deepline 0.1.79 → 0.1.80

package/dist/repo/apps/play-runner-workers/src/entry.ts

@@ -44,6 +44,22 @@ import {
   type ChunkExecutionResult,
 } from '../../../shared_libs/play-runtime/batch-runtime';
 import { getDefaultPlayRuntimeBatchStrategy } from '../../../shared_libs/play-runtime/default-batch-strategies';
+import { STANDARD_PLAY_RUNTIME_LIMIT_SECONDS } from '../../../shared_libs/temporal/constants';
+import {
+  createPlayExecutionGovernor,
+  type GovernanceSnapshot,
+  type PlayExecutionGovernor,
+} from '../../../shared_libs/play-runtime/governor/governor';
+import {
+  CoordinatorRateStateBackend,
+  type CoordinatorRatePort,
+} from '../../../shared_libs/play-runtime/governor/coordinator-rate-state-backend';
+import type { PacingRule } from '../../../shared_libs/play-runtime/governor/rate-state-backend';
+import {
+  awaitChildTerminal,
+  type ChildPlayTerminalWaitResult,
+  type WorkflowStepLike,
+} from './child-play-await';
 import type { AnyBatchOperationStrategy } from '../../../shared_libs/play-runtime/batching-types';
 import {
   createToolBatchExecutor,
@@ -201,6 +217,8 @@ type RunRequest = {
   /** Internal ctx.runPlay lineage. Public SDK/users never see this. */
   playCallGovernance?: PlayCallGovernanceSnapshot | null;
   preloadedDbSessions?: PreloadedRuntimeDbSession[] | null;
+  /** Coordinator already created the child run row before invoking /run-inline. */
+  inlineChildRunRegistered?: boolean | null;
   /** Cloudflare coordinator URL for direct Workflow control-plane signals. */
   coordinatorUrl?: string | null;
   /** Request-scoped coordinator auth token for preview/dev direct control calls. */
@@ -253,11 +271,21 @@ type WorkerEnv = {
    * `/api/v2/plays/runtime-tools/*`) skip the public callback URL and route
    * directly through the coordinator's process to the configured app — saves
    * the *.workers.dev → CF edge → cloudflared → localhost chain on every
-   * runtime callback. Absent on legacy coordinator deploys; the fetch
-   * helpers fall back to `globalThis.fetch(req.baseUrl + path)`.
+   * runtime callback. Required for workers_edge; missing binding is an infra
+   * error instead of a transport fallback.
    */
   RUNTIME_API?: {
-    fetch(input: Request): Promise<Response>;
+    runtimeApiCall(input: {
+      executorToken: string;
+      path: string;
+      body: unknown;
+      headers?: Record<string, string>;
+      timeoutMs?: number;
+    }): Promise<{
+      status: number;
+      headers?: Record<string, string>;
+      body: string;
+    }>;
   };
   /**
    * Loopback RPC binding into the coordinator Worker. Used for CF-to-CF
@@ -280,6 +308,20 @@ type WorkerEnv = {
       logs?: string[];
       timings?: Array<{ phase: string; ms: number }>;
     }>;
+    submitWorkflowChild?(
+      parentRunId: string,
+      body: Record<string, unknown>,
+    ): Promise<{
+      workflowId?: string;
+      runId?: string;
+      status?: string;
+      mode?: string;
+      output?: unknown;
+      result?: unknown;
+      error?: unknown;
+      logs?: string[];
+      timings?: Array<{ phase: string; ms: number }>;
+    }>;
     signal(
       runId: string,
       body: Record<string, unknown>,
@@ -292,6 +334,26 @@ type WorkerEnv = {
       runId: string,
       event: Record<string, unknown>,
     ): Promise<void>;
+    readTerminalState?(runId: string): Promise<Record<string, unknown> | null>;
+    readChildTerminalState?(
+      parentRunId: string,
+      eventKey: string,
+      timeoutMs?: number,
+    ): Promise<Record<string, unknown> | null>;
+    /**
+     * Distributed Rate State Backend RPC. Routes to the per-(org,provider)
+     * rate-bucket Durable Object so the request window is global across
+     * isolates. See CoordinatorRateStateBackend + dedup-do.ts.
+     */
+    rateAcquire?(input: {
+      bucketId: string;
+      rules: PacingRule[];
+      requested: number;
+    }): Promise<{ granted: number; waitMs: number }>;
+    ratePenalize?(input: {
+      bucketId: string;
+      cooldownMs: number;
+    }): Promise<void>;
   };
   /**
    * Required service binding to the long-lived Play Harness Worker
@@ -379,10 +441,9 @@ async function probeHarnessOnce(
   }
 }
 /**
- * Routes runtime API requests through the in-process RUNTIME_API binding when
- * Cloudflare exposes the coordinator WorkerEntrypoint export. Some workflow
- * execution paths do not expose those exports; there we keep the older public
- * fetch transport so the play still reaches the same authenticated handler.
+ * Routes runtime API requests through the in-process RUNTIME_API service
+ * binding. workers_edge treats a missing binding as infrastructure failure
+ * instead of falling back to public HTTP.
  */
 const RUNTIME_API_TIMEOUT_MS = 30_000;
 const RUNTIME_API_PLAY_RUN_TIMEOUT_MS = 75_000;
@@ -390,7 +451,6 @@ const RUNTIME_API_INTEGRATION_EXECUTE_TIMEOUT_MS = 180_000;
 const RUNTIME_API_RETRY_DELAYS_MS = [
   250, 750, 1500, 3000, 5000, 10000,
 ] as const;
-let loggedMissingRuntimeApiBinding = false;
 
 async function fetchRuntimeApi(
   baseUrl: string,
@@ -418,37 +478,25 @@ async function fetchRuntimeApi(
   try {
     const mergedInit: RequestInit = {
       ...init,
-      headers: runtimeApiHeaders(init.headers, cachedRuntimeApiBinding == null),
+      headers: runtimeApiHeaders(init.headers, false),
       signal: controller.signal,
     };
     if (!cachedRuntimeApiBinding) {
-      if (!loggedMissingRuntimeApiBinding) {
-        loggedMissingRuntimeApiBinding = true;
-        console.warn(
-          `[play-harness] RUNTIME_API binding missing; using public runtime API transport. path=${path}`,
-        );
-      }
-      return await Promise.race([
-        fetch(`${baseUrl.replace(/\/$/, '')}${path}`, mergedInit),
-        timeoutPromise,
-      ]);
+      throw new Error('[play-harness] RUNTIME_API service binding is required');
     }
-    const responsePromise = cachedRuntimeApiBinding.fetch(
-      new Request(`${baseUrl.replace(/\/$/, '')}${path}`, mergedInit),
+    const responsePromise = callRuntimeApiRpcBinding(
+      cachedRuntimeApiBinding,
+      mergedInit,
+      {
+        path,
+        timeoutMs,
+      },
     );
     const response = await Promise.race([responsePromise, timeoutPromise]);
-    if (await shouldFallbackRuntimeApiBindingResponse(response)) {
-      console.warn(
-        `[play-harness] RUNTIME_API binding returned coordinator not found; using public runtime API transport. path=${path}`,
+    if (await isRuntimeApiBindingNotFoundResponse(response)) {
+      throw new Error(
+        `[play-harness] RUNTIME_API service binding could not route ${path}; coordinator returned not found.`,
       );
-      return await Promise.race([
-        fetch(`${baseUrl.replace(/\/$/, '')}${path}`, {
-          ...init,
-          headers: runtimeApiHeaders(init.headers, true),
-          signal: controller.signal,
-        }),
-        timeoutPromise,
-      ]);
     }
     return response;
   } catch (err) {
@@ -463,7 +511,33 @@ async function fetchRuntimeApi(
   }
 }
 
-async function shouldFallbackRuntimeApiBindingResponse(
+async function callRuntimeApiRpcBinding(
+  binding: NonNullable<WorkerEnv['RUNTIME_API']>,
+  init: RequestInit,
+  input: { path: string; timeoutMs: number },
+): Promise<Response> {
+  const h = new Headers(init.headers);
+  const authorization = h.get('authorization') ?? '';
+  const headers: Record<string, string> = {};
+  const metadata = h.get(EXECUTE_TOOL_METADATA_HEADER);
+  if (metadata) headers[EXECUTE_TOOL_METADATA_HEADER] = metadata;
+  const contract = h.get(EXECUTE_RESPONSE_CONTRACT_HEADER);
+  if (contract) headers[EXECUTE_RESPONSE_CONTRACT_HEADER] = contract;
+  const rawBody = typeof init.body === 'string' ? init.body : '';
+  const result = await binding.runtimeApiCall({
+    executorToken: authorization.replace(/^Bearer\s+/i, '').trim(),
+    path: input.path,
+    body: rawBody ? JSON.parse(rawBody) : {},
+    headers,
+    timeoutMs: input.timeoutMs,
+  });
+  return new Response(result.body, {
+    status: result.status,
+    headers: result.headers ?? {},
+  });
+}
+
+async function isRuntimeApiBindingNotFoundResponse(
   response: Response,
 ): Promise<boolean> {
   if (response.status !== 404) {
@@ -494,13 +568,6 @@ function cachedVercelProtectionBypassToken(): string | null {
   return cachedRuntimeApiVercelBypassToken;
 }
 
-const WORKER_PLAY_CALL_LIMITS = {
-  maxPlayCallDepth: 6,
-  maxPlayCallCount: 1_000,
-  maxChildPlayCallsPerParent: 1_000,
-  maxConcurrentPlayCalls: 16,
-};
-
 type RunnerEvent =
   | {
       type: 'log';
@@ -520,6 +587,12 @@ type WorkflowRunOutput = {
   durationMs: number;
 };
 
+type InlineRunTiming = {
+  phase: string;
+  ms: number;
+  extra?: Record<string, unknown>;
+};
+
 type WorkerCtxCallbacks = {
   onNodeProgress?: (input: {
     nodeId: string;
@@ -658,9 +731,8 @@ async function postRuntimeApi<T>(
   executorToken: string,
   body: unknown,
 ): Promise<T> {
-  // Routes through the in-process RUNTIME_API binding when present; otherwise
-  // falls back to a public fetch against `${baseUrl}${path}`. Either path
-  // hits the same handler with the same auth — only the transport changes.
+  // Routes through the in-process RUNTIME_API service binding. Missing binding
+  // is an infra error in workers_edge, not a reason to fall back to public HTTP.
   const serializedBody = JSON.stringify(body);
   let lastError: unknown = null;
   for (
@@ -797,6 +869,15 @@ async function submitChildPlayThroughCoordinator(input: {
     }
     return cachedCoordinatorBinding.submitChild(input.req.runId, input.body);
   }
+  if (cachedCoordinatorBinding?.submitWorkflowChild) {
+    if (!isRecord(input.body)) {
+      throw new Error('ctx.runPlay child submit requires an object body.');
+    }
+    return cachedCoordinatorBinding.submitWorkflowChild(
+      input.req.runId,
+      input.body,
+    );
+  }
   const coordinatorUrl = input.req.coordinatorUrl?.trim();
   if (coordinatorUrl) {
     // Keep child plays on the same coordinator/Workflow submit path as
@@ -924,46 +1005,6 @@ function workflowTimeoutFromMs(timeoutMs: number): string {
   return `${seconds} second${seconds === 1 ? '' : 's'}`;
 }
 
-async function waitForChildPlayTerminalEvent(input: {
-  req: RunRequest;
-  workflowStep?: WorkflowStep;
-  workflowId: string;
-  playName: string;
-  key: string;
-  timeoutMs: number;
-}): Promise<unknown> {
-  if (!input.workflowStep) {
-    throw new Error(
-      'ctx.runPlay child waits require the cf-workflows runtime event scheduler.',
-    );
-  }
-  const eventKey = await childPlayEventKey({
-    key: input.key,
-    workflowId: input.workflowId,
-  });
-  const event = (await (
-    input.workflowStep.waitForEvent as unknown as (
-      name: string,
-      options: { type: string; timeout: string },
-    ) => Promise<{ payload: unknown }>
-  )(`child_play_terminal:${eventKey}`, {
-    type: integrationEventType(eventKey),
-    timeout: workflowTimeoutFromMs(input.timeoutMs),
-  })) as { payload: unknown };
-  const rawPayload = isRecord(event.payload) ? event.payload : {};
-  const payload = isRecord(rawPayload.data) ? rawPayload.data : rawPayload;
-  const status = String(payload.status ?? '').toLowerCase();
-  if (status === 'completed') {
-    return extractChildPlayOutput(payload);
-  }
-  const error = isRecord(payload.error) ? payload.error : null;
-  const message =
-    (typeof error?.message === 'string' && error.message.trim()) ||
-    (typeof payload.error === 'string' && payload.error.trim()) ||
-    `Child play ${input.playName} (${input.workflowId}) finished with status ${status || 'unknown'}.`;
-  throw new Error(message);
-}
-
 async function signalParentPlayTerminal(input: {
   req: RunRequest;
   status: 'completed' | 'failed' | 'cancelled';
@@ -1045,6 +1086,8 @@ async function executeTool(
   req: RunRequest,
   args: { id: string; toolId: string; input: Record<string, unknown> },
   workflowStep?: WorkflowStep,
+  onProviderBackpressure?: (retryAfterMs: number) => void,
+  onRetryAttempt?: () => void,
 ): Promise<ToolExecuteResult> {
   if (args.toolId === 'test_wait_for_event' && workflowStep) {
     const result = await waitForSyntheticIntegrationEvent(
@@ -1059,7 +1102,7 @@ async function executeTool(
   // service bindings, NOT through HTTP from this worker. Removing the
   // dispatcher-side coordinatorUrl plumbing intentionally turns the old
   // HTTP-based dedup helpers into dead code.
-  return callToolDirect(req, args);
+  return callToolDirect(req, args, onProviderBackpressure, onRetryAttempt);
 }
 
 async function executeToolWithLifecycle(
@@ -1193,6 +1236,13 @@ async function waitForSyntheticIntegrationEvent(
 async function callToolDirect(
   req: RunRequest,
   args: { id: string; toolId: string; input: Record<string, unknown> },
+  onProviderBackpressure?: (retryAfterMs: number) => void,
+  // Invoked once per in-process retry attempt (429 / retryable 5xx / synthetic
+  // transient) so the Governor charges chargeBudget('retry') per attempt — the
+  // same runaway guard the cjs runner applies (context.ts charges retry on each
+  // 429 / transient-5xx retry). Without this the worker substrate would leave
+  // policy.budgets.maxRetryCount effectively unenforced.
+  onRetryAttempt?: () => void,
 ): Promise<ToolExecuteResult> {
   const { id, toolId, input } = args;
   if (toolId === 'test_rate_limit') {
@@ -1233,6 +1283,8 @@ async function callToolDirect(
       if (attempt >= maxAttempts) {
         throw lastError;
       }
+      // Charge the retry budget per attempt, matching the cjs runner.
+      onRetryAttempt?.();
       await new Promise((resolve) => setTimeout(resolve, 1_000));
       continue;
     }
@@ -1273,17 +1325,26 @@ async function callToolDirect(
       maxAttempts,
       bodyText: text,
     });
+    const retryAfterSeconds = Number(res.headers.get('retry-after'));
+    const retryAfterMs =
+      Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0
+        ? Math.ceil(retryAfterSeconds * 1000)
+        : 0;
+    if (res.status === 429) {
+      // Feed the provider's backpressure into the shared pacer even on the
+      // final attempt so the (org, provider) bucket backs off across isolates.
+      onProviderBackpressure?.(retryAfterMs > 0 ? retryAfterMs : 1_000);
+    }
     const retryable =
       (res.status === 429 && !isHardBillingToolHttpError(lastError)) ||
       (res.status >= 500 && WORKER_RETRY_SAFE_5XX_TOOLS.has(toolId));
     if (!retryable || attempt >= maxAttempts) {
       throw lastError;
     }
-    const retryAfterSeconds = Number(res.headers.get('retry-after'));
-    const delayMs =
-      Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0
-        ? Math.min(5_000, Math.ceil(retryAfterSeconds * 1000))
-        : 1_000;
+    // Charge the retry budget per attempt, matching the cjs runner's
+    // chargeBudget('retry') on every 429 / retryable-5xx retry.
+    onRetryAttempt?.();
+    const delayMs = retryAfterMs > 0 ? Math.min(5_000, retryAfterMs) : 1_000;
     await new Promise((resolve) => setTimeout(resolve, delayMs));
   }
 
@@ -1731,6 +1792,11 @@ type WorkerToolBatchRequest = {
 };
 
 const WORKER_TOOL_BATCH_GRACE_MS = 15;
+// Fallback batch-chunk parallelism when a tool declares no provider rate hints.
+// Matches the prior hardcoded `Math.min(4, ...)` so undeclared providers keep
+// their previous batching behavior; declared providers tighten via the
+// Governor's suggestedParallelism.
+const WORKER_TOOL_BATCH_DEFAULT_PARALLELISM = 4;
 const WORKER_RETRY_SAFE_5XX_TOOLS = new Set(['test_transient_500']);
 
 function stepProgramColumnName(parentField: string, stepId: string): string {
@@ -1741,7 +1807,31 @@ class WorkerToolBatchScheduler {
   private queue: WorkerToolBatchRequest[] = [];
   private scheduled = false;
 
-  constructor(private readonly req: RunRequest) {}
+  constructor(
+    private readonly req: RunRequest,
+    private readonly governor: PlayExecutionGovernor,
+    private readonly resolvePacing: WorkerPacingResolver,
+    private readonly abortSignal?: AbortSignal,
+  ) {}
+
+  /**
+   * Report a provider 429 / Retry-After back into the Governor's shared pacer
+   * so future acquires for this (org, provider) bucket back off across all
+   * isolates. Provider comes from the same pacing resolver the Governor uses
+   * (the worker has no local catalog), so callers pass only the toolId.
+   */
+  private reportBackpressure(toolId: string, retryAfterMs: number): void {
+    if (retryAfterMs <= 0) return;
+    void (async () => {
+      const pacing = await this.resolvePacing(toolId).catch(() => null);
+      if (pacing?.provider) {
+        this.governor.reportProviderBackpressure({
+          provider: pacing.provider,
+          retryAfterMs,
+        });
+      }
+    })();
+  }
 
   execute(
     id: string,
@@ -1824,16 +1914,26 @@ class WorkerToolBatchScheduler {
       const groupStartedAt = nowMs();
       await Promise.all(
         requests.map(async (request) => {
+          // Each unbatched provider call takes its own tool slot: the Governor
+          // charges tool budget, holds a global tool-concurrency slot, and
+          // applies per-(org,provider) pacing before the call runs.
+          const slot = await this.governor.acquireToolSlot(toolId, {
+            signal: this.abortSignal,
+          });
           try {
             request.resolve(
               await executeTool(
                 this.req,
                 { id: request.id, toolId, input: request.input },
                 request.workflowStep,
+                (retryAfterMs) => this.reportBackpressure(toolId, retryAfterMs),
+                () => this.governor.chargeBudget('retry'),
               ),
             );
           } catch (error) {
             request.reject(error);
+          } finally {
+            slot.release();
           }
         }),
       );
@@ -1851,6 +1951,14 @@ class WorkerToolBatchScheduler {
       req: this.req,
       requests,
       strategy,
+      governor: this.governor,
+      suggestedParallelism: await this.governor.suggestedParallelism(
+        toolId,
+        WORKER_TOOL_BATCH_DEFAULT_PARALLELISM,
+      ),
+      abortSignal: this.abortSignal,
+      reportBackpressure: (retryAfterMs) =>
+        this.reportBackpressure(toolId, retryAfterMs),
     });
     recordRunnerPerfTrace({
       req: this.req,
@@ -1880,6 +1988,10 @@ async function executeBatchedWorkerToolGroup(input: {
   req: RunRequest;
   requests: WorkerToolBatchRequest[];
   strategy: AnyBatchOperationStrategy;
+  governor: PlayExecutionGovernor;
+  suggestedParallelism: number;
+  abortSignal?: AbortSignal;
+  reportBackpressure: (retryAfterMs: number) => void;
 }): Promise<void> {
   const compiledBatches = compileRequestsWithStrategy({
     requests: input.requests,
@@ -1889,13 +2001,34 @@ async function executeBatchedWorkerToolGroup(input: {
 
   await executeChunkedRequests({
     requests: compiledBatches,
-    batchSize: Math.max(1, Math.min(4, compiledBatches.length || 1)),
-    execute: async (batch) =>
-      await executeTool(input.req, {
-        id: `batch:${batch.memberRequests.map((request) => request.id).join('|')}`,
-        toolId: batch.batchOperation,
-        input: batch.batchPayload,
-      }),
+    // Chunk parallelism is the Governor's per-tool suggestion (provider rate
+    // hints tightened to the policy ceiling), bounded by the batch count.
+    batchSize: Math.max(
+      1,
+      Math.min(input.suggestedParallelism, compiledBatches.length || 1),
+    ),
+    execute: async (batch) => {
+      // One provider call per batch → one tool slot (budget + global
+      // concurrency + per-(org,provider) pacing) around the whole batch.
+      const slot = await input.governor.acquireToolSlot(batch.batchOperation, {
+        signal: input.abortSignal,
+      });
+      try {
+        return await executeTool(
+          input.req,
+          {
+            id: `batch:${batch.memberRequests.map((request) => request.id).join('|')}`,
+            toolId: batch.batchOperation,
+            input: batch.batchPayload,
+          },
+          undefined,
+          input.reportBackpressure,
+          () => input.governor.chargeBudget('retry'),
+        );
+      } finally {
+        slot.release();
+      }
+    },
     onChunkComplete: async (
       chunkResults: Array<
         ChunkExecutionResult<(typeof compiledBatches)[number], unknown>
@@ -3164,9 +3297,23 @@ function assertNotAborted(signal: AbortSignal | undefined): void {
 function childPipelineUsesCtxDataset(
   pipeline: PlayStaticPipeline | null | undefined,
 ): boolean {
-  return getCompiledPipelineSubsteps(pipeline).some(
-    (substep) => substep.type === 'dataset',
-  );
+  if (!pipeline) return false;
+  if (typeof pipeline.tableNamespace === 'string' && pipeline.tableNamespace) {
+    return true;
+  }
+  if (pipeline.sheetContract) {
+    return true;
+  }
+  return flattenStaticPipeline(pipeline).some((substep) => {
+    if (substep.type === 'dataset') return true;
+    if (!isRecord(substep)) return false;
+    return (
+      ('tableNamespace' in substep &&
+        typeof substep.tableNamespace === 'string' &&
+        substep.tableNamespace.length > 0) ||
+      ('sheetContract' in substep && Boolean(substep.sheetContract))
+    );
+  });
 }
 
 function childPipelineNeedsWorkflowScheduler(
@@ -3181,16 +3328,160 @@ function childPipelineNeedsWorkflowScheduler(
   );
 }
 
-function releaseChildPlayConcurrency(
-  inFlightByPlayName: Record<string, number>,
-  playName: string,
-): void {
-  const next = Math.max(0, (inFlightByPlayName[playName] ?? 0) - 1);
-  if (next === 0) {
-    delete inFlightByPlayName[playName];
-    return;
-  }
-  inFlightByPlayName[playName] = next;
+/**
+ * Build the per-(org,provider) rate port the distributed Rate State Backend
+ * RPCs through. When the coordinator binding (or its rate RPCs) is absent we
+ * fail OPEN — grant immediately — matching customer-rate-limiter semantics so a
+ * miswired binding degrades pacing without stalling the run.
+ */
+function createCoordinatorRatePort(): CoordinatorRatePort {
+  return {
+    async rateAcquire(input) {
+      const binding = cachedCoordinatorBinding;
+      if (!binding?.rateAcquire) {
+        return { granted: input.requested, waitMs: 0 };
+      }
+      return await binding.rateAcquire(input);
+    },
+    async ratePenalize(input) {
+      const binding = cachedCoordinatorBinding;
+      if (!binding?.ratePenalize) return;
+      await binding.ratePenalize(input);
+    },
+  };
+}
+
+/**
+ * Resolve a tool's provider + pacing rules from the same runtime tool-metadata
+ * endpoint the cjs_node20 runner uses (`getToolQueueHints`). The worker has no
+ * local catalog, so this is an HTTP fetch through the runtime API binding,
+ * memoized per isolate. No hints → null (pacing is a no-op; the Governor's
+ * global tool-concurrency slot still applies).
+ */
+type WorkerPacingResolver = (
+  toolId: string,
+) => Promise<{ provider: string; rules: PacingRule[] } | null>;
+
+function createWorkerPacingResolver(req: RunRequest): WorkerPacingResolver {
+  const cache = new Map<
+    string,
+    Promise<{ provider: string; rules: PacingRule[] } | null>
+  >();
+  return (toolId: string) => {
+    const normalized = String(toolId || '').trim();
+    if (!normalized) return Promise.resolve(null);
+    const cached = cache.get(normalized);
+    if (cached) return cached;
+    const promise = (async () => {
+      const res = await fetchRuntimeApi(
+        req.baseUrl,
+        `/api/v2/plays/runtime-tools/${encodeURIComponent(normalized)}`,
+        {
+          method: 'GET',
+          headers: { authorization: `Bearer ${req.executorToken}` },
+        },
+      ).catch(() => null);
+      if (!res || !res.ok) return null;
+      const body = (await res.json().catch(() => null)) as {
+        provider?: unknown;
+        queueHints?: unknown;
+      } | null;
+      if (!body) return null;
+      const provider =
+        typeof body.provider === 'string' && body.provider.trim()
+          ? body.provider.trim()
+          : null;
+      if (!provider || !Array.isArray(body.queueHints)) return null;
+      const rules: PacingRule[] = body.queueHints.flatMap((hint) => {
+        if (!hint || typeof hint !== 'object') return [];
+        const record = hint as Record<string, unknown>;
+        if (
+          typeof record.ruleId !== 'string' ||
+          typeof record.requestsPerWindow !== 'number' ||
+          typeof record.windowMs !== 'number'
+        ) {
+          return [];
+        }
+        return [
+          {
+            ruleId: record.ruleId,
+            requestsPerWindow: record.requestsPerWindow,
+            windowMs: record.windowMs,
+            maxConcurrency:
+              typeof record.maxConcurrency === 'number'
+                ? record.maxConcurrency
+                : null,
+          } satisfies PacingRule,
+        ];
+      });
+      if (rules.length === 0) return null;
+      return { provider, rules };
+    })();
+    cache.set(normalized, promise);
+    return promise;
+  };
+}
+
+/**
+ * Build the Governor's lineage snapshot for this worker, seeded from the
+ * inherited PlayCallGovernanceSnapshot (threaded via internalRunPlay) so play-
+ * call budgets accumulate down the dispatch tree across isolates. The current
+ * play id is always `req.playName` so the per-parent child-call counter keys off
+ * the executing play (matching the prior worker behavior). Per-run counters the
+ * worker lineage does not carry (tool/retry/descendant/waterfall) seed at 0 —
+ * these are runaway guards, not exact cross-isolate ledgers, so a per-worker
+ * reset is acceptable and matches the Governor contract.
+ */
+function resumeGovernanceFromRequest(req: RunRequest): GovernanceSnapshot {
+  const inherited = req.playCallGovernance;
+  const rootRunId = inherited?.rootRunId || req.runId;
+  const ancestryPlayIds = inherited?.ancestryPlayIds?.length
+    ? // Per the lineage validator the inherited tail equals the parent; ensure
+      // the chain ends with the currently-executing play for the cycle guard.
+      inherited.ancestryPlayIds[inherited.ancestryPlayIds.length - 1] ===
+      req.playName
+      ? [...inherited.ancestryPlayIds]
+      : [...inherited.ancestryPlayIds, req.playName]
+    : [req.playName];
+  const ancestryRunIds =
+    rootRunId === req.runId ? [req.runId] : [rootRunId, req.runId];
+  return {
+    rootRunId,
+    currentRunId: req.runId,
+    currentPlayId: req.playName,
+    ancestryPlayIds,
+    ancestryRunIds,
+    callDepth: inherited?.callDepth ?? 0,
+    // Seed every lineage-global budget counter from the inherited snapshot so
+    // descendant/tool/retry/waterfall budgets accumulate across isolates exactly
+    // as they do across the cjs forkChild lineage. Without this they would reset
+    // to 0 in each isolate and become per-worker — contradicting the Governor's
+    // lineage-global budget contract. Fail-safe to 0 for older callers.
+    playCallCount: inherited?.playCallCount ?? 0,
+    toolCallCount: inherited?.toolCallCount ?? 0,
+    retryCount: inherited?.retryCount ?? 0,
+    descendantCount: inherited?.descendantCount ?? 0,
+    waterfallStepExecutions: inherited?.waterfallStepExecutions ?? 0,
+    parentChildCalls: {},
+  };
+}
+
+function createGovernorForRun(req: RunRequest): {
+  governor: PlayExecutionGovernor;
+  resolvePacing: WorkerPacingResolver;
+} {
+  const resolvePacing = createWorkerPacingResolver(req);
+  const governor = createPlayExecutionGovernor({
+    adapter: 'esm_workers',
+    scope: {
+      orgId: req.orgId,
+      rootRunId: req.playCallGovernance?.rootRunId ?? req.runId,
+    },
+    rateState: new CoordinatorRateStateBackend(createCoordinatorRatePort()),
+    resolvePacing,
+    resume: resumeGovernanceFromRequest(req),
+  });
+  return { governor, resolvePacing };
 }
 
 function createMinimalWorkerCtx(
@@ -3201,12 +3492,12 @@ function createMinimalWorkerCtx(
   abortSignal?: AbortSignal,
   callbacks?: WorkerCtxCallbacks,
 ): unknown {
-  let playCallCount = 0;
-  const parentChildCalls: Record<string, number> = {};
+  const { governor, resolvePacing: resolveToolPacing } =
+    createGovernorForRun(req);
+  // Play-call depth/count/per-parent budgets, child-play concurrency, and the
+  // lineage snapshot are owned by the Governor (createGovernorForRun above).
+  // The worker keeps only substrate mechanism here.
   const stepCallCounts: Record<string, number> = {};
-  const inFlightChildCallsByPlayName: Record<string, number> = {};
-  let inFlightChildPlayCalls = 0;
-  const childPlaySlotWaiters: Array<() => void> = [];
   const secretRedactor = createSecretRedactionContext();
 
   const resolveSecretAuth = async (auth?: SecretAuth) => {
@@ -3245,38 +3536,6 @@ function createMinimalWorkerCtx(
       : { [auth.header.toLowerCase()]: value };
   };
 
-  const acquireChildPlaySlot = async (): Promise<() => void> => {
-    while (
-      inFlightChildPlayCalls >= WORKER_PLAY_CALL_LIMITS.maxConcurrentPlayCalls
-    ) {
-      await new Promise<void>((resolve, reject) => {
-        const waiter = () => {
-          abortSignal?.removeEventListener('abort', onAbort);
-          resolve();
-        };
-        const onAbort = () => {
-          const index = childPlaySlotWaiters.indexOf(waiter);
-          if (index >= 0) childPlaySlotWaiters.splice(index, 1);
-          reject(
-            abortSignal?.reason instanceof Error
-              ? abortSignal.reason
-              : new WorkflowAbortError(),
-          );
-        };
-        childPlaySlotWaiters.push(waiter);
-        abortSignal?.addEventListener('abort', onAbort, { once: true });
-      });
-      assertNotAborted(abortSignal);
-    }
-    inFlightChildPlayCalls += 1;
-    let released = false;
-    return () => {
-      if (released) return;
-      released = true;
-      inFlightChildPlayCalls = Math.max(0, inFlightChildPlayCalls - 1);
-      childPlaySlotWaiters.shift()?.();
-    };
-  };
   const rootGovernance = req.playCallGovernance;
   const rootRunId = rootGovernance?.rootRunId ?? req.runId;
   const receiptStore = createHarnessWorkerReceiptStore({
@@ -3577,7 +3836,12 @@ function createMinimalWorkerCtx(
         0,
         prepared.skipped - missingPreparedRows.length,
       );
-      const concurrency = Math.max(1, Math.min(opts?.concurrency ?? 10, 100));
+      // Row concurrency comes from the Governor: an explicit map concurrency is
+      // clamped to the policy row-max, otherwise the policy default. Each row
+      // body additionally acquires a global row slot (the Governor's rowMax
+      // semaphore) so total in-flight rows across all maps in this isolate stay
+      // bounded even when several maps run at once.
+      const concurrency = governor.resolveRowConcurrency();
       const executedRows: Array<T & Record<string, unknown>> = new Array(
         rowsToExecute.length,
       );
@@ -3594,7 +3858,12 @@ function createMinimalWorkerCtx(
           >
         | undefined
       > = new Array(rowsToExecute.length);
-      const toolBatchScheduler = new WorkerToolBatchScheduler(req);
+      const toolBatchScheduler = new WorkerToolBatchScheduler(
+        req,
+        governor,
+        resolveToolPacing,
+        abortSignal,
+      );
       const generatedOutputFields = new Set<string>();
       let idx = 0;
       const workers: Array<Promise<void>> = [];
@@ -3605,143 +3874,152 @@ function createMinimalWorkerCtx(
               if (abortSignal?.aborted) return;
               const myIndex = idx++;
               if (myIndex >= rowsToExecute.length) return;
-              const entry = uniqueRowsToExecuteEntries[myIndex]!;
-              const row = pendingRowsByKey.has(entry.rowKey)
-                ? ({
-                    ...entry.row,
-                    ...publicCsvInputRow(pendingRowsByKey.get(entry.rowKey)!),
-                  } as T & Record<string, unknown>)
-                : entry.row;
-              const absoluteIndex = entry.absoluteIndex;
-              const enriched: Record<string, unknown> = cloneCsvAliasedRow(row);
-              const fieldOutputs: Record<string, unknown> = {};
-              const cellMetaPatch: Record<
-                string,
-                {
-                  status: 'cached' | 'skipped' | 'completed';
-                  stage?: string | null;
-                  reused?: boolean;
-                  runId?: string;
-                  completedAt?: number;
-                }
-              > = {};
-              const waterfallOutputs: RecordedWaterfallOutput[] = [];
-              const stepProgramOutputs: RecordedStepProgramOutput[] = [];
-              const rowCtx = {
-                ...(ctx as Record<string, unknown>),
-                tools: {
-                  ...((ctx as { tools?: Record<string, unknown> }).tools ?? {}),
-                  execute: async (requestArg: unknown): Promise<unknown> => {
-                    assertNotAborted(abortSignal);
-                    const request = normalizeToolExecuteArgs(requestArg);
-                    return await toolBatchScheduler.execute(
-                      request.id,
-                      request.toolId,
-                      request.input,
-                      workflowStep,
-                    );
+              const rowSlot = await governor.acquireRowSlot({
+                signal: abortSignal,
+              });
+              try {
+                const entry = uniqueRowsToExecuteEntries[myIndex]!;
+                const row = pendingRowsByKey.has(entry.rowKey)
+                  ? ({
+                      ...entry.row,
+                      ...publicCsvInputRow(pendingRowsByKey.get(entry.rowKey)!),
+                    } as T & Record<string, unknown>)
+                  : entry.row;
+                const absoluteIndex = entry.absoluteIndex;
+                const enriched: Record<string, unknown> =
+                  cloneCsvAliasedRow(row);
+                const fieldOutputs: Record<string, unknown> = {};
+                const cellMetaPatch: Record<
+                  string,
+                  {
+                    status: 'cached' | 'skipped' | 'completed';
+                    stage?: string | null;
+                    reused?: boolean;
+                    runId?: string;
+                    completedAt?: number;
+                  }
+                > = {};
+                const waterfallOutputs: RecordedWaterfallOutput[] = [];
+                const stepProgramOutputs: RecordedStepProgramOutput[] = [];
+                const rowCtx = {
+                  ...(ctx as Record<string, unknown>),
+                  tools: {
+                    ...((ctx as { tools?: Record<string, unknown> }).tools ??
+                      {}),
+                    execute: async (requestArg: unknown): Promise<unknown> => {
+                      assertNotAborted(abortSignal);
+                      const request = normalizeToolExecuteArgs(requestArg);
+                      return await toolBatchScheduler.execute(
+                        request.id,
+                        request.toolId,
+                        request.input,
+                        workflowStep,
+                      );
+                    },
                   },
-                },
-                waterfall: (
-                  toolNameOrSpec: string | WorkerInlineWaterfallSpec,
-                  waterfallInput: Record<string, unknown>,
-                  waterfallOpts?: WorkerWaterfallOptions,
-                ) =>
-                  executeWorkerWaterfall(
-                    req,
-                    waterfallOutputs,
-                    toolNameOrSpec,
-                    waterfallInput,
-                    waterfallOpts,
-                    callbacks,
-                    workflowStep,
-                  ),
-              };
-              for (const [key, value] of fieldEntries) {
-                const rawCellMeta =
-                  enriched[DEEPLINE_CELL_META_FIELD] &&
-                  typeof enriched[DEEPLINE_CELL_META_FIELD] === 'object'
-                    ? (
-                        enriched[DEEPLINE_CELL_META_FIELD] as Record<
-                          string,
-                          unknown
-                        >
-                      )[key]
-                    : null;
-                const reuseDecision = shouldRecomputeCell({
-                  hasValue: isCompletedWorkerFieldValue(enriched[key]),
-                  meta:
-                    rawCellMeta && typeof rawCellMeta === 'object'
-                      ? (rawCellMeta as {
-                          status?: string;
-                          completedAt?: number;
-                        })
-                      : null,
-                  policy: cellPolicies?.[key],
-                });
-                if (reuseDecision.action === 'reuse') {
-                  cellMetaPatch[key] = {
-                    status: 'cached',
-                    stage: key,
-                    reused: true,
-                    runId: req.runId,
-                  };
-                  continue;
+                  waterfall: (
+                    toolNameOrSpec: string | WorkerInlineWaterfallSpec,
+                    waterfallInput: Record<string, unknown>,
+                    waterfallOpts?: WorkerWaterfallOptions,
+                  ) =>
+                    executeWorkerWaterfall(
+                      req,
+                      waterfallOutputs,
+                      toolNameOrSpec,
+                      waterfallInput,
+                      waterfallOpts,
+                      callbacks,
+                      workflowStep,
+                    ),
+                };
+                for (const [key, value] of fieldEntries) {
+                  const rawCellMeta =
+                    enriched[DEEPLINE_CELL_META_FIELD] &&
+                    typeof enriched[DEEPLINE_CELL_META_FIELD] === 'object'
+                      ? (
+                          enriched[DEEPLINE_CELL_META_FIELD] as Record<
+                            string,
+                            unknown
+                          >
+                        )[key]
+                      : null;
+                  const reuseDecision = shouldRecomputeCell({
+                    hasValue: isCompletedWorkerFieldValue(enriched[key]),
+                    meta:
+                      rawCellMeta && typeof rawCellMeta === 'object'
+                        ? (rawCellMeta as {
+                            status?: string;
+                            completedAt?: number;
+                          })
+                        : null,
+                    policy: cellPolicies?.[key],
+                  });
+                  if (reuseDecision.action === 'reuse') {
+                    cellMetaPatch[key] = {
+                      status: 'cached',
+                      stage: key,
+                      reused: true,
+                      runId: req.runId,
+                    };
+                    continue;
+                  }
+                  const resolved = await executeWorkerStepResolver(
+                    value,
+                    enriched,
+                    rowCtx,
+                    absoluteIndex,
+                    isWorkerStepProgram(value)
+                      ? {
+                          parentField: key,
+                          path: [],
+                          outputs: stepProgramOutputs,
+                        }
+                      : undefined,
+                  );
+                  enriched[key] = resolved.value;
+                  fieldOutputs[key] = resolved.value;
+                  if (resolved.status === 'skipped') {
+                    cellMetaPatch[key] = {
+                      status: 'skipped',
+                      stage: key,
+                      runId: req.runId,
+                    };
+                  } else {
+                    cellMetaPatch[key] = {
+                      status: 'completed',
+                      stage: key,
+                      runId: req.runId,
+                      completedAt: nowMs(),
+                    };
+                  }
                 }
-                const resolved = await executeWorkerStepResolver(
-                  value,
-                  enriched,
-                  rowCtx,
-                  absoluteIndex,
-                  isWorkerStepProgram(value)
-                    ? {
-                        parentField: key,
-                        path: [],
-                        outputs: stepProgramOutputs,
-                      }
-                    : undefined,
-                );
-                enriched[key] = resolved.value;
-                fieldOutputs[key] = resolved.value;
-                if (resolved.status === 'skipped') {
-                  cellMetaPatch[key] = {
-                    status: 'skipped',
-                    stage: key,
-                    runId: req.runId,
-                  };
-                } else {
-                  cellMetaPatch[key] = {
-                    status: 'completed',
-                    stage: key,
-                    runId: req.runId,
-                    completedAt: nowMs(),
-                  };
+                for (const stepOutput of stepProgramOutputs) {
+                  enriched[stepOutput.columnName] = stepOutput.value;
+                  fieldOutputs[stepOutput.columnName] = stepOutput.value;
+                  generatedOutputFields.add(stepOutput.columnName);
+                  if (stepOutput.status === 'skipped') {
+                    cellMetaPatch[stepOutput.columnName] = {
+                      status: 'skipped',
+                      stage: stepOutput.stepId,
+                      runId: req.runId,
+                    };
+                  }
                 }
-              }
-              for (const stepOutput of stepProgramOutputs) {
-                enriched[stepOutput.columnName] = stepOutput.value;
-                fieldOutputs[stepOutput.columnName] = stepOutput.value;
-                generatedOutputFields.add(stepOutput.columnName);
-                if (stepOutput.status === 'skipped') {
-                  cellMetaPatch[stepOutput.columnName] = {
-                    status: 'skipped',
-                    stage: stepOutput.stepId,
-                    runId: req.runId,
-                  };
+                for (const waterfallOutput of waterfallOutputs) {
+                  const columnName =
+                    `${sqlishIdentifierPart(waterfallOutput.waterfallId)}__` +
+                    sqlishIdentifierPart(waterfallOutput.stepId);
+                  enriched[columnName] = waterfallOutput.value;
+                  generatedOutputFields.add(columnName);
                 }
+                executedCellMetaPatches[myIndex] =
+                  Object.keys(cellMetaPatch).length > 0
+                    ? cellMetaPatch
+                    : undefined;
+                executedRows[myIndex] = enriched as T & Record<string, unknown>;
+              } finally {
+                rowSlot.release();
               }
-              for (const waterfallOutput of waterfallOutputs) {
-                const columnName =
-                  `${sqlishIdentifierPart(waterfallOutput.waterfallId)}__` +
-                  sqlishIdentifierPart(waterfallOutput.stepId);
-                enriched[columnName] = waterfallOutput.value;
-                generatedOutputFields.add(columnName);
-              }
-              executedCellMetaPatches[myIndex] =
-                Object.keys(cellMetaPatch).length > 0
-                  ? cellMetaPatch
-                  : undefined;
-              executedRows[myIndex] = enriched as T & Record<string, unknown>;
             }
           })(),
         );
@@ -4410,33 +4688,20 @@ function createMinimalWorkerCtx(
         childPlayName: resolvedName,
         input,
       })}${staleRuntimeSuffix(options?.staleAfterSeconds)}`;
-      if (ancestryPlayIds.includes(resolvedName)) {
-        const chain = [...ancestryPlayIds, resolvedName].join(' -> ');
-        throw new Error(`Recursive play graph detected: ${chain}`);
-      }
-      const nextDepth = callDepth + 1;
-      if (nextDepth > WORKER_PLAY_CALL_LIMITS.maxPlayCallDepth) {
-        throw new Error(
-          `Play-call depth exceeded (${nextDepth}/${WORKER_PLAY_CALL_LIMITS.maxPlayCallDepth}) while calling ${resolvedName}.`,
-        );
-      }
-      const nextPlayCallCount = playCallCount + 1;
-      if (nextPlayCallCount > WORKER_PLAY_CALL_LIMITS.maxPlayCallCount) {
-        throw new Error(
-          `Root play-call budget exceeded (${nextPlayCallCount}/${WORKER_PLAY_CALL_LIMITS.maxPlayCallCount}).`,
-        );
-      }
-      const nextParentCalls = (parentChildCalls[req.playName] ?? 0) + 1;
-      if (
-        nextParentCalls > WORKER_PLAY_CALL_LIMITS.maxChildPlayCallsPerParent
-      ) {
-        throw new Error(
-          `Child play-call cap exceeded for ${req.playName} (${nextParentCalls}/${WORKER_PLAY_CALL_LIMITS.maxChildPlayCallsPerParent}).`,
-        );
-      }
       return await executeWithRuntimeReceipt(receiptKey, async () => {
-        playCallCount = nextPlayCallCount;
-        parentChildCalls[req.playName] = nextParentCalls;
+        // The Governor owns the play-call lineage: forkChild does the cycle
+        // guard, depth/per-parent/playCall/descendant budget charges, and
+        // returns the snapshot to thread into the child so budgets accumulate
+        // across isolates. Charged inside the receipt boundary so a replay
+        // (cache hit) never double-charges.
+        const childRunId = `${req.runId}:child:${normalizedKey}`;
+        const childGovernance = governor.forkChild({
+          childPlayName: resolvedName,
+          childRunId,
+        });
+        const nextDepth = childGovernance.callDepth;
+        const nextParentCalls =
+          governor.snapshot().parentChildCalls[req.playName] ?? 0;
 
         emitEvent({
           type: 'log',
@@ -4456,31 +4721,47 @@ function createMinimalWorkerCtx(
         const childNeedsWorkflowScheduler = childPipelineNeedsWorkflowScheduler(
           childManifest.staticPipeline,
         );
-        let childConcurrencyAcquired = false;
-        let releaseChildPlaySlot: (() => void) | null = null;
-        if (childIsDatasetBacked) {
-          const nextInFlight =
-            (inFlightChildCallsByPlayName[resolvedName] ?? 0) + 1;
-          if (nextInFlight > 1) {
-            throw new Error(
-              `Concurrent dataset-backed play call blocked for ${resolvedName}. ` +
-                'A child play that uses ctx.dataset() cannot run more than once at the same time because its dataset tables share durable row identity. ' +
-                'Run these child play calls sequentially, or give each concurrent branch a different child play/table contract.',
-            );
-          }
-          inFlightChildCallsByPlayName[resolvedName] = nextInFlight;
-          childConcurrencyAcquired = true;
-        }
+        console.info('[play.runtime.span]', {
+          event: 'play.runtime.span',
+          phase: 'child_route',
+          runId: req.runId,
+          parentRunId: req.runId,
+          playName: resolvedName,
+          graphHash: req.graphHash ?? null,
+          depth: nextDepth,
+          fanoutIndex: nextParentCalls - 1,
+          childIsDatasetBacked,
+          childNeedsWorkflowScheduler,
+          hasStaticPipeline: Boolean(childManifest.staticPipeline),
+          childTableNamespace:
+            typeof childManifest.staticPipeline?.tableNamespace === 'string'
+              ? childManifest.staticPipeline.tableNamespace
+              : null,
+          childStageCount: Array.isArray(childManifest.staticPipeline?.stages)
+            ? childManifest.staticPipeline.stages.length
+            : null,
+          childSubstepCount: Array.isArray(
+            childManifest.staticPipeline?.substeps,
+          )
+            ? childManifest.staticPipeline.substeps.length
+            : null,
+        });
+        let childPlaySlot: { release(): void } | null = null;
         try {
-          releaseChildPlaySlot = await acquireChildPlaySlot();
+          childPlaySlot = await governor.acquireChildPlaySlot({
+            signal: abortSignal,
+          });
           const childSubmitStartedAt = nowMs();
           let started: {
             workflowId?: string;
             runId?: string;
             status?: string;
+            mode?: string;
             output?: unknown;
             result?: unknown;
             error?: unknown;
+            logs?: string[];
+            timings?: Array<{ phase: string; ms: number }>;
           };
           try {
             started = await submitChildPlayThroughCoordinator({
@@ -4507,6 +4788,17 @@ function createMinimalWorkerCtx(
                   // executor token's play name (the parent making this call).
                   ancestryPlayIds,
                   callDepth: nextDepth,
+                  // Cumulative lineage-global budget counters (incl. this
+                  // launch's play/descendant charges) so the child seeds its
+                  // budgets from the lineage total instead of resetting to 0 in
+                  // its isolate. Threading descendantCount in particular keeps
+                  // fan-out descendant accounting lineage-global, matching cjs.
+                  playCallCount: childGovernance.playCallCount,
+                  toolCallCount: childGovernance.toolCallCount,
+                  retryCount: childGovernance.retryCount,
+                  descendantCount: childGovernance.descendantCount,
+                  waterfallStepExecutions:
+                    childGovernance.waterfallStepExecutions,
                   description:
                     typeof options?.description === 'string'
                       ? options.description
@@ -4528,6 +4820,21 @@ function createMinimalWorkerCtx(
               status: 'failed',
               errorCode: 'CHILD_SUBMIT_FAILED',
             });
+            recordRunnerPerfTrace({
+              req,
+              phase: 'ctx_run_play.child_submit',
+              ms: nowMs() - childSubmitStartedAt,
+              extra: {
+                status: 'failed',
+                errorCode: 'CHILD_SUBMIT_FAILED',
+                playName: resolvedName,
+                key: normalizedKey,
+                depth: nextDepth,
+                fanoutIndex: nextParentCalls - 1,
+                childIsDatasetBacked,
+                childNeedsWorkflowScheduler,
+              },
+            });
             throw error;
           }
           const workflowId = started.workflowId ?? started.runId;
@@ -4558,6 +4865,26 @@ function createMinimalWorkerCtx(
             ms: nowMs() - childSubmitStartedAt,
             status: 'ok',
           });
+          recordRunnerPerfTrace({
+            req,
+            phase: 'ctx_run_play.child_submit',
+            ms: nowMs() - childSubmitStartedAt,
+            extra: {
+              status: 'ok',
+              childRunId: workflowId,
+              startedStatus: started.status ?? null,
+              mode: started.mode ?? null,
+              coordinatorTimings: Array.isArray(started.timings)
+                ? started.timings
+                : null,
+              playName: resolvedName,
+              key: normalizedKey,
+              depth: nextDepth,
+              fanoutIndex: nextParentCalls - 1,
+              childIsDatasetBacked,
+              childNeedsWorkflowScheduler,
+            },
+          });
           const startedStatus = String(started.status ?? '').toLowerCase();
           if (startedStatus === 'completed') {
             emitEvent({
@@ -4580,11 +4907,16 @@ function createMinimalWorkerCtx(
             throw new Error(startedErrorMessage);
           }
           const childWaitStartedAt = nowMs();
-          let result: unknown;
+          let waitResult: ChildPlayTerminalWaitResult;
           try {
-            result = await waitForChildPlayTerminalEvent({
-              req,
-              workflowStep,
+            waitResult = await awaitChildTerminal({
+              parentRunId: req.runId,
+              // CF's WorkflowStep.waitForEvent generic signature is wider than
+              // the small structural shape ChildPlayAwait needs; bridge it the
+              // same way the inline implementation did.
+              workflowStep: workflowStep as unknown as
+                | WorkflowStepLike
+                | undefined,
               workflowId,
               playName: resolvedName,
               key: normalizedKey,
@@ -4592,6 +4924,22 @@ function createMinimalWorkerCtx(
                 1_000,
                 Math.min(options?.timeoutMs ?? 5 * 60_000, 30 * 60_000),
               ),
+              coordinator: cachedCoordinatorBinding?.readChildTerminalState
+                ? {
+                    readChildTerminalState: (
+                      parentRunId,
+                      eventKey,
+                      timeoutMs,
+                    ) =>
+                      cachedCoordinatorBinding!.readChildTerminalState!(
+                        parentRunId,
+                        eventKey,
+                        timeoutMs,
+                      ),
+                  }
+                : null,
+              now: nowMs,
+              hashJson,
             });
           } catch (error) {
             console.info('[play.runtime.span]', {
@@ -4608,6 +4956,22 @@ function createMinimalWorkerCtx(
               status: 'failed',
               errorCode: 'CHILD_WAIT_FAILED',
             });
+            recordRunnerPerfTrace({
+              req,
+              phase: 'ctx_run_play.child_wait',
+              ms: nowMs() - childWaitStartedAt,
+              extra: {
+                status: 'failed',
+                errorCode: 'CHILD_WAIT_FAILED',
+                childRunId: workflowId,
+                playName: resolvedName,
+                key: normalizedKey,
+                depth: nextDepth,
+                fanoutIndex: nextParentCalls - 1,
+                childIsDatasetBacked,
+                childNeedsWorkflowScheduler,
+              },
+            });
             throw error;
           }
           console.info('[play.runtime.span]', {
@@ -4622,6 +4986,27 @@ function createMinimalWorkerCtx(
             fanoutIndex: nextParentCalls - 1,
             ms: nowMs() - childWaitStartedAt,
             status: 'ok',
+            waitSource: waitResult.source,
+            waitAttempts: waitResult.attempts ?? null,
+            reportedWaitMs: waitResult.waitMs,
+          });
+          recordRunnerPerfTrace({
+            req,
+            phase: 'ctx_run_play.child_wait',
+            ms: nowMs() - childWaitStartedAt,
+            extra: {
+              status: 'ok',
+              childRunId: workflowId,
+              playName: resolvedName,
+              key: normalizedKey,
+              depth: nextDepth,
+              fanoutIndex: nextParentCalls - 1,
+              childIsDatasetBacked,
+              childNeedsWorkflowScheduler,
+              waitSource: waitResult.source,
+              waitAttempts: waitResult.attempts ?? null,
+              reportedWaitMs: waitResult.waitMs,
+            },
           });
           emitEvent({
             type: 'log',
@@ -4629,15 +5014,9 @@ function createMinimalWorkerCtx(
             message: `Completed child play ${resolvedName} (${normalizedKey})`,
             ts: nowMs(),
           });
-          return result;
+          return waitResult.output;
         } finally {
-          releaseChildPlaySlot?.();
-          if (childConcurrencyAcquired) {
-            releaseChildPlayConcurrency(
-              inFlightChildCallsByPlayName,
-              resolvedName,
-            );
-          }
+          childPlaySlot?.release();
         }
       });
     },
@@ -4813,6 +5192,135 @@ async function handleRun(request: Request, env: WorkerEnv): Promise<Response> {
   });
 }
 
+async function handleRunInline(
+  request: Request,
+  env: WorkerEnv,
+): Promise<Response> {
+  let req: RunRequest;
+  try {
+    req = (await request.json()) as RunRequest;
+  } catch {
+    return Response.json(
+      {
+        status: 'failed',
+        error: { message: 'invalid JSON body' },
+      },
+      { status: 400 },
+    );
+  }
+
+  const events: RunnerEvent[] = [];
+  const timings: InlineRunTiming[] = [];
+  const traceInline = (
+    phase: string,
+    phaseStartedAt: number,
+    extra?: Record<string, unknown>,
+  ): void => {
+    timings.push({
+      phase,
+      ms: nowMs() - phaseStartedAt,
+      ...(extra ? { extra } : {}),
+    });
+  };
+  const inlineStartedAt = nowMs();
+  try {
+    const runPrefix = `[deepline-run:${req.runId}]`;
+    captureCoordinatorBinding(env);
+    captureRuntimeApiBinding(env);
+    captureHarnessBinding(env);
+    const probeStartedAt = nowMs();
+    await probeHarnessOnce(env, runPrefix);
+    traceInline('inline.probe_harness', probeStartedAt);
+    if (!req.inlineChildRunRegistered) {
+      const registerStartedAt = nowMs();
+      await registerInlineChildRun(req);
+      traceInline('inline.register_child_run', registerStartedAt);
+    } else {
+      traceInline('inline.register_child_run', nowMs(), { skipped: true });
+    }
+    const executeStartedAt = nowMs();
+    const output = await executeRunRequest(
+      req,
+      env,
+      (event) => {
+        events.push(event);
+      },
+      undefined,
+      {
+        persistResultDatasets: true,
+      },
+    );
+    traceInline('inline.execute_run_request', executeStartedAt, {
+      durationMs: output.durationMs,
+      outputRows: output.outputRows,
+    });
+    traceInline('inline.total', inlineStartedAt);
+    return Response.json({
+      status: 'completed',
+      result: output.result,
+      outputRows: output.outputRows,
+      durationMs: output.durationMs,
+      events,
+      timings,
+    });
+  } catch (error) {
+    const err = error as Error;
+    events.push({
+      type: 'error',
+      message: err.message ?? String(err),
+      stack: err.stack,
+      ts: nowMs(),
+    });
+    return Response.json({
+      status: 'failed',
+      error: {
+        message: err.message ?? String(err),
+        stack: err.stack,
+      },
+      events,
+      timings,
+    });
+  }
+}
+
+async function registerInlineChildRun(req: RunRequest): Promise<void> {
+  const snapshot = isRecord(req.contractSnapshot) ? req.contractSnapshot : {};
+  const artifactMetadata = isRecord(snapshot.artifactMetadata)
+    ? snapshot.artifactMetadata
+    : {};
+  const governance = req.playCallGovernance;
+  await postRuntimeApi(req.baseUrl, req.executorToken, {
+    action: 'start_inline_child_run',
+    playName: req.playName,
+    runId: req.runId,
+    workflowFamilyKey:
+      governance?.rootRunId ?? governance?.parentRunId ?? req.runId,
+    artifactStorageKey:
+      typeof artifactMetadata.storageKey === 'string'
+        ? artifactMetadata.storageKey
+        : undefined,
+    artifactHash:
+      typeof artifactMetadata.artifactHash === 'string'
+        ? artifactMetadata.artifactHash
+        : undefined,
+    graphHash:
+      typeof artifactMetadata.graphHash === 'string'
+        ? artifactMetadata.graphHash
+        : undefined,
+    runtimeBackend: 'workers_edge',
+    schedulerBackend: 'inline_child',
+    executionProfile: 'workers_edge',
+    maxCreditsPerRun: extractMaxCreditsPerRun(req.contractSnapshot),
+    staticPipeline: snapshot.staticPipeline ?? null,
+    source:
+      snapshot.source === 'published' ||
+      snapshot.source === 'ad_hoc' ||
+      snapshot.source === 'draft'
+        ? snapshot.source
+        : 'published',
+  });
+}
+
 /** Cap on run log lines retained in the terminal output compatibility shape. */
 const RUN_LOG_BUFFER_LIMIT = 500;
 /** Min wall-clock interval between live run-ledger flushes during a run. */
@@ -5081,6 +5589,20 @@ async function executeRunRequest(
     abortSignal,
     workerCallbacks,
   );
+  // Hard wall-clock cap on active user-code runtime. CF Workflows does not
+  // impose a play-level execution ceiling on this substrate, so without this a
+  // runaway play (infinite loop, stuck await) would only stop when the executor
+  // token expires. Aborting the controller surfaces cooperatively through the
+  // same assertNotAborted checks used for harness cancellation.
+  let runtimeLimitExceeded = false;
+  const runtimeDeadlineTimer = setTimeout(() => {
+    runtimeLimitExceeded = true;
+    if (!abortSignal.aborted) {
+      abortController.abort(
+        `Play runtime limit exceeded after ${STANDARD_PLAY_RUNTIME_LIMIT_SECONDS}s.`,
+      );
+    }
+  }, STANDARD_PLAY_RUNTIME_LIMIT_SECONDS * 1000);
   try {
     const playStartedAt = nowMs();
     const result = await (
@@ -5102,6 +5624,33 @@ async function executeRunRequest(
       phase: 'runner.serialize_result',
       ms: nowMs() - serializeStartedAt,
     });
+    const terminalResult = trimResultForStatus(serializedResult);
+    let parentSignalPromise: Promise<void> | null = null;
+    const startParentTerminalSignal = (): Promise<void> => {
+      if (!parentSignalPromise) {
+        const parentSignalStartedAt = nowMs();
+        parentSignalPromise = signalParentPlayTerminal({
+          req,
+          status: 'completed',
+          result: terminalResult as Record<string, unknown>,
+        })
+          .catch((error) => {
+            console.error(
+              `[play-harness] non-fatal parent completion signal failed runId=${req.runId}: ${
+                error instanceof Error ? error.message : String(error)
+              }`,
+            );
+          })
+          .finally(() => {
+            recordRunnerPerfTrace({
+              req,
+              phase: 'runner.parent_terminal_signal',
+              ms: nowMs() - parentSignalStartedAt,
+            });
+          });
+      }
+      return parentSignalPromise;
+    };
     if (options?.persistResultDatasets) {
       const ledgerFlushWaitStartedAt = nowMs();
       await ledgerFlushInFlight;
@@ -5117,7 +5666,7 @@ async function executeRunRequest(
         phase: 'runner.persist_result_datasets',
         ms: nowMs() - resultDatasetStartedAt,
       });
-      const terminalResult = trimResultForStatus(serializedResult);
+      const parentSignal = startParentTerminalSignal();
       const terminalOccurredAt = nowMs();
       const terminalUpdateStartedAt = nowMs();
       await flushTerminalLedgerEvents({
@@ -5161,24 +5710,9 @@ async function executeRunRequest(
           await nonBlockingBillingPromise;
         }
       }
+      await parentSignal;
     }
-    const parentSignalStartedAt = nowMs();
-    await signalParentPlayTerminal({
-      req,
-      status: 'completed',
-      result: trimResultForStatus(serializedResult) as Record<string, unknown>,
-    }).catch((error) => {
-      console.error(
-        `[play-harness] non-fatal parent completion signal failed runId=${req.runId}: ${
-          error instanceof Error ? error.message : String(error)
-        }`,
-      );
-    });
-    recordRunnerPerfTrace({
-      req,
-      phase: 'runner.parent_terminal_signal',
-      ms: nowMs() - parentSignalStartedAt,
-    });
+    await startParentTerminalSignal();
     recordRunnerPerfTrace({
       req,
       phase: 'runner.execute_total',
@@ -5194,7 +5728,10 @@ async function executeRunRequest(
     };
   } catch (error) {
     stepLifecycle?.markStartedFailed(nowMs());
-    const aborted = isAbortLikeError(error);
+    // A runtime-limit abort is a timeout failure, not a user cancellation, so
+    // it should be reported as run.failed with the limit message rather than
+    // run.cancelled.
+    const aborted = isAbortLikeError(error) && !runtimeLimitExceeded;
     if (aborted) {
       // Flip the controller so any concurrent user code observes the abort
       // through ctx.signal. We mark the run cancelled instead of failed.
@@ -5253,6 +5790,8 @@ async function executeRunRequest(
       error: message,
     }).catch(() => null);
     throw error;
+  } finally {
+    clearTimeout(runtimeDeadlineTimer);
   }
 }
 
@@ -5851,6 +6390,9 @@ const workerEntrypoint = {
         },
       });
     }
+    if (request.method === 'POST' && url.pathname === '/run-inline') {
+      return handleRunInline(request, env);
+    }
     if (request.method === 'POST' && url.pathname === '/run') {
       return handleRun(request, env);
     }