deepline 0.3.409 → 0.3.411

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -289,6 +289,7 @@ const POSTGRES_SCHEDULER_SCHEMA_INIT_ADVISORY_LOCK_NAMESPACE = 0x44505349;
 const POSTGRES_SCHEDULER_SCHEMA_INIT_ADVISORY_LOCK_SEED =
   'deepline:runtime-scheduler:schema-init:v1';
 const POSTGRES_SCHEDULER_RELEASE_ADMISSION_LOCK_NAMESPACE = 0x44505241;
+const POSTGRES_SCHEDULER_ADMISSION_LOCK_TIMEOUT_MS = 5_000;
 const POSTGRES_SCHEDULER_SCHEMA_INIT_STATEMENT_TIMEOUT_MS = 60_000;
 /**
  * Every new scheduler DDL migration must bump this version. Runtime callers
@@ -4707,6 +4708,7 @@ function absurdSchemaInitAdvisoryLockKey(): readonly [number, number] {
  */
 export async function ensureAbsurdSchema(
   client: PostgresSchedulerQueryClient,
+  options: { refreshClaimBody?: boolean } = {},
 ): Promise<void> {
   const [lockClassId, lockObjectId] = absurdSchemaInitAdvisoryLockKey();
   let stage = 'begin transaction';
@@ -4760,9 +4762,28 @@ export async function ensureAbsurdSchema(
               `SELECT absurd.deepline_no_scheduler_org_cap_compatibility_version() AS v`,
             )
           : null;
+        // Only the explicit deployment migration reconciles equivalent bodies.
+        // Runtime readiness keeps the same ABI marker and remains read-only.
+        let claimBodyCurrent = true;
+        if (options.refreshClaimBody) {
+          stage = 'compare Absurd claim function body';
+          const sql = readAbsurdSchemaNoSchedulerOrgCapCompatibilitySql();
+          const start = sql.indexOf('as $$');
+          const end = sql.lastIndexOf('$$');
+          if (start < 0 || end <= start) {
+            throw new Error('Absurd claim body delimiters are malformed.');
+          }
+          const body = await client.query<{ current: boolean }>(
+            `SELECT prosrc = $1::text AS current FROM pg_proc
+             WHERE oid = to_regprocedure('absurd.claim_task(text,text,integer,integer)')`,
+            [sql.slice(start + 'as $$'.length, end)],
+          );
+          claimBodyCurrent = body.rows[0]?.current === true;
+        }
         if (
+          !claimBodyCurrent ||
           markerVersion?.rows[0]?.v !==
-          ABSURD_NO_SCHEDULER_ORG_CAP_COMPATIBILITY_VERSION
+            ABSURD_NO_SCHEDULER_ORG_CAP_COMPATIBILITY_VERSION
         ) {
           stage = 'apply Absurd no-org-cap compatibility function patch';
           await client.query(
@@ -5147,7 +5168,17 @@ async function submitPostgresSchedulerRunTransaction(
     existing_launch_json: unknown | null;
   }>(
     `
-      WITH run_lock AS MATERIALIZED (
+      WITH admission_lock_timeout AS MATERIALIZED (
+        -- This single-statement admission can wait on run, release, or row
+        -- locks. Bound that wait inside the same implicit transaction; the
+        -- dependency below applies it before acquiring the first lock, and
+        -- transaction-local scope cannot leak through PgBouncer.
+        SELECT set_config(
+          'lock_timeout',
+          '${POSTGRES_SCHEDULER_ADMISSION_LOCK_TIMEOUT_MS}ms',
+          true
+        )
+      ), run_lock AS MATERIALIZED (
         -- A run id is a global job key, not a release-local key. Serialize it
         -- before inspecting the runs table so two app releases cannot each
         -- spawn the
@@ -5158,6 +5189,7 @@ async function submitPostgresSchedulerRunTransaction(
             'run:' || $1::text
           )
         )
+        FROM admission_lock_timeout
       ), admission_lock AS (
         SELECT pg_advisory_xact_lock_shared(
           ${POSTGRES_SCHEDULER_RELEASE_ADMISSION_LOCK_NAMESPACE},
@@ -7082,33 +7114,23 @@ export type PostgresSchedulerRunLaneState = {
   laneClaiming: boolean;
 };
 
-/**
- * One transactional read of everything the lane guard needs about a claimed
- * run: which lane owns it, whether that lane still claims, and whether the run
- * is parked in a wait a newer lane may adopt.
- *
- * The scheduler run row — not the engine task row — is the authority on "parked
- * in a durable wait". The engine cannot tell a durable suspension from a retry
- * backoff or a capacity `DeferTask`, all of which sit in `sleeping`.
- */
-export async function readPostgresSchedulerRunLaneState(
-  client: PostgresSchedulerQueryClient,
-  input: { runId: string },
+type RunLaneStateRow = {
+  release_id: string | null;
+  environment: string;
+  status: string;
+  wait_kind: string | null;
+  parked: boolean;
+  lane_claiming: boolean | null;
+};
+
+/** The lane prefix is bound as $2 by both readers of this projection. */
+function runLaneStateSelectionSql(
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
-): Promise<PostgresSchedulerRunLaneState | null> {
+): string {
   const adoptableKinds = POSTGRES_SCHEDULER_ADOPTABLE_WAIT_KINDS.map(
     (kind) => `'${kind}'`,
   ).join(', ');
-  const result = await client.query<{
-    release_id: string | null;
-    environment: string;
-    status: string;
-    wait_kind: string | null;
-    parked: boolean;
-    lane_claiming: boolean | null;
-  }>(
-    `
-      SELECT
+  return `
         nullif(btrim(runs.launch_json ->> 'absurdReleaseId'), '') AS release_id,
         coalesce(
           nullif(btrim(runs.launch_json ->> 'absurdReleaseEnvironment'), ''),
@@ -7141,14 +7163,12 @@ export async function readPostgresSchedulerRunLaneState(
                    )
                 || ':'
                 || nullif(btrim(runs.launch_json ->> 'absurdReleaseId'), '')
-        ) AS lane_claiming
-      FROM ${tableName('runs', options)} AS runs
-      WHERE runs.run_id = $1
-    `,
-    [input.runId, POSTGRES_SCHEDULER_RELEASE_CLAIMING_CONTROL_PREFIX],
-  );
-  const row = result.rows[0];
-  if (!row) return null;
+        ) AS lane_claiming`;
+}
+
+function runLaneStateFromRow(
+  row: RunLaneStateRow,
+): PostgresSchedulerRunLaneState {
   return {
     releaseId: row.release_id,
     environment: row.environment === 'preview' ? 'preview' : 'production',
@@ -7159,6 +7179,32 @@ export async function readPostgresSchedulerRunLaneState(
   };
 }
 
+/**
+ * One transactional read of everything the lane guard needs about a claimed
+ * run: which lane owns it, whether that lane still claims, and whether the run
+ * is parked in a wait a newer lane may adopt.
+ *
+ * The scheduler run row — not the engine task row — is the authority on "parked
+ * in a durable wait". The engine cannot tell a durable suspension from a retry
+ * backoff or a capacity `DeferTask`, all of which sit in `sleeping`.
+ */
+export async function readPostgresSchedulerRunLaneState(
+  client: PostgresSchedulerQueryClient,
+  input: { runId: string },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<PostgresSchedulerRunLaneState | null> {
+  const result = await client.query<RunLaneStateRow>(
+    `
+      SELECT ${runLaneStateSelectionSql(options)}
+      FROM ${tableName('runs', options)} AS runs
+      WHERE runs.run_id = $1
+    `,
+    [input.runId, POSTGRES_SCHEDULER_RELEASE_CLAIMING_CONTROL_PREFIX],
+  );
+  const row = result.rows[0];
+  return row ? runLaneStateFromRow(row) : null;
+}
+
 /**
  * Discover the lanes whose parked durable waits the caller may adopt: lanes
  * that have explicitly stopped claiming AND still hold at least one adoptable
@@ -7259,21 +7305,30 @@ export async function assignPostgresSchedulerRunAttempt(
     runId: string;
     attempt: number;
     taskToken: string;
+    /** Persist cleanup ownership in the same fenced write as a fresh claim. */
+    initialRuntimeResource?: unknown;
   },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<{
   checkpoint?: unknown;
   suspension?: unknown;
   firstClaimLatencyMs?: number;
+  initialRuntimeResourcePersisted: boolean;
 } | null> {
   const assigned = await client.query<{
     checkpoint_json: unknown;
     suspension_json: unknown;
     first_claim_latency_ms: string | null;
+    initial_runtime_resource_persisted: boolean;
   }>(
     `
       WITH locked_run AS MATERIALIZED (
-        SELECT runs.run_id, runs.started_at, runs.status
+        SELECT
+          runs.run_id,
+          runs.started_at,
+          runs.status,
+          runs.checkpoint_json,
+          runs.suspension_json
         FROM ${tableName('runs', options)} AS runs
         WHERE runs.run_id = $1
           AND runs.status IN ('queued', 'running', 'waiting')
@@ -7282,6 +7337,8 @@ export async function assignPostgresSchedulerRunAttempt(
         SELECT
           runs.run_id,
           runs.started_at,
+          runs.checkpoint_json,
+          runs.suspension_json,
           max(attempts.attempt) FILTER (
             WHERE attempts.status IN ('claimed', 'running', 'waiting')
           ) AS active_attempt
@@ -7290,7 +7347,11 @@ export async function assignPostgresSchedulerRunAttempt(
           ON attempts.run_id = runs.run_id
         WHERE runs.run_id = $1
           AND runs.status IN ('queued', 'running', 'waiting')
-        GROUP BY runs.run_id, runs.started_at
+        GROUP BY
+          runs.run_id,
+          runs.started_at,
+          runs.checkpoint_json,
+          runs.suspension_json
         HAVING max(attempts.attempt) FILTER (
                  WHERE attempts.status IN ('claimed', 'running', 'waiting')
                ) IS NULL
@@ -7306,7 +7367,8 @@ export async function assignPostgresSchedulerRunAttempt(
           lease_owner,
           lease_token,
           lease_expires_at,
-          heartbeat_at
+          heartbeat_at,
+          resource_json
         )
         SELECT
           run_id,
@@ -7315,10 +7377,17 @@ export async function assignPostgresSchedulerRunAttempt(
           $3,
           $4,
           NULL,
-          now()
+          now(),
+          CASE
+            WHEN $5::jsonb IS NOT NULL
+              AND checkpoint_json IS NULL
+              AND suspension_json IS NULL
+              THEN jsonb_build_array($5::jsonb)
+            ELSE NULL
+          END
         FROM target_run
         ON CONFLICT (run_id, attempt) DO NOTHING
-        RETURNING run_id
+        RETURNING run_id, resource_json IS NOT NULL AS initial_runtime_resource_persisted
       ),
       retired_attempts AS (
         UPDATE ${tableName('attempts', options)}
@@ -7396,16 +7465,20 @@ export async function assignPostgresSchedulerRunAttempt(
               WHERE run_started.run_id = runs.run_id
             )
           ELSE NULL
-        END AS first_claim_latency_ms
+        END AS first_claim_latency_ms,
+        assigned.initial_runtime_resource_persisted
       FROM ${tableName('runs', options)}
       AS runs
-      WHERE run_id IN (SELECT run_id FROM assigned)
+      JOIN assigned USING (run_id)
     `,
     [
       input.runId,
       input.attempt,
       POSTGRES_SCHEDULER_ATTEMPT_OWNER,
       input.taskToken,
+      input.initialRuntimeResource === undefined
+        ? null
+        : stringifyPostgresJson(input.initialRuntimeResource),
     ],
   );
   const row = assigned.rows[0] ?? null;
@@ -7416,6 +7489,8 @@ export async function assignPostgresSchedulerRunAttempt(
     ...(row.first_claim_latency_ms == null
       ? {}
       : { firstClaimLatencyMs: Number(row.first_claim_latency_ms) }),
+    initialRuntimeResourcePersisted:
+      row.initial_runtime_resource_persisted === true,
   };
 }
 
@@ -9157,12 +9232,11 @@ export async function readPostgresSchedulerLaunchRouting(
   }
 }
 
-export async function readPostgresSchedulerLaunch(
-  client: PostgresSchedulerQueryClient,
-  runId: string,
+async function observeSchedulerLaunchRead<T>(
   options: Pick<PostgresSchedulerOptions, 'schema'> | undefined,
   telemetry: { caller: SchedulerLaunchReadCaller },
-): Promise<PlaySchedulerSubmitInput | null> {
+  read: () => Promise<{ launch: PlaySchedulerSubmitInput | null; value: T }>,
+): Promise<T> {
   const caller = telemetry.caller;
   const startedAt = performance.now();
   try {
@@ -9176,21 +9250,7 @@ export async function readPostgresSchedulerLaunch(
         },
       },
       async (span) => {
-        const result = await client.query<{ launch_json: unknown }>(
-          `
-            -- admission_json is the first-writer trusted projection. New rows
-            -- retain non-secret lane/callback routing there while legacy rows
-            -- fall back to launch_json. Merge it last so descendants never
-            -- follow transport metadata changed by a later operational repair.
-            SELECT launch_json || coalesce(admission_json, '{}'::jsonb)
-              AS launch_json
-            FROM ${tableName('runs', options)}
-            WHERE run_id = $1
-          `,
-          [runId],
-        );
-        const row = result.rows[0] ?? null;
-        const launch = row ? parseLaunchJson(row.launch_json) : null;
+        const { launch, value } = await read();
         const durationMs = performance.now() - startedAt;
         recordSchedulerLaunchRead({
           caller,
@@ -9204,7 +9264,7 @@ export async function readPostgresSchedulerLaunch(
           'runtime.scheduler.release_id':
             launch?.absurdReleaseId?.trim() || 'unassigned',
         });
-        return launch;
+        return value;
       },
     );
   } catch (error) {
@@ -9218,6 +9278,108 @@ export async function readPostgresSchedulerLaunch(
   }
 }
 
+export async function readPostgresSchedulerLaunch(
+  client: PostgresSchedulerQueryClient,
+  runId: string,
+  options: Pick<PostgresSchedulerOptions, 'schema'> | undefined,
+  telemetry: { caller: SchedulerLaunchReadCaller },
+): Promise<PlaySchedulerSubmitInput | null> {
+  return observeSchedulerLaunchRead(options, telemetry, async () => {
+    const result = await client.query<{ launch_json: unknown }>(
+      `
+        -- admission_json is the first-writer trusted projection. New rows
+        -- retain non-secret lane/callback routing there while legacy rows
+        -- fall back to launch_json. Merge it last so descendants never
+        -- follow transport metadata changed by a later operational repair.
+        SELECT launch_json || coalesce(admission_json, '{}'::jsonb)
+          AS launch_json
+        FROM ${tableName('runs', options)}
+        WHERE run_id = $1
+      `,
+      [runId],
+    );
+    const row = result.rows[0];
+    const launch = row ? parseLaunchJson(row.launch_json) : null;
+    return { launch, value: launch };
+  });
+}
+
+export type PostgresSchedulerAttemptPreparation = {
+  launch: PlaySchedulerSubmitInput;
+  existing: PlaySchedulerResultEnvelope | null;
+  laneState: PostgresSchedulerRunLaneState;
+  createdProjection: PostgresSchedulerOutboxDeliveryStatus;
+  /** Candidate only; the assignment fence admits at most one racing reader. */
+  nextAttempt: number;
+};
+
+/**
+ * Read attempt ingress facts in one database snapshot. Assignment and detached
+ * recovery still perform their own fenced writes; this read cannot claim work.
+ */
+export async function readPostgresSchedulerAttemptPreparation(
+  client: PostgresSchedulerQueryClient,
+  runId: string,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<PostgresSchedulerAttemptPreparation | null> {
+  return observeSchedulerLaunchRead(
+    options,
+    { caller: 'runtime_worker_execute' },
+    async () => {
+      const result = await client.query<
+        RunRow &
+          RunLaneStateRow & {
+            launch_json: unknown;
+            projection_exists: boolean;
+            projection_delivered: boolean;
+            projection_blocked: boolean;
+            next_attempt: number | string;
+          }
+      >(
+        `
+          SELECT runs.run_id, runs.terminal_result_json, runs.terminal_error_json,
+            runs.runtime_timing_json, runs.created_at, runs.started_at, runs.finished_at,
+            runs.launch_json || coalesce(runs.admission_json, '{}'::jsonb) AS launch_json,
+            (SELECT coalesce(max(attempt), 0) + 1
+             FROM ${tableName('attempts', options)}
+             WHERE run_id = runs.run_id) AS next_attempt,
+            ${runLaneStateSelectionSql(options)},
+            created.event_id IS NOT NULL AS projection_exists,
+            created.delivered_at IS NOT NULL AS projection_delivered,
+            CASE WHEN created.event_id IS NULL THEN false
+              ELSE ${outboxDeliveryBlockedSql('created', options)}
+            END AS projection_blocked
+          FROM ${tableName('runs', options)} AS runs
+          LEFT JOIN ${tableName('outbox', options)} AS created
+            ON created.run_id = runs.run_id
+            AND created.event_id = 'run-created:' || runs.run_id
+            AND (runs.launch_json || coalesce(runs.admission_json, '{}'::jsonb))
+                  ->> 'requiresRunCreatedProjection' = 'true'
+          WHERE runs.run_id = $1
+        `,
+        [runId, POSTGRES_SCHEDULER_RELEASE_CLAIMING_CONTROL_PREFIX],
+      );
+      const row = result.rows[0];
+      const launch = row ? parseLaunchJson(row.launch_json) : null;
+      const value: PostgresSchedulerAttemptPreparation | null =
+        row && launch
+          ? {
+              launch,
+              existing: schedulerResultFromRow(row),
+              laneState: runLaneStateFromRow(row),
+              nextAttempt: Number(row.next_attempt),
+              createdProjection: {
+                exists: row.projection_exists === true,
+                delivered: row.projection_delivered === true,
+                blocked: row.projection_blocked === true,
+              },
+            }
+          : null;
+      return { launch, value };
+    },
+  );
+}
+
 /**
  * One round-trip replay inspection for externally retried admissions. The
  * caller uses this only to return an already-committed Run without rebuilding
@@ -9316,7 +9478,7 @@ const POSTGRES_SCHEDULER_ATTEMPT_AUTHORITY_FIELDS = [
 export type PostgresSchedulerAttemptAuthority = Pick<
   PlaySchedulerSubmitInput,
   (typeof POSTGRES_SCHEDULER_ATTEMPT_AUTHORITY_FIELDS)[number]
->;
+> & { computeSessionIntentPersisted?: boolean };
 
 type PostgresSchedulerAuthorityRow = PostgresSchedulerAttemptAuthority & {
   launch_required_fields_valid: boolean;
@@ -9362,7 +9524,17 @@ export async function readPostgresSchedulerAttemptAuthorityForLease(
 ): Promise<PostgresSchedulerAttemptAuthority | null> {
   const result = await client.query<PostgresSchedulerAuthorityRow>(
     `
-      SELECT ${POSTGRES_SCHEDULER_AUTHORITY_SELECT}
+      SELECT ${POSTGRES_SCHEDULER_AUTHORITY_SELECT},
+        EXISTS (
+          SELECT 1 FROM jsonb_array_elements(
+            CASE
+              WHEN jsonb_typeof(attempts.resource_json) = 'array' THEN attempts.resource_json
+              WHEN attempts.resource_json IS NULL THEN '[]'::jsonb
+              ELSE jsonb_build_array(attempts.resource_json)
+            END
+          ) AS resource
+          WHERE resource->>'kind' = 'compute_session'
+        ) AS "computeSessionIntentPersisted"
       FROM ${tableName('runs', options)} AS runs
       JOIN ${tableName('attempts', options)} AS attempts
         ON attempts.run_id = runs.run_id
@@ -13215,14 +13387,10 @@ export async function readPostgresSchedulerRunnerLiveness(
  * and no newer attempt to exist. Gateway replicas must never infer this fence
  * from process memory.
  */
-export async function isPostgresSchedulerRunnerProgressAttemptCurrent(
-  client: PostgresSchedulerQueryClient,
-  input: { runId: string; attempt: number },
+function runnerProgressAttemptCurrentCondition(
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
-): Promise<boolean> {
-  const result = await client.query<{ current: boolean }>(
-    `
-      SELECT EXISTS (
+): string {
+  return `EXISTS (
         SELECT 1
         FROM ${tableName('attempts', options)} AS current_attempt
         JOIN ${tableName('runs', options)} AS run
@@ -13237,13 +13405,50 @@ export async function isPostgresSchedulerRunnerProgressAttemptCurrent(
             WHERE newer_attempt.run_id = current_attempt.run_id
               AND newer_attempt.attempt > current_attempt.attempt
           )
-      ) AS current
-    `,
+      )`;
+}
+
+export async function isPostgresSchedulerRunnerProgressAttemptCurrent(
+  client: PostgresSchedulerQueryClient,
+  input: { runId: string; attempt: number },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<boolean> {
+  const result = await client.query<{ current: boolean }>(
+    `SELECT ${runnerProgressAttemptCurrentCondition(options)} AS current`,
     [input.runId, input.attempt],
   );
   return result.rows[0]?.current === true;
 }
 
+/** Observe terminal ingress authority without loading the stored result. */
+export async function readPostgresSchedulerRunnerAttemptAuthority(
+  client: PostgresSchedulerQueryClient,
+  input: { runId: string; attempt: number },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<{ current: boolean; terminalRecorded: boolean }> {
+  const result = await client.query<{
+    current: boolean;
+    terminal_recorded: boolean;
+  }>(
+    `
+      SELECT ${runnerProgressAttemptCurrentCondition(options)} AS current,
+        EXISTS (
+          SELECT 1
+          FROM ${tableName('attempts', options)}
+          WHERE run_id = $1
+            AND attempt = $2
+            AND runner_result_json IS NOT NULL
+            AND runner_result_json <> 'null'::jsonb
+        ) AS terminal_recorded
+    `,
+    [input.runId, input.attempt],
+  );
+  return {
+    current: result.rows[0]?.current === true,
+    terminalRecorded: result.rows[0]?.terminal_recorded === true,
+  };
+}
+
 /**
  * Push execution (B2-final): the detached runner's liveness/cancellation poll.
  * Bumps `heartbeat_at` on the runner's attempt row (the same liveness column
@@ -17667,6 +17872,13 @@ export async function readPostgresSchedulerResult(
   );
   const row = result.rows[0] ?? null;
   if (!row) return null;
+  return schedulerResultFromRow(row, options?.includeCancelledOutput);
+}
+
+function schedulerResultFromRow(
+  row: RunRow,
+  includeCancelledOutput = false,
+): PlaySchedulerResultEnvelope | null {
   if (
     row.status !== 'completed' &&
     row.status !== 'failed' &&
@@ -17684,7 +17896,7 @@ export async function readPostgresSchedulerResult(
     status: row.status,
     ...(row.status === 'completed' ||
     ((row.status === 'failed' ||
-      (row.status === 'cancelled' && options?.includeCancelledOutput)) &&
+      (row.status === 'cancelled' && includeCancelledOutput)) &&
       row.terminal_result_json !== null)
       ? { output: row.terminal_result_json }
       : {}),
@@ -18590,7 +18802,13 @@ function runLedgerOutboxPrefixClaimSql(
     Parameters<typeof readPendingPostgresSchedulerOutboxEvents>[1]
   >,
   options: Pick<PostgresSchedulerOptions, 'schema'> | undefined,
-  acknowledgement: { eventIds: string[]; targetEventId: string } | undefined,
+  acknowledgement:
+    | {
+        eventIds: string[];
+        targetEventId: string;
+        createdProjectionWake?: RunCreatedProjectionWake;
+      }
+    | undefined,
   supportsTerminalBatchMarker: boolean,
   fence?: { runId: string; expectedHeadEventId?: string },
 ): string {
@@ -19020,12 +19238,7 @@ function runLedgerOutboxPrefixClaimSql(
       ${
         acknowledgement
           ? `, notified AS MATERIALIZED (
-        SELECT delivered.*,
-               pg_notify(
-                 $7,
-                 json_build_object('eventId', event_id, 'kind', 'outbox_delivered')::text
-               ) AS notification
-        FROM delivered
+        ${runLedgerDeliveredNotificationsSql('$7', acknowledgement.createdProjectionWake ? { queue: '$8', event: '$9' } : undefined)}
       )`
           : ''
       }
@@ -19156,7 +19369,11 @@ async function claimRunLedgerOutboxPrefixInBatch(
     recoverTransportDelivery?: boolean;
   },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
-  acknowledgement?: { eventIds: string[]; targetEventId: string },
+  acknowledgement?: {
+    eventIds: string[];
+    targetEventId: string;
+    createdProjectionWake?: RunCreatedProjectionWake;
+  },
 ): Promise<{
   events: PostgresSchedulerOutboxEvent[];
   deliveredRows: RunLedgerOutboxDeliveredRow[];
@@ -19184,6 +19401,12 @@ async function claimRunLedgerOutboxPrefixInBatch(
           acknowledgement.eventIds,
           acknowledgement.targetEventId,
           postgresSchedulerNotifyChannel('terminal', options),
+          ...(acknowledgement.createdProjectionWake
+            ? [
+                acknowledgement.createdProjectionWake.queueName,
+                acknowledgement.createdProjectionWake.eventName,
+              ]
+            : []),
         ]
       : input.extendOwnedHead
         ? [input.extendOwnedHead]
@@ -19395,7 +19618,11 @@ async function claimPostgresSchedulerOutboxPrefix(
     Parameters<typeof readPendingPostgresSchedulerOutboxEvents>[1]
   >,
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
-  acknowledgement?: { eventIds: string[]; targetEventId: string },
+  acknowledgement?: {
+    eventIds: string[];
+    targetEventId: string;
+    createdProjectionWake?: RunCreatedProjectionWake;
+  },
 ): Promise<{
   events: PostgresSchedulerOutboxEvent[];
   deliveredRows: RunLedgerOutboxDeliveredRow[];
@@ -19426,6 +19653,12 @@ async function claimPostgresSchedulerOutboxPrefix(
               acknowledgement.eventIds,
               acknowledgement.targetEventId,
               postgresSchedulerNotifyChannel('terminal', options),
+              ...(acknowledgement.createdProjectionWake
+                ? [
+                    acknowledgement.createdProjectionWake.queueName,
+                    acknowledgement.createdProjectionWake.eventName,
+                  ]
+                : []),
             ]
           : input.extendOwnedHead
             ? [input.extendOwnedHead]
@@ -19654,13 +19887,7 @@ export async function readPostgresSchedulerOutboxDeliveryStatus(
             ${
               options?.includeBlocked === false
                 ? 'false'
-                : `target.failed_at IS NOT NULL OR EXISTS (
-              SELECT 1
-              FROM ${tableName('outbox', options)} predecessor
-              WHERE predecessor.run_id = target.run_id
-                AND predecessor.failed_at IS NOT NULL
-                AND ${runLedgerPrecedesSql('predecessor', 'target', true)}
-            )`
+                : outboxDeliveryBlockedSql('target', options)
             } AS blocked
      FROM ${tableName('outbox', options)} target
      WHERE target.run_id = $1 AND target.event_id = $2`,
@@ -19674,6 +19901,19 @@ export async function readPostgresSchedulerOutboxDeliveryStatus(
   };
 }
 
+function outboxDeliveryBlockedSql(
+  target: string,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): string {
+  return `${target}.failed_at IS NOT NULL OR EXISTS (
+    SELECT 1
+    FROM ${tableName('outbox', options)} predecessor
+    WHERE predecessor.run_id = ${target}.run_id
+      AND predecessor.failed_at IS NOT NULL
+      AND ${runLedgerPrecedesSql('predecessor', target, true)}
+  )`;
+}
+
 /**
  * Read the age of one oldest pending outbox row through the partial
  * `(created_at, event_id)` index. This deliberately avoids the historical
@@ -20156,6 +20396,31 @@ function runLedgerAcknowledgeSql(
                     AS lag_ms`;
 }
 
+type RunCreatedProjectionWake = { queueName: string; eventName: string };
+
+/** Both standalone and continuation ACKs publish the same atomic wake. */
+function runLedgerDeliveredNotificationsSql(
+  terminalChannel: string,
+  wake?: { queue: string; event: string },
+): string {
+  return `SELECT delivered.*,
+    pg_notify(${terminalChannel},
+      json_build_object('eventId', event_id, 'kind', 'outbox_delivered')::text
+    ) AS notification
+    ${
+      wake
+        ? `,
+      CASE WHEN event_type = ${RUN_EVENT_KIND_SQL_LITERAL.runCreated}
+        THEN absurd.emit_event(${wake.queue}, ${wake.event}, 'true'::jsonb)
+      END AS engine_wake,
+      CASE WHEN event_type = ${RUN_EVENT_KIND_SQL_LITERAL.runCreated}
+        THEN pg_notify('absurd_wake', ${wake.queue})
+      END AS engine_notification`
+        : ''
+    }
+    FROM delivered`;
+}
+
 /**
  * Lease-fenced acknowledgement that also reports each row's event type and
  * commit-to-acknowledgement lag on the database clock, so lag metrics never
@@ -20166,6 +20431,7 @@ export async function markPostgresSchedulerOutboxDeliveredRows(
   eventIds: string[],
   options?: Pick<PostgresSchedulerOptions, 'schema'> & {
     leaseOwner?: string | null;
+    createdProjectionWake?: RunCreatedProjectionWake;
   },
 ): Promise<RunLedgerOutboxDeliveredRow[]> {
   if (eventIds.length === 0) return [];
@@ -20177,20 +20443,21 @@ export async function markPostgresSchedulerOutboxDeliveredRows(
     `
       WITH delivered AS (
         ${runLedgerAcknowledgeSql(options, '$1', '$2')}
+      ), notified AS MATERIALIZED (
+        ${runLedgerDeliveredNotificationsSql('$3', options?.createdProjectionWake ? { queue: '$4', event: '$5' } : undefined)}
       )
-      SELECT event_id,
-             event_type,
-             lag_ms,
-             pg_notify(
-               $3,
-               json_build_object('eventId', event_id, 'kind', 'outbox_delivered')::text
-             )
-      FROM delivered
+      SELECT event_id, event_type, lag_ms FROM notified
     `,
     [
       eventIds,
       options?.leaseOwner?.trim() || null,
       postgresSchedulerNotifyChannel('terminal', options),
+      ...(options?.createdProjectionWake
+        ? [
+            options.createdProjectionWake.queueName,
+            options.createdProjectionWake.eventName,
+          ]
+        : []),
     ],
   );
   return result.rows.map((row) => {
@@ -20705,6 +20972,8 @@ export function postgresSchedulerCancellationOutboxLease(runId: string): {
 }
 
 export type RunLedgerOutboxDispatchInput = {
+  /** App-owned transport; launch authority and routing still come from the lease. */
+  appRuntimeFetch?: typeof fetch;
   /** Dedicated bounded checkout for indexing; claims/ACKs use withClient. */
   withObservabilityClient?: RunLedgerOutboxWithClient;
 
@@ -21054,10 +21323,14 @@ async function dispatchRunLedgerOutboxBatchWithScope(
   // A committed terminal is running-work control traffic. Use the existing
   // alternating critical admission lane so its short lease operations do not
   // sit behind a full ordinary-work backlog; capacity is unchanged.
-  const terminalRunId =
+  // Only a caller that explicitly targets this run's terminal may reuse the
+  // claim's first-HTTP lease proof. Background discovery can still prioritize
+  // a terminal after claiming it, but must renew before its first append.
+  const targetedTerminalRunId =
     scope && scope.targetEventId === `run-terminal:${scope.runId}`
       ? scope.runId
       : null;
+  let terminalRunId = targetedTerminalRunId;
   const withClient: RunLedgerOutboxWithClient = (operation, trace) =>
     acquireClient(
       operation,
@@ -21092,7 +21365,11 @@ async function dispatchRunLedgerOutboxBatchWithScope(
          WHEN ${runLedgerSearchOnlyOutboxFactSql('head')} THEN NULL::jsonb
          ELSE ${runLedgerDispatchLaunchSql('runs')}
        END`
-    : 'NULL::jsonb';
+    : input.searchOnly
+      ? 'NULL::jsonb'
+      : `CASE WHEN head.event_type = ${RUN_EVENT_KIND_SQL_LITERAL.runCreated}
+           THEN ${runLedgerDispatchLaunchSql('runs')}
+           ELSE NULL::jsonb END`;
   const transportHeadSelection =
     tokenAuthority === 'gateway' &&
     !input.searchOnly &&
@@ -21439,7 +21716,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
           dispatch_launch_json: unknown;
         }>(
           `SELECT runs.run_id,
-                  ${needsLaunch ? runLedgerDispatchLaunchSql('runs') : 'NULL::jsonb'} AS dispatch_launch_json
+                  ${!input.searchOnly ? runLedgerDispatchLaunchSql('runs') : 'NULL::jsonb'} AS dispatch_launch_json
            FROM ${tableName('runs', options)} AS runs
            WHERE runs.run_id = $1 FOR UPDATE`,
           [targetRunId],
@@ -21582,6 +21859,21 @@ async function dispatchRunLedgerOutboxBatchWithScope(
     });
   }
 
+  // Background discovery cannot classify its head before claiming it. Once
+  // the owned prefix contains a terminal, its renewal and acknowledgement
+  // are the same critical running-work control as a targeted worker drain.
+  const prioritizeClaimedTerminal = () => {
+    if (
+      !input.searchOnly &&
+      events.some((event) =>
+        RUN_SCHEDULER_OUTBOX_TERMINAL_EVENT_TYPES.includes(event.eventType),
+      )
+    ) {
+      terminalRunId = events[0]!.runId;
+    }
+  };
+  prioritizeClaimedTerminal();
+
   const claimedAtMs = Date.now();
   let authorityReadyAtMs: number | null = null;
   let appendFinishedAtMs: number | null = null;
@@ -21948,6 +22240,9 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         gatewayRuntimeApi ?? input.runtimeApi ?? (await resolveRunRuntimeApi());
       runtimeApi = {
         ...resolvedRuntimeApi,
+        ...(tokenAuthority === 'local_mint' && input.appRuntimeFetch
+          ? { fetch: input.appRuntimeFetch }
+          : {}),
         ...(gatewayRuntimeApi && input.runtimeApi
           ? {
               ...(input.runtimeApi.fetch
@@ -22082,6 +22377,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
         );
       }
       events = widened;
+      prioritizeClaimedTerminal();
     }
     // Widening can add deferred facts to the lease. Project the complete
     // frozen prefix before any HTTP append, including its newly claimed rows.
@@ -22137,7 +22433,7 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       }
       if (
         firstRenewal &&
-        terminalRunId === first.runId &&
+        targetedTerminalRunId === first.runId &&
         tokenAuthority === 'gateway' &&
         runtimeApi?.runLedgerIngressPrefixBatching === true &&
         ledgerEvents !== null &&
@@ -22267,12 +22563,30 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       await renewDelivery();
     }
     appendFinishedAtMs = Date.now();
+    let createdProjectionWake: RunCreatedProjectionWake | undefined;
+    if (
+      events.some((event) => event.eventType === RUN_EVENT_KIND.runCreated) &&
+      launchJson
+    ) {
+      const routing = parseRunLedgerDispatchLaunch(launchJson);
+      if (routing.requiresRunCreatedProjection) {
+        const {
+          absurdQueueNameForLaunch,
+          absurdRunCreatedProjectionEventName,
+        } = await import('./absurd-shared');
+        createdProjectionWake = {
+          queueName: absurdQueueNameForLaunch(routing),
+          eventName: absurdRunCreatedProjectionEventName(first.runId),
+        };
+      }
+    }
     const acknowledgement = await acknowledgeRunLedgerPrefixWithContinuation(
       withClient,
       {
         input,
         events,
         leaseOwner,
+        createdProjectionWake,
         runtimeApi,
         scope,
         continuation,
@@ -22667,6 +22981,7 @@ async function acknowledgeRunLedgerPrefixWithContinuation(
     input: RunLedgerOutboxDispatchInput;
     events: PostgresSchedulerOutboxEvent[];
     leaseOwner: string;
+    createdProjectionWake?: RunCreatedProjectionWake;
     runtimeApi: WorkerRuntimeApiContext | null;
     scope?: RunLedgerOutboxDrainScope;
     continuation: { current: RunLedgerOutboxDrainScope | null };
@@ -22769,13 +23084,21 @@ async function acknowledgeRunLedgerPrefixWithContinuation(
                     input.runtimeApi?.runLedgerIngressPrefixBatching === true,
                 },
                 options,
-                { eventIds, targetEventId },
+                {
+                  eventIds,
+                  targetEventId,
+                  createdProjectionWake: input.createdProjectionWake,
+                },
               )
             : {
                 deliveredRows: await markPostgresSchedulerOutboxDeliveredRows(
                   client,
                   eventIds,
-                  { ...options, leaseOwner: input.leaseOwner },
+                  {
+                    ...options,
+                    leaseOwner: input.leaseOwner,
+                    createdProjectionWake: input.createdProjectionWake,
+                  },
                 ),
                 events: [],
               };