deepline 0.3.43 → 0.3.45

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -30,6 +30,7 @@ import {
   compileRequestsWithStrategy,
   executeChunkedRequests,
 } from './batch-runtime';
+import type { AnyBatchOperationStrategy } from './batching-types';
 import {
   PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
   runtimeLeaseHeartbeatIntervalFromExpiry,
@@ -132,6 +133,19 @@ import {
   type ToolResultExecutionMetadata,
   type ToolResultMetadataInput,
 } from './tool-result';
+import {
+  createAlwaysFreshToolCallAdapter,
+  createExternallyOwnedToolResultReceipts,
+  createNativeBatchToolCallJob,
+  createToolCallReceiptCohortJob,
+  createRuntimeStepToolResultReceipts,
+  createToolCallJob,
+  ToolCallReceiptLeaseLostError,
+  type ToolCallReceiptCohortStore,
+  type ToolCallReceiptRecord,
+  type ToolCallInput,
+  type ToolResultReceipts,
+} from './tool-call/index';
 import {
   markToolExecuteResultExecutionOutcome,
   toolExecutionMetadataForOutcome,
@@ -1217,7 +1231,7 @@ function publicToolResponseEnvelope(value: unknown): {
  * projection change on receipt replay and duplicate every batch for every row.
  */
 function publicToolResponseForBatchedItem(
-  execution: ParsedToolExecuteResponse,
+  execution: ToolExecuteResult,
   result: unknown,
   forceRawV2: boolean,
 ): ParsedToolExecuteResponse['toolResponse'] | undefined {
@@ -1240,19 +1254,14 @@ function publicToolResponseForBatchedItem(
  * Batch splitters predate raw-v2 and receive the same legacy value they got
  * from callToolAPI. Keep that input contract stable; raw-v2 is attached to the
  * completed logical call separately by publicToolResponseForBatchedItem.
+ *
+ * Physical map dispatch now crosses the Tool Call Module, which returns the
+ * public ToolExecuteResult rather than leaking its private HTTP parse shape.
+ * This adapter deliberately projects that result back to the splitter's
+ * long-lived legacy input contract at the edge.
  */
-function legacyResultForBatchSplitter(
-  execution: ParsedToolExecuteResponse,
-): unknown {
-  if (execution.toolResponse && 'raw' in execution.toolResponse) {
-    return execution.toolResponse.raw;
-  }
-  return execution.result != null &&
-    typeof execution.result === 'object' &&
-    !Array.isArray(execution.result) &&
-    'data' in execution.result
-    ? execution.result.data
-    : execution.result;
+function legacyResultForBatchSplitter(execution: ToolExecuteResult): unknown {
+  return execution.toolResponse.raw;
 }
 
 const EXECUTE_TOOL_METADATA_HEADER = 'x-deepline-include-tool-metadata';
@@ -4395,6 +4404,131 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     );
   }
 
+  /**
+   * Maps already own a richer receipt cohort than a single Tool Call: one
+   * physical native batch can hold many row receipts, and the outer map job
+   * publishes each split result atomically.  Keep that ownership where it is,
+   * but make the physical provider dispatch cross the same Tool Call boundary
+   * as a direct invocation.
+   *
+   * The external receipt adapter is intentionally local to this migration.
+   * It checks the exact compatibility identities passed by the map, while the
+   * map remains the sole writer for its member receipts, follower delivery,
+   * and completion barrier.  In particular, do not turn an always-fresh map
+   * request into a provider-idempotent request here: `apiOptions` is forwarded
+   * byte-for-byte and decides whether the historical wire carried an identity.
+   */
+  private async executeMappedToolCallThroughModule(input: {
+    request: ToolCallRequest;
+    dispatchToolId: string;
+    dispatchPayload: Record<string, unknown>;
+    /** The physical operation identity already selected by the map adapter. */
+    providerOperationKey?: string;
+    /** Present only when the physical call has a durable result receipt. */
+    resultReceiptKey?: string;
+    /**
+     * The mapped receipt cohort owns the durable lifecycle for cacheable
+     * scalar calls. Native batches and always-fresh calls deliberately leave
+     * this unset and retain their existing outer compatibility adapter.
+     */
+    resultReceipts?: ToolResultReceipts;
+    apiOptions: ToolExecutionApiOptions;
+  }): Promise<ToolExecuteResult> {
+    const providerActionVersion =
+      (
+        await this.#options.getToolActionCacheVersion?.(input.dispatchToolId)
+      )?.trim() ?? '';
+    const alwaysFresh = !input.apiOptions.durableCallReceiptKey;
+    const dispatcher = {
+      dispatch: async ({
+        providerOperationKey,
+      }: {
+        providerOperationKey: string | null;
+      }) => {
+        // ToolCall is allowed to transport the compatibility identity, never
+        // derive a replacement one. A mismatch would mean a future adapter
+        // accidentally sent a different operation than it recorded.
+        if (
+          !alwaysFresh &&
+          providerOperationKey !== input.providerOperationKey
+        ) {
+          throw new Error(
+            'Map Tool Call operation identity changed in transit.',
+          );
+        }
+        const execution = await this.callToolExecutionAPI(
+          input.dispatchToolId,
+          input.dispatchPayload,
+          input.apiOptions,
+        );
+        return await this.wrapToolExecutionResult({
+          toolId: input.dispatchToolId,
+          status: execution.status,
+          jobId: execution.jobId,
+          result: execution.result,
+          toolResponse: execution.toolResponse,
+          metadata: execution.metadata,
+          meta: execution.meta,
+          requestInput: input.dispatchPayload,
+          execution: toolExecutionMetadataForOutcome({
+            kind: 'live',
+            cacheKey: input.request.cacheKey,
+            receiptKey: input.request.receiptKey,
+          }),
+        });
+      },
+    };
+    const call: Omit<ToolCallInput, 'compatibility'> = {
+      scope: {
+        organizationId: this.#options.orgId ?? 'unknown-org',
+        playScope: this.currentGovernance.currentPlayId,
+      },
+      tool: {
+        id: input.dispatchToolId,
+        providerActionVersion,
+      },
+      payload: input.dispatchPayload,
+      authorization: {
+        scopeDigest: input.request.executionAuthScopeDigest ?? null,
+      },
+      output: {
+        intent: 'dataset',
+        format:
+          this.currentToolResponseContract === RAW_V2_TOOL_RESPONSE_CONTRACT
+            ? 'raw-v2'
+            : 'v2',
+        revision: this.currentToolResponseReceiptRevision ?? null,
+      },
+      execution: {
+        mode: 'map',
+        ownerRunId: this.currentReceiptOwnerRunId,
+        force: input.request.force === true,
+      },
+    };
+    if (alwaysFresh) {
+      return await createAlwaysFreshToolCallAdapter({ dispatcher }).call(call);
+    }
+    if (!input.resultReceiptKey || !input.providerOperationKey) {
+      throw new Error('Receipt-backed map Tool Call needs durable identities.');
+    }
+    return await createToolCallJob({
+      resultReceipts:
+        input.resultReceipts ??
+        createExternallyOwnedToolResultReceipts({
+          resultReceiptKey: input.resultReceiptKey,
+          ownerRunId: this.currentReceiptOwnerRunId,
+          leaseId: input.request.receiptLeaseId,
+        }),
+      dispatcher,
+    }).call({
+      ...call,
+      compatibility: {
+        resultReceiptKey: input.resultReceiptKey,
+        providerOperationKey: input.providerOperationKey,
+      },
+    });
+  }
+
   /**
    * Bounded per-cell producer trace (ADR 0018).
    *
@@ -6825,7 +6959,11 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             staticPipeline: this.currentStaticPipeline ?? null,
           });
           if (writeResult) {
+            const recoveredStaleKeys = new Set(
+              writeResult.recoveredStaleKeys ?? [],
+            );
             for (const key of writeResult.staleDroppedKeys ?? []) {
+              if (recoveredStaleKeys.has(key)) continue;
               staleCompletionKeys.add(key);
             }
           }
@@ -8979,13 +9117,18 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       requestInput: input,
     });
     const store = rowContext.getStore();
-    let logicalCallId: string | null = null;
-    if (!store) {
-      const callIndexKey = `${this.currentExecutionScope.receipt.namespace}:workflow:${normalizedKey}:${toolRequestIdentity}`;
-      const callIndex = this.toolCallIndexByKey.get(callIndexKey) ?? 0;
-      this.toolCallIndexByKey.set(callIndexKey, callIndex + 1);
-      logicalCallId = stableDigest(`${callIndexKey}:${callIndex}`);
-    }
+    const logicalCallScope = store
+      ? [
+          'row',
+          store.tableNamespace?.trim() || 'map',
+          store.rowKey?.trim() || String(store.rowId),
+          store.fieldName?.trim() || 'field',
+        ].join(':')
+      : 'workflow';
+    const callIndexKey = `${this.currentExecutionScope.receipt.namespace}:${logicalCallScope}:${normalizedKey}:${toolRequestIdentity}`;
+    const callIndex = this.toolCallIndexByKey.get(callIndexKey) ?? 0;
+    this.toolCallIndexByKey.set(callIndexKey, callIndex + 1);
+    const logicalCallId = stableDigest(`${callIndexKey}:${callIndex}`);
     let executionAuthScopeDigest =
       (await this.resolveToolAuthScopeDigest(toolId))?.trim() ?? null;
     const eventWaitHandler =
@@ -9037,6 +9180,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
 
       if (!store) {
         const directCacheKey = durableCacheKey;
+        let initialDirectReceipt: RuntimeStepReceipt | null | undefined;
         const cached = !cacheableToolResult
           ? null
           : toolCachePolicy.force
@@ -9079,6 +9223,35 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             }
           }
         }
+        // A completed historical receipt may predate the ToolExecuteResult
+        // envelope. ToolCall deliberately speaks the current full-result ABI;
+        // preserve those byte-compatible stored values at this one legacy
+        // reader seam rather than teaching the deep Module an untyped result.
+        // New direct calls use the real Tool Result Receipt Adapter below.
+        if (cacheableToolResult && !toolCachePolicy.force) {
+          const historicalReceipt = await this.withRuntimeReceiptHydrationTurn(
+            async () => await this.getRuntimeStepReceipt(directCacheKey),
+          );
+          initialDirectReceipt = historicalReceipt;
+          if (
+            historicalReceipt &&
+            (historicalReceipt.status === 'completed' ||
+              historicalReceipt.status === 'skipped') &&
+            !isSerializedToolExecuteResult(historicalReceipt.output) &&
+            !isToolExecuteResult(historicalReceipt.output)
+          ) {
+            const historicalOutput =
+              this.runtimeReceiptOutput<unknown>(historicalReceipt);
+            return markToolExecuteResultExecutionOutcome(
+              historicalOutput,
+              toolExecutionOutcomeForDurableReceipt({
+                source: 'cache',
+                receiptKey: directCacheKey,
+                cacheKey: directCacheKey,
+              }),
+            );
+          }
+        }
         this.log(
           toolCachePolicy.force
             ? `Calling tool: ${toolId} (force)`
@@ -9120,71 +9293,182 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 orgId: this.#options.orgId ?? 'unknown-org',
                 toolId,
               })}${stableDigest(`${this.currentRunId}:${logicalCallId}:always-fresh`)}`;
-          const execution = await this.executeDirectToolCall({
-            toolId,
-            callKey: normalizedKey,
-            startedAt: directCallStartedAt,
-            input,
-            options: {
-              durableCallReceiptKey: physicalDirectKey,
-              playNodeScope: buildPlayNodeScope({
+          const providerOperationKey = providerIdempotencyKeyBase;
+          const resultReceiptKey = directCacheKey;
+          const toolRetryPolicy = await this.#options
+            .getToolRetryPolicy?.(toolId, input)
+            .catch(() => null);
+          // Direct cacheable calls now give ToolCall the real completed-result
+          // receipt Adapter. The provider-operation fence remains below the
+          // dispatcher: V2 and legacy presentation keys can therefore publish
+          // independent Tool Result Receipts without a second provider effect.
+          // Map members retain their cohort-owned receipt Adapter until their
+          // batched claim/heartbeat protocol moves behind the same Interface.
+          const dispatcher = {
+            dispatch: async ({
+              providerOperationKey: operationKey,
+            }: {
+              providerOperationKey: string | null;
+            }) => {
+              if (
+                cacheableToolResult &&
+                operationKey !== providerOperationKey
+              ) {
+                throw new Error(
+                  'Direct Tool Call operation identity changed in transit.',
+                );
+              }
+              const execution = await this.executeDirectToolCall({
                 toolId,
                 callKey: normalizedKey,
-              }),
-              executionAuthScopeDigest,
-              providerIdempotencyReceiptKey: cacheableToolResult
-                ? providerIdempotencyKeyBase
-                : physicalDirectKey,
-              providerIdempotencyKey: cacheableToolResult
-                ? this.providerIdempotencyKeyForToolCall({
-                    cacheKey: providerIdempotencyKeyBase,
-                    force: toolCachePolicy.force,
-                    leaseId: directReceiptLeaseId,
-                    logicalCallId,
-                  })
-                : physicalDirectKey,
-              timeoutMs: resolveToolRuntimeTimeoutMs(
+                startedAt: directCallStartedAt,
+                input,
+                options: {
+                  ...(cacheableToolResult
+                    ? {
+                        durableCallReceiptKey: physicalDirectKey,
+                        executionAuthScopeDigest,
+                        providerIdempotencyReceiptKey: operationKey,
+                        providerIdempotencyKey:
+                          this.providerIdempotencyKeyForToolCall({
+                            cacheKey: providerIdempotencyKeyBase,
+                            force: toolCachePolicy.force,
+                            leaseId: directReceiptLeaseId,
+                            logicalCallId,
+                          }),
+                        ...(directReceiptLeaseId &&
+                        (this.#options.heartbeatRuntimeStepReceipts ||
+                          this.#options.getRuntimeStepReceipt ||
+                          this.#options.getRuntimeStepReceipts)
+                          ? {
+                              beforeProviderCall: async () => {
+                                await this.assertRuntimeToolReceiptOwnership([
+                                  {
+                                    callId: 'direct',
+                                    cacheKey: directCacheKey,
+                                    receiptKey: directCacheKey,
+                                    receiptLeaseId: directReceiptLeaseId,
+                                    rowId: -1,
+                                    toolId,
+                                    input,
+                                  },
+                                ]);
+                              },
+                            }
+                          : {}),
+                      }
+                    : {}),
+                  playNodeScope: buildPlayNodeScope({
+                    toolId,
+                    callKey: normalizedKey,
+                  }),
+                  timeoutMs: resolveToolRuntimeTimeoutMs(
+                    toolId,
+                    options?.timeoutMs,
+                    this.currentAuthoringContractEdition,
+                  ),
+                  retainToolSlot: context?.retainExternalCallSlot,
+                },
+              });
+              return await this.wrapToolExecutionResult({
                 toolId,
-                options?.timeoutMs,
-                this.currentAuthoringContractEdition,
-              ),
-              retainToolSlot: context?.retainExternalCallSlot,
-              ...(directReceiptLeaseId &&
-              (this.#options.heartbeatRuntimeStepReceipts ||
-                this.#options.getRuntimeStepReceipt ||
-                this.#options.getRuntimeStepReceipts)
-                ? {
-                    beforeProviderCall: async () => {
-                      await this.assertRuntimeToolReceiptOwnership([
-                        {
-                          callId: 'direct',
-                          cacheKey: directCacheKey,
-                          receiptKey: directCacheKey,
-                          receiptLeaseId: directReceiptLeaseId,
-                          rowId: -1,
-                          toolId,
-                          input,
+                status: execution.status,
+                jobId: execution.jobId,
+                result: execution.result,
+                toolResponse: execution.toolResponse,
+                metadata: execution.metadata,
+                meta: execution.meta,
+                requestInput: input,
+                execution: toolExecutionMetadataForOutcome({
+                  kind: 'live',
+                  cacheKey: directCacheKey,
+                  ...(cacheableToolResult
+                    ? { receiptKey: resultReceiptKey }
+                    : {}),
+                }),
+              });
+            },
+          };
+          const toolCall = cacheableToolResult
+            ? createToolCallJob({
+                resultReceipts: createRuntimeStepToolResultReceipts({
+                  store: this.durableReceiptExecutionStore(),
+                  owner: { runId: this.currentReceiptOwnerRunId },
+                  ...(initialDirectReceipt !== undefined
+                    ? {
+                        initialReceipt: {
+                          key: directCacheKey,
+                          receipt: initialDirectReceipt,
                         },
-                      ]);
-                    },
-                  }
-                : {}),
+                      }
+                    : {}),
+                  withCompletedReceiptHydration: (hydrate) =>
+                    this.withRuntimeReceiptHydrationTurn(hydrate),
+                  ...(toolRetryPolicy?.requiresExecutionFence === true
+                    ? {
+                        executionLock: {
+                          required: true,
+                          ttlMs: Math.min(
+                            600_000,
+                            resolveToolRuntimeTimeoutMs(
+                              toolId,
+                              options?.timeoutMs,
+                              this.currentAuthoringContractEdition,
+                            ) ?? 300_000,
+                          ),
+                        },
+                      }
+                    : {}),
+                  recover: ({ result, resultReceiptKey, source }) =>
+                    cloneToolExecuteResultWithExecution(
+                      result,
+                      toolExecutionMetadataForOutcome(
+                        toolExecutionOutcomeForDurableReceipt({
+                          source,
+                          receiptKey: resultReceiptKey,
+                          cacheKey: directCacheKey,
+                        }),
+                      ),
+                    ),
+                }),
+                dispatcher,
+              })
+            : null;
+          const providerActionVersion =
+            (await this.#options.getToolActionCacheVersion?.(toolId))?.trim() ??
+            '';
+          const call: Omit<ToolCallInput, 'compatibility'> = {
+            scope: {
+              organizationId: this.#options.orgId ?? 'unknown-org',
+              playScope: this.currentGovernance.currentPlayId,
             },
-          });
-          const wrapped = await this.wrapToolExecutionResult({
-            toolId,
-            status: execution.status,
-            jobId: execution.jobId,
-            result: execution.result,
-            toolResponse: execution.toolResponse,
-            metadata: execution.metadata,
-            meta: execution.meta,
-            requestInput: input,
-            execution: toolExecutionMetadataForOutcome({
-              kind: 'live',
-              cacheKey: directCacheKey,
-            }),
-          });
+            tool: { id: toolId, providerActionVersion },
+            payload: input,
+            authorization: { scopeDigest: executionAuthScopeDigest },
+            output: {
+              intent: 'dataset',
+              format:
+                this.currentToolResponseContract ===
+                RAW_V2_TOOL_RESPONSE_CONTRACT
+                  ? 'raw-v2'
+                  : 'v2',
+              revision: this.currentToolResponseReceiptRevision ?? null,
+            },
+            execution: {
+              mode: 'direct',
+              ownerRunId: this.currentReceiptOwnerRunId,
+              force: toolCachePolicy.force,
+            },
+          };
+          const wrapped = toolCall
+            ? await toolCall.call({
+                ...call,
+                compatibility: {
+                  resultReceiptKey,
+                  providerOperationKey,
+                },
+              })
+            : await createAlwaysFreshToolCallAdapter({ dispatcher }).call(call);
           settleDirectCall(toolAttemptOutcomeForResult(wrapped));
           if (cacheableToolResult) {
             this.cacheToolResult(toolId, directCacheKey, wrapped, 'direct');
@@ -9284,6 +9568,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         );
         this.enqueueToolCall({
           callId,
+          logicalCallId,
           cacheKey: toolResultCacheKey,
           providerIdempotencyKeyBase,
           cacheable: cacheableToolResult,
@@ -9327,56 +9612,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       authScopeAttempt += 1
     ) {
       try {
-        const toolRetryPolicy = await this.#options
-          .getToolRetryPolicy?.(toolId, input)
-          .catch(() => null);
-        return await this.executeWithRuntimeReceipt(
-          'tool',
-          normalizedKey,
-          this.currentRunId,
-          {
-            receiptKey: durableCacheKey,
-            semanticKey: toolRequestIdentity,
-            force: toolCachePolicy.force,
-            // Missing metadata is intentionally lock-free. Only explicitly
-            // dangerous non-idempotent side effects enter the fence path.
-            requiresExecutionLock:
-              toolRetryPolicy?.requiresExecutionFence === true,
-            executionLockTtlMs: Math.min(
-              600_000,
-              resolveToolRuntimeTimeoutMs(
-                toolId,
-                options?.timeoutMs,
-                this.currentAuthoringContractEdition,
-              ) ?? 300_000,
-            ),
-            staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
-            onClaimedResult: (output, receiptKey) =>
-              markToolExecuteResultExecutionOutcome(output, {
-                kind: 'live',
-                receiptKey,
-              }),
-            onRecovered: (output, _receipt, source) =>
-              markToolExecuteResultExecutionOutcome(
-                output,
-                toolExecutionOutcomeForDurableReceipt({
-                  source,
-                  receiptKey: durableCacheKey,
-                }),
-              ),
-            shouldPersistFailure: (error) =>
-              !(error instanceof ToolExecuteAuthScopeChangedError),
-            markRunningBeforeExecute: false,
-            execute: ({ leaseId, retainExternalCallSlot }) =>
-              executeTool({ leaseId, retainExternalCallSlot }),
-            runningReceiptWaitMaxAttempts:
-              resolveRuntimeToolReceiptWaitMaxAttempts(
-                options?.receiptWaitMs !== undefined
-                  ? { max_wait_ms: options.receiptWaitMs }
-                  : input,
-              ),
-          },
-        );
+        return await executeTool();
       } catch (error) {
         if (
           !(error instanceof ToolExecuteAuthScopeChangedError) ||
@@ -10450,6 +10686,938 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     };
   }
 
+  /**
+   * Concrete RuntimeStepReceipt adapter for the map receipt-cohort Module.
+   *
+   * It is intentionally shared by scalar and provider-native map calls. The
+   * two call shapes differ at provider dispatch, not at the member receipt
+   * protocol: both need an atomic claim/reclaim, a single cohort heartbeat,
+   * and lease-fenced terminal fanout. Keeping that at one seam prevents a
+   * native batch from becoming a second, subtly different receipt runtime.
+   */
+  private createRuntimeStepToolCallReceiptCohortStore(input: {
+    toolId: string;
+    requestForReceipt: ReadonlyMap<string, ToolCallRequest>;
+  }): ToolCallReceiptCohortStore {
+    const asRecord = async (
+      receiptKey: string,
+      receipt: RuntimeStepReceipt | null | undefined,
+    ): Promise<ToolCallReceiptRecord | null> => {
+      if (!receipt) return null;
+      const normalized = this.normalizeRuntimeStepReceipt(receiptKey, receipt);
+      if (!normalized) return null;
+      const request = input.requestForReceipt.get(receiptKey);
+      if (!request) {
+        throw new Error(
+          `Unknown Tool Call Receipt Cohort receipt ${receiptKey}.`,
+        );
+      }
+      const terminal =
+        normalized.status === 'completed' || normalized.status === 'skipped';
+      const result = terminal
+        ? await this.wrapToolExecutionResult({
+            toolId: input.toolId,
+            status:
+              normalized.output === null || normalized.output === undefined
+                ? 'no_result'
+                : 'completed',
+            result: this.runtimeReceiptOutput(normalized),
+            requestInput: request.input,
+            execution: toolExecutionMetadataForOutcome({
+              kind: 'cache',
+              cacheKey: request.cacheKey,
+              receiptKey,
+              attachedToReceiptKey: receiptKey,
+            }),
+          })
+        : undefined;
+      return {
+        resultReceiptKey: receiptKey,
+        status: normalized.status,
+        ...(result !== undefined ? { result } : {}),
+        ...(normalized.status === 'failed'
+          ? {
+              error: runtimeReceiptFailureError(
+                normalized,
+                'Durable tool call failed',
+                this.currentToolErrorSchemaVersion,
+              ),
+            }
+          : {}),
+        ...(normalized.leaseId &&
+        (normalized.leaseOwnerRunId ?? normalized.runId)?.trim()
+          ? {
+              lease: {
+                leaseId: normalized.leaseId,
+                ownerRunId: (normalized.leaseOwnerRunId ??
+                  normalized.runId)!.trim(),
+              },
+            }
+          : {}),
+        ...(normalized.leaseExpiresAt
+          ? { leaseExpiresAt: normalized.leaseExpiresAt }
+          : {}),
+        ...(normalized.claimState ? { claimState: normalized.claimState } : {}),
+      };
+    };
+    const recordsFor = async (
+      receiptKeys: string[],
+      receipts: Map<string, RuntimeStepReceipt>,
+    ): Promise<ToolCallReceiptRecord[]> =>
+      (
+        await Promise.all(
+          receiptKeys.map(
+            async (receiptKey) =>
+              await asRecord(receiptKey, receipts.get(receiptKey)),
+          ),
+        )
+      ).filter((record): record is ToolCallReceiptRecord => record !== null);
+
+    return {
+      read: async ({ resultReceiptKeys }) =>
+        await this.withRuntimeReceiptHydrationTurn(
+          async () =>
+            await recordsFor(
+              resultReceiptKeys,
+              await this.getRuntimeStepReceipts(resultReceiptKeys),
+            ),
+        ),
+      claim: async ({ receipts }) => {
+        const claims = new Map<string, RuntimeStepReceipt>();
+        const groups = new Map<string, Array<(typeof receipts)[number]>>();
+        for (const receipt of receipts) {
+          const groupKey = [
+            receipt.reclaimRunning ? 'reclaim' : 'ordinary',
+            receipt.force ? 'force' : 'cached',
+            receipt.forceFailedRefresh ? 'failed-force' : 'failed-cached',
+          ].join(':');
+          const group = groups.get(groupKey) ?? [];
+          group.push(receipt);
+          groups.set(groupKey, group);
+        }
+        for (const group of groups.values()) {
+          const first = group[0]!;
+          const claimed = await this.claimRuntimeStepReceipts(
+            group.map((receipt) => receipt.resultReceiptKey),
+            this.currentReceiptOwnerRunId,
+            first.reclaimRunning,
+            first.force,
+            first.forceFailedRefresh,
+          );
+          for (const [key, receipt] of claimed) claims.set(key, receipt);
+        }
+        return await recordsFor(
+          receipts.map((receipt) => receipt.resultReceiptKey),
+          claims,
+        );
+      },
+      heartbeat: async ({ receipts }) => {
+        if (!this.#options.heartbeatRuntimeStepReceipts) {
+          return await recordsFor(
+            receipts.map((receipt) => receipt.resultReceiptKey),
+            await this.getRuntimeStepReceipts(
+              receipts.map((receipt) => receipt.resultReceiptKey),
+            ),
+          );
+        }
+        const response = await this.#options.heartbeatRuntimeStepReceipts({
+          runId: this.currentReceiptOwnerRunId,
+          runAttempt: this.currentRunAttempt,
+          keys: receipts.map((receipt) => receipt.resultReceiptKey),
+          leaseIds: receipts.map((receipt) => receipt.lease.leaseId),
+        });
+        const byKey = new Map<string, RuntimeStepReceipt>();
+        for (let index = 0; index < receipts.length; index += 1) {
+          const request = receipts[index]!;
+          const normalized = this.normalizeRuntimeStepReceipt(
+            request.resultReceiptKey,
+            response[index],
+          );
+          if (normalized) byKey.set(request.resultReceiptKey, normalized);
+        }
+        return await recordsFor(
+          receipts.map((receipt) => receipt.resultReceiptKey),
+          byKey,
+        );
+      },
+      complete: async ({ receipts }) => {
+        const completed = await this.completeRuntimeStepReceipts(
+          receipts.map((receipt) => ({
+            key: receipt.resultReceiptKey,
+            runId: this.currentReceiptOwnerRunId,
+            leaseId: receipt.lease.leaseId,
+            output: serializeToolExecuteResult(receipt.result),
+          })),
+        );
+        return await recordsFor(
+          receipts.map((receipt) => receipt.resultReceiptKey),
+          completed,
+        );
+      },
+      fail: async ({ receipts }) => {
+        const failed = await this.failRuntimeStepReceipts(
+          receipts.map((receipt) => ({
+            key: receipt.resultReceiptKey,
+            runId: this.currentReceiptOwnerRunId,
+            leaseId: receipt.lease.leaseId,
+            error: this.formatRuntimeError(receipt.error),
+            errorPayload: serializeToolExecutionFailure(receipt.error),
+            failureKind: runtimeReceiptFailureKindForError(receipt.error),
+          })),
+        );
+        return await recordsFor(
+          receipts.map((receipt) => receipt.resultReceiptKey),
+          failed,
+        );
+      },
+    };
+  }
+
+  /**
+   * The scalar map path used to duplicate the receipt state machine in
+   * `executeBatchedToolCalls`: one loop claimed/reclaimed/followed rows and a
+   * later loop heartbeated and completed them.  That made it too easy for the
+   * Tool Call boundary to be only cosmetic.  This is the narrow replacement
+   * slice: cacheable members of a *non-native* map hand their whole receipt
+   * lifecycle to the cohort Module, while this Context remains only the
+   * transport/presentation Adapter.
+   *
+   * Do not widen this to physical native batches or always-fresh calls. A
+   * native batch owns a different aggregate operation receipt, and
+   * always-fresh calls intentionally have no durable member receipt.
+   */
+  private async executeCacheableNonNativeMapToolCallCohort(input: {
+    toolId: string;
+    requests: ToolCallRequest[];
+  }): Promise<ToolCallRequest[]> {
+    const { toolId, requests } = input;
+    if (requests.length === 0) return [];
+
+    const requestForReceipt = new Map<string, ToolCallRequest>();
+    for (const request of requests) {
+      const receiptKey = request.receiptKey?.trim();
+      if (!receiptKey) {
+        throw new Error(
+          'Cacheable non-native map Tool Call cohort requires receipt keys.',
+        );
+      }
+      requestForReceipt.set(receiptKey, request);
+    }
+
+    const store = this.createRuntimeStepToolCallReceiptCohortStore({
+      toolId,
+      requestForReceipt,
+    });
+
+    const cohort = await createToolCallReceiptCohortJob({ store }).acquire({
+      owner: {
+        runId: this.currentReceiptOwnerRunId,
+        attempt: this.currentRunAttempt,
+      },
+      members: requests.map((request) => ({
+        memberId: request.callId,
+        resultReceiptKey: request.receiptKey!,
+        force: request.force === true,
+        forceFailedRefresh: request.forceFailedRefresh === true,
+        waitMaxAttempts: resolveRuntimeToolReceiptWaitMaxAttempts(
+          typeof request.receiptWaitMs === 'number'
+            ? { max_wait_ms: request.receiptWaitMs }
+            : request.input,
+        ),
+      })),
+      // Claim immediately so unrelated owned rows can cross provider work
+      // while foreign members hydrate in the bounded lane.
+      eager: true,
+    });
+
+    // Claims carry their actual expiry. Seed the cohort supervisor from that
+    // lease rather than the generic fallback, otherwise a long provider-shaped
+    // queue can let undispatched rows expire before its first renewal.
+    for (const request of requests) {
+      const member = cohort.member(request.callId);
+      if (member.kind !== 'owned') continue;
+      request.receiptLeaseId = member.lease.leaseId;
+      request.receiptLeaseExpiresAt = member.leaseExpiresAt ?? null;
+    }
+
+    const earliestLeaseExpiry = requests.reduce<string | null>(
+      (earliest, request) => {
+        const expiresAt = request.receiptLeaseExpiresAt ?? null;
+        if (!expiresAt) return earliest;
+        if (!earliest) return expiresAt;
+        return Date.parse(expiresAt) < Date.parse(earliest)
+          ? expiresAt
+          : earliest;
+      },
+      null,
+    );
+    // One cohort-wide liveness check closes the claim-to-provider window; the
+    // per-call views additionally preserve the historical exact admission
+    // fence immediately before an individual provider request.
+    await cohort.heartbeat();
+    let cohortLeaseLost: unknown | null = null;
+    const heartbeat = cohort.startHeartbeat({
+      intervalMs: Math.max(
+        1,
+        Math.floor(
+          runtimeLeaseHeartbeatIntervalFromExpiry({
+            leaseExpiresAt: earliestLeaseExpiry,
+            fallbackTtlMs: PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
+          }) / 2,
+        ),
+      ),
+      onLeaseLost: (error) => {
+        cohortLeaseLost ??= error;
+      },
+      onTransientFailure: (error) => {
+        this.log(
+          `Tool Call Receipt Cohort heartbeat transport failed; retrying: ${
+            error instanceof Error ? error.message : String(error)
+          }`,
+        );
+      },
+    });
+
+    const successful: ToolCallRequest[] = [];
+    const resolve = async (
+      request: ToolCallRequest,
+      result: ToolExecuteResult,
+      source: 'cache' | 'in_flight' | 'owner',
+    ): Promise<void> => {
+      const receiptKey = request.receiptKey!;
+      const finalResult = cloneToolExecuteResultWithExecution(
+        result,
+        toolExecutionMetadataForOutcome({
+          kind: source === 'owner' ? 'live' : source,
+          cacheKey: request.cacheKey,
+          receiptKey,
+          ...(source === 'owner' ? {} : { attachedToReceiptKey: receiptKey }),
+        }),
+      );
+      this.cacheToolResult(toolId, request.cacheKey, finalResult);
+      const resolver = this.toolCallResolvers.get(request.callId);
+      if (resolver) {
+        resolver.resolve(finalResult);
+        this.toolCallResolvers.delete(request.callId);
+      }
+      this.emitScopedFieldMetaUpdate({
+        rowId: request.rowId,
+        key: request.rowKey ?? null,
+        tableNamespace: request.tableNamespace ?? null,
+        fieldName: request.fieldName,
+        status: source === 'owner' ? 'running' : 'cached',
+        rowStatus: 'running',
+        stage: toolId,
+        provider: null,
+        error: null,
+        ...(source === 'owner' ? {} : { reused: true }),
+        dataPatch: {},
+      });
+      successful.push(request);
+    };
+    const reject = async (request: ToolCallRequest, error: unknown) => {
+      await this.rejectToolCall(toolId, request, error, {
+        // ToolCallReceiptCohort is the one failure writer. Re-entering the
+        // legacy writer here would race its member terminal transition.
+        persistReceiptFailure: false,
+      });
+    };
+
+    try {
+      const handled = new Set<string>();
+      const followOrRecover: Promise<void>[] = [];
+      const collectReadyMembers = (): Array<{
+        request: ToolCallRequest;
+        receipts: ToolResultReceipts;
+      }> => {
+        const owned: Array<{
+          request: ToolCallRequest;
+          receipts: ToolResultReceipts;
+        }> = [];
+        for (const request of requests) {
+          if (handled.has(request.callId)) continue;
+          const member = cohort.member(request.callId);
+          if (member.kind === 'recovering') continue;
+          handled.add(request.callId);
+          if (member.kind === 'completed') {
+            followOrRecover.push(
+              resolve(request, member.result, member.source),
+            );
+          } else if (member.kind === 'failed') {
+            followOrRecover.push(reject(request, member.error));
+          } else if (member.kind === 'following') {
+            followOrRecover.push(
+              member.result.then(
+                async (result) => await resolve(request, result, 'in_flight'),
+                async (error: unknown) => await reject(request, error),
+              ),
+            );
+          } else {
+            request.receiptLeaseId = member.lease.leaseId;
+            request.receiptLeaseExpiresAt = member.leaseExpiresAt ?? null;
+            owned.push({ request, receipts: member.receipts });
+          }
+        }
+        return owned;
+      };
+
+      const width = Math.min(
+        this.governor.policy.concurrency.toolCalls,
+        Math.max(
+          1,
+          this.fixtureProviderPacingDisabled()
+            ? this.governor.policy.concurrency.toolCalls
+            : await this.resourceGovernor.suggestedToolParallelism(
+                toolId,
+                this.governor.policy.concurrency.toolCalls,
+              ),
+        ),
+      );
+      const dispatchOwned = async (
+        owned: Array<{
+          request: ToolCallRequest;
+          receipts: ToolResultReceipts;
+        }>,
+      ) =>
+        await dispatchBoundedSettled(
+          owned,
+          width,
+          async ({ request, receipts }) => {
+            if (this.persistenceLatch.tripped) {
+              const error = new RuntimePersistenceCircuitOpenError(
+                this.persistenceLatch,
+              );
+              await cohort.fail([{ memberId: request.callId, error }]);
+              throw error;
+            }
+            let releaseToolSlot: () => void = () => undefined;
+            try {
+              const result = await this.executeMappedToolCallThroughModule({
+                request,
+                dispatchToolId: toolId,
+                dispatchPayload: request.input,
+                resultReceiptKey: request.receiptKey!,
+                providerOperationKey:
+                  request.providerIdempotencyKeyBase ?? request.receiptKey!,
+                resultReceipts: receipts,
+                apiOptions: {
+                  beforeProviderCall: () => {
+                    if (cohortLeaseLost) throw cohortLeaseLost;
+                    heartbeat.assertOwned();
+                  },
+                  heartbeatReceipt: async () => {
+                    try {
+                      const outcome = await cohort.heartbeat();
+                      if (outcome === 'terminal') {
+                        throw new ToolCallReceiptLeaseLostError(
+                          request.receiptKey!,
+                        );
+                      }
+                    } catch (error) {
+                      if (error instanceof ToolCallReceiptLeaseLostError) {
+                        throw new RuntimeReceiptLeaseLostError({
+                          receiptKey: request.receiptKey!,
+                          runId: this.currentReceiptOwnerRunId,
+                          leaseId:
+                            request.receiptLeaseId ?? 'missing-cohort-lease',
+                        });
+                      }
+                      throw error;
+                    }
+                  },
+                  playNodeScope: playNodeScopeForToolCallRequest(request),
+                  durableCallReceiptKey: request.receiptKey,
+                  executionAuthScopeDigest: request.executionAuthScopeDigest,
+                  providerIdempotencyReceiptKey:
+                    request.providerIdempotencyKeyBase ?? request.receiptKey,
+                  providerIdempotencyKey:
+                    this.providerIdempotencyKeyForToolCall({
+                      cacheKey:
+                        request.providerIdempotencyKeyBase ??
+                        request.receiptKey!,
+                      force: request.force === true,
+                      leaseId: request.receiptLeaseId,
+                      logicalCallId: request.logicalCallId,
+                    }),
+                  receiptLeaseExpiresAt: request.receiptLeaseExpiresAt,
+                  timeoutMs:
+                    typeof request.timeoutMs === 'number' &&
+                    request.timeoutMs > 0
+                      ? request.timeoutMs
+                      : undefined,
+                  retainToolSlot: (release) => {
+                    releaseToolSlot = release;
+                  },
+                },
+              });
+              await resolve(request, result, 'owner');
+            } catch (error) {
+              await reject(request, error);
+            } finally {
+              releaseToolSlot();
+            }
+          },
+        );
+
+      // Eager cohort acquisition makes the initial claim available before a
+      // foreign receipt's read/reclaim path completes. This preserves map
+      // overlap: a broken foreign read must not strand an already-owned
+      // provider operation behind it.
+      const initialDispatch = dispatchOwned(collectReadyMembers());
+      const settlement = cohort.settle();
+      const [initialResult, settlementResult] = await Promise.allSettled([
+        initialDispatch,
+        settlement,
+      ]);
+      // A recovery can reclaim an expired receipt and turn it into another
+      // owned member. Collect its final state after the initial work settles.
+      const recoveredDispatch = await dispatchOwned(collectReadyMembers());
+      await Promise.allSettled(followOrRecover);
+      // dispatchBoundedSettled intentionally captures provider failures; all
+      // affected row resolvers have already been rejected above.
+      void initialResult;
+      void recoveredDispatch;
+      if (settlementResult.status === 'rejected') {
+        throw settlementResult.reason;
+      }
+    } finally {
+      heartbeat.stop();
+    }
+    return successful;
+  }
+
+  /**
+   * Executes provider-native batches through the Native Batch Tool Call
+   * Module. Unlike the compatibility path below, the Module owns the member
+   * receipt cohort from claim through recovery, heartbeat and terminal split
+   * fanout. This method is only the runtime Adapter: it compiles provider
+   * payloads, invokes transport, and presents already-terminal member values
+   * to map rows.
+   */
+  private async executeCacheableNativeMapToolCallCohort(input: {
+    toolId: string;
+    requests: ToolCallRequest[];
+    strategy: AnyBatchOperationStrategy;
+  }): Promise<ToolCallRequest[]> {
+    const { toolId, requests, strategy } = input;
+    if (requests.length === 0) return [];
+
+    const requestForReceipt = new Map<string, ToolCallRequest>();
+    const requestByCallId = new Map<string, ToolCallRequest>();
+    for (const request of requests) {
+      const receiptKey = request.receiptKey?.trim();
+      if (!receiptKey) {
+        throw new Error(
+          'Cacheable native map Tool Call cohort requires receipt keys.',
+        );
+      }
+      requestForReceipt.set(receiptKey, request);
+      requestByCallId.set(request.callId, request);
+    }
+    const store = this.createRuntimeStepToolCallReceiptCohortStore({
+      toolId,
+      requestForReceipt,
+    });
+    const compiledBatches = compileRequestsWithStrategy({
+      requests,
+      strategy,
+      getPayload: (request: ToolCallRequest) => request.input,
+    });
+    const batchParallelismCeiling =
+      this.governor.policy.pacing.workerToolBatchDefaultParallelism;
+    const batchSize =
+      compiledBatches.length > 0 && !this.fixtureProviderPacingDisabled()
+        ? await this.resourceGovernor.suggestedToolParallelism(
+            compiledBatches[0]!.batchOperation,
+            batchParallelismCeiling,
+          )
+        : batchParallelismCeiling;
+    const successful: ToolCallRequest[] = [];
+
+    const deliver = (request: ToolCallRequest, result: ToolExecuteResult) => {
+      if (request.cacheable !== false) {
+        this.cacheToolResult(toolId, request.cacheKey, result);
+      }
+      const resolver = this.toolCallResolvers.get(request.callId);
+      if (resolver) {
+        resolver.resolve(result);
+        this.toolCallResolvers.delete(request.callId);
+      }
+      this.emitScopedFieldMetaUpdate({
+        rowId: request.rowId,
+        key: request.rowKey ?? null,
+        tableNamespace: request.tableNamespace ?? null,
+        fieldName: request.fieldName,
+        status:
+          result._metadata.execution.cached === true ? 'cached' : 'running',
+        rowStatus: 'running',
+        stage: toolId,
+        provider: null,
+        error: null,
+        ...(result._metadata.execution.cached === true ? { reused: true } : {}),
+        dataPatch: {},
+      });
+      successful.push(request);
+    };
+    const reject = async (request: ToolCallRequest, error: unknown) => {
+      await this.rejectToolCall(toolId, request, error, {
+        // NativeBatchToolCall owns the durable member failure transition.
+        persistReceiptFailure: false,
+      });
+    };
+
+    await executeChunkedRequests({
+      requests: compiledBatches,
+      batchSize,
+      execute: async (batch) => {
+        if (this.persistenceLatch.tripped) {
+          this.persistenceLatch.preventedCallCount +=
+            batch.memberRequests.length;
+          throw new RuntimePersistenceCircuitOpenError(this.persistenceLatch);
+        }
+        const batchRequestByCallId = new Map(
+          batch.memberRequests.map((request) => [request.callId, request]),
+        );
+        const dispatchDetails = new Map<
+          string,
+          {
+            members: ToolCallRequest[];
+            providerOperationKey: string;
+            receiptLeaseExpiresAt: string | null;
+            timeoutMs: number | undefined;
+          }
+        >();
+        const physicalToolCall = {
+          call: async (
+            physical: Parameters<
+              ReturnType<typeof createToolCallJob>['call']
+            >[0],
+          ) => {
+            const compatibility = physical.compatibility;
+            if (!compatibility) {
+              throw new Error(
+                'Native batch physical Tool Call requires compatibility identities.',
+              );
+            }
+            const detail = dispatchDetails.get(compatibility.resultReceiptKey);
+            if (!detail) {
+              throw new Error(
+                'Native batch physical Tool Call lost its dispatch details.',
+              );
+            }
+            return await createToolCallJob({
+              resultReceipts: createExternallyOwnedToolResultReceipts({
+                resultReceiptKey: compatibility.resultReceiptKey,
+                ownerRunId: this.currentReceiptOwnerRunId,
+              }),
+              dispatcher: {
+                dispatch: async ({ call, providerOperationKey }) => {
+                  if (providerOperationKey !== detail.providerOperationKey) {
+                    throw new Error(
+                      'Native batch Tool Call operation identity changed in transit.',
+                    );
+                  }
+                  const execution = await this.callToolExecutionAPI(
+                    call.tool.id,
+                    call.payload,
+                    {
+                      durableCallReceiptKey: compatibility.resultReceiptKey,
+                      playNodeScope: playNodeScopeForToolCallRequest(
+                        detail.members[0]!,
+                        call.tool.id,
+                      ),
+                      executionAuthScopeDigest:
+                        detail.members[0]?.executionAuthScopeDigest ?? null,
+                      providerIdempotencyReceiptKey:
+                        detail.providerOperationKey,
+                      providerIdempotencyKey:
+                        buildDurableToolAggregateProviderIdempotencyKey({
+                          aggregateReceiptKey: detail.providerOperationKey,
+                          receiptKeys: detail.members.map(
+                            (member) =>
+                              member.providerIdempotencyKeyBase ??
+                              member.receiptKey!,
+                          ),
+                          providerIdempotencyKeys: detail.members.map(
+                            (member) =>
+                              this.providerIdempotencyKeyForToolCall({
+                                cacheKey:
+                                  member.providerIdempotencyKeyBase ??
+                                  member.receiptKey!,
+                                force: member.force === true,
+                                leaseId: member.receiptLeaseId,
+                                logicalCallId: member.logicalCallId,
+                              }),
+                          ),
+                        }),
+                      receiptLeaseExpiresAt: detail.receiptLeaseExpiresAt,
+                      timeoutMs: detail.timeoutMs,
+                    },
+                  );
+                  return await this.wrapToolExecutionResult({
+                    toolId: call.tool.id,
+                    status: execution.status,
+                    jobId: execution.jobId,
+                    result: execution.result,
+                    toolResponse: execution.toolResponse,
+                    metadata: execution.metadata,
+                    meta: execution.meta,
+                    requestInput: call.payload,
+                    execution: toolExecutionMetadataForOutcome({
+                      kind: 'live',
+                      cacheKey: detail.members[0]!.cacheKey,
+                      receiptKey: compatibility.resultReceiptKey,
+                    }),
+                  });
+                },
+              },
+            }).call(physical);
+          },
+        };
+        const job = createNativeBatchToolCallJob({
+          receiptCohort: createToolCallReceiptCohortJob({ store }),
+          physicalToolCall,
+        });
+        const result = await job.execute({
+          owner: {
+            runId: this.currentReceiptOwnerRunId,
+            attempt: this.currentRunAttempt,
+          },
+          members: batch.memberRequests.map((request) => ({
+            memberId: request.callId,
+            forceFailedRefresh: request.forceFailedRefresh === true,
+            waitMaxAttempts: resolveRuntimeToolReceiptWaitMaxAttempts(
+              typeof request.receiptWaitMs === 'number'
+                ? { max_wait_ms: request.receiptWaitMs }
+                : request.input,
+            ),
+            call: {
+              scope: {
+                organizationId: this.#options.orgId ?? 'unknown-org',
+                playScope: this.currentGovernance.currentPlayId,
+              },
+              tool: { id: toolId, providerActionVersion: '' },
+              payload: request.input,
+              authorization: {
+                scopeDigest: request.executionAuthScopeDigest ?? null,
+              },
+              output: {
+                intent: 'dataset',
+                format:
+                  this.currentToolResponseContract ===
+                  RAW_V2_TOOL_RESPONSE_CONTRACT
+                    ? 'raw-v2'
+                    : 'v2',
+                revision: this.currentToolResponseReceiptRevision ?? null,
+              },
+              execution: {
+                mode: 'map',
+                ownerRunId: this.currentReceiptOwnerRunId,
+                force: request.force === true,
+              },
+              compatibility: {
+                resultReceiptKey: request.receiptKey!,
+                providerOperationKey:
+                  request.providerIdempotencyKeyBase ?? request.receiptKey!,
+              },
+            },
+          })),
+          buildPhysicalCall: ({ members }) => {
+            const owned = members.map(
+              (member) => batchRequestByCallId.get(member.memberId)!,
+            );
+            const receiptKeys = owned.map((request) => request.receiptKey!);
+            const providerReceiptKeys = owned.map(
+              (request) =>
+                request.providerIdempotencyKeyBase ?? request.receiptKey!,
+            );
+            const aggregateReceiptKey = buildDurableToolAggregateReceiptKey({
+              receiptKeys,
+              prefix: 'batch',
+              aggregateReceiptPrefix: buildDurableToolReceiptPrefix({
+                orgId: this.#options.orgId,
+                toolId: batch.batchOperation,
+              }),
+            });
+            const providerOperationKey = buildDurableToolAggregateReceiptKey({
+              receiptKeys: providerReceiptKeys,
+              prefix: 'batch',
+              aggregateReceiptPrefix: buildDurableToolReceiptPrefix({
+                orgId: this.#options.orgId,
+                toolId: batch.batchOperation,
+              }),
+            });
+            dispatchDetails.set(aggregateReceiptKey, {
+              members: owned,
+              providerOperationKey,
+              receiptLeaseExpiresAt: owned.reduce<string | null>(
+                (earliest, request) => {
+                  const expiresAt = request.receiptLeaseExpiresAt ?? null;
+                  if (!expiresAt) return earliest;
+                  if (!earliest) return expiresAt;
+                  return Date.parse(expiresAt) < Date.parse(earliest)
+                    ? expiresAt
+                    : earliest;
+                },
+                null,
+              ),
+              timeoutMs: owned.every(
+                (request) =>
+                  typeof request.timeoutMs === 'number' &&
+                  Number.isFinite(request.timeoutMs) &&
+                  request.timeoutMs > 0,
+              )
+                ? Math.max(...owned.map((request) => request.timeoutMs!))
+                : undefined,
+            });
+            return {
+              ...members[0]!.call,
+              tool: { id: batch.batchOperation, providerActionVersion: '' },
+              payload: batch.batchPayload,
+              compatibility: {
+                resultReceiptKey: aggregateReceiptKey,
+                providerOperationKey,
+              },
+            };
+          },
+          splitResult: async ({ result: aggregate, members }) => {
+            const split = batch.splitResults(
+              legacyResultForBatchSplitter(aggregate),
+            );
+            return await Promise.all(
+              members.map(async (member, index) => {
+                const request = batchRequestByCallId.get(member.memberId);
+                if (!request) {
+                  throw new Error(
+                    `Native batch Tool Call lost member ${member.memberId}.`,
+                  );
+                }
+                const item = split[index] ?? null;
+                return {
+                  memberId: member.memberId,
+                  result: await this.wrapToolExecutionResult({
+                    toolId,
+                    status: aggregate.status,
+                    result: item,
+                    toolResponse: publicToolResponseForBatchedItem(
+                      aggregate,
+                      item,
+                      this.currentToolResponseContract ===
+                        RAW_V2_TOOL_RESPONSE_CONTRACT,
+                    ),
+                    requestInput: request.input,
+                    execution: toolExecutionMetadataForOutcome({
+                      kind: 'live',
+                      cacheKey: request.cacheKey,
+                      receiptKey: request.receiptKey,
+                    }),
+                  }),
+                };
+              }),
+            );
+          },
+          heartbeat: {
+            // Claim replies carry the real expiry. A fixed fallback interval
+            // can be too slow for a short-lived gateway lease, so derive the
+            // one cohort supervisor from the earliest owned member instead.
+            intervalMs: ({ members }) =>
+              Math.max(
+                1,
+                Math.floor(
+                  runtimeLeaseHeartbeatIntervalFromExpiry({
+                    leaseExpiresAt: members.reduce<string | null>(
+                      (earliest, member) => {
+                        const expiresAt = member.leaseExpiresAt ?? null;
+                        if (!expiresAt) return earliest;
+                        if (!earliest) return expiresAt;
+                        return Date.parse(expiresAt) < Date.parse(earliest)
+                          ? expiresAt
+                          : earliest;
+                      },
+                      null,
+                    ),
+                    fallbackTtlMs: PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
+                  }) / 2,
+                ),
+              ),
+            onTransientFailure: (error) => {
+              this.log(
+                `Native Tool Call Receipt Cohort heartbeat transport failed; retrying: ${
+                  error instanceof Error ? error.message : String(error)
+                }`,
+              );
+            },
+          },
+        });
+        return { batch, result };
+      },
+      onChunkComplete: async (entries) => {
+        for (const entry of entries) {
+          if (entry.error !== undefined) {
+            // The cohort may have recovered each member through its
+            // lease-fenced single-receipt fallback, but that only prevents
+            // duplicate provider work. It must not convert a failed bulk
+            // persistence boundary into a successful map result: callers need
+            // the loud failure so this run can be retried from the durable
+            // receipts instead of continuing after an ambiguous bulk write.
+            for (const request of entry.request.memberRequests) {
+              await reject(request, entry.error);
+            }
+            throw entry.error;
+          }
+          if (!entry.result) {
+            // The NativeBatchToolCall already attempted a lease-fenced failure
+            // fanout. Read the actual durable terminal facts so cache hits in
+            // the same cohort still reach their rows and a stale failure never
+            // causes this Context to write a second terminal transition.
+            const durable = await store.read({
+              resultReceiptKeys: entry.request.memberRequests.map(
+                (request) => request.receiptKey!,
+              ),
+            });
+            const byReceipt = new Map(
+              durable.map((record) => [record.resultReceiptKey, record]),
+            );
+            for (const request of entry.request.memberRequests) {
+              const record = byReceipt.get(request.receiptKey!);
+              if (
+                record &&
+                (record.status === 'completed' ||
+                  record.status === 'skipped') &&
+                record.result
+              ) {
+                deliver(request, record.result);
+              } else {
+                await reject(
+                  request,
+                  record?.error ??
+                    entry.error ??
+                    new Error(
+                      'Native Tool Call did not reach a terminal receipt.',
+                    ),
+                );
+              }
+            }
+            continue;
+          }
+          for (const request of entry.request.memberRequests) {
+            const result = entry.result.result.get(request.callId);
+            if (!result) {
+              await reject(
+                request,
+                new Error(`Native Tool Call omitted member ${request.callId}.`),
+              );
+              continue;
+            }
+            deliver(request, result);
+          }
+        }
+      },
+      retainResults: false,
+    });
+    return successful;
+  }
+
   private async executeBatchedToolCalls(
     queuedToolCalls: ToolCallRequest[],
   ): Promise<void> {
@@ -10629,6 +11797,78 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           return timeoutMs > 0 ? timeoutMs : undefined;
         };
 
+        // Cacheable map members cross the real receipt-cohort boundary before
+        // the legacy claim loop. The scalar and native Modules share member
+        // receipt ownership; native batches retain their separate aggregate
+        // physical-operation receipt behind that seam. Always-fresh calls
+        // intentionally have no durable member receipt and stay below.
+        const operationStrategy =
+          this.#options.getBatchOperationStrategy?.(toolId) ?? null;
+        if (
+          operationStrategy &&
+          this.durableMappedToolResultsBackedByReceipts
+        ) {
+          const cohortRequests = pendingRequests.filter(
+            (request) =>
+              request.cacheable !== false &&
+              Boolean(request.receiptKey?.trim()),
+          );
+          if (cohortRequests.length > 0) {
+            const cohortCallIds = new Set(
+              cohortRequests.map((request) => request.callId),
+            );
+            pendingRequests.splice(
+              0,
+              pendingRequests.length,
+              ...pendingRequests.filter(
+                (request) => !cohortCallIds.has(request.callId),
+              ),
+            );
+            const successful =
+              await this.executeCacheableNativeMapToolCallCohort({
+                toolId,
+                requests: cohortRequests,
+                strategy: operationStrategy,
+              });
+            for (const request of successful) {
+              successfulLiveStepCallIds.add(request.callId);
+            }
+            recordToolStep(cohortRequests);
+            this.#options.onBatchComplete?.(this.checkpoint);
+          }
+        } else if (
+          !operationStrategy &&
+          this.durableMappedToolResultsBackedByReceipts
+        ) {
+          const cohortRequests = pendingRequests.filter(
+            (request) =>
+              request.cacheable !== false &&
+              Boolean(request.receiptKey?.trim()),
+          );
+          if (cohortRequests.length > 0) {
+            const cohortCallIds = new Set(
+              cohortRequests.map((request) => request.callId),
+            );
+            pendingRequests.splice(
+              0,
+              pendingRequests.length,
+              ...pendingRequests.filter(
+                (request) => !cohortCallIds.has(request.callId),
+              ),
+            );
+            const successful =
+              await this.executeCacheableNonNativeMapToolCallCohort({
+                toolId,
+                requests: cohortRequests,
+              });
+            for (const request of successful) {
+              successfulLiveStepCallIds.add(request.callId);
+            }
+            recordToolStep(cohortRequests);
+            this.#options.onBatchComplete?.(this.checkpoint);
+          }
+        }
+
         const durableExistingRunningWaits: Array<{
           receiptKey: string;
           requestsForKey: ToolCallRequest[];
@@ -10932,40 +12172,44 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   liveFollowersByOwnerCallId.set(owner.callId, waiters);
                 }
                 try {
-                  const execution = await this.callToolExecutionAPI(
-                    toolId,
-                    owner.input,
-                    {
-                      beforeProviderCall: () =>
-                        this.assertRuntimeToolReceiptOwnership([owner]),
-                      durableCallReceiptKey: receiptKey,
-                      playNodeScope: playNodeScopeForToolCallRequest(owner),
-                      executionAuthScopeDigest: owner.executionAuthScopeDigest,
-                      providerIdempotencyReceiptKey:
+                  const execution =
+                    await this.executeMappedToolCallThroughModule({
+                      request: owner,
+                      dispatchToolId: toolId,
+                      dispatchPayload: owner.input,
+                      resultReceiptKey: receiptKey,
+                      providerOperationKey:
                         owner.providerIdempotencyKeyBase ?? owner.cacheKey,
-                      receiptLeaseExpiresAt: owner.receiptLeaseExpiresAt,
-                      heartbeatReceipt: () =>
-                        this.renewRuntimeToolReceiptOwnership([owner]),
-                      providerIdempotencyKey:
-                        this.providerIdempotencyKeyForToolCall({
-                          cacheKey:
-                            owner.providerIdempotencyKeyBase ?? owner.cacheKey,
-                          force: owner.force === true,
-                          leaseId: owner.receiptLeaseId,
-                        }),
-                      timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners([
-                        owner,
-                      ]),
-                    },
-                  );
+                      apiOptions: {
+                        beforeProviderCall: () =>
+                          this.assertRuntimeToolReceiptOwnership([owner]),
+                        durableCallReceiptKey: receiptKey,
+                        playNodeScope: playNodeScopeForToolCallRequest(owner),
+                        executionAuthScopeDigest:
+                          owner.executionAuthScopeDigest,
+                        providerIdempotencyReceiptKey:
+                          owner.providerIdempotencyKeyBase ?? owner.cacheKey,
+                        receiptLeaseExpiresAt: owner.receiptLeaseExpiresAt,
+                        heartbeatReceipt: () =>
+                          this.renewRuntimeToolReceiptOwnership([owner]),
+                        providerIdempotencyKey:
+                          this.providerIdempotencyKeyForToolCall({
+                            cacheKey:
+                              owner.providerIdempotencyKeyBase ??
+                              owner.cacheKey,
+                            force: owner.force === true,
+                            leaseId: owner.receiptLeaseId,
+                            logicalCallId: owner.logicalCallId,
+                          }),
+                        timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners([
+                          owner,
+                        ]),
+                      },
+                    });
                   const result = await this.resolveToolCall(
                     toolId,
                     owner,
-                    execution?.result ?? null,
-                    execution?.metadata ?? null,
-                    execution?.jobId,
-                    execution?.meta,
-                    execution?.toolResponse,
+                    execution,
                   );
                   if (result != null) {
                     successfulLiveStepCallIds.add(owner.callId);
@@ -11245,8 +12489,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             await pendingReceiptHeartbeat.confirmOwned();
           }
           if (pendingRequests.length > 0) {
-            const strategy =
-              this.#options.getBatchOperationStrategy?.(toolId) ?? null;
+            const strategy = operationStrategy;
 
             if (strategy) {
               const compiledBatches = compileRequestsWithStrategy({
@@ -11306,70 +12549,74 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     });
                   let releaseToolSlot: () => void = () => undefined;
                   try {
-                    const execution = await this.callToolExecutionAPI(
-                      batch.batchOperation,
-                      batch.batchPayload,
-                      {
-                        durableCallReceiptKey: aggregateReceiptKey,
-                        // A native batch is one physical provider request for
-                        // many rows of the same column, so the batch's node scope
-                        // is its members' shared scope.
-                        playNodeScope: batch.memberRequests[0]
-                          ? playNodeScopeForToolCallRequest(
-                              batch.memberRequests[0],
-                              batch.batchOperation,
-                            )
-                          : null,
-                        executionAuthScopeDigest:
-                          batch.memberRequests[0]?.executionAuthScopeDigest ??
-                          null,
-                        providerIdempotencyReceiptKey:
+                    const execution =
+                      await this.executeMappedToolCallThroughModule({
+                        request: batch.memberRequests[0]!,
+                        dispatchToolId: batch.batchOperation,
+                        dispatchPayload: batch.batchPayload,
+                        resultReceiptKey: aggregateReceiptKey,
+                        providerOperationKey:
                           aggregateProviderIdempotencyReceiptKey,
-                        providerIdempotencyKey:
-                          buildDurableToolAggregateProviderIdempotencyKey({
-                            aggregateReceiptKey:
-                              aggregateProviderIdempotencyReceiptKey,
-                            receiptKeys: providerIdempotencyReceiptKeys,
-                            providerIdempotencyKeys: batch.memberRequests.map(
-                              (request) =>
-                                this.providerIdempotencyKeyForToolCall({
-                                  cacheKey:
-                                    request.providerIdempotencyKeyBase ??
-                                    request.cacheKey,
-                                  force: request.force === true,
-                                  leaseId: request.receiptLeaseId,
-                                }),
-                            ),
-                          }),
-                        receiptLeaseExpiresAt: batch.memberRequests.reduce<
-                          string | null
-                        >((earliest, request) => {
-                          const expiresAt =
-                            request.receiptLeaseExpiresAt ?? null;
-                          if (!expiresAt) return earliest;
-                          if (!earliest) return expiresAt;
-                          return Date.parse(expiresAt) < Date.parse(earliest)
-                            ? expiresAt
-                            : earliest;
-                        }, null),
-                        timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners(
-                          batch.memberRequests,
-                        ),
-                        beforeProviderCall: () =>
-                          pendingReceiptHeartbeat
-                            ? pendingReceiptHeartbeat.assertOwned()
-                            : this.assertRuntimeToolReceiptOwnership(
-                                batch.memberRequests,
+                        apiOptions: {
+                          durableCallReceiptKey: aggregateReceiptKey,
+                          // A native batch is one physical provider request for
+                          // many rows of the same column, so the batch's node scope
+                          // is its members' shared scope.
+                          playNodeScope: playNodeScopeForToolCallRequest(
+                            batch.memberRequests[0]!,
+                            batch.batchOperation,
+                          ),
+                          executionAuthScopeDigest:
+                            batch.memberRequests[0]?.executionAuthScopeDigest ??
+                            null,
+                          providerIdempotencyReceiptKey:
+                            aggregateProviderIdempotencyReceiptKey,
+                          providerIdempotencyKey:
+                            buildDurableToolAggregateProviderIdempotencyKey({
+                              aggregateReceiptKey:
+                                aggregateProviderIdempotencyReceiptKey,
+                              receiptKeys: providerIdempotencyReceiptKeys,
+                              providerIdempotencyKeys: batch.memberRequests.map(
+                                (request) =>
+                                  this.providerIdempotencyKeyForToolCall({
+                                    cacheKey:
+                                      request.providerIdempotencyKeyBase ??
+                                      request.cacheKey,
+                                    force: request.force === true,
+                                    leaseId: request.receiptLeaseId,
+                                    logicalCallId: request.logicalCallId,
+                                  }),
                               ),
-                        heartbeatReceipt: () =>
-                          this.renewRuntimeToolReceiptOwnership(
+                            }),
+                          receiptLeaseExpiresAt: batch.memberRequests.reduce<
+                            string | null
+                          >((earliest, request) => {
+                            const expiresAt =
+                              request.receiptLeaseExpiresAt ?? null;
+                            if (!expiresAt) return earliest;
+                            if (!earliest) return expiresAt;
+                            return Date.parse(expiresAt) < Date.parse(earliest)
+                              ? expiresAt
+                              : earliest;
+                          }, null),
+                          timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners(
                             batch.memberRequests,
                           ),
-                        retainToolSlot: (release) => {
-                          releaseToolSlot = release;
+                          beforeProviderCall: () =>
+                            pendingReceiptHeartbeat
+                              ? pendingReceiptHeartbeat.assertOwned()
+                              : this.assertRuntimeToolReceiptOwnership(
+                                  batch.memberRequests,
+                                ),
+                          heartbeatReceipt: () =>
+                            this.renewRuntimeToolReceiptOwnership(
+                              batch.memberRequests,
+                            ),
+                          retainToolSlot: (release) => {
+                            releaseToolSlot = release;
+                          },
                         },
-                      },
-                    );
+                      });
                     return { execution, releaseToolSlot };
                   } catch (error) {
                     releaseToolSlot();
@@ -11492,17 +12739,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               };
               const enqueueCompletion = (
                 request: ToolCallRequest,
-                execution: ParsedToolExecuteResponse,
+                execution: ToolExecuteResult,
               ): Promise<unknown> =>
                 new Promise((resolve, reject) => {
                   completionBuffer.push({
                     request,
-                    result: execution.result ?? null,
+                    result: execution,
                     status: execution.status,
-                    metadata: execution.metadata ?? null,
-                    jobId: execution.jobId,
-                    meta: execution.meta,
-                    toolResponse: execution.toolResponse,
                     resolve,
                     reject,
                   });
@@ -11548,47 +12791,62 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   }
                   let releaseToolSlot: () => void = () => undefined;
                   try {
-                    const execution = await this.callToolExecutionAPI(
-                      toolId,
-                      request.input,
-                      {
-                        beforeProviderCall: () =>
-                          pendingReceiptHeartbeat
-                            ? pendingReceiptHeartbeat.assertOwned()
-                            : this.assertRuntimeToolReceiptOwnership([request]),
-                        playNodeScope: playNodeScopeForToolCallRequest(request),
-                        ...(request.receiptKey
-                          ? {
-                              durableCallReceiptKey: request.receiptKey,
-                              executionAuthScopeDigest:
-                                request.executionAuthScopeDigest,
-                              providerIdempotencyReceiptKey:
-                                request.providerIdempotencyKeyBase ??
-                                request.receiptKey,
-                              providerIdempotencyKey:
-                                this.providerIdempotencyKeyForToolCall({
-                                  cacheKey:
-                                    request.providerIdempotencyKeyBase ??
-                                    request.receiptKey,
-                                  force: request.force === true,
-                                  leaseId: request.receiptLeaseId,
-                                }),
-                              receiptLeaseExpiresAt:
-                                request.receiptLeaseExpiresAt,
-                              heartbeatReceipt: () =>
-                                this.renewRuntimeToolReceiptOwnership([
+                    const execution =
+                      await this.executeMappedToolCallThroughModule({
+                        request,
+                        dispatchToolId: toolId,
+                        dispatchPayload: request.input,
+                        // Always-fresh map calls intentionally have no durable
+                        // receipt or provider idempotency header. Their cache
+                        // key is only a local ToolCall contract identity.
+                        resultReceiptKey:
+                          request.receiptKey ?? request.cacheKey,
+                        providerOperationKey:
+                          request.providerIdempotencyKeyBase ??
+                          request.receiptKey ??
+                          request.cacheKey,
+                        apiOptions: {
+                          beforeProviderCall: () =>
+                            pendingReceiptHeartbeat
+                              ? pendingReceiptHeartbeat.assertOwned()
+                              : this.assertRuntimeToolReceiptOwnership([
                                   request,
                                 ]),
-                            }
-                          : {}),
-                        timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners([
-                          request,
-                        ]),
-                        retainToolSlot: (release) => {
-                          releaseToolSlot = release;
+                          playNodeScope:
+                            playNodeScopeForToolCallRequest(request),
+                          ...(request.receiptKey
+                            ? {
+                                durableCallReceiptKey: request.receiptKey,
+                                executionAuthScopeDigest:
+                                  request.executionAuthScopeDigest,
+                                providerIdempotencyReceiptKey:
+                                  request.providerIdempotencyKeyBase ??
+                                  request.receiptKey,
+                                providerIdempotencyKey:
+                                  this.providerIdempotencyKeyForToolCall({
+                                    cacheKey:
+                                      request.providerIdempotencyKeyBase ??
+                                      request.receiptKey,
+                                    force: request.force === true,
+                                    leaseId: request.receiptLeaseId,
+                                    logicalCallId: request.logicalCallId,
+                                  }),
+                                receiptLeaseExpiresAt:
+                                  request.receiptLeaseExpiresAt,
+                                heartbeatReceipt: () =>
+                                  this.renewRuntimeToolReceiptOwnership([
+                                    request,
+                                  ]),
+                              }
+                            : {}),
+                          timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners([
+                            request,
+                          ]),
+                          retainToolSlot: (release) => {
+                            releaseToolSlot = release;
+                          },
                         },
-                      },
-                    );
+                      });
                     await enqueueCompletion(request, execution);
                   } finally {
                     releaseToolSlot();
@@ -11867,6 +13125,16 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const executionAuthScopeDigest = options?.executionAuthScopeDigest
             ? options.executionAuthScopeDigest.trim() || null
             : ((await this.resolveToolAuthScopeDigest(toolId))?.trim() ?? null);
+          const canonicalOperation = {
+            version: 1 as const,
+            tool_id: toolId,
+            action_version:
+              (
+                await this.#options.getToolActionCacheVersion?.(toolId)
+              )?.trim() || 'unversioned',
+            play_scope: this.currentGovernance.currentPlayId,
+            output_intent: 'dataset',
+          };
           const providerIdempotencyKey =
             options?.providerIdempotencyKey?.trim() || durableCallReceiptKey;
           const providerIdempotencyReceiptKey =
@@ -11891,6 +13159,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 ...(requestsDurableInvocationFence
                   ? { invocation_fence_version: 1 }
                   : {}),
+                // Canonical provider-operation receipts validate this semantic
+                // plan before replay. It is intentionally removed from the
+                // legacy byte-receipt fingerprint so mixed runner artifacts
+                // retain their existing provider-once behavior.
+                ...(requestsDurableInvocationFence
+                  ? { canonical_operation: canonicalOperation }
+                  : {}),
                 // This is deliberately the provider receipt, rather than the
                 // worker-owned response cache receipt. It keeps a newer
                 // worker wire-compatible with an already active Vercel app