Interface RunnerRuntimeOptions

The deployment execution fence (execution-fence.ts), consulted on EVERY start and resume. THIS is the closure guarantee for runs: every mint in this package funnels through start() and every re-entry through resume(), so a check here cannot be routed around by a surface that forgot to gate itself — the route-level checks are the same refusal made earlier and cheaper, never the boundary.

Absent ⇒ unfenced, byte-identical to before this seam existed. init() builds one automatically from a { DB } source and REQUIRES an explicit executionFence (a store, or 'none') from a { storage } one, so absence here is always something a host wrote down.

The host Durable Object's single pubsub identity from do-runner/pubsub.ts, threaded here by init() alongside storage so a host that configures it reaches the runtime with no host change: every DO subclass already returns init()'s runtime from build(), and nothing else in the isolate can hand this object a pubsub.

PASSED TO CORE at the two workflow.createRun({ runId, pubsub }) sites in start()/resume() — the only place core accepts one; the pubsub getter still exposes the held identity so an agent runner sharing this isolate takes THIS instance rather than building a second feed. Absent ⇒ undefined ⇒ core defaults a fresh emitter per run ⇒ byte-identical to before this seam existed.

Consulted on every start/resume — see RequestContextProvider.

The deployment's start reservations (start-idempotency.ts). The runtime neither creates nor claims one — the surfaces above it do — but it is the one layer that sees EVERY way a run reaches a terminal state, so it owns the terminal reconcile that marks a key spent.

Homed here rather than at the routes for exactly that reason: a run can end by completing, by failing, by being cancelled and by timing out, on the workflow surface and the agent surface alike, and a reconcile attached to any one route would miss the rest. A reservation that never settles is not a correctness bug (replay still answers from the snapshot) but it never leaves the drain inventory and never becomes purgeable, so a deployment would eventually be unable to prove itself empty.

Absent ⇒ no reconcile. init() builds one from a { DB } source, and DurableObjectRunner.build refuses a runtime that has none while a DB is bound, so absence means a host with no database to reserve against.