deepline 0.3.315 → 0.3.317

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres-progress.ts

@@ -1,4 +1,5 @@
 import { RUN_EVENT_KIND } from '../run-event-catalog';
+import { normalizeTableNamespace } from '../../plays/row-identity';
 /**
  * Live step/progress ledger reporting for Node runtime workers.
  *
@@ -109,7 +110,7 @@ export function buildOrderedNodeList(
   }));
 }
 
-/** Map logical dataset namespaces to their static-pipeline node IDs. */
+/** Keep authored node identity separate from the normalized Runtime Sheet namespace. */
 type StaticDatasetNodeRef = {
   nodeId: string;
   logicalNamespace: string;
@@ -129,10 +130,16 @@ function buildMapNodeLookup(
   for (let index = 0; index < substeps.length; index += 1) {
     const substep = substeps[index]!;
     if (substep.type !== 'dataset') continue;
-    const logicalNamespace =
-      substep.tableNamespace?.trim() || substep.field.trim();
+    const staticNamespace = substep.tableNamespace?.trim();
+    const logicalNamespace = staticNamespace || substep.field.trim();
     if (!logicalNamespace) continue;
-    lookup.set(logicalNamespace, {
+    // Literal dataset keys share the Runtime Sheet namespace contract. A legacy
+    // field-only label can be source-expression text, so retain its existing
+    // lookup behavior rather than validating or guessing a physical identity.
+    const lookupNamespace = staticNamespace
+      ? normalizeTableNamespace(staticNamespace)
+      : logicalNamespace;
+    lookup.set(lookupNamespace, {
       nodeId: getStaticSubstepNodeId(substep, index),
       logicalNamespace,
     });
@@ -140,6 +147,7 @@ function buildMapNodeLookup(
   return lookup;
 }
 
+/** Resolve normalized literal dataset namespaces to unchanged authored node IDs. */
 export function buildMapNodeIdLookup(
   contractSnapshot: unknown,
 ): Map<string, string> {
@@ -1219,23 +1227,21 @@ export function createPostgresSchedulerProgressReporter(input: {
     ) {
       mapsWithResolverActivity.delete(nodeId);
       stepLifecycle.onMapStarted(nodeId);
+      const failedRows = 'failedRows' in event ? (event.failedRows ?? 0) : 0;
+      const startedRows =
+        event.completedRows + failedRows + (event.supersededRows ?? 0);
       setNodeProgress(nodeId, {
         completed: event.completedRows,
-        failed: 0,
+        failed: failedRows,
         total: eventTotalRows,
         rowActivitySource: 'map_start',
         rowActivityStartedAt: event.at,
         rowActivityObservedAt: event.at,
-        startedRows: event.completedRows + (event.supersededRows ?? 0),
+        startedRows,
         activeRows: 0,
         waitingRows:
           typeof eventTotalRows === 'number'
-            ? Math.max(
-                0,
-                eventTotalRows -
-                  event.completedRows -
-                  (event.supersededRows ?? 0),
-              )
+            ? Math.max(0, eventTotalRows - startedRows)
             : undefined,
         completedRows: event.completedRows,
         ...(event.supersededRows !== undefined

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -32,7 +32,10 @@ import type {
   PlayRunnerResult,
   PlayRunnerRuntimeTiming,
 } from '../protocol';
-import { PROD_DEFAULT_RUNTIME_SCHEDULER_SCHEMA } from '../runtime-scheduler-topology';
+import {
+  normalizeRuntimeSchedulerSchema,
+  PROD_DEFAULT_RUNTIME_SCHEDULER_SCHEMA,
+} from '../runtime-scheduler-topology';
 import {
   RUNTIME_EVENT_CANONICAL_RETENTION_INDEX_READY_MARKER,
   RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD,
@@ -158,7 +161,10 @@ import {
   loadArtifactFromAppRuntime,
   loadStagedFileFromAppRuntime,
   projectRunCreatedViaAppRuntime,
+  readRuntimeApiDiagnosticHeader,
   startRunViaAppRuntime,
+  type RuntimeApiRequestAttempt,
+  type RuntimeApiResponseMeta,
   type StoredPlayArtifactPayload,
   type WorkerRuntimeApiContext,
 } from '../app-runtime-api';
@@ -19720,6 +19726,14 @@ export type RunLedgerOutboxDispatchInput = {
    * can take the same row immediately under the same idempotency key.
    */
   signal?: AbortSignal;
+  /**
+   * Told once when an attempt abandoned by `signal` has handed back the lease
+   * it took: `true` when the owner-fenced release statement completed (a
+   * release that matched no row counts, since nothing is then held), `false`
+   * when it could not run and the lease is left to expire. Not called when
+   * the attempt never took a lease. Never affects delivery.
+   */
+  onAbortedLeaseRelease?: (released: boolean) => void;
   /**
    * Observation hook for acknowledged rows (event type and commit-to-ack lag
    * measured on the database clock). Never affects delivery.
@@ -20076,7 +20090,45 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       });
     }
   };
+  // The claim can be invoked more than once for one dispatch: the pool
+  // re-runs a checkout's operation after a connection failure, and the claim
+  // itself is retried once on the missing-marker compatibility path.
+  let claimInvocations = 0;
+  // An abandoned attempt that already handed its lease back on a checkout it
+  // held does not spend another checkout on the same release.
+  const abandonedLease = { released: false };
   const claimEvents = async (client: PostgresSchedulerQueryClient) => {
+    claimInvocations += 1;
+    const abandonedHeadEventId = input.headEventId?.trim();
+    if (
+      input.signal?.aborted &&
+      (claimInvocations === 1 || abandonedHeadEventId)
+    ) {
+      // The caller's deadline elapsed while this checkout was queued. Its
+      // attempt is already abandoned, so taking a lease now could only keep
+      // the durable projector off the row until that lease expires. Claim
+      // nothing: the row stays pending and unleased for its next owner.
+      if (claimInvocations > 1 && abandonedHeadEventId) {
+        // An earlier invocation's COMMIT may have reached the server before
+        // its connection failed, so this owner can already hold the named
+        // head. Hand it back here, fenced to this owner; returning empty
+        // would leave that lease with nobody to release it. After a rolled
+        // back invocation it matches no row. A failure propagates, so the
+        // attempt is never reported as settled.
+        await releasePostgresSchedulerOutboxLease(
+          client,
+          [abandonedHeadEventId],
+          { ...options, leaseOwner },
+        );
+      }
+      const unclaimed: {
+        events: PostgresSchedulerOutboxEvent[];
+        launchJson: unknown;
+      } = { events: [], launchJson: undefined };
+      return unclaimed;
+    }
+    // A re-invocation with no named head claims again under the same owner,
+    // as it always has; the abort check after the claim releases by id.
     // The checkout is exclusive. Hold the existing scheduler run's row lock
     // only while choosing/claiming its outbox prefix, never over HTTP. A
     // second statement takes a fresh READ COMMITTED snapshot after the lock:
@@ -20271,6 +20323,26 @@ async function dispatchRunLedgerOutboxBatchWithScope(
   let authorityReadyAtMs: number | null = null;
   let appendFinishedAtMs: number | null = null;
   let acknowledgedAtMs: number | null = null;
+  // How this delivery obtained its app authority, for the slow-delivery
+  // record only. `token` is set only when the dispatch-token endpoint was
+  // actually consulted; a token pre-minted at admission and an authority
+  // reused within the drain make no such request.
+  const authorityObserved: {
+    token: RunLedgerDispatchTokenObservation | null;
+    reusedWithinDrain: boolean;
+  } = { token: null, reusedWithinDrain: false };
+  // Platform identity of the slowest append response, for the same record.
+  // Null when no append was answered or its receiver sent no such header.
+  let appendResponse:
+    | (RunLedgerDispatchResponseTrace & { roundTripMs: number | null })
+    | null = null;
+  const callerOnResponseMeta = input.runtimeApi?.onResponseMeta;
+  // The last append attempt sent, named even when it never gets a response
+  // (an append aborted at the caller's deadline has no response to read).
+  const appendAttempt: { transportAttemptId: string | null } = {
+    transportAttemptId: null,
+  };
+  const callerOnRequestAttempt = input.runtimeApi?.onRequestAttempt;
   const materializeDeferredObservability = async () => {
     if (
       events.some(
@@ -20398,6 +20470,10 @@ async function dispatchRunLedgerOutboxBatchWithScope(
     return null;
   };
   try {
+    // A deadline that elapsed during the claim abandons the attempt before
+    // any authority or renewal work. The abort branch below hands the lease
+    // straight back without charging a projection attempt.
+    input.signal?.throwIfAborted();
     // The ledger converter rejects raw deferred facts. Inline callers hand
     // them off; the background owner projects them before inspecting the
     // compact lifecycle payload or deciding that it needs no HTTP append.
@@ -20469,6 +20545,11 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         ),
       ) + RUNTIME_RELIABILITY_POLICY.schedulerDatabase.queryTimeoutMs;
     const cachedAuthority = authorityScope.authority;
+    const observeDispatchTokenResponse = (
+      observation: RunLedgerDispatchTokenObservation,
+    ) => {
+      authorityObserved.token = observation;
+    };
     const resolveRunRuntimeApi = () =>
       launchJson !== null
         ? resolvePostgresSchedulerRuntimeApiForRun(
@@ -20480,6 +20561,8 @@ async function dispatchRunLedgerOutboxBatchWithScope(
             tokenAuthority,
             options,
             input.runtimeApi?.signal,
+            reuseMarginMs,
+            observeDispatchTokenResponse,
           )
         : loadPostgresSchedulerRuntimeApiForRun(
             withClient,
@@ -20490,6 +20573,8 @@ async function dispatchRunLedgerOutboxBatchWithScope(
             tokenAuthority,
             options,
             input.runtimeApi?.signal,
+            reuseMarginMs,
+            observeDispatchTokenResponse,
           );
     const gatewayRuntimeApi =
       needsRuntimeApi && tokenAuthority === 'gateway'
@@ -20500,6 +20585,11 @@ async function dispatchRunLedgerOutboxBatchWithScope(
           ? cachedAuthority.runtimeApi
           : await resolveRunRuntimeApi()
         : null;
+    // Read-only: an authority carried over from an earlier prefix of this
+    // drain made no request for this delivery.
+    authorityObserved.reusedWithinDrain =
+      gatewayRuntimeApi !== null &&
+      gatewayRuntimeApi === cachedAuthority?.runtimeApi;
     if (
       gatewayRuntimeApi &&
       cachedAuthority?.runId === first.runId &&
@@ -20537,6 +20627,27 @@ async function dispatchRunLedgerOutboxBatchWithScope(
                 : {}),
             }
           : {}),
+        // Keep the slowest append response's platform identity for the
+        // slow-delivery record, then hand the caller's own observer the same
+        // meta it always received. Observation never affects delivery.
+        onResponseMeta: (meta: RuntimeApiResponseMeta) => {
+          const roundTripMs = meta.roundTripMs ?? null;
+          if (
+            appendResponse === null ||
+            (roundTripMs ?? 0) >= (appendResponse.roundTripMs ?? 0)
+          ) {
+            appendResponse = {
+              platformRequestId: meta.platformRequestId ?? null,
+              serverTimingHeader: meta.serverTimingHeader ?? null,
+              roundTripMs,
+            };
+          }
+          callerOnResponseMeta?.(meta);
+        },
+        onRequestAttempt: (attempt: RuntimeApiRequestAttempt) => {
+          appendAttempt.transportAttemptId = attempt.transportAttemptId;
+          callerOnRequestAttempt?.(attempt);
+        },
         retryPolicy: 'none' as const,
         // The caller-owned admission deadline (see `signal` above) wins.
         ...(input.signal ? { signal: input.signal } : {}),
@@ -20645,6 +20756,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
           tokenAuthority,
           options,
           runtimeApi.signal,
+          reuseMarginMs,
         );
         if (refreshed.baseUrl !== runtimeApi.baseUrl) {
           throw new Error(
@@ -20663,11 +20775,22 @@ async function dispatchRunLedgerOutboxBatchWithScope(
           expiresAtMs: runtimeApiTokenExpiresAtMs(runtimeApi.executorToken),
         };
       }
-      await withClient((client) =>
-        renewPostgresRunLedgerDelivery(
+      const renewed = await withClient(async (client) => {
+        const eventIds = events.map((event) => event.eventId);
+        if (input.signal?.aborted) {
+          // The caller's deadline elapsed while this checkout was queued.
+          // Renewing now would extend an abandoned attempt's lease by a full
+          // term. Hand it back on this same checkout instead.
+          await releasePostgresSchedulerOutboxLease(client, eventIds, {
+            ...options,
+            leaseOwner,
+          });
+          return false;
+        }
+        await renewPostgresRunLedgerDelivery(
           client,
           {
-            eventIds: events.map((event) => event.eventId),
+            eventIds,
             leaseOwner,
             leaseSeconds: input.leaseSeconds ?? 120,
             freezeReceipt:
@@ -20678,8 +20801,14 @@ async function dispatchRunLedgerOutboxBatchWithScope(
               ),
           },
           options,
-        ),
-      );
+        );
+        return true;
+      });
+      if (!renewed) {
+        abandonedLease.released = true;
+        // Stop before the append; the abort branch below reports the outcome.
+        input.signal?.throwIfAborted();
+      }
     };
     if (needsRuntimeApi && runtimeApi) {
       const append = async (runtimeApi: WorkerRuntimeApiContext) => {
@@ -20826,28 +20955,41 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       // replay carries the same idempotency key and is a no-op there.
       const eventIds = events.map((event) => event.eventId);
       let released: string[];
-      try {
-        released = await withClient(
-          (client) =>
-            releasePostgresSchedulerOutboxLease(client, eventIds, {
-              ...options,
-              leaseOwner,
-            }),
-          {
-            runId: events[0]!.runId,
-            phase: 'run_ledger_outbox_lease_release',
-            priority: 'critical',
-          },
-        );
-      } catch (settlementError) {
-        logRunLedgerOutboxSettlementFailure({
-          runId: events[0]!.runId,
-          eventIds,
-          stage: 'aborted_release',
-          settlementError,
-          deliveryError: error,
-        });
+      let releaseLanded = abandonedLease.released;
+      if (releaseLanded) {
+        // The renewal checkout already handed the lease back.
         released = eventIds;
+      } else {
+        try {
+          released = await withClient(
+            (client) =>
+              releasePostgresSchedulerOutboxLease(client, eventIds, {
+                ...options,
+                leaseOwner,
+              }),
+            {
+              runId: events[0]!.runId,
+              phase: 'run_ledger_outbox_lease_release',
+              priority: 'critical',
+            },
+          );
+          releaseLanded = true;
+        } catch (settlementError) {
+          logRunLedgerOutboxSettlementFailure({
+            runId: events[0]!.runId,
+            eventIds,
+            stage: 'aborted_release',
+            settlementError,
+            deliveryError: error,
+          });
+          released = eventIds;
+        }
+      }
+      try {
+        // The caller must not read a failed release as a settled lease.
+        input.onAbortedLeaseRelease?.(releaseLanded);
+      } catch {
+        // Observation must never affect durable delivery.
       }
       return {
         attempted: events.length,
@@ -21030,6 +21172,19 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         continuationMs:
           acknowledgedAtMs === null ? null : settledAtMs - acknowledgedAtMs,
         durationMs: settledAtMs - dispatchStartedAtMs,
+        // Which platform requests served the two app hops, so a slow
+        // authority or append stage can be found in the app's request log.
+        ...runLedgerSlowDeliveryResponseFields(
+          runLedgerDeliveryAuthoritySource({
+            authorityReady: authorityReadyAtMs !== null,
+            tokenAuthority,
+            reusedWithinDrain: authorityObserved.reusedWithinDrain,
+            token: authorityObserved.token,
+          }),
+          authorityObserved.token?.trace ?? null,
+          appendResponse,
+          appendAttempt.transportAttemptId,
+        ),
       });
     }
   }
@@ -21373,6 +21528,10 @@ async function resolvePostgresSchedulerRuntimeApiForRun(
   tokenAuthority: RunLedgerOutboxTokenAuthority,
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
   signal?: AbortSignal,
+  tokenReuseMarginMs = 0,
+  onDispatchTokenResponse?: (
+    observation: RunLedgerDispatchTokenObservation,
+  ) => void,
 ): Promise<
   WorkerRuntimeApiContext & {
     refreshExecutorToken?: () => Promise<string>;
@@ -21414,18 +21573,45 @@ async function resolvePostgresSchedulerRuntimeApiForRun(
       schedulerSchema: options?.schema ?? null,
       signal,
     };
-    const dispatchAuthority =
-      await requestRunLedgerDispatchToken(dispatchRequest);
-    invalidateExecutorToken = () =>
-      runLedgerDispatchTokens.delete(dispatchAuthority.cacheKey);
-    if (dispatchAuthority.reused) {
+    const preMintedToken = usableRunLedgerExecutorToken(
+      launch,
+      tokenReuseMarginMs,
+      options,
+    );
+    if (preMintedToken) {
+      // Admission minted this token with only `run.ledger.project`.
+      // Each projection request still proves its exact outbox lease at the
+      // receiver, and the scheduler ACK remains fenced to that same lease.
+      executorToken = preMintedToken.executorToken;
+      // The issuer advertises its own immutable receiver in the signed token.
+      // Merely targeting an immutable URL never proves receipt support.
+      runLedgerIngressPrefixBatching =
+        preMintedToken.runLedgerIngressPrefixBatching;
       refreshExecutorToken = async () =>
         (await requestRunLedgerDispatchToken(dispatchRequest, true))
           .executorToken;
+    } else {
+      const dispatchAuthority =
+        await requestRunLedgerDispatchToken(dispatchRequest);
+      try {
+        onDispatchTokenResponse?.({
+          reused: dispatchAuthority.reused,
+          trace: dispatchAuthority.responseTrace ?? null,
+        });
+      } catch {
+        // Observation must never affect durable delivery.
+      }
+      invalidateExecutorToken = () =>
+        runLedgerDispatchTokens.delete(dispatchAuthority.cacheKey);
+      if (dispatchAuthority.reused) {
+        refreshExecutorToken = async () =>
+          (await requestRunLedgerDispatchToken(dispatchRequest, true))
+            .executorToken;
+      }
+      executorToken = dispatchAuthority.executorToken;
+      runLedgerIngressPrefixBatching =
+        dispatchAuthority.runLedgerIngressPrefixBatching;
     }
-    executorToken = dispatchAuthority.executorToken;
-    runLedgerIngressPrefixBatching =
-      dispatchAuthority.runLedgerIngressPrefixBatching;
   }
   return {
     baseUrl: runtimeApiBaseUrlFromLaunch(launch),
@@ -21448,6 +21634,10 @@ async function loadPostgresSchedulerRuntimeApiForRun(
   tokenAuthority: RunLedgerOutboxTokenAuthority,
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
   signal?: AbortSignal,
+  tokenReuseMarginMs = 0,
+  onDispatchTokenResponse?: (
+    observation: RunLedgerDispatchTokenObservation,
+  ) => void,
 ): ReturnType<typeof resolvePostgresSchedulerRuntimeApiForRun> {
   // A continuation already owns its next event lease, so its launch context
   // is not part of the preclaim result. Load only the authority fields here.
@@ -21467,9 +21657,168 @@ async function loadPostgresSchedulerRuntimeApiForRun(
     tokenAuthority,
     options,
     signal,
+    tokenReuseMarginMs,
+    onDispatchTokenResponse,
   );
 }
 
+/**
+ * Platform identity of one app response on the Run Ledger delivery path
+ * (`x-vercel-id` and the raw `Server-Timing` header, both bounded). It exists
+ * only to label the `[run-ledger-outbox.slow_delivery]` log record. It carries
+ * no credential and no run, org, or customer identifier, and it must never be
+ * written to a run, status, or receipt document.
+ */
+type RunLedgerDispatchResponseTrace = {
+  platformRequestId: string | null;
+  serverTimingHeader: string | null;
+};
+
+/**
+ * What one consultation of the dispatch-token endpoint returned: a token
+ * reused from this process's cache (`reused`, no request made, so no trace)
+ * or a fresh response. Reported only where that endpoint is consulted, never
+ * for a token pre-minted at admission.
+ */
+type RunLedgerDispatchTokenObservation = {
+  reused: boolean;
+  trace: RunLedgerDispatchResponseTrace | null;
+};
+
+/**
+ * Where a delivery's app authority came from, for the slow-delivery record:
+ * - `requested`: a dispatch-token request was made for this delivery, so
+ *   `authorityRequestId` names it when the receiver sent a platform id.
+ * - `cached`: a dispatch token reused from this process or this drain.
+ * - `pre_minted`: the run's admission-minted projection token.
+ * - `local`: signed in-process or supplied by the caller.
+ * Only `requested` makes an authority request; for every other source a null
+ * `authorityRequestId` means no request happened, not a missing header.
+ * `null` means the delivery ended before it had an authority.
+ */
+type RunLedgerDeliveryAuthoritySource =
+  | 'requested'
+  | 'cached'
+  | 'pre_minted'
+  | 'local';
+
+function runLedgerDeliveryAuthoritySource(input: {
+  authorityReady: boolean;
+  tokenAuthority: RunLedgerOutboxTokenAuthority;
+  reusedWithinDrain: boolean;
+  token: RunLedgerDispatchTokenObservation | null;
+}): RunLedgerDeliveryAuthoritySource | null {
+  if (!input.authorityReady) return null;
+  if (input.tokenAuthority !== 'gateway') return 'local';
+  if (input.token) return input.token.reused ? 'cached' : 'requested';
+  return input.reusedWithinDrain ? 'cached' : 'pre_minted';
+}
+
+function runLedgerSlowDeliveryResponseFields(
+  authoritySource: RunLedgerDeliveryAuthoritySource | null,
+  authority: RunLedgerDispatchResponseTrace | null,
+  append:
+    | (RunLedgerDispatchResponseTrace & { roundTripMs: number | null })
+    | null,
+  appendTransportAttemptId: string | null,
+): {
+  authoritySource: RunLedgerDeliveryAuthoritySource | null;
+  authorityRequestId: string | null;
+  authorityServerTiming: string | null;
+  appendRequestId: string | null;
+  appendServerTiming: string | null;
+  appendRoundTripMs: number | null;
+  appendTransportAttemptId: string | null;
+} {
+  return {
+    authoritySource,
+    authorityRequestId: authority?.platformRequestId ?? null,
+    authorityServerTiming: authority?.serverTimingHeader ?? null,
+    appendRequestId: append?.platformRequestId ?? null,
+    appendServerTiming: append?.serverTimingHeader ?? null,
+    appendRoundTripMs: append?.roundTripMs ?? null,
+    // The id this delivery sent in its last append request's
+    // transport-attempt header. Unlike the response fields above it is set
+    // even when that request was aborted or never answered.
+    appendTransportAttemptId,
+  };
+}
+
+/**
+ * Admission persists an optional, run-scoped `run.ledger.project` token for the
+ * worker's terminal fast path. Treat it as usable only when its decoded claims
+ * match the exact durable launch contract and it has enough time left for a
+ * complete projection. The app runtime still verifies the signature, action
+ * capability, and live outbox lease before writing; a mismatch falls back to
+ * the lease-validated mint endpoint. Prefix grouping additionally requires the
+ * issuer's explicit advertisement to match the launch's immutable receiver;
+ * its absence preserves legacy grouping without discarding the usable token.
+ */
+function usableRunLedgerExecutorToken(
+  launch: RunLedgerDispatchLaunch,
+  reuseMarginMs: number,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): {
+  executorToken: string;
+  runLedgerIngressPrefixBatching?: true;
+} | null {
+  const token = launch.runLedgerExecutorToken;
+  if (!token || typeof token !== 'string') return null;
+
+  try {
+    const claims = decodeJwt(token) as Record<string, unknown>;
+    const authority = launch.runtimeAuthority;
+    if (!authority || typeof authority !== 'object') return null;
+
+    const expiresAtMs =
+      typeof claims.exp === 'number' &&
+      Number.isSafeInteger(claims.exp) &&
+      Number.isSafeInteger(claims.exp * 1_000)
+        ? claims.exp * 1_000
+        : null;
+    const expectedOrigin = new URL(runtimeTokenOriginFromLaunch(launch)).origin;
+    const expectedSchedulerSchema = normalizeRuntimeSchedulerSchema(
+      authority.schedulerSchema,
+    );
+    const requestedSchedulerSchema = normalizeRuntimeSchedulerSchema(
+      options?.schema,
+    );
+
+    if (
+      expiresAtMs === null ||
+      expiresAtMs <= Date.now() + reuseMarginMs ||
+      claims.iss !== 'deepline.internal' ||
+      claims.aud !== 'deepline.workflow.execution' ||
+      claims.purpose !== 'workflow_run_execution' ||
+      claims.org_id !== launch.orgId ||
+      claims.org_id !== authority.orgId ||
+      claims.run_id !== launch.runId ||
+      claims.run_id !== authority.runId ||
+      claims.workflow_id !== authority.workflowId ||
+      claims.runtime_origin !== expectedOrigin ||
+      normalizeRuntimeSchedulerSchema(claims.scheduler_schema) !==
+        expectedSchedulerSchema ||
+      (requestedSchedulerSchema !== null &&
+        requestedSchedulerSchema !== expectedSchedulerSchema) ||
+      !Array.isArray(claims.capabilities) ||
+      claims.capabilities.length !== 1 ||
+      claims.capabilities[0] !== 'run.ledger.project'
+    ) {
+      return null;
+    }
+    const receiverOrigin = new URL(runtimeApiBaseUrlFromLaunch(launch)).origin;
+    return {
+      executorToken: token,
+      ...(claims.run_ledger_ingress_prefix_origin === receiverOrigin &&
+      isImmutableRuntimeExecutionRecoveryOrigin(receiverOrigin)
+        ? { runLedgerIngressPrefixBatching: true as const }
+        : {}),
+    };
+  } catch {
+    return null;
+  }
+}
+
 // Reuse only gateway-issued run.progress authority. A prefix advertisement
 // remains reusable only for the same immutable app build; mutable receivers
 // must reacquire their current receipt shape on every drain. Every delivery
@@ -21497,6 +21846,8 @@ async function requestRunLedgerDispatchToken(
   reused: boolean;
   cacheKey: string;
   runLedgerIngressPrefixBatching?: true;
+  /** Present only when this call made the request (never for a reused token). */
+  responseTrace?: RunLedgerDispatchResponseTrace;
 }> {
   const internalToken = process.env.DEEPLINE_INTERNAL_TOKEN?.trim();
   if (!internalToken || !input.eventId || !input.leaseOwner) {
@@ -21647,6 +21998,16 @@ async function requestRunLedgerDispatchToken(
     ...(body.runLedgerIngressPrefixBatching === true
       ? { runLedgerIngressPrefixBatching: true as const }
       : {}),
+    responseTrace: {
+      platformRequestId: readRuntimeApiDiagnosticHeader(
+        response.headers,
+        'x-vercel-id',
+      ),
+      serverTimingHeader: readRuntimeApiDiagnosticHeader(
+        response.headers,
+        'server-timing',
+      ),
+    },
   };
 }
 

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/run-ledger-dispatch-authority.ts

@@ -12,6 +12,7 @@ export type RunLedgerDispatchLaunch = Pick<
   | 'playId'
   | 'playName'
   | 'executorToken'
+  | 'runLedgerExecutorToken'
   | 'baseUrl'
   | 'runtimeApiBaseUrl'
   | 'runtimeTokenOrigin'
@@ -27,6 +28,7 @@ export function runLedgerDispatchLaunchSql(alias: string): string {
     'playId',
     'playName',
     'executorToken',
+    'runLedgerExecutorToken',
     'baseUrl',
     'runtimeApiBaseUrl',
     'runtimeTokenOrigin',