deepline 0.1.182 → 0.1.183

package/dist/bundling-sources/apps/play-runner-workers/src/entry.ts

@@ -36,12 +36,6 @@ import {
   deterministicMapChunkStepName,
   type ExecutionPlan,
 } from '../../../shared_libs/play-runtime/execution-plan';
-import {
-  compileRequestsWithStrategy,
-  executeChunkedRequests,
-  type ChunkExecutionResult,
-} from '../../../shared_libs/play-runtime/batch-runtime';
-import { getPlayRuntimeBatchStrategy } from '../../../shared_libs/play-runtime/play-runtime-batching-registry';
 import {
   STANDARD_PLAY_RUNTIME_LIMIT_LABEL,
   STANDARD_PLAY_RUNTIME_LIMIT_SECONDS,
@@ -71,11 +65,10 @@ import {
   type WorkflowStepLike,
 } from './child-play-await';
 import { submitChildPlayThroughCoordinator } from './child-play-submit';
-import type { AnyBatchOperationStrategy } from '../../../shared_libs/play-runtime/batching-types';
 import {
   attachToolResultListDataset,
-  parseToolExecuteResponse,
   createToolExecuteResult,
+  parseToolExecuteResponse,
   deserializeToolExecuteResult,
   isSerializedToolExecuteResult,
   isToolExecuteResult,
@@ -90,29 +83,35 @@ import {
   TOOL_EXECUTE_TRANSPORT_RETRY_DELAY_MS,
   classifyToolExecuteHttpFailure,
   createToolExecuteHttpFailureAttemptTracker,
+  parseToolExecuteAuthScopeChangedError,
 } from '../../../shared_libs/play-runtime/tool-execute-retry-policy';
 import type { PlayCallGovernanceSnapshot } from '../../../shared_libs/play-runtime/scheduler-backend';
 import type { PreloadedRuntimeDbSession } from '../../../shared_libs/play-runtime/db-session';
-import type { PlayRuntimeManifestMap } from '../../../shared_libs/plays/compiler-manifest';
+import type {
+  PlayRuntimeManifest,
+  PlayRuntimeManifestMap,
+} from '../../../shared_libs/plays/compiler-manifest';
 import {
   deriveToolRequestIdentity,
   derivePlayRowIdentity,
   derivePlayRowIdentityFromKey,
   sha256Hex,
+  stableStringify,
 } from '../../../shared_libs/plays/row-identity';
 import { createDeferredPlayDataset } from '../../../shared_libs/plays/dataset';
 import {
   buildDurableCtxCallCacheKey,
-  buildDurableToolCallAuthScopeDigest,
-  buildDurableToolCallCacheKey,
+  buildDurableRunPlaySemanticKey,
 } from '../../../shared_libs/play-runtime/durable-call-cache';
+import {
+  resolveRuntimeToolReceiptWaitMaxAttempts,
+  resolveRuntimeToolReceiptWaitTimeoutMs,
+} from '../../../shared_libs/play-runtime/durable-receipt-execution';
 import {
   QUERY_RESULT_DATASET_PAGE_SIZE,
   isCustomerDbDatasetTool,
-  isQueryResultDatasetReadRequest,
   isQueryResultDatasetTool,
 } from '../../../shared_libs/play-runtime/query-result-dataset';
-import { buildScopedWorkReceiptKey } from '../../../shared_libs/play-runtime/work-receipts';
 import { DEDUPE_DUPLICATE_KEY_SAMPLE_CAP } from '../../../shared_libs/play-runtime/map-row-identity';
 import {
   getTopLevelPipelineSubsteps,
@@ -151,26 +150,41 @@ import {
 } from './runtime/dataset-handles';
 import {
   runWorkerRuntimeReceiptBoundary,
-  type WorkerRuntimeReceipt,
-  type WorkerRuntimeReceiptClaim,
-  type WorkerRuntimeReceiptStore,
+  RuntimeLeaseLostError,
+  type WorkerRuntimeReceiptExecutionContext,
 } from './runtime/receipts';
 import {
-  RuntimeReceiptWaitTimeoutError,
-  resolveRuntimeToolReceiptWaitMaxAttempts,
-  resolveRuntimeToolReceiptWaitTimeoutMs,
-  waitForCompletedRuntimeReceipt,
-} from '../../../shared_libs/play-runtime/durable-receipt-execution';
-import type { RuntimeStepReceipt } from '../../../shared_libs/play-runtime/ctx-types';
+  RuntimeReceiptPersistenceError,
+  WorkerToolBatchScheduler,
+  type WorkerPacingResolver,
+  type WorkerToolActionCacheVersionResolver,
+} from './runtime/tool-dispatch';
+import {
+  createWorkerWorkBudgetMeter,
+  type WorkerWorkBudgetMeter,
+} from './runtime/work-budget';
 import {
-  canReclaimFailedWorkerToolReceipt,
-  markWorkerToolReceiptResultCached,
-  markWorkerToolReceiptResultExecution,
-  planWorkerToolReceiptGroups,
-  reclaimRunningReceiptGroupAfterWait,
-  resolveWorkerToolReceiptGroupWaitMaxAttempts,
-  resolveWorkerToolRuntimeTimeoutMs,
-} from './runtime/tool-receipts';
+  WORKER_RUN_DISPATCHER_DEFAULT_MAX_RESIDENT_ROW_BYTES,
+  WorkerRunWorkDispatcher,
+  type WorkerRunMapBatchesResult,
+} from './runtime/run-work-dispatcher';
+import { WORKER_PLATFORM_SUBREQUESTS_PER_UNBATCHED_TOOL_CALL } from './runtime/worker-platform-budget';
+import {
+  PLAY_RUNTIME_CONTRACT,
+  PLAY_RUNTIME_CONTRACT_HEADER,
+} from '../../../shared_libs/play-runtime/runtime-contract';
+import { DYNAMIC_PLAY_WORKER_ARTIFACT_VERSION } from '../../../shared_libs/play-runtime/dynamic-worker-version';
+import {
+  PLAY_RUNTIME_TEST_FAULT_HEADER,
+  type RuntimeTestPolicyOverrides,
+} from '../../../shared_libs/play-runtime/test-runtime-seams';
+import { createRuntimeToolAuthScopeDigestResolver } from '../../../shared_libs/play-runtime/auth-scope-resolver';
+import {
+  PLAY_RUNTIME_SHEET_ATTEMPT_LEASE_TTL_MS,
+  PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
+  runtimeLeaseHeartbeatIntervalMs,
+} from '../../../shared_libs/play-runtime/lease-policy';
+import { RuntimeSheetRowsBlockedError } from '../../../shared_libs/play-runtime/runtime-sheet-errors';
 // The harness stub forwards leaf calls (validation, runtime-api HTTP) into
 // the long-lived Play Harness Worker via env.HARNESS. We import the
 // `setHarnessBinding` setter eagerly so it's available the moment
@@ -183,9 +197,12 @@ import {
 // re-bundle harness internals into per-play. Keep that in mind.
 import {
   harnessPersistCompletedSheetRows,
+  harnessHeartbeatSheetAttempt,
   harnessReadSheetDatasetRowKeys,
   harnessReadSheetDatasetRows,
   harnessReadStagedFileChunk,
+  harnessReleaseRuntimeReceipts,
+  harnessReleaseSheetAttempt,
   harnessStartSheetDataset,
   setHarnessBinding,
 } from '../../../sdk/src/plays/harness-stub';
@@ -216,7 +233,10 @@ import {
   stripMapRowOutcomeRuntimeFields,
 } from '../../../shared_libs/play-runtime/map-row-outcome';
 import { runtimeSheetSessionScope } from '../../../shared_libs/play-runtime/runtime-sheet-session';
-import { chooseWorkerMapRowsPerChunk } from './runtime/map-chunk-plan';
+import {
+  chooseWorkerMapDispatchPlan,
+  estimateBatchedToolChunkSubrequests,
+} from './runtime/map-chunk-plan';
 import {
   applyCsvRenameProjection,
   cloneCsvAliasedRow,
@@ -228,12 +248,7 @@ import { normalizePlayRunFailure } from '../../../shared_libs/play-runtime/run-f
 import {
   createRuntimePersistenceLatch,
   isRuntimePersistenceCircuitOpenError,
-  partitionDispatchWaves,
-  PROVIDER_DISPATCH_WAVE_SIZE,
-  RuntimePersistenceCircuitOpenError,
-  shouldShortenCompleteReceiptLadder,
   tripRuntimePersistenceLatch,
-  type RuntimePersistenceLatch,
 } from '../../../shared_libs/play-runtime/persistence-latch';
 import {
   createReceiptSalvageBuffer,
@@ -299,8 +314,13 @@ type RunRequest = {
   playName: string;
   graphHash?: string | null;
   userEmail: string | null;
-  force?: boolean | null;
   runtimeInput: Record<string, unknown>;
+  /** Start a fresh run graph and recompute runtime-sheet rows. */
+  force?: boolean;
+  /** Explicit durable tool receipt refresh that can re-execute completed provider calls. */
+  forceToolRefresh?: boolean;
+  /** Monotonic coordinator redispatch epoch for receipt and sheet fencing. */
+  runAttempt?: number;
   /** Optional inline CSV rows (for plays where ctx.csv was passed inline data). */
   inlineCsv?: { name: string; rows: Record<string, unknown>[] } | null;
   /** Staged input files keyed by logical filename (used by ctx.csv). */
@@ -333,6 +353,10 @@ type RunRequest = {
   coordinatorUrl?: string | null;
   /** Request-scoped coordinator auth token for preview/dev direct control calls. */
   coordinatorInternalToken?: string | null;
+  /** Request-scoped, dev-only runtime fault injection header for black-box tests. */
+  runtimeTestFaultHeader?: string | null;
+  /** Request-scoped, dev-only policy overrides for black-box durability tests. */
+  testPolicyOverrides?: RuntimeTestPolicyOverrides | null;
   /**
    * Total input rows known at submit time, when the dispatcher can count them.
    * `undefined` when the input streams from R2 (unknown row count).
@@ -348,10 +372,104 @@ type WorkerFileRef = {
   bytes?: number | null;
 };
 
+function normalizeWorkerRunAttempt(value: unknown): number {
+  return typeof value === 'number' && Number.isFinite(value)
+    ? Math.max(0, Math.floor(value))
+    : 0;
+}
+
+function normalizePositiveInteger(value: unknown): number | undefined {
+  return typeof value === 'number' &&
+    Number.isFinite(value) &&
+    Number.isInteger(value) &&
+    value > 0
+    ? value
+    : undefined;
+}
+
+function normalizeRuntimeTestPolicyOverrides(
+  value: unknown,
+): RuntimeTestPolicyOverrides | null {
+  if (!isRecord(value)) return null;
+  const overrides: RuntimeTestPolicyOverrides = {};
+  const receiptLeaseTtlMs = normalizePositiveInteger(value.receiptLeaseTtlMs);
+  if (receiptLeaseTtlMs !== undefined) {
+    overrides.receiptLeaseTtlMs = receiptLeaseTtlMs;
+  }
+  const sheetAttemptLeaseMs = normalizePositiveInteger(
+    value.sheetAttemptLeaseMs,
+  );
+  if (sheetAttemptLeaseMs !== undefined) {
+    overrides.sheetAttemptLeaseMs = sheetAttemptLeaseMs;
+  }
+  const heartbeatIntervalMs = normalizePositiveInteger(
+    value.heartbeatIntervalMs,
+  );
+  if (heartbeatIntervalMs !== undefined) {
+    overrides.heartbeatIntervalMs = heartbeatIntervalMs;
+  }
+  const batchGraceMs = normalizePositiveInteger(value.batchGraceMs);
+  if (batchGraceMs !== undefined) {
+    overrides.batchGraceMs = batchGraceMs;
+  }
+  if (isRecord(value.workBudgetYieldLimits)) {
+    const limits: NonNullable<
+      RuntimeTestPolicyOverrides['workBudgetYieldLimits']
+    > = {};
+    for (const key of [
+      'elapsed',
+      'subrequest',
+      'provider',
+      'tool',
+      'receipt',
+      'sheet',
+      'log',
+      'egress',
+    ] as const) {
+      const limit = normalizePositiveInteger(value.workBudgetYieldLimits[key]);
+      if (limit !== undefined) {
+        limits[key] = limit;
+      }
+    }
+    if (Object.keys(limits).length > 0) {
+      overrides.workBudgetYieldLimits = limits;
+    }
+  }
+  return Object.keys(overrides).length > 0 ? overrides : null;
+}
+
+function runtimeReceiptLeaseTtlMs(req: RunRequest): number | undefined {
+  return req.testPolicyOverrides?.receiptLeaseTtlMs;
+}
+
+function runtimeSheetAttemptLeaseTtlMs(req: RunRequest): number | undefined {
+  return req.testPolicyOverrides?.sheetAttemptLeaseMs;
+}
+
+function runtimePolicyHeartbeatIntervalMs(
+  req: RunRequest,
+  fallbackLeaseTtlMs: number,
+): number {
+  return (
+    req.testPolicyOverrides?.heartbeatIntervalMs ??
+    runtimeLeaseHeartbeatIntervalMs(fallbackLeaseTtlMs)
+  );
+}
+
 const EXECUTE_TOOL_METADATA_HEADER = 'x-deepline-include-tool-metadata';
 const EXECUTE_RESPONSE_CONTRACT_HEADER = 'x-deepline-execute-response-contract';
 const EXECUTE_RESPONSE_INTENT_HEADER = 'x-deepline-execute-response-intent';
 const V2_EXECUTE_RESPONSE_CONTRACT = 'v2-tool-execution-result';
+// A short durable sleep is enough to force a Cloudflare Workflows step
+// checkpoint. The resume re-enters run() as a new Worker invocation with a
+// fresh per-invocation subrequest budget (see the yield callback below), so
+// there is no need to escalate the sleep to "encourage" re-invocation.
+// A 1ms Workflow sleep is too small to reliably create a new platform
+// invocation in preview; the dispatcher then resets its local budget while
+// Cloudflare's per-invocation subrequest counter is still hot. Use a real
+// boundary so budget-yielded maps resume with fresh platform headroom.
+const WORK_DISPATCHER_YIELD_SLEEP_MS = 1_000;
+
 type CustomerDbDatasetRequest = {
   limit?: number;
   offset?: number;
@@ -418,7 +536,8 @@ type WorkerEnv = {
   /**
    * In-process Fetcher constructed by the coordinator and handed to the
    * per-graphHash play Worker. When present, runtime callbacks
-   * (`/api/v2/plays/internal/runtime`, `/api/v2/plays/internal/*`,
+   * (`/api/v2/internal/play-runtime`,
+   * `/api/v2/internal/play-runtime/*`,
    * `/api/v2/plays/runtime-tools/*`) skip the public callback URL and route
    * directly through the coordinator's process to the configured app — saves
    * the *.workers.dev → CF edge → cloudflared → localhost chain on every
@@ -427,6 +546,7 @@ type WorkerEnv = {
    */
   RUNTIME_API?: {
     runtimeApiCall(input: {
+      contract?: number;
       executorToken: string;
       baseUrl?: string;
       path: string;
@@ -663,7 +783,7 @@ async function fetchRuntimeApi(
       ? Math.max(1, Math.ceil(options.timeoutMsOverride))
       : path === '/api/v2/plays/run'
         ? RUNTIME_API_PLAY_RUN_TIMEOUT_MS
-        : path === '/api/v2/plays/internal/egress-fetch'
+        : path === '/api/v2/internal/play-runtime/egress-fetch'
           ? RUNTIME_API_EGRESS_FETCH_TIMEOUT_MS
           : /^\/api\/v2\/integrations\/[^/]+\/execute$/.test(path)
             ? RUNTIME_API_INTEGRATION_EXECUTE_TIMEOUT_MS
@@ -691,6 +811,10 @@ async function fetchRuntimeApi(
       );
     }, timeoutMs);
   });
+  const relayAbort = () => controller.abort(abortSignal?.reason);
+  if (abortSignal) {
+    abortSignal.addEventListener('abort', relayAbort, { once: true });
+  }
   try {
     const mergedInit: RequestInit = {
       ...init,
@@ -712,11 +836,10 @@ async function fetchRuntimeApi(
         timeoutMs,
       },
     );
-    // RUNTIME_API service bindings do not consume RequestInit.signal once the RPC
-    // is in flight. After dispatch, wait for the owner call to settle so the
-    // durable receipt records the real provider result instead of failing early
-    // and inviting duplicate provider work on retry.
     const response = await Promise.race([responsePromise, timeoutPromise]);
+    if (abortSignal?.aborted) {
+      throw abortError();
+    }
     if (await isRuntimeApiBindingNotFoundResponse(response)) {
       throw new Error(
         `[play-harness] RUNTIME_API service binding could not route ${path}; coordinator returned not found.`,
@@ -732,6 +855,9 @@ async function fetchRuntimeApi(
     }
     throw err;
   } finally {
+    if (abortSignal) {
+      abortSignal.removeEventListener('abort', relayAbort);
+    }
     if (timeout) clearTimeout(timeout);
   }
 }
@@ -748,10 +874,23 @@ async function callRuntimeApiRpcBinding(
   if (metadata) headers[EXECUTE_TOOL_METADATA_HEADER] = metadata;
   const contract = h.get(EXECUTE_RESPONSE_CONTRACT_HEADER);
   if (contract) headers[EXECUTE_RESPONSE_CONTRACT_HEADER] = contract;
+  const idempotencyKey = h.get('x-deepline-idempotency-key');
+  if (idempotencyKey) {
+    headers['x-deepline-idempotency-key'] = idempotencyKey;
+  }
+  const cacheControl = h.get('cache-control');
+  if (cacheControl) headers['cache-control'] = cacheControl;
+  const pragma = h.get('pragma');
+  if (pragma) headers.pragma = pragma;
+  const runtimeTestFaultHeader = h.get(PLAY_RUNTIME_TEST_FAULT_HEADER);
+  if (runtimeTestFaultHeader) {
+    headers[PLAY_RUNTIME_TEST_FAULT_HEADER] = runtimeTestFaultHeader;
+  }
   const responseIntent = h.get(EXECUTE_RESPONSE_INTENT_HEADER);
   if (responseIntent) headers[EXECUTE_RESPONSE_INTENT_HEADER] = responseIntent;
   const rawBody = typeof init.body === 'string' ? init.body : '';
   const result = await binding.runtimeApiCall({
+    contract: PLAY_RUNTIME_CONTRACT,
     executorToken: authorization.replace(/^Bearer\s+/i, '').trim(),
     baseUrl: input.baseUrl,
     path: input.path,
@@ -784,6 +923,7 @@ function runtimeApiHeaders(
   includeVercelBypass: boolean,
 ): Headers {
   const next = new Headers(headers);
+  next.set(PLAY_RUNTIME_CONTRACT_HEADER, String(PLAY_RUNTIME_CONTRACT));
   if (includeVercelBypass) {
     const bypassToken = cachedVercelProtectionBypassToken();
     if (bypassToken) {
@@ -976,9 +1116,172 @@ async function drainRunnerPerfTraces(req: RunRequest): Promise<void> {
   ]);
 }
 
+let workerRequestSequence = 0;
+
 function makeRequestId(): string {
-  // Workers crypto.randomUUID is available without nodejs_compat.
-  return crypto.randomUUID();
+  workerRequestSequence = (workerRequestSequence + 1) % Number.MAX_SAFE_INTEGER;
+  return `worker-request-${workerRequestSequence}`;
+}
+
+function makeRuntimeSheetAttempt(input: {
+  runId: string;
+  runAttempt?: number | null;
+  mapName: string;
+  chunkIndex: number | 'finalize';
+}): {
+  attemptId: string;
+  attemptOwnerRunId: string;
+  attemptExpiresAt: string | null;
+  attemptSeq: number;
+} {
+  const runAttempt =
+    typeof input.runAttempt === 'number' && Number.isFinite(input.runAttempt)
+      ? Math.max(0, Math.floor(input.runAttempt))
+      : 0;
+  const attemptKey = sha256Hex(
+    JSON.stringify({
+      runId: input.runId,
+      runAttempt,
+      mapName: input.mapName,
+      chunkIndex: input.chunkIndex,
+    }),
+  ).slice(0, 16);
+  return {
+    attemptId: `sheet:${input.mapName}:${input.chunkIndex}:attempt-${runAttempt}:${attemptKey}`,
+    attemptOwnerRunId: input.runId,
+    attemptExpiresAt: null,
+    attemptSeq: runAttempt,
+  };
+}
+
+class RuntimeSheetAttemptLeaseLostError extends Error {
+  readonly rowKeys: string[];
+  readonly runId: string;
+  readonly attemptId: string;
+  readonly tableNamespace: string;
+
+  constructor(input: {
+    rowKeys: string[];
+    runId: string;
+    attemptId: string;
+    tableNamespace: string;
+    cause?: unknown;
+  }) {
+    const rowSummary =
+      input.rowKeys.length === 1
+        ? input.rowKeys[0]!
+        : `${input.rowKeys.length} rows`;
+    super(
+      `Runtime sheet attempt ${input.attemptId} lost ownership of ${rowSummary} in ${input.tableNamespace}.`,
+      { cause: input.cause },
+    );
+    this.name = 'RuntimeSheetAttemptLeaseLostError';
+    this.rowKeys = input.rowKeys;
+    this.runId = input.runId;
+    this.attemptId = input.attemptId;
+    this.tableNamespace = input.tableNamespace;
+  }
+}
+
+async function executeWithRuntimeSheetAttemptHeartbeat<T>(input: {
+  req: RunRequest;
+  tableNamespace: string;
+  sheetContract: PlaySheetContract;
+  attemptId?: string | null;
+  attemptOwnerRunId?: string | null;
+  attemptSeq?: number | null;
+  rowKeys: string[];
+  execute: () => Promise<T> | T;
+}): Promise<T> {
+  const attemptId = input.attemptId?.trim();
+  const rowKeys = [
+    ...new Set(input.rowKeys.map((key) => key.trim()).filter(Boolean)),
+  ];
+  if (!attemptId || rowKeys.length === 0) {
+    return await input.execute();
+  }
+  const heartbeatIntervalMs = runtimePolicyHeartbeatIntervalMs(
+    input.req,
+    runtimeSheetAttemptLeaseTtlMs(input.req) ??
+      PLAY_RUNTIME_SHEET_ATTEMPT_LEASE_TTL_MS,
+  );
+
+  let stopped = false;
+  let timeout: ReturnType<typeof setTimeout> | null = null;
+  let rejectLeaseLost!: (error: RuntimeSheetAttemptLeaseLostError) => void;
+  const leaseLost = new Promise<never>((_, reject) => {
+    rejectLeaseLost = reject;
+  });
+
+  const stop = () => {
+    stopped = true;
+    if (timeout !== null) {
+      clearTimeout(timeout);
+      timeout = null;
+    }
+  };
+
+  const heartbeatOnce = async () => {
+    const result = await harnessHeartbeatSheetAttempt({
+      ...runtimeSheetSessionScope(input.req),
+      tableNamespace: input.tableNamespace,
+      sheetContract: input.sheetContract,
+      runId: input.req.runId,
+      attemptId,
+      attemptOwnerRunId: input.attemptOwnerRunId ?? input.req.runId,
+      attemptSeq: input.attemptSeq ?? input.req.runAttempt ?? 0,
+      attemptLeaseTtlMs: runtimeSheetAttemptLeaseTtlMs(input.req),
+      keys: rowKeys,
+    });
+    const renewed = new Set(result.renewedKeys);
+    const lostKeys = rowKeys.filter((key) => !renewed.has(key));
+    if (lostKeys.length > 0) {
+      throw new RuntimeSheetAttemptLeaseLostError({
+        rowKeys: lostKeys,
+        runId: input.req.runId,
+        attemptId,
+        tableNamespace: input.tableNamespace,
+      });
+    }
+  };
+
+  const schedule = () => {
+    timeout = setTimeout(() => {
+      void (async () => {
+        try {
+          await heartbeatOnce();
+        } catch (error) {
+          stop();
+          if (error instanceof RuntimeSheetAttemptLeaseLostError) {
+            rejectLeaseLost(error);
+          } else {
+            rejectLeaseLost(
+              new RuntimeSheetAttemptLeaseLostError({
+                rowKeys,
+                runId: input.req.runId,
+                attemptId,
+                tableNamespace: input.tableNamespace,
+                cause: error,
+              }),
+            );
+          }
+          return;
+        }
+        if (!stopped) {
+          schedule();
+        }
+      })();
+    }, heartbeatIntervalMs);
+  };
+
+  schedule();
+  const execution = Promise.resolve().then(input.execute);
+  execution.catch(() => {});
+  try {
+    return await Promise.race([execution, leaseLost]);
+  } finally {
+    stop();
+  }
 }
 
 /**
@@ -1004,6 +1307,11 @@ async function postRuntimeApi<T>(
   baseUrl: string,
   executorToken: string,
   body: unknown,
+  options: {
+    runtimeTestFaultHeader?: string | null;
+    timeoutMsOverride?: number;
+    timeoutErrorMessage?: string;
+  } = {},
 ): Promise<T> {
   // Routes through the in-process RUNTIME_API service binding. Missing binding
   // is an infra error in workers_edge, not a reason to fall back to public HTTP.
@@ -1016,15 +1324,29 @@ async function postRuntimeApi<T>(
   ) {
     let res: Response;
     try {
-      res = await fetchRuntimeApi(baseUrl, '/api/v2/plays/internal/runtime', {
-        method: 'POST',
-        headers: {
-          'content-type': 'application/json',
-          authorization: `Bearer ${executorToken}`,
-          'x-deepline-request-id': makeRequestId(),
+      res = await fetchRuntimeApi(
+        baseUrl,
+        '/api/v2/internal/play-runtime',
+        {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            authorization: `Bearer ${executorToken}`,
+            'x-deepline-request-id': makeRequestId(),
+            ...(options.runtimeTestFaultHeader?.trim()
+              ? {
+                  [PLAY_RUNTIME_TEST_FAULT_HEADER]:
+                    options.runtimeTestFaultHeader.trim(),
+                }
+              : {}),
+          },
+          body: serializedBody,
         },
-        body: serializedBody,
-      });
+        {
+          timeoutMsOverride: options.timeoutMsOverride,
+          timeoutErrorMessage: options.timeoutErrorMessage,
+        },
+      );
     } catch (error) {
       lastError = error;
       if (
@@ -1108,9 +1430,10 @@ async function postRuntimeApiBestEffort(
   baseUrl: string,
   executorToken: string,
   body: unknown,
+  options: { runtimeTestFaultHeader?: string | null } = {},
 ): Promise<boolean> {
   try {
-    await postRuntimeApi(baseUrl, executorToken, body);
+    await postRuntimeApi(baseUrl, executorToken, body, options);
     return true;
   } catch (error) {
     console.error(
@@ -1122,6 +1445,43 @@ async function postRuntimeApiBestEffort(
   }
 }
 
+async function readDurableChildRunTerminalState(input: {
+  baseUrl: string;
+  executorToken: string;
+  parentRunId: string;
+  childRunId: string;
+  childPlayName: string;
+  timeoutMs?: number;
+}): Promise<{ data?: unknown } | null> {
+  const response = await postRuntimeApi<{
+    state?: {
+      data?: unknown;
+      reason?: string;
+      status?: string;
+      runId?: string;
+      playName?: string;
+      parentRunId?: string | null;
+    } | null;
+  }>(
+    input.baseUrl,
+    input.executorToken,
+    {
+      action: 'read_child_run_terminal_snapshot',
+      parentRunId: input.parentRunId,
+      childRunId: input.childRunId,
+      childPlayName: input.childPlayName,
+    },
+    {
+      timeoutMsOverride: input.timeoutMs,
+      timeoutErrorMessage: `[play-harness] child run terminal snapshot read timed out after ${Math.max(
+        1,
+        Math.ceil(input.timeoutMs ?? RUNTIME_API_TIMEOUT_MS),
+      )}ms. childRunId=${input.childRunId}`,
+    },
+  );
+  return response.state ?? null;
+}
+
 function workflowEventType(name: string): string {
   const normalized = name
     .trim()
@@ -1231,6 +1591,27 @@ async function hashChildPlayEventKey(input: unknown): Promise<string> {
   return (await hashJson(input)).slice(0, 32);
 }
 
+function workerChildRevisionFingerprint(input: {
+  playName: string;
+  manifest: PlayRuntimeManifest | null | undefined;
+}): string | null {
+  const manifest = input.manifest;
+  if (!manifest) return null;
+  return sha256Hex(
+    stableStringify({
+      playId: manifest.playName?.trim() || input.playName,
+      codeFormat: 'cjs_module',
+      artifactHash: manifest.artifactHash ?? null,
+      graphHash: manifest.graphHash ?? null,
+      sourceHash: null,
+      sourceCodeHash:
+        typeof manifest.sourceCode === 'string'
+          ? sha256Hex(manifest.sourceCode)
+          : null,
+    }),
+  );
+}
+
 async function childPlayEventKey(input: {
   key: string;
   workflowId: string;
@@ -1327,7 +1708,14 @@ async function signalParentPlayTerminal(input: {
 
 async function executeTool(
   req: RunRequest,
-  args: { id: string; toolId: string; input: Record<string, unknown> },
+  args: {
+    id: string;
+    toolId: string;
+    input: Record<string, unknown>;
+    durableCallReceiptKey?: string | null;
+    executionAuthScopeDigest?: string | null;
+    providerIdempotencyKey?: string | null;
+  },
   workflowStep?: WorkflowStep,
   onProviderBackpressure?: (retryAfterMs: number) => void,
   onRetryAttempt?: () => void,
@@ -1365,7 +1753,14 @@ async function executeTool(
 
 async function executeToolWithLifecycle(
   req: RunRequest,
-  args: { id: string; toolId: string; input: Record<string, unknown> },
+  args: {
+    id: string;
+    toolId: string;
+    input: Record<string, unknown>;
+    durableCallReceiptKey?: string | null;
+    executionAuthScopeDigest?: string | null;
+    providerIdempotencyKey?: string | null;
+  },
   workflowStep: WorkflowStep | undefined,
   callbacks: WorkerCtxCallbacks | undefined,
   onProviderBackpressure?: (retryAfterMs: number) => void,
@@ -1461,24 +1856,29 @@ async function waitForSyntheticIntegrationEvent(
     typeof input.timeout_ms === 'number' && Number.isFinite(input.timeout_ms)
       ? Math.max(1, Math.round(input.timeout_ms))
       : 30_000;
-  await postRuntimeApiBestEffort(req.baseUrl, req.executorToken, {
-    action: 'append_run_events',
-    playId: req.runId,
-    events: [
-      {
-        type: 'log.appended',
-        runId: req.runId,
-        // 'system' (windowed text-dedupe channel), NOT 'worker': this line is
-        // emitted outside the harness log buffer, so it has no positional
-        // channelOffset and must not pollute the worker channel cursor.
-        source: 'system',
-        occurredAt: nowMs(),
-        lines: [
-          `Waiting for integration_event:${eventKey} for up to ${timeoutMs}ms.`,
-        ],
-      } satisfies PlayRunLedgerEvent,
-    ],
-  });
+  await postRuntimeApiBestEffort(
+    req.baseUrl,
+    req.executorToken,
+    {
+      action: 'append_run_events',
+      playId: req.runId,
+      events: [
+        {
+          type: 'log.appended',
+          runId: req.runId,
+          // 'system' (windowed text-dedupe channel), NOT 'worker': this line is
+          // emitted outside the harness log buffer, so it has no positional
+          // channelOffset and must not pollute the worker channel cursor.
+          source: 'system',
+          occurredAt: nowMs(),
+          lines: [
+            `Waiting for integration_event:${eventKey} for up to ${timeoutMs}ms.`,
+          ],
+        } satisfies PlayRunLedgerEvent,
+      ],
+    },
+    { runtimeTestFaultHeader: req.runtimeTestFaultHeader ?? null },
+  );
   try {
     const event = (await (
       workflowStep.waitForEvent as unknown as (
@@ -1526,7 +1926,14 @@ async function waitForSyntheticIntegrationEvent(
 
 async function callToolDirect(
   req: RunRequest,
-  args: { id: string; toolId: string; input: Record<string, unknown> },
+  args: {
+    id: string;
+    toolId: string;
+    input: Record<string, unknown>;
+    durableCallReceiptKey?: string | null;
+    executionAuthScopeDigest?: string | null;
+    providerIdempotencyKey?: string | null;
+  },
   onProviderBackpressure?: (retryAfterMs: number) => void,
   // Invoked once per in-process retry attempt (429 / retryable 5xx / synthetic
   // transient) so the Governor charges chargeBudget('retry') per attempt — the
@@ -1542,6 +1949,16 @@ async function callToolDirect(
 ): Promise<ToolExecuteResult> {
   const { id, toolId, input } = args;
   const path = `/api/v2/integrations/${encodeURIComponent(toolId)}/execute`;
+  const durableCallReceiptKey = args.durableCallReceiptKey?.trim() || null;
+  const executionAuthScopeDigest =
+    durableCallReceiptKey && args.executionAuthScopeDigest
+      ? args.executionAuthScopeDigest.trim() || null
+      : null;
+  const providerIdempotencyKey =
+    args.providerIdempotencyKey?.trim() || durableCallReceiptKey;
+  const deeplineRequestId = providerIdempotencyKey
+    ? `ctx-tool-${sha256Hex(providerIdempotencyKey).slice(0, 32)}`
+    : null;
   let lastError: Error | null = null;
   const httpFailureAttempts = createToolExecuteHttpFailureAttemptTracker();
   let requestAttempt = 0;
@@ -1564,7 +1981,12 @@ async function callToolDirect(
           headers: {
             'content-type': 'application/json',
             authorization: `Bearer ${req.executorToken}`,
-            'x-deepline-request-id': `${req.runId}:${toolId}:${id}:attempt:${requestAttempt}`,
+            'x-deepline-request-id':
+              deeplineRequestId ??
+              `${req.runId}:${toolId}:${id}:attempt:${requestAttempt}`,
+            ...(providerIdempotencyKey
+              ? { 'x-deepline-idempotency-key': providerIdempotencyKey }
+              : {}),
             [EXECUTE_RESPONSE_CONTRACT_HEADER]: V2_EXECUTE_RESPONSE_CONTRACT,
             [EXECUTE_RESPONSE_INTENT_HEADER]: 'dataset',
             [EXECUTE_TOOL_METADATA_HEADER]: 'true',
@@ -1573,6 +1995,16 @@ async function callToolDirect(
             payload: input,
             metadata: {
               parent_run_id: req.runId,
+              ...(durableCallReceiptKey
+                ? {
+                    durable_call_receipt_key: durableCallReceiptKey,
+                    ...(executionAuthScopeDigest
+                      ? {
+                          execution_auth_scope_digest: executionAuthScopeDigest,
+                        }
+                      : {}),
+                  }
+                : {}),
               ...(directOptions?.customerDbDataset
                 ? {
                     query_result_dataset: {
@@ -1605,6 +2037,9 @@ async function callToolDirect(
                       : {}),
                   }
                 : {}),
+              ...(providerIdempotencyKey
+                ? { provider_idempotency_key: providerIdempotencyKey }
+                : {}),
             },
             ...(req.integrationMode
               ? { integration_mode: req.integrationMode }
@@ -1652,6 +2087,13 @@ async function callToolDirect(
     }
 
     const text = await res.text().catch(() => '');
+    const authScopeChanged = parseToolExecuteAuthScopeChangedError({
+      status: res.status,
+      bodyText: text,
+    });
+    if (authScopeChanged) {
+      throw authScopeChanged;
+    }
     const httpFailureAttempt = httpFailureAttempts.next({
       toolId,
       status: res.status,
@@ -1685,48 +2127,6 @@ async function callToolDirect(
   throw lastError ?? new Error(`tool ${toolId} failed before execution.`);
 }
 
-function toolMetadataFallback(toolId: string): ToolResultMetadataInput {
-  if (toolId === 'test_rate_limit') {
-    // Batched members resolve metadata through this fallback because the lean
-    // worker does not bundle the catalog. It MUST mirror the same
-    // `email_status: emailStatus({...})` contract registered in
-    // src/lib/integrations/test/index.ts so batched results normalize to the
-    // same rich email_status OBJECT (status from statusMap, catch_all as a
-    // signal) that the single-execute real-metadata path produces. The legacy
-    // `transforms:['emailStatus']` + mx_security_gateway→'catch_all' string
-    // override coarsened email_status into a bare string and predates the
-    // emailStatus object contract (#1466).
-    return {
-      toolId,
-      extractors: {
-        email_status: {
-          paths: ['email_status'],
-          emailStatus: {
-            provider: 'test',
-            rawStatus: ['email_status'],
-            catchAll: ['mx_security_gateway'],
-            statusMap: {
-              valid: { status: 'valid', verdict: 'send', verified: true },
-              invalid: { status: 'invalid', verdict: 'drop', verified: false },
-              catch_all: {
-                status: 'catch_all',
-                verdict: 'verify_next',
-                verified: false,
-              },
-              unknown: { status: 'unknown', verdict: 'hold', verified: false },
-            },
-          },
-        },
-      },
-      targetGetters: {
-        email: ['email', 'value'],
-        email_status: ['email_status'],
-      },
-    };
-  }
-  return { toolId };
-}
-
 function wrapWorkerToolResult(
   toolId: string,
   result: unknown,
@@ -1767,10 +2167,10 @@ function attachWorkerCustomerDbDatasetResult(
     typeof options.input.sql === 'string'
       ? options.input.sql
       : typeof options.input.query === 'string'
-      ? options.input.query
-      : typeof raw?.sql === 'string'
-        ? raw.sql
-        : null;
+        ? options.input.query
+        : typeof raw?.sql === 'string'
+          ? raw.sql
+          : null;
   if (!dataset || totalRows === null || !sql) {
     return result;
   }
@@ -1880,1455 +2280,93 @@ type RecordedStepProgramOutput = {
 
 type WorkerStepProgramRecorder = {
   parentField: string;
-  path: string[];
-  outputs: RecordedStepProgramOutput[];
-  onOutput?: (output: RecordedStepProgramOutput) => void | Promise<void>;
-};
-
-type WorkerStepResolution = {
-  value: unknown;
-  status?: 'skipped';
-};
-
-type WorkerToolBatchRequest = {
-  id: string;
-  cacheKey: string;
-  receiptKey: string | null;
-  force: boolean;
-  receiptWaitMaxAttempts: number;
-  runtimeTimeoutMs?: number;
-  toolId: string;
-  input: Record<string, unknown>;
-  workflowStep?: WorkflowStep;
-  directOptions?: WorkerToolDirectOptions;
-  resolve: (value: unknown) => void;
-  reject: (error: unknown) => void;
-};
-
-type ClaimedWorkerToolBatchRequest = {
-  request: WorkerToolBatchRequest;
-  receiptKey: string | null;
-  followers: WorkerToolBatchRequest[];
-};
-
-type PreparedWorkerToolBatchRequests = {
-  claimedRequests: ClaimedWorkerToolBatchRequest[];
-  deferredClaimedRequests: Promise<ClaimedWorkerToolBatchRequest[]>[];
-};
-
-function resolveClaimedWorkerToolRuntimeTimeoutMs(
-  claimedRequests: ClaimedWorkerToolBatchRequest[],
-  input: { runtimeDeadlineMs?: number },
-): number | undefined {
-  return resolveWorkerToolRuntimeTimeoutMs(claimedRequests, {
-    resolveOwnerTimeoutMs: (request) =>
-      resolveToolRuntimeApiTimeout({
-        requestInput: request.input,
-        timeoutMs: request.runtimeTimeoutMs,
-        runtimeDeadlineMs: input.runtimeDeadlineMs,
-      }).timeoutMs,
-  });
-}
-
-const WORKER_TOOL_BATCH_GRACE_MS = 250;
-const MAP_EXECUTION_HEARTBEAT_INTERVAL_MS = 5_000;
-const MAP_INCREMENTAL_PERSIST_CHUNK_ROWS = 100;
-const MAP_INCREMENTAL_PERSIST_CHUNK_BYTES = 1 * 1024 * 1024;
-const MAP_INCREMENTAL_PERSIST_INTERVAL_MS = 1_000;
-const MAP_LIVE_UPDATE_FLUSH_CHUNK_ROWS = 1_000;
-/**
- * Bounded number of per-row failure samples carried in chunk summaries and the
- * map's terminal partial-failure log. Every failed row is persisted with its
- * full error in the runtime sheet; the samples just keep run logs readable.
- */
-const MAP_ROW_FAILURE_SAMPLE_LIMIT = 3;
-
-class RuntimeReceiptPersistenceError extends Error {
-  readonly errors: unknown[];
-
-  constructor(message: string, errors: unknown[] = []) {
-    super(message);
-    this.name = 'RuntimeReceiptPersistenceError';
-    this.errors = errors;
-  }
-}
-
-function isRuntimeReceiptPersistenceError(error: unknown): boolean {
-  if (!error || typeof error !== 'object') return false;
-  if (error instanceof RuntimeReceiptPersistenceError) return true;
-  if (
-    error instanceof Error &&
-    error.name === 'RuntimeReceiptPersistenceError'
-  ) {
-    return true;
-  }
-  const nestedErrors = (error as { errors?: unknown }).errors;
-  return (
-    Array.isArray(nestedErrors) &&
-    nestedErrors.some(isRuntimeReceiptPersistenceError)
-  );
-}
-
-function isRunFatalWorkerRowError(error: unknown): boolean {
-  return (
-    isCoordinatorProgressAuthorizationError(error) ||
-    isRowIsolationExemptError(error) ||
-    isRuntimeReceiptPersistenceError(error) ||
-    isRuntimePersistenceCircuitOpenError(error)
-  );
-}
-
-/**
- * completeReceipt salvage retry ladder. On a persistence failure after a billed
- * call we retry the receipt completion past the server-side 5s connect window:
- * 1 initial attempt + 3 retries at 1s / 3s / 9s (single isolate — no jitter).
- * Bounded by the run deadline (`runtimeDeadlineMs`); we stop early unless there
- * is at least one backoff's worth plus headroom of budget left.
- */
-const COMPLETE_RECEIPT_RETRY_BACKOFFS_MS = [1_000, 3_000, 9_000] as const;
-const COMPLETE_RECEIPT_RETRY_MIN_HEADROOM_MS = 10_000;
-
-// Fallback batch-chunk parallelism when a tool declares no provider rate hints.
-// Matches the prior hardcoded `Math.min(4, ...)` so undeclared providers keep
-// their previous batching behavior; declared providers tighten via the
-// Governor's suggestedParallelism.
-const WORKER_TOOL_BATCH_DEFAULT_PARALLELISM = 4;
-
-/**
- * In-process retry budget for HTTP 429 tool responses. Rate-limit pushback is
- * throughput pacing (provider or Deepline limiter), not a tool defect, so it
- * gets more patience than the generic 3-attempt budget: with retry-after-aware
- * escalating delays (capped at 5s) this absorbs roughly 25s of sustained
- * throttling before the call fails. Every retry still charges the Governor's
- * retry budget, so a runaway storm stays bounded and loud.
- */
-
-function sleepWorkerMs(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-function workerDurableToolCallCacheKey(input: {
-  req: RunRequest;
-  toolId: string;
-  requestInput: Record<string, unknown>;
-  providerActionVersion: string;
-  staleAfterSeconds?: number | null;
-}): string {
-  return buildDurableToolCallCacheKey({
-    orgId: input.req.orgId,
-    playId: input.req.playName,
-    toolId: input.toolId,
-    requestInput: input.requestInput,
-    authScopeDigest: buildDurableToolCallAuthScopeDigest({
-      orgId: input.req.orgId,
-      userEmail: input.req.userEmail,
-      toolId: input.toolId,
-    }),
-    providerActionVersion: input.providerActionVersion,
-    staleAfterSeconds: input.staleAfterSeconds,
-  });
-}
-
-function workerRuntimeReceiptKey(input: {
-  req: RunRequest;
-  key: string;
-}): string {
-  const orgId = input.req.orgId?.trim() || 'org';
-  if (input.key.startsWith(`ctx:${orgId}:`)) {
-    return input.key;
-  }
-  return buildScopedWorkReceiptKey({
-    orgId: input.req.orgId,
-    playName: input.req.playName,
-    key: input.key,
-  });
-}
-
-function stepProgramColumnName(parentField: string, stepId: string): string {
-  return sqlSafePlayColumnName(`${parentField}.${stepId}`);
-}
-
-class WorkerToolBatchScheduler {
-  private queue: WorkerToolBatchRequest[] = [];
-  private scheduled = false;
-
-  constructor(
-    private readonly req: RunRequest,
-    private readonly governor: PlayExecutionGovernor,
-    private readonly resolvePacing: WorkerPacingResolver,
-    private readonly resolveToolActionCacheVersion: WorkerToolActionCacheVersionResolver,
-    private readonly abortSignal?: AbortSignal,
-    private readonly onRequestsSettled?: (count: number) => void,
-    private readonly callbacks?: WorkerCtxCallbacks,
-    private readonly receiptStore?: WorkerRuntimeReceiptStore,
-    private readonly allowLocalRetryReceipts = false,
-    private readonly runtimeDeadlineMs?: number,
-    // Map-wide (or ctx-wide for the root scheduler) persistence-failure circuit
-    // breaker. Shared by every row worker so the first persistence failure
-    // halts NEW provider dispatch across the whole map.
-    private readonly latch: RuntimePersistenceLatch = createRuntimePersistenceLatch(),
-    // Run-scoped buffer for orphaned billed results whose receipt could not be
-    // completed even after the retry ladder.
-    private readonly salvage?: ReceiptSalvageBuffer,
-  ) {}
-
-  /**
-   * Run `completeReceipt`/`completeReceipts` with the salvage retry ladder.
-   * Retries a receipt-completion failure past the server-side 5s connect window
-   * so a transient blip does not orphan a billed result. Bounded by the run
-   * deadline; skips retries when the latch has already burned a ladder in this
-   * map so many in-flight orphans do not each serialize a long loop.
-   */
-  private async completeReceiptWithRetryLadder<T>(
-    run: () => Promise<T>,
-    onGiveUp?: (attempts: number) => void,
-  ): Promise<T> {
-    let attempt = 0;
-    // A ladder that has already started retrying keeps its full budget even if
-    // a peer trips the latch mid-flight — only FRESH entrants collapse once the
-    // failure is confirmed. This is what guarantees the first ladder rides out
-    // a genuine transient blip.
-    let committedToFullLadder = false;
-    const giveUp = (error: unknown): never => {
-      this.latch.latchRetryBudgetExhausted = true;
-      onGiveUp?.(attempt);
-      throw error;
-    };
-    while (true) {
-      try {
-        return await run();
-      } catch (error) {
-        attempt += 1;
-        if (
-          shouldShortenCompleteReceiptLadder(this.latch, committedToFullLadder) ||
-          attempt > COMPLETE_RECEIPT_RETRY_BACKOFFS_MS.length ||
-          this.abortSignal?.aborted
-        ) {
-          return giveUp(error);
-        }
-        const backoffMs = COMPLETE_RECEIPT_RETRY_BACKOFFS_MS[attempt - 1]!;
-        // resolveRuntimeDeadlineRemainingMs THROWS WorkflowAbortError once the
-        // run deadline has passed — the correct loud outcome (there is no
-        // separate per-chunk step timeout). Route that throw through giveUp so
-        // the billed result is still salvaged and the ladder budget flag is
-        // set: a billed output must never lose its durable trace because the
-        // clock ran out mid-ladder.
-        let remainingMs: number;
-        try {
-          remainingMs = resolveRuntimeDeadlineRemainingMs(
-            this.runtimeDeadlineMs,
-          );
-        } catch (deadlineError) {
-          return giveUp(deadlineError);
-        }
-        if (remainingMs <= backoffMs + COMPLETE_RECEIPT_RETRY_MIN_HEADROOM_MS) {
-          return giveUp(error);
-        }
-        // Past every give-up gate: this ladder is now committed to the full
-        // budget and must not be collapsed by a peer tripping the latch mid-sleep.
-        committedToFullLadder = true;
-        await sleepWorkerMs(backoffMs);
-      }
-    }
-  }
-
-  /**
-   * Record a billed-but-unpersisted tool output into the run-scoped salvage
-   * buffer. Called only after the completeReceipt ladder is exhausted, with the
-   * exact serialized payload a receipt would have stored.
-   */
-  private recordReceiptSalvage(input: {
-    claimed: ClaimedWorkerToolBatchRequest;
-    output: unknown;
-    attempts: number;
-  }): void {
-    if (!this.salvage || !input.claimed.receiptKey) return;
-    this.salvage.push({
-      receiptKey: input.claimed.receiptKey,
-      toolId: input.claimed.request.toolId,
-      cacheKey: input.claimed.request.cacheKey,
-      output: input.output,
-      completeAttempts: input.attempts,
-      firstErrorAt: nowMs(),
-    });
-  }
-
-  /**
-   * Report a provider 429 / Retry-After back into the Governor's shared pacer
-   * so future acquires for this (org, provider) bucket back off across all
-   * isolates. Provider comes from the same pacing resolver the Governor uses
-   * (the worker has no local catalog), so callers pass only the toolId.
-   */
-  private reportBackpressure(toolId: string, retryAfterMs: number): void {
-    if (retryAfterMs <= 0) return;
-    void (async () => {
-      const pacing = await this.resolvePacing(toolId).catch(() => null);
-      if (pacing?.provider) {
-        this.governor.reportProviderBackpressure({
-          provider: pacing.provider,
-          retryAfterMs,
-        });
-      }
-    })();
-  }
-
-  async execute(
-    id: string,
-    toolId: string,
-    input: Record<string, unknown>,
-    workflowStep?: WorkflowStep,
-    options?: { force?: boolean; staleAfterSeconds?: number | null },
-    runtimeOptions?: { timeoutMs?: number; receiptWaitMs?: number },
-  ): Promise<unknown> {
-    const providerActionVersion =
-      await this.resolveToolActionCacheVersion(toolId);
-    return await new Promise((resolve, reject) => {
-      const queuedAt = nowMs();
-      const receiptKey = workerDurableToolCallCacheKey({
-        req: this.req,
-        toolId,
-        requestInput: input,
-        providerActionVersion,
-        staleAfterSeconds: options?.staleAfterSeconds,
-      });
-      const queryResultDatasetRead = isQueryResultDatasetReadRequest(
-        toolId,
-        input,
-      );
-      const receiptEligible = !queryResultDatasetRead;
-      this.queue.push({
-        id,
-        cacheKey: receiptEligible ? receiptKey : '',
-        receiptKey: receiptEligible ? receiptKey : null,
-        force: options?.force === true || !!this.req.force,
-        receiptWaitMaxAttempts: resolveRuntimeToolReceiptWaitMaxAttempts(
-          typeof runtimeOptions?.receiptWaitMs === 'number'
-            ? { max_wait_ms: runtimeOptions.receiptWaitMs }
-            : input,
-        ),
-        ...(typeof runtimeOptions?.timeoutMs === 'number'
-          ? { runtimeTimeoutMs: runtimeOptions.timeoutMs }
-          : {}),
-        toolId,
-        input,
-        workflowStep,
-        ...(queryResultDatasetRead
-          ? {
-              directOptions: {
-                customerDbDataset: {
-                  offset: 0,
-                  pageSize: QUERY_RESULT_DATASET_PAGE_SIZE,
-                },
-              },
-            }
-          : {}),
-        resolve: (value) => {
-          recordRunnerPerfTrace({
-            req: this.req,
-            phase: 'runner.tool.request',
-            ms: nowMs() - queuedAt,
-            extra: { id, toolId },
-          });
-          resolve(value);
-        },
-        reject,
-      });
-      this.scheduleDrain();
-    });
-  }
-
-  private scheduleDrain(): void {
-    if (this.scheduled) return;
-    this.scheduled = true;
-    queueMicrotask(async () => {
-      if (this.hasBatchableQueuedTool()) {
-        await new Promise((resolve) =>
-          setTimeout(resolve, WORKER_TOOL_BATCH_GRACE_MS),
-        );
-      }
-      void this.drain();
-    });
-  }
-
-  private hasBatchableQueuedTool(): boolean {
-    return this.queue.some(
-      (request) =>
-        request.toolId !== 'test_wait_for_event' &&
-        getPlayRuntimeBatchStrategy(request.toolId) !== null,
-    );
-  }
-
-  private async drain(): Promise<void> {
-    const requests = this.queue;
-    this.queue = [];
-    this.scheduled = false;
-    const drainStartedAt = nowMs();
-    await Promise.all(
-      [...groupWorkerToolRequestsByTool(requests).entries()].map(
-        async ([toolId, groupedRequests]) => {
-          await this.executeToolGroup(toolId, groupedRequests);
-        },
-      ),
-    );
-    recordRunnerPerfTrace({
-      req: this.req,
-      phase: 'runner.tool.drain',
-      ms: nowMs() - drainStartedAt,
-      extra: { requests: requests.length },
-    });
-    if (this.queue.length > 0) {
-      this.scheduleDrain();
-    }
-  }
-
-  private async waitForDurableToolReceipt(input: {
-    receiptKey: string;
-    maxAttempts: number;
-  }): Promise<WorkerRuntimeReceipt> {
-    if (!this.receiptStore?.getReceipt) {
-      throw new Error(
-        'Worker durable tool receipt wait requires receipt lookup.',
-      );
-    }
-    const receipt = await waitForCompletedRuntimeReceipt({
-      receiptKey: input.receiptKey,
-      maxAttempts: input.maxAttempts,
-      abortSignal: this.abortSignal,
-      store: {
-        getMany: async (receiptKeys) => {
-          const receipts = new Map<string, RuntimeStepReceipt>();
-          await Promise.all(
-            receiptKeys.map(async (key) => {
-              const receipt = await this.receiptStore!.getReceipt!({
-                playName: this.req.playName,
-                key,
-              });
-              if (!receipt) return;
-              receipts.set(key, {
-                key: receipt.key,
-                status: receipt.status,
-                output: receipt.output,
-                error: receipt.error ?? undefined,
-                runId: receipt.runId ?? null,
-              });
-            }),
-          );
-          return receipts;
-        },
-      },
-    });
-    return receipt;
-  }
-
-  private settleRequests(
-    claimed: ClaimedWorkerToolBatchRequest,
-    result: unknown,
-  ): void {
-    claimed.request.resolve(result);
-    for (const follower of claimed.followers) {
-      follower.resolve(
-        claimed.receiptKey
-          ? markWorkerToolReceiptResultExecution(result, {
-              kind: 'in_flight',
-              receiptKey: claimed.receiptKey,
-              attachedToReceiptKey: claimed.receiptKey,
-            })
-          : result,
-      );
-    }
-    this.onRequestsSettled?.(1 + claimed.followers.length);
-  }
-
-  private rejectRequests(
-    claimed: ClaimedWorkerToolBatchRequest,
-    error: unknown,
-  ): void {
-    claimed.request.reject(error);
-    for (const follower of claimed.followers) {
-      follower.reject(error);
-    }
-    this.onRequestsSettled?.(1 + claimed.followers.length);
-  }
-
-  private rejectRawRequests(
-    requests: WorkerToolBatchRequest[],
-    error: unknown,
-  ): void {
-    for (const request of requests) {
-      request.reject(error);
-    }
-    this.onRequestsSettled?.(requests.length);
-  }
-
-  private async resolveCompletedDurableToolReceiptGroup(input: {
-    group: WorkerToolBatchRequest[];
-    receiptKey: string;
-    receipt: WorkerRuntimeReceipt;
-    source: 'cache' | 'in_flight';
-  }): Promise<void> {
-    const [first] = input.group;
-    if (!first) return;
-    const value = deserializeDurableStepValue(input.receipt.output);
-    const result =
-      input.source === 'cache'
-        ? markWorkerToolReceiptResultCached(
-            value,
-            first.cacheKey,
-            input.receiptKey,
-          )
-        : markWorkerToolReceiptResultExecution(value, {
-            kind: 'in_flight',
-            receiptKey: input.receiptKey,
-            attachedToReceiptKey: input.receiptKey,
-          });
-    for (const request of input.group) {
-      request.resolve(result);
-    }
-    this.onRequestsSettled?.(input.group.length);
-  }
-
-  private async reclaimRunningDurableToolReceiptGroupAfterWait(input: {
-    group: WorkerToolBatchRequest[];
-    receiptKey: string;
-    runningReceipt: WorkerRuntimeReceipt;
-  }): Promise<ClaimedWorkerToolBatchRequest[]> {
-    const [request, ...followers] = input.group;
-    if (!request || !this.receiptStore) {
-      this.rejectRawRequests(
-        input.group,
-        new RuntimeReceiptWaitTimeoutError(input.receiptKey),
-      );
-      return [];
-    }
-    // A `running` receipt left by a DIFFERENT run whose last write is stale will
-    // never be completed by a live worker. Polling it burns one service-binding
-    // subrequest per tick, up to the receipt's wait budget (~1320) — many such
-    // orphans on a resume exhaust Cloudflare's per-invocation subrequest budget
-    // and kill the run. The orchestrator reclaims those immediately (skipping the
-    // poll) and re-executes, matching the "on resume it reclaims and re-executes"
-    // contract; live/fresh/same-run owners still poll before reclaiming. Kept as
-    // an injected helper so the skip-poll decision is unit-testable without
-    // loading this cloudflare:workers Worker entrypoint.
-    return await reclaimRunningReceiptGroupAfterWait<ClaimedWorkerToolBatchRequest>(
-      {
-        ownership: {
-          ownerRunId: input.runningReceipt.runId,
-          currentRunId: this.req.runId,
-          updatedAt: input.runningReceipt.updatedAt,
-        },
-        timeoutError: new RuntimeReceiptWaitTimeoutError(input.receiptKey),
-        poll: async () => {
-          try {
-            const receipt = await this.waitForDurableToolReceipt({
-              receiptKey: input.receiptKey,
-              maxAttempts: resolveWorkerToolReceiptGroupWaitMaxAttempts(
-                input.group,
-                (groupRequest) => groupRequest.receiptWaitMaxAttempts,
-              ),
-            });
-            await this.resolveCompletedDurableToolReceiptGroup({
-              group: input.group,
-              receiptKey: input.receiptKey,
-              receipt,
-              source: 'in_flight',
-            });
-            return { kind: 'completed' };
-          } catch (error) {
-            if (error instanceof RuntimeReceiptWaitTimeoutError) {
-              return { kind: 'timed_out', error };
-            }
-            return { kind: 'errored', error };
-          }
-        },
-        reclaim: (rejectionOnFallthrough) =>
-          this.forceReclaimRunningDurableToolReceiptGroup({
-            group: input.group,
-            request,
-            followers,
-            receiptKey: input.receiptKey,
-            rejectionOnFallthrough,
-          }),
-        reject: (error) => this.rejectRawRequests(input.group, error),
-      },
-    );
-  }
-
-  /**
-   * Steal a `running` receipt (reclaimRunning) and route by claim disposition.
-   * Shared by the post-poll-timeout reclaim and the dead-owner fast path, so
-   * both dispose of a reclaimed/reused/failed receipt identically.
-   */
-  private async forceReclaimRunningDurableToolReceiptGroup(input: {
-    group: WorkerToolBatchRequest[];
-    request: WorkerToolBatchRequest;
-    followers: WorkerToolBatchRequest[];
-    receiptKey: string;
-    rejectionOnFallthrough: unknown;
-  }): Promise<ClaimedWorkerToolBatchRequest[]> {
-    if (!this.receiptStore) {
-      this.rejectRawRequests(input.group, input.rejectionOnFallthrough);
-      return [];
-    }
-    let claim: WorkerRuntimeReceiptClaim;
-    try {
-      claim = await this.receiptStore.claimReceipt({
-        playName: this.req.playName,
-        runId: this.req.runId,
-        key: input.receiptKey,
-        reclaimRunning: true,
-      });
-    } catch (error) {
-      this.rejectRawRequests(input.group, error);
-      return [];
-    }
-    if (claim.disposition === 'claimed') {
-      return [
-        {
-          request: input.request,
-          receiptKey: input.receiptKey,
-          followers: input.followers,
-        },
-      ];
-    }
-    if (claim.disposition === 'reused') {
-      await this.resolveCompletedDurableToolReceiptGroup({
-        group: input.group,
-        receiptKey: input.receiptKey,
-        receipt: claim.receipt,
-        source: 'cache',
-      });
-      return [];
-    }
-    if (claim.disposition === 'failed') {
-      return await this.reclaimFailedDurableToolReceiptGroup({
-        group: input.group,
-        receiptKey: input.receiptKey,
-        failedReceipt: claim.receipt,
-      });
-    }
-    this.rejectRawRequests(input.group, input.rejectionOnFallthrough);
-    return [];
-  }
-
-  private async reclaimFailedDurableToolReceiptGroup(input: {
-    group: WorkerToolBatchRequest[];
-    receiptKey: string;
-    failedReceipt: WorkerRuntimeReceipt;
-  }): Promise<ClaimedWorkerToolBatchRequest[]> {
-    const failedError = new Error(
-      `Durable tool call ${input.receiptKey} failed: ${input.failedReceipt.error ?? 'unknown error'}`,
-    );
-    const [request, ...followers] = input.group;
-    if (!request || !this.receiptStore) {
-      this.rejectRawRequests(input.group, failedError);
-      return [];
-    }
-    if (
-      !canReclaimFailedWorkerToolReceipt({
-        error: input.failedReceipt.error,
-      })
-    ) {
-      this.rejectRawRequests(input.group, failedError);
-      return [];
-    }
-    let claim: WorkerRuntimeReceiptClaim;
-    try {
-      claim = await this.receiptStore.claimReceipt({
-        playName: this.req.playName,
-        runId: this.req.runId,
-        key: input.receiptKey,
-      });
-    } catch (error) {
-      this.rejectRawRequests(input.group, error);
-      return [];
-    }
-    if (claim.disposition === 'claimed') {
-      return [{ request, receiptKey: input.receiptKey, followers }];
-    }
-    if (claim.disposition === 'reused') {
-      await this.resolveCompletedDurableToolReceiptGroup({
-        group: input.group,
-        receiptKey: input.receiptKey,
-        receipt: claim.receipt,
-        source: 'cache',
-      });
-      return [];
-    }
-    if (claim.disposition === 'running') {
-      try {
-        const receipt = await this.waitForDurableToolReceipt({
-          receiptKey: input.receiptKey,
-          maxAttempts: resolveWorkerToolReceiptGroupWaitMaxAttempts(
-            input.group,
-            (groupRequest) => groupRequest.receiptWaitMaxAttempts,
-          ),
-        });
-        await this.resolveCompletedDurableToolReceiptGroup({
-          group: input.group,
-          receiptKey: input.receiptKey,
-          receipt,
-          source: 'in_flight',
-        });
-      } catch (error) {
-        this.rejectRawRequests(input.group, error);
-      }
-      return [];
-    }
-    this.rejectRawRequests(
-      input.group,
-      new Error(
-        `Durable tool call ${input.receiptKey} failed: ${claim.receipt.error ?? 'unknown error'}`,
-      ),
-    );
-    return [];
-  }
-
-  private async failureForRejectedToolRequest(
-    claimed: ClaimedWorkerToolBatchRequest,
-    error: unknown,
-  ): Promise<unknown> {
-    try {
-      await this.failDurableToolRequest(claimed, error);
-      return error;
-    } catch (receiptError) {
-      tripRuntimePersistenceLatch(this.latch, receiptError);
-      return new RuntimeReceiptPersistenceError(
-        'Tool call failed and durable receipt could not be marked failed',
-        [error, receiptError],
-      );
-    }
-  }
-
-  private async claimDurableToolReceiptGroups(
-    groups: ReturnType<
-      typeof planWorkerToolReceiptGroups<WorkerToolBatchRequest>
-    >['durableGroups'],
-  ): Promise<
-    Array<{
-      group: ReturnType<
-        typeof planWorkerToolReceiptGroups<WorkerToolBatchRequest>
-      >['durableGroups'][number];
-      receiptKey: string;
-      claim: WorkerRuntimeReceiptClaim;
-    }>
-  > {
-    if (!this.receiptStore) return [];
-    const planned = groups.map((group) => ({
-      group,
-      receiptKey: workerRuntimeReceiptKey({
-        req: this.req,
-        key: group.claimableReceiptKey,
-      }),
-    }));
-    const claimOne = async (entry: (typeof planned)[number]) => ({
-      ...entry,
-      claim: await this.receiptStore!.claimReceipt({
-        playName: this.req.playName,
-        runId: this.req.runId,
-        key: entry.receiptKey,
-        ...(entry.group.forceDurableRefresh
-          ? { forceRefresh: true, reclaimRunning: true }
-          : {}),
-      }),
-    });
-    if (!this.receiptStore.claimReceipts) {
-      return await Promise.all(planned.map(claimOne));
-    }
-    const claimed: Array<{
-      group: (typeof planned)[number]['group'];
-      receiptKey: string;
-      claim: WorkerRuntimeReceiptClaim;
-    }> = [];
-    for (const forceDurableRefresh of [false, true]) {
-      const entries = planned.filter(
-        (entry) => entry.group.forceDurableRefresh === forceDurableRefresh,
-      );
-      if (entries.length === 0) continue;
-      const claims = await this.receiptStore.claimReceipts({
-        playName: this.req.playName,
-        runId: this.req.runId,
-        keys: entries.map((entry) => entry.receiptKey),
-        ...(forceDurableRefresh
-          ? { forceRefresh: true, reclaimRunning: true }
-          : {}),
-      });
-      entries.forEach((entry, index) => {
-        const claim = claims[index];
-        if (!claim) {
-          throw new Error(
-            `Runtime receipt batch claim did not return receipt ${entry.receiptKey}.`,
-          );
-        }
-        claimed.push({ ...entry, claim });
-      });
-    }
-    return claimed;
-  }
-
-  private async prepareDurableToolRequests(
-    requests: WorkerToolBatchRequest[],
-  ): Promise<PreparedWorkerToolBatchRequests> {
-    if (!this.receiptStore) {
-      return {
-        claimedRequests: requests.map((request) => ({
-          request,
-          receiptKey: null,
-          followers: [],
-        })),
-        deferredClaimedRequests: [],
-      };
-    }
-
-    const claimedRequests: ClaimedWorkerToolBatchRequest[] = [];
-    const deferredClaimedRequests: Promise<ClaimedWorkerToolBatchRequest[]>[] =
-      [];
-    const receiptGroupPlan = planWorkerToolReceiptGroups(requests, {
-      allowLocalRetryReceipts: this.allowLocalRetryReceipts,
-      getReceiptInput: (request) => ({
-        durableReceiptKey: request.receiptKey,
-        localRetryCacheKey: request.cacheKey,
-        force: request.force,
-      }),
-    });
-    for (const request of receiptGroupPlan.localRequests) {
-      claimedRequests.push({
-        request,
-        receiptKey: null,
-        followers: [],
-      });
-    }
-
-    try {
-      const claimEntries = await this.claimDurableToolReceiptGroups(
-        receiptGroupPlan.durableGroups,
-      );
-      for (const { group: groupState, receiptKey, claim } of claimEntries) {
-        const group = groupState.requests;
-        const [first] = group;
-        if (!first) continue;
-        if (claim.disposition === 'reused') {
-          const result = markWorkerToolReceiptResultCached(
-            deserializeDurableStepValue(claim.receipt.output),
-            first.cacheKey,
-            receiptKey,
-          );
-          for (const request of group) {
-            request.resolve(result);
-          }
-          this.onRequestsSettled?.(group.length);
-          continue;
-        }
-        if (claim.disposition === 'failed') {
-          claimedRequests.push(
-            ...(await this.reclaimFailedDurableToolReceiptGroup({
-              group,
-              receiptKey,
-              failedReceipt: claim.receipt,
-            })),
-          );
-          continue;
-        }
-        if (claim.disposition === 'running') {
-          deferredClaimedRequests.push(
-            this.reclaimRunningDurableToolReceiptGroupAfterWait({
-              group,
-              receiptKey,
-              runningReceipt: claim.receipt,
-            }),
-          );
-          continue;
-        }
-        const [request, ...followers] = group;
-        if (!request) continue;
-        claimedRequests.push({ request, receiptKey, followers });
-      }
-    } catch (error) {
-      // A receipt claim failure means the tenant Postgres is already
-      // unwritable: trip the breaker so remaining groups/rows stop dispatching.
-      tripRuntimePersistenceLatch(this.latch, error);
-      for (const group of receiptGroupPlan.durableGroups) {
-        this.rejectRawRequests(group.requests, error);
-      }
-    }
-    return { claimedRequests, deferredClaimedRequests };
-  }
-
-  private async completeDurableToolRequest(
-    claimed: ClaimedWorkerToolBatchRequest,
-    result: unknown,
-  ): Promise<unknown> {
-    if (!this.receiptStore || !claimed.receiptKey) {
-      return result;
-    }
-    const ownerResult = markWorkerToolReceiptResultExecution(result, {
-      kind: 'live',
-      receiptKey: claimed.receiptKey,
-    });
-    const serializedOutput = serializeDurableStepValue(ownerResult);
-    const completed = await this.completeReceiptWithRetryLadder(
-      () =>
-        this.receiptStore!.completeReceipt({
-          playName: this.req.playName,
-          runId: this.req.runId,
-          key: claimed.receiptKey!,
-          output: serializedOutput,
-        }),
-      // Ladder exhausted: the call billed but the receipt could not land.
-      // Salvage the exact serialized output onto the run record before the
-      // caller turns this into a RuntimeReceiptPersistenceError.
-      (attempts) =>
-        this.recordReceiptSalvage({
-          claimed,
-          output: serializedOutput,
-          attempts,
-        }),
-    );
-    if (
-      completed &&
-      (completed.status === 'completed' || completed.status === 'skipped') &&
-      completed.output !== undefined
-    ) {
-      const recovered = deserializeDurableStepValue(completed.output);
-      return completed.runId && completed.runId !== this.req.runId
-        ? markWorkerToolReceiptResultCached(
-            recovered,
-            claimed.request.cacheKey,
-            claimed.receiptKey,
-          )
-        : recovered;
-    }
-    return ownerResult;
-  }
-
-  private completedDurableToolRequestResult(input: {
-    claimed: ClaimedWorkerToolBatchRequest;
-    ownerResult: unknown;
-    completed: WorkerRuntimeReceipt | null | undefined;
-  }): unknown {
-    const { claimed, completed, ownerResult } = input;
-    if (
-      completed &&
-      (completed.status === 'completed' || completed.status === 'skipped') &&
-      completed.output !== undefined
-    ) {
-      const recovered = deserializeDurableStepValue(completed.output);
-      return completed.runId && completed.runId !== this.req.runId
-        ? markWorkerToolReceiptResultCached(
-            recovered,
-            claimed.request.cacheKey,
-            claimed.receiptKey ?? claimed.request.cacheKey,
-          )
-        : recovered;
-    }
-    return ownerResult;
-  }
-
-  private async completeDurableToolRequests(
-    entries: Array<{ claimed: ClaimedWorkerToolBatchRequest; result: unknown }>,
-  ): Promise<unknown[]> {
-    const results: unknown[] = new Array(entries.length);
-    const durableEntries: Array<{
-      index: number;
-      claimed: ClaimedWorkerToolBatchRequest;
-      ownerResult: unknown;
-    }> = [];
-    for (let index = 0; index < entries.length; index += 1) {
-      const entry = entries[index]!;
-      if (!this.receiptStore || !entry.claimed.receiptKey) {
-        results[index] = entry.result;
-        continue;
-      }
-      const ownerResult = markWorkerToolReceiptResultExecution(entry.result, {
-        kind: 'live',
-        receiptKey: entry.claimed.receiptKey,
-      });
-      durableEntries.push({ index, claimed: entry.claimed, ownerResult });
-    }
-    if (durableEntries.length === 0) {
-      return results;
-    }
-    if (!this.receiptStore?.completeReceipts) {
-      await Promise.all(
-        durableEntries.map(async (entry) => {
-          results[entry.index] = await this.completeDurableToolRequest(
-            entry.claimed,
-            entries[entry.index]!.result,
-          );
-        }),
-      );
-      return results;
-    }
-    const serializedByEntry = durableEntries.map((entry) =>
-      serializeDurableStepValue(entry.ownerResult),
-    );
-    const completed = await this.completeReceiptWithRetryLadder(
-      () =>
-        this.receiptStore!.completeReceipts!({
-          playName: this.req.playName,
-          receipts: durableEntries.map((entry, entryIndex) => ({
-            runId: this.req.runId,
-            key: entry.claimed.receiptKey!,
-            output: serializedByEntry[entryIndex],
-          })),
-        }),
-      // Ladder exhausted: every entry in this batch billed but could not be
-      // marked completed. Salvage each serialized output before the caller
-      // turns this into a RuntimeReceiptPersistenceError.
-      (attempts) => {
-        durableEntries.forEach((entry, entryIndex) => {
-          this.recordReceiptSalvage({
-            claimed: entry.claimed,
-            output: serializedByEntry[entryIndex],
-            attempts,
-          });
-        });
-      },
-    );
-    durableEntries.forEach((entry, resultIndex) => {
-      results[entry.index] = this.completedDurableToolRequestResult({
-        claimed: entry.claimed,
-        ownerResult: entry.ownerResult,
-        completed: completed[resultIndex],
-      });
-    });
-    return results;
-  }
-
-  private async failDurableToolRequest(
-    claimed: ClaimedWorkerToolBatchRequest,
-    error: unknown,
-  ): Promise<void> {
-    if (!this.receiptStore || !claimed.receiptKey) {
-      return;
-    }
-    await this.receiptStore.failReceipt({
-      playName: this.req.playName,
-      runId: this.req.runId,
-      key: claimed.receiptKey,
-      error: error instanceof Error ? error.message : String(error),
-    });
-  }
-
-  private async failDurableToolRequests(
-    claimedRequests: ClaimedWorkerToolBatchRequest[],
-    error: unknown,
-  ): Promise<void> {
-    const durable = claimedRequests.filter(
-      (claimed) => this.receiptStore && claimed.receiptKey,
-    );
-    if (durable.length === 0) return;
-    if (!this.receiptStore?.failReceipts) {
-      await Promise.all(
-        durable.map((claimed) => this.failDurableToolRequest(claimed, error)),
-      );
-      return;
-    }
-    await this.receiptStore.failReceipts({
-      playName: this.req.playName,
-      receipts: durable.map((claimed) => ({
-        runId: this.req.runId,
-        key: claimed.receiptKey!,
-        error: error instanceof Error ? error.message : String(error),
-      })),
-    });
-  }
-
-  private async executeToolGroup(
-    toolId: string,
-    requests: WorkerToolBatchRequest[],
-  ): Promise<void> {
-    // Circuit breaker, gated BEFORE the receipt claim: never-dispatched rows
-    // get NO receipt (not even `running`), so a re-run claims them fresh and
-    // executes them exactly once.
-    if (this.latch.tripped) {
-      this.latch.preventedCallCount += requests.length;
-      this.rejectRawRequests(
-        requests,
-        new RuntimePersistenceCircuitOpenError(this.latch),
-      );
-      return;
-    }
-    const { claimedRequests, deferredClaimedRequests } =
-      await this.prepareDurableToolRequests(requests);
-    await this.executeClaimedToolRequests(
-      toolId,
-      requests.length,
-      claimedRequests,
-    );
-    if (deferredClaimedRequests.length === 0) {
-      return;
-    }
-    const reclaimedRequests = (
-      await Promise.all(deferredClaimedRequests)
-    ).flat();
-    await this.executeClaimedToolRequests(
-      toolId,
-      requests.length,
-      reclaimedRequests,
-    );
-  }
-
-  private async executeClaimedToolRequests(
-    toolId: string,
-    requestCount: number,
-    claimedRequests: ClaimedWorkerToolBatchRequest[],
-  ): Promise<void> {
-    if (claimedRequests.length === 0) {
-      return;
-    }
-    const strategy = getPlayRuntimeBatchStrategy(toolId);
-    if (
-      !strategy ||
-      toolId === 'test_wait_for_event' ||
-      claimedRequests.length < 2
-    ) {
-      const groupStartedAt = nowMs();
-      const dispatchOne = async (
-        claimed: ClaimedWorkerToolBatchRequest,
-      ): Promise<void> => {
-          const { request } = claimed;
-          // Circuit breaker: the latch may have tripped after this group was
-          // claimed but before this particular call started. Do NOT call the
-          // provider. This row has a `running` receipt (claimed, never
-          // executed); on resume it reclaims and re-executes — safe, it never
-          // billed.
-          if (this.latch.tripped) {
-            this.latch.preventedCallCount += 1 + claimed.followers.length;
-            this.rejectRequests(
-              claimed,
-              new RuntimePersistenceCircuitOpenError(this.latch),
-            );
-            return;
-          }
-          const toolContract = await this.resolvePacing(toolId).catch(
-            () => null,
-          );
-          // Each unbatched provider call takes its own tool slot: the Governor
-          // charges tool budget, holds a global tool-concurrency slot, and
-          // applies per-(org,provider) pacing before the call runs.
-          const slot = await this.governor.acquireToolSlot(toolId, {
-            signal: this.abortSignal,
-          });
-          try {
-            let result: unknown;
-            try {
-              result = await executeToolWithLifecycle(
-                this.req,
-                { id: request.id, toolId, input: request.input },
-                request.workflowStep,
-                this.callbacks,
-                (retryAfterMs) => this.reportBackpressure(toolId, retryAfterMs),
-                () => this.governor.chargeBudget('retry'),
-                toolContract?.retrySafeTransientHttp === true,
-                this.abortSignal,
-                this.runtimeDeadlineMs,
-                resolveClaimedWorkerToolRuntimeTimeoutMs([claimed], {
-                  runtimeDeadlineMs: this.runtimeDeadlineMs,
-                }),
-                request.directOptions,
-              );
-            } catch (error) {
-              this.rejectRequests(
-                claimed,
-                await this.failureForRejectedToolRequest(claimed, error),
-              );
-              return;
-            }
-            this.settleRequests(
-              claimed,
-              await this.completeDurableToolRequest(claimed, result),
-            );
-          } catch (receiptError) {
-            tripRuntimePersistenceLatch(this.latch, receiptError);
-            this.rejectRequests(
-              claimed,
-              new RuntimeReceiptPersistenceError(
-                'Tool call succeeded but durable receipt could not be marked completed',
-                [receiptError],
-              ),
-            );
-          } finally {
-            slot.release();
-          }
-      };
-      // Bounded dispatch waves: an unbatched tool group can carry a whole chunk's
-      // rows (enrich compiles to one ~245-row chunk). Dispatching them all at
-      // once billed every call before the first receipt-completion failure could
-      // trip the latch (the 250/250 incident). Instead, dispatch one wave, AWAIT
-      // it so any completion failure trips the latch, then read the latch before
-      // the next wave — remaining waves are prevented (counted + rejected) exactly
-      // like the mid-wave gate above. The wave calls stay fully concurrent; the
-      // only added cost on the healthy path is one latch read per wave.
-      for (const wave of partitionDispatchWaves(
-        claimedRequests,
-        () => 1,
-        PROVIDER_DISPATCH_WAVE_SIZE,
-      )) {
-        if (this.latch.tripped) {
-          for (const claimed of wave) {
-            this.latch.preventedCallCount += 1 + claimed.followers.length;
-            this.rejectRequests(
-              claimed,
-              new RuntimePersistenceCircuitOpenError(this.latch),
-            );
-          }
-          continue;
-        }
-        await Promise.all(wave.map(dispatchOne));
-      }
-      recordRunnerPerfTrace({
-        req: this.req,
-        phase: 'runner.tool.group',
-        ms: nowMs() - groupStartedAt,
-        extra: {
-          toolId,
-          requests: requestCount,
-          executed: claimedRequests.length,
-          batched: false,
-        },
-      });
-      return;
-    }
+  path: string[];
+  outputs: RecordedStepProgramOutput[];
+  onOutput?: (output: RecordedStepProgramOutput) => void | Promise<void>;
+};
 
-    const batchStartedAt = nowMs();
-    await executeBatchedWorkerToolGroup({
-      req: this.req,
-      requests: claimedRequests,
-      strategy,
-      governor: this.governor,
-      suggestedParallelism: await this.governor.suggestedParallelism(
-        toolId,
-        WORKER_TOOL_BATCH_DEFAULT_PARALLELISM,
-      ),
-      abortSignal: this.abortSignal,
-      runtimeDeadlineMs: this.runtimeDeadlineMs,
-      reportBackpressure: (retryAfterMs) =>
-        this.reportBackpressure(toolId, retryAfterMs),
-      resolveToolContract: this.resolvePacing,
-      onRequestsSettled: this.onRequestsSettled,
-      callbacks: this.callbacks,
-      completeRequests: async (entries) =>
-        await this.completeDurableToolRequests(entries),
-      failRequests: async (claimedRequests, error) =>
-        await this.failDurableToolRequests(claimedRequests, error),
-      settleRequest: (claimed, result) => this.settleRequests(claimed, result),
-      rejectRequest: (claimed, error) => this.rejectRequests(claimed, error),
-      latch: this.latch,
-    });
-    recordRunnerPerfTrace({
-      req: this.req,
-      phase: 'runner.tool.group',
-      ms: nowMs() - batchStartedAt,
-      extra: {
-        toolId,
-        requests: requestCount,
-        executed: claimedRequests.length,
-        batched: true,
-      },
-    });
-  }
+type WorkerStepResolution = {
+  value: unknown;
+  status?: 'skipped';
+};
+
+function stepProgramColumnName(parentField: string, stepId: string): string {
+  return sqlSafePlayColumnName(`${parentField}.${stepId}`);
 }
 
-function groupWorkerToolRequestsByTool(
-  requests: WorkerToolBatchRequest[],
-): Map<string, WorkerToolBatchRequest[]> {
-  const byTool = new Map<string, WorkerToolBatchRequest[]>();
-  for (const request of requests) {
-    const existing = byTool.get(request.toolId);
-    if (existing) {
-      existing.push(request);
-    } else {
-      byTool.set(request.toolId, [request]);
-    }
+const MAP_EXECUTION_HEARTBEAT_INTERVAL_MS = 5_000;
+const MAP_INCREMENTAL_PERSIST_CHUNK_ROWS = 100;
+const MAP_INCREMENTAL_PERSIST_CHUNK_BYTES = 1 * 1024 * 1024;
+const MAP_INCREMENTAL_PERSIST_INTERVAL_MS = 1_000;
+const MAP_LIVE_UPDATE_FLUSH_CHUNK_ROWS = 1_000;
+/**
+ * Bounded number of per-row failure samples carried in chunk summaries and the
+ * map's terminal partial-failure log. Every failed row is persisted with its
+ * full error in the runtime sheet; the samples just keep run logs readable.
+ */
+const MAP_ROW_FAILURE_SAMPLE_LIMIT = 3;
+
+/**
+ * Bounded-concurrent map-chunk dispatch fan-out for the workers_edge profile
+ * (in-process play execution with no `workflowStep`). On workers_edge the whole
+ * map shares ONE per-invocation subrequest window, so sequential chunk dispatch
+ * buys no durability — it is pure wall-clock cost. Running up to K chunks in
+ * flight overlaps provider batches, sheet writes, and the per-chunk persist
+ * barrier. K is capped at 3 to bound peak memory: each in-flight chunk holds up
+ * to ~5000 rows plus their row buffers, so 3 concurrent chunks is the ceiling
+ * we accept before row payloads risk pressuring the isolate. The native
+ * Cloudflare Workflows path (workflowStep present) keeps K=1: there each chunk
+ * is a durable step and sequential dispatch is what makes replay/resume sound.
+ */
+const WORKERS_EDGE_MAX_CONCURRENT_MAP_CHUNKS = 3;
+const WORKERS_EDGE_MAP_RESIDENT_ROW_BYTES =
+  WORKER_RUN_DISPATCHER_DEFAULT_MAX_RESIDENT_ROW_BYTES;
+const WORKERS_EDGE_MAP_RESIDENT_ROW_STRUCTURAL_OVERHEAD_BYTES = 128;
+
+const workerMapResidentRowBytes = (row: unknown): number =>
+  new TextEncoder().encode(JSON.stringify(row)).byteLength +
+  WORKERS_EDGE_MAP_RESIDENT_ROW_STRUCTURAL_OVERHEAD_BYTES;
+
+function isRuntimeReceiptPersistenceError(error: unknown): boolean {
+  if (!error || typeof error !== 'object') return false;
+  if (error instanceof RuntimeReceiptPersistenceError) return true;
+  if (
+    error instanceof Error &&
+    error.name === 'RuntimeReceiptPersistenceError'
+  ) {
+    return true;
   }
-  return byTool;
+  const nestedErrors = (error as { errors?: unknown }).errors;
+  return (
+    Array.isArray(nestedErrors) &&
+    nestedErrors.some(isRuntimeReceiptPersistenceError)
+  );
 }
 
-async function executeBatchedWorkerToolGroup(input: {
-  req: RunRequest;
-  requests: ClaimedWorkerToolBatchRequest[];
-  strategy: AnyBatchOperationStrategy;
-  governor: PlayExecutionGovernor;
-  suggestedParallelism: number;
-  abortSignal?: AbortSignal;
-  runtimeDeadlineMs?: number;
-  reportBackpressure: (retryAfterMs: number) => void;
-  resolveToolContract: WorkerPacingResolver;
-  onRequestsSettled?: (count: number) => void;
-  callbacks?: WorkerCtxCallbacks;
-  completeRequests: (
-    entries: Array<{ claimed: ClaimedWorkerToolBatchRequest; result: unknown }>,
-  ) => Promise<unknown[]>;
-  failRequests: (
-    requests: ClaimedWorkerToolBatchRequest[],
-    error: unknown,
-  ) => Promise<void>;
-  settleRequest: (
-    request: ClaimedWorkerToolBatchRequest,
-    result: unknown,
-  ) => void;
-  rejectRequest: (
-    request: ClaimedWorkerToolBatchRequest,
-    error: unknown,
-  ) => void;
-  latch: RuntimePersistenceLatch;
-}): Promise<void> {
-  const compiledBatches = compileRequestsWithStrategy({
-    requests: input.requests,
-    strategy: input.strategy,
-    getPayload: (request) => request.request.input,
-  });
-  recordRunnerPerfTrace({
-    req: input.req,
-    phase: 'runner.tool.batch.compile',
-    ms: 0,
-    extra: {
-      sourceOperation: input.strategy.sourceOperation,
-      batchOperation: input.strategy.batchOperation,
-      requests: input.requests.length,
-      batches: compiledBatches.length,
-      batchSizes: compiledBatches.map((batch) => batch.memberRequests.length),
-    },
-  });
+function isRunFatalWorkerRowError(error: unknown): boolean {
+  return (
+    isCoordinatorProgressAuthorizationError(error) ||
+    isRowIsolationExemptError(error) ||
+    isRuntimeReceiptPersistenceError(error) ||
+    isRuntimePersistenceCircuitOpenError(error) ||
+    error instanceof RuntimeSheetAttemptLeaseLostError ||
+    error instanceof RuntimeLeaseLostError ||
+    (error instanceof Error &&
+      error.name === 'RuntimeSheetAttemptLeaseLostError')
+  );
+}
 
-  await executeChunkedRequests({
-    requests: compiledBatches,
-    // Chunk parallelism is the Governor's per-tool suggestion (provider rate
-    // hints tightened to the policy ceiling), bounded by the batch count.
-    batchSize: Math.max(
-      1,
-      Math.min(input.suggestedParallelism, compiledBatches.length || 1),
-    ),
-    // Bounded dispatch wave: cap the provider calls (counted by batch member
-    // size) a single chunk dispatches before the latch is read again, so a
-    // persistence failure prevents the rest of a large batch group instead of
-    // billing it all. A single over-budget batch still forms its own wave.
-    maxChunkWeight: PROVIDER_DISPATCH_WAVE_SIZE,
-    weightOf: (batch) => batch.memberRequests.length,
-    execute: async (batch) => {
-      // Circuit breaker: once a persistence failure has occurred in this map,
-      // do NOT dispatch this batch's provider call. The chunk plumbing rejects
-      // its member requests with the latch error.
-      if (input.latch.tripped) {
-        input.latch.preventedCallCount += batch.memberRequests.length;
-        throw new RuntimePersistenceCircuitOpenError(input.latch);
-      }
-      const toolContract = await input
-        .resolveToolContract(batch.batchOperation)
-        .catch(() => null);
-      // One provider call per batch → one tool slot (budget + global
-      // concurrency + per-(org,provider) pacing) around the whole batch.
-      const slot = await input.governor.acquireToolSlot(batch.batchOperation, {
-        signal: input.abortSignal,
-      });
-      try {
-        input.callbacks?.onToolCalled?.(batch.batchOperation, nowMs());
-        return await executeTool(
-          input.req,
-          {
-            id: `batch:${batch.memberRequests.map((request) => request.request.id).join('|')}`,
-            toolId: batch.batchOperation,
-            input: batch.batchPayload,
-          },
-          undefined,
-          input.reportBackpressure,
-          () => input.governor.chargeBudget('retry'),
-          toolContract?.retrySafeTransientHttp === true,
-          input.abortSignal,
-          input.runtimeDeadlineMs,
-          resolveClaimedWorkerToolRuntimeTimeoutMs(batch.memberRequests, {
-            runtimeDeadlineMs: input.runtimeDeadlineMs,
-          }),
-        );
-      } catch (error) {
-        input.callbacks?.onToolFailed?.(batch.batchOperation, nowMs());
-        throw error;
-      } finally {
-        slot.release();
-      }
-    },
-    onChunkComplete: async (
-      chunkResults: Array<
-        ChunkExecutionResult<(typeof compiledBatches)[number], unknown>
-      >,
-    ) => {
-      for (const entry of chunkResults) {
-        if (entry.error !== undefined) {
-          // One batch's provider error stays scoped to that batch's member
-          // requests. Sibling batches in this chunk keep their results so a
-          // single provider hiccup cannot cascade into a whole-map failure.
-          let rejection: unknown = entry.error;
-          try {
-            await input.failRequests(entry.request.memberRequests, entry.error);
-          } catch (receiptError) {
-            tripRuntimePersistenceLatch(input.latch, receiptError);
-            rejection = new RuntimeReceiptPersistenceError(
-              'Tool call failed and durable receipts could not be marked failed',
-              [entry.error, receiptError],
-            );
-          }
-          for (const claimed of entry.request.memberRequests) {
-            input.rejectRequest(claimed, rejection);
-          }
-          continue;
-        }
-        const batchResult = isToolExecuteResult(entry.result)
-          ? entry.result.toolOutput.raw
-          : entry.result;
-        const splitResults =
-          batchResult != null
-            ? entry.request.splitResults(batchResult)
-            : entry.request.memberRequests.map(() => null);
-        let completedResults: unknown[];
-        try {
-          completedResults = await input.completeRequests(
-            entry.request.memberRequests.map((claimed, index) => ({
-              claimed,
-              result: wrapWorkerToolResult(
-                claimed.request.toolId,
-                splitResults[index] ?? null,
-                toolMetadataFallback(claimed.request.toolId),
-                splitResults[index] == null ? 'no_result' : 'completed',
-                {
-                  req: input.req,
-                  input: claimed.request.input,
-                },
-              ),
-            })),
-          );
-        } catch (receiptError) {
-          tripRuntimePersistenceLatch(input.latch, receiptError);
-          const rejection = new RuntimeReceiptPersistenceError(
-            'Tool call succeeded but durable receipts could not be marked completed',
-            [receiptError],
-          );
-          for (const claimed of entry.request.memberRequests) {
-            input.rejectRequest(claimed, rejection);
-          }
-          continue;
-        }
-        for (let index = 0; index < completedResults.length; index += 1) {
-          const claimed = entry.request.memberRequests[index]!;
-          const request = claimed.request;
-          input.settleRequest(claimed, completedResults[index]);
-        }
-      }
-    },
-  }).catch(async (error) => {
-    let rejection: unknown = error;
-    try {
-      await input.failRequests(input.requests, error);
-    } catch (receiptError) {
-      tripRuntimePersistenceLatch(input.latch, receiptError);
-      rejection = new RuntimeReceiptPersistenceError(
-        'Tool call failed and durable receipts could not be marked failed',
-        [error, receiptError],
-      );
-    }
-    for (const claimed of input.requests) {
-      input.rejectRequest(claimed, rejection);
-    }
-  });
+/**
+ * In-process retry budget for HTTP 429 tool responses. Rate-limit pushback is
+ * throughput pacing (provider or Deepline limiter), not a tool defect, so it
+ * gets more patience than the generic 3-attempt budget: with retry-after-aware
+ * escalating delays (capped at 5s) this absorbs roughly 25s of sustained
+ * throttling before the call fails. Every retry still charges the Governor's
+ * retry budget, so a runaway storm stays bounded and loud.
+ */
+
+function sleepWorkerMs(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
 function isCompletedWorkerFieldValue(value: unknown): boolean {
@@ -3339,7 +2377,8 @@ function isCompletedWorkerFieldValue(value: unknown): boolean {
   );
 }
 
-type WorkerMapChunkSummary<T extends Record<string, unknown>> = {
+type WorkerMapCompletedChunkSummary<T extends Record<string, unknown>> = {
+  status: 'completed';
   chunkIndex: number;
   rangeStart: number;
   rangeEnd: number;
@@ -3363,6 +2402,23 @@ type WorkerMapChunkSummary<T extends Record<string, unknown>> = {
   cachedRows?: T[];
 };
 
+type WorkerMapBlockedChunkSummary = {
+  status: 'blocked';
+  chunkIndex: number;
+  rangeStart: number;
+  rangeEnd: number;
+  rowsRead: number;
+  rowsBlocked: number;
+  rowKeySamples: string[];
+  blockedRowSamples: Record<string, unknown>[];
+  outputDatasetId: string;
+  message: string;
+};
+
+type WorkerMapChunkSummary<T extends Record<string, unknown>> =
+  | WorkerMapCompletedChunkSummary<T>
+  | WorkerMapBlockedChunkSummary;
+
 function serializeDurableStepValue<T>(value: T, depth = 0): T {
   if (depth > 20 || value == null) return value;
   if (isToolExecuteResult(value)) return serializeToolExecuteResult(value) as T;
@@ -3575,6 +2631,7 @@ async function executeWorkerStepProgram(
         ...(resolution.status ? { status: resolution.status } : {}),
       };
     };
+
     const executeStep = async (): Promise<WorkerStepResolution> =>
       workflowStep
         ? await (
@@ -3799,7 +2856,7 @@ async function postRuntimeEgressFetch(
   ) {
     const response = await fetchRuntimeApi(
       req.baseUrl,
-      '/api/v2/plays/internal/egress-fetch',
+      '/api/v2/internal/play-runtime/egress-fetch',
       {
         method: 'POST',
         headers: {
@@ -4375,6 +3432,81 @@ function resolveSheetContractFromReq(
   }
 }
 
+/**
+ * Run-fatal teardown: release the runtime-sheet attempt leases and work-receipt
+ * leases this run still holds, so an immediate rerun proceeds without waiting
+ * out the 10-minute lease TTL. Every release is attempt/owner fenced downstream,
+ * so it can never weaken a different run's live lease. Failures are logged loud
+ * and swallowed here — the caller still throws the original run-fatal error.
+ */
+async function releaseRuntimeLeasesOnTeardown(input: {
+  req: RunRequest;
+  leasedSheetNamespaces: Set<string>;
+  emit: (event: RunnerEvent) => void;
+}): Promise<void> {
+  const { req, leasedSheetNamespaces, emit } = input;
+  const scope = runtimeSheetSessionScope(req);
+  for (const tableNamespace of leasedSheetNamespaces) {
+    const sheetContract = resolveSheetContractFromReq(req, tableNamespace);
+    if (!sheetContract) continue;
+    try {
+      const released = await harnessReleaseSheetAttempt({
+        ...scope,
+        tableNamespace,
+        sheetContract,
+        runId: req.runId,
+        attemptOwnerRunId: req.runId,
+        attemptSeq: req.runAttempt ?? 0,
+      });
+      if (released.released > 0) {
+        emit({
+          type: 'log',
+          level: 'info',
+          message: `Released ${released.released} runtime sheet row lease(s) for ctx.dataset("${tableNamespace}") on run-fatal teardown.`,
+          ts: nowMs(),
+        });
+      }
+    } catch (releaseError) {
+      emit({
+        type: 'log',
+        level: 'warn',
+        message: `Runtime sheet attempt release failed for ctx.dataset("${tableNamespace}") on run-fatal teardown (rerun will fall back to lease-TTL expiry): ${
+          releaseError instanceof Error
+            ? releaseError.message
+            : String(releaseError)
+        }`,
+        ts: nowMs(),
+      });
+    }
+  }
+  try {
+    const released = await harnessReleaseRuntimeReceipts({
+      ...scope,
+      runId: req.runId,
+      runAttempt: req.runAttempt ?? 0,
+    });
+    if (released.released > 0) {
+      emit({
+        type: 'log',
+        level: 'info',
+        message: `Released ${released.released} work-receipt lease(s) on run-fatal teardown.`,
+        ts: nowMs(),
+      });
+    }
+  } catch (releaseError) {
+    emit({
+      type: 'log',
+      level: 'warn',
+      message: `Work-receipt release failed on run-fatal teardown (rerun will fall back to lease-TTL expiry): ${
+        releaseError instanceof Error
+          ? releaseError.message
+          : String(releaseError)
+      }`,
+      ts: nowMs(),
+    });
+  }
+}
+
 function staticPipelineFromReq(req: RunRequest): PlayStaticPipeline | null {
   const snapshot = req.contractSnapshot as
     | { staticPipeline?: unknown }
@@ -4417,6 +3549,13 @@ async function persistCompletedMapRows(input: {
   rows: Record<string, unknown>[];
   outputFields: string[];
   extraOutputFields?: string[];
+  attemptId?: string | null;
+  attemptOwnerRunId?: string | null;
+  attemptExpiresAt?: string | null;
+  attemptSeq?: number | null;
+  budgetMeter?: WorkerWorkBudgetMeter;
+  force?: boolean;
+  forceFailedRows?: boolean;
 }): Promise<{
   rows: number;
   written: number;
@@ -4462,23 +3601,28 @@ async function persistCompletedMapRows(input: {
     sheetContract,
     rows,
     outputFields,
+    attemptId: input.attemptId ?? null,
+    attemptOwnerRunId: input.attemptOwnerRunId ?? null,
+    attemptExpiresAt: input.attemptExpiresAt ?? null,
+    attemptSeq: input.attemptSeq ?? req.runAttempt ?? 0,
+    forceFailedRows: input.forceFailedRows === true,
   };
+  input.budgetMeter?.count('sheet');
   const expectedKeys = [
     ...new Set(
       input.rows
-        .map((row) => resolveMapRowOutcomeKey(row))
-        .filter((key): key is string => Boolean(key)),
+        .map((row) => resolveMapRowOutcomeKey(row) ?? row.key)
+        .filter(Boolean),
     ),
-  ];
-  const expectedVisibleRows =
-    expectedKeys.length > 0 ? expectedKeys.length : rows.length;
+  ] as string[];
+  const expectedVisibleRows = expectedKeys.length || rows.length;
   const readVisibleRowCount = async () => {
     if (expectedKeys.length > 0) {
       const result = await harnessReadSheetDatasetRowKeys({
         ...sessionScope,
         tableNamespace,
         runId: req.runId,
-        rowMode: 'all',
+        rowMode: 'terminalAnyRun',
         keys: expectedKeys,
       });
       return result.keys.length;
@@ -4494,6 +3638,24 @@ async function persistCompletedMapRows(input: {
     return result.rows.length;
   };
   const result = await harnessPersistCompletedSheetRows(persistRequest);
+  const hasAttemptFence = Boolean(input.attemptId?.trim());
+  const assertAttemptStillOwnsTerminalWrites = (
+    written: number,
+    visible: number | null,
+  ) => {
+    // Recovery finalization may include rows completed by an earlier attempt.
+    // A complete terminal readback proves they were not lost.
+    if (
+      !hasAttemptFence ||
+      written === rows.length ||
+      (visible !== null && visible >= expectedVisibleRows)
+    ) {
+      return;
+    }
+    throw new Error(
+      `Runtime sheet attempt lost ownership for ${tableNamespace}: wrote ${written}/${rows.length}; run ${req.runId}; attempt ${input.attemptId}.`,
+    );
+  };
   console.warn('[play-runner.persist_completed_map_rows.result]', {
     runId: req.runId,
     playName: req.playName,
@@ -4518,11 +3680,19 @@ async function persistCompletedMapRows(input: {
         sheetContract,
         rows: input.rows.map((row) => runtimeCsvStorageRow(row)),
         runId: req.runId,
+        attemptId: input.attemptId ?? null,
+        attemptOwnerRunId: input.attemptOwnerRunId ?? null,
+        attemptExpiresAt: input.attemptExpiresAt ?? null,
+        attemptSeq: input.attemptSeq ?? req.runAttempt ?? 0,
+        attemptLeaseTtlMs: runtimeSheetAttemptLeaseTtlMs(req),
         inputOffset: 0,
       });
+      input.budgetMeter?.count('sheet');
       const retry = await harnessPersistCompletedSheetRows(persistRequest);
+      input.budgetMeter?.count('sheet');
       retryWritten = retry.rowsWritten;
       retryVisible = await readVisibleRowCount();
+      assertAttemptStillOwnsTerminalWrites(retryWritten, retryVisible);
       if (retryVisible >= expectedVisibleRows) {
         return {
           rows: rows.length,
@@ -4536,6 +3706,7 @@ async function persistCompletedMapRows(input: {
         `Runtime sheet persistence mismatch for ${tableNamespace}: wrote ${result.rowsWritten}/${rows.length}; visible ${visibleRows}/${expectedVisibleRows}; retry wrote ${retryWritten}/${rows.length}; retry visible ${retryVisible}/${expectedVisibleRows}; run ${req.runId}.`,
       );
     }
+    assertAttemptStillOwnsTerminalWrites(result.rowsWritten, visibleRows);
   }
   if (result.rowsWritten !== rows.length && visibleRows < expectedVisibleRows) {
     throw new Error(
@@ -4557,8 +3728,14 @@ async function applyLiveMapRowUpdates(input: {
   updates: Array<Omit<PlayRowUpdate, 'rowId'> & { runId?: string }>;
   outputFields: string[];
   extraOutputFields?: string[];
+  attemptId?: string | null;
+  attemptOwnerRunId?: string | null;
+  attemptExpiresAt?: string | null;
+  attemptSeq?: number | null;
+  budgetMeter?: WorkerWorkBudgetMeter;
 }): Promise<void> {
   if (input.updates.length === 0) return;
+  input.budgetMeter?.count('sheet');
   const outputFields = [
     ...input.outputFields,
     ...(input.extraOutputFields ?? []).filter(
@@ -4581,7 +3758,16 @@ async function applyLiveMapRowUpdates(input: {
       contractSnapshot: input.req.contractSnapshot,
       runId: input.req.runId,
       userEmail: input.req.userEmail,
-      updates: input.updates,
+      updates: input.updates.map((update) => ({
+        ...update,
+        attemptId: update.attemptId ?? input.attemptId ?? null,
+        attemptOwnerRunId:
+          update.attemptOwnerRunId ?? input.attemptOwnerRunId ?? null,
+        attemptExpiresAt:
+          update.attemptExpiresAt ?? input.attemptExpiresAt ?? null,
+        attemptSeq:
+          update.attemptSeq ?? input.attemptSeq ?? input.req.runAttempt ?? 0,
+      })),
     },
   );
 }
@@ -4592,18 +3778,39 @@ async function prepareMapRows(input: {
   rows: Record<string, unknown>[];
   inputOffset: number;
   outputFields: string[];
+  attemptId?: string | null;
+  attemptOwnerRunId?: string | null;
+  attemptExpiresAt?: string | null;
+  attemptSeq?: number | null;
+  budgetMeter?: WorkerWorkBudgetMeter;
   force?: boolean;
 }): Promise<{
   inserted: number;
   skipped: number;
   pendingRows: Record<string, unknown>[];
   completedRows: Record<string, unknown>[];
+  blockedRows: Record<string, unknown>[];
+  attemptId?: string | null;
+  attemptOwnerRunId?: string | null;
+  attemptExpiresAt?: string | null;
+  attemptSeq?: number | null;
 }> {
   if (input.rows.length === 0) {
-    return { inserted: 0, skipped: 0, pendingRows: [], completedRows: [] };
+    return {
+      inserted: 0,
+      skipped: 0,
+      pendingRows: [],
+      completedRows: [],
+      blockedRows: [],
+      attemptId: input.attemptId ?? null,
+      attemptOwnerRunId: input.attemptOwnerRunId ?? null,
+      attemptExpiresAt: input.attemptExpiresAt ?? null,
+      attemptSeq: input.attemptSeq ?? input.req.runAttempt ?? 0,
+    };
   }
   const sessionScope = runtimeSheetSessionScope(input.req);
   const rows = input.rows.map((row) => runtimeCsvStorageRow(row));
+  input.budgetMeter?.count('sheet');
   const result = await harnessStartSheetDataset({
     ...sessionScope,
     tableNamespace: input.tableNamespace,
@@ -4614,6 +3821,11 @@ async function prepareMapRows(input: {
     }),
     rows,
     inputOffset: input.inputOffset,
+    attemptId: input.attemptId ?? null,
+    attemptOwnerRunId: input.attemptOwnerRunId ?? null,
+    attemptExpiresAt: input.attemptExpiresAt ?? null,
+    attemptSeq: input.attemptSeq ?? input.req.runAttempt ?? 0,
+    attemptLeaseTtlMs: runtimeSheetAttemptLeaseTtlMs(input.req),
     ...(input.force ? { force: true } : {}),
   });
   for (const timing of result.timings ?? []) {
@@ -4643,6 +3855,13 @@ async function prepareMapRows(input: {
     skipped: result.skipped,
     pendingRows: result.pendingRows,
     completedRows: result.completedRows,
+    blockedRows: result.blockedRows ?? [],
+    attemptId: result.attemptId ?? input.attemptId ?? null,
+    attemptOwnerRunId:
+      result.attemptOwnerRunId ?? input.attemptOwnerRunId ?? null,
+    attemptExpiresAt: result.attemptExpiresAt ?? input.attemptExpiresAt ?? null,
+    attemptSeq:
+      result.attemptSeq ?? input.attemptSeq ?? input.req.runAttempt ?? 0,
   };
 }
 
@@ -4788,14 +4007,6 @@ function createCoordinatorRatePort(req: RunRequest): CoordinatorRatePort {
  * memoized per isolate. No hints → null (pacing is a no-op; the Governor's
  * global tool-concurrency slot still applies).
  */
-type WorkerPacingResolver = (
-  toolId: string,
-) => Promise<
-  (ResolvedPacingPolicy & { retrySafeTransientHttp: boolean }) | null
->;
-
-type WorkerToolActionCacheVersionResolver = (toolId: string) => Promise<string>;
-
 function createWorkerToolActionCacheVersionResolver(
   req: RunRequest,
 ): WorkerToolActionCacheVersionResolver {
@@ -4803,9 +4014,7 @@ function createWorkerToolActionCacheVersionResolver(
   return (toolId: string) => {
     const normalized = String(toolId || '').trim();
     if (!normalized) {
-      return Promise.reject(
-        new Error('Runtime tool metadata lookup requires a non-empty tool id.'),
-      );
+      return Promise.reject(new Error('Tool metadata needs tool id.'));
     }
     const cached = cache.get(normalized);
     if (cached) return cached;
@@ -4842,6 +4051,44 @@ function createWorkerToolActionCacheVersionResolver(
   };
 }
 
+function createWorkerToolAuthScopeDigestResolver(req: RunRequest) {
+  // Return type is inferred from createRuntimeToolAuthScopeDigestResolver
+  // (RuntimeToolAuthScopeDigestResolver), whose `invalidate` member is
+  // REQUIRED — the AUTH_SCOPE_CHANGED re-claim wiring below calls it directly,
+  // and a resolver without eviction support must be a type error.
+  return createRuntimeToolAuthScopeDigestResolver({
+    missingToolIdMessage: 'Tool auth scope needs tool id.',
+    fetchDigest: async (normalized) => {
+      const runScopedPath =
+        `/api/v2/plays/runtime-tools/${encodeURIComponent(normalized)}/auth-scope` +
+        `?runId=${encodeURIComponent(req.runId)}`;
+      const res = await fetchRuntimeApi(req.baseUrl, runScopedPath, {
+        method: 'GET',
+        headers: {
+          authorization: `Bearer ${req.executorToken}`,
+          'cache-control': 'no-store',
+          pragma: 'no-cache',
+        },
+      });
+      if (!res.ok) {
+        throw new Error(
+          `Runtime tool auth scope lookup for ${normalized} failed (${res.status}): ${await res.text()}`,
+        );
+      }
+      const body = (await res.json().catch(() => null)) as {
+        digest?: unknown;
+      } | null;
+      const digest = typeof body?.digest === 'string' ? body.digest.trim() : '';
+      if (!digest) {
+        throw new Error(
+          `Runtime tool auth scope lookup for ${normalized} returned no digest.`,
+        );
+      }
+      return digest;
+    },
+  });
+}
+
 function createWorkerPacingResolver(req: RunRequest): WorkerPacingResolver {
   const cache = new Map<
     string,
@@ -4983,13 +4230,22 @@ function createMinimalWorkerCtx(
   workflowStep?: WorkflowStep,
   abortSignal?: AbortSignal,
   callbacks?: WorkerCtxCallbacks,
+  workBudgetMeter: WorkerWorkBudgetMeter = createWorkerWorkBudgetMeter({
+    nowMs,
+  }),
   runtimeDeadlineMs?: number,
+  // Namespaces this run took a runtime-sheet attempt lease on. The run-fatal
+  // teardown reads this set to release exactly those leases (never a namespace
+  // whose table the run never created), so a rerun proceeds immediately.
+  leasedSheetNamespaces?: Set<string>,
   receiptSalvage?: ReceiptSalvageBuffer,
 ): unknown {
   const { governor, resolvePacing: resolveToolPacing } =
     createGovernorForRun(req);
   const resolveToolActionCacheVersion =
     createWorkerToolActionCacheVersionResolver(req);
+  const resolveToolAuthScopeDigest =
+    createWorkerToolAuthScopeDigestResolver(req);
   // Play-call depth/count/per-parent budgets, child-play concurrency, and the
   // lineage snapshot are owned by the Governor (createGovernorForRun above).
   // The worker keeps only substrate mechanism here.
@@ -5000,7 +4256,7 @@ function createMinimalWorkerCtx(
     if (!auth) return {};
     const response = await fetchRuntimeApi(
       req.baseUrl,
-      '/api/v2/plays/internal/runtime',
+      '/api/v2/internal/play-runtime',
       {
         method: 'POST',
         headers: {
@@ -5039,10 +4295,48 @@ function createMinimalWorkerCtx(
     orgId: req.orgId,
     preloadedDbSessions: req.preloadedDbSessions ?? null,
     userEmail: req.userEmail,
+    runtimeTestFaultHeader: req.runtimeTestFaultHeader ?? null,
+    runAttempt: req.runAttempt ?? 0,
+    receiptLeaseTtlMs: runtimeReceiptLeaseTtlMs(req),
   });
+  const executeDispatchedTool = async (input: {
+    id: string;
+    toolId: string;
+    input: Record<string, unknown>;
+    workflowStep?: unknown;
+    callbacks?: WorkerCtxCallbacks;
+    onProviderBackpressure?: (retryAfterMs: number) => void;
+    onRetryAttempt?: () => void;
+    transientHttpRetrySafe?: boolean;
+    durableCallReceiptKey?: string | null;
+    executionAuthScopeDigest?: string | null;
+    providerIdempotencyKey?: string | null;
+    runtimeTimeoutMs?: number;
+    directOptions?: WorkerToolDirectOptions;
+  }): Promise<ToolExecuteResult> =>
+    await executeToolWithLifecycle(
+      req,
+      {
+        id: input.id,
+        toolId: input.toolId,
+        input: input.input,
+        durableCallReceiptKey: input.durableCallReceiptKey,
+        executionAuthScopeDigest: input.executionAuthScopeDigest,
+        providerIdempotencyKey: input.providerIdempotencyKey,
+      },
+      input.workflowStep as WorkflowStep | undefined,
+      input.callbacks,
+      input.onProviderBackpressure,
+      input.onRetryAttempt,
+      input.transientHttpRetrySafe === true,
+      abortSignal,
+      runtimeDeadlineMs,
+      input.runtimeTimeoutMs,
+      input.directOptions,
+    );
   const executeWithRuntimeReceipt = async <T>(
     key: string,
-    execute: () => Promise<T> | T,
+    execute: (context: WorkerRuntimeReceiptExecutionContext) => Promise<T> | T,
     options: {
       repairRunningReceiptForSameRun?: boolean;
       reclaimRunning?: boolean;
@@ -5056,7 +4350,8 @@ function createMinimalWorkerCtx(
       runId: req.runId,
       key,
       receiptStore,
-      execute: async () => serializeDurableStepValue(await execute()),
+      execute: async (context) =>
+        serializeDurableStepValue(await execute(context)),
       repairRunningReceiptForSameRun:
         options.repairRunningReceiptForSameRun ?? false,
       reclaimRunning: options.reclaimRunning ?? false,
@@ -5098,24 +4393,54 @@ function createMinimalWorkerCtx(
       staleAfterSeconds,
     });
   };
-  // Ctx-wide breaker for top-level ctx.tool calls (outside any map). Each map
-  // creates its own map-scoped latch (see runMap) so per-map dispatch stats and
-  // the runMap failure message stay map-local.
+  const emitAuthScopeReclaimRunLog = (input: {
+    toolId: string;
+    requestIds: string[];
+  }) => {
+    // Durable run-log marker for the bounded AUTH_SCOPE_CHANGED re-claim
+    // (mirrors the shared-runtime marker in shared_libs/play-runtime/context.ts
+    // so run logs expose the credential transition on every execution path).
+    emitEvent({
+      type: 'log',
+      level: 'info',
+      message:
+        `ctx.tools.execute(${input.toolId}): auth_scope_changed_reclaim ` +
+        `(requests: ${input.requestIds.join(', ')}); credential identity ` +
+        `changed mid-run, re-resolved the auth scope and re-claimed fresh ` +
+        `receipts under the new scope.`,
+      ts: nowMs(),
+    });
+  };
   const rootPersistenceLatch = createRuntimePersistenceLatch();
-  const rootToolBatchScheduler = new WorkerToolBatchScheduler(
+  const rootToolBatchScheduler = new WorkerToolBatchScheduler({
     req,
     governor,
-    resolveToolPacing,
+    resolvePacing: resolveToolPacing,
     resolveToolActionCacheVersion,
+    resolveToolAuthScopeDigest,
+    invalidateToolAuthScopeDigest: (toolId) =>
+      resolveToolAuthScopeDigest.invalidate(toolId),
+    onAuthScopeReclaim: emitAuthScopeReclaimRunLog,
+    executeTool: executeDispatchedTool,
+    serializeDurableValue: serializeDurableStepValue,
+    deserializeDurableValue: deserializeDurableStepValue,
+    nowMs,
+    batchGraceMs: req.testPolicyOverrides?.batchGraceMs,
+    recordPerfTrace: (trace) => recordRunnerPerfTrace({ req, ...trace }),
     abortSignal,
-    undefined,
     callbacks,
     receiptStore,
-    true,
+    allowLocalRetryReceipts: true,
+    runtimeReceiptLeaseTtlMs: runtimeReceiptLeaseTtlMs(req),
+    runtimeReceiptHeartbeatIntervalMs: runtimePolicyHeartbeatIntervalMs(
+      req,
+      runtimeReceiptLeaseTtlMs(req) ?? PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
+    ),
+    budgetMeter: workBudgetMeter,
     runtimeDeadlineMs,
-    rootPersistenceLatch,
+    persistenceLatch: rootPersistenceLatch,
     receiptSalvage,
-  );
+  });
   // Local ancestry chain that always ENDS with the currently-executing play
   // (req.playName). The /api/v2/plays/run lineage validator requires the
   // submitted ancestry's tail to equal the executor token's play name (i.e.
@@ -5150,23 +4475,33 @@ function createMinimalWorkerCtx(
   ): Promise<unknown> => {
     const mapStartedAt = nowMs();
     const mapNodeId = `map:${name}`;
-    // Map-wide persistence-failure circuit breaker. Shared across every chunk's
-    // scheduler (the scheduler is rebuilt per chunk) and the map's sheet-persist
-    // flush chain, so the first persistence failure halts NEW provider dispatch
-    // for the rest of the map and its prevented-call count surfaces in the
-    // runMap failure message below.
-    const persistenceLatch = createRuntimePersistenceLatch();
     const inputRows = rows;
     const rowCountHint = datasetRowCountHint(inputRows);
     const baseOffset = 0;
     const fieldEntries = Object.entries(fieldsDef);
     const plan = req.executionPlan;
-    const rowsPerChunk = chooseWorkerMapRowsPerChunk({
+    const mapDispatchPlan = chooseWorkerMapDispatchPlan({
       mapName: name,
       rowCountHint,
       executionPlan: plan,
       staticPipeline: staticPipelineFromReq(req),
     });
+    const rowsPerChunk = mapDispatchPlan.rowsPerChunk;
+    recordRunnerPerfTrace({
+      req,
+      phase: 'runner.map_dispatch_plan',
+      ms: 0,
+      extra: {
+        mapName: name,
+        rowsPerChunk,
+        rowCountHint,
+        estimatedExternalStepsPerRow:
+          mapDispatchPlan.estimatedExternalStepsPerRow,
+        workEstimate: mapDispatchPlan.workEstimate,
+        reason: mapDispatchPlan.reason,
+        dynamicWorkerArtifactVersion: DYNAMIC_PLAY_WORKER_ARTIFACT_VERSION,
+      },
+    });
     const outputFields = fieldEntries.map(([field]) => field);
     const updateMapProgress = (
       progress: LiveNodeProgressSnapshot,
@@ -5182,6 +4517,22 @@ function createMinimalWorkerCtx(
         forceFlush: options?.forceFlush ?? true,
       });
     };
+    let queuedMapProgress: Promise<void> = Promise.resolve();
+    let queuedMapProgressError: unknown = null;
+    const enqueueMapProgressUpdate = (
+      progress: LiveNodeProgressSnapshot,
+      options?: { forceFlush?: boolean },
+    ) => {
+      queuedMapProgress = queuedMapProgress
+        .then(() => Promise.resolve(updateMapProgress(progress, options)))
+        .catch((error) => {
+          queuedMapProgressError ??= error;
+        });
+    };
+    const flushQueuedMapProgressUpdates = async () => {
+      await queuedMapProgress;
+      if (queuedMapProgressError) throw queuedMapProgressError;
+    };
     const formatMapProgressMessage = (completed: number, total?: number) =>
       typeof total === 'number' && Number.isFinite(total) && total > 0
         ? `${completed.toLocaleString()} / ${total.toLocaleString()} rows processed`
@@ -5206,7 +4557,9 @@ function createMinimalWorkerCtx(
       return formatMapProgressMessage(completed, input.total);
     };
     const formatMapProcessingMessage = (rowsToExecute: number) =>
-      rowsToExecute > 0 ? `${rowsToExecute.toLocaleString()} rows` : null;
+      rowsToExecute > 0
+        ? `Processing ${rowsToExecute.toLocaleString()} rows`
+        : null;
     const formatMapExecutionHeartbeatMessage = (input: {
       rowsToExecute: number;
       startedRows: number;
@@ -5220,7 +4573,7 @@ function createMinimalWorkerCtx(
       const waitingRows = Math.max(0, rowsToExecute - startedRows);
       const parts = [
         activeRows > 0 ? `${activeRows.toLocaleString()} active` : null,
-        waitingRows > 0 ? `${waitingRows.toLocaleString()} queued` : null,
+        waitingRows > 0 ? `${waitingRows.toLocaleString()} waiting` : null,
         completedRows > 0 ? `${completedRows.toLocaleString()} done` : null,
       ].filter((part): part is string => Boolean(part));
       const base =
@@ -5384,6 +4737,12 @@ function createMinimalWorkerCtx(
     ): Promise<WorkerMapChunkSummary<T & Record<string, unknown>>> => {
       const chunkStartedAt = nowMs();
       assertNotAborted(abortSignal);
+      const rowAttempt = makeRuntimeSheetAttempt({
+        runId: req.runId,
+        runAttempt: req.runAttempt,
+        mapName: name,
+        chunkIndex,
+      });
       const keyStartedAt = nowMs();
       const chunkEntries = chunkRows.map((row, localIndex) => {
         const absoluteIndex = baseOffset + chunkStart + localIndex;
@@ -5411,8 +4770,21 @@ function createMinimalWorkerCtx(
           ...mapRowOutcomeRuntimeFields({ key: rowKey }),
         })),
         inputOffset: baseOffset + chunkStart,
+        ...rowAttempt,
+        budgetMeter: workBudgetMeter,
         force: !!req.force,
       });
+      const activeRowAttempt = {
+        attemptId: prepared.attemptId ?? rowAttempt.attemptId,
+        attemptOwnerRunId:
+          prepared.attemptOwnerRunId ?? rowAttempt.attemptOwnerRunId,
+        attemptExpiresAt:
+          prepared.attemptExpiresAt ?? rowAttempt.attemptExpiresAt,
+        attemptSeq: prepared.attemptSeq ?? rowAttempt.attemptSeq,
+      };
+      // Record that this run holds attempt leases in `name`'s sheet so a
+      // run-fatal teardown releases them (the table now exists).
+      leasedSheetNamespaces?.add(name);
       recordRunnerPerfTrace({
         req,
         phase: 'runner.map_chunk.prepare_rows',
@@ -5425,14 +4797,15 @@ function createMinimalWorkerCtx(
           skipped: prepared.skipped,
           pendingRows: prepared.pendingRows.length,
           completedRows: prepared.completedRows.length,
+          blockedRows: prepared.blockedRows.length,
         },
       });
       const progressTotalRows = rowCountHint ?? chunkRows.length;
       const preparedCompletedRows = Math.min(
         progressTotalRows,
-        totalRowsWritten + prepared.completedRows.length,
+        totalRowsWritten,
       );
-      await updateMapProgress({
+      enqueueMapProgressUpdate({
         completed: preparedCompletedRows,
         total: progressTotalRows,
         startedAt: mapStartedAt,
@@ -5445,6 +4818,9 @@ function createMinimalWorkerCtx(
       const pendingKeys = new Set<string>();
       const pendingRowsByKey = new Map<string, Record<string, unknown>>();
       const completedKeys = new Set<string>();
+      const completedRowsByKey = new Map<string, Record<string, unknown>>();
+      const blockedKeys = new Set<string>();
+      const blockedRowsByKey = new Map<string, Record<string, unknown>>();
       const preparedKeys = new Set<string>();
       for (const row of prepared.pendingRows) {
         const key =
@@ -5462,14 +4838,95 @@ function createMinimalWorkerCtx(
           deriveDefaultMapRowIdentity(row, resolveRuntimeInputIndex(row) ?? 0);
         if (key) {
           completedKeys.add(key);
+          completedRowsByKey.set(key, row);
+          preparedKeys.add(key);
+        }
+      }
+      for (const row of prepared.blockedRows) {
+        const key =
+          resolveMapRowOutcomeKey(row) ??
+          deriveDefaultMapRowIdentity(row, resolveRuntimeInputIndex(row) ?? 0);
+        if (key) {
+          blockedKeys.add(key);
+          blockedRowsByKey.set(key, row);
           preparedKeys.add(key);
         }
       }
+      if (blockedKeys.size > 0) {
+        const rowKeySamples = Array.from(blockedKeys).slice(
+          0,
+          MAP_ROW_FAILURE_SAMPLE_LIMIT,
+        );
+        const message =
+          `ctx.dataset("${name}") chunk ${chunkIndex} is blocked by ` +
+          `${blockedKeys.size} active runtime sheet row lease(s) owned by another attempt. ` +
+          `Retry after the owning attempt finishes or the row leases expire.` +
+          (rowKeySamples.length > 0
+            ? ` Blocked row keys: ${rowKeySamples.join(', ')}`
+            : '');
+        recordRunnerPerfTrace({
+          req,
+          phase: 'runner.map_chunk.blocked_rows',
+          ms: nowMs() - prepareStartedAt,
+          extra: {
+            mapName: name,
+            chunkIndex,
+            rowsBlocked: blockedKeys.size,
+            rowKeySamples,
+          },
+        });
+        enqueueMapProgressUpdate({
+          completed: preparedCompletedRows,
+          total: progressTotalRows,
+          waitingRows: blockedKeys.size,
+          startedAt: mapStartedAt,
+          message,
+        });
+        return {
+          status: 'blocked',
+          chunkIndex,
+          rangeStart: baseOffset + chunkStart,
+          rangeEnd: baseOffset + chunkStart + chunkRows.length,
+          rowsRead: chunkRows.length,
+          rowsBlocked: blockedKeys.size,
+          rowKeySamples,
+          blockedRowSamples: rowKeySamples.map((rowKey) => {
+            const blockedRow = blockedRowsByKey.get(rowKey);
+            const attemptId =
+              typeof blockedRow?.__deeplineAttemptId === 'string'
+                ? blockedRow.__deeplineAttemptId
+                : typeof blockedRow?._attempt_id === 'string'
+                  ? blockedRow._attempt_id
+                  : activeRowAttempt.attemptId;
+            return {
+              __deeplineRowKey: rowKey,
+              __deeplineAttemptId: attemptId,
+            };
+          }),
+          outputDatasetId: `map:${name}`,
+          message,
+        };
+      }
       const missingPreparedRows = chunkEntries.filter(
         ({ rowKey }) => !preparedKeys.has(rowKey),
       );
-      const rowsToExecuteEntries = chunkEntries.filter(
-        ({ rowKey }) => pendingKeys.has(rowKey) || !completedKeys.has(rowKey),
+      if (missingPreparedRows.length > 0) {
+        const rowKeySamples = missingPreparedRows
+          .map(({ rowKey }) => rowKey)
+          .slice(0, MAP_ROW_FAILURE_SAMPLE_LIMIT);
+        throw new Error(
+          `ctx.dataset("${name}") runtime preparation omitted ${missingPreparedRows.length} row disposition(s). ` +
+            `Every input row must be claimed, completed, or blocked before execution starts.` +
+            (rowKeySamples.length > 0
+              ? ` Missing row keys: ${rowKeySamples.join(', ')}`
+              : ''),
+        );
+      }
+      const rowsToExecuteEntries = chunkEntries.filter(({ rowKey }) =>
+        pendingKeys.has(rowKey),
+      );
+      const completedChunkEntries = chunkEntries.filter(({ rowKey }) =>
+        completedKeys.has(rowKey),
       );
       const uniqueRowsToExecuteEntries = [
         ...new Map(
@@ -5486,18 +4943,15 @@ function createMinimalWorkerCtx(
         rowsToExecute.length,
       );
       if (processingMessage) {
-        await updateMapProgress({
+        enqueueMapProgressUpdate({
           completed: preparedCompletedRows,
           total: progressTotalRows,
           startedAt: mapStartedAt,
           message: processingMessage,
         });
       }
-      const rowsInserted = prepared.inserted + missingPreparedRows.length;
-      const rowsSkipped = Math.max(
-        0,
-        prepared.skipped - missingPreparedRows.length,
-      );
+      const rowsInserted = prepared.inserted;
+      const rowsSkipped = prepared.skipped;
       let completedExecutedRows = 0;
       let failedExecutedRows = 0;
       let startedExecutedRows = 0;
@@ -5505,12 +4959,7 @@ function createMinimalWorkerCtx(
       let lastChunkProgressAt = 0;
       let lastExecutionHeartbeatAt = nowMs();
       const completedRowsForProgress = () =>
-        Math.min(
-          progressTotalRows,
-          totalRowsWritten +
-            prepared.completedRows.length +
-            completedExecutedRows,
-        );
+        Math.min(progressTotalRows, totalRowsWritten + completedExecutedRows);
       const reportExecutionHeartbeat = (force = false) => {
         const now = nowMs();
         if (
@@ -5520,7 +4969,7 @@ function createMinimalWorkerCtx(
           return;
         }
         lastExecutionHeartbeatAt = now;
-        void updateMapProgress(
+        enqueueMapProgressUpdate(
           {
             completed: completedRowsForProgress(),
             total: progressTotalRows,
@@ -5554,7 +5003,7 @@ function createMinimalWorkerCtx(
           return;
         }
         lastChunkProgressAt = now;
-        void updateMapProgress(
+        enqueueMapProgressUpdate(
           {
             completed,
             total: progressTotalRows,
@@ -5585,23 +5034,44 @@ function createMinimalWorkerCtx(
       const failedRowEntries: Array<
         { row: T & Record<string, unknown>; error: string } | undefined
       > = new Array(rowsToExecute.length);
+      const fatalReceiptPersistenceRowEntries: Array<
+        { row: T & Record<string, unknown>; error: string } | undefined
+      > = new Array(rowsToExecute.length);
       const executedCellMetaPatches: Array<
         Record<string, WorkerCellMetaPatchEntry> | undefined
       > = new Array(rowsToExecute.length);
-      const toolBatchScheduler = new WorkerToolBatchScheduler(
+      const persistenceLatch = createRuntimePersistenceLatch();
+      const toolBatchScheduler = new WorkerToolBatchScheduler({
         req,
         governor,
-        resolveToolPacing,
+        resolvePacing: resolveToolPacing,
         resolveToolActionCacheVersion,
+        resolveToolAuthScopeDigest,
+        invalidateToolAuthScopeDigest: (toolId) =>
+          resolveToolAuthScopeDigest.invalidate(toolId),
+        onAuthScopeReclaim: emitAuthScopeReclaimRunLog,
+        executeTool: executeDispatchedTool,
+        serializeDurableValue: serializeDurableStepValue,
+        deserializeDurableValue: deserializeDurableStepValue,
+        nowMs,
+        batchGraceMs: req.testPolicyOverrides?.batchGraceMs,
+        recordPerfTrace: (trace) => recordRunnerPerfTrace({ req, ...trace }),
         abortSignal,
-        reportSettledToolRequests,
+        onRequestsSettled: reportSettledToolRequests,
         callbacks,
         receiptStore,
-        false,
+        allowLocalRetryReceipts: false,
+        runtimeReceiptLeaseTtlMs: runtimeReceiptLeaseTtlMs(req),
+        runtimeReceiptHeartbeatIntervalMs: runtimePolicyHeartbeatIntervalMs(
+          req,
+          runtimeReceiptLeaseTtlMs(req) ??
+            PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
+        ),
+        budgetMeter: workBudgetMeter,
         runtimeDeadlineMs,
         persistenceLatch,
         receiptSalvage,
-      );
+      });
       let stepCellsCompleted = 0;
       let stepCellsSkipped = 0;
       const generatedOutputFields = new Set<string>();
@@ -5680,6 +5150,8 @@ function createMinimalWorkerCtx(
           tableNamespace: name,
           outputFields,
           extraOutputFields: Array.from(generatedOutputFields),
+          budgetMeter: workBudgetMeter,
+          ...activeRowAttempt,
           rows: [
             ...rowsToPersist.map(({ row, executedIndex }) =>
               mapRowOutcomeRuntimeRow(
@@ -5743,9 +5215,6 @@ function createMinimalWorkerCtx(
         });
         persistFlushChain = task.catch((error) => {
           persistFailure ??= error;
-          // Output-sheet flush failed: trip the breaker so the scheduler stops
-          // dispatching new provider calls for the rest of this map.
-          tripRuntimePersistenceLatch(persistenceLatch, error);
         });
         return task;
       };
@@ -5787,6 +5256,8 @@ function createMinimalWorkerCtx(
               outputFields,
               extraOutputFields,
               updates,
+              ...activeRowAttempt,
+              budgetMeter: workBudgetMeter,
             });
           } catch (error) {
             liveUpdateFailures += 1;
@@ -5894,18 +5365,11 @@ function createMinimalWorkerCtx(
                         request.input,
                         workflowStep,
                         {
-                          force: request.force === true || !!req.force,
+                          force: request.force === true,
+                          runForceRefresh: req.forceToolRefresh === true,
+                          runForceFailedRefresh: req.force === true,
                           staleAfterSeconds: request.staleAfterSeconds,
                         },
-                        // Parity with the play-level ctx.tools.execute (and the
-                        // cjs runner's map path): the public ToolExecutionRequest
-                        // runtime options must not be silently dropped for map
-                        // rows — receiptWaitMs bounds how long a resumed run
-                        // waits on a stuck `running` receipt before reclaiming.
-                        {
-                          timeoutMs: request.timeoutMs,
-                          receiptWaitMs: request.receiptWaitMs,
-                        },
                       );
                     },
                   },
@@ -6014,8 +5478,28 @@ function createMinimalWorkerCtx(
                   notePersistableRow(enriched);
                   reportChunkProgress(false);
                 } catch (rowError) {
-                  // Abort/budget errors stay run-fatal and leave no partial
-                  // state: rethrow immediately without recording the row.
+                  // Receipt persistence errors stay run-fatal, but keep the
+                  // row identity so teardown can make the recovery state loud.
+                  if (isRuntimeReceiptPersistenceError(rowError)) {
+                    const message = formatWorkerRowFailureMessage(rowError);
+                    if (activeField) {
+                      cellMetaPatch[activeField] = {
+                        status: 'failed',
+                        stage: activeField,
+                        runId: req.runId,
+                        error: message,
+                      };
+                    }
+                    executedCellMetaPatches[myIndex] =
+                      Object.keys(cellMetaPatch).length > 0
+                        ? cellMetaPatch
+                        : undefined;
+                    fatalReceiptPersistenceRowEntries[myIndex] = {
+                      row: enriched as T & Record<string, unknown>,
+                      error: message,
+                    };
+                    throw rowError;
+                  }
                   if (isRunFatalWorkerRowError(rowError)) {
                     throw rowError;
                   }
@@ -6095,16 +5579,25 @@ function createMinimalWorkerCtx(
           return results;
         },
       );
-      while (!workerSettled) {
-        await Promise.race([
-          workerResultsPromise,
-          sleepWorkerMs(MAP_EXECUTION_HEARTBEAT_INTERVAL_MS),
-        ]);
-        if (!workerSettled) {
-          reportExecutionHeartbeat(false);
-        }
-      }
-      const workerResults = await workerResultsPromise;
+      const workerResults = await executeWithRuntimeSheetAttemptHeartbeat({
+        req,
+        tableNamespace: name,
+        sheetContract: requireSheetContract(req, name),
+        ...activeRowAttempt,
+        rowKeys: uniqueRowsToExecuteEntries.map((entry) => entry.rowKey),
+        execute: async () => {
+          while (!workerSettled) {
+            await Promise.race([
+              workerResultsPromise,
+              sleepWorkerMs(MAP_EXECUTION_HEARTBEAT_INTERVAL_MS),
+            ]);
+            if (!workerSettled) {
+              reportExecutionHeartbeat(false);
+            }
+          }
+          return await workerResultsPromise;
+        },
+      });
       recordRunnerPerfTrace({
         req,
         phase: 'runner.map_chunk.execute_workers',
@@ -6133,26 +5626,89 @@ function createMinimalWorkerCtx(
           .slice(0, MAP_ROW_FAILURE_SAMPLE_LIMIT);
       const fatalMapChunkSummary = async (
         error: unknown,
-      ): Promise<WorkerMapChunkSummary<T & Record<string, unknown>>> => ({
-        chunkIndex,
-        rangeStart: baseOffset + chunkStart,
-        rangeEnd: baseOffset + chunkStart,
-        rowsRead: chunkRows.length,
-        rowsWritten: 0,
-        rowsExecuted: rowsToExecute.length,
-        rowsCached: 0,
-        rowsDuplicateReused: duplicateInputReuseCount,
-        rowsInserted,
-        rowsSkipped,
-        rowsFailed: failedExecutedRows,
-        rowFailureSamples: buildRowFailureSamples(),
-        stepCellsCompleted,
-        stepCellsSkipped,
-        outputDatasetId: `map:${name}`,
-        hash: await hashJson([]),
-        fatalError: formatWorkerRowFailureMessage(error),
-        preview: [],
-      });
+      ): Promise<
+        WorkerMapCompletedChunkSummary<T & Record<string, unknown>>
+      > => {
+        const fatalError = formatWorkerRowFailureMessage(error);
+        const breakerMessage = persistenceLatch.tripped
+          ? ` Circuit breaker prevented ${persistenceLatch.preventedCallCount} queued provider call(s).`
+          : '';
+        return {
+          status: 'completed',
+          chunkIndex,
+          rangeStart: baseOffset + chunkStart,
+          rangeEnd: baseOffset + chunkStart,
+          rowsRead: chunkRows.length,
+          rowsWritten: 0,
+          rowsExecuted: rowsToExecute.length,
+          rowsCached: 0,
+          rowsDuplicateReused: duplicateInputReuseCount,
+          rowsInserted,
+          rowsSkipped,
+          rowsFailed: failedExecutedRows,
+          rowFailureSamples: buildRowFailureSamples(),
+          stepCellsCompleted,
+          stepCellsSkipped,
+          outputDatasetId: `map:${name}`,
+          hash: await hashJson([]),
+          fatalError: `${fatalError}${breakerMessage}`,
+          preview: [],
+        };
+      };
+      const markReceiptPersistenceFatalRowsFailed = async (error: unknown) => {
+        const message = formatWorkerRowFailureMessage(error);
+        const rows = uniqueRowsToExecuteEntries
+          .map((entry, executedIndex) => {
+            const failure = fatalReceiptPersistenceRowEntries[executedIndex];
+            const row =
+              failure?.row ??
+              executedRows[executedIndex] ??
+              (runtimeCsvExecutionRow(
+                entry.row,
+                pendingRowsByKey.get(entry.rowKey),
+              ) as T & Record<string, unknown>);
+            return mapRowOutcomeRuntimeRow(
+              failedMapRowOutcome({
+                key: entry.rowKey,
+                inputIndex: entry.absoluteIndex,
+                data: row,
+                cellMetaPatch: executedCellMetaPatches[executedIndex],
+                error: failure?.error ?? message,
+              }),
+            );
+          })
+          .filter((row): row is Record<string, unknown> => row !== null);
+        if (rows.length === 0) return;
+        try {
+          const failureStats = await persistCompletedMapRows({
+            req,
+            tableNamespace: name,
+            outputFields,
+            extraOutputFields: Array.from(generatedOutputFields),
+            budgetMeter: workBudgetMeter,
+            ...activeRowAttempt,
+            forceFailedRows: true,
+            rows,
+          });
+          emitEvent({
+            type: 'log',
+            level: 'warn',
+            message:
+              `Runtime sheet marked ${failureStats.rows} row(s) failed for ctx.dataset("${name}") ` +
+              `after a run-fatal receipt persistence error.`,
+            ts: nowMs(),
+          });
+        } catch (cleanupError) {
+          emitEvent({
+            type: 'log',
+            level: 'warn',
+            message:
+              `Runtime sheet failed-row cleanup after receipt persistence error failed for ctx.dataset("${name}"): ` +
+              formatWorkerRowFailureMessage(cleanupError),
+            ts: nowMs(),
+          });
+        }
+      };
       const persistRowsStartedAt = nowMs();
       recordRunnerPerfTrace({
         req,
@@ -6181,6 +5737,7 @@ function createMinimalWorkerCtx(
           },
         });
       } catch (error) {
+        tripRuntimePersistenceLatch(persistenceLatch, error);
         recordRunnerPerfTrace({
           req,
           phase: 'runner.map_chunk.persist_rows_error',
@@ -6199,31 +5756,24 @@ function createMinimalWorkerCtx(
           result.status === 'rejected',
       );
       if (rejectedWorker) {
-        if (
-          isRuntimeReceiptPersistenceError(rejectedWorker.reason) ||
-          isRuntimePersistenceCircuitOpenError(rejectedWorker.reason)
-        ) {
-          // Persistence-failure / circuit-breaker rejections are returned as a
-          // fatal summary (NOT rethrown into the durable step) so the chunk is
-          // not retried and provider calls are not re-billed.
+        if (isRuntimeReceiptPersistenceError(rejectedWorker.reason)) {
+          await markReceiptPersistenceFatalRowsFailed(rejectedWorker.reason);
+          return await fatalMapChunkSummary(rejectedWorker.reason);
+        }
+        if (isRuntimePersistenceCircuitOpenError(rejectedWorker.reason)) {
           return await fatalMapChunkSummary(rejectedWorker.reason);
         }
         throw rejectedWorker.reason;
       }
       const resultByKey = new Map<string, T & Record<string, unknown>>();
-      for (const completedRow of prepared.completedRows) {
-        const key =
-          resolveMapRowOutcomeKey(completedRow) ??
-          deriveDefaultMapRowIdentity(
-            completedRow,
-            resolveRuntimeInputIndex(completedRow) ?? 0,
-          );
-        if (key) {
-          const cleanedRow = stripMapRowOutcomeRuntimeFields(
-            publicCsvOutputRow(completedRow),
-          );
-          resultByKey.set(key, cleanedRow as T & Record<string, unknown>);
-        }
+      for (const entry of completedChunkEntries) {
+        const completedRow = completedRowsByKey.get(entry.rowKey);
+        if (!completedRow || resultByKey.has(entry.rowKey)) continue;
+        resultByKey.set(
+          entry.rowKey,
+          cloneCsvAliasedRow(entry.row, completedRow) as T &
+            Record<string, unknown>,
+        );
       }
       for (
         let executedIndex = 0;
@@ -6258,16 +5808,13 @@ function createMinimalWorkerCtx(
           } => entry !== null,
         );
       const out = outEntries.map((entry) => entry.row);
-      const executedSuccessCount = Math.max(
-        0,
-        executedRows.length - failedExecutedRows,
-      );
       const rowFailureSamples = buildRowFailureSamples();
       const publicOut = out.map((row) => publicCsvOutputRow(row));
       const keyedOut = outEntries.map(({ key, inputIndex, row }) => ({
         ...row,
         ...mapRowOutcomeRuntimeFields({ key, inputIndex }),
       }));
+      const completedRowsReused = completedChunkEntries.length;
       const hashStartedAt = nowMs();
       const hash = await hashJson(publicOut);
       const includeCachedRowsInChunkResult = !workflowStep;
@@ -6298,17 +5845,18 @@ function createMinimalWorkerCtx(
           rowsWritten: out.length,
           rowsExecuted: executedRows.length,
           rowsFailed: failedExecutedRows,
-          rowsCached: Math.max(0, out.length - executedSuccessCount),
+          rowsCached: completedRowsReused,
         },
       });
       return {
+        status: 'completed',
         chunkIndex,
         rangeStart: baseOffset + chunkStart,
         rangeEnd: baseOffset + chunkStart + out.length,
         rowsRead: chunkRows.length,
         rowsWritten: out.length,
         rowsExecuted: executedRows.length,
-        rowsCached: Math.max(0, out.length - executedSuccessCount),
+        rowsCached: completedRowsReused,
         rowsDuplicateReused: duplicateInputReuseCount,
         rowsInserted,
         rowsSkipped,
@@ -6340,9 +5888,12 @@ function createMinimalWorkerCtx(
     let totalRowsInserted = 0;
     let totalRowsSkipped = 0;
     let totalRowsFailed = 0;
+    let totalRowsBlocked = 0;
     let totalStepCellsCompleted = 0;
     let totalStepCellsSkipped = 0;
     const totalRowFailureSamples: Array<{ rowKey: string; error: string }> = [];
+    const blockedRowKeySamples: string[] = [];
+    const blockedRowSamples: Record<string, unknown>[] = [];
 
     const runChunkStep = async (
       chunkRows: T[],
@@ -6372,6 +5923,7 @@ function createMinimalWorkerCtx(
     const readPersistedRows = async (input: {
       limit: number;
       offset: number;
+      rowMode?: 'output' | 'all';
     }) => {
       const result = await harnessReadSheetDatasetRows({
         baseUrl: req.baseUrl,
@@ -6380,6 +5932,7 @@ function createMinimalWorkerCtx(
         playName: req.playName,
         tableNamespace: name,
         runId: req.runId,
+        rowMode: input.rowMode,
         limit: input.limit,
         offset: input.offset,
         userEmail: req.userEmail,
@@ -6388,19 +5941,61 @@ function createMinimalWorkerCtx(
       return result.rows as Array<T & Record<string, unknown>>;
     };
 
-    const finalize = async (totalRowsWritten: number) => {
+    const finalize = async () => {
+      let finalizedRowsWritten = totalRowsWritten;
+      if (
+        totalRowsFailed === 0 &&
+        rowCountHint !== null &&
+        finalizedRowsWritten > 0 &&
+        finalizedRowsWritten < rowCountHint &&
+        rowCountHint <= WORKER_DATASET_IN_MEMORY_ROWS
+      ) {
+        const persistedRows = await readPersistedRows({
+          limit: rowCountHint,
+          offset: 0,
+          rowMode: 'all',
+        });
+        if (persistedRows.length > finalizedRowsWritten) {
+          const inMemoryRowsWritten = finalizedRowsWritten;
+          finalizedRowsWritten = persistedRows.length;
+          totalRowsWritten = finalizedRowsWritten;
+          cachedRows.length = 0;
+          cachedRows.push(...persistedRows);
+          canCacheRows = true;
+          previewRows.length = 0;
+          previewRows.push(
+            ...persistedRows.slice(0, WORKER_DATASET_PREVIEW_ROWS),
+          );
+          emitEvent({
+            type: 'log',
+            level: 'warn',
+            message:
+              `Runtime sheet finalization reconciled ctx.dataset("${name}") ` +
+              `from ${inMemoryRowsWritten}/${rowCountHint} in-memory row(s) ` +
+              `to ${finalizedRowsWritten} visible persisted row(s).`,
+            ts: nowMs(),
+          });
+        }
+        if (persistedRows.length < rowCountHint) {
+          throw new Error(
+            `Runtime sheet finalization mismatch ctx.dataset("${name}"): ` +
+              `expected ${rowCountHint}, saw ${persistedRows.length}; ` +
+              `sum ${finalizedRowsWritten}; ${req.runId}`,
+          );
+        }
+      }
       const failureSampleSummary =
         totalRowFailureSamples.length > 0
           ? ` First error: ${totalRowFailureSamples[0]!.error}`
           : '';
       const cacheSummary =
         totalRowsFailed > 0
-          ? `Map completed with partial failures: ${totalRowsWritten} succeeded, ` +
-            `${totalRowsFailed} failed (${totalRowsExecuted} executed, ${totalRowsCached} already satisfied) ` +
+          ? `Map completed with partial failures: ${finalizedRowsWritten} succeeded, ` +
+            `${totalRowsFailed} failed (${totalRowsExecuted} executed) ` +
             `inserted=${totalRowsInserted} skipped=${totalRowsSkipped}. ` +
             `Failed rows are persisted with their errors and re-execute on the next run.${failureSampleSummary}`
-          : `Map completed: ${totalRowsWritten} results ` +
-            `(${totalRowsExecuted} executed, ${totalRowsCached} already satisfied) ` +
+          : `Map completed: ${finalizedRowsWritten} results ` +
+            `(${totalRowsExecuted} executed) ` +
             `inserted=${totalRowsInserted} skipped=${totalRowsSkipped}`;
       const completedAt = nowMs();
       const totalStepCells = totalStepCellsCompleted + totalStepCellsSkipped;
@@ -6408,17 +6003,21 @@ function createMinimalWorkerCtx(
         totalStepCells > 0
           ? ` cells=${totalStepCells}/${totalStepCellsCompleted}/${totalStepCellsSkipped}`
           : '';
+      await flushQueuedMapProgressUpdates();
       callbacks?.onMapCompleted?.(mapNodeId, completedAt);
       await updateMapProgress({
-        completed: totalRowsWritten,
-        total: totalRowsWritten + totalRowsFailed,
+        completed: finalizedRowsWritten,
+        total: finalizedRowsWritten + totalRowsFailed,
         failed: totalRowsFailed,
         completedAt,
         updatedAt: completedAt,
         message:
           totalRowsFailed > 0
-            ? `${totalRowsWritten.toLocaleString()} succeeded, ${totalRowsFailed.toLocaleString()} failed`
-            : formatMapProgressMessage(totalRowsWritten, totalRowsWritten),
+            ? `${finalizedRowsWritten.toLocaleString()} succeeded, ${totalRowsFailed.toLocaleString()} failed`
+            : formatMapProgressMessage(
+                finalizedRowsWritten,
+                finalizedRowsWritten,
+              ),
       });
       emitEvent({
         type: 'log',
@@ -6427,29 +6026,61 @@ function createMinimalWorkerCtx(
         ts: nowMs(),
       });
       if (
-        totalRowsWritten > 0 &&
+        finalizedRowsWritten > 0 &&
         totalRowsFailed === 0 &&
         canCacheRows &&
-        cachedRows.length === totalRowsWritten
+        cachedRows.length === finalizedRowsWritten
       ) {
         const persistedRows = await readPersistedRows({
-          limit: totalRowsWritten,
+          limit: finalizedRowsWritten,
           offset: 0,
         });
-        if (persistedRows.length < totalRowsWritten) {
+        if (persistedRows.length < finalizedRowsWritten) {
+          const repairAttempt = makeRuntimeSheetAttempt({
+            runId: req.runId,
+            runAttempt: req.runAttempt,
+            mapName: name,
+            chunkIndex: 'finalize',
+          });
+          const repairRows = cachedRows.map((row) => runtimeCsvStorageRow(row));
+          workBudgetMeter.count('sheet');
+          const repairStart = await harnessStartSheetDataset({
+            ...runtimeSheetSessionScope(req),
+            tableNamespace: name,
+            sheetContract: augmentSheetContractWithDatasetFields({
+              contract: requireSheetContract(req, name),
+              rows: repairRows,
+              outputFields,
+            }),
+            rows: repairRows,
+            runId: req.runId,
+            inputOffset: 0,
+            attemptLeaseTtlMs: runtimeSheetAttemptLeaseTtlMs(req),
+            ...repairAttempt,
+          });
+          const activeRepairAttempt = {
+            attemptId: repairStart.attemptId ?? repairAttempt.attemptId,
+            attemptOwnerRunId:
+              repairStart.attemptOwnerRunId ?? repairAttempt.attemptOwnerRunId,
+            attemptExpiresAt:
+              repairStart.attemptExpiresAt ?? repairAttempt.attemptExpiresAt,
+            attemptSeq: repairStart.attemptSeq ?? repairAttempt.attemptSeq,
+          };
           const repair = await persistCompletedMapRows({
             req,
             tableNamespace: name,
             outputFields,
             extraOutputFields: [],
             rows: cachedRows,
+            ...activeRepairAttempt,
+            budgetMeter: workBudgetMeter,
           });
           emitEvent({
             type: 'log',
             level: 'warn',
             message:
               `Runtime sheet finalization repaired ctx.dataset("${name}") ` +
-              `from ${persistedRows.length}/${totalRowsWritten} visible row(s) ` +
+              `from ${persistedRows.length}/${finalizedRowsWritten} visible row(s) ` +
               `(written=${repair.written}, visible=${repair.visible}` +
               (repair.retryWritten === null
                 ? ''
@@ -6465,7 +6096,7 @@ function createMinimalWorkerCtx(
       return createPersistedDatasetHandle({
         playName: req.playName,
         name,
-        count: totalRowsWritten,
+        count: finalizedRowsWritten,
         // In native Workflows, chunk summaries intentionally omit full row
         // payloads, so this preview only contains the bounded chunk samples.
         // Do not synchronously page rows back here: service-binding reads have
@@ -6479,7 +6110,7 @@ function createMinimalWorkerCtx(
           recordRunnerPerfTrace({ req, phase, ms, extra }),
         nowMs,
         workProgress: {
-          total: totalRowsWritten + totalRowsFailed,
+          total: finalizedRowsWritten + totalRowsFailed,
           executed: totalRowsExecuted,
           reused: totalRowsCached,
           skipped: totalRowsCached,
@@ -6493,97 +6124,248 @@ function createMinimalWorkerCtx(
     };
 
     const failFastRowErrors = opts?.onRowError === 'fail';
-    let chunkIndex = 0;
-    let chunkStart = 0;
-    for await (const rawChunkRows of iterDatasetChunks(
-      inputRows,
-      rowsPerChunk,
-    )) {
-      assertNotAborted(abortSignal);
-      if (rawChunkRows.length === 0) continue;
-      // Drop duplicate explicit-key rows before anything downstream observes
-      // them. `chunkStart` keeps advancing by the original (pre-dedupe) chunk
-      // length so cross-chunk key indices and persisted input offsets stay
-      // aligned to the original input stream.
-      const chunkRows = dedupeExplicitRowKeys(rawChunkRows, chunkStart);
-      if (chunkRows.length === 0) {
-        chunkStart += rawChunkRows.length;
-        continue;
-      }
-      const chunkResult = await runChunkStep(chunkRows, chunkStart, chunkIndex);
-      if (chunkResult.fatalError) {
-        const circuitBreakerSentence =
-          persistenceLatch.tripped && persistenceLatch.preventedCallCount > 0
-            ? `Circuit breaker prevented ${persistenceLatch.preventedCallCount} queued provider call(s) ` +
-              `from dispatching after the first persistence failure. `
-            : '';
-        throw new Error(
-          `ctx.dataset("${name}") stopped after a runtime persistence failure ` +
-            `outside the retryable chunk step. Provider calls already executed for ` +
-            `${chunkResult.rowsExecuted} row(s), so the chunk was not retried. ` +
-            circuitBreakerSentence +
-            `Fix the runtime persistence cause and re-run to resume. ` +
-            `First error: ${chunkResult.fatalError}`,
-        );
-      }
-      totalRowsWritten += chunkResult.rowsWritten;
-      totalRowsExecuted += chunkResult.rowsExecuted;
-      totalRowsCached += chunkResult.rowsCached;
-      totalRowsDuplicateReused += chunkResult.rowsDuplicateReused;
-      totalRowsInserted += chunkResult.rowsInserted;
-      totalRowsSkipped += chunkResult.rowsSkipped;
-      totalRowsFailed += chunkResult.rowsFailed ?? 0;
-      totalStepCellsCompleted += chunkResult.stepCellsCompleted ?? 0;
-      totalStepCellsSkipped += chunkResult.stepCellsSkipped ?? 0;
-      for (const sample of chunkResult.rowFailureSamples ?? []) {
-        if (totalRowFailureSamples.length >= MAP_ROW_FAILURE_SAMPLE_LIMIT) {
-          break;
+    // Bounded-concurrent chunk dispatch is only sound off the native Workflows
+    // path: with a `workflowStep` each chunk is a durable step whose sequential
+    // order makes replay/resume deterministic, so that path stays at K=1.
+    // Chunk-level concurrency is otherwise safe under workers_edge because each
+    // chunk owns a disjoint sheet row range with its own runtime-sheet attempt,
+    // receipts complete inside each chunk's persist barrier, and child submits
+    // use per-row durable receipt keys. It is disabled under onRowError:'fail'
+    // on purpose: that mode relies on a first-failure short-circuit to skip the
+    // remaining chunks and stop spending provider credits, and eager concurrent
+    // launch would already have K-1 chunks in flight (credits spent) before the
+    // short-circuit fires.
+    const canRunChunksConcurrently = !workflowStep && !failFastRowErrors;
+    const maxConcurrentMapChunks = canRunChunksConcurrently
+      ? WORKERS_EDGE_MAX_CONCURRENT_MAP_CHUNKS
+      : 1;
+    const runWorkDispatcher = new WorkerRunWorkDispatcher({
+      budgetMeter: workBudgetMeter,
+      nowMs,
+      yieldLimits: {
+        elapsed: governor.policy.pacing.workerYieldElapsedMs,
+        ...(req.testPolicyOverrides?.workBudgetYieldLimits ?? {}),
+      },
+      recordTrace: (trace) => recordRunnerPerfTrace({ req, ...trace }),
+      yieldBetweenChunks: async (yieldPoint) => {
+        emitEvent({
+          type: 'log',
+          level: 'info',
+          message:
+            `Runtime dispatcher yielded ctx.dataset("${name}") before chunk ${yieldPoint.nextChunkIndex} ` +
+            `(${yieldPoint.reason} budget).`,
+          ts: nowMs(),
+        });
+        if (workflowStep) {
+          // Cloudflare Workflows durability model: `step.sleep` writes a
+          // durable checkpoint, and the resume re-enters `run()` as a NEW
+          // Worker invocation. Cloudflare's subrequest ceiling is
+          // per-invocation, and on resume the already-completed `step.do`
+          // chunks are served from the durable step cache WITHOUT re-issuing
+          // their subrequests (replay semantics) — so the post-yield chunk
+          // runs against a fresh per-invocation subrequest budget.
+          //
+          // Isolate identity is the WRONG freshness proxy: Cloudflare routinely
+          // reuses warm isolates across invocations, so a genuinely
+          // fresh-budget resume commonly shares the pre-sleep isolate id (this
+          // is exactly why the isolate-identity check reported `false` every
+          // time and hard-failed multi-chunk maps). Crossing the durable
+          // `step.sleep` boundary IS the fresh-budget signal.
+          const sleepMs = WORK_DISPATCHER_YIELD_SLEEP_MS;
+          await (
+            workflowStep.sleep as unknown as (
+              name: string,
+              duration: number,
+            ) => Promise<void>
+          )(
+            `work-dispatcher:${name}:${yieldPoint.nextChunkIndex}:${yieldPoint.attempt}`,
+            sleepMs,
+          );
+          recordRunnerPerfTrace({
+            req,
+            phase: 'runner.work_dispatcher.yield_probe',
+            ms: sleepMs,
+            extra: {
+              mapName: name,
+              nextChunkIndex: yieldPoint.nextChunkIndex,
+              reason: yieldPoint.reason,
+              attempt: yieldPoint.attempt,
+              freshBudget: true,
+              invocationBoundary: 'workflow_step_sleep',
+            },
+          });
+          return { freshBudget: true };
         }
-        totalRowFailureSamples.push(sample);
-      }
-      await updateMapProgress({
-        completed: totalRowsWritten,
-        total: rowCountHint ?? undefined,
-        ...(totalRowsFailed > 0 ? { failed: totalRowsFailed } : {}),
-        message: formatMapProgressMessage(
-          totalRowsWritten,
-          rowCountHint ?? undefined,
-        ),
-      });
-      if (previewRows.length < WORKER_DATASET_PREVIEW_ROWS) {
-        previewRows.push(
-          ...chunkResult.preview.slice(
+        // No durable Workflow step is available to force a new invocation here,
+        // so we cannot obtain a fresh per-invocation platform budget. Report a
+        // non-fresh yield: the dispatcher escalates and then fails loudly with
+        // WorkerBudgetExhaustedError rather than silently overflowing the
+        // subrequest ceiling mid-map.
+        await sleepWorkerMs(0);
+        return { freshBudget: false };
+      },
+    });
+    let dispatchResult: WorkerRunMapBatchesResult;
+    try {
+      dispatchResult = await runWorkDispatcher.runMapBatches({
+        mapName: name,
+        chunks: iterDatasetChunks(inputRows, rowsPerChunk),
+        maxConcurrentChunks: maxConcurrentMapChunks,
+        maxResidentBatchBytes: WORKERS_EDGE_MAP_RESIDENT_ROW_BYTES,
+        prepareBatch: (rawChunkRows, chunkStart) => {
+          assertNotAborted(abortSignal);
+          if (rawChunkRows.length === 0) return [];
+          // Drop duplicate explicit-key rows before anything downstream observes
+          // them. `chunkStart` keeps advancing by the original (pre-dedupe) chunk
+          // length so cross-chunk key indices and persisted input offsets stay
+          // aligned to the original input stream.
+          return dedupeExplicitRowKeys(rawChunkRows, chunkStart);
+        },
+        estimateRawBatchResidentBytes: (rawChunkRows) =>
+          rawChunkRows.reduce(
+            (total, row) => total + workerMapResidentRowBytes(row),
+            0,
+          ),
+        executeBatch: async ({ rows: chunkRows, chunkStart, chunkIndex }) => {
+          assertNotAborted(abortSignal);
+          return await runChunkStep(chunkRows, chunkStart, chunkIndex);
+        },
+        estimateBatchResidentBytes: ({ rows: chunkRows }) =>
+          chunkRows.reduce(
+            (total, row) => total + workerMapResidentRowBytes(row),
             0,
-            WORKER_DATASET_PREVIEW_ROWS - previewRows.length,
           ),
+        estimateBatchSubrequests: ({ rows: chunkRows }) => {
+          const estimate = mapDispatchPlan.workEstimate;
+          const unbatchedProviderSubrequests =
+            estimate.unbatchedProviderToolCallsPerRow *
+            WORKER_PLATFORM_SUBREQUESTS_PER_UNBATCHED_TOOL_CALL;
+          // Static planning cannot know input-dependent batching buckets, so
+          // this projects worst-case provider-batch fanout while still treating
+          // durable receipt claim/complete/fail as bulk per drained tool group.
+          const batchedProviderSubrequests =
+            estimateBatchedToolChunkSubrequests({
+              batchableToolCallsPerRow: Math.max(
+                0,
+                estimate.providerToolCallsPerRow -
+                  estimate.unbatchedProviderToolCallsPerRow,
+              ),
+              coalescedBatchableToolCallsPerRow:
+                estimate.coalescedBatchableProviderToolCallsPerRow,
+              rows: chunkRows.length,
+              assumedBatchSize: estimate.assumedBatchSize,
+            });
+          const controlSubrequests =
+            estimate.childPlaySubmitsPerRow + estimate.eventWaitsPerRow;
+          return (
+            chunkRows.length *
+              (unbatchedProviderSubrequests + controlSubrequests) +
+            batchedProviderSubrequests +
+            estimate.runtimeSheetReadsPerChunk +
+            estimate.runtimeSheetWritesPerChunk
+          );
+        },
+        onBatchComplete: async (chunkResult) => {
+          if (chunkResult.status === 'blocked') {
+            totalRowsBlocked += chunkResult.rowsBlocked;
+            for (const key of chunkResult.rowKeySamples) {
+              if (blockedRowKeySamples.length >= MAP_ROW_FAILURE_SAMPLE_LIMIT) {
+                break;
+              }
+              blockedRowKeySamples.push(key);
+            }
+            for (const row of chunkResult.blockedRowSamples) {
+              if (blockedRowSamples.length >= MAP_ROW_FAILURE_SAMPLE_LIMIT) {
+                break;
+              }
+              blockedRowSamples.push(row);
+            }
+            emitEvent({
+              type: 'log',
+              level: 'warn',
+              message: chunkResult.message,
+              ts: nowMs(),
+            });
+            return true;
+          }
+          if (chunkResult.fatalError) {
+            throw new Error(
+              `ctx.dataset("${name}") stopped after a runtime persistence failure ` +
+                `outside the retryable chunk step. Provider calls already executed for ` +
+                `${chunkResult.rowsExecuted} row(s), so the chunk was not retried. ` +
+                `Fix the runtime persistence cause and re-run to resume. ` +
+                `First error: ${chunkResult.fatalError}`,
+            );
+          }
+          totalRowsWritten += chunkResult.rowsWritten;
+          totalRowsExecuted += chunkResult.rowsExecuted;
+          totalRowsCached += chunkResult.rowsCached;
+          totalRowsDuplicateReused += chunkResult.rowsDuplicateReused;
+          totalRowsInserted += chunkResult.rowsInserted;
+          totalRowsSkipped += chunkResult.rowsSkipped;
+          totalRowsFailed += chunkResult.rowsFailed ?? 0;
+          totalStepCellsCompleted += chunkResult.stepCellsCompleted ?? 0;
+          totalStepCellsSkipped += chunkResult.stepCellsSkipped ?? 0;
+          for (const sample of chunkResult.rowFailureSamples ?? []) {
+            if (totalRowFailureSamples.length >= MAP_ROW_FAILURE_SAMPLE_LIMIT) {
+              break;
+            }
+            totalRowFailureSamples.push(sample);
+          }
+          enqueueMapProgressUpdate({
+            completed: totalRowsWritten,
+            total: rowCountHint ?? undefined,
+            ...(totalRowsFailed > 0 ? { failed: totalRowsFailed } : {}),
+            message: formatMapProgressMessage(
+              totalRowsWritten,
+              rowCountHint ?? undefined,
+            ),
+          });
+          if (previewRows.length < WORKER_DATASET_PREVIEW_ROWS) {
+            previewRows.push(
+              ...chunkResult.preview.slice(
+                0,
+                WORKER_DATASET_PREVIEW_ROWS - previewRows.length,
+              ),
+            );
+          }
+          if (canCacheRows) {
+            const volatileRows = volatileWorkflowChunkRows.get(
+              chunkResult.chunkIndex,
+            );
+            volatileWorkflowChunkRows.delete(chunkResult.chunkIndex);
+            const nextRows = chunkResult.cachedRows ?? volatileRows ?? [];
+            if (
+              nextRows.length === chunkResult.rowsWritten &&
+              cachedRows.length + nextRows.length <=
+                WORKER_DATASET_IN_MEMORY_ROWS
+            ) {
+              cachedRows.push(...nextRows);
+            } else {
+              cachedRows.length = 0;
+              volatileWorkflowChunkRows.clear();
+              canCacheRows = false;
+            }
+          }
+          // onRowError:'fail' short-circuit: once a chunk reports a row failure,
+          // skip the remaining chunks entirely. The failing chunk itself completed
+          // normally (no chunk-step retry storm) and persisted its rows, but
+          // executing later chunks would keep spending provider credits on a run
+          // the caller asked to fail fast. The post-loop fail-fast throw below
+          // reports what committed before the stop.
+          return failFastRowErrors && totalRowsFailed > 0;
+        },
+      });
+    } catch (error) {
+      try {
+        await flushQueuedMapProgressUpdates();
+      } catch (progressError) {
+        throw new AggregateError(
+          [error, progressError],
+          `ctx.dataset("${name}") failed while flushing queued progress updates.`,
         );
       }
-      if (canCacheRows) {
-        const volatileRows = volatileWorkflowChunkRows.get(chunkIndex);
-        volatileWorkflowChunkRows.delete(chunkIndex);
-        const nextRows = chunkResult.cachedRows ?? volatileRows ?? [];
-        if (
-          nextRows.length === chunkResult.rowsWritten &&
-          cachedRows.length + nextRows.length <= WORKER_DATASET_IN_MEMORY_ROWS
-        ) {
-          cachedRows.push(...nextRows);
-        } else {
-          cachedRows.length = 0;
-          volatileWorkflowChunkRows.clear();
-          canCacheRows = false;
-        }
-      }
-      chunkStart += rawChunkRows.length;
-      chunkIndex += 1;
-      // onRowError:'fail' short-circuit: once a chunk reports a row failure,
-      // skip the remaining chunks entirely. The failing chunk itself completed
-      // normally (no chunk-step retry storm) and persisted its rows, but
-      // executing later chunks would keep spending provider credits on a run
-      // the caller asked to fail fast. The post-loop fail-fast throw below
-      // reports what committed before the stop.
-      if (failFastRowErrors && totalRowsFailed > 0) {
-        break;
-      }
+      throw error;
     }
     if (totalDuplicateKeysDropped > 0) {
       const keySample = droppedDuplicateKeySamples.join(', ');
@@ -6596,6 +6378,13 @@ function createMinimalWorkerCtx(
         ts: nowMs(),
       });
     }
+    if (totalRowsBlocked > 0) {
+      await flushQueuedMapProgressUpdates();
+      throw new RuntimeSheetRowsBlockedError({
+        tableNamespace: name,
+        blockedRows: blockedRowSamples,
+      });
+    }
     if (failFastRowErrors && totalRowsFailed > 0 && totalRowsWritten > 0) {
       // onRowError:'fail', PARTIAL failure (some rows committed): fail the run
       // without finalizing the dataset. The committed rows already persisted
@@ -6604,6 +6393,7 @@ function createMinimalWorkerCtx(
       // normally (no per-row throw inside the durable chunk step, so no
       // chunk-step retry storm); later chunks were skipped by the fail-fast
       // short-circuit in the chunk loop.
+      await flushQueuedMapProgressUpdates();
       const firstError = totalRowFailureSamples[0]?.error ?? 'unknown error';
       throw new Error(
         `ctx.dataset("${name}") failed for ${totalRowsFailed} executed row(s) under onRowError:'fail'. ` +
@@ -6621,7 +6411,7 @@ function createMinimalWorkerCtx(
       // step when no row otherwise succeeded) are summarized and registered as
       // a recovered dataset — the failed run then advertises a WORKING export
       // instead of a dead end (#15/#27). The run still fails (the throw below).
-      await finalize(totalRowsWritten);
+      await finalize();
       const firstError = totalRowFailureSamples[0]?.error ?? 'unknown error';
       throw new Error(
         `ctx.dataset("${name}") failed for all ${totalRowsFailed} executed rows. ` +
@@ -6629,7 +6419,7 @@ function createMinimalWorkerCtx(
           `(rows are persisted with per-row errors; fix the cause and re-run to resume)`,
       );
     }
-    const dataset = await finalize(totalRowsWritten);
+    const dataset = await finalize();
     recordRunnerPerfTrace({
       req,
       phase: 'runner.map.total',
@@ -6638,7 +6428,7 @@ function createMinimalWorkerCtx(
         mapName: name,
         rowsWritten: totalRowsWritten,
         inputKind: rowCountHint === null ? 'streaming' : 'known_count',
-        chunks: chunkIndex,
+        chunks: dispatchResult.chunksExecuted,
       },
     });
     return dataset;
@@ -6903,10 +6693,10 @@ function createMinimalWorkerCtx(
           request.input,
           workflowStep,
           {
-            force: request.force === true || !!req.force,
+            force: request.force === true,
+            runForceRefresh: req.forceToolRefresh === true,
+            runForceFailedRefresh: req.force === true,
             staleAfterSeconds: request.staleAfterSeconds,
-          },
-          {
             timeoutMs: request.timeoutMs,
             receiptWaitMs: request.receiptWaitMs,
           },
@@ -6947,13 +6737,18 @@ function createMinimalWorkerCtx(
       if (!resolvedName) {
         throw new Error('ctx.runPlay(...) requires a resolvable play name.');
       }
+      const childManifest = req.childPlayManifests?.[resolvedName];
       const receiptKey = buildDurableCtxCallCacheKey({
         orgId: req.orgId,
         playId: req.playName,
         kind: 'runPlay',
         id: normalizedKey,
-        semanticKey: await hashJson({
+        semanticKey: buildDurableRunPlaySemanticKey({
           childPlayName: resolvedName,
+          childRevisionFingerprint: workerChildRevisionFingerprint({
+            playName: resolvedName,
+            manifest: childManifest,
+          }),
           input,
         }),
         staleAfterSeconds: options?.staleAfterSeconds,
@@ -6981,7 +6776,6 @@ function createMinimalWorkerCtx(
             message: `Starting child play ${resolvedName} (${normalizedKey})`,
             ts: nowMs(),
           });
-          const childManifest = req.childPlayManifests?.[resolvedName];
           if (!childManifest) {
             throw new Error(
               `ctx.runPlay(${normalizedKey}) cannot start ${resolvedName}: missing trusted Cloudflare child manifest from top-level submit.`,
@@ -7019,7 +6813,7 @@ function createMinimalWorkerCtx(
           });
           let childPlaySlot: { release(): void } | null = null;
           try {
-            childPlaySlot = await governor.acquireChildPlaySlot({
+            childPlaySlot = await governor.acquireChildSubmitSlot({
               signal: abortSignal,
             });
             const childSubmitStartedAt = nowMs();
@@ -7044,12 +6838,12 @@ function createMinimalWorkerCtx(
                   options?.timeoutMs == null && !childNeedsWorkflowScheduler,
                 body: {
                   name: resolvedName,
+                  childIdempotencyKey: receiptKey,
                   input: isRecord(input) ? input : {},
                   orgId: req.orgId,
                   callbackBaseUrl: req.callbackUrl,
                   baseUrl: req.baseUrl,
                   integrationMode: req.integrationMode ?? null,
-                  forceToolRefresh: req.force === true,
                   parentExecutorToken: req.executorToken,
                   userEmail: req.userEmail ?? '',
                   profile: 'workers_edge',
@@ -7161,6 +6955,8 @@ function createMinimalWorkerCtx(
                 childNeedsWorkflowScheduler,
               },
             });
+            childPlaySlot?.release();
+            childPlaySlot = null;
             const startedStatus = String(started.status ?? '').toLowerCase();
             if (startedStatus === 'completed') {
               emitEvent({
@@ -7189,6 +6985,10 @@ function createMinimalWorkerCtx(
             }
             const childWaitStartedAt = nowMs();
             let waitResult: ChildPlayTerminalWaitResult;
+            const readCachedChildTerminalState =
+              cachedCoordinatorBinding?.readChildTerminalState?.bind(
+                cachedCoordinatorBinding,
+              );
             try {
               waitResult = await awaitChildTerminal({
                 parentRunId: req.runId,
@@ -7205,20 +7005,31 @@ function createMinimalWorkerCtx(
                   1_000,
                   Math.min(options?.timeoutMs ?? 5 * 60_000, 30 * 60_000),
                 ),
-                coordinator: cachedCoordinatorBinding?.readChildTerminalState
-                  ? {
-                      readChildTerminalState: (
-                        parentRunId,
-                        eventKey,
-                        timeoutMs,
-                      ) =>
-                        cachedCoordinatorBinding!.readChildTerminalState!(
-                          parentRunId,
-                          eventKey,
-                          timeoutMs,
-                        ),
-                    }
-                  : null,
+                coordinator: {
+                  readRunTerminalState: (runId, timeoutMs) =>
+                    readDurableChildRunTerminalState({
+                      baseUrl: req.baseUrl,
+                      executorToken: req.executorToken,
+                      parentRunId: req.runId,
+                      childRunId: runId,
+                      childPlayName: resolvedName,
+                      timeoutMs,
+                    }),
+                  ...(readCachedChildTerminalState
+                    ? {
+                        readChildTerminalState: (
+                          parentRunId: string,
+                          eventKey: string,
+                          timeoutMs?: number,
+                        ) =>
+                          readCachedChildTerminalState(
+                            parentRunId,
+                            eventKey,
+                            timeoutMs,
+                          ),
+                      }
+                    : {}),
+                },
                 now: nowMs,
                 hashJson,
               });
@@ -7401,6 +7212,7 @@ function createMinimalWorkerCtx(
             // Direct Worker fetch below is still limited to runtime origins and
             // IP literals; public IP literals also consume this slot because
             // they are customer egress.
+            workBudgetMeter.count('egress');
             const egressResponse = await postRuntimeEgressFetch(
               req,
               {
@@ -7423,6 +7235,7 @@ function createMinimalWorkerCtx(
           }
           const fetchInit = { ...init, headers };
           delete fetchInit.auth;
+          workBudgetMeter.count('egress');
           const response = await safeWorkerPublicFetch(url, fetchInit, {
             allowedOrigins,
             sensitiveHeaders: Object.keys(secretHeaderMarkers),
@@ -7493,6 +7306,7 @@ async function handleRun(request: Request, env: WorkerEnv): Promise<Response> {
   let req: RunRequest;
   try {
     req = (await request.json()) as RunRequest;
+    req.runAttempt = normalizeWorkerRunAttempt(req.runAttempt);
   } catch {
     return new Response('invalid JSON body', { status: 400 });
   }
@@ -7557,6 +7371,7 @@ async function handleRunInline(
   let req: RunRequest;
   try {
     req = (await request.json()) as RunRequest;
+    req.runAttempt = normalizeWorkerRunAttempt(req.runAttempt);
   } catch {
     return Response.json(
       {
@@ -7704,6 +7519,7 @@ async function executeRunRequest(
 ): Promise<WorkflowRunOutput> {
   installProcessExitTrap();
   const startedAt = nowMs();
+  const workBudgetMeter = createWorkerWorkBudgetMeter({ nowMs });
   recordRunnerPerfTrace({
     req,
     phase: 'runner.execute_start',
@@ -7741,6 +7557,7 @@ async function executeRunRequest(
   const appendRunLogLine = (line: string) => {
     const trimmed = redactSecretsFromLogString(line.trim());
     if (!trimmed) return;
+    workBudgetMeter.count('log');
     totalEmittedLogLines += 1;
     runLogBuffer = [...runLogBuffer, trimmed].slice(-RUN_LOG_BUFFER_LIMIT);
     pendingRunLogLines = [...pendingRunLogLines, trimmed];
@@ -7933,7 +7750,10 @@ async function executeRunRequest(
   const flushTerminalLedgerEvents = async (
     terminalEvent: PlayRunLedgerEvent,
   ): Promise<void> => {
-    if (!options?.persistResultDatasets) return;
+    const shouldPersistTerminalLedger =
+      options?.persistResultDatasets === true ||
+      Boolean(req.playCallGovernance);
+    if (!shouldPersistTerminalLedger) return;
     await ledgerFlushInFlight;
     const now = nowMs();
     dirtyProgressNodeIds = new Set([
@@ -8008,10 +7828,7 @@ async function executeRunRequest(
   stepLifecycle?.markPreDatasetStepsStarted(startedAt);
   flushLedgerEvents(false);
   const runtimeDeadlineMs = nowMs() + STANDARD_PLAY_RUNTIME_LIMIT_MS;
-  // Run-scoped buffer for provider results that billed but whose durable
-  // receipt could not be marked completed even after the retry ladder. On
-  // terminal failure the buffer is built into a size-capped salvage record and
-  // attached to the run.failed ledger event so billed data is never memory-only.
+  const leasedSheetNamespaces = new Set<string>();
   const receiptSalvage = createReceiptSalvageBuffer();
   const ctx = createMinimalWorkerCtx(
     req,
@@ -8020,7 +7837,9 @@ async function executeRunRequest(
     workflowStep,
     abortSignal,
     workerCallbacks,
+    workBudgetMeter,
     runtimeDeadlineMs,
+    leasedSheetNamespaces,
     receiptSalvage,
   );
   // Hard wall-clock cap on active user-code runtime. CF Workflows does not
@@ -8029,15 +7848,18 @@ async function executeRunRequest(
   // token expires. Aborting the controller surfaces cooperatively through the
   // same assertNotAborted checks used for harness cancellation.
   let runtimeLimitExceeded = false;
-  const runtimeDeadlineTimer = setTimeout(
-    () => {
-      runtimeLimitExceeded = true;
-      if (!abortSignal.aborted) {
-        abortController.abort(STANDARD_PLAY_RUNTIME_LIMIT_MESSAGE);
-      }
-    },
-    Math.max(1, runtimeDeadlineMs - nowMs()),
-  );
+  const runtimeDeadlineTimer =
+    workflowStep === undefined || workflowStep === null
+      ? setTimeout(
+          () => {
+            runtimeLimitExceeded = true;
+            if (!abortSignal.aborted) {
+              abortController.abort(STANDARD_PLAY_RUNTIME_LIMIT_MESSAGE);
+            }
+          },
+          Math.max(1, runtimeDeadlineMs - nowMs()),
+        )
+      : null;
   try {
     const playStartedAt = nowMs();
     const result = await (
@@ -8128,7 +7950,6 @@ async function executeRunRequest(
     }
     if (options?.persistResultDatasets) {
       await persistProjectedResultDatasets();
-      const parentSignal = startParentTerminalSignal();
       // Capped runs settle compute billing BEFORE declaring run.completed: a
       // per-run cap denial (422 billing_cap_exceeded) must fail the run as
       // its ONLY terminal. Flushing completed first opens a race — watchers
@@ -8163,6 +7984,7 @@ async function executeRunRequest(
         ms: nowMs() - terminalUpdateStartedAt,
       });
 
+      const parentSignal = startParentTerminalSignal();
       if (!capped) {
         const billingStartedAt = nowMs();
         const billingPromise = finalizeWorkerComputeBilling({
@@ -8190,6 +8012,20 @@ async function executeRunRequest(
         }
       }
       await parentSignal;
+    } else if (req.playCallGovernance) {
+      const childTerminalStartedAt = nowMs();
+      await flushTerminalLedgerEvents({
+        type: 'run.completed',
+        runId: req.runId,
+        source: 'worker',
+        occurredAt: nowMs(),
+        result: terminalResult,
+      });
+      recordRunnerPerfTrace({
+        req,
+        phase: 'runner.child_terminal_ledger_append',
+        ms: nowMs() - childTerminalStartedAt,
+      });
     }
     await startParentTerminalSignal();
     recordRunnerPerfTrace({
@@ -8216,16 +8052,8 @@ async function executeRunRequest(
     stepLifecycle?.markStartedFailed(nowMs());
     // A runtime-limit abort is a timeout failure, not a user cancellation, so
     // it should be reported as run.failed with the limit message rather than
-    // run.cancelled. The deadline can also surface as a WorkflowAbortError
-    // thrown synchronously from the completeReceipt retry ladder BEFORE the
-    // runtimeDeadlineTimer macrotask flips the flag — match the limit message
-    // directly so that race can never misclassify a timeout as a cancel (which
-    // would silently drop the salvage buffer of billed-but-unpersisted rows).
-    const runtimeLimitError =
-      runtimeLimitExceeded ||
-      (error instanceof Error &&
-        error.message === STANDARD_PLAY_RUNTIME_LIMIT_MESSAGE);
-    const aborted = isAbortLikeError(error) && !runtimeLimitError;
+    // run.cancelled.
+    const aborted = isAbortLikeError(error) && !runtimeLimitExceeded;
     if (aborted) {
       // Flip the controller so any concurrent user code observes the abort
       // through ctx.signal. We mark the run cancelled instead of failed.
@@ -8234,19 +8062,28 @@ async function executeRunRequest(
       );
     }
     const failure = normalizePlayRunFailure(error);
-    // Billed-but-unpersisted salvage rides on the run.failed event's `result`.
-    // The run STILL FAILS — salvage is a loud marker, never a success fallback.
+    const message = failure.message;
+    // Controlled run-fatal teardown: release the runtime-sheet row leases and
+    // work-receipt leases this attempt still holds so an immediate rerun is not
+    // blocked for the full lease TTL. Best-effort but LOUD — a release failure
+    // is logged and never masks the original run-fatal error. TTL expiry stays
+    // the recovery path for true crashes (isolate death) where this never runs.
+    await releaseRuntimeLeasesOnTeardown({
+      req,
+      leasedSheetNamespaces,
+      emit: wrappedEmit,
+    });
+    const errorBilling = extractErrorBilling(error);
     const salvage: ReceiptSalvage | null = aborted
       ? null
       : receiptSalvage.build();
-    const message =
+    const terminalMessage =
       salvage && salvage.totalEntries > 0
-        ? `${failure.message} ${receiptSalvageFailureSuffix(salvage)}`
-        : failure.message;
-    const errorBilling = extractErrorBilling(error);
-    if (options?.persistResultDatasets) {
+        ? `${message} ${receiptSalvageFailureSuffix(salvage)}`
+        : message;
+    if (options?.persistResultDatasets || req.playCallGovernance) {
       appendRunLogLine(
-        `${aborted ? '[cancelled]' : '[error]'} ${redactSecretsFromLogString(message)}`,
+        `${aborted ? '[cancelled]' : '[error]'} ${redactSecretsFromLogString(terminalMessage)}`,
       );
       const terminalUpdateStartedAt = nowMs();
       await flushTerminalLedgerEvents({
@@ -8254,64 +8091,70 @@ async function executeRunRequest(
         runId: req.runId,
         source: 'worker',
         occurredAt: nowMs(),
-        error: message,
+        error: terminalMessage,
         result: aborted
           ? undefined
           : {
               success: false,
               status: 'failed',
-              error: message,
+              error: terminalMessage,
+              ...(salvage && salvage.totalEntries > 0 ? { salvage } : {}),
               errors: [
                 {
                   code: failure.code,
                   phase: failure.phase,
-                  message,
+                  message: terminalMessage,
                   retryable: failure.retryable,
                   ...(errorBilling ? { billing: errorBilling } : {}),
                   ...(failure.cause ? { cause: failure.cause } : {}),
                 },
               ],
-              ...(salvage && salvage.totalEntries > 0 ? { salvage } : {}),
             },
       });
       recordRunnerPerfTrace({
         req,
-        phase: aborted
-          ? 'runner.terminal_ledger_append_cancelled'
-          : 'runner.terminal_ledger_append_failed',
+        phase: req.playCallGovernance
+          ? aborted
+            ? 'runner.child_terminal_ledger_append_cancelled'
+            : 'runner.child_terminal_ledger_append_failed'
+          : aborted
+            ? 'runner.terminal_ledger_append_cancelled'
+            : 'runner.terminal_ledger_append_failed',
         ms: nowMs() - terminalUpdateStartedAt,
         extra: {
           errorCode: failure.code,
           errorPhase: failure.phase,
         },
       });
-      const billingStartedAt = nowMs();
-      await finalizeWorkerComputeBilling({
-        req,
-        success: false,
-        actionEstimate: 4,
-      })
-        .catch((finalizeError) => {
-          console.error(
-            `[play-harness] non-fatal compute billing finalize failed runId=${req.runId}: ${
-              finalizeError instanceof Error
-                ? finalizeError.message
-                : String(finalizeError)
-            }`,
-          );
+      if (options?.persistResultDatasets) {
+        const billingStartedAt = nowMs();
+        await finalizeWorkerComputeBilling({
+          req,
+          success: false,
+          actionEstimate: 4,
         })
-        .finally(() => {
-          recordRunnerPerfTrace({
-            req,
-            phase: 'runner.compute_billing_finalize_failed',
-            ms: nowMs() - billingStartedAt,
+          .catch((finalizeError) => {
+            console.error(
+              `[play-harness] non-fatal compute billing finalize failed runId=${req.runId}: ${
+                finalizeError instanceof Error
+                  ? finalizeError.message
+                  : String(finalizeError)
+              }`,
+            );
+          })
+          .finally(() => {
+            recordRunnerPerfTrace({
+              req,
+              phase: 'runner.compute_billing_finalize_failed',
+              ms: nowMs() - billingStartedAt,
+            });
           });
-        });
+      }
     }
     await signalParentPlayTerminal({
       req,
       status: aborted ? 'cancelled' : 'failed',
-      error: message,
+      error: terminalMessage,
     }).catch(() => null);
     recordRunnerPerfTrace({
       req,
@@ -8325,7 +8168,9 @@ async function executeRunRequest(
     await drainRunnerPerfTraces(req);
     throw error;
   } finally {
-    clearTimeout(runtimeDeadlineTimer);
+    if (runtimeDeadlineTimer) {
+      clearTimeout(runtimeDeadlineTimer);
+    }
   }
 }
 
@@ -8417,10 +8262,12 @@ function runRequestFromWorkflowParams(
     orgId: String(params.orgId ?? ''),
     playName: String(params.playName ?? ''),
     userEmail: typeof params.userEmail === 'string' ? params.userEmail : null,
+    force: params.force === true,
+    forceToolRefresh: params.forceToolRefresh === true,
+    runAttempt: normalizeWorkerRunAttempt(params.runAttempt),
     runtimeInput: isRecord(params.input)
       ? (params.input as Record<string, unknown>)
       : {},
-    force: params.forceToolRefresh === true,
     inlineCsv: isInlineCsv(params.inlineCsv) ? params.inlineCsv : null,
     inputFiles:
       inputFile && inputStorageKey
@@ -8478,6 +8325,14 @@ function runRequestFromWorkflowParams(
       params.coordinatorInternalToken.trim()
         ? params.coordinatorInternalToken.trim()
         : null,
+    runtimeTestFaultHeader:
+      typeof params.runtimeTestFaultHeader === 'string' &&
+      params.runtimeTestFaultHeader.trim()
+        ? params.runtimeTestFaultHeader.trim()
+        : null,
+    testPolicyOverrides: normalizeRuntimeTestPolicyOverrides(
+      params.testPolicyOverrides,
+    ),
     totalRows:
       typeof params.totalRows === 'number' && Number.isFinite(params.totalRows)
         ? params.totalRows
@@ -8547,6 +8402,7 @@ async function persistResultDatasets(
         rows: chunk.map((row) => ({ ...row })),
         runId: req.runId,
         inputOffset,
+        attemptLeaseTtlMs: runtimeSheetAttemptLeaseTtlMs(req),
         userEmail: req.userEmail,
         preloadedDbSessions: req.preloadedDbSessions ?? null,
       });
@@ -8583,6 +8439,7 @@ async function persistResultDatasets(
       rows: dataset.rows,
       runId: req.runId,
       inputOffset: 0,
+      attemptLeaseTtlMs: runtimeSheetAttemptLeaseTtlMs(req),
       userEmail: req.userEmail,
     });
   }
@@ -8864,7 +8721,7 @@ export class TenantWorkflow extends WorkflowEntrypoint<
         try {
           const response = await fetchRuntimeApi(
             req.baseUrl,
-            '/api/v2/plays/internal/runtime',
+            '/api/v2/internal/play-runtime',
             {
               method: 'POST',
               headers: {