deepline 0.2.55 → 0.2.57

package/dist/bundling-sources/shared_libs/play-runtime/ctx-types.ts

@@ -609,6 +609,12 @@ export interface ContextOptions {
   fixtureBehavior?: FixtureBehavior | null;
   /** Preview/dev test seam that applies provider pacing to fixture responses. */
   enforceFixtureProviderPacing?: boolean;
+  /**
+   * Server-validated per-run ceiling for concurrently resident provider-tool
+   * executions and direct ctx.fetch calls. Omitted uses the platform default.
+   */
+  maxConcurrentExternalCalls?: number | null;
+  maxConcurrentRows?: number | null;
   orgId?: string;
   userEmail?: string;
   playName?: string;
@@ -646,6 +652,18 @@ export interface ContextOptions {
    * a transport that validates resolved IP addresses at connect time.
    */
   fetchImpl?: (input: string | URL, init?: RequestInit) => Promise<Response>;
+  /**
+   * Internal runtime-policy override used by focused tests and controlled
+   * harnesses. Play authors cannot set these values; ctx.fetch always has a
+   * bounded platform deadline.
+   */
+  ctxFetchTimeouts?: {
+    headersMs?: number;
+    bodyMs?: number;
+    totalMs?: number;
+  };
+  /** Internal low-cardinality map-stall diagnostic interval override. */
+  runtimeMapStallLogIntervalMs?: number;
   /** Called when a row gains new partial data or stage info. */
   onRowUpdate?: (update: PlayRowUpdate) => void | Promise<void>;
   /** Structured execution events emitted from explicit dataset scopes. */
@@ -836,6 +854,8 @@ export interface ContextOptions {
   ) =>
     | Promise<Array<RuntimeStepReceipt | null>>
     | Array<RuntimeStepReceipt | null>;
+  /** Internal backend capability: a claimed running receipt is the execution fence. */
+  runtimeReceiptClaimsEstablishExecutionFence?: boolean;
   markRuntimeStepReceiptRunning?: (
     input: MarkRuntimeStepReceiptRunningInput,
   ) => Promise<RuntimeStepReceipt | null> | RuntimeStepReceipt | null;

package/dist/bundling-sources/shared_libs/play-runtime/durable-receipt-execution.ts

@@ -28,8 +28,8 @@ import type {
   ToolExecutionFailureV1,
 } from '../tool-execution-error';
 
-const DURABLE_RECEIPT_WAIT_MAX_ATTEMPTS = 240;
-const DURABLE_RECEIPT_WAIT_DELAY_MS = 250;
+export const DURABLE_RECEIPT_WAIT_MAX_ATTEMPTS = 240;
+export const DURABLE_RECEIPT_WAIT_DELAY_MS = 250;
 const TOOL_RECEIPT_DEFAULT_WAIT_MS = 300_000;
 const TOOL_RECEIPT_COMPLETION_BUFFER_MS = 30_000;
 const TOOL_RECEIPT_MAX_WAIT_MS = 30 * 60_000;
@@ -358,15 +358,7 @@ export async function waitForCompletedRuntimeReceipts(input: {
     if (attempt > 0) {
       await sleepReceiptWait(delayMs, input.abortSignal);
     }
-    let receipts: Map<string, RuntimeStepReceipt>;
-    try {
-      receipts = await input.store.getMany([...pending]);
-    } catch (error) {
-      if (error instanceof RuntimeReceiptWaitTimeoutError) {
-        break;
-      }
-      throw error;
-    }
+    const receipts = await input.store.getMany([...pending]);
     const statuses = [...receipts.values()].reduce<Record<string, number>>(
       (counts, receipt) => {
         counts[receipt.status] = (counts[receipt.status] ?? 0) + 1;
@@ -433,6 +425,9 @@ export async function executeWithDurableRuntimeReceipt<T>(input: {
   /** New receipt-cache path: read completed facts, execute without creating an
    * in-flight receipt, then atomically insert the completed fact. */
   completedCacheOnly?: boolean;
+  withCompletedReceiptHydration?: <Result>(
+    hydrate: () => Promise<Result>,
+  ) => Promise<Result>;
   requiresExecutionLock?: boolean;
   executionLockTtlMs?: number;
   toolErrorSchemaVersion: ToolExecutionErrorSchemaVersion;
@@ -480,11 +475,33 @@ export async function executeWithDurableRuntimeReceipt<T>(input: {
   };
 
   if (input.completedCacheOnly === true) {
+    const withCompletedReceiptHydration = async <Result>(
+      hydrate: () => Promise<Result>,
+    ): Promise<Result> =>
+      input.withCompletedReceiptHydration
+        ? await input.withCompletedReceiptHydration(hydrate)
+        : await hydrate();
+    const inspectCompletedReceipt = async (
+      read: () => Promise<RuntimeStepReceipt | null>,
+      source: DurableReceiptRecoverySource = 'cache',
+    ): Promise<{ kind: 'recovered'; output: T } | { kind: 'unresolved' }> => {
+      const inspect = async () => {
+        const receipt = await read();
+        if (receipt?.status === 'completed' || receipt?.status === 'skipped') {
+          return {
+            kind: 'recovered' as const,
+            output: await recoverCompletedReceipt(receipt, source),
+          };
+        }
+        return { kind: 'unresolved' as const };
+      };
+      return await withCompletedReceiptHydration(inspect);
+    };
     if (input.force !== true) {
-      const cached = await input.store.get(input.receiptKey);
-      if (cached?.status === 'completed' || cached?.status === 'skipped') {
-        return await recoverCompletedReceipt(cached);
-      }
+      const cached = await inspectCompletedReceipt(() =>
+        input.store.get(input.receiptKey),
+      );
+      if (cached.kind === 'recovered') return cached.output;
     }
     const needsLock = input.requiresExecutionLock === true;
     const ownerExecutionId = `${input.runId}:${crypto.randomUUID()}`;
@@ -511,28 +528,30 @@ export async function executeWithDurableRuntimeReceipt<T>(input: {
         });
         ownsLock = lock?.ownerExecutionId === ownerExecutionId;
         if (ownsLock) break;
-        const winner = await input.store.get(input.receiptKey);
-        if (
-          input.force !== true &&
-          (winner?.status === 'completed' || winner?.status === 'skipped')
-        ) {
-          return await recoverCompletedReceipt(winner, 'in_flight');
+        if (input.force !== true) {
+          const winner = await inspectCompletedReceipt(
+            () => input.store.get(input.receiptKey),
+            'in_flight',
+          );
+          if (winner.kind === 'recovered') return winner.output;
         }
         if (Date.now() >= deadline) {
           throw new RuntimeReceiptWaitTimeoutError(input.receiptKey);
         }
         await sleepReceiptWait(DURABLE_RECEIPT_WAIT_DELAY_MS);
       }
-      const afterLock = await input.store.get(input.receiptKey);
-      if (
-        input.force !== true &&
-        (afterLock?.status === 'completed' || afterLock?.status === 'skipped')
-      ) {
-        await input.store.releaseExecutionLock({
-          receiptKey: input.receiptKey,
-          ownerExecutionId,
-        });
-        return await recoverCompletedReceipt(afterLock, 'in_flight');
+      if (input.force !== true) {
+        const afterLock = await inspectCompletedReceipt(
+          () => input.store.get(input.receiptKey),
+          'in_flight',
+        );
+        if (afterLock.kind === 'recovered') {
+          await input.store.releaseExecutionLock({
+            receiptKey: input.receiptKey,
+            ownerExecutionId,
+          });
+          return afterLock.output;
+        }
       }
       const lockTtlMs =
         input.executionLockTtlMs ?? TOOL_RECEIPT_DEFAULT_WAIT_MS;
@@ -597,28 +616,38 @@ export async function executeWithDurableRuntimeReceipt<T>(input: {
       if (input.force === true) {
         return result;
       }
-      const completed = await input.store.complete(
-        input.receiptKey,
-        input.runId,
-        isToolExecuteResult(result)
-          ? serializeToolExecuteResult(result)
-          : result,
-        COMPLETED_RECEIPT_CACHE_INSERT_LEASE_ID,
+      // Completion normally returns a compact acknowledgement. Keep the
+      // mutation and response decode inside the hydration turn anyway because
+      // a concurrent winner may return a full persisted payload.
+      const published = await withCompletedReceiptHydration(async () => {
+        const completed = await input.store.complete(
+          input.receiptKey,
+          input.runId,
+          isToolExecuteResult(result)
+            ? serializeToolExecuteResult(result)
+            : result,
+          COMPLETED_RECEIPT_CACHE_INSERT_LEASE_ID,
+        );
+        if (
+          completed?.status === 'completed' ||
+          completed?.status === 'skipped'
+        ) {
+          return {
+            kind: 'completed' as const,
+            output:
+              completed.output === undefined
+                ? result
+                : await recoverCompletedReceipt(completed, 'owner'),
+          };
+        }
+        return { kind: 'unresolved' as const };
+      });
+      if (published.kind === 'completed') return published.output;
+      const winner = await inspectCompletedReceipt(
+        () => input.store.get(input.receiptKey),
+        'owner',
       );
-      if (
-        completed?.status === 'completed' ||
-        completed?.status === 'skipped'
-      ) {
-        // Completion is a compact acknowledgement. This execution already
-        // owns the just-produced value; only a later receipt read needs the
-        // persisted payload for replay.
-        if (completed.output === undefined) return result;
-        return await recoverCompletedReceipt(completed, 'owner');
-      }
-      const winner = await input.store.get(input.receiptKey);
-      if (winner?.status === 'completed' || winner?.status === 'skipped') {
-        return await recoverCompletedReceipt(winner, 'owner');
-      }
+      if (winner.kind === 'recovered') return winner.output;
       throw new Error(
         `ctx.${input.operation}(${input.id}): completed receipt cache insert failed.`,
       );

package/dist/bundling-sources/shared_libs/play-runtime/fixture-behavior.ts

@@ -1,5 +1,6 @@
 export const FIXTURE_BEHAVIOR_VERSION = 1 as const;
 export const FIXTURE_BEHAVIOR_RESPONSE_VERSION = 2 as const;
+export const FIXTURE_BEHAVIOR_REPLAY_VERSION = 3 as const;
 export const MAX_FIXTURE_RESPONSE_DELAY_SAMPLES = 256;
 export const MAX_FIXTURE_RESPONSE_DELAY_MS = 8 * 60_000;
 export const MAX_FIXTURE_RESPONSE_ERROR_MESSAGE_LENGTH = 500;
@@ -26,7 +27,22 @@ export type FixtureBehaviorV2 = {
   responseSamples: FixtureResponseSample[];
 };
 
-export type FixtureBehavior = FixtureBehaviorV1 | FixtureBehaviorV2;
+export type FixtureReplayBundle = {
+  bundleId: string;
+  manifestSha256: string;
+  syntheticFallbackToolIds?: string[];
+};
+
+export type FixtureBehaviorV3 = {
+  version: typeof FIXTURE_BEHAVIOR_REPLAY_VERSION;
+  responseSamples: FixtureResponseSample[];
+  replayBundle: FixtureReplayBundle;
+};
+
+export type FixtureBehavior =
+  | FixtureBehaviorV1
+  | FixtureBehaviorV2
+  | FixtureBehaviorV3;
 
 /** Providers whose fixture-mode path intentionally remains a real local/test adapter. */
 const FIXTURE_MODE_BYPASS_PROVIDERS = new Set([
@@ -53,8 +69,15 @@ export function validateFixtureBehavior(
   }
   const record = value as Record<string, unknown>;
   const supportedKeys =
-    record.version === FIXTURE_BEHAVIOR_RESPONSE_VERSION
-      ? new Set(['version', 'responseSamples'])
+    record.version === FIXTURE_BEHAVIOR_RESPONSE_VERSION ||
+    record.version === FIXTURE_BEHAVIOR_REPLAY_VERSION
+      ? new Set([
+          'version',
+          'responseSamples',
+          ...(record.version === FIXTURE_BEHAVIOR_REPLAY_VERSION
+            ? ['replayBundle']
+            : []),
+        ])
       : new Set(['version', 'responseDelaySamplesMs']);
   const unknownKeys = Object.keys(record).filter(
     (key) => !supportedKeys.has(key),
@@ -67,16 +90,21 @@ export function validateFixtureBehavior(
   }
   if (
     record.version !== FIXTURE_BEHAVIOR_VERSION &&
-    record.version !== FIXTURE_BEHAVIOR_RESPONSE_VERSION
+    record.version !== FIXTURE_BEHAVIOR_RESPONSE_VERSION &&
+    record.version !== FIXTURE_BEHAVIOR_REPLAY_VERSION
   ) {
     return {
       ok: false,
       error:
         `fixtureBehavior.version must be ${FIXTURE_BEHAVIOR_VERSION} or ` +
-        `${FIXTURE_BEHAVIOR_RESPONSE_VERSION}.`,
+        `${FIXTURE_BEHAVIOR_RESPONSE_VERSION}, or ` +
+        `${FIXTURE_BEHAVIOR_REPLAY_VERSION}.`,
     };
   }
-  if (record.version === FIXTURE_BEHAVIOR_RESPONSE_VERSION) {
+  if (
+    record.version === FIXTURE_BEHAVIOR_RESPONSE_VERSION ||
+    record.version === FIXTURE_BEHAVIOR_REPLAY_VERSION
+  ) {
     if (
       !Array.isArray(record.responseSamples) ||
       record.responseSamples.length === 0 ||
@@ -231,6 +259,101 @@ export function validateFixtureBehavior(
         ...(httpError ? { httpError } : {}),
       });
     }
+    let replayBundle: FixtureReplayBundle | undefined;
+    if (record.version === FIXTURE_BEHAVIOR_REPLAY_VERSION) {
+      if (
+        !record.replayBundle ||
+        typeof record.replayBundle !== 'object' ||
+        Array.isArray(record.replayBundle)
+      ) {
+        return {
+          ok: false,
+          error: 'fixtureBehavior.replayBundle must be an object.',
+        };
+      }
+      const replay = record.replayBundle as Record<string, unknown>;
+      const replayUnknownKeys = Object.keys(replay).filter(
+        (key) =>
+          key !== 'bundleId' &&
+          key !== 'manifestSha256' &&
+          key !== 'syntheticFallbackToolIds',
+      );
+      if (replayUnknownKeys.length > 0) {
+        return {
+          ok: false,
+          error:
+            'Unsupported fixtureBehavior.replayBundle field ' +
+            `"${replayUnknownKeys[0]}".`,
+        };
+      }
+      const digestPattern = /^[a-f0-9]{64}$/;
+      if (
+        typeof replay.bundleId !== 'string' ||
+        !digestPattern.test(replay.bundleId)
+      ) {
+        return {
+          ok: false,
+          error:
+            'fixtureBehavior.replayBundle.bundleId must be a lowercase SHA-256 digest.',
+        };
+      }
+      if (
+        typeof replay.manifestSha256 !== 'string' ||
+        !digestPattern.test(replay.manifestSha256)
+      ) {
+        return {
+          ok: false,
+          error:
+            'fixtureBehavior.replayBundle.manifestSha256 must be a lowercase SHA-256 digest.',
+        };
+      }
+      let syntheticFallbackToolIds: string[] | undefined;
+      if (replay.syntheticFallbackToolIds !== undefined) {
+        if (
+          !Array.isArray(replay.syntheticFallbackToolIds) ||
+          replay.syntheticFallbackToolIds.length === 0 ||
+          replay.syntheticFallbackToolIds.length > 32
+        ) {
+          return {
+            ok: false,
+            error:
+              'fixtureBehavior.replayBundle.syntheticFallbackToolIds must contain 1-32 tool ids.',
+          };
+        }
+        syntheticFallbackToolIds = [];
+        for (const rawToolId of replay.syntheticFallbackToolIds) {
+          if (
+            typeof rawToolId !== 'string' ||
+            rawToolId !== rawToolId.trim().toLowerCase() ||
+            !/^[a-z0-9][a-z0-9_.-]*$/.test(rawToolId) ||
+            rawToolId.length > 250 ||
+            syntheticFallbackToolIds.includes(rawToolId)
+          ) {
+            return {
+              ok: false,
+              error:
+                'fixtureBehavior.replayBundle.syntheticFallbackToolIds contains an invalid tool id.',
+            };
+          }
+          syntheticFallbackToolIds.push(rawToolId);
+        }
+      }
+      replayBundle = {
+        bundleId: replay.bundleId,
+        manifestSha256: replay.manifestSha256,
+        ...(syntheticFallbackToolIds ? { syntheticFallbackToolIds } : {}),
+      };
+    }
+    if (record.version === FIXTURE_BEHAVIOR_REPLAY_VERSION) {
+      return {
+        ok: true,
+        behavior: {
+          version: FIXTURE_BEHAVIOR_REPLAY_VERSION,
+          responseSamples: samples,
+          replayBundle: replayBundle!,
+        },
+      };
+    }
     return {
       ok: true,
       behavior: {
@@ -329,6 +452,23 @@ function stableFixtureRequestHash(value: string): number {
   return hash >>> 0;
 }
 
+export function selectFixtureReplaySampleIndex(input: {
+  stableRequestKey: string;
+  sampleCount: number;
+}): number {
+  const stableRequestKey = input.stableRequestKey.trim();
+  if (!stableRequestKey) {
+    throw new Error('Fixture replay requires a stable request key.');
+  }
+  if (!Number.isSafeInteger(input.sampleCount) || input.sampleCount <= 0) {
+    throw new Error('Fixture replay requires a positive sample count.');
+  }
+  return (
+    stableFixtureRequestHash(`fixture-replay-v1:${stableRequestKey}`) %
+    input.sampleCount
+  );
+}
+
 export function selectFixtureResponseDelay(input: {
   behavior: FixtureBehavior;
   stableRequestKey: string;

package/dist/bundling-sources/shared_libs/play-runtime/gateway-auth-session.ts

@@ -22,6 +22,34 @@ type StoredSession<TAuth, TLaunch> = {
   runAttempt: number | null;
 };
 
+function abortReason(signal: AbortSignal): Error {
+  return signal.reason instanceof Error
+    ? signal.reason
+    : new Error('Gateway session wait was cancelled.');
+}
+
+async function awaitWithAbort<T>(
+  pending: Promise<T>,
+  signal: AbortSignal | undefined,
+): Promise<T> {
+  if (!signal) return await pending;
+  if (signal.aborted) throw abortReason(signal);
+  return await new Promise<T>((resolve, reject) => {
+    const onAbort = () => reject(abortReason(signal));
+    signal.addEventListener('abort', onAbort, { once: true });
+    void pending.then(
+      (value) => {
+        signal.removeEventListener('abort', onAbort);
+        resolve(value);
+      },
+      (error) => {
+        signal.removeEventListener('abort', onAbort);
+        reject(error);
+      },
+    );
+  });
+}
+
 /** Briefly reuse an authenticated immutable launch, bounded by token identity. */
 export function createGatewayAuthSessionCache<TAuth, TLaunch>(options: {
   ttlMs: number;
@@ -54,7 +82,10 @@ export function createGatewayAuthSessionCache<TAuth, TLaunch>(options: {
       token: string;
       tokenExpiresAt: number;
       establish: () => Promise<{ auth: TAuth; launch: TLaunch }>;
+      /** Detach this waiter without cancelling the shared establishment. */
+      signal?: AbortSignal;
     }): Promise<GatewayAuthSession<TAuth, TLaunch>> {
+      if (input.signal?.aborted) throw abortReason(input.signal);
       const key = fingerprint(input.token);
       const at = now();
       const cached = sessions.get(key);
@@ -70,28 +101,31 @@ export function createGatewayAuthSessionCache<TAuth, TLaunch>(options: {
       if (cached) sessions.delete(key);
 
       const coalesced = flights.has(key);
-      const session = await flights.run(key, async () => {
-        const established = await input.establish();
-        const identity = options.identity(established.auth);
-        if (!identity.runId) {
-          throw new Error('Gateway authentication produced no run identity.');
-        }
-        const establishedAt = now();
-        const stored: StoredSession<TAuth, TLaunch> = {
-          ...established,
-          expiresAt: Math.min(
-            establishedAt + options.ttlMs,
-            input.tokenExpiresAt,
-          ),
-          runId: identity.runId,
-          runAttempt: identity.runAttempt,
-        };
-        if (stored.expiresAt > establishedAt) {
-          prune(establishedAt);
-          sessions.set(key, stored);
-        }
-        return stored;
-      });
+      const session = await awaitWithAbort(
+        flights.run(key, async () => {
+          const established = await input.establish();
+          const identity = options.identity(established.auth);
+          if (!identity.runId) {
+            throw new Error('Gateway authentication produced no run identity.');
+          }
+          const establishedAt = now();
+          const stored: StoredSession<TAuth, TLaunch> = {
+            ...established,
+            expiresAt: Math.min(
+              establishedAt + options.ttlMs,
+              input.tokenExpiresAt,
+            ),
+            runId: identity.runId,
+            runAttempt: identity.runAttempt,
+          };
+          if (stored.expiresAt > establishedAt) {
+            prune(establishedAt);
+            sessions.set(key, stored);
+          }
+          return stored;
+        }),
+        input.signal,
+      );
       return { ...session, source: coalesced ? 'coalesced' : 'miss' };
     },
     size: () => sessions.size,

package/dist/bundling-sources/shared_libs/play-runtime/governor/app-runtime-rate-state-backend.ts

@@ -814,11 +814,11 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
 }
 
 /**
- * Multiplier applied to an adaptive pacing rule's `requestsPerWindow` to derive
- * its `adaptiveMaxRps` ceiling. The configured rate is a safe seed, while 429
- * feedback drives AIMD toward the provider's actual limit.
+ * Multiplier applied to an undeclared default-pacing rule's
+ * `requestsPerWindow` to derive its `adaptiveMaxRps` ceiling. Declared rules
+ * carry either their explicit advisory ceiling or their hard base rate.
  */
-const ADAPTIVE_MAX_RPS_MULTIPLIER = 25;
+const DEFAULT_PACING_ADAPTIVE_MAX_RPS_MULTIPLIER = 25;
 
 /**
  * A rule id shaped `default:<toolId>` is the undeclared-tool default-pacing rule
@@ -829,23 +829,26 @@ function isDefaultPacingRuleId(ruleId: string): boolean {
 }
 
 /**
- * Preserve explicit advisory ceilings. Otherwise stamp the base * 25 ceiling
- * onto legacy default-pacing rules and declared per-second rules. This lets a
- * declared 10 QPS provider discover a higher entitlement, while longer-window
- * declared budgets remain fixed because multiplying RPM into RPS is unsafe.
+ * Preserve explicit advisory ceilings, stamp the legacy base * 25 ceiling onto
+ * undeclared default-pacing rules, and stamp declared rules with their base
+ * rate. Sending the hard base explicitly also repairs bucket rows widened by a
+ * previous runtime version on their next acquire.
  */
 function withAdaptiveMaxRps(rules: readonly PacingRule[]): PacingRule[] {
   return rules.map((rule) =>
     rule.adaptiveMaxRps != null
       ? rule
-      : isDefaultPacingRuleId(rule.ruleId) || rule.windowMs === 1_000
+      : isDefaultPacingRuleId(rule.ruleId)
         ? ({
             ...rule,
             adaptiveMaxRps:
               rule.requestsPerWindow *
-              ADAPTIVE_MAX_RPS_MULTIPLIER,
+              DEFAULT_PACING_ADAPTIVE_MAX_RPS_MULTIPLIER,
           } as PacingRule)
-        : rule,
+        : ({
+            ...rule,
+            adaptiveMaxRps: (rule.requestsPerWindow / rule.windowMs) * 1_000,
+          } as PacingRule),
   );
 }
 

package/dist/bundling-sources/shared_libs/play-runtime/governor/governor.ts

@@ -17,6 +17,7 @@ import {
   type AdapterId,
   type ResolvedExecutionPolicy,
   resolveExecutionPolicy,
+  resolveMaxConcurrentExternalCalls,
   resolveRowConcurrency,
 } from './policy';
 import { type PacingRule, type RateStateBackend } from './rate-state-backend';
@@ -187,6 +188,8 @@ interface GovernorInput {
   resolveRateScope?: RateScopeResolver;
   adaptiveAdmission?: RuntimeAdaptiveAdmission;
   resume?: GovernanceSnapshot;
+  maxConcurrentExternalCalls?: number | null;
+  maxConcurrentRows?: number | null;
 }
 
 class Semaphore {
@@ -262,7 +265,23 @@ export function createDefaultGovernanceSnapshot(scope: {
 export function createPlayExecutionGovernor(
   input: GovernorInput,
 ): PlayExecutionGovernor {
-  const policy = resolveExecutionPolicy(input.adapter);
+  const basePolicy = resolveExecutionPolicy(input.adapter);
+  const maxConcurrentExternalCalls = resolveMaxConcurrentExternalCalls(
+    input.maxConcurrentExternalCalls,
+  );
+  const maxInFlightDispatchGroups = Math.min(
+    maxConcurrentExternalCalls,
+    basePolicy.concurrency.toolDispatchGroups,
+  );
+  const policy: ResolvedExecutionPolicy = {
+    ...basePolicy,
+    concurrency: {
+      ...basePolicy.concurrency,
+      toolCalls: maxConcurrentExternalCalls,
+      toolDispatchGroups: maxInFlightDispatchGroups,
+      toolDispatchGroupsPerLane: maxInFlightDispatchGroups,
+    },
+  };
   const state: GovernanceSnapshot =
     input.resume ?? createDefaultGovernanceSnapshot(input.scope);
 
@@ -481,7 +500,7 @@ export function createPlayExecutionGovernor(
     },
 
     resolveRowConcurrency: (requested) =>
-      resolveRowConcurrency(policy, requested),
+      resolveRowConcurrency(policy, requested, input.maxConcurrentRows),
 
     async reportProviderBackpressure(bp) {
       // DB-authoritative pacer: route backpressure ONLY to the row via