deepline 0.3.461 → 0.3.463

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/runtime-event-search.ts

@@ -91,7 +91,7 @@ const RUNTIME_EVENT_LOG_POSITION_EXPRESSION = `jsonb_set(
 // Migration readiness tracks this projection body independently of scheduler
 // wire and schema versions. Bump when a changed trigger must be reinstalled.
 export const RUNTIME_EVENT_SEARCH_OUTBOX_PROJECTION_MARKER =
-  'runtime-event-search-direct-receipts-bounded-terminal-log-facts';
+  'runtime-event-search-legacy-position-resolver-pools';
 /** Trusted trigger-authored state; absent on already-projected legacy rows. */
 export const RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD =
   '_runtimeSearchProjectionPending';
@@ -1516,6 +1516,12 @@ export async function hasRuntimeEventReaderGrant(
     );
   }
   const scope = requiredScope(runtimeScope);
+  // Reject explicit role edges in both directions, including NOINHERIT,
+  // without repeatedly traversing every unrelated role's membership graph.
+  // Keep membership-aware checks for the three exact owners: implicit
+  // pg_database_owner membership has no pg_auth_members edge.
+  // User-created namespaces have indexed pg_depend references; enumerate
+  // their relations without scanning every other Preview namespace's catalog.
   const result = await client.query<{ ready: boolean }>(
     `SELECT coalesce(roles.rolcanlogin AND NOT roles.rolsuper AND NOT roles.rolbypassrls
       AND has_schema_privilege(roles.oid, 'runtime_observability', 'USAGE')
@@ -1544,36 +1550,35 @@ export async function hasRuntimeEventReaderGrant(
       AND NOT has_table_privilege(roles.oid, 'runtime_observability.run_log_cursors', 'TRUNCATE')
       AND NOT has_table_privilege(roles.oid, 'runtime_observability.run_log_cursors', 'REFERENCES')
       AND NOT has_table_privilege(roles.oid, 'runtime_observability.run_log_cursors', 'TRIGGER')
-      AND NOT has_schema_privilege(roles.oid, $2, 'USAGE')
-      AND NOT has_schema_privilege(roles.oid, $2, 'CREATE')
+      AND NOT has_schema_privilege(roles.oid, runtime_schema.oid, 'USAGE')
+      AND NOT has_schema_privilege(roles.oid, runtime_schema.oid, 'CREATE')
       AND NOT EXISTS (SELECT 1 FROM pg_auth_members AS membership
-        WHERE pg_has_role(roles.oid, membership.roleid, 'MEMBER'))
-      AND NOT EXISTS (SELECT 1 FROM pg_class AS events
-        JOIN pg_namespace AS event_schema ON event_schema.oid = events.relnamespace
-        WHERE event_schema.nspname = 'runtime_observability'
-          AND events.relname = 'events'
-          AND pg_has_role(roles.oid, events.relowner, 'USAGE'))
-      AND NOT EXISTS (SELECT 1 FROM pg_class AS log_cursors
-        JOIN pg_namespace AS event_schema ON event_schema.oid = log_cursors.relnamespace
-        WHERE event_schema.nspname = 'runtime_observability'
-          AND log_cursors.relname = 'run_log_cursors'
-          AND pg_has_role(roles.oid, log_cursors.relowner, 'USAGE'))
-      AND (SELECT relrowsecurity FROM pg_class
-            WHERE oid = 'runtime_observability.events'::regclass)
-      AND (SELECT relrowsecurity FROM pg_class
-            WHERE oid = 'runtime_observability.run_log_cursors'::regclass)
-      AND NOT EXISTS (SELECT 1 FROM pg_class AS scoped_relation
-        JOIN pg_namespace AS scoped_schema ON scoped_schema.oid = scoped_relation.relnamespace
-        WHERE scoped_schema.nspname = $2
+        WHERE membership.member = roles.oid OR membership.roleid = roles.oid)
+      AND NOT pg_has_role(roles.oid, events.relowner, 'USAGE')
+      AND NOT pg_has_role(roles.oid, log_cursors.relowner, 'USAGE')
+      AND events.relrowsecurity
+      AND log_cursors.relrowsecurity
+      AND NOT EXISTS (SELECT 1 FROM pg_depend AS namespace_dependency
+        JOIN pg_class AS scoped_relation ON scoped_relation.oid = namespace_dependency.objid
+        WHERE namespace_dependency.refclassid = 'pg_namespace'::regclass
+          AND namespace_dependency.refobjid = runtime_schema.oid
+          AND namespace_dependency.classid = 'pg_class'::regclass
+          AND namespace_dependency.objsubid = 0
+          AND namespace_dependency.refobjsubid = 0
+          AND namespace_dependency.deptype = 'n'
+          AND scoped_relation.relnamespace = runtime_schema.oid
           AND scoped_relation.relkind IN ('r', 'p', 'v', 'm', 'f')
           AND (has_table_privilege(roles.oid, scoped_relation.oid, 'SELECT')
             OR has_any_column_privilege(roles.oid, scoped_relation.oid, 'SELECT')))
-      AND NOT pg_has_role(roles.oid,
-        (SELECT receipt_function.proowner FROM pg_proc AS receipt_function
-          WHERE receipt_function.oid = 'runtime_observability.fetch_receipt(text,text,text,uuid)'::regprocedure),
-        'USAGE')
+      AND NOT pg_has_role(roles.oid, receipt_function.proowner, 'USAGE')
       AND has_function_privilege(roles.oid, 'runtime_observability.fetch_receipt(text,text,text,uuid)', 'EXECUTE'), false) AS ready
-      FROM pg_roles AS roles WHERE roles.rolname = $1`,
+      FROM pg_roles AS roles
+      JOIN pg_namespace AS runtime_schema ON runtime_schema.nspname = $2
+                                          AND runtime_schema.oid >= 16384::oid
+      JOIN pg_class AS events ON events.oid = 'runtime_observability.events'::regclass
+      JOIN pg_class AS log_cursors ON log_cursors.oid = 'runtime_observability.run_log_cursors'::regclass
+      JOIN pg_proc AS receipt_function ON receipt_function.oid = 'runtime_observability.fetch_receipt(text,text,text,uuid)'::regprocedure
+      WHERE roles.rolname = $1`,
     [readerRole, scope],
   );
   return result.rows[0]?.ready === true;
@@ -2372,6 +2377,369 @@ export async function attachRuntimeEventSearchTriggers(
       ${schema}.project_origin_log_batch_with_targets(${schema}.outbox,jsonb,text,text,boolean,boolean,timestamptz,jsonb,boolean)
     FROM PUBLIC;
     END; $install_fresh_log_sequences$`);
+  // The positional path is used before origin identities are enabled. Keep
+  // its physical lookup contract local, like fresh sequence assignment: a
+  // generic plan warmed on an empty journal must not scan unrelated runs.
+  // VOLATILE preserves visibility of aliases written earlier in this batch.
+  await client.query(`DO $install_legacy_log_access$ BEGIN
+    CREATE OR REPLACE FUNCTION ${schema}.lookup_legacy_log_identity(probe_org text, probe_id text)
+    RETURNS TABLE(runtime_scope text, org_id text, event_id text, run_id text, kind text, source_digest text, search_doc jsonb)
+    LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = pg_catalog
+      SET enable_seqscan = off SET enable_indexscan = on AS $function$
+      BEGIN RETURN QUERY
+      SELECT candidate.* FROM (
+        SELECT event.runtime_scope, event.org_id, event.event_id, event.run_id,
+               event.kind, event.source_digest, event.search_doc
+          FROM runtime_observability.events AS event
+         WHERE (event.runtime_scope, event.org_id, event.event_id)
+           >= (${quoteLiteral(scope)}, probe_org, probe_id)
+         ORDER BY event.runtime_scope, event.org_id, event.event_id
+         LIMIT 1
+      ) AS candidate
+      WHERE candidate.runtime_scope = ${quoteLiteral(scope)}
+        AND candidate.org_id = probe_org AND candidate.event_id = probe_id;
+      END
+    $function$;
+    REVOKE ALL ON FUNCTION ${schema}.lookup_legacy_log_identity(text,text) FROM PUBLIC;
+    CREATE OR REPLACE FUNCTION ${schema}.update_legacy_log_alias(probe_org text, probe_id text, probe_doc jsonb, probe_run text)
+    RETURNS TABLE(updated_tid tid)
+    LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = pg_catalog
+      SET enable_seqscan = off SET enable_indexscan = on SET enable_tidscan = on AS $function$
+    DECLARE alias_identity record;
+      alias_target NO SCROLL CURSOR FOR
+        WITH alias_candidate AS MATERIALIZED (
+          SELECT event.ctid AS target_tid
+            FROM runtime_observability.events AS event
+           WHERE (event.runtime_scope, event.org_id, event.event_id)
+             >= (${quoteLiteral(scope)}, probe_org, probe_id)
+           ORDER BY event.runtime_scope, event.org_id, event.event_id
+           LIMIT 1
+        )
+        SELECT event.runtime_scope, event.org_id, event.run_id, event.event_id
+          FROM alias_candidate AS candidate
+          JOIN runtime_observability.events AS event ON event.ctid = candidate.target_tid
+         WHERE event.runtime_scope = ${quoteLiteral(scope)} AND event.org_id = probe_org
+           AND event.run_id = probe_run AND event.event_id = probe_id
+         FOR UPDATE OF event;
+    BEGIN
+      -- Resolve and lock one exact identity in the same cursor statement.
+      -- Filtering before FOR UPDATE must never lock a neighboring run on EOF.
+      OPEN alias_target;
+      BEGIN
+        FETCH alias_target INTO alias_identity;
+        IF NOT FOUND THEN
+          RAISE EXCEPTION 'Legacy log alias target changed before update' USING ERRCODE = '40001';
+        END IF;
+        IF alias_identity.runtime_scope IS DISTINCT FROM ${quoteLiteral(scope)}
+          OR alias_identity.org_id IS DISTINCT FROM probe_org
+          OR alias_identity.run_id IS DISTINCT FROM probe_run
+          OR alias_identity.event_id IS DISTINCT FROM probe_id THEN
+          RAISE EXCEPTION 'Legacy log alias target changed before update' USING ERRCODE = '40001';
+        END IF;
+        RETURN QUERY
+        UPDATE runtime_observability.events SET search_doc = probe_doc
+         WHERE CURRENT OF alias_target RETURNING ctid;
+        IF NOT FOUND THEN
+          RAISE EXCEPTION 'Legacy log alias target changed before update' USING ERRCODE = '40001';
+        END IF;
+      EXCEPTION WHEN OTHERS THEN
+        -- The cursor predates this exception block, so it remains open after
+        -- rollback of a failed update. Preserve the original SQL error.
+        CLOSE alias_target;
+        RAISE;
+      END;
+      CLOSE alias_target;
+      END
+    $function$;
+    REVOKE ALL ON FUNCTION ${schema}.update_legacy_log_alias(text,text,jsonb,text) FROM PUBLIC;
+    -- These cursors keep a cached, index-ordered lower-bound plan. Stop at the
+    -- first different complete prefix, retaining all equal-prefix occurrences
+    -- before applying the original sequence and identity ordering.
+    CREATE OR REPLACE FUNCTION ${schema}.lookup_legacy_log_position(probe_org text, probe_run text, probe_channel text, probe_alias jsonb)
+    RETURNS TABLE(event_id text, source_digest text, search_doc jsonb)
+    LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = pg_catalog
+      SET enable_seqscan = off SET enable_indexscan = on AS $function$
+    DECLARE candidate record; active_cursor refcursor;
+      best_id text; best_digest text; best_doc jsonb; best_seq bigint;
+      ${RUNTIME_EVENT_LOG_POSITION_CHANNELS.map(
+        (channel) => `
+      ${channel}_positions NO SCROLL CURSOR FOR
+        SELECT ARRAY[event.runtime_scope, event.org_id, event.run_id] AS key_scope,
+               event.search_doc->'producerAttempt' AS key_attempt,
+               event.search_doc->'logPositions'->'${channel}' AS key_position,
+               event.event_id, event.source_digest, event.search_doc, event.log_seq
+          FROM runtime_observability.events AS event
+         WHERE event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
+           AND event.search_doc ? 'producerAttempt' AND event.search_doc ? 'logPositions'
+           AND (event.search_doc->'logPositions') ? '${channel}'
+           AND ROW(ARRAY[event.runtime_scope, event.org_id, event.run_id],
+                 event.search_doc->'producerAttempt', event.search_doc->'logPositions'->'${channel}')
+             >= ROW(ARRAY[${quoteLiteral(scope)}, probe_org, probe_run],
+                    probe_alias->'producerAttempt', probe_alias->'${channel}')
+           AND ROW(ARRAY[event.runtime_scope, event.org_id, event.run_id],
+                 event.search_doc->'producerAttempt', event.search_doc->'logPositions'->'${channel}')
+             <= ROW(ARRAY[${quoteLiteral(scope)}, probe_org, probe_run],
+                    probe_alias->'producerAttempt', probe_alias->'${channel}')
+         ORDER BY ARRAY[event.runtime_scope, event.org_id, event.run_id],
+                  event.search_doc->'producerAttempt', event.search_doc->'logPositions'->'${channel}';
+      `,
+      ).join('')}
+    BEGIN
+      CASE probe_channel
+        ${RUNTIME_EVENT_LOG_POSITION_CHANNELS.map(
+          (channel) => `
+        WHEN '${channel}' THEN OPEN ${channel}_positions; active_cursor := ${channel}_positions;
+        `,
+        ).join('')}
+        ELSE RAISE EXCEPTION 'Legacy log read channel is invalid';
+      END CASE;
+      BEGIN
+        LOOP
+          FETCH active_cursor INTO candidate;
+          EXIT WHEN NOT FOUND;
+          EXIT WHEN candidate.key_scope IS DISTINCT FROM ARRAY[${quoteLiteral(scope)}, probe_org, probe_run]
+            OR candidate.key_attempt IS DISTINCT FROM probe_alias->'producerAttempt'
+            OR candidate.key_position IS DISTINCT FROM probe_alias->probe_channel;
+          IF best_id IS NULL OR (candidate.log_seq IS NOT NULL AND best_seq IS NULL)
+            OR candidate.log_seq < best_seq
+            OR (candidate.log_seq IS NOT DISTINCT FROM best_seq AND candidate.event_id < best_id) THEN
+            best_id := candidate.event_id; best_digest := candidate.source_digest;
+            best_doc := candidate.search_doc; best_seq := candidate.log_seq;
+          END IF;
+        END LOOP;
+      EXCEPTION WHEN OTHERS THEN
+        CLOSE active_cursor;
+        RAISE;
+      END;
+      CLOSE active_cursor;
+      IF best_id IS NOT NULL THEN RETURN QUERY SELECT best_id, best_digest, best_doc; END IF;
+    END
+    $function$;
+    REVOKE ALL ON FUNCTION ${schema}.lookup_legacy_log_position(text,text,text,jsonb) FROM PUBLIC;
+    -- Resolve direct and aliased positions once per line. This intentionally
+    -- retains the old helper signature above for already-installed callers.
+    CREATE OR REPLACE FUNCTION ${schema}.resolve_legacy_log_position(probe_org text, probe_run text, probe_channel text, probe_alias jsonb, probe_position bigint, probe_worker_key text, probe_ids text[])
+    RETURNS TABLE(event_id text, source_digest text, search_doc jsonb, worker_key_reserved boolean)
+    LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = pg_catalog
+      SET enable_seqscan = off SET enable_indexscan = on AS $function$
+    DECLARE candidate record; active_cursor refcursor;
+      best_id text; best_digest text; best_doc jsonb; best_seq bigint; worker_reserved boolean;
+      ${RUNTIME_EVENT_LOG_POSITION_CHANNELS.map(
+        (channel) => `
+      ${channel}_positions NO SCROLL CURSOR FOR
+        SELECT ARRAY[event.runtime_scope, event.org_id, event.run_id] AS key_scope,
+               event.search_doc->'producerAttempt' AS key_attempt,
+               event.search_doc->'logPositions'->'${channel}' AS key_position,
+               event.event_id, event.source_digest, event.search_doc, event.log_seq
+          FROM runtime_observability.events AS event
+         WHERE event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
+           AND event.search_doc ? 'producerAttempt' AND event.search_doc ? 'logPositions'
+           AND (event.search_doc->'logPositions') ? '${channel}'
+           AND ROW(ARRAY[event.runtime_scope, event.org_id, event.run_id],
+                 event.search_doc->'producerAttempt', event.search_doc->'logPositions'->'${channel}')
+             >= ROW(ARRAY[${quoteLiteral(scope)}, probe_org, probe_run],
+                    probe_alias->'producerAttempt', probe_alias->'${channel}')
+           AND ROW(ARRAY[event.runtime_scope, event.org_id, event.run_id],
+                 event.search_doc->'producerAttempt', event.search_doc->'logPositions'->'${channel}')
+             <= ROW(ARRAY[${quoteLiteral(scope)}, probe_org, probe_run],
+                    probe_alias->'producerAttempt', probe_alias->'${channel}')
+         ORDER BY ARRAY[event.runtime_scope, event.org_id, event.run_id],
+                  event.search_doc->'producerAttempt', event.search_doc->'logPositions'->'${channel}';
+      `,
+      ).join('')}
+    BEGIN
+      IF probe_channel NOT IN ('worker','replay','envelope') OR probe_channel IS NULL THEN
+        RAISE EXCEPTION 'Legacy log read channel is invalid';
+      END IF;
+      -- All historical primary-key candidates share this one planner/security
+      -- boundary. Keep the old complete-key seek and exact equality check;
+      -- never prefetch absence across lines or change positional precedence.
+      WITH identities AS MATERIALIZED (
+        SELECT identity.*
+          FROM unnest(probe_ids) AS keys(event_id)
+          CROSS JOIN LATERAL (
+            SELECT identity_candidate.* FROM (
+              SELECT event.runtime_scope, event.org_id, event.event_id, event.run_id,
+                     event.kind, event.source_digest, event.search_doc
+                FROM runtime_observability.events AS event
+               WHERE (event.runtime_scope, event.org_id, event.event_id)
+                 >= (${quoteLiteral(scope)}, probe_org, keys.event_id)
+               ORDER BY event.runtime_scope, event.org_id, event.event_id
+               LIMIT 1
+            ) AS identity_candidate
+            WHERE identity_candidate.runtime_scope = ${quoteLiteral(scope)}
+              AND identity_candidate.org_id = probe_org AND identity_candidate.event_id = keys.event_id
+          ) AS identity
+      )
+      SELECT matched.event_id, matched.source_digest, matched.search_doc,
+             coalesce(reserved.worker_reserved, false)
+        INTO best_id, best_digest, best_doc, worker_reserved
+        FROM (
+          SELECT bool_or(event.event_id = probe_worker_key
+            AND event.search_doc->>'source' = 'coordinator'
+            AND NOT (coalesce(event.search_doc->'logPositions', '{}'::jsonb) ? 'worker')) AS worker_reserved
+          FROM identities AS event
+        ) AS reserved
+        LEFT JOIN LATERAL (
+          SELECT event.event_id, event.source_digest, event.search_doc
+          FROM identities AS event
+          WHERE event.runtime_scope = ${quoteLiteral(scope)} AND event.org_id = probe_org
+            AND event.run_id = probe_run AND event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
+            AND (
+              event.search_doc->'logPositions'->>probe_channel = probe_position::text
+              OR (NOT (event.search_doc ? 'logPositions')
+                AND event.event_id = probe_worker_key
+                AND (CASE WHEN event.search_doc->>'source' = 'coordinator'
+                  THEN 'replay' ELSE 'worker' END) = probe_channel)
+            )
+          ORDER BY event.event_id LIMIT 1
+        ) AS matched ON true;
+      IF best_id IS NOT NULL THEN
+        RETURN QUERY SELECT best_id, best_digest, best_doc, worker_reserved;
+        RETURN;
+      END IF;
+      CASE probe_channel
+        ${RUNTIME_EVENT_LOG_POSITION_CHANNELS.map(
+          (channel) => `
+        WHEN '${channel}' THEN OPEN ${channel}_positions; active_cursor := ${channel}_positions;
+        `,
+        ).join('')}
+        ELSE RAISE EXCEPTION 'Legacy log read channel is invalid';
+      END CASE;
+      BEGIN
+        LOOP
+          FETCH active_cursor INTO candidate;
+          EXIT WHEN NOT FOUND;
+          EXIT WHEN candidate.key_scope IS DISTINCT FROM ARRAY[${quoteLiteral(scope)}, probe_org, probe_run]
+            OR candidate.key_attempt IS DISTINCT FROM probe_alias->'producerAttempt'
+            OR candidate.key_position IS DISTINCT FROM probe_alias->probe_channel;
+          IF best_id IS NULL OR (candidate.log_seq IS NOT NULL AND best_seq IS NULL)
+            OR candidate.log_seq < best_seq
+            OR (candidate.log_seq IS NOT DISTINCT FROM best_seq AND candidate.event_id < best_id) THEN
+            best_id := candidate.event_id; best_digest := candidate.source_digest;
+            best_doc := candidate.search_doc; best_seq := candidate.log_seq;
+          END IF;
+        END LOOP;
+      EXCEPTION WHEN OTHERS THEN
+        CLOSE active_cursor;
+        RAISE;
+      END;
+      CLOSE active_cursor;
+      RETURN QUERY SELECT best_id, best_digest, best_doc, worker_reserved;
+    END
+    $function$;
+    REVOKE ALL ON FUNCTION ${schema}.resolve_legacy_log_position(text,text,text,jsonb,bigint,text,text[]) FROM PUBLIC;
+    CREATE OR REPLACE FUNCTION ${schema}.lookup_legacy_log_occurrence(probe_org text, probe_run text, probe_attempt text, probe_digest text, probe_channel text)
+    RETURNS TABLE(event_id text, search_doc jsonb)
+    LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = pg_catalog
+      SET enable_seqscan = off SET enable_indexscan = on AS $function$
+    DECLARE candidate record; best_id text; best_doc jsonb; best_seq bigint;
+      digest_occurrences NO SCROLL CURSOR FOR
+        SELECT event.runtime_scope, event.org_id, event.run_id,
+               event.search_doc->>'producerAttempt' AS key_attempt,
+               event.source_digest, event.event_id, event.search_doc, event.log_seq
+          FROM runtime_observability.events AS event
+         WHERE event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
+           AND event.source_digest IS NOT NULL AND event.search_doc ? 'producerAttempt'
+           AND event.search_doc ? 'logContentDigest'
+           AND ROW(event.runtime_scope, event.org_id, event.run_id,
+                   event.search_doc->>'producerAttempt', event.source_digest)
+             >= ROW(${quoteLiteral(scope)}, probe_org, probe_run, probe_attempt, probe_digest)
+           AND ROW(event.runtime_scope, event.org_id, event.run_id,
+                   event.search_doc->>'producerAttempt', event.source_digest)
+             <= ROW(${quoteLiteral(scope)}, probe_org, probe_run, probe_attempt, probe_digest)
+         ORDER BY event.runtime_scope, event.org_id, event.run_id,
+                  event.search_doc->>'producerAttempt', event.source_digest;
+    BEGIN
+      IF probe_channel NOT IN ('worker','replay','envelope') OR probe_channel IS NULL THEN
+        RAISE EXCEPTION 'Legacy log read channel is invalid';
+      END IF;
+      OPEN digest_occurrences;
+      BEGIN
+        LOOP
+          FETCH digest_occurrences INTO candidate;
+          EXIT WHEN NOT FOUND;
+          EXIT WHEN candidate.runtime_scope IS DISTINCT FROM ${quoteLiteral(scope)}
+            OR candidate.org_id IS DISTINCT FROM probe_org OR candidate.run_id IS DISTINCT FROM probe_run
+            OR candidate.key_attempt IS DISTINCT FROM probe_attempt OR candidate.source_digest IS DISTINCT FROM probe_digest;
+          IF NOT (candidate.search_doc ? 'entryId')
+            AND candidate.search_doc @> jsonb_build_object('logContentDigest', probe_digest)
+            AND NOT (coalesce(candidate.search_doc->'logPositions', '{}'::jsonb) ? probe_channel)
+            AND (candidate.search_doc ? 'logPositions' OR probe_channel <>
+              CASE WHEN candidate.search_doc->>'source' = 'coordinator' THEN 'replay' ELSE 'worker' END)
+            AND (best_id IS NULL OR (candidate.log_seq IS NOT NULL AND best_seq IS NULL)
+              OR candidate.log_seq < best_seq
+              OR (candidate.log_seq IS NOT DISTINCT FROM best_seq AND candidate.event_id < best_id)) THEN
+            best_id := candidate.event_id; best_doc := candidate.search_doc; best_seq := candidate.log_seq;
+          END IF;
+        END LOOP;
+      EXCEPTION WHEN OTHERS THEN
+        CLOSE digest_occurrences;
+        RAISE;
+      END;
+      CLOSE digest_occurrences;
+      IF best_id IS NOT NULL THEN RETURN QUERY SELECT best_id, best_doc; END IF;
+    END
+    $function$;
+    REVOKE ALL ON FUNCTION ${schema}.lookup_legacy_log_occurrence(text,text,text,text,text) FROM PUBLIC;
+    -- A request can consume at most probe_count distinct occurrences. Keep
+    -- only that necessary rank, not the run's whole equal-digest history. The
+    -- inner order preserves the existing complete-prefix access contract;
+    -- the outer top-N sort holds only compact identity/sequence metadata.
+    CREATE OR REPLACE FUNCTION ${schema}.lookup_legacy_log_occurrence_pool(
+      probe_org text, probe_run text, probe_attempt text, probe_digest text,
+      probe_channel text, probe_count bigint)
+    RETURNS TABLE(event_id text, cacheable boolean)
+    LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = pg_catalog
+      SET enable_seqscan = off SET enable_indexscan = on AS $function$
+    DECLARE candidate record; emitted boolean := false;
+    BEGIN
+      IF probe_channel NOT IN ('worker','replay','envelope') OR probe_channel IS NULL
+        OR probe_count IS NULL OR probe_count < 1 THEN
+        RAISE EXCEPTION 'Legacy log occurrence pool requires a channel and positive request rank';
+      END IF;
+      FOR candidate IN
+        SELECT prefix.event_id, prefix.log_seq,
+          (prefix.null_entry OR prefix.null_channel) IS TRUE AS unsafe
+        FROM (
+          SELECT event.event_id, event.log_seq, event.search_doc ? 'entryId' AS has_entry_id,
+            event.search_doc->'entryId' = 'null'::jsonb AS null_entry,
+            event.search_doc @> jsonb_build_object('logContentDigest', probe_digest) AS same_digest,
+            coalesce(event.search_doc->'logPositions', '{}'::jsonb) ? probe_channel AS has_channel,
+            event.search_doc->'logPositions'->probe_channel = 'null'::jsonb AS null_channel,
+            event.search_doc ? 'logPositions' OR probe_channel <>
+              CASE WHEN event.search_doc->>'source' = 'coordinator' THEN 'replay' ELSE 'worker' END AS cross_channel
+          FROM runtime_observability.events AS event
+          WHERE event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
+            AND event.source_digest IS NOT NULL AND event.search_doc ? 'producerAttempt'
+            AND event.search_doc ? 'logContentDigest'
+            AND ROW(event.runtime_scope, event.org_id, event.run_id,
+                    event.search_doc->>'producerAttempt', event.source_digest)
+              >= ROW(${quoteLiteral(scope)}, probe_org, probe_run, probe_attempt, probe_digest)
+            AND ROW(event.runtime_scope, event.org_id, event.run_id,
+                    event.search_doc->>'producerAttempt', event.source_digest)
+              <= ROW(${quoteLiteral(scope)}, probe_org, probe_run, probe_attempt, probe_digest)
+          ORDER BY event.runtime_scope, event.org_id, event.run_id,
+                   event.search_doc->>'producerAttempt', event.source_digest
+          OFFSET 0
+        ) AS prefix
+        WHERE (NOT prefix.has_entry_id AND prefix.same_digest
+          AND NOT prefix.has_channel AND prefix.cross_channel)
+          OR prefix.null_entry OR prefix.null_channel
+        ORDER BY unsafe DESC, prefix.log_seq NULLS LAST, prefix.event_id
+        LIMIT probe_count
+      LOOP
+        -- TTL strips null object members without the log mutex. Such legacy
+        -- metadata can become newly eligible, so retain its scalar semantics.
+        IF candidate.unsafe THEN RETURN QUERY SELECT NULL::text, false; RETURN; END IF;
+        emitted := true;
+        RETURN QUERY SELECT candidate.event_id::text, true;
+      END LOOP;
+      IF NOT emitted THEN RETURN QUERY SELECT NULL::text, true; END IF;
+    END
+    $function$;
+    REVOKE ALL ON FUNCTION ${schema}.lookup_legacy_log_occurrence_pool(text,text,text,text,text,bigint) FROM PUBLIC;
+    END; $install_legacy_log_access$`);
   const acquireLogCursorSql = `
       IF NOT cursor_locked THEN
       -- One allocation owner supplies final sequences at INSERT time. The
@@ -2398,7 +2766,10 @@ export async function attachRuntimeEventSearchTriggers(
             doc jsonb; line_doc jsonb; line_context jsonb; line_metadata jsonb; line_at timestamptz;
             eid text; existing_digest text; digest text; assigned_seq bigint; terminal_progress_identity boolean;
             log_channel text; log_position bigint; matched_event_id text; matched_doc jsonb;
-            legacy_position_prefix text; position_event_ids text[];
+            legacy_position_prefix text; position_event_ids text[]; worker_key_reserved boolean;
+            occurrence_pool_digests text[]; occurrence_pool_ids text[]; occurrence_pool_cacheable boolean[];
+            occurrence_pool_heads integer[]; occurrence_pool_loaded boolean;
+            occurrence_low integer; occurrence_high integer; occurrence_mid integer; occurrence_group integer; occurrence_head integer;
             log_alias jsonb; position_alias jsonb; envelope_attempt jsonb;
             cursor_created boolean := false; cursor_locked boolean := false; line_count bigint; fresh_event_ids text[] := ARRAY[]::text[];
             fresh_tids tid[] := ARRAY[]::tid[]; inserted_tid tid;
@@ -2537,20 +2908,24 @@ export async function attachRuntimeEventSearchTriggers(
         -- unmarked rows otherwise scans the whole attempt for every new line.
         IF EXISTS (SELECT 1 FROM jsonb_array_elements(event_batch) AS entry
           WHERE entry->>'type' = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended} AND (NOT (entry ? 'lineIds') OR EXISTS (SELECT 1 FROM jsonb_array_elements(CASE WHEN jsonb_typeof(entry->'lineIds') = 'array' THEN entry->'lineIds' ELSE '[]'::jsonb END) id WHERE id = 'null'::jsonb))) THEN
+          -- Replan this once-per-batch legacy normalization with its real run.
+          -- A retained empty-table plan otherwise rereads every run's history.
+          EXECUTE $legacy_normalize$
           UPDATE runtime_observability.events AS event SET search_doc = event.search_doc ||
             jsonb_build_object('logContentDigest', event.source_digest) ||
             CASE WHEN NOT (event.search_doc ? 'logPositions')
-              AND left(event.event_id, length('log:' || observation.run_id || ':' || (event.search_doc->>'producerAttempt') || ':')) =
-                'log:' || observation.run_id || ':' || (event.search_doc->>'producerAttempt') || ':'
-              AND substring(event.event_id FROM length('log:' || observation.run_id || ':' || (event.search_doc->>'producerAttempt') || ':') + 1) ~ '^[0-9]{1,12}$'
+              AND left(event.event_id, length('log:' || $2 || ':' || (event.search_doc->>'producerAttempt') || ':')) =
+                'log:' || $2 || ':' || (event.search_doc->>'producerAttempt') || ':'
+              AND substring(event.event_id FROM length('log:' || $2 || ':' || (event.search_doc->>'producerAttempt') || ':') + 1) ~ '^[0-9]{1,12}$'
               THEN jsonb_build_object('logPositions', jsonb_build_object(
                 CASE WHEN event.search_doc->>'source' = 'coordinator' THEN 'replay' ELSE 'worker' END,
-                substring(event.event_id FROM length('log:' || observation.run_id || ':' || (event.search_doc->>'producerAttempt') || ':') + 1)::bigint))
+                substring(event.event_id FROM length('log:' || $2 || ':' || (event.search_doc->>'producerAttempt') || ':') + 1)::bigint))
               ELSE '{}'::jsonb END
-           WHERE event.runtime_scope = ${quoteLiteral(scope)} AND event.org_id = run_org
-             AND event.run_id = observation.run_id AND event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
+           WHERE event.runtime_scope = ${quoteLiteral(scope)} AND event.org_id = $1
+             AND event.run_id = $2 AND event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
              AND event.source_digest IS NOT NULL AND NOT (event.search_doc ? 'logContentDigest') AND NOT (event.search_doc ? 'entryId')
-             AND (event.search_doc->>'producerAttempt') ~ '^[1-9][0-9]{0,5}$';
+             AND (event.search_doc->>'producerAttempt') ~ '^[1-9][0-9]{0,5}$'
+          $legacy_normalize$ USING run_org, observation.run_id;
         END IF;
         FOR item, ordinal IN SELECT value, ordinality FROM jsonb_array_elements(event_batch) WITH ORDINALITY LOOP
           IF jsonb_typeof(item) IS DISTINCT FROM 'object'
@@ -2613,6 +2988,7 @@ export async function attachRuntimeEventSearchTriggers(
             END IF;
           END IF;
           IF kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended} THEN
+            occurrence_pool_loaded := false;
             FOR line, line_ordinal IN SELECT value, ordinality FROM jsonb_array_elements(item->'lines') WITH ORDINALITY LOOP
               IF jsonb_typeof(line) IS DISTINCT FROM 'string' THEN
                 RAISE EXCEPTION 'Search projection requires log line strings';
@@ -2700,17 +3076,6 @@ export async function attachRuntimeEventSearchTriggers(
                 eid := CASE WHEN log_channel = 'worker' THEN legacy_position_prefix
                   ELSE 'log-' || log_channel || ':' || observation.run_id || ':' || (item->>'producerAttempt') || ':' END
                   || log_position::text;
-                -- Older coordinator replays used the worker-shaped primary
-                -- key. Do not overwrite it when a delayed worker owns a
-                -- different line at that number; aliases remain authoritative.
-                IF log_channel = 'worker' AND EXISTS (
-                  SELECT 1 FROM runtime_observability.events
-                   WHERE runtime_scope = ${quoteLiteral(scope)} AND org_id = run_org AND event_id = eid
-                     AND search_doc->>'source' = 'coordinator'
-                     AND NOT (coalesce(search_doc->'logPositions', '{}'::jsonb) ? 'worker')
-                ) THEN
-                  eid := 'log-worker:' || observation.run_id || ':' || (item->>'producerAttempt') || ':' || log_position::text;
-                END IF;
                 log_alias := jsonb_build_object('producerAttempt', (item->>'producerAttempt')::integer,
                   'logPositions', jsonb_build_object(log_channel, log_position));
                 position_alias := jsonb_build_object(
@@ -2723,53 +3088,18 @@ export async function attachRuntimeEventSearchTriggers(
                   'log-replay:' || observation.run_id || ':' || (item->>'producerAttempt') || ':' || log_position::text,
                   'log-envelope:' || observation.run_id || ':' || (item->>'producerAttempt') || ':' || log_position::text
                 ];
-                -- Positional identities have a bounded set of historical IDs.
-                -- Probe those primary keys directly; scanning every event in
-                -- the run for JSON containment made one lookup grow with run age.
-                SELECT event.event_id, event.source_digest, event.search_doc
-                  INTO matched_event_id, existing_digest, matched_doc
-                  FROM runtime_observability.events AS event
-                 WHERE event.runtime_scope = ${quoteLiteral(scope)} AND event.org_id = run_org
-                   AND event.run_id = observation.run_id AND event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
-                   AND event.event_id = ANY(position_event_ids)
-                   AND (
-                     event.search_doc->'logPositions'->>log_channel = log_position::text
-                     OR (NOT (event.search_doc ? 'logPositions')
-                       AND event.event_id = legacy_position_prefix || log_position::text
-                       AND (CASE WHEN event.search_doc->>'source' = 'coordinator'
-                            THEN 'replay' ELSE 'worker' END) = log_channel)
-                   )
-                 ORDER BY event.event_id
-                 LIMIT 1;
-                IF matched_event_id IS NULL THEN
-                  -- Pack scope, organization and run into one indexed key.
-                  -- The materialization keeps generic plans from choosing a
-                  -- run-history scan based on the outer identity checks.
-                  WITH position_matches AS MATERIALIZED (
-                    ${RUNTIME_EVENT_LOG_POSITION_CHANNELS.map(
-                      (channel) => `
-                    SELECT event.event_id, event.source_digest, event.search_doc,
-                           event.log_seq, event.runtime_scope, event.org_id, event.run_id
-                      FROM runtime_observability.events AS event
-                     WHERE log_channel = '${channel}'
-                       AND ARRAY[event.runtime_scope, event.org_id, event.run_id]
-                         = ARRAY[${quoteLiteral(scope)}, run_org, observation.run_id]
-                       AND event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
-                       AND event.search_doc ? 'producerAttempt'
-                       AND event.search_doc ? 'logPositions'
-                       AND (event.search_doc->'logPositions') ? '${channel}'
-                       AND event.search_doc->'producerAttempt' = position_alias->'producerAttempt'
-                       AND event.search_doc->'logPositions'->'${channel}' = position_alias->'${channel}'
-                    `,
-                    ).join(' UNION ALL ')}
-                  )
-                  SELECT event.event_id, event.source_digest, event.search_doc
-                    INTO matched_event_id, existing_digest, matched_doc
-                    FROM position_matches AS event
-                   WHERE event.runtime_scope = ${quoteLiteral(scope)} AND event.org_id = run_org
-                     AND event.run_id = observation.run_id
-                   ORDER BY event.log_seq NULLS LAST, event.event_id
-                   LIMIT 1;
+                -- Resolve every direct key and the fallback alias in one
+                -- private scope, preserving the same live per-line decisions.
+                SELECT event.event_id, event.source_digest, event.search_doc,
+                       event.worker_key_reserved
+                  INTO matched_event_id, existing_digest, matched_doc, worker_key_reserved
+                  FROM ${schema}.resolve_legacy_log_position(run_org, observation.run_id,
+                    log_channel, position_alias, log_position,
+                    legacy_position_prefix || log_position::text, position_event_ids) AS event;
+                -- Older coordinator replays used the worker-shaped primary
+                -- key. Keep that conflict decision even when no position matches.
+                IF log_channel = 'worker' AND worker_key_reserved THEN
+                  eid := 'log-worker:' || observation.run_id || ':' || (item->>'producerAttempt') || ':' || log_position::text;
                 END IF;
                 IF matched_event_id IS NOT NULL THEN
                   IF existing_digest IS DISTINCT FROM digest THEN
@@ -2777,30 +3107,84 @@ export async function attachRuntimeEventSearchTriggers(
                   END IF;
                   CONTINUE;
                 END IF;
-                -- Bind one equal occurrence from another channel. Aliases
-                -- are checked first, so retries cannot consume another copy.
-                -- Full digests include context; repeated text is not a set.
-                SELECT event.event_id, event.search_doc
-                  INTO matched_event_id, matched_doc
-                  FROM runtime_observability.events AS event
-                 WHERE event.runtime_scope = ${quoteLiteral(scope)} AND event.org_id = run_org
-                   AND event.run_id = observation.run_id AND event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
-                   AND event.source_digest IS NOT NULL
-                   AND event.search_doc ? 'producerAttempt'
-                   AND event.search_doc ? 'logContentDigest' AND NOT (event.search_doc ? 'entryId')
-                   AND event.search_doc->>'producerAttempt' = ((item->>'producerAttempt')::integer)::text
-                   AND event.source_digest = digest
-                   AND event.search_doc @> jsonb_build_object('logContentDigest', digest)
-                   AND NOT (coalesce(event.search_doc->'logPositions', '{}'::jsonb) ? log_channel)
-                   AND (event.search_doc ? 'logPositions' OR log_channel <>
-                     CASE WHEN event.search_doc->>'source' = 'coordinator' THEN 'replay' ELSE 'worker' END)
-                 ORDER BY event.log_seq NULLS LAST, event.event_id LIMIT 1;
+                -- Positional decisions stay in original line order. Only the
+                -- occurrence candidates are shared within this one item: an
+                -- inserted line already has this channel (or entryId), and an
+                -- alias can only remove eligibility, never add another row.
+                IF NOT occurrence_pool_loaded THEN
+                  EXECUTE $legacy_occurrence_pools$
+                  WITH requested AS MATERIALIZED (
+                    SELECT CASE WHEN NULLIF($2->((entry.ordinality-1)::integer), 'null'::jsonb) IS NULL
+                      THEN encode(sha256(convert_to(entry.value #>> '{}','UTF8')),'hex')
+                      ELSE encode(sha256(convert_to(jsonb_build_array(entry.value #>> '{}',
+                        $2->((entry.ordinality-1)::integer))::text,'UTF8')),'hex') END AS content_digest
+                    FROM jsonb_array_elements($1) WITH ORDINALITY AS entry(value, ordinality)
+                    WHERE jsonb_typeof(entry.value) = 'string'
+                      AND NULLIF($3->((entry.ordinality-1)::integer), 'null'::jsonb) IS NULL
+                  ), groups AS (
+                    SELECT content_digest, count(*) AS request_count FROM requested GROUP BY content_digest
+                  )
+                  SELECT array_agg(groups.content_digest ORDER BY groups.content_digest COLLATE "C", pool.ordinality),
+                    array_agg(pool.event_id ORDER BY groups.content_digest COLLATE "C", pool.ordinality),
+                    array_agg(pool.cacheable ORDER BY groups.content_digest COLLATE "C", pool.ordinality)
+                  FROM groups CROSS JOIN LATERAL
+                    ${schema}.lookup_legacy_log_occurrence_pool($4,$5,$6,groups.content_digest,$7,groups.request_count)
+                    WITH ORDINALITY AS pool(event_id,cacheable,ordinality)
+                  $legacy_occurrence_pools$
+                  INTO occurrence_pool_digests, occurrence_pool_ids, occurrence_pool_cacheable
+                  USING item->'lines', item->'lineContexts', item->'lineIds', run_org, observation.run_id,
+                    ((item->>'producerAttempt')::integer)::text, log_channel;
+                  occurrence_pool_heads := array_fill(NULL::integer, ARRAY[cardinality(occurrence_pool_digests)]);
+                  occurrence_pool_loaded := true;
+                END IF;
+                -- Binary search the flat digest groups; native array element
+                -- assignments retain compact mutable heads without copying a
+                -- growing JSON metadata map for every incoming line.
+                occurrence_low := 1; occurrence_high := cardinality(occurrence_pool_digests);
+                WHILE occurrence_low < occurrence_high LOOP
+                  occurrence_mid := (occurrence_low + occurrence_high) / 2;
+                  IF occurrence_pool_digests[occurrence_mid] COLLATE "C" < digest COLLATE "C" THEN
+                    occurrence_low := occurrence_mid + 1;
+                  ELSE occurrence_high := occurrence_mid; END IF;
+                END LOOP;
+                occurrence_group := occurrence_low;
+                IF occurrence_pool_digests[occurrence_group] IS DISTINCT FROM digest THEN
+                  RAISE EXCEPTION 'Legacy log occurrence pool omitted an incoming digest';
+                END IF;
+                occurrence_head := coalesce(occurrence_pool_heads[occurrence_group], occurrence_group);
+                matched_event_id := NULL; matched_doc := NULL;
+                IF occurrence_pool_cacheable[occurrence_group]
+                  AND occurrence_pool_digests[occurrence_head] IS NOT DISTINCT FROM digest
+                  AND occurrence_pool_ids[occurrence_head] IS NOT NULL THEN
+                  SELECT event.event_id, event.search_doc INTO matched_event_id, matched_doc
+                    FROM ${schema}.lookup_legacy_log_identity(run_org, occurrence_pool_ids[occurrence_head]) AS event
+                   WHERE event.run_id = observation.run_id AND event.kind = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
+                     AND event.source_digest = digest AND event.search_doc->>'producerAttempt' = ((item->>'producerAttempt')::integer)::text
+                     AND NOT (event.search_doc ? 'entryId')
+                     AND event.search_doc @> jsonb_build_object('logContentDigest', digest)
+                     AND NOT (coalesce(event.search_doc->'logPositions', '{}'::jsonb) ? log_channel)
+                     AND (event.search_doc ? 'logPositions' OR log_channel <>
+                       CASE WHEN event.search_doc->>'source' = 'coordinator' THEN 'replay' ELSE 'worker' END);
+                  IF matched_event_id IS NULL THEN
+                    -- A concurrent TTL scrub may remove a null alias. Once
+                    -- the snapshot changes, scalar lookup sees the full tail.
+                    occurrence_pool_cacheable[occurrence_group] := false;
+                  END IF;
+                END IF;
+                IF NOT occurrence_pool_cacheable[occurrence_group] THEN
+                  SELECT event.event_id, event.search_doc INTO matched_event_id, matched_doc
+                    FROM ${schema}.lookup_legacy_log_occurrence(run_org, observation.run_id,
+                      ((item->>'producerAttempt')::integer)::text, digest, log_channel) AS event;
+                END IF;
                 IF matched_event_id IS NOT NULL THEN
-                  UPDATE runtime_observability.events SET search_doc = matched_doc ||
-                    jsonb_build_object('logContentDigest', digest, 'logPositions',
-                      coalesce(matched_doc->'logPositions', '{}'::jsonb) || jsonb_build_object(log_channel, log_position))
-                   WHERE runtime_scope = ${quoteLiteral(scope)} AND org_id = run_org AND event_id = matched_event_id
-                   RETURNING ctid INTO inserted_tid;
+                  matched_doc := matched_doc || jsonb_build_object('logContentDigest', digest, 'logPositions',
+                    coalesce(matched_doc->'logPositions', '{}'::jsonb) || jsonb_build_object(log_channel, log_position));
+                  SELECT updated.updated_tid INTO inserted_tid
+                  FROM ${schema}.update_legacy_log_alias(run_org, matched_event_id, matched_doc, observation.run_id) AS updated;
+                  IF occurrence_pool_cacheable[occurrence_group]
+                    AND (coalesce(matched_doc->'logPositions', '{}'::jsonb) ? log_channel) THEN
+                    occurrence_pool_heads[occurrence_group] := occurrence_head + 1;
+                  END IF;
                   -- Aliasing a fresh line moves its tuple within this transaction.
                   fresh_target_index := array_position(fresh_event_ids, matched_event_id);
                   IF fresh_target_index IS NOT NULL THEN