deepline 0.1.199 → 0.1.200

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -2,18 +2,21 @@
  * PlayContextImpl — the cloud execution engine.
  *
  * Batching model:
- * 1. ctx.dataset("table_key", rows).withColumn("field", resolver).run() starts all row column resolvers concurrently
- * 2. ctx.tools.execute() calls inside field resolvers QUEUE requests
- * 3. After all rows have queued, executeBatchedToolCalls() runs provider calls
- * 4. Results resolve suspended row promises, rows complete
+ * 1. ctx.dataset("table_key", rows).withColumn("field", resolver).run()
+ *    admits a bounded row worker pool.
+ * 2. ctx.tools.execute() calls inside admitted field resolvers QUEUE requests.
+ * 3. The drain loop runs queued provider batches while row workers wait.
+ * 4. Provider results resolve rows, and the next pending rows are admitted.
  *
- * Temporal integration:
- * - checkpoint: recovered from heartbeatDetails on retry (skip completed batches)
- * - onBatchComplete: called after each provider batch (heartbeat checkpoint to Temporal)
+ * Runtime integration:
+ * - checkpoint: recovered on retry (skip completed batches)
+ * - onBatchComplete: called after each provider batch for scheduler checkpointing
  */
 import { AsyncLocalStorage } from 'async_hooks';
 import {
   createDeferredPlayDataset,
+  isPlayDataset,
+  iteratePlayDatasetInputPages,
   materializePlayDatasetInput,
 } from '@shared_libs/plays/dataset';
 import type { PlayDataset, PlayDatasetInput } from '@shared_libs/plays/dataset';
@@ -21,6 +24,12 @@ import {
   compileRequestsWithStrategy,
   executeChunkedRequests,
 } from './batch-runtime';
+import { AdaptiveToolDispatcher } from './adaptive-tool-dispatcher';
+import {
+  PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
+  runtimeLeaseHeartbeatIntervalFromExpiry,
+} from './lease-policy';
+import { createRuntimeReceiptHeartbeatSupervisor } from './receipt-heartbeat-supervisor';
 import type { PlayQueueHint } from './governor/rate-state-backend';
 import type { MapRowOutcome } from './durability-store';
 import type { WorkReceiptFailureKind } from './work-receipts';
@@ -41,6 +50,7 @@ import {
   PLAY_RUNTIME_API_COMPAT_PATH,
   PLAY_RUNTIME_CHILD_EXECUTOR_TOKEN_COMPAT_PATH,
 } from './runtime-api-paths';
+import { vercelProtectionBypassHeader } from './vercel-protection';
 export {
   RuntimeSheetRowsBlockedError,
   type RuntimeSheetBlockedRowDetail,
@@ -52,6 +62,10 @@ import {
   type PacingResolver,
   type PlayExecutionGovernor,
 } from './governor/governor';
+import {
+  createRuntimeResourceGovernor,
+  type RuntimeResourceGovernor,
+} from './resource-governor';
 import { CTX_FETCH_EGRESS_TOOL_ID } from './builtin-pacing';
 import { InMemoryRateStateBackend } from './governor/in-memory-rate-state-backend';
 import { pacingPolicyForTool } from './pacing';
@@ -101,6 +115,7 @@ import {
   runtimeReceiptFailureKindForError,
   runtimeReceiptOutput as durableRuntimeReceiptOutput,
   waitForCompletedRuntimeReceipt,
+  waitForCompletedRuntimeReceipts,
   type DurableReceiptExecutionStore,
 } from './durable-receipt-execution';
 import {
@@ -116,6 +131,10 @@ import {
   tripRuntimePersistenceLatch,
   type RuntimePersistenceLatch,
 } from './persistence-latch';
+import {
+  assertCustomerOutputObjectWithinLimit,
+  assertRuntimeReceiptOutputWithinLimit,
+} from './output-size-limits';
 import { createRuntimeDatasetId } from './dataset-id';
 import { dedupeExplicitMapKeyRows } from './map-row-identity';
 import {
@@ -127,6 +146,7 @@ import {
   sha256Hex,
   stableStringify,
 } from '@shared_libs/plays/row-identity';
+import { sqlSafePlayColumnName } from '@shared_libs/plays/static-pipeline';
 import {
   DEEPLINE_CELL_META_FIELD,
   previousCellFromValue,
@@ -138,6 +158,15 @@ import {
   stripCsvProjectionMetadata,
   toSerializableCsvAliasedRow,
 } from './csv-rename';
+import {
+  createRuntimeMapMaterializationTracker,
+  createRuntimeMapRetainedRowsTracker,
+  estimateRuntimeMapRowsMemory,
+  resolveRuntimeMapRowAdmission,
+  runtimeMapJsonByteLength,
+  resolveRuntimeMapMemoryLimits,
+  RuntimeMapMemoryLimitError,
+} from './map-memory-limits';
 import { setSpanAttributes, withActiveSpan } from './tracing';
 import { DISALLOWED_RUN_JAVASCRIPT_TOOL_MESSAGE } from './runtime-constraints';
 import {
@@ -234,11 +263,83 @@ const TOOL_RETRY_HEARTBEAT_INTERVAL_MS = 30_000;
 const DEEPLINEAGENT_TOOL_RUNTIME_TIMEOUT_MS = 15 * 60 * 1000;
 const FETCH_TRANSPORT_MAX_ATTEMPTS = 3;
 const FETCH_TRANSPORT_RETRY_DELAY_MS = 100;
+const CHILD_PLAY_LAUNCH_WRITE_CONFLICT_RETRY_DELAYS_MS = [
+  50, 100, 200, 400, 800,
+] as const;
+const CHILD_PLAY_LAUNCH_ADMISSION_RETRY_DELAYS_MS = [
+  250, 500, 1_000, 2_000, 4_000, 8_000, 8_000, 8_000, 8_000, 8_000, 8_000,
+  8_000, 8_000, 8_000, 8_000,
+] as const;
 const NODE_RUNTIME_MAP_VISIBILITY_MAX_ATTEMPTS = 100;
 const NODE_RUNTIME_MAP_VISIBILITY_RETRY_MS = 25;
+// A single batched runtime-step-receipt request (get/claim/complete/fail/seed)
+// carries at most this many keys. At map scale a run can hold 5k-10k receipt
+// keys; sending them all in one request made the server claim/complete them
+// one-per-key serially in a single HTTP call, which crossed the ~100s origin
+// cap and 524'd (ADR-0012 receipt fence at 5k/10k rows). Chunking bounds each
+// request's server-side work while keeping per-key results faithful — chunks
+// are dispatched in order and their aligned result arrays concatenated, so the
+// key→receipt mapping is identical to the unchunked path.
+export const RUNTIME_STEP_RECEIPT_REQUEST_CHUNK_SIZE = 1_000;
+
+export function chunkArrayForReceiptRequest<T>(items: readonly T[]): T[][] {
+  if (items.length <= RUNTIME_STEP_RECEIPT_REQUEST_CHUNK_SIZE) {
+    return items.length === 0 ? [] : [[...items]];
+  }
+  const chunks: T[][] = [];
+  for (
+    let start = 0;
+    start < items.length;
+    start += RUNTIME_STEP_RECEIPT_REQUEST_CHUNK_SIZE
+  ) {
+    chunks.push(
+      items.slice(start, start + RUNTIME_STEP_RECEIPT_REQUEST_CHUNK_SIZE),
+    );
+  }
+  return chunks;
+}
+
 type SafeFetchModule = typeof import('@shared_libs/security/safe-fetch');
 let safeFetchModule: Promise<SafeFetchModule> | null = null;
 
+function sleepTransientRuntimeMs(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function isConvexWriteConflictMessage(message: string): boolean {
+  return (
+    message.includes('OptimisticConcurrencyControlFailure') ||
+    /changed while this mutation was being run/i.test(message) ||
+    /write conflict/i.test(message)
+  );
+}
+
+function isChildPlayLaunchAdmissionMessage(message: string): boolean {
+  return /too many play runs (?:are )?(?:starting|active)/i.test(message);
+}
+
+function childPlayLaunchRetryDelayMs(input: {
+  status: number;
+  message: string;
+  attempt: number;
+}): number | null {
+  if (
+    input.status === 429 &&
+    isChildPlayLaunchAdmissionMessage(input.message)
+  ) {
+    return CHILD_PLAY_LAUNCH_ADMISSION_RETRY_DELAYS_MS[input.attempt] ?? null;
+  }
+  if (
+    ![409, 429, 500, 502, 503, 504].includes(input.status) ||
+    !isConvexWriteConflictMessage(input.message)
+  ) {
+    return null;
+  }
+  return (
+    CHILD_PLAY_LAUNCH_WRITE_CONFLICT_RETRY_DELAYS_MS[input.attempt] ?? null
+  );
+}
+
 export async function waitForNodeRuntimeMapRowsVisible(input: {
   mapName: string;
   tableNamespace: string;
@@ -291,6 +392,27 @@ export async function waitForNodeRuntimeMapRowsVisible(input: {
   );
 }
 
+/**
+ * Persisted sheet fields to layer onto a fresh map input row during seeding,
+ * excluding any column the current run's input already provides. Input columns
+ * stay authoritative (a persisted row is matched only by the map key and may
+ * belong to a different run that merely shares that key); runtime fields like
+ * __deeplineRowKey and re-derivable output columns — never present on the raw
+ * input row — are restored.
+ */
+export function persistedFieldsAbsentFromInputRow(
+  inputRow: Record<string, unknown>,
+  persisted: Record<string, unknown>,
+): Record<string, unknown> {
+  const extra: Record<string, unknown> = {};
+  for (const key of Object.keys(persisted)) {
+    if (!Object.prototype.hasOwnProperty.call(inputRow, key)) {
+      extra[key] = persisted[key];
+    }
+  }
+  return extra;
+}
+
 export async function reconcileNodeRuntimeMapResultsWithPersistedSheet(input: {
   mapName: string;
   tableNamespace: string;
@@ -443,6 +565,10 @@ type ToolExecutionApiOptions = {
   durableCallReceiptKey?: string | null;
   executionAuthScopeDigest?: string | null;
   providerIdempotencyKey?: string | null;
+  receiptLeaseExpiresAt?: string | null;
+  beforeProviderCall?: () => Promise<void> | void;
+  heartbeatReceipt?: () => Promise<void> | void;
+  parkProviderCall?: () => Promise<void> | void;
   customerDbDataset?: {
     limit: number;
     offset: number;
@@ -458,6 +584,10 @@ function shouldPersistMapCellField(fieldName: string): boolean {
   return !fieldName.startsWith('_') || fieldName === '_metadata';
 }
 
+function runtimeSheetPatchFieldName(fieldName: string): string {
+  return fieldName.includes('.') ? sqlSafePlayColumnName(fieldName) : fieldName;
+}
+
 type PersistableMapRow = MapRowOutcome;
 
 function comparePersistableMapRowsByInputIndex(
@@ -486,6 +616,22 @@ function persistableMapRowBytes(row: PersistableMapRow): number {
   return JSON.stringify(row).length;
 }
 
+function assertPersistableMapRowWithinCustomerOutputLimits(input: {
+  mapName: string;
+  row: PersistableMapRow;
+}): void {
+  const rowLabel =
+    input.row.key?.trim() ||
+    (typeof input.row.inputIndex === 'number' &&
+    Number.isFinite(input.row.inputIndex)
+      ? `input:${Math.floor(input.row.inputIndex)}`
+      : 'unknown');
+  assertCustomerOutputObjectWithinLimit({
+    value: input.row.data,
+    path: `ctx.dataset("${input.mapName}").row("${rowLabel}")`,
+  });
+}
+
 function failedMapRowLogLabel(row: PersistableMapRow): string {
   const rowId = row.data?.row_id;
   if (typeof rowId === 'string' && rowId.trim()) return rowId.trim();
@@ -786,6 +932,10 @@ class RuntimeDatasetBuilder<T extends Record<string, unknown>> {
 
 const WAITING_ROW = Symbol('deepline.waiting_row');
 const FAILED_ROW = Symbol('deepline.failed_row');
+type MapRowExecutionResult =
+  | Record<string, unknown>
+  | typeof WAITING_ROW
+  | typeof FAILED_ROW;
 
 function normalizeFetchHeaders(
   headers: RequestInit['headers'],
@@ -933,6 +1083,7 @@ export class PlayContextImpl {
    * via `chargeBudget`; child plays fork lineage-global counters via `forkChild`.
    */
   private readonly governor: PlayExecutionGovernor;
+  private readonly resourceGovernor: RuntimeResourceGovernor;
   /**
    * Lineage identity for this context (run/play ids + ancestry). Seeded from the
    * Governor snapshot; used only for receipt keys, durable-boundary scoping, and
@@ -1071,6 +1222,9 @@ export class PlayContextImpl {
         ancestryPlayIds: [rootPlayId],
       },
     });
+    this.resourceGovernor = createRuntimeResourceGovernor({
+      executionGovernor: this.governor,
+    });
     this.governance = this.governor.snapshot();
   }
 
@@ -1191,7 +1345,13 @@ export class PlayContextImpl {
     }
   }
 
-  private runtimeApiHeaders(): Record<string, string> {
+  private async vercelProtectionHeaders(): Promise<Record<string, string>> {
+    return vercelProtectionBypassHeader(
+      this.#options.vercelProtectionBypassToken,
+    );
+  }
+
+  private async runtimeApiHeaders(): Promise<Record<string, string>> {
     if (!this.#options.executorToken?.trim()) {
       throw new Error(
         'ctx.runPlay scheduled child launch requires an executor token.',
@@ -1207,12 +1367,7 @@ export class PlayContextImpl {
             [SYNTHETIC_RUN_HEADER]: '1',
           }
         : {}),
-      ...(this.#options.vercelProtectionBypassToken?.trim()
-        ? {
-            'x-vercel-protection-bypass':
-              this.#options.vercelProtectionBypassToken.trim(),
-          }
-        : {}),
+      ...(await this.vercelProtectionHeaders()),
     };
   }
 
@@ -1250,25 +1405,36 @@ export class PlayContextImpl {
       descendantCount: input.childGovernance.descendantCount,
       waterfallStepExecutions: input.childGovernance.waterfallStepExecutions,
     };
-    const response = await fetch(
-      `${this.runtimeApiBaseUrl()}/api/v2/plays/run`,
-      {
-        method: 'POST',
-        headers: this.runtimeApiHeaders(),
-        body: JSON.stringify({
-          name: input.childPlayName,
-          workflowId: input.childRunId,
-          input: input.childInput,
-          profile: 'hatchet',
-          waitForCompletionMs: 0,
-          internalRunPlay: {
-            ...governance,
-            description: input.description ?? null,
-          },
-        }),
+    const requestBody = JSON.stringify({
+      name: input.childPlayName,
+      workflowId: input.childRunId,
+      input: input.childInput,
+      // Inherit the parent's scheduler profile so an `absurd` parent launches
+      // its child on the same scheduler. Absent threading defaults to absurd.
+      profile: this.#options.childRunProfile?.trim() || 'absurd',
+      waitForCompletionMs: 0,
+      internalRunPlay: {
+        ...governance,
+        description: input.description ?? null,
       },
-    );
-    if (!response.ok) {
+    });
+    for (let attempt = 0; ; attempt += 1) {
+      const response = await fetch(
+        `${this.runtimeApiBaseUrl()}/api/v2/plays/run`,
+        {
+          method: 'POST',
+          headers: await this.runtimeApiHeaders(),
+          body: requestBody,
+        },
+      );
+      if (response.ok) {
+        if (attempt > 0) {
+          this.log(
+            `ctx.runPlay(${input.key}): child launch recovered after ${attempt} retry(s)`,
+          );
+        }
+        return;
+      }
       const body = (await response.json().catch(() => null)) as {
         error?: unknown;
       } | null;
@@ -1276,9 +1442,24 @@ export class PlayContextImpl {
         typeof body?.error === 'string' && body.error.trim()
           ? body.error.trim()
           : response.statusText;
-      throw new Error(
-        `ctx.runPlay(${input.key}) failed to launch child play "${input.childPlayName}": ${message} (status ${response.status}).`,
+      const retryDelayMs = childPlayLaunchRetryDelayMs({
+        status: response.status,
+        message,
+        attempt,
+      });
+      if (retryDelayMs === null) {
+        throw new Error(
+          `ctx.runPlay(${input.key}) failed to launch child play "${input.childPlayName}": ${message} (status ${response.status}).`,
+        );
+      }
+      const retryReason =
+        response.status === 429 && isChildPlayLaunchAdmissionMessage(message)
+          ? 'start admission backpressure'
+          : 'transient write conflict';
+      this.log(
+        `ctx.runPlay(${input.key}): retrying child launch after ${retryReason} (attempt ${attempt + 1})`,
       );
+      await sleepTransientRuntimeMs(retryDelayMs);
     }
   }
 
@@ -1294,7 +1475,7 @@ export class PlayContextImpl {
       `${this.runtimeApiBaseUrl()}${PLAY_RUNTIME_API_COMPAT_PATH}`,
       {
         method: 'POST',
-        headers: this.runtimeApiHeaders(),
+        headers: await this.runtimeApiHeaders(),
         body: JSON.stringify({
           action: 'read_child_run_terminal_snapshot',
           parentRunId: this.governance.currentRunId,
@@ -1412,12 +1593,7 @@ export class PlayContextImpl {
           headers: {
             Authorization: `Bearer ${this.#options.executorToken}`,
             'Content-Type': 'application/json',
-            ...(this.#options.vercelProtectionBypassToken?.trim()
-              ? {
-                  'x-vercel-protection-bypass':
-                    this.#options.vercelProtectionBypassToken.trim(),
-                }
-              : {}),
+            ...(await this.vercelProtectionHeaders()),
           },
           body: JSON.stringify({
             action: 'resolve_secret',
@@ -1459,7 +1635,8 @@ export class PlayContextImpl {
     artifactTableNamespace: string;
     mapNodeId?: string | null;
     explicitKey?:
-      ((row: Record<string, unknown>, index: number) => string) | null;
+      | ((row: Record<string, unknown>, index: number) => string)
+      | null;
   }): MapExecutionScope {
     const mapInvocationId = `${input.logicalNamespace}:${this.mapInvocationIndex}`;
     this.mapInvocationIndex += 1;
@@ -1507,7 +1684,7 @@ export class PlayContextImpl {
     return receipt
       ? {
           key: key.trim(),
-          status: 'pending',
+          status: 'queued',
         }
       : null;
   }
@@ -1548,6 +1725,10 @@ export class PlayContextImpl {
     leaseId?: string | null,
   ): Promise<RuntimeStepReceipt | null> {
     assertNoSecretTaint(output, 'ctx.step receipt output');
+    assertRuntimeReceiptOutputWithinLimit({
+      output,
+      path: `ctx.step receipt "${key}"`,
+    });
     if (!this.#options.completeRuntimeStepReceipt) {
       return null;
     }
@@ -1639,6 +1820,30 @@ export class PlayContextImpl {
       byLeaseId.set(target.leaseId, keys);
     }
 
+    if (
+      this.#options.markRuntimeStepReceiptsRunning ||
+      this.#options.markRuntimeStepReceiptRunning
+    ) {
+      const receipts = await this.markRuntimeStepReceiptsRunning(
+        targets.map((target) => ({
+          key: target.receiptKey,
+          runId: this.currentRunId,
+          leaseId: target.leaseId,
+        })),
+      );
+      for (const target of targets) {
+        const receipt = receipts.get(target.receiptKey);
+        if (!this.runtimeToolReceiptStillOwned(receipt, target.leaseId)) {
+          throw new RuntimeReceiptLeaseLostError({
+            receiptKey: target.receiptKey,
+            runId: this.currentRunId,
+            leaseId: target.leaseId,
+          });
+        }
+      }
+      return;
+    }
+
     if (this.#options.heartbeatRuntimeStepReceipts) {
       for (const [leaseId, keys] of byLeaseId) {
         const receipts = await this.#options.heartbeatRuntimeStepReceipts({
@@ -1702,7 +1907,11 @@ export class PlayContextImpl {
     receipt: RuntimeStepReceipt | null | undefined,
     leaseId: string,
   ): boolean {
-    if (!receipt || receipt.status !== 'running') return false;
+    if (!receipt) return false;
+    if (receipt.status === 'completed' || receipt.status === 'skipped') {
+      return true;
+    }
+    if (receipt.status !== 'running') return false;
     if (receipt.leaseId !== leaseId) return false;
     const ownerRunId = receipt.leaseOwnerRunId ?? receipt.runId ?? null;
     return !ownerRunId || ownerRunId === this.currentRunId;
@@ -1727,6 +1936,18 @@ export class PlayContextImpl {
     return ownerAttempt === this.currentRunAttempt;
   }
 
+  private isOwnedClaimedRuntimeReceipt(
+    receipt: RuntimeStepReceipt | null | undefined,
+  ): receipt is RuntimeStepReceipt {
+    return (
+      Boolean(receipt) &&
+      receipt?.claimState !== 'existing' &&
+      (receipt?.status === 'queued' ||
+        receipt?.status === 'pending' ||
+        receipt?.status === 'running')
+    );
+  }
+
   private async failRuntimeStepReceipt(
     key: string,
     runId: string,
@@ -1774,6 +1995,38 @@ export class PlayContextImpl {
     };
   }
 
+  /**
+   * Dispatch a batched runtime-step-receipt request in bounded chunks and
+   * concatenate the aligned result arrays back into one array positioned
+   * identically to `items`. Every batch adapter returns receipts index-aligned
+   * to the keys/receipts it was given, and chunks are dispatched sequentially in
+   * input order, so the concatenation preserves the exact per-key mapping the
+   * callers rely on. Sequential dispatch also keeps at most one receipt request
+   * in flight, bounding tenant-DB and origin load at map scale. See
+   * RUNTIME_STEP_RECEIPT_REQUEST_CHUNK_SIZE.
+   */
+  private async dispatchChunkedRuntimeReceiptRequest<TItem>(
+    items: readonly TItem[],
+    dispatchChunk: (
+      chunk: TItem[],
+    ) =>
+      | Promise<Array<RuntimeStepReceipt | null>>
+      | Array<RuntimeStepReceipt | null>,
+  ): Promise<Array<RuntimeStepReceipt | null>> {
+    const chunks = chunkArrayForReceiptRequest(items);
+    if (chunks.length <= 1) {
+      return chunks.length === 0 ? [] : dispatchChunk(chunks[0]!);
+    }
+    const results: Array<RuntimeStepReceipt | null> = [];
+    for (const chunk of chunks) {
+      const chunkResults = await dispatchChunk(chunk);
+      for (const result of chunkResults) {
+        results.push(result);
+      }
+    }
+    return results;
+  }
+
   private async getRuntimeStepReceipts(
     keys: string[],
   ): Promise<Map<string, RuntimeStepReceipt>> {
@@ -1781,8 +2034,11 @@ export class PlayContextImpl {
       ...new Set(keys.map((key) => key.trim()).filter(Boolean)),
     ];
     if (uniqueKeys.length === 0) return new Map();
-    const receipts = this.#options.getRuntimeStepReceipts
-      ? await this.#options.getRuntimeStepReceipts({ keys: uniqueKeys })
+    const getReceipts = this.#options.getRuntimeStepReceipts;
+    const receipts = getReceipts
+      ? await this.dispatchChunkedRuntimeReceiptRequest(uniqueKeys, (chunk) =>
+          getReceipts({ keys: chunk }),
+        )
       : await Promise.all(
           uniqueKeys.map((key) => this.getRuntimeStepReceipt(key)),
         );
@@ -1808,16 +2064,19 @@ export class PlayContextImpl {
       ...new Set(keys.map((key) => key.trim()).filter(Boolean)),
     ];
     if (uniqueKeys.length === 0) return new Map();
-    const receipts = this.#options.claimRuntimeStepReceipts
-      ? await this.#options.claimRuntimeStepReceipts({
-          keys: uniqueKeys,
-          runId,
-          runAttempt: this.currentRunAttempt,
-          leaseAware: true,
-          ...(reclaimRunning ? { reclaimRunning: true } : {}),
-          ...(forceRefresh ? { forceRefresh: true } : {}),
-          ...(forceFailedRefresh ? { forceFailedRefresh: true } : {}),
-        })
+    const claimReceipts = this.#options.claimRuntimeStepReceipts;
+    const receipts = claimReceipts
+      ? await this.dispatchChunkedRuntimeReceiptRequest(uniqueKeys, (chunk) =>
+          claimReceipts({
+            keys: chunk,
+            runId,
+            runAttempt: this.currentRunAttempt,
+            leaseAware: true,
+            ...(reclaimRunning ? { reclaimRunning: true } : {}),
+            ...(forceRefresh ? { forceRefresh: true } : {}),
+            ...(forceFailedRefresh ? { forceFailedRefresh: true } : {}),
+          }),
+        )
       : await Promise.all(
           uniqueKeys.map((key) =>
             this.claimRuntimeStepReceipt(
@@ -1840,6 +2099,111 @@ export class PlayContextImpl {
     return byKey;
   }
 
+  private async markRuntimeStepReceiptRunning(input: {
+    key: string;
+    runId: string;
+    leaseId?: string | null;
+  }): Promise<RuntimeStepReceipt | null> {
+    if (!this.#options.markRuntimeStepReceiptRunning) {
+      if (input.leaseId && this.#options.heartbeatRuntimeStepReceipts) {
+        return await this.heartbeatRuntimeStepReceipt(
+          input.key,
+          input.runId,
+          input.leaseId,
+        );
+      }
+      return await this.getRuntimeStepReceipt(input.key);
+    }
+    const receipt = await this.#options.markRuntimeStepReceiptRunning({
+      key: input.key,
+      runId: input.runId,
+      runAttempt: this.currentRunAttempt,
+      ...(input.leaseId ? { leaseId: input.leaseId } : {}),
+    });
+    return this.normalizeRuntimeStepReceipt(input.key, receipt);
+  }
+
+  private async markRuntimeStepReceiptsRunning(
+    receipts: Array<{
+      key: string;
+      runId: string;
+      leaseId?: string | null;
+    }>,
+  ): Promise<Map<string, RuntimeStepReceipt>> {
+    const normalizedInputs = receipts.filter((receipt) => receipt.key.trim());
+    if (normalizedInputs.length === 0) return new Map();
+    let marked: Array<RuntimeStepReceipt | null>;
+    const markReceipts = this.#options.markRuntimeStepReceiptsRunning;
+    if (markReceipts) {
+      marked = await this.dispatchChunkedRuntimeReceiptRequest(
+        normalizedInputs.map((receipt) => ({
+          ...receipt,
+          runAttempt: this.currentRunAttempt,
+        })),
+        (chunk) => markReceipts({ receipts: chunk }),
+      );
+    } else {
+      marked = await Promise.all(
+        normalizedInputs.map((receipt) =>
+          this.markRuntimeStepReceiptRunning(receipt),
+        ),
+      );
+    }
+    const byKey = new Map<string, RuntimeStepReceipt>();
+    for (let index = 0; index < marked.length; index += 1) {
+      const normalized = this.normalizeRuntimeStepReceipt(
+        normalizedInputs[index]?.key ?? '',
+        marked[index],
+      );
+      if (normalized) byKey.set(normalized.key, normalized);
+    }
+    return byKey;
+  }
+
+  private async markRuntimeStepReceiptsQueued(
+    receipts: Array<{
+      key: string;
+      runId: string;
+      leaseId?: string | null;
+    }>,
+  ): Promise<Map<string, RuntimeStepReceipt>> {
+    const normalizedInputs = receipts.filter((receipt) => receipt.key.trim());
+    if (normalizedInputs.length === 0) return new Map();
+    if (!this.#options.markRuntimeStepReceiptsQueued) {
+      return new Map();
+    }
+    const queued = await this.dispatchChunkedRuntimeReceiptRequest(
+      normalizedInputs.map((receipt) => ({
+        ...receipt,
+        runAttempt: this.currentRunAttempt,
+      })),
+      (chunk) =>
+        this.#options.markRuntimeStepReceiptsQueued!({ receipts: chunk }),
+    );
+    const byKey = new Map<string, RuntimeStepReceipt>();
+    for (let index = 0; index < queued.length; index += 1) {
+      const normalized = this.normalizeRuntimeStepReceipt(
+        normalizedInputs[index]?.key ?? '',
+        queued[index],
+      );
+      if (normalized) byKey.set(normalized.key, normalized);
+    }
+    return byKey;
+  }
+
+  private async parkRuntimeToolReceiptsQueued(
+    requests: ToolCallRequest[],
+  ): Promise<void> {
+    const targets = requests.flatMap((request) => {
+      const receiptKey = request.receiptKey?.trim() || null;
+      const leaseId = request.receiptLeaseId?.trim() || null;
+      if (!receiptKey || !leaseId) return [];
+      return [{ key: receiptKey, runId: this.currentRunId, leaseId }];
+    });
+    if (targets.length === 0) return;
+    await this.markRuntimeStepReceiptsQueued(targets);
+  }
+
   private async completeRuntimeStepReceipts(
     receipts: Array<{
       key: string;
@@ -1853,16 +2217,22 @@ export class PlayContextImpl {
     if (normalizedInputs.length === 0) return new Map();
     for (const receipt of normalizedInputs) {
       assertNoSecretTaint(receipt.output, 'ctx.tool receipt output');
+      assertRuntimeReceiptOutputWithinLimit({
+        output: receipt.output,
+        path: `ctx.tool receipt "${receipt.key}"`,
+      });
     }
     let completed: Array<RuntimeStepReceipt | null>;
     try {
-      completed = this.#options.completeRuntimeStepReceipts
-        ? await this.#options.completeRuntimeStepReceipts({
-            receipts: normalizedInputs.map((receipt) => ({
+      const completeReceipts = this.#options.completeRuntimeStepReceipts;
+      completed = completeReceipts
+        ? await this.dispatchChunkedRuntimeReceiptRequest(
+            normalizedInputs.map((receipt) => ({
               ...receipt,
               runAttempt: receipt.runAttempt ?? this.currentRunAttempt,
             })),
-          })
+            (chunk) => completeReceipts({ receipts: chunk }),
+          )
         : await Promise.all(
             normalizedInputs.map((receipt) =>
               this.completeRuntimeStepReceipt(
@@ -1998,13 +2368,15 @@ export class PlayContextImpl {
   ): Promise<Map<string, RuntimeStepReceipt>> {
     const normalizedInputs = receipts.filter((receipt) => receipt.key.trim());
     if (normalizedInputs.length === 0) return new Map();
-    const failed = this.#options.failRuntimeStepReceipts
-      ? await this.#options.failRuntimeStepReceipts({
-          receipts: normalizedInputs.map((receipt) => ({
+    const failReceipts = this.#options.failRuntimeStepReceipts;
+    const failed = failReceipts
+      ? await this.dispatchChunkedRuntimeReceiptRequest(
+          normalizedInputs.map((receipt) => ({
             ...receipt,
             runAttempt: receipt.runAttempt ?? this.currentRunAttempt,
           })),
-        })
+          (chunk) => failReceipts({ receipts: chunk }),
+        )
       : await Promise.all(
           normalizedInputs.map((receipt) =>
             this.failRuntimeStepReceipt(
@@ -2114,6 +2486,17 @@ export class PlayContextImpl {
           forceRefresh,
           forceFailedRefresh,
         ),
+      ...(this.#options.markRuntimeStepReceiptRunning ||
+      this.#options.markRuntimeStepReceiptsRunning
+        ? {
+            markRunning: (receiptKey, runId, leaseId) =>
+              this.markRuntimeStepReceiptRunning({
+                key: receiptKey,
+                runId,
+                leaseId,
+              }),
+          }
+        : {}),
       complete: (receiptKey, runId, output, leaseId) =>
         this.completeRuntimeStepReceipt(receiptKey, runId, output, leaseId),
       release: (receiptKey, runId, leaseId) =>
@@ -2133,7 +2516,10 @@ export class PlayContextImpl {
           failureKind,
         ),
       canPersistFailure: Boolean(this.#options.failRuntimeStepReceipt),
-      canPersistCompletion: Boolean(this.#options.completeRuntimeStepReceipt),
+      canPersistCompletion: Boolean(
+        this.#options.completeRuntimeStepReceipt ||
+        this.#options.completeRuntimeStepReceipts,
+      ),
     };
   }
 
@@ -2152,6 +2538,21 @@ export class PlayContextImpl {
     });
   }
 
+  private async waitForCompletedRuntimeToolReceipts(
+    keys: string[],
+    maxAttempts?: number,
+  ): Promise<{
+    completed: Map<string, RuntimeStepReceipt>;
+    failed: Map<string, Error>;
+    timedOut: Set<string>;
+  }> {
+    return await waitForCompletedRuntimeReceipts({
+      receiptKeys: keys,
+      store: this.durableReceiptExecutionStore(),
+      maxAttempts,
+    });
+  }
+
   private async executeWithRuntimeReceipt<T>(
     operation: DurableCtxOperation,
     id: string,
@@ -2174,6 +2575,7 @@ export class PlayContextImpl {
       ) => T;
       onClaimedResult?: (output: T, receiptKey: string) => T;
       shouldPersistFailure?: (error: unknown) => boolean;
+      markRunningBeforeExecute?: boolean;
       execute: (context: { leaseId: string | null }) => Promise<T>;
     },
   ): Promise<T> {
@@ -2204,6 +2606,7 @@ export class PlayContextImpl {
       onRecovered: opts.onRecovered,
       onClaimedResult: opts.onClaimedResult,
       shouldPersistFailure: opts.shouldPersistFailure,
+      markRunningBeforeExecute: opts.markRunningBeforeExecute,
       formatError: (error) => this.formatRuntimeError(error),
       log: (message) => this.log(message),
       execute: opts.execute,
@@ -2820,8 +3223,8 @@ export class PlayContextImpl {
       completed?.status !== 'completed' &&
       completed?.status !== 'skipped'
     ) {
-      throw new Error(
-        `Durable tool call ${receiptKey} lost receipt ownership before completion.`,
+      this.log(
+        `Durable tool call ${receiptKey} completed live after its receipt lease moved; using live result without overwriting the receipt.`,
       );
     }
     const finalWrapped =
@@ -2885,6 +3288,7 @@ export class PlayContextImpl {
     let rejectionError = error;
     const receiptKey = request.receiptKey?.trim() || null;
     if (receiptKey && options?.persistReceiptFailure !== false) {
+      const persistenceAlreadyFailed = this.persistenceLatch.tripped;
       try {
         await this.failRuntimeStepReceipts([
           {
@@ -2897,10 +3301,13 @@ export class PlayContextImpl {
         ]);
       } catch (receiptError) {
         tripRuntimePersistenceLatch(this.persistenceLatch, receiptError);
-        rejectionError = new AggregateError(
-          [error, receiptError],
-          'Tool call failed and durable receipt could not be marked failed',
-        );
+        if (!persistenceAlreadyFailed) {
+          const receiptFailureMessage = this.formatRuntimeError(receiptError);
+          rejectionError = new AggregateError(
+            [error, receiptError],
+            `Tool call failed and durable receipt could not be marked failed: ${message}; receipt failure: ${receiptFailureMessage}`,
+          );
+        }
       }
     }
     const resolver = this.toolCallResolvers.get(request.callId);
@@ -2951,7 +3358,7 @@ export class PlayContextImpl {
     // The activity loads the actual data before creating the ctx
     throw new Error(
       `ctx.csv("${path}") is handled by the workflow. ` +
-        `CSV data is loaded as a Temporal activity and passed to your play via input.`,
+        `CSV data is loaded by the runtime and passed to your play via input.`,
     );
   }
 
@@ -3006,7 +3413,8 @@ export class PlayContextImpl {
     _key: string,
     _items: PlayDatasetInput<T>,
     _input?:
-      MapFieldDefinition<T, Record<string, unknown>> | RuntimeStepProgram,
+      | MapFieldDefinition<T, Record<string, unknown>>
+      | RuntimeStepProgram,
     _options?: DatasetOptions<T>,
   ): never {
     void _key;
@@ -3092,7 +3500,8 @@ export class PlayContextImpl {
 
     const userKeyOption = options?.key;
     let explicitKeyResolver:
-      ((row: Record<string, unknown>, index: number) => string) | null = null;
+      | ((row: Record<string, unknown>, index: number) => string)
+      | null = null;
     if (userKeyOption !== undefined) {
       explicitKeyResolver = (row, index) => {
         const inputRow = stripFieldOutputs(row);
@@ -3143,7 +3552,516 @@ export class PlayContextImpl {
         : derivePlayRowIdentity(stableInputRow(row), resolvedTableNamespace);
     };
 
-    const rawMaterializedItems = await materializePlayDatasetInput(items);
+    // Identity for SEED rows (pre-execution raw inputs), matching the server's
+    // own derivation in startRuntimeSheetDataset: hash the FULL cleaned input
+    // row, output-named columns INCLUDED. Two distinct input rows that differ
+    // only in a column sharing an output's name (e.g. a CSV `domain` column +
+    // withColumn('domain', ...)) must stay two rows — the stripped-row
+    // `rowIdentity` fallback would collapse them to one key, silently dropping
+    // a row from execution and the sheet. Output-insensitivity across the
+    // execution round-trip is provided by CARRYING this key on the row
+    // (__deeplineRowKey, which rowIdentity prefers), not by stripping.
+    const seedRowIdentity = (row: Record<string, unknown>, index = 0) => {
+      const runtimeKey = resolveMapRowOutcomeKey(row);
+      if (runtimeKey) return runtimeKey;
+      if (explicitKeyResolver) {
+        return derivePlayRowIdentityFromKey(
+          explicitKeyResolver(row, index),
+          resolvedTableNamespace,
+        );
+      }
+      return derivePlayRowIdentity(
+        toSerializableCsvAliasedRow(row),
+        resolvedTableNamespace,
+      );
+    };
+
+    const mapMemoryLimits = resolveRuntimeMapMemoryLimits(
+      this.#options.runtimeMapMemoryLimits,
+    );
+    const materializationMemoryTracker = createRuntimeMapMaterializationTracker(
+      {
+        mapName: normalizedMapNamespace,
+        budgetBytes: mapMemoryLimits.materializedBudgetBytes,
+      },
+    );
+    const shouldStreamRuntimeBackedDataset =
+      isPlayDataset<T>(items) &&
+      this.#options.runtimeSheetBackedMapDatasets === true &&
+      Boolean(
+        this.#options.onMapStart &&
+        this.#options.onMapRowsCompleted &&
+        this.#options.baseUrl &&
+        this.#options.executorToken &&
+        this.#options.playName &&
+        this.#options.runId,
+      );
+    if (shouldStreamRuntimeBackedDataset) {
+      totalInputCount = await items.count();
+      const mapScope = this.createMapExecutionScope({
+        logicalNamespace: normalizedMapNamespace,
+        artifactTableNamespace: resolvedTableNamespace,
+        explicitKey: explicitKeyResolver,
+      });
+      this.setMapFrame({
+        mapInvocationId: mapScope.mapInvocationId,
+        mapNodeId: mapScope.mapNodeId ?? null,
+        logicalNamespace: mapScope.logicalNamespace,
+        artifactTableNamespace: mapScope.artifactTableNamespace,
+        status: 'running',
+        totalRows: totalInputCount,
+        completedRowKeys: [],
+        pendingRowKeys: [],
+        completedRowsCount: 0,
+        pendingRowsCount: totalInputCount,
+        failedRowsCount: 0,
+        startedAt: Date.now(),
+        updatedAt: Date.now(),
+      });
+      this.emitExecutionEvent({
+        type: 'map.started',
+        mapInvocationId: mapScope.mapInvocationId,
+        mapNodeId: mapScope.mapNodeId ?? null,
+        logicalNamespace: mapScope.logicalNamespace,
+        artifactTableNamespace: mapScope.artifactTableNamespace,
+        totalRows: totalInputCount,
+        completedRows: 0,
+        pendingRows: totalInputCount,
+        at: Date.now(),
+      });
+
+      const seenExplicitKeys = new Set<string>();
+      let processedCount = 0;
+      let successfulCount = 0;
+      let failedCount = 0;
+      let duplicateReuseCount = 0;
+      let executedCount = 0;
+      const previewRows: Record<string, unknown>[] = [];
+
+      const persistMapRows = async (rows: PersistableMapRow[]) => {
+        if (!this.#options.onMapRowsCompleted || rows.length === 0) {
+          return;
+        }
+        for (const row of rows) {
+          assertPersistableMapRowWithinCustomerOutputLimits({
+            mapName: normalizedMapNamespace,
+            row,
+          });
+        }
+        let chunk: PersistableMapRow[] = [];
+        let chunkBytes = 0;
+        const flushChunk = async () => {
+          if (chunk.length === 0) return;
+          try {
+            const sheetFlushLease =
+              await this.resourceGovernor.acquireSheetFlush({
+                estimatedBytes: chunkBytes,
+                rowCount: chunk.length,
+              });
+            const flushStartedAt = Date.now();
+            try {
+              await this.#options.onMapRowsCompleted!({
+                playName: this.#options.playName,
+                playId: this.#options.playId,
+                runId: this.#options.runId,
+                executorToken: this.#options.executorToken,
+                tableNamespace: resolvedTableNamespace,
+                rows: chunk,
+                outputFields: datasetColumnNames.filter((field) =>
+                  shouldPersistMapCellField(field),
+                ),
+                staticPipeline: this.#options.staticPipeline ?? null,
+              });
+              this.resourceGovernor.observe({
+                sheetFlushBytes: chunkBytes,
+                sheetFlushLatencyMs: Date.now() - flushStartedAt,
+              });
+            } finally {
+              sheetFlushLease.release();
+            }
+          } catch (error) {
+            tripRuntimePersistenceLatch(this.persistenceLatch, error);
+            throw error;
+          }
+          chunk = [];
+          chunkBytes = 0;
+        };
+        for (const row of rows) {
+          const rowBytes = persistableMapRowBytes(row);
+          if (
+            chunk.length >= MAP_PERSIST_CHUNK_ROWS ||
+            (chunkBytes + rowBytes > MAP_PERSIST_CHUNK_BYTES &&
+              chunk.length > 0)
+          ) {
+            await flushChunk();
+          }
+          chunk.push(row);
+          chunkBytes += rowBytes;
+        }
+        await flushChunk();
+      };
+
+      for await (const page of iteratePlayDatasetInputPages(items)) {
+        const pageRawItems = page.rows.map((item) =>
+          this.toOutputRow(item as Record<string, unknown>),
+        );
+        const pageMemoryEstimate = estimateRuntimeMapRowsMemory(pageRawItems);
+        if (
+          pageMemoryEstimate.estimatedResidentBytes >
+          mapMemoryLimits.materializedBudgetBytes
+        ) {
+          throw new RuntimeMapMemoryLimitError({
+            mapName: normalizedMapNamespace,
+            phase: 'materialize',
+            estimate: pageMemoryEstimate,
+            budgetBytes: mapMemoryLimits.materializedBudgetBytes,
+          });
+        }
+        const pageStartRows = pageRawItems.map((row, index) => {
+          const originalIndex = page.offset + index;
+          return {
+            ...toSerializableCsvAliasedRow(row),
+            ...mapRowOutcomeRuntimeFields({
+              key: seedRowIdentity(row, originalIndex),
+              inputIndex: originalIndex,
+            }),
+          };
+        });
+        const mapStartResult = await this.#options.onMapStart!(
+          pageStartRows,
+          resolvedTableNamespace,
+          {
+            playName: this.#options.playName,
+            playId: this.#options.playId,
+            runId: this.#options.runId,
+            executorToken: this.#options.executorToken,
+            staticPipeline: this.#options.staticPipeline,
+            forceRefresh: this.#options.cachePolicy?.forceToolRefresh === true,
+            inputOffset: page.offset,
+          },
+        );
+        resolvedTableNamespace = normalizeTableNamespace(
+          mapStartResult.tableNamespace,
+        );
+        if ((mapStartResult.blockedRows?.length ?? 0) > 0) {
+          throw new RuntimeSheetRowsBlockedError({
+            tableNamespace: resolvedTableNamespace,
+            blockedRows: mapStartResult.blockedRows ?? [],
+          });
+        }
+
+        const persistedRowIdentity = (
+          row: Record<string, unknown>,
+          index = 0,
+        ) => resolveMapRowOutcomeKey(row) ?? rowIdentity(row, index);
+        const pendingRowsByKey = new Map<string, Record<string, unknown>>();
+        for (
+          let index = 0;
+          index < mapStartResult.pendingRows.length;
+          index += 1
+        ) {
+          const row = mapStartResult.pendingRows[index]!;
+          const rowKey = persistedRowIdentity(row, page.offset + index);
+          if (rowKey) pendingRowsByKey.set(rowKey, row);
+        }
+        const completedRowsByKey = new Map<string, Record<string, unknown>>();
+        for (const row of mapStartResult.completedRows ?? []) {
+          const rowKey = persistedRowIdentity(row);
+          if (!rowKey) continue;
+          completedRowsByKey.set(rowKey, row);
+        }
+
+        const seededItems = page.rows.map((item, index) => {
+          const originalIndex = page.offset + index;
+          const row = this.toOutputRow(item as Record<string, unknown>);
+          const rowKey = seedRowIdentity(row, originalIndex);
+          const persisted =
+            pendingRowsByKey.get(rowKey) ?? completedRowsByKey.get(rowKey);
+          return {
+            row: persisted
+              ? cloneCsvAliasedRow(
+                  row,
+                  persistedFieldsAbsentFromInputRow(row, persisted),
+                )
+              : row,
+            index: originalIndex,
+          };
+        });
+
+        const rowsToExecuteByKey = new Map<
+          string,
+          { row: Record<string, unknown>; originalIndex: number }
+        >();
+        for (const { row, index } of seededItems) {
+          if (explicitKeyResolver) {
+            const explicitKey = explicitKeyResolver(row, index);
+            if (seenExplicitKeys.has(explicitKey)) {
+              duplicateReuseCount += 1;
+              processedCount += 1;
+              continue;
+            }
+            seenExplicitKeys.add(explicitKey);
+          }
+          const rowKey = rowIdentity(row, index);
+          if (!rowsToExecuteByKey.has(rowKey)) {
+            rowsToExecuteByKey.set(rowKey, { row, originalIndex: index });
+          } else {
+            duplicateReuseCount += 1;
+            processedCount += 1;
+          }
+        }
+        const rowsToExecuteEntries = [...rowsToExecuteByKey.entries()].map(
+          ([rowKey, entry]) => ({ rowKey, ...entry }),
+        );
+        const rowsToExecute = rowsToExecuteEntries.map((entry) => entry.row);
+        const rowsToExecuteMemoryEstimate =
+          estimateRuntimeMapRowsMemory(rowsToExecute);
+        const incrementalPersistence =
+          createIncrementalMapRowPersistence(persistMapRows);
+
+        this.activeMapCellMeta = new Map();
+        this.setMapFrame({
+          mapInvocationId: mapScope.mapInvocationId,
+          mapNodeId: mapScope.mapNodeId ?? null,
+          logicalNamespace: mapScope.logicalNamespace,
+          artifactTableNamespace: resolvedTableNamespace,
+          status: 'running',
+          totalRows: totalInputCount,
+          completedRowKeys: [],
+          pendingRowKeys: rowsToExecuteEntries.map((entry) => entry.rowKey),
+          completedRowsCount: Math.max(0, processedCount - failedCount),
+          pendingRowsCount: Math.max(0, totalInputCount - processedCount),
+          failedRowsCount: failedCount,
+          startedAt:
+            this.checkpoint.mapFrames?.[mapScope.mapInvocationId]?.startedAt ??
+            Date.now(),
+          updatedAt: Date.now(),
+        });
+
+        let mapResult: FieldMapRunResult;
+        try {
+          mapResult = await this.runFieldMap(
+            rowsToExecute,
+            mapScope,
+            input as MapFieldDefinition<Record<string, unknown>>,
+            options?.description,
+            {
+              totalRows: totalInputCount,
+              completedRows: duplicateReuseCount,
+            },
+            {
+              emitTerminalEvent: false,
+              onRowError: options?.onRowError,
+              executionRowKeys: rowsToExecuteEntries.map(
+                (entry) => entry.rowKey,
+              ),
+              executionRowIndexes: rowsToExecuteEntries.map(
+                (entry) => entry.originalIndex,
+              ),
+              progressCompletedOffset: Math.max(
+                0,
+                processedCount - failedCount,
+              ),
+              progressFailedOffset: failedCount,
+              progressTotalRows: totalInputCount,
+              largestRowBytes: rowsToExecuteMemoryEstimate.largestRowBytes,
+              retainedRowsMemoryBudgetBytes:
+                mapMemoryLimits.materializedBudgetBytes,
+              activeRowsMemoryBudgetBytes:
+                mapMemoryLimits.activeRowsBudgetBytes,
+              incrementalPersistence,
+            },
+          );
+        } catch (error) {
+          if (error instanceof FailFastMapRowsError) {
+            const rowsToPersist = [...error.completedRows, ...error.failedRows];
+            await incrementalPersistence.flush();
+            const unpersistedRows = rowsToPersist.filter(
+              (row) => !incrementalPersistence.isPersisted(row),
+            );
+            await persistMapRows(unpersistedRows);
+            this.activeMapCellMeta = null;
+            throw error.cause;
+          }
+          this.activeMapCellMeta = null;
+          throw error;
+        }
+
+        await incrementalPersistence.flush();
+        const mapCellMeta = this.activeMapCellMeta;
+        const persistRows: PersistableMapRow[] = [];
+        for (const row of mapResult.completedRows) {
+          if (incrementalPersistence.isPersisted(row)) continue;
+          const meta = mapCellMeta?.get(row.key);
+          persistRows.push(
+            completedMapRowOutcome({
+              key: row.key,
+              data: row.data,
+              inputIndex: row.inputIndex,
+              cellMetaPatch: {
+                ...(row.cellMetaPatch ?? {}),
+                ...(meta ?? {}),
+              },
+            }),
+          );
+        }
+        persistRows.push(
+          ...mapResult.failedRows.filter(
+            (row) => !incrementalPersistence.isPersisted(row),
+          ),
+        );
+        await persistMapRows(persistRows);
+        this.activeMapCellMeta = null;
+
+        for (const row of mapResult.completedRows) {
+          if (previewRows.length >= 5) break;
+          previewRows.push(this.toMaterializedOutputRow(row.data));
+        }
+        executedCount += rowsToExecute.length;
+        successfulCount += mapResult.completedRows.length;
+        failedCount += mapResult.failedRows.length;
+        processedCount += rowsToExecute.length;
+        page.rows.length = 0;
+      }
+
+      this.setMapFrame({
+        mapInvocationId: mapScope.mapInvocationId,
+        mapNodeId: mapScope.mapNodeId ?? null,
+        logicalNamespace: mapScope.logicalNamespace,
+        artifactTableNamespace: resolvedTableNamespace,
+        status: 'completed',
+        totalRows: totalInputCount,
+        completedRowKeys: [],
+        pendingRowKeys: [],
+        completedRowsCount: Math.max(0, processedCount - failedCount),
+        pendingRowsCount: 0,
+        failedRowsCount: failedCount,
+        startedAt:
+          this.checkpoint.mapFrames?.[mapScope.mapInvocationId]?.startedAt ??
+          Date.now(),
+        updatedAt: Date.now(),
+      });
+      this.emitExecutionEvent({
+        type: 'map.completed',
+        mapInvocationId: mapScope.mapInvocationId,
+        mapNodeId: mapScope.mapNodeId ?? null,
+        logicalNamespace: mapScope.logicalNamespace,
+        artifactTableNamespace: resolvedTableNamespace,
+        completedRows: Math.max(0, processedCount - failedCount),
+        failedRows: failedCount,
+        totalRows: totalInputCount,
+        at: Date.now(),
+      });
+
+      const readRuntimeBackedMapRows = async (input: {
+        limit: number;
+        offset: number;
+      }) => {
+        const result = await readRuntimeSheetDatasetRows(
+          {
+            baseUrl: this.#options.baseUrl!,
+            executorToken: this.#options.executorToken!,
+            playName: this.#options.playName!,
+            userEmail: this.#options.userEmail,
+            runId: this.#options.runId!,
+          },
+          {
+            tableNamespace: resolvedTableNamespace,
+            runId: this.#options.runId!,
+            limit: input.limit,
+            offset: input.offset,
+          },
+        );
+        return result.rows.map((row) => this.toMaterializedOutputRow(row));
+      };
+      const materializeRuntimeBackedMapRows = async (limit?: number) => {
+        if (limit !== undefined && limit <= 0) return [];
+        const pageSize = 1000;
+        const materialized: Record<string, unknown>[] = [];
+        let offset = 0;
+        while (true) {
+          const remaining =
+            limit === undefined
+              ? pageSize
+              : Math.max(0, limit - materialized.length);
+          if (remaining === 0) break;
+          const rows = await readRuntimeBackedMapRows({
+            limit: Math.min(pageSize, remaining),
+            offset,
+          });
+          if (rows.length === 0) break;
+          materialized.push(...rows);
+          if (limit !== undefined && materialized.length >= limit) {
+            return materialized.slice(0, limit);
+          }
+          offset += rows.length;
+        }
+        return materialized;
+      };
+
+      return createDeferredPlayDataset({
+        datasetKind: 'map',
+        datasetId: createRuntimeDatasetId(
+          this.#options.playName ?? this.#options.playId ?? 'play',
+          resolvedTableNamespace,
+        ),
+        count: successfulCount,
+        backing: {
+          storage: 'neon_sheet',
+          sheet: {
+            playName: this.#options.playName!,
+            tableNamespace: resolvedTableNamespace,
+          },
+        },
+        previewRows,
+        tableNamespace: resolvedTableNamespace,
+        workProgress: {
+          total: totalInputCount,
+          executed: executedCount,
+          reused: duplicateReuseCount,
+          skipped: duplicateReuseCount,
+          pending: 0,
+          failed: failedCount,
+          ...(duplicateReuseCount > 0
+            ? { duplicates: { exact: duplicateReuseCount } }
+            : {}),
+        },
+        resolvers: {
+          count: async () => successfulCount,
+          peek: async (limit) =>
+            limit <= 0
+              ? []
+              : await readRuntimeBackedMapRows({
+                  limit,
+                  offset: 0,
+                }),
+          materialize: materializeRuntimeBackedMapRows,
+          iterate: () =>
+            ({
+              async *[Symbol.asyncIterator]() {
+                const pageSize = 1000;
+                let offset = 0;
+                while (true) {
+                  const rows = await readRuntimeBackedMapRows({
+                    limit: pageSize,
+                    offset,
+                  });
+                  if (rows.length === 0) return;
+                  for (const row of rows) {
+                    yield row;
+                  }
+                  offset += rows.length;
+                }
+              },
+            }) as AsyncIterable<Record<string, unknown>>,
+        },
+      });
+    }
+    const rawMaterializedItems = await materializePlayDatasetInput(items, {
+      onRow: (row) => {
+        materializationMemoryTracker.track(row);
+      },
+    });
     // Silent dedupe of duplicate explicit map keys: keep the first row per
     // canonical key and drop subsequent duplicates. Deduping the materialized
     // input here keeps every downstream derivation (rawItems, itemsToProcess,
@@ -3176,19 +4094,32 @@ export class PlayContextImpl {
     itemOriginalIndexes = materializedItems.map((_item, index) => index);
     const mapStartSeedRowsByKey = new Map<string, Record<string, unknown>>();
     if (this.#options.onMapStart) {
-      const shouldPassRowKey = explicitKeyResolver != null;
+      // ALWAYS stamp the canonical seed row key — including no-explicit-key
+      // datasets — using seedRowIdentity (full-input-row hash, matching the
+      // server's own derivation). Without the stamp, seed and completion keys
+      // diverge whenever an input column shares a name with an output column
+      // (e.g. a CSV `domain` column + withColumn('domain', ...)): the seed
+      // row persists under the full-row key while completion/visibility used
+      // a stripped-row key, so the input-index repair flipped the seed row
+      // terminal under the OLD key and the visibility barrier polled a key
+      // that never existed — "Runtime sheet visibility mismatch ... saw 0;
+      // write reported 1" (28-packaged-literal-csv on the Daytona runner).
+      // Stamping a STRIPPED-row key instead would collapse distinct input
+      // rows differing only in output-named columns into one sheet row
+      // (resultView expected 2, got 1). Full-input identity keeps them
+      // distinct; the carried __deeplineRowKey keeps identity stable across
+      // the execution round-trip.
+      //
       // toSerializableCsvAliasedRow (not a plain spread): projected CSV
       // aliases ride on non-enumerable props after stripCsvProjectionMetadata,
       // so a spread would silently drop them before the sheet write and the
       // aliases would never persist as visible input cells.
-      const mapStartRows = shouldPassRowKey
-        ? rawItems.map((row, index) => ({
-            ...toSerializableCsvAliasedRow(row),
-            ...mapRowOutcomeRuntimeFields({
-              key: rowIdentity(row, index),
-            }),
-          }))
-        : rawItems.map((row) => toSerializableCsvAliasedRow(row));
+      const mapStartRows = rawItems.map((row, index) => ({
+        ...toSerializableCsvAliasedRow(row),
+        ...mapRowOutcomeRuntimeFields({
+          key: seedRowIdentity(row, index),
+        }),
+      }));
       const mapStartResult = await this.#options.onMapStart(
         mapStartRows,
         resolvedTableNamespace,
@@ -3233,15 +4164,31 @@ export class PlayContextImpl {
           index,
         }))
         .map(({ row, index }) => {
-          const rowKey = rowIdentity(row, index);
+          // Look up by the SAME seed identity the stamp above used — the
+          // merged persisted row then carries __deeplineRowKey, which every
+          // downstream rowIdentity call prefers over re-derivation.
+          const rowKey = seedRowIdentity(row, index);
           const persisted =
             pendingRowsByKey.get(rowKey) ?? mapStartSeedRowsByKey.get(rowKey);
-          // Persisted rows lose the non-enumerable CSV alias projections on
-          // the sheet round-trip. Merge the persisted data/meta over the
-          // in-memory row so key functions and column resolvers keep seeing
-          // projected aliases.
+          // Restore persisted OUTPUT columns, cell meta, and the carried
+          // __deeplineRowKey so key functions and column resolvers keep seeing
+          // projected values/aliases across the sheet round-trip. But the
+          // CURRENT run's INPUT columns are authoritative and must win: a
+          // persisted row is matched only by the map key, so for a play whose
+          // key does not capture every input column it can be a DIFFERENT run's
+          // row that merely shares that key. Letting its stale input columns
+          // overwrite this run's inputs corrupts input-derived tool arguments
+          // (e.g. scenario 87 vs 78 collide on key `id`='target' but pass
+          // distinct `key` columns to the probe tool, flipping a terminal
+          // failure into a spurious success). Merge only persisted fields
+          // absent from the fresh input row.
           return {
-            row: persisted ? cloneCsvAliasedRow(row, persisted) : row,
+            row: persisted
+              ? cloneCsvAliasedRow(
+                  row,
+                  persistedFieldsAbsentFromInputRow(row, persisted),
+                )
+              : row,
             index,
           };
         });
@@ -3298,6 +4245,8 @@ export class PlayContextImpl {
       ([rowKey, entry]) => ({ rowKey, ...entry }),
     );
     const rowsToExecute = rowsToExecuteEntries.map((entry) => entry.row);
+    const rowsToExecuteMemoryEstimate =
+      estimateRuntimeMapRowsMemory(rowsToExecute);
     const duplicateReuseCount = Math.max(
       0,
       itemsToProcess.length - rowsToExecute.length,
@@ -3308,23 +4257,44 @@ export class PlayContextImpl {
       if (!this.#options.onMapRowsCompleted || rows.length === 0) {
         return;
       }
+      for (const row of rows) {
+        assertPersistableMapRowWithinCustomerOutputLimits({
+          mapName: normalizedMapNamespace,
+          row,
+        });
+      }
       let chunk: PersistableMapRow[] = [];
       let chunkBytes = 0;
       const flushChunk = async () => {
         if (chunk.length === 0) return;
         try {
-          await this.#options.onMapRowsCompleted!({
-            playName: this.#options.playName,
-            playId: this.#options.playId,
-            runId: this.#options.runId,
-            executorToken: this.#options.executorToken,
-            tableNamespace: resolvedTableNamespace,
-            rows: chunk,
-            outputFields: datasetColumnNames.filter((field) =>
-              shouldPersistMapCellField(field),
-            ),
-            staticPipeline: this.#options.staticPipeline ?? null,
-          });
+          const sheetFlushLease = await this.resourceGovernor.acquireSheetFlush(
+            {
+              estimatedBytes: chunkBytes,
+              rowCount: chunk.length,
+            },
+          );
+          const flushStartedAt = Date.now();
+          try {
+            await this.#options.onMapRowsCompleted!({
+              playName: this.#options.playName,
+              playId: this.#options.playId,
+              runId: this.#options.runId,
+              executorToken: this.#options.executorToken,
+              tableNamespace: resolvedTableNamespace,
+              rows: chunk,
+              outputFields: datasetColumnNames.filter((field) =>
+                shouldPersistMapCellField(field),
+              ),
+              staticPipeline: this.#options.staticPipeline ?? null,
+            });
+            this.resourceGovernor.observe({
+              sheetFlushBytes: chunkBytes,
+              sheetFlushLatencyMs: Date.now() - flushStartedAt,
+            });
+          } finally {
+            sheetFlushLease.release();
+          }
         } catch (error) {
           // Output-sheet flush failed: trip the breaker so the dispatch loops
           // stop dispatching new provider calls for the rest of this map.
@@ -3368,6 +4338,10 @@ export class PlayContextImpl {
           executionRowIndexes: rowsToExecuteEntries.map(
             (entry) => entry.originalIndex,
           ),
+          largestRowBytes: rowsToExecuteMemoryEstimate.largestRowBytes,
+          retainedRowsMemoryBudgetBytes:
+            mapMemoryLimits.materializedBudgetBytes,
+          activeRowsMemoryBudgetBytes: mapMemoryLimits.activeRowsBudgetBytes,
           incrementalPersistence,
         },
       );
@@ -3499,6 +4473,63 @@ export class PlayContextImpl {
       });
     }
 
+    const readRuntimeBackedMapRows =
+      this.#options.runtimeSheetBackedMapDatasets === true &&
+      this.#options.baseUrl &&
+      this.#options.executorToken &&
+      this.#options.playName &&
+      this.#options.runId
+        ? async (input: { limit: number; offset: number }) => {
+            const result = await readRuntimeSheetDatasetRows(
+              {
+                baseUrl: this.#options.baseUrl!,
+                executorToken: this.#options.executorToken!,
+                playName: this.#options.playName!,
+                userEmail: this.#options.userEmail,
+                runId: this.#options.runId!,
+              },
+              {
+                tableNamespace: resolvedTableNamespace,
+                runId: this.#options.runId!,
+                limit: input.limit,
+                offset: input.offset,
+              },
+            );
+            return result.rows.map((row) => this.toMaterializedOutputRow(row));
+          }
+        : null;
+    const materializeRuntimeBackedMapRows = async (limit?: number) => {
+      if (!readRuntimeBackedMapRows) {
+        return limit === undefined
+          ? results.map((row) => this.toMaterializedOutputRow(row))
+          : results
+              .slice(0, Math.max(0, limit))
+              .map((row) => this.toMaterializedOutputRow(row));
+      }
+      if (limit !== undefined && limit <= 0) return [];
+      const pageSize = 1000;
+      const materialized: Record<string, unknown>[] = [];
+      let offset = 0;
+      while (true) {
+        const remaining =
+          limit === undefined
+            ? pageSize
+            : Math.max(0, limit - materialized.length);
+        if (remaining === 0) break;
+        const rows = await readRuntimeBackedMapRows({
+          limit: Math.min(pageSize, remaining),
+          offset,
+        });
+        if (rows.length === 0) break;
+        materialized.push(...rows);
+        if (limit !== undefined && materialized.length >= limit) {
+          return materialized.slice(0, limit);
+        }
+        offset += rows.length;
+      }
+      return materialized;
+    };
+
     return createDeferredPlayDataset({
       datasetKind: 'map',
       datasetId: createRuntimeDatasetId(
@@ -3506,6 +4537,15 @@ export class PlayContextImpl {
         resolvedTableNamespace,
       ),
       count: results.length,
+      backing: readRuntimeBackedMapRows
+        ? {
+            storage: 'neon_sheet',
+            sheet: {
+              playName: this.#options.playName!,
+              tableNamespace: resolvedTableNamespace,
+            },
+          }
+        : undefined,
       previewRows: results
         .slice(0, 5)
         .map((row) => this.toMaterializedOutputRow(row)),
@@ -3524,18 +4564,35 @@ export class PlayContextImpl {
       resolvers: {
         count: async () => results.length,
         peek: async (limit) =>
-          results
-            .slice(0, Math.max(0, limit))
-            .map((row) => this.toMaterializedOutputRow(row)),
-        materialize: async (limit) =>
-          limit === undefined
-            ? results.map((row) => this.toMaterializedOutputRow(row))
+          readRuntimeBackedMapRows
+            ? limit <= 0
+              ? []
+              : await readRuntimeBackedMapRows({
+                  limit,
+                  offset: 0,
+                })
             : results
                 .slice(0, Math.max(0, limit))
                 .map((row) => this.toMaterializedOutputRow(row)),
+        materialize: materializeRuntimeBackedMapRows,
         iterate: () =>
           ({
             async *[Symbol.asyncIterator]() {
+              if (readRuntimeBackedMapRows) {
+                const pageSize = 1000;
+                let offset = 0;
+                while (true) {
+                  const rows = await readRuntimeBackedMapRows({
+                    limit: pageSize,
+                    offset,
+                  });
+                  if (rows.length === 0) return;
+                  for (const row of rows) {
+                    yield row;
+                  }
+                  offset += rows.length;
+                }
+              }
               for (const row of results) {
                 yield row;
               }
@@ -3561,12 +4618,16 @@ export class PlayContextImpl {
       executionRowIndexes?: number[];
       /**
        * Opt-in cap on how many row resolvers run their body concurrently. When
-       * unset (the default), all rows in the batch start together — the
-       * established behavior the batch executor relies on. When set, excess
-       * rows wait for a slot, bounding in-flight per-row work for callers who
-       * want to throttle a wide map.
+       * unset, the Governor's rowDefault is used. Excess rows stay pending as
+       * indexes until a worker is free.
        */
       concurrency?: number;
+      largestRowBytes?: number;
+      retainedRowsMemoryBudgetBytes?: number;
+      activeRowsMemoryBudgetBytes?: number;
+      progressCompletedOffset?: number;
+      progressFailedOffset?: number;
+      progressTotalRows?: number;
       incrementalPersistence?: IncrementalMapRowPersistence | null;
     },
   ): Promise<FieldMapRunResult> {
@@ -3596,7 +4657,9 @@ export class PlayContextImpl {
       runtimeOptions?.executionRowIndexes?.[index] ?? index;
 
     const totalRows = Math.max(
-      executionSummary?.totalRows ?? items.length,
+      runtimeOptions?.progressTotalRows ??
+        executionSummary?.totalRows ??
+        items.length,
       items.length,
     );
     const completedRows = Math.min(
@@ -3610,6 +4673,10 @@ export class PlayContextImpl {
     const failedRowsToPersist: PersistableMapRow[] = [];
     const incrementalPersistence =
       runtimeOptions?.incrementalPersistence ?? null;
+    const retainedRowsMemoryTracker = createRuntimeMapRetainedRowsTracker({
+      mapName: normalizedTableNamespace,
+      budgetBytes: runtimeOptions?.retainedRowsMemoryBudgetBytes,
+    });
     const enqueueIncrementalPersist = (row: PersistableMapRow): void => {
       void incrementalPersistence?.persistRows([row]).catch(() => {
         // The final map-level flush awaits the same chain and surfaces the
@@ -3728,17 +4795,21 @@ export class PlayContextImpl {
           ? 'map.progress'
           : null);
       if (progressEventType) {
+        const failedRows = Math.max(
+          0,
+          (runtimeOptions?.progressFailedOffset ?? 0) +
+            (items.length - completedRowKeys.size - pendingRowKeys.size),
+        );
         this.emitExecutionEvent({
           type: progressEventType,
           mapInvocationId: mapScope.mapInvocationId,
           mapNodeId: mapScope.mapNodeId ?? null,
           logicalNamespace: mapScope.logicalNamespace,
           artifactTableNamespace: mapScope.artifactTableNamespace,
-          completedRows: completedRowKeys.size,
-          failedRows: Math.max(
-            0,
-            totalRows - completedRowKeys.size - pendingRowKeys.size,
-          ),
+          completedRows:
+            (runtimeOptions?.progressCompletedOffset ?? 0) +
+            completedRowKeys.size,
+          failedRows,
           totalRows,
           at: Date.now(),
         } as PlayExecutionEvent);
@@ -3753,6 +4824,22 @@ export class PlayContextImpl {
         normalizedTableNamespace,
         executionRowKey,
       );
+      const pureResultsMemoryEstimate = estimateRuntimeMapRowsMemory(results);
+      const retainedRowsBudgetBytes =
+        runtimeOptions?.retainedRowsMemoryBudgetBytes ??
+        resolveRuntimeMapMemoryLimits(this.#options.runtimeMapMemoryLimits)
+          .materializedBudgetBytes;
+      if (
+        pureResultsMemoryEstimate.estimatedResidentBytes >
+        retainedRowsBudgetBytes
+      ) {
+        throw new RuntimeMapMemoryLimitError({
+          mapName: normalizedTableNamespace,
+          phase: 'retained_rows',
+          estimate: pureResultsMemoryEstimate,
+          budgetBytes: retainedRowsBudgetBytes,
+        });
+      }
       // One batched frame update for the whole pure map. The per-row loop
       // this replaces ran AFTER every row had already computed, emitting 150k
       // post-hoc map.progress events and re-copying the completed-keys array
@@ -3794,46 +4881,64 @@ export class PlayContextImpl {
 
     this.initializeRowStates(items);
 
-    // Bound on how many row resolver bodies run at once. An explicit
+    // Bound on how many row resolver bodies exist at once. An explicit
     // `concurrency` is clamped to [1, policy.concurrency.rowMax]; unset uses
-    // policy.concurrency.rowDefault (resolved by the Governor). The promises array is still created up
-    // front so drainQueuedWork is unaffected — only body execution is gated, so
-    // excess rows wait for a slot rather than allocating unbounded in-flight
-    // work. (Pure-JS maps use a separate fast path and never reach here.)
-    const rowConcurrencyLimit = this.governor.resolveRowConcurrency(
+    // policy.concurrency.rowDefault (resolved by the Governor). Pending rows are
+    // indexes, not promises, so they do not pre-claim receipts, queue tools, or
+    // retain row closures before admission. Pure-JS maps use a separate fast
+    // path and never reach here.
+    const requestedRowConcurrency = this.resourceGovernor.resolveRowConcurrency(
       runtimeOptions?.concurrency,
     );
-    // Local per-map slot enforces THIS map's `concurrency`. It is wrapped by the
-    // Governor's GLOBAL row slot (acquired first, below) so N concurrent ctx.map
-    // calls cannot exceed policy.concurrency.rowMax total in-flight rows — the
-    // same global backstop the esm_workers path applies per row. Without the
-    // global slot, sum(perMapLimit) rows could run with no run-wide ceiling.
-    const rowSlotWaiters: Array<() => void> = [];
-    let activeRowResolvers = 0;
-    const acquireLocalRowSlot = async (): Promise<void> => {
-      while (activeRowResolvers >= rowConcurrencyLimit) {
-        await new Promise<void>((resolve) => {
-          rowSlotWaiters.push(resolve);
-        });
-      }
-      activeRowResolvers += 1;
-    };
-    const releaseLocalRowSlot = (): void => {
-      activeRowResolvers = Math.max(0, activeRowResolvers - 1);
-      rowSlotWaiters.shift()?.();
-    };
+    const largestRowBytes =
+      runtimeOptions?.largestRowBytes ??
+      estimateRuntimeMapRowsMemory(items).largestRowBytes;
+    const rowAdmission = resolveRuntimeMapRowAdmission({
+      rowCount: items.length,
+      requestedConcurrency: requestedRowConcurrency,
+      largestRowBytes,
+      activeRowsBudgetBytes: runtimeOptions?.activeRowsMemoryBudgetBytes,
+    });
+    const rowConcurrencyLimit = rowAdmission.concurrency;
+    if (items.length > 0 && rowConcurrencyLimit === 0) {
+      throw new RuntimeMapMemoryLimitError({
+        mapName: normalizedTableNamespace,
+        phase: 'active_rows',
+        estimate: {
+          rowCount: items.length,
+          serializedBytes: largestRowBytes,
+          largestRowBytes,
+          estimatedResidentBytes: rowAdmission.estimatedBytesPerActiveRow,
+        },
+        budgetBytes:
+          runtimeOptions?.activeRowsMemoryBudgetBytes ??
+          resolveRuntimeMapMemoryLimits().activeRowsBudgetBytes,
+        activeRows: 1,
+        rowConcurrency: requestedRowConcurrency,
+      });
+    }
+    this.resourceGovernor.observe({
+      memoryBytes: rowAdmission.estimatedResidentBytes,
+    });
+    const settledResults = new Array<MapRowExecutionResult | undefined>(
+      items.length,
+    );
+    let nextRowIndex = 0;
+    let firstRowError: unknown = null;
 
-    const promises = items.map(async (item, idx) => {
+    const runRow = async (idx: number): Promise<MapRowExecutionResult> => {
+      const item = items[idx];
       const baseRow = this.toOutputRow(item);
       const rowKey = executionRowKey(baseRow, idx);
       const rowIndex = executionRowIndex(idx);
       const computedFields: Record<string, unknown> = {};
       let activeFieldName: string | null = null;
 
-      // Global row slot first (run-wide rowMax backstop), then the local per-map
-      // slot (this map's concurrency). Released in reverse in the finally below.
-      const globalRowSlot = await this.governor.acquireRowSlot();
-      await acquireLocalRowSlot();
+      // Global row slot keeps concurrent maps in the same run under rowMax. The
+      // worker pool above enforces this map's requested/default concurrency.
+      const globalRowSlot = await this.resourceGovernor.acquireRow({
+        estimatedBytes: runtimeMapJsonByteLength(baseRow),
+      });
       try {
         for (const [fieldName, resolver] of fieldEntries) {
           activeFieldName = fieldName;
@@ -3910,6 +5015,7 @@ export class PlayContextImpl {
                   : {}),
                 error: formattedError,
               });
+              retainedRowsMemoryTracker.track(failedRow);
               failedRowsToPersist.push(failedRow);
               throw error;
             }
@@ -3924,6 +5030,7 @@ export class PlayContextImpl {
               ...(cellMetaPatch ? { cellMetaPatch } : {}),
               error: formattedError,
             });
+            retainedRowsMemoryTracker.track(failedRow);
             failedRowsToPersist.push(failedRow);
             updateMapFrameProgress({
               failedRowKey: rowKey,
@@ -3942,6 +5049,31 @@ export class PlayContextImpl {
           const cellValue = this.serializeCellValue(value);
           computedFields[fieldName] = cellValue;
           this.rowStates.get(idx)?.results.set(fieldName, cellValue);
+          const currentCellMeta =
+            this.activeMapCellMeta?.get(rowKey)?.[fieldName];
+          const currentCellStatus =
+            currentCellMeta &&
+            typeof currentCellMeta === 'object' &&
+            !Array.isArray(currentCellMeta) &&
+            'status' in currentCellMeta
+              ? (currentCellMeta as { status?: unknown }).status
+              : null;
+          if (currentCellStatus === 'skipped') {
+            if (
+              shouldPersistMapCellField(fieldName) &&
+              Object.prototype.hasOwnProperty.call(computedFields, fieldName)
+            ) {
+              this.emitScopedRowUpdate(rowKey, normalizedTableNamespace, {
+                rowId: idx,
+                status: 'running',
+                stage: 'skipped',
+                provider: null,
+                error: null,
+                dataPatch: { [fieldName]: cellValue },
+              });
+            }
+            continue;
+          }
           this.emitScopedFieldMetaUpdate({
             rowId: idx,
             key: rowKey,
@@ -3978,6 +5110,7 @@ export class PlayContextImpl {
             ? { cellMetaPatch: this.activeMapCellMeta.get(rowKey) }
             : {}),
         });
+        retainedRowsMemoryTracker.track(completedRow);
         completedRowsToPersist.push(completedRow);
         enqueueIncrementalPersist(completedRow);
         return publicRow;
@@ -4023,16 +5156,30 @@ export class PlayContextImpl {
         });
         throw error;
       } finally {
-        releaseLocalRowSlot();
         globalRowSlot.release();
       }
+    };
+
+    const workerCount = Math.min(rowConcurrencyLimit, items.length);
+    const workers = Array.from({ length: workerCount }, async () => {
+      while (firstRowError == null) {
+        const idx = nextRowIndex;
+        nextRowIndex += 1;
+        if (idx >= items.length) return;
+        try {
+          settledResults[idx] = await runRow(idx);
+        } catch (error) {
+          firstRowError = error;
+          throw error;
+        }
+      }
     });
 
-    await this.drainQueuedWork(promises);
+    await this.drainQueuedWork(workers);
     this.lastDatasetStep = datasetStep;
     this.activeDatasetStep = null;
 
-    const settled = await Promise.allSettled(promises);
+    const settled = await Promise.allSettled(workers);
     const rejected = settled.find(
       (result): result is PromiseRejectedResult => result.status === 'rejected',
     );
@@ -4043,12 +5190,15 @@ export class PlayContextImpl {
         failedRows: failedRowsToPersist,
       });
     }
-    const settledResults = settled.map((result) => {
-      if (result.status === 'rejected') {
-        throw result.reason;
-      }
-      return result.value;
-    });
+    const missingResultIndex = settledResults.findIndex(
+      (result) => result === undefined,
+    );
+    if (missingResultIndex !== -1) {
+      throw new Error(
+        `Runtime map execution worker pool ended before row ${missingResultIndex} settled for ctx.dataset("${normalizedTableNamespace}").`,
+      );
+    }
+    const rowResults = settledResults as MapRowExecutionResult[];
     const accountedRowIndexes = new Set<number>();
     for (const row of completedRowsToPersist) {
       if (typeof row.inputIndex === 'number') {
@@ -4062,8 +5212,8 @@ export class PlayContextImpl {
     }
     if (this.pendingRowEventBoundaries.length > 0) {
       const completedRowKeys = new Set<string>();
-      for (let index = 0; index < settledResults.length; index += 1) {
-        const result = settledResults[index];
+      for (let index = 0; index < rowResults.length; index += 1) {
+        const result = rowResults[index];
         const rawItem = this.toOutputRow(
           items[index] as Record<string, unknown>,
         );
@@ -4129,7 +5279,7 @@ export class PlayContextImpl {
           `missing input index(es): ${missingRowIndexes.slice(0, 10).join(', ') || 'unknown'}.`,
       );
     }
-    const results = settledResults.filter(
+    const results = rowResults.filter(
       (result): result is Record<string, unknown> =>
         result !== WAITING_ROW && result !== FAILED_ROW,
     );
@@ -4232,6 +5382,25 @@ export class PlayContextImpl {
             undefined,
           );
       produced[step.name] = value;
+      const rowStore = rowContext.getStore();
+      const fieldName = stepPath.join('.');
+      const patchFieldName = runtimeSheetPatchFieldName(fieldName);
+      if (rowStore && shouldPersistMapCellField(patchFieldName)) {
+        const cellValue = this.serializeCellValue(value);
+        this.emitScopedFieldMetaUpdate({
+          rowId: rowStore.rowId,
+          key: rowStore.rowKey ?? null,
+          tableNamespace: rowStore.tableNamespace ?? null,
+          fieldName,
+          status: 'completed',
+          rowStatus: 'running',
+          stage: 'completed',
+          provider: null,
+          error: null,
+          completedAt: Date.now(),
+          dataPatch: { [patchFieldName]: cellValue },
+        });
+      }
       currentRow = cloneCsvAliasedRow(currentRow, { [step.name]: value });
     }
     if (typeof program.returnResolver === 'function') {
@@ -4626,6 +5795,7 @@ export class PlayContextImpl {
             ? `Calling tool: ${toolId} (force)`
             : `Calling tool: ${toolId}`,
         );
+        const directReceiptLeaseId = context?.leaseId?.trim() || null;
         const execution = await this.callToolExecutionAPI(toolId, input, {
           ...(cacheableToolResult
             ? {
@@ -4634,11 +5804,43 @@ export class PlayContextImpl {
                 providerIdempotencyKey: this.providerIdempotencyKeyForToolCall({
                   cacheKey: directCacheKey,
                   force: toolCachePolicy.force,
-                  leaseId: context?.leaseId ?? null,
+                  leaseId: directReceiptLeaseId,
                 }),
               }
             : {}),
           timeoutMs: resolveToolRuntimeTimeoutMs(toolId, options?.timeoutMs),
+          ...(directReceiptLeaseId &&
+          (this.#options.markRuntimeStepReceiptRunning ||
+            this.#options.markRuntimeStepReceiptsRunning)
+            ? {
+                beforeProviderCall: async () => {
+                  await this.assertRuntimeToolReceiptOwnership([
+                    {
+                      callId: 'direct',
+                      cacheKey: directCacheKey,
+                      receiptKey: directCacheKey,
+                      receiptLeaseId: directReceiptLeaseId,
+                      rowId: -1,
+                      toolId,
+                      input,
+                    },
+                  ]);
+                },
+                ...(this.#options.markRuntimeStepReceiptsQueued
+                  ? {
+                      parkProviderCall: async () => {
+                        await this.markRuntimeStepReceiptsQueued([
+                          {
+                            key: directCacheKey,
+                            runId: this.currentRunId,
+                            leaseId: directReceiptLeaseId,
+                          },
+                        ]);
+                      },
+                    }
+                  : {}),
+              }
+            : {}),
         });
         const wrapped = await this.wrapToolExecutionResult({
           toolId,
@@ -4788,6 +5990,7 @@ export class PlayContextImpl {
               ),
             shouldPersistFailure: (error) =>
               !(error instanceof ToolExecuteAuthScopeChangedError),
+            markRunningBeforeExecute: false,
             execute: ({ leaseId }) => executeTool({ leaseId }),
             runningReceiptWaitMaxAttempts:
               resolveRuntimeToolReceiptWaitMaxAttempts(
@@ -5262,12 +6465,7 @@ export class PlayContextImpl {
         headers: {
           Authorization: `Bearer ${this.#options.executorToken}`,
           'Content-Type': 'application/json',
-          ...(this.#options.vercelProtectionBypassToken?.trim()
-            ? {
-                'x-vercel-protection-bypass':
-                  this.#options.vercelProtectionBypassToken.trim(),
-              }
-            : {}),
+          ...(await this.vercelProtectionHeaders()),
         },
         body: JSON.stringify({
           parentRunId: input.parentRunId,
@@ -5469,9 +6667,11 @@ export class PlayContextImpl {
           // ctx.fetch is arbitrary customer-directed egress. Pace it through
           // the same generic_http_request lane as the explicit Generic HTTP
           // integration tool so switching syntax cannot bypass per-org limits.
-          const egressSlot = await this.governor.acquireToolSlot(
-            CTX_FETCH_EGRESS_TOOL_ID,
-          );
+          const egressSlot = await this.resourceGovernor.acquireTool({
+            orgId: this.#options.orgId ?? null,
+            providerResourceKey: CTX_FETCH_EGRESS_TOOL_ID,
+            toolId: CTX_FETCH_EGRESS_TOOL_ID,
+          });
           let response: Response | null = null;
           try {
             const canRetryTransport = ['GET', 'HEAD', 'OPTIONS'].includes(
@@ -5781,11 +6981,12 @@ export class PlayContextImpl {
         ): Promise<void> => {
           const followers = liveFollowersByOwnerCallId.get(owner.callId) ?? [];
           liveFollowersByOwnerCallId.delete(owner.callId);
+          const shouldPersistReceiptFailure =
+            !(error instanceof ToolExecuteAuthScopeChangedError) &&
+            !this.persistenceLatch.tripped;
           for (const request of [owner, ...followers]) {
             await this.rejectToolCall(toolId, request, error, {
-              persistReceiptFailure: !(
-                error instanceof ToolExecuteAuthScopeChangedError
-              ),
+              persistReceiptFailure: shouldPersistReceiptFailure,
             });
           }
         };
@@ -5833,7 +7034,13 @@ export class PlayContextImpl {
           return timeoutMs > 0 ? timeoutMs : undefined;
         };
 
-        const durableExistingRunningHandlers: Promise<void>[] = [];
+        const durableExistingRunningWaits: Array<{
+          receiptKey: string;
+          requestsForKey: ToolCallRequest[];
+          forceAfterWait: boolean;
+          waitMaxAttempts?: number;
+        }> = [];
+        let durableExistingRunningHandler: Promise<void> | null = null;
         if (
           pendingRequests.length > 0 &&
           (this.#options.claimRuntimeStepReceipts ||
@@ -5882,7 +7089,12 @@ export class PlayContextImpl {
             : new Map<string, RuntimeStepReceipt>();
           const forcedRunningReceiptKeys = new Set(
             [...forcedExisting]
-              .filter(([, receipt]) => receipt.status === 'running')
+              .filter(
+                ([, receipt]) =>
+                  receipt.status === 'queued' ||
+                  receipt.status === 'pending' ||
+                  receipt.status === 'running',
+              )
               .map(([receiptKey]) => receiptKey),
           );
           const claimableForcedReceiptKeys = forcedReceiptKeys.filter(
@@ -5982,44 +7194,75 @@ export class PlayContextImpl {
               liveFollowersByOwnerCallId.set(owner.callId, followers);
             }
           };
+          const resolveReceiptWaitMaxAttempts = (
+            requestsForKey: ToolCallRequest[],
+          ): number | undefined =>
+            requestsForKey.length > 0
+              ? Math.max(
+                  ...requestsForKey.map((request) =>
+                    resolveRuntimeToolReceiptWaitMaxAttempts(
+                      typeof request.receiptWaitMs === 'number'
+                        ? { max_wait_ms: request.receiptWaitMs }
+                        : request.input,
+                    ),
+                  ),
+                )
+              : undefined;
+          const queueExistingRunningReceiptWait = (
+            receiptKey: string,
+            requestsForKey: ToolCallRequest[],
+            forceAfterWait = false,
+          ): void => {
+            durableExistingRunningWaits.push({
+              receiptKey,
+              requestsForKey,
+              forceAfterWait,
+              waitMaxAttempts: resolveReceiptWaitMaxAttempts(requestsForKey),
+            });
+          };
           const reclaimExistingRunningReceiptAfterWait = async (
             receiptKey: string,
             requestsForKey: ToolCallRequest[],
             forceAfterWait = false,
+            waitResult?: {
+              completedReceipt?: RuntimeStepReceipt;
+              skipWait?: boolean;
+            },
           ): Promise<void> => {
-            const waitMaxAttempts =
-              requestsForKey.length > 0
-                ? Math.max(
-                    ...requestsForKey.map((request) =>
-                      resolveRuntimeToolReceiptWaitMaxAttempts(
-                        typeof request.receiptWaitMs === 'number'
-                          ? { max_wait_ms: request.receiptWaitMs }
-                          : request.input,
-                      ),
-                    ),
-                  )
-                : undefined;
-            try {
-              const completed = await this.waitForCompletedRuntimeToolReceipt(
-                receiptKey,
-                waitMaxAttempts,
-              );
+            if (waitResult?.completedReceipt) {
               if (!forceAfterWait) {
                 await resolveRequestsFromReceipt(
                   requestsForKey,
-                  completed,
+                  waitResult.completedReceipt,
                   'in_flight',
                 );
                 return;
               }
-            } catch (error) {
-              if (!(error instanceof RuntimeReceiptWaitTimeoutError)) {
-                for (const request of requestsForKey) {
-                  await this.rejectToolCall(toolId, request, error, {
-                    persistReceiptFailure: false,
-                  });
+            } else if (waitResult?.skipWait !== true) {
+              const waitMaxAttempts =
+                resolveReceiptWaitMaxAttempts(requestsForKey);
+              try {
+                const completed = await this.waitForCompletedRuntimeToolReceipt(
+                  receiptKey,
+                  waitMaxAttempts,
+                );
+                if (!forceAfterWait) {
+                  await resolveRequestsFromReceipt(
+                    requestsForKey,
+                    completed,
+                    'in_flight',
+                  );
+                  return;
+                }
+              } catch (error) {
+                if (!(error instanceof RuntimeReceiptWaitTimeoutError)) {
+                  for (const request of requestsForKey) {
+                    await this.rejectToolCall(toolId, request, error, {
+                      persistReceiptFailure: false,
+                    });
+                  }
+                  return;
                 }
-                return;
               }
             }
             const reclaimed = (
@@ -6052,10 +7295,7 @@ export class PlayContextImpl {
               }
               return;
             }
-            if (
-              reclaimed?.status === 'running' &&
-              reclaimed.claimState !== 'existing'
-            ) {
+            if (this.isOwnedClaimedRuntimeReceipt(reclaimed)) {
               const [owner, ...waiters] = requestsForKey;
               if (!owner) return;
               if (!reclaimed.leaseId) {
@@ -6066,17 +7306,24 @@ export class PlayContextImpl {
                 });
               }
               owner.receiptLeaseId = reclaimed.leaseId ?? null;
+              owner.receiptLeaseExpiresAt = reclaimed.leaseExpiresAt ?? null;
               if (waiters.length > 0) {
                 liveFollowersByOwnerCallId.set(owner.callId, waiters);
               }
               try {
-                await this.assertRuntimeToolReceiptOwnership([owner]);
                 const execution = await this.callToolExecutionAPI(
                   toolId,
                   owner.input,
                   {
+                    beforeProviderCall: () =>
+                      this.assertRuntimeToolReceiptOwnership([owner]),
+                    parkProviderCall: () =>
+                      this.parkRuntimeToolReceiptsQueued([owner]),
                     durableCallReceiptKey: receiptKey,
                     executionAuthScopeDigest: owner.executionAuthScopeDigest,
+                    receiptLeaseExpiresAt: owner.receiptLeaseExpiresAt,
+                    heartbeatReceipt: () =>
+                      this.assertRuntimeToolReceiptOwnership([owner]),
                     providerIdempotencyKey:
                       this.providerIdempotencyKeyForToolCall({
                         cacheKey: owner.cacheKey,
@@ -6112,17 +7359,50 @@ export class PlayContextImpl {
               );
             }
           };
+          const processExistingRunningReceiptWaits =
+            async (): Promise<void> => {
+              if (durableExistingRunningWaits.length === 0) return;
+              const waitMaxAttempts = Math.max(
+                ...durableExistingRunningWaits.map(
+                  (wait) => wait.waitMaxAttempts ?? 0,
+                ),
+              );
+              const waited = await this.waitForCompletedRuntimeToolReceipts(
+                durableExistingRunningWaits.map((wait) => wait.receiptKey),
+                waitMaxAttempts > 0 ? waitMaxAttempts : undefined,
+              );
+              await Promise.allSettled(
+                durableExistingRunningWaits.map(async (wait) => {
+                  const failed = waited.failed.get(wait.receiptKey);
+                  if (failed) {
+                    for (const request of wait.requestsForKey) {
+                      await this.rejectToolCall(toolId, request, failed, {
+                        persistReceiptFailure: false,
+                      });
+                    }
+                    return;
+                  }
+                  await reclaimExistingRunningReceiptAfterWait(
+                    wait.receiptKey,
+                    wait.requestsForKey,
+                    wait.forceAfterWait,
+                    {
+                      completedReceipt: waited.completed.get(wait.receiptKey),
+                      skipWait: true,
+                    },
+                  );
+                }),
+              );
+            };
 
           for (const [receiptKey, group] of requestsByReceiptKey) {
             const requestsForKey = group.requests;
             const claim = claims.get(receiptKey);
             if (!claim) {
-              durableExistingRunningHandlers.push(
-                reclaimExistingRunningReceiptAfterWait(
-                  receiptKey,
-                  requestsForKey,
-                  group.forceRefresh,
-                ),
+              queueExistingRunningReceiptWait(
+                receiptKey,
+                requestsForKey,
+                group.forceRefresh,
               );
               continue;
             }
@@ -6142,9 +7422,19 @@ export class PlayContextImpl {
               continue;
             }
             if (
-              claim?.status === 'running' &&
-              claim.claimState !== 'existing'
+              (claim?.status === 'queued' ||
+                claim?.status === 'pending' ||
+                claim?.status === 'running') &&
+              claim.claimState === 'existing'
             ) {
+              queueExistingRunningReceiptWait(
+                receiptKey,
+                requestsForKey,
+                group.forceRefresh,
+              );
+              continue;
+            }
+            if (this.isOwnedClaimedRuntimeReceipt(claim)) {
               const [owner, ...waiters] = requestsForKey;
               if (!claim.leaseId) {
                 throw new RuntimeReceiptLeaseLostError({
@@ -6155,34 +7445,24 @@ export class PlayContextImpl {
               }
               if (owner) {
                 owner.receiptLeaseId = claim.leaseId ?? null;
+                owner.receiptLeaseExpiresAt = claim.leaseExpiresAt ?? null;
               }
               claimOwnerWithLiveFollowers(owner, waiters);
               continue;
             }
-            if (
-              claim?.status === 'running' &&
-              claim.claimState === 'existing'
-            ) {
-              durableExistingRunningHandlers.push(
-                reclaimExistingRunningReceiptAfterWait(
-                  receiptKey,
-                  requestsForKey,
-                  group.forceRefresh,
-                ),
-              );
-              continue;
-            }
-            durableExistingRunningHandlers.push(
-              reclaimExistingRunningReceiptAfterWait(
-                receiptKey,
-                requestsForKey,
-                group.forceRefresh,
-              ),
+            queueExistingRunningReceiptWait(
+              receiptKey,
+              requestsForKey,
+              group.forceRefresh,
             );
           }
 
           pendingRequests.length = 0;
           pendingRequests.push(...claimedRequests);
+          durableExistingRunningHandler =
+            durableExistingRunningWaits.length > 0
+              ? processExistingRunningReceiptWaits()
+              : null;
           recordToolStep(durableRecoveredRequests);
         }
 
@@ -6199,7 +7479,7 @@ export class PlayContextImpl {
 
             const batchSize =
               compiledBatches.length > 0
-                ? await this.governor.suggestedParallelism(
+                ? await this.resourceGovernor.suggestedToolParallelism(
                     compiledBatches[0]!.batchOperation,
                     this.governor.policy.pacing
                       .workerToolBatchDefaultParallelism,
@@ -6218,9 +7498,6 @@ export class PlayContextImpl {
                     this.persistenceLatch,
                   );
                 }
-                await this.assertRuntimeToolReceiptOwnership(
-                  batch.memberRequests,
-                );
                 const receiptKeys = batch.memberRequests.map(
                   (request) => request.cacheKey,
                 );
@@ -6254,9 +7531,29 @@ export class PlayContextImpl {
                             }),
                         ),
                       }),
+                    receiptLeaseExpiresAt: batch.memberRequests.reduce<
+                      string | null
+                    >((earliest, request) => {
+                      const expiresAt = request.receiptLeaseExpiresAt ?? null;
+                      if (!expiresAt) return earliest;
+                      if (!earliest) return expiresAt;
+                      return Date.parse(expiresAt) < Date.parse(earliest)
+                        ? expiresAt
+                        : earliest;
+                    }, null),
                     timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners(
                       batch.memberRequests,
                     ),
+                    beforeProviderCall: () =>
+                      this.assertRuntimeToolReceiptOwnership(
+                        batch.memberRequests,
+                      ),
+                    heartbeatReceipt: () =>
+                      this.assertRuntimeToolReceiptOwnership(
+                        batch.memberRequests,
+                      ),
+                    parkProviderCall: () =>
+                      this.parkRuntimeToolReceiptsQueued(batch.memberRequests),
                   },
                 );
               },
@@ -6299,77 +7596,144 @@ export class PlayContextImpl {
               },
             });
           } else {
-            const batchSize = await this.governor.suggestedParallelism(
-              toolId,
-              this.governor.policy.pacing.suggestedMaxParallelism,
-            );
-            for (
-              let start = 0;
-              start < pendingRequests.length;
-              start += batchSize
-            ) {
-              const chunk = pendingRequests.slice(start, start + batchSize);
-              await Promise.allSettled(
-                chunk.map(async (request) => {
-                  // Circuit breaker: do not dispatch this provider call once a
-                  // persistence failure has occurred in this run.
-                  if (this.persistenceLatch.tripped) {
-                    this.persistenceLatch.preventedCallCount += 1;
-                    await rejectWithLiveFollowers(
-                      request,
-                      new RuntimePersistenceCircuitOpenError(
-                        this.persistenceLatch,
-                      ),
-                    );
-                    return;
-                  }
-                  try {
-                    await this.assertRuntimeToolReceiptOwnership([request]);
-                    const execution = await this.callToolExecutionAPI(
-                      toolId,
-                      request.input,
-                      {
-                        ...(request.receiptKey
-                          ? {
-                              durableCallReceiptKey: request.receiptKey,
-                              executionAuthScopeDigest:
-                                request.executionAuthScopeDigest,
-                              providerIdempotencyKey:
-                                this.providerIdempotencyKeyForToolCall({
-                                  cacheKey: request.receiptKey,
-                                  force: request.force === true,
-                                  leaseId: request.receiptLeaseId,
-                                }),
-                            }
-                          : {}),
-                        timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners([
-                          request,
-                        ]),
-                      },
-                    );
-                    const result = await this.resolveToolCall(
-                      toolId,
-                      request,
-                      execution?.result ?? null,
-                      execution?.metadata ?? null,
-                      execution?.jobId,
-                      execution?.meta,
-                    );
-                    liveStepResults.set(request.callId, result);
-                    resolveLiveFollowers(request, result);
-                  } catch (error) {
-                    await rejectWithLiveFollowers(request, error);
-                  }
-                }),
+            const initialRequestsPerSecond =
+              await this.resourceGovernor.suggestedToolParallelism(
+                toolId,
+                this.governor.policy.pacing.suggestedMaxParallelism,
               );
-
-              recordToolStep(chunk);
-              this.#options.onBatchComplete?.(this.checkpoint);
-            }
+            const dispatcher = new AdaptiveToolDispatcher<
+              ToolCallRequest,
+              unknown
+            >({
+              initialRequestsPerSecond,
+              maxRequestsPerSecond:
+                this.governor.policy.pacing.suggestedMaxParallelism,
+              maxConcurrency: this.governor.policy.concurrency.toolCalls,
+              defaultLatencyMs: 1_000,
+              safetyFactor: 1.5,
+            });
+            const completionBuffer: Array<{
+              request: ToolCallRequest;
+              result: unknown | null;
+              metadata?: ToolResultMetadataInput | null;
+              jobId?: string;
+              meta?: Record<string, unknown>;
+              resolve: (value: unknown) => void;
+              reject: (error: unknown) => void;
+            }> = [];
+            const completionFailedCallIds = new Set<string>();
+            let completionFlushScheduled = false;
+            const flushCompletionBuffer = async (): Promise<void> => {
+              const entries = completionBuffer.splice(0);
+              if (entries.length === 0) return;
+              try {
+                const resolvedResults = await this.resolveToolCallBatchResults(
+                  toolId,
+                  entries.map((entry) => ({
+                    request: entry.request,
+                    result: entry.result,
+                    metadata: entry.metadata,
+                    jobId: entry.jobId,
+                    meta: entry.meta,
+                  })),
+                );
+                for (let index = 0; index < entries.length; index += 1) {
+                  const entry = entries[index]!;
+                  const result = resolvedResults[index];
+                  liveStepResults.set(entry.request.callId, result);
+                  resolveLiveFollowers(entry.request, result);
+                  entry.resolve(result);
+                }
+              } catch (error) {
+                for (const entry of entries) {
+                  completionFailedCallIds.add(entry.request.callId);
+                  await this.rejectToolCall(toolId, entry.request, error, {
+                    persistReceiptFailure: false,
+                  });
+                  entry.reject(error);
+                }
+              }
+            };
+            const enqueueCompletion = (
+              request: ToolCallRequest,
+              execution: ParsedToolExecuteResponse,
+            ): Promise<unknown> =>
+              new Promise((resolve, reject) => {
+                completionBuffer.push({
+                  request,
+                  result: execution.result ?? null,
+                  metadata: execution.metadata ?? null,
+                  jobId: execution.jobId,
+                  meta: execution.meta,
+                  resolve,
+                  reject,
+                });
+                if (completionFlushScheduled) return;
+                completionFlushScheduled = true;
+                setTimeout(() => {
+                  completionFlushScheduled = false;
+                  void flushCompletionBuffer();
+                }, 0);
+              });
+            const dispatchResults = await dispatcher.dispatch(
+              pendingRequests,
+              async (request) => {
+                // Circuit breaker: do not dispatch this provider call once a
+                // persistence failure has occurred in this run.
+                if (this.persistenceLatch.tripped) {
+                  this.persistenceLatch.preventedCallCount += 1;
+                  throw new RuntimePersistenceCircuitOpenError(
+                    this.persistenceLatch,
+                  );
+                }
+                const execution = await this.callToolExecutionAPI(
+                  toolId,
+                  request.input,
+                  {
+                    beforeProviderCall: () =>
+                      this.assertRuntimeToolReceiptOwnership([request]),
+                    parkProviderCall: () =>
+                      this.parkRuntimeToolReceiptsQueued([request]),
+                    ...(request.receiptKey
+                      ? {
+                          durableCallReceiptKey: request.receiptKey,
+                          executionAuthScopeDigest:
+                            request.executionAuthScopeDigest,
+                          providerIdempotencyKey:
+                            this.providerIdempotencyKeyForToolCall({
+                              cacheKey: request.receiptKey,
+                              force: request.force === true,
+                              leaseId: request.receiptLeaseId,
+                            }),
+                          receiptLeaseExpiresAt: request.receiptLeaseExpiresAt,
+                          heartbeatReceipt: () =>
+                            this.assertRuntimeToolReceiptOwnership([request]),
+                        }
+                      : {}),
+                    timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners([
+                      request,
+                    ]),
+                  },
+                );
+                return await enqueueCompletion(request, execution);
+              },
+            );
+            const failedEntries = dispatchResults.filter(
+              (entry) =>
+                entry.error !== undefined &&
+                !completionFailedCallIds.has(entry.job.callId),
+            );
+            await Promise.allSettled(
+              failedEntries.map((entry) =>
+                rejectWithLiveFollowers(entry.job, entry.error),
+              ),
+            );
+            recordToolStep(pendingRequests);
+            this.#options.onBatchComplete?.(this.checkpoint);
           }
         }
-        if (durableExistingRunningHandlers.length > 0) {
-          await Promise.allSettled(durableExistingRunningHandlers);
+        if (durableExistingRunningHandler) {
+          await durableExistingRunningHandler;
         }
       }),
     );
@@ -6498,7 +7862,11 @@ export class PlayContextImpl {
     // The Governor's tool slot is the single seam for tool-call budget + the
     // global tool-concurrency backstop + per-(org, provider) pacing. It blocks
     // until all three are satisfied and is held (across retries) until release.
-    const toolSlot = await this.governor.acquireToolSlot(toolId);
+    const toolSlot = await this.resourceGovernor.acquireTool({
+      orgId: this.#options.orgId ?? null,
+      providerResourceKey: `tool:${toolId}`,
+      toolId,
+    });
     try {
       return await withActiveSpan(
         'plays.tool.execute',
@@ -6538,7 +7906,15 @@ export class PlayContextImpl {
             const deeplineRequestId = providerIdempotencyKey
               ? `ctx-tool-${stableDigest(providerIdempotencyKey).slice(0, 32)}`
               : null;
-            const abortController = timeoutMs ? new AbortController() : null;
+            // Receipt ownership is a liveness contract, not a one-time check.
+            // Keep it alive for the whole provider HTTP request. The cadence
+            // comes from the store-issued expiry because a remote runner may
+            // not share the coordinator's TTL environment.
+            const hasReceiptHeartbeat = Boolean(options?.heartbeatReceipt);
+            const abortController =
+              timeoutMs || hasReceiptHeartbeat ? new AbortController() : null;
+            const receiptHeartbeat = options?.heartbeatReceipt;
+            let heartbeatFailure: unknown = null;
             const timeoutHandle = timeoutMs
               ? setTimeout(() => {
                   abortController?.abort(
@@ -6549,75 +7925,114 @@ export class PlayContextImpl {
                 }, timeoutMs)
               : null;
             try {
-              response = await fetch(url, {
-                method: 'POST',
-                signal: abortController?.signal,
-                headers: {
-                  'Content-Type': 'application/json',
-                  Authorization: `Bearer ${this.#options.executorToken}`,
-                  [EXECUTE_RESPONSE_CONTRACT_HEADER]:
-                    V2_EXECUTE_RESPONSE_CONTRACT,
-                  [EXECUTE_RESPONSE_INTENT_HEADER]: 'dataset',
-                  [EXECUTE_TOOL_METADATA_HEADER]: 'true',
-                  ...(deeplineRequestId
-                    ? {
-                        'x-deepline-request-id': deeplineRequestId,
-                        'x-deepline-idempotency-key': providerIdempotencyKey!,
-                      }
-                    : {}),
-                  ...(this.#options.vercelProtectionBypassToken?.trim()
-                    ? {
-                        'x-vercel-protection-bypass':
-                          this.#options.vercelProtectionBypassToken.trim(),
-                      }
-                    : {}),
-                },
-                body: JSON.stringify({
-                  payload: input,
-                  metadata: {
-                    parent_run_id: this.#options.runId,
-                    ...(durableCallReceiptKey
-                      ? {
-                          durable_call_receipt_key: durableCallReceiptKey,
-                          ...(executionAuthScopeDigest
-                            ? {
-                                execution_auth_scope_digest:
-                                  executionAuthScopeDigest,
-                              }
-                            : {}),
-                        }
-                      : {}),
-                    ...(options?.customerDbDataset
+              const providerCallStartedAt = Date.now();
+              await options?.beforeProviderCall?.();
+              const heartbeatIntervalMs = hasReceiptHeartbeat
+                ? runtimeLeaseHeartbeatIntervalFromExpiry({
+                    leaseExpiresAt: options?.receiptLeaseExpiresAt,
+                    fallbackTtlMs: PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
+                  })
+                : null;
+              const receiptHeartbeatSupervisor =
+                heartbeatIntervalMs !== null && receiptHeartbeat
+                  ? createRuntimeReceiptHeartbeatSupervisor({
+                      intervalMs: heartbeatIntervalMs,
+                      heartbeat: async () => {
+                        await receiptHeartbeat();
+                        return 'active';
+                      },
+                      isLeaseLost: (error) =>
+                        error instanceof RuntimeReceiptLeaseLostError,
+                      onLeaseLost: (error) => {
+                        heartbeatFailure ??= error;
+                        abortController?.abort(error);
+                      },
+                      onTransientFailure: (error) => {
+                        this.log(
+                          `Tool ${toolId} receipt heartbeat transport failed; retrying: ${error instanceof Error ? error.message : String(error)}`,
+                        );
+                      },
+                    })
+                  : null;
+              receiptHeartbeatSupervisor?.start();
+              try {
+                response = await fetch(url, {
+                  method: 'POST',
+                  signal: abortController?.signal,
+                  headers: {
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${this.#options.executorToken}`,
+                    [EXECUTE_RESPONSE_CONTRACT_HEADER]:
+                      V2_EXECUTE_RESPONSE_CONTRACT,
+                    [EXECUTE_RESPONSE_INTENT_HEADER]: 'dataset',
+                    [EXECUTE_TOOL_METADATA_HEADER]: 'true',
+                    ...(deeplineRequestId
                       ? {
-                          query_result_dataset: {
-                            limit: options.customerDbDataset.limit,
-                            offset: options.customerDbDataset.offset,
-                            page_size: options.customerDbDataset.pageSize,
-                            total_rows: options.customerDbDataset.totalRows,
-                          },
-                          ...(isCustomerDbDatasetTool(toolId)
-                            ? {
-                                customer_db_dataset: {
-                                  limit: options.customerDbDataset.limit,
-                                  offset: options.customerDbDataset.offset,
-                                  page_size: options.customerDbDataset.pageSize,
-                                  total_rows:
-                                    options.customerDbDataset.totalRows,
-                                },
-                              }
-                            : {}),
+                          'x-deepline-request-id': deeplineRequestId,
+                          'x-deepline-idempotency-key': providerIdempotencyKey!,
                         }
                       : {}),
-                    ...(providerIdempotencyKey
-                      ? { provider_idempotency_key: providerIdempotencyKey }
-                      : {}),
+                    ...(await this.vercelProtectionHeaders()),
                   },
-                  ...(this.#options.integrationMode
-                    ? { integration_mode: this.#options.integrationMode }
-                    : {}),
-                }),
-              });
+                  body: JSON.stringify({
+                    payload: input,
+                    metadata: {
+                      parent_run_id: this.#options.runId,
+                      ...(durableCallReceiptKey
+                        ? {
+                            durable_call_receipt_key: durableCallReceiptKey,
+                            ...(executionAuthScopeDigest
+                              ? {
+                                  execution_auth_scope_digest:
+                                    executionAuthScopeDigest,
+                                }
+                              : {}),
+                          }
+                        : {}),
+                      ...(options?.customerDbDataset
+                        ? {
+                            query_result_dataset: {
+                              limit: options.customerDbDataset.limit,
+                              offset: options.customerDbDataset.offset,
+                              page_size: options.customerDbDataset.pageSize,
+                              total_rows: options.customerDbDataset.totalRows,
+                            },
+                            ...(isCustomerDbDatasetTool(toolId)
+                              ? {
+                                  customer_db_dataset: {
+                                    limit: options.customerDbDataset.limit,
+                                    offset: options.customerDbDataset.offset,
+                                    page_size:
+                                      options.customerDbDataset.pageSize,
+                                    total_rows:
+                                      options.customerDbDataset.totalRows,
+                                  },
+                                }
+                              : {}),
+                          }
+                        : {}),
+                      ...(providerIdempotencyKey
+                        ? { provider_idempotency_key: providerIdempotencyKey }
+                        : {}),
+                    },
+                    ...(this.#options.integrationMode
+                      ? { integration_mode: this.#options.integrationMode }
+                      : {}),
+                  }),
+                });
+                this.resourceGovernor.observe({
+                  providerResourceKey: `tool:${toolId}`,
+                  providerLatencyMs: Date.now() - providerCallStartedAt,
+                  providerSuccess: response.ok,
+                  provider429: response.status === 429,
+                });
+              } finally {
+                receiptHeartbeatSupervisor?.stop();
+              }
             } catch (error) {
+              if (heartbeatFailure) {
+                throw heartbeatFailure;
+              }
               if (abortController?.signal.aborted) {
                 throw abortController.signal.reason instanceof Error
                   ? abortController.signal.reason
@@ -6639,6 +8054,7 @@ export class PlayContextImpl {
                 this.log(
                   `Tool ${toolId} transport failed calling ${url} on attempt ${transportAttempt}/${TOOL_EXECUTE_TRANSPORT_MAX_ATTEMPTS}; retrying after ${retryAfterMs}ms: ${message}`,
                 );
+                await options?.parkProviderCall?.();
                 await this.sleepWithCheckpointHeartbeat(retryAfterMs);
                 continue;
               }
@@ -6702,6 +8118,7 @@ export class PlayContextImpl {
                 this.log(
                   `Tool ${toolId} returned ${response.status}; retrying after ${failure.retryDelayMs}ms`,
                 );
+                await options?.parkProviderCall?.();
                 await this.sleepWithCheckpointHeartbeat(failure.retryDelayMs);
                 continue;
               }
@@ -6730,8 +8147,8 @@ export class PlayContextImpl {
 
   /**
    * Resolve the provider backing a tool (from queue-hint metadata) and feed a
-   * server-observed Retry-After back into the Governor's shared pacer. No hints
-   * → no known provider → nothing to penalize.
+   * server-observed Retry-After back into the Governor's shared pacer. Tools
+   * without hints use the Governor's default `tool:${toolId}` bucket.
    */
   private async reportToolBackpressure(
     toolId: string,
@@ -6740,11 +8157,11 @@ export class PlayContextImpl {
     const hints: readonly PlayQueueHint[] = this.#options.getToolQueueHints
       ? await this.#options.getToolQueueHints(toolId)
       : [];
-    const provider = hints[0]?.provider;
-    if (!provider) {
-      return;
-    }
-    this.governor.reportProviderBackpressure({ provider, retryAfterMs });
+    const provider = hints[0]?.provider?.trim() || `tool:${toolId}`;
+    this.resourceGovernor.reportProviderBackpressure({
+      provider,
+      retryAfterMs,
+    });
   }
 
   private async sleepWithCheckpointHeartbeat(ms: number): Promise<void> {