@sublang/playbook 13.3.0 → 14.1.0

package/src/xstate-playbook-runtime.js

@@ -21,7 +21,8 @@ import { isDeepStrictEqual } from 'node:util';
 import PQueue from 'p-queue';
 import { createActor, fromPromise } from 'xstate';
 import { createAcceptedOutcomeConsumer, } from './accepted-outcome.js';
-import { assertPlaybookRuntimeSnapshot, assertPlaybookEffectLedger, combineAbortSignals, createNestedPlaybookBridge, detachPersistedMachineSnapshot, normalizeError, normalizePlaybookSnapshot, snapshotJsonValue, snapshotPlaybookSession, isPlaybookEffectLedgerMonotonicExtension, PlaybookSemanticCandidateStructureError, reconcilePlaybookSemanticEvidence, validateCaptainResult, validatePlayerResult, waitForPlaybookQuiescence, } from './xstate-runtime.js';
+import { assertPlaybookFailureCause } from './runtime.js';
+import { assertPlaybookRuntimeSnapshot, assertPlaybookEffectLedger, attachPlaybookFailureCause, combineAbortSignals, createNestedPlaybookBridge, detachPersistedMachineSnapshot, normalizeError, normalizePlaybookSnapshot, snapshotJsonValue, snapshotPlaybookSession, isPlaybookEffectLedgerMonotonicExtension, PlaybookSemanticCandidateStructureError, reconcilePlaybookSemanticEvidence, validateCaptainResult, validatePlayerResult, waitForPlaybookQuiescence, } from './xstate-runtime.js';
 export const BOSS_REPLY_ERRORS = {
     missingQuestion: "needsBossReply outcome missing 'question' field",
     unregisteredState: (stateId) => `state ${stateId} declared needsBossReply but is not registered as resumable`,
@@ -38,6 +39,17 @@ export const BOSS_REPLY_ERRORS = {
 const fsmResultFailures = new WeakSet();
 function markFsmResultFailure(error) {
     fsmResultFailures.add(error);
+    // DR-063 §2: there is no failure without a cause. A failure the runtime
+    // marks with nothing more specific is a runtime defect carrying its own
+    // message; a decision site that knows better attaches its cause afterwards.
+    attachPlaybookFailureCause(error, {
+        code: 'runtime-defect',
+        evidence: {
+            reason: typeof error.message === 'string' && error.message.length > 0
+                ? error.message
+                : 'unknown runtime defect',
+        },
+    });
     return error;
 }
 function isFsmResultFailure(error) {
@@ -46,6 +58,63 @@ function isFsmResultFailure(error) {
         fsmResultFailures.has(error));
 }
 // ---------------------------------------------------------------------------
+// DR-063 §1/§2: there is no failure without a cause. Each decision site builds
+// the cause its own evidence states, the runtime attaches it to the error it
+// marks as the FSM failure, and anything else the runtime marks becomes
+// `runtime-defect` carrying its message as `reason`.
+// ---------------------------------------------------------------------------
+/** Adjudication reasons this runtime decides itself, and their codes. */
+const GOVERNED_JUDGE_FAILURE_REASONS = [
+    'judge transport failed',
+    'corrective judge failed',
+    'corrective semantic candidate is invalid',
+    'semantic correction budget is unavailable',
+];
+const ABORTED_FAILURE_CAUSE = assertPlaybookFailureCause({
+    code: 'aborted',
+    evidence: {},
+});
+function runtimeDefectCause(reason) {
+    return assertPlaybookFailureCause({
+        code: 'runtime-defect',
+        evidence: { reason: reason.length === 0 ? 'unknown runtime defect' : reason },
+    });
+}
+function failureErrorEvidence(error) {
+    if (error === undefined || error === null)
+        return undefined;
+    const { name, message } = normalizeError(error);
+    return { name, message };
+}
+/** A string `code` the rejecting port reported, when it reported one. */
+function failureErrorCode(error) {
+    if (typeof error !== 'object' || error === null)
+        return undefined;
+    try {
+        const code = error.code;
+        return typeof code === 'string' && code.length > 0 ? code : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function playerFailureCause(input) {
+    return assertPlaybookFailureCause({
+        code: 'player-failed',
+        evidence: {
+            roleId: input.roleId,
+            ...(input.playerId === undefined ? {} : { playerId: input.playerId }),
+            error: failureErrorEvidence(input.error) ?? {
+                name: 'Error',
+                message: 'Unknown error',
+            },
+            ...(failureErrorCode(input.error) === undefined
+                ? {}
+                : { errorCode: failureErrorCode(input.error) }),
+        },
+    });
+}
+// ---------------------------------------------------------------------------
 // DR-028: both call boundaries treat an `ok` result whose `finalText` is
 // missing, empty, or whitespace-only under one empty predicate, and that
 // shape earns exactly one corrective re-ask — the same composed call
@@ -320,7 +389,13 @@ export function normalizeErrorCompact(err) {
     if (err === undefined || err === null)
         return undefined;
     const normalized = normalizeError(err);
-    return { name: normalized.name, message: normalized.message };
+    return {
+        name: normalized.name,
+        message: normalized.message,
+        // DR-063 §2: on a failure the cause is why the compact form exists, so it
+        // survives where the stack does not.
+        ...(normalized.cause === undefined ? {} : { cause: normalized.cause }),
+    };
 }
 export function normalizeErrorFull(err) {
     if (err === undefined || err === null)
@@ -417,6 +492,97 @@ function continuationBlocks(input, resuming = false) {
 export function composePlayerContinuation(input, body, resuming = false) {
     return [...continuationBlocks(input, resuming), body].join('\n\n');
 }
+// DR-062 §4: the Coder is told which uncommitted changes were already in the
+// worktree when its own call started. The block is composed from the call's
+// own baseline observation, names paths only, and is bounded.
+const PRE_EXISTING_CHANGE_GROUPS = [
+    'staged',
+    'modified',
+    'deleted',
+    'untracked',
+    'renamed',
+    'unmerged',
+    'other',
+];
+const PRE_EXISTING_CHANGE_PATH_LIMIT = 40;
+/**
+ * The group one baseline projection entry belongs to. The shapes are the
+ * porcelain-v2 records the repository observer projects: an `untracked`,
+ * `rename-or-copy`, or `unmerged` kind, and otherwise an `ordinary` record
+ * whose two-character `xy` carries the index state first and the worktree
+ * state second.
+ */
+function preExistingChangeGroup(entry) {
+    if (!isPlainObject(entry))
+        return 'other';
+    if (entry.kind === 'untracked')
+        return 'untracked';
+    if (entry.kind === 'rename-or-copy')
+        return 'renamed';
+    if (entry.kind === 'unmerged')
+        return 'unmerged';
+    const xy = entry.xy;
+    if (entry.kind !== 'ordinary' || typeof xy !== 'string' || xy.length !== 2) {
+        return 'other';
+    }
+    if (xy[1] === 'D')
+        return 'deleted';
+    if (xy[1] === '.')
+        return xy[0] === '.' ? 'other' : 'staged';
+    return 'modified';
+}
+/**
+ * The pre-existing-changes block appended to an effect-authorized player
+ * prompt, or `undefined` for an empty baseline projection.
+ */
+function preExistingChangesBlock(baseline) {
+    const projection = baseline?.projection;
+    if (!isPlainObject(projection))
+        return undefined;
+    const grouped = new Map();
+    let total = 0;
+    for (const path of Object.keys(projection)) {
+        const group = preExistingChangeGroup(projection[path]);
+        const paths = grouped.get(group);
+        if (paths === undefined)
+            grouped.set(group, [path]);
+        else
+            paths.push(path);
+        total += 1;
+    }
+    if (total === 0)
+        return undefined;
+    const omitted = Math.max(0, total - PRE_EXISTING_CHANGE_PATH_LIMIT);
+    const lines = [];
+    let budget = PRE_EXISTING_CHANGE_PATH_LIMIT;
+    for (const group of PRE_EXISTING_CHANGE_GROUPS) {
+        const paths = grouped.get(group);
+        if (paths === undefined || budget <= 0)
+            continue;
+        const printed = paths.slice().sort().slice(0, budget);
+        budget -= printed.length;
+        lines.push(`> - ${group}: ${printed.join(', ')}`);
+    }
+    if (omitted > 0 && lines.length > 0) {
+        lines[lines.length - 1] += `, … and ${omitted} more`;
+    }
+    return [
+        '> Uncommitted changes present before this call, belonging to the Boss:',
+        ...lines,
+        "> Leave them exactly as they are unless the task or the Boss's request requires building on them; never revert or delete them; when you commit any of them, name them in your final report.",
+    ].join('\n');
+}
+/**
+ * The block for one governed call, or `undefined` where the call is not
+ * effect-authorized — a call whose declared outcomes carry no
+ * `one-descendant-commit` disposition may commit nothing, so it is told
+ * nothing.
+ */
+function effectAuthorizedPreExistingBlock(effectBoundary, baseline) {
+    return effectBoundary.dispositions.includes('one-descendant-commit')
+        ? preExistingChangesBlock(baseline)
+        : undefined;
+}
 const PLACEHOLDER_PATTERN = /<(#|[A-Za-z_$][A-Za-z0-9_$-]*)>/g;
 function placeholderFieldName(token, fields) {
     const explicit = fields[token];
@@ -830,7 +996,8 @@ export function createPlayerBridge(spec, ports, getActiveSignal, boundary, onCon
                 : false);
         }
         if (result.status !== 'ok') {
-            throw new Error(result.error ?? `captainBridge: callPlayer status "${result.status}"`);
+            const failure = new Error(result.error ?? `captainBridge: callPlayer status "${result.status}"`);
+            throw boundary?.markPlayerResultFailure?.(failure) ?? failure;
         }
         const finalText = result.finalText ?? '';
         if (isEmptyFinalText(finalText)) {
@@ -2019,6 +2186,15 @@ export function createXStatePlaybookRuntime(machine, spec) {
         let deferInspectionEmissions = false;
         let deferredInspectionEmissions = [];
         let controlPlaneError;
+        // DR-063 §2: the cause decided at the site the failure was decided, kept
+        // for the failures whose Error the compiled artifact builds itself and the
+        // runtime therefore cannot decorate. It is cleared at each Boss turn start
+        // and at each successful player result, so it is never stale, and it is
+        // only ever read as the cause of an error that carries none of its own.
+        let lastFailureCause;
+        const rememberFailureCause = (cause) => {
+            lastFailureCause = cause;
+        };
         // Previous root-machine state for the inspect-driven telemetry /
         // status emitter. undefined before the first inspect firing.
         let priorState;
@@ -2388,6 +2564,13 @@ export function createXStatePlaybookRuntime(machine, spec) {
             refreshRetainedEffectReconciliation(current);
             syncDeferredReconciliationOverlay();
             refreshUnresolvedSemanticReconciliation(current);
+            return projectUnresolvedEffectEnvelopes(current);
+        }
+        /**
+         * The unresolved envelopes of one already-refreshed ledger mirror. Pure:
+         * `describe()` reads it through the control view without moving anything.
+         */
+        function projectUnresolvedEffectEnvelopes(current) {
             if (!hasUnresolvedReconciliation())
                 return [];
             const boundaryIds = new Set(unresolvedSemanticBoundaryIds);
@@ -2455,6 +2638,39 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 throw new Error(`createPlaybookRuntime.${method}: deferred settlement recovery is required`, { cause: deferredSettlementClosure });
             }
         }
+        function pendingHasExactUnchangedOrigin(pending) {
+            // The outcome menu is not the selected outcome: a source-authored
+            // unchanged question may share its state with needsBossReply: deferred.
+            // An open operation nevertheless always retains its checkpoint and
+            // cumulative receipt authority, even if a later boundary looks alike.
+            if (runtimeLogicalOperations().some((operation) => operation.logicalReceipt === undefined)) {
+                return false;
+            }
+            const latest = effectLedgerMirror.boundaries
+                .filter(runtimeBoundaryIsOwned)
+                .at(-1);
+            if (latest === undefined ||
+                latest.sourceStateId !== pending.resumeStateId ||
+                pending.asker.kind !== 'role' ||
+                latest.roleId !== pending.asker.roleId ||
+                latest.logicalOperationId !== undefined ||
+                latest.physicalReceipt?.classification !== 'unchanged') {
+                return false;
+            }
+            // Reuse the persisted authority/receipt check rather than infer an arm
+            // from question prose or search older evidence for a convenient match.
+            const persisted = persistedBoundaryReconciliation(latest, effectLedgerMirror);
+            if (persisted === undefined ||
+                persisted.historicalDeferred ||
+                persisted.reconciliation.status !== 'resolved') {
+                return false;
+            }
+            const output = persisted.reconciliation.output;
+            const declaration = outcomeAuthority.governedPlayerStates[latest.sourceStateId]?.[output.guard];
+            return (declaration?.repositoryDisposition === 'unchanged' &&
+                typeof output.question === 'string' &&
+                output.question === pending.question);
+        }
         function currentBoundDeferredOperation(pending) {
             const projected = {
                 questionId: pending.questionId,
@@ -2886,16 +3102,44 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 },
             });
         }
-        function unresolvedGovernedSettlement(reason, error, signal = activeSignal) {
-            if (error !== undefined && signal?.aborted && Object.is(error, signal.reason)) {
-                return { status: 'unresolved', error };
+        // DR-063 §1: the cause of an unresolved governed settlement. A reconciled
+        // mismatch supplies its own receipt-read cause; the reasons this function
+        // owns map to adjudication, abort, and runtime-defect codes.
+        function governedSettlementCause(reason, error, aborted, supplied) {
+            if (supplied !== undefined)
+                return supplied;
+            if (aborted || reason.includes('aborted'))
+                return ABORTED_FAILURE_CAUSE;
+            if (GOVERNED_JUDGE_FAILURE_REASONS.includes(reason)) {
+                const transport = failureErrorEvidence(error);
+                return assertPlaybookFailureCause({
+                    code: 'judge-failed',
+                    evidence: {
+                        reason,
+                        ...(transport === undefined ? {} : { error: transport }),
+                    },
+                });
+            }
+            return runtimeDefectCause(reason);
+        }
+        function unresolvedGovernedSettlement(reason, error, signal = activeSignal, cause) {
+            const aborted = error !== undefined && signal?.aborted === true
+                ? Object.is(error, signal.reason)
+                : false;
+            const decided = governedSettlementCause(reason, error, aborted, cause);
+            rememberFailureCause(decided);
+            if (aborted) {
+                return {
+                    status: 'unresolved',
+                    error: attachPlaybookFailureCause(error, decided),
+                };
             }
             const failure = error instanceof Error
                 ? error
                 : new Error(`${label} governed outcome remains unresolved: ${reason}`);
             return {
                 status: 'unresolved',
-                error: markFsmResultFailure(failure),
+                error: attachPlaybookFailureCause(markFsmResultFailure(failure), decided),
             };
         }
         async function spendSemanticCorrectionBudget(completedBoundary, receipt, finalText, semanticCandidate) {
@@ -3052,7 +3296,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
             }
             const semanticCandidate = snapshotJsonValue(reconciliation.evidence.semanticCandidate, `${label} governed semantic candidate`);
             if (reconciliation.status === 'unresolved') {
-                governedSettlementsByBoundaryId.set(completion.boundary.boundaryId, unresolvedGovernedSettlement(reconciliation.reason));
+                governedSettlementsByBoundaryId.set(completion.boundary.boundaryId, unresolvedGovernedSettlement(reconciliation.reason, undefined, undefined, reconciliation.cause));
                 return { finalText, semanticCandidate, unresolved: true };
             }
             const output = reconciliation.output;
@@ -3429,9 +3673,16 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 }
                 activePlayerKeys.add(playerKey);
                 try {
-                    const runTracedPlayerCall = async (resume = selectedResume) => {
+                    const runTracedPlayerCall = async (resume = selectedResume, 
+                    // DR-062 §4: composed from this call's own baseline observation,
+                    // so the prompt the trace records is the prompt the player is sent.
+                    preExistingBlock) => {
                         const identity = callIdentity(resume);
-                        const callPrompt = resume === false ? freshPrompt : prompt;
+                        const withPreExisting = (text) => preExistingBlock === undefined
+                            ? text
+                            : `${text}\n\n${preExistingBlock}`;
+                        const callPrompt = withPreExisting(resume === false ? freshPrompt : prompt);
+                        const callFreshPrompt = withPreExisting(freshPrompt);
                         await emitCallStarted('player.call.started', 'player.call.finished', { ...identity, prompt: callPrompt }, position, signal);
                         let rawResult;
                         try {
@@ -3440,7 +3691,12 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             // never start after abort, so settle the already-started pair
                             // as `aborted` through the catch below.
                             signal.throwIfAborted();
-                            rawResult = await requireHostPorts().callPlayer(roleId, callPrompt, signal, { resume, ...(callPrompt === freshPrompt ? {} : { freshPrompt }) });
+                            rawResult = await requireHostPorts().callPlayer(roleId, callPrompt, signal, {
+                                resume,
+                                ...(callPrompt === callFreshPrompt
+                                    ? {}
+                                    : { freshPrompt: callFreshPrompt }),
+                            });
                             // A host promise is not required to honor cancellation. Do not
                             // let a late result mutate continuity or publish a successful
                             // finish.
@@ -3461,7 +3717,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             }
                             // A thrown port call carries no authoritative result, so the
                             // prior token remains available for a later explicit resume.
-                            throw error;
+                            throw decidePlayerCallFailure(error, roleId, playerId, signal);
                         }
                         let result;
                         try {
@@ -3476,7 +3732,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             catch {
                                 // The malformed host result remains authoritative.
                             }
-                            throw error;
+                            throw decidePlayerCallFailure(error, roleId, playerId, signal);
                         }
                         try {
                             updatePlayerResume(roleId, playerId, result);
@@ -3505,6 +3761,24 @@ export function createXStatePlaybookRuntime(machine, spec) {
                                 ? { resumeToken: result.resumeToken }
                                 : {}),
                         }, position);
+                        // DR-063 §2: the player bridge builds the failure Error for a
+                        // non-`ok` result, so the cause is decided here, where the role,
+                        // the player, and the reported error are known, and a successful
+                        // result clears it so no later failure inherits it.
+                        if (result.status === 'ok') {
+                            lastFailureCause = undefined;
+                        }
+                        else if (result.status === 'aborted') {
+                            rememberFailureCause(ABORTED_FAILURE_CAUSE);
+                        }
+                        else {
+                            rememberFailureCause(playerFailureCause({
+                                roleId,
+                                ...(playerId === undefined ? {} : { playerId }),
+                                error: result.error ??
+                                    `callPlayer status ${JSON.stringify(result.status)}`,
+                            }));
+                        }
                         return result;
                     };
                     const effectBoundary = governedBoundarySeed(input, roleId, callId, turnId);
@@ -3527,7 +3801,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         deferredContinuation.playerId = playerId;
                         deferredContinuation.signal = signal;
                         try {
-                            deferredContinuation.result = await runTracedPlayerCall(selectedResume);
+                            deferredContinuation.result = await runTracedPlayerCall(selectedResume, effectAuthorizedPreExistingBlock(effectBoundary, deferredContinuation.baseline));
                         }
                         catch (error) {
                             deferredContinuation.callError = error;
@@ -3549,7 +3823,11 @@ export function createXStatePlaybookRuntime(machine, spec) {
                         const exclusive = await repositoryCapability.runExclusive({
                             signal,
                             effectBoundary,
-                            operation: () => runTracedPlayerCall(),
+                            // DR-062 §4: the call's own baseline, supplied by the host that
+                            // captured it under this exclusive claim. A host that supplies
+                            // none states no pre-existing change, exactly as an empty
+                            // baseline projection does.
+                            operation: (context) => runTracedPlayerCall(selectedResume, effectAuthorizedPreExistingBlock(effectBoundary, context?.baseline)),
                             completeEffectBoundary: completionEvidenceFor(input, roleId, playerId, signal, undefined),
                         });
                         return acknowledgeGovernedPlayerResult(exclusive, effectBoundary.boundaryId);
@@ -3571,6 +3849,11 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     activePlayerKeys.delete(playerKey);
                 }
             },
+            markPlayerResultFailure(error) {
+                return lastFailureCause === undefined
+                    ? error
+                    : attachPlaybookFailureCause(error, lastFailureCause);
+            },
             takeGovernedPlayerOutput(result) {
                 const settlement = governedPlayerSettlements.get(result);
                 if (settlement !== undefined)
@@ -4085,6 +4368,61 @@ export function createXStatePlaybookRuntime(machine, spec) {
         function tracePositionForActiveTurn() {
             return activeTurnId === undefined ? {} : { turnId: activeTurnId };
         }
+        // DR-063 §2: the parked failure's error as every public surface publishes
+        // it — the FSM's own `lastError`, completed with the cause decided where
+        // the failure was decided. An error that already carries a valid cause
+        // keeps it; an artifact-built error takes the runtime's own slot; anything
+        // else is a runtime defect carrying its message. There is no failure
+        // without a cause.
+        function failedStateError(context) {
+            const normalized = normalizeErrorFull(context.lastError);
+            if (normalized === undefined || normalized.cause !== undefined) {
+                return normalized;
+            }
+            return {
+                ...normalized,
+                cause: lastFailureCause ?? runtimeDefectCause(normalized.message),
+            };
+        }
+        // DR-063 §2: a rejected player port or a result the runtime cannot read is
+        // a `player-failed` failure named by role; an abort is `aborted`.
+        function decidePlayerCallFailure(error, roleId, playerId, signal) {
+            const cause = isAbortFailure(error, signal)
+                ? ABORTED_FAILURE_CAUSE
+                : playerFailureCause({
+                    roleId,
+                    ...(playerId === undefined ? {} : { playerId }),
+                    error,
+                });
+            rememberFailureCause(cause);
+            return attachPlaybookFailureCause(error, cause);
+        }
+        function completeFailedStatuses(statuses, state, context) {
+            if (state.stateId !== 'failed')
+                return statuses;
+            const lastError = failedStateError(context);
+            if (lastError?.cause === undefined)
+                return statuses;
+            const cause = lastError.cause;
+            return statuses.map((status) => {
+                const data = status.data;
+                if (data === null || typeof data !== 'object' || Array.isArray(data)) {
+                    return status;
+                }
+                const recorded = data;
+                const recordedError = recorded.lastError;
+                if (recordedError === undefined ||
+                    recordedError === null ||
+                    typeof recordedError !== 'object' ||
+                    Array.isArray(recordedError)) {
+                    return status;
+                }
+                return {
+                    ...status,
+                    data: snapshotJsonValue({ ...recorded, lastError: { ...recordedError, cause } }, 'failed status data'),
+                };
+            });
+        }
         function structuredStateTelemetryPayload(previousState, state, event, context) {
             const payload = {
                 from: previousState?.value ?? null,
@@ -4099,7 +4437,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 payload.pendingBossQuestion = pendingBossQuestion;
             }
             if (state.stateId === 'failed') {
-                const lastError = normalizeErrorFull(context.lastError);
+                const lastError = failedStateError(context);
                 if (lastError !== undefined)
                     payload.lastError = lastError;
             }
@@ -4269,7 +4607,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             validateBoundQuestionProjection();
                         }
                         const payload = structuredStateTelemetryPayload(previousState, state, inspectionEvent.event, context);
-                        const stateStatuses = statusesForState(state, context, inspectionEvent.event);
+                        const stateStatuses = completeFailedStatuses(statusesForState(state, context, inspectionEvent.event), state, context);
                         const outcomeStatuses = usesDefaultStatuses
                             ? acceptedOutcomes.map(({ acceptedOutcome }) => ({
                                 message: `→ ${acceptedOutcome}`,
@@ -4349,10 +4687,17 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     : outcome === 'aborted'
                         ? activeSignal?.reason
                         : undefined);
+            if (failure === undefined)
+                return { outcome, state };
+            // DR-063 §2: a `failed` settlement publishes the same cause-completed
+            // error the failed state's status line and telemetry publish.
+            const normalized = outcome === 'failed'
+                ? failedStateError({ lastError: failure })
+                : normalizeError(failure);
             return {
                 outcome,
                 state,
-                ...(failure !== undefined ? { error: normalizeError(failure) } : {}),
+                ...(normalized === undefined ? {} : { error: normalized }),
             };
         }
         function settledOutcome(signal) {
@@ -4561,10 +4906,36 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 action: {
                     id: `retry:${retryEvent.type}`,
                     label: `Retry: ${description}`,
+                    // DR-063 §3: retrying a failed call is `ready` — the runtime cannot
+                    // see whether the Boss changed the outside world since it failed.
+                    standing: 'ready',
                 },
                 event: retryEvent,
             };
         }
+        /**
+         * DR-063 §3: reconciliation only re-reads the host's ledger, which the
+         * control view has just done. Where no checkpoint restoration is eligible
+         * and every unresolved envelope's boundary already holds a complete
+         * receipt, re-reading can resolve nothing, so the action is a no-op.
+         */
+        function reconciliationStanding(deferredRestoreOperationId) {
+            if (deferredRestoreOperationId !== undefined)
+                return { standing: 'ready' };
+            const current = effectLedgerMirror;
+            const envelopes = projectUnresolvedEffectEnvelopes(current);
+            if (envelopes.length === 0)
+                return { standing: 'ready' };
+            const boundaryIds = envelopes.flatMap((envelope) => envelope.kind === 'boundary'
+                ? [envelope.boundaryId]
+                : (current.logicalOperations.find(({ operationId }) => operationId === envelope.operationId)?.boundaryIds ?? []));
+            if (boundaryIds.length === 0)
+                return { standing: 'ready' };
+            const complete = boundaryIds.every((boundaryId) => current.boundaries.find((candidate) => candidate.boundaryId === boundaryId)?.physicalReceipt !== undefined);
+            return complete
+                ? { standing: 'no-op', reason: 'receipt-complete' }
+                : { standing: 'ready' };
+        }
         function deriveControlActions(snapshot) {
             // Actions derive only at the safe point the parked snapshot also
             // uses — quiescent actor with status `active` and no pending nested
@@ -4596,6 +4967,7 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     action: {
                         id: UNRESOLVED_EFFECT_RECONCILIATION_ACTION_ID,
                         label: 'Retry unresolved effect reconciliation',
+                        ...reconciliationStanding(deferredRestoreOperationId),
                     },
                     unresolvedEffectAction: 'reconcile',
                     ...(deferredRestoreOperationId === undefined
@@ -4605,6 +4977,8 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     action: {
                         id: UNRESOLVED_EFFECT_ABANDONMENT_ACTION_ID,
                         label: 'Abandon unresolved workflow attempt',
+                        // DR-063 §3: abandonment always changes the session's standing.
+                        standing: 'ready',
                     },
                     unresolvedEffectAction: 'abandon',
                 });
@@ -4631,6 +5005,8 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     action: {
                         id: `jump:${targetId}`,
                         label: `Resume from: ${description}`,
+                        // DR-063 §3: a jump always moves the machine.
+                        standing: 'ready',
                     },
                     event,
                 });
@@ -5017,8 +5393,12 @@ export function createXStatePlaybookRuntime(machine, spec) {
                     signal,
                     operationId: operation.operationId,
                     effectBoundary,
-                    operation: async ({ playerContinuation }) => {
+                    operation: async (context) => {
+                        const { playerContinuation } = context ?? {};
                         validateBinding(playerContinuation);
+                        // DR-062 §4: the continuation's own baseline, captured before the
+                        // FSM re-enters the bound player state that reads it.
+                        continuation.baseline = context?.baseline;
                         continuation.playerContinuation = selectPlayerResume(effectBoundary.roleId, boundPlayerId);
                         continuationStarted = true;
                         actor.send(event);
@@ -5407,7 +5787,9 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 const pending = !hasUnresolvedReconciliation()
                     ? pendingBossQuestionForState(state, context)
                     : undefined;
-                const lastError = normalizeErrorFull(context.lastError);
+                const lastError = state.stateId === 'failed'
+                    ? failedStateError(context)
+                    : normalizeErrorFull(context.lastError);
                 const projectedContext = projectControlContext(context);
                 const stateDescription = !hasUnresolvedReconciliation()
                     ? stateDescriptionFor(state)
@@ -5746,6 +6128,9 @@ export function createXStatePlaybookRuntime(machine, spec) {
                 activeAborts = abortReasonClassifier(signal);
                 activeAbortEmission = undefined;
                 controlPlaneError = undefined;
+                // DR-063 §2: each turn decides its own failures, so the slot never
+                // carries a previous turn's cause into this one.
+                lastFailureCause = undefined;
                 let result;
                 let operationError;
                 // The boundary sentinel releases on every exit: a settlement defect
@@ -5779,7 +6164,8 @@ export function createXStatePlaybookRuntime(machine, spec) {
                             deferredPending = pendingBossQuestionForState(normalizePlaybookSnapshot(snapshot), snapshotContext);
                             pendingRequiresDeferredBinding =
                                 deferredPending !== undefined &&
-                                    outcomeAuthority?.governedPlayerStates[deferredPending.resumeStateId]?.needsBossReply?.repositoryDisposition === 'deferred';
+                                    outcomeAuthority?.governedPlayerStates[deferredPending.resumeStateId]?.needsBossReply?.repositoryDisposition === 'deferred' &&
+                                    !pendingHasExactUnchangedOrigin(deferredPending);
                             deferredOperation =
                                 !pendingRequiresDeferredBinding
                                     ? undefined