deepline 0.3.88 → 0.3.90

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -109,7 +109,11 @@ import {
   type ToolResponseContract,
   type ToolResponseView,
 } from '../plays/tool-response-contract';
-import { ProviderExhaustedError } from './run-failure';
+import {
+  isProviderExhaustedFailure,
+  ProviderExhaustedError,
+} from './run-failure';
+import { PROVIDER_EXHAUSTED_MAX_WAIT_MS } from './governor/app-runtime-rate-state-backend';
 import {
   buildPlayContractCompatibility,
   normalizePlayContractCompatibility,
@@ -122,6 +126,10 @@ import {
   type ToolExecutionErrorSchemaVersion,
   type ToolExecutionFailureV1,
 } from '../plays/tool-execution-error';
+import {
+  SLACK_HITL_TIMEOUT_ERROR_CODE,
+  SlackHitlTimeoutError,
+} from '../plays/slack-hitl-timeout-error';
 import { InMemoryRateStateBackend } from './governor/in-memory-rate-state-backend';
 import { pacingPolicyForTool } from './pacing';
 import {
@@ -177,6 +185,7 @@ import {
   buildDurableToolAggregateReceiptKey,
   buildDurableToolCallAuthScopeDigest,
   buildDurableToolCallCacheKey,
+  buildSourceRunToolReceiptManifestKey,
   buildLegacyRevisionedDurableToolCallCacheKey,
   buildDurableToolPayloadProviderIdempotencyKey,
   buildProviderOperationIdempotencyKey,
@@ -353,7 +362,11 @@ import type {
   PlayRowReadOrder,
   PlayRowMeta,
   PlaySheetCellProducer,
+  PlayAsyncCallOptions,
 } from './ctx-types';
+import { assertKnownResolvedBoundary } from './checkpoint-boundaries';
+import type { AsyncPlayRunRef } from '../plays/authoring-contract';
+import { admitAsyncPlayLineage } from './async-play-invocation';
 import {
   MAX_CELL_READ_REFS,
   MAX_ROW_READ_CELLS,
@@ -1982,6 +1995,19 @@ function normalizeStepDescription(
   return trimmed ? trimmed : undefined;
 }
 
+function resolvePlayReferenceName(playRef: unknown): string {
+  if (typeof playRef === 'string') return playRef;
+  if (
+    playRef === null ||
+    (typeof playRef !== 'object' && typeof playRef !== 'function')
+  ) {
+    return '';
+  }
+  const reference = playRef as { playName?: unknown; name?: unknown };
+  if (typeof reference.playName === 'string') return reference.playName;
+  return typeof reference.name === 'string' ? reference.name : '';
+}
+
 function emptyCheckpoint(): PlayCheckpoint {
   return {
     completedBatches: {},
@@ -1996,6 +2022,14 @@ function cloneMapFrame(frame: MapExecutionFrame): MapExecutionFrame {
     ...frame,
     completedRowKeys: [...frame.completedRowKeys],
     pendingRowKeys: [...frame.pendingRowKeys],
+    ...(frame.suspendedInputRows
+      ? {
+          suspendedInputRows: frame.suspendedInputRows.map((row) => ({
+            inputIndex: row.inputIndex,
+            data: cloneCsvAliasedRow(row.data),
+          })),
+        }
+      : {}),
   };
 }
 
@@ -2089,6 +2123,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
    * waterfall miss.
    */
   private deeplineInsufficientCreditsFailure: ToolExecutionError | null = null;
+  /**
+   * A Slack HITL timeout is terminal only after its card finalizer has proved
+   * the Slack replacement. Keep that terminal result outside authored promise
+   * control flow so catching the rejected tool call cannot settle the Play or
+   * start a later durable operation.
+   */
+  private slackHitlTimeoutFailure: ToolExecutionError | null = null;
   private toolCallResolvers = new Map<
     string,
     { resolve: (value: unknown) => void; reject: (reason: unknown) => void }
@@ -2103,6 +2144,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   >();
   private readonly ctxFetchHttpFailureDiagnosticIdentities = new Set<string>();
   private checkpoint: PlayCheckpoint;
+  /**
+   * A durable boundary is a control-flow handoff, not a customer-catchable
+   * business failure. Keep it on the context as the source of truth so a
+   * broad catch cannot turn the invocation into a normal completed result.
+   */
+  private pendingDurableSuspension: PlayExecutionSuspension | null = null;
   private readonly durableCallCacheEpochMs: number;
   /**
    * Durable tool receipts are the replay/cache authority for the execution
@@ -2215,6 +2262,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       timeoutMs?: number;
       receiptWaitMs?: number;
     }): Promise<TOutput> => {
+      this.assertNoPendingDurableSuspension();
       if (!request || typeof request !== 'object' || Array.isArray(request)) {
         throw new Error(
           'ctx.tools.execute requires a request object: ctx.tools.execute({ id, tool, input, description }).',
@@ -2281,6 +2329,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           : undefined,
       ).catch((error: unknown) => {
         this.recordDeeplineInsufficientCreditsFailure(error);
+        this.recordSlackHitlTimeoutFailure(error);
         throw error;
       }) as Promise<TOutput>;
     },
@@ -2303,6 +2352,62 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     }
   }
 
+  private recordSlackHitlTimeoutFailure(error: unknown): void {
+    if (
+      error instanceof ToolExecutionError &&
+      error.code === SLACK_HITL_TIMEOUT_ERROR_CODE
+    ) {
+      if (!this.slackHitlTimeoutFailure) {
+        this.slackHitlTimeoutFailure = error;
+        this.runtimeLog(
+          `[slack_hitl.timeout_terminal] code=${SLACK_HITL_TIMEOUT_ERROR_CODE} ` +
+            'card_finalization=confirmed outcome=run_fatal',
+        );
+      }
+    }
+  }
+
+  /**
+   * Called by the runner before a normal result settles. This preserves a
+   * terminal Slack timeout even if authored code catches it and returns a
+   * value. It intentionally remains separate from provider errors, which are
+   * ordinary customer-handled waterfall misses.
+   */
+  assertNoSlackHitlTimeoutFailure(): void {
+    if (this.slackHitlTimeoutFailure) {
+      throw this.slackHitlTimeoutFailure;
+    }
+  }
+
+  /** Called by the runner after customer code returns, before a success settles. */
+  assertNoRunFatalToolFailure(): void {
+    this.assertNoSlackHitlTimeoutFailure();
+    this.assertNoDeeplineInsufficientCreditsFailure();
+  }
+
+  /**
+   * Called at ctx effect boundaries and by the runner before it can settle a
+   * normal result. This makes suspension sticky even when authored code uses a
+   * broad catch around `await ctx.sleep(...)`.
+   */
+  assertNoPendingDurableSuspension(): void {
+    this.assertNoSlackHitlTimeoutFailure();
+    if (this.pendingDurableSuspension) {
+      throw new PlayExecutionSuspendedError(this.pendingDurableSuspension);
+    }
+  }
+
+  /**
+   * The single seam that hands this invocation back to the scheduler. The
+   * first suspension wins: a later boundary reached by code that caught the
+   * first one cannot replace the handoff the scheduler already owes a resume.
+   */
+  private suspendDurably(suspension: PlayExecutionSuspension): never {
+    this.pendingDurableSuspension ??= suspension;
+    this.#options.onBatchComplete?.(this.checkpoint);
+    throw new PlayExecutionSuspendedError(this.pendingDurableSuspension);
+  }
+
   async tool<TOutput = unknown>(
     key: string,
     toolId: string,
@@ -2416,6 +2521,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       options.artifactRuntimeContract ??
       resolvePlayArtifactRuntimeContract({
         authoringContractEdition: options.authoringContractEdition,
+        slackHitlTimeoutOutcome: options.slackHitlTimeoutOutcome,
         toolResponseContract: options.toolResponseContract,
         toolResponseReceiptRevision: options.toolResponseReceiptRevision,
       });
@@ -2475,11 +2581,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       options.playId ||
       options.workflowId ||
       'anonymous-play';
-    const rootRunId = options.runId ?? options.workflowId ?? 'anonymous-run';
+    const currentRunId = options.runId ?? options.workflowId ?? 'anonymous-run';
+    const rootRunId = options.rootRunId ?? currentRunId;
     this.executionScope =
       options.executionScope ??
       createRootRunExecutionScope({
-        runId: rootRunId,
+        runId: currentRunId,
         playId: rootPlayId,
         attempt:
           typeof options.runAttempt === 'number' &&
@@ -2489,7 +2596,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         receiptNamespace: options.runtimeReceiptScope ?? rootPlayId,
         authority: {
           orgId: options.orgId ?? 'org',
-          workflowId: options.workflowId ?? rootRunId,
+          workflowId: options.workflowId ?? currentRunId,
           integrationMode: options.integrationMode ?? null,
           capabilities: DEFAULT_RUNTIME_EXECUTION_CAPABILITIES,
         },
@@ -2505,7 +2612,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         adapter: 'cjs_node20',
         scope: {
           orgId: options.orgId ?? 'org',
-          rootRunId: options.runId ?? options.workflowId ?? 'run',
+          rootRunId,
         },
         rateState: options.rateState ?? new InMemoryRateStateBackend(),
         budgetState: options.budgetState,
@@ -2710,6 +2817,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   private assertInlineChildContract(
     reason: 'dataset_child' | 'suspending_child',
   ): void {
+    this.assertNoPendingDurableSuspension();
     const composition = this.activeInlineComposition;
     if (!composition) return;
     throw new Error(ctxRunPlayInlineOnlyMessage(composition.playName, reason));
@@ -3389,6 +3497,223 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     };
   }
 
+  /**
+   * Record tiny pointers after canonical tool receipts settle. A rerun can
+   * then recover each exact source-run receipt before trying the ordinary
+   * cross-run cache. The pointers never contain provider input, credentials,
+   * or provider responses.
+   *
+   * This deliberately uses the same bulk receipt seam as canonical result
+   * persistence. A map can settle hundreds of results at once; falling back
+   * to one read/claim/complete triplet per pointer would make compatibility
+   * bookkeeping contend with the customer's provider work.
+   */
+  private async persistSourceRunToolReceiptManifests(
+    inputs: Array<{
+      toolId: string;
+      logicalCallId?: string | null;
+      executionAuthScopeDigest?: string | null;
+      resultReceiptKey: string;
+    }>,
+  ): Promise<void> {
+    const sourceRunId = this.currentReceiptOwnerRunId.trim();
+    if (
+      !sourceRunId ||
+      !(
+        this.#options.claimRuntimeStepReceipt ||
+        this.#options.claimRuntimeStepReceipts
+      ) ||
+      !(
+        this.#options.completeRuntimeStepReceipt ||
+        this.#options.completeRuntimeStepReceipts
+      )
+    ) {
+      return;
+    }
+    try {
+      const providerActionVersions = new Map<string, string>();
+      await Promise.all(
+        [...new Set(inputs.map((input) => input.toolId))].map(
+          async (toolId) => {
+            providerActionVersions.set(
+              toolId,
+              (
+                await this.#options.getToolActionCacheVersion?.(toolId)
+              )?.trim() ?? '',
+            );
+          },
+        ),
+      );
+      const manifests = inputs.flatMap((input) => {
+        const logicalCallId = input.logicalCallId?.trim();
+        const resultReceiptKey = input.resultReceiptKey.trim();
+        if (!logicalCallId || !resultReceiptKey) return [];
+        const providerActionVersion =
+          providerActionVersions.get(input.toolId) ?? '';
+        if (!providerActionVersion) return [];
+        const key = buildSourceRunToolReceiptManifestKey({
+          orgId: this.#options.orgId,
+          sourceRunId,
+          logicalCallId,
+        });
+        return [
+          {
+            key,
+            output: {
+              kind: 'source-run-tool-receipt-manifest-v1' as const,
+              toolId: input.toolId,
+              providerActionVersion,
+              executionAuthScopeDigest:
+                input.executionAuthScopeDigest?.trim() ?? null,
+              resultReceiptKey,
+            },
+          },
+        ];
+      });
+      if (manifests.length === 0) return;
+
+      // Several row callbacks can refer to the same logical call. The first
+      // canonical receipt is authoritative, so one idempotent pointer write is
+      // enough.
+      const uniqueManifests = [
+        ...new Map(
+          manifests.map((manifest) => [manifest.key, manifest]),
+        ).values(),
+      ];
+      const existing = await this.getRuntimeStepReceipts(
+        uniqueManifests.map((manifest) => manifest.key),
+      );
+      const missing = uniqueManifests.filter((manifest) => {
+        const receipt = existing.get(manifest.key);
+        return receipt?.status !== 'completed' && receipt?.status !== 'skipped';
+      });
+      if (missing.length === 0) return;
+
+      const claims = await this.claimRuntimeStepReceipts(
+        missing.map((manifest) => manifest.key),
+        sourceRunId,
+      );
+      await this.completeRuntimeStepReceipts(
+        missing.flatMap((manifest) => {
+          const claim = claims.get(manifest.key);
+          return claim?.leaseId
+            ? [
+                {
+                  key: manifest.key,
+                  runId: sourceRunId,
+                  leaseId: claim.leaseId,
+                  output: manifest.output,
+                },
+              ]
+            : [];
+        }),
+      );
+    } catch (error) {
+      // The canonical result receipt has already settled. A telemetry pointer
+      // must never turn that successful provider result into a failed run.
+      this.runtimeLog(
+        `Tool source-run receipt manifest write skipped: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+
+  private async persistSourceRunToolReceiptManifest(input: {
+    toolId: string;
+    logicalCallId?: string | null;
+    executionAuthScopeDigest?: string | null;
+    resultReceiptKey: string;
+  }): Promise<void> {
+    await this.persistSourceRunToolReceiptManifests([input]);
+  }
+
+  private async recoverSourceRunToolReceipt(input: {
+    toolId: string;
+    logicalCallId: string;
+    executionAuthScopeDigest?: string | null;
+    cacheKey: string;
+  }): Promise<ToolExecuteResult | null> {
+    const sourceRunId = this.#options.replayedFromRunId?.trim();
+    if (!sourceRunId || !this.#options.getRuntimeStepReceipt) return null;
+
+    const manifestKey = buildSourceRunToolReceiptManifestKey({
+      orgId: this.#options.orgId,
+      sourceRunId,
+      logicalCallId: input.logicalCallId,
+    });
+    const manifestReceipt = await this.withRuntimeReceiptHydrationTurn(
+      async () => await this.getRuntimeStepReceipt(manifestKey),
+    );
+    if (
+      !manifestReceipt ||
+      (manifestReceipt.status !== 'completed' &&
+        manifestReceipt.status !== 'skipped')
+    ) {
+      return null;
+    }
+    const manifest = recordOrNull(this.runtimeReceiptOutput(manifestReceipt));
+    if (
+      !manifest ||
+      manifest.kind !== 'source-run-tool-receipt-manifest-v1' ||
+      manifest.toolId !== input.toolId ||
+      typeof manifest.resultReceiptKey !== 'string' ||
+      !manifest.resultReceiptKey.trim() ||
+      typeof manifest.providerActionVersion !== 'string'
+    ) {
+      return null;
+    }
+    const currentActionVersion =
+      (await this.#options.getToolActionCacheVersion?.(input.toolId))?.trim() ??
+      '';
+    const compatibleActionVersions = new Set([
+      currentActionVersion,
+      ...(
+        (await this.#options.getToolActionCacheReadVersions?.(input.toolId)) ??
+        []
+      ).map((version) => String(version || '').trim()),
+    ]);
+    if (!compatibleActionVersions.has(manifest.providerActionVersion.trim())) {
+      return null;
+    }
+    const manifestAuthScopeDigest =
+      typeof manifest.executionAuthScopeDigest === 'string'
+        ? manifest.executionAuthScopeDigest.trim() || null
+        : null;
+    if (
+      manifestAuthScopeDigest !==
+      (input.executionAuthScopeDigest?.trim() || null)
+    ) {
+      return null;
+    }
+    const resultReceiptKey = manifest.resultReceiptKey.trim();
+    const sourceReceipt = await this.withRuntimeReceiptHydrationTurn(
+      async () => await this.getRuntimeStepReceipt(resultReceiptKey),
+    );
+    if (
+      !sourceReceipt ||
+      (sourceReceipt.status !== 'completed' &&
+        sourceReceipt.status !== 'skipped')
+    ) {
+      return null;
+    }
+    const stored = this.runtimeReceiptOutput(sourceReceipt);
+    const result = isSerializedToolExecuteResult(stored)
+      ? deserializeToolExecuteResult(stored)
+      : isToolExecuteResult(stored)
+        ? stored
+        : null;
+    if (!result || !this.canReuseToolResultForCurrentResponseContract(result)) {
+      return null;
+    }
+    return cloneToolExecuteResultWithExecution(
+      result,
+      toolExecutionMetadataForOutcome({
+        kind: 'source_run',
+        cacheKey: input.cacheKey,
+        receiptKey: resultReceiptKey,
+      }),
+    );
+  }
+
   private async releaseRuntimeStepReceipt(
     key: string,
     _runId: string,
@@ -4206,6 +4531,47 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     return buildDurableToolCallCacheKey(identity);
   }
 
+  /**
+   * The first key is the only write/provider identity. Later keys are explicit
+   * action-local read fallbacks, used only when source metadata says their
+   * completed result remains compatible. Deploy and generated-catalog state
+   * never participate in this list.
+   */
+  private async compatibleDurableToolCallCacheKeysForScope(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+    playLocalScope?: string | null;
+  }): Promise<string[]> {
+    const identity = await this.durableToolCallCacheIdentity(input);
+    const primaryVersion = identity.providerActionVersion?.trim();
+    if (!primaryVersion) {
+      throw new Error(
+        `Tool ${input.toolId} is missing a provider action compatibility version.`,
+      );
+    }
+    const readVersions = await this.#options.getToolActionCacheReadVersions?.(
+      input.toolId,
+    );
+    const versions = [
+      primaryVersion,
+      ...(readVersions ?? [])
+        .map((version) => String(version || '').trim())
+        .filter(Boolean),
+    ];
+    return [
+      ...new Set(
+        versions.map((providerActionVersion) =>
+          buildDurableToolCallCacheKey({
+            ...identity,
+            providerActionVersion,
+          }),
+        ),
+      ),
+    ];
+  }
+
   private async legacyDurableToolCallCacheKeyForScope(input: {
     toolId: string;
     requestInput: Record<string, unknown>;
@@ -4263,6 +4629,18 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     });
   }
 
+  private async compatibleDurableToolCallCacheKeys(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+  }): Promise<string[]> {
+    return await this.compatibleDurableToolCallCacheKeysForScope({
+      ...input,
+      playLocalScope: this.currentGovernance.currentPlayId,
+    });
+  }
+
   private async legacyDurableToolCallCacheKey(input: {
     toolId: string;
     requestInput: Record<string, unknown>;
@@ -4429,6 +4807,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       }) => Promise<T>;
     },
   ): Promise<T> {
+    this.assertNoPendingDurableSuspension();
     let releaseExternalCallSlot: (() => void) | null = null;
     const execute = async (leaseId: string | null): Promise<T> =>
       await opts.execute({
@@ -4471,7 +4850,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         cacheEpochMs: this.durableCallCacheEpochMs,
       });
     try {
-      return await executeWithDurableRuntimeReceipt<T>({
+      const output = await executeWithDurableRuntimeReceipt<T>({
         operation,
         id,
         runId: this.currentReceiptOwnerRunId,
@@ -4499,6 +4878,11 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         log: (message) => this.runtimeLog(message),
         execute: ({ leaseId }) => execute(leaseId),
       });
+      // Every receipt publication and cache return crosses this one success
+      // seam. A customer catch cannot turn a pending durable handoff into a
+      // reusable completed value.
+      this.assertNoPendingDurableSuspension();
+      return output;
     } finally {
       const release = releaseExternalCallSlot as (() => void) | null;
       release?.();
@@ -4705,6 +5089,62 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     });
   }
 
+  /**
+   * A forced call bypasses the immutable Tool Result Receipt, so its physical
+   * gateway invocation must bypass that receipt's replay identity too. Keep
+   * the transport key deterministic for one logical call: a retry of that
+   * call still converges, while a later explicit force gets a fresh identity.
+   */
+  private toolTransportReceiptKey(input: {
+    toolId: string;
+    resultReceiptKey: string;
+    providerOperationKey: string;
+    force?: boolean;
+  }): string {
+    if (input.force !== true) return input.resultReceiptKey;
+    return `${buildDurableToolReceiptPrefix({
+      orgId: this.#options.orgId,
+      toolId: input.toolId,
+    })}${stableDigest(`forced-provider-invocation:${input.providerOperationKey}`)}`;
+  }
+
+  /**
+   * Ordinary operations do not carry provider-idempotency metadata, but the
+   * execution relay still needs a semantic signal that an explicit force is
+   * a new provider operation. Unsafe-write operations already carry their
+   * forced provider key directly, so only ordinary calls need this attested
+   * canonical-operation salt.
+   */
+  private providerForceRefreshIdentitiesForToolCall(input: {
+    operationKey: string;
+    force?: boolean;
+    requiresExecutionFence?: boolean;
+    logicalCallId?: string;
+  }): string[] {
+    if (input.force !== true || input.requiresExecutionFence === true) {
+      return [];
+    }
+    return [
+      this.providerIdempotencyKeyForToolCall({
+        operationKey: input.operationKey,
+        force: true,
+        logicalCallId: input.logicalCallId,
+      }),
+    ];
+  }
+
+  private providerForceRefreshOptionsForToolCall(input: {
+    operationKey: string;
+    force?: boolean;
+    requiresExecutionFence?: boolean;
+    logicalCallId?: string;
+  }): Pick<ToolExecutionApiOptions, 'providerOperationForceRefreshIdentities'> {
+    const identities = this.providerForceRefreshIdentitiesForToolCall(input);
+    return identities.length > 0
+      ? { providerOperationForceRefreshIdentities: identities }
+      : {};
+  }
+
   /**
    * Bounded per-cell producer trace (ADR 0018).
    *
@@ -6125,6 +6565,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     input: TInput,
     options?: { description?: string },
   ): Promise<TOutput> {
+    this.assertNoPendingDurableSuspension();
     if (!isRuntimeStepProgram(program)) {
       throw new Error('ctx.runSteps(program, input) requires steps().');
     }
@@ -6149,6 +6590,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     input: MapFieldDefinition<T, TColumns>,
     options?: RuntimeDatasetOptions<T>,
   ): Promise<PlayDataset<Record<string, unknown>>> {
+    this.assertNoPendingDurableSuspension();
     if (rowContext.getStore()) {
       throw new Error(
         'Nested ctx.dataset() is not supported. Flatten your columns into one dataset, or keep custom per-row logic inside a single column.',
@@ -6305,6 +6747,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         this.#options.playName &&
         this.#options.runId,
       );
+    // The invocation id is deterministic for a replay: mapInvocationIndex is
+    // rebuilt in authored call order. Look up a previously suspended plan now,
+    // before a stateful source query can decide that a sibling action is no
+    // longer eligible because an earlier action already completed.
+    const replayMapInvocationId = `${normalizedMapNamespace}:${this.mapInvocationIndex}`;
+    const suspendedInputRows = shouldStreamRuntimeBackedDataset
+      ? null
+      : (this.checkpoint.mapFrames?.[replayMapInvocationId]
+          ?.suspendedInputRows ?? null);
     if (shouldStreamRuntimeBackedDataset) {
       // Net-new admission happens one source page at a time. Its progress and
       // returned dataset describe admitted rows, not every provider/CSV row
@@ -6954,11 +7405,24 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         },
       });
     }
-    const rawMaterializedItems = await materializePlayDatasetInput(items, {
-      onRow: (row) => {
-        materializationMemoryTracker.track(row);
-      },
-    });
+    const rawMaterializedEntries = suspendedInputRows?.length
+      ? suspendedInputRows.map((row) => ({
+          item: cloneCsvAliasedRow(row.data) as T,
+          inputIndex: row.inputIndex,
+        }))
+      : (
+          await materializePlayDatasetInput(items, {
+            onRow: (row) => {
+              materializationMemoryTracker.track(row);
+            },
+          })
+        ).map((item, inputIndex) => ({ item, inputIndex }));
+    const rawMaterializedItems = rawMaterializedEntries.map(
+      (entry) => entry.item,
+    );
+    const originalInputIndexByItem = new Map<T, number>(
+      rawMaterializedEntries.map(({ item, inputIndex }) => [item, inputIndex]),
+    );
     // Silent dedupe of duplicate explicit map keys: keep the first row per
     // canonical key and drop subsequent duplicates. Deduping the materialized
     // input here keeps every downstream derivation (rawItems, itemsToProcess,
@@ -6971,7 +7435,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           resolver: (item, index) =>
             explicitKeyResolver(
               this.toOutputRow(item as Record<string, unknown>),
-              index,
+              originalInputIndexByItem.get(item) ?? index,
             ),
         })
       : { rows: rawMaterializedItems, droppedCount: 0, duplicateKeys: [] };
@@ -6988,7 +7452,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     itemsToProcess = materializedItems.map((item) =>
       this.toOutputRow(item as Record<string, unknown>),
     );
-    itemOriginalIndexes = materializedItems.map((_item, index) => index);
+    itemOriginalIndexes = materializedItems.map(
+      (item, index) => originalInputIndexByItem.get(item) ?? index,
+    );
     const mapStartSeedRowsByKey = new Map<string, Record<string, unknown>>();
     if (this.#options.onMapStart) {
       // ALWAYS stamp the canonical seed row key — including no-explicit-key
@@ -7376,6 +7842,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         pendingRowsCount: 0,
         failedRowsCount: durableFailedRows,
         activeBoundaryId: null,
+        suspendedInputRows: undefined,
         updatedAt: Date.now(),
       });
     }
@@ -8224,6 +8691,67 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           });
           return WAITING_ROW;
         }
+        if (isPlayExecutionSuspendedError(error)) {
+          const completedKeys = new Set(
+            completedRowsToPersist.map((row) => row.key),
+          );
+          const suspendedInputRows = items.flatMap((item, index) => {
+            const rowKey = executionRowKey(
+              this.toOutputRow(item as Record<string, unknown>),
+              index,
+            );
+            if (completedKeys.has(rowKey)) return [];
+            return [
+              {
+                inputIndex: executionRowIndex(index),
+                data: this.toPersistedOutputRow(
+                  this.toOutputRow(item as Record<string, unknown>),
+                ),
+              },
+            ];
+          });
+          const existingFrame =
+            this.checkpoint.mapFrames?.[mapScope.mapInvocationId];
+          this.setMapFrame({
+            ...(existingFrame ?? {
+              mapInvocationId: mapScope.mapInvocationId,
+              mapNodeId: mapScope.mapNodeId ?? null,
+              logicalNamespace: mapScope.logicalNamespace,
+              artifactTableNamespace: mapScope.artifactTableNamespace,
+              totalRows,
+              completedRowKeys: [],
+              pendingRowKeys: [],
+              startedAt: Date.now(),
+            }),
+            status: 'suspended',
+            pendingRowKeys: suspendedInputRows.map(({ data, inputIndex }) =>
+              executionRowKey(data, inputIndex),
+            ),
+            suspendedInputRows,
+            activeBoundaryId:
+              error.suspension.kind === 'sleep'
+                ? error.suspension.boundaryId
+                : null,
+            updatedAt: Date.now(),
+          });
+          this.emitExecutionEvent({
+            type: 'map.suspended',
+            mapInvocationId: mapScope.mapInvocationId,
+            mapNodeId: mapScope.mapNodeId ?? null,
+            logicalNamespace: mapScope.logicalNamespace,
+            artifactTableNamespace: mapScope.artifactTableNamespace,
+            completedRows: completedKeys.size,
+            failedRows: 0,
+            totalRows,
+            at: Date.now(),
+          });
+          // ctx.sleep() emitted its boundary checkpoint before control reached
+          // this row catch. Emit once more after recording the admitted plan so
+          // the scheduler can resume the same action set if the worker exits
+          // immediately after handing off the suspension.
+          this.#options.onBatchComplete?.(this.checkpoint);
+          throw error;
+        }
         const fieldName = rowContext.getStore()?.fieldName;
         updateMapFrameProgress({
           status: 'failed',
@@ -8257,16 +8785,51 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         try {
           settledResults[idx] = await runRow(idx);
         } catch (error) {
-          firstRowError = error;
+          firstRowError = this.pendingDurableSuspension
+            ? new PlayExecutionSuspendedError(this.pendingDurableSuspension)
+            : (firstRowError ?? error);
+          this.wakeToolDispatcher();
           throw error;
         }
       }
     });
 
-    await this.drainQueuedWork(workers);
+    // Drain queued work but exit early if a suspension error occurs.
+    // When a worker suspends (e.g., ctx.sleep), we must propagate the
+    // suspension immediately without waiting for other concurrent rows to
+    // settle. This prevents restart loops and false completions.
+    await this.drainQueuedWork(workers, () => {
+      if (firstRowError != null) {
+        if (
+          isPlayExecutionSuspendedError(firstRowError) ||
+          isPlayRowExecutionSuspendedError(firstRowError)
+        )
+          return firstRowError;
+      }
+      return null;
+    });
     this.lastDatasetStep = datasetStep;
     this.activeDatasetStep = null;
 
+    // If drainQueuedWork exited early due to suspension, throw it immediately
+    // WITHOUT waiting for Promise.allSettled(workers). The worker promises
+    // may never settle (e.g., sibling rows blocked on long-running operations),
+    // and we must not block suspension propagation on them.
+    if (firstRowError != null) {
+      if (
+        isPlayExecutionSuspendedError(firstRowError) ||
+        isPlayRowExecutionSuspendedError(firstRowError)
+      ) {
+        // Use the existing failure barrier to commit accepted terminal rows
+        // before the caller hands this invocation back to the scheduler.
+        throw new FailFastMapRowsError({
+          cause: firstRowError,
+          completedRows: completedRowsToPersist,
+          failedRows: failedRowsToPersist,
+        });
+      }
+    }
+
     const settled = await Promise.allSettled(workers);
     const rejected = settled.find(
       (result): result is PromiseRejectedResult => result.status === 'rejected',
@@ -8356,8 +8919,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       await incrementalPersistence?.checkpoint(checkpointUpdates);
       await incrementalPersistence?.flush();
       this.pendingRowEventBoundaries = [];
-      this.#options.onBatchComplete?.(this.checkpoint);
-      throw new PlayExecutionSuspendedError({
+      this.suspendDurably({
         kind: 'integration_event_batch',
         boundaries: uniqueBoundaries,
       });
@@ -8452,7 +9014,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           if (
             (!continueOnProviderUnavailable &&
               step.continueOnProviderUnavailable !== true) ||
-            (!(error instanceof ProviderExhaustedError) &&
+            (!isProviderExhaustedFailure(error) &&
               !isProviderUnavailable(error))
           ) {
             throw error;
@@ -8537,6 +9099,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       let value: unknown;
       try {
         value = await runStep();
+        // A step-program resolver has the same publication boundary as a
+        // normal mapped field. Its customer callback may catch `ctx.sleep()`;
+        // do not turn that parked invocation into a waterfall output/cell.
+        this.assertNoPendingDurableSuspension();
       } catch (error) {
         // A provider admission, transient upstream failure, or exhausted
         // managed provider account is a visible unavailable leg, not a row
@@ -8545,8 +9111,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         // author hand-writing error handling.
         if (
           !continueOnProviderUnavailable ||
-          (!(error instanceof ProviderExhaustedError) &&
-            !isProviderUnavailable(error))
+          (!isProviderExhaustedFailure(error) && !isProviderUnavailable(error))
         ) {
           throw error;
         }
@@ -8755,7 +9320,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
 
       const source = Function.prototype.toString.call(resolver);
       return (
-        !source.includes('.tools.execute(') && !source.includes('.runPlay(')
+        !source.includes('.tools.execute(') &&
+        !source.includes('.runPlay(') &&
+        !source.includes('.runPlayAsync(')
       );
     });
   }
@@ -9117,7 +9684,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     });
   }
 
-  private async drainQueuedWork<T>(promises: Promise<T>[]): Promise<void> {
+  private async drainQueuedWork<T>(
+    promises: Promise<T>[],
+    earlyExitCheck?: () => unknown,
+  ): Promise<void> {
     // One dispatcher owns ready work, fixed lane coalescing deadlines, and the
     // bounded in-flight registry. A row resumes after its own receipt persists;
     // it never waits for unrelated sibling calls from the previous column.
@@ -9149,6 +9719,20 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     try {
       let pass = 0;
       while (true) {
+        // Check for early exit FIRST, before any dispatch or wait logic.
+        // When a row suspends, we must exit immediately without waiting for
+        // sibling rows or tool dispatcher wake events.
+        const suspension = earlyExitCheck?.();
+        if (suspension != null) {
+          // Queued calls have not started; reject them at the suspension fence.
+          // Already-dispatched calls must settle while this attempt still owns
+          // their receipts. Runner teardown releases leases, so detaching live
+          // provider requests here could duplicate them on the next resume.
+          this.rejectQueuedToolCalls(suspension);
+          await Promise.allSettled([...inFlightToolExecutions]);
+          break;
+        }
+
         if (this.toolDispatcherFailure != null) {
           this.rejectQueuedToolCalls(this.toolDispatcherFailure);
           await Promise.allSettled([...inFlightToolExecutions]);
@@ -9237,7 +9821,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       return resolver;
     }
 
-    return await resolver(row, this, fields, index, previousCell);
+    const value = await resolver(row, this, fields, index, previousCell);
+    // This is the common user-code return seam for every mapped field path
+    // (incremental, pure, and step-program adapters). Check before callers
+    // serialize a cell, emit a completion event, or advance a map frame.
+    this.assertNoPendingDurableSuspension();
+    return value;
   }
 
   private toOutputRow<T>(item: T): Record<string, unknown> {
@@ -9358,12 +9947,17 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       !eventWaitHandler &&
       !isQueryResultDatasetReadRequest(toolId, input) &&
       !isAlwaysFreshIntegrationTool(toolId);
-    let durableCacheKey = await this.durableToolCallCacheKey({
-      toolId,
-      requestInput: input,
-      executionAuthScopeDigest,
-      staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
-    });
+    let compatibleDurableCacheKeys =
+      await this.compatibleDurableToolCallCacheKeys({
+        toolId,
+        requestInput: input,
+        executionAuthScopeDigest,
+        staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
+      });
+    let durableCacheKey = compatibleDurableCacheKeys[0];
+    if (!durableCacheKey) {
+      throw new Error(`Tool ${toolId} is missing a primary durable cache key.`);
+    }
     let legacyDurableCacheKey = await this.legacyDurableToolCallCacheKey({
       toolId,
       requestInput: input,
@@ -9390,7 +9984,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     // incompatible state deliberately forgoes caching until it is repaired.
     let bypassDirectResultCache = false;
     const checkpointCacheKeys = [
-      durableCacheKey,
+      ...compatibleDurableCacheKeys,
       ...(legacyDurableCacheKey ? [legacyDurableCacheKey] : []),
     ];
 
@@ -9408,6 +10002,28 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       if (toolId === 'run_javascript') {
         throw new Error(DISALLOWED_RUN_JAVASCRIPT_TOOL_MESSAGE);
       }
+      // A user-requested rerun first asks its exact source run whether this
+      // logical call already completed. This is stronger than the shared cache:
+      // it is an explicit, authenticated pointer to one known source receipt.
+      if (cacheableToolResult && !toolCachePolicy.force) {
+        const sourceRunRecovered = await this.recoverSourceRunToolReceipt({
+          toolId,
+          logicalCallId,
+          executionAuthScopeDigest,
+          cacheKey: durableCacheKey,
+        });
+        if (sourceRunRecovered) {
+          this.runtimeLog(
+            `Calling tool: ${toolId} recovered from source run ${this.#options.replayedFromRunId}`,
+          );
+          this.emitToolCallLifecycle('started', toolId, normalizedKey);
+          this.emitToolCallLifecycle('settled', toolId, normalizedKey, {
+            outcome: 'cached',
+            durationMs: 0,
+          });
+          return this.materializeToolExecutionResult(sourceRunRecovered);
+        }
+      }
       // Tool-call budget is charged by the Governor's acquireToolSlot in
       // callToolExecutionAPI, so each real outbound call is counted exactly once
       // (cached/checkpoint recoveries never acquire a slot and so never charge).
@@ -9476,6 +10092,45 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         // reader seam rather than teaching the deep Module an untyped result.
         // New direct calls use the real Tool Result Receipt Adapter below.
         if (cacheableToolResult && !toolCachePolicy.force) {
+          // A source action can explicitly carry forward a previous result
+          // contract after a local version bump. Read those exact older keys
+          // before the canonical key; do not derive fallbacks from a deploy.
+          for (const compatibleCacheKey of compatibleDurableCacheKeys.slice(
+            1,
+          )) {
+            const compatibleReceipt =
+              await this.withRuntimeReceiptHydrationTurn(
+                async () =>
+                  await this.getRuntimeStepReceipt(compatibleCacheKey),
+              );
+            if (
+              compatibleReceipt &&
+              (compatibleReceipt.status === 'completed' ||
+                compatibleReceipt.status === 'skipped') &&
+              compatibleReceipt.output !== undefined
+            ) {
+              const recoveredCompatible = markToolExecuteResultExecutionOutcome(
+                this.runtimeReceiptOutput(compatibleReceipt),
+                toolExecutionOutcomeForDurableReceipt({
+                  source: 'cache',
+                  receiptKey: compatibleCacheKey,
+                  cacheKey: directCacheKey,
+                }),
+              );
+              if (
+                this.canReuseToolResultForCurrentResponseContract(
+                  recoveredCompatible,
+                )
+              ) {
+                this.runtimeLog(
+                  `Calling tool: ${toolId} recovered from an explicit action compatibility receipt`,
+                );
+                return isToolExecuteResult(recoveredCompatible)
+                  ? this.materializeToolExecutionResult(recoveredCompatible)
+                  : recoveredCompatible;
+              }
+            }
+          }
           const historicalReceipt = await this.withRuntimeReceiptHydrationTurn(
             async () => await this.getRuntimeStepReceipt(directCacheKey),
           );
@@ -9592,14 +10247,23 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           }
           const useDirectResultReceipts =
             cacheableToolResult && !bypassDirectResultCache;
+          const providerOperationKey = this.providerIdempotencyKeyForToolCall({
+            operationKey: providerIdempotencyKeyBase,
+            force: cacheableToolResult && toolCachePolicy.force,
+            logicalCallId,
+          });
           const physicalDirectKey = useDirectResultReceipts
-            ? directCacheKey
+            ? this.toolTransportReceiptKey({
+                toolId,
+                resultReceiptKey: directCacheKey,
+                providerOperationKey,
+                force: toolCachePolicy.force,
+              })
             : `${buildDurableToolReceiptPrefix({
                 orgId: this.#options.orgId ?? 'unknown-org',
                 toolId,
               })}${stableDigest(`${this.currentRunId}:${logicalCallId}:always-fresh`)}`;
           const resultReceiptKey = directResultReceiptKey;
-          const providerOperationKey = providerIdempotencyKeyBase;
           const toolRetryPolicy = await this.#options
             .getToolRetryPolicy?.(toolId, input)
             .catch(() => null);
@@ -9665,16 +10329,20 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                             ? resultReceiptKey
                             : physicalDirectKey,
                         providerIdempotencyKey:
-                          this.providerIdempotencyKeyForToolCall({
-                            operationKey:
-                              useDirectResultReceipts && operationKey
-                                ? providerIdempotencyKeyBase
-                                : physicalDirectKey,
-                            force: cacheableToolResult && toolCachePolicy.force,
-                            logicalCallId,
-                          }),
+                          useDirectResultReceipts && operationKey
+                            ? providerOperationKey
+                            : physicalDirectKey,
                       }
                     : {}),
+                  ...(useDirectResultReceipts && operationKey
+                    ? this.providerForceRefreshOptionsForToolCall({
+                        operationKey: providerIdempotencyKeyBase,
+                        force: toolCachePolicy.force,
+                        requiresExecutionFence:
+                          toolRetryPolicy?.requiresExecutionFence,
+                        logicalCallId,
+                      })
+                    : {}),
                   playNodeScope: buildPlayNodeScope({
                     toolId,
                     callKey: normalizedKey,
@@ -9721,6 +10389,14 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     : {}),
                   withCompletedReceiptHydration: (hydrate) =>
                     this.withRuntimeReceiptHydrationTurn(hydrate),
+                  onStored: async ({ resultReceiptKey }) => {
+                    await this.persistSourceRunToolReceiptManifest({
+                      toolId,
+                      logicalCallId,
+                      executionAuthScopeDigest,
+                      resultReceiptKey,
+                    });
+                  },
                   ...(toolRetryPolicy?.requiresExecutionFence === true
                     ? {
                         executionLock: {
@@ -9898,9 +10574,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           providerIdempotencyKeyBase,
           cacheable: cacheableToolResult,
           receiptKey: cacheableToolResult ? durableCacheKey : null,
-          legacyReceiptKeys: legacyDurableCacheKey
-            ? [legacyDurableCacheKey]
-            : [],
+          legacyReceiptKeys: [
+            ...compatibleDurableCacheKeys.slice(1),
+            ...(legacyDurableCacheKey ? [legacyDurableCacheKey] : []),
+          ],
           executionAuthScopeDigest,
           requiresExecutionFence:
             rowToolRetryPolicy?.requiresExecutionFence === true,
@@ -9968,12 +10645,19 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         this.invalidateToolAuthScopeDigest(toolId);
         executionAuthScopeDigest =
           (await this.resolveToolAuthScopeDigest(toolId))?.trim() ?? null;
-        durableCacheKey = await this.durableToolCallCacheKey({
-          toolId,
-          requestInput: input,
-          executionAuthScopeDigest,
-          staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
-        });
+        compatibleDurableCacheKeys =
+          await this.compatibleDurableToolCallCacheKeys({
+            toolId,
+            requestInput: input,
+            executionAuthScopeDigest,
+            staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
+          });
+        durableCacheKey = compatibleDurableCacheKeys[0];
+        if (!durableCacheKey) {
+          throw new Error(
+            `Tool ${toolId} is missing a primary durable cache key after auth refresh.`,
+          );
+        }
         legacyDurableCacheKey = await this.legacyDurableToolCallCacheKey({
           toolId,
           requestInput: input,
@@ -9993,7 +10677,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         checkpointCacheKeys.splice(
           0,
           checkpointCacheKeys.length,
-          durableCacheKey,
+          ...compatibleDurableCacheKeys,
           ...(legacyDurableCacheKey ? [legacyDurableCacheKey] : []),
         );
       }
@@ -10019,6 +10703,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       workflowId: this.#options.workflowId,
       orgId: this.#options.orgId,
       executorToken: this.#options.executorToken,
+      slackHitlDefaultTimeoutMs:
+        this.currentRuntimeSemantics.slackHitl.defaultTimeoutMs,
+      slackHitlTimeoutOutcome:
+        this.currentRuntimeContract.slackHitlTimeoutOutcome,
     };
     const basePreparedBoundary = await handler.prepare({
       payload: input,
@@ -10039,23 +10727,65 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         }
       : basePreparedBoundary;
 
-    const existing =
-      this.checkpoint.resolvedBoundaries?.[preparedBoundary.boundaryId];
+    const existing = assertKnownResolvedBoundary(
+      preparedBoundary.boundaryId,
+      this.checkpoint.resolvedBoundaries?.[preparedBoundary.boundaryId],
+    );
     if (existing?.kind === 'integration_event' && 'output' in existing) {
       const output = recordOrNull(existing.output);
       if (output?.timed_out === true) {
-        await handler.onTimeout?.({
-          payload: input,
-          context: eventContext,
-          boundary: {
+        // The runtime proxy is recreated for each worker invocation. Preserve
+        // the policy that armed this boundary so its timeout finalizer and
+        // parking behavior survive a durable replay.
+        const timeoutPolicy =
+          existing.timeoutPolicy ?? preparedBoundary.timeoutPolicy;
+        // An explicit boundary policy may deliberately omit parking (the
+        // new on_timeout: "return_null" escape hatch). Only fall back to the
+        // handler's historical default when this is an old boundary with no
+        // persisted policy at all.
+        const suspendAfterTimeoutMs = timeoutPolicy
+          ? timeoutPolicy.suspendAfterTimeoutMs
+          : handler.suspendAfterTimeoutMs;
+        try {
+          await handler.onTimeout?.({
+            payload: input,
+            context: eventContext,
+            boundary: {
+              boundaryId: preparedBoundary.boundaryId,
+              eventKey: preparedBoundary.eventKey,
+              timeoutMs: preparedBoundary.timeoutMs,
+              provider: existing.provider ?? handler.provider,
+              toolId: existing.toolId ?? handler.toolId,
+              ...(existing.messageRef
+                ? { messageRef: existing.messageRef }
+                : {}),
+              ...(timeoutPolicy ? { timeoutPolicy } : {}),
+            },
+          });
+        } catch (error) {
+          this.recordSlackHitlTimeoutFailure(error);
+          throw error;
+        }
+        if (timeoutPolicy?.timeoutOutcome === 'error') {
+          // The provider finalizer above must complete first. That ordering
+          // makes an expired Slack card and the terminal Play state agree,
+          // while provider finalization failures stay retryable instead.
+          const error = new SlackHitlTimeoutError(timeoutPolicy.timeoutError);
+          this.recordSlackHitlTimeoutFailure(error);
+          throw error;
+        }
+        if (suspendAfterTimeoutMs !== undefined) {
+          this.runtimeLog(
+            `Integration event ${preparedBoundary.boundaryId}: timeout finalized externally; keeping Play parked`,
+          );
+          this.suspendDurably({
+            kind: 'integration_event',
             boundaryId: preparedBoundary.boundaryId,
             eventKey: preparedBoundary.eventKey,
-            timeoutMs: preparedBoundary.timeoutMs,
-            provider: existing.provider ?? handler.provider,
-            toolId: existing.toolId ?? handler.toolId,
+            timeoutMs: suspendAfterTimeoutMs,
             ...(existing.messageRef ? { messageRef: existing.messageRef } : {}),
-          },
-        });
+          });
+        }
       }
       this.runtimeLog(
         `Integration event ${preparedBoundary.boundaryId}: recovered response from checkpoint`,
@@ -10091,6 +10821,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         timeoutMs: boundary.timeoutMs,
         provider: boundary.provider,
         toolId: boundary.toolId,
+        ...(boundary.timeoutPolicy
+          ? { timeoutPolicy: boundary.timeoutPolicy }
+          : {}),
         ...(rowScope
           ? {
               scope: {
@@ -10105,9 +10838,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         ...(boundary.messageRef ? { messageRef: boundary.messageRef } : {}),
       },
     };
-    this.#options.onBatchComplete?.(this.checkpoint);
-
     if (rowScope) {
+      this.#options.onBatchComplete?.(this.checkpoint);
       throw new PlayRowExecutionSuspendedError({
         boundaryId: boundary.boundaryId,
         eventKey: boundary.eventKey,
@@ -10116,7 +10848,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       });
     }
 
-    throw new PlayExecutionSuspendedError({
+    this.suspendDurably({
       kind: 'integration_event',
       boundaryId: boundary.boundaryId,
       eventKey: boundary.eventKey,
@@ -10131,6 +10863,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     input: Record<string, unknown>,
     options?: PlayCallOptions,
   ): Promise<TOutput> {
+    this.assertNoPendingDurableSuspension();
     if (
       arguments.length === 3 &&
       typeof playRef === 'object' &&
@@ -10140,19 +10873,16 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         'ctx.runPlay(...) signature is ctx.runPlay(key, playRef, input, { description }). Add a stable call key as the first argument.',
       );
     }
-    const resolvedName =
-      typeof playRef === 'string'
-        ? playRef
-        : playRef && typeof playRef.playName === 'string'
-          ? playRef.playName
-          : playRef && typeof playRef.name === 'string'
-            ? playRef.name
-            : '';
+    const resolvedName = resolvePlayReferenceName(playRef);
 
     if (!resolvedName.trim()) {
       throw new Error('ctx.runPlay(...) requires a resolvable play name.');
     }
-    validatePlayAuthoringField('ctx.runPlay.playRef', playRef);
+    // Imported Play dependencies are callable proxy functions at runtime. The
+    // authoring contract describes their durable identity, so validate the
+    // normalized name rather than requiring the ephemeral handle itself to be
+    // JSON-shaped.
+    validatePlayAuthoringField('ctx.runPlay.playRef', resolvedName);
     validatePlayAuthoringField('ctx.runPlay.input', input);
     assertNoSecretTaint(input, 'ctx.runPlay input');
     validatePlayAuthoringField('ctx.runPlay.key', key);
@@ -10258,12 +10988,18 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             runtimeContract: resolvePlayArtifactRuntimeContract({
               authoringContractEdition:
                 childCompatibility.authoringContractEdition,
+              slackHitlTimeoutOutcome:
+                childCompatibility.slackHitlTimeoutOutcome,
               toolResponseContract: childToolResponseContract,
               toolResponseReceiptRevision: childToolResponseReceiptRevision,
             }),
           },
           () => this.executeResolvedPlay(resolvedPlay, this, input),
         );
+        // Inline composition shares this Play Invocation. A child may catch a
+        // parent suspension, but it cannot publish child success while that
+        // handoff is still pending.
+        this.assertNoPendingDurableSuspension();
         this.inlineChildAggregates.ok += 1;
         if (rowStore) {
           this.emitScopedFieldMetaUpdate({
@@ -10313,6 +11049,81 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     }
   }
 
+  async runPlayAsync(
+    key: string,
+    playRef: string | { playName?: string; name?: string },
+    input: Record<string, unknown>,
+    options: PlayAsyncCallOptions,
+  ): Promise<AsyncPlayRunRef> {
+    const resolvedName = resolvePlayReferenceName(playRef);
+    if (!resolvedName.trim()) {
+      throw new Error(
+        'ctx.runPlayAsync(...) requires a resolvable Play name or definition handle.',
+      );
+    }
+    validatePlayAuthoringField('ctx.runPlayAsync.playRef', resolvedName);
+    validatePlayAuthoringField('ctx.runPlayAsync.input', input);
+    assertNoSecretTaint(input, 'ctx.runPlayAsync input');
+    validatePlayAuthoringField('ctx.runPlayAsync.key', key);
+    validatePlayAuthoringField(
+      'ctx.runPlayAsync.options.description',
+      options?.description,
+    );
+    const normalizedKey = this.normalizeContextKey(key, 'runPlayAsync');
+    if (!this.#options.launchPlayAsync) {
+      throw new Error(
+        'ctx.runPlayAsync(...) is unavailable because no async Play admission Adapter was configured.',
+      );
+    }
+    const ancestryPlayIds =
+      this.currentExecutionGovernor.snapshot().ancestryPlayIds;
+    admitAsyncPlayLineage({
+      ancestryPlayIds,
+      childPlayName: resolvedName,
+    });
+
+    const rowScope = rowContext.getStore();
+    const invocationKey = sha256Hex(
+      stableStringify({
+        parentRunId: this.currentExecutionScope.logical.runId,
+        callerScope: this.currentExecutionScope.receipt.namespace,
+        key: normalizedKey,
+        row: rowScope
+          ? {
+              tableNamespace: rowScope.tableNamespace ?? null,
+              rowKey: rowScope.rowKey ?? null,
+              rowId: rowScope.rowKey ? null : rowScope.rowId,
+              fieldName: rowScope.fieldName ?? null,
+            }
+          : null,
+      }),
+    );
+    const launched = await this.#options.launchPlayAsync({
+      key: normalizedKey,
+      invocationKey,
+      playRef: resolvedName,
+      input,
+      description: options.description,
+      schedulerSchema: this.#options.runtimeSchedulerSchema ?? null,
+      ancestryPlayIds,
+    });
+    const step = {
+      type: 'play_launch' as const,
+      playId: resolvedName,
+      runId: launched.runId,
+      description: normalizeStepDescription(options?.description),
+    };
+    if (this.activeDatasetStep) {
+      this.activeDatasetStep.substeps.push(step);
+    } else {
+      this.steps.push(step);
+    }
+    this.log(
+      `ctx.runPlayAsync(${normalizedKey}): admitted ${resolvedName} as ${launched.runId}`,
+    );
+    return launched;
+  }
+
   /**
    * Replay-stable receipt namespace for primitives executed by one inline
    * `ctx.runPlay` invocation. Format
@@ -10577,7 +11388,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         `sleep-${this.sleepBoundaryIndex}-${delayMs}`,
       );
       this.sleepBoundaryIndex += 1;
-      const existing = this.checkpoint.resolvedBoundaries?.[boundaryId];
+      const existing = assertKnownResolvedBoundary(
+        boundaryId,
+        this.checkpoint.resolvedBoundaries?.[boundaryId],
+      );
       if (existing?.kind === 'sleep' && existing.completedAt !== undefined) {
         return;
       }
@@ -10588,8 +11402,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           delayMs,
         },
       };
-      this.#options.onBatchComplete?.(this.checkpoint);
-      throw new PlayExecutionSuspendedError({
+      this.suspendDurably({
         kind: 'sleep',
         boundaryId,
         delayMs,
@@ -10759,7 +11572,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             )}`,
           );
 
-          const existing = this.checkpoint.resolvedBoundaries?.[boundaryId];
+          const existing = assertKnownResolvedBoundary(
+            boundaryId,
+            this.checkpoint.resolvedBoundaries?.[boundaryId],
+          );
           // A transient request deliberately has no durable recovery path, so
           // its response stays in the running Play rather than a checkpoint.
           if (
@@ -10951,6 +11767,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               options?.transient !== true &&
               !this.durableDirectToolResultsBackedByReceipts
             ) {
+              // Publishing a fetch boundary makes the result replay-visible.
+              // A caught durable suspension is still the invocation's outcome,
+              // so never checkpoint over a pending handoff.
+              this.assertNoPendingDurableSuspension();
               this.checkpoint.resolvedBoundaries = {
                 ...(this.checkpoint.resolvedBoundaries ?? {}),
                 [boundaryId]: {
@@ -10998,7 +11818,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       `step-${scope}:${normalizedKey}${boundarySuffix}`,
     );
     const executeStep = async (): Promise<T> => {
-      const existing = this.checkpoint.resolvedBoundaries?.[boundaryId];
+      const existing = assertKnownResolvedBoundary(
+        boundaryId,
+        this.checkpoint.resolvedBoundaries?.[boundaryId],
+      );
       if (existing?.kind === 'step' && 'output' in existing) {
         this.runtimeLog(
           `ctx.step(${normalizedKey}): recovered result from checkpoint`,
@@ -11008,6 +11831,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
 
       const output = await run();
       assertJsonSerializableStepOutput(normalizedKey, output);
+      // A caught durable suspension is still the invocation's outcome. Never
+      // publish an enclosing step fallback that would make a later resume skip
+      // the suspended work.
+      this.assertNoPendingDurableSuspension();
       this.checkpoint.resolvedBoundaries = {
         ...(this.checkpoint.resolvedBoundaries ?? {}),
         [boundaryId]: {
@@ -11355,6 +12182,23 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             output: serializeToolExecuteResult(receipt.result),
           })),
         );
+        await this.persistSourceRunToolReceiptManifests(
+          receipts.flatMap((receipt) => {
+            const request = input.requestForReceipt.get(
+              receipt.resultReceiptKey,
+            );
+            return request
+              ? [
+                  {
+                    toolId: input.toolId,
+                    logicalCallId: request.logicalCallId,
+                    executionAuthScopeDigest: request.executionAuthScopeDigest,
+                    resultReceiptKey: receipt.resultReceiptKey,
+                  },
+                ]
+              : [];
+          }),
+        );
         return await recordsFor(
           receipts.map((receipt) => receipt.resultReceiptKey),
           completed,
@@ -11566,19 +12410,38 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           }
           let releaseToolSlot: () => void = () => undefined;
           try {
+            const providerOperationKey = this.providerIdempotencyKeyForToolCall(
+              {
+                operationKey:
+                  request.providerIdempotencyKeyBase ?? request.receiptKey!,
+                force: request.force === true,
+                logicalCallId: request.logicalCallId,
+              },
+            );
             const result = await this.executeMappedToolCallThroughModule({
               request,
               dispatchToolId: toolId,
               dispatchPayload: request.input,
               resultReceiptKey: request.receiptKey!,
-              providerOperationKey:
-                request.providerIdempotencyKeyBase ?? request.receiptKey!,
+              providerOperationKey,
               resultReceipts: receipts,
               apiOptions: {
                 playNodeScope: playNodeScopeForToolCallRequest(request),
-                durableCallReceiptKey: request.receiptKey,
+                durableCallReceiptKey: this.toolTransportReceiptKey({
+                  toolId,
+                  resultReceiptKey: request.receiptKey!,
+                  providerOperationKey,
+                  force: request.force,
+                }),
                 completedResultCache: true,
                 executionAuthScopeDigest: request.executionAuthScopeDigest,
+                ...this.providerForceRefreshOptionsForToolCall({
+                  operationKey:
+                    request.providerIdempotencyKeyBase ?? request.receiptKey!,
+                  force: request.force,
+                  requiresExecutionFence: request.requiresExecutionFence,
+                  logicalCallId: request.logicalCallId,
+                }),
                 timeoutMs:
                   typeof request.timeoutMs === 'number' && request.timeoutMs > 0
                     ? request.timeoutMs
@@ -11618,7 +12481,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     if (requests.length === 0) return [];
 
     const requestForReceipt = new Map<string, ToolCallRequest>();
-    const requestByCallId = new Map<string, ToolCallRequest>();
     for (const request of requests) {
       const receiptKey = request.receiptKey?.trim();
       if (!receiptKey) {
@@ -11627,13 +12489,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         );
       }
       requestForReceipt.set(receiptKey, request);
-      requestByCallId.set(request.callId, request);
     }
     const store = this.createRuntimeStepToolCallReceiptCohortStore({
       toolId,
       requestForReceipt,
     });
-    const compiledBatches = compileRequestsWithStrategy({
+    const plannedBatches = compileRequestsWithStrategy({
       requests,
       strategy,
       getPayload: (request: ToolCallRequest) => request.input,
@@ -11656,9 +12517,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     const batchParallelismCeiling =
       this.governor.policy.pacing.workerToolBatchDefaultParallelism;
     const batchSize =
-      compiledBatches.length > 0
+      plannedBatches.length > 0
         ? await this.resourceGovernor.suggestedToolParallelism(
-            compiledBatches[0]!.batchOperation,
+            plannedBatches[0]!.batchOperation,
             batchParallelismCeiling,
           )
         : batchParallelismCeiling;
@@ -11697,27 +12558,36 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     };
 
     await executeChunkedRequests({
-      requests: compiledBatches,
+      requests: plannedBatches,
       batchSize,
-      execute: async (batch) => {
+      execute: async (plannedBatch) => {
         if (this.persistenceLatch.tripped) {
           this.persistenceLatch.preventedCallCount +=
-            batch.memberRequests.length;
+            plannedBatch.memberRequests.length;
           throw new RuntimePersistenceCircuitOpenError(this.persistenceLatch);
         }
-        const batchRequestByCallId = new Map(
-          batch.memberRequests.map((request) => [request.callId, request]),
+        const requestByCallId = new Map(
+          plannedBatch.memberRequests.map((request) => [
+            request.callId,
+            request,
+          ]),
         );
-        const dispatchDetails = new Map<
+        type NativeBatchPhysicalDispatchDetails = {
+          members: ToolCallRequest[];
+          compiled: CompiledRequestBatch<ToolCallRequest>;
+          providerOperationKey: string;
+          forceRefreshIdentities: string[];
+          receiptLeaseExpiresAt: string | null;
+          timeoutMs: number | undefined;
+        };
+        const nativeBatchPhysicalDispatchByAggregateReceipt = new Map<
           string,
-          {
-            members: ToolCallRequest[];
-            compiled: CompiledRequestBatch<ToolCallRequest>;
-            providerOperationKey: string;
-            receiptLeaseExpiresAt: string | null;
-            timeoutMs: number | undefined;
-          }
+          NativeBatchPhysicalDispatchDetails
         >();
+        const aggregateReceiptKeyByOwnedMemberIds = new Map<string, string>();
+        const ownedMemberIdsKey = (
+          members: ReadonlyArray<{ memberId: string }>,
+        ): string => JSON.stringify(members.map((member) => member.memberId));
         const physicalToolCall = {
           call: async (
             physical: Parameters<
@@ -11730,7 +12600,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 'Native batch physical Tool Call requires compatibility identities.',
               );
             }
-            const detail = dispatchDetails.get(compatibility.resultReceiptKey);
+            const detail = nativeBatchPhysicalDispatchByAggregateReceipt.get(
+              compatibility.resultReceiptKey,
+            );
             if (!detail) {
               throw new Error(
                 'Native batch physical Tool Call lost its dispatch details.',
@@ -11752,7 +12624,14 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     call.tool.id,
                     call.payload,
                     {
-                      durableCallReceiptKey: compatibility.resultReceiptKey,
+                      durableCallReceiptKey: this.toolTransportReceiptKey({
+                        toolId: call.tool.id,
+                        resultReceiptKey: compatibility.resultReceiptKey,
+                        providerOperationKey: detail.providerOperationKey,
+                        force: detail.members.some(
+                          (request) => request.force === true,
+                        ),
+                      }),
                       completedResultCache: true,
                       playNodeScope: playNodeScopeForToolCallRequest(
                         detail.members[0]!,
@@ -11760,6 +12639,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                       ),
                       executionAuthScopeDigest:
                         detail.members[0]?.executionAuthScopeDigest ?? null,
+                      ...(detail.forceRefreshIdentities.length > 0
+                        ? {
+                            providerOperationForceRefreshIdentities:
+                              detail.forceRefreshIdentities,
+                          }
+                        : {}),
                       receiptLeaseExpiresAt: detail.receiptLeaseExpiresAt,
                       timeoutMs: detail.timeoutMs,
                     },
@@ -11793,7 +12678,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             runId: this.currentReceiptOwnerRunId,
             attempt: this.currentRunAttempt,
           },
-          members: batch.memberRequests.map((request) => ({
+          members: plannedBatch.memberRequests.map((request) => ({
             memberId: request.callId,
             forceFailedRefresh: request.forceFailedRefresh === true,
             waitMaxAttempts: resolveRuntimeToolReceiptWaitMaxAttempts(
@@ -11831,53 +12716,92 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               },
             },
           })),
-          buildPhysicalCall: ({ members }) => {
-            const owned = members.map(
-              (member) => batchRequestByCallId.get(member.memberId)!,
+          buildPhysicalCall: async ({ members: ownedMembers }) => {
+            // `ownedMembers` are the rows we still need to execute.
+            const ownedMemberRequests = ownedMembers.map(
+              (member) => requestByCallId.get(member.memberId)!,
+            );
+            const compiled = compileOwnedPhysicalBatch(ownedMemberRequests);
+            const receiptKeys = ownedMemberRequests.map(
+              (request) => request.receiptKey!,
             );
-            const receiptKeys = owned.map((request) => request.receiptKey!);
             const aggregateReceiptKey = buildDurableToolAggregateReceiptKey({
               receiptKeys,
               prefix: 'batch',
               aggregateReceiptPrefix: buildDurableToolReceiptPrefix({
                 orgId: this.#options.orgId,
-                toolId: batch.batchOperation,
+                toolId: compiled.batchOperation,
               }),
             });
-            const compiled = compileOwnedPhysicalBatch(owned);
-            if (compiled.batchOperation !== batch.batchOperation) {
-              throw new Error(
-                'Native batch owned members changed provider operation during compilation.',
-              );
-            }
-            const providerOperationKey = aggregateReceiptKey;
-            dispatchDetails.set(aggregateReceiptKey, {
-              members: owned,
-              compiled,
-              providerOperationKey,
-              receiptLeaseExpiresAt: owned.reduce<string | null>(
-                (earliest, request) => {
+            const providerActionVersion =
+              (
+                await this.#options.getToolActionCacheVersion?.(
+                  compiled.batchOperation,
+                )
+              )?.trim() ?? '';
+            const forceRefreshIdentities = ownedMemberRequests.flatMap(
+              (request) =>
+                this.providerForceRefreshIdentitiesForToolCall({
+                  operationKey:
+                    this.providerOperationKeyForQueuedToolCall(request),
+                  force: request.force,
+                  requiresExecutionFence: request.requiresExecutionFence,
+                  logicalCallId: request.logicalCallId,
+                }),
+            );
+            const providerOperationKey =
+              buildDurableToolPayloadProviderIdempotencyKey({
+                orgId: this.#options.orgId,
+                toolId: compiled.batchOperation,
+                executionAuthScopeDigest:
+                  ownedMemberRequests[0]?.executionAuthScopeDigest ?? null,
+                providerActionVersion,
+                payload: compiled.batchPayload,
+                forceRefreshIdentities,
+              });
+            const aggregateDispatchDetails: NativeBatchPhysicalDispatchDetails =
+              {
+                members: ownedMemberRequests,
+                compiled,
+                providerOperationKey,
+                forceRefreshIdentities,
+                receiptLeaseExpiresAt: ownedMemberRequests.reduce<
+                  string | null
+                >((earliest, request) => {
                   const expiresAt = request.receiptLeaseExpiresAt ?? null;
                   if (!expiresAt) return earliest;
                   if (!earliest) return expiresAt;
                   return Date.parse(expiresAt) < Date.parse(earliest)
                     ? expiresAt
                     : earliest;
-                },
-                null,
-              ),
-              timeoutMs: owned.every(
-                (request) =>
-                  typeof request.timeoutMs === 'number' &&
-                  Number.isFinite(request.timeoutMs) &&
-                  request.timeoutMs > 0,
-              )
-                ? Math.max(...owned.map((request) => request.timeoutMs!))
-                : undefined,
-            });
+                }, null),
+                timeoutMs: ownedMemberRequests.every(
+                  (request) =>
+                    typeof request.timeoutMs === 'number' &&
+                    Number.isFinite(request.timeoutMs) &&
+                    request.timeoutMs > 0,
+                )
+                  ? Math.max(
+                      ...ownedMemberRequests.map(
+                        (request) => request.timeoutMs!,
+                      ),
+                    )
+                  : undefined,
+              };
+            nativeBatchPhysicalDispatchByAggregateReceipt.set(
+              aggregateReceiptKey,
+              aggregateDispatchDetails,
+            );
+            aggregateReceiptKeyByOwnedMemberIds.set(
+              ownedMemberIdsKey(ownedMembers),
+              aggregateReceiptKey,
+            );
             return {
-              ...members[0]!.call,
-              tool: { id: batch.batchOperation, providerActionVersion: '' },
+              ...ownedMembers[0]!.call,
+              tool: {
+                id: compiled.batchOperation,
+                providerActionVersion,
+              },
               payload: compiled.batchPayload,
               compatibility: {
                 resultReceiptKey: aggregateReceiptKey,
@@ -11885,34 +12809,29 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               },
             };
           },
-          splitResult: async ({ result: aggregate, members }) => {
-            const receiptKeys = members.map((member) => {
-              const request = batchRequestByCallId.get(member.memberId);
-              if (!request?.receiptKey) {
-                throw new Error(
-                  `Native batch Tool Call lost receipt for ${member.memberId}.`,
-                );
-              }
-              return request.receiptKey;
-            });
-            const aggregateReceiptKey = buildDurableToolAggregateReceiptKey({
-              receiptKeys,
-              prefix: 'batch',
-              aggregateReceiptPrefix: buildDurableToolReceiptPrefix({
-                orgId: this.#options.orgId,
-                toolId: batch.batchOperation,
-              }),
-            });
-            const detail = dispatchDetails.get(aggregateReceiptKey);
+          splitResult: async ({ result: aggregate, members: ownedMembers }) => {
+            const aggregateReceiptKey = aggregateReceiptKeyByOwnedMemberIds.get(
+              ownedMemberIdsKey(ownedMembers),
+            );
+            if (!aggregateReceiptKey) {
+              throw new Error(
+                'Native batch Tool Call lost its physical aggregate receipt identity.',
+              );
+            }
+            const detail =
+              nativeBatchPhysicalDispatchByAggregateReceipt.get(
+                aggregateReceiptKey,
+              );
             if (!detail) {
               throw new Error(
                 'Native batch Tool Call lost its split compilation details.',
               );
             }
             if (
-              detail.members.length !== members.length ||
+              detail.members.length !== ownedMembers.length ||
               !detail.members.every(
-                (request, index) => request.callId === members[index]?.memberId,
+                (request, index) =>
+                  request.callId === ownedMembers[index]?.memberId,
               )
             ) {
               throw new Error(
@@ -11923,8 +12842,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               legacyResultForBatchSplitter(aggregate),
             );
             return await Promise.all(
-              members.map(async (member, index) => {
-                const request = batchRequestByCallId.get(member.memberId);
+              ownedMembers.map(async (member, index) => {
+                const request = requestByCallId.get(member.memberId);
                 if (!request) {
                   throw new Error(
                     `Native batch Tool Call lost member ${member.memberId}.`,
@@ -11954,7 +12873,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             );
           },
         });
-        return { batch, result };
+        return { batch: plannedBatch, result };
       },
       onChunkComplete: async (entries) => {
         for (const entry of entries) {
@@ -11964,6 +12883,17 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             for (const request of entry.request.memberRequests) {
               await reject(request, entry.error);
             }
+            // A provider-unavailable physical batch is a logical outcome for
+            // each member, not a map-fatal scheduler failure. Each rejected
+            // row resolver now receives the typed error above, where a
+            // waterfall may persist the failed leg and advance to its next
+            // provider. Keep infrastructure and contract failures loud.
+            if (
+              isProviderExhaustedFailure(entry.error) ||
+              isProviderUnavailable(entry.error)
+            ) {
+              continue;
+            }
             throw entry.error;
           }
           if (!entry.result) {
@@ -12618,6 +13548,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                             force: owner.force === true,
                             logicalCallId: owner.logicalCallId,
                           }),
+                        ...this.providerForceRefreshOptionsForToolCall({
+                          operationKey:
+                            this.providerOperationKeyForQueuedToolCall(owner),
+                          force: owner.force,
+                          requiresExecutionFence: owner.requiresExecutionFence,
+                          logicalCallId: owner.logicalCallId,
+                        }),
                         timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners([
                           owner,
                         ]),
@@ -13232,6 +14169,16 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                                     force: request.force === true,
                                     logicalCallId: request.logicalCallId,
                                   }),
+                                ...this.providerForceRefreshOptionsForToolCall({
+                                  operationKey:
+                                    this.providerOperationKeyForQueuedToolCall(
+                                      request,
+                                    ),
+                                  force: request.force,
+                                  requiresExecutionFence:
+                                    request.requiresExecutionFence,
+                                  logicalCallId: request.logicalCallId,
+                                }),
                                 receiptLeaseExpiresAt:
                                   request.receiptLeaseExpiresAt,
                                 heartbeatReceipt: () =>
@@ -13440,9 +14387,20 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     const asyncContract = options?.skipAsyncOperationResolution
       ? null
       : ((await this.#options.getToolAsyncOperation?.(toolId)) ?? null);
+    const asyncOperationPoll = options?.skipAsyncOperationResolution
+      ? null
+      : ((await this.#options.getToolAsyncOperationPoll?.(toolId)) ?? null);
     const shouldWaitForAsyncOperation = Boolean(
       asyncContract && asyncOperationShouldWait(asyncContract, input),
     );
+    // An explicitly opted-in caller-managed launch gives the Play author the
+    // provider handle and leaves polling to the authored graph. Do not let a
+    // provider's legacy synchronous helper turn a wide start wave into
+    // long-lived HTTP calls before that graph can make its own poll.
+    const shouldPreferAsyncProviderExecution =
+      asyncContract?.wait.kind === 'caller_managed' &&
+      asyncContract.lifecycle.startAction === toolId &&
+      asyncContract.launch?.preferAsync === true;
     const executionAuthScopeDigest = options?.executionAuthScopeDigest
       ? options.executionAuthScopeDigest.trim() || null
       : ((await this.resolveToolAuthScopeDigest(toolId))?.trim() ?? null);
@@ -13635,13 +14593,17 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               `Tool ${toolId} requires a provider execution fence but no provider operation identity was supplied.`,
             );
           }
-          const canonicalOperationActionVersion = providerExecutionFenceKey
-            ? (
-                await this.#options.getToolActionCacheVersion?.(toolId)
-              )?.trim() || null
-            : null;
+          const canonicalOperationActionVersion =
+            providerExecutionFenceKey ||
+            options?.providerOperationForceRefreshIdentities?.length
+              ? (
+                  await this.#options.getToolActionCacheVersion?.(toolId)
+                )?.trim() || null
+              : null;
           const canonicalOperation =
-            providerExecutionFenceKey && canonicalOperationActionVersion
+            (providerExecutionFenceKey ||
+              options?.providerOperationForceRefreshIdentities?.length) &&
+            canonicalOperationActionVersion
               ? {
                   version: 1,
                   tool_id: toolId,
@@ -13672,6 +14634,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 ...(shouldWaitForAsyncOperation
                   ? { async_operation_wait: true }
                   : {}),
+                ...(shouldPreferAsyncProviderExecution
+                  ? { prefer_async: true }
+                  : {}),
+                ...(asyncOperationPoll
+                  ? {
+                      async_operation_poll_timeout_ms:
+                        asyncOperationPoll.checkTimeoutMs,
+                    }
+                  : {}),
                 ...(usesDurableInvocationFence
                   ? {
                       invocation_fence_version:
@@ -14242,14 +15213,36 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   toolId,
                   failure.backpressureDelayMs,
                 );
+                // A Retry-After beyond the durable pacer's maximum wait has
+                // no useful in-process retry. It is already an exhausted
+                // provider outcome: surface the same typed error the next
+                // provider admission would produce, without sleeping before a
+                // waterfall can choose an independent fallback.
+                if (
+                  failure.backpressureDelayMs > PROVIDER_EXHAUSTED_MAX_WAIT_MS
+                ) {
+                  throw new ProviderExhaustedError({
+                    provider,
+                    retryAtMs: Date.now() + failure.backpressureDelayMs,
+                    cause: failure.error,
+                  });
+                }
               }
               if (
                 failure.shouldRetry &&
-                (ambiguousTransportReplayAllowed ||
+                (failure.knownNotDispatched ||
+                  failure.reason === 'gateway_invocation_in_progress' ||
+                  ambiguousTransportReplayAllowed ||
                   retrySafeTransientHttp ||
                   fixtureReplaySafe)
               ) {
-                invocationAttempt += 1;
+                // A gateway follower is retrying transport delivery to the
+                // same durable invocation. Advancing the logical attempt here
+                // would mint a new invocation key while the original owner is
+                // still running, defeating the gateway's replay fence.
+                if (failure.reason !== 'gateway_invocation_in_progress') {
+                  invocationAttempt += 1;
+                }
                 if (failure.chargeRetryBudget) {
                   await this.governor.chargeBudget('retry');
                 }