- metadata route: drop the \`as unknown as Parameters<...>\` cast on
  the parent/root operations path. Widen \`routeOperationsToRun\`'s env
  parameter to \`AuthenticatedEnvironment\` so the service's typed
  signature carries through; the caller always has the full env in
  scope.
- replay route: validate the buffered fallback against a Zod
  \`BufferedReplayInputSchema\` covering the fields
  \`ReplayTaskRunService.call\` actually reads (id, friendlyId,
  runtimeEnvironmentId, taskIdentifier, payload, payloadType, queue,
  isTest, traceId, spanId, engine, runTags + nullable
  concurrencyKey/workerQueue/machinePreset/realtimeStreamsVersion).
  Schema-fail logs the issue list and 404s rather than passing a
  half-shaped object into the service.
- resetIdempotencyKey: distinguish "PG-empty + buffer-cleared-nothing"
  (genuine 404) from "PG-empty + buffer-unreachable" (partial outage —
  503 with retry hint). The previous behaviour silently returned 404
  on outage, hiding the partial failure and leaving a buffered key
  effectively un-reset. New regression test covers all four branches
  (PG-hit + buffer-throws, PG-empty + buffer-hit, PG-empty +
  buffer-clean-miss, PG-empty + buffer-outage, mollifier-disabled).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- metadata route was routing rootOperations to bufferedEntry.parentTaskRunId
  with a comment claiming PG's nil-coalesce defaults to parent. PG actually
  defaults to taskRun.id (self), so a buffered grandchild metadata.root.set()
  was silently mutating the child's metadata instead of the root's.
  SyntheticRun already carries rootTaskRunFriendlyId from the snapshot —
  use it, falling back to the run itself (matching PG) when absent.

- reschedule route's PG path delegates to RescheduleTaskRunService which
  enforces `status !== "DELAYED"` and 422s otherwise. The buffer path had
  no equivalent guard, so a customer could inject delayUntil into the
  snapshot of an undelayed buffered run and the drainer would materialise
  it with an unintended delay. Added a pre-fetch through
  findRunByIdWithMollifierFallback and 422 when the buffered run has no
  delayUntil. SyntheticRun doesn't carry a "DELAYED" status enum
  (only QUEUED|FAILED|CANCELED) so the gate reads the snapshot's
  delayUntil field directly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The wait-and-bounce loop for mutations racing a mid-drain run polled the
PG primary on a fixed 20ms cadence with no jitter — up to ~100 reads per
request, synchronized across concurrent waiters, piling load onto the
writer exactly when mollifier is engaged to shed it.

The drainer writes the canonical PG row BEFORE it acks (sets
`materialised`) or fails (deletes the entry), so the buffer entry's own
state is an authoritative, already-in-Redis signal for "is the row in PG
yet?". Watch that (cheap Redis getEntry) instead, and touch the primary
exactly once — for the actual mutation — only after it resolves. Poll
gaps now use jittered exponential backoff (20ms → 250ms cap).

Drops the per-poll PG timeout race (DEFAULT_PG_TIMEOUT_MS / pgTimeoutMs /
findRunInPgWithTimeout), unneeded now that PG is read once rather than in
a tight loop.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Remove plan-tracking shorthand (Q2/Q3 design, _plans/) from mutations-layer mollifier comments; reword to plain English. Comment-only; no behaviour change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

… metadata fallback errors

The tags API skipped MAX_TAGS_PER_RUN enforcement on the buffered path,
letting a buffered run exceed the cap the trigger validator applies at
creation. Enforce it atomically in the mutateSnapshot Lua: append_tags
now accepts an optional maxTags and returns "limit_exceeded" (writing
nothing) when the deduped count would overflow. mutateWithFallback gains
a symmetric rejectedResponse builder + a "rejected" outcome; the tags
route returns 422, matching the PG path.

Also stop silently swallowing PG failures in the metadata route's
parent/root op fan-out: warn (with targetRunId + error) before the
best-effort buffer fallback so a genuine PG outage is observable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…oute comments

Two Phase labels survived the earlier sweep — "Phase A6" in
api.v1.runs.\$runId.metadata.ts (the GET-loader-added comment, mirroring
the same pattern in api.v1.runs.\$runParam.attempts.ts on reads), and
"Phase B4" in api.v1.runs.\$runParam.replay.ts (referring to where
SyntheticRun was extended). Rewritten to plain prose; comment-only, no
behaviour change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…n comments

Two stragglers from the prior sweep: a "(Q5)" tag in the
resetIdempotencyKey buffer-side comment, and a "Phase F" reference in
the applyMetadataMutation test's regression note. Comment-only; no
behavioural change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…llowups

Four Devin-flagged issues on PR #3756:

* Cross-env auth gate on the buffer mutation path (#2). mutateWithFallback
  and applyMetadataMutationToBufferedRun now verify entry.envId/orgId match
  the caller's environmentId/organizationId before any buffer write, so a
  token authed in env A can't mutate a buffered run in env B by guessing
  the friendlyId. Mismatches return not_found (no existence leak), mirroring
  the env scoping the PG path already enforces via Prisma filters.

* Unhandled error in routeOperationsToRun (#0). The parent/root op fan-out
  is documented as best-effort but a Redis throw used to 500 the request
  even though the primary mutation already landed. The buffer fallback now
  runs through tryCatch and warns instead of throwing.

* Silent no-op when parent metadata routes to an internal id (#1). The
  PG service accepts internal ids, but the buffer is keyed by friendlyId;
  passing an internal cuid to the fallback was a silent miss. Made it an
  intentional skip (with a comment explaining why a buffered child's parent
  is always materialised already).

* BufferedReplayInputSchema strips seedMetadata (#3). Replays from a
  buffered source were silently losing initial metadata vs PG-sourced
  replays. Added seedMetadata + seedMetadataType to the schema.

Tests added: cross-env + cross-org gate cases on both helpers.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ionsToRun

Follow-up to the Devin review on PR #3756. updateMetadataService.call
resolves with undefined (not a throw) when the target run isn't in PG,
so the previous `if (!error) return;` treated PG-miss as success and
the buffer fallback below was unreachable. Capture the result too and
fall through only on PG-applied; PG-miss now proceeds to the buffer
fallback alongside the PG-threw path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>