deepline 0.3.127 → 0.3.129

package/dist/bundling-sources/shared_libs/play-runtime/memory-pressure-signal.ts

@@ -0,0 +1,138 @@
+import { readFileSync, renameSync, writeFileSync } from 'node:fs';
+
+/**
+ * Runner half of the sandbox memory envelope.
+ *
+ * The watchdog parent (see `runner-backends/backends/daytona-runtime-watchdog.ts`)
+ * samples the cgroup every 250 ms from outside this process. At the pressure
+ * ratio it writes the observed sample to `DEEPLINE_RUNTIME_MEMORY_PRESSURE_PATH`
+ * and raises SIGUSR2 here; at the abort ratio it terminates this process and
+ * attaches whatever `reportMemoryLedger` last wrote to
+ * `DEEPLINE_RUNTIME_MEMORY_LEDGER_PATH` to the termination diagnostic.
+ *
+ * Node's default SIGUSR2 disposition terminates the process, so the handler
+ * must exist before the watchdog can ever signal. Install it at module load of
+ * the runner entry, not lazily at first map admission.
+ *
+ * Dependency-free on purpose: this runs inside the customer runner bundle, on
+ * a process that is by construction already short of memory.
+ */
+
+/**
+ * Path this process writes its latest byte-ledger snapshot to. Per-run, so an
+ * env var rather than a constant; the watchdog passes it to the child.
+ */
+export const RUNTIME_MEMORY_LEDGER_PATH_ENV =
+  'DEEPLINE_RUNTIME_MEMORY_LEDGER_PATH';
+
+/**
+ * Path the watchdog writes the observed usage/limit to immediately before it
+ * raises SIGUSR2, so this process reports real cgroup numbers instead of
+ * guessing from inside its own heap.
+ */
+export const RUNTIME_MEMORY_PRESSURE_PATH_ENV =
+  'DEEPLINE_RUNTIME_MEMORY_PRESSURE_PATH';
+
+export type MemoryPressureSample = {
+  /** Which cgroup interface the watchdog read, when it reported one. */
+  source: string | null;
+  /** Observed cgroup usage in bytes, or null when the watchdog wrote nothing. */
+  usageBytes: number | null;
+  /** Observed cgroup limit in bytes, or null when the watchdog wrote nothing. */
+  limitBytes: number | null;
+  /** usageBytes / limitBytes, or null when either is unknown. */
+  ratio: number | null;
+};
+
+export type MemoryPressureListener = (sample: MemoryPressureSample) => void;
+
+const EMPTY_SAMPLE: MemoryPressureSample = {
+  source: null,
+  usageBytes: null,
+  limitBytes: null,
+  ratio: null,
+};
+
+const listeners = new Set<MemoryPressureListener>();
+let handlerInstalled = false;
+
+function finiteOrNull(value: unknown): number | null {
+  return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+
+/**
+ * Read the sample the watchdog wrote alongside the signal. A missing or
+ * unreadable file is not a failure: the signal itself is the instruction, and
+ * these numbers are evidence for the log line.
+ */
+export function readMemoryPressureSample(): MemoryPressureSample {
+  const path = process.env[RUNTIME_MEMORY_PRESSURE_PATH_ENV];
+  if (!path) return EMPTY_SAMPLE;
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(path, 'utf8'));
+    if (!parsed || typeof parsed !== 'object') return EMPTY_SAMPLE;
+    const record = parsed as Record<string, unknown>;
+    return {
+      source: typeof record.source === 'string' ? record.source : null,
+      usageBytes: finiteOrNull(record.usageBytes),
+      limitBytes: finiteOrNull(record.limitBytes),
+      ratio: finiteOrNull(record.ratio),
+    };
+  } catch {
+    return EMPTY_SAMPLE;
+  }
+}
+
+/**
+ * Deliver a sample to every subscriber. A throwing subscriber must not stop
+ * the others: a memory hold that half-runs is worse than one that is noisy.
+ */
+export function emitMemoryPressure(sample: MemoryPressureSample): void {
+  for (const listener of Array.from(listeners)) {
+    try {
+      listener(sample);
+    } catch {}
+  }
+}
+
+/**
+ * Install the SIGUSR2 handler. Idempotent, and safe to call before any
+ * listener exists — installing it is what stops Node's default disposition
+ * from killing the runner on the first pressure signal.
+ */
+export function installMemoryPressureHandler(): void {
+  if (handlerInstalled) return;
+  handlerInstalled = true;
+  process.on('SIGUSR2', () => {
+    emitMemoryPressure(readMemoryPressureSample());
+  });
+}
+
+/** Subscribe to watchdog memory-pressure signals. Returns an unsubscribe. */
+export function onMemoryPressure(listener: MemoryPressureListener): () => void {
+  installMemoryPressureHandler();
+  listeners.add(listener);
+  return () => {
+    listeners.delete(listener);
+  };
+}
+
+/**
+ * Publish the runtime's latest byte-ledger snapshot for the watchdog to attach
+ * to an abort diagnostic. The snapshot is opaque here: the ledger owner
+ * decides its shape. Written to a sibling temp file and renamed, so the
+ * watchdog never parses a half-written object.
+ *
+ * Never throws. A failed ledger write must not fail a run.
+ */
+export function reportMemoryLedger(snapshot: unknown): void {
+  const path = process.env[RUNTIME_MEMORY_LEDGER_PATH_ENV];
+  if (!path) return;
+  try {
+    const serialized = JSON.stringify(snapshot);
+    if (serialized === undefined) return;
+    const temporaryPath = `${path}.tmp`;
+    writeFileSync(temporaryPath, serialized);
+    renameSync(temporaryPath, path);
+  } catch {}
+}

package/dist/bundling-sources/shared_libs/play-runtime/output-size-limits.ts

@@ -38,6 +38,18 @@ export const CUSTOMER_OUTPUT_TOTAL_MAX_BYTES = 5 * 1024 * 1024;
 export const RUNTIME_RECEIPT_OUTPUT_MAX_BYTES = 10 * 1024 * 1024;
 /** One completion request may contain multiple receipts up to 32 MiB total. */
 export const RUNTIME_RECEIPT_COMPLETION_BUFFER_MAX_BYTES = 32 * 1024 * 1024;
+/**
+ * A Context can retain at most one 1,000-command logical request for each of
+ * its sixteen completion flights. This bounds closures and tiny-result bursts
+ * independently of the byte budget above.
+ */
+export const RUNTIME_RECEIPT_COMPLETION_BUFFER_MAX_ITEMS = 16_000;
+/**
+ * Controls stay small but need their own retained envelope during a full
+ * completion burst; this is a reservation, not added completion throughput.
+ */
+export const RUNTIME_RECEIPT_CONTROL_BUFFER_MAX_BYTES = 2 * 1024 * 1024;
+export const RUNTIME_RECEIPT_CONTROL_BUFFER_MAX_ITEMS = 2_000;
 /**
  * The Fly receipt gateway accepts one runner-terminal control request up to
  * this size. This is a transport ceiling, not a customer-output contract:
@@ -58,7 +70,49 @@ export const RUNTIME_RECEIPT_GATEWAY_BATCH_MAX_BYTES = 12 * 1024 * 1024;
  * prevents several multi-megabyte results from monopolizing the serialized
  * gateway writer behind one request.
  */
-export const RUNTIME_RECEIPT_WRITER_TARGET_BATCH_BYTES = 4 * 1024 * 1024;
+export const RUNTIME_RECEIPT_WRITER_TARGET_BATCH_BYTES = 8 * 1024 * 1024;
+/**
+ * Batching window for runtime step receipt completions.
+ *
+ * A completion writer with no window sends whatever settled in the current
+ * event-loop turn, so an idle writer sends singletons: one measured 1k-row
+ * fixture run spent 1,479 gateway completion requests on 17,307 receipts, 691
+ * of them carrying a single receipt. Holding results for this window lets the
+ * results of one provider wave share one request, one gateway heavy-admission
+ * slot, and one storage statement. Size and byte triggers still flush at once,
+ * so the window bounds latency without bounding throughput.
+ *
+ * The window is charged to `resultDelivery`, the interval between a parsed
+ * provider body and the row that resumes on it. On run 34088584407 (1000-row
+ * modal) that interval was 1.57 s mean / 1.61 s p50 against a 0.16 s p50
+ * gateway round trip, so the window is a small but real slice of a delivery
+ * that is otherwise transport and queue wait. Ten milliseconds still coalesces
+ * a provider wave settling in the same tick; zero would restore the
+ * singleton-request behaviour measured above.
+ */
+export const RUNTIME_RECEIPT_COMPLETION_DEBOUNCE_MS = 10;
+/**
+ * Completion batches the runner may hold open against the receipt gateway.
+ *
+ * Receipts are keyed, so completion order across batches carries no meaning;
+ * in-flight batches overlap queue wait with flight. Two were not enough for
+ * body-heavy shapes: with ~500 ms per request the runner drained at most two
+ * target batches per round trip, and jai (agent and enformion bodies of
+ * megabytes) queued 59 s per receipt while jacob queued 14 s (run
+ * 34066820247). The gateway coalesces concurrent requests of one org into a
+ * single statement under one heavy slot, so a wider runner pipeline no longer
+ * multiplies gateway statements. Sixteen, not twelve: a direct 1k-row jai
+ * Preview run filled all twelve flights, queued further receipts for 8.8 s at
+ * p90, and retained 31.2 MiB of the same 32 MiB byte budget while gateway pool
+ * wait p90 was below 1 ms and R2 persistence p90 was 1.3 ms. Sixteen turns
+ * retained queued receipts into active bounded flights; it does not enlarge
+ * that byte budget or add another persistence path. The temporary transport
+ * copy is ledgered independently, so map admission still reacts to the actual
+ * resident-memory increase.
+ */
+export const RUNTIME_RECEIPT_COMPLETION_MAX_IN_FLIGHT_BATCHES = 16;
+/** Control traffic keeps two physical transports during a completion burst. */
+export const RUNTIME_RECEIPT_CONTROL_MAX_IN_FLIGHT_BATCHES = 2;
 /**
  * The terminal `result` line is the crash-recovery record in Daytona stdout.
  * Once that line is written, retries may still emit runner-owned diagnostics.
@@ -910,6 +964,9 @@ export function assertCustomerPlayReturnWithinLimit(input: {
   });
 }
 
+const RUNTIME_RECEIPT_OUTPUT_SIZE_ADVICE =
+  'This receipt result is too large for durable call caching. This usually means raw search results, HTML, or a large list is being cached as one cell. Parse it before returning it from the tool boundary.';
+
 export function assertRuntimeReceiptOutputWithinLimit(input: {
   output: unknown;
   path: string;
@@ -919,7 +976,32 @@ export function assertRuntimeReceiptOutputWithinLimit(input: {
     value: input.output,
     path: input.path,
     limitBytes: input.limitBytes ?? RUNTIME_RECEIPT_OUTPUT_MAX_BYTES,
-    advice:
-      'This receipt result is too large for durable call caching. This usually means raw search results, HTML, or a large list is being cached as one cell. Parse it before returning it from the tool boundary.',
+    advice: RUNTIME_RECEIPT_OUTPUT_SIZE_ADVICE,
   });
 }
+
+/**
+ * Enforce the same receipt contract against an already-serialized value.
+ *
+ * The accepted completion path serializes a receipt output exactly once (the
+ * canonical Postgres JSON text that is persisted). Measuring that text instead
+ * of re-walking the value keeps the limit exact while removing the duplicate
+ * `JSON.stringify` passes that dominated gateway CPU on large results.
+ */
+export function assertSerializedRuntimeReceiptOutputWithinLimit(input: {
+  serialized: string;
+  path: string;
+  limitBytes?: number;
+}): number {
+  const limitBytes = input.limitBytes ?? RUNTIME_RECEIPT_OUTPUT_MAX_BYTES;
+  const bytes = utf8ByteLength(input.serialized);
+  if (bytes > limitBytes) {
+    throw new OutputTooLargeError({
+      path: input.path,
+      bytes,
+      limitBytes,
+      advice: RUNTIME_RECEIPT_OUTPUT_SIZE_ADVICE,
+    });
+  }
+  return bytes;
+}

package/dist/bundling-sources/shared_libs/play-runtime/persistence-latch.ts

@@ -1,4 +1,5 @@
 import { isAppRuntimeApiCapacityError } from './app-runtime-api';
+import { RuntimeReceiptWriterCapacityError } from './runtime-receipt-writer';
 
 /**
  * Runtime persistence-failure circuit breaker.
@@ -107,18 +108,75 @@ function formatLatchCause(error: unknown): string {
   return message.length > 1_000 ? `${message.slice(0, 1_000)}…` : message;
 }
 
+type RuntimePersistenceLatchListener = (cause: unknown) => void;
+
+// Kept beside the latch rather than on it: the latch is a plain data object
+// that tests compare structurally, and the error object / listener set are
+// process-local state that must not travel with a serialized latch.
+const latchCauseErrors = new WeakMap<RuntimePersistenceLatch, unknown>();
+const latchTripListeners = new WeakMap<
+  RuntimePersistenceLatch,
+  Set<RuntimePersistenceLatchListener>
+>();
+
 /**
  * Trip the latch on the first persistence failure. Idempotent: later trips are
- * no-ops so `cause` keeps the first, root failure.
+ * no-ops so `cause` keeps the first, root failure. Listeners registered with
+ * `onRuntimePersistenceLatchTripped` run once, synchronously, on that first
+ * trip, so a map can fail fast and its writers can reject their pending work
+ * with this same cause instead of waiting for it to reach them by accident.
  */
 export function tripRuntimePersistenceLatch(
   latch: RuntimePersistenceLatch,
   error: unknown,
 ): void {
-  if (isAppRuntimeApiCapacityError(error)) return;
+  if (
+    isAppRuntimeApiCapacityError(error) ||
+    error instanceof RuntimeReceiptWriterCapacityError
+  ) {
+    return;
+  }
   if (latch.tripped) return;
   latch.tripped = true;
   latch.cause = formatLatchCause(error);
+  latchCauseErrors.set(latch, error);
+  const listeners = latchTripListeners.get(latch);
+  if (!listeners) return;
+  for (const listener of [...listeners]) listener(error);
+}
+
+/**
+ * The error object behind `latch.cause`. A latch tripped through this module
+ * always has one; a latch constructed elsewhere and marked tripped by hand gets
+ * an Error carrying its formatted cause so callers can still reject with it.
+ */
+export function runtimePersistenceLatchCauseError(
+  latch: RuntimePersistenceLatch,
+): unknown {
+  if (latchCauseErrors.has(latch)) return latchCauseErrors.get(latch);
+  return new Error(latch.cause ?? 'Runtime persistence failed.');
+}
+
+/**
+ * Observe the latch's first trip. The listener does NOT run for a latch that
+ * is already tripped when it subscribes: a caller that cares about that state
+ * reads `latch.tripped` itself, because "tripped before I started" and
+ * "tripped while I was running" call for different reactions (a map started
+ * after a trip still dispatches so the circuit breaker names the refusal).
+ */
+export function onRuntimePersistenceLatchTripped(
+  latch: RuntimePersistenceLatch,
+  listener: RuntimePersistenceLatchListener,
+): () => void {
+  let listeners = latchTripListeners.get(latch);
+  if (!listeners) {
+    listeners = new Set();
+    latchTripListeners.set(latch, listeners);
+  }
+  listeners.add(listener);
+  return () => {
+    listeners.delete(listener);
+  };
 }
 
 /**

package/dist/bundling-sources/shared_libs/play-runtime/play-run-recovery-policy.ts

@@ -42,6 +42,7 @@ export type PlayRunRecoveryReason =
   | 'modal_sandbox_unavailable_before_execution'
   | 'modal_runner_start_failed_before_execution'
   | 'daytona_sandbox_transition_pending_before_execution'
+  | 'daytona_sandbox_acquisition_unavailable_before_execution'
   | 'runtime_initialization_transport_before_execution'
   | 'runtime_traffic_hold_before_execution'
   | 'runtime_traffic_throttled_before_execution';
@@ -231,6 +232,49 @@ export function recoveryForDaytonaSandboxTransitionPending(
   });
 }
 
+/**
+ * Daytona proved that a fresh sandbox was not acquired, but the provider's
+ * bounded create ladder was exhausted on a shared capacity/rate/startup
+ * condition. Keep this distinct from an ordinary runner failure: no customer
+ * code could have started, so the durable scheduler must defer the same run
+ * instead of consuming the engine-attempt budget and terminalizing it.
+ *
+ * This classifier intentionally uses the serialized error shape rather than
+ * importing the Daytona backend. The app-owned scheduler and the provider
+ * adapter must remain separate, and placement backends may still consume the
+ * raw error for an explicitly configured fallback provider before it reaches
+ * this boundary.
+ */
+export function recoveryForDaytonaSandboxAcquisitionUnavailable(
+  error: unknown,
+): PlayRunRecoveryError | null {
+  if (!error || typeof error !== 'object') return null;
+  const candidate = error as {
+    name?: unknown;
+    reason?: unknown;
+  };
+  if (
+    candidate.name !== 'DaytonaSandboxAcquisitionUnavailableError' ||
+    (candidate.reason !== 'daytona_total_cpu_limit_exceeded' &&
+      candidate.reason !== 'daytona_acquisition_rate_limited' &&
+      candidate.reason !== 'daytona_sandbox_start_timeout')
+  ) {
+    return null;
+  }
+  return new PlayRunRecoveryError({
+    decision: {
+      stage: 'pre_code',
+      action: 'defer',
+      reason: 'daytona_sandbox_acquisition_unavailable_before_execution',
+      dependency: 'runtime',
+    },
+    message:
+      `Daytona sandbox acquisition is temporarily unavailable before customer ` +
+      `execution began (${candidate.reason}).`,
+    cause: error,
+  });
+}
+
 /**
  * This is constructed only by the detached-runner readiness check.  That
  * check has not parked the runner or observed scheduler liveness, so it is a
@@ -264,7 +308,8 @@ export function recoveryForRuntimeInitializationTransportFailure(
     | 'runtime_api_transport'
     | 'runtime_receipt_gateway_transport'
     | 'daytona_public_status'
-    | 'daytona_runner_startup_transport',
+    | 'daytona_runner_startup_transport'
+    | 'daytona_infrastructure',
 ): PlayRunRecoveryError {
   return new PlayRunRecoveryError({
     decision: {

package/dist/bundling-sources/shared_libs/play-runtime/play-runs/terminal/contracts.ts

@@ -53,6 +53,8 @@ export type PlayRunTerminalInput = {
   attempt: number;
   authority?: PlayRunTerminalAuthority | null;
   result: unknown;
+  /** Completed-run progress already folded by the receipt gateway. */
+  terminalProgressEvents?: readonly unknown[];
 };
 
 export type PlayRunTerminalJob = {

package/dist/bundling-sources/shared_libs/play-runtime/play-runs/terminal/job.ts

@@ -34,6 +34,7 @@ export function createPlayRunTerminalJob(
             attempt: input.attempt,
             authority,
             result: input.result,
+            terminalProgressEvents: input.terminalProgressEvents,
             queueName: input.queueName,
             // An authority exists only for the one terminal contract this
             // build recognizes, and that contract is what proves the durable

package/dist/bundling-sources/shared_libs/play-runtime/play-runs/terminal/ports.ts

@@ -22,6 +22,7 @@ export type DirectTerminalCommitter = {
     attempt: number;
     authority: PlayRunTerminalAuthority;
     result: unknown;
+    terminalProgressEvents?: readonly unknown[];
     queueName: string;
     allowCappedCompletion: boolean;
   }): Promise<DirectTerminalCommitOutcome>;

package/dist/bundling-sources/shared_libs/play-runtime/play-runs/terminal/postgres-adapter.ts

@@ -29,6 +29,7 @@ export function createPostgresPlayRunTerminalPorts(input: {
             attempt: terminal.attempt,
             leaseToken: terminal.authority.leaseToken,
             result: terminal.result,
+            terminalProgressEvents: terminal.terminalProgressEvents,
             terminalLogOutbox: 'ctx_log_tail',
             allowCappedCompletion: terminal.allowCappedCompletion,
             engineWake: {

package/dist/bundling-sources/shared_libs/play-runtime/play-runtime-semantics.ts

@@ -34,11 +34,24 @@ export type PlayRuntimeSemantics = Readonly<{
      */
     receiptIdentityEdition: PlayAuthoringContractEdition | null;
   }>;
+  inlineChild: Readonly<{
+    /**
+     * Whether a scalar child may rely solely on its execution-time
+     * capabilities instead of a stored static pipeline. The runtime still
+     * rejects lifecycle-owning APIs at their own effect boundary.
+     */
+    runtimeOnly: boolean;
+  }>;
   slackHitl: Readonly<{
     defaultTimeoutMs: number;
   }>;
 }>;
 
+type PlayRuntimeSemanticsTemplate = Omit<
+  PlayRuntimeSemantics,
+  'authoringContractEdition'
+>;
+
 function definePlayRuntimeSemantics(
   semantics: PlayRuntimeSemantics,
 ): PlayRuntimeSemantics {
@@ -46,6 +59,7 @@ function definePlayRuntimeSemantics(
     ...semantics,
     secrets: Object.freeze({ ...semantics.secrets }),
     fetch: Object.freeze({ ...semantics.fetch }),
+    inlineChild: Object.freeze({ ...semantics.inlineChild }),
     slackHitl: Object.freeze({ ...semantics.slackHitl }),
   });
 }
@@ -58,6 +72,7 @@ const LEGACY_SEMANTICS = {
     persistHttpFailure: true,
     receiptIdentityEdition: null,
   },
+  inlineChild: { runtimeOnly: false },
 } as const;
 
 const STRICT_SEMANTICS = {
@@ -78,6 +93,13 @@ const WEEK_LONG_SLACK_HITL_SEMANTICS = {
   defaultTimeoutMs: 7 * 24 * 60 * 60 * 1000,
 } as const;
 
+// These are historical receipt-key partitions, named so later authoring
+// changes can explicitly retain them instead of creating another wire tag.
+const FETCH_RECEIPT_IDENTITIES = {
+  firstTypedHttpFailure: 5 as PlayAuthoringContractEdition,
+  typedHttpFailure: 6 as PlayAuthoringContractEdition,
+} as const;
+
 /**
  * Exhaustive compatibility registry for worker-visible Play behavior.
  *
@@ -85,39 +107,33 @@ const WEEK_LONG_SLACK_HITL_SEMANTICS = {
  * declared here. Entries are fully materialized and frozen so every context
  * using the same edition shares one cached contract projection.
  */
-const PLAY_RUNTIME_SEMANTICS_BY_EDITION = {
-  1: definePlayRuntimeSemantics({
-    authoringContractEdition: 1,
+const PLAY_RUNTIME_SEMANTICS_BY_AUTHORING = {
+  1: {
     ...LEGACY_SEMANTICS,
     slackHitl: LEGACY_SLACK_HITL_SEMANTICS,
-  }),
-  2: definePlayRuntimeSemantics({
-    authoringContractEdition: 2,
+  },
+  2: {
     ...STRICT_SEMANTICS,
     slackHitl: LEGACY_SLACK_HITL_SEMANTICS,
-  }),
-  3: definePlayRuntimeSemantics({
-    authoringContractEdition: 3,
+  },
+  3: {
     ...STRICT_SEMANTICS,
     slackHitl: LEGACY_SLACK_HITL_SEMANTICS,
-  }),
-  4: definePlayRuntimeSemantics({
-    authoringContractEdition: 4,
+  },
+  4: {
     ...PLAINTEXT_SECRET_SEMANTICS,
     slackHitl: LEGACY_SLACK_HITL_SEMANTICS,
-  }),
-  5: definePlayRuntimeSemantics({
-    authoringContractEdition: 5,
+  },
+  5: {
     ...PLAINTEXT_SECRET_SEMANTICS,
     slackHitl: LEGACY_SLACK_HITL_SEMANTICS,
     fetch: {
       httpFailure: 'throw_typed_error',
       persistHttpFailure: false,
-      receiptIdentityEdition: 5,
+      receiptIdentityEdition: FETCH_RECEIPT_IDENTITIES.firstTypedHttpFailure,
     },
-  }),
-  6: definePlayRuntimeSemantics({
-    authoringContractEdition: 6,
+  },
+  6: {
     ...PLAINTEXT_SECRET_SEMANTICS,
     slackHitl: LEGACY_SLACK_HITL_SEMANTICS,
     fetch: {
@@ -125,20 +141,47 @@ const PLAY_RUNTIME_SEMANTICS_BY_EDITION = {
       persistHttpFailure: false,
       // Preserve the existing edition-6 receipt identity. Future unrelated
       // editions may retain this epoch rather than partitioning the cache.
-      receiptIdentityEdition: 6,
+      receiptIdentityEdition: FETCH_RECEIPT_IDENTITIES.typedHttpFailure,
     },
-  }),
-  7: definePlayRuntimeSemantics({
-    authoringContractEdition: 7,
+  },
+  7: {
     ...PLAINTEXT_SECRET_SEMANTICS,
+    fetch: {
+      httpFailure: 'throw_typed_error',
+      persistHttpFailure: false,
+      receiptIdentityEdition: FETCH_RECEIPT_IDENTITIES.typedHttpFailure,
+    },
     slackHitl: WEEK_LONG_SLACK_HITL_SEMANTICS,
+  },
+  8: {
+    ...PLAINTEXT_SECRET_SEMANTICS,
     fetch: {
       httpFailure: 'throw_typed_error',
       persistHttpFailure: false,
-      receiptIdentityEdition: 6,
+      // Inline-child admission does not change fetch receipt identity.
+      receiptIdentityEdition: FETCH_RECEIPT_IDENTITIES.typedHttpFailure,
+    },
+    inlineChild: { runtimeOnly: true },
+    slackHitl: WEEK_LONG_SLACK_HITL_SEMANTICS,
+  },
+} satisfies Record<PlayAuthoringContractEdition, PlayRuntimeSemanticsTemplate>;
+
+const PLAY_RUNTIME_SEMANTICS = Object.fromEntries(
+  Object.entries(PLAY_RUNTIME_SEMANTICS_BY_AUTHORING).map(
+    ([storedEdition, semantics]) => {
+      const authoringContractEdition = normalizePlayAuthoringContractEdition(
+        Number(storedEdition),
+      );
+      return [
+        authoringContractEdition,
+        definePlayRuntimeSemantics({
+          authoringContractEdition,
+          ...semantics,
+        }),
+      ];
     },
-  }),
-} satisfies Record<PlayAuthoringContractEdition, PlayRuntimeSemantics>;
+  ),
+) as Record<PlayAuthoringContractEdition, PlayRuntimeSemantics>;
 
 export function resolvePlayRuntimeSemantics(
   authoringContractEdition: unknown,
@@ -146,5 +189,5 @@ export function resolvePlayRuntimeSemantics(
   const edition = normalizePlayAuthoringContractEdition(
     authoringContractEdition,
   );
-  return PLAY_RUNTIME_SEMANTICS_BY_EDITION[edition];
+  return PLAY_RUNTIME_SEMANTICS[edition];
 }