# Worker queue digest cutover

This release changes Scheduled batch lookup and Runtime-bound Rollup reads to
use catalog-owned persisted digests. The explicit scope/batch columns remain
authority. The digests are not optional for work consumed by the new readers.

## Required stopped-writer boundary

The L2 delivery workflow must enforce this sequence for an existing database:

1. Stop all old Runtime processes that can produce Scheduled reservations or
   Rollup dirty markers, including Runtime API and Worker roles. Stop their
   ingress, wait for in-flight transactions to finish or roll back, and disable
   automatic restart of predecessor processes. Stopping only Integration does
   not establish this boundary.
2. While these writers remain stopped, run the candidate's canonical L0 schema
   reconciliation. It adds the indexes/columns and backfills Scheduled
   BatchIdentityDigest and Rollup ScopeDigest from the authoritative columns.
   If an earlier online schema pass already ran, reapply it here: that earlier
   pass cannot cover old-writer commits made after its final backfill.
3. Verify the candidate schema and queue readiness before activating the new
   workers. Rollup readiness rejects scoped pending/failed work without a digest;
   Scheduled readiness already rejects active scoped work without a batch digest.
   Neither guard is permission to leave old writers running after verification.
4. Start only candidate Runtime writers/consumers. Never restart the predecessor
   writer binaries against the new digest-consuming queue without re-establishing
   this complete stopped-writer sequence.

An interrupted apply resumes with the same stopped-writer boundary and an
idempotent schema reapply. Do not skip the final backfill based on a previous
online shape check. Do not add a fallback full scan to the steady-state worker,
repair data in a readiness check, or keep a second legacy read path.

The Integration dependency-state cutover is a separate fence: install and verify
its additive columns/indexes before starting the new Integration binary, and stop
all old Integration claimants before enabling dependency_registration or
waiting_dependency. Both fences must hold for a release containing both changes.

Environment-specific shutdown, transaction-drain proof, checkpoint resume and
activation belong in the target L2 workflow. A deployment that cannot prove the
stopped Runtime writer boundary is not eligible for this Core cutover. No data
reset or restoration of an older database is required for the forward upgrade.

## Data and verification

Outbound dependency fields do not require a bulk conversion of existing retry
rows; normal preparation puts them into dependency wait when appropriate.
Scheduled and Rollup backfills update only system queue projections, not business
records or metadata facts. Warm migration tests cover exact digest derivation,
Unicode scope values, idempotence and preflight rejection of schema drift. The
Records cutover regression inserts a valid old-writer row after the first schema
pass, requires readiness to reject it, then proves that final reapply restores
visibility with the original immutable Runtime binding.