deepline 0.3.284 → 0.3.286

package/dist/bundling-sources/shared_libs/play-runtime/durable-receipt-execution.ts

@@ -16,42 +16,22 @@ import type {
   RuntimeMemoryOccupancyReader,
 } from './map-memory-limits';
 import type { DurableReceiptRecoverySource } from './tool-execution-outcome';
-import {
-  isPlayExecutionSuspendedError,
-  isPlayRowExecutionSuspendedError,
-  PlayRowProviderBackpressureError,
-} from './suspension';
 import type { WorkReceiptFailureKind } from './work-receipts';
-import {
-  PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
-  runtimeLeaseHeartbeatIntervalFromExpiry,
-  runtimeLeaseHeartbeatIntervalMs,
-} from './lease-policy';
 import { createRuntimeReceiptHeartbeatSupervisor } from './receipt-heartbeat-supervisor';
-import {
-  deserializeToolExecutionFailure,
-  serializeToolExecutionFailure,
-  TOOL_EXECUTION_ERROR_SCHEMA_VERSION,
-} from '../plays/tool-execution-error';
 import type {
   ToolExecutionErrorSchemaVersion,
   ToolExecutionFailureV1,
 } from '../plays/tool-execution-error';
 
-export const DURABLE_RECEIPT_WAIT_MAX_ATTEMPTS = 240;
 export const DURABLE_RECEIPT_WAIT_DELAY_MS = 250;
-// A running receipt owned elsewhere is re-read with exponential backoff up to
-// this cap. Fixed 250 ms polls from every waiting group were most of the
-// gateway read traffic in a 1k map. Because the delay grows, the attempt count
-// alone no longer bounds wall time: every backoff loop must clamp itself to
-// `runtimeReceiptWaitBudgetMs`.
+// Invocation execution-lock retries back off within their wall-clock deadline.
 export const DURABLE_RECEIPT_WAIT_MAX_DELAY_MS = 2_000;
 // The hydration lane re-examines its queue on this cadence while turns are
 // waiting, so headroom freed outside the lane reaches a waiter promptly. It is
 // a probe interval, not a width: nothing about it bounds concurrency.
 const RUNTIME_RECEIPT_HYDRATION_PROBE_MS = 25;
 
-/** Backoff delay before re-reading a running receipt on the given attempt (1-based). */
+/** Backoff delay for an invocation execution-lock retry (1-based). */
 export function runtimeReceiptWaitDelayMs(attempt: number): number {
   const exponent = Math.max(0, Math.min(attempt, 8) - 1);
   return Math.min(
@@ -60,30 +40,6 @@ export function runtimeReceiptWaitDelayMs(attempt: number): number {
   );
 }
 
-/**
- * Whether a claim that came back `existing` is actually blocked by live work.
- *
- * A non-forced claim's status set is `('pending','failed')`, so a `running`
- * row returns `existing` whether its owner is alive or long dead. Only an
- * unexpired lease proves the former; anything else must be reclaimed and
- * re-executed rather than waited on.
- */
-export function runtimeReceiptClaimLeaseIsLive(
-  claim: Pick<RuntimeStepReceipt, 'leaseExpiresAt'>,
-  nowMs: number = Date.now(),
-): boolean {
-  const expiresAtMs = Date.parse(claim.leaseExpiresAt ?? '');
-  return !Number.isFinite(expiresAtMs) || expiresAtMs > nowMs;
-}
-
-/** Wall-clock budget that a fixed-delay attempt count used to express. */
-export function runtimeReceiptWaitBudgetMs(
-  maxAttempts: number,
-  delayMs: number = DURABLE_RECEIPT_WAIT_DELAY_MS,
-): number {
-  return Math.max(delayMs, maxAttempts * delayMs);
-}
-
 /**
  * Settled per-key hydration samples the lane keeps to price a turn. Bounded,
  * so past this many the reservoir below chooses which to keep.
@@ -702,18 +658,6 @@ export class RuntimeReceiptLeaseLostError extends Error {
   }
 }
 
-function isInFlightRuntimeReceipt(
-  receipt: RuntimeStepReceipt | null | undefined,
-): receipt is RuntimeStepReceipt & {
-  status: 'queued' | 'pending' | 'running';
-} {
-  return (
-    receipt?.status === 'queued' ||
-    receipt?.status === 'pending' ||
-    receipt?.status === 'running'
-  );
-}
-
 export function runtimeReceiptFailureKindForError(
   _error: unknown,
 ): WorkReceiptFailureKind {
@@ -753,45 +697,11 @@ export function resolveRuntimeToolReceiptWaitMaxAttempts(
   );
 }
 
-function throwIfReceiptWaitAborted(signal?: AbortSignal): void {
-  if (!signal?.aborted) return;
-  throw signal.reason instanceof Error
-    ? signal.reason
-    : new Error(
-        typeof signal.reason === 'string' && signal.reason.trim()
-          ? signal.reason
-          : 'Durable receipt wait aborted.',
-      );
-}
-
-async function sleepReceiptWait(
-  delayMs: number,
-  signal?: AbortSignal,
-): Promise<void> {
-  throwIfReceiptWaitAborted(signal);
+async function sleepReceiptWait(delayMs: number): Promise<void> {
   if (delayMs <= 0) return;
-  await new Promise<void>((resolve, reject) => {
-    const timeout = setTimeout(finish, delayMs);
-    const abort = () => {
-      clearTimeout(timeout);
-      reject(
-        signal?.reason instanceof Error
-          ? signal.reason
-          : new Error(
-              typeof signal?.reason === 'string' && signal.reason.trim()
-                ? signal.reason
-                : 'Durable receipt wait aborted.',
-            ),
-      );
-    };
-    function finish() {
-      signal?.removeEventListener('abort', abort);
-      resolve();
-    }
-    signal?.addEventListener('abort', abort, { once: true });
-    if (signal?.aborted) abort();
+  await new Promise<void>((resolve) => {
+    setTimeout(resolve, delayMs);
   });
-  throwIfReceiptWaitAborted(signal);
 }
 
 export type DurableReceiptOperation = 'step' | 'tool' | 'fetch' | 'runPlay';
@@ -849,206 +759,12 @@ export type DurableReceiptExecutionStore = {
   }) => Promise<boolean>;
 };
 
-async function executeWithDurableRuntimeReceiptHeartbeat<T>(input: {
-  receiptKey: string;
-  runId: string;
-  leaseId: string;
-  heartbeatIntervalMs?: number;
-  store: DurableReceiptExecutionStore;
-  onTerminalHeartbeat?: (receipt: RuntimeStepReceipt) => void;
-  execute: () => Promise<T>;
-}): Promise<T> {
-  if (!input.store.heartbeat) {
-    return await input.execute();
-  }
-  const heartbeatIntervalMs =
-    input.heartbeatIntervalMs ??
-    runtimeLeaseHeartbeatIntervalMs(PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS);
-  if (!Number.isFinite(heartbeatIntervalMs) || heartbeatIntervalMs <= 0) {
-    throw new Error('Runtime receipt heartbeat interval must be positive.');
-  }
-
-  let rejectLeaseLost!: (error: RuntimeReceiptLeaseLostError) => void;
-  const leaseLost = new Promise<never>((_, reject) => {
-    rejectLeaseLost = reject;
-  });
-  const heartbeatOnce = async (): Promise<'active' | 'terminal'> => {
-    const receipt = await input.store.heartbeat!(
-      input.receiptKey,
-      input.runId,
-      input.leaseId,
-    );
-    const isTerminal =
-      receipt?.status === 'completed' || receipt?.status === 'skipped';
-    if (receipt && isTerminal) {
-      input.onTerminalHeartbeat?.(receipt);
-      return 'terminal';
-    }
-    const stillOwnsReceipt =
-      receipt &&
-      (receipt.status === 'running' || receipt.status === 'queued') &&
-      receipt.leaseId === input.leaseId;
-    if (!stillOwnsReceipt) {
-      const latest = await input.store.get(input.receiptKey);
-      if (
-        latest &&
-        (latest.status === 'completed' || latest.status === 'skipped')
-      ) {
-        input.onTerminalHeartbeat?.(latest);
-        return 'terminal';
-      }
-    }
-    if (!stillOwnsReceipt) {
-      throw new RuntimeReceiptLeaseLostError(input);
-    }
-    return 'active';
-  };
-  const supervisor = createRuntimeReceiptHeartbeatSupervisor({
-    intervalMs: heartbeatIntervalMs,
-    heartbeat: heartbeatOnce,
-    isLeaseLost: (error) => error instanceof RuntimeReceiptLeaseLostError,
-    onLeaseLost: (error) =>
-      rejectLeaseLost(error as RuntimeReceiptLeaseLostError),
-  });
-
-  // The claim is the authoritative pre-dispatch ownership fence. Renewal is
-  // only needed when the lease approaches expiry; an immediate read/renewal
-  // adds a round trip to every short tool call without extending ownership.
-  // Completion remains conditional on this lease, and long work still renews.
-  supervisor.start();
-  try {
-    return await Promise.race([input.execute(), leaseLost]);
-  } finally {
-    supervisor.stop();
-  }
-}
-
 export function runtimeReceiptOutput<T>(receipt: RuntimeStepReceipt): T {
   return isSerializedToolExecuteResult(receipt.output)
     ? (deserializeToolExecuteResult(receipt.output) as T)
     : (receipt.output as T);
 }
 
-export function runtimeReceiptFailureError(
-  receipt: RuntimeStepReceipt,
-  legacyPrefix: string,
-  _toolErrorSchemaVersion: ToolExecutionErrorSchemaVersion,
-): Error {
-  const message = receipt.error ?? 'unknown error';
-  return (
-    deserializeToolExecutionFailure(
-      message,
-      receipt.errorPayload,
-      TOOL_EXECUTION_ERROR_SCHEMA_VERSION,
-    ) ?? new Error(`${legacyPrefix}: ${message}`)
-  );
-}
-
-export async function waitForCompletedRuntimeReceipt(input: {
-  receiptKey: string;
-  store: Pick<DurableReceiptExecutionStore, 'getMany'>;
-  maxAttempts?: number;
-  delayMs?: number;
-  abortSignal?: AbortSignal;
-  toolErrorSchemaVersion: ToolExecutionErrorSchemaVersion;
-}): Promise<RuntimeStepReceipt> {
-  const maxAttempts = input.maxAttempts ?? DURABLE_RECEIPT_WAIT_MAX_ATTEMPTS;
-  const delayMs = input.delayMs ?? DURABLE_RECEIPT_WAIT_DELAY_MS;
-  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-    throwIfReceiptWaitAborted(input.abortSignal);
-    if (attempt > 0) {
-      await sleepReceiptWait(delayMs, input.abortSignal);
-    }
-    const receipt = (await input.store.getMany([input.receiptKey])).get(
-      input.receiptKey,
-    );
-    if (receipt?.status === 'completed' || receipt?.status === 'skipped') {
-      return receipt;
-    }
-    if (receipt?.status === 'failed') {
-      throw runtimeReceiptFailureError(
-        receipt,
-        `Durable tool call ${input.receiptKey} failed`,
-        input.toolErrorSchemaVersion,
-      );
-    }
-  }
-  throw new RuntimeReceiptWaitTimeoutError(input.receiptKey);
-}
-
-export async function waitForCompletedRuntimeReceipts(input: {
-  receiptKeys: string[];
-  store: Pick<DurableReceiptExecutionStore, 'getMany'>;
-  maxAttempts?: number;
-  delayMs?: number;
-  abortSignal?: AbortSignal;
-  log?: (message: string) => void;
-  toolErrorSchemaVersion: ToolExecutionErrorSchemaVersion;
-}): Promise<{
-  completed: Map<string, RuntimeStepReceipt>;
-  failed: Map<string, Error>;
-  timedOut: Set<string>;
-}> {
-  const uniqueKeys = [
-    ...new Set(input.receiptKeys.map((key) => key.trim()).filter(Boolean)),
-  ];
-  const pending = new Set(uniqueKeys);
-  const completed = new Map<string, RuntimeStepReceipt>();
-  const failed = new Map<string, Error>();
-  const maxAttempts = input.maxAttempts ?? DURABLE_RECEIPT_WAIT_MAX_ATTEMPTS;
-  const delayMs = input.delayMs ?? DURABLE_RECEIPT_WAIT_DELAY_MS;
-
-  for (
-    let attempt = 0;
-    attempt < maxAttempts && pending.size > 0;
-    attempt += 1
-  ) {
-    throwIfReceiptWaitAborted(input.abortSignal);
-    if (attempt > 0) {
-      await sleepReceiptWait(delayMs, input.abortSignal);
-    }
-    const receipts = await input.store.getMany([...pending]);
-    const statuses = [...receipts.values()].reduce<Record<string, number>>(
-      (counts, receipt) => {
-        counts[receipt.status] = (counts[receipt.status] ?? 0) + 1;
-        return counts;
-      },
-      {},
-    );
-    input.log?.(
-      `[perf] runtime-receipt-wait attempt=${attempt} requested=${pending.size} indexed=${receipts.size} statuses=${
-        Object.entries(statuses)
-          .map(([status, count]) => `${status}:${count}`)
-          .join(',') || 'none'
-      }`,
-    );
-    for (const key of [...pending]) {
-      const receipt = receipts.get(key);
-      if (receipt?.status === 'completed' || receipt?.status === 'skipped') {
-        completed.set(key, receipt);
-        pending.delete(key);
-        continue;
-      }
-      if (receipt?.status === 'failed') {
-        failed.set(
-          key,
-          runtimeReceiptFailureError(
-            receipt,
-            `Durable tool call ${key} failed`,
-            input.toolErrorSchemaVersion,
-          ),
-        );
-        pending.delete(key);
-      }
-    }
-    input.log?.(
-      `[perf] runtime-receipt-wait attempt=${attempt} remaining=${pending.size}`,
-    );
-  }
-
-  return { completed, failed, timedOut: pending };
-}
-
 export async function executeWithDurableRuntimeReceipt<T>(input: {
   operation: DurableReceiptOperation;
   id: string;
@@ -1071,14 +787,14 @@ export async function executeWithDurableRuntimeReceipt<T>(input: {
   shouldPersistFailure?: (error: unknown) => boolean;
   heartbeatIntervalMs?: number;
   markRunningBeforeExecute?: boolean;
-  /** New receipt-cache path: read completed facts, execute without creating an
-   * in-flight receipt, then atomically insert the completed fact. */
+  /** Historical caller option; all receipts now cache completed values only. */
   completedCacheOnly?: boolean;
   withCompletedReceiptHydration?: <Result>(
     hydrate: () => Promise<Result>,
   ) => Promise<Result>;
   requiresExecutionLock?: boolean;
   executionLockTtlMs?: number;
+  executionLockKey?: string;
   toolErrorSchemaVersion: ToolExecutionErrorSchemaVersion;
   formatError: (error: unknown) => string;
   log: (message: string) => void;
@@ -1087,35 +803,20 @@ export async function executeWithDurableRuntimeReceipt<T>(input: {
     signal?: AbortSignal;
   }) => Promise<T>;
 }): Promise<T> {
-  const lifecycleStartedAt = Date.now();
-  const logPhase = (phase: string, startedAt: number): void => {
-    // Keep this at the semantic receipt layer. Transport timing below this
-    // function explains HTTP cost; these markers expose gaps before/after the
-    // store calls and prove whether user code or receipt orchestration owns the
-    // elapsed time. Do not log receipt keys because they encode tool inputs.
-    input.log(
-      `[perf] durable receipt operation=${input.operation} id=${input.id} phase=${phase} elapsed_ms=${Date.now() - startedAt} lifecycle_ms=${Date.now() - lifecycleStartedAt}`,
-    );
-  };
   if (!input.store.enabled) {
     return await input.execute({ leaseId: null });
   }
 
   const recoverCompletedReceipt = async (
     receipt: RuntimeStepReceipt,
-    source: DurableReceiptRecoverySource = 'cache',
   ): Promise<T> => {
-    input.log(
-      source === 'owner'
-        ? `ctx.${input.operation}(${input.id}): executed and converged through immutable publication`
-        : `ctx.${input.operation}(${input.id}): reused completed work`,
-    );
+    input.log(`ctx.${input.operation}(${input.id}): reused completed work`);
     if (receipt.output === undefined) {
       return receipt.output as T;
     }
     const output = runtimeReceiptOutput<T>(receipt);
     const recovered = input.onRecovered
-      ? input.onRecovered(output, receipt, source)
+      ? input.onRecovered(output, receipt, 'cache')
       : output;
     if (input.markSkipped) {
       await input.markSkipped(recovered);
@@ -1123,509 +824,146 @@ export async function executeWithDurableRuntimeReceipt<T>(input: {
     return recovered;
   };
 
-  if (input.completedCacheOnly === true) {
-    const withCompletedReceiptHydration = async <Result>(
-      hydrate: () => Promise<Result>,
-    ): Promise<Result> =>
-      input.withCompletedReceiptHydration
-        ? await input.withCompletedReceiptHydration(hydrate)
-        : await hydrate();
-    const inspectCompletedReceipt = async (
-      read: () => Promise<RuntimeStepReceipt | null>,
-      source: DurableReceiptRecoverySource = 'cache',
-    ): Promise<{ kind: 'recovered'; output: T } | { kind: 'unresolved' }> => {
-      const inspect = async () => {
-        const receipt = await read();
-        if (receipt?.status === 'completed' || receipt?.status === 'skipped') {
-          return {
-            kind: 'recovered' as const,
-            output: await recoverCompletedReceipt(receipt, source),
-          };
-        }
-        return { kind: 'unresolved' as const };
-      };
-      return await withCompletedReceiptHydration(inspect);
+  if (input.force !== true) {
+    const readCompleted = async (): Promise<
+      { kind: 'recovered'; output: T } | { kind: 'unresolved' }
+    > => {
+      const receipt = await input.store.get(input.receiptKey);
+      if (receipt?.status === 'completed' || receipt?.status === 'skipped') {
+        return {
+          kind: 'recovered',
+          output: await recoverCompletedReceipt(receipt),
+        };
+      }
+      return { kind: 'unresolved' };
     };
-    if (input.force !== true) {
-      const cached = await inspectCompletedReceipt(() =>
-        input.store.get(input.receiptKey),
+    const cached = input.withCompletedReceiptHydration
+      ? await input.withCompletedReceiptHydration(readCompleted)
+      : await readCompleted();
+    if (cached.kind === 'recovered') return cached.output;
+  }
+  const needsLock = input.requiresExecutionLock === true;
+  const ownerExecutionId = `${input.runId}:${crypto.randomUUID()}`;
+  const executionLockKey =
+    input.executionLockKey?.trim() ||
+    `${input.receiptKey}:invocation:${ownerExecutionId}`;
+  let ownsLock = false;
+  let lockSupervisor: ReturnType<
+    typeof createRuntimeReceiptHeartbeatSupervisor
+  > | null = null;
+  const executionAbortController = needsLock ? new AbortController() : null;
+  if (needsLock) {
+    if (
+      !input.store.acquireExecutionLock ||
+      !input.store.releaseExecutionLock
+    ) {
+      throw new Error(
+        `ctx.${input.operation}(${input.id}): non-idempotent provider requires the receipt execution-lock backend.`,
       );
-      if (cached.kind === 'recovered') return cached.output;
     }
-    const needsLock = input.requiresExecutionLock === true;
-    const ownerExecutionId = `${input.runId}:${crypto.randomUUID()}`;
-    let ownsLock = false;
-    let lockSupervisor: ReturnType<
-      typeof createRuntimeReceiptHeartbeatSupervisor
-    > | null = null;
-    const executionAbortController = needsLock ? new AbortController() : null;
-    if (needsLock) {
-      if (
-        !input.store.acquireExecutionLock ||
-        !input.store.releaseExecutionLock
-      ) {
-        throw new Error(
-          `ctx.${input.operation}(${input.id}): non-idempotent provider requires the receipt execution-lock backend.`,
-        );
+    const deadline = Date.now() + DANGEROUS_SIDE_EFFECT_LOCK_WAIT_MS;
+    let completedWaitAttempt = 0;
+    while (!ownsLock) {
+      const lock = await input.store.acquireExecutionLock({
+        receiptKey: executionLockKey,
+        ownerExecutionId,
+        ttlMs: input.executionLockTtlMs ?? TOOL_RECEIPT_DEFAULT_WAIT_MS,
+      });
+      ownsLock = lock?.ownerExecutionId === ownerExecutionId;
+      if (ownsLock) break;
+      if (Date.now() >= deadline) {
+        throw new RuntimeReceiptWaitTimeoutError(input.receiptKey);
       }
-      const deadline = Date.now() + DANGEROUS_SIDE_EFFECT_LOCK_WAIT_MS;
-      let completedWaitAttempt = 0;
-      while (!ownsLock) {
-        const lock = await input.store.acquireExecutionLock({
-          receiptKey: input.receiptKey,
+      completedWaitAttempt += 1;
+      await sleepReceiptWait(
+        Math.min(
+          runtimeReceiptWaitDelayMs(completedWaitAttempt),
+          Math.max(0, deadline - Date.now()),
+        ),
+      );
+    }
+    const lockTtlMs = input.executionLockTtlMs ?? TOOL_RECEIPT_DEFAULT_WAIT_MS;
+    lockSupervisor = createRuntimeReceiptHeartbeatSupervisor({
+      intervalMs:
+        input.heartbeatIntervalMs ?? Math.max(1_000, Math.floor(lockTtlMs / 3)),
+      heartbeat: async () => {
+        const renewed = await input.store.acquireExecutionLock!({
+          receiptKey: executionLockKey,
           ownerExecutionId,
-          ttlMs: input.executionLockTtlMs ?? TOOL_RECEIPT_DEFAULT_WAIT_MS,
+          ttlMs: lockTtlMs,
         });
-        ownsLock = lock?.ownerExecutionId === ownerExecutionId;
-        if (ownsLock) break;
-        if (input.force !== true) {
-          const winner = await inspectCompletedReceipt(
-            () => input.store.get(input.receiptKey),
-            'in_flight',
-          );
-          if (winner.kind === 'recovered') return winner.output;
-        }
-        if (Date.now() >= deadline) {
-          throw new RuntimeReceiptWaitTimeoutError(input.receiptKey);
-        }
-        completedWaitAttempt += 1;
-        await sleepReceiptWait(
-          Math.min(
-            runtimeReceiptWaitDelayMs(completedWaitAttempt),
-            Math.max(0, deadline - Date.now()),
-          ),
-        );
-      }
-      if (input.force !== true) {
-        const afterLock = await inspectCompletedReceipt(
-          () => input.store.get(input.receiptKey),
-          'in_flight',
-        );
-        if (afterLock.kind === 'recovered') {
-          await input.store.releaseExecutionLock({
-            receiptKey: input.receiptKey,
-            ownerExecutionId,
+        if (renewed?.ownerExecutionId !== ownerExecutionId) {
+          throw new RuntimeReceiptLeaseLostError({
+            receiptKey: executionLockKey,
+            runId: input.runId,
+            leaseId: ownerExecutionId,
           });
-          return afterLock.output;
         }
-      }
-      const lockTtlMs =
-        input.executionLockTtlMs ?? TOOL_RECEIPT_DEFAULT_WAIT_MS;
-      lockSupervisor = createRuntimeReceiptHeartbeatSupervisor({
-        intervalMs:
-          input.heartbeatIntervalMs ??
-          Math.max(1_000, Math.floor(lockTtlMs / 3)),
-        heartbeat: async () => {
-          const renewed = await input.store.acquireExecutionLock!({
-            receiptKey: input.receiptKey,
-            ownerExecutionId,
-            ttlMs: lockTtlMs,
-          });
-          if (renewed?.ownerExecutionId !== ownerExecutionId) {
-            throw new RuntimeReceiptLeaseLostError({
-              receiptKey: input.receiptKey,
-              runId: input.runId,
-              leaseId: ownerExecutionId,
-            });
-          }
-          return 'active';
-        },
-        isLeaseLost: (error) => error instanceof RuntimeReceiptLeaseLostError,
-        onLeaseLost: (error) => {
-          input.log(
-            `ctx.${input.operation}(${input.id}): dangerous side-effect execution fence lost: ${error instanceof Error ? error.message : String(error)}`,
-          );
-          executionAbortController?.abort(error);
-        },
-      });
-      lockSupervisor.start();
-    }
-    const releaseOwnLock = async (): Promise<void> => {
-      lockSupervisor?.stop();
-      lockSupervisor = null;
-      if (ownsLock) {
-        ownsLock = false;
-        await input.store.releaseExecutionLock!({
-          receiptKey: input.receiptKey,
-          ownerExecutionId,
-        });
-      }
-    };
-    let executed: T;
-    try {
-      executed = await input.execute({
-        leaseId: null,
-        signal: executionAbortController?.signal,
-      });
-      executionAbortController?.signal.throwIfAborted();
-    } catch (error) {
-      await releaseOwnLock();
-      throw error;
-    }
-    try {
-      const result = input.onClaimedResult
-        ? input.onClaimedResult(executed, input.receiptKey)
-        : executed;
-      assertNoSecretTaint(result, `ctx.${input.operation} result`);
-      // Force bypasses the immutable cache. It does not grant permission to
-      // replace the completed fact already published under this semantic key.
-      if (input.force === true) {
-        return result;
-      }
-      // The hydration window bounds how many stored payloads expand at once.
-      // A completion is a write, and on wire format 3 it answers with a
-      // compact acknowledgement carrying no payload at all — nothing expands,
-      // so nothing needs a turn. Holding a slot of the 8-wide run-global
-      // window across the whole gateway round trip only queued unrelated rows
-      // behind this row's write. Only a response that really carries a stored
-      // payload decodes under the gate.
-      const completed = await input.store.complete(
-        input.receiptKey,
-        input.runId,
-        isToolExecuteResult(result)
-          ? serializeToolExecuteResult(result)
-          : result,
-        COMPLETED_RECEIPT_CACHE_INSERT_LEASE_ID,
-      );
-      if (
-        completed?.status === 'completed' ||
-        completed?.status === 'skipped'
-      ) {
-        if (completed.output === undefined) return result;
-        return await withCompletedReceiptHydration(
-          async () => await recoverCompletedReceipt(completed, 'owner'),
+        return 'active';
+      },
+      isLeaseLost: (error) => error instanceof RuntimeReceiptLeaseLostError,
+      onLeaseLost: (error) => {
+        input.log(
+          `ctx.${input.operation}(${input.id}): dangerous side-effect execution fence lost: ${error instanceof Error ? error.message : String(error)}`,
         );
-      }
-      const winner = await inspectCompletedReceipt(
-        () => input.store.get(input.receiptKey),
-        'owner',
-      );
-      if (winner.kind === 'recovered') return winner.output;
-      throw new Error(
-        `ctx.${input.operation}(${input.id}): completed receipt cache insert failed.`,
-      );
-    } finally {
-      await releaseOwnLock();
-    }
+        executionAbortController?.abort(error);
+      },
+    });
+    lockSupervisor.start();
   }
-
-  let ownedLeaseId: string | null = null;
-  let ownedLeaseExpiresAt: string | null = null;
-
-  const reclaimReceipt = async (): Promise<
-    { kind: 'recovered'; output: T } | { kind: 'claimed' }
-  > => {
-    const reclaimed = await input.store.claim(
-      input.receiptKey,
-      input.runId,
-      true,
-    );
-    if (reclaimed?.status === 'completed' || reclaimed?.status === 'skipped') {
-      return {
-        kind: 'recovered',
-        output: await recoverCompletedReceipt(reclaimed, 'cache'),
-      };
-    }
-    if (reclaimed?.status === 'failed') {
-      throw runtimeReceiptFailureError(
-        reclaimed,
-        `ctx.${input.operation}(${input.id}): previous execution failed and cannot be reused`,
-        input.toolErrorSchemaVersion,
-      );
-    }
-    if (
-      isInFlightRuntimeReceipt(reclaimed) &&
-      reclaimed.claimState === 'existing'
-    ) {
-      throw new RuntimeReceiptWaitTimeoutError(input.receiptKey);
-    }
-    ownedLeaseId = reclaimed?.leaseId ?? null;
-    ownedLeaseExpiresAt = reclaimed?.leaseExpiresAt ?? null;
-    return { kind: 'claimed' };
-  };
-  const shouldRepairSameRunRunningReceipt = (
-    receipt: RuntimeStepReceipt,
-  ): boolean =>
-    input.repairRunningReceiptForSameRun === true &&
-    isInFlightRuntimeReceipt(receipt) &&
-    typeof receipt.runId === 'string' &&
-    receipt.runId.trim() === input.runId;
-  const waitForRunningReceiptOrRelease = async (): Promise<
-    { kind: 'recovered'; output: T } | { kind: 'claimed' }
-  > => {
-    const maxAttempts =
-      input.runningReceiptWaitMaxAttempts ?? DURABLE_RECEIPT_WAIT_MAX_ATTEMPTS;
-    const delayMs =
-      input.runningReceiptWaitDelayMs ?? DURABLE_RECEIPT_WAIT_DELAY_MS;
-    // An explicit delay keeps the caller's fixed cadence; the default backs off.
-    const backoff = input.runningReceiptWaitDelayMs == null;
-    const waitDeadline =
-      Date.now() + runtimeReceiptWaitBudgetMs(maxAttempts, delayMs);
-    for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-      if (attempt > 0) {
-        if (backoff && Date.now() >= waitDeadline) break;
-        await sleepReceiptWait(
-          backoff
-            ? Math.min(
-                runtimeReceiptWaitDelayMs(attempt),
-                Math.max(0, waitDeadline - Date.now()),
-              )
-            : delayMs,
-        );
-      }
-      const current = await input.store.get(input.receiptKey);
-      if (current?.status === 'completed' || current?.status === 'skipped') {
-        return {
-          kind: 'recovered',
-          output: await recoverCompletedReceipt(current, 'in_flight'),
-        };
-      }
-      if (current?.status === 'failed') {
-        throw runtimeReceiptFailureError(
-          current,
-          `ctx.${input.operation}(${input.id}): previous execution failed and cannot be reused`,
-          input.toolErrorSchemaVersion,
-        );
-      }
-      if (
-        (current?.status === 'queued' || current?.status === 'pending') &&
-        !current.leaseId &&
-        !current.leaseExpiresAt
-      ) {
-        return await reclaimReceipt();
-      }
-    }
-    throw new RuntimeReceiptWaitTimeoutError(input.receiptKey);
-  };
-  const repairOrWaitForRunningReceipt = async (
-    receipt: RuntimeStepReceipt,
-  ): Promise<{ kind: 'recovered'; output: T } | { kind: 'claimed' }> => {
-    if (shouldRepairSameRunRunningReceipt(receipt)) {
-      const recovered = await reclaimReceipt();
-      if (recovered.kind === 'recovered') return recovered;
-      return { kind: 'claimed' };
-    }
-    try {
-      return await waitForRunningReceiptOrRelease();
-    } catch (error) {
-      if (error instanceof RuntimeReceiptWaitTimeoutError) {
-        const recovered = await reclaimReceipt();
-        if (recovered.kind === 'recovered') return recovered;
-        return { kind: 'claimed' };
-      }
-      throw error;
+  const releaseOwnLock = async (): Promise<void> => {
+    lockSupervisor?.stop();
+    lockSupervisor = null;
+    if (ownsLock) {
+      ownsLock = false;
+      await input.store.releaseExecutionLock!({
+        receiptKey: executionLockKey,
+        ownerExecutionId,
+      });
     }
   };
-  const repairFailedReceipt = async (
-    receipt: RuntimeStepReceipt,
-  ): Promise<never> => {
-    throw runtimeReceiptFailureError(
-      receipt,
-      `ctx.${input.operation}(${input.id}): previous execution failed and cannot be reused`,
-      input.toolErrorSchemaVersion,
-    );
-  };
-
-  const claimStartedAt = Date.now();
-  const claimed = await input.store.claim(
-    input.receiptKey,
-    input.runId,
-    input.reclaimRunning === true || input.force === true,
-    input.force === true,
-  );
-  logPhase('claim', claimStartedAt);
-  if (
-    input.force !== true &&
-    (claimed?.status === 'completed' || claimed?.status === 'skipped')
-  ) {
-    return await recoverCompletedReceipt(claimed);
-  }
-  if (!claimed) {
-    const latest = await input.store.get(input.receiptKey);
-    if (latest?.status === 'completed' || latest?.status === 'skipped') {
-      return await recoverCompletedReceipt(latest);
-    }
-    if (isInFlightRuntimeReceipt(latest)) {
-      const recovered = await repairOrWaitForRunningReceipt(latest);
-      if (recovered.kind === 'recovered') return recovered.output;
-    } else if (latest?.status === 'failed') {
-      await repairFailedReceipt(latest);
-    } else {
-      throw new Error(
-        `ctx.${input.operation}(${input.id}): receipt claim did not return execution ownership.`,
-      );
-    }
-  } else if (isInFlightRuntimeReceipt(claimed)) {
-    if (claimed.claimState === 'existing') {
-      const recovered = await repairOrWaitForRunningReceipt(claimed);
-      if (recovered.kind === 'recovered') return recovered.output;
-    } else {
-      ownedLeaseId = claimed.leaseId ?? null;
-      ownedLeaseExpiresAt = claimed.leaseExpiresAt ?? null;
-    }
-  } else if (claimed.status === 'failed') {
-    await repairFailedReceipt(claimed);
-  }
-
-  let result: T;
   try {
-    // New runners treat a claimed, nonterminal receipt as active. Keep the
-    // mark-running transition as an explicit compatibility option for older
-    // stores during their migration window, but do not pay the extra durable
-    // mutation on the normal claim -> terminal path.
-    if (input.markRunningBeforeExecute === true && input.store.markRunning) {
-      const markRunningStartedAt = Date.now();
-      const running = await input.store.markRunning(
-        input.receiptKey,
-        input.runId,
-        ownedLeaseId,
-      );
-      logPhase('mark_running', markRunningStartedAt);
-      if (!running || running.status !== 'running') {
-        throw new RuntimeReceiptLeaseLostError({
-          receiptKey: input.receiptKey,
-          runId: input.runId,
-          leaseId: ownedLeaseId ?? '',
-        });
-      }
-      ownedLeaseId = running.leaseId ?? ownedLeaseId;
-      ownedLeaseExpiresAt = running.leaseExpiresAt ?? ownedLeaseExpiresAt;
-    }
-    const executeStartedAt = Date.now();
-    const executed =
-      ownedLeaseId && input.store.heartbeat
-        ? await executeWithDurableRuntimeReceiptHeartbeat({
-            receiptKey: input.receiptKey,
-            runId: input.runId,
-            leaseId: ownedLeaseId,
-            heartbeatIntervalMs:
-              input.heartbeatIntervalMs ??
-              runtimeLeaseHeartbeatIntervalFromExpiry({
-                leaseExpiresAt: ownedLeaseExpiresAt,
-                fallbackTtlMs: PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
-              }),
-            store: input.store,
-            onTerminalHeartbeat: (receipt) => {
-              input.log(
-                `ctx.${input.operation}(${input.id}): receipt heartbeat observed terminal ${receipt.status}; treating inner gateway completion as ownership handoff`,
-              );
-            },
-            execute: () => input.execute({ leaseId: ownedLeaseId }),
-          })
-        : await input.execute({ leaseId: ownedLeaseId });
-    logPhase('execute', executeStartedAt);
-    result = input.onClaimedResult
+    const executed = await input.execute({
+      leaseId: null,
+      signal: executionAbortController?.signal,
+    });
+    executionAbortController?.signal.throwIfAborted();
+    const result = input.onClaimedResult
       ? input.onClaimedResult(executed, input.receiptKey)
       : executed;
     assertNoSecretTaint(result, `ctx.${input.operation} result`);
-  } catch (error) {
-    if (input.shouldPersistFailure?.(error) === false) {
-      // This error is deliberately not a durable execution result (for
-      // example, an HTTP non-2xx response under the current ctx.fetch
-      // contract). Release only the lease we still own so a later run can
-      // make a fresh, idempotency-protected attempt rather than inheriting a
-      // running or failed receipt.
-      const released = await input.store.release(
-        input.receiptKey,
-        input.runId,
-        ownedLeaseId,
-      );
-      if (
-        !released ||
-        (released.status !== 'queued' && released.status !== 'pending')
-      ) {
-        throw new Error(
-          `ctx.${input.operation}(${input.id}): non-cacheable execution failed but receipt ownership could not be released: ${input.formatError(error)}.`,
-        );
-      }
-      throw error;
-    }
-    // The ownership is uncertain, so neither `fail` nor `release` is safe.
-    // Let the attempt-level cleanup and the receipt lease fence reconcile this
-    // on the next Play Run attempt. In particular, never replace a possibly
-    // completed invocation with a terminal error from the old owner.
-    if (error instanceof RuntimeReceiptLeaseLostError) {
-      throw error;
-    }
-    if (
-      isPlayExecutionSuspendedError(error) ||
-      isPlayRowExecutionSuspendedError(error) ||
-      error instanceof PlayRowProviderBackpressureError
-    ) {
-      const released = await input.store.release(
-        input.receiptKey,
-        input.runId,
-        ownedLeaseId,
-      );
-      if (
-        !released ||
-        (released.status !== 'queued' && released.status !== 'pending')
-      ) {
-        throw new Error(
-          `ctx.${input.operation}(${input.id}): receipt suspended but ownership could not be released: ${input.formatError(error)}.`,
-        );
-      }
-      throw error;
-    }
-    const failed = await input.store.fail(
+    // Force bypasses the immutable cache. It does not grant permission to
+    // replace the completed fact already published under this semantic key.
+    if (input.force === true) {
+      return result;
+    }
+    // The hydration window bounds how many stored payloads expand at once.
+    // A completion is a write, and on wire format 3 it answers with a
+    // compact acknowledgement carrying no payload at all — nothing expands,
+    // so nothing needs a turn. Holding a slot of the 8-wide run-global
+    // window across the whole gateway round trip only queued unrelated rows
+    // behind this row's write. Only a response that really carries a stored
+    // payload decodes under the gate.
+    const completed = await input.store.complete(
       input.receiptKey,
       input.runId,
-      input.formatError(error),
-      ownedLeaseId,
-      runtimeReceiptFailureKindForError(error),
-      serializeToolExecutionFailure(error),
+      isToolExecuteResult(result) ? serializeToolExecuteResult(result) : result,
+      COMPLETED_RECEIPT_CACHE_INSERT_LEASE_ID,
     );
-    if (!failed && input.store.canPersistFailure) {
+    const stored =
+      completed?.status === 'completed' || completed?.status === 'skipped'
+        ? completed
+        : await input.store.get(input.receiptKey);
+    if (stored?.status !== 'completed' && stored?.status !== 'skipped') {
       throw new Error(
-        `ctx.${input.operation}(${input.id}): execution failed and failed receipt could not be persisted: ${input.formatError(error)}`,
-      );
-    }
-    throw error;
-  }
-
-  const completeStartedAt = Date.now();
-  const completed = await input.store.complete(
-    input.receiptKey,
-    input.runId,
-    isToolExecuteResult(result) ? serializeToolExecuteResult(result) : result,
-    ownedLeaseId,
-  );
-  logPhase('complete', completeStartedAt);
-  if (
-    !completed ||
-    (completed.status !== 'completed' && completed.status !== 'skipped')
-  ) {
-    const latest = await input.store.get(input.receiptKey);
-    if (
-      latest &&
-      (latest.status === 'completed' || latest.status === 'skipped')
-    ) {
-      input.log(
-        `ctx.${input.operation}(${input.id}): receipt completion response reconciled from durable store read-back`,
+        `ctx.${input.operation}(${input.id}): completed receipt cache insert failed.`,
       );
-      return await recoverCompletedReceipt(latest, 'owner');
     }
-  }
-  if (!completed && input.store.canPersistCompletion) {
-    throw new Error(
-      `ctx.${input.operation}(${input.id}): lost durable receipt ownership before completion.`,
-    );
-  }
-  if (
-    completed &&
-    (completed.status === 'completed' || completed.status === 'skipped')
-  ) {
-    logPhase('total', lifecycleStartedAt);
-    // Completion endpoints acknowledge ownership and status only. The caller
-    // already owns the live value; replay reads are the only path that needs
-    // the receipt payload returned over the transport.
-    if (completed.output === undefined) return result;
-    return await recoverCompletedReceipt(completed, 'owner');
-  }
-  if (input.store.canPersistCompletion) {
-    throw new Error(
-      `ctx.${input.operation}(${input.id}): lost durable receipt ownership before completion.`,
+    input.log(
+      `ctx.${input.operation}(${input.id}): executed and converged through immutable publication`,
     );
+    return result;
+  } finally {
+    await releaseOwnLock();
   }
-  return result;
 }