deepline 0.3.473 → 0.3.475

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/modal.ts

@@ -18,10 +18,11 @@ import {
   PLAY_RUNNER_TERMINAL_GRACE_SECONDS,
 } from '../../runtime-constants';
 import {
-  MODAL_SANDBOX_CPU_CORES,
-  MODAL_SANDBOX_MEMORY_MIB,
+  modalSandboxResourcesForPlay,
   loadModalClientConfig,
   loadModalRequiredConfig,
+  resolveModalSandboxMemoryPolicy,
+  isModalPreviewEvaluation,
   withModalCallSignal,
 } from '../../modal-runtime-config';
 import type { PlaySandboxRuntimeLimits } from '../../../plays/sandbox-runtime-limits';
@@ -371,10 +372,33 @@ export const modalPlayRunnerBackend: PlayRunnerBackend = {
         runtimeSchedulerSchema: config.context.runtimeSchedulerSchema,
         limits: config.context.sandboxRuntimeLimits,
       });
+      const resources = modalSandboxResourcesForPlay(modalConfig.limits);
+      const memoryPolicy = resolveModalSandboxMemoryPolicy({
+        limits: modalConfig.limits,
+        runtimeSchedulerSchema: config.context.runtimeSchedulerSchema,
+      });
       const app = await modalConfig.client.apps.fromName(modalConfig.appName, {
         createIfMissing: true,
       });
-      const image = modalConfig.client.images.fromRegistry(modalConfig.image);
+      const baseImage = modalConfig.client.images.fromRegistry(
+        modalConfig.image,
+      );
+      // Modal caches this immutable layer by its build commands. Build before
+      // sandbox admission so a cold Python image owns no sandbox-capacity lease
+      // or ambiguous SandboxCreate intent. Production keeps its existing image.
+      const image = isModalPreviewEvaluation({
+        runtimeSchedulerSchema: config.context.runtimeSchedulerSchema,
+      })
+        ? await withModalCallSignal(
+            AbortSignal.timeout(MODAL_SANDBOX_CREATE_TIMEOUT_MS),
+            () =>
+              baseImage
+                .dockerfileCommands([
+                  'RUN apt-get update && apt-get install -y --no-install-recommends python3 python-is-python3 && rm -rf /var/lib/apt/lists/*',
+                ])
+                .build(app),
+          )
+        : baseImage;
       const capacityReservation =
         await callbacks?.reserveSandboxCapacity?.('modal');
       const createTags = {
@@ -428,10 +452,10 @@ export const modalPlayRunnerBackend: PlayRunnerBackend = {
         createSent = true;
         sandbox = await awaitModalSandboxCreate({
           create: modalConfig.client.sandboxes.create(app, image, {
-            cpu: MODAL_SANDBOX_CPU_CORES,
-            cpuLimit: MODAL_SANDBOX_CPU_CORES,
-            memoryMiB: MODAL_SANDBOX_MEMORY_MIB,
-            memoryLimitMiB: MODAL_SANDBOX_MEMORY_MIB,
+            cpu: resources.physicalCpuCores,
+            cpuLimit: resources.physicalCpuCores,
+            memoryMiB: memoryPolicy.reservationMemoryMiB,
+            memoryLimitMiB: memoryPolicy.memoryLimitMiB,
             timeoutMs: modalSandboxLifetimeMs(modalConfig.limits),
             idleTimeoutMs: modalSandboxLifetimeMs(modalConfig.limits),
             workdir: modalConfig.workdir,
@@ -473,8 +497,12 @@ export const modalPlayRunnerBackend: PlayRunnerBackend = {
                 maxBillingDurationSeconds:
                   modalConfig.limits.timeoutSeconds +
                   PLAY_RUNNER_TERMINAL_GRACE_SECONDS,
-                cpu: MODAL_SANDBOX_CPU_CORES,
-                memoryGiB: MODAL_SANDBOX_MEMORY_MIB / 1024,
+                cpu: resources.physicalCpuCores,
+                memoryGiB: modalConfig.limits.memoryGiB,
+                ...(memoryPolicy.memoryLimitMiB >
+                memoryPolicy.reservationMemoryMiB
+                  ? { memoryLimitGiB: memoryPolicy.memoryLimitMiB / 1024 }
+                  : {}),
                 diskGiB: 0,
                 ...(capacityReservation
                   ? { sandboxCapacityLeaseId: capacityReservation.leaseId }
@@ -587,8 +615,11 @@ export const modalPlayRunnerBackend: PlayRunnerBackend = {
             maxBillingDurationSeconds:
               modalConfig.limits.timeoutSeconds +
               PLAY_RUNNER_TERMINAL_GRACE_SECONDS,
-            cpu: MODAL_SANDBOX_CPU_CORES,
-            memoryGiB: MODAL_SANDBOX_MEMORY_MIB / 1024,
+            cpu: resources.physicalCpuCores,
+            memoryGiB: modalConfig.limits.memoryGiB,
+            ...(memoryPolicy.memoryLimitMiB > memoryPolicy.reservationMemoryMiB
+              ? { memoryLimitGiB: memoryPolicy.memoryLimitMiB / 1024 }
+              : {}),
             diskGiB: 0,
             ...(capacityReservation
               ? { sandboxCapacityLeaseId: capacityReservation.leaseId }
@@ -654,6 +685,9 @@ export const modalPlayRunnerBackend: PlayRunnerBackend = {
             },
             bundlePromise: buildPlayRunnerBundle(),
             config: withRunnerSandboxProvider(config, 'modal'),
+            ...(memoryPolicy.memoryLimitMiB > memoryPolicy.reservationMemoryMiB
+              ? { memoryLimitMiB: memoryPolicy.memoryLimitMiB }
+              : {}),
             workDir: modalConfig.workdir,
             startedAt,
             emitStage: (stage, extra) =>
@@ -972,9 +1006,7 @@ export async function inspectDetachedModalRunner(input: {
   const deadline = new AbortController();
   const timer = setTimeout(() => {
     deadline.abort(
-      new Error(
-        `Modal detached-runner inspection exceeded ${timeoutMs}ms.`,
-      ),
+      new Error(`Modal detached-runner inspection exceeded ${timeoutMs}ms.`),
     );
   }, timeoutMs);
   try {

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/types.ts

@@ -41,6 +41,8 @@ export type PlayRunnerRuntimeResource = {
   terminalAt?: number | null;
   cpu?: number | null;
   memoryGiB?: number | null;
+  /** Optional Modal burst ceiling; absence retains the fixed reservation. */
+  memoryLimitGiB?: number | null;
   diskGiB?: number | null;
   /** Scheduler-only soft-capacity reservation made before provider create. */
   sandboxCapacityLeaseId?: string;

package/dist/bundling-sources/shared_libs/play-runtime/runtime-incident-drills.ts

@@ -362,16 +362,20 @@ export const RUNTIME_INCIDENT_DRILL_CATALOG: readonly RuntimeIncidentDrill[] = [
     topologies: LOCAL_AND_PREVIEW_TOPOLOGIES,
     control: {
       kind: 'runtime_test_fault',
-      // The 120-second lease plus 80 seconds of confirmation puts the first
-      // provider read at about 200 seconds. The rest absorbs late wakes, so
-      // that read lands inside the silence and not after it.
-      defaultValue: 300_000,
+      // The 120-second lease plus 80 seconds of on-time confirmation is the
+      // earliest provider read. Preview woke late enough to exhaust 300
+      // seconds of silence before that read. Keep the synthetic runner quiet
+      // for seven minutes without changing the worker's liveness policy.
+      defaultValue: 420_000,
       valueMeaning: 'milliseconds',
     },
     expected: {
       outcome:
         'The worker asks the provider once the lease and confirmation pass, the sandbox is not proven gone, and the same attempt finishes after heartbeats return.',
-      safetyFacts: ['same_logical_run', 'no_loss_verdict_without_provider_proof'],
+      safetyFacts: [
+        'same_logical_run',
+        'no_loss_verdict_without_provider_proof',
+      ],
     },
     verification: {
       kind: 'preview_black_box',

package/dist/bundling-sources/shared_libs/play-runtime/sandbox-compute-usage.ts

@@ -23,6 +23,7 @@ export function resolveRuntimeSandboxComputeItems(input: {
       endedAt: number | null;
       physicalCpuCores: number | null;
       memoryGiB: number | null;
+      memoryLimitGiB: number | null;
       maxBillingDurationSeconds: number | null;
     }
   >();
@@ -52,6 +53,10 @@ export function resolveRuntimeSandboxComputeItems(input: {
         finiteNonNegative(value.cpu) ?? existing?.physicalCpuCores ?? null,
       memoryGiB:
         finiteNonNegative(value.memoryGiB) ?? existing?.memoryGiB ?? null,
+      memoryLimitGiB:
+        finiteNonNegative(value.memoryLimitGiB) ??
+        existing?.memoryLimitGiB ??
+        null,
       maxBillingDurationSeconds:
         finiteNonNegative(value.maxBillingDurationSeconds) ??
         existing?.maxBillingDurationSeconds ??
@@ -77,6 +82,9 @@ export function resolveRuntimeSandboxComputeItems(input: {
         wallTimeSeconds: Math.max(0, endedAt - resource.startedAt) / 1_000,
         physicalCpuCores: resource.physicalCpuCores ?? 0.5,
         memoryGiB: resource.memoryGiB ?? 1,
+        ...(resource.memoryLimitGiB === null
+          ? {}
+          : { memoryLimitGiB: resource.memoryLimitGiB }),
         sandboxId,
         startedAt: resource.startedAt,
         endedAt,

package/dist/bundling-sources/shared_libs/play-runtime/sandbox-runs/contract.ts

@@ -204,6 +204,8 @@ export type SandboxExecutionResource = SandboxRunResource & {
   billingEndedAtMs?: number | null;
   cpu?: number | null;
   memoryGiB?: number | null;
+  /** Optional provider burst ceiling, distinct from the reserved memory. */
+  memoryLimitGiB?: number | null;
   diskGiB?: number | null;
   /** A create settled after the launching attempt had already timed out. */
   lateAcquired?: boolean;

package/dist/bundling-sources/shared_libs/play-runtime/sandbox-runs/runner-backend-adapter.ts

@@ -254,6 +254,7 @@ function toSandboxResource(
     maxBillingDurationSeconds: resource.maxBillingDurationSeconds ?? null,
     cpu: resource.cpu ?? null,
     memoryGiB: resource.memoryGiB ?? null,
+    memoryLimitGiB: resource.memoryLimitGiB ?? null,
     diskGiB: resource.diskGiB ?? null,
     // Historical Daytona facts use `daytonaEnvironment`; normalize it at the
     // portable boundary so the cleanup job stays in the resource's actual
@@ -295,6 +296,7 @@ export function playRunnerRuntimeResourceFromSandboxExecutionResource(
     maxBillingDurationSeconds: resource.maxBillingDurationSeconds ?? null,
     cpu: resource.cpu ?? null,
     memoryGiB: resource.memoryGiB ?? null,
+    memoryLimitGiB: resource.memoryLimitGiB ?? null,
     diskGiB: resource.diskGiB ?? null,
     ...(resource.capacityLeaseId
       ? { sandboxCapacityLeaseId: resource.capacityLeaseId }

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres-rate-scope.ts

@@ -78,29 +78,51 @@ export function acquireRateScopeSql(
   const observationWasIdle = `${successesParameter}::int = 0
     AND nv.now_ms - GREATEST(h.refilled_at_ms, h.next_dispatch_at_ms, h.retry_at_ms, h.cool_until_ms)
       > GREATEST(1000, 2000.0 / ${refillRate})`;
-  // A denied refill may fold a completion before the next floor interval is
-  // due. Keep that fresh completion available for one later ramp rather than
-  // requiring another provider call at the old pace. Its baseline advances on
-  // every floor ramp, so time alone cannot reuse it for another increase.
-  const recoverySuccess =
-    unknownProvider && probeBaselineSupported
-      ? `(${successesParameter}::int > 0 OR (
+  // A denied refill may fold a completion before the next recovery interval.
+  // Keep it available for one later ramp rather than requiring another call at
+  // the old pace. The baseline consumes it once. Unknown-provider upward probes
+  // above useful seed capacity retain their separate observation policy.
+  const recoverySuccess = probeBaselineSupported
+    ? `(${successesParameter}::int > 0 OR (
           h.seen_backpressure
-          AND ${refillRate} < ${DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS}
+          AND (${!unknownProvider} OR ${refillRate} < ${DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS})
           AND h.rate_probe_started_at_ms >= h.last_ramp_at_ms
           AND h.rate_probe_started_at_ms >= h.rate_observation_started_at_ms
           AND h.rate_successes > h.rate_probe_successes_at_ramp
           AND NOT (${observationWasIdle})
         ))`
-      : `${successesParameter}::int > 0`;
+    : `${successesParameter}::int > 0`;
+  // Known-provider feedback can arrive before its recovery interval. Wake at
+  // that opportunity instead of sleeping an entire old, slow token interval;
+  // the baseline below consumes each confirmed success for at most one ramp.
+  const pendingRecoveryWaitMs =
+    !unknownProvider && probeBaselineSupported
+      ? `CASE WHEN ${recoverySuccess}
+          AND h.seen_backpressure
+          AND h.rate_observation_started_at_ms IS NOT NULL
+          AND GREATEST(h.retry_at_ms, h.cool_until_ms) <= nv.now_ms
+          AND nv.now_ms < h.last_ramp_at_ms + ${backpressuredRecoveryInterval}
+        THEN h.last_ramp_at_ms + ${backpressuredRecoveryInterval} - nv.now_ms
+        ELSE NULL END`
+      : 'NULL::bigint';
+  // A provider's elapsed hold authorizes one shared recovery probe. Requiring
+  // a whole token at the newly learned rate would add another wait when the
+  // measured quota cycle is longer than Retry-After itself. The first grant
+  // starts an observation epoch, so competing callers cannot reuse this floor.
+  const postHoldProbeDue = `h.seen_backpressure
+    AND h.rate_observation_started_at_ms IS NULL
+    AND h.retry_at_ms > 0
+    AND GREATEST(h.retry_at_ms, h.cool_until_ms) <= nv.now_ms`;
   return `provider_hold_rows AS (
     SELECT * FROM ${table} WHERE bucket_id = $1 FOR UPDATE
   ), provider_hold AS (
     SELECT h.*,
-      LEAST(
+      ${postHoldProbeDue} AS post_hold_probe_due,
+      ${pendingRecoveryWaitMs} AS pending_recovery_wait_ms,
+      GREATEST(CASE WHEN ${postHoldProbeDue} THEN 1.0 ELSE 0.0 END, LEAST(
         GREATEST(CASE WHEN h.seen_backpressure THEN 1 ELSE h.capacity END, ${refillRate}),
         h.tokens + GREATEST(0, nv.now_ms - h.refilled_at_ms) * ${refillRate} / 1000.0
-      ) AS tokens_after_refill,
+      )) AS tokens_after_refill,
       ${observationWasIdle} AS observation_was_idle,
       CASE WHEN ${recoverySuccess}
           AND h.rate_observation_started_at_ms IS NOT NULL
@@ -140,7 +162,9 @@ export function updateRateScopeSql(
   const floorRampedObservation = `${unknownProvider} AND ph.seen_backpressure
     AND ph.refill_per_sec < ${DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS}
     AND ph.next_refill_per_sec > ph.refill_per_sec`;
-  const idleFloorObservation = `ph.observation_was_idle
+  const knownRampedObservation = `${!unknownProvider} AND ph.seen_backpressure
+    AND ph.next_refill_per_sec > ph.refill_per_sec`;
+  const idleFloorObservation = `${unknownProvider} AND ph.observation_was_idle
     AND ph.refill_per_sec < ${DEFAULT_UNKNOWN_PROVIDER_FAST_RECOVERY_RPS}`;
   const rebaseProbe =
     'ph.rate_probe_started_at_ms < ph.last_ramp_at_ms OR ph.rate_probe_started_at_ms < COALESCE(ph.rate_observation_started_at_ms, 0) OR ph.rate_probe_successes_at_ramp > ph.rate_successes';
@@ -163,16 +187,16 @@ export function updateRateScopeSql(
         WHEN (SELECT granted FROM grant_calc) > 0 AND ph.observation_was_idle THEN 0
         ELSE ph.rate_successes END,
       ${
-        unknownProvider && probeBaselineSupported
+        probeBaselineSupported
           ? `rate_probe_successes_at_ramp = CASE
         WHEN ${recoveredObservation} THEN 0
         WHEN (SELECT granted FROM grant_calc) > 0
           AND (ph.rate_observation_started_at_ms IS NULL OR ph.observation_was_idle) THEN 0
           WHEN ${idleFloorObservation} THEN ph.rate_successes
-          WHEN ${floorRampedObservation} OR ${probedObservation} OR (${rebaseProbe}) THEN ph.rate_successes
+          WHEN ${knownRampedObservation} OR ${floorRampedObservation} OR ${probedObservation} OR (${rebaseProbe}) THEN ph.rate_successes
           ELSE ph.rate_probe_successes_at_ramp END,
       rate_probe_started_at_ms = CASE
-        WHEN ${idleFloorObservation} OR ${recoveredObservation} OR ${floorRampedObservation} OR ${probedObservation} OR (${rebaseProbe}) THEN nv.now_ms
+        WHEN ${knownRampedObservation} OR ${idleFloorObservation} OR ${recoveredObservation} OR ${floorRampedObservation} OR ${probedObservation} OR (${rebaseProbe}) THEN nv.now_ms
         WHEN (SELECT granted FROM grant_calc) > 0
           AND (ph.rate_observation_started_at_ms IS NULL OR ph.observation_was_idle) THEN nv.now_ms
         ELSE ph.rate_probe_started_at_ms END,`

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres-rate-state.ts

@@ -1444,7 +1444,12 @@ async function acquirePureRate(
           LEAST(
             ${effectiveCapacitySql('normalized', 'refill_per_sec', unknownProvider)},
             ph.tokens_after_refill,
-            LEAST(b.tokens, sc.capacity)
+            GREATEST(CASE WHEN ph.post_hold_probe_due
+              AND LEAST(b.tokens, sc.capacity)
+                + GREATEST(0, nv.now_ms - b.refilled_at_ms) / 1000.0
+                  * CASE WHEN sc.adaptive_max_configured
+                    THEN sc.max_rps ELSE b.max_rps END >= 1
+              THEN 1.0 ELSE 0.0 END, LEAST(b.tokens, sc.capacity)
               + GREATEST(0, nv.now_ms - b.refilled_at_ms) / 1000.0
                 * LEAST(
                     CASE
@@ -1452,7 +1457,7 @@ async function acquirePureRate(
                       ELSE b.max_rps
                     END,
                     GREATEST(sc.min_rps, ph.refill_per_sec)
-                  )
+                  ))
           ) AS tokens_after_refill
         FROM ${bucketTableName(input)} b
         JOIN seed_config sc ON sc.rule_id = b.rule_id
@@ -1683,7 +1688,7 @@ async function acquirePureRate(
               (SELECT cool_until_ms FROM cooling),
               (SELECT retry_at_ms FROM cooling)
             ) - (SELECT now_ms FROM refreshed LIMIT 1)${fair?.waitBranch ?? ''}
-          ELSE (
+          ELSE LEAST((SELECT pending_recovery_wait_ms FROM provider_hold), (
             SELECT CEIL(
               MAX(
                 (
@@ -1699,7 +1704,7 @@ async function acquirePureRate(
               )
             )::bigint
             FROM updated
-          )
+          ))
         END AS wait_ms
     `,
     [
@@ -1964,7 +1969,12 @@ async function grantWithConcurrency(
           LEAST(
             ${effectiveCapacitySql('normalized', 'refill_per_sec', unknownProvider)},
             ph.tokens_after_refill,
-            LEAST(b.tokens, sc.capacity)
+            GREATEST(CASE WHEN ph.post_hold_probe_due
+              AND LEAST(b.tokens, sc.capacity)
+                + GREATEST(0, nv.now_ms - b.refilled_at_ms) / 1000.0
+                  * CASE WHEN sc.adaptive_max_configured
+                    THEN sc.max_rps ELSE b.max_rps END >= 1
+              THEN 1.0 ELSE 0.0 END, LEAST(b.tokens, sc.capacity)
               + GREATEST(0, nv.now_ms - b.refilled_at_ms) / 1000.0
                 * LEAST(
                     CASE
@@ -1972,7 +1982,7 @@ async function grantWithConcurrency(
                       ELSE b.max_rps
                     END,
                     GREATEST(sc.min_rps, ph.refill_per_sec)
-                  )
+                  ))
           ) AS tokens_after_refill
         FROM ${bucketTableName(input)} b
         JOIN seed_config sc ON sc.rule_id = b.rule_id
@@ -2306,7 +2316,7 @@ async function grantWithConcurrency(
               (SELECT retry_at_ms FROM cooling)
             ) - (SELECT now_ms FROM refreshed LIMIT 1)${fair?.waitBranch ?? ''}
           WHEN (SELECT free FROM free_slots) <= 0 THEN $7::bigint
-          ELSE (
+          ELSE LEAST((SELECT pending_recovery_wait_ms FROM provider_hold), (
             SELECT CEIL(
               MAX(
                 (
@@ -2323,7 +2333,7 @@ async function grantWithConcurrency(
               )
             )::bigint
             FROM updated
-          )
+          ))
         END AS wait_ms
     `,
     [

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -16389,7 +16389,6 @@ export async function executePostgresSchedulerClaim(
   execute: PostgresSchedulerAttemptExecutor,
   options: PostgresSchedulerClaimExecutionOptions = {},
 ): Promise<PostgresSchedulerWorkerOnceResult> {
-  let runtimeResources: unknown[] = [];
   let runnerFailureResult: Extract<
     PlayRunnerResult,
     { status: 'failed' }
@@ -16445,11 +16444,6 @@ export async function executePostgresSchedulerClaim(
       },
       options,
     );
-    runtimeResources = await readPostgresSchedulerRuntimeResourcesForRun(
-      client,
-      { runId: claim.runId },
-      options,
-    );
     // A PlayRunnerResult envelope ({status, output, logs, steps, ...}) is the
     // executor's transport shape; the run's terminal result — what the ledger
     // run.completed event and `runs get` expose — is the play's own output.
@@ -16587,31 +16581,9 @@ export async function executePostgresSchedulerClaim(
         `Postgres scheduler worker failed after losing lease for ${claim.runId}/${claim.attempt}: ${message}`,
       );
     }
-    if (runtimeResources.length === 0) {
-      await settlePostgresSchedulerRuntimeResources(
-        client,
-        {
-          runId: claim.runId,
-          billingEndedAt: runnerTerminalReceivedAtMs ?? Date.now(),
-          terminalReason,
-        },
-        options,
-      ).catch((settlementError) => {
-        console.warn('[postgres-scheduler.resource_settlement_failed]', {
-          runId: claim.runId,
-          terminalReason,
-          error:
-            settlementError instanceof Error
-              ? settlementError.message
-              : String(settlementError),
-        });
-      });
-      runtimeResources = await readPostgresSchedulerRuntimeResourcesForRun(
-        client,
-        { runId: claim.runId },
-        options,
-      ).catch(() => []);
-    }
+    // The failure statement already stamps every sandbox and persists its
+    // cleanup/billing obligations. Return to terminal projection without
+    // reacquiring custody locks or reading resources that this caller never uses.
     return {
       status: 'failed',
       runId: claim.runId,
@@ -19477,6 +19449,27 @@ export async function readPostgresSchedulerTerminalArrayInputIntent(
   return readTerminalArrayInputIntentForScope(client, input, options);
 }
 
+/**
+ * Prove delivery before exposing the same run's terminal cleanup intent.
+ * Fold the optional-column probe into that proof, preserving old schemas
+ * without another round trip or copying the wide run tuple to JSON.
+ */
+export async function assertPostgresRunLedgerDeliveryAndReadTerminalArrayInputIntent(
+  client: PostgresSchedulerQueryClient,
+  input: Parameters<typeof assertPostgresRunLedgerDelivery>[1],
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<{ playName: string | null; started: boolean }> {
+  const markerPresent = await provePostgresRunLedgerDelivery(
+    client,
+    input,
+    options,
+    true,
+  );
+  return markerPresent
+    ? readTerminalArrayInputIntentRow(client, input, options)
+    : { playName: null, started: false };
+}
+
 /** Internal dispatch already owns the run's outbox lease; receiver reads also bind its org. */
 async function readTerminalArrayInputIntentForScope(
   client: PostgresSchedulerQueryClient,
@@ -19499,6 +19492,14 @@ async function readTerminalArrayInputIntentForScope(
   if (column.rows[0]?.present !== true) {
     return { playName: null, started: false };
   }
+  return readTerminalArrayInputIntentRow(client, input, options);
+}
+
+async function readTerminalArrayInputIntentRow(
+  client: PostgresSchedulerQueryClient,
+  input: { orgId?: string; runId: string },
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<{ playName: string | null; started: boolean }> {
   const run = await client.query<{
     array_input_started: boolean;
     play_name: string;
@@ -19529,6 +19530,15 @@ export async function assertPostgresRunLedgerDelivery(
   },
   options?: Pick<PostgresSchedulerOptions, 'schema'>,
 ): Promise<void> {
+  await provePostgresRunLedgerDelivery(client, input, options);
+}
+
+async function provePostgresRunLedgerDelivery(
+  client: PostgresSchedulerQueryClient,
+  input: Parameters<typeof assertPostgresRunLedgerDelivery>[1],
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+  readArrayInputMarker = false,
+): Promise<boolean> {
   const result = await client.query<{
     delivery_key: string;
     event_type: string;
@@ -19539,6 +19549,7 @@ export async function assertPostgresRunLedgerDelivery(
     blocked: boolean;
     payload_json: unknown;
     created_at: Date;
+    array_input_marker_present?: boolean;
   }>(
     `
     SELECT outbox.delivery_key,
@@ -19551,6 +19562,16 @@ export async function assertPostgresRunLedgerDelivery(
            outbox.failed_at IS NOT NULL AS blocked,
            outbox.payload_json,
            outbox.created_at
+           ${
+             readArrayInputMarker
+               ? `, EXISTS (
+                   SELECT 1 FROM pg_attribute
+                   WHERE attrelid = to_regclass($3)
+                     AND attname = 'array_input_started'
+                     AND NOT attisdropped
+                 ) AS array_input_marker_present`
+               : ''
+           }
     FROM ${tableName('outbox', options)} AS outbox
     JOIN ${tableName('runs', options)} AS runs ON runs.run_id = outbox.run_id
     WHERE outbox.run_id = $1 AND runs.org_id = $2
@@ -19562,7 +19583,9 @@ export async function assertPostgresRunLedgerDelivery(
     -- their own delivery without changing the drain's convergence behavior.
     LIMIT ${RUN_LEDGER_PROJECTION_PREFIX_MAX_FACTS}
   `,
-    [input.runId, input.orgId],
+    readArrayInputMarker
+      ? [input.runId, input.orgId, tableName('runs', options)]
+      : [input.runId, input.orgId],
   );
   const rows = result.rows;
   const leaseOwner = input.leaseOwner?.trim() || rows[0]?.lease_owner;
@@ -19656,7 +19679,8 @@ export async function assertPostgresRunLedgerDelivery(
         input.idempotencyKey === batchKey ||
         legacySingletonKey)
     ) {
-      if (input.projectedEvents === undefined) return;
+      if (input.projectedEvents === undefined)
+        return rows[0]?.array_input_marker_present === true;
       const prefixEvents: PlayRunLedgerIngressEvent[] = [];
       for (const prefixRow of prefix) {
         prefixEvents.push(
@@ -19696,7 +19720,8 @@ export async function assertPostgresRunLedgerDelivery(
         expectedEventCandidates: expectedProjectionCandidates,
         ...(input.projectionChunk ? { chunk: input.projectionChunk } : {}),
       });
-      if (projectionMismatch === null) return;
+      if (projectionMismatch === null)
+        return rows[0]?.array_input_marker_present === true;
       throw new RunLedgerProjectionLeaseLostError(
         'projected_events_mismatch',
         projectionMismatch,
@@ -24428,7 +24453,11 @@ async function acknowledgeRunLedgerPrefixWithContinuation(
           waitForRunLock: true,
         },
         options,
-        { eventIds, targetEventId },
+        {
+          eventIds,
+          targetEventId,
+          createdProjectionWake: input.createdProjectionWake,
+        },
       );
       if (fast !== null) {
         let continuation: RunLedgerOutboxDrainScope | null = null;

package/dist/bundling-sources/shared_libs/play-runtime/worker-api-types.ts

@@ -1,6 +1,7 @@
 import type { PlayDocflowNodeIoState } from './docflow-node-io';
 import type { PlayMapRowActivitySource } from './run-ledger';
 import type { PlayConditionCounts } from './cell-provenance';
+import { PLAY_SANDBOX_SIZE_LIMITS } from '../plays/sandbox-runtime-limits';
 
 export type PlayStagedFileRef = {
   storageKind: 'r2';
@@ -69,6 +70,17 @@ export const MODAL_SANDBOX_COMPUTE_PRICING_USD = {
 // Convex billing can use it without importing Modal's Node runtime config.
 export const MODAL_SANDBOX_CPU_CORES = 0.5;
 
+/** Scale Modal's physical-core request from Deepline's standard one-vCPU unit. */
+export function modalSandboxResourcesForPlay(input: {
+  cpu: number;
+  memoryGiB: number;
+}) {
+  return {
+    physicalCpuCores: MODAL_SANDBOX_CPU_CORES * input.cpu,
+    memoryMiB: input.memoryGiB * 1024,
+  };
+}
+
 const NEON_COMPUTE_PRICING_USD = {
   cuHour: 0.106,
   defaultCu: 1,
@@ -78,6 +90,14 @@ function roundUsd(amount: number): number {
   return Number(Math.max(0, amount).toFixed(12));
 }
 
+/** Portable billing identity derived from the resources actually acquired. */
+function sandboxSizeMetadata(cpu: number, memoryGiB: number) {
+  const entry = Object.entries(PLAY_SANDBOX_SIZE_LIMITS).find(
+    ([, limits]) => limits.cpu === cpu && limits.memoryGiB === memoryGiB,
+  );
+  return entry ? { sandboxSize: entry[0] } : {};
+}
+
 export function resolveDaytonaSandboxComputeItem(input: {
   itemId: string;
   source?: string;
@@ -110,6 +130,7 @@ export function resolveDaytonaSandboxComputeItem(input: {
     units: billableSeconds,
     providerCostUsd,
     metadata: {
+      ...sandboxSizeMetadata(cpu, memoryGiB),
       sandboxId: input.sandboxId ?? null,
       cpu,
       memoryGiB,
@@ -126,6 +147,8 @@ export function resolveModalSandboxComputeItem(input: {
   wallTimeSeconds: number;
   physicalCpuCores: number;
   memoryGiB: number;
+  /** Bounded burst allocation; absent on fixed-resource historical items. */
+  memoryLimitGiB?: number;
   sandboxId?: string | null;
   startedAt?: number;
   endedAt?: number;
@@ -145,9 +168,22 @@ export function resolveModalSandboxComputeItem(input: {
     units: billableSeconds,
     providerCostUsd,
     metadata: {
+      ...sandboxSizeMetadata(
+        physicalCpuCores / MODAL_SANDBOX_CPU_CORES,
+        memoryGiB,
+      ),
       sandboxId: input.sandboxId ?? null,
       physicalCpuCores,
       memoryGiB,
+      ...(input.memoryLimitGiB === undefined
+        ? {}
+        : {
+            memoryLimitGiB: input.memoryLimitGiB,
+            // The Preview evaluation preserves the existing compute price.
+            // Sampled burst cost is diagnostic until provider billing can be
+            // reconciled; a hard ceiling is never presented as actual usage.
+            costBasis: 'reserved_resources',
+          }),
       startedAt: input.startedAt,
       endedAt: input.endedAt,
     },