deepline 0.3.314 → 0.3.316

package/dist/bundling-sources/shared_libs/play-runtime/runtime-api.ts

@@ -1,3 +1,15 @@
+import {
+  RuntimeSheetAttemptSupersededError,
+  RuntimeSheetWriteIntentUnavailableError,
+  type RuntimeMapRowsStaleReason,
+  type RuntimeMapRowsStaleRow,
+} from './runtime-sheet-errors';
+export {
+  RuntimeSheetAttemptSupersededError,
+  RuntimeSheetWriteIntentUnavailableError,
+  type RuntimeMapRowsStaleReason,
+  type RuntimeMapRowsStaleRow,
+} from './runtime-sheet-errors';
 import {
   prepareRetainedPlayPipelinesForTransport,
   hydrateRetainedPlayPipelines,
@@ -74,6 +86,7 @@ import {
 } from './db-session-crypto';
 import { createRuntimeDatasetId } from './dataset-id';
 import {
+  buildScopedWorkReceiptKey,
   scopedWorkReceiptKeyPrefix,
   isReusableWorkReceipt,
   type WorkReceipt,
@@ -88,7 +101,10 @@ import {
   stringifyPostgresJson,
 } from './postgres-json';
 import { RECEIPT_STATUS_CODE, receiptStatusFromCode } from './receipt-status';
-import { WORK_RECEIPT_EXECUTION_LOCK_TABLE } from './work-receipt-storage-contract';
+import {
+  WORK_RECEIPT_EXECUTION_LOCK_TABLE,
+  RUNTIME_SHEET_WRITE_INTENT_RECEIPT_KIND,
+} from './work-receipt-storage-contract';
 import {
   workReceiptClaimableStatusCodes,
   workReceiptActiveOwnerPredicateSql,
@@ -103,6 +119,7 @@ import {
 } from './sheet-attempt-sql';
 import type { MapRowOutcome } from './durability-store';
 import { RUNTIME_CAPACITY_POLICY } from './runtime-capacity-policy';
+import type { RUNTIME_SHEET_ADMISSION_CAPABILITIES } from './runtime-operation-contract';
 import {
   normalizeRuntimeMapInputIndex,
   prepareRuntimeSheetRowsForJsonTransport,
@@ -562,7 +579,7 @@ type RuntimeApiActionRequest =
       runId?: string | null;
     }
   | {
-      action: 'runtime_sheet_start';
+      action: keyof typeof RUNTIME_SHEET_ADMISSION_CAPABILITIES;
       input: Parameters<typeof startRuntimeSheetDataset>[1];
     }
   | {
@@ -960,6 +977,17 @@ async function postRuntimeApi<TResponse>(
     ]
       .filter((value): value is string => Boolean(value))
       .join(', ');
+    if (
+      body.action === 'runtime_sheet_start_with_intent' &&
+      (response.status === 400 || response.status === 403) &&
+      (errorMessage === 'Unsupported runtime action capability scope.' ||
+        errorMessage === 'Unsupported runtime data-plane action.' ||
+        errorMessage === `Unsupported action: ${body.action}`)
+    ) {
+      throw new RuntimeSheetWriteIntentUnavailableError(
+        new Error(`${errorMessage} (${diagnosticContext}).`),
+      );
+    }
     throw new Error(
       details
         ? `${errorMessage} (${diagnosticContext}): ${details}`
@@ -989,7 +1017,8 @@ function runtimeApiRequestTimeoutMs(
   if (action === 'runtime_sheet_complete_map_rows') {
     return RUNTIME_SHEET_COMPLETION_REQUEST_TIMEOUT_MS;
   }
-  return action === 'runtime_sheet_start'
+  return action === 'runtime_sheet_start' ||
+    action === 'runtime_sheet_start_with_intent'
     ? RUNTIME_SHEET_ADMISSION_REQUEST_TIMEOUT_MS
     : RUNTIME_API_REQUEST_TIMEOUT_MS;
 }
@@ -3073,6 +3102,92 @@ async function mintRuntimeSheetWriteVersion(
   return value;
 }
 
+/**
+ * One run/table admits one write intent, independently of runner attempts and
+ * source pages. Publish its immutable scalar in the row-admission transaction:
+ * a lost response or checkpoint cannot turn a wake into newer customer intent.
+ * Older callers without the opt-in retain the existing allocation behavior.
+ */
+async function resolveRuntimeSheetWriteVersion(
+  client: RuntimeQueryClient,
+  session: RuntimePostgresSession,
+  input: Pick<
+    Parameters<typeof startRuntimeSheetDataset>[1],
+    'runId' | 'tableNamespace' | 'writeVersion' | 'stableWriteIntent'
+  >,
+): Promise<number> {
+  if (input.stableWriteIntent !== true) {
+    return await mintRuntimeSheetWriteVersion(
+      client,
+      session,
+      input.writeVersion,
+    );
+  }
+  const key = buildScopedWorkReceiptKey({
+    orgId: session.target.orgId,
+    playName: session.playName,
+    key: JSON.stringify([
+      RUNTIME_SHEET_WRITE_INTENT_RECEIPT_KIND,
+      input.runId,
+      normalizeTableNamespace(input.tableNamespace),
+    ]),
+  });
+  const keyHex = workReceiptKeyHex(key);
+  type WriteIntentReceipt = {
+    status: number;
+    run_id: string;
+    output: { writeVersion?: unknown } | null;
+  };
+  const read = async () => {
+    const { rows } = await client.query<WriteIntentReceipt>(
+      `SELECT status, run_id, output FROM ${workReceiptTable(session)} WHERE k = decode($1, 'hex')`,
+      [keyHex],
+    );
+    return rows[0];
+  };
+  let receipt = await read();
+  if (!receipt) {
+    const candidate = await mintRuntimeSheetWriteVersion(
+      client,
+      session,
+      input.writeVersion,
+    );
+    const { rows } = await client.query<WriteIntentReceipt>(
+      `INSERT INTO ${workReceiptTable(session)} (k, status, output, run_id)
+       VALUES (decode($1, 'hex'), $2::smallint, $3::jsonb, $4)
+       ON CONFLICT (k) DO NOTHING
+       RETURNING status, run_id, output`,
+      [
+        keyHex,
+        RECEIPT_STATUS_COMPLETED,
+        stringifyPostgresJson({ writeVersion: candidate }),
+        input.runId,
+      ],
+    );
+    // A conflicting INSERT may wait for its winner. A new statement is needed
+    // to see that commit under READ COMMITTED; never use the losing candidate.
+    receipt = rows[0] ?? (await read());
+  }
+  const version = receipt?.output?.writeVersion;
+  if (
+    receipt?.status !== RECEIPT_STATUS_COMPLETED ||
+    receipt.run_id !== input.runId ||
+    typeof version !== 'number' ||
+    !Number.isSafeInteger(version) ||
+    version <= 0
+  ) {
+    throw new Error(
+      'Runtime sheet write intent did not contain its admitted version.',
+    );
+  }
+  if (input.writeVersion != null && input.writeVersion !== version) {
+    throw new Error(
+      'Runtime sheet writeVersion disagrees with its admitted write intent.',
+    );
+  }
+  return version;
+}
+
 function parseRuntimeCellMeta(value: unknown): Record<string, unknown> {
   if (value && typeof value === 'object' && !Array.isArray(value)) {
     return value as Record<string, unknown>;
@@ -6558,6 +6673,14 @@ export async function skipRuntimeWorkReceipt(
   );
 }
 
+/**
+ * Prepare one dataset page and return its row dispositions and write version.
+ * With stableWriteIntent, the first admission for a run/table is durable in
+ * the same transaction as its rows; subsequent pages and wakes reuse it even
+ * after losing all runner-local state. A new run admits a newer intent.
+ * Gateway transport uses a named operation; an older receiver cannot silently
+ * ignore this opt-in or trigger unsafe legacy admission.
+ */
 export async function startRuntimeSheetDataset(
   context: RuntimeApiContext,
   input: {
@@ -6573,6 +6696,8 @@ export async function startRuntimeSheetDataset(
     attemptSeq?: number | null;
     attemptLeaseTtlMs?: number | null;
     writeVersion?: number | null;
+    /** Retain this run/table's first admission across pages, retries and wakes. Absence keeps legacy allocation. */
+    stableWriteIntent?: boolean;
     inputOffset?: number;
     force?: boolean;
     mode?: RuntimeSheetDatasetMode;
@@ -6582,7 +6707,12 @@ export async function startRuntimeSheetDataset(
 ): Promise<PrepareRuntimeSheetResult> {
   if (context.dbSessionStrategy === 'gateway_only') {
     return await postRuntimeApi<PrepareRuntimeSheetResult>(context, {
-      action: 'runtime_sheet_start',
+      // A named operation prevents an old gateway from silently ignoring the
+      // intent opt-in and re-admitting this run under a new version.
+      action:
+        input.stableWriteIntent === true
+          ? 'runtime_sheet_start_with_intent'
+          : 'runtime_sheet_start',
       input: { ...input, pendingRerunAdmission: true },
     });
   }
@@ -6738,10 +6868,10 @@ export async function startRuntimeSheetDataset(
         client,
         input.attemptLeaseTtlMs,
       );
-      const writeVersion = await mintRuntimeSheetWriteVersion(
+      const writeVersion = await resolveRuntimeSheetWriteVersion(
         client,
         session,
-        input.writeVersion,
+        input,
       );
       const columnTypes = await RuntimeSheetColumns.prepareWrite(client, {
         schema: session.postgres.schema,
@@ -7258,35 +7388,6 @@ type CompleteRuntimeMapRowChunksInput = {
   outputFields: string[];
 };
 
-/**
- * Why a terminal row write was rejected as stale. Runtime Sheet rows are fenced
- * by their schedule-time `_write_version` alone (the legacy attempt-lease
- * predicates are stubbed to TRUE/FALSE in sheet-attempt-sql.ts), so a stale
- * versioned write always means the row is owned by a different admission than
- * the one the writer carries:
- *  - `newer_write_version`: a later admission (rerun, resumed attempt, or a
- *    concurrent run of the same play) re-admitted the row after this writer
- *    admitted it.
- *  - `older_write_version`: the row was admitted under an older version than
- *    the writer sent; the writer's version never admitted this row.
- *  - `already_terminal`: an unversioned writer hit an already-enriched row.
- *    Nothing is being overwritten, so this is the one benign reason.
- *  - `unreported`: the gateway returned stale keys without reasons (predates
- *    this field). Treated as superseded: every stale versioned write is.
- */
-export type RuntimeMapRowsStaleReason =
-  | 'newer_write_version'
-  | 'older_write_version'
-  | 'already_terminal'
-  | 'unreported';
-
-export type RuntimeMapRowsStaleRow = {
-  key: string;
-  reason: RuntimeMapRowsStaleReason;
-  /** The admission version currently stamped on the sheet row. */
-  rowVersionStamp: number | null;
-};
-
 export type RuntimeMapRowsWriteResult = {
   /** Submitted row identities durably accepted, including idempotent replays. */
   committedKeys: string[];
@@ -7417,58 +7518,6 @@ export function supersededRuntimeMapRows(
   return superseded;
 }
 
-/**
- * A terminal write batch was explicitly marked as an attempt-wide
- * supersession. Retained for compatibility with older terminal-write handlers
- * and the Context's explicit `supersededKeys` stop signal. The current
- * runner-app writer reports ordinary stale latest-view rows without throwing
- * this error.
- */
-export class RuntimeSheetAttemptSupersededError extends Error {
-  readonly tableNamespace: string;
-  readonly runId: string;
-  readonly writeVersion: number | null;
-  readonly submittedRows: number;
-  readonly supersededRows: RuntimeMapRowsStaleRow[];
-
-  constructor(input: {
-    tableNamespace: string;
-    runId: string;
-    writeVersionValue: number | null;
-    submittedRows: number;
-    supersededRows: RuntimeMapRowsStaleRow[];
-  }) {
-    const reasonCounts = new Map<RuntimeMapRowsStaleReason, number>();
-    for (const row of input.supersededRows) {
-      reasonCounts.set(row.reason, (reasonCounts.get(row.reason) ?? 0) + 1);
-    }
-    const reasons = [...reasonCounts.entries()]
-      .map(([reason, count]) => `${reason}=${count}`)
-      .join(', ');
-    const samples = input.supersededRows
-      .slice(0, 5)
-      .map(
-        (row) =>
-          `key=${row.key} row_write_version=${row.rowVersionStamp ?? 'unknown'}`,
-      )
-      .join('; ');
-    super(
-      `RUNTIME_SHEET_ATTEMPT_SUPERSEDED: Runtime Sheet table "${input.tableNamespace}" ` +
-        `rejected ${input.supersededRows.length} of ${input.submittedRows} terminal row write(s) ` +
-        `from run ${input.runId} at write version ${input.writeVersionValue ?? 'none'} ` +
-        `because the rows are owned by a different write version (${reasons || 'unreported'}). ` +
-        `This attempt has been superseded by a newer admission of these rows and must stop ` +
-        `executing: nothing it persists from here on can be accepted. Sample: ${samples}.`,
-    );
-    this.name = 'RuntimeSheetAttemptSupersededError';
-    this.tableNamespace = input.tableNamespace;
-    this.runId = input.runId;
-    this.writeVersion = input.writeVersionValue;
-    this.submittedRows = input.submittedRows;
-    this.supersededRows = input.supersededRows;
-  }
-}
-
 export function isRuntimeSheetAttemptSupersededError(
   error: unknown,
 ): error is RuntimeSheetAttemptSupersededError {

package/dist/bundling-sources/shared_libs/play-runtime/runtime-authority.ts

@@ -11,6 +11,8 @@ import type { DirectCompletedTerminalContract } from './/scheduler-backends/term
 
 export type RuntimeAuthority = {
   executorToken: string;
+  /** Narrow credential for append-only Run Ledger projection from a leased outbox. */
+  runLedgerExecutorToken: string;
   descriptor: RuntimeAuthorityDescriptor;
 };
 
@@ -60,13 +62,25 @@ export function deriveAsyncChildRuntimeAuthority(input: {
 export async function mintPlayRunRuntimeAuthorityDescriptor(input: {
   descriptor: RuntimeAuthorityDescriptor;
   runtimeOrigin?: string | null;
+  /** Current immutable app receiver; absent retains legacy delivery grouping. */
+  runLedgerIngressPrefixOrigin?: string | null;
 }): Promise<RuntimeAuthority> {
-  return {
-    descriptor: input.descriptor,
-    executorToken: await mintWorkflowExecutorToken({
+  const [executorToken, runLedgerExecutorToken] = await Promise.all([
+    mintWorkflowExecutorToken({
       ...runtimeAuthorityMintInput(input.descriptor),
       runtimeOrigin: input.runtimeOrigin,
     }),
+    mintPlayRunAttemptRuntimeToken({
+      descriptor: input.descriptor,
+      capabilities: ['run.ledger.project'],
+      runtimeOrigin: input.runtimeOrigin,
+      runLedgerIngressPrefixOrigin: input.runLedgerIngressPrefixOrigin,
+    }),
+  ]);
+  return {
+    descriptor: input.descriptor,
+    executorToken,
+    runLedgerExecutorToken,
   };
 }
 
@@ -87,6 +101,7 @@ export async function mintPlayRunRuntimeAuthority(input: {
   /** Docflow rollout answer for the launching actor, resolved by the caller. */
   docflowEnabled?: boolean | null;
   runtimeOrigin?: string | null;
+  runLedgerIngressPrefixOrigin?: string | null;
 }): Promise<RuntimeAuthority> {
   const descriptor: RuntimeAuthorityDescriptor = {
     orgId: input.orgId,
@@ -110,6 +125,7 @@ export async function mintPlayRunRuntimeAuthority(input: {
   return await mintPlayRunRuntimeAuthorityDescriptor({
     descriptor,
     runtimeOrigin: input.runtimeOrigin,
+    runLedgerIngressPrefixOrigin: input.runLedgerIngressPrefixOrigin,
   });
 }
 
@@ -152,10 +168,12 @@ export async function mintPlayRunAttemptRuntimeToken(input: {
   terminalContract?: DirectCompletedTerminalContract | null;
   capabilities?: readonly RuntimeExecutionCapability[];
   runtimeOrigin?: string | null;
+  runLedgerIngressPrefixOrigin?: string | null;
 }): Promise<string> {
-  return await mintWorkflowExecutorToken(
-    runtimeAuthorityMintInput(input.descriptor, input),
-  );
+  return await mintWorkflowExecutorToken({
+    ...runtimeAuthorityMintInput(input.descriptor, input),
+    runLedgerIngressPrefixOrigin: input.runLedgerIngressPrefixOrigin,
+  });
 }
 
 /**

package/dist/bundling-sources/shared_libs/play-runtime/runtime-operation-contract.ts

@@ -4,6 +4,26 @@ import {
 } from '@deepline/deployed-contracts';
 import type { RuntimeExecutionCapability } from './execution-capabilities';
 
+/** Gateway sheet admission operations retain distinct old/new semantics. */
+export const RUNTIME_SHEET_ADMISSION_CAPABILITIES = {
+  runtime_sheet_start: 'sheet.write',
+  runtime_sheet_start_with_intent: 'sheet.write',
+} as const satisfies Readonly<Record<string, RuntimeExecutionCapability>>;
+
+export const RUNTIME_SHEET_ADMISSION_OPERATION_CONTRACT: DeployedOperationContract =
+  deployed.operation({
+    id: 'runtime-sheet-admission-actions',
+    actions: RUNTIME_SHEET_ADMISSION_CAPABILITIES,
+    olderReceiver: {
+      // A legacy start would mint newer intent after a wake or lost response.
+      // Refuse unsupported receivers before any row admission instead.
+      runtime_sheet_start_with_intent: {
+        kind: 'feature-unavailable',
+        code: 'RUNTIME_SHEET_WRITE_INTENT_UNAVAILABLE',
+      },
+    },
+  });
+
 /**
  * One declarative owner for the runtime action → authority relationship. The
  * route still owns authentication and execution; callers can add an action in
@@ -89,3 +109,39 @@ export function runtimeOperationCapability(
     ] ?? null
   );
 }
+
+/**
+ * Projection credentials permit only keyed outbox deliveries, never progress
+ * producers. Each accepted action still validates its key, run scope and live
+ * lease in the receiver before writing. Ordinary executor authority keeps the
+ * established action mapping. This policy is shared by preflight and dispatch,
+ * including every action in a batch.
+ */
+export function runtimeOperationCapabilityForRequest(
+  body: unknown,
+  capabilities: readonly string[] | null | undefined,
+): RuntimeExecutionCapability | null {
+  if (!body || typeof body !== 'object' || Array.isArray(body)) return null;
+  const request = body as Record<string, unknown>;
+  const action = request.action;
+  if (typeof action !== 'string') return null;
+  if (capabilities?.includes('run.ledger.project')) {
+    if (
+      capabilities.length !== 1 ||
+      ![
+        'project_run_events',
+        'project_run_created',
+        'append_run_events',
+        'start_run',
+      ].includes(action) ||
+      typeof request.idempotencyKey !== 'string' ||
+      !request.idempotencyKey.trim() ||
+      typeof request.deliveryLeaseOwner !== 'string' ||
+      !request.deliveryLeaseOwner.trim()
+    ) {
+      return null;
+    }
+    return 'run.ledger.project';
+  }
+  return runtimeOperationCapability(action);
+}

package/dist/bundling-sources/shared_libs/play-runtime/runtime-sheet-errors.ts

@@ -1,5 +1,18 @@
 import { resolveMapRowOutcomeKey } from './map-row-outcome';
 
+/** An older gateway cannot safely translate durable intent to legacy start. */
+export class RuntimeSheetWriteIntentUnavailableError extends Error {
+  readonly code = 'RUNTIME_SHEET_WRITE_INTENT_UNAVAILABLE';
+
+  constructor(cause: Error) {
+    super(
+      'Runtime Sheet write intent is unavailable on this gateway. Retry after the runtime rollout.',
+      { cause },
+    );
+    this.name = 'RuntimeSheetWriteIntentUnavailableError';
+  }
+}
+
 export interface RuntimeSheetBlockedRowDetail {
   rowKey: string | null;
   attemptId: string | null;
@@ -86,3 +99,84 @@ export class RuntimeSheetRowsBlockedError extends Error {
     this.blockedRowDetails = blockedRowDetails.slice(0, 20);
   }
 }
+
+/**
+ * Why a terminal row write was rejected as stale. Runtime Sheet rows are fenced
+ * by their schedule-time `_write_version` alone (the legacy attempt-lease
+ * predicates are stubbed to TRUE/FALSE in sheet-attempt-sql.ts), so a stale
+ * versioned write always means the row is owned by a different admission than
+ * the one the writer carries:
+ *  - `newer_write_version`: a later admission (a new run, or a legacy caller
+ *    that allocated again on resume) re-admitted the row after this writer
+ *    admitted it. Stable-intent callers retain their version through wakes.
+ *  - `older_write_version`: the row was admitted under an older version than
+ *    the writer sent; the writer's version never admitted this row.
+ *  - `already_terminal`: an unversioned writer hit an already-enriched row.
+ *    Nothing is being overwritten, so this is the one benign reason.
+ *  - `unreported`: the gateway returned stale keys without reasons (predates
+ *    this field). Treated as superseded: every stale versioned write is.
+ */
+export type RuntimeMapRowsStaleReason =
+  | 'newer_write_version'
+  | 'older_write_version'
+  | 'already_terminal'
+  | 'unreported';
+
+export type RuntimeMapRowsStaleRow = {
+  key: string;
+  reason: RuntimeMapRowsStaleReason;
+  /** The admission version currently stamped on the sheet row. */
+  rowVersionStamp: number | null;
+};
+
+/**
+ * A terminal write batch was explicitly marked as an attempt-wide
+ * supersession. Retained for compatibility with older terminal-write handlers
+ * and the Context's explicit `supersededKeys` stop signal. The current
+ * runner-app writer reports ordinary stale latest-view rows without throwing
+ * this error.
+ */
+export class RuntimeSheetAttemptSupersededError extends Error {
+  readonly tableNamespace: string;
+  readonly runId: string;
+  readonly writeVersion: number | null;
+  readonly submittedRows: number;
+  readonly supersededRows: RuntimeMapRowsStaleRow[];
+
+  constructor(input: {
+    tableNamespace: string;
+    runId: string;
+    writeVersionValue: number | null;
+    submittedRows: number;
+    supersededRows: RuntimeMapRowsStaleRow[];
+  }) {
+    const reasonCounts = new Map<RuntimeMapRowsStaleReason, number>();
+    for (const row of input.supersededRows) {
+      reasonCounts.set(row.reason, (reasonCounts.get(row.reason) ?? 0) + 1);
+    }
+    const reasons = [...reasonCounts.entries()]
+      .map(([reason, count]) => `${reason}=${count}`)
+      .join(', ');
+    const samples = input.supersededRows
+      .slice(0, 5)
+      .map(
+        (row) =>
+          `key=${row.key} row_write_version=${row.rowVersionStamp ?? 'unknown'}`,
+      )
+      .join('; ');
+    super(
+      `RUNTIME_SHEET_ATTEMPT_SUPERSEDED: Runtime Sheet table "${input.tableNamespace}" ` +
+        `rejected ${input.supersededRows.length} of ${input.submittedRows} terminal row write(s) ` +
+        `from run ${input.runId} at write version ${input.writeVersionValue ?? 'none'} ` +
+        `because the rows are owned by a different write version (${reasons || 'unreported'}). ` +
+        `This attempt has been superseded by a newer admission of these rows and must stop ` +
+        `executing: nothing it persists from here on can be accepted. Sample: ${samples}.`,
+    );
+    this.name = 'RuntimeSheetAttemptSupersededError';
+    this.tableNamespace = input.tableNamespace;
+    this.runId = input.runId;
+    this.writeVersion = input.writeVersionValue;
+    this.submittedRows = input.submittedRows;
+    this.supersededRows = input.supersededRows;
+  }
+}

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backend.ts

@@ -149,6 +149,8 @@ export type PlaySchedulerSubmitInput = RetainedPipelineCarrier & {
    */
   preloadedDbSessionUnwrapKey?: string | null;
   executorToken: string;
+  /** Optional run.progress-only authority minted at admission for ledger projection. */
+  runLedgerExecutorToken?: string | null;
   /** Immutable facts used by durable schedulers to mint a fresh leg token. */
   runtimeAuthority: RuntimeAuthorityDescriptor;
   /**

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/absurd-shared.ts

@@ -588,8 +588,11 @@ const absurdReadyPromises = new Map<string, Promise<void>>();
 /**
  * Verify, once per process (keyed by pool url + schema), the deployment-owned
  * Absurd schema contract and provision the shared queue with its policies.
- * Schema DDL belongs exclusively to the migration gate: a worker or Vercel
- * cold start may read this contract, but may never take the global bootstrap
+ * Worker startup owns hosted release queues; ordinary Vercel admission never
+ * calls this maintenance path. Local callers may prepare a queue lazily, and
+ * historic task recovery may prepare the run's original lane.
+ * Schema DDL belongs exclusively to the migration gate: startup or recovery
+ * may read this contract, but may never take the global bootstrap
  * lock. The memoized promise is shared; a failure evicts the cache so the next
  * caller retries loudly.
  */

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/absurd.ts

@@ -9,10 +9,9 @@
  * modules.
  *
  * Lifecycle:
- *   submit  → ensure schemas + queues → insert launch row (postgres) → spawn an
- *             absurd task (idempotencyKey=runId, orgKey=orgId) on `runs`.
- *             Persist the absurd task id
- *             on the run row so a later cancel can target it.
+ *   submit  → atomically insert launch row and spawn its absurd task on the
+ *             release queue prepared by worker startup. Non-Vercel callers
+ *             retain lazy queue setup for local app-before-worker startup.
  *   observe/result → reuse the postgres LISTEN/NOTIFY run handle.
  *   cancel  → commit the Absurd stop and a durable cancellation request;
  *             the worker deletes sandboxes before the final run write.
@@ -419,13 +418,21 @@ export function createAbsurdSchedulerBackend(
             queueDepth: permit.queueDepth,
             waitMs: permit.waitMs,
           });
-          await ensureAbsurdRuntimeReady(
-            poolOptions,
-            normalizedSchedulerOptions,
-            queueSuffix,
-            releaseId,
-          );
-          recordAbsurdSubmitPhase(input, 'schema_ready', submitStartedAt);
+          // Vercel only admits work. The release worker prepares its Absurd
+          // queue before it reports ready; repeating schema checks, queue
+          // inventory, cutover cleanup, and queue-policy writes in each cold
+          // admission isolate adds database round trips to the user's launch
+          // path. If the worker has not prepared the queue, the atomic submit
+          // below fails loudly and a webhook receipt remains retryable.
+          if (!process.env.VERCEL?.trim()) {
+            await ensureAbsurdRuntimeReady(
+              poolOptions,
+              normalizedSchedulerOptions,
+              queueSuffix,
+              releaseId,
+            );
+            recordAbsurdSubmitPhase(input, 'schema_ready', submitStartedAt);
+          }
 
           // Loud, structured submit log: the #1 way an absurd run silently hangs
           // is an app→worker queue-name mismatch (the shared preview app
@@ -480,6 +487,8 @@ export function createAbsurdSchedulerBackend(
         spawn = await withRuntimeSchedulerSubmitAdmission(
           admissionParams,
           async () => {
+            // Historic launches may outlive a physically reclaimed queue.
+            // Recovery retains its original-lane preparation on every host.
             await ensureAbsurdRuntimeReady(
               poolOptions,
               normalizedSchedulerOptions,