deepline 0.3.49 → 0.3.51

package/dist/bundling-sources/sdk/src/index.ts

@@ -56,6 +56,7 @@
 
 // ——— Client ———
 export { DeeplineClient } from './client.js';
+export { CtxFetchHttpError } from './play.js';
 export { RunObserveTransportUnavailableError } from './runs/observe-transport.js';
 export type {
   BillingCreditPool,

package/dist/bundling-sources/sdk/src/play.ts

@@ -80,6 +80,7 @@ import {
 } from '../../shared_libs/play-runtime/tool-result.js';
 export { readValue, readList } from '../../shared_libs/play-runtime/tool-result.js';
 import { createDeferredPlayDataset } from '../../shared_libs/plays/dataset.js';
+export { CtxFetchHttpError } from '../../shared_libs/plays/authoring-contract.js';
 import {
   QUERY_RESULT_DATASET_PAGE_SIZE,
   isCustomerDbDatasetTool,

package/dist/bundling-sources/sdk/src/release.ts

@@ -199,7 +199,7 @@ export const SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: '0.3.49',
+  version: '0.3.51',
   updateSummary:
     'Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.',
   packageCapabilities: {

package/dist/bundling-sources/sdk/src/types.ts

@@ -657,6 +657,8 @@ export interface PlayRunPackage {
     playName: string;
     status: string;
     dashboardUrl?: string;
+    /** Durable acceptance time: the run record was created. */
+    acceptedAt?: number | null;
     updatedAt?: number | null;
     startedAt?: number | null;
     finishedAt?: number | null;

package/dist/bundling-sources/shared_libs/play-runtime/app-runtime-api.ts

@@ -652,6 +652,7 @@ function isRetryableAppRuntimeAction(
     action === 'create_signed_staged_file_url' ||
     action === 'get_runtime_step_receipt' ||
     action === 'get_runtime_step_receipts' ||
+    action === 'governor_budget_charge' ||
     action === 'heartbeat_runtime_step_receipts' ||
     action === 'claim_runtime_step_receipt' ||
     action === 'claim_runtime_step_receipts' ||

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -178,6 +178,7 @@ import {
   resolveDurableCallCachePolicy,
 } from './durable-call-cache';
 import {
+  CtxFetchHttpError,
   PLAY_AUTHORING_CONTRACT_EDITION,
   normalizePlayAuthoringCustomerDbStatement,
   validateOptionalPlayAuthoringField,
@@ -287,6 +288,7 @@ import {
   isSecretAuthInput,
   isPlaintextSecretPromise,
   isSecretHandle,
+  isSecretValue,
   secretAuthEntries,
   secretAuthHeaderMarkers,
   valueContainsSecret,
@@ -2040,8 +2042,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   #options: ContextOptions;
   private readonly executionScope: RunExecutionScope;
   private logBuffer: string[] = [];
-  private fixtureProviderPacingBypassLogged = false;
-  private fixtureProviderPacingEnforcementLogged = false;
   private checkpoint: PlayCheckpoint;
   private readonly durableCallCacheEpochMs: number;
   /**
@@ -2866,7 +2866,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       this.secretRedactor.register(value);
       return value;
     }
-    return this.resolveSecretValue(secret as SecretValue);
+    if (isSecretHandle(secret) || isSecretValue(secret)) {
+      return this.resolveSecretValue(secret);
+    }
+    throw new Error(
+      'ctx.secrets auth requires a resolved string or an approved secret value.',
+    );
   }
 
   private async resolveSecretValue(secret: SecretValue): Promise<string> {
@@ -4253,6 +4258,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       ) => T;
       onClaimedResult?: (output: T, receiptKey: string) => T;
       shouldPersistFailure?: (error: unknown) => boolean;
+      transient?: boolean;
       markRunningBeforeExecute?: boolean;
       requiresExecutionLock?: boolean;
       executionLockTtlMs?: number;
@@ -4262,6 +4268,28 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       }) => Promise<T>;
     },
   ): Promise<T> {
+    let releaseExternalCallSlot: (() => void) | null = null;
+    const execute = async (leaseId: string | null): Promise<T> =>
+      await opts.execute({
+        leaseId,
+        retainExternalCallSlot: (release) => {
+          if (releaseExternalCallSlot) {
+            release();
+            throw new Error(
+              `ctx.${operation}(${id}) attempted to retain more than one external-call slot.`,
+            );
+          }
+          releaseExternalCallSlot = release;
+        },
+      });
+    if (opts.transient === true) {
+      try {
+        return await execute(null);
+      } finally {
+        const release = releaseExternalCallSlot as (() => void) | null;
+        release?.();
+      }
+    }
     const stalePolicy = resolveDurableCallCachePolicy(
       opts.staleAfterSeconds,
       operation === 'step'
@@ -4281,7 +4309,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         staleAfterSeconds: stalePolicy.staleAfterSeconds,
         cacheEpochMs: this.durableCallCacheEpochMs,
       });
-    let releaseExternalCallSlot: (() => void) | null = null;
     try {
       return await executeWithDurableRuntimeReceipt<T>({
         operation,
@@ -4309,19 +4336,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         toolErrorSchemaVersion: this.currentToolErrorSchemaVersion,
         formatError: (error) => this.formatRuntimeError(error),
         log: (message) => this.log(message),
-        execute: ({ leaseId }) =>
-          opts.execute({
-            leaseId,
-            retainExternalCallSlot: (release) => {
-              if (releaseExternalCallSlot) {
-                release();
-                throw new Error(
-                  `ctx.${operation}(${id}) attempted to retain more than one external-call slot.`,
-                );
-              }
-              releaseExternalCallSlot = release;
-            },
-          }),
+        execute: ({ leaseId }) => execute(leaseId),
       });
     } finally {
       const release = releaseExternalCallSlot as (() => void) | null;
@@ -8698,13 +8713,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     }
   }
 
-  private fixtureProviderPacingDisabled(): boolean {
-    return (
-      this.#options.integrationMode === 'fixture' &&
-      this.#options.enforceFixtureProviderPacing !== true
-    );
-  }
-
   private toolDispatchLane(request: ToolCallRequest): {
     key: string;
     readyCount: number;
@@ -10215,9 +10223,31 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               ...secretHeaderMarkers,
             },
             row: rowFetchScope,
+            // Edition 5 changes non-2xx responses from cached values to
+            // non-cacheable errors. Partition those receipts from editions
+            // 1–4 so a republished artifact makes a fresh request instead of
+            // inheriting a legacy error record.
+            ...(this.currentAuthoringContractEdition >= 5
+              ? {
+                  authoringContractEdition:
+                    this.currentAuthoringContractEdition,
+                }
+              : {}),
           }),
         ),
         staleAfterSeconds: options?.staleAfterSeconds,
+        transient: options?.transient === true,
+        onRecovered: (output) => {
+          if (!output.ok && this.currentAuthoringContractEdition >= 5) {
+            throw new CtxFetchHttpError(output);
+          }
+          return output;
+        },
+        shouldPersistFailure: (error) =>
+          !(
+            error instanceof CtxFetchHttpError &&
+            this.currentAuthoringContractEdition >= 5
+          ),
         execute: async ({ retainExternalCallSlot }) => {
           const method = (init.method ?? 'GET').toUpperCase();
           const secretHeaders = await this.resolveSecretAuth(secretAuth);
@@ -10225,6 +10255,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             ...normalizeFetchHeaders(init.headers),
             ...secretHeaders,
           };
+          if (headers['user-agent'] === undefined) {
+            headers['user-agent'] = 'Deepline Play Runtime';
+          }
           const fetchInit = { ...init, headers };
           delete fetchInit.auth;
           const boundaryId = this.durableBoundaryId(
@@ -10243,7 +10276,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           );
 
           const existing = this.checkpoint.resolvedBoundaries?.[boundaryId];
-          if (existing?.kind === 'fetch' && 'output' in existing) {
+          // A transient request deliberately has no durable recovery path, so
+          // its response stays in the running Play rather than a checkpoint.
+          if (
+            options?.transient !== true &&
+            existing?.kind === 'fetch' &&
+            'output' in existing
+          ) {
             this.log(`ctx.fetch(${url}): recovered response from checkpoint`);
             if (this.durableDirectToolResultsBackedByReceipts) {
               // The outer durable receipt is the replay authority in hosted
@@ -10324,6 +10363,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                       fetchImpl: this.#options.fetchImpl,
                       sensitiveHeaders: Object.keys(secretHeaderMarkers),
                       stripHeadersOnCrossOriginRedirect: true,
+                      headersOnCrossOriginRedirect: {
+                        'user-agent': 'Deepline Play Runtime',
+                      },
                     }),
                 });
                 bodyText = await readCtxFetchBody({
@@ -10375,6 +10417,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 `ctx.fetch(${method} ${url}) failed while reading the response body.`,
               );
             }
+            const rawJson = parseJsonOrNull(bodyText);
             const redactedBodyText = this.secretRedactor.redactString(bodyText);
             const output: PlayFetchResponse = {
               ok: response.ok,
@@ -10385,12 +10428,21 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 Object.fromEntries(response.headers.entries()),
               ) as Record<string, string>,
               bodyText: redactedBodyText,
-              json: this.secretRedactor.redactKnownSecrets(
-                parseJsonOrNull(bodyText),
-              ),
+              json: this.secretRedactor.redactKnownSecrets(rawJson),
             };
 
-            if (!this.durableDirectToolResultsBackedByReceipts) {
+            // Edition 5 adopts normal fetch semantics: a non-2xx response is
+            // a failed durable operation. Throw before checkpoint/receipt
+            // completion so the failure is never cached. Editions 1–4 retain
+            // their response-record behavior for the same upstream response.
+            if (!output.ok && this.currentAuthoringContractEdition >= 5) {
+              throw new CtxFetchHttpError(output);
+            }
+
+            if (
+              options?.transient !== true &&
+              !this.durableDirectToolResultsBackedByReceipts
+            ) {
               this.checkpoint.resolvedBoundaries = {
                 ...(this.checkpoint.resolvedBoundaries ?? {}),
                 [boundaryId]: {
@@ -11065,12 +11117,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         this.governor.policy.concurrency.toolCalls,
         Math.max(
           1,
-          this.fixtureProviderPacingDisabled()
-            ? this.governor.policy.concurrency.toolCalls
-            : await this.resourceGovernor.suggestedToolParallelism(
-                toolId,
-                this.governor.policy.concurrency.toolCalls,
-              ),
+          await this.resourceGovernor.suggestedToolParallelism(
+            toolId,
+            this.governor.policy.concurrency.toolCalls,
+          ),
         ),
       );
       const dispatchOwned = async (
@@ -11226,7 +11276,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     const batchParallelismCeiling =
       this.governor.policy.pacing.workerToolBatchDefaultParallelism;
     const batchSize =
-      compiledBatches.length > 0 && !this.fixtureProviderPacingDisabled()
+      compiledBatches.length > 0
         ? await this.resourceGovernor.suggestedToolParallelism(
             compiledBatches[0]!.batchOperation,
             batchParallelismCeiling,
@@ -12501,8 +12551,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               const batchParallelismCeiling =
                 this.governor.policy.pacing.workerToolBatchDefaultParallelism;
               const batchSize =
-                compiledBatches.length > 0 &&
-                !this.fixtureProviderPacingDisabled()
+                compiledBatches.length > 0
                   ? await this.resourceGovernor.suggestedToolParallelism(
                       compiledBatches[0]!.batchOperation,
                       batchParallelismCeiling,
@@ -12756,23 +12805,18 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     void flushCompletionBuffer();
                   }, 0);
                 });
-              // Seed the dispatch width from the governor's provider-shaped
-              // parallelism instead of the flat policy.concurrency.toolCalls
-              // ceiling. The flat width launched every pending row at once into
-              // the pacer, so unhinted providers 429'd on the first burst before
-              // AIMD could halve the rate. The shaped estimate is derived from the
-              // provider's RPS/maxConcurrency pacing rules (see
-              // suggestedParallelism in governor.ts), floored at 1 and capped by
-              // the global tool-call concurrency ceiling. The pacer still gates
-              // each in-flight call, so this only trims the launch burst.
+              // Bound direct map dispatch separately from ordinary provider
+              // residency. This prevents a blocked first chunk from launching
+              // another chunk ahead of a provider's admitted start rate, while
+              // preserving the wider resident-call capacity used by batched and
+              // high-latency providers.
               const toolCallConcurrencyCeiling =
                 this.governor.policy.concurrency.toolCalls;
-              const shapedToolParallelism = this.fixtureProviderPacingDisabled()
-                ? toolCallConcurrencyCeiling
-                : await this.resourceGovernor.suggestedToolParallelism(
-                    toolId,
-                    toolCallConcurrencyCeiling,
-                  );
+              const shapedToolParallelism =
+                await this.resourceGovernor.suggestedDirectToolParallelism(
+                  toolId,
+                  toolCallConcurrencyCeiling,
+                );
               const dispatchWidth = Math.min(
                 toolCallConcurrencyCeiling,
                 Math.max(1, shapedToolParallelism),
@@ -13339,44 +13383,17 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 // is the fetch itself, so independently delayed runners cannot
                 // compress real provider arrivals after their tickets.
                 const protectionHeaders = await this.vercelProtectionHeaders();
-                // Use the mode carried by this physical execution request.
-                // A restored execution scope may predate integration-mode
-                // authority metadata, while the signed launch and every tool
-                // request still carry options.integrationMode. Pacing the
-                // latter as live would make fixture runs both slow and
-                // unauditable even though the app never dispatches a provider
-                // request.
+                // Fixture responses simulate provider residence, but provider
+                // admission remains real. This makes fixture volume results a
+                // faithful measurement of the runtime controller without
+                // spending provider credits.
                 const fixtureExecution =
                   this.#options.integrationMode === 'fixture';
-                const enforceFixtureProviderPacing =
-                  fixtureExecution &&
-                  this.#options.enforceFixtureProviderPacing === true;
-                const fixtureOnlyExecution =
-                  this.fixtureProviderPacingDisabled();
-                if (
-                  fixtureOnlyExecution &&
-                  !this.fixtureProviderPacingBypassLogged
-                ) {
-                  this.fixtureProviderPacingBypassLogged = true;
-                  this.log(
-                    'Fixture mode: provider pacing bypassed because no provider request is dispatched.',
-                  );
-                }
-                if (
-                  enforceFixtureProviderPacing &&
-                  !this.fixtureProviderPacingEnforcementLogged
-                ) {
-                  this.fixtureProviderPacingEnforcementLogged = true;
-                  this.log(
-                    'Fixture mode: provider pacing explicitly enforced for production-parity testing.',
-                  );
-                }
-                const providerPermit = fixtureOnlyExecution
-                  ? { release() {} }
-                  : await this.resourceGovernor.acquireProviderPermit({
-                      toolId,
-                      signal: abortController?.signal,
-                    });
+                const providerPermit =
+                  await this.resourceGovernor.acquireProviderPermit({
+                    toolId,
+                    signal: abortController?.signal,
+                  });
                 try {
                   // Provider admission is our queue, not provider execution.
                   // Start the tool deadline only after admission so a busy

package/dist/bundling-sources/shared_libs/play-runtime/ctx-types.ts

@@ -619,8 +619,6 @@ export interface ContextOptions {
   docflowEnabled?: boolean;
   /** Internal fixture-only simulation of provider response residence. */
   fixtureBehavior?: FixtureBehavior | null;
-  /** Preview/dev test seam that applies provider pacing to fixture responses. */
-  enforceFixtureProviderPacing?: boolean;
   /**
    * Server-validated per-run ceiling for concurrently resident provider-tool
    * executions and direct ctx.fetch calls. Omitted uses the platform default.

package/dist/bundling-sources/shared_libs/play-runtime/durable-receipt-execution.ts

@@ -697,26 +697,39 @@ export async function executeWithDurableRuntimeReceipt<T>(input: {
     isInFlightRuntimeReceipt(receipt) &&
     typeof receipt.runId === 'string' &&
     receipt.runId.trim() === input.runId;
-  const waitForRunningReceipt = async (): Promise<{
-    kind: 'recovered';
-    output: T;
-  }> => ({
-    kind: 'recovered',
-    output: await recoverCompletedReceipt(
-      await waitForCompletedRuntimeReceipt({
-        receiptKey: input.receiptKey,
-        store: input.store,
-        maxAttempts: input.runningReceiptWaitMaxAttempts,
-        delayMs: input.runningReceiptWaitDelayMs,
-        toolErrorSchemaVersion: input.toolErrorSchemaVersion,
-      }),
-      'in_flight',
-    ),
-  });
-  const waitForRunningReceiptOrTimeout = async (): Promise<{
-    kind: 'recovered';
-    output: T;
-  }> => waitForRunningReceipt();
+  const waitForRunningReceiptOrRelease = async (): Promise<
+    { kind: 'recovered'; output: T } | { kind: 'claimed' }
+  > => {
+    const maxAttempts =
+      input.runningReceiptWaitMaxAttempts ?? DURABLE_RECEIPT_WAIT_MAX_ATTEMPTS;
+    const delayMs =
+      input.runningReceiptWaitDelayMs ?? DURABLE_RECEIPT_WAIT_DELAY_MS;
+    for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+      if (attempt > 0) await sleepReceiptWait(delayMs);
+      const current = await input.store.get(input.receiptKey);
+      if (current?.status === 'completed' || current?.status === 'skipped') {
+        return {
+          kind: 'recovered',
+          output: await recoverCompletedReceipt(current, 'in_flight'),
+        };
+      }
+      if (current?.status === 'failed') {
+        throw runtimeReceiptFailureError(
+          current,
+          `ctx.${input.operation}(${input.id}): previous execution failed and cannot be reused`,
+          input.toolErrorSchemaVersion,
+        );
+      }
+      if (
+        (current?.status === 'queued' || current?.status === 'pending') &&
+        !current.leaseId &&
+        !current.leaseExpiresAt
+      ) {
+        return await reclaimReceipt();
+      }
+    }
+    throw new RuntimeReceiptWaitTimeoutError(input.receiptKey);
+  };
   const repairOrWaitForRunningReceipt = async (
     receipt: RuntimeStepReceipt,
   ): Promise<{ kind: 'recovered'; output: T } | { kind: 'claimed' }> => {
@@ -726,7 +739,7 @@ export async function executeWithDurableRuntimeReceipt<T>(input: {
       return { kind: 'claimed' };
     }
     try {
-      return await waitForRunningReceiptOrTimeout();
+      return await waitForRunningReceiptOrRelease();
     } catch (error) {
       if (error instanceof RuntimeReceiptWaitTimeoutError) {
         const recovered = await reclaimReceipt();
@@ -840,6 +853,24 @@ export async function executeWithDurableRuntimeReceipt<T>(input: {
     assertNoSecretTaint(result, `ctx.${input.operation} result`);
   } catch (error) {
     if (input.shouldPersistFailure?.(error) === false) {
+      // This error is deliberately not a durable execution result (for
+      // example, an HTTP non-2xx response under the current ctx.fetch
+      // contract). Release only the lease we still own so a later run can
+      // make a fresh, idempotency-protected attempt rather than inheriting a
+      // running or failed receipt.
+      const released = await input.store.release(
+        input.receiptKey,
+        input.runId,
+        ownedLeaseId,
+      );
+      if (
+        !released ||
+        (released.status !== 'queued' && released.status !== 'pending')
+      ) {
+        throw new Error(
+          `ctx.${input.operation}(${input.id}): non-cacheable execution failed but receipt ownership could not be released: ${input.formatError(error)}.`,
+        );
+      }
       throw error;
     }
     // The ownership is uncertain, so neither `fail` nor `release` is safe.

package/dist/bundling-sources/shared_libs/play-runtime/governor/governor.ts

@@ -137,6 +137,15 @@ export interface PlayExecutionGovernor {
    */
   suggestedParallelism(toolId: string, fallback: number): Promise<number>;
 
+  /**
+   * Suggested resident width for direct, unbatched tool dispatch.
+   * Provider permits, not this queue width, govern outbound starts.
+   */
+  suggestedDirectToolParallelism(
+    toolId: string,
+    fallback: number,
+  ): Promise<number>;
+
   /** Increment a monotonic budget counter; throws GovernorBudgetError on breach. */
   chargeBudget(kind: BudgetKind, amount?: number): Promise<void>;
 
@@ -479,14 +488,43 @@ export function createPlayExecutionGovernor(
 
     async suggestedParallelism(toolId, fallback) {
       const pacing = await resolveAdaptivePacing(toolId);
-      const limits = pacing.rules.flatMap((rule) =>
-        rule.maxConcurrency != null
-          ? [rule.requestsPerWindow, rule.maxConcurrency]
-          : [rule.requestsPerWindow],
+      const concurrencyLimits = pacing.rules.flatMap((rule) =>
+        rule.maxConcurrency != null ? [rule.maxConcurrency] : [],
       );
+      // A provider that declares only RPS has no resident-call contract, so
+      // retain the caller's bounded envelope; the rate-state backend still
+      // governs every outbound start.
+      const widthLimits =
+        concurrencyLimits.length > 0 ? concurrencyLimits : [fallback];
       return Math.max(
         1,
-        Math.min(policy.pacing.suggestedMaxParallelism, ...limits),
+        Math.min(
+          Math.max(1, fallback),
+          policy.pacing.suggestedMaxParallelism,
+          ...widthLimits,
+        ),
+      );
+    },
+
+    async suggestedDirectToolParallelism(toolId, fallback) {
+      const pacing = await resolveAdaptivePacing(toolId);
+      const concurrencyLimits = pacing.rules.flatMap((rule) =>
+        rule.maxConcurrency != null ? [rule.maxConcurrency] : [],
+      );
+      // The shared rate backend controls every outbound start. An RPS-only
+      // provider needs enough resident work to cover response residence; using
+      // requestsPerWindow as this width turns, for example, a 25-RPS provider
+      // with 4-second responses into a 6.25-RPS lane. Only an explicit provider
+      // concurrency contract may tighten the resident envelope.
+      const widthLimits =
+        concurrencyLimits.length > 0 ? concurrencyLimits : [fallback];
+      return Math.max(
+        1,
+        Math.min(
+          Math.max(1, fallback),
+          policy.pacing.suggestedMaxParallelism,
+          ...widthLimits,
+        ),
       );
     },
 
@@ -615,6 +653,8 @@ function createInlineChildGovernor(
       root.acquireProviderPermit(toolId, opts),
     suggestedParallelism: (toolId, fallback) =>
       root.suggestedParallelism(toolId, fallback),
+    suggestedDirectToolParallelism: (toolId, fallback) =>
+      root.suggestedDirectToolParallelism(toolId, fallback),
     chargeBudget: (kind, amount) => root.chargeBudget(kind, amount),
     resolveRowConcurrency: (requested) => root.resolveRowConcurrency(requested),
     reportProviderBackpressure: async (input) =>

package/dist/bundling-sources/shared_libs/play-runtime/governor/policy.ts

@@ -80,7 +80,11 @@ export interface ResolvedExecutionPolicy {
 }
 
 export const DEFAULT_MAX_CONCURRENT_EXTERNAL_CALLS = 64;
-export const MAX_CONFIGURABLE_CONCURRENT_EXTERNAL_CALLS = 256;
+// A 1,000-row Play may legitimately need 1,000 resident provider calls to
+// sustain a declared start rate while responses are slow. This is a validated
+// opt-in ceiling, not the default transport load: short runtime-to-app fetches
+// remain guarded independently by `integrationRequests` below.
+export const MAX_CONFIGURABLE_CONCURRENT_EXTERNAL_CALLS = 1_000;
 export const MAX_CONFIGURABLE_CONCURRENT_ROWS = 1_000;
 // Dispatch groups are only a scheduler envelope. The external-call semaphore
 // remains the resource bound, so do not impose a lower hidden ceiling here.
@@ -146,7 +150,7 @@ export const SHARED_EXECUTION_POLICY: ResolvedExecutionPolicy = {
     rowMax: 1_000,
     // Global logical-call backstop. The default is intentionally close to the
     // standard row cohort so slow small responses do not serialize most rows.
-    // Runs may request a value through the validated 1..256 launch contract;
+    // Runs may request a value through the validated 1..1000 launch contract;
     // provider pacing and the runner-owned hard ceiling still apply.
     toolCalls: DEFAULT_MAX_CONCURRENT_EXTERNAL_CALLS,
     // Physical runtime-to-app fetch/body admission. Keep short socket bursts
@@ -173,7 +177,11 @@ export const SHARED_EXECUTION_POLICY: ResolvedExecutionPolicy = {
   pacing: {
     // Undeclared providers; declared providers (rate-limit-definitions.ts) win.
     defaultProviderRequestsPerSecond: 10,
-    suggestedMaxParallelism: 256,
+    // This is the scheduler's resident-call envelope, not an RPS target.
+    // Keep it aligned with the explicit run ceiling so an RPS-only provider
+    // can retain the calls required by its observed residence time. A declared
+    // provider maxConcurrency still tightens this per lane.
+    suggestedMaxParallelism: MAX_CONFIGURABLE_CONCURRENT_EXTERNAL_CALLS,
     // Worker isolate pacing knobs. The budget module owns platform accounting;
     // the Governor owns the policy values that decide when work is chunked.
     workerYieldElapsedMs: 45_000,

package/dist/bundling-sources/shared_libs/play-runtime/protocol.ts

@@ -138,8 +138,6 @@ export interface PlayRunnerContextConfig {
   docflowEnabled?: boolean;
   /** Validated internal fixture-only provider response simulation. */
   fixtureBehavior?: FixtureBehavior | null;
-  /** Preview/dev test seam that applies provider pacing to fixture responses. */
-  enforceFixtureProviderPacing?: boolean;
   /** Validated per-run ceiling for provider-tool executions and ctx.fetch. */
   maxConcurrentExternalCalls?: number | null;
   maxConcurrentRows?: number | null;

package/dist/bundling-sources/shared_libs/play-runtime/resource-governor.ts

@@ -60,6 +60,10 @@ export interface RuntimeResourceGovernor {
     signal?: AbortSignal;
   }): Promise<RuntimeResourceLease>;
   suggestedToolParallelism(toolId: string, fallback: number): Promise<number>;
+  suggestedDirectToolParallelism(
+    toolId: string,
+    fallback: number,
+  ): Promise<number>;
   resolveRowConcurrency(requested?: number): number;
   reportProviderBackpressure(input: {
     provider: string;
@@ -228,6 +232,13 @@ export function createRuntimeResourceGovernor(input: {
       return input.executionGovernor.suggestedParallelism(toolId, fallback);
     },
 
+    suggestedDirectToolParallelism(toolId, fallback) {
+      return input.executionGovernor.suggestedDirectToolParallelism(
+        toolId,
+        fallback,
+      );
+    },
+
     resolveRowConcurrency(requested) {
       return input.executionGovernor.resolveRowConcurrency(requested);
     },

package/dist/bundling-sources/shared_libs/play-runtime/secret-capability.ts

@@ -129,7 +129,11 @@ export function valueContainsSecret(value: unknown): boolean {
   const seen = new WeakSet<object>();
   while (pending.length > 0) {
     const candidate = pending.pop();
-    if (isSecretValue(candidate) || isSecretAuth(candidate)) return true;
+    if (
+      isSecretValue(candidate) || isSecretAuth(candidate)
+    ) {
+      return true;
+    }
     if (typeof candidate === 'string') {
       if (SECRET_HANDLE_MARKER_RE.test(candidate)) return true;
       continue;