deepline 0.3.288 → 0.3.290

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -1,3 +1,9 @@
+import {
+  parseRunLedgerDispatchLaunch,
+  runLedgerDispatchLaunchSql,
+  type RunLedgerDispatchLaunch,
+} from './run-ledger-dispatch-authority';
+import { normalizeRunLogIds } from '../run-log-buffer';
 import {
   retainedPlayPipelineFields,
   hydrateRetainedPlayPipelines,
@@ -28,6 +34,8 @@ import type {
 import { PROD_DEFAULT_RUNTIME_SCHEDULER_SCHEMA } from '../runtime-scheduler-topology';
 import {
   RUNTIME_EVENT_CANONICAL_RETENTION_INDEX_READY_MARKER,
+  RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD,
+  RUNTIME_EVENT_SEARCH_ONLY_FIELD,
   RUNTIME_EVENT_SEARCH_OUTBOX_PROJECTION_MARKER,
 } from './runtime-event-search';
 import type { PlayRunnerRuntimeResource } from '../runner-backends/types';
@@ -105,7 +113,6 @@ import {
   RUN_SCHEDULER_OUTBOX_START_EVENT_TYPES,
   RUN_SCHEDULER_OUTBOX_EVENT_TYPE,
   RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL,
-  RUN_SCHEDULER_OUTBOX_PREFIX_STOP_EVENT_TYPES,
   RUN_SCHEDULER_OUTBOX_TERMINAL_EVENT_TYPES,
 } from '../run-event-catalog';
 import { stableStringify } from '../../plays/row-identity';
@@ -336,7 +343,10 @@ const POSTGRES_SCHEDULER_SCHEMA_INIT_STATEMENT_TIMEOUT_MS = 60_000;
 // recovery, which scans only active runs for each release lane.
 // v57 refreshes log-position lookups after the operator concurrently prepares
 // channel-specific indexes; outgoing readers retain the existing GIN index.
-export const POSTGRES_SCHEDULER_SCHEMA_VERSION = 57;
+// v58 installs deferred outbox readers while retaining synchronous writers
+// until the separately operated, reader-first cutover.
+// v59 adds origin identity bulk projection and independent durable search progress.
+export const POSTGRES_SCHEDULER_SCHEMA_VERSION = 59;
 const POSTGRES_SCHEDULER_SCHEMA_MIGRATIONS_TABLE =
   'scheduler_schema_migrations';
 export const POSTGRES_SCHEDULER_OPEN_RECOVERY_INDEX =
@@ -1928,6 +1938,24 @@ export async function hasCurrentPostgresSchedulerSchemaShape(
             AND index_row.indrelid = to_regclass($3)
             AND index_row.indisready AND index_row.indisvalid
         )
+        AND EXISTS (
+          SELECT 1 FROM pg_index AS index_row
+          JOIN pg_class AS index_class ON index_class.oid = index_row.indexrelid
+          JOIN pg_namespace AS index_namespace ON index_namespace.oid = index_class.relnamespace
+          WHERE index_namespace.nspname = $1
+            AND index_class.relname = 'runtime_scheduler_outbox_lifecycle_pending_order_idx'
+            AND index_row.indrelid = to_regclass($3)
+            AND index_row.indisready AND index_row.indisvalid
+        )
+        AND EXISTS (
+          SELECT 1 FROM pg_index AS index_row
+          JOIN pg_class AS index_class ON index_class.oid = index_row.indexrelid
+          JOIN pg_namespace AS index_namespace ON index_namespace.oid = index_class.relnamespace
+          WHERE index_namespace.nspname = $1
+            AND index_class.relname = 'runtime_scheduler_outbox_search_pending_order_idx'
+            AND index_row.indrelid = to_regclass($3)
+            AND index_row.indisready AND index_row.indisvalid
+        )
         AND EXISTS (
           SELECT 1 FROM pg_index AS index_row
           JOIN pg_class AS index_class ON index_class.oid = index_row.indexrelid
@@ -2461,6 +2489,7 @@ export async function ensurePostgresSchedulerLaunchAdmissionFunctions(
         jsonb_set(
           launch_json - ARRAY[
             'launchIdentityDigest',
+            'runtimeLogIdentity',
             'executorToken',
             'inputFileId',
             'preloadedDbSessionUnwrapKey',
@@ -3944,6 +3973,26 @@ export async function ensurePostgresSchedulerSchema(
           )
           WHERE delivered_at IS NULL
       `);
+      await client.query(`
+        CREATE INDEX IF NOT EXISTS runtime_scheduler_outbox_lifecycle_pending_order_idx
+          ON ${tableName('outbox', options)} (
+            run_id,
+            (CASE event_type WHEN ${RUN_EVENT_KIND_SQL_LITERAL.runCreated} THEN 0 WHEN ${RUN_EVENT_KIND_SQL_LITERAL.runStarted} THEN 1 ELSE 2 END),
+            created_at,
+            event_id
+          )
+          WHERE delivered_at IS NULL AND ${searchLaneSql('outbox')} = false
+      `);
+      await client.query(`
+        CREATE INDEX IF NOT EXISTS runtime_scheduler_outbox_search_pending_order_idx
+          ON ${tableName('outbox', options)} (
+            run_id,
+            (CASE event_type WHEN ${RUN_EVENT_KIND_SQL_LITERAL.runCreated} THEN 0 WHEN ${RUN_EVENT_KIND_SQL_LITERAL.runStarted} THEN 1 ELSE 2 END),
+            created_at,
+            event_id
+          )
+          WHERE delivered_at IS NULL AND ${searchLaneSql('outbox')} = true
+      `);
       await client.query(`
         CREATE INDEX IF NOT EXISTS runtime_scheduler_outbox_lease_health_idx
           ON ${tableName('outbox', options)}
@@ -4094,6 +4143,22 @@ const POSTGRES_SCHEDULER_RUNTIME_ADMIN_INDEXES = [
       created_at, event_id)
       WHERE delivered_at IS NULL`,
   },
+  {
+    name: 'runtime_scheduler_outbox_lifecycle_pending_order_idx',
+    table: 'outbox',
+    definition: `(run_id,
+      (CASE event_type WHEN ${RUN_EVENT_KIND_SQL_LITERAL.runCreated} THEN 0 WHEN ${RUN_EVENT_KIND_SQL_LITERAL.runStarted} THEN 1 ELSE 2 END),
+      created_at, event_id)
+      WHERE delivered_at IS NULL AND ${searchLaneSql('outbox')} = false`,
+  },
+  {
+    name: 'runtime_scheduler_outbox_search_pending_order_idx',
+    table: 'outbox',
+    definition: `(run_id,
+      (CASE event_type WHEN ${RUN_EVENT_KIND_SQL_LITERAL.runCreated} THEN 0 WHEN ${RUN_EVENT_KIND_SQL_LITERAL.runStarted} THEN 1 ELSE 2 END),
+      created_at, event_id)
+      WHERE delivered_at IS NULL AND ${searchLaneSql('outbox')} = true`,
+  },
   {
     name: 'runtime_scheduler_outbox_lease_health_idx',
     table: 'outbox',
@@ -10318,8 +10383,8 @@ export async function recordPostgresSchedulerRunnerTerminal(
   const recorded = await client.query<{ run_id: string }>(
     `
       WITH accepted AS MATERIALIZED (
-        -- Match direct completion's Run -> attempt lock order. The log
-        -- acceptance trigger also locks the Run for sequence assignment.
+        -- Record the authoritative terminal boundary before accepting the
+        -- attempt payload; deferred log indexing owns no Run row lock.
         SELECT clock_timestamp() AS accepted_at
           FROM ${tableName('runs', options)}
          WHERE run_id = $1
@@ -10758,6 +10823,7 @@ export async function directCompletePostgresSchedulerRunnerTerminal(
             'producerAttempt', $2::integer,
             'terminalLogLines', $7::jsonb,
             'terminalLogContexts', $17::jsonb,
+            'terminalLogIds', $19::jsonb->'terminalLogIds',
             'terminalProgressEvents', coalesce((
               SELECT accepted.runner_log_payload_json->'terminalProgressEvents'
               FROM completed_attempt AS accepted
@@ -13134,6 +13200,7 @@ export async function completePostgresSchedulerAttempt(
     runtimeTiming?: PlayRunnerRuntimeTiming | null;
     terminalLogLines?: readonly string[] | null;
     terminalLogContexts?: readonly (PlayLogContext | null)[] | null;
+    terminalLogIds?: readonly (string | null)[] | null;
     terminalWorkCounterSegment?: PlayRunLedgerTerminalWorkCounterSegment;
   },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
@@ -13151,10 +13218,15 @@ export async function completePostgresSchedulerAttempt(
       'Terminal log contexts must align with terminal log lines.',
     );
   }
+  const terminalLogIds = normalizeRunLogIds(
+    input.terminalLogIds,
+    input.terminalLogLines ?? [],
+  );
   const terminalLogEntries = (input.terminalLogLines ?? [])
     .map((line, index) => ({
       line: line.trim(),
       context: input.terminalLogContexts?.[index] ?? null,
+      entryId: terminalLogIds?.[index] ?? null,
     }))
     .filter((entry) => entry.line.length > 0)
     .slice(-LOG_TAIL_LIMIT);
@@ -13340,6 +13412,7 @@ export async function completePostgresSchedulerAttempt(
             'producerAttempt', $2::integer,
             'terminalLogLines', $8::jsonb,
             'terminalLogContexts', $11::jsonb,
+            'terminalLogIds', $13::jsonb,
             'resultSummary', $10::jsonb,
             'terminalWorkCounterSegment', $12::jsonb
           ),
@@ -13365,6 +13438,11 @@ export async function completePostgresSchedulerAttempt(
       stringifyPostgresJson(resultSummary),
       JSON.stringify(terminalLogContexts),
       stringifyPostgresJson(input.terminalWorkCounterSegment ?? null),
+      stringifyPostgresJson(
+        terminalLogIds
+          ? terminalLogEntries.map((entry) => entry.entryId)
+          : null,
+      ),
     ],
   );
   if (completed.rows.length === 0) {
@@ -13383,6 +13461,7 @@ export async function failPostgresSchedulerAttempt(
     result?: unknown;
     terminalLogLines?: readonly string[] | null;
     terminalLogContexts?: readonly (PlayLogContext | null)[] | null;
+    terminalLogIds?: readonly (string | null)[] | null;
     /** Refuse to overwrite an authoritative detached runner terminal that won
      * after claim. Resumable `suspended` receipts may be superseded by the
      * hard ceiling in the same fenced statement. */
@@ -13429,10 +13508,15 @@ export async function failPostgresSchedulerAttempt(
       'Terminal log contexts must align with terminal log lines.',
     );
   }
+  const terminalLogIds = normalizeRunLogIds(
+    input.terminalLogIds,
+    input.terminalLogLines ?? [],
+  );
   const terminalLogEntries = (input.terminalLogLines ?? [])
     .map((line, index) => ({
       line: line.trim(),
       context: input.terminalLogContexts?.[index] ?? null,
+      entryId: terminalLogIds?.[index] ?? null,
     }))
     .filter((entry) => entry.line.length > 0)
     .slice(-LOG_TAIL_LIMIT);
@@ -13678,6 +13762,7 @@ export async function failPostgresSchedulerAttempt(
             'producerAttempt', $2::integer,
             'terminalLogLines', $12::jsonb,
             'terminalLogContexts', $14::jsonb,
+            'terminalLogIds', $17::jsonb,
             'resultSummary', $13::jsonb,
             'terminalWorkCounterSegment', $15::jsonb
           ) || CASE
@@ -13711,6 +13796,11 @@ export async function failPostgresSchedulerAttempt(
       JSON.stringify(terminalLogContexts),
       stringifyPostgresJson(terminalWorkCounterSegment ?? null),
       stringifyPostgresJson(input.terminalProgressEvents ?? []),
+      stringifyPostgresJson(
+        terminalLogIds
+          ? terminalLogEntries.map((entry) => entry.entryId)
+          : null,
+      ),
     ],
   );
   return failed.rows.length > 0;
@@ -14413,6 +14503,7 @@ function runnerTerminalLogPayload(input: {
     producerAttempt: input.attempt,
     terminalLogLines: projection.lines,
     terminalLogContexts: projection.lineContexts,
+    ...(projection.lineIds ? { terminalLogIds: projection.lineIds } : {}),
     terminalProgressEvents: input.terminalProgressEvents ?? [],
     // Older runner envelopes conveyed these diagnostics only in tagged log
     // text. Preserve their small structured facts before removing that text.
@@ -14433,7 +14524,11 @@ function runnerTerminalLogPayload(input: {
 function terminalLogProjectionForOutbox(
   runnerResult: unknown,
   mode: PostgresSchedulerTerminalLogOutbox | undefined,
-): { lines: string[]; lineContexts: Array<PlayLogContext | null> } {
+): {
+  lines: string[];
+  lineContexts: Array<PlayLogContext | null>;
+  lineIds?: Array<string | null>;
+} {
   if (
     mode !== 'ctx_log_tail' ||
     !runnerResult ||
@@ -14444,6 +14539,7 @@ function terminalLogProjectionForOutbox(
   const result = runnerResult as {
     logs?: unknown;
     logContexts?: unknown;
+    logIds?: unknown;
   };
   const logs = result.logs;
   if (!Array.isArray(logs)) {
@@ -14459,6 +14555,7 @@ function terminalLogProjectionForOutbox(
   const logContexts = Array.isArray(result.logContexts)
     ? result.logContexts
     : undefined;
+  const logIds = normalizeRunLogIds(result.logIds, logs);
   const entries = logs
     .map((line, index) => {
       if (typeof line !== 'string') return null;
@@ -14475,16 +14572,23 @@ function terminalLogProjectionForOutbox(
       return {
         line: line.trim(),
         context: normalizePlayLogContext(logContexts?.[index]),
+        entryId: logIds?.[index] ?? null,
       };
     })
     .filter(
-      (entry): entry is { line: string; context: PlayLogContext | null } =>
-        entry !== null,
+      (
+        entry,
+      ): entry is {
+        line: string;
+        context: PlayLogContext | null;
+        entryId: string | null;
+      } => entry !== null,
     )
     .slice(-LOG_TAIL_LIMIT);
   return {
     lines: entries.map((entry) => entry.line),
     lineContexts: entries.map((entry) => entry.context),
+    ...(logIds ? { lineIds: entries.map((entry) => entry.entryId) } : {}),
   };
 }
 
@@ -14733,6 +14837,7 @@ export async function executePostgresSchedulerClaim(
         runtimeTiming: extractRunnerRuntimeTiming(output),
         terminalLogLines: terminalLogProjection.lines,
         terminalLogContexts: terminalLogProjection.lineContexts,
+        terminalLogIds: terminalLogProjection.lineIds,
         terminalWorkCounterSegment: terminalWorkCounterSegmentFromRunnerResult(
           output,
           claim.attempt,
@@ -14794,6 +14899,7 @@ export async function executePostgresSchedulerClaim(
         result: terminalFailureResult,
         terminalLogLines: terminalLogProjection.lines,
         terminalLogContexts: terminalLogProjection.lineContexts,
+        terminalLogIds: terminalLogProjection.lineIds,
         sandboxCrashDiagnostic: options.sandboxCrashDiagnostic,
         ...(options.preserveRunnerTerminal
           ? { preserveRunnerTerminal: true }
@@ -14987,6 +15093,9 @@ export function buildPostgresSchedulerRunnerContext(
   const rootRunId = launch.rootRunId?.trim() || launch.runId;
   return {
     executorToken: launch.executorToken,
+    ...(launch.runtimeLogIdentity === 'origin'
+      ? { runtimeLogIdentity: 'origin' as const }
+      : {}),
     baseUrl: runtimeApiBaseUrlFromLaunch(launch),
     executionGatewayBaseUrl,
     receiptGatewayBaseUrl,
@@ -17388,6 +17497,12 @@ async function appendRunLedgerOutboxFact(
     WITH admitted AS MATERIALIZED (
       SELECT run_id FROM ${tableName('runs', options)}
       WHERE run_id = $1 AND org_id = $2
+      -- Evaluate ingress time only after the projector/lifecycle fence. An
+      -- insert waiting behind a frozen receipt must become its successor,
+      -- never a late predecessor that changes the attempted receipt.
+      -- NO KEY UPDATE still permits legacy inserts' foreign-key KEY SHARE
+      -- while they finish under the event-search advisory mutex.
+      FOR NO KEY UPDATE
     ), recorded AS (
       INSERT INTO ${tableName('outbox', options)}
         (event_id, run_id, event_type, payload_json, created_at)
@@ -17413,23 +17528,43 @@ export { RunLedgerProjectionLeaseLostError } from '../run-ledger-projection-cont
 /** Extend only our still-live lease before another bounded transport piece. */
 export async function renewPostgresRunLedgerDelivery(
   client: PostgresSchedulerQueryClient,
-  input: { eventIds: string[]; leaseOwner: string; leaseSeconds: number },
+  input: {
+    eventIds: string[];
+    leaseOwner: string;
+    leaseSeconds: number;
+    /** Freeze an ingress receipt before any HTTP attempt, including singletons. */
+    freezeReceipt?: boolean;
+  },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<void> {
-  const result = await client.query<{ event_id: string }>(
-    `
+  const renew = (freezeReceipt: boolean) =>
+    client.query<{ event_id: string }>(
+      `
     UPDATE ${tableName('outbox', options)}
     SET lease_expires_at = now() + make_interval(secs => $3::integer)
+        ${freezeReceipt ? ', delivery_batch_started_at = coalesce(delivery_batch_started_at, statement_timestamp())' : ''}
     WHERE event_id = ANY($1::text[]) AND lease_owner = $2
       AND delivered_at IS NULL AND failed_at IS NULL AND lease_expires_at > now()
     RETURNING event_id
   `,
-    [
-      input.eventIds,
-      input.leaseOwner,
-      Math.max(5, Math.min(300, input.leaseSeconds)),
-    ],
-  );
+      [
+        input.eventIds,
+        input.leaseOwner,
+        Math.max(5, Math.min(300, input.leaseSeconds)),
+      ],
+    );
+  let result;
+  try {
+    result = await renew(
+      input.freezeReceipt === true &&
+        supportsOutboxDeliveryBatchMarker(options),
+    );
+  } catch (error) {
+    if (!input.freezeReceipt || !isMissingOutboxDeliveryBatchMarker(error))
+      throw error;
+    markOutboxDeliveryBatchMarkerUnavailable(options);
+    result = await renew(false);
+  }
   if (result.rows.length !== input.eventIds.length)
     throw new RunLedgerProjectionLeaseLostError('delivery_lease_not_current');
 }
@@ -17457,6 +17592,7 @@ export async function assertPostgresRunLedgerDelivery(
   const result = await client.query<{
     delivery_key: string;
     event_type: string;
+    delivery_batch_started_at: string | null;
     lease_owner: string | null;
     lease_live: boolean;
     due: boolean;
@@ -17467,6 +17603,8 @@ export async function assertPostgresRunLedgerDelivery(
     `
     SELECT outbox.delivery_key,
            outbox.event_type,
+           -- Row JSON keeps this optional on historical scheduler schemas.
+           to_jsonb(outbox)->>'delivery_batch_started_at' AS delivery_batch_started_at,
            outbox.lease_owner,
            outbox.lease_expires_at > now() AS lease_live,
            coalesce(outbox.next_attempt_at, outbox.created_at) <= now() AS due,
@@ -17476,6 +17614,7 @@ export async function assertPostgresRunLedgerDelivery(
     FROM ${tableName('outbox', options)} AS outbox
     JOIN ${tableName('runs', options)} AS runs ON runs.run_id = outbox.run_id
     WHERE outbox.run_id = $1 AND runs.org_id = $2
+      AND NOT ${searchLaneSql('outbox')}
       AND outbox.delivered_at IS NULL
     ORDER BY ${runLedgerOrderSql('outbox')}
     -- Later producer facts cannot belong to this receipt. Do not hydrate their
@@ -17497,9 +17636,12 @@ export async function assertPostgresRunLedgerDelivery(
   // Cancellation may own several pending facts at once. Validate the exact
   // contiguous, due prefix named by the receipt instead of all rows sharing
   // that cancellation lease.
+  const ingressReceiptStarted =
+    rows[0]?.event_type === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents &&
+    rows[0]?.delivery_batch_started_at != null;
   const prefix: typeof rows = [];
   let prefixStopReason: RunLedgerProjectionLeaseLostReason | null = null;
-  for (const row of rows) {
+  for (const [index, row] of rows.entries()) {
     if (row.lease_owner !== leaseOwner) {
       prefixStopReason = 'prefix_lease_owner_mismatch';
       break;
@@ -17516,11 +17658,6 @@ export async function assertPostgresRunLedgerDelivery(
       prefixStopReason = 'predecessor_failed';
       break;
     }
-    if (
-      prefix.length > 0 &&
-      row.event_type === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents
-    )
-      break;
     prefix.push(row);
 
     const first = prefix[0]!;
@@ -17567,10 +17704,17 @@ export async function assertPostgresRunLedgerDelivery(
           runId: input.runId,
           deliveryKey: first.delivery_key,
         });
+    // A receipt already attempted as a compound prefix cannot be split by
+    // an older competing projector after lease expiry. Reject with the normal
+    // retryable lease-lost response until a capable writer reclaims it whole.
+    const atStartedPrefixEnd =
+      !ingressReceiptStarted ||
+      rows[index + 1]?.delivery_batch_started_at == null;
     if (
-      input.idempotencyKey === expectedKey ||
-      input.idempotencyKey === batchKey ||
-      legacySingletonKey
+      atStartedPrefixEnd &&
+      (input.idempotencyKey === expectedKey ||
+        input.idempotencyKey === batchKey ||
+        legacySingletonKey)
     ) {
       if (input.projectedEvents === undefined) return;
       const prefixEvents: PlayRunLedgerIngressEvent[] = [];
@@ -17612,11 +17756,18 @@ export async function assertPostgresRunLedgerDelivery(
 
     if (
       prefix.length === 1 &&
-      RUN_SCHEDULER_OUTBOX_PREFIX_STOP_EVENT_TYPES.includes(first.event_type)
+      RUN_SCHEDULER_OUTBOX_START_EVENT_TYPES.includes(first.event_type)
     ) {
       break;
     }
-    if (terminal || prefix.length >= RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS) {
+    // A frozen ingress receipt can include late runner logs after terminal.
+    // Prove its complete immutable boundary, including transport chunks after
+    // terminal, rather than splitting a receipt that has already been attempted.
+    if (
+      (terminal && !ingressReceiptStarted) ||
+      (ingressReceiptStarted && atStartedPrefixEnd) ||
+      prefix.length >= RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS
+    ) {
       break;
     }
   }
@@ -17631,7 +17782,11 @@ function runLedgerPrecedesSql(
   successor: string,
   inclusive = false,
 ): string {
-  return `${runLedgerPositionSql(predecessor)} ${inclusive ? '<=' : '<'} ${runLedgerPositionSql(successor)}`;
+  return `(${searchLaneSql(predecessor)} = ${searchLaneSql(successor)} AND ${runLedgerPositionSql(predecessor)} ${inclusive ? '<=' : '<'} ${runLedgerPositionSql(successor)})`;
+}
+
+function searchLaneSql(alias: string): string {
+  return `coalesce(${alias}.payload_json->'${RUNTIME_EVENT_SEARCH_ONLY_FIELD}' = 'true'::jsonb, false)`;
 }
 
 function runLedgerPositionSql(alias: string): string {
@@ -17658,6 +17813,32 @@ function runLedgerTerminalPendingSql(
   )`;
 }
 
+function runLedgerWaitingRunsSql(
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+  runIdParameter?: string,
+): string {
+  return `SELECT DISTINCT waiting_event.run_id
+    FROM ${tableName('outbox', options)} AS waiting_event
+    WHERE waiting_event.event_type = ${RUN_EVENT_KIND_SQL_LITERAL.runWaiting}
+      -- Detached runner parks are transport-only and project no public wait.
+      AND waiting_event.payload_json->>'kind' IS DISTINCT FROM 'detached_runner'
+      AND waiting_event.delivered_at IS NULL
+      AND waiting_event.failed_at IS NULL
+      AND coalesce(waiting_event.next_attempt_at, waiting_event.created_at) <= now()
+      ${runIdParameter ? `AND (${runIdParameter}::text IS NULL OR waiting_event.run_id = ${runIdParameter}::text)` : ''}`;
+}
+
+function runLedgerWaitingPendingSql(alias: string): string {
+  return `(${alias}.run_id IN (SELECT run_id FROM waiting_runs))`;
+}
+
+function runLedgerUrgentLifecyclePendingSql(
+  alias: string,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): string {
+  return `(${runLedgerTerminalPendingSql(alias, options)} OR ${runLedgerWaitingPendingSql(alias)})`;
+}
+
 /**
  * Claim a causal prefix, preserving the v33 adapter while the additive batch
  * marker is absent. An enclosing transaction uses a savepoint so the missing
@@ -17670,6 +17851,12 @@ export async function readPendingPostgresSchedulerOutboxEvents(
     runId?: string | null;
     leaseOwner?: string | null;
     leaseSeconds?: number;
+    /** Independent raw search work uses the same outbox leases and controls. */
+    searchOnly?: boolean;
+    /** Advertised by the launch-pinned receipt verifier, never inferred locally. */
+    allowIngressPrefix?: boolean;
+    /** Extend this still-owned head atomically under the run cancellation fence. */
+    extendOwnedHead?: string;
     /** The dispatcher owns a short, exclusive claim transaction. */
     inTransaction?: boolean;
   } = {},
@@ -17682,8 +17869,16 @@ export async function readPendingPostgresSchedulerOutboxEvents(
   const runId = input.runId?.trim() || null;
   const leaseOwner = input.leaseOwner?.trim() || null;
   const leaseSeconds = Math.max(5, Math.min(300, input.leaseSeconds ?? 30));
-  const claim = async (supportsTerminalBatchMarker: boolean) =>
-    await client.query<{
+  const claim = async (supportsTerminalBatchMarker: boolean) => {
+    const urgentLifecyclePendingSql = (alias: string) =>
+      input.searchOnly === true
+        ? runLedgerTerminalPendingSql(alias, options)
+        : runLedgerUrgentLifecyclePendingSql(alias, options);
+    const ingressPrefixSql =
+      supportsTerminalBatchMarker && input.allowIngressPrefix === true
+        ? `(head.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents} AND ${urgentLifecyclePendingSql('head')})`
+        : 'false';
+    return await client.query<{
       event_id: string;
       run_id: string;
       event_type: string;
@@ -17692,10 +17887,33 @@ export async function readPendingPostgresSchedulerOutboxEvents(
       delivery_key: string | null;
     }>(
       `
-      WITH head AS MATERIALIZED (
-        SELECT candidate.event_id, candidate.run_id, candidate.event_type
+      WITH ${
+        input.searchOnly === true
+          ? ''
+          : `waiting_runs AS MATERIALIZED (
+        ${runLedgerWaitingRunsSql(options, '$2')}
+      ), `
+      }${
+        input.extendOwnedHead
+          ? `owned_run AS MATERIALIZED (
+        SELECT run_id FROM ${tableName('runs', options)}
+        WHERE run_id = $2
+        FOR UPDATE SKIP LOCKED
+      ),`
+          : ''
+      } head AS MATERIALIZED (
+        SELECT candidate.event_id, candidate.run_id, candidate.event_type,
+               ${supportsTerminalBatchMarker ? 'candidate.delivery_batch_started_at' : 'NULL::timestamptz'} AS delivery_batch_started_at
         FROM ${tableName('outbox', options)} AS candidate
+        ${input.extendOwnedHead ? 'JOIN owned_run ON owned_run.run_id = candidate.run_id' : ''}
         WHERE candidate.delivered_at IS NULL
+          AND ${searchLaneSql('candidate')} = ${input.searchOnly === true ? 'true' : 'false'}
+          ${
+            input.extendOwnedHead
+              ? `AND candidate.event_id = $5
+          AND candidate.lease_owner = $3 AND candidate.lease_expires_at > now()`
+              : ''
+          }
           AND candidate.failed_at IS NULL
           AND coalesce(candidate.next_attempt_at, candidate.created_at) <= now()
           AND ($2::text IS NULL OR candidate.run_id = $2)
@@ -17711,6 +17929,7 @@ export async function readPendingPostgresSchedulerOutboxEvents(
           AND NOT EXISTS (
             SELECT 1 FROM ${tableName('outbox', options)} AS active
             WHERE active.run_id = candidate.run_id
+              AND ${searchLaneSql('active')} = ${searchLaneSql('candidate')}
               AND active.delivered_at IS NULL
               AND active.lease_owner IS NOT NULL
               AND active.lease_expires_at > now()
@@ -17738,7 +17957,8 @@ export async function readPendingPostgresSchedulerOutboxEvents(
           CASE
             WHEN candidate.event_type = ${RUN_EVENT_KIND_SQL_LITERAL.runCreated} THEN 0
             WHEN ${runLedgerTerminalPendingSql('candidate', options)} THEN 1
-            ELSE 2
+            ${input.searchOnly === true ? '' : `WHEN ${runLedgerWaitingPendingSql('candidate')} THEN 2`}
+            ELSE 3
           END,
           coalesce(candidate.next_attempt_at, candidate.created_at),
           candidate.created_at,
@@ -17750,16 +17970,25 @@ export async function readPendingPostgresSchedulerOutboxEvents(
         FROM ${tableName('outbox', options)} AS outbox
         JOIN head ON head.run_id = outbox.run_id
         WHERE outbox.delivered_at IS NULL
+          AND ${searchLaneSql('outbox')} = ${input.searchOnly === true ? 'true' : 'false'}
           AND outbox.failed_at IS NULL
           -- Admission is causally first and must be projected alone. A later
           -- start/terminal append may not leapfrog a delayed queued row.
           AND (
             head.event_type NOT IN (${RUN_EVENT_KIND_SQL_LITERAL.runCreated}, ${RUN_EVENT_KIND_SQL_LITERAL.runStarted}, ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents})
             OR outbox.event_id = head.event_id
+            OR (head.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents}
+                AND ${ingressPrefixSql})
           )
-          -- An ingress row already contains a producer's bounded batch. Keep
-          -- its receipt stable independently of the recovery caller's limit.
-          AND (outbox.event_type <> ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents} OR outbox.event_id = head.event_id)
+          -- Only a receiver with the exact-prefix verifier may combine ingress
+          -- facts while draining a pending terminal. Old launch origins and
+          -- schemas retain each producer's existing singleton receipt.
+          AND (outbox.event_type <> ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents}
+               OR outbox.event_id = head.event_id
+               OR ${ingressPrefixSql})
+          -- Once any ingress prefix was attempted, its receipt is immutable,
+          -- including singleton appends whose HTTP/ACK outcome was ambiguous.
+          AND (${supportsTerminalBatchMarker && input.allowIngressPrefix === true ? 'head.delivery_batch_started_at IS NULL OR outbox.delivery_batch_started_at IS NOT NULL' : 'true'})
           AND coalesce(outbox.next_attempt_at, outbox.created_at) <= now()
           AND (
             $3::text IS NULL
@@ -17802,7 +18031,9 @@ export async function readPendingPostgresSchedulerOutboxEvents(
               AND predecessor.delivered_at IS NULL
               AND ${runLedgerPrecedesSql('predecessor', 'outbox')}
               AND (
-                predecessor.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents}
+                (predecessor.event_type = ${RUN_SCHEDULER_OUTBOX_EVENT_TYPE_SQL_LITERAL.runEvents}
+                 AND NOT (${ingressPrefixSql}))
+                OR (${supportsTerminalBatchMarker && input.allowIngressPrefix === true ? 'head.delivery_batch_started_at IS NOT NULL AND predecessor.delivery_batch_started_at IS NULL' : 'false'})
                 OR predecessor.failed_at IS NOT NULL
                 OR coalesce(predecessor.next_attempt_at, predecessor.created_at) > now()
                 OR (
@@ -17833,8 +18064,8 @@ export async function readPendingPostgresSchedulerOutboxEvents(
             ${
               supportsTerminalBatchMarker
                 ? `, delivery_batch_started_at = CASE
-              WHEN terminal_batch.has_terminal
-                THEN COALESCE(outbox.delivery_batch_started_at, clock_timestamp())
+              WHEN terminal_batch.has_terminal ${input.allowIngressPrefix === true ? `OR ${urgentLifecyclePendingSql('outbox')}` : ''}
+                THEN COALESCE(outbox.delivery_batch_started_at, statement_timestamp())
               ELSE outbox.delivery_batch_started_at
             END`
                 : ''
@@ -17851,8 +18082,15 @@ export async function readPendingPostgresSchedulerOutboxEvents(
       FROM claimed
       ORDER BY ${runLedgerOrderSql('claimed')}
     `,
-      [limit, runId, leaseOwner, leaseSeconds],
+      [
+        limit,
+        runId,
+        leaseOwner,
+        leaseSeconds,
+        ...(input.extendOwnedHead ? [input.extendOwnedHead] : []),
+      ],
     );
+  };
   let result;
   if (input.inTransaction) await client.query('SAVEPOINT run_ledger_claim');
   if (supportsOutboxDeliveryBatchMarker(options)) {
@@ -17910,6 +18148,7 @@ export async function readPostgresSchedulerOutboxNextDueAt(
         (SELECT max(active.lease_expires_at)
          FROM ${tableName('outbox', options)} AS active
          WHERE active.run_id = candidate.run_id
+           AND ${searchLaneSql('active')} = ${searchLaneSql('candidate')}
            AND active.delivered_at IS NULL AND active.lease_owner IS NOT NULL
            AND active.lease_expires_at > now())
       )) AS due_at
@@ -18149,7 +18388,7 @@ export async function purgePostgresSchedulerDeliveredOutboxRetentionBatch(
               '{events}',
               (SELECT jsonb_agg(
                  CASE WHEN item.value->>'type' = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
-                   THEN item.value - 'lines' - 'lineContexts'
+                   THEN item.value - 'lines' - 'lineContexts' - 'lineIds'
                    ELSE item.value
                  END ORDER BY item.ordinality
                )
@@ -18162,11 +18401,11 @@ export async function purgePostgresSchedulerDeliveredOutboxRetentionBatch(
             )
             WHEN jsonb_typeof(outbox.payload_json->'terminalProgressEvents') = 'array'
               THEN jsonb_set(
-                outbox.payload_json - 'terminalLogLines' - 'terminalLogContexts',
+                outbox.payload_json - 'terminalLogLines' - 'terminalLogContexts' - 'terminalLogIds',
                 '{terminalProgressEvents}',
                 coalesce((SELECT jsonb_agg(
                    CASE WHEN item.value->>'type' = ${RUN_EVENT_KIND_SQL_LITERAL.logAppended}
-                     THEN item.value - 'lines' - 'lineContexts'
+                     THEN item.value - 'lines' - 'lineContexts' - 'lineIds'
                      ELSE item.value
                    END ORDER BY item.ordinality
                  )
@@ -18174,7 +18413,7 @@ export async function purgePostgresSchedulerDeliveredOutboxRetentionBatch(
                      WITH ORDINALITY AS item(value, ordinality)), '[]'::jsonb),
                 false
               )
-            ELSE outbox.payload_json - 'terminalLogLines' - 'terminalLogContexts'
+            ELSE outbox.payload_json - 'terminalLogLines' - 'terminalLogContexts' - 'terminalLogIds'
           END
          FROM candidates
         WHERE outbox.event_id = candidates.event_id`,
@@ -18538,6 +18777,22 @@ function normalizeOutboxIngressPreview(
 export function buildRunLedgerEventsFromPostgresSchedulerOutbox(
   event: PostgresSchedulerOutboxEvent,
 ): PlayRunLedgerIngressEvent[] {
+  if (
+    payloadField(event.payload, RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD) ===
+    true
+  ) {
+    throw new Error(
+      'Deferred outbox input must be projected before ledger delivery.',
+    );
+  }
+  if (
+    payloadField(event.payload, RUNTIME_EVENT_SEARCH_ONLY_FIELD) === true ||
+    event.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.receiptEvent ||
+    event.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runnerLogs
+  ) {
+    // Search-only carriers are already durable in the canonical journal.
+    return [];
+  }
   const occurredAt = event.createdAt.getTime();
   if (event.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents) {
     const events = payloadField(event.payload, 'events');
@@ -18774,6 +19029,8 @@ export type PostgresSchedulerOutboxMaterializationPlan = {
 };
 
 const RUN_LEDGER_KNOWN_OUTBOX_EVENT_TYPES: ReadonlySet<string> = new Set([
+  RUN_SCHEDULER_OUTBOX_EVENT_TYPE.receiptEvent,
+  RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runnerLogs,
   RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents,
   RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runStarted,
   RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runCompleted,
@@ -18912,6 +19169,21 @@ export type RunLedgerOutboxTokenAuthority = 'local_mint' | 'gateway';
 /** Cross-run service policy; causal order within a run is always unchanged. */
 export type RunLedgerOutboxHeadPriority = 'admission_first' | 'oldest_ready';
 
+class DeferredRuntimeProjectionInputError extends AppRuntimeApiResponseError {
+  constructor(
+    readonly eventId: string,
+    detail: string,
+  ) {
+    super({
+      action: 'project_run_events',
+      status: 422,
+      code: 'runtime_event_projection_invalid',
+      retryable: false,
+      detail,
+    });
+  }
+}
+
 const POSTGRES_SCHEDULER_CANCELLATION_OUTBOX_LEASE_SECONDS =
   // The direct projection can run for the full app-runtime request deadline.
   // Keep another 30 seconds for dispatch setup and acknowledgement so a
@@ -18942,6 +19214,10 @@ export function postgresSchedulerCancellationOutboxLease(runId: string): {
 }
 
 export type RunLedgerOutboxDispatchInput = {
+  /** Only the existing background projector claims the independent search prefix. */
+  searchOnly?: boolean;
+  /** Only the existing background projector indexes deferred raw inputs. */
+  materializeObservability?: boolean;
   /**
    * Optional runtime context. `gateway` authority always replaces its
    * credentials with a fresh lease-scoped token and keeps only supported
@@ -18983,8 +19259,9 @@ export type RunLedgerOutboxDispatchInput = {
    * untargeted fast path) set this: after acknowledging a batch, also carry
    * the run's terminal fact through when it is now pending (see
    * `continueRunLedgerOutboxThroughTerminal`). Callers that drive their own
-   * bounded batches over a pre-leased prefix (cancellation, inline
-   * `run.created`, the targeted terminal drain) leave it unset.
+   * bounded batches (cancellation, inline `run.created`, the targeted terminal
+   * drain) leave it unset. Targeted drains retain successors through their
+   * explicit run/owner/target scope instead.
    */
   continueThroughTerminal?: boolean;
 };
@@ -19066,7 +19343,10 @@ type RunLedgerOutboxAuthorityScope = {
   authority: {
     runId: string;
     leaseOwner: string;
-    runtimeApi: WorkerRuntimeApiContext;
+    runtimeApi: WorkerRuntimeApiContext & {
+      refreshExecutorToken?: () => Promise<string>;
+      invalidateExecutorToken?: () => void;
+    };
     expiresAtMs: number | null;
   } | null;
 };
@@ -19101,6 +19381,9 @@ async function dispatchRunLedgerOutboxThroughEventWithScope(
     input.leaseOwner?.trim() ||
     scope?.leaseOwner ||
     `run-ledger-outbox-dispatch:${randomUUID()}`;
+  // The same owner retains each successor in the ACK transaction, including
+  // for a fresh worker drain that did not arrive with a preclaimed prefix.
+  scope ??= { runId, leaseOwner, targetEventId, nextClaimed: [] };
   const scopedInput = { ...input, leaseOwner };
   const batchSize = RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS;
   const eventIds: string[] = [];
@@ -19111,75 +19394,87 @@ async function dispatchRunLedgerOutboxThroughEventWithScope(
   let failed = 0;
   let retrying = 0;
 
-  let remaining = maxEvents;
-  while (remaining === null || remaining > 0) {
-    const result = await dispatchRunLedgerOutboxBatchWithScope(
-      withClient,
-      {
-        ...scopedInput,
-        waitForRunLock: true,
-        continueThroughTerminal: false,
-        limit: remaining === null ? batchSize : Math.min(batchSize, remaining),
-      },
-      options,
-      scope,
-      authorityScope,
+  try {
+    let remaining = maxEvents;
+    while (remaining === null || remaining > 0) {
+      const result = await dispatchRunLedgerOutboxBatchWithScope(
+        withClient,
+        {
+          ...scopedInput,
+          waitForRunLock: true,
+          continueThroughTerminal: false,
+          limit:
+            remaining === null ? batchSize : Math.min(batchSize, remaining),
+        },
+        options,
+        scope,
+        authorityScope,
+        remaining,
+      );
+      attempted += result.attempted;
+      projected += result.projected;
+      failed += result.failed;
+      retrying += result.retrying;
+      eventIds.push(...result.eventIds);
+      failedEventIds.push(...result.failedEventIds);
+      retryingEventIds.push(...result.retryingEventIds);
+      if (remaining !== null) remaining -= result.attempted;
+      if (result.eventIds.includes(targetEventId)) {
+        return {
+          attempted,
+          projected,
+          eventIds,
+          failed,
+          failedEventIds,
+          retrying,
+          retryingEventIds,
+          targetEventId,
+          targetDelivered: true,
+          targetBlocked: false,
+        };
+      }
+      // A projection failure is durably scheduled for retry or moved to terminal
+      // DLQ. Its policy owns the next attempt; spinning here would only reclaim
+      // the same failed predecessor and delay the park indefinitely.
+      // An absent target cannot retain a successor in ACK. Keep the existing
+      // fresh-claim traversal in that case until ready work is exhausted.
+      if (result.projected === 0 || result.attempted === 0) break;
+    }
+
+    // A concurrent dispatcher can claim the target between batches. An empty
+    // drain therefore does not prove delivery; read the durable acknowledgement
+    // before reporting the target as pending.
+    const target = await withClient((client) =>
+      readPostgresSchedulerOutboxDeliveryStatus(
+        client,
+        { runId, eventId: targetEventId },
+        options,
+      ),
     );
-    attempted += result.attempted;
-    projected += result.projected;
-    failed += result.failed;
-    retrying += result.retrying;
-    eventIds.push(...result.eventIds);
-    failedEventIds.push(...result.failedEventIds);
-    retryingEventIds.push(...result.retryingEventIds);
-    if (remaining !== null) remaining -= result.attempted;
-    if (result.eventIds.includes(targetEventId)) {
-      return {
-        attempted,
-        projected,
-        eventIds,
-        failed,
-        failedEventIds,
-        retrying,
-        retryingEventIds,
-        targetEventId,
-        targetDelivered: true,
-        targetBlocked: false,
-      };
+    return {
+      attempted,
+      projected,
+      eventIds,
+      failed,
+      failedEventIds,
+      retrying,
+      retryingEventIds,
+      targetEventId,
+      targetDelivered: target.delivered,
+      targetBlocked: target.blocked,
+    };
+  } finally {
+    if (scope.nextClaimed.length > 0) {
+      await withClient((client) =>
+        releasePostgresSchedulerOutboxLease(
+          client,
+          scope.nextClaimed.map((event) => event.eventId),
+          { ...options, leaseOwner },
+        ),
+      );
+      scope.nextClaimed.length = 0;
     }
-    // A projection failure is durably scheduled for retry or moved to terminal
-    // DLQ. Its policy owns the next attempt; spinning here would only reclaim
-    // the same failed predecessor and delay the park indefinitely.
-    if (
-      result.projected === 0 ||
-      result.attempted === 0 ||
-      (scope && scope.nextClaimed.length === 0)
-    )
-      break;
   }
-
-  // A concurrent dispatcher can claim the target between batches. An empty
-  // drain therefore does not prove delivery; read the durable acknowledgement
-  // before reporting the target as pending.
-  const target = await withClient((client) =>
-    readPostgresSchedulerOutboxDeliveryStatus(
-      client,
-      { runId, eventId: targetEventId },
-      options,
-    ),
-  );
-  return {
-    attempted,
-    projected,
-    eventIds,
-    failed,
-    failedEventIds,
-    retrying,
-    retryingEventIds,
-    targetEventId,
-    targetDelivered: target.delivered,
-    targetBlocked: target.blocked,
-  };
 }
 
 /**
@@ -19219,8 +19514,15 @@ async function dispatchRunLedgerOutboxBatchWithScope(
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
   scope?: RunLedgerOutboxDrainScope,
   authorityScope: RunLedgerOutboxAuthorityScope = { authority: null },
+  remainingEvents: number | null = null,
 ): Promise<PostgresSchedulerOutboxProjectionResult> {
   const dispatchStartedAtMs = Date.now();
+  const tokenAuthority = input.tokenAuthority ?? 'local_mint';
+  const dispatchLaunchSql =
+    !input.searchOnly && (tokenAuthority === 'gateway' || !input.runtimeApi)
+      ? runLedgerDispatchLaunchSql('runs')
+      : 'NULL::jsonb';
+  let claimedLaunchJson: unknown;
   const leaseOwner =
     input.leaseOwner?.trim() || `run-ledger-outbox-dispatch:${randomUUID()}`;
   const continuation: { current: RunLedgerOutboxDrainScope | null } = {
@@ -19272,7 +19574,10 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       // for each lifecycle transition. Only the two dedicated projectors may
       // perform the global distinct-head scan below.
       const selected = targetRunId
-        ? await client.query<{ run_id: string }>(
+        ? await client.query<{
+            run_id: string;
+            dispatch_launch_json?: unknown;
+          }>(
             `
             WITH head AS MATERIALIZED (
               SELECT pending.run_id,
@@ -19284,10 +19589,11 @@ async function dispatchRunLedgerOutboxBatchWithScope(
               FROM ${tableName('outbox', options)} AS pending
               WHERE pending.run_id = $1
                 AND pending.delivered_at IS NULL
+                AND ${searchLaneSql('pending')} = ${input.searchOnly === true ? 'true' : 'false'}
               ORDER BY ${runLedgerOrderSql('pending')}
               LIMIT 1
             )
-            SELECT runs.run_id
+            SELECT runs.run_id, ${dispatchLaunchSql} AS dispatch_launch_json
             FROM head
             JOIN ${tableName('runs', options)} AS runs ON runs.run_id = head.run_id
             WHERE head.failed_at IS NULL
@@ -19296,6 +19602,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
               AND NOT EXISTS (
                 SELECT 1 FROM ${tableName('outbox', options)} AS active
                 WHERE active.run_id = runs.run_id
+                  AND ${searchLaneSql('active')} = ${input.searchOnly === true ? 'true' : 'false'}
                   AND active.delivered_at IS NULL
                   AND active.lease_owner IS NOT NULL
                   AND active.lease_expires_at > now()
@@ -19305,8 +19612,17 @@ async function dispatchRunLedgerOutboxBatchWithScope(
           `,
             [targetRunId, leaseOwner, input.headEventId?.trim() || null],
           )
-        : await client.query<{ run_id: string }>(`
-            WITH heads AS MATERIALIZED (
+        : await client.query<{
+            run_id: string;
+            dispatch_launch_json?: unknown;
+          }>(`
+            WITH ${
+              input.searchOnly === true
+                ? ''
+                : `waiting_runs AS MATERIALIZED (
+              ${runLedgerWaitingRunsSql(options)}
+            ), `
+            }heads AS MATERIALIZED (
               SELECT DISTINCT ON (pending.run_id)
                 pending.run_id,
                 pending.event_id,
@@ -19316,9 +19632,10 @@ async function dispatchRunLedgerOutboxBatchWithScope(
                 pending.failed_at
               FROM ${tableName('outbox', options)} AS pending
               WHERE pending.delivered_at IS NULL
+                AND ${searchLaneSql('pending')} = ${input.searchOnly === true ? 'true' : 'false'}
               ORDER BY pending.run_id, ${runLedgerOrderSql('pending')}
             )
-            SELECT runs.run_id
+            SELECT runs.run_id, ${dispatchLaunchSql} AS dispatch_launch_json
             FROM heads AS head
             JOIN ${tableName('runs', options)} AS runs ON runs.run_id = head.run_id
             WHERE head.failed_at IS NULL
@@ -19326,12 +19643,13 @@ async function dispatchRunLedgerOutboxBatchWithScope(
               AND NOT EXISTS (
                 SELECT 1 FROM ${tableName('outbox', options)} AS active
                 WHERE active.run_id = runs.run_id
+                  AND ${searchLaneSql('active')} = ${input.searchOnly === true ? 'true' : 'false'}
                   AND active.delivered_at IS NULL
                   AND active.lease_owner IS NOT NULL
                   AND active.lease_expires_at > now()
               )
             -- admission_first: admission, then the causal head of a run with
-            -- a pending terminal, then FIFO progress. oldest_ready keeps its
+            -- a pending terminal or public wait, then FIFO progress. oldest_ready keeps its
             -- pure age order so continuous admissions/terminals cannot starve
             -- ordinary progress.
             ORDER BY ${
@@ -19340,7 +19658,8 @@ async function dispatchRunLedgerOutboxBatchWithScope(
                 : `CASE
                        WHEN head.event_type = ${RUN_EVENT_KIND_SQL_LITERAL.runCreated} THEN 0
                        WHEN ${runLedgerTerminalPendingSql('head', options)} THEN 1
-                       ELSE 2
+                       ${input.searchOnly === true ? '' : `WHEN ${runLedgerWaitingPendingSql('head')} THEN 2`}
+                       ELSE 3
                      END,`
             }
                      head.created_at, runs.run_id
@@ -19356,10 +19675,19 @@ async function dispatchRunLedgerOutboxBatchWithScope(
               leaseOwner,
               leaseSeconds: input.leaseSeconds ?? 120,
               inTransaction: true,
+              searchOnly: input.searchOnly,
             },
             options,
           )
         : [];
+      // Authority/routing is immutable and already lives on the locked Run.
+      // Capture only its existing narrow projection with the successful lease
+      // claim, then release the checkout before requesting gateway authority.
+      // The gateway still independently proves that this lease is current.
+      const launchJson = selected.rows[0]?.dispatch_launch_json;
+      if (claimed.length > 0 && launchJson != null) {
+        claimedLaunchJson = launchJson;
+      }
       await client.query('COMMIT');
       return claimed;
     } catch (error) {
@@ -19367,7 +19695,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       throw error;
     }
   };
-  const events = scope?.nextClaimed.length
+  let events = scope?.nextClaimed.length
     ? scope.nextClaimed.splice(0)
     : await withClient(claimEvents);
   if (events.length === 0) {
@@ -19386,9 +19714,148 @@ async function dispatchRunLedgerOutboxBatchWithScope(
   let authorityReadyAtMs: number | null = null;
   let appendFinishedAtMs: number | null = null;
   let acknowledgedAtMs: number | null = null;
+  const materializeDeferredObservability = async () => {
+    if (
+      events.some(
+        (event) =>
+          payloadField(
+            event.payload,
+            RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD,
+          ) === true,
+      )
+    ) {
+      if (!input.materializeObservability) {
+        // Inline admission/lifecycle/read-heal paths must never index logs.
+        // Release and wake the existing projector without charging a retry.
+        const released = await withClient((client) =>
+          releasePostgresSchedulerOutboxLease(
+            client,
+            events.map((event) => event.eventId),
+            { ...options, leaseOwner },
+          ),
+        );
+        return {
+          attempted: events.length,
+          projected: 0,
+          eventIds: [],
+          failed: 0,
+          failedEventIds: [],
+          retrying: released.length,
+          retryingEventIds: released,
+        };
+      }
+      for (const event of events) {
+        if (
+          payloadField(
+            event.payload,
+            RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD,
+          ) !== true
+        )
+          continue;
+        await withClient(async (client) => {
+          await renewPostgresRunLedgerDelivery(
+            client,
+            {
+              eventIds: events.map((row) => row.eventId),
+              leaseOwner,
+              leaseSeconds: 120,
+            },
+            options,
+          );
+          // Keep projection below its renewed lease. The final payload update
+          // fences ownership; indexing locks neither outbox nor Run rows.
+          await client.query('BEGIN');
+          try {
+            // Let PostgreSQL cancel before the pool's client-side timeout,
+            // so rollback completes while the checkout is still usable.
+            await client.query(
+              "SELECT set_config('statement_timeout', $1, true)",
+              [
+                `${Math.min(60_000, RUNTIME_RELIABILITY_POLICY.schedulerDatabase.queryTimeoutMs - 1_000)}ms`,
+              ],
+            );
+            const result = await client.query<{ payload: unknown }>(
+              `SELECT ${quoteIdent(schemaName(options))}.materialize_runtime_outbox_event($1, $2) AS payload`,
+              [event.eventId, leaseOwner],
+            );
+            await client.query('COMMIT');
+            event.payload = result.rows[0]!.payload;
+          } catch (error) {
+            await client.query('ROLLBACK');
+            if (
+              error &&
+              typeof error === 'object' &&
+              'code' in error &&
+              error.code === 'P0001'
+            ) {
+              // The installed projector's explicit RAISEs reject malformed
+              // or conflicting immutable facts. Retain them in the existing
+              // quarantine instead of retrying the same invalid input forever.
+              throw new DeferredRuntimeProjectionInputError(
+                event.eventId,
+                error instanceof Error
+                  ? error.message
+                  : 'Invalid runtime event projection input.',
+              );
+            }
+            throw error;
+          }
+        });
+      }
+    }
+    return null;
+  };
   try {
+    if (!input.materializeObservability) {
+      const handedOff = await materializeDeferredObservability();
+      if (handedOff) return handedOff;
+    }
+    if (input.searchOnly) {
+      const handedOff = await materializeDeferredObservability();
+      if (handedOff) return handedOff;
+      if (
+        events.some(
+          (event) =>
+            payloadField(event.payload, RUNTIME_EVENT_SEARCH_ONLY_FIELD) !==
+            true,
+        )
+      )
+        throw new Error('Search lease includes a lifecycle fact.');
+      const delivered = await withClient((client) =>
+        markPostgresSchedulerOutboxDeliveredRows(
+          client,
+          events.map((event) => event.eventId),
+          { ...options, leaseOwner },
+        ),
+      );
+      if (delivered.length !== events.length)
+        throw new RunLedgerProjectionLeaseLostError(
+          'delivery_lease_not_current',
+        );
+      if (input.onDelivered) {
+        try {
+          input.onDelivered(delivered);
+        } catch (error) {
+          console.warn('[run-ledger-outbox.delivery_observer_failed]', {
+            error: error instanceof Error ? error.message : String(error),
+          });
+        }
+      }
+      return {
+        attempted: events.length,
+        projected: delivered.length,
+        eventIds: events.map((event) => event.eventId),
+        failed: 0,
+        failedEventIds: [],
+        retrying: 0,
+        retryingEventIds: [],
+      };
+    }
     const first = events[0]!;
-    const tokenAuthority = input.tokenAuthority ?? 'local_mint';
+    const claimedLaunch =
+      claimedLaunchJson == null
+        ? undefined
+        : parseLaunchJson(claimedLaunchJson);
     if (
       scope &&
       (scope.runId !== first.runId || scope.leaseOwner !== leaseOwner)
@@ -19422,6 +19889,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
               tokenAuthority,
               options,
               input.runtimeApi?.signal,
+              claimedLaunch,
             )
         : null;
     if (
@@ -19445,6 +19913,8 @@ async function dispatchRunLedgerOutboxBatchWithScope(
           : null,
         tokenAuthority,
         options,
+        undefined,
+        claimedLaunch,
       ));
     const runtimeApi = {
       ...resolvedRuntimeApi,
@@ -19486,6 +19956,49 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       };
     }
     authorityReadyAtMs = Date.now();
+    // The initial claim deliberately uses the old contract until its immutable
+    // launch receiver advertises support. Widen under the same run/owner fence
+    // before the first HTTP append, so an already-finished run need not pay one
+    // authority/append/ACK round trip for every ingress predecessor.
+    if (
+      runtimeApi.runLedgerIngressPrefixBatching === true &&
+      events.length === 1 &&
+      first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents
+    ) {
+      const widened = await withClient((client) =>
+        readPendingPostgresSchedulerOutboxEvents(
+          client,
+          {
+            runId: first.runId,
+            leaseOwner,
+            leaseSeconds: input.leaseSeconds ?? 120,
+            limit: Math.min(
+              RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS,
+              remainingEvents ?? RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS,
+            ),
+            allowIngressPrefix: true,
+            extendOwnedHead: first.eventId,
+          },
+          options,
+        ),
+      );
+      // Expansion uses SKIP LOCKED on the run fence. A concurrent lifecycle
+      // writer can make it empty while our original head lease remains live.
+      // Keep that singleton; mandatory renewal below still rejects expired
+      // or replaced ownership and freezes its receipt before any HTTP append.
+      if (widened.length > 0) {
+        if (widened[0]!.eventId !== first.eventId) {
+          throw new RunLedgerProjectionLeaseLostError(
+            'head_lease_owner_mismatch',
+          );
+        }
+        events = widened;
+      }
+    }
+    // Widening can add deferred facts to the lease. Project the complete
+    // frozen prefix before any HTTP append, including its newly claimed rows.
+    const handedOff = await materializeDeferredObservability();
+    if (handedOff) return handedOff;
     const renewDelivery = async () => {
       const currentAuthority = authorityScope.authority;
       if (
@@ -19508,14 +20021,16 @@ async function dispatchRunLedgerOutboxBatchWithScope(
             'Run Ledger dispatch origin changed within an immutable launch.',
           );
         }
-        runtimeApi.executorToken = refreshed.executorToken;
+        runtimeApi.executorToken = refreshed.refreshExecutorToken
+          ? await refreshed.refreshExecutorToken()
+          : refreshed.executorToken;
         runtimeApi.vercelProtectionBypassToken =
           refreshed.vercelProtectionBypassToken;
         authorityScope.authority = {
           runId: first.runId,
           leaseOwner,
           runtimeApi,
-          expiresAtMs: runtimeApiTokenExpiresAtMs(refreshed.executorToken),
+          expiresAtMs: runtimeApiTokenExpiresAtMs(runtimeApi.executorToken),
         };
       }
       await withClient((client) =>
@@ -19525,70 +20040,108 @@ async function dispatchRunLedgerOutboxBatchWithScope(
             eventIds: events.map((event) => event.eventId),
             leaseOwner,
             leaseSeconds: input.leaseSeconds ?? 120,
+            freezeReceipt:
+              runtimeApi.runLedgerIngressPrefixBatching === true &&
+              events.some(
+                (event) =>
+                  event.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runEvents,
+              ),
           },
           options,
         ),
       );
     };
-    // A pending start is always claimed alone because later events require its
-    // snapshot. It cannot share the append endpoint, so retain that mutation
-    // as its own exact delivery.
-    if (first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runCreated) {
-      await renewDelivery();
-      await projectPostgresSchedulerCreatedEvent(runtimeApi, first);
-    } else if (first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runStarted) {
-      await renewDelivery();
-      const leaseOwner = first.leaseOwner;
-      const launch = leaseOwner
-        ? await withClient((client) =>
-            readRunLedgerDispatchLaunchForLease(
-              client,
-              {
-                runId: first.runId,
-                eventId: first.eventId,
-                leaseOwner,
-              },
-              options,
-            ),
-          )
-        : null;
-      await projectPostgresSchedulerStartEvent(runtimeApi, first, launch);
-    } else {
-      const ledgerEvents = events.flatMap(
-        buildRunLedgerEventsFromPostgresSchedulerOutbox,
-      );
-      if (ledgerEvents.length > 0) {
-        const terminal = [...events]
-          .reverse()
-          .find((event) =>
-            RUN_SCHEDULER_OUTBOX_TERMINAL_EVENT_TYPES.includes(event.eventType),
-          );
-        const batchDeliveryKey = createHash('sha256')
-          .update(events.map((event) => event.deliveryKey).join('\n'))
-          .digest('hex');
-        await projectRunEventsViaAppRuntime(runtimeApi, {
-          playId: first.runId,
-          events: ledgerEvents,
-          deliveryLeaseOwner: leaseOwner,
-          beforeBatch: renewDelivery,
-          idempotencyKey: terminal
-            ? buildRunLedgerTerminalIdempotencyKey({
-                runId: first.runId,
-                deliveryKey: terminal.deliveryKey,
-              })
-            : buildRunLedgerEventsIdempotencyKey({
-                runId: first.runId,
-                deliveryDigest: batchDeliveryKey,
-              }),
-        });
-      } else {
+    const append = async () => {
+      // A pending start is always claimed alone because later events require its
+      // snapshot. It cannot share the append endpoint, so retain that mutation
+      // as its own exact delivery.
+      if (first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runCreated) {
         await renewDelivery();
+        await projectPostgresSchedulerCreatedEvent(runtimeApi, first);
+      } else if (
+        first.eventType === RUN_SCHEDULER_OUTBOX_EVENT_TYPE.runStarted
+      ) {
+        await renewDelivery();
+        const leaseOwner = first.leaseOwner;
+        const launch = leaseOwner
+          ? await withClient((client) =>
+              readRunLedgerDispatchLaunchForLease(
+                client,
+                {
+                  runId: first.runId,
+                  eventId: first.eventId,
+                  leaseOwner,
+                },
+                options,
+              ),
+            )
+          : null;
+        await projectPostgresSchedulerStartEvent(runtimeApi, first, launch);
+      } else {
+        const ledgerEvents = events.flatMap(
+          buildRunLedgerEventsFromPostgresSchedulerOutbox,
+        );
+        if (ledgerEvents.length > 0) {
+          const terminal = [...events]
+            .reverse()
+            .find((event) =>
+              RUN_SCHEDULER_OUTBOX_TERMINAL_EVENT_TYPES.includes(
+                event.eventType,
+              ),
+            );
+          const batchDeliveryKey = createHash('sha256')
+            .update(events.map((event) => event.deliveryKey).join('\n'))
+            .digest('hex');
+          await projectRunEventsViaAppRuntime(runtimeApi, {
+            playId: first.runId,
+            events: ledgerEvents,
+            deliveryLeaseOwner: leaseOwner,
+            beforeBatch: renewDelivery,
+            idempotencyKey: terminal
+              ? buildRunLedgerTerminalIdempotencyKey({
+                  runId: first.runId,
+                  deliveryKey: terminal.deliveryKey,
+                })
+              : buildRunLedgerEventsIdempotencyKey({
+                  runId: first.runId,
+                  deliveryDigest: batchDeliveryKey,
+                }),
+          });
+        } else {
+          await renewDelivery();
+        }
       }
+    };
+    try {
+      await append();
+    } catch (error) {
+      // A cached authority can be invalidated by signer rotation. Refresh it
+      // once through this delivery's active lease; the append remains fenced
+      // and carries the same idempotency key on both attempts.
+      if (
+        !gatewayRuntimeApi?.refreshExecutorToken ||
+        !(error instanceof AppRuntimeApiResponseError) ||
+        error.status !== 401
+      )
+        throw error;
+      runtimeApi.executorToken = await gatewayRuntimeApi.refreshExecutorToken();
+      await append();
     }
     appendFinishedAtMs = Date.now();
     const acknowledgement = await acknowledgeRunLedgerPrefixWithContinuation(
       withClient,
-      { input, events, leaseOwner, runtimeApi, scope, continuation },
+      {
+        input,
+        events,
+        leaseOwner,
+        runtimeApi,
+        scope,
+        continuation,
+        continuationAllowance:
+          remainingEvents === null
+            ? null
+            : Math.max(0, remainingEvents - events.length),
+      },
       options,
     );
     const { deliveredRows } = acknowledgement;
@@ -19630,6 +20183,10 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       authorityScope,
     );
   } catch (error) {
+    // A failed append must reacquire receiver truth on its next attempt,
+    // including an older receiver that rejected a frozen compound receipt.
+    authorityScope.authority?.runtimeApi.invalidateExecutorToken?.();
+    authorityScope.authority = null;
     await releasePendingContinuation();
     if (input.signal?.aborted) {
       // The caller's latency budget expired; this is not a delivery failure.
@@ -19654,20 +20211,87 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         retryingEventIds: released,
       };
     }
-    const settlement = await withClient(async (client) => {
-      const blocked: string[] = [];
-      const retrying: string[] = [];
-      for (const event of events) {
-        const outcome = await settlePostgresSchedulerOutboxFailure(
+    if (error instanceof DeferredRuntimeProjectionInputError) {
+      const outcome = await withClient((client) =>
+        settlePostgresSchedulerOutboxFailure(client, error.eventId, error, {
+          ...options,
+          leaseOwner,
+        }),
+      );
+      // Earlier facts may already be indexed. Only the invalid immutable row
+      // is quarantined; valid predecessors remain deliverable in causal order.
+      const released = await withClient((client) =>
+        releasePostgresSchedulerOutboxLease(
           client,
-          event.eventId,
-          error,
+          events
+            .filter((event) => event.eventId !== error.eventId)
+            .map((event) => event.eventId),
           { ...options, leaseOwner },
-        );
-        if (outcome === 'blocked') blocked.push(event.eventId);
-        else retrying.push(event.eventId);
+        ),
+      );
+      const failed = outcome === 'blocked' ? [error.eventId] : [];
+      const retrying =
+        outcome === 'blocked' ? released : [...released, error.eventId];
+      console.error('[run-ledger-outbox.invalid_projection_input]', {
+        eventId: error.eventId,
+        code: error.code,
+        detail: error.message,
+      });
+      return {
+        attempted: events.length,
+        projected: 0,
+        eventIds: [],
+        failed: failed.length,
+        failedEventIds: failed,
+        retrying: retrying.length,
+        retryingEventIds: retrying,
+      };
+    }
+    const settlement = await withClient(async (client) => {
+      await client.query('BEGIN');
+      try {
+        const blocked: string[] = [];
+        const retrying: string[] = [];
+        const ownedRetrying: string[] = [];
+        for (const event of events) {
+          const outcome = await settlePostgresSchedulerOutboxFailure(
+            client,
+            event.eventId,
+            error,
+            { ...options, leaseOwner },
+          );
+          if (outcome === 'blocked') blocked.push(event.eventId);
+          else retrying.push(event.eventId);
+          if (outcome === 'retrying') ownedRetrying.push(event.eventId);
+        }
+        // All members of this failed append must become due together. Keep
+        // the existing per-row retry policy, taking its latest deadline only
+        // for rows this owner actually settled, before releasing their locks.
+        if (ownedRetrying.length > 1) {
+          await client.query(
+            `
+            WITH retry AS (
+              SELECT max(next_attempt_at) AS retry_at
+              FROM ${tableName('outbox', options)}
+              WHERE event_id = ANY($1::text[])
+                AND delivered_at IS NULL AND failed_at IS NULL
+            )
+            UPDATE ${tableName('outbox', options)} AS outbox
+            SET next_attempt_at = retry.retry_at
+            FROM retry
+            WHERE outbox.event_id = ANY($1::text[])
+              AND outbox.delivered_at IS NULL AND outbox.failed_at IS NULL
+              AND retry.retry_at IS NOT NULL
+          `,
+            [ownedRetrying],
+          );
+        }
+        await client.query('COMMIT');
+        return { blocked, retrying };
+      } catch (settlementError) {
+        await client.query('ROLLBACK');
+        throw settlementError;
       }
-      return { blocked, retrying };
     });
     console.warn('[run-ledger-outbox.batch_dispatch_failed]', {
       runId: input.runId ?? null,
@@ -19784,6 +20408,7 @@ async function acknowledgeRunLedgerPrefixWithContinuation(
     runtimeApi: WorkerRuntimeApiContext;
     scope?: RunLedgerOutboxDrainScope;
     continuation: { current: RunLedgerOutboxDrainScope | null };
+    continuationAllowance: number | null;
   },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<{
@@ -19824,6 +20449,7 @@ async function acknowledgeRunLedgerPrefixWithContinuation(
       let continuation: RunLedgerOutboxDrainScope | null = null;
       if (
         retainContinuation &&
+        input.continuationAllowance !== 0 &&
         deliveredRows.length === input.events.length &&
         !input.events.some((event) => event.eventId === targetEventId)
       ) {
@@ -19841,8 +20467,14 @@ async function acknowledgeRunLedgerPrefixWithContinuation(
               leaseSeconds: input.input.leaseSeconds ?? 120,
               limit: Math.min(
                 RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS,
-                input.input.limit ?? 1,
+                input.runtimeApi.runLedgerIngressPrefixBatching === true
+                  ? RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS
+                  : (input.input.limit ?? 1),
+                input.continuationAllowance ??
+                  RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS,
               ),
+              allowIngressPrefix:
+                input.runtimeApi.runLedgerIngressPrefixBatching === true,
               inTransaction: true,
             },
             options,
@@ -20019,38 +20651,7 @@ async function projectPostgresSchedulerStartEvent(
   });
 }
 
-export type RunLedgerDispatchLaunch = Pick<
-  PlaySchedulerSubmitInput,
-  | 'runId'
-  | 'playId'
-  | 'playName'
-  | 'executorToken'
-  | 'baseUrl'
-  | 'runtimeApiBaseUrl'
-  | 'runtimeTokenOrigin'
-  | 'orgId'
-  | 'runtimeAuthority'
-  | 'vercelProtectionBypassToken'
->;
-
-/** Authority reads never transfer customer input, artifacts or execution graphs. */
-function runLedgerDispatchLaunchSql(alias: string): string {
-  const fields: (keyof RunLedgerDispatchLaunch)[] = [
-    'runId',
-    'playId',
-    'playName',
-    'executorToken',
-    'baseUrl',
-    'runtimeApiBaseUrl',
-    'runtimeTokenOrigin',
-    'orgId',
-    'runtimeAuthority',
-    'vercelProtectionBypassToken',
-  ];
-  return `jsonb_build_object(${fields
-    .map((field) => `'${field}', ${alias}.launch_json->'${field}'`)
-    .join(', ')})`;
-}
+export type { RunLedgerDispatchLaunch } from './run-ledger-dispatch-authority';
 
 async function loadPostgresSchedulerRuntimeApiForRun(
   withClient: <T>(
@@ -20061,28 +20662,37 @@ async function loadPostgresSchedulerRuntimeApiForRun(
   tokenAuthority: RunLedgerOutboxTokenAuthority,
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
   signal?: AbortSignal,
-): Promise<WorkerRuntimeApiContext> {
+  claimedLaunch?: RunLedgerDispatchLaunch,
+): Promise<
+  WorkerRuntimeApiContext & {
+    refreshExecutorToken?: () => Promise<string>;
+    invalidateExecutorToken?: () => void;
+  }
+> {
   // Release the scarce scheduler checkout before the token authority hop.
   // A slow gateway must not retain either projector pool client, and its
   // launch context must not hydrate customer execution graphs.
-  const result = await withClient((client) =>
-    client.query<{ launch_json: unknown }>(
-      `SELECT ${runLedgerDispatchLaunchSql('runs')} AS launch_json
-       FROM ${tableName('runs', options)} AS runs
-       WHERE run_id = $1
-       LIMIT 1`,
-      [runId],
-    ),
-  );
-  const launch: RunLedgerDispatchLaunch = parseLaunchJson(
-    result.rows[0]?.launch_json,
-  );
+  const launch: RunLedgerDispatchLaunch =
+    claimedLaunch ??
+    (await withClient(async (client) => {
+      const result = await client.query<{ launch_json: unknown }>(
+        `SELECT ${runLedgerDispatchLaunchSql('runs')} AS launch_json
+         FROM ${tableName('runs', options)} AS runs
+         WHERE run_id = $1
+         LIMIT 1`,
+        [runId],
+      );
+      return parseLaunchJson(result.rows[0]?.launch_json);
+    }));
   if (!launch?.baseUrl) {
     throw new Error(
       `Run-ledger outbox dispatcher cannot resolve runtime API context for ${runId}.`,
     );
   }
   let executorToken: string;
+  let runLedgerIngressPrefixBatching: true | undefined;
+  let refreshExecutorToken: (() => Promise<string>) | undefined;
+  let invalidateExecutorToken: (() => void) | undefined;
   if (tokenAuthority === 'local_mint') {
     // App-side authoritative projector: sign in-process. NEVER reached on the
     // Fly worker (it passes `gateway`), so this is the only place `BETTER_AUTH_
@@ -20101,34 +20711,89 @@ async function loadPostgresSchedulerRuntimeApiForRun(
         `Run-ledger outbox gateway dispatch for ${runId} requires an active outbox lease.`,
       );
     }
-    executorToken = await requestRunLedgerDispatchToken({
+    const dispatchRequest = {
       launch,
       eventId: dispatchLease.eventId,
       leaseOwner: dispatchLease.leaseOwner,
       schedulerSchema: options?.schema ?? null,
       signal,
-    });
+    };
+    const dispatchAuthority =
+      await requestRunLedgerDispatchToken(dispatchRequest);
+    invalidateExecutorToken = () =>
+      runLedgerDispatchTokens.delete(dispatchAuthority.cacheKey);
+    if (dispatchAuthority.reused) {
+      refreshExecutorToken = async () =>
+        (await requestRunLedgerDispatchToken(dispatchRequest, true))
+          .executorToken;
+    }
+    executorToken = dispatchAuthority.executorToken;
+    runLedgerIngressPrefixBatching =
+      dispatchAuthority.runLedgerIngressPrefixBatching;
   }
   return {
     baseUrl: runtimeApiBaseUrlFromLaunch(launch),
     executorToken,
+    ...(runLedgerIngressPrefixBatching
+      ? { runLedgerIngressPrefixBatching }
+      : {}),
     vercelProtectionBypassToken: launch.vercelProtectionBypassToken ?? null,
+    ...(refreshExecutorToken ? { refreshExecutorToken } : {}),
+    ...(invalidateExecutorToken ? { invalidateExecutorToken } : {}),
   };
 }
 
-async function requestRunLedgerDispatchToken(input: {
-  launch: RunLedgerDispatchLaunch;
-  eventId: string;
-  leaseOwner: string;
-  schedulerSchema: string | null;
-  signal?: AbortSignal;
-}): Promise<string> {
+// Only freshly gateway-issued legacy run.progress authority is reused.
+// Prefix advertisements are reacquired for each drain because they select its
+// receipt shape, including recovery across receiver capability changes. This is not
+// a lease cache: every delivery still claims, renews, and proves its own lease
+// at append. Include the complete pinned authority/routing and internal-token
+// fingerprint so a different run, schema, origin, or authority never shares it.
+const RUN_LEDGER_DISPATCH_TOKEN_CACHE_MS = 30_000;
+const RUN_LEDGER_DISPATCH_TOKEN_CACHE_ENTRIES = 256;
+const runLedgerDispatchTokens = new Map<
+  string,
+  { token: string; expiresAt: number; runLedgerIngressPrefixBatching?: true }
+>();
+
+async function requestRunLedgerDispatchToken(
+  input: {
+    launch: RunLedgerDispatchLaunch;
+    eventId: string;
+    leaseOwner: string;
+    schedulerSchema: string | null;
+    signal?: AbortSignal;
+  },
+  forceFresh = false,
+): Promise<{
+  executorToken: string;
+  reused: boolean;
+  cacheKey: string;
+  runLedgerIngressPrefixBatching?: true;
+}> {
   const internalToken = process.env.DEEPLINE_INTERNAL_TOKEN?.trim();
   if (!internalToken || !input.eventId || !input.leaseOwner) {
     throw new Error(
       'Run-ledger outbox recovery requires a valid dispatch lease and DEEPLINE_INTERNAL_TOKEN.',
     );
   }
+  input.signal?.throwIfAborted();
+  const { executorToken: _storedToken, ...authority } = input.launch;
+  const cacheKey = createHash('sha256')
+    .update(JSON.stringify([input.schedulerSchema, authority, internalToken]))
+    .digest('hex');
+  const now = Date.now();
+  for (const [key, entry] of runLedgerDispatchTokens) {
+    if (entry.expiresAt <= now) runLedgerDispatchTokens.delete(key);
+  }
+  const cached = runLedgerDispatchTokens.get(cacheKey);
+  if (!forceFresh && cached)
+    return {
+      executorToken: cached.token,
+      reused: true,
+      cacheKey,
+    };
+  runLedgerDispatchTokens.delete(cacheKey);
   const url = `${runtimeApiBaseUrlFromLaunch(input.launch).replace(/\/$/, '')}/api/v2/internal/play-runtime/run-ledger-dispatch-token`;
   const vercelProtectionHeaders = await vercelProtectionBypassHeaders({
     baseUrl: runtimeApiBaseUrlFromLaunch(input.launch),
@@ -20164,6 +20829,7 @@ async function requestRunLedgerDispatchToken(input: {
     try {
       return JSON.parse(responseText) as {
         executorToken?: unknown;
+        runLedgerIngressPrefixBatching?: unknown;
         error?: unknown;
         code?: unknown;
         retryable?: unknown;
@@ -20196,7 +20862,53 @@ async function requestRunLedgerDispatchToken(input: {
             : 'invalid response',
     });
   }
-  return body.executorToken;
+  // Decode only the lifetime, never an authentication decision: the app
+  // validates the signature, run scope, and live delivery lease on append.
+  // Opaque/older token formats continue to work without this optimization.
+  try {
+    const claims = JSON.parse(
+      Buffer.from(
+        body.executorToken.split('.')[1] ?? '',
+        'base64url',
+      ).toString(),
+    ) as { exp?: unknown };
+    if (
+      body.runLedgerIngressPrefixBatching === undefined &&
+      typeof claims.exp === 'number' &&
+      Number.isFinite(claims.exp)
+    ) {
+      const expiresAt = Math.min(
+        Date.now() + RUN_LEDGER_DISPATCH_TOKEN_CACHE_MS,
+        claims.exp * 1_000 - 5_000,
+      );
+      if (expiresAt > Date.now()) {
+        runLedgerDispatchTokens.set(cacheKey, {
+          token: body.executorToken,
+          expiresAt,
+        });
+        while (
+          runLedgerDispatchTokens.size > RUN_LEDGER_DISPATCH_TOKEN_CACHE_ENTRIES
+        ) {
+          runLedgerDispatchTokens.delete(
+            runLedgerDispatchTokens.keys().next().value!,
+          );
+        }
+      }
+    }
+  } catch {
+    // A cache miss never changes delivery or hides a gateway rejection.
+  }
+  if (body.runLedgerIngressPrefixBatching !== undefined) {
+    runLedgerDispatchTokens.delete(cacheKey);
+  }
+  return {
+    executorToken: body.executorToken,
+    reused: false,
+    cacheKey,
+    ...(body.runLedgerIngressPrefixBatching === true
+      ? { runLedgerIngressPrefixBatching: true as const }
+      : {}),
+  };
 }
 
 export async function requestComputeBillingDispatchToken(input: {
@@ -20272,27 +20984,7 @@ export async function requestComputeBillingDispatchToken(input: {
   return body.executorToken;
 }
 
-/** Read only the immutable authority/routing fields under the same lease fence. */
-export async function readRunLedgerDispatchAuthorityForLease(
-  client: PostgresSchedulerQueryClient,
-  input: { runId: string; eventId: string; leaseOwner: string },
-  options?: Pick<PostgresSchedulerOptions, 'schema'>,
-): Promise<RunLedgerDispatchLaunch | null> {
-  const result = await client.query<{ launch_json: unknown }>(
-    `SELECT ${runLedgerDispatchLaunchSql('runs')} AS launch_json
-     FROM ${tableName('outbox', options)} outbox
-     JOIN ${tableName('runs', options)} runs ON runs.run_id = outbox.run_id
-     WHERE outbox.event_id = $1
-       AND outbox.run_id = $2
-       AND outbox.lease_owner = $3
-       AND outbox.lease_expires_at > now()
-       AND outbox.delivered_at IS NULL
-       AND outbox.failed_at IS NULL
-     LIMIT 1`,
-    [input.eventId, input.runId, input.leaseOwner],
-  );
-  return result.rows[0] ? parseLaunchJson(result.rows[0].launch_json) : null;
-}
+export { readRunLedgerDispatchAuthorityForLease } from './run-ledger-dispatch-authority';
 
 export async function readRunLedgerDispatchLaunchForLease(
   client: PostgresSchedulerQueryClient,
@@ -20415,22 +21107,10 @@ function sourcePayloadField(
 }
 
 function parseLaunchJson(value: unknown): PlaySchedulerSubmitInput {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) {
-    throw new Error('Postgres scheduler launch_json is not an object.');
-  }
-  const launch = value as Partial<PlaySchedulerSubmitInput>;
-  if (
-    typeof launch.runId !== 'string' ||
-    typeof launch.playId !== 'string' ||
-    typeof launch.playName !== 'string' ||
-    typeof launch.executorToken !== 'string' ||
-    typeof launch.baseUrl !== 'string'
-  ) {
-    throw new Error(
-      'Postgres scheduler launch_json is missing required fields.',
-    );
-  }
-  return hydrateRetainedPlayPipelines(launch as PlaySchedulerSubmitInput);
+  const launch = parseRunLedgerDispatchLaunch(
+    value,
+  ) as PlaySchedulerSubmitInput;
+  return hydrateRetainedPlayPipelines(launch);
 }
 
 function parsePostgresSchedulerCronSourcePin(