deepline 0.1.201 → 0.1.202

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona.ts

@@ -46,6 +46,71 @@ const DAYTONA_RUNTIME_DB_CONNECT_MAX_ATTEMPTS = 2;
 const DAYTONA_INFRASTRUCTURE_MAX_ATTEMPTS = 2;
 const DAYTONA_UPLOAD_MAX_ATTEMPTS = 2;
 const DAYTONA_UPLOAD_ATTEMPT_DEADLINE_MS = 90_000;
+/**
+ * Client-side wall-clock grace for `sandbox.process.executeCommand`. The
+ * `timeout` argument we pass is a SERVER-side directive; the Daytona SDK's
+ * underlying HTTP call has no client deadline, so a wedged socket (observed:
+ * `AggregateError [ETIMEDOUT]`) leaves the await hanging forever and holds the
+ * worker slot. We race the call against this deadline = server timeout + grace,
+ * so a genuine server-side runtime-limit hit still returns first, but a wedged
+ * client transport fails the attempt loudly and lets the engine retry ladder
+ * take over instead of livelocking the slot.
+ */
+const DAYTONA_EXECUTE_CLIENT_GRACE_MS = 60_000;
+const DAYTONA_EXECUTE_CLIENT_DEADLINE_MS =
+  DAYTONA_EXECUTE_TIMEOUT_SECONDS * 1_000 + DAYTONA_EXECUTE_CLIENT_GRACE_MS;
+/**
+ * Bound for individual sandbox/runtime API calls that have no natural timeout
+ * (e.g. recording the acquired runtime resource). A wedged one of these must
+ * fail the attempt, not hold the slot.
+ */
+const DAYTONA_API_CALL_DEADLINE_MS = 60_000;
+
+export class DaytonaOperationDeadlineError extends Error {
+  readonly operation: string;
+  readonly deadlineMs: number;
+
+  constructor(input: { operation: string; deadlineMs: number }) {
+    super(
+      `Daytona operation "${input.operation}" exceeded client deadline of ${input.deadlineMs}ms and was abandoned to free the worker slot.`,
+    );
+    this.name = 'DaytonaOperationDeadlineError';
+    this.operation = input.operation;
+    this.deadlineMs = input.deadlineMs;
+  }
+}
+
+/**
+ * Race `promise` against a wall-clock deadline. On breach, reject loudly with a
+ * `DaytonaOperationDeadlineError` (the caller's retry/failure classification
+ * decides what happens next). The timer is always cleared so a fast-resolving
+ * promise never leaves a dangling handle.
+ */
+export async function withDaytonaOperationDeadline<T>(input: {
+  operation: string;
+  deadlineMs: number;
+  promise: Promise<T>;
+}): Promise<T> {
+  let deadlineTimer: ReturnType<typeof setTimeout> | null = null;
+  const deadlinePromise = new Promise<never>((_resolve, reject) => {
+    deadlineTimer = setTimeout(() => {
+      reject(
+        new DaytonaOperationDeadlineError({
+          operation: input.operation,
+          deadlineMs: input.deadlineMs,
+        }),
+      );
+    }, input.deadlineMs);
+    deadlineTimer.unref?.();
+  });
+  try {
+    return await Promise.race([input.promise, deadlinePromise]);
+  } finally {
+    if (deadlineTimer) {
+      clearTimeout(deadlineTimer);
+    }
+  }
+}
 const RUNTIME_POSTGRES_CONNECT_RETRY_PATTERN =
   /\bRuntime Postgres\b.*\b(connection timed out|connect timeout|ETIMEDOUT|ECONNRESET|ECONNREFUSED|Connection terminated|Connection ended unexpectedly)\b/i;
 const DAYTONA_INFRASTRUCTURE_RETRY_PATTERN =
@@ -223,10 +288,11 @@ function createDaytonaProgressSidecarPoller(input: {
   context: DaytonaExecutionContext;
   startedAt: number;
   processedEventKeys: Set<string>;
-}): { start(): void; stop(): Promise<void> } {
+}): { start(): void; stop(flush?: boolean): Promise<void> } {
   let timer: ReturnType<typeof setTimeout> | null = null;
   let stopped = false;
   let inFlight: Promise<void> = Promise.resolve();
+  let segment = 0;
   let offsetBytes = 0;
   let pendingLine = '';
   let warned = false;
@@ -259,20 +325,39 @@ function createDaytonaProgressSidecarPoller(input: {
 
   const poll = async (flushPartial = false): Promise<void> => {
     try {
-      const file = await input.sandbox.fs.downloadFile(
+      const manifest = await input.sandbox.fs.downloadFile(
         input.progressEventPath,
         5,
       );
-      const buffer = Buffer.isBuffer(file) ? file : Buffer.from(file);
-      if (buffer.length < offsetBytes) {
+      const parsedLatestSegment = Number.parseInt(
+        Buffer.isBuffer(manifest)
+          ? manifest.toString('utf-8').trim()
+          : String(manifest).trim(),
+        10,
+      );
+      const latestSegment = Number.isFinite(parsedLatestSegment)
+        ? Math.max(segment, parsedLatestSegment)
+        : segment;
+      while (segment <= latestSegment) {
+        const segmentPath = `${input.progressEventPath}.${String(
+          segment,
+        ).padStart(6, '0')}`;
+        const file = await input.sandbox.fs.downloadFile(segmentPath, 5);
+        const buffer = Buffer.isBuffer(file) ? file : Buffer.from(file);
+        if (buffer.length < offsetBytes) {
+          offsetBytes = 0;
+          pendingLine = '';
+        }
+        if (buffer.length > offsetBytes) {
+          const chunk = buffer.subarray(offsetBytes).toString('utf-8');
+          offsetBytes = buffer.length;
+          processText(chunk, flushPartial && segment === latestSegment);
+        }
+        if (segment >= latestSegment) break;
+        segment += 1;
         offsetBytes = 0;
-        pendingLine = '';
       }
-      if (buffer.length > offsetBytes) {
-        const chunk = buffer.subarray(offsetBytes).toString('utf-8');
-        offsetBytes = buffer.length;
-        processText(chunk, flushPartial);
-      } else if (flushPartial && pendingLine.trim()) {
+      if (flushPartial && pendingLine.trim()) {
         processText('\n', true);
       }
     } catch (error) {
@@ -304,14 +389,14 @@ function createDaytonaProgressSidecarPoller(input: {
     start() {
       inFlight = inFlight.then(() => poll()).finally(schedule);
     },
-    async stop() {
+    async stop(flush = true) {
       stopped = true;
       if (timer) {
         clearTimeout(timer);
         timer = null;
       }
       await inFlight.catch(() => {});
-      await poll(true);
+      if (flush) await poll(true);
     },
   };
 }
@@ -422,6 +507,12 @@ function isRetryableDaytonaInfrastructureFailure(error: unknown): boolean {
   if (error instanceof DaytonaCommandTransportError) {
     return false;
   }
+  // A client-side deadline breach is a wedged transport (hung socket / SDK call
+  // with no client timeout). Retry once on a fresh sandbox before spending an
+  // engine attempt, same as the other transport-level infrastructure failures.
+  if (error instanceof DaytonaOperationDeadlineError) {
+    return true;
+  }
   const message = error instanceof Error ? error.message : String(error);
   if (!message || /cancelled|aborted/i.test(message)) {
     return false;
@@ -566,15 +657,24 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
             acquiredSandbox.billingStartedAt - startedAt;
           const sandbox = acquiredSandbox.sandbox;
           sandboxForAttempt = sandbox;
-          await callbacks?.onRuntimeResourceAcquired?.({
-            kind: 'daytona_sandbox',
-            sandboxId: sandbox.id,
-            billingStartedAt: acquiredSandbox.billingStartedAt,
-            cpu: typeof sandbox.cpu === 'number' ? sandbox.cpu : null,
-            memoryGiB:
-              typeof sandbox.memory === 'number' ? sandbox.memory : null,
-            diskGiB: typeof sandbox.disk === 'number' ? sandbox.disk : null,
-          });
+          const resourceAcquiredNotice = callbacks?.onRuntimeResourceAcquired?.(
+            {
+              kind: 'daytona_sandbox',
+              sandboxId: sandbox.id,
+              billingStartedAt: acquiredSandbox.billingStartedAt,
+              cpu: typeof sandbox.cpu === 'number' ? sandbox.cpu : null,
+              memoryGiB:
+                typeof sandbox.memory === 'number' ? sandbox.memory : null,
+              diskGiB: typeof sandbox.disk === 'number' ? sandbox.disk : null,
+            },
+          );
+          if (resourceAcquiredNotice) {
+            await withDaytonaOperationDeadline({
+              operation: 'onRuntimeResourceAcquired',
+              deadlineMs: DAYTONA_API_CALL_DEADLINE_MS,
+              promise: resourceAcquiredNotice,
+            });
+          }
           throwIfCancellationRequested();
 
           const { workdir: workDir } = loadDaytonaRunnerPathsConfig();
@@ -676,16 +776,19 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
           try {
             progressSidecar.start();
             execution = await Promise.race([
-              sandbox.process.executeCommand(
-                stagedPayload.command,
-                stagedPayload.workDir,
-                undefined,
-                DAYTONA_EXECUTE_TIMEOUT_SECONDS,
-              ),
+              withDaytonaOperationDeadline({
+                operation: 'sandbox.process.executeCommand',
+                deadlineMs: DAYTONA_EXECUTE_CLIENT_DEADLINE_MS,
+                promise: sandbox.process.executeCommand(
+                  stagedPayload.command,
+                  stagedPayload.workDir,
+                  undefined,
+                  DAYTONA_EXECUTE_TIMEOUT_SECONDS,
+                ),
+              }),
               cancellationPromise,
             ]);
           } catch (error) {
-            await progressSidecar.stop();
             if (
               cancellationRequested ||
               callbacks?.cancellationSignal?.aborted
@@ -729,7 +832,10 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
             });
             execution = recovered.execution;
           } finally {
-            await progressSidecar.stop();
+            await progressSidecar.stop(
+              !cancellationRequested &&
+                callbacks?.cancellationSignal?.aborted !== true,
+            );
           }
           const runnerOutput = await resolveDaytonaCommandOutput({
             sandbox,
@@ -818,9 +924,11 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
               error:
                 typeof execution.exitCode === 'number' &&
                 execution.exitCode !== 0
-                  ? `Daytona play runner exited with code ${execution.exitCode}.${
-                      outputTail ? ` Output tail: ${outputTail}` : ''
-                    }`
+                  ? `Daytona play runner exited with code ${execution.exitCode}${
+                      execution.exitCode === 137
+                        ? ' (sandbox OOM or forced SIGKILL)'
+                        : ''
+                    }.${outputTail ? ` Output tail: ${outputTail}` : ''}`
                   : 'Daytona play runner produced no result.',
               runtimeTiming,
             }),

package/dist/bundling-sources/shared_libs/play-runtime/runtime-api.ts

@@ -115,7 +115,11 @@ type RuntimeApiContext = {
   runId?: string | null;
   userEmail?: string | null;
   integrationMode?: 'live' | 'eval_stub' | 'fixture' | null;
-  dbSessionStrategy?: 'preloaded' | 'sandbox_public_key' | null;
+  dbSessionStrategy?:
+    | 'preloaded'
+    | 'sandbox_public_key'
+    | 'gateway_only'
+    | null;
   preloadedDbSessions?: PreloadedRuntimeDbSession[] | null;
   vercelProtectionBypassToken?: string | null;
   runtimeTestFaultHeader?: string | null;
@@ -443,9 +447,33 @@ type RuntimeApiActionRequest =
       action: 'repair_runtime_storage_grants';
       playName: string;
       runId?: string | null;
+    }
+  | {
+      action: 'runtime_sheet_start';
+      input: Parameters<typeof startRuntimeSheetDataset>[1];
+    }
+  | {
+      action: 'runtime_sheet_complete_map_rows';
+      input: Parameters<typeof completeRuntimeMapRows>[1];
+    }
+  | {
+      action: 'runtime_sheet_read_rows';
+      input: Parameters<typeof readRuntimeSheetDatasetRows>[1];
+    }
+  | {
+      action: 'runtime_sheet_read_row_keys';
+      input: Parameters<typeof readRuntimeSheetDatasetRowKeys>[1];
+    }
+  | {
+      action: 'runtime_sheet_release_attempt';
+      input: Parameters<typeof releaseRuntimeSheetAttempt>[1];
+    }
+  | {
+      action: 'runtime_receipts_release_attempt';
+      input: Parameters<typeof releaseRuntimeWorkReceipts>[1];
     };
 
-type RuntimeApiRowRecord = MapRowOutcome & {
+export type RuntimeApiRowRecord = MapRowOutcome & {
   inputIndex?: number | null;
 };
 
@@ -614,8 +642,8 @@ function runtimeApiMaxAttempts(
   return runtimeApiRetryDelaysForAction(action).length + 1;
 }
 
-function isTransientRuntimeApiErrorMessage(message: string): boolean {
-  return /timeout exceeded when trying to connect|timed out|fetch failed|ECONNRESET|ECONNREFUSED|UND_ERR_CONNECT_TIMEOUT|requested endpoint could not be found, or you don't have access/i.test(
+export function isTransientRuntimeApiErrorMessage(message: string): boolean {
+  return /timeout exceeded when trying to connect|timed out|fetch failed|ECONNRESET|ECONNREFUSED|UND_ERR_CONNECT_TIMEOUT|requested endpoint could not be found, or you don't have access|RUNTIME_SCHEDULER_SATURATED|Runtime scheduler DB pool is saturated|Runtime scheduler DB circuit breaker is open/i.test(
     message,
   );
 }
@@ -4258,6 +4286,36 @@ export async function markRuntimeWorkReceiptsQueued(
   );
 }
 
+/**
+ * Replay-idempotency fence for a receipt whose active complete/fail UPDATE
+ * matched 0 rows. This fires when the durable write committed but the HTTP
+ * response was lost and the SAME caller retries: the row is already terminal,
+ * so the active-owner predicate (which requires status IN (queued, running))
+ * can never match again. We surface the already-terminal row as success ONLY
+ * when its run identity matches the retrying caller, so the retry does not
+ * spuriously fail a receipt whose provider spend and durable write both
+ * succeeded.
+ *
+ * The predicate mirrors the run-identity half of {@link
+ * workReceiptActiveOwnerPredicateSql}: `COALESCE(lease_owner_run_id, run_id)`
+ * must equal the caller's run id. complete/fail null the lease-owner and
+ * attempt columns as part of the terminal write, so run id is the only durable
+ * ownership marker left on a terminal row — a different run (the stale-owner
+ * rejection case) never matches and still resolves to null exactly as before.
+ * This is replay-idempotency only; it never lets a foreign run read or claim a
+ * receipt it did not complete.
+ */
+function workReceiptTerminalReplayPredicateSql(input: {
+  receiptTable: string;
+  terminalStatusSql: string;
+  ownerRunIdSql: string;
+}): string {
+  const table = input.receiptTable;
+  return `${table}.status = ${input.terminalStatusSql}::smallint
+            /* replay-idempotency: same-run retry after a lost response; run identity is the only durable owner marker on a terminal row */
+            AND COALESCE(${table}.lease_owner_run_id, ${table}.run_id) = ${input.ownerRunIdSql}`;
+}
+
 export async function completeRuntimeWorkReceipt(
   context: RuntimeApiContext,
   input: {
@@ -4340,8 +4398,31 @@ export async function completeRuntimeWorkReceipt(
 	                    lease_owner_attempt,
 	                    lease_expires_at,
 	                    updated_at
+	        ),
+	        replay AS (
+	          SELECT convert_from(k, 'UTF8') AS k,
+	                 status,
+	                 output,
+	                 error,
+	                 failure_kind,
+	                 run_id,
+	                 lease_id,
+	                 lease_owner_run_id,
+	                 lease_owner_attempt,
+	                 lease_expires_at,
+	                 updated_at
+	            FROM ${workReceiptTable(session)}
+	           WHERE k = decode($1, 'hex')
+	             AND NOT EXISTS (SELECT 1 FROM completed)
+	             AND ${workReceiptTerminalReplayPredicateSql({
+                 receiptTable: workReceiptTable(session),
+                 terminalStatusSql: '$2',
+                 ownerRunIdSql: '$4',
+               })}
 	        )
 	        SELECT k, status, output, error, failure_kind, run_id, lease_id, lease_owner_run_id, lease_owner_attempt, lease_expires_at, updated_at FROM completed
+	        UNION ALL
+	        SELECT k, status, output, error, failure_kind, run_id, lease_id, lease_owner_run_id, lease_owner_attempt, lease_expires_at, updated_at FROM replay
       `,
         [
           workReceiptKeyHex(input.key),
@@ -4478,21 +4559,49 @@ export async function completeRuntimeWorkReceipts(
                   target.updated_at,
                   inputs.ord
       ),
+      replay AS (
+        SELECT target.k,
+               target.status,
+               target.output,
+               target.error,
+               target.failure_kind,
+               target.run_id,
+               target.lease_id,
+               target.lease_owner_run_id,
+               target.lease_owner_attempt,
+               target.lease_expires_at,
+               target.updated_at,
+               inputs.ord
+          FROM inputs
+          JOIN ${workReceiptTable(session)} AS target
+            ON target.k = decode(inputs.key_hex, 'hex')
+         WHERE NOT EXISTS (SELECT 1 FROM completed WHERE completed.ord = inputs.ord)
+           AND ${workReceiptTerminalReplayPredicateSql({
+             receiptTable: 'target',
+             terminalStatusSql: '$6',
+             ownerRunIdSql: 'inputs.run_id',
+           })}
+      ),
+      resolved AS (
+        SELECT ord, k, status, output, error, failure_kind, run_id, lease_id, lease_owner_run_id, lease_owner_attempt, lease_expires_at, updated_at FROM completed
+        UNION ALL
+        SELECT ord, k, status, output, error, failure_kind, run_id, lease_id, lease_owner_run_id, lease_owner_attempt, lease_expires_at, updated_at FROM replay
+      ),
       returned AS (
-        SELECT completed.k,
-               completed.status,
-	               completed.output,
-	               completed.error,
-	               completed.failure_kind,
-	               completed.run_id,
-               completed.lease_id,
-               completed.lease_owner_run_id,
-               completed.lease_owner_attempt,
-               completed.lease_expires_at,
-               completed.updated_at,
+        SELECT resolved.k,
+               resolved.status,
+	               resolved.output,
+	               resolved.error,
+	               resolved.failure_kind,
+	               resolved.run_id,
+               resolved.lease_id,
+               resolved.lease_owner_run_id,
+               resolved.lease_owner_attempt,
+               resolved.lease_expires_at,
+               resolved.updated_at,
                inputs.ord
           FROM inputs
-          LEFT JOIN completed ON completed.ord = inputs.ord
+          LEFT JOIN resolved ON resolved.ord = inputs.ord
       )
       SELECT convert_from(returned.k, 'UTF8') AS k,
              returned.status,
@@ -4584,8 +4693,31 @@ export async function failRuntimeWorkReceipt(
 	                    lease_owner_attempt,
 	                    lease_expires_at,
 	                    updated_at
+	        ),
+	        replay AS (
+	          SELECT convert_from(k, 'UTF8') AS k,
+	                 status,
+	                 output,
+	                 error,
+	                 failure_kind,
+	                 run_id,
+	                 lease_id,
+	                 lease_owner_run_id,
+	                 lease_owner_attempt,
+	                 lease_expires_at,
+	                 updated_at
+	            FROM ${workReceiptTable(session)}
+	           WHERE k = decode($1, 'hex')
+	             AND NOT EXISTS (SELECT 1 FROM failed)
+	             AND ${workReceiptTerminalReplayPredicateSql({
+                 receiptTable: workReceiptTable(session),
+                 terminalStatusSql: '$2',
+                 ownerRunIdSql: '$4',
+               })}
 	        )
 	        SELECT k, status, output, error, failure_kind, run_id, lease_id, lease_owner_run_id, lease_owner_attempt, lease_expires_at, updated_at FROM failed
+	        UNION ALL
+	        SELECT k, status, output, error, failure_kind, run_id, lease_id, lease_owner_run_id, lease_owner_attempt, lease_expires_at, updated_at FROM replay
       `,
         [
           workReceiptKeyHex(input.key),
@@ -4749,21 +4881,49 @@ export async function failRuntimeWorkReceipts(
                   target.updated_at,
                   inputs.ord
       ),
+      replay AS (
+        SELECT target.k,
+               target.status,
+               target.output,
+               target.error,
+               target.failure_kind,
+               target.run_id,
+               target.lease_id,
+               target.lease_owner_run_id,
+               target.lease_owner_attempt,
+               target.lease_expires_at,
+               target.updated_at,
+               inputs.ord
+          FROM inputs
+          JOIN ${workReceiptTable(session)} AS target
+            ON target.k = decode(inputs.key_hex, 'hex')
+         WHERE NOT EXISTS (SELECT 1 FROM failed WHERE failed.ord = inputs.ord)
+           AND ${workReceiptTerminalReplayPredicateSql({
+             receiptTable: 'target',
+             terminalStatusSql: '$7',
+             ownerRunIdSql: 'inputs.run_id',
+           })}
+      ),
+      resolved AS (
+        SELECT ord, k, status, output, error, failure_kind, run_id, lease_id, lease_owner_run_id, lease_owner_attempt, lease_expires_at, updated_at FROM failed
+        UNION ALL
+        SELECT ord, k, status, output, error, failure_kind, run_id, lease_id, lease_owner_run_id, lease_owner_attempt, lease_expires_at, updated_at FROM replay
+      ),
       returned AS (
-        SELECT failed.k,
-               failed.status,
-	               failed.output,
-	               failed.error,
-	               failed.failure_kind,
-	               failed.run_id,
-               failed.lease_id,
-               failed.lease_owner_run_id,
-               failed.lease_owner_attempt,
-               failed.lease_expires_at,
-               failed.updated_at,
+        SELECT resolved.k,
+               resolved.status,
+	               resolved.output,
+	               resolved.error,
+	               resolved.failure_kind,
+	               resolved.run_id,
+               resolved.lease_id,
+               resolved.lease_owner_run_id,
+               resolved.lease_owner_attempt,
+               resolved.lease_expires_at,
+               resolved.updated_at,
                inputs.ord
           FROM inputs
-          LEFT JOIN failed ON failed.ord = inputs.ord
+          LEFT JOIN resolved ON resolved.ord = inputs.ord
       )
       SELECT convert_from(returned.k, 'UTF8') AS k,
              returned.status,
@@ -4992,6 +5152,12 @@ export async function startRuntimeSheetDataset(
     force?: boolean;
   },
 ): Promise<PrepareRuntimeSheetResult> {
+  if (context.dbSessionStrategy === 'gateway_only') {
+    return await postRuntimeApi<PrepareRuntimeSheetResult>(context, {
+      action: 'runtime_sheet_start',
+      input,
+    });
+  }
   const totalStartedAt = Date.now();
   const timings: RuntimeSheetTiming[] = [];
   const playName = context.playName?.trim() || input.playName;
@@ -5383,6 +5549,12 @@ export async function releaseRuntimeSheetAttempt(
     attemptSeq?: number | null;
   },
 ): Promise<RuntimeSheetAttemptReleaseResult> {
+  if (context.dbSessionStrategy === 'gateway_only') {
+    return await postRuntimeApi<RuntimeSheetAttemptReleaseResult>(context, {
+      action: 'runtime_sheet_release_attempt',
+      input,
+    });
+  }
   const playName = context.playName?.trim() || input.playName;
   if (!playName) {
     throw new Error('Runtime sheet attempt release requires a playName.');
@@ -5471,6 +5643,12 @@ export async function releaseRuntimeWorkReceipts(
     runAttempt?: number | null;
   },
 ): Promise<RuntimeWorkReceiptReleaseResult> {
+  if (context.dbSessionStrategy === 'gateway_only') {
+    return await postRuntimeApi<RuntimeWorkReceiptReleaseResult>(context, {
+      action: 'runtime_receipts_release_attempt',
+      input,
+    });
+  }
   const runId = input.runId.trim();
   if (!runId) {
     return { released: 0, releasedKeys: [] };
@@ -5523,7 +5701,7 @@ type CompleteRuntimeMapRowChunksInput = {
   outputFields: string[];
 };
 
-type RuntimeMapRowsWriteResult = {
+export type RuntimeMapRowsWriteResult = {
   updated: number;
   fencedKeys: string[];
 };
@@ -6444,6 +6622,12 @@ export async function completeRuntimeMapRows(
     forceFailedRows?: boolean;
   },
 ): Promise<RuntimeMapRowsWriteResult> {
+  if (context.dbSessionStrategy === 'gateway_only') {
+    return await postRuntimeApi<RuntimeMapRowsWriteResult>(context, {
+      action: 'runtime_sheet_complete_map_rows',
+      input,
+    });
+  }
   if (input.rows.length === 0) {
     return { updated: 0, fencedKeys: [] };
   }
@@ -6598,6 +6782,12 @@ export async function readRuntimeSheetDatasetRows(
     offset: number;
   },
 ): Promise<{ rows: Record<string, unknown>[]; limit: number; offset: number }> {
+  if (context.dbSessionStrategy === 'gateway_only') {
+    return await postRuntimeApi(context, {
+      action: 'runtime_sheet_read_rows',
+      input,
+    });
+  }
   const limit = Math.max(
     1,
     Math.min(DIRECT_POSTGRES_BATCH_SIZE, Math.floor(input.limit)),
@@ -6640,6 +6830,12 @@ export async function readRuntimeSheetDatasetRowKeys(
     rowMode?: 'output' | 'all' | 'terminalAnyRun';
   },
 ): Promise<{ keys: string[] }> {
+  if (context.dbSessionStrategy === 'gateway_only') {
+    return await postRuntimeApi(context, {
+      action: 'runtime_sheet_read_row_keys',
+      input,
+    });
+  }
   const keys = [
     ...new Set(
       input.keys.map((key) => key.trim()).filter((key) => key.length > 0),

package/dist/bundling-sources/shared_libs/play-runtime/runtime-scheduler-topology.ts

@@ -0,0 +1,26 @@
+/**
+ * Runtime-scheduler topology predicate shared by the app-side lane helpers
+ * (`src/lib/plays/scheduler-backends/absurd-shared.ts`) and the runner
+ * backends (`runner-backends/backends/daytona-lifecycle.ts`).
+ *
+ * ONE distinction drives several guards: a run whose scheduler schema is the
+ * prod default rides the production topology (base queue names, customer code,
+ * production egress policy), while any other schema is an ISOLATED topology —
+ * a per-PR preview fleet or a per-worktree dev fleet running synthetic
+ * internal test plays. Keeping the predicate here (dependency-free) lets
+ * shared_libs code use it without importing the app-side scheduler stack.
+ */
+export const PROD_DEFAULT_RUNTIME_SCHEDULER_SCHEMA = 'runtime_scheduler';
+
+/**
+ * True when the scheduler schema names an isolated (preview CI / worktree)
+ * topology. Null/empty/prod-default => false (production topology). Callers
+ * that gate SECURITY policy on this must treat `false` as the fail-closed
+ * production posture — an absent schema is production, never "unknown".
+ */
+export function isIsolatedRuntimeSchedulerSchema(
+  schedulerSchema: string | null | undefined,
+): boolean {
+  const schema = schedulerSchema?.trim();
+  return Boolean(schema) && schema !== PROD_DEFAULT_RUNTIME_SCHEDULER_SCHEMA;
+}