deepline 0.3.72 → 0.3.73

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -175,6 +175,7 @@ import {
   buildDurableToolAggregateReceiptKey,
   buildDurableToolCallAuthScopeDigest,
   buildDurableToolCallCacheKey,
+  buildLegacyRevisionedDurableToolCallCacheKey,
   buildDurableToolPayloadProviderIdempotencyKey,
   buildDurableToolProviderIdempotencyKey,
   buildDurableToolReceiptPrefix,
@@ -1395,6 +1396,8 @@ function playNodeScopeForToolCallRequest(
 type ToolExecutionApiOptions = {
   timeoutMs?: number;
   durableCallReceiptKey?: string | null;
+  /** The receipt key is a completed-result cache for this read-only call. */
+  completedResultCache?: boolean;
   executionAuthScopeDigest?: string | null;
   /**
    * Historical receipt identity used for the API's provider/billing
@@ -2763,9 +2766,22 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   }
 
   /**
-   * Only explicitly declared response transformations affect receipt reuse.
-   * Missing preserves historical artifact/receipt identity, while the public
-   * response header still normalizes it to the legacy V2 behavior above.
+   * A real published artifact pins its response presentation in its launch
+   * contract. In-process callers that omit the option are runtime consumers,
+   * not historical Play artifacts, and retain the canonical result they pass
+   * in. This keeps the context API backward-compatible while letting a pinned
+   * legacy artifact request its old projection after a cache read.
+   */
+  private get hasPinnedToolResponseContract(): boolean {
+    return (
+      this.activeInlineComposition !== null ||
+      this.#options.toolResponseContract !== undefined
+    );
+  }
+
+  /**
+   * Compatibility metadata retained for already-published artifacts. It never
+   * changes the completed-result cache identity.
    */
   private get currentToolResponseReceiptRevision(): string | undefined {
     if (this.activeInlineComposition) {
@@ -4020,14 +4036,14 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       );
       if (normalized) byKey.set(normalized.key, normalized);
     }
-    await this.reconcileMissingRuntimeStepReceiptCompletions(
+    await this.reconcileIncompleteRuntimeStepReceiptCompletions(
       normalizedInputs,
       byKey,
     );
     return byKey;
   }
 
-  private async reconcileMissingRuntimeStepReceiptCompletions(
+  private async reconcileIncompleteRuntimeStepReceiptCompletions(
     receipts: Array<{
       key: string;
       runId: string;
@@ -4038,32 +4054,45 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     completedByKey: Map<string, RuntimeStepReceipt>,
   ): Promise<void> {
     if (
-      receipts.length === completedByKey.size ||
-      (!this.#options.getRuntimeStepReceipt &&
-        !this.#options.getRuntimeStepReceipts)
+      !this.#options.getRuntimeStepReceipt &&
+      !this.#options.getRuntimeStepReceipts
     ) {
       return;
     }
-    const missingKeys = receipts
+    // The receipt gateway is allowed to return a compact terminal
+    // acknowledgement without `output`. That is sufficient for old callers
+    // which keep the live result, but a completed-result cache must hydrate
+    // the stored output before handing it to a cache cohort.
+    const incompleteKeys = receipts
       .map((receipt) => receipt.key.trim())
-      .filter((key) => key && !completedByKey.has(key));
-    if (missingKeys.length === 0) return;
-    const latest = await this.getRuntimeStepReceipts(missingKeys);
-    for (const key of missingKeys) {
+      .filter((key) => {
+        if (!key) return false;
+        const completed = completedByKey.get(key);
+        return (
+          !completed ||
+          ((completed.status === 'completed' ||
+            completed.status === 'skipped') &&
+            completed.output === undefined)
+        );
+      });
+    if (incompleteKeys.length === 0) return;
+    const latest = await this.getRuntimeStepReceipts(incompleteKeys);
+    for (const key of incompleteKeys) {
       const recovered = latest.get(key);
       if (
-        recovered?.status === 'completed' ||
-        recovered?.status === 'skipped'
+        (recovered?.status === 'completed' ||
+          recovered?.status === 'skipped') &&
+        recovered.output !== undefined
       ) {
         completedByKey.set(key, recovered);
       }
     }
-    const recoveredCount = missingKeys.filter((key) =>
-      completedByKey.has(key),
+    const recoveredCount = incompleteKeys.filter(
+      (key) => completedByKey.get(key)?.output !== undefined,
     ).length;
     if (recoveredCount > 0) {
       this.runtimeLog(
-        `Runtime tool receipt completion response reconciled ${recoveredCount}/${missingKeys.length} missing receipt(s) from durable store read-back.`,
+        `Runtime tool receipt completion response hydrated ${recoveredCount}/${incompleteKeys.length} incomplete receipt(s) from durable store read-back.`,
       );
     }
   }
@@ -4178,17 +4207,39 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     );
   }
 
-  private async durableToolCallCacheKeyForScope(
-    input: {
-      toolId: string;
-      requestInput: Record<string, unknown>;
-      executionAuthScopeDigest?: string | null;
-      staleAfterSeconds?: number | null;
-      playLocalScope?: string | null;
-    },
-    toolResponseReceiptRevision: string | null | undefined = this
-      .currentToolResponseReceiptRevision,
-  ): Promise<string> {
+  private async durableToolCallCacheKeyForScope(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+    playLocalScope?: string | null;
+  }): Promise<string> {
+    const identity = await this.durableToolCallCacheIdentity(input);
+    return buildDurableToolCallCacheKey(identity);
+  }
+
+  private async legacyDurableToolCallCacheKeyForScope(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+    playLocalScope?: string | null;
+  }): Promise<string | null> {
+    const revision = this.currentToolResponseReceiptRevision;
+    if (!revision) return null;
+    return buildLegacyRevisionedDurableToolCallCacheKey({
+      ...(await this.durableToolCallCacheIdentity(input)),
+      toolResponseReceiptRevision: revision,
+    });
+  }
+
+  private async durableToolCallCacheIdentity(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+    playLocalScope?: string | null;
+  }): Promise<Parameters<typeof buildDurableToolCallCacheKey>[0]> {
     const providerActionVersion =
       (await this.#options.getToolActionCacheVersion?.(input.toolId))?.trim() ??
       '';
@@ -4196,7 +4247,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       input.executionAuthScopeDigest?.trim() ||
       (await this.resolveToolAuthScopeDigest(input.toolId))?.trim() ||
       null;
-    return buildDurableToolCallCacheKey({
+    return {
       orgId: this.#options.orgId,
       playLocalScope: input.playLocalScope,
       toolId: input.toolId,
@@ -4207,29 +4258,33 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         executionAuthScopeDigest,
       }),
       providerActionVersion,
-      toolResponseReceiptRevision,
       staleAfterSeconds: input.staleAfterSeconds,
       cacheEpochMs: this.durableCallCacheEpochMs,
+    };
+  }
+
+  private async durableToolCallCacheKey(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+  }): Promise<string> {
+    return await this.durableToolCallCacheKeyForScope({
+      ...input,
+      playLocalScope: this.currentGovernance.currentPlayId,
     });
   }
 
-  private async durableToolCallCacheKey(
-    input: {
-      toolId: string;
-      requestInput: Record<string, unknown>;
-      executionAuthScopeDigest?: string | null;
-      staleAfterSeconds?: number | null;
-    },
-    toolResponseReceiptRevision: string | null | undefined = this
-      .currentToolResponseReceiptRevision,
-  ): Promise<string> {
-    return await this.durableToolCallCacheKeyForScope(
-      {
-        ...input,
-        playLocalScope: this.currentGovernance.currentPlayId,
-      },
-      toolResponseReceiptRevision,
-    );
+  private async legacyDurableToolCallCacheKey(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+  }): Promise<string | null> {
+    return await this.legacyDurableToolCallCacheKeyForScope({
+      ...input,
+      playLocalScope: this.currentGovernance.currentPlayId,
+    });
   }
 
   private async resolveToolAuthScopeDigest(
@@ -5379,6 +5434,23 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     return null;
   }
 
+  private canReuseToolResultForCurrentResponseContract(
+    result: unknown,
+  ): boolean {
+    if (this.currentToolResponseContract !== RAW_V2_TOOL_RESPONSE_CONTRACT) {
+      return true;
+    }
+    const toolResult = isToolExecuteResult(result)
+      ? result
+      : isSerializedToolExecuteResult(result)
+        ? deserializeToolExecuteResult(result)
+        : null;
+    return (
+      toolResult !== null &&
+      Object.prototype.hasOwnProperty.call(toolResult.toolResponse, 'rawV2')
+    );
+  }
+
   private cacheToolResult(
     toolId: string,
     rowCacheKey: string,
@@ -5491,6 +5563,38 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     );
   }
 
+  /**
+   * Receipts retain the canonical raw-v2 provider outcome. Older artifacts
+   * receive their legacy projection only at the Play boundary, after cache
+   * lookup and persistence have finished.
+   */
+  private materializeToolExecutionResult(
+    result: ToolExecuteResult,
+  ): ToolExecuteResult {
+    if (
+      this.currentToolResponseContract === RAW_V2_TOOL_RESPONSE_CONTRACT ||
+      !this.hasPinnedToolResponseContract ||
+      !Object.prototype.hasOwnProperty.call(result.toolResponse, 'rawV2')
+    ) {
+      return result;
+    }
+    const serialized = serializeToolExecuteResult(result);
+    if (serialized.__kind !== 'deepline.tool_execute_result.v2') {
+      return result;
+    }
+    return deserializeToolExecuteResult({
+      ...serialized,
+      __kind: 'deepline.tool_execute_result.v1',
+      toolResponse: {
+        raw: legacyRawFromToolResponseRawV2(
+          serialized.toolResponse.rawV2,
+          serialized.toolResponse.view,
+          serialized.toolResponse.responseMeta,
+        ),
+      },
+    });
+  }
+
   private attachCustomerDbDatasetResult(
     toolId: string,
     requestInput: Record<string, unknown> | undefined,
@@ -9272,16 +9376,26 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       executionAuthScopeDigest,
       staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
     });
-    let providerIdempotencyKeyBase = await this.durableToolCallCacheKey(
-      {
-        toolId,
-        requestInput: input,
-        executionAuthScopeDigest,
-        staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
-      },
-      null,
-    );
-    const checkpointCacheKeys = [durableCacheKey];
+    let legacyDurableCacheKey = await this.legacyDurableToolCallCacheKey({
+      toolId,
+      requestInput: input,
+      executionAuthScopeDigest,
+      staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
+    });
+    // Only explicitly fenced operations use this key as a provider identity.
+    // Ordinary calls use it solely as their completed-result cache key.
+    let providerIdempotencyKeyBase = durableCacheKey;
+    let directResultReceiptKey = durableCacheKey;
+    // A raw-v2 artifact must never read an older receipt that cannot render
+    // raw-v2. If both the primary and its revisioned recovery receipt are
+    // unrenderable, make a live call rather than returning either cache entry.
+    // We cannot safely replace an immutable completed receipt, so that rare
+    // incompatible state deliberately forgoes caching until it is repaired.
+    let bypassDirectResultCache = false;
+    const checkpointCacheKeys = [
+      durableCacheKey,
+      ...(legacyDurableCacheKey ? [legacyDurableCacheKey] : []),
+    ];
 
     const executeTool = async (context?: {
       leaseId?: string | null;
@@ -9310,7 +9424,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       if (!store) {
         const directCacheKey = durableCacheKey;
         let initialDirectReceipt: RuntimeStepReceipt | null | undefined;
-        const cached = !cacheableToolResult
+        const cachedCandidate = !cacheableToolResult
           ? null
           : toolCachePolicy.force
             ? null
@@ -9319,6 +9433,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 checkpointCacheKeys,
                 'direct',
               );
+        const cached =
+          cachedCandidate &&
+          this.canReuseToolResultForCurrentResponseContract(
+            cachedCandidate.result.result,
+          )
+            ? cachedCandidate
+            : null;
         if (cached) {
           this.runtimeLog(`Calling tool: ${toolId} recovered from checkpoint`);
           // Started and settled are paired in a finally: an uncovered throw
@@ -9342,7 +9463,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               outcome: 'cached',
               durationMs: 0,
             });
-            return recovered;
+            return this.materializeToolExecutionResult(recovered);
           } finally {
             if (!settled) {
               this.emitToolCallLifecycle('settled', toolId, normalizedKey, {
@@ -9361,17 +9482,36 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const historicalReceipt = await this.withRuntimeReceiptHydrationTurn(
             async () => await this.getRuntimeStepReceipt(directCacheKey),
           );
-          initialDirectReceipt = historicalReceipt;
+          const historicalOutput = historicalReceipt
+            ? this.runtimeReceiptOutput<unknown>(historicalReceipt)
+            : undefined;
+          const historicalIsTerminal =
+            historicalReceipt?.status === 'completed' ||
+            historicalReceipt?.status === 'skipped';
+          const historicalCanServeCurrentContract =
+            !historicalIsTerminal ||
+            this.canReuseToolResultForCurrentResponseContract(historicalOutput);
+          initialDirectReceipt = historicalCanServeCurrentContract
+            ? historicalReceipt
+            : null;
+          if (!historicalCanServeCurrentContract) {
+            if (!legacyDurableCacheKey) {
+              throw new Error(
+                `Tool ${toolId} has an unrenderable legacy result but no response-contract recovery cache key.`,
+              );
+            }
+            directResultReceiptKey = legacyDurableCacheKey;
+          }
           if (
             historicalReceipt &&
-            (historicalReceipt.status === 'completed' ||
-              historicalReceipt.status === 'skipped') &&
+            historicalIsTerminal &&
+            historicalCanServeCurrentContract &&
             !isSerializedToolExecuteResult(historicalReceipt.output) &&
             !isToolExecuteResult(historicalReceipt.output)
           ) {
             const historicalOutput =
               this.runtimeReceiptOutput<unknown>(historicalReceipt);
-            return markToolExecuteResultExecutionOutcome(
+            const recoveredHistorical = markToolExecuteResultExecutionOutcome(
               historicalOutput,
               toolExecutionOutcomeForDurableReceipt({
                 source: 'cache',
@@ -9379,6 +9519,43 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 cacheKey: directCacheKey,
               }),
             );
+            return isToolExecuteResult(recoveredHistorical)
+              ? this.materializeToolExecutionResult(recoveredHistorical)
+              : recoveredHistorical;
+          }
+          if (
+            (!historicalReceipt || !historicalCanServeCurrentContract) &&
+            legacyDurableCacheKey
+          ) {
+            const legacyReceipt = await this.withRuntimeReceiptHydrationTurn(
+              async () =>
+                await this.getRuntimeStepReceipt(legacyDurableCacheKey!),
+            );
+            if (
+              legacyReceipt &&
+              (legacyReceipt.status === 'completed' ||
+                legacyReceipt.status === 'skipped') &&
+              legacyReceipt.output !== undefined
+            ) {
+              const recoveredLegacy = markToolExecuteResultExecutionOutcome(
+                this.runtimeReceiptOutput(legacyReceipt),
+                toolExecutionOutcomeForDurableReceipt({
+                  source: 'cache',
+                  receiptKey: legacyDurableCacheKey,
+                  cacheKey: directCacheKey,
+                }),
+              );
+              if (
+                this.canReuseToolResultForCurrentResponseContract(
+                  recoveredLegacy,
+                )
+              ) {
+                return isToolExecuteResult(recoveredLegacy)
+                  ? this.materializeToolExecutionResult(recoveredLegacy)
+                  : recoveredLegacy;
+              }
+              bypassDirectResultCache = true;
+            }
           }
         }
         this.runtimeLog(
@@ -9416,23 +9593,27 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               'Direct tool execution requires a stable logical call identity.',
             );
           }
-          const physicalDirectKey = cacheableToolResult
+          const useDirectResultReceipts =
+            cacheableToolResult && !bypassDirectResultCache;
+          const physicalDirectKey = useDirectResultReceipts
             ? directCacheKey
             : `${buildDurableToolReceiptPrefix({
                 orgId: this.#options.orgId ?? 'unknown-org',
                 toolId,
               })}${stableDigest(`${this.currentRunId}:${logicalCallId}:always-fresh`)}`;
+          const resultReceiptKey = directResultReceiptKey;
           const providerOperationKey = providerIdempotencyKeyBase;
-          const resultReceiptKey = directCacheKey;
           const toolRetryPolicy = await this.#options
             .getToolRetryPolicy?.(toolId, input)
             .catch(() => null);
-          // Direct cacheable calls now give ToolCall the real completed-result
-          // receipt Adapter. The provider-operation fence remains below the
-          // dispatcher: V2 and legacy presentation keys can therefore publish
-          // independent Tool Result Receipts without a second provider effect.
-          // Map members retain their cohort-owned receipt Adapter until their
-          // batched claim/heartbeat protocol moves behind the same Interface.
+          if (
+            bypassDirectResultCache &&
+            toolRetryPolicy?.requiresExecutionFence === true
+          ) {
+            throw new Error(
+              `Tool ${toolId} has an unrenderable completed result under an execution fence and cannot safely refresh it.`,
+            );
+          }
           const dispatcher = {
             dispatch: async ({
               providerOperationKey: operationKey,
@@ -9440,7 +9621,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               providerOperationKey: string | null;
             }) => {
               if (
-                cacheableToolResult &&
+                useDirectResultReceipts &&
                 operationKey !== providerOperationKey
               ) {
                 throw new Error(
@@ -9453,18 +9634,11 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 startedAt: directCallStartedAt,
                 input,
                 options: {
-                  ...(cacheableToolResult
+                  ...(useDirectResultReceipts
                     ? {
                         durableCallReceiptKey: physicalDirectKey,
+                        completedResultCache: true,
                         executionAuthScopeDigest,
-                        providerIdempotencyReceiptKey: operationKey,
-                        providerIdempotencyKey:
-                          this.providerIdempotencyKeyForToolCall({
-                            cacheKey: providerIdempotencyKeyBase,
-                            force: toolCachePolicy.force,
-                            leaseId: directReceiptLeaseId,
-                            logicalCallId,
-                          }),
                         ...(directReceiptLeaseId &&
                         (this.#options.heartbeatRuntimeStepReceipts ||
                           this.#options.getRuntimeStepReceipt ||
@@ -9487,6 +9661,24 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                           : {}),
                       }
                     : {}),
+                  ...(toolRetryPolicy?.requiresExecutionFence === true
+                    ? {
+                        providerIdempotencyReceiptKey:
+                          cacheableToolResult && operationKey
+                            ? operationKey
+                            : physicalDirectKey,
+                        providerIdempotencyKey:
+                          this.providerIdempotencyKeyForToolCall({
+                            cacheKey:
+                              useDirectResultReceipts && operationKey
+                                ? providerIdempotencyKeyBase
+                                : physicalDirectKey,
+                            force: cacheableToolResult && toolCachePolicy.force,
+                            leaseId: directReceiptLeaseId,
+                            logicalCallId,
+                          }),
+                      }
+                    : {}),
                   playNodeScope: buildPlayNodeScope({
                     toolId,
                     callKey: normalizedKey,
@@ -9511,14 +9703,14 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 execution: toolExecutionMetadataForOutcome({
                   kind: 'live',
                   cacheKey: directCacheKey,
-                  ...(cacheableToolResult
+                  ...(useDirectResultReceipts
                     ? { receiptKey: resultReceiptKey }
                     : {}),
                 }),
               });
             },
           };
-          const toolCall = cacheableToolResult
+          const toolCall = useDirectResultReceipts
             ? createToolCallJob({
                 resultReceipts: createRuntimeStepToolResultReceipts({
                   store: this.durableReceiptExecutionStore(),
@@ -9526,7 +9718,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   ...(initialDirectReceipt !== undefined
                     ? {
                         initialReceipt: {
-                          key: directCacheKey,
+                          key: directResultReceiptKey,
                           receipt: initialDirectReceipt,
                         },
                       }
@@ -9537,6 +9729,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     ? {
                         executionLock: {
                           required: true,
+                          key: providerOperationKey,
                           ttlMs: Math.min(
                             600_000,
                             resolveToolRuntimeTimeoutMs(
@@ -9599,11 +9792,16 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               })
             : await createAlwaysFreshToolCallAdapter({ dispatcher }).call(call);
           settleDirectCall(toolAttemptOutcomeForResult(wrapped));
-          if (cacheableToolResult) {
-            this.cacheToolResult(toolId, directCacheKey, wrapped, 'direct');
+          if (useDirectResultReceipts) {
+            this.cacheToolResult(
+              toolId,
+              directResultReceiptKey,
+              wrapped,
+              'direct',
+            );
             this.#options.onBatchComplete?.(this.checkpoint);
           }
-          return wrapped;
+          return this.materializeToolExecutionResult(wrapped);
         } catch (error) {
           settleDirectCall('failed', error);
           throw error;
@@ -9637,17 +9835,22 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           : this.getCachedToolResultCandidate(toolId, checkpointCacheKeys);
       if (cached) {
         this.runtimeLog(`  Row ${rowId} ${toolId}: recovered from checkpoint`);
-        return await this.wrapToolExecutionResult({
-          toolId,
-          status: cached.result.result == null ? 'no_result' : 'completed',
-          result: cached.result.result,
-          requestInput: input,
-          execution: toolExecutionMetadataForOutcome({
-            kind: 'checkpoint',
-            cacheKey: cached.cacheKey,
+        return this.materializeToolExecutionResult(
+          await this.wrapToolExecutionResult({
+            toolId,
+            status: cached.result.result == null ? 'no_result' : 'completed',
+            result: cached.result.result,
+            requestInput: input,
+            execution: toolExecutionMetadataForOutcome({
+              kind: 'checkpoint',
+              cacheKey: cached.cacheKey,
+            }),
           }),
-        });
+        );
       }
+      const rowToolRetryPolicy = await this.#options
+        .getToolRetryPolicy?.(toolId, input)
+        .catch(() => null);
 
       // ADR 0018: record this leg before it runs. `producer` still names the
       // last leg (the usual cascade winner); `producers` keeps every leg, which
@@ -9702,7 +9905,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           providerIdempotencyKeyBase,
           cacheable: cacheableToolResult,
           receiptKey: cacheableToolResult ? durableCacheKey : null,
+          legacyReceiptKeys: legacyDurableCacheKey
+            ? [legacyDurableCacheKey]
+            : [],
           executionAuthScopeDigest,
+          requiresExecutionFence:
+            rowToolRetryPolicy?.requiresExecutionFence === true,
           force: toolCachePolicy.force,
           forceFailedRefresh: toolCachePolicy.forceFailedRefresh,
           rowId,
@@ -9722,7 +9930,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       return await pendingToolCall.then(
         (value) => {
           settleProducerAttempt(toolAttemptOutcomeForResult(value));
-          return value;
+          return this.materializeToolExecutionResult(
+            value as ToolExecuteResult,
+          );
         },
         (error: unknown) => {
           settleProducerAttempt('failed');
@@ -9771,16 +9981,21 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           executionAuthScopeDigest,
           staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
         });
-        providerIdempotencyKeyBase = await this.durableToolCallCacheKey(
-          {
-            toolId,
-            requestInput: input,
-            executionAuthScopeDigest,
-            staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
-          },
-          null,
+        legacyDurableCacheKey = await this.legacyDurableToolCallCacheKey({
+          toolId,
+          requestInput: input,
+          executionAuthScopeDigest,
+          staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
+        });
+        providerIdempotencyKeyBase = durableCacheKey;
+        directResultReceiptKey = durableCacheKey;
+        bypassDirectResultCache = false;
+        checkpointCacheKeys.splice(
+          0,
+          checkpointCacheKeys.length,
+          durableCacheKey,
+          ...(legacyDurableCacheKey ? [legacyDurableCacheKey] : []),
         );
-        checkpointCacheKeys[0] = durableCacheKey;
       }
     }
 
@@ -11009,75 +11224,59 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   /**
    * Concrete RuntimeStepReceipt adapter for the map receipt-cohort Module.
    *
-   * It is intentionally shared by scalar and provider-native map calls. The
-   * two call shapes differ at provider dispatch, not at the member receipt
-   * protocol: both need an atomic claim/reclaim, a single cohort heartbeat,
-   * and lease-fenced terminal fanout. Keeping that at one seam prevents a
-   * native batch from becoming a second, subtly different receipt runtime.
+   * Scalar and provider-native map calls share completed-result cache reads
+   * and atomic successful inserts. A miss has no durable execution owner.
    */
   private createRuntimeStepToolCallReceiptCohortStore(input: {
     toolId: string;
     requestForReceipt: ReadonlyMap<string, ToolCallRequest>;
   }): ToolCallReceiptCohortStore {
     const asRecord = async (
-      receiptKey: string,
+      resultReceiptKey: string,
+      storedReceiptKey: string,
       receipt: RuntimeStepReceipt | null | undefined,
     ): Promise<ToolCallReceiptRecord | null> => {
       if (!receipt) return null;
-      const normalized = this.normalizeRuntimeStepReceipt(receiptKey, receipt);
+      const normalized = this.normalizeRuntimeStepReceipt(
+        storedReceiptKey,
+        receipt,
+      );
       if (!normalized) return null;
-      const request = input.requestForReceipt.get(receiptKey);
+      if (
+        normalized.status !== 'completed' &&
+        normalized.status !== 'skipped'
+      ) {
+        return null;
+      }
+      // A terminal acknowledgement without output is not a cache hit. The
+      // completion path hydrates it first; if that read cannot provide an
+      // output, retain the live result rather than resolving `undefined`.
+      if (normalized.output === undefined) return null;
+      const request = input.requestForReceipt.get(resultReceiptKey);
       if (!request) {
         throw new Error(
-          `Unknown Tool Call Receipt Cohort receipt ${receiptKey}.`,
+          `Unknown Tool Call Receipt Cohort receipt ${resultReceiptKey}.`,
         );
       }
-      const terminal =
-        normalized.status === 'completed' || normalized.status === 'skipped';
-      const result = terminal
-        ? await this.wrapToolExecutionResult({
-            toolId: input.toolId,
-            status:
-              normalized.output === null || normalized.output === undefined
-                ? 'no_result'
-                : 'completed',
-            result: this.runtimeReceiptOutput(normalized),
-            requestInput: request.input,
-            execution: toolExecutionMetadataForOutcome({
-              kind: 'cache',
-              cacheKey: request.cacheKey,
-              receiptKey,
-              attachedToReceiptKey: receiptKey,
-            }),
-          })
-        : undefined;
+      const result = await this.wrapToolExecutionResult({
+        toolId: input.toolId,
+        status:
+          normalized.output === null || normalized.output === undefined
+            ? 'no_result'
+            : 'completed',
+        result: this.runtimeReceiptOutput(normalized),
+        requestInput: request.input,
+        execution: toolExecutionMetadataForOutcome({
+          kind: 'cache',
+          cacheKey: request.cacheKey,
+          receiptKey: resultReceiptKey,
+          attachedToReceiptKey: storedReceiptKey,
+        }),
+      });
       return {
-        resultReceiptKey: receiptKey,
+        resultReceiptKey,
         status: normalized.status,
-        ...(result !== undefined ? { result } : {}),
-        ...(normalized.status === 'failed'
-          ? {
-              error: runtimeReceiptFailureError(
-                normalized,
-                'Durable tool call failed',
-                this.currentToolErrorSchemaVersion,
-              ),
-            }
-          : {}),
-        ...(normalized.leaseId &&
-        (normalized.leaseOwnerRunId ?? normalized.runId)?.trim()
-          ? {
-              lease: {
-                leaseId: normalized.leaseId,
-                ownerRunId: (normalized.leaseOwnerRunId ??
-                  normalized.runId)!.trim(),
-              },
-            }
-          : {}),
-        ...(normalized.leaseExpiresAt
-          ? { leaseExpiresAt: normalized.leaseExpiresAt }
-          : {}),
-        ...(normalized.claimState ? { claimState: normalized.claimState } : {}),
+        result,
       };
     };
     const recordsFor = async (
@@ -11086,10 +11285,22 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     ): Promise<ToolCallReceiptRecord[]> =>
       (
         await Promise.all(
-          receiptKeys.map(
-            async (receiptKey) =>
-              await asRecord(receiptKey, receipts.get(receiptKey)),
-          ),
+          receiptKeys.map(async (receiptKey) => {
+            const request = input.requestForReceipt.get(receiptKey);
+            const candidates = [
+              receiptKey,
+              ...(request?.legacyReceiptKeys ?? []),
+            ];
+            for (const candidate of candidates) {
+              const record = await asRecord(
+                receiptKey,
+                candidate,
+                receipts.get(candidate),
+              );
+              if (record) return record;
+            }
+            return null;
+          }),
         )
       ).filter((record): record is ToolCallReceiptRecord => record !== null);
 
@@ -11099,83 +11310,17 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           async () =>
             await recordsFor(
               resultReceiptKeys,
-              await this.getRuntimeStepReceipts(resultReceiptKeys),
+              await this.getRuntimeStepReceipts(
+                [...new Set(
+                  resultReceiptKeys.flatMap((receiptKey) => [
+                    receiptKey,
+                    ...(input.requestForReceipt.get(receiptKey)
+                      ?.legacyReceiptKeys ?? []),
+                  ]),
+                )],
+              ),
             ),
         ),
-      claim: async ({ receipts }) => {
-        const claims = new Map<string, RuntimeStepReceipt>();
-        const groups = new Map<string, Array<(typeof receipts)[number]>>();
-        for (const receipt of receipts) {
-          const groupKey = [
-            receipt.reclaimRunning ? 'reclaim' : 'ordinary',
-            receipt.force ? 'force' : 'cached',
-            receipt.forceFailedRefresh ? 'failed-force' : 'failed-cached',
-          ].join(':');
-          const group = groups.get(groupKey) ?? [];
-          group.push(receipt);
-          groups.set(groupKey, group);
-        }
-        for (const group of groups.values()) {
-          const first = group[0]!;
-          const claimed = await this.claimRuntimeStepReceipts(
-            group.map((receipt) => receipt.resultReceiptKey),
-            this.currentReceiptOwnerRunId,
-            first.reclaimRunning,
-            first.force,
-            first.forceFailedRefresh,
-          );
-          for (const [key, receipt] of claimed) claims.set(key, receipt);
-        }
-        const safeFailedKeys = receipts.flatMap((receipt) => {
-          const claimed = claims.get(receipt.resultReceiptKey);
-          return claimed && this.canRetryWithoutProviderDispatch(claimed)
-            ? [receipt.resultReceiptKey]
-            : [];
-        });
-        if (safeFailedKeys.length > 0) {
-          const refreshed = await this.claimRuntimeStepReceipts(
-            safeFailedKeys,
-            this.currentReceiptOwnerRunId,
-            false,
-            false,
-            true,
-          );
-          for (const [key, receipt] of refreshed) claims.set(key, receipt);
-        }
-        return await recordsFor(
-          receipts.map((receipt) => receipt.resultReceiptKey),
-          claims,
-        );
-      },
-      heartbeat: async ({ receipts }) => {
-        if (!this.#options.heartbeatRuntimeStepReceipts) {
-          return await recordsFor(
-            receipts.map((receipt) => receipt.resultReceiptKey),
-            await this.getRuntimeStepReceipts(
-              receipts.map((receipt) => receipt.resultReceiptKey),
-            ),
-          );
-        }
-        const response = await this.#options.heartbeatRuntimeStepReceipts({
-          runId: this.currentReceiptOwnerRunId,
-          runAttempt: this.currentRunAttempt,
-          keys: receipts.map((receipt) => receipt.resultReceiptKey),
-          leaseIds: receipts.map((receipt) => receipt.lease.leaseId),
-        });
-        const byKey = new Map<string, RuntimeStepReceipt>();
-        for (let index = 0; index < receipts.length; index += 1) {
-          const request = receipts[index]!;
-          const normalized = this.normalizeRuntimeStepReceipt(
-            request.resultReceiptKey,
-            response[index],
-          );
-          if (normalized) byKey.set(request.resultReceiptKey, normalized);
-        }
-        return await recordsFor(
-          receipts.map((receipt) => receipt.resultReceiptKey),
-          byKey,
-        );
-      },
       complete: async ({ receipts }) => {
         const completed = await this.completeRuntimeStepReceipts(
           receipts.map((receipt) => ({
@@ -11190,33 +11335,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           completed,
         );
       },
-      fail: async ({ receipts }) => {
-        const failed = await this.failRuntimeStepReceipts(
-          receipts.map((receipt) => ({
-            key: receipt.resultReceiptKey,
-            runId: this.currentReceiptOwnerRunId,
-            leaseId: receipt.lease.leaseId,
-            error: this.formatRuntimeError(receipt.error),
-            errorPayload: serializeToolExecutionFailure(receipt.error),
-            failureKind: runtimeReceiptFailureKindForError(receipt.error),
-          })),
-        );
-        return await recordsFor(
-          receipts.map((receipt) => receipt.resultReceiptKey),
-          failed,
-        );
-      },
     };
   }
 
   /**
-   * The scalar map path used to duplicate the receipt state machine in
-   * `executeBatchedToolCalls`: one loop claimed/reclaimed/followed rows and a
-   * later loop heartbeated and completed them.  That made it too easy for the
-   * Tool Call boundary to be only cosmetic.  This is the narrow replacement
-   * slice: cacheable members of a *non-native* map hand their whole receipt
-   * lifecycle to the cohort Module, while this Context remains only the
-   * transport/presentation Adapter.
+   * Cacheable scalar map members share completed-result reads and successful
+   * writes through the cohort Module. This Context only transports and
+   * presents results.
    *
    * Do not widen this to physical native batches or always-fresh calls. A
    * native batch owns a different aggregate operation receipt, and
@@ -11318,7 +11443,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     const resolve = async (
       request: ToolCallRequest,
       result: ToolExecuteResult,
-      source: 'cache' | 'in_flight' | 'owner',
+      source: 'cache' | 'owner',
     ): Promise<void> => {
       const receiptKey = request.receiptKey!;
       const finalResult = cloneToolExecuteResultWithExecution(
@@ -11353,180 +11478,111 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     };
     const reject = async (request: ToolCallRequest, error: unknown) => {
       await this.rejectToolCall(toolId, request, error, {
-        // ToolCallReceiptCohort is the one failure writer. Re-entering the
-        // legacy writer here would race its member terminal transition.
+        // Failures are never cache entries, including failed local misses.
         persistReceiptFailure: false,
       });
     };
 
-    try {
-      const handled = new Set<string>();
-      const followOrRecover: Promise<void>[] = [];
-      const collectReadyMembers = (): Array<{
+    const handled = new Set<string>();
+    const followerResults: Promise<void>[] = [];
+    const collectReadyMembers = (): Array<{
+      request: ToolCallRequest;
+      receipts: ToolResultReceipts;
+    }> => {
+      const owned: Array<{
         request: ToolCallRequest;
         receipts: ToolResultReceipts;
-      }> => {
-        const owned: Array<{
-          request: ToolCallRequest;
-          receipts: ToolResultReceipts;
-        }> = [];
-        for (const request of requests) {
-          if (handled.has(request.callId)) continue;
-          const member = cohort.member(request.callId);
-          if (member.kind === 'recovering') continue;
-          handled.add(request.callId);
-          if (member.kind === 'completed') {
-            followOrRecover.push(
-              resolve(request, member.result, member.source),
-            );
-          } else if (member.kind === 'failed') {
-            followOrRecover.push(reject(request, member.error));
-          } else if (member.kind === 'following') {
-            followOrRecover.push(
-              member.result.then(
-                async (result) => await resolve(request, result, 'in_flight'),
-                async (error: unknown) => await reject(request, error),
-              ),
-            );
-          } else {
-            request.receiptLeaseId = member.lease.leaseId;
-            request.receiptLeaseExpiresAt = member.leaseExpiresAt ?? null;
-            owned.push({ request, receipts: member.receipts });
-          }
+      }> = [];
+      for (const request of requests) {
+        if (handled.has(request.callId)) continue;
+        const member = cohort.member(request.callId);
+        handled.add(request.callId);
+        if (member.kind === 'completed') {
+          followerResults.push(resolve(request, member.result, member.source));
+        } else if (member.kind === 'following') {
+          followerResults.push(
+            member.result.then(
+              async (result) => await resolve(request, result, 'owner'),
+              async (error: unknown) => await reject(request, error),
+            ),
+          );
+        } else {
+          owned.push({ request, receipts: member.receipts });
         }
-        return owned;
-      };
+      }
+      return owned;
+    };
 
-      const width = Math.min(
-        this.governor.policy.concurrency.toolCalls,
-        Math.max(
-          1,
-          await this.resourceGovernor.suggestedToolParallelism(
-            toolId,
-            this.governor.policy.concurrency.toolCalls,
-          ),
+    const width = Math.min(
+      this.governor.policy.concurrency.toolCalls,
+      Math.max(
+        1,
+        await this.resourceGovernor.suggestedToolParallelism(
+          toolId,
+          this.governor.policy.concurrency.toolCalls,
         ),
-      );
-      const dispatchOwned = async (
-        owned: Array<{
-          request: ToolCallRequest;
-          receipts: ToolResultReceipts;
-        }>,
-      ) =>
-        await dispatchBoundedSettled(
-          owned,
-          width,
-          async ({ request, receipts }) => {
-            if (this.persistenceLatch.tripped) {
-              const error = new RuntimePersistenceCircuitOpenError(
-                this.persistenceLatch,
-              );
-              await cohort.fail([{ memberId: request.callId, error }]);
-              throw error;
-            }
-            let releaseToolSlot: () => void = () => undefined;
-            try {
-              const result = await this.executeMappedToolCallThroughModule({
-                request,
-                dispatchToolId: toolId,
-                dispatchPayload: request.input,
-                resultReceiptKey: request.receiptKey!,
-                providerOperationKey:
-                  request.providerIdempotencyKeyBase ?? request.receiptKey!,
-                resultReceipts: receipts,
-                apiOptions: {
-                  beforeProviderCall: () => {
-                    if (cohortLeaseLost) throw cohortLeaseLost;
-                    heartbeat.assertOwned();
-                  },
-                  heartbeatReceipt: async () => {
-                    try {
-                      const outcome = await cohort.heartbeat();
-                      if (outcome === 'terminal') {
-                        throw new ToolCallReceiptLeaseLostError(
-                          request.receiptKey!,
-                        );
-                      }
-                    } catch (error) {
-                      if (error instanceof ToolCallReceiptLeaseLostError) {
-                        throw new RuntimeReceiptLeaseLostError({
-                          receiptKey: request.receiptKey!,
-                          runId: this.currentReceiptOwnerRunId,
-                          leaseId:
-                            request.receiptLeaseId ?? 'missing-cohort-lease',
-                        });
-                      }
-                      throw error;
-                    }
-                  },
-                  playNodeScope: playNodeScopeForToolCallRequest(request),
-                  durableCallReceiptKey: request.receiptKey,
-                  executionAuthScopeDigest: request.executionAuthScopeDigest,
-                  providerIdempotencyReceiptKey:
-                    request.providerIdempotencyKeyBase ?? request.receiptKey,
-                  providerIdempotencyKey:
-                    this.providerIdempotencyKeyForToolCall({
-                      cacheKey:
-                        request.providerIdempotencyKeyBase ??
-                        request.receiptKey!,
-                      force: request.force === true,
-                      leaseId: request.receiptLeaseId,
-                      logicalCallId: request.logicalCallId,
-                    }),
-                  receiptLeaseExpiresAt: request.receiptLeaseExpiresAt,
-                  timeoutMs:
-                    typeof request.timeoutMs === 'number' &&
-                    request.timeoutMs > 0
-                      ? request.timeoutMs
-                      : undefined,
-                  retainToolSlot: (release) => {
-                    releaseToolSlot = release;
-                  },
+      ),
+    );
+    const dispatchOwned = async (
+      owned: Array<{
+        request: ToolCallRequest;
+        receipts: ToolResultReceipts;
+      }>,
+    ) =>
+      await dispatchBoundedSettled(
+        owned,
+        width,
+        async ({ request, receipts }) => {
+          if (this.persistenceLatch.tripped) {
+            const error = new RuntimePersistenceCircuitOpenError(
+              this.persistenceLatch,
+            );
+            throw error;
+          }
+          let releaseToolSlot: () => void = () => undefined;
+          try {
+            const result = await this.executeMappedToolCallThroughModule({
+              request,
+              dispatchToolId: toolId,
+              dispatchPayload: request.input,
+              resultReceiptKey: request.receiptKey!,
+              providerOperationKey:
+                request.providerIdempotencyKeyBase ?? request.receiptKey!,
+              resultReceipts: receipts,
+              apiOptions: {
+                playNodeScope: playNodeScopeForToolCallRequest(request),
+                durableCallReceiptKey: request.receiptKey,
+                completedResultCache: true,
+                executionAuthScopeDigest: request.executionAuthScopeDigest,
+                timeoutMs:
+                  typeof request.timeoutMs === 'number' && request.timeoutMs > 0
+                    ? request.timeoutMs
+                    : undefined,
+                retainToolSlot: (release) => {
+                  releaseToolSlot = release;
                 },
-              });
-              await resolve(request, result, 'owner');
-            } catch (error) {
-              await reject(request, error);
-            } finally {
-              releaseToolSlot();
-            }
-          },
-        );
+              },
+            });
+            await resolve(request, result, 'owner');
+          } catch (error) {
+            await reject(request, error);
+          } finally {
+            releaseToolSlot();
+          }
+        },
+      );
 
-      // Eager cohort acquisition makes the initial claim available before a
-      // foreign receipt's read/reclaim path completes. This preserves map
-      // overlap: a broken foreign read must not strand an already-owned
-      // provider operation behind it.
-      const initialDispatch = dispatchOwned(collectReadyMembers());
-      const settlement = cohort.settle();
-      const [initialResult, settlementResult] = await Promise.allSettled([
-        initialDispatch,
-        settlement,
-      ]);
-      // A recovery can reclaim an expired receipt and turn it into another
-      // owned member. Collect its final state after the initial work settles.
-      const recoveredDispatch = await dispatchOwned(collectReadyMembers());
-      await Promise.allSettled(followOrRecover);
-      // dispatchBoundedSettled intentionally captures provider failures; all
-      // affected row resolvers have already been rejected above.
-      void initialResult;
-      void recoveredDispatch;
-      if (settlementResult.status === 'rejected') {
-        throw settlementResult.reason;
-      }
-    } finally {
-      heartbeat.stop();
-    }
+    await dispatchOwned(collectReadyMembers());
+    await Promise.allSettled(followerResults);
     return successful;
   }
 
   /**
    * Executes provider-native batches through the Native Batch Tool Call
-   * Module. Unlike the compatibility path below, the Module owns the member
-   * receipt cohort from claim through recovery, heartbeat and terminal split
-   * fanout. This method is only the runtime Adapter: it compiles provider
-   * payloads, invokes transport, and presents already-terminal member values
-   * to map rows.
+   * Module. The Module reads exact completed-result cache entries, batches
+   * misses, then publishes each successful split result. This Context only
+   * compiles provider payloads, invokes transport, and presents terminal
+   * member values to map rows.
    */
   private async executeCacheableNativeMapToolCallCohort(input: {
     toolId: string;
@@ -11581,9 +11637,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             batchParallelismCeiling,
           )
         : batchParallelismCeiling;
-    const batchProviderActionVersion =
-      (await this.#options.getToolActionCacheVersion?.(toolId))?.trim() ??
-      'unversioned';
     const successful: ToolCallRequest[] = [];
 
     const deliver = (request: ToolCallRequest, result: ToolExecuteResult) => {
@@ -11613,7 +11666,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     };
     const reject = async (request: ToolCallRequest, error: unknown) => {
       await this.rejectToolCall(toolId, request, error, {
-        // NativeBatchToolCall owns the durable member failure transition.
+        // Failed provider calls are never cache entries.
         persistReceiptFailure: false,
       });
     };
@@ -11675,15 +11728,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     call.payload,
                     {
                       durableCallReceiptKey: compatibility.resultReceiptKey,
+                      completedResultCache: true,
                       playNodeScope: playNodeScopeForToolCallRequest(
                         detail.members[0]!,
                         call.tool.id,
                       ),
                       executionAuthScopeDigest:
                         detail.members[0]?.executionAuthScopeDigest ?? null,
-                      providerIdempotencyReceiptKey:
-                        detail.providerOperationKey,
-                      providerIdempotencyKey: detail.providerOperationKey,
                       receiptLeaseExpiresAt: detail.receiptLeaseExpiresAt,
                       timeoutMs: detail.timeoutMs,
                     },
@@ -11751,8 +11802,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               },
               compatibility: {
                 resultReceiptKey: request.receiptKey!,
-                providerOperationKey:
-                  request.providerIdempotencyKeyBase ?? request.receiptKey!,
+                providerOperationKey: request.receiptKey!,
               },
             },
           })),
@@ -11775,27 +11825,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 'Native batch owned members changed provider operation during compilation.',
               );
             }
-            const providerOperationKey =
-              buildDurableToolPayloadProviderIdempotencyKey({
-                orgId: this.#options.orgId,
-                toolId: batch.batchOperation,
-                executionAuthScopeDigest:
-                  owned[0]?.executionAuthScopeDigest ?? null,
-                providerActionVersion: batchProviderActionVersion,
-                payload: compiled.batchPayload,
-                forceRefreshIdentities: owned
-                  .filter((request) => request.force === true)
-                  .map((request) =>
-                    this.providerIdempotencyKeyForToolCall({
-                      cacheKey:
-                        request.providerIdempotencyKeyBase ??
-                        request.receiptKey!,
-                      force: true,
-                      leaseId: request.receiptLeaseId,
-                      logicalCallId: request.logicalCallId,
-                    }),
-                  ),
-              });
+            const providerOperationKey = aggregateReceiptKey;
             dispatchDetails.set(aggregateReceiptKey, {
               members: owned,
               compiled,
@@ -11885,8 +11915,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     toolResponse: publicToolResponseForBatchedItem(
                       aggregate,
                       item,
-                      this.currentToolResponseContract ===
-                        RAW_V2_TOOL_RESPONSE_CONTRACT,
+                      true,
                     ),
                     requestInput: request.input,
                     execution: toolExecutionMetadataForOutcome({
@@ -11899,60 +11928,22 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               }),
             );
           },
-          heartbeat: {
-            // Claim replies carry the real expiry. A fixed fallback interval
-            // can be too slow for a short-lived gateway lease, so derive the
-            // one cohort supervisor from the earliest owned member instead.
-            intervalMs: ({ members }) =>
-              Math.max(
-                1,
-                Math.floor(
-                  runtimeLeaseHeartbeatIntervalFromExpiry({
-                    leaseExpiresAt: members.reduce<string | null>(
-                      (earliest, member) => {
-                        const expiresAt = member.leaseExpiresAt ?? null;
-                        if (!expiresAt) return earliest;
-                        if (!earliest) return expiresAt;
-                        return Date.parse(expiresAt) < Date.parse(earliest)
-                          ? expiresAt
-                          : earliest;
-                      },
-                      null,
-                    ),
-                    fallbackTtlMs: PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
-                  }) / 2,
-                ),
-              ),
-            onTransientFailure: (error) => {
-              this.runtimeLog(
-                `Native Tool Call Receipt Cohort heartbeat transport failed; retrying: ${
-                  error instanceof Error ? error.message : String(error)
-                }`,
-              );
-            },
-          },
         });
         return { batch, result };
       },
       onChunkComplete: async (entries) => {
         for (const entry of entries) {
           if (entry.error !== undefined) {
-            // The cohort may have recovered each member through its
-            // lease-fenced single-receipt fallback, but that only prevents
-            // duplicate provider work. It must not convert a failed bulk
-            // persistence boundary into a successful map result: callers need
-            // the loud failure so this run can be retried from the durable
-            // receipts instead of continuing after an ambiguous bulk write.
+            // A failed batch is not a cache entry. Surface it to every row so
+            // a later run can make a fresh provider attempt.
             for (const request of entry.request.memberRequests) {
               await reject(request, entry.error);
             }
             throw entry.error;
           }
           if (!entry.result) {
-            // The NativeBatchToolCall already attempted a lease-fenced failure
-            // fanout. Read the actual durable terminal facts so cache hits in
-            // the same cohort still reach their rows and a stale failure never
-            // causes this Context to write a second terminal transition.
+            // Successful split results must be present in the completed cache
+            // before they are delivered to rows.
             const durable = await store.read({
               resultReceiptKeys: entry.request.memberRequests.map(
                 (request) => request.receiptKey!,
@@ -11973,8 +11964,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               } else {
                 await reject(
                   request,
-                  record?.error ??
-                    entry.error ??
+                  entry.error ??
                     new Error(
                       'Native Tool Call did not reach a terminal receipt.',
                     ),
@@ -12198,6 +12188,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const cohortRequests = pendingRequests.filter(
             (request) =>
               request.cacheable !== false &&
+              request.requiresExecutionFence !== true &&
               Boolean(request.receiptKey?.trim()),
           );
           if (cohortRequests.length > 0) {
@@ -12230,6 +12221,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const cohortRequests = pendingRequests.filter(
             (request) =>
               request.cacheable !== false &&
+              request.requiresExecutionFence !== true &&
               Boolean(request.receiptKey?.trim()),
           );
           if (cohortRequests.length > 0) {
@@ -13056,8 +13048,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                                   : publicToolResponseForBatchedItem(
                                       batchExecution.execution,
                                       splitResults[index] ?? null,
-                                      this.currentToolResponseContract ===
-                                        RAW_V2_TOOL_RESPONSE_CONTRACT,
+                                      true,
                                     ),
                             }),
                           ),
@@ -13213,6 +13204,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                           ...(request.receiptKey
                             ? {
                                 durableCallReceiptKey: request.receiptKey,
+                                completedResultCache: true,
                                 executionAuthScopeDigest:
                                   request.executionAuthScopeDigest,
                                 providerIdempotencyReceiptKey:
@@ -13675,6 +13667,19 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             .catch(() => null);
           const retrySafeTransientHttp =
             retryPolicy?.retrySafeTransientHttp === true;
+          const requiresExecutionFence =
+            retryPolicy?.requiresExecutionFence === true;
+          const fixtureReplaySafe = this.#options.integrationMode === 'fixture';
+          const readOnlyQuery = isQueryResultDatasetReadRequest(
+            toolId,
+            toolInputSnapshot,
+          );
+          // A completed result cache eliminates repeated successful work; it
+          // does not prove an ambiguous provider write can be replayed. Only
+          // a read-only query or an action which explicitly declares transient
+          // retries safe may issue another physical request after dispatch.
+          const ambiguousTransportReplayAllowed =
+            readOnlyQuery || retrySafeTransientHttp;
           const invocationOrgId = this.#options.orgId?.trim() ?? '';
           const durableCallReceiptKey =
             options?.durableCallReceiptKey?.trim() ||
@@ -13689,26 +13694,25 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const executionAuthScopeDigest = options?.executionAuthScopeDigest
             ? options.executionAuthScopeDigest.trim() || null
             : ((await this.resolveToolAuthScopeDigest(toolId))?.trim() ?? null);
-          const canonicalOperation = {
-            version: 1 as const,
-            tool_id: toolId,
-            action_version:
-              (
-                await this.#options.getToolActionCacheVersion?.(toolId)
-              )?.trim() || 'unversioned',
-            play_scope: this.currentGovernance.currentPlayId,
-            output_intent: 'dataset',
-          };
-          const providerIdempotencyKey =
-            options?.providerIdempotencyKey?.trim() || durableCallReceiptKey;
+          const executionRequestNonce = crypto.randomUUID();
+          // This identifies one logical tool call to billing. Physical retry
+          // count remains in request metadata, so a transport retry cannot
+          // reserve or charge the same call twice.
+          const deeplineRequestId = `ctx-tool-${stableDigest(executionRequestNonce).slice(0, 32)}`;
+          // The provider operation has a semantic identity independent of
+          // the response receipt. Its key is supplied by the caller that owns
+          // that compatibility contract; never substitute request/billing
+          // attribution for it.
           const providerIdempotencyReceiptKey =
-            options?.providerIdempotencyReceiptKey?.trim() ||
-            durableCallReceiptKey;
-          // Correlation identity is stable across every transport retry,
-          // including calls without a durable receipt.
-          const deeplineRequestId = providerIdempotencyKey
-            ? `ctx-tool-${stableDigest(providerIdempotencyKey).slice(0, 32)}`
-            : `ctx-tool-${crypto.randomUUID()}`;
+            options?.providerIdempotencyReceiptKey?.trim() || null;
+          const providerExecutionFenceKey = requiresExecutionFence
+            ? options?.providerIdempotencyKey?.trim() || null
+            : null;
+          if (requiresExecutionFence && !providerExecutionFenceKey) {
+            throw new Error(
+              `Tool ${toolId} requires a provider execution fence but no provider operation identity was supplied.`,
+            );
+          }
           // Every runtime provider call carries at least a tool-scoped
           // attribution. Callers that know the execution location (row-scoped
           // map cells, batched owners) supply the fuller scope.
@@ -13723,16 +13727,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 ...(requestsDurableInvocationFence
                   ? { invocation_fence_version: 1 }
                   : {}),
-                // Canonical provider-operation receipts validate this semantic
-                // plan before replay. It is intentionally removed from the
-                // legacy byte-receipt fingerprint so mixed runner artifacts
-                // retain their existing provider-once behavior.
-                ...(requestsDurableInvocationFence
-                  ? { canonical_operation: canonicalOperation }
-                  : {}),
-                // The worker-owned receipt coordinates this physical durable
-                // call. Provider idempotency is carried separately below so
-                // exact-payload reuse never replaces batch receipt ownership.
                 ...(durableCallReceiptKey
                   ? {
                       durable_call_receipt_key: durableCallReceiptKey,
@@ -13744,10 +13738,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                         : {}),
                     }
                   : {}),
-                ...(providerIdempotencyReceiptKey
+                ...(providerExecutionFenceKey
                   ? {
-                      provider_idempotency_receipt_key:
-                        providerIdempotencyReceiptKey,
+                      provider_idempotency_key: providerExecutionFenceKey,
+                      ...(providerIdempotencyReceiptKey
+                        ? {
+                            provider_idempotency_receipt_key:
+                              providerIdempotencyReceiptKey,
+                          }
+                        : {}),
                     }
                   : {}),
                 ...(options?.customerDbDataset
@@ -13770,9 +13769,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                         : {}),
                     }
                   : {}),
-                ...(providerIdempotencyKey
-                  ? { provider_idempotency_key: providerIdempotencyKey }
-                  : {}),
                 ...(playNodeScope
                   ? { play_node_scope: playNodeScopeToWire(playNodeScope) }
                   : {}),
@@ -13789,6 +13785,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             elapsedMs: number;
             requestId: string | null;
             aborted: boolean;
+            /** The ingress rejected the request before any provider dispatch. */
+            knownNotDispatched?: boolean;
           }): Promise<void> => {
             transportAttempt += 1;
             const diagnostic = describeTransportError(input.error);
@@ -13804,7 +13802,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 error: diagnostic,
               })}`,
             );
-            if (transportAttempt < TOOL_EXECUTE_TRANSPORT_MAX_ATTEMPTS) {
+            if (
+              transportAttempt < TOOL_EXECUTE_TRANSPORT_MAX_ATTEMPTS &&
+              (input.knownNotDispatched === true ||
+                ambiguousTransportReplayAllowed ||
+                fixtureReplaySafe)
+            ) {
+              invocationAttempt += 1;
               await this.governor.chargeBudget('retry');
               const retryAfterMs =
                 TOOL_RETRY_AFTER_FALLBACK_MS * transportAttempt;
@@ -14033,17 +14037,17 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                         'Content-Type': 'application/json',
                         Authorization: `Bearer ${this.#options.executorToken}`,
                         [EXECUTE_RESPONSE_CONTRACT_HEADER]:
-                          this.currentToolResponseContract,
+                          RAW_V2_TOOL_RESPONSE_CONTRACT,
                         [EXECUTE_RESPONSE_INTENT_HEADER]: 'dataset',
                         [EXECUTE_TOOL_METADATA_HEADER]: 'true',
                         [TOOL_EXECUTION_ERROR_SCHEMA_HEADER]: String(
                           toolErrorSchemaVersion,
                         ),
                         'x-deepline-request-id': deeplineRequestId,
-                        ...(providerIdempotencyKey
+                        ...(providerExecutionFenceKey
                           ? {
                               'x-deepline-idempotency-key':
-                                providerIdempotencyKey,
+                                providerExecutionFenceKey,
                             }
                           : {}),
                         ...protectionHeaders,
@@ -14145,40 +14149,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 (response === null ||
                   error instanceof ToolExecuteResponseBodyTransportError ||
                   error instanceof ToolExecuteInvalidJsonError);
-              const hasDurableInvocationIdentity = Boolean(
-                durableCallReceiptKey &&
-                providerIdempotencyKey &&
-                executionAuthScopeDigest,
-              );
               // A post-header body deadline aborts the fetch controller solely
               // to stop consuming that response. It must not also cancel the
               // independent gateway health check that establishes whether the
               // committed response can be replayed safely. Preserve genuine
               // caller/runtime cancellation by dropping the signal only when
               // this exact body deadline caused the abort.
-              const durableFenceVerificationSignal =
-                abortController?.signal.aborted === true &&
-                abortController.signal.reason instanceof
-                  ToolExecuteResponseBodyTimeoutError
-                  ? undefined
-                  : abortController?.signal;
-              const durableInvocationFenceVerified =
-                hasDurableInvocationIdentity &&
-                requestsDurableInvocationFence &&
-                (this.#options.durableInvocationFence === true ||
-                  (await this.#options
-                    .verifyDurableInvocationFence?.(
-                      durableFenceVerificationSignal,
-                    )
-                    .catch(() => false)) === true);
-              // Fixture execution has no provider-side effect. Replaying the
-              // same stable request after our own transport fails is always
-              // safe, even when this runner lacks a live-provider fence.
-              const fixtureReplaySafe =
-                this.#options.integrationMode === 'fixture';
               const transportReplaySafe =
                 !ambiguousDispatchedFailure ||
-                durableInvocationFenceVerified ||
+                ambiguousTransportReplayAllowed ||
                 fixtureReplaySafe;
               if (!transportReplaySafe) {
                 const diagnostic = describeTransportError(transportError);
@@ -14271,6 +14250,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   elapsedMs: providerCallElapsedMs ?? 0,
                   requestId: deeplineRequestId,
                   aborted: false,
+                  knownNotDispatched: true,
                 });
                 continue;
               }
@@ -14308,13 +14288,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   failure.backpressureDelayMs,
                 );
               }
-              if (failure.shouldRetry) {
-                if (
-                  failure.reason !== 'gateway_invocation_in_progress' &&
-                  failure.reason !== 'concurrency_backpressure'
-                ) {
-                  invocationAttempt += 1;
-                }
+              if (
+                failure.shouldRetry &&
+                (ambiguousTransportReplayAllowed ||
+                  retrySafeTransientHttp ||
+                  fixtureReplaySafe)
+              ) {
+                invocationAttempt += 1;
                 if (failure.chargeRetryBudget) {
                   await this.governor.chargeBudget('retry');
                 }