@sublang/playbook 13.3.0 → 14.1.0

package/src/xstate-playbook-runtime.ts

@@ -31,9 +31,11 @@ import {
   createAcceptedOutcomeConsumer,
   type AcceptedOutcomeReceipt,
 } from './accepted-outcome.js';
+import { assertPlaybookFailureCause } from './runtime.js';
 import {
   assertPlaybookRuntimeSnapshot,
   assertPlaybookEffectLedger,
+  attachPlaybookFailureCause,
   combineAbortSignals,
   createNestedPlaybookBridge,
   detachPersistedMachineSnapshot,
@@ -60,7 +62,9 @@ import type {
   PlaybookEffectBoundaryStart,
   PlaybookEffectLedger,
   PlaybookEffectLedgerCapability,
+  NormalizedError,
   PlaybookEffectLogicalOperation,
+  PlaybookFailureCause,
   PlaybookPendingBossQuestion,
   PlaybookPorts,
   PlaybookRepositoryReceipt,
@@ -149,6 +153,12 @@ export interface RuntimeBoundaryCalls {
     result: PlayerResult,
     output: PlaybookActorOutput,
   ): void;
+  /**
+   * DR-063 §2: decorate the failure the bridge builds for a non-`ok` result
+   * with the cause the boundary decided at the call itself, where the role,
+   * the resolved player, and the reported error are known.
+   */
+  markPlayerResultFailure?(error: Error): Error;
   callJudge(
     purpose: JudgePurpose,
     stateId: string | undefined,
@@ -236,6 +246,18 @@ const fsmResultFailures = new WeakSet<object>();
 
 function markFsmResultFailure(error: Error): Error {
   fsmResultFailures.add(error);
+  // DR-063 §2: there is no failure without a cause. A failure the runtime
+  // marks with nothing more specific is a runtime defect carrying its own
+  // message; a decision site that knows better attaches its cause afterwards.
+  attachPlaybookFailureCause(error, {
+    code: 'runtime-defect',
+    evidence: {
+      reason:
+        typeof error.message === 'string' && error.message.length > 0
+          ? error.message
+          : 'unknown runtime defect',
+    },
+  });
   return error;
 }
 
@@ -247,6 +269,74 @@ function isFsmResultFailure(error: unknown): boolean {
   );
 }
 
+// ---------------------------------------------------------------------------
+// DR-063 §1/§2: there is no failure without a cause. Each decision site builds
+// the cause its own evidence states, the runtime attaches it to the error it
+// marks as the FSM failure, and anything else the runtime marks becomes
+// `runtime-defect` carrying its message as `reason`.
+// ---------------------------------------------------------------------------
+
+/** Adjudication reasons this runtime decides itself, and their codes. */
+const GOVERNED_JUDGE_FAILURE_REASONS: readonly string[] = [
+  'judge transport failed',
+  'corrective judge failed',
+  'corrective semantic candidate is invalid',
+  'semantic correction budget is unavailable',
+];
+
+const ABORTED_FAILURE_CAUSE: PlaybookFailureCause = assertPlaybookFailureCause({
+  code: 'aborted',
+  evidence: {},
+});
+
+function runtimeDefectCause(reason: string): PlaybookFailureCause {
+  return assertPlaybookFailureCause({
+    code: 'runtime-defect',
+    evidence: { reason: reason.length === 0 ? 'unknown runtime defect' : reason },
+  });
+}
+
+function failureErrorEvidence(
+  error: unknown,
+): { readonly name: string; readonly message: string } | undefined {
+  if (error === undefined || error === null) return undefined;
+  const { name, message } = normalizeError(error);
+  return { name, message };
+}
+
+/** A string `code` the rejecting port reported, when it reported one. */
+function failureErrorCode(error: unknown): string | undefined {
+  if (typeof error !== 'object' || error === null) return undefined;
+  try {
+    const code = (error as { code?: unknown }).code;
+    return typeof code === 'string' && code.length > 0 ? code : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function playerFailureCause(input: {
+  readonly roleId: string;
+  readonly playerId?: string;
+  readonly error: unknown;
+}): PlaybookFailureCause {
+  return assertPlaybookFailureCause({
+    code: 'player-failed',
+    evidence: {
+      roleId: input.roleId,
+      ...(input.playerId === undefined ? {} : { playerId: input.playerId }),
+      error: failureErrorEvidence(input.error) ?? {
+        name: 'Error',
+        message: 'Unknown error',
+      },
+      ...(failureErrorCode(input.error) === undefined
+        ? {}
+        : { errorCode: failureErrorCode(input.error)! }),
+    },
+  });
+}
+
+
 // ---------------------------------------------------------------------------
 // DR-028: both call boundaries treat an `ok` result whose `finalText` is
 // missing, empty, or whitespace-only under one empty predicate, and that
@@ -946,15 +1036,21 @@ export function parseJudgeJson(raw: string): unknown {
 
 export function normalizeErrorCompact(
   err: unknown,
-): { name: string; message: string } | undefined {
+): Omit<NormalizedError, 'stack'> | undefined {
   if (err === undefined || err === null) return undefined;
   const normalized = normalizeError(err);
-  return { name: normalized.name, message: normalized.message };
+  return {
+    name: normalized.name,
+    message: normalized.message,
+    // DR-063 §2: on a failure the cause is why the compact form exists, so it
+    // survives where the stack does not.
+    ...(normalized.cause === undefined ? {} : { cause: normalized.cause }),
+  };
 }
 
 export function normalizeErrorFull(
   err: unknown,
-): { name: string; message: string; stack?: string } | undefined {
+): NormalizedError | undefined {
   if (err === undefined || err === null) return undefined;
   return normalizeError(err);
 }
@@ -1090,6 +1186,98 @@ export function composePlayerContinuation(
   return [...continuationBlocks(input, resuming), body].join('\n\n');
 }
 
+// DR-062 §4: the Coder is told which uncommitted changes were already in the
+// worktree when its own call started. The block is composed from the call's
+// own baseline observation, names paths only, and is bounded.
+const PRE_EXISTING_CHANGE_GROUPS = [
+  'staged',
+  'modified',
+  'deleted',
+  'untracked',
+  'renamed',
+  'unmerged',
+  'other',
+] as const;
+
+type PreExistingChangeGroup = (typeof PRE_EXISTING_CHANGE_GROUPS)[number];
+
+const PRE_EXISTING_CHANGE_PATH_LIMIT = 40;
+
+/**
+ * The group one baseline projection entry belongs to. The shapes are the
+ * porcelain-v2 records the repository observer projects: an `untracked`,
+ * `rename-or-copy`, or `unmerged` kind, and otherwise an `ordinary` record
+ * whose two-character `xy` carries the index state first and the worktree
+ * state second.
+ */
+function preExistingChangeGroup(entry: unknown): PreExistingChangeGroup {
+  if (!isPlainObject(entry)) return 'other';
+  if (entry.kind === 'untracked') return 'untracked';
+  if (entry.kind === 'rename-or-copy') return 'renamed';
+  if (entry.kind === 'unmerged') return 'unmerged';
+  const xy = entry.xy;
+  if (entry.kind !== 'ordinary' || typeof xy !== 'string' || xy.length !== 2) {
+    return 'other';
+  }
+  if (xy[1] === 'D') return 'deleted';
+  if (xy[1] === '.') return xy[0] === '.' ? 'other' : 'staged';
+  return 'modified';
+}
+
+/**
+ * The pre-existing-changes block appended to an effect-authorized player
+ * prompt, or `undefined` for an empty baseline projection.
+ */
+function preExistingChangesBlock(
+  baseline: PlaybookRepositoryReceipt['baseline'] | undefined,
+): string | undefined {
+  const projection = baseline?.projection;
+  if (!isPlainObject(projection)) return undefined;
+  const grouped = new Map<PreExistingChangeGroup, string[]>();
+  let total = 0;
+  for (const path of Object.keys(projection)) {
+    const group = preExistingChangeGroup(projection[path]);
+    const paths = grouped.get(group);
+    if (paths === undefined) grouped.set(group, [path]);
+    else paths.push(path);
+    total += 1;
+  }
+  if (total === 0) return undefined;
+  const omitted = Math.max(0, total - PRE_EXISTING_CHANGE_PATH_LIMIT);
+  const lines: string[] = [];
+  let budget = PRE_EXISTING_CHANGE_PATH_LIMIT;
+  for (const group of PRE_EXISTING_CHANGE_GROUPS) {
+    const paths = grouped.get(group);
+    if (paths === undefined || budget <= 0) continue;
+    const printed = paths.slice().sort().slice(0, budget);
+    budget -= printed.length;
+    lines.push(`> - ${group}: ${printed.join(', ')}`);
+  }
+  if (omitted > 0 && lines.length > 0) {
+    lines[lines.length - 1] += `, … and ${omitted} more`;
+  }
+  return [
+    '> Uncommitted changes present before this call, belonging to the Boss:',
+    ...lines,
+    "> Leave them exactly as they are unless the task or the Boss's request requires building on them; never revert or delete them; when you commit any of them, name them in your final report.",
+  ].join('\n');
+}
+
+/**
+ * The block for one governed call, or `undefined` where the call is not
+ * effect-authorized — a call whose declared outcomes carry no
+ * `one-descendant-commit` disposition may commit nothing, so it is told
+ * nothing.
+ */
+function effectAuthorizedPreExistingBlock(
+  effectBoundary: Pick<XStateEffectBoundarySeed, 'dispositions'>,
+  baseline: PlaybookRepositoryReceipt['baseline'] | undefined,
+): string | undefined {
+  return effectBoundary.dispositions.includes('one-descendant-commit')
+    ? preExistingChangesBlock(baseline)
+    : undefined;
+}
+
 const PLACEHOLDER_PATTERN = /<(#|[A-Za-z_$][A-Za-z0-9_$-]*)>/g;
 
 function placeholderFieldName(
@@ -1692,9 +1880,10 @@ export function createPlayerBridge(
         );
       }
       if (result.status !== 'ok') {
-        throw new Error(
+        const failure = new Error(
           result.error ?? `captainBridge: callPlayer status "${result.status}"`,
         );
+        throw boundary?.markPlayerResultFailure?.(failure) ?? failure;
       }
       const finalText = result.finalText ?? '';
       if (isEmptyFinalText(finalText)) {
@@ -3371,6 +3560,8 @@ export function createXStatePlaybookRuntime<
       | {
           readonly operationId: string;
           readonly effectBoundary: XStateEffectBoundarySeed;
+          /** The continuation's own baseline observation (DR-062 §4). */
+          baseline?: PlaybookRepositoryReceipt['baseline'];
           playerContinuation?: string | false;
           input?: PlaybookPlayerInput;
           roleId?: string;
@@ -3386,6 +3577,15 @@ export function createXStatePlaybookRuntime<
     let deferInspectionEmissions = false;
     let deferredInspectionEmissions: Array<() => void> = [];
     let controlPlaneError: unknown;
+    // DR-063 §2: the cause decided at the site the failure was decided, kept
+    // for the failures whose Error the compiled artifact builds itself and the
+    // runtime therefore cannot decorate. It is cleared at each Boss turn start
+    // and at each successful player result, so it is never stale, and it is
+    // only ever read as the cause of an error that carries none of its own.
+    let lastFailureCause: PlaybookFailureCause | undefined;
+    const rememberFailureCause = (cause: PlaybookFailureCause): void => {
+      lastFailureCause = cause;
+    };
     // Previous root-machine state for the inspect-driven telemetry /
     // status emitter. undefined before the first inspect firing.
     let priorState: PlaybookState | undefined;
@@ -3881,6 +4081,19 @@ export function createXStatePlaybookRuntime<
       refreshRetainedEffectReconciliation(current);
       syncDeferredReconciliationOverlay();
       refreshUnresolvedSemanticReconciliation(current);
+      return projectUnresolvedEffectEnvelopes(current);
+    }
+
+    /**
+     * The unresolved envelopes of one already-refreshed ledger mirror. Pure:
+     * `describe()` reads it through the control view without moving anything.
+     */
+    function projectUnresolvedEffectEnvelopes(
+      current: PlaybookEffectLedger,
+    ): readonly (
+      | { readonly kind: 'boundary'; readonly boundaryId: string }
+      | { readonly kind: 'logical-operation'; readonly operationId: string }
+    )[] {
       if (!hasUnresolvedReconciliation()) return [];
 
       const boundaryIds = new Set(unresolvedSemanticBoundaryIds);
@@ -3987,6 +4200,58 @@ export function createXStatePlaybookRuntime<
       }
     }
 
+    function pendingHasExactUnchangedOrigin(
+      pending: PlaybookPendingBossQuestionContext,
+    ): boolean {
+      // The outcome menu is not the selected outcome: a source-authored
+      // unchanged question may share its state with needsBossReply: deferred.
+      // An open operation nevertheless always retains its checkpoint and
+      // cumulative receipt authority, even if a later boundary looks alike.
+      if (
+        runtimeLogicalOperations().some(
+          (operation) => operation.logicalReceipt === undefined,
+        )
+      ) {
+        return false;
+      }
+      const latest = effectLedgerMirror.boundaries
+        .filter(runtimeBoundaryIsOwned)
+        .at(-1);
+      if (
+        latest === undefined ||
+        latest.sourceStateId !== pending.resumeStateId ||
+        pending.asker.kind !== 'role' ||
+        latest.roleId !== pending.asker.roleId ||
+        latest.logicalOperationId !== undefined ||
+        latest.physicalReceipt?.classification !== 'unchanged'
+      ) {
+        return false;
+      }
+      // Reuse the persisted authority/receipt check rather than infer an arm
+      // from question prose or search older evidence for a convenient match.
+      const persisted = persistedBoundaryReconciliation(
+        latest,
+        effectLedgerMirror,
+      );
+      if (
+        persisted === undefined ||
+        persisted.historicalDeferred ||
+        persisted.reconciliation.status !== 'resolved'
+      ) {
+        return false;
+      }
+      const output = persisted.reconciliation.output;
+      const declaration =
+        outcomeAuthority.governedPlayerStates[latest.sourceStateId]?.[
+          output.guard
+        ];
+      return (
+        declaration?.repositoryDisposition === 'unchanged' &&
+        typeof output.question === 'string' &&
+        output.question === pending.question
+      );
+    }
+
     function currentBoundDeferredOperation(
       pending: PlaybookPendingBossQuestionContext,
     ): PlaybookEffectLogicalOperation | undefined {
@@ -4600,13 +4865,47 @@ export function createXStatePlaybookRuntime<
       });
     }
 
+    // DR-063 §1: the cause of an unresolved governed settlement. A reconciled
+    // mismatch supplies its own receipt-read cause; the reasons this function
+    // owns map to adjudication, abort, and runtime-defect codes.
+    function governedSettlementCause(
+      reason: string,
+      error: unknown,
+      aborted: boolean,
+      supplied: PlaybookFailureCause | undefined,
+    ): PlaybookFailureCause {
+      if (supplied !== undefined) return supplied;
+      if (aborted || reason.includes('aborted')) return ABORTED_FAILURE_CAUSE;
+      if (GOVERNED_JUDGE_FAILURE_REASONS.includes(reason)) {
+        const transport = failureErrorEvidence(error);
+        return assertPlaybookFailureCause({
+          code: 'judge-failed',
+          evidence: {
+            reason,
+            ...(transport === undefined ? {} : { error: transport }),
+          },
+        });
+      }
+      return runtimeDefectCause(reason);
+    }
+
     function unresolvedGovernedSettlement(
       reason: string,
       error?: unknown,
       signal: AbortSignal | undefined = activeSignal,
+      cause?: PlaybookFailureCause,
     ): GovernedPlayerSettlement {
-      if (error !== undefined && signal?.aborted && Object.is(error, signal.reason)) {
-        return { status: 'unresolved', error };
+      const aborted =
+        error !== undefined && signal?.aborted === true
+          ? Object.is(error, signal.reason)
+          : false;
+      const decided = governedSettlementCause(reason, error, aborted, cause);
+      rememberFailureCause(decided);
+      if (aborted) {
+        return {
+          status: 'unresolved',
+          error: attachPlaybookFailureCause(error, decided),
+        };
       }
       const failure =
         error instanceof Error
@@ -4614,7 +4913,10 @@ export function createXStatePlaybookRuntime<
           : new Error(`${label} governed outcome remains unresolved: ${reason}`);
       return {
         status: 'unresolved',
-        error: markFsmResultFailure(failure),
+        error: attachPlaybookFailureCause(
+          markFsmResultFailure(failure),
+          decided,
+        ),
       };
     }
 
@@ -4862,7 +5164,12 @@ export function createXStatePlaybookRuntime<
       if (reconciliation.status === 'unresolved') {
         governedSettlementsByBoundaryId.set(
           completion.boundary.boundaryId,
-          unresolvedGovernedSettlement(reconciliation.reason),
+          unresolvedGovernedSettlement(
+            reconciliation.reason,
+            undefined,
+            undefined,
+            reconciliation.cause,
+          ),
         );
         return { finalText, semanticCandidate, unresolved: true };
       }
@@ -5410,9 +5717,19 @@ export function createXStatePlaybookRuntime<
         try {
           const runTracedPlayerCall = async (
             resume: string | false = selectedResume,
+            // DR-062 §4: composed from this call's own baseline observation,
+            // so the prompt the trace records is the prompt the player is sent.
+            preExistingBlock?: string,
           ): Promise<PlayerResult> => {
             const identity = callIdentity(resume);
-            const callPrompt = resume === false ? freshPrompt : prompt;
+            const withPreExisting = (text: string): string =>
+              preExistingBlock === undefined
+                ? text
+                : `${text}\n\n${preExistingBlock}`;
+            const callPrompt = withPreExisting(
+              resume === false ? freshPrompt : prompt,
+            );
+            const callFreshPrompt = withPreExisting(freshPrompt);
             await emitCallStarted(
               'player.call.started',
               'player.call.finished',
@@ -5432,7 +5749,12 @@ export function createXStatePlaybookRuntime<
                 roleId,
                 callPrompt,
                 signal,
-                { resume, ...(callPrompt === freshPrompt ? {} : { freshPrompt }) },
+                {
+                  resume,
+                  ...(callPrompt === callFreshPrompt
+                    ? {}
+                    : { freshPrompt: callFreshPrompt }),
+                },
               );
               // A host promise is not required to honor cancellation. Do not
               // let a late result mutate continuity or publish a successful
@@ -5455,7 +5777,7 @@ export function createXStatePlaybookRuntime<
               }
               // A thrown port call carries no authoritative result, so the
               // prior token remains available for a later explicit resume.
-              throw error;
+              throw decidePlayerCallFailure(error, roleId, playerId, signal);
             }
 
             let result: PlayerResult;
@@ -5472,7 +5794,7 @@ export function createXStatePlaybookRuntime<
               } catch {
                 // The malformed host result remains authoritative.
               }
-              throw error;
+              throw decidePlayerCallFailure(error, roleId, playerId, signal);
             }
 
             try {
@@ -5508,6 +5830,25 @@ export function createXStatePlaybookRuntime<
               },
               position,
             );
+            // DR-063 §2: the player bridge builds the failure Error for a
+            // non-`ok` result, so the cause is decided here, where the role,
+            // the player, and the reported error are known, and a successful
+            // result clears it so no later failure inherits it.
+            if (result.status === 'ok') {
+              lastFailureCause = undefined;
+            } else if (result.status === 'aborted') {
+              rememberFailureCause(ABORTED_FAILURE_CAUSE);
+            } else {
+              rememberFailureCause(
+                playerFailureCause({
+                  roleId,
+                  ...(playerId === undefined ? {} : { playerId }),
+                  error:
+                    result.error ??
+                    `callPlayer status ${JSON.stringify(result.status)}`,
+                }),
+              );
+            }
             return result;
           };
 
@@ -5548,6 +5889,10 @@ export function createXStatePlaybookRuntime<
             try {
               deferredContinuation.result = await runTracedPlayerCall(
                 selectedResume,
+                effectAuthorizedPreExistingBlock(
+                  effectBoundary,
+                  deferredContinuation.baseline,
+                ),
               );
             } catch (error) {
               deferredContinuation.callError = error;
@@ -5569,7 +5914,18 @@ export function createXStatePlaybookRuntime<
             const exclusive = await repositoryCapability.runExclusive({
               signal,
               effectBoundary,
-              operation: () => runTracedPlayerCall(),
+              // DR-062 §4: the call's own baseline, supplied by the host that
+              // captured it under this exclusive claim. A host that supplies
+              // none states no pre-existing change, exactly as an empty
+              // baseline projection does.
+              operation: (context) =>
+                runTracedPlayerCall(
+                  selectedResume,
+                  effectAuthorizedPreExistingBlock(
+                    effectBoundary,
+                    context?.baseline,
+                  ),
+                ),
               completeEffectBoundary: completionEvidenceFor(
                 input,
                 roleId,
@@ -5600,6 +5956,12 @@ export function createXStatePlaybookRuntime<
         }
       },
 
+      markPlayerResultFailure(error): Error {
+        return lastFailureCause === undefined
+          ? error
+          : attachPlaybookFailureCause(error, lastFailureCause);
+      },
+
       takeGovernedPlayerOutput(result): GovernedPlayerSettlement | undefined {
         const settlement = governedPlayerSettlements.get(result);
         if (settlement !== undefined) governedPlayerSettlements.delete(result);
@@ -6240,6 +6602,80 @@ export function createXStatePlaybookRuntime<
       return activeTurnId === undefined ? {} : { turnId: activeTurnId };
     }
 
+    // DR-063 §2: the parked failure's error as every public surface publishes
+    // it — the FSM's own `lastError`, completed with the cause decided where
+    // the failure was decided. An error that already carries a valid cause
+    // keeps it; an artifact-built error takes the runtime's own slot; anything
+    // else is a runtime defect carrying its message. There is no failure
+    // without a cause.
+    function failedStateError(
+      context: Record<string, unknown>,
+    ): NormalizedError | undefined {
+      const normalized: NormalizedError | undefined = normalizeErrorFull(
+        context.lastError,
+      );
+      if (normalized === undefined || normalized.cause !== undefined) {
+        return normalized;
+      }
+      return {
+        ...normalized,
+        cause: lastFailureCause ?? runtimeDefectCause(normalized.message),
+      };
+    }
+
+    // DR-063 §2: a rejected player port or a result the runtime cannot read is
+    // a `player-failed` failure named by role; an abort is `aborted`.
+    function decidePlayerCallFailure(
+      error: unknown,
+      roleId: string,
+      playerId: string | undefined,
+      signal: AbortSignal,
+    ): unknown {
+      const cause = isAbortFailure(error, signal)
+        ? ABORTED_FAILURE_CAUSE
+        : playerFailureCause({
+            roleId,
+            ...(playerId === undefined ? {} : { playerId }),
+            error,
+          });
+      rememberFailureCause(cause);
+      return attachPlaybookFailureCause(error, cause);
+    }
+
+    function completeFailedStatuses(
+      statuses: readonly ScheduledStatus[],
+      state: PlaybookState,
+      context: Record<string, unknown>,
+    ): readonly ScheduledStatus[] {
+      if (state.stateId !== 'failed') return statuses;
+      const lastError = failedStateError(context);
+      if (lastError?.cause === undefined) return statuses;
+      const cause = lastError.cause as unknown as JsonValue;
+      return statuses.map((status) => {
+        const data = status.data;
+        if (data === null || typeof data !== 'object' || Array.isArray(data)) {
+          return status;
+        }
+        const recorded = data as { readonly [key: string]: JsonValue };
+        const recordedError = recorded.lastError;
+        if (
+          recordedError === undefined ||
+          recordedError === null ||
+          typeof recordedError !== 'object' ||
+          Array.isArray(recordedError)
+        ) {
+          return status;
+        }
+        return {
+          ...status,
+          data: snapshotJsonValue(
+            { ...recorded, lastError: { ...recordedError, cause } },
+            'failed status data',
+          ),
+        };
+      });
+    }
+
     function structuredStateTelemetryPayload(
       previousState: PlaybookState | undefined,
       state: PlaybookState,
@@ -6261,7 +6697,7 @@ export function createXStatePlaybookRuntime<
         payload.pendingBossQuestion = pendingBossQuestion;
       }
       if (state.stateId === 'failed') {
-        const lastError = normalizeErrorFull(context.lastError);
+        const lastError = failedStateError(context);
         if (lastError !== undefined) payload.lastError = lastError;
       }
       return snapshotJsonValue(payload, 'FSM telemetry payload');
@@ -6466,10 +6902,10 @@ export function createXStatePlaybookRuntime<
               inspectionEvent.event,
               context,
             );
-            const stateStatuses = statusesForState(
+            const stateStatuses = completeFailedStatuses(
+              statusesForState(state, context, inspectionEvent.event),
               state,
               context,
-              inspectionEvent.event,
             );
             const outcomeStatuses = usesDefaultStatuses
               ? acceptedOutcomes.map(({ acceptedOutcome }) => ({
@@ -6569,10 +7005,17 @@ export function createXStatePlaybookRuntime<
           : outcome === 'aborted'
             ? activeSignal?.reason
             : undefined);
+      if (failure === undefined) return { outcome, state };
+      // DR-063 §2: a `failed` settlement publishes the same cause-completed
+      // error the failed state's status line and telemetry publish.
+      const normalized =
+        outcome === 'failed'
+          ? failedStateError({ lastError: failure })
+          : normalizeError(failure);
       return {
         outcome,
         state,
-        ...(failure !== undefined ? { error: normalizeError(failure) } : {}),
+        ...(normalized === undefined ? {} : { error: normalized }),
       };
     }
 
@@ -6801,11 +7244,46 @@ export function createXStatePlaybookRuntime<
         action: {
           id: `retry:${retryEvent.type}`,
           label: `Retry: ${description}`,
+          // DR-063 §3: retrying a failed call is `ready` — the runtime cannot
+          // see whether the Boss changed the outside world since it failed.
+          standing: 'ready',
         },
         event: retryEvent,
       };
     }
 
+    /**
+     * DR-063 §3: reconciliation only re-reads the host's ledger, which the
+     * control view has just done. Where no checkpoint restoration is eligible
+     * and every unresolved envelope's boundary already holds a complete
+     * receipt, re-reading can resolve nothing, so the action is a no-op.
+     */
+    function reconciliationStanding(
+      deferredRestoreOperationId: string | undefined,
+    ): Pick<PlaybookControlAction, 'standing' | 'reason'> {
+      if (deferredRestoreOperationId !== undefined) return { standing: 'ready' };
+      const current = effectLedgerMirror;
+      const envelopes = projectUnresolvedEffectEnvelopes(current);
+      if (envelopes.length === 0) return { standing: 'ready' };
+      const boundaryIds = envelopes.flatMap((envelope) =>
+        envelope.kind === 'boundary'
+          ? [envelope.boundaryId]
+          : (current.logicalOperations.find(
+              ({ operationId }) => operationId === envelope.operationId,
+            )?.boundaryIds ?? []),
+      );
+      if (boundaryIds.length === 0) return { standing: 'ready' };
+      const complete = boundaryIds.every(
+        (boundaryId) =>
+          current.boundaries.find(
+            (candidate) => candidate.boundaryId === boundaryId,
+          )?.physicalReceipt !== undefined,
+      );
+      return complete
+        ? { standing: 'no-op', reason: 'receipt-complete' }
+        : { standing: 'ready' };
+    }
+
     function deriveControlActions(snapshot: unknown): DerivedControlAction[] {
       // Actions derive only at the safe point the parked snapshot also
       // uses — quiescent actor with status `active` and no pending nested
@@ -6844,6 +7322,7 @@ export function createXStatePlaybookRuntime<
             action: {
               id: UNRESOLVED_EFFECT_RECONCILIATION_ACTION_ID,
               label: 'Retry unresolved effect reconciliation',
+              ...reconciliationStanding(deferredRestoreOperationId),
             },
             unresolvedEffectAction: 'reconcile',
             ...(deferredRestoreOperationId === undefined
@@ -6854,6 +7333,8 @@ export function createXStatePlaybookRuntime<
             action: {
               id: UNRESOLVED_EFFECT_ABANDONMENT_ACTION_ID,
               label: 'Abandon unresolved workflow attempt',
+              // DR-063 §3: abandonment always changes the session's standing.
+              standing: 'ready',
             },
             unresolvedEffectAction: 'abandon',
           },
@@ -6878,6 +7359,8 @@ export function createXStatePlaybookRuntime<
           action: {
             id: `jump:${targetId}`,
             label: `Resume from: ${description}`,
+            // DR-063 §3: a jump always moves the machine.
+            standing: 'ready',
           },
           event,
         });
@@ -7369,8 +7852,12 @@ export function createXStatePlaybookRuntime<
           signal,
           operationId: operation.operationId,
           effectBoundary,
-          operation: async ({ playerContinuation }) => {
+          operation: async (context) => {
+            const { playerContinuation } = context ?? {};
             validateBinding(playerContinuation);
+            // DR-062 §4: the continuation's own baseline, captured before the
+            // FSM re-enters the bound player state that reads it.
+            continuation.baseline = context?.baseline;
             continuation.playerContinuation = selectPlayerResume(
               effectBoundary.roleId, boundPlayerId,
             );
@@ -7874,7 +8361,10 @@ export function createXStatePlaybookRuntime<
           !hasUnresolvedReconciliation()
             ? pendingBossQuestionForState(state, context)
             : undefined;
-        const lastError = normalizeErrorFull(context.lastError);
+        const lastError =
+          state.stateId === 'failed'
+            ? failedStateError(context)
+            : normalizeErrorFull(context.lastError);
         const projectedContext = projectControlContext(context);
         const stateDescription =
           !hasUnresolvedReconciliation()
@@ -8273,6 +8763,9 @@ export function createXStatePlaybookRuntime<
         activeAborts = abortReasonClassifier(signal);
         activeAbortEmission = undefined;
         controlPlaneError = undefined;
+        // DR-063 §2: each turn decides its own failures, so the slot never
+        // carries a previous turn's cause into this one.
+        lastFailureCause = undefined;
         let result: PlaybookRunResult | undefined;
         let operationError: unknown;
         // The boundary sentinel releases on every exit: a settlement defect
@@ -8313,7 +8806,8 @@ export function createXStatePlaybookRuntime<
                 deferredPending !== undefined &&
                 outcomeAuthority?.governedPlayerStates[
                   deferredPending.resumeStateId
-                ]?.needsBossReply?.repositoryDisposition === 'deferred';
+                ]?.needsBossReply?.repositoryDisposition === 'deferred' &&
+                !pendingHasExactUnchangedOrigin(deferredPending);
               deferredOperation =
                 !pendingRequiresDeferredBinding
                   ? undefined