deepline 0.3.71 → 0.3.73

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -175,6 +175,7 @@ import {
   buildDurableToolAggregateReceiptKey,
   buildDurableToolCallAuthScopeDigest,
   buildDurableToolCallCacheKey,
+  buildLegacyRevisionedDurableToolCallCacheKey,
   buildDurableToolPayloadProviderIdempotencyKey,
   buildDurableToolProviderIdempotencyKey,
   buildDurableToolReceiptPrefix,
@@ -195,8 +196,11 @@ import {
   type PlayAuthoringRuntimeContext,
 } from '../plays/authoring-contract';
 import {
+  LOG_LEVELS,
   formatCtxFetchHttpFailureDiagnostic,
-  tagLogProvenance,
+  tagLogEntry,
+  tagLogLevel,
+  type LogLevel,
 } from './log-provenance';
 import {
   DURABLE_RECEIPT_WAIT_DELAY_MS,
@@ -1392,6 +1396,8 @@ function playNodeScopeForToolCallRequest(
 type ToolExecutionApiOptions = {
   timeoutMs?: number;
   durableCallReceiptKey?: string | null;
+  /** The receipt key is a completed-result cache for this read-only call. */
+  completedResultCache?: boolean;
   executionAuthScopeDigest?: string | null;
   /**
    * Historical receipt identity used for the API's provider/billing
@@ -1432,6 +1438,22 @@ const IN_MEMORY_STEP_RESULT_PREVIEW_LIMIT = 25;
  */
 const MAX_CELL_PRODUCER_ATTEMPTS = 12;
 const BATCH_SIZE_LOG_SAMPLE_LIMIT = 10;
+
+/**
+ * A 100k-row Play must not turn `ctx.log` into a second data plane. Keep an
+ * initial useful window, then deterministic samples and explicit durable
+ * warnings. Warn/error are never sampled: losing the actual failure is worse
+ * than spending additional log capacity.
+ */
+const LOG_RATE_LIMIT_POLICY: Readonly<
+  Record<Exclude<LogLevel, 'warn' | 'error'>, { first: number; every: number }>
+> = {
+  debug: { first: 200, every: 100 },
+  info: { first: 1_000, every: 100 },
+};
+const LOG_RATE_LIMIT_MARKER_EVERY = 1_000;
+
+type LogRateLimitState = { seen: number; sampled: number; suppressed: number };
 const STEP_PROGRAM_MAP_DEFINITION = Symbol('deepline.stepProgramMapDefinition');
 
 function shouldPersistMapCellField(fieldName: string): boolean {
@@ -2095,6 +2117,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   #options: ContextOptions;
   private readonly executionScope: RunExecutionScope;
   private logBuffer: string[] = [];
+  private readonly logRateLimitState = new Map<
+    Exclude<LogLevel, 'warn' | 'error'>,
+    LogRateLimitState
+  >();
   private readonly ctxFetchHttpFailureDiagnosticIdentities = new Set<string>();
   private checkpoint: PlayCheckpoint;
   private readonly durableCallCacheEpochMs: number;
@@ -2740,9 +2766,22 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   }
 
   /**
-   * Only explicitly declared response transformations affect receipt reuse.
-   * Missing preserves historical artifact/receipt identity, while the public
-   * response header still normalizes it to the legacy V2 behavior above.
+   * A real published artifact pins its response presentation in its launch
+   * contract. In-process callers that omit the option are runtime consumers,
+   * not historical Play artifacts, and retain the canonical result they pass
+   * in. This keeps the context API backward-compatible while letting a pinned
+   * legacy artifact request its old projection after a cache read.
+   */
+  private get hasPinnedToolResponseContract(): boolean {
+    return (
+      this.activeInlineComposition !== null ||
+      this.#options.toolResponseContract !== undefined
+    );
+  }
+
+  /**
+   * Compatibility metadata retained for already-published artifacts. It never
+   * changes the completed-result cache identity.
    */
   private get currentToolResponseReceiptRevision(): string | undefined {
     if (this.activeInlineComposition) {
@@ -3022,7 +3061,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             attempt,
             retryAfter: null,
           });
-          this.log(
+          this.runtimeLog(
             `[runtime.secret_resolution_failure] ${JSON.stringify({
               stage: 'transport',
               secret_name: secret.name,
@@ -3077,7 +3116,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           retry_after_exceeds_cap: retry.retryAfterExceedsCap,
         };
         if (!response.ok) {
-          this.log(
+          this.runtimeLog(
             `[runtime.secret_resolution_failure] ${JSON.stringify(responseDiagnostic)}`,
           );
           cancelRuntimeResponseBody(response);
@@ -3094,7 +3133,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         try {
           payload = await response.json();
         } catch (error) {
-          this.log(
+          this.runtimeLog(
             `[runtime.secret_resolution_failure] ${JSON.stringify({
               ...responseDiagnostic,
               response_kind: 'invalid_json',
@@ -3115,7 +3154,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             ? (payload as { value: string }).value
             : null;
         if (!value) {
-          this.log(
+          this.runtimeLog(
             `[runtime.secret_resolution_failure] ${JSON.stringify({
               ...responseDiagnostic,
               response_kind:
@@ -3131,7 +3170,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           );
         }
         if (attempt > 1) {
-          this.log(
+          this.runtimeLog(
             `[runtime.secret_resolution_recovered] ${JSON.stringify({
               secret_name: secret.name,
               gateway_origin: transportGatewayOriginForDiagnostic(url),
@@ -3739,7 +3778,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       if (normalized) byKey.set(normalized.key, normalized);
     }
     if (runtimeReceiptReadTraceEnabled) {
-      this.log(
+      this.runtimeLog(
         `[runtime-receipt-normalize] ${runtimeReceiptReadSummary({
           requested: uniqueKeys,
           receipts,
@@ -3751,7 +3790,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         receipts,
         byKey,
       });
-      if (trace) this.log(trace);
+      if (trace) this.runtimeLog(trace);
     }
     return byKey;
   }
@@ -3806,7 +3845,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       if (normalized) byKey.set(normalized.key, normalized);
     }
     if (runtimeReceiptReadTraceEnabled) {
-      this.log(
+      this.runtimeLog(
         `[runtime-receipt-claim-normalize] reclaim_running=${reclaimRunning} force_refresh=${forceRefresh} force_failed_refresh=${forceFailedRefresh} ` +
           runtimeReceiptReadSummary({
             requested: uniqueKeys,
@@ -3997,14 +4036,14 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       );
       if (normalized) byKey.set(normalized.key, normalized);
     }
-    await this.reconcileMissingRuntimeStepReceiptCompletions(
+    await this.reconcileIncompleteRuntimeStepReceiptCompletions(
       normalizedInputs,
       byKey,
     );
     return byKey;
   }
 
-  private async reconcileMissingRuntimeStepReceiptCompletions(
+  private async reconcileIncompleteRuntimeStepReceiptCompletions(
     receipts: Array<{
       key: string;
       runId: string;
@@ -4015,32 +4054,45 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     completedByKey: Map<string, RuntimeStepReceipt>,
   ): Promise<void> {
     if (
-      receipts.length === completedByKey.size ||
-      (!this.#options.getRuntimeStepReceipt &&
-        !this.#options.getRuntimeStepReceipts)
+      !this.#options.getRuntimeStepReceipt &&
+      !this.#options.getRuntimeStepReceipts
     ) {
       return;
     }
-    const missingKeys = receipts
+    // The receipt gateway is allowed to return a compact terminal
+    // acknowledgement without `output`. That is sufficient for old callers
+    // which keep the live result, but a completed-result cache must hydrate
+    // the stored output before handing it to a cache cohort.
+    const incompleteKeys = receipts
       .map((receipt) => receipt.key.trim())
-      .filter((key) => key && !completedByKey.has(key));
-    if (missingKeys.length === 0) return;
-    const latest = await this.getRuntimeStepReceipts(missingKeys);
-    for (const key of missingKeys) {
+      .filter((key) => {
+        if (!key) return false;
+        const completed = completedByKey.get(key);
+        return (
+          !completed ||
+          ((completed.status === 'completed' ||
+            completed.status === 'skipped') &&
+            completed.output === undefined)
+        );
+      });
+    if (incompleteKeys.length === 0) return;
+    const latest = await this.getRuntimeStepReceipts(incompleteKeys);
+    for (const key of incompleteKeys) {
       const recovered = latest.get(key);
       if (
-        recovered?.status === 'completed' ||
-        recovered?.status === 'skipped'
+        (recovered?.status === 'completed' ||
+          recovered?.status === 'skipped') &&
+        recovered.output !== undefined
       ) {
         completedByKey.set(key, recovered);
       }
     }
-    const recoveredCount = missingKeys.filter((key) =>
-      completedByKey.has(key),
+    const recoveredCount = incompleteKeys.filter(
+      (key) => completedByKey.get(key)?.output !== undefined,
     ).length;
     if (recoveredCount > 0) {
-      this.log(
-        `Runtime tool receipt completion response reconciled ${recoveredCount}/${missingKeys.length} missing receipt(s) from durable store read-back.`,
+      this.runtimeLog(
+        `Runtime tool receipt completion response hydrated ${recoveredCount}/${incompleteKeys.length} incomplete receipt(s) from durable store read-back.`,
       );
     }
   }
@@ -4155,17 +4207,39 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     );
   }
 
-  private async durableToolCallCacheKeyForScope(
-    input: {
-      toolId: string;
-      requestInput: Record<string, unknown>;
-      executionAuthScopeDigest?: string | null;
-      staleAfterSeconds?: number | null;
-      playLocalScope?: string | null;
-    },
-    toolResponseReceiptRevision: string | null | undefined = this
-      .currentToolResponseReceiptRevision,
-  ): Promise<string> {
+  private async durableToolCallCacheKeyForScope(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+    playLocalScope?: string | null;
+  }): Promise<string> {
+    const identity = await this.durableToolCallCacheIdentity(input);
+    return buildDurableToolCallCacheKey(identity);
+  }
+
+  private async legacyDurableToolCallCacheKeyForScope(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+    playLocalScope?: string | null;
+  }): Promise<string | null> {
+    const revision = this.currentToolResponseReceiptRevision;
+    if (!revision) return null;
+    return buildLegacyRevisionedDurableToolCallCacheKey({
+      ...(await this.durableToolCallCacheIdentity(input)),
+      toolResponseReceiptRevision: revision,
+    });
+  }
+
+  private async durableToolCallCacheIdentity(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+    playLocalScope?: string | null;
+  }): Promise<Parameters<typeof buildDurableToolCallCacheKey>[0]> {
     const providerActionVersion =
       (await this.#options.getToolActionCacheVersion?.(input.toolId))?.trim() ??
       '';
@@ -4173,7 +4247,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       input.executionAuthScopeDigest?.trim() ||
       (await this.resolveToolAuthScopeDigest(input.toolId))?.trim() ||
       null;
-    return buildDurableToolCallCacheKey({
+    return {
       orgId: this.#options.orgId,
       playLocalScope: input.playLocalScope,
       toolId: input.toolId,
@@ -4184,29 +4258,33 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         executionAuthScopeDigest,
       }),
       providerActionVersion,
-      toolResponseReceiptRevision,
       staleAfterSeconds: input.staleAfterSeconds,
       cacheEpochMs: this.durableCallCacheEpochMs,
+    };
+  }
+
+  private async durableToolCallCacheKey(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+  }): Promise<string> {
+    return await this.durableToolCallCacheKeyForScope({
+      ...input,
+      playLocalScope: this.currentGovernance.currentPlayId,
     });
   }
 
-  private async durableToolCallCacheKey(
-    input: {
-      toolId: string;
-      requestInput: Record<string, unknown>;
-      executionAuthScopeDigest?: string | null;
-      staleAfterSeconds?: number | null;
-    },
-    toolResponseReceiptRevision: string | null | undefined = this
-      .currentToolResponseReceiptRevision,
-  ): Promise<string> {
-    return await this.durableToolCallCacheKeyForScope(
-      {
-        ...input,
-        playLocalScope: this.currentGovernance.currentPlayId,
-      },
-      toolResponseReceiptRevision,
-    );
+  private async legacyDurableToolCallCacheKey(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+  }): Promise<string | null> {
+    return await this.legacyDurableToolCallCacheKeyForScope({
+      ...input,
+      playLocalScope: this.currentGovernance.currentPlayId,
+    });
   }
 
   private async resolveToolAuthScopeDigest(
@@ -4326,7 +4404,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       receiptKeys: keys,
       store: this.durableReceiptExecutionStore(),
       maxAttempts,
-      log: (message) => this.log(message),
+      log: (message) => this.runtimeLog(message),
       toolErrorSchemaVersion: this.currentToolErrorSchemaVersion,
     });
   }
@@ -4430,7 +4508,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         executionLockTtlMs: opts.executionLockTtlMs,
         toolErrorSchemaVersion: this.currentToolErrorSchemaVersion,
         formatError: (error) => this.formatRuntimeError(error),
-        log: (message) => this.log(message),
+        log: (message) => this.runtimeLog(message),
         execute: ({ leaseId }) => execute(leaseId),
       });
     } finally {
@@ -5356,6 +5434,23 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     return null;
   }
 
+  private canReuseToolResultForCurrentResponseContract(
+    result: unknown,
+  ): boolean {
+    if (this.currentToolResponseContract !== RAW_V2_TOOL_RESPONSE_CONTRACT) {
+      return true;
+    }
+    const toolResult = isToolExecuteResult(result)
+      ? result
+      : isSerializedToolExecuteResult(result)
+        ? deserializeToolExecuteResult(result)
+        : null;
+    return (
+      toolResult !== null &&
+      Object.prototype.hasOwnProperty.call(toolResult.toolResponse, 'rawV2')
+    );
+  }
+
   private cacheToolResult(
     toolId: string,
     rowCacheKey: string,
@@ -5468,6 +5563,38 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     );
   }
 
+  /**
+   * Receipts retain the canonical raw-v2 provider outcome. Older artifacts
+   * receive their legacy projection only at the Play boundary, after cache
+   * lookup and persistence have finished.
+   */
+  private materializeToolExecutionResult(
+    result: ToolExecuteResult,
+  ): ToolExecuteResult {
+    if (
+      this.currentToolResponseContract === RAW_V2_TOOL_RESPONSE_CONTRACT ||
+      !this.hasPinnedToolResponseContract ||
+      !Object.prototype.hasOwnProperty.call(result.toolResponse, 'rawV2')
+    ) {
+      return result;
+    }
+    const serialized = serializeToolExecuteResult(result);
+    if (serialized.__kind !== 'deepline.tool_execute_result.v2') {
+      return result;
+    }
+    return deserializeToolExecuteResult({
+      ...serialized,
+      __kind: 'deepline.tool_execute_result.v1',
+      toolResponse: {
+        raw: legacyRawFromToolResponseRawV2(
+          serialized.toolResponse.rawV2,
+          serialized.toolResponse.view,
+          serialized.toolResponse.responseMeta,
+        ),
+      },
+    });
+  }
+
   private attachCustomerDbDatasetResult(
     toolId: string,
     requestInput: Record<string, unknown> | undefined,
@@ -5781,7 +5908,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       completed?.status !== 'completed' &&
       completed?.status !== 'skipped'
     ) {
-      this.log(
+      this.runtimeLog(
         `Durable tool call ${receiptKey} completed live after its receipt lease moved; using live result without overwriting the receipt.`,
       );
     }
@@ -6018,7 +6145,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         'ctx.runSteps.options.description',
         options.description,
       );
-      this.log(options.description);
+      this.runtimeLog(options.description);
     }
     return (await this.executeStepProgram(program, input, 0, [], {
       checkpointSteps: true,
@@ -6249,7 +6376,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         immediateMaterializedRows.length = 0;
         immediateMaterializedResidentBytes = 0;
         immediateMaterializedCacheEnabled = false;
-        this.log(
+        this.runtimeLog(
           `Dataset ${normalizedMapNamespace} result cache disabled (${reason}); using the durable runtime sheet.`,
         );
       };
@@ -6862,7 +6989,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       : { rows: rawMaterializedItems, droppedCount: 0, duplicateKeys: [] };
     if (dedupedMaterialized.droppedCount > 0) {
       const keySample = dedupedMaterialized.duplicateKeys.join(', ');
-      this.log(
+      this.runtimeLog(
         `deduped ${dedupedMaterialized.droppedCount} duplicate dataset key(s) for ctx.dataset("${normalizedMapNamespace}"); keeping first occurrence` +
           (keySample ? ` (e.g. ${keySample})` : ''),
       );
@@ -7159,7 +7286,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         const persistStartedAt = Date.now();
         await persistMapRows(unpersistedRows);
         if (unpersistedRows.length > 0) {
-          this.log(
+          this.runtimeLog(
             `Persisted ${unpersistedRows.length} fail-fast rows to sheet ${resolvedTableNamespace} in ${Date.now() - persistStartedAt}ms`,
           );
         }
@@ -7227,7 +7354,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       const persistStartedAt = Date.now();
       await persistMapRows(persistRows);
       if (persistRows.length > 0) {
-        this.log(
+        this.runtimeLog(
           `Persisted ${persistRows.length} executed rows to sheet ${resolvedTableNamespace} in ${Date.now() - persistStartedAt}ms`,
         );
       }
@@ -7285,7 +7412,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         expectedRows: totalInputCount,
         currentRows: results,
         failedRowCount: mapResult.failedRows.length,
-        log: (line) => this.log(line),
+        log: (line) => this.runtimeLog(line),
         readPersistedRows: async (readInput) => {
           if (
             !this.#options.baseUrl ||
@@ -7548,7 +7675,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         completedRowsToPersist.length = 0;
         failedRowsToPersist.length = 0;
         retainedRowsComplete = false;
-        this.log(
+        this.runtimeLog(
           `Dataset ${normalizedTableNamespace} released its in-memory result cache after ${completedRowCount + failedRowCount} row(s); using the durable Runtime Sheet.`,
         );
       }
@@ -7583,11 +7710,11 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     };
 
     if (completedRows > 0 || pendingRows !== totalRows) {
-      this.log(
+      this.runtimeLog(
         `Starting map over ${totalRows} items with ${visibleFields.length} fields (key: ${normalizedTableNamespace}; ${completedRows} duplicate keys skipped; ${pendingRows} pending)`,
       );
     } else {
-      this.log(
+      this.runtimeLog(
         `Starting map over ${items.length} items with ${visibleFields.length} fields (key: ${normalizedTableNamespace})`,
       );
     }
@@ -7764,7 +7891,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       }
       this.lastDatasetStep = datasetStep;
       this.activeDatasetStep = null;
-      this.log(
+      this.runtimeLog(
         `Map completed: ${results.length + completedRows} results (${results.length} succeeded, 0 failed, ${completedRows} duplicate keys skipped)`,
       );
       return {
@@ -7829,7 +7956,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     });
     mapStallObserver = new RuntimeMapStallObserver({
       getWriterDiagnostics: () => incrementalPersistence?.diagnostics() ?? null,
-      log: (line) => this.log(line),
+      log: (line) => this.runtimeLog(line),
       mapName: normalizedTableNamespace,
       pageOffset:
         runtimeOptions?.executionRowIndexes?.[0] ??
@@ -8281,17 +8408,20 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       });
     }
     for (const failedRow of failedRowsToPersist.slice(0, 3)) {
-      this.log(
+      this.runtimeLog(
         `row ${failedMapRowLogLabel(failedRow)} failed: ${failedRow.error ?? 'unknown error'}`,
+        { level: 'error' },
       );
     }
     if (failedRowsToPersist.length > 3) {
-      this.log(
+      this.runtimeLog(
         `${failedRowsToPersist.length - 3} additional row failure(s) omitted from map log`,
+        { level: 'warn' },
       );
     }
-    this.log(
+    this.runtimeLog(
       `Map completed: ${succeededRows + completedRows} results (${succeededRows} succeeded, ${failedRowCount} failed, ${completedRows} duplicate keys skipped)`,
+      failedRowCount > 0 ? { level: 'warn' } : undefined,
     );
     return {
       completedRows: [...completedRowsToPersist].sort(
@@ -9055,8 +9185,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               );
         if (dispatchable.requests.length > 0) {
           pass += 1;
-          this.log(`  Batch pass ${pass}`);
-          this.log(
+          this.runtimeLog(`  Batch pass ${pass}`);
+          this.runtimeLog(
             `  Dispatcher launch: ready=${dispatchable.requests.length} ` +
               `queued=${this.toolCallQueue.length} ` +
               `in_flight_groups=${inFlightToolExecutions.size}`,
@@ -9246,16 +9376,26 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       executionAuthScopeDigest,
       staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
     });
-    let providerIdempotencyKeyBase = await this.durableToolCallCacheKey(
-      {
-        toolId,
-        requestInput: input,
-        executionAuthScopeDigest,
-        staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
-      },
-      null,
-    );
-    const checkpointCacheKeys = [durableCacheKey];
+    let legacyDurableCacheKey = await this.legacyDurableToolCallCacheKey({
+      toolId,
+      requestInput: input,
+      executionAuthScopeDigest,
+      staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
+    });
+    // Only explicitly fenced operations use this key as a provider identity.
+    // Ordinary calls use it solely as their completed-result cache key.
+    let providerIdempotencyKeyBase = durableCacheKey;
+    let directResultReceiptKey = durableCacheKey;
+    // A raw-v2 artifact must never read an older receipt that cannot render
+    // raw-v2. If both the primary and its revisioned recovery receipt are
+    // unrenderable, make a live call rather than returning either cache entry.
+    // We cannot safely replace an immutable completed receipt, so that rare
+    // incompatible state deliberately forgoes caching until it is repaired.
+    let bypassDirectResultCache = false;
+    const checkpointCacheKeys = [
+      durableCacheKey,
+      ...(legacyDurableCacheKey ? [legacyDurableCacheKey] : []),
+    ];
 
     const executeTool = async (context?: {
       leaseId?: string | null;
@@ -9284,7 +9424,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       if (!store) {
         const directCacheKey = durableCacheKey;
         let initialDirectReceipt: RuntimeStepReceipt | null | undefined;
-        const cached = !cacheableToolResult
+        const cachedCandidate = !cacheableToolResult
           ? null
           : toolCachePolicy.force
             ? null
@@ -9293,8 +9433,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 checkpointCacheKeys,
                 'direct',
               );
+        const cached =
+          cachedCandidate &&
+          this.canReuseToolResultForCurrentResponseContract(
+            cachedCandidate.result.result,
+          )
+            ? cachedCandidate
+            : null;
         if (cached) {
-          this.log(`Calling tool: ${toolId} recovered from checkpoint`);
+          this.runtimeLog(`Calling tool: ${toolId} recovered from checkpoint`);
           // Started and settled are paired in a finally: an uncovered throw
           // between them strands the tool node `running` forever in the
           // snapshot, which is exactly the lossy state ADR 0018 removed.
@@ -9316,7 +9463,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               outcome: 'cached',
               durationMs: 0,
             });
-            return recovered;
+            return this.materializeToolExecutionResult(recovered);
           } finally {
             if (!settled) {
               this.emitToolCallLifecycle('settled', toolId, normalizedKey, {
@@ -9335,17 +9482,36 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const historicalReceipt = await this.withRuntimeReceiptHydrationTurn(
             async () => await this.getRuntimeStepReceipt(directCacheKey),
           );
-          initialDirectReceipt = historicalReceipt;
+          const historicalOutput = historicalReceipt
+            ? this.runtimeReceiptOutput<unknown>(historicalReceipt)
+            : undefined;
+          const historicalIsTerminal =
+            historicalReceipt?.status === 'completed' ||
+            historicalReceipt?.status === 'skipped';
+          const historicalCanServeCurrentContract =
+            !historicalIsTerminal ||
+            this.canReuseToolResultForCurrentResponseContract(historicalOutput);
+          initialDirectReceipt = historicalCanServeCurrentContract
+            ? historicalReceipt
+            : null;
+          if (!historicalCanServeCurrentContract) {
+            if (!legacyDurableCacheKey) {
+              throw new Error(
+                `Tool ${toolId} has an unrenderable legacy result but no response-contract recovery cache key.`,
+              );
+            }
+            directResultReceiptKey = legacyDurableCacheKey;
+          }
           if (
             historicalReceipt &&
-            (historicalReceipt.status === 'completed' ||
-              historicalReceipt.status === 'skipped') &&
+            historicalIsTerminal &&
+            historicalCanServeCurrentContract &&
             !isSerializedToolExecuteResult(historicalReceipt.output) &&
             !isToolExecuteResult(historicalReceipt.output)
           ) {
             const historicalOutput =
               this.runtimeReceiptOutput<unknown>(historicalReceipt);
-            return markToolExecuteResultExecutionOutcome(
+            const recoveredHistorical = markToolExecuteResultExecutionOutcome(
               historicalOutput,
               toolExecutionOutcomeForDurableReceipt({
                 source: 'cache',
@@ -9353,9 +9519,46 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 cacheKey: directCacheKey,
               }),
             );
+            return isToolExecuteResult(recoveredHistorical)
+              ? this.materializeToolExecutionResult(recoveredHistorical)
+              : recoveredHistorical;
+          }
+          if (
+            (!historicalReceipt || !historicalCanServeCurrentContract) &&
+            legacyDurableCacheKey
+          ) {
+            const legacyReceipt = await this.withRuntimeReceiptHydrationTurn(
+              async () =>
+                await this.getRuntimeStepReceipt(legacyDurableCacheKey!),
+            );
+            if (
+              legacyReceipt &&
+              (legacyReceipt.status === 'completed' ||
+                legacyReceipt.status === 'skipped') &&
+              legacyReceipt.output !== undefined
+            ) {
+              const recoveredLegacy = markToolExecuteResultExecutionOutcome(
+                this.runtimeReceiptOutput(legacyReceipt),
+                toolExecutionOutcomeForDurableReceipt({
+                  source: 'cache',
+                  receiptKey: legacyDurableCacheKey,
+                  cacheKey: directCacheKey,
+                }),
+              );
+              if (
+                this.canReuseToolResultForCurrentResponseContract(
+                  recoveredLegacy,
+                )
+              ) {
+                return isToolExecuteResult(recoveredLegacy)
+                  ? this.materializeToolExecutionResult(recoveredLegacy)
+                  : recoveredLegacy;
+              }
+              bypassDirectResultCache = true;
+            }
           }
         }
-        this.log(
+        this.runtimeLog(
           toolCachePolicy.force
             ? `Calling tool: ${toolId} (force)`
             : `Calling tool: ${toolId}`,
@@ -9390,23 +9593,27 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               'Direct tool execution requires a stable logical call identity.',
             );
           }
-          const physicalDirectKey = cacheableToolResult
+          const useDirectResultReceipts =
+            cacheableToolResult && !bypassDirectResultCache;
+          const physicalDirectKey = useDirectResultReceipts
             ? directCacheKey
             : `${buildDurableToolReceiptPrefix({
                 orgId: this.#options.orgId ?? 'unknown-org',
                 toolId,
               })}${stableDigest(`${this.currentRunId}:${logicalCallId}:always-fresh`)}`;
+          const resultReceiptKey = directResultReceiptKey;
           const providerOperationKey = providerIdempotencyKeyBase;
-          const resultReceiptKey = directCacheKey;
           const toolRetryPolicy = await this.#options
             .getToolRetryPolicy?.(toolId, input)
             .catch(() => null);
-          // Direct cacheable calls now give ToolCall the real completed-result
-          // receipt Adapter. The provider-operation fence remains below the
-          // dispatcher: V2 and legacy presentation keys can therefore publish
-          // independent Tool Result Receipts without a second provider effect.
-          // Map members retain their cohort-owned receipt Adapter until their
-          // batched claim/heartbeat protocol moves behind the same Interface.
+          if (
+            bypassDirectResultCache &&
+            toolRetryPolicy?.requiresExecutionFence === true
+          ) {
+            throw new Error(
+              `Tool ${toolId} has an unrenderable completed result under an execution fence and cannot safely refresh it.`,
+            );
+          }
           const dispatcher = {
             dispatch: async ({
               providerOperationKey: operationKey,
@@ -9414,7 +9621,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               providerOperationKey: string | null;
             }) => {
               if (
-                cacheableToolResult &&
+                useDirectResultReceipts &&
                 operationKey !== providerOperationKey
               ) {
                 throw new Error(
@@ -9427,18 +9634,11 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 startedAt: directCallStartedAt,
                 input,
                 options: {
-                  ...(cacheableToolResult
+                  ...(useDirectResultReceipts
                     ? {
                         durableCallReceiptKey: physicalDirectKey,
+                        completedResultCache: true,
                         executionAuthScopeDigest,
-                        providerIdempotencyReceiptKey: operationKey,
-                        providerIdempotencyKey:
-                          this.providerIdempotencyKeyForToolCall({
-                            cacheKey: providerIdempotencyKeyBase,
-                            force: toolCachePolicy.force,
-                            leaseId: directReceiptLeaseId,
-                            logicalCallId,
-                          }),
                         ...(directReceiptLeaseId &&
                         (this.#options.heartbeatRuntimeStepReceipts ||
                           this.#options.getRuntimeStepReceipt ||
@@ -9461,6 +9661,24 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                           : {}),
                       }
                     : {}),
+                  ...(toolRetryPolicy?.requiresExecutionFence === true
+                    ? {
+                        providerIdempotencyReceiptKey:
+                          cacheableToolResult && operationKey
+                            ? operationKey
+                            : physicalDirectKey,
+                        providerIdempotencyKey:
+                          this.providerIdempotencyKeyForToolCall({
+                            cacheKey:
+                              useDirectResultReceipts && operationKey
+                                ? providerIdempotencyKeyBase
+                                : physicalDirectKey,
+                            force: cacheableToolResult && toolCachePolicy.force,
+                            leaseId: directReceiptLeaseId,
+                            logicalCallId,
+                          }),
+                      }
+                    : {}),
                   playNodeScope: buildPlayNodeScope({
                     toolId,
                     callKey: normalizedKey,
@@ -9485,14 +9703,14 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 execution: toolExecutionMetadataForOutcome({
                   kind: 'live',
                   cacheKey: directCacheKey,
-                  ...(cacheableToolResult
+                  ...(useDirectResultReceipts
                     ? { receiptKey: resultReceiptKey }
                     : {}),
                 }),
               });
             },
           };
-          const toolCall = cacheableToolResult
+          const toolCall = useDirectResultReceipts
             ? createToolCallJob({
                 resultReceipts: createRuntimeStepToolResultReceipts({
                   store: this.durableReceiptExecutionStore(),
@@ -9500,7 +9718,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   ...(initialDirectReceipt !== undefined
                     ? {
                         initialReceipt: {
-                          key: directCacheKey,
+                          key: directResultReceiptKey,
                           receipt: initialDirectReceipt,
                         },
                       }
@@ -9511,6 +9729,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     ? {
                         executionLock: {
                           required: true,
+                          key: providerOperationKey,
                           ttlMs: Math.min(
                             600_000,
                             resolveToolRuntimeTimeoutMs(
@@ -9573,11 +9792,16 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               })
             : await createAlwaysFreshToolCallAdapter({ dispatcher }).call(call);
           settleDirectCall(toolAttemptOutcomeForResult(wrapped));
-          if (cacheableToolResult) {
-            this.cacheToolResult(toolId, directCacheKey, wrapped, 'direct');
+          if (useDirectResultReceipts) {
+            this.cacheToolResult(
+              toolId,
+              directResultReceiptKey,
+              wrapped,
+              'direct',
+            );
             this.#options.onBatchComplete?.(this.checkpoint);
           }
-          return wrapped;
+          return this.materializeToolExecutionResult(wrapped);
         } catch (error) {
           settleDirectCall('failed', error);
           throw error;
@@ -9610,18 +9834,23 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           ? null
           : this.getCachedToolResultCandidate(toolId, checkpointCacheKeys);
       if (cached) {
-        this.log(`  Row ${rowId} ${toolId}: recovered from checkpoint`);
-        return await this.wrapToolExecutionResult({
-          toolId,
-          status: cached.result.result == null ? 'no_result' : 'completed',
-          result: cached.result.result,
-          requestInput: input,
-          execution: toolExecutionMetadataForOutcome({
-            kind: 'checkpoint',
-            cacheKey: cached.cacheKey,
+        this.runtimeLog(`  Row ${rowId} ${toolId}: recovered from checkpoint`);
+        return this.materializeToolExecutionResult(
+          await this.wrapToolExecutionResult({
+            toolId,
+            status: cached.result.result == null ? 'no_result' : 'completed',
+            result: cached.result.result,
+            requestInput: input,
+            execution: toolExecutionMetadataForOutcome({
+              kind: 'checkpoint',
+              cacheKey: cached.cacheKey,
+            }),
           }),
-        });
+        );
       }
+      const rowToolRetryPolicy = await this.#options
+        .getToolRetryPolicy?.(toolId, input)
+        .catch(() => null);
 
       // ADR 0018: record this leg before it runs. `producer` still names the
       // last leg (the usual cascade winner); `producers` keeps every leg, which
@@ -9676,7 +9905,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           providerIdempotencyKeyBase,
           cacheable: cacheableToolResult,
           receiptKey: cacheableToolResult ? durableCacheKey : null,
+          legacyReceiptKeys: legacyDurableCacheKey
+            ? [legacyDurableCacheKey]
+            : [],
           executionAuthScopeDigest,
+          requiresExecutionFence:
+            rowToolRetryPolicy?.requiresExecutionFence === true,
           force: toolCachePolicy.force,
           forceFailedRefresh: toolCachePolicy.forceFailedRefresh,
           rowId,
@@ -9696,7 +9930,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       return await pendingToolCall.then(
         (value) => {
           settleProducerAttempt(toolAttemptOutcomeForResult(value));
-          return value;
+          return this.materializeToolExecutionResult(
+            value as ToolExecuteResult,
+          );
         },
         (error: unknown) => {
           settleProducerAttempt('failed');
@@ -9730,7 +9966,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         // of a silent continuation: the credential identity changed after the
         // receipt key was prepared, so we evict the cached digest, re-resolve,
         // and re-claim a fresh receipt under the new scope before retrying once.
-        this.log(
+        this.runtimeLog(
           `ctx.tools.execute(${toolId}): auth_scope_changed_reclaim ` +
             `(label: ${normalizedKey}); credential identity changed mid-run, ` +
             `re-resolving auth scope and re-claiming a fresh receipt under the ` +
@@ -9745,16 +9981,21 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           executionAuthScopeDigest,
           staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
         });
-        providerIdempotencyKeyBase = await this.durableToolCallCacheKey(
-          {
-            toolId,
-            requestInput: input,
-            executionAuthScopeDigest,
-            staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
-          },
-          null,
+        legacyDurableCacheKey = await this.legacyDurableToolCallCacheKey({
+          toolId,
+          requestInput: input,
+          executionAuthScopeDigest,
+          staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
+        });
+        providerIdempotencyKeyBase = durableCacheKey;
+        directResultReceiptKey = durableCacheKey;
+        bypassDirectResultCache = false;
+        checkpointCacheKeys.splice(
+          0,
+          checkpointCacheKeys.length,
+          durableCacheKey,
+          ...(legacyDurableCacheKey ? [legacyDurableCacheKey] : []),
         );
-        checkpointCacheKeys[0] = durableCacheKey;
       }
     }
 
@@ -9801,7 +10042,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     const existing =
       this.checkpoint.resolvedBoundaries?.[preparedBoundary.boundaryId];
     if (existing?.kind === 'integration_event' && 'output' in existing) {
-      this.log(
+      this.runtimeLog(
         `Integration event ${preparedBoundary.boundaryId}: recovered response from checkpoint`,
       );
       // Wrapped like every other tool result (toolOutput.raw, getters) — the
@@ -9824,7 +10065,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       boundary: preparedBoundary,
     });
 
-    this.log(
+    this.runtimeLog(
       `Armed ${handler.provider} integration event wait: ${boundary.eventKey}`,
     );
     this.checkpoint.resolvedBoundaries = {
@@ -9936,7 +10177,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       execution: options?.execution,
       childPlayName: resolvedName,
     });
-    this.log(
+    this.runtimeLog(
       `ctx.runPlay(${normalizedKey}): ${childExecutionDecision.strategy} (${childExecutionDecision.reason})`,
     );
 
@@ -10182,22 +10423,89 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       });
   }
 
-  log(msg: string): void {
+  log(msg: string, options?: { level?: LogLevel }): void {
     assertNoSecretTaint(msg, 'ctx.log');
-    const line = `[${new Date().toISOString()}] ${this.secretRedactor.redactRegisteredSecrets(msg)}`;
+    const requestedLevel = options?.level;
+    if (requestedLevel !== undefined && !LOG_LEVELS.includes(requestedLevel)) {
+      throw new Error(
+        `ctx.log level must be one of: ${LOG_LEVELS.join(', ')}.`,
+      );
+    }
+    const level = requestedLevel ?? 'info';
+    const timestamped = `[${new Date().toISOString()}] ${this.secretRedactor.redactRegisteredSecrets(msg)}`;
+    // Stamp the default too: a customer message that happens to begin with
+    // "[error]" is still info unless the author selected a higher severity.
+    const line = tagLogEntry('user', level, timestamped);
+    if (!this.shouldKeepRateLimitedLog(level)) return;
     this.logBuffer.push(line);
     this.#options.onLog?.(line);
     if (this.#options.verbose) console.log(line);
   }
 
+  /**
+   * Runtime-owned progress and failure narration must stay durable even when
+   * authored per-row logs are being sampled. Preserve the untagged historical
+   * wire shape by default: several runtime diagnostics contain trailing JSON
+   * consumed by older readers. Callers may opt into an explicit severity.
+   */
+  private runtimeLog(msg: string, options?: { level?: LogLevel }): void {
+    assertNoSecretTaint(msg, 'runtime log');
+    const timestamped = `[${new Date().toISOString()}] ${this.secretRedactor.redactRegisteredSecrets(msg)}`;
+    const line = options?.level
+      ? tagLogLevel(timestamped, options.level)
+      : timestamped;
+    this.logBuffer.push(line);
+    this.#options.onLog?.(line);
+    if (this.#options.verbose) console.log(line);
+  }
+
+  /** Rate-limit chatty authored logs before they consume the live stream or durable retention. */
+  private shouldKeepRateLimitedLog(level: LogLevel): boolean {
+    if (level === 'warn' || level === 'error') return true;
+    const policy = LOG_RATE_LIMIT_POLICY[level];
+    const state = this.logRateLimitState.get(level) ?? {
+      seen: 0,
+      sampled: 0,
+      suppressed: 0,
+    };
+    state.seen += 1;
+    const keep = state.seen <= policy.first || state.seen % policy.every === 0;
+    if (keep) {
+      if (state.seen > policy.first) state.sampled += 1;
+      this.logRateLimitState.set(level, state);
+      return true;
+    }
+    state.suppressed += 1;
+    this.logRateLimitState.set(level, state);
+    if (
+      state.suppressed === 1 ||
+      state.suppressed % LOG_RATE_LIMIT_MARKER_EVERY === 0
+    ) {
+      const marker = `[log rate limited: level=${level} retained=${policy.first + state.sampled} sampled=${state.sampled} suppressed=${state.suppressed}; showing first ${policy.first}, then 1 every ${policy.every}]`;
+      const line = tagLogEntry(
+        'diagnostic',
+        'warn',
+        `[${new Date().toISOString()}] ${marker}`,
+      );
+      this.logBuffer.push(line);
+      this.#options.onLog?.(line);
+      if (this.#options.verbose) console.log(line);
+    }
+    return false;
+  }
+
   /**
    * Emit a runtime-authored diagnostic through the same durable log path as
    * ctx.log without changing the customer-authored log wire format.
    */
-  private runtimeDiagnosticLog(message: string): void {
+  private runtimeDiagnosticLog(
+    message: string,
+    level: LogLevel = 'warn',
+  ): void {
     assertNoSecretTaint(message, 'runtime diagnostic log');
-    const line = tagLogProvenance(
+    const line = tagLogEntry(
       'diagnostic',
+      level,
       `[${new Date().toISOString()}] ${this.secretRedactor.redactRegisteredSecrets(message)}`,
     );
     this.logBuffer.push(line);
@@ -10438,7 +10746,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             existing?.kind === 'fetch' &&
             'output' in existing
           ) {
-            this.log(`ctx.fetch(${url}): recovered response from checkpoint`);
+            this.runtimeLog(
+              `ctx.fetch(${url}): recovered response from checkpoint`,
+            );
             const checkpointOutput = existing.output as PlayFetchResponse;
             if (!checkpointOutput.ok) {
               this.logCtxFetchHttpFailure({
@@ -10556,7 +10866,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   canRetryTransport &&
                   attempt < FETCH_TRANSPORT_MAX_ATTEMPTS
                 ) {
-                  this.log(
+                  this.runtimeLog(
                     `ctx.fetch(${method} ${url}) transport failed on attempt ${attempt}/${FETCH_TRANSPORT_MAX_ATTEMPTS}; retrying: ${message}`,
                   );
                   await sleepWithinCtxFetchDeadline({
@@ -10665,7 +10975,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     const executeStep = async (): Promise<T> => {
       const existing = this.checkpoint.resolvedBoundaries?.[boundaryId];
       if (existing?.kind === 'step' && 'output' in existing) {
-        this.log(
+        this.runtimeLog(
           `ctx.step(${normalizedKey}): recovered result from checkpoint`,
         );
         return existing.output as T;
@@ -10869,7 +11179,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         leaseLost ??= error;
       },
       onTransientFailure: (error) => {
-        this.log(
+        this.runtimeLog(
           `Pending tool receipt heartbeat transport failed; retrying: ${error instanceof Error ? error.message : String(error)}`,
         );
       },
@@ -10914,75 +11224,59 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   /**
    * Concrete RuntimeStepReceipt adapter for the map receipt-cohort Module.
    *
-   * It is intentionally shared by scalar and provider-native map calls. The
-   * two call shapes differ at provider dispatch, not at the member receipt
-   * protocol: both need an atomic claim/reclaim, a single cohort heartbeat,
-   * and lease-fenced terminal fanout. Keeping that at one seam prevents a
-   * native batch from becoming a second, subtly different receipt runtime.
+   * Scalar and provider-native map calls share completed-result cache reads
+   * and atomic successful inserts. A miss has no durable execution owner.
    */
   private createRuntimeStepToolCallReceiptCohortStore(input: {
     toolId: string;
     requestForReceipt: ReadonlyMap<string, ToolCallRequest>;
   }): ToolCallReceiptCohortStore {
     const asRecord = async (
-      receiptKey: string,
+      resultReceiptKey: string,
+      storedReceiptKey: string,
       receipt: RuntimeStepReceipt | null | undefined,
     ): Promise<ToolCallReceiptRecord | null> => {
       if (!receipt) return null;
-      const normalized = this.normalizeRuntimeStepReceipt(receiptKey, receipt);
+      const normalized = this.normalizeRuntimeStepReceipt(
+        storedReceiptKey,
+        receipt,
+      );
       if (!normalized) return null;
-      const request = input.requestForReceipt.get(receiptKey);
+      if (
+        normalized.status !== 'completed' &&
+        normalized.status !== 'skipped'
+      ) {
+        return null;
+      }
+      // A terminal acknowledgement without output is not a cache hit. The
+      // completion path hydrates it first; if that read cannot provide an
+      // output, retain the live result rather than resolving `undefined`.
+      if (normalized.output === undefined) return null;
+      const request = input.requestForReceipt.get(resultReceiptKey);
       if (!request) {
         throw new Error(
-          `Unknown Tool Call Receipt Cohort receipt ${receiptKey}.`,
+          `Unknown Tool Call Receipt Cohort receipt ${resultReceiptKey}.`,
         );
       }
-      const terminal =
-        normalized.status === 'completed' || normalized.status === 'skipped';
-      const result = terminal
-        ? await this.wrapToolExecutionResult({
-            toolId: input.toolId,
-            status:
-              normalized.output === null || normalized.output === undefined
-                ? 'no_result'
-                : 'completed',
-            result: this.runtimeReceiptOutput(normalized),
-            requestInput: request.input,
-            execution: toolExecutionMetadataForOutcome({
-              kind: 'cache',
-              cacheKey: request.cacheKey,
-              receiptKey,
-              attachedToReceiptKey: receiptKey,
-            }),
-          })
-        : undefined;
+      const result = await this.wrapToolExecutionResult({
+        toolId: input.toolId,
+        status:
+          normalized.output === null || normalized.output === undefined
+            ? 'no_result'
+            : 'completed',
+        result: this.runtimeReceiptOutput(normalized),
+        requestInput: request.input,
+        execution: toolExecutionMetadataForOutcome({
+          kind: 'cache',
+          cacheKey: request.cacheKey,
+          receiptKey: resultReceiptKey,
+          attachedToReceiptKey: storedReceiptKey,
+        }),
+      });
       return {
-        resultReceiptKey: receiptKey,
+        resultReceiptKey,
         status: normalized.status,
-        ...(result !== undefined ? { result } : {}),
-        ...(normalized.status === 'failed'
-          ? {
-              error: runtimeReceiptFailureError(
-                normalized,
-                'Durable tool call failed',
-                this.currentToolErrorSchemaVersion,
-              ),
-            }
-          : {}),
-        ...(normalized.leaseId &&
-        (normalized.leaseOwnerRunId ?? normalized.runId)?.trim()
-          ? {
-              lease: {
-                leaseId: normalized.leaseId,
-                ownerRunId: (normalized.leaseOwnerRunId ??
-                  normalized.runId)!.trim(),
-              },
-            }
-          : {}),
-        ...(normalized.leaseExpiresAt
-          ? { leaseExpiresAt: normalized.leaseExpiresAt }
-          : {}),
-        ...(normalized.claimState ? { claimState: normalized.claimState } : {}),
+        result,
       };
     };
     const recordsFor = async (
@@ -10991,10 +11285,22 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     ): Promise<ToolCallReceiptRecord[]> =>
       (
         await Promise.all(
-          receiptKeys.map(
-            async (receiptKey) =>
-              await asRecord(receiptKey, receipts.get(receiptKey)),
-          ),
+          receiptKeys.map(async (receiptKey) => {
+            const request = input.requestForReceipt.get(receiptKey);
+            const candidates = [
+              receiptKey,
+              ...(request?.legacyReceiptKeys ?? []),
+            ];
+            for (const candidate of candidates) {
+              const record = await asRecord(
+                receiptKey,
+                candidate,
+                receipts.get(candidate),
+              );
+              if (record) return record;
+            }
+            return null;
+          }),
         )
       ).filter((record): record is ToolCallReceiptRecord => record !== null);
 
@@ -11004,83 +11310,17 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           async () =>
             await recordsFor(
               resultReceiptKeys,
-              await this.getRuntimeStepReceipts(resultReceiptKeys),
+              await this.getRuntimeStepReceipts(
+                [...new Set(
+                  resultReceiptKeys.flatMap((receiptKey) => [
+                    receiptKey,
+                    ...(input.requestForReceipt.get(receiptKey)
+                      ?.legacyReceiptKeys ?? []),
+                  ]),
+                )],
+              ),
             ),
         ),
-      claim: async ({ receipts }) => {
-        const claims = new Map<string, RuntimeStepReceipt>();
-        const groups = new Map<string, Array<(typeof receipts)[number]>>();
-        for (const receipt of receipts) {
-          const groupKey = [
-            receipt.reclaimRunning ? 'reclaim' : 'ordinary',
-            receipt.force ? 'force' : 'cached',
-            receipt.forceFailedRefresh ? 'failed-force' : 'failed-cached',
-          ].join(':');
-          const group = groups.get(groupKey) ?? [];
-          group.push(receipt);
-          groups.set(groupKey, group);
-        }
-        for (const group of groups.values()) {
-          const first = group[0]!;
-          const claimed = await this.claimRuntimeStepReceipts(
-            group.map((receipt) => receipt.resultReceiptKey),
-            this.currentReceiptOwnerRunId,
-            first.reclaimRunning,
-            first.force,
-            first.forceFailedRefresh,
-          );
-          for (const [key, receipt] of claimed) claims.set(key, receipt);
-        }
-        const safeFailedKeys = receipts.flatMap((receipt) => {
-          const claimed = claims.get(receipt.resultReceiptKey);
-          return claimed && this.canRetryWithoutProviderDispatch(claimed)
-            ? [receipt.resultReceiptKey]
-            : [];
-        });
-        if (safeFailedKeys.length > 0) {
-          const refreshed = await this.claimRuntimeStepReceipts(
-            safeFailedKeys,
-            this.currentReceiptOwnerRunId,
-            false,
-            false,
-            true,
-          );
-          for (const [key, receipt] of refreshed) claims.set(key, receipt);
-        }
-        return await recordsFor(
-          receipts.map((receipt) => receipt.resultReceiptKey),
-          claims,
-        );
-      },
-      heartbeat: async ({ receipts }) => {
-        if (!this.#options.heartbeatRuntimeStepReceipts) {
-          return await recordsFor(
-            receipts.map((receipt) => receipt.resultReceiptKey),
-            await this.getRuntimeStepReceipts(
-              receipts.map((receipt) => receipt.resultReceiptKey),
-            ),
-          );
-        }
-        const response = await this.#options.heartbeatRuntimeStepReceipts({
-          runId: this.currentReceiptOwnerRunId,
-          runAttempt: this.currentRunAttempt,
-          keys: receipts.map((receipt) => receipt.resultReceiptKey),
-          leaseIds: receipts.map((receipt) => receipt.lease.leaseId),
-        });
-        const byKey = new Map<string, RuntimeStepReceipt>();
-        for (let index = 0; index < receipts.length; index += 1) {
-          const request = receipts[index]!;
-          const normalized = this.normalizeRuntimeStepReceipt(
-            request.resultReceiptKey,
-            response[index],
-          );
-          if (normalized) byKey.set(request.resultReceiptKey, normalized);
-        }
-        return await recordsFor(
-          receipts.map((receipt) => receipt.resultReceiptKey),
-          byKey,
-        );
-      },
       complete: async ({ receipts }) => {
         const completed = await this.completeRuntimeStepReceipts(
           receipts.map((receipt) => ({
@@ -11095,33 +11335,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           completed,
         );
       },
-      fail: async ({ receipts }) => {
-        const failed = await this.failRuntimeStepReceipts(
-          receipts.map((receipt) => ({
-            key: receipt.resultReceiptKey,
-            runId: this.currentReceiptOwnerRunId,
-            leaseId: receipt.lease.leaseId,
-            error: this.formatRuntimeError(receipt.error),
-            errorPayload: serializeToolExecutionFailure(receipt.error),
-            failureKind: runtimeReceiptFailureKindForError(receipt.error),
-          })),
-        );
-        return await recordsFor(
-          receipts.map((receipt) => receipt.resultReceiptKey),
-          failed,
-        );
-      },
     };
   }
 
   /**
-   * The scalar map path used to duplicate the receipt state machine in
-   * `executeBatchedToolCalls`: one loop claimed/reclaimed/followed rows and a
-   * later loop heartbeated and completed them.  That made it too easy for the
-   * Tool Call boundary to be only cosmetic.  This is the narrow replacement
-   * slice: cacheable members of a *non-native* map hand their whole receipt
-   * lifecycle to the cohort Module, while this Context remains only the
-   * transport/presentation Adapter.
+   * Cacheable scalar map members share completed-result reads and successful
+   * writes through the cohort Module. This Context only transports and
+   * presents results.
    *
    * Do not widen this to physical native batches or always-fresh calls. A
    * native batch owns a different aggregate operation receipt, and
@@ -11211,7 +11431,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         cohortLeaseLost ??= error;
       },
       onTransientFailure: (error) => {
-        this.log(
+        this.runtimeLog(
           `Tool Call Receipt Cohort heartbeat transport failed; retrying: ${
             error instanceof Error ? error.message : String(error)
           }`,
@@ -11223,7 +11443,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     const resolve = async (
       request: ToolCallRequest,
       result: ToolExecuteResult,
-      source: 'cache' | 'in_flight' | 'owner',
+      source: 'cache' | 'owner',
     ): Promise<void> => {
       const receiptKey = request.receiptKey!;
       const finalResult = cloneToolExecuteResultWithExecution(
@@ -11258,180 +11478,111 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     };
     const reject = async (request: ToolCallRequest, error: unknown) => {
       await this.rejectToolCall(toolId, request, error, {
-        // ToolCallReceiptCohort is the one failure writer. Re-entering the
-        // legacy writer here would race its member terminal transition.
+        // Failures are never cache entries, including failed local misses.
         persistReceiptFailure: false,
       });
     };
 
-    try {
-      const handled = new Set<string>();
-      const followOrRecover: Promise<void>[] = [];
-      const collectReadyMembers = (): Array<{
+    const handled = new Set<string>();
+    const followerResults: Promise<void>[] = [];
+    const collectReadyMembers = (): Array<{
+      request: ToolCallRequest;
+      receipts: ToolResultReceipts;
+    }> => {
+      const owned: Array<{
         request: ToolCallRequest;
         receipts: ToolResultReceipts;
-      }> => {
-        const owned: Array<{
-          request: ToolCallRequest;
-          receipts: ToolResultReceipts;
-        }> = [];
-        for (const request of requests) {
-          if (handled.has(request.callId)) continue;
-          const member = cohort.member(request.callId);
-          if (member.kind === 'recovering') continue;
-          handled.add(request.callId);
-          if (member.kind === 'completed') {
-            followOrRecover.push(
-              resolve(request, member.result, member.source),
-            );
-          } else if (member.kind === 'failed') {
-            followOrRecover.push(reject(request, member.error));
-          } else if (member.kind === 'following') {
-            followOrRecover.push(
-              member.result.then(
-                async (result) => await resolve(request, result, 'in_flight'),
-                async (error: unknown) => await reject(request, error),
-              ),
-            );
-          } else {
-            request.receiptLeaseId = member.lease.leaseId;
-            request.receiptLeaseExpiresAt = member.leaseExpiresAt ?? null;
-            owned.push({ request, receipts: member.receipts });
-          }
+      }> = [];
+      for (const request of requests) {
+        if (handled.has(request.callId)) continue;
+        const member = cohort.member(request.callId);
+        handled.add(request.callId);
+        if (member.kind === 'completed') {
+          followerResults.push(resolve(request, member.result, member.source));
+        } else if (member.kind === 'following') {
+          followerResults.push(
+            member.result.then(
+              async (result) => await resolve(request, result, 'owner'),
+              async (error: unknown) => await reject(request, error),
+            ),
+          );
+        } else {
+          owned.push({ request, receipts: member.receipts });
         }
-        return owned;
-      };
+      }
+      return owned;
+    };
 
-      const width = Math.min(
-        this.governor.policy.concurrency.toolCalls,
-        Math.max(
-          1,
-          await this.resourceGovernor.suggestedToolParallelism(
-            toolId,
-            this.governor.policy.concurrency.toolCalls,
-          ),
+    const width = Math.min(
+      this.governor.policy.concurrency.toolCalls,
+      Math.max(
+        1,
+        await this.resourceGovernor.suggestedToolParallelism(
+          toolId,
+          this.governor.policy.concurrency.toolCalls,
         ),
-      );
-      const dispatchOwned = async (
-        owned: Array<{
-          request: ToolCallRequest;
-          receipts: ToolResultReceipts;
-        }>,
-      ) =>
-        await dispatchBoundedSettled(
-          owned,
-          width,
-          async ({ request, receipts }) => {
-            if (this.persistenceLatch.tripped) {
-              const error = new RuntimePersistenceCircuitOpenError(
-                this.persistenceLatch,
-              );
-              await cohort.fail([{ memberId: request.callId, error }]);
-              throw error;
-            }
-            let releaseToolSlot: () => void = () => undefined;
-            try {
-              const result = await this.executeMappedToolCallThroughModule({
-                request,
-                dispatchToolId: toolId,
-                dispatchPayload: request.input,
-                resultReceiptKey: request.receiptKey!,
-                providerOperationKey:
-                  request.providerIdempotencyKeyBase ?? request.receiptKey!,
-                resultReceipts: receipts,
-                apiOptions: {
-                  beforeProviderCall: () => {
-                    if (cohortLeaseLost) throw cohortLeaseLost;
-                    heartbeat.assertOwned();
-                  },
-                  heartbeatReceipt: async () => {
-                    try {
-                      const outcome = await cohort.heartbeat();
-                      if (outcome === 'terminal') {
-                        throw new ToolCallReceiptLeaseLostError(
-                          request.receiptKey!,
-                        );
-                      }
-                    } catch (error) {
-                      if (error instanceof ToolCallReceiptLeaseLostError) {
-                        throw new RuntimeReceiptLeaseLostError({
-                          receiptKey: request.receiptKey!,
-                          runId: this.currentReceiptOwnerRunId,
-                          leaseId:
-                            request.receiptLeaseId ?? 'missing-cohort-lease',
-                        });
-                      }
-                      throw error;
-                    }
-                  },
-                  playNodeScope: playNodeScopeForToolCallRequest(request),
-                  durableCallReceiptKey: request.receiptKey,
-                  executionAuthScopeDigest: request.executionAuthScopeDigest,
-                  providerIdempotencyReceiptKey:
-                    request.providerIdempotencyKeyBase ?? request.receiptKey,
-                  providerIdempotencyKey:
-                    this.providerIdempotencyKeyForToolCall({
-                      cacheKey:
-                        request.providerIdempotencyKeyBase ??
-                        request.receiptKey!,
-                      force: request.force === true,
-                      leaseId: request.receiptLeaseId,
-                      logicalCallId: request.logicalCallId,
-                    }),
-                  receiptLeaseExpiresAt: request.receiptLeaseExpiresAt,
-                  timeoutMs:
-                    typeof request.timeoutMs === 'number' &&
-                    request.timeoutMs > 0
-                      ? request.timeoutMs
-                      : undefined,
-                  retainToolSlot: (release) => {
-                    releaseToolSlot = release;
-                  },
+      ),
+    );
+    const dispatchOwned = async (
+      owned: Array<{
+        request: ToolCallRequest;
+        receipts: ToolResultReceipts;
+      }>,
+    ) =>
+      await dispatchBoundedSettled(
+        owned,
+        width,
+        async ({ request, receipts }) => {
+          if (this.persistenceLatch.tripped) {
+            const error = new RuntimePersistenceCircuitOpenError(
+              this.persistenceLatch,
+            );
+            throw error;
+          }
+          let releaseToolSlot: () => void = () => undefined;
+          try {
+            const result = await this.executeMappedToolCallThroughModule({
+              request,
+              dispatchToolId: toolId,
+              dispatchPayload: request.input,
+              resultReceiptKey: request.receiptKey!,
+              providerOperationKey:
+                request.providerIdempotencyKeyBase ?? request.receiptKey!,
+              resultReceipts: receipts,
+              apiOptions: {
+                playNodeScope: playNodeScopeForToolCallRequest(request),
+                durableCallReceiptKey: request.receiptKey,
+                completedResultCache: true,
+                executionAuthScopeDigest: request.executionAuthScopeDigest,
+                timeoutMs:
+                  typeof request.timeoutMs === 'number' && request.timeoutMs > 0
+                    ? request.timeoutMs
+                    : undefined,
+                retainToolSlot: (release) => {
+                  releaseToolSlot = release;
                 },
-              });
-              await resolve(request, result, 'owner');
-            } catch (error) {
-              await reject(request, error);
-            } finally {
-              releaseToolSlot();
-            }
-          },
-        );
+              },
+            });
+            await resolve(request, result, 'owner');
+          } catch (error) {
+            await reject(request, error);
+          } finally {
+            releaseToolSlot();
+          }
+        },
+      );
 
-      // Eager cohort acquisition makes the initial claim available before a
-      // foreign receipt's read/reclaim path completes. This preserves map
-      // overlap: a broken foreign read must not strand an already-owned
-      // provider operation behind it.
-      const initialDispatch = dispatchOwned(collectReadyMembers());
-      const settlement = cohort.settle();
-      const [initialResult, settlementResult] = await Promise.allSettled([
-        initialDispatch,
-        settlement,
-      ]);
-      // A recovery can reclaim an expired receipt and turn it into another
-      // owned member. Collect its final state after the initial work settles.
-      const recoveredDispatch = await dispatchOwned(collectReadyMembers());
-      await Promise.allSettled(followOrRecover);
-      // dispatchBoundedSettled intentionally captures provider failures; all
-      // affected row resolvers have already been rejected above.
-      void initialResult;
-      void recoveredDispatch;
-      if (settlementResult.status === 'rejected') {
-        throw settlementResult.reason;
-      }
-    } finally {
-      heartbeat.stop();
-    }
+    await dispatchOwned(collectReadyMembers());
+    await Promise.allSettled(followerResults);
     return successful;
   }
 
   /**
    * Executes provider-native batches through the Native Batch Tool Call
-   * Module. Unlike the compatibility path below, the Module owns the member
-   * receipt cohort from claim through recovery, heartbeat and terminal split
-   * fanout. This method is only the runtime Adapter: it compiles provider
-   * payloads, invokes transport, and presents already-terminal member values
-   * to map rows.
+   * Module. The Module reads exact completed-result cache entries, batches
+   * misses, then publishes each successful split result. This Context only
+   * compiles provider payloads, invokes transport, and presents terminal
+   * member values to map rows.
    */
   private async executeCacheableNativeMapToolCallCohort(input: {
     toolId: string;
@@ -11486,9 +11637,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             batchParallelismCeiling,
           )
         : batchParallelismCeiling;
-    const batchProviderActionVersion =
-      (await this.#options.getToolActionCacheVersion?.(toolId))?.trim() ??
-      'unversioned';
     const successful: ToolCallRequest[] = [];
 
     const deliver = (request: ToolCallRequest, result: ToolExecuteResult) => {
@@ -11518,7 +11666,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     };
     const reject = async (request: ToolCallRequest, error: unknown) => {
       await this.rejectToolCall(toolId, request, error, {
-        // NativeBatchToolCall owns the durable member failure transition.
+        // Failed provider calls are never cache entries.
         persistReceiptFailure: false,
       });
     };
@@ -11580,15 +11728,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     call.payload,
                     {
                       durableCallReceiptKey: compatibility.resultReceiptKey,
+                      completedResultCache: true,
                       playNodeScope: playNodeScopeForToolCallRequest(
                         detail.members[0]!,
                         call.tool.id,
                       ),
                       executionAuthScopeDigest:
                         detail.members[0]?.executionAuthScopeDigest ?? null,
-                      providerIdempotencyReceiptKey:
-                        detail.providerOperationKey,
-                      providerIdempotencyKey: detail.providerOperationKey,
                       receiptLeaseExpiresAt: detail.receiptLeaseExpiresAt,
                       timeoutMs: detail.timeoutMs,
                     },
@@ -11656,8 +11802,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               },
               compatibility: {
                 resultReceiptKey: request.receiptKey!,
-                providerOperationKey:
-                  request.providerIdempotencyKeyBase ?? request.receiptKey!,
+                providerOperationKey: request.receiptKey!,
               },
             },
           })),
@@ -11680,27 +11825,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 'Native batch owned members changed provider operation during compilation.',
               );
             }
-            const providerOperationKey =
-              buildDurableToolPayloadProviderIdempotencyKey({
-                orgId: this.#options.orgId,
-                toolId: batch.batchOperation,
-                executionAuthScopeDigest:
-                  owned[0]?.executionAuthScopeDigest ?? null,
-                providerActionVersion: batchProviderActionVersion,
-                payload: compiled.batchPayload,
-                forceRefreshIdentities: owned
-                  .filter((request) => request.force === true)
-                  .map((request) =>
-                    this.providerIdempotencyKeyForToolCall({
-                      cacheKey:
-                        request.providerIdempotencyKeyBase ??
-                        request.receiptKey!,
-                      force: true,
-                      leaseId: request.receiptLeaseId,
-                      logicalCallId: request.logicalCallId,
-                    }),
-                  ),
-              });
+            const providerOperationKey = aggregateReceiptKey;
             dispatchDetails.set(aggregateReceiptKey, {
               members: owned,
               compiled,
@@ -11790,8 +11915,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     toolResponse: publicToolResponseForBatchedItem(
                       aggregate,
                       item,
-                      this.currentToolResponseContract ===
-                        RAW_V2_TOOL_RESPONSE_CONTRACT,
+                      true,
                     ),
                     requestInput: request.input,
                     execution: toolExecutionMetadataForOutcome({
@@ -11804,60 +11928,22 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               }),
             );
           },
-          heartbeat: {
-            // Claim replies carry the real expiry. A fixed fallback interval
-            // can be too slow for a short-lived gateway lease, so derive the
-            // one cohort supervisor from the earliest owned member instead.
-            intervalMs: ({ members }) =>
-              Math.max(
-                1,
-                Math.floor(
-                  runtimeLeaseHeartbeatIntervalFromExpiry({
-                    leaseExpiresAt: members.reduce<string | null>(
-                      (earliest, member) => {
-                        const expiresAt = member.leaseExpiresAt ?? null;
-                        if (!expiresAt) return earliest;
-                        if (!earliest) return expiresAt;
-                        return Date.parse(expiresAt) < Date.parse(earliest)
-                          ? expiresAt
-                          : earliest;
-                      },
-                      null,
-                    ),
-                    fallbackTtlMs: PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
-                  }) / 2,
-                ),
-              ),
-            onTransientFailure: (error) => {
-              this.log(
-                `Native Tool Call Receipt Cohort heartbeat transport failed; retrying: ${
-                  error instanceof Error ? error.message : String(error)
-                }`,
-              );
-            },
-          },
         });
         return { batch, result };
       },
       onChunkComplete: async (entries) => {
         for (const entry of entries) {
           if (entry.error !== undefined) {
-            // The cohort may have recovered each member through its
-            // lease-fenced single-receipt fallback, but that only prevents
-            // duplicate provider work. It must not convert a failed bulk
-            // persistence boundary into a successful map result: callers need
-            // the loud failure so this run can be retried from the durable
-            // receipts instead of continuing after an ambiguous bulk write.
+            // A failed batch is not a cache entry. Surface it to every row so
+            // a later run can make a fresh provider attempt.
             for (const request of entry.request.memberRequests) {
               await reject(request, entry.error);
             }
             throw entry.error;
           }
           if (!entry.result) {
-            // The NativeBatchToolCall already attempted a lease-fenced failure
-            // fanout. Read the actual durable terminal facts so cache hits in
-            // the same cohort still reach their rows and a stale failure never
-            // causes this Context to write a second terminal transition.
+            // Successful split results must be present in the completed cache
+            // before they are delivered to rows.
             const durable = await store.read({
               resultReceiptKeys: entry.request.memberRequests.map(
                 (request) => request.receiptKey!,
@@ -11878,8 +11964,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               } else {
                 await reject(
                   request,
-                  record?.error ??
-                    entry.error ??
+                  entry.error ??
                     new Error(
                       'Native Tool Call did not reach a terminal receipt.',
                     ),
@@ -11918,7 +12003,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
 
     const toolSettlements = await Promise.allSettled(
       [...byTool.entries()].map(async ([toolId, requests]) => {
-        this.log(`Executing tool batch ${toolId}: ${requests.length} calls`);
+        this.runtimeLog(
+          `Executing tool batch ${toolId}: ${requests.length} calls`,
+        );
         const successfulLiveStepCallIds = new Set<string>();
 
         const recordToolStep = (stepRequests: ToolCallRequest[]): void => {
@@ -11973,7 +12060,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 ? undefined
                 : this.getCachedToolResult(toolId, req.cacheKey);
           if (cached?.done) {
-            this.log(`  Row ${req.rowId} ${toolId}: recovered from checkpoint`);
+            this.runtimeLog(
+              `  Row ${req.rowId} ${toolId}: recovered from checkpoint`,
+            );
             const resolver = this.toolCallResolvers.get(req.callId);
             if (resolver) {
               resolver.resolve(cached.result);
@@ -12099,6 +12188,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const cohortRequests = pendingRequests.filter(
             (request) =>
               request.cacheable !== false &&
+              request.requiresExecutionFence !== true &&
               Boolean(request.receiptKey?.trim()),
           );
           if (cohortRequests.length > 0) {
@@ -12131,6 +12221,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const cohortRequests = pendingRequests.filter(
             (request) =>
               request.cacheable !== false &&
+              request.requiresExecutionFence !== true &&
               Boolean(request.receiptKey?.trim()),
           );
           if (cohortRequests.length > 0) {
@@ -12553,7 +12644,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     ),
                   ) || DURABLE_RECEIPT_WAIT_MAX_ATTEMPTS;
                 if (runtimeReceiptReadTraceEnabled) {
-                  this.log(
+                  this.runtimeLog(
                     `[runtime-receipt-wait] phase=start requested=${pendingWaits.size} ` +
                       `request_digests=${[...pendingWaits.keys()]
                         .map(runtimeReceiptKeyDigest)
@@ -12650,7 +12741,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                             : ['unknown'];
                         },
                       );
-                      this.log(
+                      this.runtimeLog(
                         `[runtime-receipt-wait] phase=delivery settled=${deliverySettlements.length} ` +
                           `rejected=${rejected.length} rejected_digests=${rejected.join(',')}`,
                       );
@@ -12957,8 +13048,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                                   : publicToolResponseForBatchedItem(
                                       batchExecution.execution,
                                       splitResults[index] ?? null,
-                                      this.currentToolResponseContract ===
-                                        RAW_V2_TOOL_RESPONSE_CONTRACT,
+                                      true,
                                     ),
                             }),
                           ),
@@ -13114,6 +13204,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                           ...(request.receiptKey
                             ? {
                                 durableCallReceiptKey: request.receiptKey,
+                                completedResultCache: true,
                                 executionAuthScopeDigest:
                                   request.executionAuthScopeDigest,
                                 providerIdempotencyReceiptKey:
@@ -13540,7 +13631,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       );
     }
     if (runtimeReceiptReadTraceEnabled) {
-      this.log(
+      this.runtimeLog(
         `[perf] tool call id=${toolId} phase=governor_admission elapsed_ms=${Date.now() - admissionStartedAt}`,
       );
     }
@@ -13576,6 +13667,19 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             .catch(() => null);
           const retrySafeTransientHttp =
             retryPolicy?.retrySafeTransientHttp === true;
+          const requiresExecutionFence =
+            retryPolicy?.requiresExecutionFence === true;
+          const fixtureReplaySafe = this.#options.integrationMode === 'fixture';
+          const readOnlyQuery = isQueryResultDatasetReadRequest(
+            toolId,
+            toolInputSnapshot,
+          );
+          // A completed result cache eliminates repeated successful work; it
+          // does not prove an ambiguous provider write can be replayed. Only
+          // a read-only query or an action which explicitly declares transient
+          // retries safe may issue another physical request after dispatch.
+          const ambiguousTransportReplayAllowed =
+            readOnlyQuery || retrySafeTransientHttp;
           const invocationOrgId = this.#options.orgId?.trim() ?? '';
           const durableCallReceiptKey =
             options?.durableCallReceiptKey?.trim() ||
@@ -13590,26 +13694,25 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const executionAuthScopeDigest = options?.executionAuthScopeDigest
             ? options.executionAuthScopeDigest.trim() || null
             : ((await this.resolveToolAuthScopeDigest(toolId))?.trim() ?? null);
-          const canonicalOperation = {
-            version: 1 as const,
-            tool_id: toolId,
-            action_version:
-              (
-                await this.#options.getToolActionCacheVersion?.(toolId)
-              )?.trim() || 'unversioned',
-            play_scope: this.currentGovernance.currentPlayId,
-            output_intent: 'dataset',
-          };
-          const providerIdempotencyKey =
-            options?.providerIdempotencyKey?.trim() || durableCallReceiptKey;
+          const executionRequestNonce = crypto.randomUUID();
+          // This identifies one logical tool call to billing. Physical retry
+          // count remains in request metadata, so a transport retry cannot
+          // reserve or charge the same call twice.
+          const deeplineRequestId = `ctx-tool-${stableDigest(executionRequestNonce).slice(0, 32)}`;
+          // The provider operation has a semantic identity independent of
+          // the response receipt. Its key is supplied by the caller that owns
+          // that compatibility contract; never substitute request/billing
+          // attribution for it.
           const providerIdempotencyReceiptKey =
-            options?.providerIdempotencyReceiptKey?.trim() ||
-            durableCallReceiptKey;
-          // Correlation identity is stable across every transport retry,
-          // including calls without a durable receipt.
-          const deeplineRequestId = providerIdempotencyKey
-            ? `ctx-tool-${stableDigest(providerIdempotencyKey).slice(0, 32)}`
-            : `ctx-tool-${crypto.randomUUID()}`;
+            options?.providerIdempotencyReceiptKey?.trim() || null;
+          const providerExecutionFenceKey = requiresExecutionFence
+            ? options?.providerIdempotencyKey?.trim() || null
+            : null;
+          if (requiresExecutionFence && !providerExecutionFenceKey) {
+            throw new Error(
+              `Tool ${toolId} requires a provider execution fence but no provider operation identity was supplied.`,
+            );
+          }
           // Every runtime provider call carries at least a tool-scoped
           // attribution. Callers that know the execution location (row-scoped
           // map cells, batched owners) supply the fuller scope.
@@ -13624,16 +13727,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 ...(requestsDurableInvocationFence
                   ? { invocation_fence_version: 1 }
                   : {}),
-                // Canonical provider-operation receipts validate this semantic
-                // plan before replay. It is intentionally removed from the
-                // legacy byte-receipt fingerprint so mixed runner artifacts
-                // retain their existing provider-once behavior.
-                ...(requestsDurableInvocationFence
-                  ? { canonical_operation: canonicalOperation }
-                  : {}),
-                // The worker-owned receipt coordinates this physical durable
-                // call. Provider idempotency is carried separately below so
-                // exact-payload reuse never replaces batch receipt ownership.
                 ...(durableCallReceiptKey
                   ? {
                       durable_call_receipt_key: durableCallReceiptKey,
@@ -13645,10 +13738,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                         : {}),
                     }
                   : {}),
-                ...(providerIdempotencyReceiptKey
+                ...(providerExecutionFenceKey
                   ? {
-                      provider_idempotency_receipt_key:
-                        providerIdempotencyReceiptKey,
+                      provider_idempotency_key: providerExecutionFenceKey,
+                      ...(providerIdempotencyReceiptKey
+                        ? {
+                            provider_idempotency_receipt_key:
+                              providerIdempotencyReceiptKey,
+                          }
+                        : {}),
                     }
                   : {}),
                 ...(options?.customerDbDataset
@@ -13671,9 +13769,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                         : {}),
                     }
                   : {}),
-                ...(providerIdempotencyKey
-                  ? { provider_idempotency_key: providerIdempotencyKey }
-                  : {}),
                 ...(playNodeScope
                   ? { play_node_scope: playNodeScopeToWire(playNodeScope) }
                   : {}),
@@ -13690,10 +13785,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             elapsedMs: number;
             requestId: string | null;
             aborted: boolean;
+            /** The ingress rejected the request before any provider dispatch. */
+            knownNotDispatched?: boolean;
           }): Promise<void> => {
             transportAttempt += 1;
             const diagnostic = describeTransportError(input.error);
-            this.log(
+            this.runtimeLog(
               `[runtime.transport_failure] ${JSON.stringify({
                 tool_id: toolId,
                 gateway_origin: transportGatewayOriginForDiagnostic(url),
@@ -13705,7 +13802,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 error: diagnostic,
               })}`,
             );
-            if (transportAttempt < TOOL_EXECUTE_TRANSPORT_MAX_ATTEMPTS) {
+            if (
+              transportAttempt < TOOL_EXECUTE_TRANSPORT_MAX_ATTEMPTS &&
+              (input.knownNotDispatched === true ||
+                ambiguousTransportReplayAllowed ||
+                fixtureReplaySafe)
+            ) {
+              invocationAttempt += 1;
               await this.governor.chargeBudget('retry');
               const retryAfterMs =
                 TOOL_RETRY_AFTER_FALLBACK_MS * transportAttempt;
@@ -13713,7 +13816,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 'plays.transport_retry_attempt',
                 transportAttempt,
               );
-              this.log(
+              this.runtimeLog(
                 `Tool ${toolId} transport failed calling ${url} on attempt ${transportAttempt}/${TOOL_EXECUTE_TRANSPORT_MAX_ATTEMPTS}; retrying after ${retryAfterMs}ms: ${diagnostic.message ?? 'unknown transport error'}`,
               );
               await options?.parkProviderCall?.();
@@ -13770,7 +13873,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               const ownershipStartedAt = Date.now();
               await options?.beforeProviderCall?.();
               if (runtimeReceiptReadTraceEnabled) {
-                this.log(
+                this.runtimeLog(
                   `[perf] tool call id=${toolId} phase=before_provider_ownership elapsed_ms=${Date.now() - ownershipStartedAt}`,
                 );
               }
@@ -13795,7 +13898,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                         abortController?.abort(error);
                       },
                       onTransientFailure: (error) => {
-                        this.log(
+                        this.runtimeLog(
                           `Tool ${toolId} receipt heartbeat transport failed; retrying: ${error instanceof Error ? error.message : String(error)}`,
                         );
                       },
@@ -13874,7 +13977,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                           signal: abortController?.signal,
                           onSelected: (value) => {
                             selected = value;
-                            this.log(
+                            this.runtimeLog(
                               `[fixture.response_delay] ${JSON.stringify({
                                 outcome: 'scheduled',
                                 provider: canonicalProvider,
@@ -13889,7 +13992,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                           },
                         });
                       } catch (error) {
-                        this.log(
+                        this.runtimeLog(
                           `[fixture.response_delay] ${JSON.stringify({
                             outcome: 'aborted',
                             provider: canonicalProvider,
@@ -13904,7 +14007,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                         );
                         throw error;
                       }
-                      this.log(
+                      this.runtimeLog(
                         `[fixture.response_delay] ${JSON.stringify({
                           outcome: 'completed',
                           provider: canonicalProvider,
@@ -13934,17 +14037,17 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                         'Content-Type': 'application/json',
                         Authorization: `Bearer ${this.#options.executorToken}`,
                         [EXECUTE_RESPONSE_CONTRACT_HEADER]:
-                          this.currentToolResponseContract,
+                          RAW_V2_TOOL_RESPONSE_CONTRACT,
                         [EXECUTE_RESPONSE_INTENT_HEADER]: 'dataset',
                         [EXECUTE_TOOL_METADATA_HEADER]: 'true',
                         [TOOL_EXECUTION_ERROR_SCHEMA_HEADER]: String(
                           toolErrorSchemaVersion,
                         ),
                         'x-deepline-request-id': deeplineRequestId,
-                        ...(providerIdempotencyKey
+                        ...(providerExecutionFenceKey
                           ? {
                               'x-deepline-idempotency-key':
-                                providerIdempotencyKey,
+                                providerExecutionFenceKey,
                             }
                           : {}),
                         ...protectionHeaders,
@@ -13994,7 +14097,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   runtimeReceiptReadTraceEnabled &&
                   integrationFetchStartedAt !== null
                 ) {
-                  this.log(
+                  this.runtimeLog(
                     `[perf] tool call id=${toolId} phase=integration_fetch_body elapsed_ms=${Date.now() - integrationFetchStartedAt} status=${response.status}`,
                   );
                 }
@@ -14046,44 +14149,19 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 (response === null ||
                   error instanceof ToolExecuteResponseBodyTransportError ||
                   error instanceof ToolExecuteInvalidJsonError);
-              const hasDurableInvocationIdentity = Boolean(
-                durableCallReceiptKey &&
-                providerIdempotencyKey &&
-                executionAuthScopeDigest,
-              );
               // A post-header body deadline aborts the fetch controller solely
               // to stop consuming that response. It must not also cancel the
               // independent gateway health check that establishes whether the
               // committed response can be replayed safely. Preserve genuine
               // caller/runtime cancellation by dropping the signal only when
               // this exact body deadline caused the abort.
-              const durableFenceVerificationSignal =
-                abortController?.signal.aborted === true &&
-                abortController.signal.reason instanceof
-                  ToolExecuteResponseBodyTimeoutError
-                  ? undefined
-                  : abortController?.signal;
-              const durableInvocationFenceVerified =
-                hasDurableInvocationIdentity &&
-                requestsDurableInvocationFence &&
-                (this.#options.durableInvocationFence === true ||
-                  (await this.#options
-                    .verifyDurableInvocationFence?.(
-                      durableFenceVerificationSignal,
-                    )
-                    .catch(() => false)) === true);
-              // Fixture execution has no provider-side effect. Replaying the
-              // same stable request after our own transport fails is always
-              // safe, even when this runner lacks a live-provider fence.
-              const fixtureReplaySafe =
-                this.#options.integrationMode === 'fixture';
               const transportReplaySafe =
                 !ambiguousDispatchedFailure ||
-                durableInvocationFenceVerified ||
+                ambiguousTransportReplayAllowed ||
                 fixtureReplaySafe;
               if (!transportReplaySafe) {
                 const diagnostic = describeTransportError(transportError);
-                this.log(
+                this.runtimeLog(
                   `[runtime.transport_failure] ${JSON.stringify({
                     tool_id: toolId,
                     gateway_origin: transportGatewayOriginForDiagnostic(url),
@@ -14172,6 +14250,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   elapsedMs: providerCallElapsedMs ?? 0,
                   requestId: deeplineRequestId,
                   aborted: false,
+                  knownNotDispatched: true,
                 });
                 continue;
               }
@@ -14209,13 +14288,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   failure.backpressureDelayMs,
                 );
               }
-              if (failure.shouldRetry) {
-                if (
-                  failure.reason !== 'gateway_invocation_in_progress' &&
-                  failure.reason !== 'concurrency_backpressure'
-                ) {
-                  invocationAttempt += 1;
-                }
+              if (
+                failure.shouldRetry &&
+                (ambiguousTransportReplayAllowed ||
+                  retrySafeTransientHttp ||
+                  fixtureReplaySafe)
+              ) {
+                invocationAttempt += 1;
                 if (failure.chargeRetryBudget) {
                   await this.governor.chargeBudget('retry');
                 }
@@ -14230,8 +14309,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   `plays.${retryAttributePrefix}_attempt`,
                   httpFailureAttempt,
                 );
-                this.log(
+                this.runtimeLog(
                   `Tool ${toolId} returned ${response.status}; retrying after ${failure.retryDelayMs}ms`,
+                  { level: 'warn' },
                 );
                 retryActivityEmitted = true;
                 this.emitExecutionEvent({
@@ -14275,7 +14355,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 });
                 continue;
               }
-              this.log(failure.error.message);
+              this.runtimeLog(failure.error.message, { level: 'error' });
               throw failure.error;
             }