deepline 0.2.55 → 0.2.57

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -46,7 +46,10 @@ import type { PlayQueueHint } from './governor/rate-state-backend';
 import type { MapRowOutcome } from './durability-store';
 import { stringifyPostgresJson } from './postgres-json';
 import { RUNTIME_ROW_OUTPUT_NOT_JSON_SERIALIZABLE } from './runtime-sheet-row-transition';
-import { RuntimeSheetRowWriter } from './runtime-sheet-row-writer';
+import {
+  RuntimeSheetRowWriter,
+  type RuntimeSheetRowWriterDiagnostics,
+} from './runtime-sheet-row-writer';
 import type { WorkReceiptFailureKind } from './work-receipts';
 import {
   completedMapRowOutcome,
@@ -161,6 +164,8 @@ import {
   type PlayAuthoringRuntimeContext,
 } from '../plays/authoring-contract';
 import {
+  DURABLE_RECEIPT_WAIT_DELAY_MS,
+  DURABLE_RECEIPT_WAIT_MAX_ATTEMPTS,
   RuntimeReceiptLeaseLostError,
   RuntimeReceiptWaitTimeoutError,
   executeWithDurableRuntimeReceipt,
@@ -331,6 +336,8 @@ const rowContext = new AsyncLocalStorage<{
   tableNamespace?: string;
   rowKey?: string;
   mapScope?: MapExecutionScope;
+  mapStallObserver?: RuntimeMapStallObserver;
+  mapStallResolverToken?: number;
   /**
    * Per-resolver inline-child fan-width guard. This stays in the async row
    * scope, so it becomes collectible as soon as the resolver settles.
@@ -366,6 +373,7 @@ const MAP_PERSIST_CHUNK_BYTES = 8 * 1024 * 1024;
 const MAP_ROW_WRITER_BUFFER_BYTES = 16 * 1024 * 1024;
 const MAP_ROW_WRITER_MAX_FLUSH_MS = 100;
 const MAP_FRAME_FLUSH_INTERVAL_MS = 250;
+const MAP_STALL_LOG_INTERVAL_MS = 60_000;
 // Tool scheduling lanes wait at most this long for same-lane row continuations.
 // The window is fixed from the first item and never resets on later arrivals.
 const TOOL_BATCH_COALESCE_WINDOW_MS = 5;
@@ -389,6 +397,9 @@ const DEEPLINEAGENT_TOOL_RUNTIME_TIMEOUT_MS = 15 * 60 * 1000;
 const DEFAULT_TOOL_RUNTIME_TIMEOUT_MS = 15 * 60 * 1000 + 30_000;
 const FETCH_TRANSPORT_MAX_ATTEMPTS = 3;
 const FETCH_TRANSPORT_RETRY_DELAY_MS = 100;
+const CTX_FETCH_HEADERS_TIMEOUT_MS = 30_000;
+const CTX_FETCH_BODY_TIMEOUT_MS = 30_000;
+const CTX_FETCH_TOTAL_TIMEOUT_MS = 120_000;
 // cloudflared returns this branded HTML when its connection to the local app
 // resets. It is a transport failure before the app can reach a provider, not a
 // provider 502; require both the branded page and our development tunnel host.
@@ -427,6 +438,388 @@ class ToolExecuteResponseBodyTimeoutError extends Error {
   }
 }
 
+export class CtxFetchTimeoutError extends Error {
+  readonly code = 'CTX_FETCH_TIMEOUT';
+
+  constructor(
+    readonly phase: 'headers' | 'body' | 'total',
+    readonly timeoutMs: number,
+  ) {
+    super(
+      `[CTX_FETCH_TIMEOUT phase=${phase} timeout_ms=${timeoutMs}] ` +
+        `ctx.fetch exceeded its ${phase} deadline after ${timeoutMs}ms.`,
+    );
+    this.name = 'CtxFetchTimeoutError';
+  }
+}
+
+type CtxFetchDeadline = {
+  bodyMs: number;
+  headersMs: number;
+  startedAt: number;
+  totalMs: number;
+};
+
+function positiveTimeoutMs(
+  value: number | undefined,
+  fallback: number,
+): number {
+  return value === undefined || !Number.isFinite(value) || value <= 0
+    ? fallback
+    : Math.max(1, Math.floor(value));
+}
+
+function remainingCtxFetchMs(deadline: CtxFetchDeadline): number {
+  return Math.max(0, deadline.totalMs - (Date.now() - deadline.startedAt));
+}
+
+async function runCtxFetchPhase<T>(input: {
+  callerSignal?: AbortSignal | null;
+  controller: AbortController;
+  deadline: CtxFetchDeadline;
+  phase: 'headers' | 'body';
+  run: () => Promise<T>;
+}): Promise<T> {
+  const remainingMs = remainingCtxFetchMs(input.deadline);
+  if (remainingMs <= 0) {
+    throw new CtxFetchTimeoutError('total', input.deadline.totalMs);
+  }
+  if (input.callerSignal?.aborted) {
+    throw (
+      input.callerSignal.reason ?? new DOMException('Aborted', 'AbortError')
+    );
+  }
+  const phaseLimitMs =
+    input.phase === 'headers'
+      ? input.deadline.headersMs
+      : input.deadline.bodyMs;
+  const timeoutMs = Math.min(phaseLimitMs, remainingMs);
+  const timeoutPhase = timeoutMs >= remainingMs ? 'total' : input.phase;
+  let timeout: ReturnType<typeof setTimeout> | null = null;
+  let onCallerAbort: (() => void) | null = null;
+  const phaseTimeout = new Promise<never>((_resolve, reject) => {
+    timeout = setTimeout(() => {
+      const error = new CtxFetchTimeoutError(
+        timeoutPhase,
+        timeoutPhase === 'total' ? input.deadline.totalMs : phaseLimitMs,
+      );
+      reject(error);
+      input.controller.abort(error);
+    }, timeoutMs);
+  });
+  const callerAbort = input.callerSignal
+    ? new Promise<never>((_resolve, reject) => {
+        onCallerAbort = () => {
+          const reason =
+            input.callerSignal?.reason ??
+            new DOMException('Aborted', 'AbortError');
+          reject(reason);
+          input.controller.abort(reason);
+        };
+        input.callerSignal!.addEventListener('abort', onCallerAbort, {
+          once: true,
+        });
+      })
+    : null;
+  try {
+    return await Promise.race([
+      input.run(),
+      phaseTimeout,
+      ...(callerAbort ? [callerAbort] : []),
+    ]);
+  } finally {
+    if (timeout) clearTimeout(timeout);
+    if (onCallerAbort) {
+      input.callerSignal?.removeEventListener('abort', onCallerAbort);
+    }
+  }
+}
+
+async function sleepWithinCtxFetchDeadline(input: {
+  callerSignal?: AbortSignal | null;
+  deadline: CtxFetchDeadline;
+  delayMs: number;
+}): Promise<void> {
+  const controller = new AbortController();
+  await runCtxFetchPhase({
+    callerSignal: input.callerSignal,
+    controller,
+    deadline: input.deadline,
+    phase: 'headers',
+    run: () =>
+      new Promise<void>((resolve) => {
+        setTimeout(
+          resolve,
+          Math.min(input.delayMs, remainingCtxFetchMs(input.deadline)),
+        );
+      }),
+  });
+}
+
+async function readCtxFetchBody(input: {
+  callerSignal?: AbortSignal | null;
+  controller: AbortController;
+  deadline: CtxFetchDeadline;
+  response: Response;
+}): Promise<string> {
+  if (!input.response.body) return '';
+  const reader = input.response.body.getReader();
+  const decoder = new TextDecoder();
+  try {
+    return await runCtxFetchPhase({
+      callerSignal: input.callerSignal,
+      controller: input.controller,
+      deadline: input.deadline,
+      phase: 'body',
+      run: async () => {
+        let body = '';
+        for (;;) {
+          const chunk = await reader.read();
+          if (chunk.done) return body + decoder.decode();
+          body += decoder.decode(chunk.value, { stream: true });
+        }
+      },
+    });
+  } catch (error) {
+    // Cancellation is socket hygiene, not part of the timeout contract. A
+    // hostile/custom stream may never resolve its cancel hook; awaiting it
+    // here would recreate the exact forever-pending ctx.fetch this deadline
+    // is meant to eliminate.
+    void reader.cancel(error).catch(() => {});
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+class RuntimeMapStallObserver {
+  readonly #resolvers = new Map<
+    number,
+    {
+      phase: 'resolver' | 'fetch';
+      phaseStartedAt: number;
+      startedAt: number;
+    }
+  >();
+  readonly #terminalAdmissionStartedAt = new Map<number, number>();
+  readonly #terminalCommitStartedAt = new Map<number, number>();
+  readonly #getWriterDiagnostics: () => RuntimeSheetRowWriterDiagnostics | null;
+  readonly #log: (line: string) => void;
+  readonly #mapName: string;
+  readonly #pageOffset: number;
+  readonly #intervalMs: number;
+  #timer: ReturnType<typeof setTimeout> | null = null;
+  #lastTerminalCommitAt = Date.now();
+  #terminalCommitted = 0;
+  #token = 0;
+
+  constructor(input: {
+    getWriterDiagnostics: () => RuntimeSheetRowWriterDiagnostics | null;
+    log: (line: string) => void;
+    mapName: string;
+    pageOffset: number;
+    intervalMs?: number;
+  }) {
+    this.#getWriterDiagnostics = input.getWriterDiagnostics;
+    this.#log = input.log;
+    this.#mapName = input.mapName;
+    this.#pageOffset = input.pageOffset;
+    this.#intervalMs = positiveTimeoutMs(
+      input.intervalMs,
+      MAP_STALL_LOG_INTERVAL_MS,
+    );
+  }
+
+  resolverStarted(): { finish: () => void; token: number } {
+    const token = ++this.#token;
+    const now = Date.now();
+    this.#resolvers.set(token, {
+      phase: 'resolver',
+      phaseStartedAt: now,
+      startedAt: now,
+    });
+    this.#schedule();
+    return {
+      token,
+      finish: () => {
+        this.#resolvers.delete(token);
+        this.#cancelIfIdle();
+      },
+    };
+  }
+
+  fetchStarted(resolverToken: number | undefined): () => void {
+    if (resolverToken === undefined) return () => {};
+    const resolver = this.#resolvers.get(resolverToken);
+    if (!resolver) return () => {};
+    resolver.phase = 'fetch';
+    resolver.phaseStartedAt = Date.now();
+    return () => {
+      const current = this.#resolvers.get(resolverToken);
+      if (!current) return;
+      current.phase = 'resolver';
+      current.phaseStartedAt = Date.now();
+    };
+  }
+
+  terminalQueued(): {
+    admitted: () => void;
+    committed: () => void;
+    failed: () => void;
+  } {
+    const token = ++this.#token;
+    const now = Date.now();
+    this.#terminalAdmissionStartedAt.set(token, now);
+    this.#schedule();
+    return {
+      admitted: () => {
+        this.#terminalAdmissionStartedAt.delete(token);
+        this.#terminalCommitStartedAt.set(token, Date.now());
+      },
+      committed: () => {
+        this.#terminalAdmissionStartedAt.delete(token);
+        if (this.#terminalCommitStartedAt.delete(token)) {
+          this.#terminalCommitted += 1;
+          this.#lastTerminalCommitAt = Date.now();
+        }
+        this.#cancelIfIdle();
+      },
+      failed: () => {
+        this.#terminalAdmissionStartedAt.delete(token);
+        this.#terminalCommitStartedAt.delete(token);
+        this.#cancelIfIdle();
+      },
+    };
+  }
+
+  stop(): void {
+    if (this.#timer) clearTimeout(this.#timer);
+    this.#timer = null;
+  }
+
+  #schedule(): void {
+    if (this.#timer) return;
+    this.#timer = setTimeout(() => {
+      this.#timer = null;
+      this.#emitIfStalled();
+      if (this.#hasUnresolved()) this.#schedule();
+    }, this.#intervalMs);
+    if (
+      typeof this.#timer === 'object' &&
+      'unref' in this.#timer &&
+      typeof this.#timer.unref === 'function'
+    ) {
+      this.#timer.unref();
+    }
+  }
+
+  #cancelIfIdle(): void {
+    if (!this.#hasUnresolved()) this.stop();
+  }
+
+  #hasUnresolved(): boolean {
+    return (
+      this.#resolvers.size > 0 ||
+      this.#terminalAdmissionStartedAt.size > 0 ||
+      this.#terminalCommitStartedAt.size > 0
+    );
+  }
+
+  #emitIfStalled(): void {
+    const now = Date.now();
+    if (now - this.#lastTerminalCommitAt < this.#intervalMs) return;
+    const writer = this.#getWriterDiagnostics();
+    const unresolved =
+      this.#resolvers.size +
+      this.#terminalAdmissionStartedAt.size +
+      this.#terminalCommitStartedAt.size +
+      (writer?.activeRows ?? 0) +
+      (writer?.queuedTerminalRows ?? 0) +
+      (writer?.blockedTerminalRows ?? 0);
+    if (unresolved === 0) return;
+    const oldest = (...sources: Array<Iterable<number>>): number | null => {
+      let value: number | null = null;
+      for (const source of sources) {
+        for (const candidate of source) {
+          value = value === null ? candidate : Math.min(value, candidate);
+        }
+      }
+      return value;
+    };
+    const oldestUnsettledAt = oldest(
+      [...this.#resolvers.values()].map((resolver) => resolver.startedAt),
+      this.#terminalAdmissionStartedAt.values(),
+      this.#terminalCommitStartedAt.values(),
+      writer?.activeStartedAt === null || writer?.activeStartedAt === undefined
+        ? []
+        : [writer.activeStartedAt],
+    );
+    const phaseCandidates: Array<{
+      at: number;
+      phase: 'fetch' | 'resolver' | 'writer_admission' | 'writer_commit';
+    }> = [
+      ...[...this.#resolvers.values()].map((resolver) => ({
+        at: resolver.startedAt,
+        phase: resolver.phase,
+      })),
+      ...[...this.#terminalAdmissionStartedAt.values()].map((at) => ({
+        at,
+        phase: 'writer_admission' as const,
+      })),
+      ...[...this.#terminalCommitStartedAt.values()].map((at) => ({
+        at,
+        phase: 'writer_commit' as const,
+      })),
+    ];
+    if (
+      writer?.activeKind === 'terminal' &&
+      writer.activeRows > 0 &&
+      writer.activeStartedAt !== null
+    ) {
+      phaseCandidates.push({
+        at: writer.activeStartedAt,
+        phase: 'writer_commit',
+      });
+    }
+    const oldestPhase = phaseCandidates.reduce<
+      (typeof phaseCandidates)[number] | null
+    >(
+      (current, candidate) =>
+        current === null || candidate.at < current.at ? candidate : current,
+      null,
+    )?.phase;
+    const fetchResolvers = [...this.#resolvers.values()].filter(
+      (resolver) => resolver.phase === 'fetch',
+    );
+    this.#log(
+      `[runtime.map_stall] ${JSON.stringify({
+        map: this.#mapName,
+        page_offset: this.#pageOffset,
+        resolver_active: this.#resolvers.size,
+        fetch_active: fetchResolvers.length,
+        oldest_fetch_ms: Math.max(
+          0,
+          now -
+            (oldest(
+              fetchResolvers.map((resolver) => resolver.phaseStartedAt),
+            ) ?? now),
+        ),
+        terminal_admission_waiting: this.#terminalAdmissionStartedAt.size,
+        terminal_commit_waiting: this.#terminalCommitStartedAt.size,
+        terminal_write_active:
+          writer?.activeKind === 'terminal' ? writer.activeRows : 0,
+        terminal_queued:
+          (writer?.queuedTerminalRows ?? 0) +
+          (writer?.blockedTerminalRows ?? 0),
+        terminal_committed: this.#terminalCommitted,
+        oldest_unsettled_ms: Math.max(0, now - (oldestUnsettledAt ?? now)),
+        oldest_phase: oldestPhase ?? 'resolver',
+        last_terminal_commit_ms: Math.max(0, now - this.#lastTerminalCommitAt),
+      })}`,
+    );
+  }
+}
+
 async function readToolExecuteResponseBody<T>(input: {
   toolId: string;
   abortController: AbortController | null;
@@ -841,6 +1234,12 @@ type ToolExecutionApiOptions = {
   beforeProviderCall?: () => Promise<void> | void;
   heartbeatReceipt?: () => Promise<void> | void;
   parkProviderCall?: () => Promise<void> | void;
+  /**
+   * Transfer the logical tool permit to the caller so it can remain held until
+   * the decoded response is durably settled. The release callback is
+   * idempotent. Callers must release it in a finally block.
+   */
+  retainToolSlot?: (release: () => void) => void;
   /**
    * Explicit graph-node attribution for this provider call (ADR 0018). Carried
    * to the execute route, which stamps it onto the usage event so per-node
@@ -936,6 +1335,10 @@ function failedMapRowLogLabel(row: PersistableMapRow): string {
 type FieldMapRunResult = {
   completedRows: PersistableMapRow[];
   failedRows: PersistableMapRow[];
+  completedRowCount: number;
+  failedRowCount: number;
+  previewRows: Record<string, unknown>[];
+  retainedRowsComplete: boolean;
 };
 
 type RuntimeMapRowPersistence = {
@@ -946,6 +1349,7 @@ type RuntimeMapRowPersistence = {
   isPersisted: (row: PersistableMapRow) => boolean;
   checkpoint: (updates: PlayRowUpdate[]) => Promise<void>;
   flush: () => Promise<void>;
+  diagnostics: () => RuntimeSheetRowWriterDiagnostics;
 };
 
 function createRuntimeMapRowPersistence(
@@ -1050,6 +1454,7 @@ function createRuntimeMapRowPersistence(
     flush: async () => {
       await writer.finish();
     },
+    diagnostics: () => writer.diagnostics(),
   };
 }
 
@@ -1324,8 +1729,9 @@ class RuntimeDatasetBuilder<T extends Record<string, unknown>> {
 
 const WAITING_ROW = Symbol('deepline.waiting_row');
 const FAILED_ROW = Symbol('deepline.failed_row');
+const COMPLETED_ROW = Symbol('deepline.completed_row');
 type MapRowExecutionResult =
-  | Record<string, unknown>
+  | typeof COMPLETED_ROW
   | typeof WAITING_ROW
   | typeof FAILED_ROW;
 
@@ -1446,6 +1852,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     reject: (error: unknown) => void;
   }> = [];
   private runtimeToolOwnershipAssertionFlushScheduled = false;
+  private runtimeToolReceiptCompletionsInFlight = new Map<string, number>();
   /**
    * Direct durable boundaries (including ctx.fetch) arrive independently from
    * concurrent map rows. Hold one microtask's worth so they can use the bulk
@@ -1465,6 +1872,14 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       }>;
     }
   >();
+  /**
+   * Completed durable receipt payloads can expand many times beyond their wire
+   * size during JSON parsing. Scheduling groups may overlap for provider
+   * throughput, but only one group at a time may hydrate and deliver cached
+   * results. Pending claims leave this section before provider execution, so
+   * cache misses retain normal cross-group concurrency.
+   */
+  private runtimeReceiptHydrationTurn: Promise<void> = Promise.resolve();
   /**
    * Fixed, non-resetting coalescing deadlines for ready scheduling lanes. A
    * deadline starts when the first request enters an empty batch bucket. New
@@ -1850,6 +2265,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           options.getToolProvider,
         ),
         resolveRateScope: options.getToolRateScope,
+        maxConcurrentExternalCalls: options.maxConcurrentExternalCalls,
+        maxConcurrentRows: options.maxConcurrentRows,
         // A root run keeps depth 0 (its first child play is depth 1) but still
         // seeds its own play id into the ancestry/currentPlayId so the cycle guard
         // catches a child re-invoking the root. createDefaultGovernanceSnapshot
@@ -3077,6 +3494,22 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     return byKey;
   }
 
+  private async withRuntimeReceiptHydrationTurn<T>(
+    hydrate: () => Promise<T>,
+  ): Promise<T> {
+    const precedingTurn = this.runtimeReceiptHydrationTurn;
+    let releaseTurn!: () => void;
+    this.runtimeReceiptHydrationTurn = new Promise<void>((resolve) => {
+      releaseTurn = resolve;
+    });
+    await precedingTurn;
+    try {
+      return await hydrate();
+    } finally {
+      releaseTurn();
+    }
+  }
+
   private async markRuntimeStepReceiptRunning(input: {
     key: string;
     runId: string;
@@ -3587,7 +4020,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       markRunningBeforeExecute?: boolean;
       requiresExecutionLock?: boolean;
       executionLockTtlMs?: number;
-      execute: (context: { leaseId: string | null }) => Promise<T>;
+      execute: (context: {
+        leaseId: string | null;
+        retainExternalCallSlot: (release: () => void) => void;
+      }) => Promise<T>;
     },
   ): Promise<T> {
     const stalePolicy = resolveDurableCallCachePolicy(
@@ -3609,32 +4045,52 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         staleAfterSeconds: stalePolicy.staleAfterSeconds,
         cacheEpochMs: this.durableCallCacheEpochMs,
       });
-    return await executeWithDurableRuntimeReceipt<T>({
-      operation,
-      id,
-      runId: this.currentReceiptOwnerRunId,
-      receiptKey,
-      store: this.durableReceiptExecutionStore(),
-      force: opts.force === true || stalePolicy.forceRefresh,
-      repairRunningReceiptForSameRun: opts.repairRunningReceiptForSameRun,
-      repairRunningReceiptForSameRunAfterWaitTimeout:
-        opts.repairRunningReceiptForSameRunAfterWaitTimeout,
-      runningReceiptWaitMaxAttempts: opts.runningReceiptWaitMaxAttempts,
-      runningReceiptWaitDelayMs: opts.runningReceiptWaitDelayMs,
-      reclaimRunning: opts.reclaimRunning,
-      markSkipped: opts.markSkipped,
-      onRecovered: opts.onRecovered,
-      onClaimedResult: opts.onClaimedResult,
-      shouldPersistFailure: opts.shouldPersistFailure,
-      markRunningBeforeExecute: opts.markRunningBeforeExecute,
-      completedCacheOnly: operation === 'tool',
-      requiresExecutionLock: opts.requiresExecutionLock,
-      executionLockTtlMs: opts.executionLockTtlMs,
-      toolErrorSchemaVersion: this.currentToolErrorSchemaVersion,
-      formatError: (error) => this.formatRuntimeError(error),
-      log: (message) => this.log(message),
-      execute: opts.execute,
-    });
+    let releaseExternalCallSlot: (() => void) | null = null;
+    try {
+      return await executeWithDurableRuntimeReceipt<T>({
+        operation,
+        id,
+        runId: this.currentReceiptOwnerRunId,
+        receiptKey,
+        store: this.durableReceiptExecutionStore(),
+        force: opts.force === true || stalePolicy.forceRefresh,
+        repairRunningReceiptForSameRun: opts.repairRunningReceiptForSameRun,
+        repairRunningReceiptForSameRunAfterWaitTimeout:
+          opts.repairRunningReceiptForSameRunAfterWaitTimeout,
+        runningReceiptWaitMaxAttempts: opts.runningReceiptWaitMaxAttempts,
+        runningReceiptWaitDelayMs: opts.runningReceiptWaitDelayMs,
+        reclaimRunning: opts.reclaimRunning,
+        markSkipped: opts.markSkipped,
+        onRecovered: opts.onRecovered,
+        onClaimedResult: opts.onClaimedResult,
+        shouldPersistFailure: opts.shouldPersistFailure,
+        markRunningBeforeExecute: opts.markRunningBeforeExecute,
+        completedCacheOnly: operation === 'tool',
+        withCompletedReceiptHydration: (hydrate) =>
+          this.withRuntimeReceiptHydrationTurn(hydrate),
+        requiresExecutionLock: opts.requiresExecutionLock,
+        executionLockTtlMs: opts.executionLockTtlMs,
+        toolErrorSchemaVersion: this.currentToolErrorSchemaVersion,
+        formatError: (error) => this.formatRuntimeError(error),
+        log: (message) => this.log(message),
+        execute: ({ leaseId }) =>
+          opts.execute({
+            leaseId,
+            retainExternalCallSlot: (release) => {
+              if (releaseExternalCallSlot) {
+                release();
+                throw new Error(
+                  `ctx.${operation}(${id}) attempted to retain more than one external-call slot.`,
+                );
+              }
+              releaseExternalCallSlot = release;
+            },
+          }),
+      });
+    } finally {
+      const release = releaseExternalCallSlot as (() => void) | null;
+      release?.();
+    }
   }
 
   private get currentRunId(): string {
@@ -4669,32 +5125,39 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       }),
       requestInput: request.input,
     });
-    let completed: RuntimeStepReceipt | null | undefined = null;
-    if (receiptKey) {
-      try {
-        completed = (
-          await this.completeRuntimeStepReceipts([
-            {
-              key: receiptKey,
-              runId: this.currentReceiptOwnerRunId,
-              leaseId: request.receiptLeaseId ?? null,
-              output: serializeToolExecuteResult(wrapped),
-            },
-          ])
-        ).get(receiptKey);
-      } catch (receiptError) {
-        // Completion failed AFTER a successful (billed) tool call: trip the
-        // breaker so remaining rows stop dispatching new provider calls.
-        tripRuntimePersistenceLatch(this.persistenceLatch, receiptError);
-        throw receiptError;
+    const releaseCompletionHold = this.holdRuntimeToolReceiptCompletions(
+      receiptKey ? [receiptKey] : [],
+    );
+    try {
+      let completed: RuntimeStepReceipt | null | undefined = null;
+      if (receiptKey) {
+        try {
+          completed = (
+            await this.completeRuntimeStepReceipts([
+              {
+                key: receiptKey,
+                runId: this.currentReceiptOwnerRunId,
+                leaseId: request.receiptLeaseId ?? null,
+                output: serializeToolExecuteResult(wrapped),
+              },
+            ])
+          ).get(receiptKey);
+        } catch (receiptError) {
+          // Completion failed AFTER a successful (billed) tool call: trip the
+          // breaker so remaining rows stop dispatching new provider calls.
+          tripRuntimePersistenceLatch(this.persistenceLatch, receiptError);
+          throw receiptError;
+        }
       }
+      return await this.finalizeResolvedToolCall(
+        toolId,
+        request,
+        wrapped,
+        completed,
+      );
+    } finally {
+      releaseCompletionHold();
     }
-    return await this.finalizeResolvedToolCall(
-      toolId,
-      request,
-      wrapped,
-      completed,
-    );
   }
 
   private async resolveToolCallBatchResults(
@@ -4739,37 +5202,70 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           ]
         : [];
     });
-    let completedByKey = new Map<string, RuntimeStepReceipt>();
-    if (receiptInputs.length > 0) {
-      try {
-        completedByKey = await this.completeRuntimeStepReceipts(receiptInputs);
-      } catch (receiptError) {
-        // Completion failed AFTER successful (billed) tool calls: trip the
-        // breaker so remaining rows stop dispatching new provider calls.
-        tripRuntimePersistenceLatch(this.persistenceLatch, receiptError);
-        await Promise.all(
-          wrappedEntries.map((entry) =>
-            this.rejectToolCall(toolId, entry.request, receiptError, {
-              persistReceiptFailure: false,
-            }),
+    const releaseCompletionHold = this.holdRuntimeToolReceiptCompletions(
+      receiptInputs.map((receipt) => receipt.key),
+    );
+    try {
+      let completedByKey = new Map<string, RuntimeStepReceipt>();
+      if (receiptInputs.length > 0) {
+        try {
+          completedByKey =
+            await this.completeRuntimeStepReceipts(receiptInputs);
+        } catch (receiptError) {
+          // Completion failed AFTER successful (billed) tool calls: trip the
+          // breaker so remaining rows stop dispatching new provider calls.
+          tripRuntimePersistenceLatch(this.persistenceLatch, receiptError);
+          await Promise.all(
+            wrappedEntries.map((entry) =>
+              this.rejectToolCall(toolId, entry.request, receiptError, {
+                persistReceiptFailure: false,
+              }),
+            ),
+          );
+          throw receiptError;
+        }
+      }
+      const results: unknown[] = [];
+      for (const entry of wrappedEntries) {
+        const receiptKey = entry.request.receiptKey?.trim() || null;
+        results.push(
+          await this.finalizeResolvedToolCall(
+            toolId,
+            entry.request,
+            entry.wrapped,
+            receiptKey ? completedByKey.get(receiptKey) : null,
           ),
         );
-        throw receiptError;
       }
+      return results;
+    } finally {
+      releaseCompletionHold();
     }
-    const results: unknown[] = [];
-    for (const entry of wrappedEntries) {
-      const receiptKey = entry.request.receiptKey?.trim() || null;
-      results.push(
-        await this.finalizeResolvedToolCall(
-          toolId,
-          entry.request,
-          entry.wrapped,
-          receiptKey ? completedByKey.get(receiptKey) : null,
-        ),
+  }
+
+  private holdRuntimeToolReceiptCompletions(receiptKeys: string[]): () => void {
+    const uniqueKeys = [
+      ...new Set(receiptKeys.map((key) => key.trim())),
+    ].filter(Boolean);
+    for (const key of uniqueKeys) {
+      this.runtimeToolReceiptCompletionsInFlight.set(
+        key,
+        (this.runtimeToolReceiptCompletionsInFlight.get(key) ?? 0) + 1,
       );
     }
-    return results;
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      for (const key of uniqueKeys) {
+        const count = this.runtimeToolReceiptCompletionsInFlight.get(key) ?? 0;
+        if (count <= 1) {
+          this.runtimeToolReceiptCompletionsInFlight.delete(key);
+        } else {
+          this.runtimeToolReceiptCompletionsInFlight.set(key, count - 1);
+        }
+      }
+    };
   }
 
   private async finalizeResolvedToolCall(
@@ -5514,6 +6010,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               activeRowsMemoryBudgetBytes:
                 mapMemoryLimits.activeRowsBudgetBytes,
               incrementalPersistence,
+              releasePersistedRowsOnMemoryPressure: true,
             },
           );
         } catch (error) {
@@ -5560,9 +6057,16 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         this.activeMapCellMeta = null;
         this.activeMapCheckpointUpdates = null;
 
+        for (const materializedRow of mapResult.previewRows) {
+          if (previewRows.length < 5) previewRows.push(materializedRow);
+        }
+        if (!mapResult.retainedRowsComplete) {
+          disableImmediateMaterializedCache(
+            'the current execution page exceeded the in-memory result budget',
+          );
+        }
         for (const row of mapResult.completedRows) {
           const materializedRow = this.toMaterializedOutputRow(row.data);
-          if (previewRows.length < 5) previewRows.push(materializedRow);
           if (
             immediateMaterializedCacheEnabled &&
             immediateMaterializedRows.length < materializedResultRowLimit
@@ -5607,8 +6111,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           }
         }
         executedCount += rowsToExecute.length;
-        successfulCount += mapResult.completedRows.length;
-        failedCount += mapResult.failedRows.length;
+        successfulCount += mapResult.completedRowCount;
+        failedCount += mapResult.failedRowCount;
         processedCount += rowsToExecute.length;
         page.rows.length = 0;
       }
@@ -6464,6 +6968,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       progressFailedOffset?: number;
       progressTotalRows?: number;
       incrementalPersistence?: RuntimeMapRowPersistence | null;
+      /**
+       * Runtime Sheet-backed maps may discard their optional in-memory result
+       * cache once it reaches the resident-byte budget. The durable sheet is
+       * already authoritative; retaining the same completed payloads until a
+       * source page ends must never turn a successful large map into an OOM.
+       */
+      releasePersistedRowsOnMemoryPressure?: boolean;
     },
   ): Promise<FieldMapRunResult> {
     const fieldEntries = Object.entries(definition);
@@ -6508,12 +7019,41 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     const failFastOnRowError = runtimeOptions?.onRowError === 'fail';
     const completedRowsToPersist: PersistableMapRow[] = [];
     const failedRowsToPersist: PersistableMapRow[] = [];
+    const previewRows: Record<string, unknown>[] = [];
+    let completedRowCount = 0;
+    let failedRowCount = 0;
+    let retainedRowsComplete = true;
     const incrementalPersistence =
       runtimeOptions?.incrementalPersistence ?? null;
+    let mapStallObserver: RuntimeMapStallObserver | null = null;
     const retainedRowsMemoryTracker = createRuntimeMapRetainedRowsTracker({
       mapName: normalizedTableNamespace,
       budgetBytes: runtimeOptions?.retainedRowsMemoryBudgetBytes,
     });
+    const retainPersistedRow = (
+      row: PersistableMapRow,
+      target: PersistableMapRow[],
+    ): void => {
+      if (!retainedRowsComplete) return;
+      try {
+        retainedRowsMemoryTracker.track(row);
+        target.push(row);
+      } catch (error) {
+        if (
+          !runtimeOptions?.releasePersistedRowsOnMemoryPressure ||
+          !incrementalPersistence ||
+          !(error instanceof RuntimeMapMemoryLimitError)
+        ) {
+          throw error;
+        }
+        completedRowsToPersist.length = 0;
+        failedRowsToPersist.length = 0;
+        retainedRowsComplete = false;
+        this.log(
+          `Dataset ${normalizedTableNamespace} released its in-memory result cache after ${completedRowCount + failedRowCount} row(s); using the durable Runtime Sheet.`,
+        );
+      }
+    };
     const enqueueIncrementalPersist = (
       row: PersistableMapRow,
       onCommitted: () => void,
@@ -6523,11 +7063,24 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         return Promise.resolve();
       }
       const settlement = incrementalPersistence.persistRows([row]);
-      void settlement.committed.then(onCommitted).catch(() => {
-        // The terminal map barrier awaits the writer and surfaces the same
-        // latched failure. This continuation only publishes durable progress.
-      });
-      return settlement.admitted;
+      const stall = mapStallObserver?.terminalQueued();
+      void settlement.committed
+        .then(() => {
+          stall?.committed();
+          onCommitted();
+        })
+        .catch(() => {
+          stall?.failed();
+          // The terminal map barrier awaits the writer and surfaces the same
+          // latched failure. This continuation only publishes durable progress.
+        });
+      return settlement.admitted.then(
+        () => stall?.admitted(),
+        (error) => {
+          stall?.failed();
+          throw error;
+        },
+      );
     };
 
     if (completedRows > 0 || pendingRows !== totalRows) {
@@ -6727,6 +7280,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           }),
         ),
         failedRows: [],
+        completedRowCount: results.length,
+        failedRowCount: 0,
+        previewRows: results.slice(0, 5),
+        retainedRowsComplete: true,
       };
     }
 
@@ -6771,6 +7328,16 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     this.resourceGovernor.observe({
       memoryBytes: rowAdmission.estimatedResidentBytes,
     });
+    mapStallObserver = new RuntimeMapStallObserver({
+      getWriterDiagnostics: () => incrementalPersistence?.diagnostics() ?? null,
+      log: (line) => this.log(line),
+      mapName: normalizedTableNamespace,
+      pageOffset:
+        runtimeOptions?.executionRowIndexes?.[0] ??
+        runtimeOptions?.progressCompletedOffset ??
+        0,
+      intervalMs: this.#options.runtimeMapStallLogIntervalMs,
+    });
     const settledResults = new Array<MapRowExecutionResult | undefined>(
       items.length,
     );
@@ -6803,6 +7370,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       const globalRowSlot = await this.resourceGovernor.acquireRow({
         estimatedBytes: runtimeMapJsonByteLength(baseRow),
       });
+      const resolverObservation = mapStallObserver?.resolverStarted();
+      let resolverObservationActive = resolverObservation !== undefined;
+      const finishResolver = () => {
+        if (!resolverObservationActive) return;
+        resolverObservationActive = false;
+        resolverObservation?.finish();
+      };
       try {
         for (const [fieldName, resolver] of fieldEntries) {
           activeFieldName = fieldName;
@@ -6834,6 +7408,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 tableNamespace: normalizedTableNamespace,
                 rowKey,
                 mapScope,
+                mapStallObserver: mapStallObserver ?? undefined,
+                mapStallResolverToken: resolverObservation?.token,
               },
               async () =>
                 await this.resolveMapFieldValue(
@@ -6860,7 +7436,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
 
             value = null;
             computedFields[fieldName] = value;
-            this.rowStates.get(idx)?.results.set(fieldName, value);
             const formattedError = this.formatRuntimeError(error);
             this.emitScopedFieldMetaUpdate({
               rowId: idx,
@@ -6888,8 +7463,16 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   : {}),
                 error: formattedError,
               });
-              retainedRowsMemoryTracker.track(failedRow);
-              failedRowsToPersist.push(failedRow);
+              // This row has not entered incremental persistence because the
+              // fail-fast error is about to unwind the resolver. Retain this
+              // one terminal fact even if the optional completed-row cache was
+              // already released, so the outer failure barrier can persist it.
+              if (retainedRowsComplete) {
+                retainPersistedRow(failedRow, failedRowsToPersist);
+              }
+              if (!retainedRowsComplete) {
+                failedRowsToPersist.push(failedRow);
+              }
               throw error;
             }
             const failedData = this.toPersistedOutputRow(
@@ -6903,8 +7486,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               ...(cellMetaPatch ? { cellMetaPatch } : {}),
               error: formattedError,
             });
-            retainedRowsMemoryTracker.track(failedRow);
-            failedRowsToPersist.push(failedRow);
+            failedRowCount += 1;
+            retainPersistedRow(failedRow, failedRowsToPersist);
             this.emitScopedRowUpdate(rowKey, normalizedTableNamespace, {
               rowId: idx,
               status: 'failed',
@@ -6913,6 +7496,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               error: formattedError,
               dataPatch: {},
             });
+            finishResolver();
             await enqueueIncrementalPersist(failedRow, () => {
               this.clearActiveMapCheckpointUpdate(
                 rowKey,
@@ -6923,7 +7507,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             return FAILED_ROW;
           }
           computedFields[fieldName] = cellValue;
-          this.rowStates.get(idx)?.results.set(fieldName, cellValue);
           const currentCellMeta =
             this.activeMapCellMeta?.get(rowKey)?.[fieldName];
           const currentCellRecord =
@@ -6975,6 +7558,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           });
         }
 
+        finishResolver();
         const merged = cloneCsvAliasedRow(baseRow, computedFields);
         activeFieldName = null;
         this.emitScopedRowUpdate(rowKey, normalizedTableNamespace, {
@@ -6985,7 +7569,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           error: null,
           dataPatch: {},
         });
-        const publicRow = this.toPublicOutputRow(merged);
         const completedRow: PersistableMapRow = completedMapRowOutcome({
           key: rowKey,
           inputIndex: rowIndex,
@@ -6994,13 +7577,16 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             ? { cellMetaPatch: this.activeMapCellMeta.get(rowKey) }
             : {}),
         });
-        retainedRowsMemoryTracker.track(completedRow);
-        completedRowsToPersist.push(completedRow);
+        completedRowCount += 1;
+        if (previewRows.length < 5) {
+          previewRows.push(this.toMaterializedOutputRow(completedRow.data));
+        }
+        retainPersistedRow(completedRow, completedRowsToPersist);
         await enqueueIncrementalPersist(completedRow, () => {
           this.clearActiveMapCheckpointUpdate(rowKey, normalizedTableNamespace);
           updateMapFrameProgress({ completedRowKey: rowKey });
         });
-        return publicRow;
+        return COMPLETED_ROW;
       } catch (error) {
         if (isPlayRowExecutionSuspendedError(error)) {
           this.pendingRowEventBoundaries.push(error.boundary);
@@ -7043,6 +7629,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         });
         throw error;
       } finally {
+        finishResolver();
         globalRowSlot.release();
       }
     };
@@ -7104,16 +7691,14 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         const rawItem = this.toOutputRow(
           items[index] as Record<string, unknown>,
         );
+        const key = executionRowKey(rawItem, index);
         if (result === WAITING_ROW) {
-          const key = executionRowKey(rawItem, index);
           if (key) {
             completedRowKeys.add(key);
           }
           accountedRowIndexes.add(executionRowIndex(index));
           continue;
         }
-        const row = result as Record<string, unknown>;
-        const key = executionRowKey(row, index);
         if (key) completedRowKeys.add(key);
       }
       this.setMapFrame({
@@ -7163,6 +7748,11 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         boundaries: uniqueBoundaries,
       });
     }
+    for (let index = 0; index < rowResults.length; index += 1) {
+      if (rowResults[index] !== WAITING_ROW) {
+        accountedRowIndexes.add(executionRowIndex(index));
+      }
+    }
     if (accountedRowIndexes.size !== items.length) {
       const expectedRowIndexes = items.map((_item, index) =>
         executionRowIndex(index),
@@ -7176,10 +7766,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           `missing input index(es): ${missingRowIndexes.slice(0, 10).join(', ') || 'unknown'}.`,
       );
     }
-    const results = rowResults.filter(
-      (result): result is Record<string, unknown> =>
-        result !== WAITING_ROW && result !== FAILED_ROW,
-    );
+    const succeededRows = rowResults.filter(
+      (result) => result === COMPLETED_ROW,
+    ).length;
     // A row is acknowledged only after its terminal sheet batch commits. The
     // incremental promises publish their frame updates from the commit
     // continuation, so this barrier also makes the terminal map event derive
@@ -7203,13 +7792,17 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       );
     }
     this.log(
-      `Map completed: ${results.length + completedRows} results (${results.length} succeeded, ${failedRowsToPersist.length} failed, ${completedRows} duplicate keys skipped)`,
+      `Map completed: ${succeededRows + completedRows} results (${succeededRows} succeeded, ${failedRowCount} failed, ${completedRows} duplicate keys skipped)`,
     );
     return {
       completedRows: [...completedRowsToPersist].sort(
         comparePersistableMapRowsByInputIndex,
       ),
       failedRows: failedRowsToPersist,
+      completedRowCount,
+      failedRowCount,
+      previewRows,
+      retainedRowsComplete,
     };
   }
 
@@ -7719,6 +8312,20 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     }
   }
 
+  private async rejectUnresolvedToolCalls(
+    requests: readonly ToolCallRequest[],
+    error: unknown,
+  ): Promise<void> {
+    await Promise.all(
+      requests.map(async (request) => {
+        if (!this.toolCallResolvers.has(request.callId)) return;
+        await this.rejectToolCall(request.toolId, request, error, {
+          persistReceiptFailure: false,
+        });
+      }),
+    );
+  }
+
   private takeDispatchableToolCalls(
     nowMs: number,
     blockedLaneKeys: ReadonlySet<string>,
@@ -7886,9 +8493,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             );
           }
           const tracked = this.executeBatchedToolCalls(dispatchable.requests)
-            .catch((error) => {
+            .catch(async (error) => {
               this.toolDispatcherFailure ??= error;
               this.rejectQueuedToolCalls(error);
+              await this.rejectUnresolvedToolCalls(
+                dispatchable.requests,
+                error,
+              );
             })
             .finally(() => {
               for (const laneKey of dispatchable.laneKeys) {
@@ -8059,6 +8670,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
 
     const executeTool = async (context?: {
       leaseId?: string | null;
+      retainExternalCallSlot?: (release: () => void) => void;
     }): Promise<unknown> => {
       if (eventWaitHandler) {
         return this.executeIntegrationEventWaitTool(
@@ -8190,6 +8802,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 options?.timeoutMs,
                 this.currentAuthoringContractEdition,
               ),
+              retainToolSlot: context?.retainExternalCallSlot,
               ...(directReceiptLeaseId &&
               (this.#options.heartbeatRuntimeStepReceipts ||
                 this.#options.getRuntimeStepReceipt ||
@@ -8406,7 +9019,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             shouldPersistFailure: (error) =>
               !(error instanceof ToolExecuteAuthScopeChangedError),
             markRunningBeforeExecute: false,
-            execute: ({ leaseId }) => executeTool({ leaseId }),
+            execute: ({ leaseId, retainExternalCallSlot }) =>
+              executeTool({ leaseId, retainExternalCallSlot }),
             runningReceiptWaitMaxAttempts:
               resolveRuntimeToolReceiptWaitMaxAttempts(
                 options?.receiptWaitMs !== undefined
@@ -8943,7 +9557,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     assertSecretAuthUsesTls(init.auth, input, 'ctx.fetch');
     const secretHeaderMarkers = secretAuthHeaderMarkers(init.auth);
 
-    return this.executeWithRuntimeReceipt<PlayFetchResponse>(
+    const execution = this.executeWithRuntimeReceipt<PlayFetchResponse>(
       'fetch',
       normalizedKey,
       this.currentRunId,
@@ -8961,7 +9575,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           }),
         ),
         staleAfterSeconds: options?.staleAfterSeconds,
-        execute: async () => {
+        execute: async ({ retainExternalCallSlot }) => {
           const url = input.toString();
           const method = (init.method ?? 'GET').toUpperCase();
           const secretHeaders = await this.resolveSecretAuth(init.auth);
@@ -8989,6 +9603,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const existing = this.checkpoint.resolvedBoundaries?.[boundaryId];
           if (existing?.kind === 'fetch' && 'output' in existing) {
             this.log(`ctx.fetch(${url}): recovered response from checkpoint`);
+            if (this.durableDirectToolResultsBackedByReceipts) {
+              // The outer durable receipt is the replay authority in hosted
+              // runtimes. A legacy checkpoint fetch may seed that receipt
+              // once, but it must not remain as a second full response-body
+              // cache for the lifetime of a large map.
+              delete this.checkpoint.resolvedBoundaries?.[boundaryId];
+            }
             return existing.output as PlayFetchResponse;
           }
 
@@ -9011,7 +9632,28 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             providerResourceKey: CTX_FETCH_EGRESS_TOOL_ID,
             toolId: CTX_FETCH_EGRESS_TOOL_ID,
           });
+          retainExternalCallSlot(() => egressSlot.release());
+          const finishFetchObservation =
+            rowStore?.mapStallObserver?.fetchStarted(
+              rowStore.mapStallResolverToken,
+            );
+          const fetchDeadline: CtxFetchDeadline = {
+            startedAt: Date.now(),
+            headersMs: positiveTimeoutMs(
+              this.#options.ctxFetchTimeouts?.headersMs,
+              CTX_FETCH_HEADERS_TIMEOUT_MS,
+            ),
+            bodyMs: positiveTimeoutMs(
+              this.#options.ctxFetchTimeouts?.bodyMs,
+              CTX_FETCH_BODY_TIMEOUT_MS,
+            ),
+            totalMs: positiveTimeoutMs(
+              this.#options.ctxFetchTimeouts?.totalMs,
+              CTX_FETCH_TOTAL_TIMEOUT_MS,
+            ),
+          };
           let response: Response | null = null;
+          let bodyText: string | null = null;
           try {
             const canRetryTransport = ['GET', 'HEAD', 'OPTIONS'].includes(
               method,
@@ -9022,13 +9664,40 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               attempt <= FETCH_TRANSPORT_MAX_ATTEMPTS;
               attempt += 1
             ) {
+              const attemptController = new AbortController();
               try {
-                response = await safePublicFetch(url, fetchInit, {
-                  fetchImpl: this.#options.fetchImpl,
-                  sensitiveHeaders: Object.keys(secretHeaderMarkers),
+                const attemptInit = {
+                  ...fetchInit,
+                  signal: init.signal
+                    ? AbortSignal.any([init.signal, attemptController.signal])
+                    : attemptController.signal,
+                };
+                response = await runCtxFetchPhase({
+                  callerSignal: init.signal,
+                  controller: attemptController,
+                  deadline: fetchDeadline,
+                  phase: 'headers',
+                  run: () =>
+                    safePublicFetch(url, attemptInit, {
+                      fetchImpl: this.#options.fetchImpl,
+                      sensitiveHeaders: Object.keys(secretHeaderMarkers),
+                    }),
+                });
+                bodyText = await readCtxFetchBody({
+                  callerSignal: init.signal,
+                  controller: attemptController,
+                  deadline: fetchDeadline,
+                  response,
                 });
                 break;
               } catch (error) {
+                void response?.body?.cancel(error).catch(() => undefined);
+                response = null;
+                bodyText = null;
+                if (error instanceof CtxFetchTimeoutError) throw error;
+                if (init.signal?.aborted) {
+                  throw init.signal.reason ?? error;
+                }
                 if (isUnsafeOutboundUrlError(error)) {
                   throw error;
                 }
@@ -9041,12 +9710,11 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   this.log(
                     `ctx.fetch(${method} ${url}) transport failed on attempt ${attempt}/${FETCH_TRANSPORT_MAX_ATTEMPTS}; retrying: ${message}`,
                   );
-                  await new Promise((resolve) =>
-                    setTimeout(
-                      resolve,
-                      FETCH_TRANSPORT_RETRY_DELAY_MS * attempt,
-                    ),
-                  );
+                  await sleepWithinCtxFetchDeadline({
+                    callerSignal: init.signal,
+                    deadline: fetchDeadline,
+                    delayMs: FETCH_TRANSPORT_RETRY_DELAY_MS * attempt,
+                  });
                   continue;
                 }
                 throw new Error(
@@ -9059,7 +9727,11 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 `ctx.fetch(${method} ${url}) failed before receiving a response.`,
               );
             }
-            const bodyText = await response.text();
+            if (bodyText === null) {
+              throw new Error(
+                `ctx.fetch(${method} ${url}) failed while reading the response body.`,
+              );
+            }
             const redactedBodyText = this.secretRedactor.redactString(bodyText);
             const output: PlayFetchResponse = {
               ok: response.ok,
@@ -9075,24 +9747,27 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               ),
             };
 
-            this.checkpoint.resolvedBoundaries = {
-              ...(this.checkpoint.resolvedBoundaries ?? {}),
-              [boundaryId]: {
-                kind: 'fetch',
-                url,
-                method,
-                output,
-                completedAt: Date.now(),
-              },
-            };
-            this.#options.onBatchComplete?.(this.checkpoint);
-            return output;
-          } finally {
-            egressSlot.release();
-          }
-        },
+            if (!this.durableDirectToolResultsBackedByReceipts) {
+              this.checkpoint.resolvedBoundaries = {
+                ...(this.checkpoint.resolvedBoundaries ?? {}),
+                [boundaryId]: {
+                  kind: 'fetch',
+                  url,
+                  method,
+                  output,
+                  completedAt: Date.now(),
+                },
+              };
+              this.#options.onBatchComplete?.(this.checkpoint);
+            }
+            return output;
+          } finally {
+            finishFetchObservation?.();
+          }
+        },
       },
     );
+    return execution;
   }
 
   async step<T>(
@@ -9213,9 +9888,14 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
 
   // ——— Batched tool call execution ———
 
-  private startPendingToolReceiptHeartbeat(requests: ToolCallRequest[]): {
+  private startPendingToolReceiptHeartbeat(
+    requests: ToolCallRequest[],
+    claimsEstablishedExecutionFence: boolean,
+  ): {
     stop: () => void;
     leaseLost: () => unknown | null;
+    confirmOwned: () => Promise<void>;
+    assertOwned: () => void;
   } | null {
     const heartbeatReceipts = this.#options.heartbeatRuntimeStepReceipts;
     const ownedRequests = requests.filter(
@@ -9235,66 +9915,87 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       null,
     );
     let leaseLost: unknown | null = null;
-    const supervisor = createRuntimeReceiptHeartbeatSupervisor({
-      intervalMs: runtimeLeaseHeartbeatIntervalFromExpiry({
-        leaseExpiresAt: earliestLeaseExpiry,
-        fallbackTtlMs: PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
-      }),
-      heartbeat: async () => {
-        // Receipt claims are acquired in bulk before the provider-shaped
-        // dispatcher admits every call. Renew the undispatched tail as well as
-        // in-flight calls; otherwise a slow provider can let later claims
-        // expire while they are still waiting behind the concurrency gate.
-        const unsettled = ownedRequests.filter((request) =>
-          this.toolCallResolvers.has(request.callId),
-        );
-        if (unsettled.length === 0) return 'terminal';
-        const byReceiptKey = new Map<string, ToolCallRequest[]>();
-        for (const request of unsettled) {
-          const receiptKey = request.receiptKey!;
-          const group = byReceiptKey.get(receiptKey) ?? [];
-          group.push(request);
-          byReceiptKey.set(receiptKey, group);
+    let ownershipConfirmedUntilMs = Number.isFinite(
+      Date.parse(earliestLeaseExpiry ?? ''),
+    )
+      ? Date.parse(earliestLeaseExpiry!)
+      : Date.now() + PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS;
+    const firstOwnedRequest = ownedRequests[0]!;
+    const heartbeatOwnedRequests = async () => {
+      // Receipt claims are acquired in bulk before the provider-shaped
+      // dispatcher admits every call. Renew the undispatched tail as well as
+      // in-flight calls; otherwise a slow provider can let later claims
+      // expire while they are still waiting behind the concurrency gate.
+      const unsettled = ownedRequests.filter((request) =>
+        this.toolCallResolvers.has(request.callId),
+      );
+      if (unsettled.length === 0) return 'terminal' as const;
+      const byReceiptKey = new Map<string, ToolCallRequest[]>();
+      for (const request of unsettled) {
+        const receiptKey = request.receiptKey!;
+        const group = byReceiptKey.get(receiptKey) ?? [];
+        group.push(request);
+        byReceiptKey.set(receiptKey, group);
+      }
+      // One content-addressed receipt can have many same-run followers. The
+      // store renews unique receipt rows, not request positions, so dedupe by
+      // key while preserving the matching per-row lease id.
+      const entries = [...byReceiptKey];
+      const keys = entries.map(([receiptKey]) => receiptKey);
+      const leaseIds = entries.map(
+        ([, requests]) => requests[0]!.receiptLeaseId!,
+      );
+      const receipts = await heartbeatReceipts({
+        runId: this.currentReceiptOwnerRunId,
+        runAttempt: this.currentRunAttempt,
+        keys,
+        leaseIds,
+      });
+      const renewedExpiries: number[] = [];
+      for (let index = 0; index < entries.length; index += 1) {
+        const [receiptKey, requests] = entries[index]!;
+        const leaseId = leaseIds[index]!;
+        // Completion can race this bulk heartbeat response. A settled
+        // receipt group no longer needs ownership and must not turn that
+        // race into a false lease-loss failure or hold the confirmation
+        // horizon at its old expiry.
+        if (
+          this.runtimeToolReceiptCompletionsInFlight.has(receiptKey) ||
+          !requests.some((request) =>
+            this.toolCallResolvers.has(request.callId),
+          )
+        ) {
+          continue;
         }
-        // One content-addressed receipt can have many same-run followers. The
-        // store renews unique receipt rows, not request positions, so dedupe by
-        // key while preserving the matching per-row lease id.
-        const entries = [...byReceiptKey];
-        const keys = entries.map(([receiptKey]) => receiptKey);
-        const leaseIds = entries.map(
-          ([, requests]) => requests[0]!.receiptLeaseId!,
-        );
-        const receipts = await heartbeatReceipts({
-          runId: this.currentReceiptOwnerRunId,
-          runAttempt: this.currentRunAttempt,
-          keys,
-          leaseIds,
-        });
-        for (let index = 0; index < entries.length; index += 1) {
-          const [receiptKey, requests] = entries[index]!;
-          const leaseId = leaseIds[index]!;
-          // Completion can race this bulk heartbeat response. A settled
-          // receipt group no longer needs ownership and must not turn that
-          // race into a false lease-loss failure.
-          if (
-            !requests.some((request) =>
-              this.toolCallResolvers.has(request.callId),
-            )
-          ) {
-            continue;
-          }
-          if (
-            !this.runtimeToolReceiptStillOwned(receipts[index] ?? null, leaseId)
-          ) {
-            throw new RuntimeReceiptLeaseLostError({
-              receiptKey,
-              runId: this.currentReceiptOwnerRunId,
-              leaseId,
-            });
-          }
+        const receipt = receipts[index] ?? null;
+        const renewedExpiryMs = Date.parse(receipt?.leaseExpiresAt ?? '');
+        if (
+          !this.runtimeToolReceiptStillOwned(receipt, leaseId) ||
+          !Number.isFinite(renewedExpiryMs)
+        ) {
+          throw new RuntimeReceiptLeaseLostError({
+            receiptKey,
+            runId: this.currentReceiptOwnerRunId,
+            leaseId,
+          });
         }
-        return 'active';
-      },
+        renewedExpiries.push(renewedExpiryMs);
+      }
+      if (renewedExpiries.length === 0) return 'terminal' as const;
+      ownershipConfirmedUntilMs = Math.min(...renewedExpiries);
+      return 'active' as const;
+    };
+    const perCallHeartbeatIntervalMs = runtimeLeaseHeartbeatIntervalFromExpiry({
+      leaseExpiresAt: earliestLeaseExpiry,
+      fallbackTtlMs: PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
+    });
+    const supervisor = createRuntimeReceiptHeartbeatSupervisor({
+      // The cohort owns claims that have not reached provider admission yet.
+      // Renew it before the one-call supervisors can win the same short-lease
+      // timer race, so the queued tail remains fenced while the active call
+      // consumes the provider concurrency slot.
+      intervalMs: Math.max(1, Math.floor(perCallHeartbeatIntervalMs / 2)),
+      heartbeat: heartbeatOwnedRequests,
       isLeaseLost: (error) => error instanceof RuntimeReceiptLeaseLostError,
       onLeaseLost: (error) => {
         leaseLost ??= error;
@@ -9305,10 +10006,32 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         );
       },
     });
-    supervisor.start();
     return {
       stop: () => supervisor.stop(),
       leaseLost: () => leaseLost,
+      confirmOwned: async () => {
+        // The scheduler receipt gateway returns `running` from an atomic
+        // claim. That claim is already the provider-execution fence, so short
+        // calls only need scheduled renewal if they approach lease expiry.
+        // Other callers may still return queued/pending claims or omit the
+        // explicit backend capability; retain the immediate ownership check
+        // for those receipts.
+        if (claimsEstablishedExecutionFence) {
+          supervisor.start();
+          return;
+        }
+        const outcome = await heartbeatOwnedRequests();
+        if (outcome === 'active') supervisor.start();
+      },
+      assertOwned: () => {
+        if (leaseLost) throw leaseLost;
+        if (Date.now() < ownershipConfirmedUntilMs) return;
+        throw new RuntimeReceiptLeaseLostError({
+          receiptKey: firstOwnedRequest.receiptKey!,
+          runId: this.currentReceiptOwnerRunId,
+          leaseId: firstOwnedRequest.receiptLeaseId!,
+        });
+      },
     };
   }
 
@@ -9368,6 +10091,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         };
 
         const pendingRequests: ToolCallRequest[] = [];
+        let pendingReceiptClaimsEstablishExecutionFence =
+          this.#options.runtimeReceiptClaimsEstablishExecutionFence === true;
         const recoveredRequests: ToolCallRequest[] = [];
         for (const req of requests) {
           const cached =
@@ -9495,504 +10220,611 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           forceAfterWait: boolean;
           waitMaxAttempts?: number;
         }> = [];
-        let durableExistingRunningHandler: Promise<void> | null = null;
+        const durableExistingRunningState: {
+          settlement: Promise<
+            { status: 'fulfilled' } | { status: 'rejected'; reason: unknown }
+          > | null;
+        } = { settlement: null };
+        const durableExistingRunningAbort = new AbortController();
         if (
           pendingRequests.length > 0 &&
           (this.#options.claimRuntimeStepReceipts ||
             this.#options.claimRuntimeStepReceipt)
         ) {
-          const requestsByReceiptKey = new Map<
-            string,
-            {
-              requests: ToolCallRequest[];
-              forceRefresh: boolean;
-              forceFailedRefresh: boolean;
-            }
-          >();
-          const localOnlyRequests: ToolCallRequest[] = [];
-          for (const request of pendingRequests) {
-            const receiptKey = request.receiptKey?.trim() || null;
-            if (!receiptKey) {
-              localOnlyRequests.push(request);
-              continue;
+          await this.withRuntimeReceiptHydrationTurn(async () => {
+            const requestsByReceiptKey = new Map<
+              string,
+              {
+                requests: ToolCallRequest[];
+                forceRefresh: boolean;
+                forceFailedRefresh: boolean;
+              }
+            >();
+            const localOnlyRequests: ToolCallRequest[] = [];
+            for (const request of pendingRequests) {
+              const receiptKey = request.receiptKey?.trim() || null;
+              if (!receiptKey) {
+                localOnlyRequests.push(request);
+                continue;
+              }
+              const group = requestsByReceiptKey.get(receiptKey) ?? {
+                requests: [],
+                forceRefresh: false,
+                forceFailedRefresh: false,
+              };
+              group.requests.push(request);
+              group.forceRefresh ||= request.force === true;
+              group.forceFailedRefresh ||= request.forceFailedRefresh === true;
+              requestsByReceiptKey.set(receiptKey, group);
             }
-            const group = requestsByReceiptKey.get(receiptKey) ?? {
-              requests: [],
-              forceRefresh: false,
-              forceFailedRefresh: false,
-            };
-            group.requests.push(request);
-            group.forceRefresh ||= request.force === true;
-            group.forceFailedRefresh ||= request.forceFailedRefresh === true;
-            requestsByReceiptKey.set(receiptKey, group);
-          }
-          const normalReceiptKeys = [...requestsByReceiptKey]
-            .filter(
-              ([, group]) => !group.forceRefresh && !group.forceFailedRefresh,
-            )
-            .map(([receiptKey]) => receiptKey);
-          const forcedReceiptKeys = [...requestsByReceiptKey]
-            .filter(([, group]) => group.forceRefresh)
-            .map(([receiptKey]) => receiptKey);
-          const failedRefreshReceiptKeys = [...requestsByReceiptKey]
-            .filter(
-              ([, group]) => !group.forceRefresh && group.forceFailedRefresh,
-            )
-            .map(([receiptKey]) => receiptKey);
-          const forcedExisting = forcedReceiptKeys.length
-            ? await this.getRuntimeStepReceipts(forcedReceiptKeys)
-            : new Map<string, RuntimeStepReceipt>();
-          // A forced refresh must never duplicate a provider call owned by a
-          // live lease. It can, however, immediately claim pending/unleased
-          // work and any expired lease. Waiting first for those receipts turns
-          // an already-recoverable interruption into a five-minute stall.
-          const forcedLiveReceiptKeys = new Set(
-            [...forcedExisting]
-              .filter(([, receipt]) => {
-                if (
-                  receipt.status !== 'queued' &&
-                  receipt.status !== 'pending' &&
-                  receipt.status !== 'running'
-                ) {
-                  return false;
-                }
-                if (!receipt.leaseId?.trim()) return false;
-                const expiresAt = receipt.leaseExpiresAt
-                  ? Date.parse(receipt.leaseExpiresAt)
-                  : Number.NaN;
-                // Keep an unparseable leased receipt conservative. The
-                // fenced claim remains the recovery path after the wait.
-                return !Number.isFinite(expiresAt) || expiresAt > Date.now();
-              })
-              .map(([receiptKey]) => receiptKey),
-          );
-          const claimableForcedReceiptKeys = forcedReceiptKeys.filter(
-            (receiptKey) => !forcedLiveReceiptKeys.has(receiptKey),
-          );
-          const claims =
-            normalReceiptKeys.length > 0
-              ? await this.claimRuntimeStepReceipts(
-                  normalReceiptKeys,
-                  this.currentReceiptOwnerRunId,
-                )
-              : new Map<string, RuntimeStepReceipt>();
-          const forcedClaims =
-            claimableForcedReceiptKeys.length > 0
-              ? await this.claimRuntimeStepReceipts(
-                  claimableForcedReceiptKeys,
-                  this.currentReceiptOwnerRunId,
-                  false,
-                  true,
-                )
-              : new Map<string, RuntimeStepReceipt>();
-          const failedRefreshClaims =
-            failedRefreshReceiptKeys.length > 0
-              ? await this.claimRuntimeStepReceipts(
-                  failedRefreshReceiptKeys,
-                  this.currentReceiptOwnerRunId,
-                  false,
-                  false,
-                  true,
-                )
+            const normalReceiptKeys = [...requestsByReceiptKey]
+              .filter(
+                ([, group]) => !group.forceRefresh && !group.forceFailedRefresh,
+              )
+              .map(([receiptKey]) => receiptKey);
+            const forcedReceiptKeys = [...requestsByReceiptKey]
+              .filter(([, group]) => group.forceRefresh)
+              .map(([receiptKey]) => receiptKey);
+            const failedRefreshReceiptKeys = [...requestsByReceiptKey]
+              .filter(
+                ([, group]) => !group.forceRefresh && group.forceFailedRefresh,
+              )
+              .map(([receiptKey]) => receiptKey);
+            const forcedExisting = forcedReceiptKeys.length
+              ? await this.getRuntimeStepReceipts(forcedReceiptKeys)
               : new Map<string, RuntimeStepReceipt>();
-          for (const [receiptKey, claim] of forcedClaims) {
-            claims.set(receiptKey, claim);
-          }
-          for (const [receiptKey, claim] of failedRefreshClaims) {
-            claims.set(receiptKey, claim);
-          }
-          const claimedRequests: ToolCallRequest[] = [...localOnlyRequests];
-          const durableRecoveredRequests: ToolCallRequest[] = [];
-          const resolveRequestsFromReceipt = async (
-            requestsForKey: ToolCallRequest[],
-            receipt: RuntimeStepReceipt,
-            source: 'cache' | 'in_flight',
-          ): Promise<void> => {
-            const request = requestsForKey[0];
-            if (!request) return;
-            const receiptKey = request.receiptKey?.trim() || null;
-            if (!receiptKey) {
-              throw new Error(`${source} tool recovery needs receipt key.`);
-            }
-            const wrapped = await this.wrapToolExecutionResult({
-              toolId,
-              status:
-                receipt.output === null || receipt.output === undefined
-                  ? 'no_result'
-                  : 'completed',
-              result: this.runtimeReceiptOutput(receipt),
-              requestInput: request.input,
-              execution: toolExecutionMetadataForOutcome({
-                kind: source,
-                cacheKey: request.cacheKey,
-                receiptKey,
-                attachedToReceiptKey: receiptKey,
-              }),
-            });
-            this.cacheToolResult(toolId, request.cacheKey, wrapped);
-            for (const waitingRequest of requestsForKey) {
-              successfulLiveStepCallIds.add(waitingRequest.callId);
-              const resolver = this.toolCallResolvers.get(
-                waitingRequest.callId,
-              );
-              if (resolver) {
-                resolver.resolve(wrapped);
-                this.toolCallResolvers.delete(waitingRequest.callId);
-              }
-              this.emitScopedFieldMetaUpdate({
-                rowId: waitingRequest.rowId,
-                key: waitingRequest.rowKey ?? null,
-                tableNamespace: waitingRequest.tableNamespace ?? null,
-                fieldName: waitingRequest.fieldName,
-                status: 'cached',
-                rowStatus: 'running',
-                stage: toolId,
-                provider: null,
-                error: null,
-                reused: true,
-                dataPatch: {},
-              });
+            // A forced refresh must never duplicate a provider call owned by a
+            // live lease. It can, however, immediately claim pending/unleased
+            // work and any expired lease. Waiting first for those receipts turns
+            // an already-recoverable interruption into a five-minute stall.
+            const forcedLiveReceiptKeys = new Set(
+              [...forcedExisting]
+                .filter(([, receipt]) => {
+                  if (
+                    receipt.status !== 'queued' &&
+                    receipt.status !== 'pending' &&
+                    receipt.status !== 'running'
+                  ) {
+                    return false;
+                  }
+                  if (!receipt.leaseId?.trim()) return false;
+                  const expiresAt = receipt.leaseExpiresAt
+                    ? Date.parse(receipt.leaseExpiresAt)
+                    : Number.NaN;
+                  // Keep an unparseable leased receipt conservative. The
+                  // fenced claim remains the recovery path after the wait.
+                  return !Number.isFinite(expiresAt) || expiresAt > Date.now();
+                })
+                .map(([receiptKey]) => receiptKey),
+            );
+            const claimableForcedReceiptKeys = forcedReceiptKeys.filter(
+              (receiptKey) => !forcedLiveReceiptKeys.has(receiptKey),
+            );
+            const claims =
+              normalReceiptKeys.length > 0
+                ? await this.claimRuntimeStepReceipts(
+                    normalReceiptKeys,
+                    this.currentReceiptOwnerRunId,
+                  )
+                : new Map<string, RuntimeStepReceipt>();
+            const forcedClaims =
+              claimableForcedReceiptKeys.length > 0
+                ? await this.claimRuntimeStepReceipts(
+                    claimableForcedReceiptKeys,
+                    this.currentReceiptOwnerRunId,
+                    false,
+                    true,
+                  )
+                : new Map<string, RuntimeStepReceipt>();
+            const failedRefreshClaims =
+              failedRefreshReceiptKeys.length > 0
+                ? await this.claimRuntimeStepReceipts(
+                    failedRefreshReceiptKeys,
+                    this.currentReceiptOwnerRunId,
+                    false,
+                    false,
+                    true,
+                  )
+                : new Map<string, RuntimeStepReceipt>();
+            for (const [receiptKey, claim] of forcedClaims) {
+              claims.set(receiptKey, claim);
             }
-          };
-          const claimOwnerWithLiveFollowers = (
-            owner: ToolCallRequest | undefined,
-            followers: ToolCallRequest[],
-          ): void => {
-            if (!owner) return;
-            claimedRequests.push(owner);
-            if (followers.length > 0) {
-              liveFollowersByOwnerCallId.set(owner.callId, followers);
+            for (const [receiptKey, claim] of failedRefreshClaims) {
+              claims.set(receiptKey, claim);
             }
-          };
-          const resolveReceiptWaitMaxAttempts = (
-            requestsForKey: ToolCallRequest[],
-          ): number | undefined =>
-            requestsForKey.length > 0
-              ? Math.max(
-                  ...requestsForKey.map((request) =>
-                    resolveRuntimeToolReceiptWaitMaxAttempts(
-                      typeof request.receiptWaitMs === 'number'
-                        ? { max_wait_ms: request.receiptWaitMs }
-                        : request.input,
-                    ),
-                  ),
-                )
-              : undefined;
-          const queueExistingRunningReceiptWait = (
-            receiptKey: string,
-            requestsForKey: ToolCallRequest[],
-            forceAfterWait = false,
-          ): void => {
-            durableExistingRunningWaits.push({
-              receiptKey,
-              requestsForKey,
-              forceAfterWait,
-              waitMaxAttempts: resolveReceiptWaitMaxAttempts(requestsForKey),
-            });
-          };
-          const reclaimExistingRunningReceiptAfterWait = async (
-            receiptKey: string,
-            requestsForKey: ToolCallRequest[],
-            forceAfterWait = false,
-            waitResult?: {
-              completedReceipt?: RuntimeStepReceipt;
-              skipWait?: boolean;
-            },
-          ): Promise<void> => {
-            if (waitResult?.completedReceipt) {
-              if (!forceAfterWait) {
-                await resolveRequestsFromReceipt(
-                  requestsForKey,
-                  waitResult.completedReceipt,
-                  'in_flight',
-                );
-                return;
+            const claimedRequests: ToolCallRequest[] = [...localOnlyRequests];
+            const durableRecoveredRequests: ToolCallRequest[] = [];
+            const resolveRequestsFromReceipt = async (
+              requestsForKey: ToolCallRequest[],
+              receipt: RuntimeStepReceipt,
+              source: 'cache' | 'in_flight',
+            ): Promise<void> => {
+              const request = requestsForKey[0];
+              if (!request) return;
+              const receiptKey = request.receiptKey?.trim() || null;
+              if (!receiptKey) {
+                throw new Error(`${source} tool recovery needs receipt key.`);
               }
-            } else if (waitResult?.skipWait !== true) {
-              const waitMaxAttempts =
-                resolveReceiptWaitMaxAttempts(requestsForKey);
-              try {
-                const completed = await this.waitForCompletedRuntimeToolReceipt(
+              const wrapped = await this.wrapToolExecutionResult({
+                toolId,
+                status:
+                  receipt.output === null || receipt.output === undefined
+                    ? 'no_result'
+                    : 'completed',
+                result: this.runtimeReceiptOutput(receipt),
+                requestInput: request.input,
+                execution: toolExecutionMetadataForOutcome({
+                  kind: source,
+                  cacheKey: request.cacheKey,
                   receiptKey,
-                  waitMaxAttempts,
+                  attachedToReceiptKey: receiptKey,
+                }),
+              });
+              this.cacheToolResult(toolId, request.cacheKey, wrapped);
+              for (const waitingRequest of requestsForKey) {
+                successfulLiveStepCallIds.add(waitingRequest.callId);
+                const resolver = this.toolCallResolvers.get(
+                  waitingRequest.callId,
                 );
+                if (resolver) {
+                  resolver.resolve(wrapped);
+                  this.toolCallResolvers.delete(waitingRequest.callId);
+                }
+                this.emitScopedFieldMetaUpdate({
+                  rowId: waitingRequest.rowId,
+                  key: waitingRequest.rowKey ?? null,
+                  tableNamespace: waitingRequest.tableNamespace ?? null,
+                  fieldName: waitingRequest.fieldName,
+                  status: 'cached',
+                  rowStatus: 'running',
+                  stage: toolId,
+                  provider: null,
+                  error: null,
+                  reused: true,
+                  dataPatch: {},
+                });
+              }
+            };
+            const claimOwnerWithLiveFollowers = (
+              owner: ToolCallRequest | undefined,
+              followers: ToolCallRequest[],
+            ): void => {
+              if (!owner) return;
+              claimedRequests.push(owner);
+              if (followers.length > 0) {
+                liveFollowersByOwnerCallId.set(owner.callId, followers);
+              }
+            };
+            const resolveReceiptWaitMaxAttempts = (
+              requestsForKey: ToolCallRequest[],
+            ): number | undefined =>
+              requestsForKey.length > 0
+                ? Math.max(
+                    ...requestsForKey.map((request) =>
+                      resolveRuntimeToolReceiptWaitMaxAttempts(
+                        typeof request.receiptWaitMs === 'number'
+                          ? { max_wait_ms: request.receiptWaitMs }
+                          : request.input,
+                      ),
+                    ),
+                  )
+                : undefined;
+            const queueExistingRunningReceiptWait = (
+              receiptKey: string,
+              requestsForKey: ToolCallRequest[],
+              forceAfterWait = false,
+            ): void => {
+              durableExistingRunningWaits.push({
+                receiptKey,
+                requestsForKey,
+                forceAfterWait,
+                waitMaxAttempts: resolveReceiptWaitMaxAttempts(requestsForKey),
+              });
+            };
+            const reclaimExistingRunningReceiptAfterWait = async (
+              receiptKey: string,
+              requestsForKey: ToolCallRequest[],
+              forceAfterWait = false,
+              waitResult?: {
+                completedReceipt?: RuntimeStepReceipt;
+                skipWait?: boolean;
+              },
+            ): Promise<void> => {
+              if (waitResult?.completedReceipt) {
                 if (!forceAfterWait) {
                   await resolveRequestsFromReceipt(
                     requestsForKey,
-                    completed,
+                    waitResult.completedReceipt,
                     'in_flight',
                   );
                   return;
                 }
-              } catch (error) {
-                if (!(error instanceof RuntimeReceiptWaitTimeoutError)) {
-                  for (const request of requestsForKey) {
-                    await this.rejectToolCall(toolId, request, error, {
-                      persistReceiptFailure: false,
-                    });
+              } else if (waitResult?.skipWait !== true) {
+                const waitMaxAttempts =
+                  resolveReceiptWaitMaxAttempts(requestsForKey);
+                try {
+                  const completed =
+                    await this.waitForCompletedRuntimeToolReceipt(
+                      receiptKey,
+                      waitMaxAttempts,
+                    );
+                  if (!forceAfterWait) {
+                    await resolveRequestsFromReceipt(
+                      requestsForKey,
+                      completed,
+                      'in_flight',
+                    );
+                    return;
+                  }
+                } catch (error) {
+                  if (!(error instanceof RuntimeReceiptWaitTimeoutError)) {
+                    for (const request of requestsForKey) {
+                      await this.rejectToolCall(toolId, request, error, {
+                        persistReceiptFailure: false,
+                      });
+                    }
+                    return;
                   }
-                  return;
                 }
               }
-            }
-            const reclaimed = (
-              await this.claimRuntimeStepReceipts(
-                [receiptKey],
-                this.currentReceiptOwnerRunId,
-                true,
-                forceAfterWait,
-              )
-            ).get(receiptKey);
-            if (
-              reclaimed?.status === 'completed' ||
-              reclaimed?.status === 'skipped'
-            ) {
-              await resolveRequestsFromReceipt(
-                requestsForKey,
-                reclaimed,
-                'cache',
-              );
-              durableRecoveredRequests.push(...requestsForKey);
-              return;
-            }
-            if (reclaimed?.status === 'failed') {
+              const reclaimed = (
+                await this.claimRuntimeStepReceipts(
+                  [receiptKey],
+                  this.currentReceiptOwnerRunId,
+                  true,
+                  forceAfterWait,
+                )
+              ).get(receiptKey);
+              if (
+                reclaimed?.status === 'completed' ||
+                reclaimed?.status === 'skipped'
+              ) {
+                await resolveRequestsFromReceipt(
+                  requestsForKey,
+                  reclaimed,
+                  'cache',
+                );
+                durableRecoveredRequests.push(...requestsForKey);
+                return;
+              }
+              if (reclaimed?.status === 'failed') {
+                for (const request of requestsForKey) {
+                  await this.rejectToolCall(
+                    toolId,
+                    request,
+                    runtimeReceiptFailureError(
+                      reclaimed,
+                      'Durable tool call failed',
+                      this.currentToolErrorSchemaVersion,
+                    ),
+                  );
+                }
+                return;
+              }
+              if (this.isOwnedClaimedRuntimeReceipt(reclaimed)) {
+                const [owner, ...waiters] = requestsForKey;
+                if (!owner) return;
+                if (!reclaimed.leaseId) {
+                  throw new RuntimeReceiptLeaseLostError({
+                    receiptKey,
+                    runId: this.currentReceiptOwnerRunId,
+                    leaseId: 'missing',
+                  });
+                }
+                owner.receiptLeaseId = reclaimed.leaseId ?? null;
+                owner.receiptLeaseExpiresAt = reclaimed.leaseExpiresAt ?? null;
+                if (waiters.length > 0) {
+                  liveFollowersByOwnerCallId.set(owner.callId, waiters);
+                }
+                try {
+                  const execution = await this.callToolExecutionAPI(
+                    toolId,
+                    owner.input,
+                    {
+                      beforeProviderCall: () =>
+                        this.assertRuntimeToolReceiptOwnership([owner]),
+                      durableCallReceiptKey: receiptKey,
+                      playNodeScope: playNodeScopeForToolCallRequest(owner),
+                      executionAuthScopeDigest: owner.executionAuthScopeDigest,
+                      receiptLeaseExpiresAt: owner.receiptLeaseExpiresAt,
+                      heartbeatReceipt: () =>
+                        this.renewRuntimeToolReceiptOwnership([owner]),
+                      providerIdempotencyKey:
+                        this.providerIdempotencyKeyForToolCall({
+                          cacheKey: owner.cacheKey,
+                          force: owner.force === true,
+                          leaseId: owner.receiptLeaseId,
+                        }),
+                      timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners([
+                        owner,
+                      ]),
+                    },
+                  );
+                  const result = await this.resolveToolCall(
+                    toolId,
+                    owner,
+                    execution?.result ?? null,
+                    execution?.metadata ?? null,
+                    execution?.jobId,
+                    execution?.meta,
+                  );
+                  if (result != null) {
+                    successfulLiveStepCallIds.add(owner.callId);
+                  }
+                  resolveLiveFollowers(owner, result);
+                  recordToolStep([owner]);
+                  this.#options.onBatchComplete?.(this.checkpoint);
+                } catch (error) {
+                  await rejectWithLiveFollowers(owner, error);
+                }
+                return;
+              }
               for (const request of requestsForKey) {
                 await this.rejectToolCall(
                   toolId,
                   request,
-                  runtimeReceiptFailureError(
-                    reclaimed,
-                    'Durable tool call failed',
-                    this.currentToolErrorSchemaVersion,
-                  ),
+                  new RuntimeReceiptWaitTimeoutError(receiptKey),
+                  { persistReceiptFailure: false },
                 );
               }
-              return;
-            }
-            if (this.isOwnedClaimedRuntimeReceipt(reclaimed)) {
-              const [owner, ...waiters] = requestsForKey;
-              if (!owner) return;
-              if (!reclaimed.leaseId) {
-                throw new RuntimeReceiptLeaseLostError({
-                  receiptKey,
-                  runId: this.currentReceiptOwnerRunId,
-                  leaseId: 'missing',
-                });
-              }
-              owner.receiptLeaseId = reclaimed.leaseId ?? null;
-              owner.receiptLeaseExpiresAt = reclaimed.leaseExpiresAt ?? null;
-              if (waiters.length > 0) {
-                liveFollowersByOwnerCallId.set(owner.callId, waiters);
-              }
-              try {
-                const execution = await this.callToolExecutionAPI(
-                  toolId,
-                  owner.input,
-                  {
-                    beforeProviderCall: () =>
-                      this.assertRuntimeToolReceiptOwnership([owner]),
-                    durableCallReceiptKey: receiptKey,
-                    playNodeScope: playNodeScopeForToolCallRequest(owner),
-                    executionAuthScopeDigest: owner.executionAuthScopeDigest,
-                    receiptLeaseExpiresAt: owner.receiptLeaseExpiresAt,
-                    heartbeatReceipt: () =>
-                      this.renewRuntimeToolReceiptOwnership([owner]),
-                    providerIdempotencyKey:
-                      this.providerIdempotencyKeyForToolCall({
-                        cacheKey: owner.cacheKey,
-                        force: owner.force === true,
-                        leaseId: owner.receiptLeaseId,
+            };
+            const processExistingRunningReceiptWaits =
+              async (): Promise<void> => {
+                if (durableExistingRunningWaits.length === 0) return;
+                const waitSignal = durableExistingRunningAbort.signal;
+                const pendingWaits = new Map(
+                  durableExistingRunningWaits.map((wait) => [
+                    wait.receiptKey,
+                    wait,
+                  ]),
+                );
+                const waitMaxAttempts =
+                  Math.max(
+                    ...durableExistingRunningWaits.map(
+                      (wait) => wait.waitMaxAttempts ?? 0,
+                    ),
+                  ) || DURABLE_RECEIPT_WAIT_MAX_ATTEMPTS;
+                if (runtimeReceiptReadTraceEnabled) {
+                  this.log(
+                    `[runtime-receipt-wait] phase=start requested=${pendingWaits.size} ` +
+                      `request_digests=${[...pendingWaits.keys()]
+                        .map(runtimeReceiptKeyDigest)
+                        .join(',')} max_attempts=${waitMaxAttempts}`,
+                  );
+                }
+                for (
+                  let attempt = 0;
+                  attempt < waitMaxAttempts && pendingWaits.size > 0;
+                  attempt += 1
+                ) {
+                  if (waitSignal.aborted) return;
+                  if (attempt > 0) {
+                    await new Promise<void>((resolve) => {
+                      const finish = () => {
+                        clearTimeout(timeout);
+                        waitSignal.removeEventListener('abort', finish);
+                        resolve();
+                      };
+                      const timeout = setTimeout(
+                        finish,
+                        DURABLE_RECEIPT_WAIT_DELAY_MS,
+                      );
+                      waitSignal.addEventListener('abort', finish, {
+                        once: true,
+                      });
+                    });
+                    if (waitSignal.aborted) return;
+                  }
+                  // The long backoff lives outside the hydration lane. Only a
+                  // bounded receipt read and delivery hold the lane, so stale
+                  // ownership cannot block unrelated cache misses/provider
+                  // work while terminal payloads still hydrate one group at a
+                  // time.
+                  await this.withRuntimeReceiptHydrationTurn(async () => {
+                    if (waitSignal.aborted) return;
+                    const waited =
+                      await this.waitForCompletedRuntimeToolReceipts(
+                        [...pendingWaits.keys()],
+                        1,
+                      );
+                    if (waitSignal.aborted) return;
+                    const settledWaits = [...pendingWaits.values()].filter(
+                      (wait) =>
+                        waited.completed.has(wait.receiptKey) ||
+                        waited.failed.has(wait.receiptKey),
+                    );
+                    const deliverySettlements = await Promise.allSettled(
+                      settledWaits.map(async (wait) => {
+                        const failed = waited.failed.get(wait.receiptKey);
+                        if (failed) {
+                          for (const request of wait.requestsForKey) {
+                            await this.rejectToolCall(toolId, request, failed, {
+                              persistReceiptFailure: false,
+                            });
+                          }
+                          return;
+                        }
+                        await reclaimExistingRunningReceiptAfterWait(
+                          wait.receiptKey,
+                          wait.requestsForKey,
+                          wait.forceAfterWait,
+                          {
+                            completedReceipt: waited.completed.get(
+                              wait.receiptKey,
+                            ),
+                            skipWait: true,
+                          },
+                        );
                       }),
-                    timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners([owner]),
-                  },
+                    );
+                    for (
+                      let index = 0;
+                      index < settledWaits.length;
+                      index += 1
+                    ) {
+                      if (deliverySettlements[index]?.status === 'fulfilled') {
+                        pendingWaits.delete(settledWaits[index]!.receiptKey);
+                      }
+                    }
+                    if (runtimeReceiptReadTraceEnabled) {
+                      const rejected = deliverySettlements.flatMap(
+                        (settlement, index) => {
+                          if (settlement.status !== 'rejected') return [];
+                          const receiptKey = settledWaits[index]?.receiptKey;
+                          return receiptKey
+                            ? [
+                                `${runtimeReceiptKeyDigest(receiptKey)}:${
+                                  settlement.reason instanceof Error
+                                    ? settlement.reason.name
+                                    : 'non_error'
+                                }`,
+                              ]
+                            : ['unknown'];
+                        },
+                      );
+                      this.log(
+                        `[runtime-receipt-wait] phase=delivery settled=${deliverySettlements.length} ` +
+                          `rejected=${rejected.length} rejected_digests=${rejected.join(',')}`,
+                      );
+                    }
+                    const rejectedDelivery = deliverySettlements.find(
+                      (settlement) => settlement.status === 'rejected',
+                    );
+                    if (rejectedDelivery?.status === 'rejected') {
+                      throw rejectedDelivery.reason;
+                    }
+                  });
+                }
+                if (waitSignal.aborted) return;
+                const reclaimSettlements = await Promise.allSettled(
+                  [...pendingWaits.values()].map((wait) =>
+                    reclaimExistingRunningReceiptAfterWait(
+                      wait.receiptKey,
+                      wait.requestsForKey,
+                      wait.forceAfterWait,
+                      { skipWait: true },
+                    ),
+                  ),
                 );
-                const result = await this.resolveToolCall(
-                  toolId,
-                  owner,
-                  execution?.result ?? null,
-                  execution?.metadata ?? null,
-                  execution?.jobId,
-                  execution?.meta,
+                const rejectedReclaim = reclaimSettlements.find(
+                  (settlement) => settlement.status === 'rejected',
                 );
-                if (result != null) {
-                  successfulLiveStepCallIds.add(owner.callId);
+                if (rejectedReclaim?.status === 'rejected') {
+                  throw rejectedReclaim.reason;
                 }
-                resolveLiveFollowers(owner, result);
-                recordToolStep([owner]);
-                this.#options.onBatchComplete?.(this.checkpoint);
-              } catch (error) {
-                await rejectWithLiveFollowers(owner, error);
-              }
-              return;
-            }
-            for (const request of requestsForKey) {
-              await this.rejectToolCall(
-                toolId,
-                request,
-                new RuntimeReceiptWaitTimeoutError(receiptKey),
-                { persistReceiptFailure: false },
-              );
-            }
-          };
-          const processExistingRunningReceiptWaits =
-            async (): Promise<void> => {
-              if (durableExistingRunningWaits.length === 0) return;
-              const waitingReceiptKeys = durableExistingRunningWaits.map(
-                (wait) => wait.receiptKey,
-              );
-              const waitMaxAttempts = Math.max(
-                ...durableExistingRunningWaits.map(
-                  (wait) => wait.waitMaxAttempts ?? 0,
-                ),
-              );
-              if (runtimeReceiptReadTraceEnabled) {
-                this.log(
-                  `[runtime-receipt-wait] phase=start requested=${waitingReceiptKeys.length} ` +
-                    `request_digests=${waitingReceiptKeys
-                      .map(runtimeReceiptKeyDigest)
-                      .join(',')} max_attempts=${waitMaxAttempts || 'default'}`,
+              };
+
+            for (const [receiptKey, group] of requestsByReceiptKey) {
+              const requestsForKey = group.requests;
+              const claim = claims.get(receiptKey);
+              if (!claim) {
+                queueExistingRunningReceiptWait(
+                  receiptKey,
+                  requestsForKey,
+                  group.forceRefresh,
                 );
+                continue;
               }
-              const waited = await this.waitForCompletedRuntimeToolReceipts(
-                waitingReceiptKeys,
-                waitMaxAttempts > 0 ? waitMaxAttempts : undefined,
-              );
-              if (runtimeReceiptReadTraceEnabled) {
-                this.log(
-                  `[runtime-receipt-wait] phase=settled completed=${waited.completed.size} ` +
-                    `failed=${waited.failed.size} timed_out=${waited.timedOut.size} ` +
-                    `completed_digests=${[...waited.completed.keys()]
-                      .map(runtimeReceiptKeyDigest)
-                      .join(',')} ` +
-                    `timed_out_digests=${[...waited.timedOut]
-                      .map(runtimeReceiptKeyDigest)
-                      .join(',')}`,
+              if (
+                claim?.status === 'completed' ||
+                claim?.status === 'skipped'
+              ) {
+                await resolveRequestsFromReceipt(
+                  requestsForKey,
+                  claim,
+                  'cache',
                 );
+                durableRecoveredRequests.push(...requestsForKey);
+                continue;
               }
-              const deliverySettlements = await Promise.allSettled(
-                durableExistingRunningWaits.map(async (wait) => {
-                  const failed = waited.failed.get(wait.receiptKey);
-                  if (failed) {
-                    for (const request of wait.requestsForKey) {
-                      await this.rejectToolCall(toolId, request, failed, {
-                        persistReceiptFailure: false,
-                      });
-                    }
-                    return;
-                  }
-                  await reclaimExistingRunningReceiptAfterWait(
-                    wait.receiptKey,
-                    wait.requestsForKey,
-                    wait.forceAfterWait,
-                    {
-                      completedReceipt: waited.completed.get(wait.receiptKey),
-                      skipWait: true,
-                    },
+              if (claim?.status === 'failed') {
+                for (const request of requestsForKey) {
+                  await this.rejectToolCall(
+                    toolId,
+                    request,
+                    runtimeReceiptFailureError(
+                      claim,
+                      'Durable tool call failed',
+                      this.currentToolErrorSchemaVersion,
+                    ),
                   );
-                }),
-              );
-              if (runtimeReceiptReadTraceEnabled) {
-                const rejected = deliverySettlements.flatMap(
-                  (settlement, index) => {
-                    if (settlement.status !== 'rejected') return [];
-                    const receiptKey =
-                      durableExistingRunningWaits[index]?.receiptKey;
-                    return receiptKey
-                      ? [
-                          `${runtimeReceiptKeyDigest(receiptKey)}:${
-                            settlement.reason instanceof Error
-                              ? settlement.reason.name
-                              : 'non_error'
-                          }`,
-                        ]
-                      : ['unknown'];
-                  },
-                );
-                this.log(
-                  `[runtime-receipt-wait] phase=delivery settled=${deliverySettlements.length} ` +
-                    `rejected=${rejected.length} rejected_digests=${rejected.join(',')}`,
-                );
+                }
+                continue;
               }
-            };
-
-          for (const [receiptKey, group] of requestsByReceiptKey) {
-            const requestsForKey = group.requests;
-            const claim = claims.get(receiptKey);
-            if (!claim) {
-              queueExistingRunningReceiptWait(
-                receiptKey,
-                requestsForKey,
-                group.forceRefresh,
-              );
-              continue;
-            }
-            if (claim?.status === 'completed' || claim?.status === 'skipped') {
-              await resolveRequestsFromReceipt(requestsForKey, claim, 'cache');
-              durableRecoveredRequests.push(...requestsForKey);
-              continue;
-            }
-            if (claim?.status === 'failed') {
-              for (const request of requestsForKey) {
-                await this.rejectToolCall(
-                  toolId,
-                  request,
-                  runtimeReceiptFailureError(
-                    claim,
-                    'Durable tool call failed',
-                    this.currentToolErrorSchemaVersion,
-                  ),
+              if (
+                (claim?.status === 'queued' ||
+                  claim?.status === 'pending' ||
+                  claim?.status === 'running') &&
+                claim.claimState === 'existing'
+              ) {
+                queueExistingRunningReceiptWait(
+                  receiptKey,
+                  requestsForKey,
+                  group.forceRefresh,
                 );
+                continue;
+              }
+              if (this.isOwnedClaimedRuntimeReceipt(claim)) {
+                const [owner, ...waiters] = requestsForKey;
+                if (!claim.leaseId) {
+                  throw new RuntimeReceiptLeaseLostError({
+                    receiptKey,
+                    runId: this.currentReceiptOwnerRunId,
+                    leaseId: 'missing',
+                  });
+                }
+                if (owner) {
+                  owner.receiptLeaseId = claim.leaseId ?? null;
+                  owner.receiptLeaseExpiresAt = claim.leaseExpiresAt ?? null;
+                  const claimLeaseExpiresAtMs = Date.parse(
+                    claim.leaseExpiresAt ?? '',
+                  );
+                  pendingReceiptClaimsEstablishExecutionFence &&=
+                    claim.claimState === 'claimed' &&
+                    claim.status === 'running' &&
+                    Number.isFinite(claimLeaseExpiresAtMs) &&
+                    claimLeaseExpiresAtMs > Date.now();
+                }
+                claimOwnerWithLiveFollowers(owner, waiters);
+                continue;
               }
-              continue;
-            }
-            if (
-              (claim?.status === 'queued' ||
-                claim?.status === 'pending' ||
-                claim?.status === 'running') &&
-              claim.claimState === 'existing'
-            ) {
               queueExistingRunningReceiptWait(
                 receiptKey,
                 requestsForKey,
                 group.forceRefresh,
               );
-              continue;
-            }
-            if (this.isOwnedClaimedRuntimeReceipt(claim)) {
-              const [owner, ...waiters] = requestsForKey;
-              if (!claim.leaseId) {
-                throw new RuntimeReceiptLeaseLostError({
-                  receiptKey,
-                  runId: this.currentReceiptOwnerRunId,
-                  leaseId: 'missing',
-                });
-              }
-              if (owner) {
-                owner.receiptLeaseId = claim.leaseId ?? null;
-                owner.receiptLeaseExpiresAt = claim.leaseExpiresAt ?? null;
-              }
-              claimOwnerWithLiveFollowers(owner, waiters);
-              continue;
             }
-            queueExistingRunningReceiptWait(
-              receiptKey,
-              requestsForKey,
-              group.forceRefresh,
-            );
-          }
 
-          pendingRequests.length = 0;
-          pendingRequests.push(...claimedRequests);
-          durableExistingRunningHandler =
-            durableExistingRunningWaits.length > 0
-              ? processExistingRunningReceiptWaits()
-              : null;
-          recordToolStep(durableRecoveredRequests);
+            pendingRequests.length = 0;
+            pendingRequests.push(...claimedRequests);
+            durableExistingRunningState.settlement =
+              durableExistingRunningWaits.length > 0
+                ? processExistingRunningReceiptWaits().then(
+                    () => ({ status: 'fulfilled' as const }),
+                    (reason: unknown) => ({
+                      status: 'rejected' as const,
+                      reason,
+                    }),
+                  )
+                : null;
+            recordToolStep(durableRecoveredRequests);
+          });
         }
 
-        const pendingReceiptHeartbeat =
-          this.startPendingToolReceiptHeartbeat(pendingRequests);
+        // Claims establish one lease cohort. Revalidate that cohort in one
+        // gateway operation before provider admission, then let the existing
+        // cohort heartbeat keep the undispatched tail alive. Revalidating each
+        // call separately after a tool slot opens fragments the writer into
+        // one-row batches and starves otherwise healthy providers.
+        const pendingReceiptHeartbeat = this.startPendingToolReceiptHeartbeat(
+          pendingRequests,
+          pendingReceiptClaimsEstablishExecutionFence,
+        );
+        let providerFailure: { reason: unknown } | null = null;
         try {
+          if (pendingReceiptHeartbeat) {
+            await pendingReceiptHeartbeat.confirmOwned();
+          }
           if (pendingRequests.length > 0) {
             const strategy =
               this.#options.getBatchOperationStrategy?.(toolId) ?? null;
@@ -10039,59 +10871,72 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                         toolId: batch.batchOperation,
                       }),
                     });
-                  return await this.callToolAPI(
-                    batch.batchOperation,
-                    batch.batchPayload,
-                    {
-                      durableCallReceiptKey: aggregateReceiptKey,
-                      // A native batch is one physical provider request for
-                      // many rows of the same column, so the batch's node scope
-                      // is its members' shared scope.
-                      playNodeScope: batch.memberRequests[0]
-                        ? playNodeScopeForToolCallRequest(
-                            batch.memberRequests[0],
-                            batch.batchOperation,
-                          )
-                        : null,
-                      executionAuthScopeDigest:
-                        batch.memberRequests[0]?.executionAuthScopeDigest ??
-                        null,
-                      providerIdempotencyKey:
-                        buildDurableToolAggregateProviderIdempotencyKey({
-                          aggregateReceiptKey,
-                          receiptKeys,
-                          providerIdempotencyKeys: batch.memberRequests.map(
-                            (request) =>
-                              this.providerIdempotencyKeyForToolCall({
-                                cacheKey: request.cacheKey,
-                                force: request.force === true,
-                                leaseId: request.receiptLeaseId,
-                              }),
-                          ),
-                        }),
-                      receiptLeaseExpiresAt: batch.memberRequests.reduce<
-                        string | null
-                      >((earliest, request) => {
-                        const expiresAt = request.receiptLeaseExpiresAt ?? null;
-                        if (!expiresAt) return earliest;
-                        if (!earliest) return expiresAt;
-                        return Date.parse(expiresAt) < Date.parse(earliest)
-                          ? expiresAt
-                          : earliest;
-                      }, null),
-                      timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners(
-                        batch.memberRequests,
-                      ),
-                      beforeProviderCall: () =>
-                        this.assertRuntimeToolReceiptOwnership(
-                          batch.memberRequests,
-                        ),
-                      heartbeatReceipt: () =>
-                        this.renewRuntimeToolReceiptOwnership(
+                  let releaseToolSlot: () => void = () => undefined;
+                  try {
+                    const value = await this.callToolAPI(
+                      batch.batchOperation,
+                      batch.batchPayload,
+                      {
+                        durableCallReceiptKey: aggregateReceiptKey,
+                        // A native batch is one physical provider request for
+                        // many rows of the same column, so the batch's node scope
+                        // is its members' shared scope.
+                        playNodeScope: batch.memberRequests[0]
+                          ? playNodeScopeForToolCallRequest(
+                              batch.memberRequests[0],
+                              batch.batchOperation,
+                            )
+                          : null,
+                        executionAuthScopeDigest:
+                          batch.memberRequests[0]?.executionAuthScopeDigest ??
+                          null,
+                        providerIdempotencyKey:
+                          buildDurableToolAggregateProviderIdempotencyKey({
+                            aggregateReceiptKey,
+                            receiptKeys,
+                            providerIdempotencyKeys: batch.memberRequests.map(
+                              (request) =>
+                                this.providerIdempotencyKeyForToolCall({
+                                  cacheKey: request.cacheKey,
+                                  force: request.force === true,
+                                  leaseId: request.receiptLeaseId,
+                                }),
+                            ),
+                          }),
+                        receiptLeaseExpiresAt: batch.memberRequests.reduce<
+                          string | null
+                        >((earliest, request) => {
+                          const expiresAt =
+                            request.receiptLeaseExpiresAt ?? null;
+                          if (!expiresAt) return earliest;
+                          if (!earliest) return expiresAt;
+                          return Date.parse(expiresAt) < Date.parse(earliest)
+                            ? expiresAt
+                            : earliest;
+                        }, null),
+                        timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners(
                           batch.memberRequests,
                         ),
-                    },
-                  );
+                        beforeProviderCall: () =>
+                          pendingReceiptHeartbeat
+                            ? pendingReceiptHeartbeat.assertOwned()
+                            : this.assertRuntimeToolReceiptOwnership(
+                                batch.memberRequests,
+                              ),
+                        heartbeatReceipt: () =>
+                          this.renewRuntimeToolReceiptOwnership(
+                            batch.memberRequests,
+                          ),
+                        retainToolSlot: (release) => {
+                          releaseToolSlot = release;
+                        },
+                      },
+                    );
+                    return { value, releaseToolSlot };
+                  } catch (error) {
+                    releaseToolSlot();
+                    throw error;
+                  }
                 },
                 onChunkComplete: async (chunkResults) => {
                   for (const entry of chunkResults) {
@@ -10101,29 +10946,35 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                       }
                       continue;
                     }
-                    const splitResults =
-                      entry.result != null
-                        ? entry.request.splitResults(entry.result)
-                        : entry.request.memberRequests.map(() => null);
-                    const resolvedResults =
-                      await this.resolveToolCallBatchResults(
-                        toolId,
-                        entry.request.memberRequests.map((request, index) => ({
-                          request,
-                          result: splitResults[index] ?? null,
-                        })),
-                      );
+                    try {
+                      const splitResults =
+                        entry.result != null
+                          ? entry.request.splitResults(entry.result.value)
+                          : entry.request.memberRequests.map(() => null);
+                      const resolvedResults =
+                        await this.resolveToolCallBatchResults(
+                          toolId,
+                          entry.request.memberRequests.map(
+                            (request, index) => ({
+                              request,
+                              result: splitResults[index] ?? null,
+                            }),
+                          ),
+                        );
 
-                    for (
-                      let index = 0;
-                      index < entry.request.memberRequests.length;
-                      index += 1
-                    ) {
-                      const request = entry.request.memberRequests[index]!;
-                      if (resolvedResults[index] != null) {
-                        successfulLiveStepCallIds.add(request.callId);
+                      for (
+                        let index = 0;
+                        index < entry.request.memberRequests.length;
+                        index += 1
+                      ) {
+                        const request = entry.request.memberRequests[index]!;
+                        if (resolvedResults[index] != null) {
+                          successfulLiveStepCallIds.add(request.callId);
+                        }
+                        resolveLiveFollowers(request, resolvedResults[index]);
                       }
-                      resolveLiveFollowers(request, resolvedResults[index]);
+                    } finally {
+                      entry.result?.releaseToolSlot();
                     }
                   }
 
@@ -10134,6 +10985,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   );
                   this.#options.onBatchComplete?.(this.checkpoint);
                 },
+                retainResults: false,
               });
             } else {
               const completionBuffer: Array<{
@@ -10235,36 +11087,48 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                       this.persistenceLatch,
                     );
                   }
-                  const execution = await this.callToolExecutionAPI(
-                    toolId,
-                    request.input,
-                    {
-                      beforeProviderCall: () =>
-                        this.assertRuntimeToolReceiptOwnership([request]),
-                      playNodeScope: playNodeScopeForToolCallRequest(request),
-                      ...(request.receiptKey
-                        ? {
-                            durableCallReceiptKey: request.receiptKey,
-                            executionAuthScopeDigest:
-                              request.executionAuthScopeDigest,
-                            providerIdempotencyKey:
-                              this.providerIdempotencyKeyForToolCall({
-                                cacheKey: request.receiptKey,
-                                force: request.force === true,
-                                leaseId: request.receiptLeaseId,
-                              }),
-                            receiptLeaseExpiresAt:
-                              request.receiptLeaseExpiresAt,
-                            heartbeatReceipt: () =>
-                              this.renewRuntimeToolReceiptOwnership([request]),
-                          }
-                        : {}),
-                      timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners([
-                        request,
-                      ]),
-                    },
-                  );
-                  return await enqueueCompletion(request, execution);
+                  let releaseToolSlot: () => void = () => undefined;
+                  try {
+                    const execution = await this.callToolExecutionAPI(
+                      toolId,
+                      request.input,
+                      {
+                        beforeProviderCall: () =>
+                          pendingReceiptHeartbeat
+                            ? pendingReceiptHeartbeat.assertOwned()
+                            : this.assertRuntimeToolReceiptOwnership([request]),
+                        playNodeScope: playNodeScopeForToolCallRequest(request),
+                        ...(request.receiptKey
+                          ? {
+                              durableCallReceiptKey: request.receiptKey,
+                              executionAuthScopeDigest:
+                                request.executionAuthScopeDigest,
+                              providerIdempotencyKey:
+                                this.providerIdempotencyKeyForToolCall({
+                                  cacheKey: request.receiptKey,
+                                  force: request.force === true,
+                                  leaseId: request.receiptLeaseId,
+                                }),
+                              receiptLeaseExpiresAt:
+                                request.receiptLeaseExpiresAt,
+                              heartbeatReceipt: () =>
+                                this.renewRuntimeToolReceiptOwnership([
+                                  request,
+                                ]),
+                            }
+                          : {}),
+                        timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners([
+                          request,
+                        ]),
+                        retainToolSlot: (release) => {
+                          releaseToolSlot = release;
+                        },
+                      },
+                    );
+                    await enqueueCompletion(request, execution);
+                  } finally {
+                    releaseToolSlot();
+                  }
                 },
               );
               const failedEntries = dispatchResults.filter(
@@ -10281,14 +11145,26 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               this.#options.onBatchComplete?.(this.checkpoint);
             }
           }
+        } catch (reason) {
+          providerFailure = { reason };
+          durableExistingRunningAbort.abort(reason);
         } finally {
           pendingReceiptHeartbeat?.stop();
         }
         const pendingReceiptLeaseLost = pendingReceiptHeartbeat?.leaseLost();
-        if (pendingReceiptLeaseLost) throw pendingReceiptLeaseLost;
-        if (durableExistingRunningHandler) {
-          await durableExistingRunningHandler;
+        if (pendingReceiptLeaseLost && providerFailure === null) {
+          providerFailure = { reason: pendingReceiptLeaseLost };
+          durableExistingRunningAbort.abort(pendingReceiptLeaseLost);
+        }
+        const durableExistingRunningSettlement =
+          durableExistingRunningState.settlement;
+        if (durableExistingRunningSettlement) {
+          const settlement = await durableExistingRunningSettlement;
+          if (settlement.status === 'rejected' && providerFailure === null) {
+            providerFailure = { reason: settlement.reason };
+          }
         }
+        if (providerFailure) throw providerFailure.reason;
       }),
     );
     const rejected = toolSettlements.find(
@@ -10497,7 +11373,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         `[perf] tool call id=${toolId} phase=governor_admission elapsed_ms=${Date.now() - admissionStartedAt}`,
       );
     }
+    let toolSlotTransferred = false;
     try {
+      if (options?.retainToolSlot) {
+        options.retainToolSlot(() => toolSlot.release());
+        toolSlotTransferred = true;
+      }
       return await withActiveSpan(
         'plays.tool.execute',
         {
@@ -11271,7 +12152,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           },
         });
       }
-      toolSlot.release();
+      if (!toolSlotTransferred) {
+        toolSlot.release();
+      }
     }
   }