deepline 0.3.332 → 0.3.334

package/dist/bundling-sources/sdk/src/play.ts

@@ -477,7 +477,7 @@ export type CsvOptions = PlayAuthoringCsvOptions;
  *   // Emit a log line (visible in `play tail`)
  *   ctx.log(`Loaded ${await leads.count()} leads`);
  *
- *   // Pause execution
+ *   // Wait at least one second before continuing.
  *   await ctx.sleep(1000);
  *
  *   // Access submitted input through the handler's second argument.

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.332',
+  version: '0.3.334',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -222,7 +222,8 @@ import {
   classifyToolExecuteHttpFailure,
   createToolExecuteHttpFailureAttemptTracker,
   parseToolExecuteRetryAfterMs,
-  parseToolExecuteRetryAtMs,
+  parseToolExecuteProviderRetryAtMs,
+  parseToolExecuteExactProviderRetryAtMs,
   parseToolExecuteAuthScopeChangedError,
   ToolExecuteAuthScopeChangedError,
   type ToolExecuteHttpFailureOutcome,
@@ -653,6 +654,7 @@ const TOOL_RETRY_AFTER_FALLBACK_MS = 1_000;
 export const TOOL_EXECUTE_RESPONSE_BODY_TIMEOUT_MS = 30_000;
 const TOOL_RETRY_HEARTBEAT_INTERVAL_MS = 30_000;
 const TOOL_PROVIDER_RESIDENT_WAIT_BUDGET_MS = 5_000;
+const AUTHORED_SLEEP_RESIDENT_LIMIT_MS = 10_000;
 const DEEPLINEAGENT_TOOL_RUNTIME_TIMEOUT_MS = 15 * 60 * 1000;
 // Every runtime-API tool fetch needs a client-side deadline. Without one, a
 // stalled execute request (e.g. a credential-less call whose gateway connection
@@ -2928,6 +2930,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
    */
   private readonly persistenceLatch: RuntimePersistenceLatch =
     createRuntimePersistenceLatch();
+  private sleepMetadataPersistenceFailed = false;
   /**
    * The single source of every concurrency, budget, and pacing decision for this
    * run-attempt. Tool/play/row slots are blocking semaphores; budgets are charged
@@ -3153,6 +3156,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
    */
   assertNoPendingDurableSuspension(): void {
     this.#options.executionSignal?.throwIfAborted();
+    if (this.sleepMetadataPersistenceFailed) {
+      throw new RuntimePersistenceCircuitOpenError(this.persistenceLatch);
+    }
     this.assertNoSlackHitlTimeoutFailure();
     this.assertNoRowProviderBackpressure();
     if (this.pendingDurableSuspension) {
@@ -6234,7 +6240,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       runningReceiptWaitMaxAttempts?: number;
       runningReceiptWaitDelayMs?: number;
       reclaimRunning?: boolean;
-      markSkipped?: (output: T) => Promise<void> | void;
+      markSkipped?: (
+        output: T,
+        receipt: RuntimeStepReceipt,
+      ) => Promise<void> | void;
       onRecovered?: (
         output: T,
         receipt: RuntimeStepReceipt,
@@ -14580,6 +14589,111 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     this.suspendDurably({ kind: 'sleep', boundaryId, delayMs });
   }
 
+  private sleepMetadataReceiptKey(
+    boundaryId: string,
+    intent: 'wake' | 'count',
+  ): string {
+    return durableCtxKey({
+      orgId: this.#options.orgId,
+      playId: this.currentExecutionScope.receipt.namespace,
+      operation: 'step',
+      id: `__deepline_sleep_${intent}__`,
+      semanticKey: stableStringify({
+        runId: this.currentReceiptOwnerRunId,
+        boundaryId,
+      }),
+    });
+  }
+
+  private async readStepSleepCount(boundaryId: string): Promise<number | null> {
+    try {
+      const receipt = await this.getRuntimeStepReceipt(
+        this.sleepMetadataReceiptKey(boundaryId, 'count'),
+      );
+      if (receipt?.status !== 'completed') return null;
+      const output = receipt.output;
+      const sleepCount =
+        output && typeof output === 'object' && 'sleepCount' in output
+          ? output.sleepCount
+          : undefined;
+      if (
+        typeof sleepCount !== 'number' ||
+        !Number.isSafeInteger(sleepCount) ||
+        sleepCount < 0
+      ) {
+        throw new Error(`Durable step ${boundaryId} has no valid sleep count.`);
+      }
+      return sleepCount;
+    } catch (error) {
+      this.sleepMetadataPersistenceFailed = true;
+      tripRuntimePersistenceLatch(this.persistenceLatch, error);
+      throw error;
+    }
+  }
+
+  private async persistStepSleepCount(
+    boundaryId: string,
+    sleepCount: number,
+  ): Promise<void> {
+    try {
+      await this.completeRuntimeStepReceipt(
+        this.sleepMetadataReceiptKey(boundaryId, 'count'),
+        this.currentReceiptOwnerRunId,
+        { sleepCount },
+        COMPLETED_RECEIPT_CACHE_INSERT_LEASE_ID,
+      );
+      if ((await this.readStepSleepCount(boundaryId)) === null) {
+        throw new Error(
+          `Durable step ${boundaryId} did not persist its sleep count.`,
+        );
+      }
+    } catch (error) {
+      this.sleepMetadataPersistenceFailed = true;
+      tripRuntimePersistenceLatch(this.persistenceLatch, error);
+      throw error;
+    }
+  }
+
+  private async resolveCanonicalSleepWakeAtMs(
+    boundaryId: string,
+    delayMs: number,
+  ): Promise<number> {
+    const key = this.sleepMetadataReceiptKey(boundaryId, 'wake');
+    const proposedWakeAtMs = Date.now() + delayMs;
+    try {
+      let receipt = await this.getRuntimeStepReceipt(key);
+      if (receipt?.status !== 'completed') {
+        await this.completeRuntimeStepReceipt(
+          key,
+          this.currentReceiptOwnerRunId,
+          { wakeAtMs: proposedWakeAtMs },
+          COMPLETED_RECEIPT_CACHE_INSERT_LEASE_ID,
+        );
+        receipt = await this.getRuntimeStepReceipt(key);
+      }
+      const output = receipt?.output;
+      const wakeAtMs =
+        output && typeof output === 'object' && 'wakeAtMs' in output
+          ? output.wakeAtMs
+          : undefined;
+      if (
+        receipt?.status !== 'completed' ||
+        typeof wakeAtMs !== 'number' ||
+        !Number.isSafeInteger(wakeAtMs) ||
+        wakeAtMs < 0
+      ) {
+        throw new Error(
+          `Durable sleep intent ${boundaryId} has no valid wake timestamp.`,
+        );
+      }
+      return wakeAtMs;
+    } catch (error) {
+      this.sleepMetadataPersistenceFailed = true;
+      tripRuntimePersistenceLatch(this.persistenceLatch, error);
+      throw error;
+    }
+  }
+
   async sleep(ms: number): Promise<void> {
     if (!rowContext.getStore()) this.assertRowAdmissionOpen();
     this.assertNoPendingDurableSuspension();
@@ -14653,17 +14767,49 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       if (existing?.kind === 'sleep' && existing.completedAt !== undefined) {
         return;
       }
+      const wakeAtMs =
+        existing?.kind === 'sleep' && existing.wakeAtMs !== undefined
+          ? existing.wakeAtMs
+          : this.durableDirectToolResultsBackedByReceipts
+            ? await this.resolveCanonicalSleepWakeAtMs(boundaryId, delayMs)
+            : undefined;
+      this.assertNoPendingDurableSuspension();
       this.checkpoint.resolvedBoundaries = {
         ...(this.checkpoint.resolvedBoundaries ?? {}),
         [boundaryId]: {
+          ...existing,
           kind: 'sleep',
           delayMs,
+          ...(wakeAtMs !== undefined ? { wakeAtMs } : {}),
         },
       };
+      if (
+        wakeAtMs !== undefined &&
+        !rowStore &&
+        this.durableDirectToolResultsBackedByReceipts &&
+        (wakeAtMs <= Date.now() ||
+          (delayMs <= AUTHORED_SLEEP_RESIDENT_LIMIT_MS &&
+            wakeAtMs < (this.#options.executionDrainAtMs ?? Infinity)))
+      ) {
+        const remainingMs = Math.max(0, wakeAtMs - Date.now());
+        if (remainingMs > 0)
+          await this.sleepWithCheckpointHeartbeat(remainingMs);
+        this.assertNoPendingDurableSuspension();
+        this.checkpoint.resolvedBoundaries[boundaryId] = {
+          ...this.checkpoint.resolvedBoundaries[boundaryId],
+          kind: 'sleep',
+          delayMs,
+          wakeAtMs,
+          completedAt: Date.now(),
+        };
+        this.#options.onBatchComplete?.(this.checkpoint);
+        return;
+      }
       this.suspendDurably({
         kind: 'sleep',
         boundaryId,
         delayMs,
+        ...(wakeAtMs !== undefined ? { wakeAtMs } : {}),
       });
     }
     return new Promise((resolve) => setTimeout(resolve, delayMs));
@@ -15000,30 +15146,33 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     const boundaryId = this.durableBoundaryId(
       `step-${scope}:${normalizedKey}${boundarySuffix}`,
     );
+    const advanceRecoveredSleepCursor = async (
+      receipt?: RuntimeStepReceipt,
+    ) => {
+      if (rowStore?.replayCallIndexes?.recoverStep(boundaryId)) return;
+      const existing = assertKnownResolvedBoundary(
+        boundaryId,
+        this.checkpoint.resolvedBoundaries?.[boundaryId],
+      );
+      const sleepCount =
+        existing?.kind === 'step' && existing.sleepCount !== undefined
+          ? existing.sleepCount
+          : receipt?.runId === this.currentReceiptOwnerRunId
+            ? ((await this.readStepSleepCount(boundaryId)) ?? 0)
+            : 0;
+      if (Number.isSafeInteger(sleepCount) && sleepCount > 0)
+        this.sleepBoundaryIndex += sleepCount;
+    };
     const executeStep = async (): Promise<T> => {
       const existing = assertKnownResolvedBoundary(
         boundaryId,
         this.checkpoint.resolvedBoundaries?.[boundaryId],
       );
       if (existing?.kind === 'step' && 'output' in existing) {
-        const replayedCalls =
-          rowStore?.replayCallIndexes?.recoverStep(boundaryId) ?? false;
         this.runtimeLog(
           `ctx.step(${normalizedKey}): recovered result from checkpoint`,
         );
-        // The step callback is not evaluated on replay, so any sleeps that it
-        // contained would otherwise disappear from the positional sleep
-        // cursor. Preserve the authored boundary sequence before evaluating
-        // the next sibling operation. This is deliberately run-local state;
-        // it is not a cross-run sleep cache or an input-derived identity.
-        if (
-          !replayedCalls &&
-          Number.isSafeInteger(existing.sleepCount) &&
-          existing.sleepCount !== undefined &&
-          existing.sleepCount > 0
-        ) {
-          this.sleepBoundaryIndex += existing.sleepCount;
-        }
+        await advanceRecoveredSleepCursor();
         return existing.output as T;
       }
 
@@ -15046,15 +15195,20 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       // publish an enclosing step fallback that would make a later resume skip
       // the suspended work.
       this.assertNoPendingDurableSuspension();
+      const sleepCount = rowStore?.replayCallIndexes
+        ? (callAdvances.get('sleep:legacy') ?? 0)
+        : this.sleepBoundaryIndex - sleepBoundaryIndexBefore;
+      if (sleepCount > 0 && this.durableDirectToolResultsBackedByReceipts) {
+        await this.persistStepSleepCount(boundaryId, sleepCount);
+      }
+      this.assertNoPendingDurableSuspension();
       this.checkpoint.resolvedBoundaries = {
         ...(this.checkpoint.resolvedBoundaries ?? {}),
         [boundaryId]: {
           kind: 'step',
           stepId: normalizedKey,
           output,
-          sleepCount: rowStore?.replayCallIndexes
-            ? (callAdvances.get('sleep:legacy') ?? 0)
-            : this.sleepBoundaryIndex - sleepBoundaryIndexBefore,
+          sleepCount,
           completedAt: Date.now(),
         },
       };
@@ -15099,8 +15253,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 : options?.semanticKey,
               staleAfterSeconds: options?.staleAfterSeconds,
               force: this.#options.cachePolicy?.forceStepRefresh === true,
-              markSkipped: (output) => {
+              markSkipped: async (output, receipt) => {
                 assertJsonSerializableStepOutput(normalizedKey, output);
+                await advanceRecoveredSleepCursor(receipt);
               },
               execute: executeStep,
             },
@@ -17849,8 +18004,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const executionRequestNonce = crypto.randomUUID();
           // Transport ambiguity must retain the billing identity. An ordinary
           // (unfenced) call advances it after a definite rejection released
-          // that attempt's reservation, including app pacing refusals. Fenced
-          // calls retain it: gateway-qualified retries own their distinct charge lifecycle.
+          // that attempt's reservation. A proven app pacing refusal also
+          // renews fenced billing attribution, keeping its invocation and
+          // provider-operation identities unchanged. Ambiguous deliveries retain it.
           let deeplineRequestId = `ctx-tool-${stableDigest(executionRequestNonce).slice(0, 32)}`;
           // The provider operation has a semantic identity independent of
           // the response receipt. Its key is supplied by the caller that owns
@@ -18647,13 +18803,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                                 // settle the row as failed instead of pacing.
                                 [TOOL_EXECUTE_RUNNER_ACCEPTS_HEADER]:
                                   TOOL_EXECUTE_RUNNER_ACCEPTS_VALUE,
-                                ...(!usesDurableInvocationFence &&
-                                !providerExecutionFenceKey
-                                  ? {
-                                      [TOOL_EXECUTE_APP_PACING_REFUSAL_HEADER]:
-                                        TOOL_EXECUTE_APP_PACING_REFUSAL_VALUE,
-                                    }
-                                  : {}),
+                                [TOOL_EXECUTE_APP_PACING_REFUSAL_HEADER]:
+                                  TOOL_EXECUTE_APP_PACING_REFUSAL_VALUE,
                                 ...(providerGatewayDispatchProof
                                   ? {
                                       [TOOL_EXECUTE_PROVIDER_RATE_SCOPE_HEADER]:
@@ -18698,18 +18849,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                             recordProviderDispatch();
                           if (dispatchedResponse.status === 429) {
                             const observedAt = Date.now();
-                            const retryAfter =
-                              dispatchedResponse.headers.get('retry-after');
                             // Preserve absolute provider deadlines even when the
                             // response did not carry the gateway's counter
                             // attestation. Classification below still decides
                             // whether this 429 may update shared provider pacing.
-                            providerRetryAtMs = retryAfter?.trim()
-                              ? parseToolExecuteRetryAtMs(
-                                  retryAfter,
-                                  observedAt,
-                                )
-                              : undefined;
+                            providerRetryAtMs =
+                              parseToolExecuteProviderRetryAtMs(
+                                dispatchedResponse,
+                                observedAt,
+                              );
                           }
                           if (
                             isAttestedProvider429Response(dispatchedResponse)
@@ -18877,6 +19025,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                               schemaVersion: toolErrorSchemaVersion,
                               retryAfterHeader:
                                 dispatchedResponse.headers.get('retry-after'),
+                              retryAtMs:
+                                parseToolExecuteExactProviderRetryAtMs(
+                                  dispatchedResponse,
+                                ),
                               transientHttpRetrySafe:
                                 retrySafeTransientHttp || fixtureReplaySafe,
                               executionFenced: usesDurableInvocationFence,
@@ -18898,6 +19050,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                                 schemaVersion: toolErrorSchemaVersion,
                                 retryAfterHeader:
                                   dispatchedResponse.headers.get('retry-after'),
+                                retryAtMs:
+                                  parseToolExecuteExactProviderRetryAtMs(
+                                    dispatchedResponse,
+                                  ),
                                 transientHttpRetrySafe:
                                   retrySafeTransientHttp || fixtureReplaySafe,
                                 executionFenced: usesDurableInvocationFence,
@@ -19294,6 +19450,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   bodyText: text,
                   schemaVersion: toolErrorSchemaVersion,
                   retryAfterHeader: response.headers.get('retry-after'),
+                  retryAtMs: parseToolExecuteExactProviderRetryAtMs(response),
                   transientHttpRetrySafe:
                     retrySafeTransientHttp || fixtureReplaySafe,
                   executionFenced: usesDurableInvocationFence,
@@ -19519,11 +19676,11 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 );
                 logProvider429RetryPhase('retry_sleep_completed');
                 if (
-                  !usesDurableInvocationFence &&
-                  (failure.backpressureDelayMs !== null ||
-                    failure.reason === 'provider_pacing_wait' ||
-                    (failure.reason === 'rate_limit' &&
-                      failure.knownNotDispatched))
+                  failure.reason === 'provider_pacing_wait' ||
+                  (!usesDurableInvocationFence &&
+                    (failure.backpressureDelayMs !== null ||
+                      (failure.reason === 'rate_limit' &&
+                        failure.knownNotDispatched)))
                 ) {
                   // These refusals release the prior reservation. App pacing
                   // does not advance invocationAttempt, so use its own HTTP

package/dist/bundling-sources/shared_libs/play-runtime/ctx-types.ts

@@ -815,6 +815,8 @@ export interface ContextOptions {
   rowAdmissionSignal?: AbortSignal;
   /** Local runner cancellation; never serialized into a Play artifact. */
   executionSignal?: AbortSignal;
+  /** Runner-local deadline for stopping new work, captured when its timer arms. */
+  executionDrainAtMs?: number;
   /**
    * Runtime-sheet transport selected by the runner. Daytona sandboxes use the
    * execution gateway and must never fall back to minting direct DB sessions.
@@ -1244,6 +1246,8 @@ export interface PlayCheckpoint {
     | {
         kind: 'sleep';
         delayMs: number;
+        /** Original wake deadline. Historical boundaries retain relative waits. */
+        wakeAtMs?: number;
         completedAt?: number;
         scope?: {
           type: 'workflow' | 'map_row';

package/dist/bundling-sources/shared_libs/play-runtime/durable-receipt-execution.ts

@@ -777,7 +777,10 @@ export async function executeWithDurableRuntimeReceipt<T>(input: {
   runningReceiptWaitMaxAttempts?: number;
   runningReceiptWaitDelayMs?: number;
   reclaimRunning?: boolean;
-  markSkipped?: (output: T) => Promise<void> | void;
+  markSkipped?: (
+    output: T,
+    receipt: RuntimeStepReceipt,
+  ) => Promise<void> | void;
   onRecovered?: (
     output: T,
     receipt: RuntimeStepReceipt,
@@ -812,6 +815,9 @@ export async function executeWithDurableRuntimeReceipt<T>(input: {
   ): Promise<T> => {
     input.log(`ctx.${input.operation}(${input.id}): reused completed work`);
     if (receipt.output === undefined) {
+      if (input.operation === 'step' && input.markSkipped) {
+        await input.markSkipped(receipt.output as T, receipt);
+      }
       return receipt.output as T;
     }
     const output = runtimeReceiptOutput<T>(receipt);
@@ -819,7 +825,7 @@ export async function executeWithDurableRuntimeReceipt<T>(input: {
       ? input.onRecovered(output, receipt, 'cache')
       : output;
     if (input.markSkipped) {
-      await input.markSkipped(recovered);
+      await input.markSkipped(recovered, receipt);
     }
     return recovered;
   };

package/dist/bundling-sources/shared_libs/play-runtime/execution-gateway-invocation-fence.ts

@@ -62,6 +62,14 @@ export type DurableInvocationDiagnostic = {
   error?: unknown;
 };
 
+/** Authenticated transport proof that this owner sent no provider request. */
+export class DurableInvocationDispatchNotStartedError extends Error {
+  constructor(readonly reason: string) {
+    super(reason);
+    this.name = 'DurableInvocationDispatchNotStartedError';
+  }
+}
+
 export class DurableInvocationConflictError extends Error {
   readonly code = 'DURABLE_INVOCATION_REQUEST_CONFLICT';
 
@@ -313,6 +321,14 @@ export async function executeWithDurableInvocationFence(input: {
       response = await input.execute();
     } catch (error) {
       diagnose('dispatch_failed', error);
+      if (error instanceof DurableInvocationDispatchNotStartedError) {
+        // An authenticated app refusal proves no provider request was sent.
+        // Release only this owner; ordinary transport failures stay unknown.
+        if (!(await input.store.abandon(begun))) {
+          throw new DurableInvocationInProgressError();
+        }
+        throw error;
+      }
       if (input.replaySafeAfterDispatch) {
         return await retryReplaySafeInvocation(begun);
       }

package/dist/bundling-sources/shared_libs/play-runtime/governor/app-runtime-rate-state-backend.ts

@@ -140,7 +140,6 @@ function sleepWithAbort(
  * hold more than a moment of a shared provider window.
  */
 const RATE_BLOCK_HORIZON_MS = 1_000;
-const UNKNOWN_PROVIDER_RECOVERY_BLOCK_HORIZON_MS = 500;
 const STORE_FAILURE_RETRY_DELAYS_MS = [100, 250] as const;
 /**
  * Jitter fraction applied to a server-supplied `waitMs` so a synchronized wave
@@ -667,23 +666,22 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
     // a hot map is a round trip per permit. The store's own token floor, not
     // this number, is what bounds the grant.
     const learnedRps = this.effectiveRps.get(laneKey);
+    const currentRps = learnedRps ?? configuredRps;
     const recoveringUnknownProvider =
       learnedRps !== undefined &&
       learnedRps < DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS &&
       rules.some((rule) => rule.ruleId === 'default:provider-scope') &&
       rules.every((rule) => rule.ruleId.startsWith('default:'));
-    // Below recovered capacity, the next clean observation can double the
-    // pace after 500ms. Do not reserve a full second at the old slower pace:
-    // that schedule debt would delay grants even after learning succeeds.
+    // Below recovered capacity, one dispatch interval (500/250/125ms at
+    // 2/4/8 RPS) can prove the next step. Reserve only that interval so cached
+    // old-pace tickets cannot postpone the next fresh-feedback refill.
     const horizonMs = Math.min(
-      recoveringUnknownProvider
-        ? UNKNOWN_PROVIDER_RECOVERY_BLOCK_HORIZON_MS
-        : RATE_BLOCK_HORIZON_MS,
+      recoveringUnknownProvider ? 1_000 / currentRps : RATE_BLOCK_HORIZON_MS,
       leasedBlockTtlMs(rules),
     );
     const rateBudget = Math.max(
       1,
-      Math.floor(((learnedRps ?? configuredRps) * horizonMs) / 1_000),
+      Math.floor((currentRps * horizonMs) / 1_000),
     );
     if (!Number.isFinite(rateBudget) || rateBudget <= 0) return floor;
     const waiters = this.waiters.get(laneKey) ?? 1;
@@ -1018,7 +1016,8 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
         const releaseGeneration = releaseSignal?.generation;
         const successKey = pendingSuccessKey(bucketId, ordered);
         const feedback = this.snapshotSuccessFeedback(successKey);
-        const response = await this.port.acquire({
+        const requestStartedAtMs = this.now();
+        const rawResponse = await this.port.acquire({
           bucketId,
           rateScopeToken,
           rules: withAdaptiveMaxRps(ordered),
@@ -1026,6 +1025,28 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
           ...feedback,
           schedulerSchema: this.schedulerSchema,
         });
+        const serverElapsedMs = rawResponse.serverClockElapsedMs;
+        const validServerElapsed =
+          typeof rawResponse.serverNowMs === 'number' &&
+          Number.isFinite(rawResponse.serverNowMs) &&
+          rawResponse.serverNowMs >= 0 &&
+          typeof serverElapsedMs === 'number' &&
+          Number.isSafeInteger(serverElapsedMs) &&
+          serverElapsedMs >= 0 &&
+          serverElapsedMs <= this.now() - requestStartedAtMs;
+        // The clock was already this old when the response left the server.
+        // Advance only by confirmed elapsed time; unknown transit remains
+        // conservative, and an invalid/legacy response keeps the old clock.
+        const response = validServerElapsed
+          ? {
+              ...rawResponse,
+              serverNowMs: rawResponse.serverNowMs! + serverElapsedMs,
+              waitMs:
+                rawResponse.waitMs > 0
+                  ? Math.max(1, rawResponse.waitMs - serverElapsedMs)
+                  : rawResponse.waitMs,
+            }
+          : rawResponse;
         this.acknowledgeSuccessFeedback(successKey, feedback);
         this.recordCooldown(bucketId, response);
         if (response.scopeValidationSupported === true)

package/dist/bundling-sources/shared_libs/play-runtime/protocol.ts

@@ -96,6 +96,12 @@ export type PlayRunnerRateStateAcquireResult = {
    * provider spacing.
    */
   serverNowMs?: number;
+  /**
+   * Confirmed elapsed time after receiving the database clock and before
+   * returning this grant. This is a lower bound on the clock's age: uncertain
+   * database and HTTP transit time is excluded. Absent on older receivers.
+   */
+  serverClockElapsedMs?: number;
   /**
    * One globally reserved dispatch timestamp per granted permit. The runtime
    * may cache the block, but must not dispatch a permit before its timestamp.

package/dist/bundling-sources/shared_libs/play-runtime/runner-app/index.ts

@@ -1159,6 +1159,7 @@ export interface ExecutePlayRunnerOptions {
   signal?: AbortSignal;
   /** Stops future row admission while already admitted rows can persist. */
   rowAdmissionSignal?: AbortSignal;
+  executionDrainAtMs?: number;
   /** Runner-local terminal state made available to the deadline drain. */
   onRuntimeReady?: (runtime: {
     log: (line: string) => void;
@@ -2036,14 +2037,15 @@ async function run(
     runnerRunAttempt,
   );
   const workCounterSegmentId = randomUUID();
+  const runtimeLimitMs =
+    validatePlaySandboxRuntimeLimits(
+      config.context.sandboxRuntimeLimits ??
+        STANDARD_PLAY_SANDBOX_RUNTIME_LIMITS,
+    ).timeoutSeconds * 1_000;
   const persistenceSignal =
-    options?.signal ??
-    AbortSignal.timeout(
-      validatePlaySandboxRuntimeLimits(
-        config.context.sandboxRuntimeLimits ??
-          STANDARD_PLAY_SANDBOX_RUNTIME_LIMITS,
-      ).timeoutSeconds * 1_000,
-    );
+    options?.signal ?? AbortSignal.timeout(runtimeLimitMs);
+  const executionDrainAtMs =
+    options?.executionDrainAtMs ?? runStartedAt + runtimeLimitMs;
   const contextSetupStartedAt = Date.now();
   const getRuntimeToolMetadata = createRuntimeToolMetadataResolver(config);
   const getRuntimeToolAuthScopeDigest =
@@ -2225,6 +2227,7 @@ async function run(
     artifactRuntimeContract,
     rowAdmissionSignal: options?.rowAdmissionSignal,
     executionSignal: persistenceSignal,
+    executionDrainAtMs,
     executorToken: config.context.executorToken,
     baseUrl: config.context.baseUrl,
     // Runtime control stays on baseUrl (the receipt gateway); provider calls
@@ -3894,6 +3897,7 @@ async function main() {
       result = await executePlayRunner(config, {
         signal: executionController.signal,
         rowAdmissionSignal: rowAdmissionController.signal,
+        executionDrainAtMs: runtimeDeadline.drainAtMs,
         onRuntimeReady: (runtime) => {
           runtimeState = runtime;
         },