deepline 0.3.89 → 0.3.91

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -126,6 +126,10 @@ import {
   type ToolExecutionErrorSchemaVersion,
   type ToolExecutionFailureV1,
 } from '../plays/tool-execution-error';
+import {
+  SLACK_HITL_TIMEOUT_ERROR_CODE,
+  SlackHitlTimeoutError,
+} from '../plays/slack-hitl-timeout-error';
 import { InMemoryRateStateBackend } from './governor/in-memory-rate-state-backend';
 import { pacingPolicyForTool } from './pacing';
 import {
@@ -181,6 +185,7 @@ import {
   buildDurableToolAggregateReceiptKey,
   buildDurableToolCallAuthScopeDigest,
   buildDurableToolCallCacheKey,
+  buildSourceRunToolReceiptManifestKey,
   buildLegacyRevisionedDurableToolCallCacheKey,
   buildDurableToolPayloadProviderIdempotencyKey,
   buildProviderOperationIdempotencyKey,
@@ -2017,6 +2022,14 @@ function cloneMapFrame(frame: MapExecutionFrame): MapExecutionFrame {
     ...frame,
     completedRowKeys: [...frame.completedRowKeys],
     pendingRowKeys: [...frame.pendingRowKeys],
+    ...(frame.suspendedInputRows
+      ? {
+          suspendedInputRows: frame.suspendedInputRows.map((row) => ({
+            inputIndex: row.inputIndex,
+            data: cloneCsvAliasedRow(row.data),
+          })),
+        }
+      : {}),
   };
 }
 
@@ -2110,6 +2123,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
    * waterfall miss.
    */
   private deeplineInsufficientCreditsFailure: ToolExecutionError | null = null;
+  /**
+   * A Slack HITL timeout is terminal only after its card finalizer has proved
+   * the Slack replacement. Keep that terminal result outside authored promise
+   * control flow so catching the rejected tool call cannot settle the Play or
+   * start a later durable operation.
+   */
+  private slackHitlTimeoutFailure: ToolExecutionError | null = null;
   private toolCallResolvers = new Map<
     string,
     { resolve: (value: unknown) => void; reject: (reason: unknown) => void }
@@ -2309,6 +2329,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           : undefined,
       ).catch((error: unknown) => {
         this.recordDeeplineInsufficientCreditsFailure(error);
+        this.recordSlackHitlTimeoutFailure(error);
         throw error;
       }) as Promise<TOutput>;
     },
@@ -2331,12 +2352,46 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     }
   }
 
+  private recordSlackHitlTimeoutFailure(error: unknown): void {
+    if (
+      error instanceof ToolExecutionError &&
+      error.code === SLACK_HITL_TIMEOUT_ERROR_CODE
+    ) {
+      if (!this.slackHitlTimeoutFailure) {
+        this.slackHitlTimeoutFailure = error;
+        this.runtimeLog(
+          `[slack_hitl.timeout_terminal] code=${SLACK_HITL_TIMEOUT_ERROR_CODE} ` +
+            'card_finalization=confirmed outcome=run_fatal',
+        );
+      }
+    }
+  }
+
+  /**
+   * Called by the runner before a normal result settles. This preserves a
+   * terminal Slack timeout even if authored code catches it and returns a
+   * value. It intentionally remains separate from provider errors, which are
+   * ordinary customer-handled waterfall misses.
+   */
+  assertNoSlackHitlTimeoutFailure(): void {
+    if (this.slackHitlTimeoutFailure) {
+      throw this.slackHitlTimeoutFailure;
+    }
+  }
+
+  /** Called by the runner after customer code returns, before a success settles. */
+  assertNoRunFatalToolFailure(): void {
+    this.assertNoSlackHitlTimeoutFailure();
+    this.assertNoDeeplineInsufficientCreditsFailure();
+  }
+
   /**
    * Called at ctx effect boundaries and by the runner before it can settle a
    * normal result. This makes suspension sticky even when authored code uses a
    * broad catch around `await ctx.sleep(...)`.
    */
   assertNoPendingDurableSuspension(): void {
+    this.assertNoSlackHitlTimeoutFailure();
     if (this.pendingDurableSuspension) {
       throw new PlayExecutionSuspendedError(this.pendingDurableSuspension);
     }
@@ -2466,6 +2521,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       options.artifactRuntimeContract ??
       resolvePlayArtifactRuntimeContract({
         authoringContractEdition: options.authoringContractEdition,
+        slackHitlTimeoutOutcome: options.slackHitlTimeoutOutcome,
         toolResponseContract: options.toolResponseContract,
         toolResponseReceiptRevision: options.toolResponseReceiptRevision,
       });
@@ -3441,6 +3497,223 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     };
   }
 
+  /**
+   * Record tiny pointers after canonical tool receipts settle. A rerun can
+   * then recover each exact source-run receipt before trying the ordinary
+   * cross-run cache. The pointers never contain provider input, credentials,
+   * or provider responses.
+   *
+   * This deliberately uses the same bulk receipt seam as canonical result
+   * persistence. A map can settle hundreds of results at once; falling back
+   * to one read/claim/complete triplet per pointer would make compatibility
+   * bookkeeping contend with the customer's provider work.
+   */
+  private async persistSourceRunToolReceiptManifests(
+    inputs: Array<{
+      toolId: string;
+      logicalCallId?: string | null;
+      executionAuthScopeDigest?: string | null;
+      resultReceiptKey: string;
+    }>,
+  ): Promise<void> {
+    const sourceRunId = this.currentReceiptOwnerRunId.trim();
+    if (
+      !sourceRunId ||
+      !(
+        this.#options.claimRuntimeStepReceipt ||
+        this.#options.claimRuntimeStepReceipts
+      ) ||
+      !(
+        this.#options.completeRuntimeStepReceipt ||
+        this.#options.completeRuntimeStepReceipts
+      )
+    ) {
+      return;
+    }
+    try {
+      const providerActionVersions = new Map<string, string>();
+      await Promise.all(
+        [...new Set(inputs.map((input) => input.toolId))].map(
+          async (toolId) => {
+            providerActionVersions.set(
+              toolId,
+              (
+                await this.#options.getToolActionCacheVersion?.(toolId)
+              )?.trim() ?? '',
+            );
+          },
+        ),
+      );
+      const manifests = inputs.flatMap((input) => {
+        const logicalCallId = input.logicalCallId?.trim();
+        const resultReceiptKey = input.resultReceiptKey.trim();
+        if (!logicalCallId || !resultReceiptKey) return [];
+        const providerActionVersion =
+          providerActionVersions.get(input.toolId) ?? '';
+        if (!providerActionVersion) return [];
+        const key = buildSourceRunToolReceiptManifestKey({
+          orgId: this.#options.orgId,
+          sourceRunId,
+          logicalCallId,
+        });
+        return [
+          {
+            key,
+            output: {
+              kind: 'source-run-tool-receipt-manifest-v1' as const,
+              toolId: input.toolId,
+              providerActionVersion,
+              executionAuthScopeDigest:
+                input.executionAuthScopeDigest?.trim() ?? null,
+              resultReceiptKey,
+            },
+          },
+        ];
+      });
+      if (manifests.length === 0) return;
+
+      // Several row callbacks can refer to the same logical call. The first
+      // canonical receipt is authoritative, so one idempotent pointer write is
+      // enough.
+      const uniqueManifests = [
+        ...new Map(
+          manifests.map((manifest) => [manifest.key, manifest]),
+        ).values(),
+      ];
+      const existing = await this.getRuntimeStepReceipts(
+        uniqueManifests.map((manifest) => manifest.key),
+      );
+      const missing = uniqueManifests.filter((manifest) => {
+        const receipt = existing.get(manifest.key);
+        return receipt?.status !== 'completed' && receipt?.status !== 'skipped';
+      });
+      if (missing.length === 0) return;
+
+      const claims = await this.claimRuntimeStepReceipts(
+        missing.map((manifest) => manifest.key),
+        sourceRunId,
+      );
+      await this.completeRuntimeStepReceipts(
+        missing.flatMap((manifest) => {
+          const claim = claims.get(manifest.key);
+          return claim?.leaseId
+            ? [
+                {
+                  key: manifest.key,
+                  runId: sourceRunId,
+                  leaseId: claim.leaseId,
+                  output: manifest.output,
+                },
+              ]
+            : [];
+        }),
+      );
+    } catch (error) {
+      // The canonical result receipt has already settled. A telemetry pointer
+      // must never turn that successful provider result into a failed run.
+      this.runtimeLog(
+        `Tool source-run receipt manifest write skipped: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
+  }
+
+  private async persistSourceRunToolReceiptManifest(input: {
+    toolId: string;
+    logicalCallId?: string | null;
+    executionAuthScopeDigest?: string | null;
+    resultReceiptKey: string;
+  }): Promise<void> {
+    await this.persistSourceRunToolReceiptManifests([input]);
+  }
+
+  private async recoverSourceRunToolReceipt(input: {
+    toolId: string;
+    logicalCallId: string;
+    executionAuthScopeDigest?: string | null;
+    cacheKey: string;
+  }): Promise<ToolExecuteResult | null> {
+    const sourceRunId = this.#options.replayedFromRunId?.trim();
+    if (!sourceRunId || !this.#options.getRuntimeStepReceipt) return null;
+
+    const manifestKey = buildSourceRunToolReceiptManifestKey({
+      orgId: this.#options.orgId,
+      sourceRunId,
+      logicalCallId: input.logicalCallId,
+    });
+    const manifestReceipt = await this.withRuntimeReceiptHydrationTurn(
+      async () => await this.getRuntimeStepReceipt(manifestKey),
+    );
+    if (
+      !manifestReceipt ||
+      (manifestReceipt.status !== 'completed' &&
+        manifestReceipt.status !== 'skipped')
+    ) {
+      return null;
+    }
+    const manifest = recordOrNull(this.runtimeReceiptOutput(manifestReceipt));
+    if (
+      !manifest ||
+      manifest.kind !== 'source-run-tool-receipt-manifest-v1' ||
+      manifest.toolId !== input.toolId ||
+      typeof manifest.resultReceiptKey !== 'string' ||
+      !manifest.resultReceiptKey.trim() ||
+      typeof manifest.providerActionVersion !== 'string'
+    ) {
+      return null;
+    }
+    const currentActionVersion =
+      (await this.#options.getToolActionCacheVersion?.(input.toolId))?.trim() ??
+      '';
+    const compatibleActionVersions = new Set([
+      currentActionVersion,
+      ...(
+        (await this.#options.getToolActionCacheReadVersions?.(input.toolId)) ??
+        []
+      ).map((version) => String(version || '').trim()),
+    ]);
+    if (!compatibleActionVersions.has(manifest.providerActionVersion.trim())) {
+      return null;
+    }
+    const manifestAuthScopeDigest =
+      typeof manifest.executionAuthScopeDigest === 'string'
+        ? manifest.executionAuthScopeDigest.trim() || null
+        : null;
+    if (
+      manifestAuthScopeDigest !==
+      (input.executionAuthScopeDigest?.trim() || null)
+    ) {
+      return null;
+    }
+    const resultReceiptKey = manifest.resultReceiptKey.trim();
+    const sourceReceipt = await this.withRuntimeReceiptHydrationTurn(
+      async () => await this.getRuntimeStepReceipt(resultReceiptKey),
+    );
+    if (
+      !sourceReceipt ||
+      (sourceReceipt.status !== 'completed' &&
+        sourceReceipt.status !== 'skipped')
+    ) {
+      return null;
+    }
+    const stored = this.runtimeReceiptOutput(sourceReceipt);
+    const result = isSerializedToolExecuteResult(stored)
+      ? deserializeToolExecuteResult(stored)
+      : isToolExecuteResult(stored)
+        ? stored
+        : null;
+    if (!result || !this.canReuseToolResultForCurrentResponseContract(result)) {
+      return null;
+    }
+    return cloneToolExecuteResultWithExecution(
+      result,
+      toolExecutionMetadataForOutcome({
+        kind: 'source_run',
+        cacheKey: input.cacheKey,
+        receiptKey: resultReceiptKey,
+      }),
+    );
+  }
+
   private async releaseRuntimeStepReceipt(
     key: string,
     _runId: string,
@@ -4258,6 +4531,47 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     return buildDurableToolCallCacheKey(identity);
   }
 
+  /**
+   * The first key is the only write/provider identity. Later keys are explicit
+   * action-local read fallbacks, used only when source metadata says their
+   * completed result remains compatible. Deploy and generated-catalog state
+   * never participate in this list.
+   */
+  private async compatibleDurableToolCallCacheKeysForScope(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+    playLocalScope?: string | null;
+  }): Promise<string[]> {
+    const identity = await this.durableToolCallCacheIdentity(input);
+    const primaryVersion = identity.providerActionVersion?.trim();
+    if (!primaryVersion) {
+      throw new Error(
+        `Tool ${input.toolId} is missing a provider action compatibility version.`,
+      );
+    }
+    const readVersions = await this.#options.getToolActionCacheReadVersions?.(
+      input.toolId,
+    );
+    const versions = [
+      primaryVersion,
+      ...(readVersions ?? [])
+        .map((version) => String(version || '').trim())
+        .filter(Boolean),
+    ];
+    return [
+      ...new Set(
+        versions.map((providerActionVersion) =>
+          buildDurableToolCallCacheKey({
+            ...identity,
+            providerActionVersion,
+          }),
+        ),
+      ),
+    ];
+  }
+
   private async legacyDurableToolCallCacheKeyForScope(input: {
     toolId: string;
     requestInput: Record<string, unknown>;
@@ -4315,6 +4629,18 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     });
   }
 
+  private async compatibleDurableToolCallCacheKeys(input: {
+    toolId: string;
+    requestInput: Record<string, unknown>;
+    executionAuthScopeDigest?: string | null;
+    staleAfterSeconds?: number | null;
+  }): Promise<string[]> {
+    return await this.compatibleDurableToolCallCacheKeysForScope({
+      ...input,
+      playLocalScope: this.currentGovernance.currentPlayId,
+    });
+  }
+
   private async legacyDurableToolCallCacheKey(input: {
     toolId: string;
     requestInput: Record<string, unknown>;
@@ -6421,6 +6747,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         this.#options.playName &&
         this.#options.runId,
       );
+    // The invocation id is deterministic for a replay: mapInvocationIndex is
+    // rebuilt in authored call order. Look up a previously suspended plan now,
+    // before a stateful source query can decide that a sibling action is no
+    // longer eligible because an earlier action already completed.
+    const replayMapInvocationId = `${normalizedMapNamespace}:${this.mapInvocationIndex}`;
+    const suspendedInputRows = shouldStreamRuntimeBackedDataset
+      ? null
+      : (this.checkpoint.mapFrames?.[replayMapInvocationId]
+          ?.suspendedInputRows ?? null);
     if (shouldStreamRuntimeBackedDataset) {
       // Net-new admission happens one source page at a time. Its progress and
       // returned dataset describe admitted rows, not every provider/CSV row
@@ -7070,11 +7405,24 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         },
       });
     }
-    const rawMaterializedItems = await materializePlayDatasetInput(items, {
-      onRow: (row) => {
-        materializationMemoryTracker.track(row);
-      },
-    });
+    const rawMaterializedEntries = suspendedInputRows?.length
+      ? suspendedInputRows.map((row) => ({
+          item: cloneCsvAliasedRow(row.data) as T,
+          inputIndex: row.inputIndex,
+        }))
+      : (
+          await materializePlayDatasetInput(items, {
+            onRow: (row) => {
+              materializationMemoryTracker.track(row);
+            },
+          })
+        ).map((item, inputIndex) => ({ item, inputIndex }));
+    const rawMaterializedItems = rawMaterializedEntries.map(
+      (entry) => entry.item,
+    );
+    const originalInputIndexByItem = new Map<T, number>(
+      rawMaterializedEntries.map(({ item, inputIndex }) => [item, inputIndex]),
+    );
     // Silent dedupe of duplicate explicit map keys: keep the first row per
     // canonical key and drop subsequent duplicates. Deduping the materialized
     // input here keeps every downstream derivation (rawItems, itemsToProcess,
@@ -7087,7 +7435,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           resolver: (item, index) =>
             explicitKeyResolver(
               this.toOutputRow(item as Record<string, unknown>),
-              index,
+              originalInputIndexByItem.get(item) ?? index,
             ),
         })
       : { rows: rawMaterializedItems, droppedCount: 0, duplicateKeys: [] };
@@ -7104,7 +7452,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     itemsToProcess = materializedItems.map((item) =>
       this.toOutputRow(item as Record<string, unknown>),
     );
-    itemOriginalIndexes = materializedItems.map((_item, index) => index);
+    itemOriginalIndexes = materializedItems.map(
+      (item, index) => originalInputIndexByItem.get(item) ?? index,
+    );
     const mapStartSeedRowsByKey = new Map<string, Record<string, unknown>>();
     if (this.#options.onMapStart) {
       // ALWAYS stamp the canonical seed row key — including no-explicit-key
@@ -7492,6 +7842,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         pendingRowsCount: 0,
         failedRowsCount: durableFailedRows,
         activeBoundaryId: null,
+        suspendedInputRows: undefined,
         updatedAt: Date.now(),
       });
     }
@@ -8340,6 +8691,67 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           });
           return WAITING_ROW;
         }
+        if (isPlayExecutionSuspendedError(error)) {
+          const completedKeys = new Set(
+            completedRowsToPersist.map((row) => row.key),
+          );
+          const suspendedInputRows = items.flatMap((item, index) => {
+            const rowKey = executionRowKey(
+              this.toOutputRow(item as Record<string, unknown>),
+              index,
+            );
+            if (completedKeys.has(rowKey)) return [];
+            return [
+              {
+                inputIndex: executionRowIndex(index),
+                data: this.toPersistedOutputRow(
+                  this.toOutputRow(item as Record<string, unknown>),
+                ),
+              },
+            ];
+          });
+          const existingFrame =
+            this.checkpoint.mapFrames?.[mapScope.mapInvocationId];
+          this.setMapFrame({
+            ...(existingFrame ?? {
+              mapInvocationId: mapScope.mapInvocationId,
+              mapNodeId: mapScope.mapNodeId ?? null,
+              logicalNamespace: mapScope.logicalNamespace,
+              artifactTableNamespace: mapScope.artifactTableNamespace,
+              totalRows,
+              completedRowKeys: [],
+              pendingRowKeys: [],
+              startedAt: Date.now(),
+            }),
+            status: 'suspended',
+            pendingRowKeys: suspendedInputRows.map(({ data, inputIndex }) =>
+              executionRowKey(data, inputIndex),
+            ),
+            suspendedInputRows,
+            activeBoundaryId:
+              error.suspension.kind === 'sleep'
+                ? error.suspension.boundaryId
+                : null,
+            updatedAt: Date.now(),
+          });
+          this.emitExecutionEvent({
+            type: 'map.suspended',
+            mapInvocationId: mapScope.mapInvocationId,
+            mapNodeId: mapScope.mapNodeId ?? null,
+            logicalNamespace: mapScope.logicalNamespace,
+            artifactTableNamespace: mapScope.artifactTableNamespace,
+            completedRows: completedKeys.size,
+            failedRows: 0,
+            totalRows,
+            at: Date.now(),
+          });
+          // ctx.sleep() emitted its boundary checkpoint before control reached
+          // this row catch. Emit once more after recording the admitted plan so
+          // the scheduler can resume the same action set if the worker exits
+          // immediately after handing off the suspension.
+          this.#options.onBatchComplete?.(this.checkpoint);
+          throw error;
+        }
         const fieldName = rowContext.getStore()?.fieldName;
         updateMapFrameProgress({
           status: 'failed',
@@ -8373,16 +8785,51 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         try {
           settledResults[idx] = await runRow(idx);
         } catch (error) {
-          firstRowError = error;
+          firstRowError = this.pendingDurableSuspension
+            ? new PlayExecutionSuspendedError(this.pendingDurableSuspension)
+            : (firstRowError ?? error);
+          this.wakeToolDispatcher();
           throw error;
         }
       }
     });
 
-    await this.drainQueuedWork(workers);
+    // Drain queued work but exit early if a suspension error occurs.
+    // When a worker suspends (e.g., ctx.sleep), we must propagate the
+    // suspension immediately without waiting for other concurrent rows to
+    // settle. This prevents restart loops and false completions.
+    await this.drainQueuedWork(workers, () => {
+      if (firstRowError != null) {
+        if (
+          isPlayExecutionSuspendedError(firstRowError) ||
+          isPlayRowExecutionSuspendedError(firstRowError)
+        )
+          return firstRowError;
+      }
+      return null;
+    });
     this.lastDatasetStep = datasetStep;
     this.activeDatasetStep = null;
 
+    // If drainQueuedWork exited early due to suspension, throw it immediately
+    // WITHOUT waiting for Promise.allSettled(workers). The worker promises
+    // may never settle (e.g., sibling rows blocked on long-running operations),
+    // and we must not block suspension propagation on them.
+    if (firstRowError != null) {
+      if (
+        isPlayExecutionSuspendedError(firstRowError) ||
+        isPlayRowExecutionSuspendedError(firstRowError)
+      ) {
+        // Use the existing failure barrier to commit accepted terminal rows
+        // before the caller hands this invocation back to the scheduler.
+        throw new FailFastMapRowsError({
+          cause: firstRowError,
+          completedRows: completedRowsToPersist,
+          failedRows: failedRowsToPersist,
+        });
+      }
+    }
+
     const settled = await Promise.allSettled(workers);
     const rejected = settled.find(
       (result): result is PromiseRejectedResult => result.status === 'rejected',
@@ -8664,8 +9111,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         // author hand-writing error handling.
         if (
           !continueOnProviderUnavailable ||
-          (!isProviderExhaustedFailure(error) &&
-            !isProviderUnavailable(error))
+          (!isProviderExhaustedFailure(error) && !isProviderUnavailable(error))
         ) {
           throw error;
         }
@@ -9238,7 +9684,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     });
   }
 
-  private async drainQueuedWork<T>(promises: Promise<T>[]): Promise<void> {
+  private async drainQueuedWork<T>(
+    promises: Promise<T>[],
+    earlyExitCheck?: () => unknown,
+  ): Promise<void> {
     // One dispatcher owns ready work, fixed lane coalescing deadlines, and the
     // bounded in-flight registry. A row resumes after its own receipt persists;
     // it never waits for unrelated sibling calls from the previous column.
@@ -9270,6 +9719,20 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     try {
       let pass = 0;
       while (true) {
+        // Check for early exit FIRST, before any dispatch or wait logic.
+        // When a row suspends, we must exit immediately without waiting for
+        // sibling rows or tool dispatcher wake events.
+        const suspension = earlyExitCheck?.();
+        if (suspension != null) {
+          // Queued calls have not started; reject them at the suspension fence.
+          // Already-dispatched calls must settle while this attempt still owns
+          // their receipts. Runner teardown releases leases, so detaching live
+          // provider requests here could duplicate them on the next resume.
+          this.rejectQueuedToolCalls(suspension);
+          await Promise.allSettled([...inFlightToolExecutions]);
+          break;
+        }
+
         if (this.toolDispatcherFailure != null) {
           this.rejectQueuedToolCalls(this.toolDispatcherFailure);
           await Promise.allSettled([...inFlightToolExecutions]);
@@ -9484,12 +9947,17 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       !eventWaitHandler &&
       !isQueryResultDatasetReadRequest(toolId, input) &&
       !isAlwaysFreshIntegrationTool(toolId);
-    let durableCacheKey = await this.durableToolCallCacheKey({
-      toolId,
-      requestInput: input,
-      executionAuthScopeDigest,
-      staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
-    });
+    let compatibleDurableCacheKeys =
+      await this.compatibleDurableToolCallCacheKeys({
+        toolId,
+        requestInput: input,
+        executionAuthScopeDigest,
+        staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
+      });
+    let durableCacheKey = compatibleDurableCacheKeys[0];
+    if (!durableCacheKey) {
+      throw new Error(`Tool ${toolId} is missing a primary durable cache key.`);
+    }
     let legacyDurableCacheKey = await this.legacyDurableToolCallCacheKey({
       toolId,
       requestInput: input,
@@ -9516,7 +9984,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     // incompatible state deliberately forgoes caching until it is repaired.
     let bypassDirectResultCache = false;
     const checkpointCacheKeys = [
-      durableCacheKey,
+      ...compatibleDurableCacheKeys,
       ...(legacyDurableCacheKey ? [legacyDurableCacheKey] : []),
     ];
 
@@ -9534,6 +10002,28 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       if (toolId === 'run_javascript') {
         throw new Error(DISALLOWED_RUN_JAVASCRIPT_TOOL_MESSAGE);
       }
+      // A user-requested rerun first asks its exact source run whether this
+      // logical call already completed. This is stronger than the shared cache:
+      // it is an explicit, authenticated pointer to one known source receipt.
+      if (cacheableToolResult && !toolCachePolicy.force) {
+        const sourceRunRecovered = await this.recoverSourceRunToolReceipt({
+          toolId,
+          logicalCallId,
+          executionAuthScopeDigest,
+          cacheKey: durableCacheKey,
+        });
+        if (sourceRunRecovered) {
+          this.runtimeLog(
+            `Calling tool: ${toolId} recovered from source run ${this.#options.replayedFromRunId}`,
+          );
+          this.emitToolCallLifecycle('started', toolId, normalizedKey);
+          this.emitToolCallLifecycle('settled', toolId, normalizedKey, {
+            outcome: 'cached',
+            durationMs: 0,
+          });
+          return this.materializeToolExecutionResult(sourceRunRecovered);
+        }
+      }
       // Tool-call budget is charged by the Governor's acquireToolSlot in
       // callToolExecutionAPI, so each real outbound call is counted exactly once
       // (cached/checkpoint recoveries never acquire a slot and so never charge).
@@ -9602,6 +10092,45 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         // reader seam rather than teaching the deep Module an untyped result.
         // New direct calls use the real Tool Result Receipt Adapter below.
         if (cacheableToolResult && !toolCachePolicy.force) {
+          // A source action can explicitly carry forward a previous result
+          // contract after a local version bump. Read those exact older keys
+          // before the canonical key; do not derive fallbacks from a deploy.
+          for (const compatibleCacheKey of compatibleDurableCacheKeys.slice(
+            1,
+          )) {
+            const compatibleReceipt =
+              await this.withRuntimeReceiptHydrationTurn(
+                async () =>
+                  await this.getRuntimeStepReceipt(compatibleCacheKey),
+              );
+            if (
+              compatibleReceipt &&
+              (compatibleReceipt.status === 'completed' ||
+                compatibleReceipt.status === 'skipped') &&
+              compatibleReceipt.output !== undefined
+            ) {
+              const recoveredCompatible = markToolExecuteResultExecutionOutcome(
+                this.runtimeReceiptOutput(compatibleReceipt),
+                toolExecutionOutcomeForDurableReceipt({
+                  source: 'cache',
+                  receiptKey: compatibleCacheKey,
+                  cacheKey: directCacheKey,
+                }),
+              );
+              if (
+                this.canReuseToolResultForCurrentResponseContract(
+                  recoveredCompatible,
+                )
+              ) {
+                this.runtimeLog(
+                  `Calling tool: ${toolId} recovered from an explicit action compatibility receipt`,
+                );
+                return isToolExecuteResult(recoveredCompatible)
+                  ? this.materializeToolExecutionResult(recoveredCompatible)
+                  : recoveredCompatible;
+              }
+            }
+          }
           const historicalReceipt = await this.withRuntimeReceiptHydrationTurn(
             async () => await this.getRuntimeStepReceipt(directCacheKey),
           );
@@ -9860,6 +10389,14 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     : {}),
                   withCompletedReceiptHydration: (hydrate) =>
                     this.withRuntimeReceiptHydrationTurn(hydrate),
+                  onStored: async ({ resultReceiptKey }) => {
+                    await this.persistSourceRunToolReceiptManifest({
+                      toolId,
+                      logicalCallId,
+                      executionAuthScopeDigest,
+                      resultReceiptKey,
+                    });
+                  },
                   ...(toolRetryPolicy?.requiresExecutionFence === true
                     ? {
                         executionLock: {
@@ -10037,9 +10574,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           providerIdempotencyKeyBase,
           cacheable: cacheableToolResult,
           receiptKey: cacheableToolResult ? durableCacheKey : null,
-          legacyReceiptKeys: legacyDurableCacheKey
-            ? [legacyDurableCacheKey]
-            : [],
+          legacyReceiptKeys: [
+            ...compatibleDurableCacheKeys.slice(1),
+            ...(legacyDurableCacheKey ? [legacyDurableCacheKey] : []),
+          ],
           executionAuthScopeDigest,
           requiresExecutionFence:
             rowToolRetryPolicy?.requiresExecutionFence === true,
@@ -10107,12 +10645,19 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         this.invalidateToolAuthScopeDigest(toolId);
         executionAuthScopeDigest =
           (await this.resolveToolAuthScopeDigest(toolId))?.trim() ?? null;
-        durableCacheKey = await this.durableToolCallCacheKey({
-          toolId,
-          requestInput: input,
-          executionAuthScopeDigest,
-          staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
-        });
+        compatibleDurableCacheKeys =
+          await this.compatibleDurableToolCallCacheKeys({
+            toolId,
+            requestInput: input,
+            executionAuthScopeDigest,
+            staleAfterSeconds: toolCachePolicy.staleAfterSeconds,
+          });
+        durableCacheKey = compatibleDurableCacheKeys[0];
+        if (!durableCacheKey) {
+          throw new Error(
+            `Tool ${toolId} is missing a primary durable cache key after auth refresh.`,
+          );
+        }
         legacyDurableCacheKey = await this.legacyDurableToolCallCacheKey({
           toolId,
           requestInput: input,
@@ -10132,7 +10677,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         checkpointCacheKeys.splice(
           0,
           checkpointCacheKeys.length,
-          durableCacheKey,
+          ...compatibleDurableCacheKeys,
           ...(legacyDurableCacheKey ? [legacyDurableCacheKey] : []),
         );
       }
@@ -10160,6 +10705,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       executorToken: this.#options.executorToken,
       slackHitlDefaultTimeoutMs:
         this.currentRuntimeSemantics.slackHitl.defaultTimeoutMs,
+      slackHitlTimeoutOutcome:
+        this.currentRuntimeContract.slackHitlTimeoutOutcome,
     };
     const basePreparedBoundary = await handler.prepare({
       payload: input,
@@ -10187,19 +10734,47 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     if (existing?.kind === 'integration_event' && 'output' in existing) {
       const output = recordOrNull(existing.output);
       if (output?.timed_out === true) {
-        await handler.onTimeout?.({
-          payload: input,
-          context: eventContext,
-          boundary: {
-            boundaryId: preparedBoundary.boundaryId,
-            eventKey: preparedBoundary.eventKey,
-            timeoutMs: preparedBoundary.timeoutMs,
-            provider: existing.provider ?? handler.provider,
-            toolId: existing.toolId ?? handler.toolId,
-            ...(existing.messageRef ? { messageRef: existing.messageRef } : {}),
-          },
-        });
-        if (handler.suspendAfterTimeoutMs !== undefined) {
+        // The runtime proxy is recreated for each worker invocation. Preserve
+        // the policy that armed this boundary so its timeout finalizer and
+        // parking behavior survive a durable replay.
+        const timeoutPolicy =
+          existing.timeoutPolicy ?? preparedBoundary.timeoutPolicy;
+        // An explicit boundary policy may deliberately omit parking (the
+        // new on_timeout: "return_null" escape hatch). Only fall back to the
+        // handler's historical default when this is an old boundary with no
+        // persisted policy at all.
+        const suspendAfterTimeoutMs = timeoutPolicy
+          ? timeoutPolicy.suspendAfterTimeoutMs
+          : handler.suspendAfterTimeoutMs;
+        try {
+          await handler.onTimeout?.({
+            payload: input,
+            context: eventContext,
+            boundary: {
+              boundaryId: preparedBoundary.boundaryId,
+              eventKey: preparedBoundary.eventKey,
+              timeoutMs: preparedBoundary.timeoutMs,
+              provider: existing.provider ?? handler.provider,
+              toolId: existing.toolId ?? handler.toolId,
+              ...(existing.messageRef
+                ? { messageRef: existing.messageRef }
+                : {}),
+              ...(timeoutPolicy ? { timeoutPolicy } : {}),
+            },
+          });
+        } catch (error) {
+          this.recordSlackHitlTimeoutFailure(error);
+          throw error;
+        }
+        if (timeoutPolicy?.timeoutOutcome === 'error') {
+          // The provider finalizer above must complete first. That ordering
+          // makes an expired Slack card and the terminal Play state agree,
+          // while provider finalization failures stay retryable instead.
+          const error = new SlackHitlTimeoutError(timeoutPolicy.timeoutError);
+          this.recordSlackHitlTimeoutFailure(error);
+          throw error;
+        }
+        if (suspendAfterTimeoutMs !== undefined) {
           this.runtimeLog(
             `Integration event ${preparedBoundary.boundaryId}: timeout finalized externally; keeping Play parked`,
           );
@@ -10207,7 +10782,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             kind: 'integration_event',
             boundaryId: preparedBoundary.boundaryId,
             eventKey: preparedBoundary.eventKey,
-            timeoutMs: handler.suspendAfterTimeoutMs,
+            timeoutMs: suspendAfterTimeoutMs,
             ...(existing.messageRef ? { messageRef: existing.messageRef } : {}),
           });
         }
@@ -10246,6 +10821,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         timeoutMs: boundary.timeoutMs,
         provider: boundary.provider,
         toolId: boundary.toolId,
+        ...(boundary.timeoutPolicy
+          ? { timeoutPolicy: boundary.timeoutPolicy }
+          : {}),
         ...(rowScope
           ? {
               scope: {
@@ -10410,6 +10988,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             runtimeContract: resolvePlayArtifactRuntimeContract({
               authoringContractEdition:
                 childCompatibility.authoringContractEdition,
+              slackHitlTimeoutOutcome:
+                childCompatibility.slackHitlTimeoutOutcome,
               toolResponseContract: childToolResponseContract,
               toolResponseReceiptRevision: childToolResponseReceiptRevision,
             }),
@@ -11602,6 +12182,23 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             output: serializeToolExecuteResult(receipt.result),
           })),
         );
+        await this.persistSourceRunToolReceiptManifests(
+          receipts.flatMap((receipt) => {
+            const request = input.requestForReceipt.get(
+              receipt.resultReceiptKey,
+            );
+            return request
+              ? [
+                  {
+                    toolId: input.toolId,
+                    logicalCallId: request.logicalCallId,
+                    executionAuthScopeDigest: request.executionAuthScopeDigest,
+                    resultReceiptKey: receipt.resultReceiptKey,
+                  },
+                ]
+              : [];
+          }),
+        );
         return await recordsFor(
           receipts.map((receipt) => receipt.resultReceiptKey),
           completed,
@@ -11884,7 +12481,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     if (requests.length === 0) return [];
 
     const requestForReceipt = new Map<string, ToolCallRequest>();
-    const requestByCallId = new Map<string, ToolCallRequest>();
     for (const request of requests) {
       const receiptKey = request.receiptKey?.trim();
       if (!receiptKey) {
@@ -11893,13 +12489,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         );
       }
       requestForReceipt.set(receiptKey, request);
-      requestByCallId.set(request.callId, request);
     }
     const store = this.createRuntimeStepToolCallReceiptCohortStore({
       toolId,
       requestForReceipt,
     });
-    const compiledBatches = compileRequestsWithStrategy({
+    const plannedBatches = compileRequestsWithStrategy({
       requests,
       strategy,
       getPayload: (request: ToolCallRequest) => request.input,
@@ -11922,9 +12517,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     const batchParallelismCeiling =
       this.governor.policy.pacing.workerToolBatchDefaultParallelism;
     const batchSize =
-      compiledBatches.length > 0
+      plannedBatches.length > 0
         ? await this.resourceGovernor.suggestedToolParallelism(
-            compiledBatches[0]!.batchOperation,
+            plannedBatches[0]!.batchOperation,
             batchParallelismCeiling,
           )
         : batchParallelismCeiling;
@@ -11963,34 +12558,36 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     };
 
     await executeChunkedRequests({
-      requests: compiledBatches,
+      requests: plannedBatches,
       batchSize,
-      execute: async (batch) => {
+      execute: async (plannedBatch) => {
         if (this.persistenceLatch.tripped) {
           this.persistenceLatch.preventedCallCount +=
-            batch.memberRequests.length;
+            plannedBatch.memberRequests.length;
           throw new RuntimePersistenceCircuitOpenError(this.persistenceLatch);
         }
-        const batchProviderActionVersion =
-          (
-            await this.#options.getToolActionCacheVersion?.(
-              batch.batchOperation,
-            )
-          )?.trim() ?? '';
-        const batchRequestByCallId = new Map(
-          batch.memberRequests.map((request) => [request.callId, request]),
+        const requestByCallId = new Map(
+          plannedBatch.memberRequests.map((request) => [
+            request.callId,
+            request,
+          ]),
         );
-        const dispatchDetails = new Map<
+        type NativeBatchPhysicalDispatchDetails = {
+          members: ToolCallRequest[];
+          compiled: CompiledRequestBatch<ToolCallRequest>;
+          providerOperationKey: string;
+          forceRefreshIdentities: string[];
+          receiptLeaseExpiresAt: string | null;
+          timeoutMs: number | undefined;
+        };
+        const nativeBatchPhysicalDispatchByAggregateReceipt = new Map<
           string,
-          {
-            members: ToolCallRequest[];
-            compiled: CompiledRequestBatch<ToolCallRequest>;
-            providerOperationKey: string;
-            forceRefreshIdentities: string[];
-            receiptLeaseExpiresAt: string | null;
-            timeoutMs: number | undefined;
-          }
+          NativeBatchPhysicalDispatchDetails
         >();
+        const aggregateReceiptKeyByOwnedMemberIds = new Map<string, string>();
+        const ownedMemberIdsKey = (
+          members: ReadonlyArray<{ memberId: string }>,
+        ): string => JSON.stringify(members.map((member) => member.memberId));
         const physicalToolCall = {
           call: async (
             physical: Parameters<
@@ -12003,7 +12600,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 'Native batch physical Tool Call requires compatibility identities.',
               );
             }
-            const detail = dispatchDetails.get(compatibility.resultReceiptKey);
+            const detail = nativeBatchPhysicalDispatchByAggregateReceipt.get(
+              compatibility.resultReceiptKey,
+            );
             if (!detail) {
               throw new Error(
                 'Native batch physical Tool Call lost its dispatch details.',
@@ -12079,7 +12678,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             runId: this.currentReceiptOwnerRunId,
             attempt: this.currentRunAttempt,
           },
-          members: batch.memberRequests.map((request) => ({
+          members: plannedBatch.memberRequests.map((request) => ({
             memberId: request.callId,
             forceFailedRefresh: request.forceFailedRefresh === true,
             waitMaxAttempts: resolveRuntimeToolReceiptWaitMaxAttempts(
@@ -12117,74 +12716,91 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               },
             },
           })),
-          buildPhysicalCall: ({ members }) => {
-            const owned = members.map(
-              (member) => batchRequestByCallId.get(member.memberId)!,
+          buildPhysicalCall: async ({ members: ownedMembers }) => {
+            // `ownedMembers` are the rows we still need to execute.
+            const ownedMemberRequests = ownedMembers.map(
+              (member) => requestByCallId.get(member.memberId)!,
+            );
+            const compiled = compileOwnedPhysicalBatch(ownedMemberRequests);
+            const receiptKeys = ownedMemberRequests.map(
+              (request) => request.receiptKey!,
             );
-            const receiptKeys = owned.map((request) => request.receiptKey!);
             const aggregateReceiptKey = buildDurableToolAggregateReceiptKey({
               receiptKeys,
               prefix: 'batch',
               aggregateReceiptPrefix: buildDurableToolReceiptPrefix({
                 orgId: this.#options.orgId,
-                toolId: batch.batchOperation,
+                toolId: compiled.batchOperation,
               }),
             });
-            const compiled = compileOwnedPhysicalBatch(owned);
-            if (compiled.batchOperation !== batch.batchOperation) {
-              throw new Error(
-                'Native batch owned members changed provider operation during compilation.',
-              );
-            }
-            const forceRefreshIdentities = owned.flatMap((request) =>
-              this.providerForceRefreshIdentitiesForToolCall({
-                operationKey:
-                  this.providerOperationKeyForQueuedToolCall(request),
-                force: request.force,
-                requiresExecutionFence: request.requiresExecutionFence,
-                logicalCallId: request.logicalCallId,
-              }),
+            const providerActionVersion =
+              (
+                await this.#options.getToolActionCacheVersion?.(
+                  compiled.batchOperation,
+                )
+              )?.trim() ?? '';
+            const forceRefreshIdentities = ownedMemberRequests.flatMap(
+              (request) =>
+                this.providerForceRefreshIdentitiesForToolCall({
+                  operationKey:
+                    this.providerOperationKeyForQueuedToolCall(request),
+                  force: request.force,
+                  requiresExecutionFence: request.requiresExecutionFence,
+                  logicalCallId: request.logicalCallId,
+                }),
             );
             const providerOperationKey =
               buildDurableToolPayloadProviderIdempotencyKey({
                 orgId: this.#options.orgId,
-                toolId: batch.batchOperation,
+                toolId: compiled.batchOperation,
                 executionAuthScopeDigest:
-                  owned[0]?.executionAuthScopeDigest ?? null,
-                providerActionVersion: batchProviderActionVersion,
+                  ownedMemberRequests[0]?.executionAuthScopeDigest ?? null,
+                providerActionVersion,
                 payload: compiled.batchPayload,
                 forceRefreshIdentities,
               });
-            dispatchDetails.set(aggregateReceiptKey, {
-              members: owned,
-              compiled,
-              providerOperationKey,
-              forceRefreshIdentities,
-              receiptLeaseExpiresAt: owned.reduce<string | null>(
-                (earliest, request) => {
+            const aggregateDispatchDetails: NativeBatchPhysicalDispatchDetails =
+              {
+                members: ownedMemberRequests,
+                compiled,
+                providerOperationKey,
+                forceRefreshIdentities,
+                receiptLeaseExpiresAt: ownedMemberRequests.reduce<
+                  string | null
+                >((earliest, request) => {
                   const expiresAt = request.receiptLeaseExpiresAt ?? null;
                   if (!expiresAt) return earliest;
                   if (!earliest) return expiresAt;
                   return Date.parse(expiresAt) < Date.parse(earliest)
                     ? expiresAt
                     : earliest;
-                },
-                null,
-              ),
-              timeoutMs: owned.every(
-                (request) =>
-                  typeof request.timeoutMs === 'number' &&
-                  Number.isFinite(request.timeoutMs) &&
-                  request.timeoutMs > 0,
-              )
-                ? Math.max(...owned.map((request) => request.timeoutMs!))
-                : undefined,
-            });
+                }, null),
+                timeoutMs: ownedMemberRequests.every(
+                  (request) =>
+                    typeof request.timeoutMs === 'number' &&
+                    Number.isFinite(request.timeoutMs) &&
+                    request.timeoutMs > 0,
+                )
+                  ? Math.max(
+                      ...ownedMemberRequests.map(
+                        (request) => request.timeoutMs!,
+                      ),
+                    )
+                  : undefined,
+              };
+            nativeBatchPhysicalDispatchByAggregateReceipt.set(
+              aggregateReceiptKey,
+              aggregateDispatchDetails,
+            );
+            aggregateReceiptKeyByOwnedMemberIds.set(
+              ownedMemberIdsKey(ownedMembers),
+              aggregateReceiptKey,
+            );
             return {
-              ...members[0]!.call,
+              ...ownedMembers[0]!.call,
               tool: {
-                id: batch.batchOperation,
-                providerActionVersion: batchProviderActionVersion,
+                id: compiled.batchOperation,
+                providerActionVersion,
               },
               payload: compiled.batchPayload,
               compatibility: {
@@ -12193,34 +12809,29 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               },
             };
           },
-          splitResult: async ({ result: aggregate, members }) => {
-            const receiptKeys = members.map((member) => {
-              const request = batchRequestByCallId.get(member.memberId);
-              if (!request?.receiptKey) {
-                throw new Error(
-                  `Native batch Tool Call lost receipt for ${member.memberId}.`,
-                );
-              }
-              return request.receiptKey;
-            });
-            const aggregateReceiptKey = buildDurableToolAggregateReceiptKey({
-              receiptKeys,
-              prefix: 'batch',
-              aggregateReceiptPrefix: buildDurableToolReceiptPrefix({
-                orgId: this.#options.orgId,
-                toolId: batch.batchOperation,
-              }),
-            });
-            const detail = dispatchDetails.get(aggregateReceiptKey);
+          splitResult: async ({ result: aggregate, members: ownedMembers }) => {
+            const aggregateReceiptKey = aggregateReceiptKeyByOwnedMemberIds.get(
+              ownedMemberIdsKey(ownedMembers),
+            );
+            if (!aggregateReceiptKey) {
+              throw new Error(
+                'Native batch Tool Call lost its physical aggregate receipt identity.',
+              );
+            }
+            const detail =
+              nativeBatchPhysicalDispatchByAggregateReceipt.get(
+                aggregateReceiptKey,
+              );
             if (!detail) {
               throw new Error(
                 'Native batch Tool Call lost its split compilation details.',
               );
             }
             if (
-              detail.members.length !== members.length ||
+              detail.members.length !== ownedMembers.length ||
               !detail.members.every(
-                (request, index) => request.callId === members[index]?.memberId,
+                (request, index) =>
+                  request.callId === ownedMembers[index]?.memberId,
               )
             ) {
               throw new Error(
@@ -12231,8 +12842,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               legacyResultForBatchSplitter(aggregate),
             );
             return await Promise.all(
-              members.map(async (member, index) => {
-                const request = batchRequestByCallId.get(member.memberId);
+              ownedMembers.map(async (member, index) => {
+                const request = requestByCallId.get(member.memberId);
                 if (!request) {
                   throw new Error(
                     `Native batch Tool Call lost member ${member.memberId}.`,
@@ -12262,7 +12873,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             );
           },
         });
-        return { batch, result };
+        return { batch: plannedBatch, result };
       },
       onChunkComplete: async (entries) => {
         for (const entry of entries) {
@@ -13776,9 +14387,20 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     const asyncContract = options?.skipAsyncOperationResolution
       ? null
       : ((await this.#options.getToolAsyncOperation?.(toolId)) ?? null);
+    const asyncOperationPoll = options?.skipAsyncOperationResolution
+      ? null
+      : ((await this.#options.getToolAsyncOperationPoll?.(toolId)) ?? null);
     const shouldWaitForAsyncOperation = Boolean(
       asyncContract && asyncOperationShouldWait(asyncContract, input),
     );
+    // An explicitly opted-in caller-managed launch gives the Play author the
+    // provider handle and leaves polling to the authored graph. Do not let a
+    // provider's legacy synchronous helper turn a wide start wave into
+    // long-lived HTTP calls before that graph can make its own poll.
+    const shouldPreferAsyncProviderExecution =
+      asyncContract?.wait.kind === 'caller_managed' &&
+      asyncContract.lifecycle.startAction === toolId &&
+      asyncContract.launch?.preferAsync === true;
     const executionAuthScopeDigest = options?.executionAuthScopeDigest
       ? options.executionAuthScopeDigest.trim() || null
       : ((await this.resolveToolAuthScopeDigest(toolId))?.trim() ?? null);
@@ -14012,6 +14634,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 ...(shouldWaitForAsyncOperation
                   ? { async_operation_wait: true }
                   : {}),
+                ...(shouldPreferAsyncProviderExecution
+                  ? { prefer_async: true }
+                  : {}),
+                ...(asyncOperationPoll
+                  ? {
+                      async_operation_poll_timeout_ms:
+                        asyncOperationPoll.checkTimeoutMs,
+                    }
+                  : {}),
                 ...(usesDurableInvocationFence
                   ? {
                       invocation_fence_version:
@@ -14599,11 +15230,19 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               }
               if (
                 failure.shouldRetry &&
-                (ambiguousTransportReplayAllowed ||
+                (failure.knownNotDispatched ||
+                  failure.reason === 'gateway_invocation_in_progress' ||
+                  ambiguousTransportReplayAllowed ||
                   retrySafeTransientHttp ||
                   fixtureReplaySafe)
               ) {
-                invocationAttempt += 1;
+                // A gateway follower is retrying transport delivery to the
+                // same durable invocation. Advancing the logical attempt here
+                // would mint a new invocation key while the original owner is
+                // still running, defeating the gateway's replay fence.
+                if (failure.reason !== 'gateway_invocation_in_progress') {
+                  invocationAttempt += 1;
+                }
                 if (failure.chargeRetryBudget) {
                   await this.governor.chargeBudget('retry');
                 }