deepline 0.3.72 → 0.3.74

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -100,7 +100,6 @@ import {
 import { CTX_FETCH_EGRESS_TOOL_ID } from './builtin-pacing';
 import {
   legacyRawFromToolResponseRawV2,
-  normalizeToolResponseContract,
   providerMetaFromToolResponseRawV2,
   RAW_V2_TOOL_RESPONSE_CONTRACT,
   type ToolResponseContract,
@@ -115,7 +114,6 @@ import {
   isProviderUnavailable,
   serializeToolExecutionFailure,
   ToolExecutionError,
-  TOOL_EXECUTION_ERROR_SCHEMA_VERSION,
   TOOL_EXECUTION_ERROR_SCHEMA_HEADER,
   type ToolExecutionErrorSchemaVersion,
   type ToolExecutionFailureV1,
@@ -175,6 +173,7 @@ import {
   buildDurableToolAggregateReceiptKey,
   buildDurableToolCallAuthScopeDigest,
   buildDurableToolCallCacheKey,
+  buildLegacyRevisionedDurableToolCallCacheKey,
   buildDurableToolPayloadProviderIdempotencyKey,
   buildDurableToolProviderIdempotencyKey,
   buildDurableToolReceiptPrefix,
@@ -194,6 +193,10 @@ import {
   type PlayAuthoringRunScope,
   type PlayAuthoringRuntimeContext,
 } from '../plays/authoring-contract';
+import {
+  resolvePlayArtifactRuntimeContract,
+  type PlayArtifactRuntimeContract,
+} from './play-artifact-runtime-contract';
 import {
   LOG_LEVELS,
   formatCtxFetchHttpFailureDiagnostic,
@@ -406,14 +409,8 @@ type InlineCompositionStore = {
   governor: PlayExecutionGovernor;
   playName: string;
   staticPipeline: ContextOptions['staticPipeline'];
-  /** Immutable error contract pinned by the child play artifact. */
-  toolErrorSchemaVersion: ToolExecutionErrorSchemaVersion;
-  /** Immutable authoring semantics pinned by the child play artifact. */
-  authoringContractEdition: PlayAuthoringContractEdition;
-  /** Execute response contract pinned by the child artifact. */
-  toolResponseContract: ToolResponseContract;
-  /** Explicit response-transform revision used for durable receipt identity. */
-  toolResponseReceiptRevision?: string;
+  /** Immutable compatibility projection of the child Play artifact. */
+  runtimeContract: PlayArtifactRuntimeContract;
 };
 const inlineCompositionContext =
   new AsyncLocalStorage<InlineCompositionStore>();
@@ -1088,7 +1085,10 @@ export function resolveToolRuntimeTimeoutMs(
   authoringContractEdition: PlayAuthoringContractEdition = PLAY_AUTHORING_CONTRACT_EDITION,
 ): number | undefined {
   if (requestedTimeoutMs !== undefined) {
-    if (authoringContractEdition >= 2) {
+    if (
+      resolvePlayArtifactRuntimeContract({ authoringContractEdition }).semantics
+        .validation === 'strict'
+    ) {
       validatePlayAuthoringField(
         'ctx.tools.execute.timeoutMs',
         requestedTimeoutMs,
@@ -1395,6 +1395,8 @@ function playNodeScopeForToolCallRequest(
 type ToolExecutionApiOptions = {
   timeoutMs?: number;
   durableCallReceiptKey?: string | null;
+  /** The receipt key is a completed-result cache for this read-only call. */
+  completedResultCache?: boolean;
   executionAuthScopeDigest?: string | null;
   /**
    * Historical receipt identity used for the API's provider/billing
@@ -2112,6 +2114,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     { active: number; waiters: Array<() => void> }
   >();
   #options: ContextOptions;
+  private readonly rootRuntimeContract: PlayArtifactRuntimeContract;
   private readonly executionScope: RunExecutionScope;
   private logBuffer: string[] = [];
   private readonly logRateLimitState = new Map<
@@ -2250,7 +2253,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       assertNoSecretTaint(request.input, 'ctx.tools.execute input');
       if (
         request.timeoutMs !== undefined &&
-        this.currentAuthoringContractEdition >= 2
+        this.currentRuntimeSemantics.validation === 'strict'
       ) {
         validatePlayAuthoringField(
           'ctx.tools.execute.timeoutMs',
@@ -2259,7 +2262,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       }
       if (
         request.receiptWaitMs !== undefined &&
-        this.currentAuthoringContractEdition >= 2
+        this.currentRuntimeSemantics.validation === 'strict'
       ) {
         validatePlayAuthoringField(
           'ctx.tools.execute.receiptWaitMs',
@@ -2403,7 +2406,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       }
       const handle = createSecretHandle(name.trim());
       const value =
-        this.currentAuthoringContractEdition >= 4
+        this.currentRuntimeSemantics.secrets.value === 'plaintext_promise'
           ? createPlaintextSecretPromise(handle.name, () =>
               this.resolveSecretHandle(handle),
             )
@@ -2427,6 +2430,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   };
 
   constructor(options: ContextOptions) {
+    this.rootRuntimeContract =
+      options.artifactRuntimeContract ??
+      resolvePlayArtifactRuntimeContract({
+        authoringContractEdition: options.authoringContractEdition,
+        toolResponseContract: options.toolResponseContract,
+        toolResponseReceiptRevision: options.toolResponseReceiptRevision,
+      });
     const fixtureBehavior = validateFixtureBehavior(options.fixtureBehavior);
     if (fixtureBehavior.ok === false) {
       throw new Error(fixtureBehavior.error);
@@ -2746,42 +2756,54 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
 
   /**
    * Inline children share this context's queues, but not its artifact contract.
-   * Each child tool call must preserve the error shape pinned when that child
-   * was published, even when the parent was published under another schema.
+   * Each child uses its own admitted semantics and response projection even
+   * when the parent was published under another artifact contract.
    */
   private get currentToolErrorSchemaVersion(): ToolExecutionErrorSchemaVersion {
-    // Historical artifacts must not turn durable structured failures back into
-    // strings. Every runtime tool call and receipt rehydration uses v1.
-    return TOOL_EXECUTION_ERROR_SCHEMA_VERSION;
+    return this.currentRuntimeContract.toolErrorSchemaVersion;
   }
 
   private get currentToolResponseContract(): ToolResponseContract {
-    return normalizeToolResponseContract(
-      this.activeInlineComposition?.toolResponseContract ??
-        this.#options.toolResponseContract,
+    return this.currentRuntimeContract.toolResponseContract;
+  }
+
+  /**
+   * A real published artifact pins its response presentation in its launch
+   * contract. In-process callers that omit the option are runtime consumers,
+   * not historical Play artifacts, and retain the canonical result they pass
+   * in. This keeps the context API backward-compatible while letting a pinned
+   * legacy artifact request its old projection after a cache read.
+   */
+  private get hasPinnedToolResponseContract(): boolean {
+    return (
+      this.activeInlineComposition !== null ||
+      this.#options.artifactRuntimeContract !== undefined ||
+      this.#options.toolResponseContract !== undefined
     );
   }
 
   /**
-   * Only explicitly declared response transformations affect receipt reuse.
-   * Missing preserves historical artifact/receipt identity, while the public
-   * response header still normalizes it to the legacy V2 behavior above.
+   * Compatibility metadata retained for already-published artifacts. It never
+   * changes the completed-result cache identity.
    */
   private get currentToolResponseReceiptRevision(): string | undefined {
-    if (this.activeInlineComposition) {
-      return this.activeInlineComposition.toolResponseReceiptRevision;
-    }
-    return this.#options.toolResponseReceiptRevision;
+    return this.currentRuntimeContract.toolResponseReceiptRevision;
   }
 
   private get currentAuthoringContractEdition(): PlayAuthoringContractEdition {
+    return this.currentRuntimeContract.semantics.authoringContractEdition;
+  }
+
+  private get currentRuntimeContract(): PlayArtifactRuntimeContract {
     return (
-      this.activeInlineComposition?.authoringContractEdition ??
-      this.#options.authoringContractEdition ??
-      PLAY_AUTHORING_CONTRACT_EDITION
+      this.activeInlineComposition?.runtimeContract ?? this.rootRuntimeContract
     );
   }
 
+  private get currentRuntimeSemantics() {
+    return this.currentRuntimeContract.semantics;
+  }
+
   private recordPlayCallStep(input: {
     playId: string;
     execution?: 'inline';
@@ -4020,14 +4042,14 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       );
       if (normalized) byKey.set(normalized.key, normalized);
     }
-    await this.reconcileMissingRuntimeStepReceiptCompletions(
+    await this.reconcileIncompleteRuntimeStepReceiptCompletions(
       normalizedInputs,
       byKey,
     );
     return byKey;
   }
 
-  private async reconcileMissingRuntimeStepReceiptCompletions(
+  private async reconcileIncompleteRuntimeStepReceiptCompletions(
     receipts: Array<{
       key: string;
       runId: string;
@@ -4038,32 +4060,45 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     completedByKey: Map<string, RuntimeStepReceipt>,
   ): Promise<void> {
     if (
-      receipts.length === completedByKey.size ||
-      (!this.#options.getRuntimeStepReceipt &&
-        !this.#options.getRuntimeStepReceipts)
+      !this.#options.getRuntimeStepReceipt &&
+      !this.#options.getRuntimeStepReceipts
     ) {
       return;
     }
-    const missingKeys = receipts
+    // The receipt gateway is allowed to return a compact terminal
+    // acknowledgement without `output`. That is sufficient for old callers
+    // which keep the live result, but a completed-result cache must hydrate
+    // the stored output before handing it to a cache cohort.
+    const incompleteKeys = receipts
       .map((receipt) => receipt.key.trim())
-      .filter((key) => key && !completedByKey.has(key));
-    if (missingKeys.length === 0) return;
-    const latest = await this.getRuntimeStepReceipts(missingKeys);
-    for (const key of missingKeys) {
+      .filter((key) => {
+        if (!key) return false;
+        const completed = completedByKey.get(key);
+        return (
+          !completed ||
+          ((completed.status === 'completed' ||
+            completed.status === 'skipped') &&
+            completed.output === undefined)
+        );
+      });
+    if (incompleteKeys.length === 0) return;
+    const latest = await this.getRuntimeStepReceipts(incompleteKeys);
+    for (const key of incompleteKeys) {
       const recovered = latest.get(key);
       if (
-        recovered?.status === 'completed' ||
-        recovered?.status === 'skipped'
+        (recovered?.status === 'completed' ||
+          recovered?.status === 'skipped') &&
+        recovered.output !== undefined
       ) {
         completedByKey.set(key, recovered);
       }
     }
-    const recoveredCount = missingKeys.filter((key) =>
-      completedByKey.has(key),
+    const recoveredCount = incompleteKeys.filter(
+      (key) => completedByKey.get(key)?.output !== undefined,
     ).length;
     if (recoveredCount > 0) {
       this.runtimeLog(
-        `Runtime tool receipt completion response reconciled ${recoveredCount}/${missingKeys.length} missing receipt(s) from durable store read-back.`,
+        `Runtime tool receipt completion response hydrated ${recoveredCount}/${incompleteKeys.length} incomplete receipt(s) from durable store read-back.`,
       );
     }
   }
@@ -4178,17 +4213,39 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     );
   }
 
-  private async durableToolCallCacheKeyForScope(
-    input: {
-      toolId: string;
-      requestInput: Record<string, unknown>;
-      executionAuthScopeDigest?: string | null;
-      staleAfterSeconds?: number | null;
-      playLocalScope?: string | null;
-    },
-    toolResponseReceiptRevision: string | null | undefined = this
-      .currentToolResponseReceiptRevision,
-  ): Promise<string> {
+  private async durableToolCallCacheKeyForScope(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+    playLocalScope?: string | null;
+  }): Promise<string> {
+    const identity = await this.durableToolCallCacheIdentity(input);
+    return buildDurableToolCallCacheKey(identity);
+  }
+
+  private async legacyDurableToolCallCacheKeyForScope(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+    playLocalScope?: string | null;
+  }): Promise<string | null> {
+    const revision = this.currentToolResponseReceiptRevision;
+    if (!revision) return null;
+    return buildLegacyRevisionedDurableToolCallCacheKey({
+      ...(await this.durableToolCallCacheIdentity(input)),
+      toolResponseReceiptRevision: revision,
+    });
+  }
+
+  private async durableToolCallCacheIdentity(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+    playLocalScope?: string | null;
+  }): Promise<Parameters<typeof buildDurableToolCallCacheKey>[0]> {
     const providerActionVersion =
       (await this.#options.getToolActionCacheVersion?.(input.toolId))?.trim() ??
       '';
@@ -4196,7 +4253,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       input.executionAuthScopeDigest?.trim() ||
       (await this.resolveToolAuthScopeDigest(input.toolId))?.trim() ||
       null;
-    return buildDurableToolCallCacheKey({
+    return {
       orgId: this.#options.orgId,
       playLocalScope: input.playLocalScope,
       toolId: input.toolId,
@@ -4207,29 +4264,33 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         executionAuthScopeDigest,
       }),
       providerActionVersion,
-      toolResponseReceiptRevision,
       staleAfterSeconds: input.staleAfterSeconds,
       cacheEpochMs: this.durableCallCacheEpochMs,
+    };
+  }
+
+  private async durableToolCallCacheKey(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+  }): Promise<string> {
+    return await this.durableToolCallCacheKeyForScope({
+      ...input,
+      playLocalScope: this.currentGovernance.currentPlayId,
     });
   }
 
-  private async durableToolCallCacheKey(
-    input: {
-      toolId: string;
-      requestInput: Record<string, unknown>;
-      executionAuthScopeDigest?: string | null;
-      staleAfterSeconds?: number | null;
-    },
-    toolResponseReceiptRevision: string | null | undefined = this
-      .currentToolResponseReceiptRevision,
-  ): Promise<string> {
-    return await this.durableToolCallCacheKeyForScope(
-      {
-        ...input,
-        playLocalScope: this.currentGovernance.currentPlayId,
-      },
-      toolResponseReceiptRevision,
-    );
+  private async legacyDurableToolCallCacheKey(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+  }): Promise<string | null> {
+    return await this.legacyDurableToolCallCacheKeyForScope({
+      ...input,
+      playLocalScope: this.currentGovernance.currentPlayId,
+    });
   }
 
   private async resolveToolAuthScopeDigest(
@@ -5379,6 +5440,23 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     return null;
   }
 
+  private canReuseToolResultForCurrentResponseContract(
+    result: unknown,
+  ): boolean {
+    if (this.currentToolResponseContract !== RAW_V2_TOOL_RESPONSE_CONTRACT) {
+      return true;
+    }
+    const toolResult = isToolExecuteResult(result)
+      ? result
+      : isSerializedToolExecuteResult(result)
+        ? deserializeToolExecuteResult(result)
+        : null;
+    return (
+      toolResult !== null &&
+      Object.prototype.hasOwnProperty.call(toolResult.toolResponse, 'rawV2')
+    );
+  }
+
   private cacheToolResult(
     toolId: string,
     rowCacheKey: string,
@@ -5491,6 +5569,38 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     );
   }
 
+  /**
+   * Receipts retain the canonical raw-v2 provider outcome. Older artifacts
+   * receive their legacy projection only at the Play boundary, after cache
+   * lookup and persistence have finished.
+   */
+  private materializeToolExecutionResult(
+    result: ToolExecuteResult,
+  ): ToolExecuteResult {
+    if (
+      this.currentToolResponseContract === RAW_V2_TOOL_RESPONSE_CONTRACT ||
+      !this.hasPinnedToolResponseContract ||
+      !Object.prototype.hasOwnProperty.call(result.toolResponse, 'rawV2')
+    ) {
+      return result;
+    }
+    const serialized = serializeToolExecuteResult(result);
+    if (serialized.__kind !== 'deepline.tool_execute_result.v2') {
+      return result;
+    }
+    return deserializeToolExecuteResult({
+      ...serialized,
+      __kind: 'deepline.tool_execute_result.v1',
+      toolResponse: {
+        raw: legacyRawFromToolResponseRawV2(
+          serialized.toolResponse.rawV2,
+          serialized.toolResponse.view,
+          serialized.toolResponse.responseMeta,
+        ),
+      },
+    });
+  }
+
   private attachCustomerDbDatasetResult(
     toolId: string,
     requestInput: Record<string, unknown> | undefined,
@@ -9222,7 +9332,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     }
     if (
       options?.timeoutMs !== undefined &&
-      this.currentAuthoringContractEdition >= 2
+      this.currentRuntimeSemantics.validation === 'strict'
     ) {
       validatePlayAuthoringField(
         'ctx.tools.execute.timeoutMs',
@@ -9231,7 +9341,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     }
     if (
       options?.receiptWaitMs !== undefined &&
-      this.currentAuthoringContractEdition >= 2
+      this.currentRuntimeSemantics.validation === 'strict'
     ) {
       validatePlayAuthoringField(
         'ctx.tools.execute.receiptWaitMs',
@@ -9272,16 +9382,26 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       executionAuthScopeDigest,
       staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
     });
-    let providerIdempotencyKeyBase = await this.durableToolCallCacheKey(
-      {
-        toolId,
-        requestInput: input,
-        executionAuthScopeDigest,
-        staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
-      },
-      null,
-    );
-    const checkpointCacheKeys = [durableCacheKey];
+    let legacyDurableCacheKey = await this.legacyDurableToolCallCacheKey({
+      toolId,
+      requestInput: input,
+      executionAuthScopeDigest,
+      staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
+    });
+    // Only explicitly fenced operations use this key as a provider identity.
+    // Ordinary calls use it solely as their completed-result cache key.
+    let providerIdempotencyKeyBase = durableCacheKey;
+    let directResultReceiptKey = durableCacheKey;
+    // A raw-v2 artifact must never read an older receipt that cannot render
+    // raw-v2. If both the primary and its revisioned recovery receipt are
+    // unrenderable, make a live call rather than returning either cache entry.
+    // We cannot safely replace an immutable completed receipt, so that rare
+    // incompatible state deliberately forgoes caching until it is repaired.
+    let bypassDirectResultCache = false;
+    const checkpointCacheKeys = [
+      durableCacheKey,
+      ...(legacyDurableCacheKey ? [legacyDurableCacheKey] : []),
+    ];
 
     const executeTool = async (context?: {
       leaseId?: string | null;
@@ -9310,7 +9430,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       if (!store) {
         const directCacheKey = durableCacheKey;
         let initialDirectReceipt: RuntimeStepReceipt | null | undefined;
-        const cached = !cacheableToolResult
+        const cachedCandidate = !cacheableToolResult
           ? null
           : toolCachePolicy.force
             ? null
@@ -9319,6 +9439,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 checkpointCacheKeys,
                 'direct',
               );
+        const cached =
+          cachedCandidate &&
+          this.canReuseToolResultForCurrentResponseContract(
+            cachedCandidate.result.result,
+          )
+            ? cachedCandidate
+            : null;
         if (cached) {
           this.runtimeLog(`Calling tool: ${toolId} recovered from checkpoint`);
           // Started and settled are paired in a finally: an uncovered throw
@@ -9342,7 +9469,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               outcome: 'cached',
               durationMs: 0,
             });
-            return recovered;
+            return this.materializeToolExecutionResult(recovered);
           } finally {
             if (!settled) {
               this.emitToolCallLifecycle('settled', toolId, normalizedKey, {
@@ -9361,17 +9488,36 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const historicalReceipt = await this.withRuntimeReceiptHydrationTurn(
             async () => await this.getRuntimeStepReceipt(directCacheKey),
           );
-          initialDirectReceipt = historicalReceipt;
+          const historicalOutput = historicalReceipt
+            ? this.runtimeReceiptOutput<unknown>(historicalReceipt)
+            : undefined;
+          const historicalIsTerminal =
+            historicalReceipt?.status === 'completed' ||
+            historicalReceipt?.status === 'skipped';
+          const historicalCanServeCurrentContract =
+            !historicalIsTerminal ||
+            this.canReuseToolResultForCurrentResponseContract(historicalOutput);
+          initialDirectReceipt = historicalCanServeCurrentContract
+            ? historicalReceipt
+            : null;
+          if (!historicalCanServeCurrentContract) {
+            if (!legacyDurableCacheKey) {
+              throw new Error(
+                `Tool ${toolId} has an unrenderable legacy result but no response-contract recovery cache key.`,
+              );
+            }
+            directResultReceiptKey = legacyDurableCacheKey;
+          }
           if (
             historicalReceipt &&
-            (historicalReceipt.status === 'completed' ||
-              historicalReceipt.status === 'skipped') &&
+            historicalIsTerminal &&
+            historicalCanServeCurrentContract &&
             !isSerializedToolExecuteResult(historicalReceipt.output) &&
             !isToolExecuteResult(historicalReceipt.output)
           ) {
             const historicalOutput =
               this.runtimeReceiptOutput<unknown>(historicalReceipt);
-            return markToolExecuteResultExecutionOutcome(
+            const recoveredHistorical = markToolExecuteResultExecutionOutcome(
               historicalOutput,
               toolExecutionOutcomeForDurableReceipt({
                 source: 'cache',
@@ -9379,6 +9525,43 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 cacheKey: directCacheKey,
               }),
             );
+            return isToolExecuteResult(recoveredHistorical)
+              ? this.materializeToolExecutionResult(recoveredHistorical)
+              : recoveredHistorical;
+          }
+          if (
+            (!historicalReceipt || !historicalCanServeCurrentContract) &&
+            legacyDurableCacheKey
+          ) {
+            const legacyReceipt = await this.withRuntimeReceiptHydrationTurn(
+              async () =>
+                await this.getRuntimeStepReceipt(legacyDurableCacheKey!),
+            );
+            if (
+              legacyReceipt &&
+              (legacyReceipt.status === 'completed' ||
+                legacyReceipt.status === 'skipped') &&
+              legacyReceipt.output !== undefined
+            ) {
+              const recoveredLegacy = markToolExecuteResultExecutionOutcome(
+                this.runtimeReceiptOutput(legacyReceipt),
+                toolExecutionOutcomeForDurableReceipt({
+                  source: 'cache',
+                  receiptKey: legacyDurableCacheKey,
+                  cacheKey: directCacheKey,
+                }),
+              );
+              if (
+                this.canReuseToolResultForCurrentResponseContract(
+                  recoveredLegacy,
+                )
+              ) {
+                return isToolExecuteResult(recoveredLegacy)
+                  ? this.materializeToolExecutionResult(recoveredLegacy)
+                  : recoveredLegacy;
+              }
+              bypassDirectResultCache = true;
+            }
           }
         }
         this.runtimeLog(
@@ -9416,23 +9599,27 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               'Direct tool execution requires a stable logical call identity.',
             );
           }
-          const physicalDirectKey = cacheableToolResult
+          const useDirectResultReceipts =
+            cacheableToolResult && !bypassDirectResultCache;
+          const physicalDirectKey = useDirectResultReceipts
             ? directCacheKey
             : `${buildDurableToolReceiptPrefix({
                 orgId: this.#options.orgId ?? 'unknown-org',
                 toolId,
               })}${stableDigest(`${this.currentRunId}:${logicalCallId}:always-fresh`)}`;
+          const resultReceiptKey = directResultReceiptKey;
           const providerOperationKey = providerIdempotencyKeyBase;
-          const resultReceiptKey = directCacheKey;
           const toolRetryPolicy = await this.#options
             .getToolRetryPolicy?.(toolId, input)
             .catch(() => null);
-          // Direct cacheable calls now give ToolCall the real completed-result
-          // receipt Adapter. The provider-operation fence remains below the
-          // dispatcher: V2 and legacy presentation keys can therefore publish
-          // independent Tool Result Receipts without a second provider effect.
-          // Map members retain their cohort-owned receipt Adapter until their
-          // batched claim/heartbeat protocol moves behind the same Interface.
+          if (
+            bypassDirectResultCache &&
+            toolRetryPolicy?.requiresExecutionFence === true
+          ) {
+            throw new Error(
+              `Tool ${toolId} has an unrenderable completed result under an execution fence and cannot safely refresh it.`,
+            );
+          }
           const dispatcher = {
             dispatch: async ({
               providerOperationKey: operationKey,
@@ -9440,7 +9627,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               providerOperationKey: string | null;
             }) => {
               if (
-                cacheableToolResult &&
+                useDirectResultReceipts &&
                 operationKey !== providerOperationKey
               ) {
                 throw new Error(
@@ -9453,18 +9640,11 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 startedAt: directCallStartedAt,
                 input,
                 options: {
-                  ...(cacheableToolResult
+                  ...(useDirectResultReceipts
                     ? {
                         durableCallReceiptKey: physicalDirectKey,
+                        completedResultCache: true,
                         executionAuthScopeDigest,
-                        providerIdempotencyReceiptKey: operationKey,
-                        providerIdempotencyKey:
-                          this.providerIdempotencyKeyForToolCall({
-                            cacheKey: providerIdempotencyKeyBase,
-                            force: toolCachePolicy.force,
-                            leaseId: directReceiptLeaseId,
-                            logicalCallId,
-                          }),
                         ...(directReceiptLeaseId &&
                         (this.#options.heartbeatRuntimeStepReceipts ||
                           this.#options.getRuntimeStepReceipt ||
@@ -9487,6 +9667,24 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                           : {}),
                       }
                     : {}),
+                  ...(toolRetryPolicy?.requiresExecutionFence === true
+                    ? {
+                        providerIdempotencyReceiptKey:
+                          cacheableToolResult && operationKey
+                            ? operationKey
+                            : physicalDirectKey,
+                        providerIdempotencyKey:
+                          this.providerIdempotencyKeyForToolCall({
+                            cacheKey:
+                              useDirectResultReceipts && operationKey
+                                ? providerIdempotencyKeyBase
+                                : physicalDirectKey,
+                            force: cacheableToolResult && toolCachePolicy.force,
+                            leaseId: directReceiptLeaseId,
+                            logicalCallId,
+                          }),
+                      }
+                    : {}),
                   playNodeScope: buildPlayNodeScope({
                     toolId,
                     callKey: normalizedKey,
@@ -9511,14 +9709,14 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 execution: toolExecutionMetadataForOutcome({
                   kind: 'live',
                   cacheKey: directCacheKey,
-                  ...(cacheableToolResult
+                  ...(useDirectResultReceipts
                     ? { receiptKey: resultReceiptKey }
                     : {}),
                 }),
               });
             },
           };
-          const toolCall = cacheableToolResult
+          const toolCall = useDirectResultReceipts
             ? createToolCallJob({
                 resultReceipts: createRuntimeStepToolResultReceipts({
                   store: this.durableReceiptExecutionStore(),
@@ -9526,7 +9724,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   ...(initialDirectReceipt !== undefined
                     ? {
                         initialReceipt: {
-                          key: directCacheKey,
+                          key: directResultReceiptKey,
                           receipt: initialDirectReceipt,
                         },
                       }
@@ -9537,6 +9735,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     ? {
                         executionLock: {
                           required: true,
+                          key: providerOperationKey,
                           ttlMs: Math.min(
                             600_000,
                             resolveToolRuntimeTimeoutMs(
@@ -9599,11 +9798,16 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               })
             : await createAlwaysFreshToolCallAdapter({ dispatcher }).call(call);
           settleDirectCall(toolAttemptOutcomeForResult(wrapped));
-          if (cacheableToolResult) {
-            this.cacheToolResult(toolId, directCacheKey, wrapped, 'direct');
+          if (useDirectResultReceipts) {
+            this.cacheToolResult(
+              toolId,
+              directResultReceiptKey,
+              wrapped,
+              'direct',
+            );
             this.#options.onBatchComplete?.(this.checkpoint);
           }
-          return wrapped;
+          return this.materializeToolExecutionResult(wrapped);
         } catch (error) {
           settleDirectCall('failed', error);
           throw error;
@@ -9637,17 +9841,22 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           : this.getCachedToolResultCandidate(toolId, checkpointCacheKeys);
       if (cached) {
         this.runtimeLog(`  Row ${rowId} ${toolId}: recovered from checkpoint`);
-        return await this.wrapToolExecutionResult({
-          toolId,
-          status: cached.result.result == null ? 'no_result' : 'completed',
-          result: cached.result.result,
-          requestInput: input,
-          execution: toolExecutionMetadataForOutcome({
-            kind: 'checkpoint',
-            cacheKey: cached.cacheKey,
+        return this.materializeToolExecutionResult(
+          await this.wrapToolExecutionResult({
+            toolId,
+            status: cached.result.result == null ? 'no_result' : 'completed',
+            result: cached.result.result,
+            requestInput: input,
+            execution: toolExecutionMetadataForOutcome({
+              kind: 'checkpoint',
+              cacheKey: cached.cacheKey,
+            }),
           }),
-        });
+        );
       }
+      const rowToolRetryPolicy = await this.#options
+        .getToolRetryPolicy?.(toolId, input)
+        .catch(() => null);
 
       // ADR 0018: record this leg before it runs. `producer` still names the
       // last leg (the usual cascade winner); `producers` keeps every leg, which
@@ -9702,7 +9911,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           providerIdempotencyKeyBase,
           cacheable: cacheableToolResult,
           receiptKey: cacheableToolResult ? durableCacheKey : null,
+          legacyReceiptKeys: legacyDurableCacheKey
+            ? [legacyDurableCacheKey]
+            : [],
           executionAuthScopeDigest,
+          requiresExecutionFence:
+            rowToolRetryPolicy?.requiresExecutionFence === true,
           force: toolCachePolicy.force,
           forceFailedRefresh: toolCachePolicy.forceFailedRefresh,
           rowId,
@@ -9722,7 +9936,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       return await pendingToolCall.then(
         (value) => {
           settleProducerAttempt(toolAttemptOutcomeForResult(value));
-          return value;
+          return this.materializeToolExecutionResult(
+            value as ToolExecuteResult,
+          );
         },
         (error: unknown) => {
           settleProducerAttempt('failed');
@@ -9771,16 +9987,21 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           executionAuthScopeDigest,
           staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
         });
-        providerIdempotencyKeyBase = await this.durableToolCallCacheKey(
-          {
-            toolId,
-            requestInput: input,
-            executionAuthScopeDigest,
-            staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
-          },
-          null,
+        legacyDurableCacheKey = await this.legacyDurableToolCallCacheKey({
+          toolId,
+          requestInput: input,
+          executionAuthScopeDigest,
+          staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
+        });
+        providerIdempotencyKeyBase = durableCacheKey;
+        directResultReceiptKey = durableCacheKey;
+        bypassDirectResultCache = false;
+        checkpointCacheKeys.splice(
+          0,
+          checkpointCacheKeys.length,
+          durableCacheKey,
+          ...(legacyDurableCacheKey ? [legacyDurableCacheKey] : []),
         );
-        checkpointCacheKeys[0] = durableCacheKey;
       }
     }
 
@@ -9949,8 +10170,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     const childCompatibility = normalizePlayContractCompatibility(
       childCompatibilitySnapshot,
     );
-    const childToolErrorSchemaVersion =
-      childCompatibility.toolErrorSchemaVersion;
     const childToolResponseContract = childCompatibility.toolResponseContract;
     const childToolResponseReceiptRevision =
       childCompatibility.toolResponseReceiptRevision;
@@ -10025,11 +10244,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             governor: inlineChildGovernor,
             playName: resolvedName,
             staticPipeline: resolvedPlay.staticPipeline ?? null,
-            toolErrorSchemaVersion: childToolErrorSchemaVersion,
-            toolResponseContract: childToolResponseContract,
-            toolResponseReceiptRevision: childToolResponseReceiptRevision,
-            authoringContractEdition:
-              childCompatibility.authoringContractEdition,
+            runtimeContract: resolvePlayArtifactRuntimeContract({
+              authoringContractEdition:
+                childCompatibility.authoringContractEdition,
+              toolResponseContract: childToolResponseContract,
+              toolResponseReceiptRevision: childToolResponseReceiptRevision,
+            }),
           },
           () => this.executeResolvedPlay(resolvedPlay, this, input),
         );
@@ -10338,7 +10558,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   async sleep(ms: number): Promise<void> {
     this.assertInlineChildContract('suspending_child');
     const delayMs =
-      this.currentAuthoringContractEdition >= 2
+      this.currentRuntimeSemantics.validation === 'strict'
         ? (validatePlayAuthoringField('ctx.sleep.ms', ms), ms)
         : Math.max(0, Math.round(ms));
     if (this.#options.durableBoundaries) {
@@ -10464,14 +10684,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               ...secretHeaderMarkers,
             },
             row: rowFetchScope,
-            // Edition 5 changes non-2xx responses from cached values to
-            // non-cacheable errors. Partition those receipts from editions
-            // 1–4 so a republished artifact makes a fresh request instead of
-            // inheriting a legacy error record.
-            ...(this.currentAuthoringContractEdition >= 5
+            // A pinned fetch policy that turns non-2xx responses into typed,
+            // non-cacheable errors needs its own receipt epoch. Preserve the
+            // historical epoch selected by the artifact rather than deriving a
+            // new cache key from every future authoring edition.
+            ...(this.currentRuntimeSemantics.fetch.receiptIdentityEdition !==
+            null
               ? {
                   authoringContractEdition:
-                    this.currentAuthoringContractEdition,
+                    this.currentRuntimeSemantics.fetch.receiptIdentityEdition,
                 }
               : {}),
           }),
@@ -10487,7 +10708,11 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               httpStatus: output.status,
             });
           }
-          if (!output.ok && this.currentAuthoringContractEdition >= 5) {
+          if (
+            !output.ok &&
+            this.currentRuntimeSemantics.fetch.httpFailure ===
+              'throw_typed_error'
+          ) {
             throw new CtxFetchHttpError(output);
           }
           return output;
@@ -10495,7 +10720,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         shouldPersistFailure: (error) =>
           !(
             error instanceof CtxFetchHttpError &&
-            this.currentAuthoringContractEdition >= 5
+            !this.currentRuntimeSemantics.fetch.persistHttpFailure
           ),
         execute: async ({ retainExternalCallSlot }) => {
           const secretHeaders = await this.resolveSecretAuth(secretAuth);
@@ -10699,11 +10924,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               });
             }
 
-            // Edition 5 adopts normal fetch semantics: a non-2xx response is
-            // a failed durable operation. Throw before checkpoint/receipt
-            // completion so the failure is never cached. Editions 1–4 retain
-            // their response-record behavior for the same upstream response.
-            if (!output.ok && this.currentAuthoringContractEdition >= 5) {
+            // The artifact-pinned fetch policy decides whether a non-2xx
+            // response is a returned record or a failed durable operation.
+            // Throw before checkpoint/receipt completion so the throwing
+            // policy never caches its failure.
+            if (
+              !output.ok &&
+              this.currentRuntimeSemantics.fetch.httpFailure ===
+                'throw_typed_error'
+            ) {
               throw new CtxFetchHttpError(output);
             }
 
@@ -11009,75 +11238,59 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   /**
    * Concrete RuntimeStepReceipt adapter for the map receipt-cohort Module.
    *
-   * It is intentionally shared by scalar and provider-native map calls. The
-   * two call shapes differ at provider dispatch, not at the member receipt
-   * protocol: both need an atomic claim/reclaim, a single cohort heartbeat,
-   * and lease-fenced terminal fanout. Keeping that at one seam prevents a
-   * native batch from becoming a second, subtly different receipt runtime.
+   * Scalar and provider-native map calls share completed-result cache reads
+   * and atomic successful inserts. A miss has no durable execution owner.
    */
   private createRuntimeStepToolCallReceiptCohortStore(input: {
     toolId: string;
     requestForReceipt: ReadonlyMap<string, ToolCallRequest>;
   }): ToolCallReceiptCohortStore {
     const asRecord = async (
-      receiptKey: string,
+      resultReceiptKey: string,
+      storedReceiptKey: string,
       receipt: RuntimeStepReceipt | null | undefined,
     ): Promise<ToolCallReceiptRecord | null> => {
       if (!receipt) return null;
-      const normalized = this.normalizeRuntimeStepReceipt(receiptKey, receipt);
+      const normalized = this.normalizeRuntimeStepReceipt(
+        storedReceiptKey,
+        receipt,
+      );
       if (!normalized) return null;
-      const request = input.requestForReceipt.get(receiptKey);
+      if (
+        normalized.status !== 'completed' &&
+        normalized.status !== 'skipped'
+      ) {
+        return null;
+      }
+      // A terminal acknowledgement without output is not a cache hit. The
+      // completion path hydrates it first; if that read cannot provide an
+      // output, retain the live result rather than resolving `undefined`.
+      if (normalized.output === undefined) return null;
+      const request = input.requestForReceipt.get(resultReceiptKey);
       if (!request) {
         throw new Error(
-          `Unknown Tool Call Receipt Cohort receipt ${receiptKey}.`,
+          `Unknown Tool Call Receipt Cohort receipt ${resultReceiptKey}.`,
         );
       }
-      const terminal =
-        normalized.status === 'completed' || normalized.status === 'skipped';
-      const result = terminal
-        ? await this.wrapToolExecutionResult({
-            toolId: input.toolId,
-            status:
-              normalized.output === null || normalized.output === undefined
-                ? 'no_result'
-                : 'completed',
-            result: this.runtimeReceiptOutput(normalized),
-            requestInput: request.input,
-            execution: toolExecutionMetadataForOutcome({
-              kind: 'cache',
-              cacheKey: request.cacheKey,
-              receiptKey,
-              attachedToReceiptKey: receiptKey,
-            }),
-          })
-        : undefined;
+      const result = await this.wrapToolExecutionResult({
+        toolId: input.toolId,
+        status:
+          normalized.output === null || normalized.output === undefined
+            ? 'no_result'
+            : 'completed',
+        result: this.runtimeReceiptOutput(normalized),
+        requestInput: request.input,
+        execution: toolExecutionMetadataForOutcome({
+          kind: 'cache',
+          cacheKey: request.cacheKey,
+          receiptKey: resultReceiptKey,
+          attachedToReceiptKey: storedReceiptKey,
+        }),
+      });
       return {
-        resultReceiptKey: receiptKey,
+        resultReceiptKey,
         status: normalized.status,
-        ...(result !== undefined ? { result } : {}),
-        ...(normalized.status === 'failed'
-          ? {
-              error: runtimeReceiptFailureError(
-                normalized,
-                'Durable tool call failed',
-                this.currentToolErrorSchemaVersion,
-              ),
-            }
-          : {}),
-        ...(normalized.leaseId &&
-        (normalized.leaseOwnerRunId ?? normalized.runId)?.trim()
-          ? {
-              lease: {
-                leaseId: normalized.leaseId,
-                ownerRunId: (normalized.leaseOwnerRunId ??
-                  normalized.runId)!.trim(),
-              },
-            }
-          : {}),
-        ...(normalized.leaseExpiresAt
-          ? { leaseExpiresAt: normalized.leaseExpiresAt }
-          : {}),
-        ...(normalized.claimState ? { claimState: normalized.claimState } : {}),
+        result,
       };
     };
     const recordsFor = async (
@@ -11086,10 +11299,22 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     ): Promise<ToolCallReceiptRecord[]> =>
       (
         await Promise.all(
-          receiptKeys.map(
-            async (receiptKey) =>
-              await asRecord(receiptKey, receipts.get(receiptKey)),
-          ),
+          receiptKeys.map(async (receiptKey) => {
+            const request = input.requestForReceipt.get(receiptKey);
+            const candidates = [
+              receiptKey,
+              ...(request?.legacyReceiptKeys ?? []),
+            ];
+            for (const candidate of candidates) {
+              const record = await asRecord(
+                receiptKey,
+                candidate,
+                receipts.get(candidate),
+              );
+              if (record) return record;
+            }
+            return null;
+          }),
         )
       ).filter((record): record is ToolCallReceiptRecord => record !== null);
 
@@ -11099,83 +11324,17 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           async () =>
             await recordsFor(
               resultReceiptKeys,
-              await this.getRuntimeStepReceipts(resultReceiptKeys),
+              await this.getRuntimeStepReceipts([
+                ...new Set(
+                  resultReceiptKeys.flatMap((receiptKey) => [
+                    receiptKey,
+                    ...(input.requestForReceipt.get(receiptKey)
+                      ?.legacyReceiptKeys ?? []),
+                  ]),
+                ),
+              ]),
             ),
         ),
-      claim: async ({ receipts }) => {
-        const claims = new Map<string, RuntimeStepReceipt>();
-        const groups = new Map<string, Array<(typeof receipts)[number]>>();
-        for (const receipt of receipts) {
-          const groupKey = [
-            receipt.reclaimRunning ? 'reclaim' : 'ordinary',
-            receipt.force ? 'force' : 'cached',
-            receipt.forceFailedRefresh ? 'failed-force' : 'failed-cached',
-          ].join(':');
-          const group = groups.get(groupKey) ?? [];
-          group.push(receipt);
-          groups.set(groupKey, group);
-        }
-        for (const group of groups.values()) {
-          const first = group[0]!;
-          const claimed = await this.claimRuntimeStepReceipts(
-            group.map((receipt) => receipt.resultReceiptKey),
-            this.currentReceiptOwnerRunId,
-            first.reclaimRunning,
-            first.force,
-            first.forceFailedRefresh,
-          );
-          for (const [key, receipt] of claimed) claims.set(key, receipt);
-        }
-        const safeFailedKeys = receipts.flatMap((receipt) => {
-          const claimed = claims.get(receipt.resultReceiptKey);
-          return claimed && this.canRetryWithoutProviderDispatch(claimed)
-            ? [receipt.resultReceiptKey]
-            : [];
-        });
-        if (safeFailedKeys.length > 0) {
-          const refreshed = await this.claimRuntimeStepReceipts(
-            safeFailedKeys,
-            this.currentReceiptOwnerRunId,
-            false,
-            false,
-            true,
-          );
-          for (const [key, receipt] of refreshed) claims.set(key, receipt);
-        }
-        return await recordsFor(
-          receipts.map((receipt) => receipt.resultReceiptKey),
-          claims,
-        );
-      },
-      heartbeat: async ({ receipts }) => {
-        if (!this.#options.heartbeatRuntimeStepReceipts) {
-          return await recordsFor(
-            receipts.map((receipt) => receipt.resultReceiptKey),
-            await this.getRuntimeStepReceipts(
-              receipts.map((receipt) => receipt.resultReceiptKey),
-            ),
-          );
-        }
-        const response = await this.#options.heartbeatRuntimeStepReceipts({
-          runId: this.currentReceiptOwnerRunId,
-          runAttempt: this.currentRunAttempt,
-          keys: receipts.map((receipt) => receipt.resultReceiptKey),
-          leaseIds: receipts.map((receipt) => receipt.lease.leaseId),
-        });
-        const byKey = new Map<string, RuntimeStepReceipt>();
-        for (let index = 0; index < receipts.length; index += 1) {
-          const request = receipts[index]!;
-          const normalized = this.normalizeRuntimeStepReceipt(
-            request.resultReceiptKey,
-            response[index],
-          );
-          if (normalized) byKey.set(request.resultReceiptKey, normalized);
-        }
-        return await recordsFor(
-          receipts.map((receipt) => receipt.resultReceiptKey),
-          byKey,
-        );
-      },
       complete: async ({ receipts }) => {
         const completed = await this.completeRuntimeStepReceipts(
           receipts.map((receipt) => ({
@@ -11190,33 +11349,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           completed,
         );
       },
-      fail: async ({ receipts }) => {
-        const failed = await this.failRuntimeStepReceipts(
-          receipts.map((receipt) => ({
-            key: receipt.resultReceiptKey,
-            runId: this.currentReceiptOwnerRunId,
-            leaseId: receipt.lease.leaseId,
-            error: this.formatRuntimeError(receipt.error),
-            errorPayload: serializeToolExecutionFailure(receipt.error),
-            failureKind: runtimeReceiptFailureKindForError(receipt.error),
-          })),
-        );
-        return await recordsFor(
-          receipts.map((receipt) => receipt.resultReceiptKey),
-          failed,
-        );
-      },
     };
   }
 
   /**
-   * The scalar map path used to duplicate the receipt state machine in
-   * `executeBatchedToolCalls`: one loop claimed/reclaimed/followed rows and a
-   * later loop heartbeated and completed them.  That made it too easy for the
-   * Tool Call boundary to be only cosmetic.  This is the narrow replacement
-   * slice: cacheable members of a *non-native* map hand their whole receipt
-   * lifecycle to the cohort Module, while this Context remains only the
-   * transport/presentation Adapter.
+   * Cacheable scalar map members share completed-result reads and successful
+   * writes through the cohort Module. This Context only transports and
+   * presents results.
    *
    * Do not widen this to physical native batches or always-fresh calls. A
    * native batch owns a different aggregate operation receipt, and
@@ -11318,7 +11457,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     const resolve = async (
       request: ToolCallRequest,
       result: ToolExecuteResult,
-      source: 'cache' | 'in_flight' | 'owner',
+      source: 'cache' | 'owner',
     ): Promise<void> => {
       const receiptKey = request.receiptKey!;
       const finalResult = cloneToolExecuteResultWithExecution(
@@ -11353,180 +11492,111 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     };
     const reject = async (request: ToolCallRequest, error: unknown) => {
       await this.rejectToolCall(toolId, request, error, {
-        // ToolCallReceiptCohort is the one failure writer. Re-entering the
-        // legacy writer here would race its member terminal transition.
+        // Failures are never cache entries, including failed local misses.
         persistReceiptFailure: false,
       });
     };
 
-    try {
-      const handled = new Set<string>();
-      const followOrRecover: Promise<void>[] = [];
-      const collectReadyMembers = (): Array<{
+    const handled = new Set<string>();
+    const followerResults: Promise<void>[] = [];
+    const collectReadyMembers = (): Array<{
+      request: ToolCallRequest;
+      receipts: ToolResultReceipts;
+    }> => {
+      const owned: Array<{
         request: ToolCallRequest;
         receipts: ToolResultReceipts;
-      }> => {
-        const owned: Array<{
-          request: ToolCallRequest;
-          receipts: ToolResultReceipts;
-        }> = [];
-        for (const request of requests) {
-          if (handled.has(request.callId)) continue;
-          const member = cohort.member(request.callId);
-          if (member.kind === 'recovering') continue;
-          handled.add(request.callId);
-          if (member.kind === 'completed') {
-            followOrRecover.push(
-              resolve(request, member.result, member.source),
-            );
-          } else if (member.kind === 'failed') {
-            followOrRecover.push(reject(request, member.error));
-          } else if (member.kind === 'following') {
-            followOrRecover.push(
-              member.result.then(
-                async (result) => await resolve(request, result, 'in_flight'),
-                async (error: unknown) => await reject(request, error),
-              ),
-            );
-          } else {
-            request.receiptLeaseId = member.lease.leaseId;
-            request.receiptLeaseExpiresAt = member.leaseExpiresAt ?? null;
-            owned.push({ request, receipts: member.receipts });
-          }
+      }> = [];
+      for (const request of requests) {
+        if (handled.has(request.callId)) continue;
+        const member = cohort.member(request.callId);
+        handled.add(request.callId);
+        if (member.kind === 'completed') {
+          followerResults.push(resolve(request, member.result, member.source));
+        } else if (member.kind === 'following') {
+          followerResults.push(
+            member.result.then(
+              async (result) => await resolve(request, result, 'owner'),
+              async (error: unknown) => await reject(request, error),
+            ),
+          );
+        } else {
+          owned.push({ request, receipts: member.receipts });
         }
-        return owned;
-      };
+      }
+      return owned;
+    };
 
-      const width = Math.min(
-        this.governor.policy.concurrency.toolCalls,
-        Math.max(
-          1,
-          await this.resourceGovernor.suggestedToolParallelism(
-            toolId,
-            this.governor.policy.concurrency.toolCalls,
-          ),
+    const width = Math.min(
+      this.governor.policy.concurrency.toolCalls,
+      Math.max(
+        1,
+        await this.resourceGovernor.suggestedToolParallelism(
+          toolId,
+          this.governor.policy.concurrency.toolCalls,
         ),
-      );
-      const dispatchOwned = async (
-        owned: Array<{
-          request: ToolCallRequest;
-          receipts: ToolResultReceipts;
-        }>,
-      ) =>
-        await dispatchBoundedSettled(
-          owned,
-          width,
-          async ({ request, receipts }) => {
-            if (this.persistenceLatch.tripped) {
-              const error = new RuntimePersistenceCircuitOpenError(
-                this.persistenceLatch,
-              );
-              await cohort.fail([{ memberId: request.callId, error }]);
-              throw error;
-            }
-            let releaseToolSlot: () => void = () => undefined;
-            try {
-              const result = await this.executeMappedToolCallThroughModule({
-                request,
-                dispatchToolId: toolId,
-                dispatchPayload: request.input,
-                resultReceiptKey: request.receiptKey!,
-                providerOperationKey:
-                  request.providerIdempotencyKeyBase ?? request.receiptKey!,
-                resultReceipts: receipts,
-                apiOptions: {
-                  beforeProviderCall: () => {
-                    if (cohortLeaseLost) throw cohortLeaseLost;
-                    heartbeat.assertOwned();
-                  },
-                  heartbeatReceipt: async () => {
-                    try {
-                      const outcome = await cohort.heartbeat();
-                      if (outcome === 'terminal') {
-                        throw new ToolCallReceiptLeaseLostError(
-                          request.receiptKey!,
-                        );
-                      }
-                    } catch (error) {
-                      if (error instanceof ToolCallReceiptLeaseLostError) {
-                        throw new RuntimeReceiptLeaseLostError({
-                          receiptKey: request.receiptKey!,
-                          runId: this.currentReceiptOwnerRunId,
-                          leaseId:
-                            request.receiptLeaseId ?? 'missing-cohort-lease',
-                        });
-                      }
-                      throw error;
-                    }
-                  },
-                  playNodeScope: playNodeScopeForToolCallRequest(request),
-                  durableCallReceiptKey: request.receiptKey,
-                  executionAuthScopeDigest: request.executionAuthScopeDigest,
-                  providerIdempotencyReceiptKey:
-                    request.providerIdempotencyKeyBase ?? request.receiptKey,
-                  providerIdempotencyKey:
-                    this.providerIdempotencyKeyForToolCall({
-                      cacheKey:
-                        request.providerIdempotencyKeyBase ??
-                        request.receiptKey!,
-                      force: request.force === true,
-                      leaseId: request.receiptLeaseId,
-                      logicalCallId: request.logicalCallId,
-                    }),
-                  receiptLeaseExpiresAt: request.receiptLeaseExpiresAt,
-                  timeoutMs:
-                    typeof request.timeoutMs === 'number' &&
-                    request.timeoutMs > 0
-                      ? request.timeoutMs
-                      : undefined,
-                  retainToolSlot: (release) => {
-                    releaseToolSlot = release;
-                  },
+      ),
+    );
+    const dispatchOwned = async (
+      owned: Array<{
+        request: ToolCallRequest;
+        receipts: ToolResultReceipts;
+      }>,
+    ) =>
+      await dispatchBoundedSettled(
+        owned,
+        width,
+        async ({ request, receipts }) => {
+          if (this.persistenceLatch.tripped) {
+            const error = new RuntimePersistenceCircuitOpenError(
+              this.persistenceLatch,
+            );
+            throw error;
+          }
+          let releaseToolSlot: () => void = () => undefined;
+          try {
+            const result = await this.executeMappedToolCallThroughModule({
+              request,
+              dispatchToolId: toolId,
+              dispatchPayload: request.input,
+              resultReceiptKey: request.receiptKey!,
+              providerOperationKey:
+                request.providerIdempotencyKeyBase ?? request.receiptKey!,
+              resultReceipts: receipts,
+              apiOptions: {
+                playNodeScope: playNodeScopeForToolCallRequest(request),
+                durableCallReceiptKey: request.receiptKey,
+                completedResultCache: true,
+                executionAuthScopeDigest: request.executionAuthScopeDigest,
+                timeoutMs:
+                  typeof request.timeoutMs === 'number' && request.timeoutMs > 0
+                    ? request.timeoutMs
+                    : undefined,
+                retainToolSlot: (release) => {
+                  releaseToolSlot = release;
                 },
-              });
-              await resolve(request, result, 'owner');
-            } catch (error) {
-              await reject(request, error);
-            } finally {
-              releaseToolSlot();
-            }
-          },
-        );
+              },
+            });
+            await resolve(request, result, 'owner');
+          } catch (error) {
+            await reject(request, error);
+          } finally {
+            releaseToolSlot();
+          }
+        },
+      );
 
-      // Eager cohort acquisition makes the initial claim available before a
-      // foreign receipt's read/reclaim path completes. This preserves map
-      // overlap: a broken foreign read must not strand an already-owned
-      // provider operation behind it.
-      const initialDispatch = dispatchOwned(collectReadyMembers());
-      const settlement = cohort.settle();
-      const [initialResult, settlementResult] = await Promise.allSettled([
-        initialDispatch,
-        settlement,
-      ]);
-      // A recovery can reclaim an expired receipt and turn it into another
-      // owned member. Collect its final state after the initial work settles.
-      const recoveredDispatch = await dispatchOwned(collectReadyMembers());
-      await Promise.allSettled(followOrRecover);
-      // dispatchBoundedSettled intentionally captures provider failures; all
-      // affected row resolvers have already been rejected above.
-      void initialResult;
-      void recoveredDispatch;
-      if (settlementResult.status === 'rejected') {
-        throw settlementResult.reason;
-      }
-    } finally {
-      heartbeat.stop();
-    }
+    await dispatchOwned(collectReadyMembers());
+    await Promise.allSettled(followerResults);
     return successful;
   }
 
   /**
    * Executes provider-native batches through the Native Batch Tool Call
-   * Module. Unlike the compatibility path below, the Module owns the member
-   * receipt cohort from claim through recovery, heartbeat and terminal split
-   * fanout. This method is only the runtime Adapter: it compiles provider
-   * payloads, invokes transport, and presents already-terminal member values
-   * to map rows.
+   * Module. The Module reads exact completed-result cache entries, batches
+   * misses, then publishes each successful split result. This Context only
+   * compiles provider payloads, invokes transport, and presents terminal
+   * member values to map rows.
    */
   private async executeCacheableNativeMapToolCallCohort(input: {
     toolId: string;
@@ -11581,9 +11651,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             batchParallelismCeiling,
           )
         : batchParallelismCeiling;
-    const batchProviderActionVersion =
-      (await this.#options.getToolActionCacheVersion?.(toolId))?.trim() ??
-      'unversioned';
     const successful: ToolCallRequest[] = [];
 
     const deliver = (request: ToolCallRequest, result: ToolExecuteResult) => {
@@ -11613,7 +11680,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     };
     const reject = async (request: ToolCallRequest, error: unknown) => {
       await this.rejectToolCall(toolId, request, error, {
-        // NativeBatchToolCall owns the durable member failure transition.
+        // Failed provider calls are never cache entries.
         persistReceiptFailure: false,
       });
     };
@@ -11675,15 +11742,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     call.payload,
                     {
                       durableCallReceiptKey: compatibility.resultReceiptKey,
+                      completedResultCache: true,
                       playNodeScope: playNodeScopeForToolCallRequest(
                         detail.members[0]!,
                         call.tool.id,
                       ),
                       executionAuthScopeDigest:
                         detail.members[0]?.executionAuthScopeDigest ?? null,
-                      providerIdempotencyReceiptKey:
-                        detail.providerOperationKey,
-                      providerIdempotencyKey: detail.providerOperationKey,
                       receiptLeaseExpiresAt: detail.receiptLeaseExpiresAt,
                       timeoutMs: detail.timeoutMs,
                     },
@@ -11751,8 +11816,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               },
               compatibility: {
                 resultReceiptKey: request.receiptKey!,
-                providerOperationKey:
-                  request.providerIdempotencyKeyBase ?? request.receiptKey!,
+                providerOperationKey: request.receiptKey!,
               },
             },
           })),
@@ -11775,27 +11839,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 'Native batch owned members changed provider operation during compilation.',
               );
             }
-            const providerOperationKey =
-              buildDurableToolPayloadProviderIdempotencyKey({
-                orgId: this.#options.orgId,
-                toolId: batch.batchOperation,
-                executionAuthScopeDigest:
-                  owned[0]?.executionAuthScopeDigest ?? null,
-                providerActionVersion: batchProviderActionVersion,
-                payload: compiled.batchPayload,
-                forceRefreshIdentities: owned
-                  .filter((request) => request.force === true)
-                  .map((request) =>
-                    this.providerIdempotencyKeyForToolCall({
-                      cacheKey:
-                        request.providerIdempotencyKeyBase ??
-                        request.receiptKey!,
-                      force: true,
-                      leaseId: request.receiptLeaseId,
-                      logicalCallId: request.logicalCallId,
-                    }),
-                  ),
-              });
+            const providerOperationKey = aggregateReceiptKey;
             dispatchDetails.set(aggregateReceiptKey, {
               members: owned,
               compiled,
@@ -11885,8 +11929,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     toolResponse: publicToolResponseForBatchedItem(
                       aggregate,
                       item,
-                      this.currentToolResponseContract ===
-                        RAW_V2_TOOL_RESPONSE_CONTRACT,
+                      true,
                     ),
                     requestInput: request.input,
                     execution: toolExecutionMetadataForOutcome({
@@ -11899,60 +11942,22 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               }),
             );
           },
-          heartbeat: {
-            // Claim replies carry the real expiry. A fixed fallback interval
-            // can be too slow for a short-lived gateway lease, so derive the
-            // one cohort supervisor from the earliest owned member instead.
-            intervalMs: ({ members }) =>
-              Math.max(
-                1,
-                Math.floor(
-                  runtimeLeaseHeartbeatIntervalFromExpiry({
-                    leaseExpiresAt: members.reduce<string | null>(
-                      (earliest, member) => {
-                        const expiresAt = member.leaseExpiresAt ?? null;
-                        if (!expiresAt) return earliest;
-                        if (!earliest) return expiresAt;
-                        return Date.parse(expiresAt) < Date.parse(earliest)
-                          ? expiresAt
-                          : earliest;
-                      },
-                      null,
-                    ),
-                    fallbackTtlMs: PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
-                  }) / 2,
-                ),
-              ),
-            onTransientFailure: (error) => {
-              this.runtimeLog(
-                `Native Tool Call Receipt Cohort heartbeat transport failed; retrying: ${
-                  error instanceof Error ? error.message : String(error)
-                }`,
-              );
-            },
-          },
         });
         return { batch, result };
       },
       onChunkComplete: async (entries) => {
         for (const entry of entries) {
           if (entry.error !== undefined) {
-            // The cohort may have recovered each member through its
-            // lease-fenced single-receipt fallback, but that only prevents
-            // duplicate provider work. It must not convert a failed bulk
-            // persistence boundary into a successful map result: callers need
-            // the loud failure so this run can be retried from the durable
-            // receipts instead of continuing after an ambiguous bulk write.
+            // A failed batch is not a cache entry. Surface it to every row so
+            // a later run can make a fresh provider attempt.
             for (const request of entry.request.memberRequests) {
               await reject(request, entry.error);
             }
             throw entry.error;
           }
           if (!entry.result) {
-            // The NativeBatchToolCall already attempted a lease-fenced failure
-            // fanout. Read the actual durable terminal facts so cache hits in
-            // the same cohort still reach their rows and a stale failure never
-            // causes this Context to write a second terminal transition.
+            // Successful split results must be present in the completed cache
+            // before they are delivered to rows.
             const durable = await store.read({
               resultReceiptKeys: entry.request.memberRequests.map(
                 (request) => request.receiptKey!,
@@ -11973,8 +11978,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               } else {
                 await reject(
                   request,
-                  record?.error ??
-                    entry.error ??
+                  entry.error ??
                     new Error(
                       'Native Tool Call did not reach a terminal receipt.',
                     ),
@@ -12198,6 +12202,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const cohortRequests = pendingRequests.filter(
             (request) =>
               request.cacheable !== false &&
+              request.requiresExecutionFence !== true &&
               Boolean(request.receiptKey?.trim()),
           );
           if (cohortRequests.length > 0) {
@@ -12230,6 +12235,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const cohortRequests = pendingRequests.filter(
             (request) =>
               request.cacheable !== false &&
+              request.requiresExecutionFence !== true &&
               Boolean(request.receiptKey?.trim()),
           );
           if (cohortRequests.length > 0) {
@@ -13056,8 +13062,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                                   : publicToolResponseForBatchedItem(
                                       batchExecution.execution,
                                       splitResults[index] ?? null,
-                                      this.currentToolResponseContract ===
-                                        RAW_V2_TOOL_RESPONSE_CONTRACT,
+                                      true,
                                     ),
                             }),
                           ),
@@ -13213,6 +13218,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                           ...(request.receiptKey
                             ? {
                                 durableCallReceiptKey: request.receiptKey,
+                                completedResultCache: true,
                                 executionAuthScopeDigest:
                                   request.executionAuthScopeDigest,
                                 providerIdempotencyReceiptKey:
@@ -13675,6 +13681,19 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             .catch(() => null);
           const retrySafeTransientHttp =
             retryPolicy?.retrySafeTransientHttp === true;
+          const requiresExecutionFence =
+            retryPolicy?.requiresExecutionFence === true;
+          const fixtureReplaySafe = this.#options.integrationMode === 'fixture';
+          const readOnlyQuery = isQueryResultDatasetReadRequest(
+            toolId,
+            toolInputSnapshot,
+          );
+          // A completed result cache eliminates repeated successful work; it
+          // does not prove an ambiguous provider write can be replayed. Only
+          // a read-only query or an action which explicitly declares transient
+          // retries safe may issue another physical request after dispatch.
+          const ambiguousTransportReplayAllowed =
+            readOnlyQuery || retrySafeTransientHttp;
           const invocationOrgId = this.#options.orgId?.trim() ?? '';
           const durableCallReceiptKey =
             options?.durableCallReceiptKey?.trim() ||
@@ -13689,26 +13708,25 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const executionAuthScopeDigest = options?.executionAuthScopeDigest
             ? options.executionAuthScopeDigest.trim() || null
             : ((await this.resolveToolAuthScopeDigest(toolId))?.trim() ?? null);
-          const canonicalOperation = {
-            version: 1 as const,
-            tool_id: toolId,
-            action_version:
-              (
-                await this.#options.getToolActionCacheVersion?.(toolId)
-              )?.trim() || 'unversioned',
-            play_scope: this.currentGovernance.currentPlayId,
-            output_intent: 'dataset',
-          };
-          const providerIdempotencyKey =
-            options?.providerIdempotencyKey?.trim() || durableCallReceiptKey;
+          const executionRequestNonce = crypto.randomUUID();
+          // This identifies one logical tool call to billing. Physical retry
+          // count remains in request metadata, so a transport retry cannot
+          // reserve or charge the same call twice.
+          const deeplineRequestId = `ctx-tool-${stableDigest(executionRequestNonce).slice(0, 32)}`;
+          // The provider operation has a semantic identity independent of
+          // the response receipt. Its key is supplied by the caller that owns
+          // that compatibility contract; never substitute request/billing
+          // attribution for it.
           const providerIdempotencyReceiptKey =
-            options?.providerIdempotencyReceiptKey?.trim() ||
-            durableCallReceiptKey;
-          // Correlation identity is stable across every transport retry,
-          // including calls without a durable receipt.
-          const deeplineRequestId = providerIdempotencyKey
-            ? `ctx-tool-${stableDigest(providerIdempotencyKey).slice(0, 32)}`
-            : `ctx-tool-${crypto.randomUUID()}`;
+            options?.providerIdempotencyReceiptKey?.trim() || null;
+          const providerExecutionFenceKey = requiresExecutionFence
+            ? options?.providerIdempotencyKey?.trim() || null
+            : null;
+          if (requiresExecutionFence && !providerExecutionFenceKey) {
+            throw new Error(
+              `Tool ${toolId} requires a provider execution fence but no provider operation identity was supplied.`,
+            );
+          }
           // Every runtime provider call carries at least a tool-scoped
           // attribution. Callers that know the execution location (row-scoped
           // map cells, batched owners) supply the fuller scope.
@@ -13723,16 +13741,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 ...(requestsDurableInvocationFence
                   ? { invocation_fence_version: 1 }
                   : {}),
-                // Canonical provider-operation receipts validate this semantic
-                // plan before replay. It is intentionally removed from the
-                // legacy byte-receipt fingerprint so mixed runner artifacts
-                // retain their existing provider-once behavior.
-                ...(requestsDurableInvocationFence
-                  ? { canonical_operation: canonicalOperation }
-                  : {}),
-                // The worker-owned receipt coordinates this physical durable
-                // call. Provider idempotency is carried separately below so
-                // exact-payload reuse never replaces batch receipt ownership.
                 ...(durableCallReceiptKey
                   ? {
                       durable_call_receipt_key: durableCallReceiptKey,
@@ -13744,10 +13752,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                         : {}),
                     }
                   : {}),
-                ...(providerIdempotencyReceiptKey
+                ...(providerExecutionFenceKey
                   ? {
-                      provider_idempotency_receipt_key:
-                        providerIdempotencyReceiptKey,
+                      provider_idempotency_key: providerExecutionFenceKey,
+                      ...(providerIdempotencyReceiptKey
+                        ? {
+                            provider_idempotency_receipt_key:
+                              providerIdempotencyReceiptKey,
+                          }
+                        : {}),
                     }
                   : {}),
                 ...(options?.customerDbDataset
@@ -13770,9 +13783,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                         : {}),
                     }
                   : {}),
-                ...(providerIdempotencyKey
-                  ? { provider_idempotency_key: providerIdempotencyKey }
-                  : {}),
                 ...(playNodeScope
                   ? { play_node_scope: playNodeScopeToWire(playNodeScope) }
                   : {}),
@@ -13789,6 +13799,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             elapsedMs: number;
             requestId: string | null;
             aborted: boolean;
+            /** The ingress rejected the request before any provider dispatch. */
+            knownNotDispatched?: boolean;
           }): Promise<void> => {
             transportAttempt += 1;
             const diagnostic = describeTransportError(input.error);
@@ -13804,7 +13816,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 error: diagnostic,
               })}`,
             );
-            if (transportAttempt < TOOL_EXECUTE_TRANSPORT_MAX_ATTEMPTS) {
+            if (
+              transportAttempt < TOOL_EXECUTE_TRANSPORT_MAX_ATTEMPTS &&
+              (input.knownNotDispatched === true ||
+                ambiguousTransportReplayAllowed ||
+                fixtureReplaySafe)
+            ) {
+              invocationAttempt += 1;
               await this.governor.chargeBudget('retry');
               const retryAfterMs =
                 TOOL_RETRY_AFTER_FALLBACK_MS * transportAttempt;
@@ -14033,17 +14051,17 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                         'Content-Type': 'application/json',
                         Authorization: `Bearer ${this.#options.executorToken}`,
                         [EXECUTE_RESPONSE_CONTRACT_HEADER]:
-                          this.currentToolResponseContract,
+                          RAW_V2_TOOL_RESPONSE_CONTRACT,
                         [EXECUTE_RESPONSE_INTENT_HEADER]: 'dataset',
                         [EXECUTE_TOOL_METADATA_HEADER]: 'true',
                         [TOOL_EXECUTION_ERROR_SCHEMA_HEADER]: String(
                           toolErrorSchemaVersion,
                         ),
                         'x-deepline-request-id': deeplineRequestId,
-                        ...(providerIdempotencyKey
+                        ...(providerExecutionFenceKey
                           ? {
                               'x-deepline-idempotency-key':
-                                providerIdempotencyKey,
+                                providerExecutionFenceKey,
                             }
                           : {}),
                         ...protectionHeaders,
@@ -14145,40 +14163,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 (response === null ||
                   error instanceof ToolExecuteResponseBodyTransportError ||
                   error instanceof ToolExecuteInvalidJsonError);
-              const hasDurableInvocationIdentity = Boolean(
-                durableCallReceiptKey &&
-                providerIdempotencyKey &&
-                executionAuthScopeDigest,
-              );
               // A post-header body deadline aborts the fetch controller solely
               // to stop consuming that response. It must not also cancel the
               // independent gateway health check that establishes whether the
               // committed response can be replayed safely. Preserve genuine
               // caller/runtime cancellation by dropping the signal only when
               // this exact body deadline caused the abort.
-              const durableFenceVerificationSignal =
-                abortController?.signal.aborted === true &&
-                abortController.signal.reason instanceof
-                  ToolExecuteResponseBodyTimeoutError
-                  ? undefined
-                  : abortController?.signal;
-              const durableInvocationFenceVerified =
-                hasDurableInvocationIdentity &&
-                requestsDurableInvocationFence &&
-                (this.#options.durableInvocationFence === true ||
-                  (await this.#options
-                    .verifyDurableInvocationFence?.(
-                      durableFenceVerificationSignal,
-                    )
-                    .catch(() => false)) === true);
-              // Fixture execution has no provider-side effect. Replaying the
-              // same stable request after our own transport fails is always
-              // safe, even when this runner lacks a live-provider fence.
-              const fixtureReplaySafe =
-                this.#options.integrationMode === 'fixture';
               const transportReplaySafe =
                 !ambiguousDispatchedFailure ||
-                durableInvocationFenceVerified ||
+                ambiguousTransportReplayAllowed ||
                 fixtureReplaySafe;
               if (!transportReplaySafe) {
                 const diagnostic = describeTransportError(transportError);
@@ -14271,6 +14264,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   elapsedMs: providerCallElapsedMs ?? 0,
                   requestId: deeplineRequestId,
                   aborted: false,
+                  knownNotDispatched: true,
                 });
                 continue;
               }
@@ -14308,13 +14302,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   failure.backpressureDelayMs,
                 );
               }
-              if (failure.shouldRetry) {
-                if (
-                  failure.reason !== 'gateway_invocation_in_progress' &&
-                  failure.reason !== 'concurrency_backpressure'
-                ) {
-                  invocationAttempt += 1;
-                }
+              if (
+                failure.shouldRetry &&
+                (ambiguousTransportReplayAllowed ||
+                  retrySafeTransientHttp ||
+                  fixtureReplaySafe)
+              ) {
+                invocationAttempt += 1;
                 if (failure.chargeRetryBudget) {
                   await this.governor.chargeBudget('retry');
                 }