deepline 0.3.408 → 0.3.410

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/run-ledger-dispatch-authority.ts

@@ -18,6 +18,8 @@ export type RunLedgerDispatchLaunch = Pick<
   | 'runtimeTokenOrigin'
   | 'orgId'
   | 'runtimeAuthority'
+  | 'absurdReleaseId'
+  | 'requiresRunCreatedProjection'
   | 'vercelProtectionBypassToken'
 >;
 
@@ -34,6 +36,8 @@ export function runLedgerDispatchLaunchSql(alias: string): string {
     'runtimeTokenOrigin',
     'orgId',
     'runtimeAuthority',
+    'absurdReleaseId',
+    'requiresRunCreatedProjection',
     'vercelProtectionBypassToken',
   ];
   return `jsonb_build_object(${fields

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/run-ledger-outbox-recovery.ts

@@ -886,6 +886,7 @@ export async function deliverRunCreatedOutboxEventInline(input: {
   withClient: RunLedgerOutboxWithClient;
   schedulerOptions?: Pick<PostgresSchedulerOptions, 'schema'>;
   tokenAuthority: RunLedgerOutboxTokenAuthority;
+  appRuntimeFetch?: typeof fetch;
   deadlineMs?: number;
   /** Test seam; clamped to `RUN_CREATED_INLINE_RELEASE_GRACE_MS`. */
   releaseGraceMs?: number;
@@ -926,6 +927,9 @@ export async function deliverRunCreatedOutboxEventInline(input: {
       limit: 1,
       leaseSeconds: RUN_CREATED_INLINE_DELIVERY_LEASE_SECONDS,
       tokenAuthority: input.tokenAuthority,
+      ...(input.appRuntimeFetch
+        ? { appRuntimeFetch: input.appRuntimeFetch }
+        : {}),
       signal: controller.signal,
       onAbortedLeaseRelease: (released) => {
         abandoned.releaseFailed = !released;

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/runtime-event-search.ts

@@ -1223,6 +1223,15 @@ export async function getRuntimeRunLogPage(
   };
 }
 
+/** Acquire inside the writer's transaction; all namespaces share these objects. */
+export async function lockRuntimeEventSearchDdl(
+  client: PostgresSchedulerQueryClient,
+): Promise<void> {
+  await client.query(
+    `SELECT pg_advisory_xact_lock(hashtext('deepline:runtime-observability'), hashtext('schema-ddl'))`,
+  );
+}
+
 async function ensureRuntimeEventFetchReceiptFunction(
   client: PostgresSchedulerQueryClient,
 ): Promise<void> {

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/runtime-sandbox-capacity.ts

@@ -242,6 +242,19 @@ export async function readRuntimeOrgSandboxLimitCacheViaRuntimeScheduler(input:
   );
 }
 
+type RuntimeSandboxReservationProof = {
+  org_id: string;
+  run_id: string;
+  provider: RuntimeSandboxProviderId;
+  operation_attempt: number | null;
+  operation_environment: 'preview' | 'production' | null;
+  operation_provider: RuntimeSandboxProviderId | null;
+  provider_operation_token: string | null;
+  operation_state: RuntimeSandboxOperationState | null;
+  released_at: Date | null;
+  sandbox_id: string | null;
+};
+
 export async function reserveRuntimeSandboxCapacityLease(
   client: PostgresSchedulerQueryClient,
   input: {
@@ -272,11 +285,47 @@ export async function reserveRuntimeSandboxCapacityLease(
   const orgId = assertId(input.orgId, 'orgId');
   const runId = assertId(input.runId, 'runId');
   const { cache, leases, operations, runs } = schemaTables(options);
+  const leaseId = input.leaseId?.trim() || randomUUID();
+  const unsentProviderOperationToken = unsentReservationInputs.get(input);
+  const providerOperationToken =
+    input.attempt === undefined
+      ? null
+      : (unsentProviderOperationToken ??
+        runtimeSandboxProviderOperationToken(leaseId));
+  const resumePendingDaytonaOperation =
+    input.resumePendingDaytonaOperation === true &&
+    input.provider === RuntimeSandboxProvider.Daytona &&
+    input.attempt !== undefined;
   // This is deliberately a soft admission check: concurrent workers may both
   // observe space and insert. Avoid locks and long transactions; the provider
   // has its own global safety cap and the 50-minute lease bounds crashes.
-  const observed = await client.query<{ limit: number; active_leases: number }>(
+  // Read the capacity and existing intent together. Neither observation proves
+  // an INSERT winner; the fenced write must return proof or read it back.
+  const observed = await client.query<{
+    limit: number;
+    active_leases: number;
+    pending_operations: Array<{
+      lease_id: string;
+      provider_operation_token: string | null;
+      attempt: number;
+      environment: 'preview' | 'production';
+    }>;
+    existing_operation: {
+      org_id: string;
+      run_id: string;
+      provider: RuntimeSandboxProviderId;
+      operation_attempt: number | null;
+      operation_environment: 'preview' | 'production' | null;
+      operation_provider: RuntimeSandboxProviderId | null;
+      provider_operation_token: string | null;
+      operation_state: RuntimeSandboxOperationState | null;
+      released_at: string | null;
+      sandbox_id: string | null;
+    } | null;
+    inserted_proof: RuntimeSandboxReservationProof | null;
+  }>(
     `
+      WITH observed AS MATERIALIZED (
       SELECT
         coalesce(
           (
@@ -300,53 +349,119 @@ export async function reserveRuntimeSandboxCapacityLease(
             -- is only the crash backstop for a create that never became
             -- durable enough to bind to a sandbox id.
             AND (sandbox_id IS NOT NULL OR expires_at > clock_timestamp())
-        ) AS active_leases
+        ) AS active_leases,
+        coalesce((
+          SELECT jsonb_agg(pending)
+          FROM (
+            SELECT lease.lease_id, operation.provider_operation_token,
+                   operation.attempt, operation.environment
+            FROM ${operations} AS operation
+            JOIN ${leases} AS lease ON lease.lease_id = operation.operation_key
+            WHERE $6::boolean
+              AND operation.org_id = $1
+              AND operation.run_id = $3
+              AND operation.provider = $4
+              AND operation.state = $7
+              AND lease.released_at IS NULL
+              AND lease.sandbox_id IS NULL
+            ORDER BY operation.created_at ASC
+            LIMIT 2
+          ) AS pending
+        ), '[]'::jsonb) AS pending_operations,
+        (
+          SELECT to_jsonb(existing)
+          FROM (
+            SELECT lease.org_id, lease.run_id, lease.provider,
+                   operation.attempt AS operation_attempt,
+                   operation.environment AS operation_environment,
+                   operation.provider AS operation_provider,
+                   operation.provider_operation_token,
+                   operation.state AS operation_state,
+                   lease.released_at, lease.sandbox_id
+            FROM ${leases} AS lease
+            LEFT JOIN ${operations} AS operation
+              ON operation.operation_key = lease.lease_id
+            WHERE lease.lease_id = $5
+          ) AS existing
+        ) AS existing_operation
+      ), active_run AS MATERIALIZED (
+        SELECT run.run_id
+        FROM ${runs} AS run, observed
+        WHERE $8::integer IS NOT NULL
+          AND observed.existing_operation IS NULL
+          AND jsonb_array_length(observed.pending_operations) = 0
+          AND (observed.active_leases < observed."limit" OR $10::text <> 'enforce')
+          AND run.run_id = $3
+          AND run.status IN ('queued', 'running', 'waiting')
+          AND NOT EXISTS (
+            SELECT 1 FROM ${quoteIdent(options?.schema ?? 'runtime_scheduler')}."control"
+            WHERE key = 'runtime_cancel:' || $3::text
+          )
+        FOR UPDATE OF run
+      ), reserved_lease AS (
+        INSERT INTO ${leases} (
+          lease_id, org_id, run_id, provider, expires_at
+        )
+        SELECT $5, $1, $3, $4,
+               clock_timestamp() + ($11::integer * interval '1 millisecond')
+        WHERE EXISTS (SELECT 1 FROM active_run)
+        ON CONFLICT (lease_id) DO NOTHING
+        RETURNING lease_id, org_id, run_id, provider, released_at, sandbox_id
+      ), reserved_operation AS (
+        INSERT INTO ${operations} (
+          operation_key, provider_operation_token, provider, run_id, attempt, org_id, environment, state
+        )
+        SELECT lease_id, $12, $4, $3, $8, $1, $9, $7
+        FROM reserved_lease
+        ON CONFLICT (operation_key) DO NOTHING
+        RETURNING operation_key, provider_operation_token, provider,
+                  attempt, environment, state
+      )
+      SELECT observed.*, (
+        SELECT to_jsonb(proof)
+        FROM (
+          SELECT lease.org_id, lease.run_id, lease.provider,
+                 operation.attempt AS operation_attempt,
+                 operation.environment AS operation_environment,
+                 operation.provider AS operation_provider,
+                 operation.provider_operation_token,
+                 operation.state AS operation_state,
+                 lease.released_at, lease.sandbox_id
+          FROM reserved_lease AS lease
+          JOIN reserved_operation AS operation
+            ON operation.operation_key = lease.lease_id
+        ) AS proof
+      ) AS inserted_proof
+      FROM observed
     `,
-    [orgId, DEFAULT_PLAY_SANDBOX_CONCURRENCY],
+    [
+      orgId,
+      DEFAULT_PLAY_SANDBOX_CONCURRENCY,
+      runId,
+      input.provider,
+      leaseId,
+      resumePendingDaytonaOperation,
+      RuntimeSandboxOperationState.Reserved,
+      input.attempt ?? null,
+      input.environment ?? 'production',
+      input.mode ?? 'enforce',
+      RUNTIME_SANDBOX_CAPACITY_LEASE_MS,
+      providerOperationToken,
+    ],
   );
   const limit = Number(
     observed.rows[0]?.limit ?? DEFAULT_PLAY_SANDBOX_CONCURRENCY,
   );
   const activeLeases = Number(observed.rows[0]?.active_leases ?? 0);
   const wouldDefer = activeLeases >= limit;
-  const leaseId = input.leaseId?.trim() || randomUUID();
-  const unsentProviderOperationToken = unsentReservationInputs.get(input);
-  const providerOperationToken =
-    input.attempt === undefined
-      ? null
-      : (unsentProviderOperationToken ??
-        runtimeSandboxProviderOperationToken(leaseId));
-  if (
-    input.resumePendingDaytonaOperation === true &&
-    input.provider === RuntimeSandboxProvider.Daytona &&
-    input.attempt !== undefined
-  ) {
-    const pending = await client.query<{
-      lease_id: string;
-      provider_operation_token: string | null;
-      attempt: number;
-      environment: 'preview' | 'production';
-    }>(
-      `SELECT lease.lease_id, operation.provider_operation_token,
-              operation.attempt, operation.environment
-         FROM ${operations} AS operation
-         JOIN ${leases} AS lease ON lease.lease_id = operation.operation_key
-        WHERE operation.org_id = $1
-          AND operation.run_id = $2
-          AND operation.provider = $3
-          AND operation.state = $4
-          AND lease.released_at IS NULL
-          AND lease.sandbox_id IS NULL
-        ORDER BY operation.created_at ASC
-        LIMIT 2`,
-      [orgId, runId, input.provider, RuntimeSandboxOperationState.Reserved],
-    );
-    if (pending.rows.length > 1) {
+  if (resumePendingDaytonaOperation) {
+    const pending = observed.rows[0]?.pending_operations ?? [];
+    if (pending.length > 1) {
       throw new Error(
         'More than one Daytona sandbox operation is pending for this run.',
       );
     }
-    const pendingOperation = pending.rows[0];
+    const pendingOperation = pending[0];
     if (
       pendingOperation &&
       !(
@@ -384,33 +499,9 @@ export async function reserveRuntimeSandboxCapacityLease(
       };
     }
   }
-  const existing = await client.query<{
-    org_id: string;
-    run_id: string;
-    provider: RuntimeSandboxProviderId;
-    operation_attempt: number | null;
-    operation_environment: 'preview' | 'production' | null;
-    operation_provider: RuntimeSandboxProviderId | null;
-    provider_operation_token: string | null;
-    operation_state: RuntimeSandboxOperationState | null;
-    released_at: Date | null;
-    sandbox_id: string | null;
-  }>(
-    `SELECT lease.org_id, lease.run_id, lease.provider,
-            operation.attempt AS operation_attempt,
-            operation.environment AS operation_environment,
-            operation.provider AS operation_provider,
-            operation.provider_operation_token,
-            operation.state AS operation_state,
-            lease.released_at, lease.sandbox_id
-       FROM ${leases} AS lease
-       LEFT JOIN ${operations} AS operation
-         ON operation.operation_key = lease.lease_id
-      WHERE lease.lease_id = $1`,
-    [leaseId],
-  );
-  if (existing.rows[0]) {
-    const row = existing.rows[0];
+  const existingOperation = observed.rows[0]?.existing_operation;
+  if (existingOperation) {
+    const row = existingOperation;
     if (
       row.org_id !== orgId ||
       row.run_id !== runId ||
@@ -487,64 +578,30 @@ export async function reserveRuntimeSandboxCapacityLease(
   if (wouldDefer && (input.mode ?? 'enforce') === 'enforce') {
     return { granted: false, limit, activeLeases };
   }
-  await client.query(
-    `
-      WITH active_run AS MATERIALIZED (
-        SELECT run_id FROM ${runs}
-        WHERE run_id = $3 AND status IN ('queued', 'running', 'waiting')
-          AND NOT EXISTS (
-            SELECT 1 FROM ${quoteIdent(options?.schema ?? 'runtime_scheduler')}."control"
-            WHERE key = 'runtime_cancel:' || $3::text
-          )
-        FOR UPDATE
-      ), reserved_lease AS (
-        INSERT INTO ${leases} (
-          lease_id, org_id, run_id, provider, expires_at
-        )
-        SELECT $1, $2, $3, $4,
-               clock_timestamp() + ($5::integer * interval '1 millisecond')
-        WHERE $6::integer IS NULL OR EXISTS (SELECT 1 FROM active_run)
-        ON CONFLICT (lease_id) DO NOTHING
-        RETURNING lease_id
-      )
-      INSERT INTO ${operations} (
-        operation_key, provider_operation_token, provider, run_id, attempt, org_id, environment, state
-      )
-      SELECT
-        reserved_lease.lease_id, $9, $4, $3, $6, $2, $7, $8
-      FROM reserved_lease
-      WHERE $6::integer IS NOT NULL
-      ON CONFLICT (operation_key) DO NOTHING
-    `,
-    [
-      leaseId,
-      orgId,
-      runId,
-      input.provider,
-      RUNTIME_SANDBOX_CAPACITY_LEASE_MS,
-      input.attempt ?? null,
-      input.environment ?? 'production',
-      RuntimeSandboxOperationState.Reserved,
-      providerOperationToken,
-    ],
-  );
-  // The caller may have lost the INSERT response after PostgreSQL committed,
-  // or raced another identical retry.  A second read is mandatory: conflict
-  // swallowing alone would manufacture a lease without proving whose intent
-  // it resumes.
-  const persisted = await client.query<{
-    org_id: string;
-    run_id: string;
-    provider: RuntimeSandboxProviderId;
-    operation_attempt: number | null;
-    operation_environment: 'preview' | 'production' | null;
-    operation_provider: RuntimeSandboxProviderId | null;
-    provider_operation_token: string | null;
-    operation_state: RuntimeSandboxOperationState | null;
-    released_at: Date | null;
-    sandbox_id: string | null;
-  }>(
-    `SELECT lease.org_id, lease.run_id, lease.provider,
+  if (input.attempt === undefined) {
+    // Historical lease-only callers retain their read/write/readback contract.
+    await client.query(
+      `INSERT INTO ${leases} (lease_id, org_id, run_id, provider, expires_at)
+       VALUES ($1, $2, $3, $4,
+               clock_timestamp() + ($5::integer * interval '1 millisecond'))
+       ON CONFLICT (lease_id) DO NOTHING`,
+      [
+        leaseId,
+        orgId,
+        runId,
+        input.provider,
+        RUNTIME_SANDBOX_CAPACITY_LEASE_MS,
+      ],
+    );
+  }
+  // RETURNING proves only this statement's newly inserted lease AND intent.
+  // A conflict, legacy lease-only write or ambiguous result still needs the
+  // authoritative readback; swallowing a conflict never grants create rights.
+  const insertedProof = observed.rows[0]?.inserted_proof;
+  const persisted = insertedProof
+    ? { rows: [insertedProof] }
+    : await client.query<RuntimeSandboxReservationProof>(
+        `SELECT lease.org_id, lease.run_id, lease.provider,
             operation.attempt AS operation_attempt,
             operation.environment AS operation_environment,
             operation.provider AS operation_provider,
@@ -555,8 +612,8 @@ export async function reserveRuntimeSandboxCapacityLease(
        LEFT JOIN ${operations} AS operation
          ON operation.operation_key = lease.lease_id
       WHERE lease.lease_id = $1`,
-    [leaseId],
-  );
+        [leaseId],
+      );
   const row = persisted.rows[0];
   if (
     !row ||

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/runtime-worker-wake.ts

@@ -0,0 +1,152 @@
+import dns from 'node:dns';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+
+export const RUNTIME_WORKER_WAKE_PATH = '/internal/runtime-worker/wake';
+
+/** Wake the existing, fixed queue only. The hint cannot admit or name a task. */
+export function handleRuntimeWorkerWake(
+  req: IncomingMessage,
+  res: ServerResponse,
+  input: { expectedToken: string | undefined; wake: (() => boolean) | null },
+): boolean {
+  if (
+    new URL(req.url ?? '/', 'http://worker.local').pathname !==
+    RUNTIME_WORKER_WAKE_PATH
+  )
+    return false;
+  const respond = (status: number, body: string) => {
+    res.writeHead(status, {
+      'content-type': 'application/json',
+      'cache-control': 'no-store',
+      ...(status === 405 ? { allow: 'POST' } : {}),
+    });
+    res.end(body);
+  };
+  if (req.method !== 'POST') {
+    respond(405, '{"error":"Use POST."}');
+  } else if (
+    !input.expectedToken?.trim() ||
+    req.headers.authorization?.trim() !== `Bearer ${input.expectedToken.trim()}`
+  ) {
+    respond(401, '{"error":"Unauthorized."}');
+  } else if (!input.wake?.()) {
+    respond(503, '{"error":"Worker is not accepting wakes."}');
+  } else {
+    respond(202, '{"ok":true}');
+  }
+  return true;
+}
+
+export type RuntimeWorkerWakeTarget = { url: string; token: string };
+
+/** Deployment-owned routing only. No request may supply a worker destination. */
+export function runtimeWorkerWakeTargetFromEnv(
+  env: Record<string, string | undefined> = process.env,
+): RuntimeWorkerWakeTarget | null {
+  const url = env.DEEPLINE_RUNTIME_WORKER_WAKE_URL?.trim();
+  const token = env.DEEPLINE_INTERNAL_TOKEN?.trim();
+  return url && token ? { url, token } : null;
+}
+
+/** A bounded hint, never a retry, admission, or correctness dependency. */
+export async function requestRuntimeWorkerWake(
+  target: RuntimeWorkerWakeTarget,
+): Promise<boolean> {
+  const startedAt = performance.now();
+  let phase = 'resolve';
+  let status: number | undefined;
+  // Bun 1.3.14 can drop AbortSignal.timeout's timer when DNS removes its listener.
+  const controller = new AbortController();
+  const signal = controller.signal;
+  const timeout = setTimeout(
+    () =>
+      controller.abort(
+        new DOMException('Worker wake timed out.', 'TimeoutError'),
+      ),
+    500,
+  );
+  try {
+    const url = new URL(target.url);
+    // Fly's private names use IPv6. Bun 1.3.14 can select an unusable IPv4
+    // address even with node:http's family: 6; dial the resolved address.
+    if (url.protocol === 'http:' && url.hostname.endsWith('.internal')) {
+      const address = await new Promise<string>((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        signal.addEventListener('abort', abort, { once: true });
+        dns.lookup(url.hostname, { family: 6 }, (error, address) => {
+          signal.removeEventListener('abort', abort);
+          if (signal.aborted) reject(signal.reason);
+          else if (error) reject(error);
+          else resolve(address);
+        });
+      });
+      url.hostname = `[${address}]`;
+    }
+    phase = 'request';
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: { authorization: `Bearer ${target.token}` },
+      redirect: 'error',
+      signal,
+    });
+    status = response.status;
+    phase = 'cancel_response';
+    await response.body?.cancel();
+    if (status === 202) {
+      console.info('[runtime.worker_wake.accepted]', {
+        status,
+        ms: performance.now() - startedAt,
+      });
+      return true;
+    }
+    console.warn('[runtime.worker_wake.failed]', { status });
+  } catch (error) {
+    console.warn('[runtime.worker_wake.failed]', {
+      phase,
+      status,
+      error: error instanceof Error ? error.name : 'TransportError',
+      code:
+        error instanceof Error && 'code' in error
+          ? String(error.code)
+          : undefined,
+    });
+  } finally {
+    clearTimeout(timeout);
+  }
+  return false;
+}
+
+/** The existing gateway relays to its fixed private worker; it cannot name work. */
+export async function handleRuntimeGatewayWorkerWake(
+  req: Request,
+  input: {
+    expectedToken: string | undefined;
+    target: RuntimeWorkerWakeTarget | null;
+  },
+): Promise<Response | null> {
+  if (new URL(req.url).pathname !== RUNTIME_WORKER_WAKE_PATH) return null;
+  const respond = (status: number, body: string) =>
+    new Response(body, {
+      status,
+      headers: {
+        'content-type': 'application/json',
+        'cache-control': 'no-store',
+        ...(status === 405 ? { allow: 'POST' } : {}),
+      },
+    });
+  if (req.method !== 'POST') return respond(405, '{"error":"Use POST."}');
+  if (
+    !input.expectedToken?.trim() ||
+    req.headers.get('authorization')?.trim() !==
+      `Bearer ${input.expectedToken.trim()}`
+  ) {
+    return respond(401, '{"error":"Unauthorized."}');
+  }
+  if (!input.target || !(await requestRuntimeWorkerWake(input.target))) {
+    return respond(
+      503,
+      '{"error":"Worker wake unavailable; durable polling remains active."}',
+    );
+  }
+  return respond(202, '{"ok":true}');
+}

package/dist/bundling-sources/shared_libs/play-runtime/test-runtime-seams.ts

@@ -59,9 +59,11 @@ type ValidatedRuntimeTestPolicyOverrides =
   | { ok: true; overrides: RuntimeTestPolicyOverrides | null }
   | { ok: false; status: 400 | 403; error: string };
 
-const SUPPORTED_RUNTIME_TEST_FAULTS = new Set<RuntimeTestFaultName>(
-  runtimeTestFaultDrills().map(({ id }) => id),
-);
+// Keep local construction removable when a Play never uses the test seams.
+const SUPPORTED_RUNTIME_TEST_FAULTS = /* @__PURE__ */ (() =>
+  new Set<RuntimeTestFaultName>(
+    runtimeTestFaultDrills().map(({ id }) => id),
+  ))();
 
 const RUNTIME_TEST_POLICY_MS_FIELDS = new Set([
   'receiptLeaseTtlMs',

package/dist/bundling-sources/shared_libs/play-runtime/tool-cache-policy.ts

@@ -14,3 +14,34 @@ const ALWAYS_FRESH_INTEGRATION_TOOL_IDS = new Set([
 export function isAlwaysFreshIntegrationTool(toolId: string): boolean {
   return ALWAYS_FRESH_INTEGRATION_TOOL_IDS.has(toolId.trim());
 }
+
+/** Catalog capabilities are added without changing legacy artifact semantics. */
+export function toolReusableResultSupport(input: {
+  toolId?: string;
+  resultReuse?: 'read' | 'operation';
+  retry?: { idempotencyScope?: 'invocation'; requiresExecutionFence?: boolean };
+  authoredTags?: string[];
+  tags?: string[];
+}): { supported: boolean; unavailableReason: string | null } {
+  if (input.toolId && isAlwaysFreshIntegrationTool(input.toolId))
+    return {
+      supported: false,
+      unavailableReason:
+        'Workspace edits and conflict checks must be observed on every invocation.',
+    };
+  const write =
+    input.resultReuse === 'operation' ||
+    input.retry?.idempotencyScope === 'invocation' ||
+    input.retry?.requiresExecutionFence === true ||
+    [...(input.authoredTags ?? []), ...(input.tags ?? [])].some(
+      (tag) => tag === 'write' || tag.endsWith('_write') || tag === 'persist',
+    );
+  return {
+    supported: !write && input.resultReuse === 'read',
+    unavailableReason: write
+      ? 'This action performs an intended operation; completed operations recover within their run, but separate calls must execute independently.'
+      : input.resultReuse === 'read'
+        ? null
+        : 'This action has no declared read-result reuse capability. Use staleAfterSeconds: 0; completed operations still recover within their run.',
+  };
+}

package/dist/bundling-sources/shared_libs/play-runtime/transient-service-error.ts

@@ -72,6 +72,16 @@ export function transientServiceUnavailableDetail(
   ) {
     return detail;
   }
+  // Convex can fail to start a clean isolate before a function begins. Keep
+  // the exact structured internal error retryable without
+  // treating a matching message alone as a transient failure.
+  if (
+    /(?=[\s\S]*"code"\s*:\s*"IsolateNotClean")(?=[\s\S]*"message"\s*:\s*"Couldn't start running this function")/i.test(
+      detail,
+    )
+  ) {
+    return detail;
+  }
   // Convex uses explicit ServiceUnavailable, ExpiredInQueue and
   // TooManyConcurrentRequests admission responses, as
   // well as this generic InternalServerError envelope for short control-plane

package/dist/bundling-sources/shared_libs/plays/ambiguous-write-error.ts

@@ -0,0 +1,25 @@
+/** A dispatched HTTP write whose outcome could not be confirmed. */
+export class CtxFetchAmbiguousWriteError extends Error {
+  static [Symbol.hasInstance](value: unknown): boolean {
+    return (
+      value !== null &&
+      typeof value === 'object' &&
+      (value as { code?: unknown }).code === 'CTX_FETCH_WRITE_OUTCOME_UNKNOWN'
+    );
+  }
+
+  readonly code = 'CTX_FETCH_WRITE_OUTCOME_UNKNOWN' as const;
+  readonly outcome = 'unknown' as const;
+
+  constructor(
+    readonly method: string,
+    readonly origin: string,
+    options?: ErrorOptions,
+  ) {
+    super(
+      `ctx.fetch ${method} to ${origin} was dispatched, but its outcome is unknown. Reconcile with the provider or retry only under its supported idempotency contract using the same intended-operation key.`,
+      options,
+    );
+    this.name = 'CtxFetchAmbiguousWriteError';
+  }
+}

package/dist/bundling-sources/shared_libs/plays/artifact-types.ts

@@ -38,6 +38,8 @@ export type PlayArtifactCompatibility = {
   toolResponseReceiptRevision?: string;
   /** Missing preserves Slack HITL's historical parked timeout behavior. */
   slackHitlTimeoutOutcome?: 'error';
+  /** Missing preserves historical stored-output hydration into dataset rows. */
+  datasetRowInput?: 'current_run';
 };
 
 /** The only executable Play artifact contract. */
@@ -53,6 +55,8 @@ export type PlayBundleArtifact = {
   /** Defaults to cjs_node20 when not present on legacy Node artifacts. */
   artifactKind?: PlayArtifactKind;
   entryFile: string;
+  /** Source declaration selected by a named-export bundle. Absent preserves legacy admission. */
+  exportName?: string;
   virtualFilename: string;
   sourceHash: string;
   graphHash: string;