-        failedRows: failedRowCount,
-        chunks: chunkCount,
-        updatedRows: updatedRowCount,
-        fencedRows: fencedRowCount,
-        ...completionDiagnostics,
-        totalMs: Date.now() - completionStartedAt,
-      }),
-    );
+    const diagnostics: RuntimeSheetMapCompletionDiagnostics = {
+      event: 'finished',
+      outcome: completionOutcome,
+      inputRows: input.rows.length,
+      uniqueRows: uniqueRowCount,
+      completedRows: completedRowCount,
+      failedRows: failedRowCount,
+      chunks: chunkCount,
+      updatedRows: updatedRowCount,
+      fencedRows: fencedRowCount,
+      ...completionDiagnostics,
+      totalMs: Date.now() - completionStartedAt,
+    };
+    try {
+      if (context.onSheetMapCompletion) {
+        // Delivery is observational: neither a synchronous throw nor a rejected
+        // asynchronous sink may replace the write's result or delay its return.
+        void Promise.resolve(context.onSheetMapCompletion(diagnostics)).catch(
+          () => {},
+        );
+      } else {
+        console.info(
+          '[runtime-sheet-map-completion]',
+          JSON.stringify(diagnostics),
+        );
+      }
+    } catch {
+      // Product execution does not depend on operational telemetry delivery.
+    }
   };
   let session: RuntimePostgresSession;
   try {
@@ -9175,11 +10158,20 @@ export async function completeRuntimeMapRows(
     runId: input.runId,
     outputFields: input.outputFields ?? [],
   });
+  const sqlBatchBudget = {
+    maxRows: DIRECT_POSTGRES_BATCH_SIZE,
+    maxBytes: RUNTIME_MAP_SQL_BATCH_INPUT_BYTES,
+  };
   const chunks = chunkValues(completedRows, DIRECT_POSTGRES_BATCH_SIZE);
+  const exactKeyChunks = chunks.map((chunk) =>
+    chunkPreparedRuntimeSheetRows(chunk, sqlBatchBudget),
+  );
   const failedChunks = chunkValues(failedRows, DIRECT_POSTGRES_BATCH_SIZE);
   completedRowCount = completedRows.length;
   failedRowCount = failedRows.length;
-  chunkCount = chunks.length + failedChunks.length;
+  chunkCount =
+    exactKeyChunks.reduce((total, group) => total + group.length, 0) +
+    failedChunks.length;
   const needsTransaction = true;
   const outputFields = [...new Set(input.outputFields ?? [])];
   const attemptId = input.attemptId?.trim() || null;
@@ -9205,15 +10197,18 @@ export async function completeRuntimeMapRows(
       tableNamespace: input.tableNamespace,
       sheetContract,
       transactional: needsTransaction,
+      concurrentColumnPreparation: true,
       statementTimeoutMs: RUNTIME_SHEET_COMPLETION_STATEMENT_TIMEOUT_MS,
       completionDiagnostics,
     },
-    async (client) => {
+    async (client, columnLockMode) => {
       const completed =
         completedRows.length > 0
           ? await (async () => {
               const chunkInput = {
+                columnLockMode,
                 chunks,
+                exactKeyChunks,
                 physicalColumnProjections: projections,
                 runId: input.runId,
                 attemptId,
@@ -9232,16 +10227,19 @@ export async function completeRuntimeMapRows(
                 'mapRowsUpdate',
                 () => completeRuntimeMapRowChunks(client, session, chunkInput),
               );
-              const inserted = await measureRuntimeSheetPhase(
-                completionDiagnostics,
-                'missingRowsInsert',
-                () =>
-                  insertMissingCompletedMapRowChunks(
-                    client,
-                    session,
-                    chunkInput,
-                  ),
-              );
+              const inserted =
+                updated.allExactRowsUpdated === true
+                  ? { inserted: 0 }
+                  : await measureRuntimeSheetPhase(
+                      completionDiagnostics,
+                      'missingRowsInsert',
+                      () =>
+                        insertMissingCompletedMapRowChunks(
+                          client,
+                          session,
+                          chunkInput,
+                        ),
+                    );
               return {
                 updated: updated.updated + inserted.inserted,
                 fencedRows: updated.fencedRows,
@@ -9255,6 +10253,7 @@ export async function completeRuntimeMapRows(
               'failedRowsUpdate',
               () =>
                 failRuntimeMapRowChunks(client, session, {
+                  columnLockMode,
                   chunks: failedChunks,
                   physicalColumnProjections: projections,
                   forceTerminal: input.forceFailedRows === true,
@@ -9278,14 +10277,22 @@ export async function completeRuntimeMapRows(
         updated: completed.updated + failed.updated,
         fencedRows: [...completed.fencedRows, ...failed.fencedRows],
       });
-      if (await runtimeSheetMembershipCaptureAvailable(client, session)) {
-        await captureRuntimeSheetTerminalMembership(client, session, {
-          runId: input.runId,
-          tableNamespace: input.tableNamespace,
-          sheetContract,
-          keys: classified.committedKeys,
-        });
-      }
+      // This phase includes the availability probe and, when available, the
+      // terminal membership capture. It is nested inside queryClientMs.
+      await measureRuntimeSheetPhase(
+        completionDiagnostics,
+        'membershipCapture',
+        async () => {
+          if (await runtimeSheetMembershipCaptureAvailable(client, session)) {
+            await captureRuntimeSheetTerminalMembership(client, session, {
+              runId: input.runId,
+              tableNamespace: input.tableNamespace,
+              sheetContract,
+              keys: classified.committedKeys,
+            });
+          }
+        },
+      );
       return classified;
     },
   )
@@ -9318,7 +10325,15 @@ export function createCompleteRuntimeMapRowsOperation(
       outputFields: input.outputFields ?? [],
     }),
   };
-  return () => completeRuntimeMapRows(context, frozenInput);
+  const submittedKeys = frozenInput.rows
+    .map((row) => row.key)
+    .filter((key): key is string => Boolean(key));
+  // The operation owns this JSON-safe snapshot. Re-preparing it on each
+  // capacity retry repeats full data/meta stringify+parse without changing
+  // its canonical value. Ordinary public calls still prepare above.
+  return frozenInput.rows.length === 0
+    ? () => completeRuntimeMapRows(context, frozenInput)
+    : () => postPreparedRuntimeMapRows(context, frozenInput, submittedKeys);
 }
 
 export type RuntimeSheetDatasetReadInput = {