deepline 0.1.182 → 0.1.184

package/dist/bundling-sources/shared_libs/play-runtime/runtime-api.ts

@@ -1,4 +1,4 @@
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import {
   createRuntimePool,
   createRuntimeOneShotQueryClient,
@@ -55,12 +55,28 @@ import {
   isReusableWorkReceipt,
   type WorkReceipt,
   type WorkReceiptClaim,
+  workReceiptFailureKindCode,
+  workReceiptFailureKindFromCode,
+  type WorkReceiptFailureKind,
 } from './work-receipts';
 import {
   sanitizePostgresJsonValue,
   stringifyPostgresJson,
 } from './postgres-json';
 import { RECEIPT_STATUS_CODE, receiptStatusFromCode } from './receipt-status';
+import {
+  workReceiptClaimableStatusCodes,
+  workReceiptClaimConflictPredicateSql,
+  workReceiptHeartbeatPredicateSql,
+  workReceiptReleaseOwnerPredicateSql,
+  workReceiptRunningOwnerPredicateSql,
+} from './receipt-sql';
+import {
+  activeRuntimeSheetAttemptFenceSql,
+  newerTerminalRuntimeSheetRowSql,
+  releasableRuntimeSheetAttemptFenceSql,
+  sameOwnerTerminalAttemptEpochSql,
+} from './sheet-attempt-sql';
 import type { MapRowOutcome } from './durability-store';
 import {
   normalizeRuntimeMapInputIndex,
@@ -75,6 +91,20 @@ import {
 } from './map-row-outcome';
 import { DEEPLINE_CELL_META_FIELD } from './cell-staleness';
 import type { PlayArtifactKind } from './backend';
+import {
+  PLAY_RUNTIME_CONTRACT,
+  PLAY_RUNTIME_CONTRACT_HEADER,
+} from './runtime-contract';
+import { PLAY_RUNTIME_API_COMPAT_PATH } from './runtime-api-paths';
+import {
+  PLAY_RUNTIME_SHEET_ATTEMPT_LEASE_TTL_MS,
+  PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
+} from './lease-policy';
+import {
+  parseRuntimeTestFaultCounts,
+  PLAY_RUNTIME_TEST_FAULT_HEADER,
+  type RuntimeTestFaultName,
+} from './test-runtime-seams';
 
 type RuntimeApiContext = {
   baseUrl?: string | null;
@@ -87,10 +117,133 @@ type RuntimeApiContext = {
   dbSessionStrategy?: 'preloaded' | 'sandbox_public_key' | null;
   preloadedDbSessions?: PreloadedRuntimeDbSession[] | null;
   vercelProtectionBypassToken?: string | null;
+  runtimeTestFaultHeader?: string | null;
   disablePostgresPoolCache?: boolean | null;
   postgresSessionUnwrapKey?: string | null;
 };
 
+type DirectRuntimeTestFaultState = {
+  headerValue: string;
+  counts: Partial<Record<RuntimeTestFaultName, number>>;
+};
+
+const directRuntimeTestFaults = new Map<string, DirectRuntimeTestFaultState>();
+
+function consumeDirectRuntimeTestFault(input: {
+  context: RuntimeApiContext;
+  runId: string;
+  name: RuntimeTestFaultName;
+}): boolean {
+  const headerValue = input.context.runtimeTestFaultHeader?.trim();
+  if (!headerValue) return false;
+  const stateKey = input.runId.trim();
+  if (!stateKey) return false;
+  let state = directRuntimeTestFaults.get(stateKey);
+  if (!state || state.headerValue !== headerValue) {
+    const parsed = parseRuntimeTestFaultCounts({
+      headerValue,
+      syntheticRunHeader: '1',
+    });
+    if (parsed.ok === false) {
+      throw new Error(parsed.error);
+    }
+    state = {
+      headerValue,
+      counts:
+        (parsed.counts as Partial<Record<RuntimeTestFaultName, number>>) ?? {},
+    };
+    directRuntimeTestFaults.set(stateKey, state);
+  }
+  const count = state.counts[input.name] ?? 0;
+  if (count <= 0) return false;
+  if (count === 1) {
+    delete state.counts[input.name];
+  } else {
+    state.counts[input.name] = count - 1;
+  }
+  state.headerValue = headerValue;
+  directRuntimeTestFaults.set(stateKey, state);
+  return true;
+}
+
+function runtimeTestFaultError(name: RuntimeTestFaultName): Error {
+  const error = new Error(`Injected runtime test fault: ${name}.`);
+  if (
+    name === 'receipt_complete_write_fail' ||
+    name === 'receipt_fail_write_fail'
+  ) {
+    error.name = 'RuntimeReceiptPersistenceError';
+  }
+  return error;
+}
+
+async function forceFailRuntimeWorkReceiptForRuntimeTestFault(
+  context: RuntimeApiContext,
+  input: {
+    playName: string;
+    runId: string;
+    key: string;
+    error: string;
+    failureKind: WorkReceiptFailureKind;
+    runAttempt?: number | null;
+  },
+): Promise<WorkReceipt | null> {
+  const runAttempt = normalizeRuntimeRunAttempt(input.runAttempt);
+  const session = await getRuntimeWorkReceiptSession(context, {
+    playName: input.playName,
+    key: input.key,
+  });
+  return await withRuntimeWorkReceiptClient(
+    context,
+    session,
+    async (client) => {
+      const { rows } = await client.query<Record<string, unknown>>(
+        `
+        WITH failed AS (
+          UPDATE ${workReceiptTable(session)}
+             SET status = $2::smallint,
+                 output = NULL,
+                 error = $3,
+                 failure_kind = $5::smallint,
+                 lease_id = NULL,
+                 lease_owner_run_id = NULL,
+                 lease_owner_attempt = NULL,
+                 lease_expires_at = NULL,
+                 updated_at = now()
+           WHERE k = decode($1, 'hex')
+             AND run_id = $4
+             AND COALESCE(lease_owner_attempt, 0) = $7::integer
+             AND status <> $6::smallint
+          RETURNING convert_from(k, 'UTF8') AS k,
+                    status,
+                    output,
+                    error,
+                    failure_kind,
+                    run_id,
+                    lease_id,
+                    lease_owner_run_id,
+                    lease_owner_attempt,
+                    lease_expires_at,
+                    updated_at
+        )
+        SELECT k, status, output, error, failure_kind, run_id, lease_id, lease_owner_run_id, lease_owner_attempt, lease_expires_at, updated_at
+          FROM failed
+      `,
+        [
+          workReceiptKeyHex(input.key),
+          RECEIPT_STATUS_FAILED,
+          input.error,
+          input.runId,
+          workReceiptFailureKindCode(input.failureKind),
+          RECEIPT_STATUS_COMPLETED,
+          runAttempt,
+        ],
+      );
+      return rows[0] ? mapRuntimeWorkReceiptRow(rows[0]) : null;
+    },
+  );
+}
+
 type DbSessionCacheEntry = {
   session: CreateDbSessionResponse;
 };
@@ -101,6 +254,11 @@ type RuntimeDatasetRowEntry = {
   row: Record<string, unknown>;
   inputIndex: number;
 };
+type RuntimeSheetPrepareDisposition = 'pending' | 'completed' | 'blocked';
+type RuntimeSheetPreparedRowDisposition = {
+  key: string;
+  disposition: RuntimeSheetPrepareDisposition;
+};
 const dbSessionCache = new Map<string, DbSessionCacheEntry>();
 const dbSessionInFlight = new Map<string, Promise<CreateDbSessionResponse>>();
 const postgresPools = new Map<string, RuntimePool>();
@@ -119,6 +277,23 @@ const APPEND_KEY_SUFFIX_LENGTH = 12;
 // 60-min alignment fixed. A shorter TTL only causes periodic re-mints (cheap;
 // the tenant runtime role is long-lived), not run failures.
 const RUNTIME_DB_SESSION_TTL_SECONDS = 10 * 60;
+const RUNTIME_WORK_RECEIPT_LEASE_COLUMNS = [
+  'lease_id',
+  'lease_owner_run_id',
+  'lease_owner_attempt',
+  'lease_expires_at',
+] as const;
+const RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN = 'failure_kind';
+const RUNTIME_WORK_RECEIPT_SELF_HEAL_COLUMNS = [
+  ...RUNTIME_WORK_RECEIPT_LEASE_COLUMNS,
+  RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN,
+] as const;
+const RUNTIME_SHEET_ATTEMPT_COLUMNS = [
+  '_attempt_id',
+  '_attempt_owner_run_id',
+  '_attempt_seq',
+  '_attempt_expires_at',
+] as const;
 const RUNTIME_SHEET_ENSURE_CACHE_TTL_MS = 10 * 60_000;
 const RUNTIME_SHEET_READY_AFTER_ENSURE_RETRY_DELAYS_MS = [
   100, 250, 500, 1_000, 2_000,
@@ -178,8 +353,13 @@ export type PrepareRuntimeSheetResult = {
   skipped: number;
   pendingRows: Record<string, unknown>[];
   completedRows: Record<string, unknown>[];
+  blockedRows: Record<string, unknown>[];
   tableNamespace: string;
   timings?: RuntimeSheetTiming[];
+  attemptId?: string;
+  attemptOwnerRunId?: string;
+  attemptExpiresAt?: string;
+  attemptSeq?: number;
 };
 
 export type RuntimeSheetTiming = {
@@ -197,6 +377,22 @@ export type RuntimeSheetTiming = {
   error?: string;
 };
 
+export type RuntimeSheetAttemptHeartbeatResult = {
+  renewed: number;
+  renewedKeys: string[];
+  attemptExpiresAt: string | null;
+};
+
+export type RuntimeSheetAttemptReleaseResult = {
+  released: number;
+  releasedKeys: string[];
+};
+
+export type RuntimeWorkReceiptReleaseResult = {
+  released: number;
+  releasedKeys: string[];
+};
+
 type RuntimeApiActionRequest =
   | {
       action: 'resolve_play';
@@ -261,7 +457,7 @@ function resolveRuntimeApiUrl(context: RuntimeApiContext): string {
     throw new Error('Runner runtime API requires a baseUrl.');
   }
   const url = new URL(
-    `${baseUrl.replace(/\/$/, '')}/api/v2/plays/internal/runtime`,
+    `${baseUrl.replace(/\/$/, '')}${PLAY_RUNTIME_API_COMPAT_PATH}`,
   );
   const bypassToken = context.vercelProtectionBypassToken?.trim();
   if (bypassToken) {
@@ -282,9 +478,16 @@ function resolveRuntimeApiHeaders(
   return {
     'content-type': 'application/json',
     authorization: `Bearer ${token}`,
+    [PLAY_RUNTIME_CONTRACT_HEADER]: String(PLAY_RUNTIME_CONTRACT),
     ...(context.vercelProtectionBypassToken
       ? { 'x-vercel-protection-bypass': context.vercelProtectionBypassToken }
       : {}),
+    ...(context.runtimeTestFaultHeader?.trim()
+      ? {
+          [PLAY_RUNTIME_TEST_FAULT_HEADER]:
+            context.runtimeTestFaultHeader.trim(),
+        }
+      : {}),
     ...(vercelProtectionCookie ? { cookie: vercelProtectionCookie } : {}),
   };
 }
@@ -516,20 +719,36 @@ async function isRuntimeSheetSchemaReady(
     physicalColumns.length > 0
       ? physicalColumns.map(quoteIdentifier).join(', ')
       : '1';
-  const query = async (client: RuntimeQueryClient): Promise<void> => {
+  const query = async (client: RuntimeQueryClient): Promise<boolean> => {
     await client.query(
       `SELECT ${selectList}
        FROM ${sheetTable(session)}
        LIMIT 0`,
     );
+    const attemptColumns = await client.query<Record<string, unknown>>(
+      `
+        SELECT count(*)::int AS present_count
+        FROM information_schema.columns
+        WHERE table_schema = $1
+          AND table_name = $2
+          AND column_name = ANY($3::text[])
+      `,
+      [
+        session.postgres.schema,
+        session.postgres.sheetTable,
+        [...RUNTIME_SHEET_ATTEMPT_COLUMNS],
+      ],
+    );
+    return (
+      Number(attemptColumns.rows[0]?.present_count ?? 0) ===
+      RUNTIME_SHEET_ATTEMPT_COLUMNS.length
+    );
   };
   try {
     if (isRuntimeOneShotQueryFactoryRegistered()) {
-      await withRuntimeOneShotPostgres(session, query);
-    } else {
-      await withRuntimePostgres(session, query);
+      return await withRuntimeOneShotPostgres(session, query);
     }
-    return true;
+    return await withRuntimePostgres(session, query);
   } catch (error) {
     if (isMissingRelationError(error)) {
       return false;
@@ -1530,6 +1749,10 @@ function workReceiptKeyHex(key: string): string {
   ).join('');
 }
 
+function newRuntimeWorkReceiptLeaseId(): string {
+  return `receipt-lease:${randomUUID()}`;
+}
+
 function validateRuntimeWorkReceiptKeyScope(
   session: RuntimePostgresSession,
   input: { key: string },
@@ -1548,22 +1771,86 @@ function validateRuntimeWorkReceiptKeyScope(
 }
 
 function mapRuntimeWorkReceiptRow(raw: Record<string, unknown>): WorkReceipt {
+  const leaseExpiresAt = raw.lease_expires_at;
   return {
     key: String(raw.k ?? ''),
     status: receiptStatusFromCode(raw.status),
     output: raw.output == null ? null : raw.output,
     error: raw.error == null ? null : String(raw.error),
+    failureKind: workReceiptFailureKindFromCode(raw.failure_kind),
     runId: raw.run_id == null ? null : String(raw.run_id),
+    leaseId: raw.lease_id == null ? null : String(raw.lease_id),
+    leaseOwnerRunId:
+      raw.lease_owner_run_id == null ? null : String(raw.lease_owner_run_id),
+    leaseOwnerAttempt:
+      raw.lease_owner_attempt == null ||
+      !Number.isFinite(Number(raw.lease_owner_attempt))
+        ? null
+        : Number(raw.lease_owner_attempt),
+    leaseExpiresAt:
+      leaseExpiresAt instanceof Date
+        ? leaseExpiresAt.toISOString()
+        : leaseExpiresAt == null
+          ? null
+          : String(leaseExpiresAt),
     updatedAt: raw.updated_at == null ? null : String(raw.updated_at),
   };
 }
 
+function isMissingRuntimeWorkReceiptSelfHealColumnError(
+  error: unknown,
+): boolean {
+  if (!error || typeof error !== 'object') {
+    return false;
+  }
+  const code = 'code' in error ? String(error.code) : '';
+  const message = 'message' in error ? String(error.message) : '';
+  if (code !== '42703' && !/column .* does not exist/i.test(message)) {
+    return false;
+  }
+  return RUNTIME_WORK_RECEIPT_SELF_HEAL_COLUMNS.some((column) =>
+    message.includes(column),
+  );
+}
+
 function runtimeWorkReceiptEnsureCacheKey(
   session: RuntimePostgresSession,
 ): string {
   return `${postgresUrlCacheKey(session.postgresUrl)}::${session.postgres.schema}::${session.postgres.receiptTable ?? RUNTIME_WORK_RECEIPT_POSTGRES_TABLE}`;
 }
 
+async function missingRuntimeWorkReceiptSelfHealColumns(
+  session: RuntimePostgresSession,
+  client: RuntimeQueryClient,
+): Promise<string[]> {
+  const result = await client.query(
+    `
+      SELECT column_name
+      FROM information_schema.columns
+      WHERE table_schema = $1
+        AND table_name = $2
+        AND column_name = ANY($3::text[])
+    `,
+    [
+      session.postgres.schema,
+      session.postgres.receiptTable ?? RUNTIME_WORK_RECEIPT_POSTGRES_TABLE,
+      [...RUNTIME_WORK_RECEIPT_SELF_HEAL_COLUMNS],
+    ],
+  );
+  const present = new Set(
+    result.rows.map((row) => String(row.column_name ?? '')),
+  );
+  return RUNTIME_WORK_RECEIPT_SELF_HEAL_COLUMNS.filter(
+    (column) => !present.has(column),
+  );
+}
+
+// COMPAT / SELF-HEAL — owner: runtime. Removal milestone: execution-ledger
+// cutover M1 (docs/play-runtime-execution-ledger-plan.md). The customer-Neon
+// work-receipt table (lease columns + failure_kind) is the dying surface. The
+// F2 rolling migration (scripts/migrate-play-runtime-storage.ts) backfills these
+// columns; this lazy CREATE/ALTER self-heal is a compat-window safety net and is
+// deleted together with the Neon receipt path at M1.
 async function ensureRuntimeWorkReceiptTable(
   session: RuntimePostgresSession,
   client: RuntimeQueryClient,
@@ -1582,11 +1869,39 @@ async function ensureRuntimeWorkReceiptTable(
       status smallint NOT NULL DEFAULT 0,
       output jsonb,
       error text,
+      failure_kind smallint NOT NULL DEFAULT 0,
       run_id text,
+      lease_id text,
+      lease_owner_run_id text,
+      lease_owner_attempt integer,
+      lease_expires_at timestamptz,
       updated_at timestamptz NOT NULL DEFAULT now()
     )
   `,
     )
+    .then(async () => {
+      const missingColumns = await missingRuntimeWorkReceiptSelfHealColumns(
+        session,
+        client,
+      );
+      if (missingColumns.length === 0) return;
+      await client.query(`
+        ALTER TABLE ${workReceiptTable(session)}
+          ${missingColumns
+            .map((column) => {
+              const type =
+                column === 'lease_expires_at'
+                  ? 'timestamptz'
+                  : column === 'lease_owner_attempt'
+                    ? 'integer'
+                    : column === RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN
+                      ? 'smallint NOT NULL DEFAULT 0'
+                      : 'text';
+              return `ADD COLUMN IF NOT EXISTS ${column} ${type}`;
+            })
+            .join(',\n          ')}
+      `);
+    })
     .then(() => undefined);
   runtimeWorkReceiptEnsureCache.set(cacheKey, promise);
   try {
@@ -1612,11 +1927,26 @@ async function withRuntimeWorkReceiptClient<T>(
     try {
       return await operation(client);
     } catch (error) {
-      if (isMissingRelationError(error)) {
+      if (
+        isMissingRelationError(error) ||
+        isMissingRuntimeWorkReceiptSelfHealColumnError(error)
+      ) {
         runtimeWorkReceiptEnsureCache.delete(
           runtimeWorkReceiptEnsureCacheKey(session),
         );
-        await ensureRuntimeWorkReceiptTable(session, client);
+        try {
+          await ensureRuntimeWorkReceiptTable(session, client);
+        } catch (ensureError) {
+          if (!isPostgresPermissionDeniedError(ensureError)) {
+            throw ensureError;
+          }
+          runtimeWorkReceiptEnsureCache.delete(
+            runtimeWorkReceiptEnsureCacheKey(session),
+          );
+          await repairRuntimeStorageGrants(context, {
+            playName: context.playName?.trim() || session.playName,
+          });
+        }
       } else if (isPostgresPermissionDeniedError(error)) {
         await repairRuntimeStorageGrants(context, {
           playName: context.playName?.trim() || session.playName,
@@ -1715,6 +2045,10 @@ function isSystemSheetColumn(columnName: string): boolean {
     case '_stage':
     case '_provider':
     case '_input_index':
+    case '_attempt_id':
+    case '_attempt_owner_run_id':
+    case '_attempt_expires_at':
+    case '_attempt_seq':
     case '_created_at':
     case '_updated_at':
     case '_version':
@@ -1732,6 +2066,64 @@ function isSystemSheetColumn(columnName: string): boolean {
   }
 }
 
+function normalizeRuntimeSheetAttemptId(
+  value: string | null | undefined,
+): string {
+  const trimmed = value?.trim();
+  return trimmed || `sheet-attempt:${randomUUID()}`;
+}
+
+function normalizeRuntimeSheetAttemptOwnerRunId(input: {
+  attemptOwnerRunId?: string | null;
+  runId: string;
+}): string {
+  return input.attemptOwnerRunId?.trim() || input.runId;
+}
+
+function normalizeRuntimeRunAttempt(value: number | null | undefined): number {
+  if (typeof value !== 'number' || !Number.isFinite(value)) return 0;
+  return Math.max(0, Math.floor(value));
+}
+
+function normalizeRuntimeLeaseTtlMs(
+  value: number | null | undefined,
+  fallback: number,
+): number {
+  if (
+    typeof value !== 'number' ||
+    !Number.isFinite(value) ||
+    !Number.isInteger(value) ||
+    value <= 0
+  ) {
+    return fallback;
+  }
+  return value;
+}
+
+async function mintRuntimeSheetAttemptExpiresAt(
+  client: RuntimeQueryClient,
+  leaseTtlMs?: number | null,
+): Promise<string> {
+  const ttlMs = normalizeRuntimeLeaseTtlMs(
+    leaseTtlMs,
+    PLAY_RUNTIME_SHEET_ATTEMPT_LEASE_TTL_MS,
+  );
+  const { rows } = await client.query<{ attempt_expires_at: Date | string }>(
+    `
+      SELECT now() + ($1::double precision * interval '1 millisecond') AS attempt_expires_at
+    `,
+    [ttlMs],
+  );
+  const value = rows[0]?.attempt_expires_at;
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  if (typeof value === 'string' && value.trim()) {
+    return new Date(value).toISOString();
+  }
+  throw new Error('Runtime sheet attempt expiry mint did not return a value.');
+}
+
 function parseRuntimeCellMeta(value: unknown): Record<string, unknown> {
   if (value && typeof value === 'object' && !Array.isArray(value)) {
     return value as Record<string, unknown>;
@@ -2228,6 +2620,10 @@ async function prepareRuntimeSheetDatasetRows(
     runId: string;
     normalizedPlayName: string;
     normalizedTableNamespace: string;
+    attemptId: string;
+    attemptOwnerRunId: string;
+    attemptExpiresAt: string;
+    attemptSeq: number;
     physicalInsertColumnsSql: string;
     physicalInsertValuesSql: string;
     physicalRefreshSetSql: string;
@@ -2235,9 +2631,12 @@ async function prepareRuntimeSheetDatasetRows(
     outputPhysicalColumns: PhysicalSheetColumnProjection[];
     force?: boolean;
   },
-): Promise<{ inserted: number; pendingKeys: string[] }> {
+): Promise<{
+  inserted: number;
+  rowDispositions: RuntimeSheetPreparedRowDisposition[];
+}> {
   let inserted = 0;
-  const pendingKeys: string[] = [];
+  const rowDispositions: RuntimeSheetPreparedRowDisposition[] = [];
   for (const chunk of input.chunks) {
     const chunkKeys = chunk.map((entry) => entry.key);
     const chunkPayloads = chunk.map((entry) =>
@@ -2252,6 +2651,41 @@ async function prepareRuntimeSheetDatasetRows(
       'target',
       input.outputPhysicalColumns,
     );
+    const targetAttemptFenceSql = activeRuntimeSheetAttemptFenceSql(
+      'target',
+      '$7::text',
+      '$8::text',
+      '$9::timestamptz',
+      '$10::integer',
+    );
+    const existingAttemptFenceSql = activeRuntimeSheetAttemptFenceSql(
+      'existing',
+      '$7::text',
+      '$8::text',
+      '$9::timestamptz',
+      '$10::integer',
+    );
+    const targetNewerTerminalRowSql = newerTerminalRuntimeSheetRowSql(
+      'target',
+      '$9::timestamptz',
+      '$10::integer',
+      '$7::text',
+      '$8::text',
+    );
+    const existingNewerTerminalRowSql = newerTerminalRuntimeSheetRowSql(
+      'existing',
+      '$9::timestamptz',
+      '$10::integer',
+      '$7::text',
+      '$8::text',
+    );
+    const existingWritableEnrichedAttemptSql =
+      writableEnrichedRuntimeSheetAttemptSql(
+        'existing',
+        '$8::text',
+        '$9::timestamptz',
+        '$10',
+      );
     const { rows } = await client.query(
       `
        WITH input_rows AS (
@@ -2273,19 +2707,38 @@ async function prepareRuntimeSheetDatasetRows(
           WHERE target._key = input_rows._key
             AND target._status <> 'stale'
             AND (
-              $7::boolean
+              NOT (${targetNewerTerminalRowSql})
+              OR (
+                $11::boolean
+                AND target._status = 'enriched'
+                AND COALESCE(target._attempt_seq, 0) <= $10::integer
+              )
+            )
+            AND (
+              ${targetAttemptFenceSql}
+              OR (
+                $11::boolean
+                AND target._status = 'enriched'
+              )
+            )
+            AND (
+              $11::boolean
               OR target._input_index IS DISTINCT FROM input_rows._input_index
             )
           RETURNING target._key
         ),
         inserted_rows AS (
-          INSERT INTO ${sheetTable(session)} (_key, _status, _run_id, _input_index${input.physicalInsertColumnsSql})
-          SELECT _key, 'pending', $4::text, _input_index${input.physicalInsertValuesSql}
+          INSERT INTO ${sheetTable(session)} (_key, _status, _run_id, _input_index, _attempt_id, _attempt_owner_run_id, _attempt_expires_at, _attempt_seq${input.physicalInsertColumnsSql})
+          SELECT _key, 'pending', $4::text, _input_index, $7::text, $8::text, $9::timestamptz, $10::integer${input.physicalInsertValuesSql}
           FROM input_rows
           ON CONFLICT (_key) DO UPDATE SET
             _status = 'pending',
             _run_id = EXCLUDED._run_id,
             _input_index = EXCLUDED._input_index,
+            _attempt_id = EXCLUDED._attempt_id,
+            _attempt_owner_run_id = EXCLUDED._attempt_owner_run_id,
+            _attempt_expires_at = EXCLUDED._attempt_expires_at,
+            _attempt_seq = EXCLUDED._attempt_seq,
             _updated_at = now(),
             _version = ${nextRuntimeSheetVersionExpression(session)}${input.physicalUpsertSetSql}
           WHERE ${sheetTable(session)}._status = 'stale'
@@ -2296,26 +2749,42 @@ async function prepareRuntimeSheetDatasetRows(
           SET _status = 'pending',
               _run_id = $4::text,
               _input_index = input_rows._input_index,
+              _attempt_id = $7::text,
+              _attempt_owner_run_id = $8::text,
+              _attempt_expires_at = $9::timestamptz,
+              _attempt_seq = $10::integer,
               _updated_at = now(),
               _version = ${nextRuntimeSheetVersionExpression(session)}
           FROM input_rows
           WHERE target._key = input_rows._key
             AND target._status = 'enriched'
             AND (${targetMissingOutputSql})
+            AND COALESCE(target._attempt_seq, 0) <= $10::integer
           RETURNING target._key
         ),
         claimed_existing_rows AS (
           UPDATE ${sheetTable(session)} AS target
           SET _run_id = $4::text,
               _input_index = input_rows._input_index,
+              _attempt_id = $7::text,
+              _attempt_owner_run_id = $8::text,
+              _attempt_expires_at = $9::timestamptz,
+              _attempt_seq = $10::integer,
               _updated_at = now(),
               _version = ${nextRuntimeSheetVersionExpression(session)}
           FROM input_rows
           WHERE target._key = input_rows._key
             AND target._status IN ('pending', 'running', 'failed')
+            AND NOT (${targetNewerTerminalRowSql})
+	            AND (
+	              target._status = 'failed'
+	              OR ${targetAttemptFenceSql}
+	            )
             AND (
               target._run_id IS DISTINCT FROM $4::text
               OR target._input_index IS DISTINCT FROM input_rows._input_index
+              OR target._attempt_id IS DISTINCT FROM $7::text
+              OR COALESCE(target._attempt_seq, 0) IS DISTINCT FROM $10::integer
             )
           RETURNING target._key
         ),
@@ -2329,15 +2798,61 @@ async function prepareRuntimeSheetDatasetRows(
           SELECT _key
           FROM claimed_existing_rows
           UNION
+          SELECT _key
+          FROM existing_rows
+          WHERE $11::boolean
+          UNION
           SELECT existing._key
           FROM ${sheetTable(session)} AS existing
           JOIN input_rows ON input_rows._key = existing._key
-          WHERE existing._status IN ('pending', 'running', 'failed')
+          WHERE (
+               existing._status IN ('pending', 'running', 'failed')
+               AND NOT (${existingNewerTerminalRowSql})
+	               AND (
+	                 existing._status = 'failed'
+	                 OR ${existingAttemptFenceSql}
+	               )
+             )
              OR (
                existing._status = 'enriched'
                AND (${existingMissingOutputSql})
+               AND (
+                 ${existingAttemptFenceSql}
+                 OR ${existingWritableEnrichedAttemptSql}
+               )
              )
         ),
+        completed_rows AS (
+          SELECT existing._key
+          FROM ${sheetTable(session)} AS existing
+          JOIN input_rows ON input_rows._key = existing._key
+          WHERE existing._status = 'enriched'
+            AND NOT ($11::boolean)
+            AND NOT (${existingMissingOutputSql})
+            AND NOT EXISTS (
+              SELECT 1 FROM pending_rows WHERE pending_rows._key = existing._key
+            )
+        ),
+        blocked_rows AS (
+          SELECT input_rows._key
+          FROM input_rows
+          WHERE NOT EXISTS (
+            SELECT 1 FROM pending_rows WHERE pending_rows._key = input_rows._key
+          )
+            AND NOT EXISTS (
+              SELECT 1 FROM completed_rows WHERE completed_rows._key = input_rows._key
+            )
+        ),
+        row_dispositions AS (
+          SELECT _key, 'pending'::text AS disposition
+          FROM pending_rows
+          UNION ALL
+          SELECT _key, 'completed'::text AS disposition
+          FROM completed_rows
+          UNION ALL
+          SELECT _key, 'blocked'::text AS disposition
+          FROM blocked_rows
+        ),
         inserted_count_cte AS (
           SELECT count(*)::bigint AS c FROM inserted_rows
         ),
@@ -2377,7 +2892,13 @@ async function prepareRuntimeSheetDatasetRows(
         )
         SELECT
           (SELECT c::int FROM inserted_count_cte) AS inserted_count,
-          coalesce((SELECT array_agg(_key) FROM pending_rows), '{}'::text[]) AS pending_keys,
+          coalesce(
+            (
+              SELECT jsonb_agg(jsonb_build_object('key', _key, 'disposition', disposition))
+              FROM row_dispositions
+            ),
+            '[]'::jsonb
+          ) AS row_dispositions,
           (SELECT count(*)::int FROM existing_rows) AS reordered_count,
           (SELECT c::int FROM missing_output_count_cte) AS missing_output_count
       `,
@@ -2388,15 +2909,30 @@ async function prepareRuntimeSheetDatasetRows(
         input.runId,
         input.normalizedPlayName,
         input.normalizedTableNamespace,
+        input.attemptId,
+        input.attemptOwnerRunId,
+        input.attemptExpiresAt,
+        input.attemptSeq,
         input.force === true,
       ],
     );
     inserted += Number(rows[0]?.inserted_count ?? 0);
-    if (Array.isArray(rows[0]?.pending_keys)) {
-      pendingKeys.push(...(rows[0]?.pending_keys as string[]));
+    if (Array.isArray(rows[0]?.row_dispositions)) {
+      for (const row of rows[0]
+        ?.row_dispositions as RuntimeSheetPreparedRowDisposition[]) {
+        if (
+          row &&
+          typeof row.key === 'string' &&
+          (row.disposition === 'pending' ||
+            row.disposition === 'completed' ||
+            row.disposition === 'blocked')
+        ) {
+          rowDispositions.push(row);
+        }
+      }
     }
   }
-  return { inserted, pendingKeys };
+  return { inserted, rowDispositions };
 }
 
 async function buildRuntimeSheetDatasetStartResult(
@@ -2410,8 +2946,12 @@ async function buildRuntimeSheetDatasetStartResult(
     normalizedPlayName: string;
     normalizedTableNamespace: string;
     runId: string;
+    attemptId: string;
+    attemptOwnerRunId: string;
+    attemptExpiresAt: string;
+    attemptSeq: number;
     inserted: number;
-    pendingKeys: string[];
+    rowDispositions: RuntimeSheetPreparedRowDisposition[];
     force?: boolean;
     timings?: RuntimeSheetTiming[];
   },
@@ -2421,19 +2961,20 @@ async function buildRuntimeSheetDatasetStartResult(
       ? [column.field]
       : [],
   );
-  const buildFreshPendingRows = () => {
-    return input.rowEntries.map((entry) => {
-      const row: Record<string, unknown> = {
-        ...sanitizePostgresJsonValue(entry.row),
-        __deeplineRowKey: entry.key,
-      };
-      for (const field of datasetFields) {
-        if (!Object.prototype.hasOwnProperty.call(row, field)) {
-          row[field] = null;
-        }
+  const buildFreshRow = (entry: RuntimeDatasetRowEntry) => {
+    const row: Record<string, unknown> = {
+      ...sanitizePostgresJsonValue(entry.row),
+      __deeplineRowKey: entry.key,
+    };
+    for (const field of datasetFields) {
+      if (!Object.prototype.hasOwnProperty.call(row, field)) {
+        row[field] = null;
       }
-      return row;
-    });
+    }
+    return row;
+  };
+  const buildFreshPendingRows = (entries = input.rowEntries) => {
+    return entries.map(buildFreshRow);
   };
 
   if (input.inserted === input.rowEntries.length) {
@@ -2442,18 +2983,31 @@ async function buildRuntimeSheetDatasetStartResult(
       skipped: input.sourceRowsLength - input.rowEntries.length,
       pendingRows: buildFreshPendingRows(),
       completedRows: [],
+      blockedRows: [],
       tableNamespace: input.tableNamespace,
     };
   }
 
-  const pendingKeys = new Set(input.pendingKeys);
+  const dispositionsByKey = new Map(
+    input.rowDispositions.map((row) => [row.key, row.disposition]),
+  );
+  const pendingKeys = new Set(
+    input.rowDispositions.flatMap((row) =>
+      row.disposition === 'pending' ? [row.key] : [],
+    ),
+  );
   const startedAt = Date.now();
   await markRuntimeRowsPendingForRecompute(client, session, {
     keys: [...pendingKeys],
     runId: input.runId,
+    attemptId: input.attemptId,
+    attemptOwnerRunId: input.attemptOwnerRunId,
+    attemptExpiresAt: input.attemptExpiresAt,
+    attemptSeq: input.attemptSeq,
     normalizedPlayName: input.normalizedPlayName,
     normalizedTableNamespace: input.normalizedTableNamespace,
     outputFields: input.force === true ? datasetFields : [],
+    force: input.force === true,
   });
   if (pendingKeys.size > 0) {
     input.timings?.push({
@@ -2463,11 +3017,22 @@ async function buildRuntimeSheetDatasetStartResult(
     });
   }
   if (input.force === true) {
+    const pendingRows: Record<string, unknown>[] = [];
+    const blockedRows: Record<string, unknown>[] = [];
+    for (const entry of input.rowEntries) {
+      const disposition = dispositionsByKey.get(entry.key) ?? 'blocked';
+      if (disposition === 'pending') {
+        pendingRows.push(buildFreshRow(entry));
+      } else if (disposition === 'blocked') {
+        blockedRows.push(buildFreshRow(entry));
+      }
+    }
     return {
       inserted: input.inserted,
       skipped: input.sourceRowsLength - input.rowEntries.length,
-      pendingRows: buildFreshPendingRows(),
+      pendingRows,
       completedRows: [],
+      blockedRows,
       tableNamespace: input.tableNamespace,
     };
   }
@@ -2498,14 +3063,25 @@ async function buildRuntimeSheetDatasetStartResult(
     };
   };
   const pendingRows: Record<string, unknown>[] = [];
+  const completedRows: Record<string, unknown>[] = [];
+  const blockedRows: Record<string, unknown>[] = [];
   for (const entry of input.rowEntries) {
-    pendingRows.push(buildMergedRow(entry));
+    const merged = buildMergedRow(entry);
+    const disposition = dispositionsByKey.get(entry.key) ?? 'blocked';
+    if (disposition === 'pending') {
+      pendingRows.push(merged);
+    } else if (disposition === 'completed') {
+      completedRows.push(merged);
+    } else {
+      blockedRows.push(merged);
+    }
   }
   return {
     inserted: input.inserted,
     skipped: input.sourceRowsLength - input.rowEntries.length,
     pendingRows,
-    completedRows: [],
+    completedRows,
+    blockedRows,
     tableNamespace: input.tableNamespace,
   };
 }
@@ -2516,12 +3092,31 @@ async function markRuntimeRowsPendingForRecompute(
   input: {
     keys: string[];
     runId: string;
+    attemptId: string;
+    attemptOwnerRunId: string;
+    attemptExpiresAt: string;
+    attemptSeq: number;
     normalizedPlayName: string;
     normalizedTableNamespace: string;
     outputFields?: string[];
+    force?: boolean;
   },
 ): Promise<void> {
   if (input.keys.length === 0) return;
+  const targetAttemptFenceSql = activeRuntimeSheetAttemptFenceSql(
+    'target',
+    '$5::text',
+    '$6::text',
+    '$7::timestamptz',
+    '$8::integer',
+  );
+  const targetWritableEnrichedAttemptSql =
+    writableEnrichedRuntimeSheetAttemptSql(
+      'target',
+      '$6::text',
+      '$7::timestamptz',
+      '$8',
+    );
   const outputFields = [...new Set(input.outputFields ?? [])];
   await client.query(
     `WITH target_rows AS (
@@ -2534,13 +3129,31 @@ async function markRuntimeRowsPendingForRecompute(
        UPDATE ${sheetTable(session)} AS target
         SET _status = 'pending',
             _run_id = $2::text,
+            _attempt_id = $5::text,
+            _attempt_owner_run_id = $6::text,
+            _attempt_expires_at = $7::timestamptz,
+            _attempt_seq = $8::integer,
             _updated_at = now(),
             _version = ${nextRuntimeSheetVersionExpression(session)}
         FROM target_rows
       WHERE target._key = target_rows._key
+         AND (
+           ${targetAttemptFenceSql}
+           OR (
+             $10::boolean
+             AND target._status = 'enriched'
+             AND COALESCE(target._attempt_seq, 0) <= $8::integer
+           )
+           OR (
+             target._status = 'enriched'
+             AND ${targetWritableEnrichedAttemptSql}
+           )
+         )
          AND (
            target._status <> 'pending'
            OR target._run_id IS DISTINCT FROM $2::text
+           OR target._attempt_id IS DISTINCT FROM $5::text
+           OR COALESCE(target._attempt_seq, 0) IS DISTINCT FROM $8::integer
          )
        RETURNING target_rows._status AS previous_status,
                  target_rows._cell_meta AS previous_cell_meta
@@ -2561,7 +3174,7 @@ async function markRuntimeRowsPendingForRecompute(
                 WHERE previous_cell_meta -> field_values.field ->> 'status' = 'failed'
               )::int AS failed_to_pending
          FROM updated
-         JOIN unnest($5::text[]) AS field_values(field) ON true
+         JOIN unnest($9::text[]) AS field_values(field) ON true
         GROUP BY field_values.field
      ),
      summary_delta AS (
@@ -2619,7 +3232,12 @@ async function markRuntimeRowsPendingForRecompute(
       input.runId,
       input.normalizedPlayName,
       input.normalizedTableNamespace,
+      input.attemptId,
+      input.attemptOwnerRunId,
+      input.attemptExpiresAt,
+      input.attemptSeq,
       outputFields,
+      input.force === true,
     ],
   );
 }
@@ -2657,6 +3275,41 @@ async function getRuntimeWorkReceiptSession(
   return session;
 }
 
+/**
+ * Work receipts for a play share a single table, so run-scoped operations (the
+ * run-fatal lease release) need a session without a specific key to scope by.
+ * This mirrors `getRuntimeWorkReceiptSession` minus the per-key scope check.
+ */
+async function getRuntimeWorkReceiptSessionForRun(
+  context: RuntimeApiContext,
+  input: {
+    playName: string;
+  },
+): Promise<RuntimePostgresSession> {
+  const playName = context.playName?.trim() || input.playName;
+  if (!playName) {
+    throw new Error('Runtime work receipts require a playName.');
+  }
+  const runtimeContext = {
+    ...context,
+    playName,
+  };
+  const preloaded = findPreloadedRuntimeDbSession(runtimeContext, {
+    tableNamespace: RUNTIME_WORK_RECEIPT_TABLE_NAMESPACE,
+    logicalTable: RUNTIME_WORK_RECEIPT_LOGICAL_TABLE,
+    operations: ['rows.read', 'rows.upsert'],
+  });
+  return requireRuntimePostgresSession(
+    preloaded
+      ? await unwrapRuntimeDbSession(runtimeContext, preloaded)
+      : await getRuntimeDbSession(runtimeContext, {
+          tableNamespace: RUNTIME_WORK_RECEIPT_TABLE_NAMESPACE,
+          logicalTable: RUNTIME_WORK_RECEIPT_LOGICAL_TABLE,
+          operations: ['rows.read', 'rows.upsert'],
+        }),
+  );
+}
+
 async function getRuntimeWorkReceiptSessionForKeys(
   context: RuntimeApiContext,
   input: {
@@ -2684,7 +3337,17 @@ async function readRuntimeWorkReceipt(
   key: string,
 ): Promise<WorkReceipt | null> {
   const { rows } = await client.query<Record<string, unknown>>(
-    `SELECT convert_from(k, 'UTF8') AS k, status, output, error, run_id, updated_at
+    `SELECT convert_from(k, 'UTF8') AS k,
+            status,
+            output,
+            error,
+            failure_kind,
+            run_id,
+            lease_id,
+            lease_owner_run_id,
+            lease_owner_attempt,
+            lease_expires_at,
+            updated_at
        FROM ${workReceiptTable(session)}
       WHERE k = decode($1, 'hex')`,
     [workReceiptKeyHex(key)],
@@ -2714,7 +3377,7 @@ export async function getRuntimeWorkReceipts(
     playName: string;
     keys: string[];
   },
-): Promise<WorkReceipt[]> {
+): Promise<Array<WorkReceipt | null>> {
   const keys = [
     ...new Set(input.keys.map((key) => key.trim()).filter(Boolean)),
   ];
@@ -2737,16 +3400,23 @@ export async function getRuntimeWorkReceipts(
              receipts.status,
              receipts.output,
              receipts.error,
+             receipts.failure_kind,
              receipts.run_id,
+             receipts.lease_id,
+             receipts.lease_owner_run_id,
+             receipts.lease_owner_attempt,
+             receipts.lease_expires_at,
              receipts.updated_at
         FROM input_keys
-        JOIN ${workReceiptTable(session)} AS receipts
+        LEFT JOIN ${workReceiptTable(session)} AS receipts
           ON receipts.k = decode(input_keys.key_hex, 'hex')
        ORDER BY input_keys.ord
     `,
         [keys.map(workReceiptKeyHex)],
       );
-      return rows.map(mapRuntimeWorkReceiptRow);
+      return rows.map((row) =>
+        row.k == null ? null : mapRuntimeWorkReceiptRow(row),
+      );
     },
   );
 }
@@ -2757,8 +3427,12 @@ export async function claimRuntimeWorkReceipt(
     playName: string;
     runId: string;
     key: string;
+    runAttempt?: number | null;
+    leaseAware?: boolean;
     reclaimRunning?: boolean;
     forceRefresh?: boolean;
+    forceFailedRefresh?: boolean;
+    leaseTtlMs?: number | null;
   },
 ): Promise<WorkReceiptClaim> {
   const session = await getRuntimeWorkReceiptSession(context, {
@@ -2769,36 +3443,89 @@ export async function claimRuntimeWorkReceipt(
     context,
     session,
     async (client) => {
-      const claimableStatuses = input.forceRefresh
-        ? [
-            RECEIPT_STATUS_PENDING,
-            RECEIPT_STATUS_FAILED,
-            RECEIPT_STATUS_RUNNING,
-            RECEIPT_STATUS_COMPLETED,
-            RECEIPT_STATUS_SKIPPED,
-          ]
-        : input.reclaimRunning
-          ? [
-              RECEIPT_STATUS_PENDING,
-              RECEIPT_STATUS_FAILED,
-              RECEIPT_STATUS_RUNNING,
-            ]
-          : [RECEIPT_STATUS_PENDING, RECEIPT_STATUS_FAILED];
+      const leaseId =
+        input.leaseAware === true ? newRuntimeWorkReceiptLeaseId() : null;
+      const runAttempt = normalizeRuntimeRunAttempt(input.runAttempt);
+      const leaseTtlMs = normalizeRuntimeLeaseTtlMs(
+        input.leaseTtlMs,
+        PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
+      );
+      const claimableStatuses = workReceiptClaimableStatusCodes({
+        forceRefresh: input.forceRefresh,
+        forceFailedRefresh: input.forceFailedRefresh,
+        reclaimRunning: input.reclaimRunning,
+      });
       const { rows } = await client.query<Record<string, unknown>>(
         `
         WITH claimed AS (
-          INSERT INTO ${workReceiptTable(session)} (k, status, run_id, updated_at)
-          VALUES (decode($1, 'hex'), $2::smallint, $3, now())
+          INSERT INTO ${workReceiptTable(session)} (
+            k,
+            status,
+            run_id,
+            lease_id,
+            lease_owner_run_id,
+            lease_owner_attempt,
+            lease_expires_at,
+            updated_at
+          )
+          VALUES (
+            decode($1, 'hex'),
+            $2::smallint,
+            $3,
+            $6,
+            CASE WHEN $6::text IS NULL THEN NULL ELSE $3 END,
+            CASE WHEN $6::text IS NULL THEN NULL ELSE $9::integer END,
+            CASE
+              WHEN $6::text IS NULL THEN NULL
+              ELSE now() + ($7::double precision * interval '1 millisecond')
+            END,
+            now()
+          )
           ON CONFLICT (k) DO UPDATE
           SET status = $4::smallint,
               output = NULL,
+              failure_kind = 0,
               run_id = $3,
+              lease_id = $6,
+              lease_owner_run_id = CASE WHEN $6::text IS NULL THEN NULL ELSE $3 END,
+              lease_owner_attempt = CASE WHEN $6::text IS NULL THEN NULL ELSE $9::integer END,
+              lease_expires_at = CASE
+                WHEN $6::text IS NULL THEN NULL
+                ELSE now() + ($7::double precision * interval '1 millisecond')
+              END,
               error = NULL,
               updated_at = now()
-          WHERE ${workReceiptTable(session)}.status = ANY($5::smallint[])
-          RETURNING convert_from(k, 'UTF8') AS k, status, output, error, run_id, updated_at
+          WHERE ${workReceiptClaimConflictPredicateSql({
+            receiptTable: workReceiptTable(session),
+            claimableStatusesSql: '$5',
+            claimantRunIdSql: '$3',
+            claimantRunAttemptSql: '$9',
+            forceRefreshSql: '$8',
+            forceFailedRefreshSql: '$10',
+          })}
+          RETURNING convert_from(k, 'UTF8') AS k,
+                    status,
+                    output,
+                    error,
+                    failure_kind,
+                    run_id,
+                    lease_id,
+                    lease_owner_run_id,
+                    lease_owner_attempt,
+                    lease_expires_at,
+                    updated_at
         )
-        SELECT k, status, output, error, run_id, updated_at
+        SELECT k,
+               status,
+               output,
+               error,
+               failure_kind,
+               run_id,
+               lease_id,
+               lease_owner_run_id,
+               lease_owner_attempt,
+               lease_expires_at,
+               updated_at
         FROM claimed
       `,
         [
@@ -2807,6 +3534,11 @@ export async function claimRuntimeWorkReceipt(
           input.runId,
           RECEIPT_STATUS_RUNNING,
           claimableStatuses,
+          leaseId,
+          leaseTtlMs,
+          input.forceRefresh === true,
+          runAttempt,
+          input.forceFailedRefresh === true,
         ],
       );
       const claimed = rows[0] ? mapRuntimeWorkReceiptRow(rows[0]) : null;
@@ -2815,14 +3547,19 @@ export async function claimRuntimeWorkReceipt(
       }
 
       const latest = await readRuntimeWorkReceipt(client, session, input.key);
-      if (latest && isReusableWorkReceipt(latest)) {
+      if (
+        latest &&
+        input.forceRefresh !== true &&
+        isReusableWorkReceipt(latest)
+      ) {
         return { disposition: 'reused', receipt: latest };
       }
-      if (latest?.status === 'running') {
-        return { disposition: 'running', receipt: latest };
-      }
-      if (latest?.status === 'failed') {
-        return { disposition: 'failed', receipt: latest };
+      if (latest) {
+        return runtimeWorkReceiptClaimDispositionForBlockedReceipt({
+          receipt: latest,
+          claimantRunId: input.runId,
+          claimantRunAttempt: runAttempt,
+        });
       }
       throw new Error(
         `Runtime receipt ${input.key} claim did not return execution ownership.`,
@@ -2831,14 +3568,48 @@ export async function claimRuntimeWorkReceipt(
   );
 }
 
+function runtimeWorkReceiptClaimDispositionForBlockedReceipt(input: {
+  receipt: WorkReceipt;
+  claimantRunId: string;
+  claimantRunAttempt?: number | null;
+}): Exclude<WorkReceiptClaim, { disposition: 'claimed' | 'reused' }> {
+  const receipt = input.receipt;
+  if (receipt.status === 'failed') {
+    return { disposition: 'failed', receipt };
+  }
+  if (receipt.status === 'pending' || receipt.status === 'running') {
+    const ownerRunId = receipt.leaseOwnerRunId ?? receipt.runId ?? null;
+    const leaseExpiresAtMs =
+      typeof receipt.leaseExpiresAt === 'string'
+        ? Date.parse(receipt.leaseExpiresAt)
+        : NaN;
+    const hasActiveForeignLease =
+      ownerRunId !== null &&
+      ownerRunId !== input.claimantRunId &&
+      typeof receipt.leaseId === 'string' &&
+      receipt.leaseId.length > 0 &&
+      Number.isFinite(leaseExpiresAtMs) &&
+      leaseExpiresAtMs > Date.now();
+    return {
+      disposition: hasActiveForeignLease ? 'blocked_active_lease' : 'running',
+      receipt,
+    };
+  }
+  return { disposition: 'running', receipt };
+}
+
 export async function claimRuntimeWorkReceipts(
   context: RuntimeApiContext,
   input: {
     playName: string;
     runId: string;
     keys: string[];
+    runAttempt?: number | null;
+    leaseAware?: boolean;
     reclaimRunning?: boolean;
     forceRefresh?: boolean;
+    forceFailedRefresh?: boolean;
+    leaseTtlMs?: number | null;
   },
 ): Promise<WorkReceiptClaim[]> {
   const keys = [
@@ -2854,46 +3625,104 @@ export async function claimRuntimeWorkReceipts(
     session,
     async (client) => {
       const keyHexes = keys.map(workReceiptKeyHex);
-      const reclaimStatuses = input.forceRefresh
-        ? [
-            RECEIPT_STATUS_PENDING,
-            RECEIPT_STATUS_FAILED,
-            RECEIPT_STATUS_RUNNING,
-            RECEIPT_STATUS_COMPLETED,
-            RECEIPT_STATUS_SKIPPED,
-          ]
-        : input.reclaimRunning
-          ? [
-              RECEIPT_STATUS_PENDING,
-              RECEIPT_STATUS_FAILED,
-              RECEIPT_STATUS_RUNNING,
-            ]
-          : [RECEIPT_STATUS_PENDING, RECEIPT_STATUS_FAILED];
+      const leaseIds = keys.map(() =>
+        input.leaseAware === true ? newRuntimeWorkReceiptLeaseId() : null,
+      );
+      const runAttempt = normalizeRuntimeRunAttempt(input.runAttempt);
+      const leaseTtlMs = normalizeRuntimeLeaseTtlMs(
+        input.leaseTtlMs,
+        PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
+      );
+      const reclaimStatuses = workReceiptClaimableStatusCodes({
+        forceRefresh: input.forceRefresh,
+        forceFailedRefresh: input.forceFailedRefresh,
+        reclaimRunning: input.reclaimRunning,
+      });
       const { rows } = await client.query<Record<string, unknown>>(
         `
       WITH input_keys AS (
-        SELECT key_values.key_hex, key_values.ord
+        SELECT key_values.key_hex, lease_values.lease_id, key_values.ord
         FROM unnest($1::text[]) WITH ORDINALITY AS key_values(key_hex, ord)
+        JOIN unnest($2::text[]) WITH ORDINALITY AS lease_values(lease_id, ord)
+          ON lease_values.ord = key_values.ord
       ),
       claimed AS (
-        INSERT INTO ${workReceiptTable(session)} (k, status, run_id, updated_at)
-        SELECT decode(input_keys.key_hex, 'hex'), $2::smallint, $3::text, now()
+        INSERT INTO ${workReceiptTable(session)} (
+          k,
+          status,
+          run_id,
+          lease_id,
+          lease_owner_run_id,
+          lease_owner_attempt,
+          lease_expires_at,
+          updated_at
+        )
+        SELECT decode(input_keys.key_hex, 'hex'),
+               $3::smallint,
+               $4::text,
+               input_keys.lease_id,
+               CASE
+                 WHEN input_keys.lease_id IS NULL THEN NULL
+                 ELSE $4::text
+               END,
+               CASE
+                 WHEN input_keys.lease_id IS NULL THEN NULL
+                 ELSE $9::integer
+               END,
+               CASE
+                 WHEN input_keys.lease_id IS NULL THEN NULL
+                 ELSE now() + ($7::double precision * interval '1 millisecond')
+               END,
+               now()
           FROM input_keys
         ON CONFLICT (k) DO UPDATE
-        SET status = $4::smallint,
+        SET status = $5::smallint,
             output = NULL,
-            run_id = $3::text,
+            failure_kind = 0,
+            run_id = $4::text,
+            lease_id = EXCLUDED.lease_id,
+            lease_owner_run_id = CASE
+              WHEN EXCLUDED.lease_id IS NULL THEN NULL
+              ELSE $4::text
+            END,
+            lease_owner_attempt = CASE
+              WHEN EXCLUDED.lease_id IS NULL THEN NULL
+              ELSE $9::integer
+            END,
+            lease_expires_at = EXCLUDED.lease_expires_at,
             error = NULL,
             updated_at = now()
-        WHERE ${workReceiptTable(session)}.status = ANY($5::smallint[])
-        RETURNING k, status, output, error, run_id, updated_at
+        WHERE ${workReceiptClaimConflictPredicateSql({
+          receiptTable: workReceiptTable(session),
+          claimableStatusesSql: '$6',
+          claimantRunIdSql: '$4::text',
+          claimantRunAttemptSql: '$9',
+          forceRefreshSql: '$8',
+          forceFailedRefreshSql: '$10',
+        })}
+        RETURNING k,
+                  status,
+                  output,
+                  error,
+                  failure_kind,
+                  run_id,
+                  lease_id,
+                  lease_owner_run_id,
+                  lease_owner_attempt,
+                  lease_expires_at,
+                  updated_at
       ),
       latest AS (
         SELECT receipts.k,
                receipts.status,
                receipts.output,
                receipts.error,
+               receipts.failure_kind,
                receipts.run_id,
+               receipts.lease_id,
+               receipts.lease_owner_run_id,
+               receipts.lease_owner_attempt,
+               receipts.lease_expires_at,
                receipts.updated_at,
                input_keys.ord,
                false AS claimed
@@ -2909,21 +3738,43 @@ export async function claimRuntimeWorkReceipts(
                claimed.status,
                claimed.output,
                claimed.error,
+               claimed.failure_kind,
                claimed.run_id,
+               claimed.lease_id,
+               claimed.lease_owner_run_id,
+               claimed.lease_owner_attempt,
+               claimed.lease_expires_at,
                claimed.updated_at,
                input_keys.ord,
                true AS claimed
           FROM claimed
           JOIN input_keys ON claimed.k = decode(input_keys.key_hex, 'hex')
         UNION ALL
-        SELECT k, status, output, error, run_id, updated_at, ord, claimed
+        SELECT k,
+               status,
+               output,
+               error,
+               failure_kind,
+               run_id,
+               lease_id,
+               lease_owner_run_id,
+               lease_owner_attempt,
+               lease_expires_at,
+               updated_at,
+               ord,
+               claimed
           FROM latest
       )
       SELECT convert_from(k, 'UTF8') AS k,
              status,
              output,
              error,
+             failure_kind,
              run_id,
+             lease_id,
+             lease_owner_run_id,
+             lease_owner_attempt,
+             lease_expires_at,
              updated_at,
              claimed
         FROM returned
@@ -2931,10 +3782,15 @@ export async function claimRuntimeWorkReceipts(
     `,
         [
           keyHexes,
+          leaseIds,
           RECEIPT_STATUS_RUNNING,
           input.runId,
           RECEIPT_STATUS_RUNNING,
           reclaimStatuses,
+          leaseTtlMs,
+          input.forceRefresh === true,
+          runAttempt,
+          input.forceFailedRefresh === true,
         ],
       );
       return rows.map((row) => {
@@ -2942,16 +3798,14 @@ export async function claimRuntimeWorkReceipts(
         if (row.claimed === true) {
           return { disposition: 'claimed', receipt } satisfies WorkReceiptClaim;
         }
-        if (isReusableWorkReceipt(receipt)) {
+        if (input.forceRefresh !== true && isReusableWorkReceipt(receipt)) {
           return { disposition: 'reused', receipt } satisfies WorkReceiptClaim;
         }
-        if (receipt.status === 'running') {
-          return { disposition: 'running', receipt } satisfies WorkReceiptClaim;
-        }
-        if (receipt.status === 'failed') {
-          return { disposition: 'failed', receipt } satisfies WorkReceiptClaim;
-        }
-        return { disposition: 'running', receipt } satisfies WorkReceiptClaim;
+        return runtimeWorkReceiptClaimDispositionForBlockedReceipt({
+          receipt,
+          claimantRunId: input.runId,
+          claimantRunAttempt: runAttempt,
+        });
       });
     },
   );
@@ -2963,17 +3817,50 @@ export async function completeRuntimeWorkReceipt(
     playName: string;
     runId: string;
     key: string;
+    runAttempt?: number | null;
+    leaseId?: string | null;
     output: unknown;
   },
 ): Promise<WorkReceipt | null> {
-  const session = await getRuntimeWorkReceiptSession(context, {
-    playName: input.playName,
-    key: input.key,
-  });
-  return await withRuntimeWorkReceiptClient(
-    context,
-    session,
-    async (client) => {
+  if (
+    consumeDirectRuntimeTestFault({
+      context,
+      runId: input.runId,
+      name: 'receipt_complete_write_fail',
+    })
+  ) {
+    const error = runtimeTestFaultError('receipt_complete_write_fail');
+    const failed = await failRuntimeWorkReceipt(context, {
+      playName: input.playName,
+      runId: input.runId,
+      key: input.key,
+      leaseId: input.leaseId,
+      error: error.message,
+      failureKind: 'repairable',
+      runAttempt: input.runAttempt,
+    });
+    if (!failed) {
+      await forceFailRuntimeWorkReceiptForRuntimeTestFault(context, {
+        playName: input.playName,
+        runId: input.runId,
+        key: input.key,
+        error: error.message,
+        failureKind: 'repairable',
+        runAttempt: input.runAttempt,
+      });
+    }
+    throw error;
+  }
+  const session = await getRuntimeWorkReceiptSession(context, {
+    playName: input.playName,
+    key: input.key,
+  });
+  return await withRuntimeWorkReceiptClient(
+    context,
+    session,
+    async (client) => {
+      const leaseId = input.leaseId?.trim() || null;
+      const runAttempt = normalizeRuntimeRunAttempt(input.runAttempt);
       const { rows } = await client.query<Record<string, unknown>>(
         `
         WITH completed AS (
@@ -2981,29 +3868,41 @@ export async function completeRuntimeWorkReceipt(
           SET status = $2::smallint,
               output = $3::jsonb,
               error = NULL,
+              failure_kind = 0,
               run_id = $4,
+              lease_id = NULL,
+              lease_owner_run_id = NULL,
+              lease_owner_attempt = NULL,
+              lease_expires_at = NULL,
               updated_at = now()
           WHERE k = decode($1, 'hex')
-            AND status = $5::smallint
-            AND run_id = $4
-          RETURNING convert_from(k, 'UTF8') AS k, status, output, error, run_id, updated_at
-        ),
-        latest AS (
-          SELECT convert_from(k, 'UTF8') AS k, status, output, error, run_id, updated_at
-            FROM ${workReceiptTable(session)}
-           WHERE k = decode($1, 'hex')
-             AND NOT EXISTS (SELECT 1 FROM completed)
-        )
-        SELECT k, status, output, error, run_id, updated_at FROM completed
-        UNION ALL
-        SELECT k, status, output, error, run_id, updated_at FROM latest
+            AND ${workReceiptRunningOwnerPredicateSql({
+              receiptTable: workReceiptTable(session),
+              ownerRunIdSql: '$4',
+              ownerRunAttemptSql: '$6',
+              leaseIdSql: '$5::text',
+            })}
+	          RETURNING convert_from(k, 'UTF8') AS k,
+	                    status,
+	                    output,
+	                    error,
+	                    failure_kind,
+	                    run_id,
+	                    lease_id,
+	                    lease_owner_run_id,
+	                    lease_owner_attempt,
+	                    lease_expires_at,
+	                    updated_at
+	        )
+	        SELECT k, status, output, error, failure_kind, run_id, lease_id, lease_owner_run_id, lease_owner_attempt, lease_expires_at, updated_at FROM completed
       `,
         [
           workReceiptKeyHex(input.key),
           RECEIPT_STATUS_COMPLETED,
           input.output === null ? null : stringifyPostgresJson(input.output),
           input.runId,
-          RECEIPT_STATUS_RUNNING,
+          leaseId,
+          runAttempt,
         ],
       );
       return rows[0] ? mapRuntimeWorkReceiptRow(rows[0]) : null;
@@ -3015,11 +3914,63 @@ export async function completeRuntimeWorkReceipts(
   context: RuntimeApiContext,
   input: {
     playName: string;
-    receipts: Array<{ runId: string; key: string; output: unknown }>;
+    receipts: Array<{
+      runId: string;
+      key: string;
+      output: unknown;
+      leaseId?: string | null;
+      runAttempt?: number | null;
+    }>;
   },
-): Promise<WorkReceipt[]> {
+): Promise<Array<WorkReceipt | null>> {
   const receipts = input.receipts.filter((receipt) => receipt.key.trim());
   if (receipts.length === 0) return [];
+  if (
+    consumeDirectRuntimeTestFault({
+      context,
+      runId: receipts[0]?.runId ?? '',
+      name: 'receipt_complete_write_fail',
+    })
+  ) {
+    const [skippedReceipt, ...siblingReceipts] = receipts;
+    let siblingError: unknown = null;
+    if (siblingReceipts.length > 0) {
+      try {
+        await completeRuntimeWorkReceipts(context, {
+          playName: input.playName,
+          receipts: siblingReceipts,
+        });
+      } catch (error) {
+        siblingError = error;
+      }
+    }
+    const error = runtimeTestFaultError('receipt_complete_write_fail');
+    if (skippedReceipt) {
+      const failed = await failRuntimeWorkReceipt(context, {
+        playName: input.playName,
+        runId: skippedReceipt.runId,
+        key: skippedReceipt.key,
+        leaseId: skippedReceipt.leaseId,
+        error: error.message,
+        failureKind: 'repairable',
+        runAttempt: skippedReceipt.runAttempt,
+      });
+      if (!failed) {
+        await forceFailRuntimeWorkReceiptForRuntimeTestFault(context, {
+          playName: input.playName,
+          runId: skippedReceipt.runId,
+          key: skippedReceipt.key,
+          error: error.message,
+          failureKind: 'repairable',
+          runAttempt: skippedReceipt.runAttempt,
+        });
+      }
+    }
+    if (siblingError) {
+      throw siblingError;
+    }
+    throw error;
+  }
   const session = await getRuntimeWorkReceiptSessionForKeys(context, {
     playName: input.playName,
     keys: receipts.map((receipt) => receipt.key),
@@ -3033,52 +3984,79 @@ export async function completeRuntimeWorkReceipts(
       WITH inputs AS (
         SELECT key_values.key_hex,
                run_values.run_id,
+               lease_values.lease_id,
+               attempt_values.run_attempt,
                output_values.output,
                key_values.ord
           FROM unnest($1::text[]) WITH ORDINALITY AS key_values(key_hex, ord)
           JOIN unnest($2::text[]) WITH ORDINALITY AS run_values(run_id, ord)
             ON run_values.ord = key_values.ord
-          JOIN jsonb_array_elements($3::jsonb) WITH ORDINALITY AS output_values(output, ord)
+          JOIN unnest($3::text[]) WITH ORDINALITY AS lease_values(lease_id, ord)
+            ON lease_values.ord = key_values.ord
+          JOIN unnest($4::integer[]) WITH ORDINALITY AS attempt_values(run_attempt, ord)
+            ON attempt_values.ord = key_values.ord
+          JOIN jsonb_array_elements($5::jsonb) WITH ORDINALITY AS output_values(output, ord)
             ON output_values.ord = key_values.ord
       ),
       completed AS (
         UPDATE ${workReceiptTable(session)} AS target
-           SET status = $4::smallint,
-               output = inputs.output,
-               error = NULL,
-               run_id = inputs.run_id,
+           SET status = $6::smallint,
+		               output = inputs.output,
+	               error = NULL,
+	               failure_kind = 0,
+	               run_id = inputs.run_id,
+	               lease_id = NULL,
+	               lease_owner_run_id = NULL,
+	               lease_owner_attempt = NULL,
+	               lease_expires_at = NULL,
                updated_at = now()
           FROM inputs
          WHERE target.k = decode(inputs.key_hex, 'hex')
-           AND target.status = $5::smallint
-           AND target.run_id = inputs.run_id
-        RETURNING target.k, target.status, target.output, target.error, target.run_id, target.updated_at, inputs.ord
+           AND ${workReceiptRunningOwnerPredicateSql({
+             receiptTable: 'target',
+             ownerRunIdSql: 'inputs.run_id',
+             ownerRunAttemptSql: 'inputs.run_attempt',
+             leaseIdSql: 'inputs.lease_id',
+           })}
+        RETURNING target.k,
+                  target.status,
+	                  target.output,
+	                  target.error,
+	                  target.failure_kind,
+	                  target.run_id,
+                  target.lease_id,
+                  target.lease_owner_run_id,
+                  target.lease_owner_attempt,
+                  target.lease_expires_at,
+                  target.updated_at,
+                  inputs.ord
       ),
-      latest AS (
-        SELECT receipts.k,
-               receipts.status,
-               receipts.output,
-               receipts.error,
-               receipts.run_id,
-               receipts.updated_at,
+      returned AS (
+        SELECT completed.k,
+               completed.status,
+	               completed.output,
+	               completed.error,
+	               completed.failure_kind,
+	               completed.run_id,
+               completed.lease_id,
+               completed.lease_owner_run_id,
+               completed.lease_owner_attempt,
+               completed.lease_expires_at,
+               completed.updated_at,
                inputs.ord
           FROM inputs
-          JOIN ${workReceiptTable(session)} AS receipts
-            ON receipts.k = decode(inputs.key_hex, 'hex')
-         WHERE NOT EXISTS (
-           SELECT 1 FROM completed WHERE completed.k = receipts.k
-         )
-      ),
-      returned AS (
-        SELECT k, status, output, error, run_id, updated_at, ord FROM completed
-        UNION ALL
-        SELECT k, status, output, error, run_id, updated_at, ord FROM latest
+          LEFT JOIN completed ON completed.ord = inputs.ord
       )
       SELECT convert_from(returned.k, 'UTF8') AS k,
              returned.status,
-             returned.output,
-             returned.error,
-             returned.run_id,
+	             returned.output,
+	             returned.error,
+	             returned.failure_kind,
+		             returned.run_id,
+             returned.lease_id,
+             returned.lease_owner_run_id,
+             returned.lease_owner_attempt,
+             returned.lease_expires_at,
              returned.updated_at
         FROM returned
        ORDER BY returned.ord
@@ -3086,16 +4064,21 @@ export async function completeRuntimeWorkReceipts(
         [
           receipts.map((receipt) => workReceiptKeyHex(receipt.key)),
           receipts.map((receipt) => receipt.runId),
+          receipts.map((receipt) => receipt.leaseId?.trim() || null),
+          receipts.map((receipt) =>
+            normalizeRuntimeRunAttempt(receipt.runAttempt),
+          ),
           stringifyPostgresJson(
             receipts.map((receipt) =>
               receipt.output === null ? null : receipt.output,
             ),
           ),
           RECEIPT_STATUS_COMPLETED,
-          RECEIPT_STATUS_RUNNING,
         ],
       );
-      return rows.map(mapRuntimeWorkReceiptRow);
+      return rows.map((row) =>
+        row.k == null ? null : mapRuntimeWorkReceiptRow(row),
+      );
     },
   );
 }
@@ -3106,7 +4089,10 @@ export async function failRuntimeWorkReceipt(
     playName: string;
     runId: string;
     key: string;
+    runAttempt?: number | null;
+    leaseId?: string | null;
     error: string;
+    failureKind?: WorkReceiptFailureKind | null;
   },
 ): Promise<WorkReceipt | null> {
   const session = await getRuntimeWorkReceiptSession(context, {
@@ -3117,36 +4103,119 @@ export async function failRuntimeWorkReceipt(
     context,
     session,
     async (client) => {
+      const leaseId = input.leaseId?.trim() || null;
+      const runAttempt = normalizeRuntimeRunAttempt(input.runAttempt);
       const { rows } = await client.query<Record<string, unknown>>(
         `
         WITH failed AS (
           UPDATE ${workReceiptTable(session)}
-          SET status = $2::smallint,
-              output = NULL,
-              error = $3,
+	          SET status = $2::smallint,
+	              output = NULL,
+	              error = $3,
+	              failure_kind = $6::smallint,
               run_id = $4,
+              lease_id = NULL,
+              lease_owner_run_id = NULL,
+              lease_owner_attempt = NULL,
+              lease_expires_at = NULL,
               updated_at = now()
           WHERE k = decode($1, 'hex')
-            AND status = $5::smallint
-            AND run_id = $4
-          RETURNING convert_from(k, 'UTF8') AS k, status, output, error, run_id, updated_at
-        ),
-        latest AS (
-          SELECT convert_from(k, 'UTF8') AS k, status, output, error, run_id, updated_at
-            FROM ${workReceiptTable(session)}
-           WHERE k = decode($1, 'hex')
-             AND NOT EXISTS (SELECT 1 FROM failed)
-        )
-        SELECT k, status, output, error, run_id, updated_at FROM failed
-        UNION ALL
-        SELECT k, status, output, error, run_id, updated_at FROM latest
+            AND ${workReceiptRunningOwnerPredicateSql({
+              receiptTable: workReceiptTable(session),
+              ownerRunIdSql: '$4',
+              ownerRunAttemptSql: '$7',
+              leaseIdSql: '$5::text',
+            })}
+	          RETURNING convert_from(k, 'UTF8') AS k,
+	                    status,
+	                    output,
+	                    error,
+	                    failure_kind,
+	                    run_id,
+	                    lease_id,
+	                    lease_owner_run_id,
+	                    lease_owner_attempt,
+	                    lease_expires_at,
+	                    updated_at
+	        )
+	        SELECT k, status, output, error, failure_kind, run_id, lease_id, lease_owner_run_id, lease_owner_attempt, lease_expires_at, updated_at FROM failed
       `,
         [
           workReceiptKeyHex(input.key),
           RECEIPT_STATUS_FAILED,
           input.error,
           input.runId,
-          RECEIPT_STATUS_RUNNING,
+          leaseId,
+          workReceiptFailureKindCode(input.failureKind),
+          runAttempt,
+        ],
+      );
+      return rows[0] ? mapRuntimeWorkReceiptRow(rows[0]) : null;
+    },
+  );
+}
+
+export async function releaseRuntimeWorkReceipt(
+  context: RuntimeApiContext,
+  input: {
+    playName: string;
+    runId: string;
+    key: string;
+    runAttempt?: number | null;
+    leaseId?: string | null;
+  },
+): Promise<WorkReceipt | null> {
+  const session = await getRuntimeWorkReceiptSession(context, {
+    playName: input.playName,
+    key: input.key,
+  });
+  return await withRuntimeWorkReceiptClient(
+    context,
+    session,
+    async (client) => {
+      const leaseId = input.leaseId?.trim() || null;
+      const runAttempt = normalizeRuntimeRunAttempt(input.runAttempt);
+      const { rows } = await client.query<Record<string, unknown>>(
+        `
+        WITH released AS (
+          UPDATE ${workReceiptTable(session)}
+             SET status = $2::smallint,
+                 output = NULL,
+                 error = NULL,
+                 failure_kind = 0,
+                 run_id = $3,
+                 lease_id = NULL,
+                 lease_owner_run_id = NULL,
+                 lease_owner_attempt = NULL,
+                 lease_expires_at = NULL,
+                 updated_at = now()
+           WHERE k = decode($1, 'hex')
+             AND ${workReceiptRunningOwnerPredicateSql({
+               receiptTable: workReceiptTable(session),
+               ownerRunIdSql: '$3',
+               ownerRunAttemptSql: '$5',
+               leaseIdSql: '$4::text',
+             })}
+          RETURNING convert_from(k, 'UTF8') AS k,
+                    status,
+                    output,
+                    error,
+                    failure_kind,
+                    run_id,
+                    lease_id,
+                    lease_owner_run_id,
+                    lease_owner_attempt,
+                    lease_expires_at,
+                    updated_at
+        )
+        SELECT k, status, output, error, failure_kind, run_id, lease_id, lease_owner_run_id, lease_owner_attempt, lease_expires_at, updated_at FROM released
+      `,
+        [
+          workReceiptKeyHex(input.key),
+          RECEIPT_STATUS_PENDING,
+          input.runId,
+          leaseId,
+          runAttempt,
         ],
       );
       return rows[0] ? mapRuntimeWorkReceiptRow(rows[0]) : null;
@@ -3158,9 +4227,16 @@ export async function failRuntimeWorkReceipts(
   context: RuntimeApiContext,
   input: {
     playName: string;
-    receipts: Array<{ runId: string; key: string; error: string }>;
+    receipts: Array<{
+      runId: string;
+      key: string;
+      error: string;
+      failureKind?: WorkReceiptFailureKind | null;
+      leaseId?: string | null;
+      runAttempt?: number | null;
+    }>;
   },
-): Promise<WorkReceipt[]> {
+): Promise<Array<WorkReceipt | null>> {
   const receipts = input.receipts.filter((receipt) => receipt.key.trim());
   if (receipts.length === 0) return [];
   const session = await getRuntimeWorkReceiptSessionForKeys(context, {
@@ -3176,65 +4252,207 @@ export async function failRuntimeWorkReceipts(
       WITH inputs AS (
         SELECT key_values.key_hex,
                run_values.run_id,
-               error_values.error,
-               key_values.ord
+	               lease_values.lease_id,
+	               attempt_values.run_attempt,
+	               error_values.error,
+	               failure_kind_values.failure_kind,
+	               key_values.ord
           FROM unnest($1::text[]) WITH ORDINALITY AS key_values(key_hex, ord)
           JOIN unnest($2::text[]) WITH ORDINALITY AS run_values(run_id, ord)
             ON run_values.ord = key_values.ord
-          JOIN unnest($3::text[]) WITH ORDINALITY AS error_values(error, ord)
-            ON error_values.ord = key_values.ord
+          JOIN unnest($3::text[]) WITH ORDINALITY AS lease_values(lease_id, ord)
+            ON lease_values.ord = key_values.ord
+	          JOIN unnest($4::integer[]) WITH ORDINALITY AS attempt_values(run_attempt, ord)
+	            ON attempt_values.ord = key_values.ord
+	          JOIN unnest($5::text[]) WITH ORDINALITY AS error_values(error, ord)
+	            ON error_values.ord = key_values.ord
+	          JOIN unnest($6::smallint[]) WITH ORDINALITY AS failure_kind_values(failure_kind, ord)
+	            ON failure_kind_values.ord = key_values.ord
       ),
       failed AS (
         UPDATE ${workReceiptTable(session)} AS target
-           SET status = $4::smallint,
-               output = NULL,
-               error = inputs.error,
-               run_id = inputs.run_id,
+	           SET status = $7::smallint,
+	               output = NULL,
+	               error = inputs.error,
+	               failure_kind = inputs.failure_kind,
+	               run_id = inputs.run_id,
+               lease_id = NULL,
+               lease_owner_run_id = NULL,
+               lease_owner_attempt = NULL,
+               lease_expires_at = NULL,
                updated_at = now()
           FROM inputs
          WHERE target.k = decode(inputs.key_hex, 'hex')
-           AND target.status = $5::smallint
-           AND target.run_id = inputs.run_id
-        RETURNING target.k, target.status, target.output, target.error, target.run_id, target.updated_at, inputs.ord
+	           AND ${workReceiptRunningOwnerPredicateSql({
+               receiptTable: 'target',
+               ownerRunIdSql: 'inputs.run_id',
+               ownerRunAttemptSql: 'inputs.run_attempt',
+               leaseIdSql: 'inputs.lease_id',
+             })}
+        RETURNING target.k,
+                  target.status,
+	                  target.output,
+	                  target.error,
+	                  target.failure_kind,
+	                  target.run_id,
+                  target.lease_id,
+                  target.lease_owner_run_id,
+                  target.lease_owner_attempt,
+                  target.lease_expires_at,
+                  target.updated_at,
+                  inputs.ord
       ),
-      latest AS (
-        SELECT receipts.k,
-               receipts.status,
-               receipts.output,
-               receipts.error,
-               receipts.run_id,
-               receipts.updated_at,
+      returned AS (
+        SELECT failed.k,
+               failed.status,
+	               failed.output,
+	               failed.error,
+	               failed.failure_kind,
+	               failed.run_id,
+               failed.lease_id,
+               failed.lease_owner_run_id,
+               failed.lease_owner_attempt,
+               failed.lease_expires_at,
+               failed.updated_at,
                inputs.ord
           FROM inputs
-          JOIN ${workReceiptTable(session)} AS receipts
-            ON receipts.k = decode(inputs.key_hex, 'hex')
-         WHERE NOT EXISTS (
-           SELECT 1 FROM failed WHERE failed.k = receipts.k
-         )
+          LEFT JOIN failed ON failed.ord = inputs.ord
+      )
+      SELECT convert_from(returned.k, 'UTF8') AS k,
+             returned.status,
+	             returned.output,
+	             returned.error,
+	             returned.failure_kind,
+		             returned.run_id,
+             returned.lease_id,
+             returned.lease_owner_run_id,
+             returned.lease_owner_attempt,
+             returned.lease_expires_at,
+             returned.updated_at
+        FROM returned
+       ORDER BY returned.ord
+    `,
+        [
+          receipts.map((receipt) => workReceiptKeyHex(receipt.key)),
+          receipts.map((receipt) => receipt.runId),
+          receipts.map((receipt) => receipt.leaseId?.trim() || null),
+          receipts.map((receipt) =>
+            normalizeRuntimeRunAttempt(receipt.runAttempt),
+          ),
+          receipts.map((receipt) => receipt.error),
+          receipts.map((receipt) =>
+            workReceiptFailureKindCode(receipt.failureKind),
+          ),
+          RECEIPT_STATUS_FAILED,
+        ],
+      );
+      return rows.map((row) =>
+        row.k == null ? null : mapRuntimeWorkReceiptRow(row),
+      );
+    },
+  );
+}
+
+export async function heartbeatRuntimeWorkReceipts(
+  context: RuntimeApiContext,
+  input: {
+    playName: string;
+    runId: string;
+    runAttempt?: number | null;
+    leaseId: string;
+    keys: string[];
+    leaseTtlMs?: number | null;
+  },
+): Promise<Array<WorkReceipt | null>> {
+  const keys = input.keys.map((key) => key.trim()).filter(Boolean);
+  if (keys.length === 0) return [];
+  const leaseId = input.leaseId.trim();
+  if (!leaseId) return keys.map(() => null);
+  const runAttempt = normalizeRuntimeRunAttempt(input.runAttempt);
+  const leaseTtlMs = normalizeRuntimeLeaseTtlMs(
+    input.leaseTtlMs,
+    PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
+  );
+  const session = await getRuntimeWorkReceiptSessionForKeys(context, {
+    playName: input.playName,
+    keys,
+  });
+  return await withRuntimeWorkReceiptClient(
+    context,
+    session,
+    async (client) => {
+      const { rows } = await client.query<Record<string, unknown>>(
+        `
+      WITH input_keys AS (
+        SELECT key_values.key_hex, key_values.ord
+        FROM unnest($1::text[]) WITH ORDINALITY AS key_values(key_hex, ord)
+      ),
+      renewed AS (
+        UPDATE ${workReceiptTable(session)} AS target
+           SET lease_expires_at = now() + ($4::double precision * interval '1 millisecond'),
+               updated_at = now()
+          FROM input_keys
+         WHERE target.k = decode(input_keys.key_hex, 'hex')
+           AND ${workReceiptHeartbeatPredicateSql({
+             receiptTable: 'target',
+             ownerRunIdSql: '$2::text',
+             ownerRunAttemptSql: '$5',
+             leaseIdSql: '$3::text',
+           })}
+        RETURNING target.k,
+                  target.status,
+                  target.output,
+                  target.error,
+                  target.failure_kind,
+                  target.run_id,
+                  target.lease_id,
+                  target.lease_owner_run_id,
+                  target.lease_owner_attempt,
+                  target.lease_expires_at,
+                  target.updated_at,
+                  input_keys.ord
       ),
       returned AS (
-        SELECT k, status, output, error, run_id, updated_at, ord FROM failed
-        UNION ALL
-        SELECT k, status, output, error, run_id, updated_at, ord FROM latest
+        SELECT renewed.k,
+               renewed.status,
+               renewed.output,
+               renewed.error,
+               renewed.failure_kind,
+               renewed.run_id,
+               renewed.lease_id,
+               renewed.lease_owner_run_id,
+               renewed.lease_owner_attempt,
+               renewed.lease_expires_at,
+               renewed.updated_at,
+               input_keys.ord
+          FROM input_keys
+          LEFT JOIN renewed ON renewed.ord = input_keys.ord
       )
       SELECT convert_from(returned.k, 'UTF8') AS k,
              returned.status,
              returned.output,
              returned.error,
+             returned.failure_kind,
              returned.run_id,
+             returned.lease_id,
+             returned.lease_owner_run_id,
+             returned.lease_owner_attempt,
+             returned.lease_expires_at,
              returned.updated_at
         FROM returned
        ORDER BY returned.ord
     `,
         [
-          receipts.map((receipt) => workReceiptKeyHex(receipt.key)),
-          receipts.map((receipt) => receipt.runId),
-          receipts.map((receipt) => receipt.error),
-          RECEIPT_STATUS_FAILED,
-          RECEIPT_STATUS_RUNNING,
+          keys.map(workReceiptKeyHex),
+          input.runId,
+          leaseId,
+          leaseTtlMs,
+          runAttempt,
         ],
       );
-      return rows.map(mapRuntimeWorkReceiptRow);
+      return rows.map((row) =>
+        row.k == null ? null : mapRuntimeWorkReceiptRow(row),
+      );
     },
   );
 }
@@ -3245,6 +4463,8 @@ export async function skipRuntimeWorkReceipt(
     playName: string;
     runId: string;
     key: string;
+    runAttempt?: number | null;
+    leaseId?: string | null;
     output: unknown;
   },
 ): Promise<WorkReceipt | null> {
@@ -3256,36 +4476,50 @@ export async function skipRuntimeWorkReceipt(
     context,
     session,
     async (client) => {
+      const leaseId = input.leaseId?.trim() || null;
+      const runAttempt = normalizeRuntimeRunAttempt(input.runAttempt);
       const { rows } = await client.query<Record<string, unknown>>(
         `
         WITH skipped AS (
           UPDATE ${workReceiptTable(session)}
-          SET status = $2::smallint,
-              output = $3::jsonb,
-              error = NULL,
+	          SET status = $2::smallint,
+	              output = $3::jsonb,
+	              error = NULL,
+	              failure_kind = 0,
               run_id = $4,
+              lease_id = NULL,
+              lease_owner_run_id = NULL,
+              lease_owner_attempt = NULL,
+              lease_expires_at = NULL,
               updated_at = now()
           WHERE k = decode($1, 'hex')
-            AND status = $5::smallint
-            AND run_id = $4
-          RETURNING convert_from(k, 'UTF8') AS k, status, output, error, run_id, updated_at
-        ),
-        latest AS (
-          SELECT convert_from(k, 'UTF8') AS k, status, output, error, run_id, updated_at
-            FROM ${workReceiptTable(session)}
-           WHERE k = decode($1, 'hex')
-             AND NOT EXISTS (SELECT 1 FROM skipped)
-        )
-        SELECT k, status, output, error, run_id, updated_at FROM skipped
-        UNION ALL
-        SELECT k, status, output, error, run_id, updated_at FROM latest
+            AND ${workReceiptRunningOwnerPredicateSql({
+              receiptTable: workReceiptTable(session),
+              ownerRunIdSql: '$4',
+              ownerRunAttemptSql: '$6',
+              leaseIdSql: '$5::text',
+            })}
+	          RETURNING convert_from(k, 'UTF8') AS k,
+	                    status,
+	                    output,
+	                    error,
+	                    failure_kind,
+	                    run_id,
+	                    lease_id,
+	                    lease_owner_run_id,
+	                    lease_owner_attempt,
+	                    lease_expires_at,
+	                    updated_at
+	        )
+	        SELECT k, status, output, error, failure_kind, run_id, lease_id, lease_owner_run_id, lease_owner_attempt, lease_expires_at, updated_at FROM skipped
       `,
         [
           workReceiptKeyHex(input.key),
           RECEIPT_STATUS_SKIPPED,
           input.output === null ? null : stringifyPostgresJson(input.output),
           input.runId,
-          RECEIPT_STATUS_RUNNING,
+          leaseId,
+          runAttempt,
         ],
       );
       return rows[0] ? mapRuntimeWorkReceiptRow(rows[0]) : null;
@@ -3302,6 +4536,11 @@ export async function startRuntimeSheetDataset(
     sheetContract: PlaySheetContract;
     rows: Record<string, unknown>[];
     runId: string;
+    attemptId?: string | null;
+    attemptOwnerRunId?: string | null;
+    attemptExpiresAt?: string | null;
+    attemptSeq?: number | null;
+    attemptLeaseTtlMs?: number | null;
     inputOffset?: number;
     force?: boolean;
   },
@@ -3378,6 +4617,7 @@ export async function startRuntimeSheetDataset(
       skipped: input.rows.length,
       pendingRows: [],
       completedRows: [],
+      blockedRows: [],
       tableNamespace: input.tableNamespace,
       timings: [
         ...timings,
@@ -3426,7 +4666,12 @@ export async function startRuntimeSheetDataset(
   const normalizedTableNamespace = normalizeTableNamespace(
     input.tableNamespace,
   );
-
+  const attemptId = normalizeRuntimeSheetAttemptId(input.attemptId);
+  const attemptOwnerRunId = normalizeRuntimeSheetAttemptOwnerRunId({
+    attemptOwnerRunId: input.attemptOwnerRunId,
+    runId: input.runId,
+  });
+  const attemptSeq = normalizeRuntimeRunAttempt(input.attemptSeq);
   const chunks = chunkValues(rowEntries, DIRECT_POSTGRES_BATCH_SIZE);
   const needsTransaction = chunks.length > 1;
 
@@ -3441,12 +4686,26 @@ export async function startRuntimeSheetDataset(
       timings,
     },
     async (client) => {
+      const attemptExpiryStartedAt = Date.now();
+      const attemptExpiresAt = await mintRuntimeSheetAttemptExpiresAt(
+        client,
+        input.attemptLeaseTtlMs,
+      );
+      timings.push({
+        phase: 'attempt_expiry_mint',
+        ms: Date.now() - attemptExpiryStartedAt,
+        rows: rowEntries.length,
+      });
       const prepareStartedAt = Date.now();
       const prepared = await prepareRuntimeSheetDatasetRows(client, session, {
         chunks,
         runId: input.runId,
         normalizedPlayName,
         normalizedTableNamespace,
+        attemptId,
+        attemptOwnerRunId,
+        attemptExpiresAt,
+        attemptSeq,
         physicalInsertColumnsSql,
         physicalInsertValuesSql,
         physicalRefreshSetSql:
@@ -3455,19 +4714,15 @@ export async function startRuntimeSheetDataset(
         outputPhysicalColumns,
         force: input.force === true,
       });
-      const effectivePrepared = input.force
-        ? {
-            inserted: prepared.inserted,
-            pendingKeys: rowEntries.map((entry) => entry.key),
-          }
-        : prepared;
       timings.push({
         phase: 'prepare_rows_sql',
         ms: Date.now() - prepareStartedAt,
         rows: rowEntries.length,
         chunks: chunks.length,
-        inserted: effectivePrepared.inserted,
-        pending: effectivePrepared.pendingKeys.length,
+        inserted: prepared.inserted,
+        pending: prepared.rowDispositions.filter(
+          (row) => row.disposition === 'pending',
+        ).length,
         ...(input.force ? { force: true } : {}),
       });
       const buildStartedAt = Date.now();
@@ -3479,9 +4734,13 @@ export async function startRuntimeSheetDataset(
         normalizedPlayName,
         normalizedTableNamespace,
         runId: input.runId,
+        attemptId,
+        attemptOwnerRunId,
+        attemptExpiresAt,
+        attemptSeq,
         timings,
         force: input.force === true,
-        ...effectivePrepared,
+        ...prepared,
       });
       timings.push({
         phase: 'build_result',
@@ -3492,7 +4751,11 @@ export async function startRuntimeSheetDataset(
         pending: built.pendingRows.length,
         completed: built.completedRows.length,
       });
-      return built;
+      return {
+        ...built,
+        attemptExpiresAt,
+        attemptSeq,
+      };
     },
   );
   timings.push({
@@ -3505,7 +4768,298 @@ export async function startRuntimeSheetDataset(
     pending: result.pendingRows.length,
     completed: result.completedRows.length,
   });
-  return { ...result, timings };
+  return {
+    ...result,
+    attemptId,
+    attemptOwnerRunId,
+    attemptExpiresAt: result.attemptExpiresAt,
+    attemptSeq,
+    timings,
+  };
+}
+
+export async function heartbeatRuntimeSheetAttempt(
+  context: RuntimeApiContext,
+  input: {
+    playName: string;
+    tableNamespace: string;
+    sheetContract: PlaySheetContract;
+    runId: string;
+    attemptId: string;
+    attemptOwnerRunId?: string | null;
+    attemptSeq?: number | null;
+    attemptLeaseTtlMs?: number | null;
+    keys: string[];
+  },
+): Promise<RuntimeSheetAttemptHeartbeatResult> {
+  const playName = context.playName?.trim() || input.playName;
+  if (!playName) {
+    throw new Error('Runtime sheet attempt heartbeat requires a playName.');
+  }
+  const attemptId = input.attemptId.trim();
+  const attemptOwnerRunId = normalizeRuntimeSheetAttemptOwnerRunId({
+    attemptOwnerRunId: input.attemptOwnerRunId,
+    runId: input.runId,
+  });
+  const attemptSeq = normalizeRuntimeRunAttempt(input.attemptSeq);
+  const attemptLeaseTtlMs = normalizeRuntimeLeaseTtlMs(
+    input.attemptLeaseTtlMs,
+    PLAY_RUNTIME_SHEET_ATTEMPT_LEASE_TTL_MS,
+  );
+  const keys = [
+    ...new Set(input.keys.map((key) => key.trim()).filter(Boolean)),
+  ];
+  if (!attemptId || keys.length === 0) {
+    return { renewed: 0, renewedKeys: [], attemptExpiresAt: null };
+  }
+  const timings: RuntimeSheetTiming[] = [];
+  const session = requireRuntimePostgresSession(
+    await getRuntimeDbSession(
+      {
+        ...context,
+        playName,
+        runId: context.runId ?? input.runId,
+      },
+      {
+        tableNamespace: input.tableNamespace,
+        logicalTable: 'sheet_rows',
+        operations: ['rows.upsert'],
+        limits: {
+          maxRows: runtimeDbSessionRowLimit(keys.length),
+        },
+        sheetContract: input.sheetContract,
+        timings,
+      },
+    ),
+  );
+  return await withRuntimeSheetQueryClient(
+    context,
+    session,
+    {
+      playName,
+      tableNamespace: input.tableNamespace,
+      sheetContract: input.sheetContract,
+      transactional: false,
+      timings,
+    },
+    async (client) => {
+      const { rows } = await client.query<{
+        renewed_keys: string[];
+        renewed: number;
+        attempt_expires_at: Date | string | null;
+      }>(
+        `
+        WITH input_keys AS (
+          SELECT key_values._key
+          FROM unnest($1::text[]) AS key_values(_key)
+        ),
+        owned_terminal AS (
+          SELECT target._key
+            FROM ${sheetTable(session)} AS target
+            JOIN input_keys ON target._key = input_keys._key
+           WHERE target._attempt_id = $2::text
+             AND coalesce(target._attempt_owner_run_id, target._run_id) = $3::text
+             AND target._run_id = $4::text
+             AND COALESCE(target._attempt_seq, 0) = $6::integer
+             AND target._status = 'enriched'
+        ),
+        renewed AS (
+          UPDATE ${sheetTable(session)} AS target
+             SET _attempt_expires_at = now() + ($5::double precision * interval '1 millisecond'),
+                 _updated_at = now(),
+                 _version = ${nextRuntimeSheetVersionExpression(session)}
+            FROM input_keys
+           WHERE target._key = input_keys._key
+             AND target._attempt_id = $2::text
+             AND coalesce(target._attempt_owner_run_id, target._run_id) = $3::text
+             AND target._run_id = $4::text
+             AND COALESCE(target._attempt_seq, 0) = $6::integer
+             AND target._status IN ('pending', 'running', 'failed')
+           RETURNING target._key, target._attempt_expires_at
+        ),
+        owned_keys AS (
+          SELECT _key FROM renewed
+          UNION
+          SELECT _key FROM owned_terminal
+        )
+        SELECT coalesce((SELECT array_agg(_key ORDER BY _key) FROM owned_keys), '{}'::text[]) AS renewed_keys,
+               count(*)::int AS renewed,
+               max(_attempt_expires_at) AS attempt_expires_at
+          FROM renewed
+        `,
+        [
+          keys,
+          attemptId,
+          attemptOwnerRunId,
+          input.runId,
+          attemptLeaseTtlMs,
+          attemptSeq,
+        ],
+      );
+      const row = rows[0];
+      const attemptExpiresAt = row?.attempt_expires_at;
+      return {
+        renewed: Number(row?.renewed ?? 0),
+        renewedKeys: row?.renewed_keys ?? [],
+        attemptExpiresAt:
+          attemptExpiresAt instanceof Date
+            ? attemptExpiresAt.toISOString()
+            : typeof attemptExpiresAt === 'string'
+              ? new Date(attemptExpiresAt).toISOString()
+              : null,
+      };
+    },
+  );
+}
+
+/**
+ * Controlled run-fatal teardown for runtime sheet rows: clear the attempt lease
+ * (`_attempt_*`) on every row the aborting attempt still owns, so an immediate
+ * rerun can claim pending rows and overwrite the aborted attempt's rows without
+ * waiting out the 10-minute lease TTL. The predicate is attempt-fenced (see
+ * `releasableRuntimeSheetAttemptFenceSql` / `decideRuntimeSheetRelease`): it only
+ * touches rows owned by this run's attempt generation, so it can never weaken a
+ * different run's live lease. TTL expiry remains the recovery path for true
+ * crashes where no teardown code runs. When `attemptId` is null every attempt id
+ * the run holds at `attemptSeq` is released (the workers runner mints a distinct
+ * attempt id per map chunk under one owner run id + seq).
+ */
+export async function releaseRuntimeSheetAttempt(
+  context: RuntimeApiContext,
+  input: {
+    playName: string;
+    tableNamespace: string;
+    sheetContract: PlaySheetContract;
+    runId: string;
+    attemptId?: string | null;
+    attemptOwnerRunId?: string | null;
+    attemptSeq?: number | null;
+  },
+): Promise<RuntimeSheetAttemptReleaseResult> {
+  const playName = context.playName?.trim() || input.playName;
+  if (!playName) {
+    throw new Error('Runtime sheet attempt release requires a playName.');
+  }
+  const attemptId = input.attemptId?.trim() || null;
+  const attemptOwnerRunId = normalizeRuntimeSheetAttemptOwnerRunId({
+    attemptOwnerRunId: input.attemptOwnerRunId,
+    runId: input.runId,
+  });
+  const attemptSeq = normalizeRuntimeRunAttempt(input.attemptSeq);
+  if (!attemptOwnerRunId) {
+    return { released: 0, releasedKeys: [] };
+  }
+  const timings: RuntimeSheetTiming[] = [];
+  const session = requireRuntimePostgresSession(
+    await getRuntimeDbSession(
+      {
+        ...context,
+        playName,
+        runId: context.runId ?? input.runId,
+      },
+      {
+        tableNamespace: input.tableNamespace,
+        logicalTable: 'sheet_rows',
+        operations: ['rows.upsert'],
+        limits: {},
+        sheetContract: input.sheetContract,
+        timings,
+      },
+    ),
+  );
+  return await withRuntimeSheetQueryClient(
+    context,
+    session,
+    {
+      playName,
+      tableNamespace: input.tableNamespace,
+      sheetContract: input.sheetContract,
+      transactional: false,
+      timings,
+    },
+    async (client) => {
+      const { rows } = await client.query<{ _key: string }>(
+        `
+        UPDATE ${sheetTable(session)} AS target
+           SET _attempt_id = NULL,
+               _attempt_owner_run_id = NULL,
+               _attempt_expires_at = NULL,
+               _attempt_seq = NULL,
+               _updated_at = now(),
+               _version = ${nextRuntimeSheetVersionExpression(session)}
+         WHERE ${releasableRuntimeSheetAttemptFenceSql(
+           'target',
+           '$1::text',
+           '$2::text',
+           '$3',
+         )}
+        RETURNING target._key
+        `,
+        [attemptId, attemptOwnerRunId, attemptSeq],
+      );
+      const releasedKeys = rows
+        .map((row) => row._key)
+        .filter((key): key is string => typeof key === 'string');
+      return { released: releasedKeys.length, releasedKeys };
+    },
+  );
+}
+
+/**
+ * Controlled run-fatal teardown for work receipts: return every receipt still
+ * leased `running` by the aborting run+attempt back to `pending` (clearing the
+ * lease) so an immediate rerun can reclaim and recompute the interrupted work
+ * without waiting out the lease TTL. Fenced by owner run id + attempt (see
+ * `workReceiptReleaseOwnerPredicateSql`), so it never touches a receipt a live
+ * competitor legitimately holds. Completed/skipped/failed receipts are terminal
+ * and untouched, preserving cross-run idempotency (already-persisted work is
+ * still reused on rerun). Work receipts for a play share one table, so a single
+ * run-scoped statement covers every stranded receipt.
+ */
+export async function releaseRuntimeWorkReceipts(
+  context: RuntimeApiContext,
+  input: {
+    playName: string;
+    runId: string;
+    runAttempt?: number | null;
+  },
+): Promise<RuntimeWorkReceiptReleaseResult> {
+  const runId = input.runId.trim();
+  if (!runId) {
+    return { released: 0, releasedKeys: [] };
+  }
+  const runAttempt = normalizeRuntimeRunAttempt(input.runAttempt);
+  const session = await getRuntimeWorkReceiptSessionForRun(context, {
+    playName: input.playName,
+  });
+  return await withRuntimeWorkReceiptClient(
+    context,
+    session,
+    async (client) => {
+      const { rows } = await client.query<{ k: string }>(
+        `
+        UPDATE ${workReceiptTable(session)} AS target
+           SET status = $3::smallint,
+               lease_id = NULL,
+               lease_owner_run_id = NULL,
+               lease_owner_attempt = NULL,
+               lease_expires_at = NULL,
+               updated_at = now()
+         WHERE ${workReceiptReleaseOwnerPredicateSql({
+           receiptTable: 'target',
+           ownerRunIdSql: '$1',
+           ownerRunAttemptSql: '$2',
+         })}
+        RETURNING convert_from(target.k, 'UTF8') AS k
+        `,
+        [runId, runAttempt, RECEIPT_STATUS_PENDING],
+      );
+      const releasedKeys = rows
+        .map((row) => row.k)
+        .filter((key): key is string => typeof key === 'string');
+      return { released: releasedKeys.length, releasedKeys };
+    },
+  );
 }
 
 type CompleteRuntimeMapRowChunksInput = {
@@ -3513,17 +5067,41 @@ type CompleteRuntimeMapRowChunksInput = {
   physicalUpdateSetSql: string;
   physicalColumnProjections: PhysicalSheetColumnProjection[];
   runId: string;
+  attemptId: string | null;
+  attemptOwnerRunId: string | null;
+  attemptExpiresAt: string | null;
+  attemptSeq: number;
   normalizedPlayName: string;
   normalizedTableNamespace: string;
   outputFields: string[];
 };
 
+type RuntimeMapRowsWriteResult = {
+  updated: number;
+  fencedKeys: string[];
+};
+
+function writableEnrichedRuntimeSheetAttemptSql(
+  tableAlias: string,
+  attemptOwnerRunIdExpression: string,
+  attemptExpiresAtExpression: string,
+  attemptSeqExpression: string,
+): string {
+  return `(
+    ${tableAlias}._status = 'enriched'
+    AND (
+      COALESCE(${tableAlias}._attempt_seq, 0) < ${attemptSeqExpression}::integer
+    )
+  )`;
+}
+
 async function completeRuntimeMapRowChunks(
   client: RuntimeQueryClient,
   session: RuntimePostgresSession,
   input: CompleteRuntimeMapRowChunksInput,
-): Promise<{ updated: number }> {
+): Promise<RuntimeMapRowsWriteResult> {
   let updated = 0;
+  const fencedKeys: string[] = [];
   for (const chunk of input.chunks) {
     const chunkKeys = chunk.map((row) => row.key);
     const chunkInputIndexes = chunk.map((row) => row.input_index);
@@ -3538,9 +5116,21 @@ async function completeRuntimeMapRowChunks(
       'updates.data_patch',
       input.physicalColumnProjections,
     );
+    const writableEnrichedAttemptSql = writableEnrichedRuntimeSheetAttemptSql(
+      'target',
+      '$10::text',
+      '$11::timestamptz',
+      '$12',
+    );
+    const sameOwnerTerminalEpochSql = sameOwnerTerminalAttemptEpochSql(
+      'target',
+      '$10::text',
+      '$12',
+    );
     const { rows } = await client.query<{
       updated: number;
       matched_keys: string[];
+      fenced_keys: string[];
     }>(
       `WITH updates AS (
          SELECT key_values._key,
@@ -3571,12 +5161,22 @@ async function completeRuntimeMapRowChunks(
          SET _status = 'enriched',
              _run_id = $5::text,
              _error = NULL,
+             _attempt_id = $9::text,
+             _attempt_owner_run_id = $10::text,
+             _attempt_expires_at = $11::timestamptz,
+             _attempt_seq = $12::integer,
              _updated_at = now(),
              _version = ${nextRuntimeSheetVersionExpression(session)},
              _cell_meta = ${mergeRuntimeCellMetaPatchSql('target._cell_meta', 'updates.cell_meta_patch')}${input.physicalUpdateSetSql}
          FROM matched_updates AS updates
          WHERE target._key = updates.matched_key
-           AND (target._run_id IS NULL OR target._run_id <= $5::text)
+		           AND NOT (${newerTerminalRuntimeSheetRowSql('target', '$11::timestamptz', '$12::integer', '$9::text', '$10::text')})
+           AND NOT (${sameOwnerTerminalEpochSql})
+           AND (
+             ($9::text IS NULL AND target._run_id = $5::text)
+             OR ($9::text IS NOT NULL AND ${activeRuntimeSheetAttemptFenceSql('target', '$9::text', '$10::text', '$11::timestamptz', '$12::integer')})
+		             OR ($9::text IS NOT NULL AND ${writableEnrichedAttemptSql})
+           )
            AND (
              target._status <> 'enriched'
              OR target._run_id IS DISTINCT FROM $5::text
@@ -3596,6 +5196,23 @@ async function completeRuntimeMapRowChunks(
                 count(*) FILTER (WHERE prev_status <> 'enriched')::bigint AS newly_completed
            FROM applied_rows
        ),
+       fenced_rows AS (
+         SELECT updates.matched_key AS _key
+           FROM matched_updates AS updates
+           JOIN ${sheetTable(session)} AS target
+             ON target._key = updates.matched_key
+          WHERE NOT EXISTS (
+                  SELECT 1 FROM applied_rows WHERE applied_rows._key = updates.matched_key
+                )
+            AND (
+	              (${newerTerminalRuntimeSheetRowSql('target', '$11::timestamptz', '$12::integer', '$9::text', '$10::text')})
+              OR NOT (
+                ($9::text IS NULL AND target._run_id = $5::text)
+                OR ($9::text IS NOT NULL AND ${activeRuntimeSheetAttemptFenceSql('target', '$9::text', '$10::text', '$11::timestamptz', '$12::integer')})
+                OR ($9::text IS NOT NULL AND ${writableEnrichedAttemptSql})
+              )
+            )
+       ),
        summary_counts AS (
          SELECT newly_completed,
                 from_failed,
@@ -3680,6 +5297,7 @@ async function completeRuntimeMapRowChunks(
        SELECT
          (SELECT count(*)::int FROM applied_rows) AS updated,
          coalesce((SELECT array_agg(matched_key) FROM matched_updates), '{}'::text[]) AS matched_keys,
+         coalesce((SELECT array_agg(_key) FROM fenced_rows), '{}'::text[]) AS fenced_keys,
          (SELECT count(*)::int FROM summary_delta) AS summary_delta_count,
          (SELECT count(*)::int FROM column_delta) AS column_delta_count`,
       [
@@ -3691,9 +5309,14 @@ async function completeRuntimeMapRowChunks(
         input.normalizedPlayName,
         input.normalizedTableNamespace,
         [...new Set(input.outputFields)],
+        input.attemptId,
+        input.attemptOwnerRunId,
+        input.attemptExpiresAt,
+        input.attemptSeq,
       ],
     );
     updated += Number(rows[0]?.updated ?? 0);
+    fencedKeys.push(...(rows[0]?.fenced_keys ?? []));
 
     const matchedKeys = new Set(rows[0]?.matched_keys ?? []);
     if (matchedKeys.size === chunk.length) {
@@ -3712,16 +5335,18 @@ async function completeRuntimeMapRowChunks(
       { ...input, chunks: [repairChunk] },
     );
     updated += repaired.updated;
+    fencedKeys.push(...repaired.fencedKeys);
   }
-  return { updated };
+  return { updated, fencedKeys };
 }
 
 async function completeRuntimeMapRowChunksWithInputIndexRepair(
   client: RuntimeQueryClient,
   session: RuntimePostgresSession,
   input: CompleteRuntimeMapRowChunksInput,
-): Promise<{ updated: number }> {
+): Promise<RuntimeMapRowsWriteResult> {
   let updated = 0;
+  const fencedKeys: string[] = [];
   for (const chunk of input.chunks) {
     const chunkKeys = chunk.map((row) => row.key);
     const chunkInputIndexes = chunk.map((row) => row.input_index);
@@ -3736,7 +5361,22 @@ async function completeRuntimeMapRowChunksWithInputIndexRepair(
       'updates.data_patch',
       input.physicalColumnProjections,
     );
-    const { rows: appliedRows } = await client.query<{ _key: string }>(
+    const writableEnrichedAttemptSql = writableEnrichedRuntimeSheetAttemptSql(
+      'target',
+      '$10::text',
+      '$11::timestamptz',
+      '$12',
+    );
+    const sameOwnerTerminalEpochSql = sameOwnerTerminalAttemptEpochSql(
+      'target',
+      '$10::text',
+      '$12',
+    );
+    const { rows } = await client.query<{
+      _key?: string;
+      fenced_keys?: string[];
+      updated?: number;
+    }>(
       `WITH updates AS (
          SELECT key_values._key,
                 input_index_values.input_index,
@@ -3770,13 +5410,23 @@ async function completeRuntimeMapRowChunksWithInputIndexRepair(
          SET _status = 'enriched',
              _run_id = $5::text,
              _error = NULL,
+             _attempt_id = $9::text,
+             _attempt_owner_run_id = $10::text,
+             _attempt_expires_at = $11::timestamptz,
+             _attempt_seq = $12::integer,
              _updated_at = now(),
              _version = ${nextRuntimeSheetVersionExpression(session)},
              _cell_meta = ${mergeRuntimeCellMetaPatchSql('target._cell_meta', 'updates.cell_meta_patch')}${input.physicalUpdateSetSql}
          FROM matched_updates AS updates, ${sheetTable(session)} AS prev
          WHERE target._key = updates.matched_key
            AND prev._key = target._key
-           AND (target._run_id IS NULL OR target._run_id <= $5::text)
+		           AND NOT (${newerTerminalRuntimeSheetRowSql('target', '$11::timestamptz', '$12::integer', '$9::text', '$10::text')})
+           AND NOT (${sameOwnerTerminalEpochSql})
+           AND (
+             ($9::text IS NULL AND target._run_id = $5::text)
+             OR ($9::text IS NOT NULL AND ${activeRuntimeSheetAttemptFenceSql('target', '$9::text', '$10::text', '$11::timestamptz', '$12::integer')})
+		             OR ($9::text IS NOT NULL AND ${writableEnrichedAttemptSql})
+           )
            AND (
              target._status <> 'enriched'
              OR target._run_id IS DISTINCT FROM $5::text
@@ -3796,6 +5446,23 @@ async function completeRuntimeMapRowChunksWithInputIndexRepair(
                 count(*) FILTER (WHERE prev_status <> 'enriched')::bigint AS newly_completed
            FROM applied_rows
        ),
+       fenced_rows AS (
+         SELECT updates.matched_key AS _key
+           FROM matched_updates AS updates
+           JOIN ${sheetTable(session)} AS target
+             ON target._key = updates.matched_key
+          WHERE NOT EXISTS (
+                  SELECT 1 FROM applied_rows WHERE applied_rows._key = updates.matched_key
+                )
+            AND (
+              (${newerTerminalRuntimeSheetRowSql('target', '$11::timestamptz', '$12::integer', '$9::text', '$10::text')})
+              OR NOT (
+                ($9::text IS NULL AND target._run_id = $5::text)
+                OR ($9::text IS NOT NULL AND ${activeRuntimeSheetAttemptFenceSql('target', '$9::text', '$10::text', '$11::timestamptz', '$12::integer')})
+                OR ($9::text IS NOT NULL AND ${writableEnrichedAttemptSql})
+              )
+            )
+       ),
        summary_counts AS (
          SELECT newly_completed,
                 from_failed,
@@ -3877,7 +5544,9 @@ async function completeRuntimeMapRowChunksWithInputIndexRepair(
            _updated_at = now()
          RETURNING 1
        )
-       SELECT _key FROM applied_rows`,
+       SELECT
+         (SELECT count(*)::int FROM applied_rows) AS updated,
+         coalesce((SELECT array_agg(_key) FROM fenced_rows), '{}'::text[]) AS fenced_keys`,
       [
         chunkKeys,
         chunkInputIndexes,
@@ -3887,11 +5556,16 @@ async function completeRuntimeMapRowChunksWithInputIndexRepair(
         input.normalizedPlayName,
         input.normalizedTableNamespace,
         [...new Set(input.outputFields)],
+        input.attemptId,
+        input.attemptOwnerRunId,
+        input.attemptExpiresAt,
+        input.attemptSeq,
       ],
     );
-    updated += appliedRows.length;
+    updated += Number(rows[0]?.updated ?? 0);
+    fencedKeys.push(...(rows[0]?.fenced_keys ?? []));
   }
-  return { updated };
+  return { updated, fencedKeys };
 }
 
 async function insertMissingCompletedMapRowChunks(
@@ -3954,8 +5628,26 @@ async function insertMissingCompletedMapRowChunks(
           )
        ),
        inserted_rows AS (
-         INSERT INTO ${sheetTable(session)} (_key, _status, _run_id, _input_index, _cell_meta${physicalInsertColumnsSql})
-         SELECT _key, 'enriched', $5::text, input_index, cell_meta_patch${physicalInsertValuesSql}
+         INSERT INTO ${sheetTable(session)} (
+           _key,
+           _status,
+           _run_id,
+           _input_index,
+           _attempt_id,
+           _attempt_owner_run_id,
+           _attempt_expires_at,
+           _attempt_seq,
+           _cell_meta${physicalInsertColumnsSql}
+         )
+         SELECT _key,
+                'enriched',
+                $5::text,
+                input_index,
+                $8::text,
+                $9::text,
+                $10::timestamptz,
+                $11::integer,
+                cell_meta_patch${physicalInsertValuesSql}
            FROM missing_rows
          ON CONFLICT (_key) DO NOTHING
          RETURNING _key
@@ -3997,7 +5689,7 @@ async function insertMissingCompletedMapRowChunks(
        ),
        completed_cell_delta AS (
          SELECT field_values.field, (SELECT c FROM inserted_count) AS c
-           FROM unnest($8::text[]) AS field_values(field)
+           FROM unnest($12::text[]) AS field_values(field)
           WHERE (SELECT c FROM inserted_count) > 0
        ),
        column_delta AS (
@@ -4028,6 +5720,10 @@ async function insertMissingCompletedMapRowChunks(
         input.runId,
         input.normalizedPlayName,
         input.normalizedTableNamespace,
+        input.attemptId,
+        input.attemptOwnerRunId,
+        input.attemptExpiresAt,
+        input.attemptSeq,
         [...new Set(input.outputFields)],
       ],
     );
@@ -4053,12 +5749,18 @@ async function failRuntimeMapRowChunks(
   input: {
     chunks: RuntimePreparedFailedRow[][];
     physicalUpdateSetSql: string;
+    forceTerminal?: boolean;
     runId: string;
+    attemptId: string | null;
+    attemptOwnerRunId: string | null;
+    attemptExpiresAt: string | null;
+    attemptSeq: number;
     normalizedPlayName: string;
     normalizedTableNamespace: string;
   },
-): Promise<{ updated: number }> {
+): Promise<RuntimeMapRowsWriteResult> {
   let updated = 0;
+  const fencedKeys: string[] = [];
   for (const chunk of input.chunks) {
     const chunkKeys = chunk.map((row) => row.key);
     const chunkInputIndexes = chunk.map((row) => row.input_index);
@@ -4087,7 +5789,10 @@ async function failRuntimeMapRowChunks(
     const failedCellTotals = failedCellFields.map(
       (field) => failedCellCounts.get(field) ?? 0,
     );
-    const { rows: appliedRows } = await client.query<{ _key: string }>(
+    const { rows } = await client.query<{
+      updated?: number;
+      fenced_keys?: string[];
+    }>(
       `WITH updates AS (
          SELECT key_values._key,
                 input_index_values.input_index,
@@ -4125,26 +5830,53 @@ async function failRuntimeMapRowChunks(
          SET _status = 'failed',
              _run_id = $6::text,
              _error = updates.error,
+             _attempt_id = $11::text,
+             _attempt_owner_run_id = $12::text,
+             _attempt_expires_at = $13::timestamptz,
+             _attempt_seq = $14::integer,
              _updated_at = now(),
              _version = ${nextRuntimeSheetVersionExpression(session)},
              _cell_meta = ${mergeRuntimeCellMetaPatchSql('target._cell_meta', 'updates.cell_meta_patch')}${input.physicalUpdateSetSql}
          FROM matched_updates AS updates, ${sheetTable(session)} AS prev
          WHERE target._key = updates.matched_key
            AND prev._key = target._key
-           AND target._status <> 'enriched'
-           AND (target._run_id IS NULL OR target._run_id <= $6::text)
+           AND ($15::boolean OR target._status <> 'enriched')
+		           AND NOT (${newerTerminalRuntimeSheetRowSql('target', '$13::timestamptz', '$14::integer', '$11::text', '$12::text')})
+           AND (
+             ($11::text IS NULL AND target._run_id = $6::text)
+             OR ($11::text IS NOT NULL AND ${activeRuntimeSheetAttemptFenceSql('target', '$11::text', '$12::text', '$13::timestamptz', '$14::integer')})
+	           )
          RETURNING target._key, prev._status AS prev_status
        ),
        applied_count AS (
          SELECT count(*)::bigint AS c,
                 count(*) FILTER (WHERE prev_status = 'failed')::bigint AS already_failed,
+                count(*) FILTER (WHERE prev_status = 'enriched')::bigint AS from_completed,
                 count(*) FILTER (WHERE prev_status = 'running')::bigint AS from_running
            FROM applied_rows
        ),
+       fenced_rows AS (
+         SELECT updates.matched_key AS _key
+           FROM matched_updates AS updates
+           JOIN ${sheetTable(session)} AS target
+             ON target._key = updates.matched_key
+          WHERE NOT EXISTS (
+                  SELECT 1 FROM applied_rows WHERE applied_rows._key = updates.matched_key
+                )
+            AND (
+              (NOT $15::boolean AND target._status = 'enriched')
+              OR (${newerTerminalRuntimeSheetRowSql('target', '$13::timestamptz', '$14::integer', '$11::text', '$12::text')})
+              OR NOT (
+                ($11::text IS NULL AND target._run_id = $6::text)
+                OR ($11::text IS NOT NULL AND ${activeRuntimeSheetAttemptFenceSql('target', '$11::text', '$12::text', '$13::timestamptz', '$14::integer')})
+              )
+            )
+       ),
        summary_counts AS (
          SELECT (c - already_failed)::bigint AS newly_failed,
+                from_completed,
                 from_running,
-                GREATEST(c - already_failed - from_running, 0)::bigint AS from_queued
+                GREATEST(c - already_failed - from_completed - from_running, 0)::bigint AS from_queued
            FROM applied_count
        ),
        summary_delta AS (
@@ -4162,20 +5894,21 @@ async function failRuntimeMapRowChunks(
                 0,
                 (-from_queued)::int,
                 (-from_running)::int,
-                0,
+                (-from_completed)::int,
                 newly_failed::int
            FROM summary_counts
           WHERE newly_failed > 0
          ON CONFLICT (play_name, table_namespace) DO UPDATE SET
            queued = GREATEST(target.queued + EXCLUDED.queued, 0),
            running = GREATEST(target.running + EXCLUDED.running, 0),
+           completed = GREATEST(target.completed + EXCLUDED.completed, 0),
            failed = GREATEST(target.failed + EXCLUDED.failed, 0),
            total = ${runtimeSummaryTotalSql({
              currentTotal: 'target.total',
              totalDelta: 'EXCLUDED.total',
              queued: 'GREATEST(target.queued + EXCLUDED.queued, 0)',
              running: 'GREATEST(target.running + EXCLUDED.running, 0)',
-             completed: 'target.completed',
+             completed: 'GREATEST(target.completed + EXCLUDED.completed, 0)',
              failed: 'GREATEST(target.failed + EXCLUDED.failed, 0)',
            })},
            _updated_at = now()
@@ -4198,7 +5931,9 @@ async function failRuntimeMapRowChunks(
            _updated_at = now()
          RETURNING 1
        )
-       SELECT _key FROM applied_rows`,
+       SELECT
+         (SELECT count(*)::int FROM applied_rows) AS updated,
+         coalesce((SELECT array_agg(_key) FROM fenced_rows), '{}'::text[]) AS fenced_keys`,
       [
         chunkKeys,
         chunkInputIndexes,
@@ -4210,11 +5945,17 @@ async function failRuntimeMapRowChunks(
         input.normalizedTableNamespace,
         failedCellFields,
         failedCellTotals,
+        input.attemptId,
+        input.attemptOwnerRunId,
+        input.attemptExpiresAt,
+        input.attemptSeq,
+        input.forceTerminal === true,
       ],
     );
-    updated += appliedRows.length;
+    updated += Number(rows[0]?.updated ?? 0);
+    fencedKeys.push(...(rows[0]?.fenced_keys ?? []));
   }
-  return { updated };
+  return { updated, fencedKeys };
 }
 
 /**
@@ -4240,10 +5981,15 @@ export async function completeRuntimeMapRows(
     rows: RuntimeApiRowRecord[];
     outputFields?: string[];
     runId: string;
+    attemptId?: string | null;
+    attemptOwnerRunId?: string | null;
+    attemptExpiresAt?: string | null;
+    attemptSeq?: number | null;
+    forceFailedRows?: boolean;
   },
-): Promise<{ updated: number }> {
+): Promise<RuntimeMapRowsWriteResult> {
   if (input.rows.length === 0) {
-    return { updated: 0 };
+    return { updated: 0, fencedKeys: [] };
   }
   const sheetContract = augmentSheetContractWithDatasetFields({
     contract: input.sheetContract,
@@ -4276,7 +6022,7 @@ export async function completeRuntimeMapRows(
     uniqueRows.set(row.key, row);
   }
   if (uniqueRows.size === 0) {
-    return { updated: 0 };
+    return { updated: 0, fencedKeys: [] };
   }
 
   const projections = physicalSheetColumnProjections(sheetContract);
@@ -4304,6 +6050,11 @@ export async function completeRuntimeMapRows(
   const failedChunks = chunkValues(failedRows, DIRECT_POSTGRES_BATCH_SIZE);
   const needsTransaction = chunks.length + failedChunks.length > 1;
   const outputFields = [...new Set(input.outputFields ?? [])];
+  const attemptId = input.attemptId?.trim() || null;
+  const attemptOwnerRunId =
+    input.attemptOwnerRunId?.trim() || (attemptId ? input.runId : null);
+  const attemptExpiresAt = input.attemptExpiresAt?.trim() || null;
+  const attemptSeq = normalizeRuntimeRunAttempt(input.attemptSeq);
 
   return await withRuntimeSheetQueryClient(
     context,
@@ -4323,6 +6074,10 @@ export async function completeRuntimeMapRows(
                 physicalUpdateSetSql,
                 physicalColumnProjections: projections,
                 runId: input.runId,
+                attemptId,
+                attemptOwnerRunId,
+                attemptExpiresAt,
+                attemptSeq,
                 normalizedPlayName: normalizePlayNameForSheet(session.playName),
                 normalizedTableNamespace: normalizeTableNamespace(
                   input.tableNamespace,
@@ -4339,22 +6094,33 @@ export async function completeRuntimeMapRows(
                 session,
                 chunkInput,
               );
-              return { updated: updated.updated + inserted.inserted };
+              return {
+                updated: updated.updated + inserted.inserted,
+                fencedKeys: updated.fencedKeys,
+              };
             })()
-          : { updated: 0 };
+          : { updated: 0, fencedKeys: [] };
       const failed =
         failedRows.length > 0
           ? await failRuntimeMapRowChunks(client, session, {
               chunks: failedChunks,
               physicalUpdateSetSql,
+              forceTerminal: input.forceFailedRows === true,
               runId: input.runId,
+              attemptId,
+              attemptOwnerRunId,
+              attemptExpiresAt,
+              attemptSeq,
               normalizedPlayName: normalizePlayNameForSheet(session.playName),
               normalizedTableNamespace: normalizeTableNamespace(
                 input.tableNamespace,
               ),
             })
-          : { updated: 0 };
-      return { updated: completed.updated + failed.updated };
+          : { updated: 0, fencedKeys: [] };
+      return {
+        updated: completed.updated + failed.updated,
+        fencedKeys: [...completed.fencedKeys, ...failed.fencedKeys],
+      };
     },
   );
 }
@@ -4408,7 +6174,7 @@ export async function readRuntimeSheetDatasetRowKeys(
     tableNamespace: string;
     runId: string;
     keys: string[];
-    rowMode?: 'output' | 'all';
+    rowMode?: 'output' | 'all' | 'terminalAnyRun';
   },
 ): Promise<{ keys: string[] }> {
   const keys = [
@@ -4435,6 +6201,16 @@ export async function readRuntimeSheetDatasetRowKeys(
     ),
   );
   const rows = await withRuntimePostgres(session, async (client) => {
+    if (input.rowMode === 'terminalAnyRun') {
+      const { rows: matchedRows } = await client.query<{ _key: string }>(
+        `SELECT _key
+           FROM ${sheetTable(session)}
+          WHERE _key = ANY($1::text[])
+            AND _status IN ('enriched', 'failed')`,
+        [keys],
+      );
+      return matchedRows;
+    }
     if (input.rowMode === 'all') {
       const { rows: matchedRows } = await client.query<{ _key: string }>(
         `SELECT _key