deepline 0.1.0 → 0.1.1

package/dist/repo/apps/play-runner-workers/src/coordinator-entry.ts

@@ -0,0 +1,3256 @@
+/**
+ * Coordinator Worker entry — main module exported by wrangler.toml.
+ *
+ * Hosts:
+ *   - DynamicWorkflow (native Cloudflare Dynamic Workflows)
+ *   - PlayDedup DO      (default export class)
+ *   - HTTP fetch handler for /api/v2/plays/run dispatch (Vercel forwards to here)
+ *   - WorkerLoader-backed dynamic play Workers
+ */
+
+export { PlayDedup } from './dedup-do';
+
+import {
+  WorkerEntrypoint,
+  WorkflowEntrypoint,
+  exports as workersExports,
+} from 'cloudflare:workers';
+import {
+  _dispatcherBindingImpl as createDispatcherWorkflowBinding,
+  dispatchWorkflow,
+  DynamicWorkflowBinding,
+  type WorkflowRunner,
+} from '@cloudflare/dynamic-workflows';
+import type { ExecutionPlan } from '../../../shared_libs/play-runtime/execution-plan';
+import type { PlayCallGovernanceSnapshot } from '../../../shared_libs/play-runtime/scheduler-backend';
+import type {
+  PlayRuntimeManifest,
+  PlayRuntimeManifestMap,
+} from '../../../shared_libs/plays/compiler-manifest';
+import { runtimeRunActions } from '../../../shared_libs/play-runtime/runtime-actions';
+
+export { DynamicWorkflowBinding };
+
+export type PlayWorkflowParams = {
+  runId: string;
+  playId: string;
+  playName: string;
+  artifactStorageKey: string;
+  artifactHash: string;
+  graphHash: string;
+  input: Record<string, unknown>;
+  inputFile?: { name?: string; r2Key?: string; path?: string } | null;
+  inlineCsv?: { name: string; rows: Record<string, unknown>[] } | null;
+  packagedFiles?: Array<{
+    playPath: string;
+    storageKey: string;
+    inlineText?: string;
+  }> | null;
+  contractSnapshot?: unknown;
+  executionPlan?: ExecutionPlan | null;
+  childPlayManifests?: PlayRuntimeManifestMap | null;
+  playCallGovernance?: PlayCallGovernanceSnapshot | null;
+  dynamicWorkerCode?: string | null;
+  executorToken: string;
+  baseUrl: string;
+  orgId: string;
+  userEmail: string;
+  userId?: string | null;
+  runtimeBackend: string;
+  dedupBackend: string;
+  totalRows?: number;
+  coordinatorUrl?: string | null;
+};
+
+type InlineChildSubmitResult =
+  | {
+      workflowId: string;
+      runId: string;
+      status: 'completed';
+      mode: 'inline_dynamic_worker';
+      output: unknown;
+      result: unknown;
+      logs: string[];
+      timings: CoordinatorTiming[];
+    }
+  | {
+      workflowId: string;
+      runId: string;
+      status: 'failed';
+      mode: 'inline_dynamic_worker';
+      error: { message: string; stack?: string | null };
+      logs: string[];
+      timings: CoordinatorTiming[];
+    };
+
+type CoordinatorTiming = {
+  phase: string;
+  ms: number;
+  graphHash?: string | null;
+  extra?: Record<string, unknown>;
+};
+
+type CoordinatorPerfTracePayload = {
+  ts: number;
+  source: 'coordinator' | 'dynamic_worker';
+  runId: string;
+  phase: string;
+  ms: number;
+  graphHash?: string | null;
+  [key: string]: unknown;
+};
+
+type CoordinatorPerfTraceInput = {
+  runId: string;
+  phase: string;
+  ms: number;
+  graphHash?: string | null;
+  extra?: Record<string, unknown>;
+};
+
+type CoordinatorPerfTraceSink = (event: CoordinatorPerfTraceInput) => void;
+
+type InlineWorkerRunResponse = {
+  status?: 'completed' | 'failed';
+  result?: unknown;
+  outputRows?: number;
+  durationMs?: number;
+  parseMs?: number;
+  events?: Array<
+    | { type: 'log'; message?: string; level?: string; ts?: number }
+    | { type: 'result'; result?: unknown; outputRows?: number; ts?: number }
+    | { type: 'error'; message?: string; stack?: string; ts?: number }
+    | Record<string, unknown>
+  >;
+  error?: { message?: string; stack?: string | null };
+};
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+
+interface CoordinatorEnv {
+  PLAY_WORKFLOW: Workflow<PlayWorkflowParams | PooledWorkflowBootstrapPayload>;
+  PLAY_DEDUP: DurableObjectNamespace;
+  LOADER?: {
+    get(
+      id: string,
+      load: () => Promise<{
+        compatibilityDate: string;
+        compatibilityFlags?: string[];
+        mainModule: string;
+        modules: Record<string, string>;
+        env?: Record<string, unknown>;
+        globalOutbound?: Fetcher | null;
+      }>,
+    ): {
+      getEntrypoint(name?: string): Fetcher & WorkflowRunner;
+    };
+  };
+  PLAYS_BUCKET: R2Bucket;
+  DEEPLINE_API_BASE_URL: string;
+  DEEPLINE_INTERNAL_TOKEN?: string;
+  DEEPLINE_TAIL_LOG_TOKEN?: string;
+  VERCEL_PROTECTION_BYPASS_TOKEN?: string;
+  DEEPLINE_WORKFLOW_PREWARM_POOL?: string;
+  DEEPLINE_WORKFLOW_PREWARM_POOL_SIZE?: string;
+  DEEPLINE_PLAY_PREVIEW_SLUG?: string;
+  /**
+   * Service binding to the long-lived Play Harness Worker
+   * (apps/play-harness-worker). Provides typed RPC access to leaf-level
+   * helpers (zod validation, runtime-API HTTP forwarder, …) that we
+   * deliberately keep OUT of every per-graphHash play bundle.
+   *
+   * Optional: when missing (e.g. an older deploy that hasn't been wired
+   * yet, or a local dev environment running without the harness), the
+   * coordinator falls back to passing a `null` HARNESS into per-play
+   * Workers and the per-play stub throws a clear error if anyone tries
+   * to use it. Loud failures > silent fallbacks.
+   *
+   * Wired in wrangler.toml as `[[services]] binding = "HARNESS"`.
+   */
+  HARNESS?: import('../../play-harness-worker/src/rpc-types').PlayHarnessRpc;
+}
+
+/**
+ * Best-effort disposal of an RPC stub. Workers' RPC machinery emits
+ * "stub not disposed" warnings (and, under stress, contributes to V8
+ * deopt failures in `wrangler dev` local mode) when these are GC'd
+ * instead of explicitly released. Optional chaining keeps this safe
+ * for non-stub values.
+ */
+function disposeRpcStub(value: unknown): void {
+  if (value == null) return;
+  const disposable = value as { [Symbol.dispose]?: () => void };
+  try {
+    disposable[Symbol.dispose]?.();
+  } catch {
+    // intentional no-op — disposal is best-effort
+  }
+}
+
+/**
+ * Structured perf trace for the coordinator. Emits one [perf-trace] JSON
+ * line that downstream tooling (tests/v2-plays/runner.ts --perf-summary)
+ * scrapes from logs/coordinator.log / logs/cf-coordinator-tail.log.
+ *
+ * Workerd has no filesystem; this is stdout-only. Stays additive next to
+ * the existing `[coordinator] ...` logs.
+ */
+function buildCoordinatorPerfTracePayload(
+  event: CoordinatorPerfTraceInput,
+): CoordinatorPerfTracePayload | null {
+  if (!event.runId || !event.phase) return null;
+  return {
+    ts: Date.now(),
+    source: 'coordinator',
+    runId: event.runId,
+    phase: event.phase,
+    ms: event.ms,
+    ...(event.graphHash ? { graphHash: event.graphHash } : {}),
+    ...(event.extra ?? {}),
+  };
+}
+
+function logCoordinatorPerfTrace(payload: CoordinatorPerfTracePayload): void {
+  console.log(`[perf-trace] ${JSON.stringify(payload)}`);
+}
+
+function recordCoordinatorPerfTrace(event: CoordinatorPerfTraceInput): void {
+  const payload = buildCoordinatorPerfTracePayload(event);
+  if (!payload) return;
+  logCoordinatorPerfTrace(payload);
+}
+
+async function appendCoordinatorPerfTrace(
+  env: CoordinatorEnv,
+  payload: CoordinatorPerfTracePayload,
+): Promise<void> {
+  const stub = env.PLAY_DEDUP.get(env.PLAY_DEDUP.idFromName(payload.runId));
+  const response = await stub.fetch(
+    'https://deepline.dedup.internal/trace-add',
+    {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(payload),
+    },
+  );
+  if (!response.ok) {
+    throw new Error(
+      `coordinator trace append failed ${response.status}: ${(
+        await response.text().catch(() => '')
+      ).slice(0, 200)}`,
+    );
+  }
+}
+
+function recordCoordinatorPerfTraceBuffered(
+  env: CoordinatorEnv,
+  ctx: ExecutionContext | null | undefined,
+  event: CoordinatorPerfTraceInput,
+): void {
+  const payload = buildCoordinatorPerfTracePayload(event);
+  if (!payload) return;
+  logCoordinatorPerfTrace(payload);
+  const append = appendCoordinatorPerfTrace(env, payload).catch((error) => {
+    console.warn('[coordinator] failed to buffer perf trace', {
+      runId: payload.runId,
+      phase: payload.phase,
+      error: error instanceof Error ? error.message : String(error),
+    });
+  });
+  if (typeof ctx?.waitUntil === 'function') {
+    ctx.waitUntil(append);
+  }
+}
+
+async function listCoordinatorPerfTrace(
+  env: CoordinatorEnv,
+  runId: string,
+): Promise<CoordinatorPerfTracePayload[]> {
+  const stub = env.PLAY_DEDUP.get(env.PLAY_DEDUP.idFromName(runId));
+  const response = await stub.fetch(
+    'https://deepline.dedup.internal/trace-list',
+  );
+  if (!response.ok) {
+    throw new Error(`coordinator trace list failed ${response.status}`);
+  }
+  const body = (await response.json().catch(() => ({}))) as {
+    entries?: unknown;
+  };
+  if (!Array.isArray(body.entries)) return [];
+  return body.entries.filter(
+    (entry): entry is CoordinatorPerfTracePayload =>
+      isRecord(entry) &&
+      (entry.source === 'coordinator' || entry.source === 'dynamic_worker') &&
+      typeof entry.runId === 'string' &&
+      typeof entry.phase === 'string' &&
+      typeof entry.ts === 'number' &&
+      typeof entry.ms === 'number',
+  );
+}
+
+function workflowEventType(name: string): string {
+  const normalized = name
+    .trim()
+    .replace(/[^A-Za-z0-9_-]+/g, '_')
+    .replace(/^_+|_+$/g, '')
+    .slice(0, 100);
+  return normalized || 'deepline_event';
+}
+
+type DynamicWorkflowMetadata = {
+  runId?: string | null;
+  graphHash: string;
+  artifactStorageKey: string;
+  artifactHash?: string | null;
+  dynamicWorkerCode?: string | null;
+  packagedFiles?: Array<{
+    playPath: string;
+    storageKey: string;
+    inlineText?: string;
+  }> | null;
+};
+
+type DispatcherEnvelope = {
+  __dispatcherMetadata: DynamicWorkflowMetadata;
+  params: PlayWorkflowParams;
+};
+
+type PooledWorkflowBootstrapPayload = {
+  __deeplinePooledWorkflow: true;
+  poolId: string;
+  createdAt: number;
+};
+
+const WORKFLOW_POOL_PROTOCOL_VERSION = 'pooled-workflow-wait-v3-dynamic-binding';
+const WORKFLOW_POOL_DO_NAME = 'workflow-pool:v2';
+const WORKFLOW_POOL_START_EVENT_TYPE = 'play_start';
+const WORKFLOW_POOL_TTL_MS = 8 * 60 * 1000;
+const WORKFLOW_POOL_DEFAULT_SIZE = 2;
+const WORKFLOW_POOL_READY_TIMEOUT_MS = 1_500;
+const WORKFLOW_POOL_READY_POLL_MS = 250;
+
+function buildDynamicWorkflowMetadata(
+  params: PlayWorkflowParams,
+): DynamicWorkflowMetadata {
+  return {
+    runId: params.runId ?? null,
+    graphHash: params.graphHash,
+    artifactStorageKey: params.artifactStorageKey,
+    artifactHash: params.artifactHash ?? null,
+    dynamicWorkerCode: params.dynamicWorkerCode ?? null,
+    packagedFiles: normalizePackagedFiles(params.packagedFiles),
+  };
+}
+
+function buildDispatcherEnvelope(params: PlayWorkflowParams): DispatcherEnvelope {
+  // Mirrors @cloudflare/dynamic-workflows' envelope. We need to send the
+  // dispatcher payload via Workflow sendEvent for prewarmed instances; the
+  // public wrapper only applies this envelope to create() params.
+  return {
+    __dispatcherMetadata: buildDynamicWorkflowMetadata(params),
+    params,
+  };
+}
+
+function isPooledWorkflowBootstrapPayload(
+  value: unknown,
+): value is PooledWorkflowBootstrapPayload {
+  return (
+    Boolean(value) &&
+    typeof value === 'object' &&
+    !Array.isArray(value) &&
+    (value as Record<string, unknown>).__deeplinePooledWorkflow === true &&
+    typeof (value as Record<string, unknown>).poolId === 'string'
+  );
+}
+
+function readWorkflowTraceContext(event: unknown): {
+  runId: string;
+  graphHash: string | null;
+  instanceId: string | null;
+  pooledBootstrap: boolean;
+} {
+  const record = isRecord(event) ? event : {};
+  const payload = isRecord(record.payload) ? record.payload : {};
+  const params = isRecord(payload.params) ? payload.params : null;
+  const metadata = isRecord(payload.__dispatcherMetadata)
+    ? payload.__dispatcherMetadata
+    : null;
+  const pooled = isPooledWorkflowBootstrapPayload(payload);
+  const runId =
+    (typeof params?.runId === 'string' && params.runId) ||
+    (typeof metadata?.runId === 'string' && metadata.runId) ||
+    (pooled && typeof payload.poolId === 'string' ? payload.poolId : null) ||
+    (typeof record.instanceId === 'string' && record.instanceId) ||
+    'unknown-workflow-run';
+  const graphHash =
+    (typeof params?.graphHash === 'string' && params.graphHash) ||
+    (typeof metadata?.graphHash === 'string' && metadata.graphHash) ||
+    (pooled ? 'workflow-pool' : null);
+  return {
+    runId,
+    graphHash,
+    instanceId:
+      typeof record.instanceId === 'string' && record.instanceId
+        ? record.instanceId
+        : null,
+    pooledBootstrap: pooled,
+  };
+}
+
+function workflowPoolEnabled(env: CoordinatorEnv): boolean {
+  const configured = env.DEEPLINE_WORKFLOW_PREWARM_POOL?.trim().toLowerCase();
+  if (configured) {
+    return configured === '1' || configured === 'true' || configured === 'yes';
+  }
+  return false;
+}
+
+function workflowPoolTargetSize(env: CoordinatorEnv): number {
+  const raw = Number(env.DEEPLINE_WORKFLOW_PREWARM_POOL_SIZE ?? '');
+  if (!Number.isFinite(raw) || raw <= 0) return WORKFLOW_POOL_DEFAULT_SIZE;
+  return Math.min(Math.max(Math.floor(raw), 1), 5);
+}
+
+async function createDynamicWorkflowInstance(input: {
+  env: CoordinatorEnv;
+  id: string;
+  params: PlayWorkflowParams;
+}): Promise<WorkflowInstance> {
+  const workflow = createDispatcherWorkflowBinding(
+    () => input.env.PLAY_WORKFLOW as unknown as Workflow,
+    buildDynamicWorkflowMetadata(input.params),
+  );
+  return workflow.create({
+    id: input.id,
+    params: input.params,
+  });
+}
+
+function workflowPoolDurableObject(env: CoordinatorEnv): DurableObjectStub {
+  return env.PLAY_DEDUP.get(env.PLAY_DEDUP.idFromName(WORKFLOW_POOL_DO_NAME));
+}
+
+async function callWorkflowPool<T>(
+  env: CoordinatorEnv,
+  path: string,
+  init?: RequestInit,
+): Promise<T> {
+  const response = await workflowPoolDurableObject(env).fetch(
+    `https://deepline.workflow-pool.internal${path}`,
+    {
+      ...init,
+      headers: {
+        'content-type': 'application/json',
+        ...(init?.headers ?? {}),
+      },
+    },
+  );
+  if (!response.ok) {
+    throw new Error(
+      `workflow pool ${path} failed ${response.status}: ${(
+        await response.text().catch(() => '')
+      ).slice(0, 400)}`,
+    );
+  }
+  return (await response.json()) as T;
+}
+
+type WorkflowPoolCounts = {
+  available: number;
+  warming: number;
+};
+
+type WorkflowPoolRefillResult = WorkflowPoolCounts & {
+  target: number;
+  created: number;
+  promoted: number;
+  removed: number;
+  waitedMs: number;
+  waitIterations: number;
+};
+
+type WorkflowPoolListEntry = {
+  id: string;
+  createdAt: number;
+  readyAt: number | null;
+  expiresAt: number;
+};
+
+async function workflowPoolCount(env: CoordinatorEnv): Promise<WorkflowPoolCounts> {
+  const body = await callWorkflowPool<{
+    available?: unknown;
+    warming?: unknown;
+  }>(
+    env,
+    `/pool-count?version=${encodeURIComponent(WORKFLOW_POOL_PROTOCOL_VERSION)}`,
+  );
+  return {
+    available: typeof body.available === 'number' ? body.available : 0,
+    warming: typeof body.warming === 'number' ? body.warming : 0,
+  };
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function listWorkflowPoolEntries(
+  env: CoordinatorEnv,
+): Promise<WorkflowPoolListEntry[]> {
+  const body = await callWorkflowPool<{ entries?: unknown }>(
+    env,
+    `/pool-list?version=${encodeURIComponent(WORKFLOW_POOL_PROTOCOL_VERSION)}`,
+  );
+  if (!Array.isArray(body.entries)) return [];
+  return body.entries
+    .filter((entry): entry is Record<string, unknown> =>
+      Boolean(entry && typeof entry === 'object' && !Array.isArray(entry)),
+    )
+    .map((entry) => ({
+      id: typeof entry.id === 'string' ? entry.id : '',
+      createdAt:
+        typeof entry.createdAt === 'number' && Number.isFinite(entry.createdAt)
+          ? entry.createdAt
+          : 0,
+      readyAt:
+        typeof entry.readyAt === 'number' && Number.isFinite(entry.readyAt)
+          ? entry.readyAt
+          : null,
+      expiresAt:
+        typeof entry.expiresAt === 'number' && Number.isFinite(entry.expiresAt)
+          ? entry.expiresAt
+          : 0,
+    }))
+    .filter((entry) => entry.id);
+}
+
+async function addWorkflowPoolIds(
+  env: CoordinatorEnv,
+  ids: string[],
+  options?: { ready?: boolean },
+): Promise<void> {
+  if (ids.length === 0) return;
+  await callWorkflowPool(env, '/pool-add', {
+    method: 'POST',
+    body: JSON.stringify({
+      ids,
+      ttlMs: WORKFLOW_POOL_TTL_MS,
+      version: WORKFLOW_POOL_PROTOCOL_VERSION,
+      ready: options?.ready === true,
+      ...(options?.ready === true ? { readyAt: Date.now() } : {}),
+    }),
+  });
+}
+
+async function promoteWorkflowPoolIds(
+  env: CoordinatorEnv,
+  ids: string[],
+): Promise<void> {
+  if (ids.length === 0) return;
+  await callWorkflowPool(env, '/pool-promote', {
+    method: 'POST',
+    body: JSON.stringify({
+      ids,
+      version: WORKFLOW_POOL_PROTOCOL_VERSION,
+    }),
+  });
+}
+
+async function deleteWorkflowPoolIds(
+  env: CoordinatorEnv,
+  ids: string[],
+): Promise<void> {
+  if (ids.length === 0) return;
+  await callWorkflowPool(env, '/pool-delete', {
+    method: 'POST',
+    body: JSON.stringify({
+      ids,
+      version: WORKFLOW_POOL_PROTOCOL_VERSION,
+    }),
+  });
+}
+
+async function leaseWorkflowPoolId(
+  env: CoordinatorEnv,
+): Promise<string | null> {
+  const body = await callWorkflowPool<{ id?: unknown }>(
+    env,
+    `/pool-lease?version=${encodeURIComponent(WORKFLOW_POOL_PROTOCOL_VERSION)}`,
+    {
+      method: 'POST',
+      body: '{}',
+    },
+  );
+  return typeof body.id === 'string' && body.id ? body.id : null;
+}
+
+async function mapRunToWorkflowInstance(input: {
+  env: CoordinatorEnv;
+  runId: string;
+  instanceId: string;
+}): Promise<void> {
+  await callWorkflowPool(input.env, '/pool-map-run', {
+    method: 'POST',
+    body: JSON.stringify({
+      runId: input.runId,
+      instanceId: input.instanceId,
+      version: WORKFLOW_POOL_PROTOCOL_VERSION,
+    }),
+  });
+}
+
+async function resolveWorkflowInstanceIdForRun(
+  env: CoordinatorEnv,
+  runId: string,
+): Promise<string> {
+  if (!workflowPoolEnabled(env)) {
+    return workflowInstanceId(runId);
+  }
+  const body = await callWorkflowPool<{ instanceId?: unknown }>(
+    env,
+    `/pool-resolve-run?runId=${encodeURIComponent(runId)}&version=${encodeURIComponent(
+      WORKFLOW_POOL_PROTOCOL_VERSION,
+    )}`,
+  ).catch(() => ({ instanceId: null }));
+  return typeof body.instanceId === 'string' && body.instanceId
+    ? body.instanceId
+    : workflowInstanceId(runId);
+}
+
+async function clearWorkflowPool(env: CoordinatorEnv): Promise<number> {
+  const entries = await listWorkflowPoolEntries(env).catch(() => []);
+  const body = await callWorkflowPool<{ deleted?: unknown }>(
+    env,
+    `/pool-clear?version=${encodeURIComponent(WORKFLOW_POOL_PROTOCOL_VERSION)}`,
+    { method: 'POST', body: '{}' },
+  );
+  await Promise.all(
+    entries.map(async (entry) => {
+      const instance = await env.PLAY_WORKFLOW.get(entry.id);
+      try {
+        await instance.terminate().catch(() => undefined);
+      } finally {
+        disposeRpcStub(instance);
+      }
+    }),
+  );
+  return typeof body.deleted === 'number' ? body.deleted : 0;
+}
+
+function workflowStatusName(status: InstanceStatus | null): string {
+  return typeof status?.status === 'string' ? status.status : 'unknown';
+}
+
+function workflowPoolStatusIsReady(statusName: string): boolean {
+  // Cloudflare Workflows may report a run as "running" even while the body is
+  // blocked inside step.waitForEvent(). Treat both states as pool-candidates;
+  // submitViaPooledWorkflow still falls back to a fresh Workflow if sendEvent
+  // fails.
+  return statusName === 'waiting' || statusName === 'running';
+}
+
+async function waitForWorkflowPoolReady(instance: WorkflowInstance): Promise<{
+  ready: boolean;
+  status: string;
+  ms: number;
+  polls: number;
+}> {
+  const startedAt = Date.now();
+  let lastStatus: InstanceStatus | null = null;
+  let polls = 0;
+  while (Date.now() - startedAt < WORKFLOW_POOL_READY_TIMEOUT_MS) {
+    lastStatus = await instance.status();
+    polls += 1;
+    const statusName = workflowStatusName(lastStatus);
+    if (workflowPoolStatusIsReady(statusName)) {
+      return {
+        ready: true,
+        status: statusName,
+        ms: Date.now() - startedAt,
+        polls,
+      };
+    }
+    if (
+      statusName === 'complete' ||
+      statusName === 'errored' ||
+      statusName === 'terminated'
+    ) {
+      return {
+        ready: false,
+        status: statusName,
+        ms: Date.now() - startedAt,
+        polls,
+      };
+    }
+    await new Promise((resolve) =>
+      setTimeout(resolve, WORKFLOW_POOL_READY_POLL_MS),
+    );
+  }
+  return {
+    ready: false,
+    status: workflowStatusName(lastStatus),
+    ms: Date.now() - startedAt,
+    polls,
+  };
+}
+
+async function refillWorkflowPoolOnce(
+  env: CoordinatorEnv,
+): Promise<Omit<WorkflowPoolRefillResult, 'waitedMs' | 'waitIterations'>> {
+  if (!workflowPoolEnabled(env)) {
+    return {
+      available: 0,
+      warming: 0,
+      target: 0,
+      created: 0,
+      promoted: 0,
+      removed: 0,
+    };
+  }
+  const target = workflowPoolTargetSize(env);
+  const entries = await listWorkflowPoolEntries(env);
+  const warmingEntries = entries.filter((entry) => entry.readyAt === null);
+  const promotedIds: string[] = [];
+  const removedIds: string[] = [];
+  for (const entry of warmingEntries) {
+    const instance = await env.PLAY_WORKFLOW.get(entry.id);
+    try {
+      const status = await instance.status().catch(() => null);
+      const statusName = workflowStatusName(status);
+      if (workflowPoolStatusIsReady(statusName)) {
+        promotedIds.push(entry.id);
+      } else if (
+        statusName === 'complete' ||
+        statusName === 'errored' ||
+        statusName === 'terminated' ||
+        statusName === 'unknown'
+      ) {
+        removedIds.push(entry.id);
+      }
+    } finally {
+      disposeRpcStub(instance);
+    }
+  }
+  await Promise.all([
+    promoteWorkflowPoolIds(env, promotedIds),
+    deleteWorkflowPoolIds(env, removedIds),
+  ]);
+  const counts = await workflowPoolCount(env);
+  const totalTracked = counts.available + counts.warming;
+  const needed = Math.max(0, target - totalTracked);
+  if (needed === 0) {
+    return {
+      available: counts.available,
+      warming: counts.warming,
+      target,
+      created: 0,
+      promoted: promotedIds.length,
+      removed: removedIds.length,
+    };
+  }
+  const readyCreatedIds: string[] = [];
+  const warmingCreatedIds: string[] = [];
+  for (let i = 0; i < needed; i += 1) {
+    const poolId = `pool-v2-${Date.now().toString(36)}-${crypto.randomUUID().slice(0, 12)}`;
+    const instance = await env.PLAY_WORKFLOW.create({
+      id: poolId,
+      params: {
+        __deeplinePooledWorkflow: true,
+        poolId,
+        createdAt: Date.now(),
+      } satisfies PooledWorkflowBootstrapPayload,
+    });
+    try {
+      const readiness = await waitForWorkflowPoolReady(instance);
+      recordCoordinatorPerfTrace({
+        runId: poolId,
+        phase: 'coordinator.workflow_pool_ready',
+        ms: readiness.ms,
+        graphHash: 'workflow-pool',
+        extra: {
+          ready: readiness.ready,
+          status: readiness.status,
+          polls: readiness.polls,
+        },
+      });
+      if (readiness.ready) {
+        readyCreatedIds.push(poolId);
+      } else if (
+        readiness.status === 'complete' ||
+        readiness.status === 'errored' ||
+        readiness.status === 'terminated' ||
+        readiness.status === 'unknown'
+      ) {
+        removedIds.push(poolId);
+        await instance.terminate().catch(() => undefined);
+      } else {
+        warmingCreatedIds.push(poolId);
+      }
+    } finally {
+      disposeRpcStub(instance);
+    }
+  }
+  await Promise.all([
+    addWorkflowPoolIds(env, readyCreatedIds, { ready: true }),
+    addWorkflowPoolIds(env, warmingCreatedIds, { ready: false }),
+  ]);
+  const finalCounts = await workflowPoolCount(env);
+  return {
+    available: finalCounts.available,
+    warming: finalCounts.warming,
+    target,
+    created: readyCreatedIds.length + warmingCreatedIds.length,
+    promoted: promotedIds.length,
+    removed: removedIds.length,
+  };
+}
+
+async function refillWorkflowPool(
+  env: CoordinatorEnv,
+  options?: {
+    minAvailable?: number;
+    waitReady?: boolean;
+    waitTimeoutMs?: number;
+  },
+): Promise<WorkflowPoolRefillResult> {
+  const startedAt = Date.now();
+  const minAvailable = Math.max(1, Math.floor(options?.minAvailable ?? 1));
+  const waitReady = options?.waitReady === true;
+  const waitTimeoutMs =
+    typeof options?.waitTimeoutMs === 'number' &&
+    Number.isFinite(options.waitTimeoutMs) &&
+    options.waitTimeoutMs > 0
+      ? Math.min(Math.floor(options.waitTimeoutMs), 15_000)
+      : 4_000;
+  let totals = await refillWorkflowPoolOnce(env);
+  let iterations = 0;
+  const readyWaitStartedAt = Date.now();
+
+  while (
+    workflowPoolEnabled(env) &&
+    waitReady &&
+    totals.available < minAvailable &&
+    Date.now() - readyWaitStartedAt < waitTimeoutMs
+  ) {
+    iterations += 1;
+    await sleep(WORKFLOW_POOL_READY_POLL_MS);
+    const next = await refillWorkflowPoolOnce(env);
+    totals = {
+      ...next,
+      created: totals.created + next.created,
+      promoted: totals.promoted + next.promoted,
+      removed: totals.removed + next.removed,
+    };
+  }
+
+  const result: WorkflowPoolRefillResult = {
+    ...totals,
+    waitedMs: Date.now() - startedAt,
+    waitIterations: iterations,
+  };
+  recordCoordinatorPerfTrace({
+    runId: 'workflow-pool',
+    phase: 'coordinator.workflow_pool_refill',
+    ms: result.waitedMs,
+    graphHash: 'workflow-pool',
+    extra: result,
+  });
+  return result;
+}
+
+async function submitViaPooledWorkflow(input: {
+  env: CoordinatorEnv;
+  params: PlayWorkflowParams;
+  recordSubmitTiming: (timing: CoordinatorTiming) => void;
+}): Promise<WorkflowInstance | null> {
+  if (!workflowPoolEnabled(input.env)) {
+    return null;
+  }
+  const leaseStartedAt = Date.now();
+  const pooledInstanceId = await leaseWorkflowPoolId(input.env);
+  const missCounts = pooledInstanceId
+    ? null
+    : await workflowPoolCount(input.env).catch(() => null);
+  input.recordSubmitTiming({
+    phase: 'coordinator.workflow_pool_lease',
+    ms: Date.now() - leaseStartedAt,
+    graphHash: input.params.graphHash ?? null,
+    extra: {
+      pooled: Boolean(pooledInstanceId),
+      ...(missCounts
+        ? {
+            availableAfterMiss: missCounts.available,
+            warmingAfterMiss: missCounts.warming,
+          }
+        : {}),
+    },
+  });
+  if (!pooledInstanceId) {
+    return null;
+  }
+
+  const instance = await input.env.PLAY_WORKFLOW.get(pooledInstanceId);
+  try {
+    const readyCheckStartedAt = Date.now();
+    const status = await instance.status().catch(() => null);
+    const statusName = workflowStatusName(status);
+    input.recordSubmitTiming({
+      phase: 'coordinator.workflow_pool_ready_check',
+      ms: Date.now() - readyCheckStartedAt,
+      graphHash: input.params.graphHash ?? null,
+      extra: { instanceId: pooledInstanceId, status: statusName },
+    });
+    if (!workflowPoolStatusIsReady(statusName)) {
+      await instance.terminate().catch(() => undefined);
+      disposeRpcStub(instance);
+      return null;
+    }
+    const sendStartedAt = Date.now();
+    await instance.sendEvent({
+      type: WORKFLOW_POOL_START_EVENT_TYPE,
+      payload: buildDispatcherEnvelope(input.params),
+    });
+    await mapRunToWorkflowInstance({
+      env: input.env,
+      runId: input.params.runId,
+      instanceId: pooledInstanceId,
+    });
+    input.recordSubmitTiming({
+      phase: 'coordinator.workflow_pool_send_event',
+      ms: Date.now() - sendStartedAt,
+      graphHash: input.params.graphHash ?? null,
+      extra: { instanceId: pooledInstanceId },
+    });
+    return instance;
+  } catch (error) {
+    disposeRpcStub(instance);
+    console.warn('[coordinator.workflow_pool] sendEvent failed; falling back', {
+      runId: input.params.runId,
+      pooledInstanceId,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return null;
+  }
+}
+
+function readWorkflowPayload(event: unknown): Record<string, unknown> | null {
+  if (!isRecord(event)) return null;
+  const payload = event.payload;
+  return isRecord(payload) ? payload : null;
+}
+
+async function markWorkflowRuntimeFailure(input: {
+  env: CoordinatorEnv;
+  event: unknown;
+  error: unknown;
+}): Promise<void> {
+  const payload = readWorkflowPayload(input.event);
+  if (!payload) return;
+  const runId = typeof payload.runId === 'string' ? payload.runId : null;
+  const baseUrl = typeof payload.baseUrl === 'string' ? payload.baseUrl : null;
+  const executorToken =
+    typeof payload.executorToken === 'string' ? payload.executorToken : null;
+  if (!runId || !baseUrl || !executorToken) return;
+  const errorName =
+    input.error instanceof Error && input.error.name
+      ? input.error.name
+      : 'Error';
+  const errorMessage =
+    input.error instanceof Error ? input.error.message : String(input.error);
+  const errorStack =
+    input.error instanceof Error && typeof input.error.stack === 'string'
+      ? input.error.stack.split('\n').slice(0, 12).join('\n')
+      : null;
+  const headers = new Headers({
+    authorization: `Bearer ${executorToken}`,
+    'content-type': 'application/json',
+  });
+  const bypass = input.env.VERCEL_PROTECTION_BYPASS_TOKEN?.trim();
+  if (bypass) headers.set('x-vercel-protection-bypass', bypass);
+  const body = JSON.stringify(
+    runtimeRunActions.updateStatus({
+      playId: runId,
+      status: 'failed',
+      error: `DynamicWorkflow runner failed: ${errorName}: ${errorMessage}${
+        errorStack ? `\n${errorStack}` : ''
+      }`,
+      runtimeBackend: 'cf_workflows_dynamic_worker',
+    }),
+  );
+  const url = `${baseUrl.replace(/\/$/, '')}/api/v2/plays/internal/runtime`;
+  const backoffMs = [200, 500, 1500];
+  let lastError: unknown = null;
+  for (let attempt = 0; attempt <= backoffMs.length; attempt += 1) {
+    try {
+      const response = await fetch(url, { method: 'POST', headers, body });
+      if (response.ok) return;
+      lastError = new Error(
+        `runtime API responded ${response.status}: ${(await response.text().catch(() => '')).slice(0, 400)}`,
+      );
+      if (
+        response.status >= 400 &&
+        response.status < 500 &&
+        response.status !== 408 &&
+        response.status !== 429
+      ) {
+        break;
+      }
+    } catch (error) {
+      lastError = error;
+    }
+    if (attempt < backoffMs.length) {
+      await new Promise((resolve) => setTimeout(resolve, backoffMs[attempt]));
+    }
+  }
+  console.error('[coordinator] failed to mark workflow runtime failure', {
+    runId,
+    message: lastError instanceof Error ? lastError.message : String(lastError),
+  });
+}
+
+type StoredPlayArtifactPayload = {
+  artifact?: {
+    bundledCode?: string;
+    artifactKind?: string;
+  };
+};
+
+const DYNAMIC_WORKER_COMPATIBILITY_DATE = '2026-05-01';
+
+async function mintChildWorkflowExecutorToken(input: {
+  env: CoordinatorEnv;
+  baseUrl: string;
+  parentExecutorToken: string;
+  parentRunId: string;
+  parentPlayName: string;
+  childRunId: string;
+  childPlayName: string;
+  maxCreditsPerRun?: number | null;
+}): Promise<string> {
+  const url = `${input.baseUrl.replace(/\/$/, '')}/api/v2/plays/internal/child-executor-token`;
+  const headers = new Headers({
+    authorization: `Bearer ${input.parentExecutorToken}`,
+    'content-type': 'application/json',
+    'x-deepline-request-id': crypto.randomUUID(),
+  });
+  if (input.env.VERCEL_PROTECTION_BYPASS_TOKEN?.trim()) {
+    headers.set(
+      'x-vercel-protection-bypass',
+      input.env.VERCEL_PROTECTION_BYPASS_TOKEN.trim(),
+    );
+  }
+  const response = await fetch(url, {
+    method: 'POST',
+    headers,
+    body: JSON.stringify({
+      parentRunId: input.parentRunId,
+      parentPlayName: input.parentPlayName,
+      childRunId: input.childRunId,
+      childPlayName: input.childPlayName,
+      maxCreditsPerRun: input.maxCreditsPerRun ?? null,
+    }),
+  });
+  const text = await response.text().catch(() => '');
+  let parsed: Record<string, unknown> = {};
+  try {
+    parsed = text ? (JSON.parse(text) as Record<string, unknown>) : {};
+  } catch {
+    parsed = {};
+  }
+  if (!response.ok) {
+    const error = isRecord(parsed.error) ? parsed.error : null;
+    const message =
+      (typeof error?.message === 'string' && error.message.trim()) ||
+      (typeof parsed.error === 'string' && parsed.error.trim()) ||
+      text.slice(0, 800) ||
+      `Origin child executor token mint failed with ${response.status}.`;
+    throw new Error(message);
+  }
+  const executorToken = parsed.executorToken;
+  if (typeof executorToken !== 'string' || !executorToken.trim()) {
+    throw new Error('Origin child executor token response was missing executorToken.');
+  }
+  return executorToken;
+}
+
+function buildChildRunId(playName: string): string {
+  const slug =
+    playName
+      .toLowerCase()
+      .replace(/[^a-z0-9-]/g, '-')
+      .replace(/-+/g, '-')
+      .replace(/^-+|-+$/g, '')
+      .slice(0, 64) || 'play';
+  return `play/${slug}/run/${new Date()
+    .toISOString()
+    .replace(/[-:.]/g, '')
+    .replace('T', 't')
+    .replace('Z', '')}-${crypto.randomUUID().slice(0, 8)}`;
+}
+
+function normalizeRuntimeBaseUrl(value: unknown): string | null {
+  if (typeof value !== 'string') return null;
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  let parsed: URL;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return null;
+  }
+  if (
+    (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') ||
+    parsed.username ||
+    parsed.password ||
+    parsed.search ||
+    parsed.hash ||
+    (parsed.pathname !== '/' && parsed.pathname !== '')
+  ) {
+    return null;
+  }
+  return parsed.toString().replace(/\/$/, '');
+}
+
+function resolveRuntimeBaseUrl(env: CoordinatorEnv, body: Record<string, unknown>): string {
+  return normalizeRuntimeBaseUrl(body.callbackBaseUrl) ??
+    normalizeRuntimeBaseUrl(body.baseUrl) ??
+    env.DEEPLINE_API_BASE_URL.replace(/\/$/, '');
+}
+
+function validateChildSubmitBody(input: {
+  parentRunId: string;
+  body: Record<string, unknown>;
+}):
+  | {
+      ok: true;
+      manifest: PlayRuntimeManifest;
+      governance: PlayCallGovernanceSnapshot;
+      childPlayName: string;
+      orgId: string;
+      parentExecutorToken: string;
+    }
+  | { ok: false; status: number; error: Record<string, unknown> } {
+  const { parentRunId, body } = input;
+  const manifest = body.manifest as PlayRuntimeManifest | undefined;
+  const governance = body.internalRunPlay as
+    | PlayCallGovernanceSnapshot
+    | undefined;
+  const childPlayName =
+    typeof body.name === 'string' && body.name.trim()
+      ? body.name.trim()
+      : manifest?.playName?.trim();
+  if (
+    !manifest ||
+    !childPlayName ||
+    !manifest.artifactStorageKey ||
+    !manifest.artifactHash ||
+    !manifest.graphHash ||
+    !governance
+  ) {
+    return {
+      ok: false,
+      status: 400,
+      error: {
+        code: 'CHILD_MANIFEST_REQUIRED',
+        message: 'submit-child requires a trusted child manifest and lineage.',
+        phase: 'coordinator_child_submit',
+        parentRunId,
+      },
+    };
+  }
+  const orgId = typeof body.orgId === 'string' ? body.orgId : '';
+  if (!orgId) {
+    return {
+      ok: false,
+      status: 400,
+      error: {
+        code: 'CHILD_ORG_REQUIRED',
+        message: 'submit-child requires orgId from the parent runtime.',
+        phase: 'coordinator_child_submit',
+        parentRunId,
+      },
+    };
+  }
+  const parentExecutorToken =
+    typeof body.parentExecutorToken === 'string'
+      ? body.parentExecutorToken.trim()
+      : '';
+  if (!parentExecutorToken) {
+    return {
+      ok: false,
+      status: 400,
+      error: {
+        code: 'PARENT_EXECUTOR_TOKEN_REQUIRED',
+        message:
+          'submit-child requires the parent executor token for origin-scoped child token minting.',
+        phase: 'coordinator_child_submit',
+        parentRunId,
+      },
+    };
+  }
+  return {
+    ok: true,
+    manifest,
+    governance,
+    childPlayName,
+    orgId,
+    parentExecutorToken,
+  };
+}
+
+function buildChildWorkflowParams(input: {
+  env: CoordinatorEnv;
+  body: Record<string, unknown>;
+  manifest: PlayRuntimeManifest;
+  governance: PlayCallGovernanceSnapshot;
+  childRunId: string;
+  childPlayName: string;
+  childToken: string;
+  orgId: string;
+  coordinatorUrl: string | null;
+}): PlayWorkflowParams {
+  const {
+    env,
+    body,
+    manifest,
+    governance,
+    childRunId,
+    childPlayName,
+    childToken,
+    orgId,
+    coordinatorUrl,
+  } = input;
+  const baseUrl = resolveRuntimeBaseUrl(env, body);
+  return {
+    runId: childRunId,
+    playId: childRunId,
+    playName: childPlayName,
+    artifactStorageKey: manifest.artifactStorageKey,
+    artifactHash: manifest.artifactHash,
+    graphHash: manifest.graphHash,
+    input: isRecord(body.input) ? body.input : {},
+    contractSnapshot: {
+      source: 'published',
+      revisionVersion: null,
+      staticPipeline: manifest.staticPipeline,
+      billingLimit:
+        typeof manifest.maxCreditsPerRun === 'number'
+          ? { maxCreditsPerRun: manifest.maxCreditsPerRun }
+          : null,
+      sourceCode: manifest.sourceCode ?? '',
+      artifactMetadata: {
+        storageKey: manifest.artifactStorageKey,
+        artifactHash: manifest.artifactHash,
+        graphHash: manifest.graphHash,
+      },
+      codeFormat: 'cjs_module',
+      compatibility: {
+        apiVersion: 2,
+        runtimeBackend: 'workers_edge',
+      },
+    },
+    executionPlan: null,
+    childPlayManifests: isRecord(body.childPlayManifests)
+      ? (body.childPlayManifests as PlayRuntimeManifestMap)
+      : null,
+    playCallGovernance: governance,
+    dynamicWorkerCode: null,
+    executorToken: childToken,
+    baseUrl,
+    orgId,
+    userEmail: typeof body.userEmail === 'string' ? body.userEmail : '',
+    userId: typeof body.userId === 'string' ? body.userId : null,
+    runtimeBackend: 'cf_workflows_dynamic_worker_inline_child',
+    dedupBackend: 'in_memory',
+    coordinatorUrl,
+  };
+}
+
+function runRequestFromPlayWorkflowParams(params: PlayWorkflowParams): Record<string, unknown> {
+  return {
+    runId: params.runId,
+    callbackUrl: params.baseUrl,
+    executorToken: params.executorToken,
+    baseUrl: params.baseUrl,
+    orgId: params.orgId,
+    playName: params.playName,
+    graphHash: params.graphHash,
+    userEmail: params.userEmail,
+    runtimeInput: params.input,
+    inlineCsv: params.inlineCsv ?? null,
+    inputR2Keys:
+      params.inputFile?.r2Key && (params.inputFile.name || params.inputFile.path)
+        ? {
+            [String(params.inputFile.name ?? params.inputFile.path)]:
+              params.inputFile.r2Key,
+          }
+        : null,
+    packagedFiles: params.packagedFiles ?? null,
+    partitionRange: null,
+    dedupBackend: params.dedupBackend,
+    resumeFromCheckpointR2Key: null,
+    contractSnapshot: params.contractSnapshot ?? null,
+    executionPlan: params.executionPlan ?? null,
+    childPlayManifests: params.childPlayManifests ?? null,
+    playCallGovernance: params.playCallGovernance ?? null,
+    coordinatorUrl: params.coordinatorUrl ?? null,
+    totalRows: params.totalRows,
+  };
+}
+
+async function readLegacyRunStream(response: Response): Promise<{
+  result: unknown;
+  outputRows: number | null;
+  logs: string[];
+  error: { message: string; stack: string | null } | null;
+}> {
+  if (!response.body) {
+    throw new Error('Legacy child Worker returned an empty stream.');
+  }
+  const decoder = new TextDecoder();
+  const reader = response.body.getReader();
+  const logs: string[] = [];
+  let result: unknown = null;
+  let outputRows: number | null = null;
+  let error: { message: string; stack: string | null } | null = null;
+  let buffered = '';
+
+  const consumeLine = (line: string): void => {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      return;
+    }
+    let event: unknown;
+    try {
+      event = JSON.parse(trimmed);
+    } catch {
+      logs.push(trimmed);
+      return;
+    }
+    if (!event || typeof event !== 'object') {
+      return;
+    }
+    const record = event as Record<string, unknown>;
+    if (record.type === 'log' && typeof record.message === 'string') {
+      logs.push(record.message);
+      return;
+    }
+    if (record.type === 'result') {
+      result = record.result;
+      outputRows =
+        typeof record.outputRows === 'number' ? record.outputRows : null;
+      return;
+    }
+    if (record.type === 'error') {
+      error = {
+        message:
+          typeof record.message === 'string'
+            ? record.message
+            : 'Legacy child Worker failed.',
+        stack: typeof record.stack === 'string' ? record.stack : null,
+      };
+    }
+  };
+
+  for (;;) {
+    const { value, done } = await reader.read();
+    if (value) {
+      buffered += decoder.decode(value, { stream: !done });
+      const lines = buffered.split('\n');
+      buffered = lines.pop() ?? '';
+      for (const line of lines) {
+        consumeLine(line);
+      }
+    }
+    if (done) {
+      buffered += decoder.decode();
+      consumeLine(buffered);
+      break;
+    }
+  }
+
+  return { result, outputRows, logs, error };
+}
+
+async function executeChildInline(input: {
+  env: CoordinatorEnv;
+  parentRunId: string;
+  body: Record<string, unknown>;
+}): Promise<InlineChildSubmitResult> {
+  const startedAt = Date.now();
+  const validated = validateChildSubmitBody(input);
+  if (!validated.ok) {
+    throw new Error(String(validated.error.message ?? 'Invalid child submit.'));
+  }
+  const {
+    manifest,
+    governance,
+    childPlayName,
+    orgId,
+    parentExecutorToken,
+  } = validated;
+  const childRunId = buildChildRunId(childPlayName);
+  const timings: CoordinatorTiming[] = [];
+  const trace = (
+    phase: string,
+    phaseStartedAt: number,
+    extra?: Record<string, unknown>,
+  ): void => {
+    const timing: CoordinatorTiming = {
+      phase,
+      ms: Date.now() - phaseStartedAt,
+      graphHash: manifest.graphHash,
+      ...(extra ? { extra } : {}),
+    };
+    timings.push(timing);
+    recordCoordinatorPerfTrace({
+      runId: childRunId,
+      phase,
+      ms: timing.ms,
+      graphHash: manifest.graphHash,
+      extra: {
+        parentRunId: input.parentRunId,
+        mode: 'inline_dynamic_worker',
+        ...(extra ?? {}),
+      },
+    });
+  };
+  recordCoordinatorPerfTrace({
+    runId: childRunId,
+    phase: 'coordinator.inline_child_boundary',
+    ms: 0,
+    graphHash: manifest.graphHash,
+    extra: {
+      parentRunId: input.parentRunId,
+      childPlayName,
+      action: 'start',
+      mode: 'inline_dynamic_worker',
+    },
+  });
+
+  const tokenStartedAt = Date.now();
+  const childToken = await mintChildWorkflowExecutorToken({
+    env: input.env,
+    baseUrl: resolveRuntimeBaseUrl(input.env, input.body),
+    parentExecutorToken,
+    parentRunId: input.parentRunId,
+    parentPlayName:
+      typeof input.body.parentPlayName === 'string' &&
+      input.body.parentPlayName.trim()
+        ? input.body.parentPlayName.trim()
+        : governance.parentPlayName,
+    childRunId,
+    childPlayName,
+    maxCreditsPerRun: manifest.maxCreditsPerRun ?? null,
+  });
+  trace('coordinator.inline_child_token', tokenStartedAt);
+
+  const params = buildChildWorkflowParams({
+    env: input.env,
+    body: input.body,
+    manifest,
+    governance,
+    childRunId,
+    childPlayName,
+    childToken,
+    orgId,
+    coordinatorUrl: null,
+  });
+  const loaderStartedAt = Date.now();
+  const stub = loadDynamicPlayWorker(input.env, {
+    runId: childRunId,
+    graphHash: manifest.graphHash,
+    artifactStorageKey: manifest.artifactStorageKey,
+    artifactHash: manifest.artifactHash,
+    dynamicWorkerCode:
+      typeof manifest.dynamicWorkerCode === 'string'
+        ? manifest.dynamicWorkerCode
+        : null,
+    packagedFiles: null,
+  });
+  trace('coordinator.inline_child_loader_get', loaderStartedAt);
+
+  let entrypoint: ReturnType<Awaited<typeof stub>['getEntrypoint']> | null =
+    null;
+  let response: Response | null = null;
+  try {
+    const awaitedStub = await stub;
+    const entrypointStartedAt = Date.now();
+    entrypoint = awaitedStub.getEntrypoint();
+    trace('coordinator.inline_child_get_entrypoint', entrypointStartedAt);
+    const fetchStartedAt = Date.now();
+    response = await entrypoint.fetch(
+      new Request('https://deepline.dynamic.internal/run-inline', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(runRequestFromPlayWorkflowParams(params)),
+      }),
+    );
+    trace('coordinator.inline_child_worker_fetch', fetchStartedAt, {
+      status: response.status,
+      endpoint: '/run-inline',
+    });
+    let usedLegacyRunStream = false;
+    if (response.status === 404) {
+      disposeRpcStub(response);
+      const legacyFetchStartedAt = Date.now();
+      response = await entrypoint.fetch(
+        new Request('https://deepline.dynamic.internal/run', {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify(runRequestFromPlayWorkflowParams(params)),
+        }),
+      );
+      usedLegacyRunStream = true;
+      trace('coordinator.inline_child_worker_fetch', legacyFetchStartedAt, {
+        status: response.status,
+        endpoint: '/run',
+        compatibility: 'legacy_stream',
+      });
+    }
+    if (!response.ok) {
+      const text = await response.text().catch(() => '');
+      throw new Error(
+        `Inline child Worker failed ${response.status}: ${text.slice(0, 800)}`,
+      );
+    }
+    const responseStartedAt = Date.now();
+    const parsed: InlineWorkerRunResponse = usedLegacyRunStream
+      ? await readLegacyRunStream(response).then((legacy) => ({
+          status: legacy.error ? 'failed' : 'completed',
+          result: legacy.result,
+          outputRows: legacy.outputRows ?? undefined,
+          events: legacy.logs.map((message) => ({
+            type: 'log',
+            message,
+          })),
+          error: legacy.error ?? undefined,
+        }))
+      : ((await response.json()) as InlineWorkerRunResponse);
+    const logs = (parsed.events ?? []).flatMap((event) => {
+      if (
+        event &&
+        typeof event === 'object' &&
+        event.type === 'log' &&
+        typeof event.message === 'string'
+      ) {
+        return [event.message];
+      }
+      return [];
+    });
+    trace('coordinator.inline_child_response', responseStartedAt, {
+      status: parsed.status ?? null,
+      endpoint: usedLegacyRunStream ? '/run' : '/run-inline',
+      logCount: logs.length,
+      outputRows:
+        typeof parsed.outputRows === 'number' ? parsed.outputRows : null,
+      durationMs:
+        typeof parsed.durationMs === 'number' ? parsed.durationMs : null,
+    });
+    trace('coordinator.inline_child_total', startedAt);
+    if (parsed.status === 'failed' || parsed.error) {
+      const error = {
+        message:
+          typeof parsed.error?.message === 'string'
+            ? parsed.error.message
+            : 'Inline child Worker failed.',
+        stack:
+          typeof parsed.error?.stack === 'string' ? parsed.error.stack : null,
+      };
+      recordCoordinatorPerfTrace({
+        runId: childRunId,
+        phase: 'coordinator.inline_child_boundary',
+        ms: Date.now() - startedAt,
+        graphHash: manifest.graphHash,
+        extra: {
+          parentRunId: input.parentRunId,
+          childPlayName,
+          action: 'failed',
+          mode: 'inline_dynamic_worker',
+          error: error.message,
+        },
+      });
+      return {
+        workflowId: childRunId,
+        runId: childRunId,
+        status: 'failed',
+        mode: 'inline_dynamic_worker',
+        error,
+        logs,
+        timings,
+      };
+    }
+    recordCoordinatorPerfTrace({
+      runId: childRunId,
+      phase: 'coordinator.inline_child_boundary',
+      ms: Date.now() - startedAt,
+      graphHash: manifest.graphHash,
+      extra: {
+        parentRunId: input.parentRunId,
+        childPlayName,
+        action: 'completed',
+        mode: 'inline_dynamic_worker',
+      },
+    });
+    return {
+      workflowId: childRunId,
+      runId: childRunId,
+      status: 'completed',
+      mode: 'inline_dynamic_worker',
+      result: parsed.result,
+      output: parsed.result,
+      logs,
+      timings,
+    };
+  } finally {
+    disposeRpcStub(response);
+    disposeRpcStub(entrypoint);
+    disposeRpcStub(await stub.catch(() => null));
+  }
+}
+
+/**
+ * In-process Fetcher handed to each per-graphHash play Worker as
+ * `env.RUNTIME_API`. Runs in the coordinator's isolate (not the play's), so
+ * `fetch(target)` here can reach `http://localhost:3000` directly in dev —
+ * no public *.workers.dev → CF edge → cloudflared → localhost chain.
+ *
+ * Has to be a `WorkerEntrypoint` (not a plain closure) because closures
+ * containing captured state aren't structured-cloneable, and Cloudflare
+ * Workflows serializes the dynamic Worker's `env` map when it persists
+ * workflow state. WorkerEntrypoint stubs ARE cloneable.
+ *
+ * Path allowlist: only `/api/v2/plays/*` and `/api/v2/integrations/*`.
+ * Anything else is a sandbox-escape attempt and gets a loud 403 — the
+ * coordinator must NOT proxy a play's request to internal admin routes
+ * even if the play tries to construct such a URL.
+ */
+export class RuntimeApi extends WorkerEntrypoint<CoordinatorEnv, undefined> {
+  async fetch(request: Request): Promise<Response> {
+    const incoming = new URL(request.url);
+    const allowed =
+      incoming.pathname.startsWith('/api/v2/plays/') ||
+      incoming.pathname.startsWith('/api/v2/integrations/');
+    if (!allowed) {
+      return new Response(
+        JSON.stringify({
+          error:
+            'RUNTIME_API binding only forwards /api/v2/plays/* and /api/v2/integrations/* paths',
+          attemptedPath: incoming.pathname,
+        }),
+        { status: 403, headers: { 'content-type': 'application/json' } },
+      );
+    }
+    const apiBaseUrl =
+      typeof this.env.DEEPLINE_API_BASE_URL === 'string' &&
+      this.env.DEEPLINE_API_BASE_URL.trim()
+        ? this.env.DEEPLINE_API_BASE_URL.trim()
+        : 'https://code.deepline.com';
+    const target = new URL(incoming.pathname + incoming.search, apiBaseUrl);
+    const forwarded = new Request(target.toString(), request);
+    const bypassToken = this.env.VERCEL_PROTECTION_BYPASS_TOKEN;
+    if (typeof bypassToken === 'string' && bypassToken) {
+      forwarded.headers.set('x-vercel-protection-bypass', bypassToken);
+    }
+    const res = await fetch(forwarded);
+    if (!res.ok) {
+      const body = await res
+        .clone()
+        .text()
+        .catch(() => '');
+      console.error(
+        `[RUNTIME_API] ${incoming.pathname} failed: status=${res.status} ` +
+          `target=${target.toString()} body=${body.slice(0, 500)}`,
+      );
+    }
+    return res;
+  }
+}
+
+export class CoordinatorControl extends WorkerEntrypoint<
+  CoordinatorEnv,
+  undefined
+> {
+  async submitChild(
+    parentRunId: string,
+    body: Record<string, unknown>,
+  ): Promise<InlineChildSubmitResult> {
+    return await executeChildInline({
+      env: this.env,
+      parentRunId,
+      body,
+    });
+  }
+
+  async signal(
+    runId: string,
+    body: Record<string, unknown>,
+  ): Promise<Record<string, unknown>> {
+    const response = await handleWorkflowRoute({
+      runId,
+      action: 'signal',
+      request: new Request(
+        `https://deepline.coordinator.internal/workflow/${encodeURIComponent(
+          runId,
+        )}/signal`,
+        {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            'x-deepline-request-id': crypto.randomUUID(),
+          },
+          body: JSON.stringify(body),
+        },
+      ),
+      env: this.env,
+    });
+    const text = await response.text().catch(() => '');
+    let parsed: Record<string, unknown> = {};
+    try {
+      parsed = text ? (JSON.parse(text) as Record<string, unknown>) : {};
+    } catch {
+      parsed = { error: text };
+    }
+    if (!response.ok) {
+      const error = isRecord(parsed.error) ? parsed.error : null;
+      const message =
+        (typeof error?.message === 'string' && error.message.trim()) ||
+        (typeof parsed.error === 'string' && parsed.error.trim()) ||
+        text.slice(0, 800) ||
+        `Coordinator signal failed with ${response.status}.`;
+      throw new Error(message);
+    }
+    return parsed;
+  }
+
+  async recordPerfTrace(
+    runId: string,
+    payload: CoordinatorPerfTracePayload,
+  ): Promise<void> {
+    if (!runId || payload.runId !== runId) {
+      throw new Error('Trace runId mismatch.');
+    }
+    await appendCoordinatorPerfTrace(this.env, payload);
+  }
+}
+
+/**
+ * Custom DynamicWorkflow class — replaces createDynamicWorkflowEntrypoint
+ * so we can wrap the framework's runner.run(innerEvent, step) RPC in a
+ * try/catch and surface the underlying error. The library's helper hides
+ * that call inside dispatchWorkflow which we now invoke directly with
+ * extra instrumentation around the inner runner call.
+ */
+export class DynamicWorkflow extends WorkflowEntrypoint<
+  CoordinatorEnv,
+  Record<string, unknown>
+> {
+  async run(event: unknown, step: unknown): Promise<unknown> {
+    const trace: CoordinatorPerfTraceSink = (traceEvent) =>
+      recordCoordinatorPerfTraceBuffered(this.env, this.ctx, traceEvent);
+    const workflowEvent = event as {
+      payload?: unknown;
+      timestamp?: Date;
+      instanceId?: string;
+    };
+    const entryTrace = readWorkflowTraceContext(event);
+    trace({
+      runId: entryTrace.runId,
+      phase: 'coordinator.workflow_run_entry',
+      ms: 0,
+      graphHash: entryTrace.graphHash,
+      extra: {
+        instanceId: entryTrace.instanceId,
+        pooledBootstrap: entryTrace.pooledBootstrap,
+      },
+    });
+    let dispatchedEvent = event;
+    if (isPooledWorkflowBootstrapPayload(workflowEvent.payload)) {
+      const waitingStep = step as {
+        waitForEvent<T>(
+          name: string,
+          options: { type: string; timeout?: string | number },
+        ): Promise<{ payload: Readonly<T>; timestamp: Date; type: string }>;
+      };
+      const waitStartedAt = Date.now();
+      const startEvent = await waitingStep.waitForEvent<DispatcherEnvelope>(
+        'wait for pooled play start',
+        { type: WORKFLOW_POOL_START_EVENT_TYPE, timeout: '10 minutes' },
+      );
+      dispatchedEvent = {
+        payload: startEvent.payload,
+        timestamp: startEvent.timestamp,
+        instanceId: workflowEvent.instanceId,
+      };
+      const dispatchedTrace = readWorkflowTraceContext(dispatchedEvent);
+      const eventDeliveryMs = Math.max(
+        0,
+        Date.now() - startEvent.timestamp.getTime(),
+      );
+      trace({
+        runId: dispatchedTrace.runId,
+        phase: 'coordinator.workflow_pool_start_event',
+        ms: eventDeliveryMs,
+        graphHash: dispatchedTrace.graphHash,
+        extra: {
+          instanceId: dispatchedTrace.instanceId,
+          eventType: startEvent.type,
+          poolWaitAgeMs: Date.now() - waitStartedAt,
+        },
+      });
+    }
+    const dispatchTrace = readWorkflowTraceContext(dispatchedEvent);
+    trace({
+      runId: dispatchTrace.runId,
+      phase: 'coordinator.dispatch_workflow_entry',
+      ms: 0,
+      graphHash: dispatchTrace.graphHash,
+      extra: {
+        instanceId: dispatchTrace.instanceId,
+        pooledBootstrap: dispatchTrace.pooledBootstrap,
+      },
+    });
+
+    return dispatchWorkflow(
+      { env: this.env, ctx: this.ctx },
+      dispatchedEvent as Parameters<typeof dispatchWorkflow>[1],
+      step as Parameters<typeof dispatchWorkflow>[2],
+      async ({ metadata, env }) => {
+        const graphHash = readMetadataString(metadata, 'graphHash');
+        const artifactStorageKey = readMetadataString(
+          metadata,
+          'artifactStorageKey',
+        );
+        const runIdForTrace =
+          typeof (metadata as Record<string, unknown>).runId === 'string'
+            ? ((metadata as Record<string, unknown>).runId as string)
+            : graphHash;
+        const loaderStartedAt = Date.now();
+        trace({
+          runId: runIdForTrace,
+          phase: 'coordinator.loader_callback_entry',
+          ms: 0,
+          graphHash,
+          extra: { artifactStorageKey },
+        });
+        const stub = loadDynamicPlayWorkerSync(
+          env,
+          {
+            runId: runIdForTrace,
+            graphHash,
+            artifactStorageKey,
+            artifactHash:
+              typeof metadata.artifactHash === 'string'
+                ? metadata.artifactHash
+                : null,
+            dynamicWorkerCode:
+              typeof metadata.dynamicWorkerCode === 'string'
+                ? metadata.dynamicWorkerCode
+                : null,
+            packagedFiles: normalizePackagedFiles(metadata.packagedFiles),
+          },
+          trace,
+        );
+        const entrypoint = stub.getEntrypoint(
+          'TenantWorkflow',
+        ) as unknown as WorkflowRunner;
+        trace({
+          runId: runIdForTrace,
+          phase: 'coordinator.loader_compile',
+          ms: Date.now() - loaderStartedAt,
+          graphHash,
+        });
+        // Wrap the entrypoint so its run() failure surfaces here rather
+        // than disappearing into the framework's silent rpcMethod=run
+        // exception path.
+        return {
+          run: async (innerEvent: unknown, innerStep: unknown) => {
+            const innerStartedAt = Date.now();
+            trace({
+              runId: runIdForTrace,
+              phase: 'coordinator.runner_run_start',
+              ms: 0,
+              graphHash,
+            });
+            try {
+              const result = await (
+                entrypoint as unknown as {
+                  run(e: unknown, s: unknown): Promise<unknown>;
+                }
+              ).run(innerEvent, innerStep);
+              trace({
+                runId: runIdForTrace,
+                phase: 'coordinator.runner_run',
+                ms: Date.now() - innerStartedAt,
+                graphHash,
+              });
+              return result;
+            } catch (innerError) {
+              console.error('[coordinator] DynamicWorkflow runner.run threw', {
+                graphHash,
+                message:
+                  innerError instanceof Error
+                    ? innerError.message
+                    : String(innerError),
+                name: innerError instanceof Error ? innerError.name : null,
+                stack:
+                  innerError instanceof Error &&
+                  typeof innerError.stack === 'string'
+                    ? innerError.stack.split('\n').slice(0, 12).join('\n')
+                    : null,
+              });
+              await markWorkflowRuntimeFailure({
+                env,
+                event: innerEvent,
+                error: innerError,
+              }).catch((markError) => {
+                console.error(
+                  '[coordinator] failed to forward DynamicWorkflow runner error',
+                  {
+                    graphHash,
+                    message:
+                      markError instanceof Error
+                        ? markError.message
+                        : String(markError),
+                  },
+                );
+              });
+              throw innerError;
+            }
+          },
+        };
+      },
+    );
+  }
+}
+
+const coordinatorEntrypoint = {
+  /**
+   * HTTP entrypoint for the Vercel app to dispatch into. Routes:
+   *   POST /workflow/{runId}/submit     → PLAY_WORKFLOW.create({ id, params })
+   *   GET  /workflow/{runId}/observe    → polling-compatible status snapshot
+   *   POST /workflow/{runId}/cancel     → Workflow instance terminate
+   *   POST /workflow/{runId}/signal     → integration_event
+   *   GET  /workflow/{runId}/result     → terminal envelope
+   *   GET  /health                      → liveness
+   */
+  async fetch(
+    request: Request,
+    env: CoordinatorEnv,
+    ctx?: ExecutionContext,
+  ): Promise<Response> {
+    const url = new URL(request.url);
+    if (url.pathname === '/health') {
+      if (workflowPoolEnabled(env)) {
+        ctx?.waitUntil(refillWorkflowPool(env).catch(() => undefined));
+      }
+      return new Response('ok', { status: 200 });
+    }
+    if (url.pathname === '/warmup/submit') {
+      return await handleCoordinatorWarmup(request, env, ctx);
+    }
+    if (url.pathname === '/workflow-pool/refill') {
+      const warmupToken = env.VERCEL_PROTECTION_BYPASS_TOKEN?.trim();
+      if (
+        warmupToken &&
+        request.headers.get('x-vercel-protection-bypass') !== warmupToken
+      ) {
+        return new Response('unauthorized', { status: 401 });
+      }
+      const startedAt = Date.now();
+      const minAvailableRaw = Number(url.searchParams.get('minAvailable') ?? '');
+      const waitTimeoutMsRaw = Number(url.searchParams.get('waitTimeoutMs') ?? '');
+      const result = await refillWorkflowPool(env, {
+        waitReady: url.searchParams.get('waitReady') === '1',
+        minAvailable:
+          Number.isFinite(minAvailableRaw) && minAvailableRaw > 0
+            ? minAvailableRaw
+            : undefined,
+        waitTimeoutMs:
+          Number.isFinite(waitTimeoutMsRaw) && waitTimeoutMsRaw > 0
+            ? waitTimeoutMsRaw
+            : undefined,
+      });
+      return Response.json({
+        ok: true,
+        ...result,
+        ms: Date.now() - startedAt,
+      });
+    }
+    if (url.pathname === '/workflow-pool/clear') {
+      const warmupToken = env.VERCEL_PROTECTION_BYPASS_TOKEN?.trim();
+      if (
+        warmupToken &&
+        request.headers.get('x-vercel-protection-bypass') !== warmupToken
+      ) {
+        return new Response('unauthorized', { status: 401 });
+      }
+      const startedAt = Date.now();
+      const deleted = await clearWorkflowPool(env);
+      return Response.json({
+        ok: true,
+        deleted,
+        ms: Date.now() - startedAt,
+      });
+    }
+
+    // Workflow routes: /workflow/{runId}/{action}
+    const wfMatch = url.pathname.match(/^\/workflow\/([^/]+)(?:\/(.+))?$/);
+    if (wfMatch) {
+      const runId = decodeURIComponent(wfMatch[1]!);
+      const action = wfMatch[2] ?? '';
+      return await handleWorkflowRoute({ runId, action, request, env, ctx });
+    }
+
+    // Dedup routes: /dedup/{runId}/{action}
+    const dedupMatch = url.pathname.match(/^\/dedup\/([^/]+)(?:\/(.+))?$/);
+    if (dedupMatch) {
+      const runId = decodeURIComponent(dedupMatch[1]!);
+      const action = dedupMatch[2] ?? '';
+      const doId = env.PLAY_DEDUP.idFromName(`dedup:${runId}`);
+      const stub = env.PLAY_DEDUP.get(doId);
+      const internalUrl = `https://internal/${action}`;
+      return stub.fetch(internalUrl, {
+        method: request.method,
+        headers: request.headers,
+        body:
+          request.method === 'GET' || request.method === 'HEAD'
+            ? undefined
+            : request.body,
+      });
+    }
+
+    return new Response('not found', { status: 404 });
+  },
+  async tail(events: unknown[], env: CoordinatorEnv): Promise<void> {
+    await flushTailRunLogs(events, env);
+  },
+};
+
+export default coordinatorEntrypoint;
+
+const RUN_LOG_PREFIX_RE = /\[deepline-run:([^\]]+)\]\s*(.*)/;
+const RUN_ID_RE = /\bplay\/[^/\s]+\/run\/[0-9a-zTt-]+/;
+
+async function flushTailRunLogs(
+  events: unknown[],
+  env: CoordinatorEnv,
+): Promise<void> {
+  const token = env.DEEPLINE_TAIL_LOG_TOKEN?.trim();
+  if (!token) {
+    return;
+  }
+  const grouped = new Map<string, string[]>();
+  for (const event of events) {
+    for (const line of extractTailLogLines(event)) {
+      const parsed = parseRunLogLine(line);
+      if (!parsed) {
+        continue;
+      }
+      const existing = grouped.get(parsed.runId) ?? [];
+      existing.push(parsed.line);
+      grouped.set(parsed.runId, existing);
+    }
+  }
+  await Promise.all(
+    [...grouped.entries()].map(async ([runId, lines]) => {
+      if (lines.length === 0) {
+        return;
+      }
+      await fetch(
+        `${env.DEEPLINE_API_BASE_URL}/api/v2/plays/internal/tail-log`,
+        {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            'x-deepline-tail-log-token': token,
+          },
+          body: JSON.stringify({
+            runId,
+            lines: lines.slice(-100),
+          }),
+        },
+      ).catch(() => null);
+    }),
+  );
+}
+
+function extractTailLogLines(event: unknown): string[] {
+  const lines: string[] = [];
+  const record =
+    event && typeof event === 'object' && !Array.isArray(event)
+      ? (event as Record<string, unknown>)
+      : {};
+  const logs = Array.isArray(record.logs) ? record.logs : [];
+  for (const log of logs) {
+    if (typeof log === 'string') {
+      lines.push(log);
+      continue;
+    }
+    if (!log || typeof log !== 'object' || Array.isArray(log)) {
+      continue;
+    }
+    const logRecord = log as Record<string, unknown>;
+    const message = logRecord.message;
+    if (Array.isArray(message)) {
+      lines.push(message.map(formatTailLogPart).join(' '));
+    } else if (typeof message === 'string') {
+      lines.push(message);
+    }
+  }
+  const exceptions = Array.isArray(record.exceptions) ? record.exceptions : [];
+  for (const exception of exceptions) {
+    lines.push(formatTailLogPart(exception));
+  }
+  return lines.map((line) => line.trim()).filter(Boolean);
+}
+
+function formatTailLogPart(value: unknown): string {
+  if (typeof value === 'string') {
+    return value;
+  }
+  if (value instanceof Error) {
+    return value.stack ?? value.message;
+  }
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+
+function parseRunLogLine(line: string): { runId: string; line: string } | null {
+  if (line.includes('[perf-trace]')) {
+    return null;
+  }
+  const prefixed = line.match(RUN_LOG_PREFIX_RE);
+  if (prefixed?.[1]) {
+    const message = prefixed[2]?.trim() ?? '';
+    return {
+      runId: prefixed[1],
+      line: message || line,
+    };
+  }
+  const runId = line.match(RUN_ID_RE)?.[0];
+  if (!runId) {
+    return null;
+  }
+  return { runId, line };
+}
+
+async function handleWorkflowRoute(input: {
+  runId: string;
+  action: string;
+  request: Request;
+  env: CoordinatorEnv;
+  ctx?: ExecutionContext;
+}): Promise<Response> {
+  const { runId, action, request, env } = input;
+  const defaultInstanceId = workflowInstanceId(runId);
+  if (action === 'submit') {
+    const submitStartedAt = Date.now();
+    const coordinatorTimings: CoordinatorTiming[] = [];
+    let submittedRunId = runId;
+    const recordSubmitTiming = (timing: CoordinatorTiming): void => {
+      coordinatorTimings.push(timing);
+      recordCoordinatorPerfTraceBuffered(env, input.ctx, {
+        runId: submittedRunId,
+        phase: timing.phase,
+        ms: timing.ms,
+        graphHash: timing.graphHash ?? null,
+        extra: timing.extra,
+      });
+    };
+    const parseStartedAt = Date.now();
+    const params = (await request.json()) as PlayWorkflowParams;
+    submittedRunId = params.runId ?? runId;
+    recordSubmitTiming({
+      phase: 'coordinator.submit_parse_body',
+      ms: Date.now() - parseStartedAt,
+      graphHash: params.graphHash ?? null,
+      extra: {
+        hasDynamicWorkerCode: Boolean(params.dynamicWorkerCode),
+        dynamicWorkerBytes:
+          typeof params.dynamicWorkerCode === 'string'
+            ? params.dynamicWorkerCode.length
+            : 0,
+      },
+    });
+    if (!env.LOADER) {
+      throw new Error(
+        'Cloudflare Dynamic Workflows require a Worker Loader binding named LOADER.',
+      );
+    }
+    if (!env.HARNESS) {
+      throw new Error(
+        'Cloudflare Dynamic Workflows require a service binding named HARNESS. ' +
+          'Start apps/play-harness-worker before the coordinator or fix wrangler.toml services.',
+      );
+    }
+    let instance: WorkflowInstance | null = null;
+    try {
+      const dispatchStartedAt = Date.now();
+      const poolStartedAt = Date.now();
+      instance = await submitViaPooledWorkflow({
+        env,
+        params,
+        recordSubmitTiming,
+      });
+      const usedWorkflowPool = Boolean(instance);
+      recordSubmitTiming({
+        phase: 'coordinator.workflow_pool_attempt',
+        ms: Date.now() - poolStartedAt,
+        graphHash: params.graphHash ?? null,
+        extra: { usedPool: usedWorkflowPool },
+      });
+      if (!instance) {
+        const createStartedAt = Date.now();
+        instance = await createDynamicWorkflowInstance({
+          env,
+          id: defaultInstanceId,
+          params,
+        });
+        recordSubmitTiming({
+          phase: 'coordinator.workflow_create',
+          ms: Date.now() - createStartedAt,
+          graphHash: params.graphHash ?? null,
+          extra: { instanceId: instance.id, pooled: false },
+        });
+      } else {
+        recordSubmitTiming({
+          phase: 'coordinator.workflow_create',
+          ms: 0,
+          graphHash: params.graphHash ?? null,
+          extra: { instanceId: instance.id, pooled: true },
+        });
+      }
+      recordSubmitTiming({
+        phase: 'coordinator.dispatch_workflow',
+        ms: Date.now() - dispatchStartedAt,
+        graphHash: params.graphHash ?? null,
+        extra: { pooled: usedWorkflowPool },
+      });
+      const totalMs = Date.now() - submitStartedAt;
+      recordSubmitTiming({
+        phase: 'coordinator.submit_total',
+        ms: totalMs,
+        graphHash: params.graphHash ?? null,
+      });
+      recordSubmitTiming({
+        phase: 'coordinator.submit_accepted',
+        ms: totalMs,
+        graphHash: params.graphHash ?? null,
+      });
+      return Response.json({
+        runId,
+        status: 'submitted',
+        instanceState: null,
+        coordinatorTimings,
+      });
+    } finally {
+      input.ctx?.waitUntil(refillWorkflowPool(env).catch(() => undefined));
+      disposeRpcStub(instance);
+    }
+  }
+
+  if (action === 'submit-child') {
+    const startedAt = Date.now();
+    try {
+      const body = (await request.json().catch(() => null)) as Record<
+        string,
+        unknown
+      > | null;
+      if (!body || typeof body !== 'object') {
+        return Response.json(
+          {
+            error: {
+              code: 'CHILD_SUBMIT_BODY_REQUIRED',
+              message: 'submit-child requires a JSON body.',
+              phase: 'coordinator_child_submit',
+              parentRunId: runId,
+            },
+          },
+          { status: 400 },
+        );
+      }
+      const manifest = body.manifest as PlayRuntimeManifest | undefined;
+      const governance = body.internalRunPlay as
+        | PlayCallGovernanceSnapshot
+        | undefined;
+      const childPlayName =
+        typeof body.name === 'string' && body.name.trim()
+          ? body.name.trim()
+          : manifest?.playName?.trim();
+      if (
+        !manifest ||
+        !childPlayName ||
+        !manifest.artifactStorageKey ||
+        !manifest.artifactHash ||
+        !manifest.graphHash ||
+        !governance
+      ) {
+        return Response.json(
+          {
+            error: {
+              code: 'CHILD_MANIFEST_REQUIRED',
+              message:
+                'submit-child requires a trusted child manifest and lineage.',
+              phase: 'coordinator_child_submit',
+              parentRunId: runId,
+            },
+          },
+          { status: 400 },
+        );
+      }
+      const childRunId = buildChildRunId(childPlayName);
+      const orgId = typeof body.orgId === 'string' ? body.orgId : '';
+      if (!orgId) {
+        return Response.json(
+          {
+            error: {
+              code: 'CHILD_ORG_REQUIRED',
+              message: 'submit-child requires orgId from the parent runtime.',
+              phase: 'coordinator_child_submit',
+              parentRunId: runId,
+            },
+          },
+          { status: 400 },
+        );
+      }
+      const parentExecutorToken =
+        typeof body.parentExecutorToken === 'string'
+          ? body.parentExecutorToken.trim()
+          : '';
+      if (!parentExecutorToken) {
+        return Response.json(
+          {
+            error: {
+              code: 'PARENT_EXECUTOR_TOKEN_REQUIRED',
+              message:
+                'submit-child requires the parent executor token for origin-scoped child token minting.',
+              phase: 'coordinator_child_submit',
+              parentRunId: runId,
+            },
+          },
+          { status: 400 },
+        );
+      }
+      const childToken = await mintChildWorkflowExecutorToken({
+        env,
+        baseUrl: resolveRuntimeBaseUrl(env, body),
+        parentExecutorToken,
+        parentRunId: runId,
+        parentPlayName:
+          typeof body.parentPlayName === 'string' && body.parentPlayName.trim()
+            ? body.parentPlayName.trim()
+            : governance.parentPlayName,
+        childRunId,
+        childPlayName,
+        maxCreditsPerRun: manifest.maxCreditsPerRun ?? null,
+      });
+      const submitResponse = await handleWorkflowRoute({
+        runId: childRunId,
+        action: 'submit',
+        request: new Request(
+          `https://deepline.coordinator.internal/workflow/${encodeURIComponent(
+            childRunId,
+          )}/submit`,
+          {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({
+              runId: childRunId,
+              playId: childRunId,
+              playName: childPlayName,
+              artifactStorageKey: manifest.artifactStorageKey,
+              artifactHash: manifest.artifactHash,
+              graphHash: manifest.graphHash,
+              input: isRecord(body.input) ? body.input : {},
+              contractSnapshot: {
+                source: 'published',
+                revisionVersion: null,
+                staticPipeline: manifest.staticPipeline,
+                billingLimit:
+                  typeof manifest.maxCreditsPerRun === 'number'
+                    ? { maxCreditsPerRun: manifest.maxCreditsPerRun }
+                    : null,
+                sourceCode: manifest.sourceCode ?? '',
+                artifactMetadata: {
+                  storageKey: manifest.artifactStorageKey,
+                  artifactHash: manifest.artifactHash,
+                  graphHash: manifest.graphHash,
+                },
+                codeFormat: 'cjs_module',
+                compatibility: {
+                  apiVersion: 2,
+                  runtimeBackend: 'workers_edge',
+                },
+              },
+              executionPlan: null,
+              childPlayManifests: isRecord(body.childPlayManifests)
+                ? (body.childPlayManifests as PlayRuntimeManifestMap)
+                : null,
+              playCallGovernance: governance,
+              dynamicWorkerCode: null,
+              executorToken: childToken,
+              baseUrl: resolveRuntimeBaseUrl(env, body),
+              orgId,
+              userEmail:
+                typeof body.userEmail === 'string' ? body.userEmail : '',
+              userId: typeof body.userId === 'string' ? body.userId : null,
+              runtimeBackend: 'cf_workflows_dynamic_worker',
+              dedupBackend: 'in_memory',
+              coordinatorUrl: new URL(request.url).origin,
+            } satisfies PlayWorkflowParams),
+          },
+        ),
+        env,
+      });
+      const responseText = await submitResponse.text().catch(() => '');
+      recordCoordinatorPerfTrace({
+        runId,
+        phase: 'coordinator.child_submit',
+        ms: Date.now() - startedAt,
+        extra: { status: submitResponse.status, childRunId },
+      });
+      console.info('[play.runtime.span]', {
+        event: 'play.runtime.span',
+        phase: 'coordinator_child_submit',
+        runId,
+        parentRunId: runId,
+        childRunId,
+        playName: childPlayName,
+        ms: Date.now() - startedAt,
+        status: submitResponse.ok ? 'ok' : 'failed',
+        ...(submitResponse.ok
+          ? {}
+          : { errorCode: 'COORDINATOR_CHILD_SUBMIT_FAILED' }),
+      });
+      if (!submitResponse.ok) {
+        return new Response(responseText, {
+          status: submitResponse.status,
+          headers: {
+            'content-type':
+              submitResponse.headers.get('content-type') ?? 'application/json',
+            'cache-control': 'no-store',
+          },
+        });
+      }
+      return Response.json(
+        {
+          workflowId: childRunId,
+          runId: childRunId,
+          status: 'started',
+          coordinator: JSON.parse(responseText || '{}'),
+        },
+        {
+          headers: {
+            'cache-control': 'no-store',
+          },
+        },
+      );
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error('[coordinator.child_submit.error]', {
+        runId,
+        ms: Date.now() - startedAt,
+        error: message,
+      });
+      return Response.json(
+        {
+          error: {
+            code: 'COORDINATOR_CHILD_SUBMIT_FAILED',
+            message,
+            phase: 'coordinator_child_submit',
+            parentRunId: runId,
+          },
+        },
+        {
+          status: 500,
+          headers: { 'cache-control': 'no-store' },
+        },
+      );
+    }
+  }
+
+  // get() throws if the instance doesn't exist (Workflows local-mode wipes
+  // state on wrangler dev reload, and superseded `--force` runs may target
+  // an instance that was never created). Treat that as a no-op cancel.
+  let instance: WorkflowInstance | null = null;
+  try {
+    const instanceId = await resolveWorkflowInstanceIdForRun(env, runId);
+    instance = await env.PLAY_WORKFLOW.get(instanceId);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (
+      !/not[ _]found|not_found|does not exist|no such instance|404/i.test(
+        message,
+      )
+    ) {
+      throw error;
+    }
+  }
+  try {
+    if (action === 'cancel') {
+      if (!instance) {
+        return Response.json({ runId, status: 'cancelled' });
+      }
+      try {
+        await instance.terminate();
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        // Tolerate four classes of error here:
+        //   - already-terminal (complete / errored / terminated)
+        //   - "Cannot terminate instance since its on a finite state"
+        //     (the runtime's wording for "already finished")
+        //   - "not implemented" (wrangler dev local mode doesn't support
+        //     instance.terminate() yet — silently no-op there)
+        //   - "not found" (instance never existed)
+        if (
+          !/complete|terminated|errored|finite state|cannot[ _]terminate|not[ _]implemented|not[ _]found|404/i.test(
+            message,
+          )
+        ) {
+          throw error;
+        }
+      }
+      return Response.json({ runId, status: 'cancelled' });
+    }
+    if (!instance) {
+      return new Response('not found', { status: 404 });
+    }
+    if (action === 'signal') {
+      const body = (await request.json().catch(() => ({}))) as Record<
+        string,
+        unknown
+      >;
+      const eventKey =
+        typeof body.eventKey === 'string' && body.eventKey.trim()
+          ? body.eventKey.trim()
+          : typeof body.event_key === 'string' && body.event_key.trim()
+            ? body.event_key.trim()
+            : '';
+      const eventType =
+        typeof body.type === 'string' && body.type.trim()
+          ? body.type.trim()
+          : eventKey
+            ? `integration_event_${eventKey}`
+            : 'integration_event';
+      await instance.sendEvent({
+        type: workflowEventType(eventType),
+        payload: body,
+      });
+      return Response.json({
+        runId,
+        status: mapWorkflowStatus(await instance.status()),
+      });
+    }
+    if (
+      action === 'result' ||
+      action === 'status' ||
+      action === 'observe' ||
+      action === ''
+    ) {
+      const observeWaitMs =
+        action === 'observe'
+          ? Math.min(
+              Math.max(
+                Number(new URL(request.url).searchParams.get('waitMs') ?? '0'),
+                0,
+              ),
+              2_000,
+            )
+          : 0;
+      const includeTrace =
+        new URL(request.url).searchParams.get('trace') === '1';
+      const statusStartedAt = Date.now();
+      let status = await instance.status();
+      let statusPolls = 1;
+      while (
+        observeWaitMs > 0 &&
+        Date.now() - statusStartedAt < observeWaitMs
+      ) {
+        const result = mapWorkflowResult(runId, status);
+        if (
+          result.status === 'completed' ||
+          result.status === 'failed' ||
+          result.status === 'cancelled'
+        ) {
+          break;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 75));
+        status = await instance.status();
+        statusPolls += 1;
+      }
+      const result = mapWorkflowResult(runId, status);
+      const observeMs = Date.now() - statusStartedAt;
+      // If we forced a permanent-error fail-fast (status='failed' even
+      // though the underlying instance is still 'running' mid-retry),
+      // terminate on the CF side once so the retry loop stops burning
+      // compute. Best-effort: tolerate races where the instance has
+      // already gone terminal between our status() and terminate().
+      if (
+        result.status === 'failed' &&
+        status.status !== 'errored' &&
+        status.status !== 'terminated' &&
+        status.status !== 'complete'
+      ) {
+        await instance.terminate().catch((error: unknown) => {
+          const message =
+            error instanceof Error ? error.message : String(error);
+          if (
+            !/complete|terminated|errored|finite state|cannot[ _]terminate|not[ _]implemented|not[ _]found|404/i.test(
+              message,
+            )
+          ) {
+            console.warn(
+              '[coordinator] terminate-after-permanent-error failed',
+              {
+                runId,
+                error: message,
+              },
+            );
+          }
+        });
+      }
+      const coordinatorTrace = includeTrace
+        ? await listCoordinatorPerfTrace(env, runId).catch(() => [])
+        : [];
+      return Response.json({
+        ...result,
+        coordinatorObserve: {
+          ms: observeMs,
+          waitMs: observeWaitMs,
+          workflowStatus: status.status,
+          statusPolls,
+          instanceId: instance.id,
+        },
+        ...(includeTrace ? { coordinatorTrace } : {}),
+      });
+    }
+    return new Response('not found', { status: 404 });
+  } finally {
+    disposeRpcStub(instance);
+  }
+}
+
+function workflowInstanceId(runId: string): string {
+  const normalized = runId.toLowerCase().replace(/[^a-z0-9_-]+/g, '-');
+  if (normalized.length > 0 && normalized.length <= 100) {
+    return normalized;
+  }
+  return `run-${stableHash(runId)}`;
+}
+
+function stableHash(value: string): string {
+  let hash = 2166136261;
+  for (let index = 0; index < value.length; index += 1) {
+    hash ^= value.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(36);
+}
+
+/**
+ * Synchronous wrapper around env.LOADER.get for use inside the
+ * createDynamicWorkflowEntrypoint loader callback. The framework's loader
+ * type allows async, but the official example
+ * (cloudflare/dynamic-workflows repo) uses sync; the microtask hop a
+ * top-level `await` introduces appears to interact badly with how the
+ * framework wires up the returned entrypoint stub for runner.run() RPC.
+ */
+function loadDynamicPlayWorkerSync(
+  env: CoordinatorEnv,
+  metadata: DynamicWorkflowMetadata,
+  trace: CoordinatorPerfTraceSink = recordCoordinatorPerfTrace,
+): {
+  getEntrypoint(name?: string): Fetcher & WorkflowRunner;
+} {
+  if (!env.LOADER) {
+    throw new Error(
+      'Cloudflare Dynamic Workflows require a Worker Loader binding named LOADER.',
+    );
+  }
+  if (!env.HARNESS) {
+    throw new Error(
+      'Cloudflare Dynamic Workflows require a service binding named HARNESS. ' +
+        'Start apps/play-harness-worker before the coordinator or fix wrangler.toml services.',
+    );
+  }
+  const graphHash = metadata.graphHash.trim();
+  if (!graphHash) {
+    throw new Error('Dynamic play worker requires graphHash metadata.');
+  }
+  const artifactStorageKey = metadata.artifactStorageKey.trim();
+  if (!artifactStorageKey) {
+    throw new Error(
+      'Dynamic play worker requires artifactStorageKey metadata.',
+    );
+  }
+  const artifactIdentity =
+    metadata.artifactHash?.trim() || stableHash(artifactStorageKey);
+  const workerCacheKey = `play:${graphHash}:${artifactIdentity}:harness=h3`;
+  const runIdForTrace = metadata.runId ?? graphHash;
+  const loaderGetStartedAt = Date.now();
+  const stub = env.LOADER.get(workerCacheKey, async () => {
+    const bundledCode = await loadDynamicWorkerBundledCode({
+      env,
+      metadata,
+      graphHash,
+      artifactStorageKey,
+      workerCacheKey,
+      runIdForTrace,
+      trace,
+    });
+    return {
+      compatibilityDate: DYNAMIC_WORKER_COMPATIBILITY_DATE,
+      compatibilityFlags: ['nodejs_compat'],
+      mainModule: 'index.js',
+      modules: { 'index.js': bundledCode },
+      env: {
+        // Service binding to the long-lived Play Harness Worker.
+        // Per-play code reaches this via `env.HARNESS.<method>(...)` —
+        // see sdk/src/plays/harness-stub.ts. May be undefined in dev
+        // environments where the harness Worker isn't running yet, in
+        // which case the per-play stub throws a loud error on first use
+        // (no silent fallbacks — see harness-stub.ts → requireBinding).
+        HARNESS: env.HARNESS,
+        // NOTE: We intentionally do NOT pass `env.PLAYS_BUCKET` (an R2Bucket
+        // binding) through to the per-play Worker's env. Including a raw
+        // R2Bucket in the dynamically-loaded Worker's env makes Cloudflare
+        // Workflows fail at workflow init with
+        //   "Could not serialize object of type 'R2Bucket'."
+        // because the framework persists workflow state through a JSDevalue
+        // path that R2Bucket bindings do not support. Per-play harness reads
+        // (CSVs, packaged imports) go through the long-lived HARNESS Worker.
+      },
+    };
+  });
+  trace({
+    runId: runIdForTrace,
+    phase: 'coordinator.loader_get_call',
+    ms: Date.now() - loaderGetStartedAt,
+    graphHash,
+    extra: { workerCacheKey },
+  });
+  return stub;
+}
+
+async function loadDynamicPlayWorker(
+  env: CoordinatorEnv,
+  metadata: DynamicWorkflowMetadata,
+  trace: CoordinatorPerfTraceSink = recordCoordinatorPerfTrace,
+): Promise<{
+  getEntrypoint(name?: string): Fetcher & WorkflowRunner;
+}> {
+  if (!env.LOADER) {
+    throw new Error(
+      'Cloudflare Dynamic Workflows require a Worker Loader binding named LOADER.',
+    );
+  }
+  if (!env.HARNESS) {
+    throw new Error(
+      'Cloudflare Dynamic Workflows require a service binding named HARNESS. ' +
+        'Start apps/play-harness-worker before the coordinator or fix wrangler.toml services.',
+    );
+  }
+  const graphHash = metadata.graphHash.trim();
+  if (!graphHash) {
+    throw new Error('Dynamic play worker requires graphHash metadata.');
+  }
+  const artifactStorageKey = metadata.artifactStorageKey.trim();
+  if (!artifactStorageKey) {
+    throw new Error(
+      'Dynamic play worker requires artifactStorageKey metadata.',
+    );
+  }
+  const artifactIdentity =
+    metadata.artifactHash?.trim() || stableHash(artifactStorageKey);
+  const workerCacheKey = `play:${graphHash}:${artifactIdentity}:harness=h3`;
+  const runIdForTrace = metadata.runId ?? graphHash;
+  const loaderGetStartedAt = Date.now();
+  const stub = env.LOADER.get(workerCacheKey, async () => {
+    const bundledCode = await loadDynamicWorkerBundledCode({
+      env,
+      metadata,
+      graphHash,
+      artifactStorageKey,
+      workerCacheKey,
+      runIdForTrace,
+      trace,
+    });
+    return {
+      compatibilityDate: DYNAMIC_WORKER_COMPATIBILITY_DATE,
+      compatibilityFlags: ['nodejs_compat'],
+      mainModule: 'index.js',
+      modules: { 'index.js': bundledCode },
+      env: {
+        // Mirror of the sync loader (above) — see that copy for the
+        // architectural rationale. The dynamic worker env is intentionally
+        // minimal; runtime callbacks and file reads go through HARNESS, and
+        // child workflow control uses the coordinator URL in the run request.
+        HARNESS: env.HARNESS,
+      },
+    };
+  });
+  trace({
+    runId: runIdForTrace,
+    phase: 'coordinator.loader_get_call',
+    ms: Date.now() - loaderGetStartedAt,
+    graphHash,
+    extra: { workerCacheKey },
+  });
+  return stub;
+}
+
+async function loadDynamicWorkerBundledCode(input: {
+  env: CoordinatorEnv;
+  metadata: DynamicWorkflowMetadata;
+  graphHash: string;
+  artifactStorageKey: string;
+  workerCacheKey: string;
+  runIdForTrace: string;
+  trace: CoordinatorPerfTraceSink;
+}): Promise<string> {
+  const callbackStartedAt = Date.now();
+  let codeSource: 'inline' | 'r2' = 'inline';
+  let r2Ms = 0;
+  const artifact = input.metadata.dynamicWorkerCode
+    ? null
+    : await (async () => {
+        codeSource = 'r2';
+        const r2StartedAt = Date.now();
+        try {
+          return await loadStoredPlayArtifactFromR2(
+            input.env,
+            input.artifactStorageKey,
+          );
+        } finally {
+          r2Ms = Date.now() - r2StartedAt;
+          input.trace({
+            runId: input.runIdForTrace,
+            phase: 'coordinator.loader_code_r2_get',
+            ms: r2Ms,
+            graphHash: input.graphHash,
+            extra: { artifactStorageKey: input.artifactStorageKey },
+          });
+        }
+      })();
+  const bundledCode =
+    input.metadata.dynamicWorkerCode ?? artifact?.artifact?.bundledCode;
+  if (typeof bundledCode !== 'string' || bundledCode.length === 0) {
+    throw new Error(
+      `Stored play artifact ${input.artifactStorageKey} does not contain bundledCode.`,
+    );
+  }
+  input.trace({
+    runId: input.runIdForTrace,
+    phase: 'coordinator.loader_code_callback',
+    ms: Date.now() - callbackStartedAt,
+    graphHash: input.graphHash,
+    extra: {
+      codeSource,
+      r2Ms,
+      workerCacheKey: input.workerCacheKey,
+      bundledCodeBytes: bundledCode.length,
+    },
+  });
+  return bundledCode;
+}
+
+function normalizePackagedFiles(
+  value: unknown,
+): NonNullable<DynamicWorkflowMetadata['packagedFiles']> {
+  if (!Array.isArray(value)) return [];
+  return value
+    .filter((entry): entry is Record<string, unknown> =>
+      Boolean(entry && typeof entry === 'object' && !Array.isArray(entry)),
+    )
+    .map((entry) => ({
+      playPath: String(entry.playPath ?? '').replace(/^\.\//, ''),
+      storageKey: String(entry.storageKey ?? ''),
+      inlineText:
+        typeof entry.inlineText === 'string' ? entry.inlineText : undefined,
+    }))
+    .filter(
+      (entry) => entry.playPath.length > 0 && entry.storageKey.length > 0,
+    );
+}
+
+const COORDINATOR_WARMUP_DYNAMIC_WORKER_CODE = `
+import { WorkflowEntrypoint } from "cloudflare:workers";
+
+export class TenantWorkflow extends WorkflowEntrypoint {
+  async run(event) {
+    const payload = event && typeof event === "object" ? event.payload : null;
+    const runId = payload && typeof payload.runId === "string" ? payload.runId : "warmup";
+    const startedAt = Date.now();
+    if (this.env.RUNTIME_API) {
+      await this.env.RUNTIME_API.fetch(new Request("https://deepline.runtime.internal/api/v2/plays/internal/runtime", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: "{}"
+      })).catch(() => null);
+    }
+    console.log("[perf-trace] " + JSON.stringify({
+      ts: Date.now(),
+      source: "dynamic_worker",
+      runId,
+      phase: "dynamic_worker.warmup_run",
+      ms: Date.now() - startedAt,
+      graphHash: "coordinator-warmup-v1"
+    }));
+    return { ok: true, warmup: true };
+  }
+}
+
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    if (request.method === "POST" && url.pathname === "/start") {
+      const body = await request.json().catch(() => null);
+      if (!body || typeof body.id !== "string" || !body.payload || typeof body.payload !== "object") {
+        return new Response("invalid workflow start body", { status: 400 });
+      }
+      const createStartedAt = Date.now();
+      const instance = await env.WORKFLOWS.create({ id: body.id, params: body.payload });
+      const workflowCreateMs = Date.now() - createStartedAt;
+      return Response.json({
+        id: instance.id,
+        status: "submitted",
+        timingsMs: { workflowCreate: workflowCreateMs }
+      });
+    }
+    if (request.method === "GET" && url.pathname === "/health") {
+      return new Response("ok", { status: 200 });
+    }
+    return new Response("not found", { status: 404 });
+  }
+};
+`;
+
+async function handleCoordinatorWarmup(
+  request: Request,
+  env: CoordinatorEnv,
+  ctx?: ExecutionContext,
+): Promise<Response> {
+  if (request.method !== 'POST') {
+    return new Response('method not allowed', { status: 405 });
+  }
+  const warmupToken = env.VERCEL_PROTECTION_BYPASS_TOKEN?.trim();
+  if (
+    warmupToken &&
+    request.headers.get('x-vercel-protection-bypass') !== warmupToken
+  ) {
+    return new Response('unauthorized', { status: 401 });
+  }
+  const url = new URL(request.url);
+  const label = url.searchParams.get('label')?.trim() || 'warmup';
+  const runId = `coordinator/warmup/${label}/${Date.now().toString(36)}`;
+  const artifactHash = `coordinator-warmup-${stableHash(COORDINATOR_WARMUP_DYNAMIC_WORKER_CODE)}`;
+  const artifactStorageKey = `coordinator-warmup/${artifactHash}.json`;
+  await env.PLAYS_BUCKET.put(
+    artifactStorageKey,
+    JSON.stringify({
+      artifact: {
+        artifactKind: 'esm_workers',
+        bundledCode: COORDINATOR_WARMUP_DYNAMIC_WORKER_CODE,
+      },
+    } satisfies StoredPlayArtifactPayload),
+    {
+      httpMetadata: {
+        contentType: 'application/json',
+      },
+    },
+  );
+  const params: PlayWorkflowParams = {
+    runId,
+    playId: runId,
+    playName: 'coordinator-warmup',
+    artifactStorageKey,
+    artifactHash,
+    graphHash: artifactHash,
+    input: {},
+    inputFile: null,
+    inlineCsv: null,
+    packagedFiles: null,
+    contractSnapshot: null,
+    executionPlan: null,
+    playCallGovernance: null,
+    dynamicWorkerCode: null,
+    executorToken: 'coordinator-warmup',
+    baseUrl: env.DEEPLINE_API_BASE_URL,
+    orgId: 'coordinator-warmup',
+    userEmail: 'coordinator-warmup@deepline.local',
+    userId: 'coordinator-warmup',
+    runtimeBackend: 'cf_workflows_dynamic_worker',
+    dedupBackend: 'durable_object',
+  };
+  const startedAt = Date.now();
+  const response = await handleWorkflowRoute({
+    runId,
+    action: 'submit',
+    request: new Request(
+      `https://deepline.coordinator.internal/workflow/${encodeURIComponent(runId)}/submit`,
+      {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(params),
+      },
+    ),
+    env,
+  });
+  const text = await response.text().catch(() => '');
+  const terminalWaitStartedAt = Date.now();
+  let terminalState: Record<string, unknown> | null = null;
+  if (response.ok) {
+    const instance = await env.PLAY_WORKFLOW.get(
+      await resolveWorkflowInstanceIdForRun(env, runId),
+    );
+    try {
+      while (Date.now() - terminalWaitStartedAt < 10_000) {
+        const status = await instance.status();
+        terminalState = mapWorkflowResult(runId, status);
+        const mappedStatus = String(terminalState.status ?? '');
+        if (
+          mappedStatus === 'completed' ||
+          mappedStatus === 'failed' ||
+          mappedStatus === 'cancelled'
+        ) {
+          break;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 100));
+      }
+    } finally {
+      disposeRpcStub(instance);
+    }
+  }
+  recordCoordinatorPerfTrace({
+    runId,
+    phase: 'coordinator.warmup_terminal_wait',
+    ms: Date.now() - terminalWaitStartedAt,
+    graphHash: params.graphHash,
+    extra: { status: terminalState?.status ?? null, label },
+  });
+  recordCoordinatorPerfTrace({
+    runId,
+    phase: 'coordinator.warmup_submit_total',
+    ms: Date.now() - startedAt,
+    graphHash: params.graphHash,
+    extra: { status: response.status, label },
+  });
+  const poolRefillPromise = refillWorkflowPool(env, {
+    waitReady: true,
+    minAvailable: 1,
+  }).catch(() => ({
+    available: 0,
+    warming: 0,
+    target: 0,
+    created: 0,
+    promoted: 0,
+    removed: 0,
+    waitedMs: 0,
+    waitIterations: 0,
+  }));
+  ctx?.waitUntil(poolRefillPromise.then(() => undefined));
+  let body: unknown = null;
+  try {
+    body = text ? JSON.parse(text) : null;
+  } catch {
+    body = text;
+  }
+  const terminalStatus = String(terminalState?.status ?? '');
+  const warmupCompleted = response.ok && terminalStatus === 'completed';
+  const responseStatus = warmupCompleted
+    ? 200
+    : terminalStatus === 'running' || terminalStatus === 'sleeping'
+      ? 504
+      : response.ok
+        ? 500
+        : response.status;
+  return Response.json(
+    {
+      ok: warmupCompleted,
+      runId,
+      status: response.status,
+      body,
+      terminalState,
+      workflowPool: await poolRefillPromise,
+    },
+    { status: responseStatus },
+  );
+}
+
+/**
+ * Returns a structured-cloneable `Fetcher` stub for the `RuntimeApi`
+ * WorkerEntrypoint. The stub goes into the per-graphHash play Worker's
+ * `env.RUNTIME_API`. When the harness calls `env.RUNTIME_API.fetch(req)`,
+ * the request is RPC-dispatched into the `RuntimeApi.fetch` method on the
+ * coordinator side, which path-allowlists it and forwards to
+ * `DEEPLINE_API_BASE_URL` directly. Skips the public *.workers.dev → CF
+ * edge → cloudflared → localhost chain that the harness's old
+ * `fetch(req.baseUrl + path)` path traverses.
+ *
+ * Implemented as a WorkerEntrypoint (not a plain closure) because Cloudflare
+ * Workflows serializes the dynamic Worker's env when persisting workflow
+ * state, and closures containing captured locals aren't
+ * structured-cloneable. WorkerEntrypoint stubs ARE cloneable — same trick
+ * `makePlayAssetsBinding` already uses.
+ *
+ * Falls back transparently in legacy coordinators: if the binding isn't
+ * present in `env`, the harness uses its existing `fetch(req.baseUrl + path)`
+ * path, which still works (just slower).
+ */
+function makeRuntimeApiBinding(): { fetch(req: Request): Promise<Response> } {
+  const exports = workersExports as unknown as {
+    RuntimeApi?: (init: { props: undefined }) => {
+      fetch(req: Request): Promise<Response>;
+    };
+  };
+  const ctor = exports.RuntimeApi;
+  if (typeof ctor !== 'function') {
+    throw new Error(
+      'RuntimeApi is not registered on cloudflare:workers exports.',
+    );
+  }
+  return ctor({ props: undefined });
+}
+
+function makeCoordinatorControlBinding(): {
+  submitChild(
+    parentRunId: string,
+    body: Record<string, unknown>,
+  ): Promise<{ workflowId?: string; runId?: string; error?: unknown }>;
+  signal(
+    runId: string,
+    body: Record<string, unknown>,
+  ): Promise<Record<string, unknown>>;
+  recordPerfTrace(
+    runId: string,
+    payload: CoordinatorPerfTracePayload,
+  ): Promise<void>;
+} {
+  const exports = workersExports as unknown as {
+    CoordinatorControl?: (init: { props: undefined }) => {
+      submitChild(
+        parentRunId: string,
+        body: Record<string, unknown>,
+      ): Promise<{ workflowId?: string; runId?: string; error?: unknown }>;
+      signal(
+        runId: string,
+        body: Record<string, unknown>,
+      ): Promise<Record<string, unknown>>;
+      recordPerfTrace(
+        runId: string,
+        payload: CoordinatorPerfTracePayload,
+      ): Promise<void>;
+    };
+  };
+  const ctor = exports.CoordinatorControl;
+  if (typeof ctor !== 'function') {
+    throw new Error(
+      'CoordinatorControl is not registered on cloudflare:workers exports.',
+    );
+  }
+  return ctor({ props: undefined });
+}
+
+async function loadStoredPlayArtifactFromR2(
+  env: CoordinatorEnv,
+  storageKey: string,
+): Promise<StoredPlayArtifactPayload> {
+  const object = await env.PLAYS_BUCKET.get(storageKey);
+  if (!object) {
+    throw new Error(`Stored play artifact missing from R2: ${storageKey}`);
+  }
+  return JSON.parse(await object.text()) as StoredPlayArtifactPayload;
+}
+
+function readMetadataString(
+  metadata: Record<string, unknown>,
+  key: keyof DynamicWorkflowMetadata,
+): string {
+  const value = metadata[key];
+  if (typeof value !== 'string' || !value.trim()) {
+    throw new Error(`Dynamic workflow metadata missing ${key}.`);
+  }
+  return value;
+}
+
+function mapWorkflowResult(
+  runId: string,
+  status: InstanceStatus,
+): Record<string, unknown> {
+  const error = readWorkflowError(status);
+  const mapped = resolveTerminalStatus(status, error);
+  const output =
+    status.output && typeof status.output === 'object'
+      ? (status.output as Record<string, unknown>)
+      : null;
+  return {
+    runId,
+    status: mapped,
+    result: output?.result ?? status.output ?? null,
+    error,
+    totalRows: output?.totalRows ?? output?.outputRows ?? null,
+    durationMs: output?.durationMs ?? null,
+    wait:
+      mapped === 'sleeping'
+        ? {
+            kind: 'integration_event_batch',
+          }
+        : null,
+  };
+}
+
+function mapWorkflowStatus(
+  status: InstanceStatus,
+): 'running' | 'sleeping' | 'completed' | 'failed' | 'cancelled' {
+  if (status.status === 'complete') return 'completed';
+  if (status.status === 'errored') return 'failed';
+  if (status.status === 'terminated') return 'cancelled';
+  if (status.status === 'waiting' || status.status === 'paused')
+    return 'sleeping';
+  return 'running';
+}
+
+/**
+ * CF Dynamic Workflows retries failed workflow bodies silently for ~3
+ * minutes before transitioning the instance to `errored`. During that
+ * retry window `status.status` stays `running`/`paused`/`waiting`, but
+ * **`status.error`** gets populated as soon as the first attempt fails —
+ * with CF's generic `"internal error; reference = <id>"` (they never
+ * surface the actual JS error message via this API). That's enough
+ * signal: any error presence on a non-terminal instance means at least
+ * one attempt has thrown, and the user is better served by failing fast
+ * than by waiting 3 minutes for CF's retry budget to exhaust.
+ *
+ * If the failure was actually transient and the next retry would have
+ * succeeded, the user can re-run. The previous "match on permanent-
+ * error patterns" approach didn't help because the error message we
+ * see from CF is never a JS error name — it's always the generic
+ * reference id.
+ */
+function resolveTerminalStatus(
+  status: InstanceStatus,
+  error: string | null,
+): 'running' | 'sleeping' | 'completed' | 'failed' | 'cancelled' {
+  const mapped = mapWorkflowStatus(status);
+  if ((mapped === 'running' || mapped === 'sleeping') && error) {
+    return 'failed';
+  }
+  return mapped;
+}
+
+function readWorkflowError(status: InstanceStatus): string | null {
+  const error = status.error as unknown;
+  if (!error) return null;
+  if (typeof error === 'string') return error;
+  if (typeof error === 'object' && 'message' in error) {
+    return String((error as { message?: unknown }).message ?? '');
+  }
+  return String(error);
+}